moved 9.6-ESV-R9rc1

3546. [func] Add EUI48 and EUI64 types. [RT #33082 ]
(cherry picked from commit 3a6d62c59f)
2013-04-05 09:24:10 +11:00 · 2013-04-05 09:09:50 +11:00 · 2013-04-03 23:45:12 +00:00 · 2013-04-03 23:30:02 +00:00 · 2013-04-04 07:26:30 +11:00 · 2013-04-03 08:39:10 -07:00
372 changed files with 36046 additions and 36854 deletions
@@ -1,8 +1,277 @@
+	--- 9.6-ESV-R9rc1 released ---
+
+3546.	[func]		Add EUI48 and EUI64 types. [RT #33082]
+
+3543.	[bug]		Update socket stucture before attaching to socket
+			manager after accept. [RT #33084]
+
+3542.	[test]		masterformat system test was broken. [RT #33086]
+
+3541.	[bug]		Parts of libdns were not properly initialized when
+			built in libexport mode. [RT #33028]
+
+3540.	[test]		libt_api: t_info and t_assert were not thread safe.
+
+3539.	[port]		win32: timestamp format didn't match other platforms.
+
+3538.	[test]		Running "make test" now requires loopback interfaces
+			to be set up. [RT #32452]
+
+3535.	[bug]		Minor win32 cleanups. [RT #32962]
+
+3534.	[bug]		Extra text after an embedded NULL was ignored when
+			parsing zone files. [RT #32699]
+
+3533.	[contrib]	query-loc-0.4.0: memory leaks. [RT #32960]
+
+3532.	[contrib]	zkt: fixed buffer overrun, resource leaks. [RT #32960]
+
+3531.	[bug]		win32: A uninitialized value could be returned on out
+			of memory. [RT #32960]
+
+3530.	[contrib]	Better RTT tracking in queryperf. [RT #30128]
+
+3526.	[cleanup]	Set up dependencies for unit tests correctly during
+			build. [RT #32803]
+
+3520.	[bug]		'mctx' was not being referenced counted in some places
+			where it should have been.  [RT #32794]
+
+	--- 9.6-ESV-R9b2 released ---
+
+3517.	[bug]		Reorder destruction to avoid shutdown race. [RT #32777]
+
+3515.	[port]		'%T' is not portable in strftime(). [RT #32763]
+
+3509.	[cleanup]	Added a product line to version file to allow for
+			easy naming of different products (BIND
+			vs BIND ESV, for example). [RT #32755]
+
+3508.	[contrib]	queryperf was incorrectly rejecting the -T option.
+			[RT #32338]
+
+3503.	[doc]		Clarify size_spec syntax. [RT #32449]
+
+3499.	[doc]		Corrected ARM documentation of built-in zones.
+			[RT #32694]
+
+3498.	[bug]		zone statistics for zones which matched a potential
+			empty zone could have their zone-statistics setting
+			overridden.
+
+3489.	[bug]		--enable-developer now turns on ISC_LIST_CHECKINIT.
+			When cloning a rdataset do not copy the link contents.
+			[RT #32651]
+
+3487.	[bug]		Change 3444 was not complete.  There was a additional
+			place where the NOQNAME proof needed to be saved.
+			[RT #32629]
+
+3481.	[cleanup]	removed use of const const in atf
+
+3479.	[bug]		Address potential memory leaks in gssapi support
+			code. [RT #32405]
+
+3478.	[port]		Fix a build failure in strict C99 environments
+			[RT #32475]
+
+3474.	[bug]		nsupdate could assert when the local and remote
+			address families didn't match. [RT #22897]
+
+	--- 9.6-ESV-R9b1 released ---
+
+3465.	[bug]		Handle isolated reserved ports. [RT #31778]
+
+3462.	[doc]		Clarify server selection behavior of dig when using
+			-4 or -6 options. [RT #32181]
+
+3461.	[bug]		Negative responses could incorrectly have AD=1
+			set. [RT #32237]
+
+3458.	[bug]		Return FORMERR when presented with a overly long
+			domain named in a request. [RT #29682]
+
+3457.	[protocol]	Add ILNP records (NID, LP, L32, L64). [RT #31836]
+
+3456.	[port]		g++47: ATF failed to compile. [RT #32012]
+
+3455.	[contrib]	queryperf: fix getopt option list. [RT #32338]
+
+3454.	[port]		sparc64: improve atomic support. [RT #25182]
+
+3452.	[bug]		Accept duplicate singleton records. [RT #32329]
+
+3451.	[port]		Increase per thread stack size from 64K to 1M.
+			[RT #32230]
+
+3450.	[bug]		Stop logfileconfig system test spam system logs.
+			[RT #32315]
+
+3449.	[bug]		gen.c: use the pre-processor to construct format
+			strings so that compiler can perform sanity checks;
+			check the snprintf results. [RT #17576]
+
+3448.	[bug]		The allow-query-on ACL was not processed correctly.
+			[RT #29486]
+
+3447.	[port]		Add support for libxml2-2.9.x [RT #32231]
+
+3446.	[port]		win32: Add source ID (see change #3400) to build.
+			[RT #31683]
+
+3445.	[bug]		Warn about zone files with blank owner names
+			immediately after $ORIGIN directives. [RT #31848]
+
+3444.	[bug]		The NOQNAME proof was not being returned from cached
+			insecure responses. [RT #21409]
+
+3442.	[port]		Net::DNS 0.69 introduced a non backwards compatible
+			change. [RT #32216]
+
+3441.	[maint]		D.ROOT-SERVERS.NET is now 199.7.91.13.
+
+3440.	[bug]		Reorder get_key_struct to not trigger a assertion when
+			cleaning up due to out of memory error. [RT #32131]
+
+3439.	[bug]		contrib/dlz error checking fixes. [RT #32102]
+
+3438.	[bug]		Don't accept unknown data escape in quotes. [RT #32031]
+
+3437.	[bug]		isc_buffer_init -> isc_buffer_constinit to initialize
+			buffers with constant data. [RT #32064]
+
+3436.	[bug]		Check malloc/calloc return values. [RT #32088]
+
+3435.	[bug]		Cross compilation support in configure was broken.
+			[RT #32078]
+
+3430.	[bug]		win32: isc_time_formatISO8601 was missing the
+			'T' between the date and time. [RT #32044]
+
+3429.	[bug]		dns_zone_getserial2 could a return success without
+			returning a valid serial. [RT #32007]
+
+3428.	[cleanup]	dig: Add timezone to date output. [RT #2269]
+
+3427.	[bug]		dig +trace incorrectly displayed name server
+			addresses instead of names. [RT #31641]
+
+3425.	[bug]		"acacheentry" reference counting was broken resulting
+			in use after free. [RT #31908]
+
+3421.	[bug]		Named loops when re-signing if all keys are offline.
+			[RT #31916]
+
+3420.	[bug]		Address VPATH compilation issues. [RT #31879]
+
+3419.	[bug]		Memory leak on validation cancel. [RT #31869]
+
+3415.	[bug]		named could die with a REQUIRE failure if a valdation
+			was canceled. [RT #31804]
+
+3412.	[bug]		Copy timeval structure from control message data.
+			[RT #31548]
+
+3411.	[tuning]	Use IPV6_USE_MIN_MTU or equivalent with TCP in addition
+			to UDP. [RT #31690]
+
+3410.	[bug]		Addressed Coverity warnings. [RT #31626]
+
+3409.	[contrib]	contrib/dane/mkdane.sh: Tool to generate TLSA RR's
+			from X.509 certificates, for use with DANE
+			(DNS-based Authentication of Named Entities).
+			[RT #30513]
+
+3406.	[bug]		mem.c: Fix compilation errors when building with
+			ISC_MEM_TRACKLINES or ISC_MEMPOOL_NAMES disabled.
+			Also, ISC_MEM_DEBUG is no longer optional. [RT #31559]
+
+3405.	[bug]		Handle time going backwards in acache. [RT #31253]
+
+3404.	[bug]		dnssec-signzone: When re-signing a zone, remove
+			RRSIG and NSEC records from nodes that used to be
+			in-zone but are now below a zone cut. [RT #31556]
+
+3403.	[bug]		Silence noisy OpenSSL logging. [RT #31497]
+
+3402.	[test]		The IPv6 interface numbers used for system
+			tests were incorrect on some platforms. [RT #25085]
+
+3401.	[bug]		Addressed Coverity warnings. [RT #31484]
+
+3400.	[cleanup]	"named -V" can now report a source ID string, defined
+			in the "srcid" file in the build tree and normally set
+			to the most recent git hash.  [RT #31494]
+
+3397.	[bug]		dig crashed when using +nssearch with +tcp. [RT #25298]
+
+3396.	[bug]		OPT records were incorrectly removed from signed,
+			truncated responses. [RT #31439]
+
+3395.	[protocol]	Add RFC 6598 reverse zones to built in empty zones
+			list, 64.100.IN-ADDR.ARPA ... 127.100.IN-ADDR.ARPA.
+			[RT #31336]
+
+3394.	[bug]		Adjust 'successfully validated after lower casing
+			signer' log level and category. [RT #31414]
+
+3393.	[bug]		'host -C' could core dump if REFUSED was received.
+			[RT #31381]
+
+3391.	[bug]		A DNSKEY lookup that encountered a CNAME failed.
+			[RT #31262]
+
+3390.	[bug]		Silence clang compiler warnings. [RT #30417]
+
+3389.	[bug]		Always return NOERROR (not 0) in TSIG. [RT #31275]
+
+3388.	[bug]		Fixed several Coverity warnings.
+			Note: This change includes a fix for a bug that
+			was subsequently determined to be an exploitable
+			security vulnerability, CVE-2012-5688: named could
+			die on specific queries with dns64 enabled.
+			[RT #30996]
+
+3386.	[bug]		Address locking violation when generating new NSEC /
+			NSEC3 chains. [RT #31224]
+
+3382.	[bug]		SOA query from slave used use-v6-udp-ports range,
+			if set, regardless of the address family in use.
+			[RT #24173]
+
+3381.	[contrib]	Update queryperf to support more RR types.
+			[RT #30762]
+
+3380.	[bug]		named could die if a non-existant master list was
+			referenced in a also-notify. [RT #31004]
+
+3379.	[bug]		isc_interval_zero and isc_time_epoch should be
+			"const (type)* const". [RT #31069]
+
+3376.	[bug]		Lack of EDNS support was being recorded without a
+			successful response. [RT #30811]
+
+3375.	[func]		Check that 'rndc dumpdb' works on a empty cache.
+			[RT #30808]
+
+3374.	[bug]		isc_parse_uint32 failed to return a range error on
+			systems with 64 bit longs. [RT #30232]
+
+3372.	[bug]		Silence spurious "deleted from unreachable cache"
+			messages.  [RT #30501]
+
+3371.	[bug]		AD=1 should behave like DO=1 when deciding whether to
+			add NS RRsets to the additional section or not.
+			[RT #30479]
+
+2512.	[func]		Print a summary of the cached records which make up
+			the negative response.  [RT #18885]
+
 	--- 9.6-ESV-R8 released ---

 3383.	[security]	A certain combination of records in the RBT could
-                        cause named to hang while populating the additional
-                        section of a response. [RT #31090]
+			cause named to hang while populating the additional
+			section of a response. [RT #31090]

 3373.	[bug]		win32: open raw files in binary mode. [RT #30944]

@@ -85,7 +354,7 @@
 	--- 9.6-ESV-R7 released ---

 3318.	[tuning]	Reduce the amount of work performed while holding a
-			bucket lock when finshed with a fetch context.
+			bucket lock when finished with a fetch context.
 			[RT #29239]

 3314.	[bug]		The masters list could be updated while refesh_callback
@@ -98,7 +367,7 @@

 3310.	[test]		Increase table size for mutex profiling. [RT #28809]

-3309.	[bug]		resolver.c:fctx_finddone() was not threadsafe.
+3309.	[bug]		resolver.c:fctx_finddone() was not thread safe.
 			[RT #27995]

 3307.	[bug]		Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS.
@@ -163,7 +432,7 @@
 			despite succeeding over the loopback interface.
 			[RT #27782]

-3374.	[bug]		Log when a zone is not reusable.  Only set loadtime
+3274.	[bug]		Log when a zone is not reusable.  Only set loadtime
 			on successful loads.  [RT #27650]

 3268.	[bug]		Convert RRSIG expiry times to 64 timestamps to work
@@ -224,7 +493,7 @@

 3234.	[bug]		'make depend' produced invalid makefiles. [RT #26830]

-3231.	[bug]		named could fail to send a uncompressable zone.
+3231.	[bug]		named could fail to send a incompressible zone.
 			[RT #26796]

 3230.	[bug]		'dig axfr' failed to properly handle a multi-message
@@ -240,7 +509,7 @@

 	--- 9.6-ESV-R6b1 released ---

-3221.	[bug]		Fixed a potential coredump on shutdown due to
+3221.	[bug]		Fixed a potential core dump on shutdown due to
 			referencing fetch context after it's been freed.
 			[RT #26720]

@@ -256,7 +525,7 @@
 			list prior to adding a reference to it leading a
 			possible assertion failure. [RT #23219]

-3208.	[bug]		'dig -y' handle unknown tsig alorithm better.
+3208.	[bug]		'dig -y' handle unknown tsig algorithm better.
 			[RT #25522]

 3207.	[contrib]	Fixed build error in Berkeley DB DLZ module. [RT #26444]
@@ -453,7 +722,7 @@
 			glue learn for zone named is authoritative for.
 			[RT #22842]

-3071.	[bug]		has_nsec could be used unintialised in
+3071.	[bug]		has_nsec could be used uninitialized in
 			update.c:next_active. [RT #20256]

 3069.	[cleanup]	Silence warnings messages from clang static analysis.
@@ -483,7 +752,7 @@
 			max-cache-size, it was possible for cache memory
 			to be exhausted and not recovered. [RT #23371]

-3051.	[bug]		NS records obsure DNAME records at the bottom of the
+3051.	[bug]		NS records obscure DNAME records at the bottom of the
 			zone if both are present. [RT #23035]

 3046.	[bug]		Use RRSIG original TTL to compute validated RRset
@@ -792,7 +1061,7 @@
 2862.	[bug]		nsupdate didn't default to the parent zone when
 			updating DS records. [RT #20896]

-2859.	[bug]		When cancelling validation it was possible to leak
+2859.	[bug]		When canceling validation it was possible to leak
 			memory. [RT #20800]

 2858.	[bug]		RTT estimates were not being adjusted on ICMP errors.
@@ -854,7 +1123,7 @@
 			[RT #22062]

 2952.	[port]		win32: named-checkzone and named-checkconf failed
-			to initialise winsock. [RT #21932]
+			to initialize winsock. [RT #21932]

 2951.	[bug]		named failed to generate a correct signed response
 			in a optout, delegation only zone with no secure
@@ -1339,7 +1608,7 @@

 2553.	[bug]		Reference leak on DNSSEC validation errors. [RT #19291]

-2552.	[bug]		zero-no-soa-ttl-cache was not being honoured.
+2552.	[bug]		zero-no-soa-ttl-cache was not being honored.
 			[RT #19340]

 2551.	[bug]		Potential Reference leak on return. [RT #19341]
@@ -1,4 +1,4 @@
-Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.

 Permission to use, copy, modify, and/or distribute this software for any
@@ -1,3 +1,150 @@
+3514.   [bug]           The ranges for valid key sizes in ddns-confgen and
+                        rndc-confgen were too constrained. Keys up to 512
+                        bits are now allowed for most algorithms, and up
+                        to 1024 bits for hmac-sha384 and hmac-sha512.
+                        [RT #32753]
+
+3511.   [doc]           Improve documentation of redirect zones. [RT #32756]
+
+3507.   [bug]           Statistics channel XSL had a glitch when attempting
+                        to chart query data before any queries had been
+                        received. [RT #32620]
+
+3505.   [bug]           When setting "max-cache-size" and "max-acache-size",
+                        larger values than 4 gigabytes could not be set
+                        explicitly, though larger sizes were available
+                        when setting cache size to 0. This has been
+                        corrected; the full range is now available.
+                        [RT #32358]
+
+3500.   [port]          Support NAPTR regular expression validation on
+                        all platforms.  [RT #32688]
+
+3493.   [contrib]       Added BDBHPT dynamically-lodable DLZ module,
+                        contributed by Mark Goldfinch. [RT #32549]
+
+3492.   [bug]           Fixed a regression in zone loading performance
+                        due to lock contention. [RT #30399]
+
+3491.   [bug]           Slave zones using inline-signing must specify a
+                        file name. [RT #31946]
+
+3490.   [bug]           When logging RDATA during update, truncate if it's
+                        too long. [RT #32365]
+
+3489.   [bug]           --enable-developer now turns on ISC_LIST_CHECKINIT.
+                        When cloning a rdataset do not copy the link contents.
+                        [RT #32651]
+
+3488.	[bug]		Use after free error with DH generated keys. [RT #32649]
+
+3486.	[bug]		named could crash when using TKEY-negotiated keys
+			that had been deleted and then recreated. [RT #32506]
+
+3485.	[cleanup]	Only compile openssl_gostlink.c if we support GOST.
+
+3484.	[bug]		Some statistics were incorrectly rendered in XML.
+			[RT #32587]
+
+3480.   [bug]           Silence logging noise when setting up zone
+                        statistics. [RT #32525]
+
+3476.   [bug]           "rndc zonestatus" could report a spurious "not
+                        found" error on inline-signing zones. [RT #29226]
+
+3475.   [cleanup]       Changed name of 'map' zone file format (previously
+                        'fast'). [RT #32458]
+
+3473.   [bug]           dnssec-signzone/verify could incorrectly report
+                        an error condition due to an empty node above an
+                        opt-out delegation lacking an NSEC3. [RT #32072]
+
+3472.   [bug]           The active-connections counter in the socket
+                        statistics could underflow. [RT #31747]
+
+3471.   [bug]           The number of UDP dispatches now defaults to
+                        the number of CPUs even if -n has been set to
+                        a higher value. [RT #30964]
+
+3469.   [bug]           Handle DLZ lookup failures more gracefully. Improve
+                        backward compatibility between versions of DLZ dlopen
+                        API. [RT #32275]
+
+3468.   [security]      RPZ rules to generate A records (but not AAAA records)
+                        could trigger an assertion failure when used in
+                        conjunction with DNS64 (CVE-2012-5689). [RT #32141]
+
+3467.   [bug]           Added checks in dnssec-keygen and dnssec-settime
+                        to check for delete date < inactive date. [RT #31719]
+
+3466.   [contrib]       Corrected the DNS_CLIENTINFOMETHODS_VERSION check
+                        in DLZ example driver. [RT #32275]
+
+3464.	[maint]		Updates to PKCS#11 openssl patches, supporting
+			versions 0.9.8x, 1.0.0j, 1.0.1c [RT #29749]
+
+3463.	[doc]		Clarify managed-keys syntax in ARM. [RT 32232]
+
+3460.	[bug]		Only link against readline where needed. [RT #29810]
+
+3453.	[bug]		'rndc addzone' of a zone with 'inline-signing yes;'
+			failed. [RT #31960]
+
+3443.	[bug]		ddns-confgen: Some TSIG algorithms were incorrectly
+			rejected when generating keys. [RT #31927]
+
+3434.	[bug]		Pass client info to the DLZ findzone() entry
+			point in addition to lookup().  This makes it
+			possible for a database to answer differently
+			whether it's authoritative for a name depending
+			on the address of the client.  [RT #31775]
+
+3433.	[bug]		dlz_findzone() did not correctly handle
+			ISC_R_NOMORE. [RT #31172]
+
+3431.	[bug]		ddns-confgen: Some valid key algorithms were
+			not accepted. [RT #31927]
+
+3426.	[bug]		dnssec-checkds: Clearer output when records are not
+			found. [RT #31968]
+
+3423.	[bug]		"rndc signing -nsec3param" didn't accept the full
+			range of possible values.  Address portability issues.
+			[RT #31938]
+
+3422.	[bug]		Added a clear error message for when the SOA does not
+			match the referral. [RT #31281]
+
+3416.	[bug]		Named could die on shutdown if running with 128 UDP
+			dispatches per interface. [RT #31743]
+
+3414.	[bug]		Address locking issues found by Coverity. [RT #31626]
+
+3408.	[bug]		Some DNSSEC-related options (update-check-ksk,
+			dnssec-loadkeys-interval, dnssec-dnskey-kskonly)
+			are now legal in slave zones as long as
+			inline-signing is in use. [RT #31078]
+
+3399.	[port]		netbsd: rename 'bool' parameter to avoid namespace
+			clash.  [RT #31515]
+
+3398.	[bug]		SOA parameters were not being updated with inline
+			signed zones if the zone was modified while the
+			server was offline. [RT #29272]
+
+3385.	[bug]		named-checkconf didn't detect missing master lists
+			in also-notify clauses. [RT #30810]
+
+3384.	[bug]		Improved logging of crypto errors. [RT #30963]
+
+3378.	[bug]		Handle missing 'managed-keys-directory' better.
+			[RT #30625]
+
+3377.	[bug]		Removed spurious newline from NSEC3 multiline
+			output. [RT #31044]
+
+3375.	[bug]		'rndc dumpdb' failed on empty caches. [RT #30808]
+
 3370.	[bug]		Address use after free while shutting down. [RT #30241]

 3368.	[bug]		<dns/iptable.h>, <dns/private.h> and <dns/zone.h>
@@ -6,49 +153,57 @@
 3367.	[bug]		dns_dnsseckey_create() result was not being checked.
 			[RT #30685]

-3363.   [bug]           Need to allow "forward" and "fowarders" options
-                        in static-stub zones; this had been overlooked.
-                        [RT #30482]
- 
-3361.   [bug]           "rndc signing -nsec3param" didn't work correctly
-                        when salt was set to '-' (no salt). [RT #30099]
+3363.	[bug]		Need to allow "forward" and "fowarders" options
+			in static-stub zones; this had been overlooked.
+			[RT #30482]

-3355.   [port]          Use more portable awk in verify system test.
+3361.	[bug]		"rndc signing -nsec3param" didn't work correctly
+			when salt was set to '-' (no salt). [RT #30099]

-3353.   [bug]           Use a single task for task exclusive operations.
-                        [RT #29872]
+3356.	[bug]		Cap the TTL of signed RRsets when RRSIGs are
+			approaching their expiry, so they don't remain
+			in caches after expiry. [RT #26429]

-3351.   [bug]           isc_mem_put and isc_mem_putanddetach didn't report
-                        caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX
-                        memory debugging flags are set. [RT #30243]
+3355.	[port]		Use more portable awk in verify system test.

-3349.   [bug]           Change #3345 was incomplete. [RT #30233]
+3353.	[bug]		Use a single task for task exclusive operations.
+			[RT #29872]

-3347.   [bug]           dnssec-settime: Issue a warning when writing a new
-                        private key file would cause a change in the
-                        permissions of the existing file. [RT #27724]
+3351.	[bug]		isc_mem_put and isc_mem_putanddetach didn't report
+			caller if either ISC_MEM_DEBUGSIZE or ISC_MEM_DEBUGCTX
+			memory debugging flags are set. [RT #30243]

-3345.   [bug]           Addressed race condition when removing the last item
-                        or inserting the first item in an ISC_QUEUE.
-                        [RT #29539]
+3349.	[bug]		Change #3345 was incomplete. [RT #30233]

-3338.   [bug]           Address race condition in units tests: asyncload_zone
-                        and asyncload_zt. [RT #26100]
+3347.	[bug]		dnssec-settime: Issue a warning when writing a new
+			private key file would cause a change in the
+			permissions of the existing file. [RT #27724]

-3334.   [bug]           Hold a zone table reference while performing a
-                        asyncronous load of a zone. [RT #28326]
+3345.	[bug]		Addressed race condition when removing the last item
+			or inserting the first item in an ISC_QUEUE.
+			[RT #29539]

-3324.   [test]          Add better tests for ADB stats [RT #27057]
+3338.	[bug]		Address race condition in units tests: asyncload_zone
+			and asyncload_zt. [RT #26100]

-3317.   [protocol]      Add ECDSA support (RFC 6605). [RT #21918]
+3334.	[bug]		Hold a zone table reference while performing a
+			asyncronous load of a zone. [RT #28326]

-3316.   [tuning]        Improved locking performance when recursing.
-                        [RT #28836]
+3333.	[bug]		Setting resolver-query-timeout too low can cause
+			named to not recover if it loses connectivity.
+			[RT #29623]

-3315.   [tuning]        Use multiple dispatch objects for sending upstream
-                        queries; this can improve performance on busy
-                        multiprocessor systems by reducing lock contention.
-                        [RT #28605]
+3324.	[test]		Add better tests for ADB stats [RT #27057]
+
+3317.	[protocol]	Add ECDSA support (RFC 6605). [RT #21918]
+
+3316.	[tuning]	Improved locking performance when recursing.
+			[RT #28836]
+
+3315.	[tuning]	Use multiple dispatch objects for sending upstream
+			queries; this can improve performance on busy
+			multiprocessor systems by reducing lock contention.
+			[RT #28605]

 3312.	[bug]		named-checkconf didn't detect a bad dns64 clients acl.
 			[RT #27631]
@@ -153,6 +308,9 @@
 3233.	[bug]		'rndc freeze/thaw' didn't work for inline zones.
 			[RT #26632]

+3229.	[bug]		Fix local variable to struct var assignment
+			found by CLANG warning.
+
 3225.	[bug]		Silence spurious "setsockopt(517, IPV6_V6ONLY) failed"
 			messages. [RT #26507]

@@ -189,6 +347,10 @@
 3195.	[cleanup]	Silence "file not found" warnings when loading
 			managed-keys zone. [RT #26340]

+3188.	[bug]		zone.c:zone_refreshkeys() could fail to detach
+			references correctly when errors occurred, causing
+			a hang on shutdown. [RT #26372]
+
 3186.	[bug]		Version/db mis-match in rpz code. [RT #26180]

 3184.	[bug]		named had excessive cpu usage when a redirect zone was
@@ -208,8 +370,8 @@
 			sample external DLZ module in contrib/dlz/example.
 			[RT #26215]

-3174.   [bug]           Always compute to revoked key tag from scratch.
-                        [RT #26186]
+3174.	[bug]		Always compute to revoked key tag from scratch.
+			[RT #26186]

 3172.	[port]		darwin 10.* and freebsd [89] are now built threaded by
 			default.
@@ -231,6 +393,9 @@
 			concurrency problems with large numbers of threads.
 			[RT #26044]

+3161.	[bug]		zone.c:del_sigs failed to always reset rdata leading
+			assertion failures. [RT #25880]
+
 3160.	[bug]		When printing out a NSEC3 record in multiline form
 			the newline was not being printed causing type codes
 			to be run together. [RT #25873]
@@ -254,6 +419,8 @@
 3141.	[bug]		Silence spurious "zone serial (0) unchanged" messages
 			associated with empty zones. [RT #25079]

+3133.	[bug]		Change #3114 was incomplete. [RT #24577]
+
 3131.	[tuning]	Improve scalability by allocating one zone task
 			per 100 zones at startup time, rather than using a
 			fixed-size task table. [RT #24406]
@@ -275,6 +442,10 @@

 3122.	[cleanup]	dnssec-settime: corrected usage message. [RT #24664]

+3119.   [bug]           When rolling to a new DNSSEC key, a private-type
+                        record could be created and never marked complete.
+                        [RT #23253]
+
 3117.	[cleanup]	Remove doc and parser references to the
 			never-implemented 'auto-dnssec create' option.
 			[RT #24533]
@@ -283,10 +454,20 @@
 			following a CNAME that points into the same zone.
 			[RT #24455]

+3114.   [bug]           Retain expired RRSIGs in dynamic zones if key is
+                        inactive and there is no replacement key. [RT #23136]
+
+3111.   [bug]           Improved consistency checks for dnssec-enable and
+                        dnssec-validation, added test cases to the
+                        checkconf system test. [RT #24398]
+
 3108.	[cleanup]	dnssec-signzone: Clarified some error and
 			warning messages; removed #ifdef ALLOW_KSKLESS_ZONES
 			code (use -P instead). [RT #20852]

+3107.	[bug]		dnssec-signzone: Report the correct number of ZSKs
+			when using -x. [RT #20852]
+
 3105.	[bug]		GOST support can be suppressed by "configure
 			--without-gost" [RT #24367]

@@ -294,8 +475,8 @@
 			instead of in the options statement could trigger
 			an assertion failure in named-checkconf. [RT #24382]

-3101.   [bug]           Zones using automatic key maintenance could fail
-                        to check the key repository for updates. [RT #23744]
+3101.	[bug]		Zones using automatic key maintenance could fail
+			to check the key repository for updates. [RT #23744]

 3100.	[security]	Certain response policy zone configurations could
 			trigger an INSIST when receiving a query of type
@@ -311,6 +492,9 @@

 3093.	[bug]		Fix gssapi/kerberos dependencies [RT #23836]

+3092.   [bug]           Signatures for records at the zone apex could go
+                        stale due to an incorrect timer setting. [RT #23769]
+
 3091.	[bug]		Fixed a bug in which zone keys that were published
 			and then subsequently activated could fail to trigger
 			automatic signing. [RT #22911]
@@ -338,6 +522,9 @@
 3072.	[bug]		dns_dns64_aaaaok() potential NULL pointer dereference.
 			[RT #20256]

+3070.   [bug]           dnssec-signzone potential NULL pointer dereference.
+                        [RT #20256]
+
 3057.	[bug]		"rndc secroots" would abort after the first error
 			and so could miss some views. [RT #23488]

@@ -350,8 +537,15 @@
 			Wait for the initial autosigning to complete
 			before running the rest of the test. [RT #23035]

+3049.   [bug]           Save and restore the gid when creating creating
+                        named.pid at startup. [RT #23290]
+
 3048.	[bug]		Fully separate view key mangement. [RT #23419]

+3047.   [bug]           DNSKEY NODATA responses not cached fixed in
+                        validator.c. Tests added to dnssec system test.
+                        [RT #22908]
+
 3045.	[removed]	Replaced by change #3050.

 3038.	[bug]		Install <dns/rpz.h>.  [RT #23342]
@@ -422,6 +616,11 @@
 2977.	[bug]		'nsupdate -l' report if the session key is missing.
 			[RT #21670]

+2974.   [bug]           Some valid UPDATE requests could fail due to a
+                        consistency check examining the existing version
+                        of the zone rather than the new version resulting
+                        from the UPDATE. [RT #22413]
+
 2973.	[bug]		bind.keys.h was being removed by the "make clean"
 			at the end of configure resulting in build failures
 			where there is very old version of perl installed.
@@ -433,6 +632,9 @@
 2961.	[bug]		Be still more selective about the non-authoritative
 			answers we apply change 2748 to. [RT #22074]

+2958.   [bug]           named failed to start with a missing master file.
+                        [RT #22076]
+
 2949.	[bug]		dns_view_setnewzones() contained a memory leak if
 			it was called multiple times. [RT #21942]

@@ -554,11 +756,14 @@
 2832.	[bug]		Modify "struct stat" in lib/export/samples/nsprobe.c
 			to avoid redefinition in some OSs [RT 20831]

-2829.   [bug]           Fixed potential node inconsistency in rbtdb.c.
-                        [RT #20808]
+2830.   [bug]           Changing the OPTOUT setting could take multiple
+                        passes. [RT #20813]

-2826.   [bug]           NSEC3->NSEC transitions could fail due to a lock not
-                        being released.  [RT #20740]
+2829.	[bug]		Fixed potential node inconsistency in rbtdb.c.
+			[RT #20808]
+
+2826.	[bug]		NSEC3->NSEC transitions could fail due to a lock not
+			being released.  [RT #20740]

 2824.	[bug]		"rndc sign" was not being run by the correct task.
 			[RT #20759]
@@ -572,8 +777,8 @@
 2816.	[bug]		previous_closest_nsec() could fail to return
 			data for NSEC3 nodes [RT #29730]

-2813.   [bug]           Better handling of unreadable DNSSEC key files.
-                        [RT #20710]
+2813.	[bug]		Better handling of unreadable DNSSEC key files.
+			[RT #20710]

 2812.	[bug]		Make sure updates can't result in a zone with
 			NSEC-only keys and NSEC3 records. [RT #20748]
@@ -1,6 +1,6 @@
 Frequently Asked Questions about BIND 9

-Copyright © 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright © 2004-2010, 2013 Internet Systems Consortium, Inc. ("ISC")

 Copyright © 2000-2003 Internet Software Consortium.

@@ -869,7 +869,7 @@ A: If you run Tiger(Mac OS 10.4) or later then this is all you need to do:
   Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.:

   key "rndc-key" {
-           algorithm hmac-md5;
+           algorithm hmac-sha256;
           secret "uvceheVuqf17ZwIcTydddw==";
   };

@@ -1,7 +1,7 @@
 <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
       "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []>
 <!--
- - Copyright (C) 2004-2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -31,6 +31,7 @@
      <year>2009</year>
      <year>2010</year>
      <year>2012</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1565,7 +1566,7 @@ rand_irqs="3 14 15"</programlisting>
 	<informalexample>
 	  <programlisting>
 key "rndc-key" {
-	algorithm hmac-md5;
+	algorithm hmac-sha256;
 	secret "uvceheVuqf17ZwIcTydddw==";
 };</programlisting>
 	</informalexample>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -60,9 +60,21 @@ tags:
 	rm -f TAGS
 	find lib bin -name "*.[ch]" -print | @ETAGS@ -

-check: test
+test check:
+	@if test -n "`${PERL} ${top_srcdir}/bin/tests/system/testsock.pl 2>&- || echo fail`"; then \
+	echo I: NOTE: The tests were not run because they require that; \
+	echo I:	the IP addresses 10.53.0.1 through 10.53.0.8 are configured; \
+	echo I:	as alias addresses on the loopback interface.  Please run; \
+	echo I:	\'bin/tests/system/ifconfig.sh up\' as root to configure; \
+	echo I:	them, then rerun the tests. Run make force-test to run the; \
+	echo I:	tests anyway.; \
+	exit 1; \
+	fi
+	${MAKE} test-force

-test:
+force-test: test-force
+
+test-force:
 	status=0; \
 	(cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
 	(test -f unit/unittest.sh && $(SHELL) unit/unittest.sh) || status=1; \
@@ -48,6 +48,11 @@ BIND 9
        For up-to-date release notes and errata, see
        http://www.isc.org/software/bind9/releasenotes

+BIND 9.6-ESV-R9 (Extended Support Version)
+
+	BIND 9.6-ESV-R9 is a maintenance release, fixing bugs in BIND
+	9.6-ESV-R8.
+
 BIND 9.6-ESV-R8 (Extended Support Version)

        BIND 9.6-ESV-R8 includes several bug fixes and patches security
@@ -1,2 +1,5 @@
-sinclude(./libtool.m4)dnl
-
+sinclude(libtool.m4/libtool.m4)dnl
+sinclude(libtool.m4/ltoptions.m4)dnl
+sinclude(libtool.m4/ltsugar.m4)dnl
+sinclude(libtool.m4/ltversion.m4)dnl
+sinclude(libtool.m4/lt~obsolete.m4)dnl
@@ -196,6 +196,10 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 		a->type == dns_rdatatype_a);
 	REQUIRE(aaaa == NULL || !dns_rdataset_isassociated(aaaa) ||
 		aaaa->type == dns_rdatatype_aaaa);
+
+	if (a == NULL || aaaa == NULL)
+		return (answer);
+
 	memset(&hints, 0, sizeof(hints));
 	hints.ai_flags = AI_CANONNAME;
 	hints.ai_family = PF_UNSPEC;
@@ -258,8 +262,7 @@ checkns(dns_zone_t *zone, dns_name_t *name, dns_name_t *owner,
 		}
 		return (ISC_TRUE);
 	}
-	if (a == NULL || aaaa == NULL)
-		return (answer);
+
 	/*
 	 * Check that all glue records really exist.
 	 */
@@ -597,7 +600,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,

 	dns_zone_settype(zone, dns_zone_master);

-	isc_buffer_init(&buffer, zonename, strlen(zonename));
+	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
 	dns_fixedname_init(&fixorigin);
 	origin = dns_fixedname_name(&fixorigin);
@@ -439,6 +439,7 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
+			/* FALLTHROUGH */
 		case 'h':
 			usage();

@@ -354,6 +354,7 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					prog_name, isc_commandline_option);
+			/* FALLTHROUGH */
 		case 'h':
 			usage();

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -57,7 +57,9 @@ allows multiple lookups to be issued from the command line.
 Unless it is told to query a specific name server,
 \fBdig\fR
 will try each of the servers listed in
-\fI/etc/resolv.conf\fR.
+\fI/etc/resolv.conf\fR. If no usable server addreses are found,
+\fBdig\fR
+will send the query to the local host.
 .PP
 When no command line arguments or options are given,
 \fBdig\fR
@@ -95,13 +97,20 @@ is the name or IP address of the name server to query. This can be an IPv4 addre
 \fIserver\fR
 argument is a hostname,
 \fBdig\fR
-resolves that name before querying that name server. If no
+resolves that name before querying that name server.
+.sp
+If no
 \fIserver\fR
 argument is provided,
 \fBdig\fR
 consults
-\fI/etc/resolv.conf\fR
-and queries the name servers listed there. The reply from the name server that responds is displayed.
+\fI/etc/resolv.conf\fR; if an address is found there, it queries the name server at that address. If either of the
+\fB\-4\fR
+or
+\fB\-6\fR
+options are in use, then only addresses for the corresponding transport will be tried. If no usable addresses are found,
+\fBdig\fR
+will send the query to the local host. The reply from the name server that responds is displayed.
 .RE
 .PP
 \fBname\fR
@@ -562,7 +571,7 @@ RFC1035.
 .PP
 There are probably too many query options.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -238,6 +238,8 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	isc_uint64_t diff;
 	isc_time_t now;
 	time_t tnow;
+	struct tm tmnow;
+	char time_str[100];
 	char fromtext[ISC_SOCKADDR_FORMATSIZE];

 	isc_sockaddr_format(from, fromtext, sizeof(fromtext));
@@ -249,7 +251,10 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		printf(";; Query time: %ld msec\n", (long int)diff/1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-		printf(";; WHEN: %s", ctime(&tnow));
+		tmnow  = *localtime(&tnow);
+		if (strftime(time_str, sizeof(time_str),
+			     "%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
+			printf(";; WHEN: %s\n", time_str);
 		if (query->lookup->doing_xfr) {
 			printf(";; XFR size: %u records (messages %u, "
 			       "bytes %" ISC_PRINT_QUADFORMAT "u)\n",
@@ -257,7 +262,6 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			       query->byte_count);
 		} else {
 			printf(";; MSG SIZE  rcvd: %u\n", bytes);
-
 		}
 		if (key != NULL) {
 			if (!validated)
@@ -274,7 +278,7 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		       "from %s(%s) in %d ms\n\n",
 		       query->lookup->doing_xfr ?
 				query->byte_count : (isc_uint64_t)bytes,
-		       fromtext, query->servname,
+		       fromtext, query->userarg,
 		       (int)diff/1000);
 	}
 }
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -45,6 +45,7 @@
      <year>2008</year>
      <year>2009</year>
      <year>2012</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -116,9 +117,10 @@

    <para>
      Unless it is told to query a specific name server,
-      <command>dig</command> will try each of the servers listed
-      in
-      <filename>/etc/resolv.conf</filename>.
+      <command>dig</command> will try each of the servers listed in
+      <filename>/etc/resolv.conf</filename>. If no usable server addreses
+      are found, <command>dig</command> will send the query to the local
+      host.
    </para>

    <para>
@@ -157,20 +159,25 @@
          <term><constant>server</constant></term>
          <listitem>
            <para>
-              is the name or IP address of the name server to query.  This can
-              be an IPv4
-              address in dotted-decimal notation or an IPv6
+              is the name or IP address of the name server to query.  This
+              can be an IPv4 address in dotted-decimal notation or an IPv6
              address in colon-delimited notation.  When the supplied
-              <parameter>server</parameter> argument is a
-              hostname,
-              <command>dig</command> resolves that name before
-              querying that name
-              server.  If no <parameter>server</parameter>
-              argument is provided,
-              <command>dig</command> consults <filename>/etc/resolv.conf</filename>
-              and queries the name servers listed there.  The reply from the
-              name
-              server that responds is displayed.
+              <parameter>server</parameter> argument is a hostname,
+              <command>dig</command> resolves that name before querying
+              that name server.
+            </para>
+            <para>
+              If no <parameter>server</parameter> argument is
+              provided, <command>dig</command> consults
+              <filename>/etc/resolv.conf</filename>; if an
+              address is found there, it queries the name server at
+              that address. If either of the <option>-4</option> or
+              <option>-6</option> options are in use, then
+              only addresses for the corresponding transport
+              will be tried.  If no usable addresses are found,
+              <command>dig</command> will send the query to the
+              local host.  The reply from the name server that
+              responds is displayed.
            </para>
          </listitem>
        </varlistentry>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -34,7 +34,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543522"></a><h2>DESCRIPTION</h2>
+<a name="id2543525"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
      (domain information groper) is a flexible tool
      for interrogating DNS name servers.  It performs DNS lookups and
@@ -57,9 +57,10 @@
    </p>
 <p>
      Unless it is told to query a specific name server,
-      <span><strong class="command">dig</strong></span> will try each of the servers listed
-      in
-      <code class="filename">/etc/resolv.conf</code>.
+      <span><strong class="command">dig</strong></span> will try each of the servers listed in
+      <code class="filename">/etc/resolv.conf</code>. If no usable server addreses
+      are found, <span><strong class="command">dig</strong></span> will send the query to the local
+      host.
    </p>
 <p>
      When no command line arguments or options are given,
@@ -80,7 +81,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543595"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543604"></a><h2>SIMPLE USAGE</h2>
 <p>
      A typical invocation of <span><strong class="command">dig</strong></span> looks like:
      </p>
@@ -91,22 +92,29 @@
      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">server</code></span></dt>
-<dd><p>
-              is the name or IP address of the name server to query.  This can
-              be an IPv4
-              address in dotted-decimal notation or an IPv6
+<dd>
+<p>
+              is the name or IP address of the name server to query.  This
+              can be an IPv4 address in dotted-decimal notation or an IPv6
              address in colon-delimited notation.  When the supplied
-              <em class="parameter"><code>server</code></em> argument is a
-              hostname,
-              <span><strong class="command">dig</strong></span> resolves that name before
-              querying that name
-              server.  If no <em class="parameter"><code>server</code></em>
-              argument is provided,
-              <span><strong class="command">dig</strong></span> consults <code class="filename">/etc/resolv.conf</code>
-              and queries the name servers listed there.  The reply from the
-              name
-              server that responds is displayed.
-            </p></dd>
+              <em class="parameter"><code>server</code></em> argument is a hostname,
+              <span><strong class="command">dig</strong></span> resolves that name before querying
+              that name server.
+            </p>
+<p>
+              If no <em class="parameter"><code>server</code></em> argument is
+              provided, <span><strong class="command">dig</strong></span> consults
+              <code class="filename">/etc/resolv.conf</code>; if an
+              address is found there, it queries the name server at
+              that address. If either of the <code class="option">-4</code> or
+              <code class="option">-6</code> options are in use, then
+              only addresses for the corresponding transport
+              will be tried.  If no usable addresses are found,
+              <span><strong class="command">dig</strong></span> will send the query to the
+              local host.  The reply from the name server that
+              responds is displayed.
+            </p>
+</dd>
 <dt><span class="term"><code class="constant">name</code></span></dt>
 <dd><p>
              is the name of the resource record that is to be looked up.
@@ -126,7 +134,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543686"></a><h2>OPTIONS</h2>
+<a name="id2543707"></a><h2>OPTIONS</h2>
 <p>
      The <code class="option">-b</code> option sets the source IP address of the query
      to <em class="parameter"><code>address</code></em>.  This must be a valid
@@ -230,7 +238,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544035"></a><h2>QUERY OPTIONS</h2>
+<a name="id2544056"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
      provides a number of query options which affect
      the way in which lookups are made and the results displayed.  Some of
@@ -555,7 +563,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545170"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545191"></a><h2>MULTIPLE QUERIES</h2>
 <p>
      The BIND 9 implementation of <span><strong class="command">dig </strong></span>
      supports
@@ -601,7 +609,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545232"></a><h2>IDN SUPPORT</h2>
+<a name="id2545253"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
@@ -615,14 +623,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545322"></a><h2>FILES</h2>
+<a name="id2545344"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 <p><code class="filename">${HOME}/.digrc</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545339"></a><h2>SEE ALSO</h2>
+<a name="id2545361"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -630,7 +638,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545377"></a><h2>BUGS</h2>
+<a name="id2545398"></a><h2>BUGS</h2>
 <p>
      There are probably too many query options.
    </p>
@@ -767,6 +767,7 @@ make_empty_lookup(void) {
 	looknew->need_search = ISC_FALSE;
 	ISC_LINK_INIT(looknew, link);
 	ISC_LIST_INIT(looknew->q);
+	ISC_LIST_INIT(looknew->connecting);
 	ISC_LIST_INIT(looknew->my_server_list);
 	return (looknew);
 }
@@ -788,11 +789,11 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {

 	looknew = make_empty_lookup();
 	INSIST(looknew != NULL);
-	strncpy(looknew->textname, lookold->textname, MXNAME);
+	strlcpy(looknew->textname, lookold->textname, MXNAME);
 #if DIG_SIGCHASE_TD
-	strncpy(looknew->textnamesigchase, lookold->textnamesigchase, MXNAME);
+	strlcpy(looknew->textnamesigchase, lookold->textnamesigchase, MXNAME);
 #endif
-	strncpy(looknew->cmdline, lookold->cmdline, MXNAME);
+	strlcpy(looknew->cmdline, lookold->cmdline, MXNAME);
 	looknew->textname[MXNAME-1] = 0;
 	looknew->rdtype = lookold->rdtype;
 	looknew->qrdtype = lookold->qrdtype;
@@ -986,7 +987,7 @@ make_searchlist_entry(char *domain) {
 	if (search == NULL)
 		fatal("memory allocation failure in %s:%d",
 		      __FILE__, __LINE__);
-	strncpy(search->origin, domain, MXNAME);
+	strlcpy(search->origin, domain, MXNAME);
 	search->origin[MXNAME-1] = 0;
 	ISC_LINK_INIT(search, link);
 	return (search);
@@ -1282,7 +1283,10 @@ clear_query(dig_query_t *query) {
 	if (lookup->current_query == query)
 		lookup->current_query = NULL;

-	ISC_LIST_UNLINK(lookup->q, query, link);
+	if (ISC_LINK_LINKED(query, link))
+		ISC_LIST_UNLINK(lookup->q, query, link);
+	if (ISC_LINK_LINKED(query, clink))
+		ISC_LIST_UNLINK(lookup->connecting, query, clink);
 	if (ISC_LINK_LINKED(&query->recvbuf, link))
 		ISC_LIST_DEQUEUE(query->recvlist, &query->recvbuf,
 				 link);
@@ -1290,6 +1294,7 @@ clear_query(dig_query_t *query) {
 		ISC_LIST_DEQUEUE(query->lengthlist, &query->lengthbuf,
 				 link);
 	INSIST(query->recvspace != NULL);
+
 	if (query->sock != NULL) {
 		isc_socket_detach(&query->sock);
 		sockcount--;
@@ -1317,13 +1322,22 @@ try_clear_lookup(dig_lookup_t *lookup) {

 	debug("try_clear_lookup(%p)", lookup);

-	if (ISC_LIST_HEAD(lookup->q) != NULL) {
+	if (ISC_LIST_HEAD(lookup->q) != NULL ||
+	    ISC_LIST_HEAD(lookup->connecting) != NULL)
+	{
 		if (debugging) {
 			q = ISC_LIST_HEAD(lookup->q);
 			while (q != NULL) {
 				debug("query to %s still pending", q->servname);
 				q = ISC_LIST_NEXT(q, link);
 			}
+
+			q = ISC_LIST_HEAD(lookup->connecting);
+			while (q != NULL) {
+				debug("query to %s still connecting",
+				      q->servname);
+				q = ISC_LIST_NEXT(q, clink);
+			}
 		}
 		return (ISC_FALSE);
 	}
@@ -1451,7 +1465,7 @@ start_lookup(void) {
 				= current_lookup->rdclassset;
 			current_lookup->rdclass = dns_rdataclass_in;

-			strncpy(current_lookup->textnamesigchase,
+			strlcpy(current_lookup->textnamesigchase,
 				current_lookup->textname, MXNAME);

 			current_lookup->trace_root_sigchase = ISC_TRUE;
@@ -1463,7 +1477,7 @@ start_lookup(void) {
 			check_result(result, "dns_name_totext");
 			isc_buffer_usedregion(b, &r);
 			r.base[r.length] = '\0';
-			strncpy(current_lookup->textname, (char*)r.base,
+			strlcpy(current_lookup->textname, (char*)r.base,
 				MXNAME);
 			isc_buffer_free(&b);

@@ -2104,7 +2118,6 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->rr_count = 0;
 		query->msg_count = 0;
 		query->byte_count = 0;
-		ISC_LINK_INIT(query, link);
 		ISC_LIST_INIT(query->recvlist);
 		ISC_LIST_INIT(query->lengthlist);
 		query->sock = NULL;
@@ -2117,6 +2130,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		isc_buffer_init(&query->slbuf, query->slspace, 2);
 		query->sendbuf = lookup->renderbuf;

+		ISC_LINK_INIT(query, clink);
 		ISC_LINK_INIT(query, link);
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}
@@ -2159,7 +2173,7 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 	query->waiting_senddone = ISC_FALSE;
 	l = query->lookup;

-	if (l->ns_search_only && !l->trace_root) {
+	if (l->ns_search_only && !l->trace_root && !l->tcp_mode) {
 		debug("sending next, since searching");
 		next = ISC_LIST_NEXT(query, link);
 		if (next != NULL)
@@ -2238,6 +2252,7 @@ static void
 force_timeout(dig_lookup_t *l, dig_query_t *query) {
 	isc_event_t *event;

+	debug("force_timeout ()");
 	event = isc_event_allocate(mctx, query, ISC_TIMEREVENT_IDLE,
 				   connect_timeout, l,
 				   sizeof(isc_event_t));
@@ -2305,6 +2320,7 @@ send_tcp_connect(dig_query_t *query) {
 		send_tcp_connect(next);
 		return;
 	}
+
 	INSIST(query->sock == NULL);
 	result = isc_socket_create(socketmgr,
 				   isc_sockaddr_pf(&query->sockaddr),
@@ -2335,6 +2351,9 @@ send_tcp_connect(dig_query_t *query) {
 	if (l->ns_search_only && !l->trace_root) {
 		debug("sending next, since searching");
 		next = ISC_LIST_NEXT(query, link);
+		if (ISC_LINK_LINKED(query, link))
+			ISC_LIST_DEQUEUE(l->q, query, link);
+		ISC_LIST_ENQUEUE(l->connecting, query, clink);
 		if (next != NULL)
 			send_tcp_connect(next);
 	}
@@ -2415,7 +2434,7 @@ send_udp(dig_query_t *query) {
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *query = NULL, *cq;
+	dig_query_t *query = NULL, *next, *cq;

 	UNUSED(task);
 	REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
@@ -2439,7 +2458,9 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			if (query->sock != NULL)
 				isc_socket_cancel(query->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
-			send_tcp_connect(ISC_LIST_NEXT(cq, link));
+			next = ISC_LIST_NEXT(cq, link);
+			if (next != NULL)
+				send_tcp_connect(next);
 		}
 		UNLOCK_LOOKUP;
 		return;
@@ -2682,9 +2703,8 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		if (next != NULL) {
 			bringup_timer(next, TCP_TIMEOUT);
 			send_tcp_connect(next);
-		} else {
+		} else
 			check_next_lookup(l);
-		}
 		UNLOCK_LOOKUP;
 		return;
 	}
@@ -3241,6 +3261,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 				if (n == 0)
 					docancel = ISC_TRUE;
 				l->trace_root = ISC_FALSE;
+				usesearch = ISC_FALSE;
 			} else
 #ifdef DIG_SIGCHASE
 				if (!do_sigchase)
@@ -3417,15 +3438,19 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 */
 void
 do_lookup(dig_lookup_t *lookup) {
+	dig_query_t *query;

 	REQUIRE(lookup != NULL);

 	debug("do_lookup()");
 	lookup->pending = ISC_TRUE;
-	if (lookup->tcp_mode)
-		send_tcp_connect(ISC_LIST_HEAD(lookup->q));
-	else
-		send_udp(ISC_LIST_HEAD(lookup->q));
+	query = ISC_LIST_HEAD(lookup->q);
+	if (query != NULL) {
+		if (lookup->tcp_mode)
+			send_tcp_connect(query);
+		else
+			send_udp(query);
+	}
 }

 /*%
@@ -3895,7 +3920,7 @@ sigchase_scanname(dns_rdatatype_t type, dns_rdatatype_t covers,
 	check_result(result, "dns_name_totext");
 	isc_buffer_usedregion(b, &r);
 	r.base[r.length] = '\0';
-	strcpy(lookup->textname, (char*)r.base);
+	strlcpy(lookup->textname, (char*)r.base, sizeof(lookup->textname));
 	isc_buffer_free(&b);

 	if (type ==  dns_rdatatype_rrsig)
@@ -4020,7 +4045,7 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
 			return (ISC_R_NOMEMORY);

 		memset(tempnamekey, 0, tempnamekeylen);
-		strncpy(tempnamekey, tempname, tempnamelen);
+		strlcpy(tempnamekey, tempname, tempnamelen);
 		strcat(tempnamekey ,".key");


@@ -4154,7 +4179,7 @@ prepare_lookup(dns_name_t *name)
 	lookup->new_search = ISC_TRUE;
 	lookup->trace_root_sigchase = ISC_FALSE;

-	strncpy(lookup->textname, lookup->textnamesigchase, MXNAME);
+	strlcpy(lookup->textname, lookup->textnamesigchase, MXNAME);

 	lookup->rdtype = lookup->rdtype_sigchase;
 	lookup->rdtypeset = ISC_TRUE;
@@ -4213,7 +4238,7 @@ prepare_lookup(dns_name_t *name)
 				dns_rdata_totext(&aaaa, &ns.name, b);
 				isc_buffer_usedregion(b, &r);
 				r.base[r.length] = '\0';
-				strncpy(namestr, (char*)r.base,
+				strlcpy(namestr, (char*)r.base,
 					DNS_NAME_FORMATSIZE);
 				isc_buffer_free(&b);
 				dns_rdata_reset(&aaaa);
@@ -4242,7 +4267,7 @@ prepare_lookup(dns_name_t *name)
 				dns_rdata_totext(&a, &ns.name, b);
 				isc_buffer_usedregion(b, &r);
 				r.base[r.length] = '\0';
-				strncpy(namestr, (char*)r.base,
+				strlcpy(namestr, (char*)r.base,
 					DNS_NAME_FORMATSIZE);
 				isc_buffer_free(&b);
 				dns_rdata_reset(&a);
@@ -4421,7 +4446,6 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 {
 	isc_result_t result;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dst_key_t *trustedKey = NULL;
 	dst_key_t *dnsseckey = NULL;
 	int i;

@@ -4465,10 +4489,6 @@ contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
 			dst_key_free(&dnsseckey);
 	} while (dns_rdataset_next(rdataset) == ISC_R_SUCCESS);

-	if (trustedKey != NULL)
-		dst_key_free(&trustedKey);
-	trustedKey = NULL;
-
 	return (ISC_R_NOTFOUND);
 }

@@ -446,10 +446,18 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	if (msg->rcode != 0) {
 		char namestr[DNS_NAME_FORMATSIZE];
 		dns_name_format(query->lookup->name, namestr, sizeof(namestr));
-		printf("Host %s not found: %d(%s)\n",
-		       (msg->rcode != dns_rcode_nxdomain) ? namestr :
-		       query->lookup->textname, msg->rcode,
-		       rcode_totext(msg->rcode));
+
+		if (query->lookup->identify_previous_line)
+			printf("Nameserver %s:\n\t%s not found: %d(%s)\n",
+			       query->servname,
+			       (msg->rcode != dns_rcode_nxdomain) ? namestr :
+			       query->lookup->textname, msg->rcode,
+			       rcode_totext(msg->rcode));
+		else
+			printf("Host %s not found: %d(%s)\n",
+			       (msg->rcode != dns_rcode_nxdomain) ? namestr :
+			       query->lookup->textname, msg->rcode,
+			       rcode_totext(msg->rcode));
 		return (ISC_R_SUCCESS);
 	}

@@ -168,6 +168,7 @@ isc_boolean_t	sigchase;
 	dns_name_t *oname;
 	ISC_LINK(dig_lookup_t) link;
 	ISC_LIST(dig_query_t) q;
+	ISC_LIST(dig_query_t) connecting;
 	dig_query_t *current_query;
 	dig_serverlist_t my_server_list;
 	dig_searchlist_t *origin;
@@ -214,6 +215,7 @@ struct dig_query {
 		slspace[4];
 	isc_socket_t *sock;
 	ISC_LINK(dig_query_t) link;
+	ISC_LINK(dig_query_t) clink;
 	isc_sockaddr_t sockaddr;
 	isc_time_t time_sent;
 	isc_uint64_t byte_count;
@@ -641,6 +641,8 @@ hashlist_add(hashlist_t *l, const unsigned char *hash, size_t len)
 	if (l->entries == l->size) {
 		l->size = l->size * 2 + 100;
 		l->hashbuf = realloc(l->hashbuf, l->size * l->length);
+		if (l->hashbuf == NULL)
+			fatal("unable to grow hashlist: out of memory");
 	}
 	memset(l->hashbuf + l->entries * l->length, 0, l->length);
 	memcpy(l->hashbuf + l->entries * l->length, hash, len);
@@ -1980,6 +1982,39 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which) {
 	dns_rdatasetiter_destroy(&rdsiter);
 }

+/*
+ * Remove signatures covering the given type (0 == all signatures).
+ */
+static void
+remove_sigs(dns_dbnode_t *node, dns_rdatatype_t which) {
+	isc_result_t result;
+	dns_rdatatype_t type, covers;
+	dns_rdatasetiter_t *rdsiter = NULL;
+	dns_rdataset_t rdataset;
+
+	dns_rdataset_init(&rdataset);
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+	check_result(result, "dns_db_allrdatasets()");
+	for (result = dns_rdatasetiter_first(rdsiter);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdatasetiter_next(rdsiter)) {
+		dns_rdatasetiter_current(rdsiter, &rdataset);
+		type = rdataset.type;
+		covers = rdataset.covers;
+		dns_rdataset_disassociate(&rdataset);
+
+		if (type == dns_rdatatype_rrsig &&
+		    (covers == which || which == 0))
+		{
+			result = dns_db_deleterdataset(gdb, node, gversion,
+						       type, covers);
+			check_result(result, "dns_db_deleterdataset()");
+			continue;
+		}
+	}
+	dns_rdatasetiter_destroy(&rdsiter);
+}
+
 /*%
 * Generate NSEC records for the zone and remove NSEC3/NSEC3PARAM records.
 */
@@ -2061,9 +2096,11 @@ nsecify(void) {
 		if (delegation(name, node, &nsttl)) {
 			zonecut = dns_fixedname_name(&fzonecut);
 			dns_name_copy(name, zonecut, NULL);
+			remove_sigs(node, 0);
 			if (generateds)
 				add_ds(name, node, nsttl);
 		}
+
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2081,6 +2118,8 @@ nsecify(void) {
 			    (zonecut != NULL &&
 			     dns_name_issubdomain(nextname, zonecut)))
 			{
+				remove_sigs(nextnode, 0);
+				remove_records(nextnode, dns_rdatatype_nsec);
 				dns_db_detachnode(gdb, &nextnode);
 				result = dns_dbiterator_next(dbiter);
 				continue;
@@ -2397,6 +2436,7 @@ nsec3ify(unsigned int hashalg, unsigned int iterations,
 			if (!dns_name_issubdomain(nextname, gorigin) ||
 			    (zonecut != NULL &&
 			     dns_name_issubdomain(nextname, zonecut))) {
+				remove_sigs(nextnode, 0);
 				dns_db_detachnode(gdb, &nextnode);
 				result = dns_dbiterator_next(dbiter);
 				continue;
@@ -2404,6 +2444,7 @@ nsec3ify(unsigned int hashalg, unsigned int iterations,
 			if (delegation(nextname, nextnode, &nsttl)) {
 				zonecut = dns_fixedname_name(&fzonecut);
 				dns_name_copy(nextname, zonecut, NULL);
+				remove_sigs(nextnode, 0);
 				if (generateds)
 					add_ds(nextname, nextnode, nsttl);
 				if (OPTOUT(nsec3flags) &&
@@ -2740,8 +2781,8 @@ warnifallksk(dns_db_t *db) {
 				"Supply non-KSK dnskey or use '-z'.\n",
 				program);
 		else
-			fatal("No non-KSK dnskey found. "
-			      "Supply non-KSK dnskey or use '-z'.");
+			fatal("No non-KSK DNSKEY found; "
+			      "supply a ZSK or use '-z'.");
 	}
 }

@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2008, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -21,6 +21,10 @@ top_srcdir =	@top_srcdir@

@BIND9_VERSION@

+@BIND9_PRODUCT@
+
+@BIND9_SRCID@
+
@BIND9_CONFIGARGS@

@BIND9_MAKE_INCLUDES@
@@ -107,6 +111,8 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
 main.@O@: main.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-DVERSION=\"${VERSION}\" \
+		-DPRODUCT=\"${PRODUCT}\" \
+		-DSRCID=\"${SRCID}\" \
 		-DCONFIGARGS="\"${CONFIGARGS}\"" \
 		-DNS_LOCALSTATEDIR=\"${localstatedir}\" \
 		-DNS_SYSCONFDIR=\"${sysconfdir}\" -c ${srcdir}/main.c
@@ -114,6 +120,7 @@ main.@O@: main.c
 config.@O@: config.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-DVERSION=\"${VERSION}\" \
+		-DSRCID=\"${SRCID}\" \
 		-DNS_LOCALSTATEDIR=\"${localstatedir}\" \
 		-c ${srcdir}/config.c

@@ -1377,10 +1377,9 @@ client_request(isc_task_t *task, isc_event_t *event) {

 	INSIST(client->recursionquota == NULL);

-	INSIST(client->state ==
-	       TCP_CLIENT(client) ?
-	       NS_CLIENTSTATE_READING :
-	       NS_CLIENTSTATE_READY);
+	INSIST(client->state == (TCP_CLIENT(client) ?
+				       NS_CLIENTSTATE_READING :
+				       NS_CLIENTSTATE_READY));

 	ns_client_requests++;

@@ -2390,6 +2389,9 @@ ns_client_replace(ns_client_t *client) {

 	CTRACE("replace");

+	REQUIRE(client != NULL);
+	REQUIRE(client->manager != NULL);
+
 	result = ns_clientmgr_createclients(client->manager,
 					    1, client->interface,
 					    (TCP_CLIENT(client) ?
@@ -601,17 +601,16 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		if (isc_sockaddr_getport(&addrs[i]) == 0)
 			isc_sockaddr_setport(&addrs[i], port);
 		keys[i] = NULL;
-		if (!cfg_obj_isstring(key)) {
-			i++;
+		i++;	/* Increment here so that cleanup on error works. */
+		if (!cfg_obj_isstring(key))
 			continue;
-		}
-		keys[i] = isc_mem_get(mctx, sizeof(dns_name_t));
-		if (keys[i] == NULL)
+		keys[i - 1] = isc_mem_get(mctx, sizeof(dns_name_t));
+		if (keys[i - 1] == NULL)
 			goto cleanup;
-		dns_name_init(keys[i], NULL);
+		dns_name_init(keys[i - 1], NULL);

 		keystr = cfg_obj_asstring(key);
-		isc_buffer_init(&b, keystr, strlen(keystr));
+		isc_buffer_constinit(&b, keystr, strlen(keystr));
 		isc_buffer_add(&b, strlen(keystr));
 		dns_fixedname_init(&fname);
 		result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
@@ -619,10 +618,9 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 		result = dns_name_dup(dns_fixedname_name(&fname), mctx,
-				      keys[i]);
+				      keys[i - 1]);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		i++;
 	}
 	if (pushed != 0) {
 		pushed--;
@@ -678,7 +676,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	if (addrs != NULL)
 		isc_mem_put(mctx, addrs, addrcount * sizeof(isc_sockaddr_t));
 	if (keys != NULL) {
-		for (j = 0; j <= i; j++) {
+		for (j = 0; j < i; j++) {
 			if (keys[j] == NULL)
 				continue;
 			if (dns_name_dynamic(keys[j]))
@@ -61,7 +61,7 @@ command_compare(const char *text, const char *command) {
 isc_result_t
 ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 	isccc_sexpr_t *data;
-	char *command;
+	char *command = NULL;
 	isc_result_t result;
 	int log_level;
 #ifdef HAVE_LIBSCF
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -149,7 +149,7 @@ free_listener(controllistener_t *listener) {
 	if (listener->acl != NULL)
 		dns_acl_detach(&listener->acl);

-	isc_mem_put(listener->mctx, listener, sizeof(*listener));
+	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }

 static void
@@ -1066,8 +1066,9 @@ add_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		result = ISC_R_NOMEMORY;

 	if (result == ISC_R_SUCCESS) {
+		listener->mctx = NULL;
+		isc_mem_attach(mctx, &listener->mctx);
 		listener->controls = cp;
-		listener->mctx = mctx;
 		listener->task = cp->server->task;
 		listener->address = *addr;
 		listener->sock = NULL;
@@ -0,0 +1 @@
+!named
@@ -161,12 +161,13 @@ struct ns_client {
 #define NS_CLIENT_MAGIC			ISC_MAGIC('N','S','C','c')
 #define NS_CLIENT_VALID(c)		ISC_MAGIC_VALID(c, NS_CLIENT_MAGIC)

-#define NS_CLIENTATTR_TCP		0x01
-#define NS_CLIENTATTR_RA		0x02 /*%< Client gets recursive service */
-#define NS_CLIENTATTR_PKTINFO		0x04 /*%< pktinfo is valid */
-#define NS_CLIENTATTR_MULTICAST		0x08 /*%< recv'd from multicast */
-#define NS_CLIENTATTR_WANTDNSSEC	0x10 /*%< include dnssec records */
-#define NS_CLIENTATTR_WANTNSID          0x20 /*%< include nameserver ID */
+#define NS_CLIENTATTR_TCP		0x001
+#define NS_CLIENTATTR_RA		0x002 /*%< Client gets recursive service */
+#define NS_CLIENTATTR_PKTINFO		0x004 /*%< pktinfo is valid */
+#define NS_CLIENTATTR_MULTICAST		0x008 /*%< recv'd from multicast */
+#define NS_CLIENTATTR_WANTDNSSEC	0x010 /*%< include dnssec records */
+#define NS_CLIENTATTR_WANTNSID          0x020 /*%< include nameserver ID */
+#define NS_CLIENTATTR_WANTAD		0x100 /*%< want AD in response if possible */

 extern unsigned int ns_client_requests;

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -63,6 +63,8 @@ EXTERN isc_timermgr_t *		ns_g_timermgr		INIT(NULL);
 EXTERN isc_socketmgr_t *	ns_g_socketmgr		INIT(NULL);
 EXTERN cfg_parser_t *		ns_g_parser		INIT(NULL);
 EXTERN const char *		ns_g_version		INIT(VERSION);
+EXTERN const char *		ns_g_product		INIT(PRODUCT);
+EXTERN const char *		ns_g_srcid		INIT(SRCID);
 EXTERN const char *		ns_g_configargs		INIT(CONFIGARGS);
 EXTERN in_port_t		ns_g_port		INIT(0);
 EXTERN in_port_t		lwresd_g_listenport	INIT(0);
@@ -111,6 +113,7 @@ EXTERN isc_boolean_t		ns_g_coreok		INIT(ISC_TRUE);
 EXTERN const char *		ns_g_chrootdir		INIT(NULL);
 EXTERN isc_boolean_t		ns_g_foreground		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_logstderr		INIT(ISC_FALSE);
+EXTERN isc_boolean_t		ns_g_nosyslog		INIT(ISC_FALSE);

 #if NS_RUN_PID_DIR
 EXTERN const char *		ns_g_defaultpidfile 	INIT(NS_LOCALSTATEDIR
@@ -134,6 +137,7 @@ EXTERN isc_boolean_t		ns_g_memstatistics	INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_clienttest		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_nosoa		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_noaa		INIT(ISC_FALSE);
+EXTERN isc_boolean_t		ns_g_nonearest		INIT(ISC_FALSE);

 #undef EXTERN
 #undef INIT
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -79,11 +79,13 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	if (mgr == NULL)
 		return (ISC_R_NOMEMORY);

+	mgr->mctx = NULL;
+	isc_mem_attach(mctx, &mgr->mctx);
+
 	result = isc_mutex_init(&mgr->lock);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_mem;

-	mgr->mctx = mctx;
 	mgr->taskmgr = taskmgr;
 	mgr->socketmgr = socketmgr;
 	mgr->dispatchmgr = dispatchmgr;
@@ -115,7 +117,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	ns_listenlist_detach(&mgr->listenon4);
 	ns_listenlist_detach(&mgr->listenon6);
 cleanup_mem:
-	isc_mem_put(mctx, mgr, sizeof(*mgr));
+	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 	return (result);
 }

@@ -128,7 +130,7 @@ ns_interfacemgr_destroy(ns_interfacemgr_t *mgr) {
 	clearlistenon(mgr);
 	DESTROYLOCK(&mgr->lock);
 	mgr->magic = 0;
-	isc_mem_put(mgr->mctx, mgr, sizeof(*mgr));
+	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 }

 dns_aclenv_t *
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -201,7 +201,7 @@ isc_result_t
 ns_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result;

-	if (! ns_g_logstderr) {
+	if (! ns_g_logstderr && ! ns_g_nosyslog) {
 		result = isc_log_usechannel(lcfg, "default_syslog",
 					    ISC_LOGCATEGORY_DEFAULT, NULL);
 		if (result != ISC_R_SUCCESS)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -246,14 +246,16 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
 					isc_result_totext(result));
 			} else
 				(void)isc_stdio_close(fp);
-		} else {
-			syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
-				dest.file.name, isc_result_totext(result));
-			fprintf(stderr, "isc_file_isplainfile '%s' failed: %s",
-				dest.file.name, isc_result_totext(result));
+			goto done;
 		}
+		if (!ns_g_nosyslog)
+			syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
+			       dest.file.name, isc_result_totext(result));
+		fprintf(stderr, "isc_file_isplainfile '%s' failed: %s",
+			dest.file.name, isc_result_totext(result));
 	}

+ done:
 	return (result);
 }

@@ -368,7 +368,7 @@ ns_lwdmanager_create(isc_mem_t *mctx, const cfg_obj_t *lwres,

 			dns_fixedname_init(&fname);
 			name = dns_fixedname_name(&fname);
-			isc_buffer_init(&namebuf, searchstr,
+			isc_buffer_constinit(&namebuf, searchstr,
 					strlen(searchstr));
 			isc_buffer_add(&namebuf, strlen(searchstr));
 			result = dns_name_fromtext(name, &namebuf,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -462,6 +462,10 @@ parse_command_line(int argc, char *argv[]) {
 				ns_g_nosoa = ISC_TRUE;
 			else if (!strcmp(isc_commandline_argument, "noaa"))
 				ns_g_noaa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nosyslog"))
+				ns_g_nosyslog = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nonearest"))
+				ns_g_nonearest = ISC_TRUE;
 			else
 				fprintf(stderr, "unknown -T flag '%s\n",
 					isc_commandline_argument);
@@ -470,11 +474,11 @@ parse_command_line(int argc, char *argv[]) {
 			ns_g_username = isc_commandline_argument;
 			break;
 		case 'v':
-			printf("BIND %s\n", ns_g_version);
+			printf("%s %s\n", ns_g_product, ns_g_version);
 			exit(0);
 		case 'V':
-			printf("BIND %s built with %s\n", ns_g_version,
-				ns_g_configargs);
+			printf("%s %s <id:%s> built with %s\n", ns_g_product,
+			       ns_g_version, ns_g_srcid, ns_g_configargs);
 			exit(0);
 		case '?':
 			usage();
@@ -685,8 +689,8 @@ setup(void) {
 				   isc_result_totext(result));

 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "starting BIND %s%s", ns_g_version,
-		      saved_command_line);
+		      ISC_LOG_NOTICE, "starting %s %s%s", ns_g_product,
+		      ns_g_version, saved_command_line);

 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "built with %s", ns_g_configargs);
@@ -909,9 +913,9 @@ main(int argc, char *argv[]) {
 	 */
 	strlcat(version,
 #if defined(NO_VERSION_DATE) || !defined(__DATE__)
-		"named version: BIND " VERSION,
+		"named version: BIND " VERSION " <" SRCID ">",
 #else
-		"named version: BIND " VERSION " (" __DATE__ ")",
+		"named version: BIND " VERSION " <" SRCID "> (" __DATE__ ")",
 #endif
 		sizeof(version));
 	result = isc_file_progname(*argv, program_name, sizeof(program_name));
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -83,6 +83,10 @@
 /*% Want DNSSEC? */
 #define WANTDNSSEC(c)		(((c)->attributes & \
 				  NS_CLIENTATTR_WANTDNSSEC) != 0)
+/*% Want WANTAD? */
+#define WANTAD(c)		(((c)->attributes & \
+				  NS_CLIENTATTR_WANTAD) != 0)
+
 /*% No authority? */
 #define NOAUTHORITY(c)		(((c)->query.attributes & \
 				  NS_QUERYATTR_NOAUTHORITY) != 0)
@@ -608,7 +612,7 @@ query_validatezonedb(ns_client_t *client, dns_name_t *name,
 {
 	isc_result_t result;
 	isc_boolean_t check_acl, new_zone;
-	dns_acl_t *queryacl;
+	dns_acl_t *queryacl, *queryonacl;
 	ns_dbversion_t *dbversion;

 	REQUIRE(zone != NULL);
@@ -645,6 +649,7 @@ query_validatezonedb(ns_client_t *client, dns_name_t *name,
 		result = DNS_R_SERVFAIL;
 		goto fail;
 	}
+
 	if (new_zone) {
 		check_acl = ISC_TRUE;
 	} else if (!dbversion->queryok) {
@@ -723,6 +728,24 @@ query_validatezonedb(ns_client_t *client, dns_name_t *name,
 			client->query.attributes |= NS_QUERYATTR_QUERYOKVALID;
 		}

+		/*
+		 * If and only if we've gotten this far, check
+		 * allow-query-on too
+		 */
+		if (result == ISC_R_SUCCESS) {
+			queryonacl = dns_zone_getqueryonacl(zone);
+			if (queryonacl == NULL)
+				queryonacl = client->view->queryonacl;
+
+			result = ns_client_checkaclsilent(client, NULL,
+							  queryonacl, ISC_TRUE);
+			if ((options & DNS_GETDB_NOLOG) == 0 &&
+			    result != ISC_R_SUCCESS)
+				ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+					      NS_LOGMODULE_QUERY, ISC_LOG_INFO,
+					      "query-on denied");
+		}
+
 		if (result != ISC_R_SUCCESS)
 			goto refuse;
 	}
@@ -2638,6 +2661,14 @@ query_addbestns(ns_client_t *client) {
 	    SECURE(client) && WANTDNSSEC(client))
 		goto cleanup;

+	/*
+	 * If the answer is secure only add NS records if they are secure		 * when the client may be looking for AD in the response.
+	 */
+	if (SECURE(client) && (WANTDNSSEC(client) || WANTAD(client)) &&
+	    ((rdataset->trust != dns_trust_secure) ||
+	    (sigrdataset != NULL && sigrdataset->trust != dns_trust_secure)))
+		goto cleanup;
+
 	/*
 	 * If the client doesn't want DNSSEC we can discard the sigrdataset
 	 * now.
@@ -4282,7 +4313,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 */
 				if (found &&
 				    dns_rdataset_isassociated(rdataset) &&
-				    !dns_name_equal(qname, found))
+				    !dns_name_equal(qname, found) &&
+				    !(ns_g_nonearest &&
+				      qtype != dns_rdatatype_ds))
 				{
 					unsigned int count;
 					unsigned int skip;
@@ -5019,7 +5052,6 @@ ns_query_start(ns_client_t *client) {
 	dns_rdatatype_t qtype;
 	unsigned int saved_extflags = client->extflags;
 	unsigned int saved_flags = client->message->flags;
-	isc_boolean_t want_ad;

 	CTRACE("ns_query_start");

@@ -5181,13 +5213,11 @@ ns_query_start(ns_client_t *client) {
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;

 	/*
-	 * Set 'want_ad' if the client has set AD in the query.
+	 * Set NS_CLIENTATTR_WANTDNSSEC if the client has set AD in the query.
 	 * This allows AD to be returned on queries without DO set.
 	 */
 	if ((message->flags & DNS_MESSAGEFLAG_AD) != 0)
-		want_ad = ISC_TRUE;
-	else
-		want_ad = ISC_FALSE;
+		client->attributes |= NS_CLIENTATTR_WANTAD;

 	/*
 	 * This is an ordinary query.
@@ -5212,7 +5242,7 @@ ns_query_start(ns_client_t *client) {
 	 * Set AD.  We must clear it if we add non-validated data to a
 	 * response.
 	 */
-	if (WANTDNSSEC(client) || want_ad)
+	if (WANTDNSSEC(client) || WANTAD(client))
 		message->flags |= DNS_MESSAGEFLAG_AD;

 	qclient = NULL;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -203,6 +203,72 @@ static const struct {
 	{ "31.172.IN-ADDR.ARPA", ISC_TRUE },
 	{ "168.192.IN-ADDR.ARPA", ISC_TRUE },

+	/* RFC 6598 */
+	{ "64.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "65.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "66.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "67.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "68.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "69.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "70.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "71.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "72.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "73.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "74.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "75.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "76.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "77.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "78.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "79.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "80.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "81.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "82.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "83.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "84.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "85.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "86.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "87.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "88.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "89.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "90.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "91.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "92.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "93.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "94.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "95.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "96.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "97.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "98.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "99.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "100.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "101.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "102.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "103.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "104.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "105.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "106.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "107.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "108.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "109.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "110.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "111.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "112.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "113.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "114.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "115.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "116.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "117.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "118.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "119.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "120.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "121.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "122.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "123.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "124.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "125.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "126.100.IN-ADDR.ARPA", ISC_FALSE },
+	{ "127.100.IN-ADDR.ARPA", ISC_FALSE },
+
 	/* RFC 5735 and RFC 5737 */
 	{ "0.IN-ADDR.ARPA", ISC_FALSE },	/* THIS NETWORK */
 	{ "127.IN-ADDR.ARPA", ISC_FALSE },	/* LOOPBACK */
@@ -414,7 +480,7 @@ configure_view_dnsseckey(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 				   keystruct.common.rdtype,
 				   &keystruct, &rrdatabuf));
 	dns_fixedname_init(&fkeyname);
-	isc_buffer_init(&namebuf, keynamestr, strlen(keynamestr));
+	isc_buffer_constinit(&namebuf, keynamestr, strlen(keynamestr));
 	isc_buffer_add(&namebuf, strlen(keynamestr));
 	CHECK(dns_name_fromtext(keyname, &namebuf,
 				dns_rootname, ISC_FALSE,
@@ -519,7 +585,7 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
 	{
 		obj = cfg_listelt_value(element);
 		str = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
-		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		CHECK(dns_name_fromtext(name, &b, dns_rootname,
 					ISC_FALSE, NULL));
@@ -673,7 +739,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	else
 		str = "*";
 	addroot = ISC_TF(strcmp(str, "*") == 0);
-	isc_buffer_init(&b, str, strlen(str));
+	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
 	dns_fixedname_init(&fixed);
 	result = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
@@ -859,7 +925,7 @@ disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
 	str = cfg_obj_asstring(cfg_tuple_get(disabled, "name"));
-	isc_buffer_init(&b, str, strlen(str));
+	isc_buffer_constinit(&b, str, strlen(str));
 	isc_buffer_add(&b, strlen(str));
 	CHECK(dns_name_fromtext(name, &b, dns_rootname, ISC_FALSE, NULL));

@@ -911,7 +977,7 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
 	{
 		value = cfg_listelt_value(element);
 		str = cfg_obj_asstring(value);
-		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(name, &b, dns_rootname,
 					   ISC_TRUE, NULL);
@@ -1773,7 +1839,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 #endif
 			str = cfg_obj_asstring(cfg_tuple_get(obj,
 							     "trust-anchor"));
-			isc_buffer_init(&b, str, strlen(str));
+			isc_buffer_constinit(&b, str, strlen(str));
 			isc_buffer_add(&b, strlen(str));
 			dlv = dns_fixedname_name(&view->dlv_fixed);
 			CHECK(dns_name_fromtext(dlv, &b, dns_rootname,
@@ -1826,7 +1892,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			     element = cfg_list_next(element)) {
 				exclude = cfg_listelt_value(element);
 				str = cfg_obj_asstring(exclude);
-				isc_buffer_init(&b, str, strlen(str));
+				isc_buffer_constinit(&b, str, strlen(str));
 				isc_buffer_add(&b, strlen(str));
 				CHECK(dns_name_fromtext(name, &b, dns_rootname,
 							ISC_FALSE, NULL));
@@ -1880,7 +1946,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 		result = ns_config_get(maps, "empty-server", &obj);
 		if (result == ISC_R_SUCCESS) {
 			str = cfg_obj_asstring(obj);
-			isc_buffer_init(&buffer, str, strlen(str));
+			isc_buffer_constinit(&buffer, str, strlen(str));
 			isc_buffer_add(&buffer, strlen(str));
 			CHECK(dns_name_fromtext(name, &buffer, dns_rootname,
 						ISC_FALSE, NULL));
@@ -1895,7 +1961,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 		result = ns_config_get(maps, "empty-contact", &obj);
 		if (result == ISC_R_SUCCESS) {
 			str = cfg_obj_asstring(obj);
-			isc_buffer_init(&buffer, str, strlen(str));
+			isc_buffer_constinit(&buffer, str, strlen(str));
 			isc_buffer_add(&buffer, strlen(str));
 			CHECK(dns_name_fromtext(name, &buffer, dns_rootname,
 						ISC_FALSE, NULL));
@@ -1919,7 +1985,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			dns_forwarders_t *forwarders = NULL;
 			dns_view_t *pview = NULL;

-			isc_buffer_init(&buffer, empty, strlen(empty));
+			isc_buffer_constinit(&buffer, empty, strlen(empty));
 			isc_buffer_add(&buffer, strlen(empty));
 			/*
 			 * Look for zone on drop list.
@@ -1935,7 +2001,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			 */
 			(void)dns_view_findzone(view, name, &zone);
 			if (zone != NULL) {
-				CHECK(setquerystats(zone, mctx, zonestats_on));
 				dns_zone_detach(&zone);
 				continue;
 			}
@@ -2113,7 +2178,7 @@ configure_alternates(const cfg_obj_t *config, dns_view_t *view,
 			isc_buffer_t buffer;
 			in_port_t myport = port;

-			isc_buffer_init(&buffer, str, strlen(str));
+			isc_buffer_constinit(&buffer, str, strlen(str));
 			isc_buffer_add(&buffer, strlen(str));
 			dns_fixedname_init(&fixed);
 			name = dns_fixedname_name(&fixed);
@@ -2375,7 +2440,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 * Get the zone origin as a dns_name_t.
 	 */
 	zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
-	isc_buffer_init(&buffer, zname, strlen(zname));
+	isc_buffer_constinit(&buffer, zname, strlen(zname));
 	isc_buffer_add(&buffer, strlen(zname));
 	dns_fixedname_init(&fixorigin);
 	CHECK(dns_name_fromtext(dns_fixedname_name(&fixorigin),
@@ -4442,7 +4507,7 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep) {
 		viewtxt = next_token(&input, " \t");
 	}

-	isc_buffer_init(&buf, zonetxt, strlen(zonetxt));
+	isc_buffer_constinit(&buf, zonetxt, strlen(zonetxt));
 	isc_buffer_add(&buf, strlen(zonetxt));
 	dns_fixedname_init(&name);
 	result = dns_name_fromtext(dns_fixedname_name(&name),
@@ -5204,7 +5269,7 @@ ns_server_flushname(ns_server_t *server, char *args) {
 	if (target == NULL)
 		return (ISC_R_UNEXPECTEDEND);

-	isc_buffer_init(&b, target, strlen(target));
+	isc_buffer_constinit(&b, target, strlen(target));
 	isc_buffer_add(&b, strlen(target));
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
@@ -876,11 +876,11 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	TRY0(xmlTextWriterEndElement(writer)); /* views */

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "socketmgr"));
-	isc_socketmgr_renderxml(ns_g_socketmgr, writer);
+	TRY0(isc_socketmgr_renderxml(ns_g_socketmgr, writer));
 	TRY0(xmlTextWriterEndElement(writer)); /* socketmgr */

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "taskmgr"));
-	isc_taskmgr_renderxml(ns_g_taskmgr, writer);
+	TRY0(isc_taskmgr_renderxml(ns_g_taskmgr, writer));
 	TRY0(xmlTextWriterEndElement(writer)); /* taskmgr */

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "server"));
@@ -943,7 +943,7 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	TRY0(xmlTextWriterEndElement(writer)); /* server */

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory"));
-	isc_mem_renderxml(writer);
+	TRY0(isc_mem_renderxml(writer));
 	TRY0(xmlTextWriterEndElement(writer)); /* memory */

 	TRY0(xmlTextWriterEndElement(writer)); /* statistics */
@@ -73,7 +73,7 @@ ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	if (result == ISC_R_SUCCESS) {
 		s = cfg_obj_asstring(cfg_tuple_get(obj, "name"));
 		n = cfg_obj_asuint32(cfg_tuple_get(obj, "keyid"));
-		isc_buffer_init(&b, s, strlen(s));
+		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		dns_fixedname_init(&fname);
 		name = dns_fixedname_name(&fname);
@@ -88,7 +88,7 @@ ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	result = cfg_map_get(options, "tkey-domain", &obj);
 	if (result == ISC_R_SUCCESS) {
 		s = cfg_obj_asstring(obj);
-		isc_buffer_init(&b, s, strlen(s));
+		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		dns_fixedname_init(&fname);
 		name = dns_fixedname_name(&fname);
@@ -108,7 +108,7 @@ ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	if (result == ISC_R_SUCCESS) {
 		s = cfg_obj_asstring(obj);

-		isc_buffer_init(&b, s, strlen(s));
+		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		dns_fixedname_init(&fname);
 		name = dns_fixedname_name(&fname);
@@ -78,7 +78,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 		 * Create the key name.
 		 */
 		dns_name_init(&keyname, NULL);
-		isc_buffer_init(&keynamesrc, keyid, strlen(keyid));
+		isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid));
 		isc_buffer_add(&keynamesrc, strlen(keyid));
 		isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
 		ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
@@ -3336,7 +3336,8 @@ add_signing_records(dns_db_t *db, dns_name_t *name, dns_dbversion_t *ver,
 		ISC_LIST_UNLINK(temp_diff.tuples, tuple, link);
 		ISC_LIST_APPEND(diff->tuples, tuple, link);

-		dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
+		result = dns_rdata_tostruct(&tuple->rdata, &dnskey, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		if ((dnskey.flags &
 		     (DNS_KEYFLAG_OWNERMASK|DNS_KEYTYPE_NOAUTH))
 			 != DNS_KEYOWNER_ZONE)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -50,6 +50,7 @@
 typedef enum {
 	allow_notify,
 	allow_query,
+	allow_query_on,
 	allow_transfer,
 	allow_update,
 	allow_update_forwarding
@@ -96,6 +97,11 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 			aclp = &view->queryacl;
 		aclname = "allow-query";
 		break;
+	    case allow_query_on:
+		if (view != NULL)
+			aclp = &view->queryonacl;
+		aclname = "allow-query-on";
+		break;
 	    case allow_transfer:
 		if (view != NULL)
 			aclp = &view->transferacl;
@@ -242,7 +248,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {

 		dns_fixedname_init(&fident);
 		str = cfg_obj_asstring(identity);
-		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
 					   dns_rootname, ISC_FALSE, NULL);
@@ -254,7 +260,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {

 		dns_fixedname_init(&fname);
 		str = cfg_obj_asstring(dname);
-		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
 					   dns_rootname, ISC_FALSE, NULL);
@@ -536,6 +542,11 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				  dns_zone_setqueryacl,
 				  dns_zone_clearqueryacl));

+	RETERR(configure_zone_acl(zconfig, vconfig, config,
+				  allow_query_on, ac, zone,
+				  dns_zone_setqueryonacl,
+				  dns_zone_clearqueryonacl));
+
 	obj = NULL;
 	result = ns_config_get(maps, "dialup", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -755,6 +755,7 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 				usage(1);
 			}
+			/* FALLTHROUGH */
 		case 'h':
 			usage(0);
 			break;
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2008, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2008, 2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -131,6 +131,10 @@ XSRCS =		adb_test.c \
 		wire_test.c \
 		zone_test.c

+# override all rule to make sure top directory targets are built before
+# processing subdirectories.
+all: ${TARGETS} subdirs testdirs
+
@BIND9_MAKE_RULES@

 all_tests: ${XTARGETS}
@@ -245,7 +245,7 @@ lookup(const char *target) {
 	INSIST(target != NULL);

 	client = new_client();
-	isc_buffer_init(&t, target, strlen(target));
+	isc_buffer_constinit(&t, target, strlen(target));
 	isc_buffer_add(&t, strlen(target));
 	isc_buffer_init(&namebuf, namedata, sizeof(namedata));
 	dns_name_init(&name, NULL);
@@ -58,7 +58,7 @@ t_create(const char *db_type, const char *origin, const char *class,

 	dns_fixedname_init(&dns_origin);
 	len = strlen(origin);
-	isc_buffer_init(&origin_buffer, origin, len);
+	isc_buffer_constinit(&origin_buffer, origin, len);
 	isc_buffer_add(&origin_buffer, len);
 	dns_result = dns_name_fromtext(dns_fixedname_name(&dns_origin),
 				       &origin_buffer, NULL, ISC_FALSE, NULL);
@@ -263,7 +263,7 @@ load(const char *filename, const char *origintext, isc_boolean_t cache) {
 	ISC_LINK_INIT(dbi, link);

 	len = strlen(origintext);
-	isc_buffer_init(&source, origintext, len);
+	isc_buffer_constinit(&source, origintext, len);
 	isc_buffer_add(&source, len);
 	dns_fixedname_init(&forigin);
 	origin = dns_fixedname_name(&forigin);
@@ -374,6 +374,7 @@ main(int argc, char *argv[]) {
 	dns_trust_t trust = 0;
 	unsigned int addopts;
 	isc_log_t *lctx = NULL;
+	size_t n;

 	dns_result_register();

@@ -395,7 +396,13 @@ main(int argc, char *argv[]) {
 				       isc_result_totext(result));
 			break;
 		case 'd':
-			strcpy(dbtype, isc_commandline_argument);
+			n = strlcpy(dbtype, isc_commandline_argument,
+				    sizeof(dbtype));
+			if (n >= sizeof(dbtype)) {
+				fprintf(stderr, "bad db type '%s'\n",
+					isc_commandline_argument);
+				exit(1);
+			}
 			break;
 		case 'g':
 			options |= (DNS_DBFIND_GLUEOK|DNS_DBFIND_VALIDATEGLUE);
@@ -0,0 +1,16 @@
+randomfile
+Kdh.+002+18602.key
+Kdh.+002+18602.private
+Kdh.+002+48957.key
+Kdh.+002+48957.private
+Ktest.+001+00002.key
+Ktest.+001+54622.key
+Ktest.+001+54622.private
+Ktest.+003+23616.key
+Ktest.+003+23616.private
+Ktest.+003+49667.key
+dst_2_data
+t2_data_1
+t2_data_2
+t2_dsasig
+t2_rsasig
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2006-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006-2008, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1999-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -49,7 +49,7 @@ dst_test@EXEEXT@: dst_test.@O@ ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 		dst_test.@O@ ${LIBS}

-t_dst@EXEEXT@: t_dst.@O@ ${DEPLIBS} ${TLIB}
+t_dst@EXEEXT@: t_dst.@O@ ${DEPLIBS} ${TLIB} randomfile
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 		t_dst.@O@ ${TLIB} ${LIBS}

@@ -57,9 +57,29 @@ gsstest@EXEEXT@: gsstest.@O@ ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 		gsstest.@O@ ${LIBS}

-test: t_dst@EXEEXT@
+test: t_dst@EXEEXT@ randomfile
+	../genrandom@EXEEXT@ 100 randomfile
+	-@ ./t_dst@EXEEXT@ -q 1800 -a
+
+randomfile:
 	../genrandom@EXEEXT@ 100 randomfile
-	-@ ./t_dst@EXEEXT@ -b @srcdir@ -q 1800 -a

 clean distclean::
 	rm -f ${TARGETS} randomfile
+
+distclean::
+	rm -f Kdh.+002+18602.key
+	rm -f Kdh.+002+18602.private
+	rm -f Kdh.+002+48957.key
+	rm -f Kdh.+002+48957.private
+	rm -f Ktest.+001+00002.key
+	rm -f Ktest.+001+54622.key
+	rm -f Ktest.+001+54622.private
+	rm -f Ktest.+003+23616.key
+	rm -f Ktest.+003+23616.private
+	rm -f Ktest.+003+49667.key
+	rm -f dst_2_data
+	rm -f t2_data_1
+	rm -f t2_data_2
+	rm -f t2_dsasig
+	rm -f t2_rsasig
@@ -54,7 +54,7 @@ use(dst_key_t *key, isc_mem_t *mctx) {
 	 */
 	isc_buffer_add(&sigbuf, 1);

-	isc_buffer_init(&databuf, data, strlen(data));
+	isc_buffer_constinit(&databuf, data, strlen(data));
 	isc_buffer_add(&databuf, strlen(data));
 	isc_buffer_usedregion(&databuf, &datareg);

@@ -262,7 +262,7 @@ main(void) {

 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
-	isc_buffer_init(&b, "test.", 5);
+	isc_buffer_constinit(&b, "test.", 5);
 	isc_buffer_add(&b, 5);
 	result = dns_name_fromtext(name, &b, NULL, ISC_FALSE, NULL);
 	if (result != ISC_R_SUCCESS)
@@ -274,7 +274,7 @@ main(void) {
 	io(name, 49667, DST_ALG_DSA, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);
 	io(name, 2, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC, mctx);

-	isc_buffer_init(&b, "dh.", 3);
+	isc_buffer_constinit(&b, "dh.", 3);
 	isc_buffer_add(&b, 3);
 	result = dns_name_fromtext(name, &b, NULL, ISC_FALSE, NULL);
 	if (result != ISC_R_SUCCESS)
@@ -61,6 +61,7 @@ cleandir(char *path) {
 	DIR		*dirp;
 	struct dirent	*pe;
 	char		fullname[PATH_MAX + 1];
+	size_t		l;

 	dirp = opendir(path);
 	if (dirp == NULL) {
@@ -73,11 +74,16 @@ cleandir(char *path) {
 			continue;
 		if (! strcmp(pe->d_name, ".."))
 			continue;
-		strcpy(fullname, path);
-		strcat(fullname, "/");
-		strcat(fullname, pe->d_name);
-		if (remove(fullname))
-			t_info("remove(%s) failed %d\n", fullname, errno);
+		(void)strlcpy(fullname, path, sizeof(fullname));
+		(void)strlcat(fullname, "/", sizeof(fullname));
+		l = strlcat(fullname, pe->d_name, sizeof(fullname));
+		if (l < sizeof(fullname)) {
+			if (remove(fullname))
+				t_info("remove(%s) failed %d\n", fullname,
+				       errno);
+		} else
+		       t_info("unable to remove '%s/%s': path too long\n",
+			      path, pe->d_name);

 	}
 	(void)closedir(dirp);
@@ -98,7 +104,7 @@ use(dst_key_t *key, isc_mem_t *mctx, isc_result_t exp_result, int *nfails) {
 	dst_context_t *ctx = NULL;

 	isc_buffer_init(&sigbuf, sig, sizeof(sig));
-	isc_buffer_init(&databuf, data, strlen(data));
+	isc_buffer_constinit(&databuf, data, strlen(data));
 	isc_buffer_add(&databuf, strlen(data));
 	isc_buffer_usedregion(&databuf, &datareg);

@@ -408,7 +414,7 @@ t1(void) {

 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
-	isc_buffer_init(&b, "test.", 5);
+	isc_buffer_constinit(&b, "test.", 5);
 	isc_buffer_add(&b, 5);
 	isc_result = dns_name_fromtext(name, &b, NULL, ISC_FALSE, NULL);
 	if (isc_result != ISC_R_SUCCESS) {
@@ -430,7 +436,7 @@ t1(void) {
 	io(name, 2, DST_ALG_RSAMD5, DST_TYPE_PRIVATE|DST_TYPE_PUBLIC,
 			mctx, DST_R_NULLKEY, &nfails, &nprobs);

-	isc_buffer_init(&b, "dh.", 3);
+	isc_buffer_constinit(&b, "dh.", 3);
 	isc_buffer_add(&b, 3);
 	isc_result = dns_name_fromtext(name, &b, NULL, ISC_FALSE, NULL);
 	if (isc_result != ISC_R_SUCCESS) {
@@ -560,25 +566,27 @@ sig_fromfile(char *path, isc_buffer_t *iscbuf) {
 	char		*p;
 	char		*buf;

-	rval = stat(path, &sb);
-	if (rval != 0) {
-		t_info("stat %s failed, errno == %d\n", path, errno);
-		return(1);
-	}
-
-	buf = (char *) malloc((sb.st_size + 1) * sizeof(unsigned char));
-	if (buf == NULL) {
-		t_info("malloc failed, errno == %d\n", errno);
-		return(1);
-	}
-
 	fd = open(path, O_RDONLY);
 	if (fd < 0) {
 		t_info("open failed, errno == %d\n", errno);
-		(void) free(buf);
 		return(1);
 	}

+	rval = fstat(fd, &sb);
+	if (rval != 0) {
+		t_info("stat %s failed, errno == %d\n", path, errno);
+		close(fd);
+		return(1);
+	}
+
+	buf = (char *) malloc((sb.st_size + 1) * sizeof(char));
+	if (buf == NULL) {
+		t_info("malloc failed, errno == %d\n", errno);
+		close(fd);
+		return(1);
+	}
+
+
 	len = sb.st_size;
 	p = buf;
 	while (len) {
@@ -651,28 +659,29 @@ t2_sigchk(char *datapath, char *sigpath, char *keyname,
 	/*
 	 * Read data from file in a form usable by dst_verify.
 	 */
-	rval = stat(datapath, &sb);
-	if (rval != 0) {
-		t_info("t2_sigchk: stat (%s) failed %d\n", datapath, errno);
-		++*nprobs;
-		return;
-	}
-
-	data = (unsigned char *) malloc(sb.st_size * sizeof(char));
-	if (data == NULL) {
-		t_info("t2_sigchk: malloc failed %d\n", errno);
-		++*nprobs;
-		return;
-	}
-
 	fd = open(datapath, O_RDONLY);
 	if (fd < 0) {
 		t_info("t2_sigchk: open failed %d\n", errno);
-		(void) free(data);
 		++*nprobs;
 		return;
 	}

+	rval = fstat(fd, &sb);
+	if (rval != 0) {
+		t_info("t2_sigchk: stat (%s) failed %d\n", datapath, errno);
+		++*nprobs;
+		close(fd);
+		return;
+	}
+
+	data = (unsigned char *) malloc(sb.st_size * sizeof(unsigned char));
+	if (data == NULL) {
+		t_info("t2_sigchk: malloc failed %d\n", errno);
+		++*nprobs;
+		close(fd);
+		return;
+	}
+
 	p = data;
 	len = sb.st_size;
 	do {
@@ -689,7 +698,7 @@ t2_sigchk(char *datapath, char *sigpath, char *keyname,
 	 */
 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
-	isc_buffer_init(&b, keyname, strlen(keyname));
+	isc_buffer_constinit(&b, keyname, strlen(keyname));
 	isc_buffer_add(&b, strlen(keyname));
 	isc_result = dns_name_fromtext(name, &b, dns_rootname, ISC_FALSE, NULL);
 	if (isc_result != ISC_R_SUCCESS) {
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -22,6 +22,8 @@
 #include <config.h>

 #include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>

 #include <sys/types.h>		/* Non-portable. */
 #include <sys/stat.h>		/* Non-portable. */
@@ -35,10 +37,24 @@ int
 main(void) {
 	isc_fsaccess_t access;
 	isc_result_t result;
+	FILE *fp;
+	int n;

-	remove(PATH);
-	fopen(PATH, "w");
-	chmod(PATH, 0);
+	n = remove(PATH);
+	if (n != 0 && errno != ENOENT) {
+		fprintf(stderr, "unable to remove(%s)\n", PATH);
+		exit(1);
+	}
+	fp = fopen(PATH, "w");
+	if (fp == NULL) {
+		fprintf(stderr, "unable to fopen(%s)\n", PATH);
+		exit(1);
+	}
+	n = chmod(PATH, 0);
+	if (n != 0) {
+		fprintf(stderr, "unable chmod(%s, 0)\n", PATH);
+		exit(1);
+	}

 	access = 0;

@@ -55,6 +71,7 @@ main(void) {
 	result = isc_fsaccess_set(PATH, access);
 	if (result != ISC_R_SUCCESS)
 		fprintf(stderr, "result = %s\n", isc_result_totext(result));
+	(void)fclose(fp);

 	return (0);
 }
@@ -9,4 +9,4 @@
 #	cishm is 0 if a case insensitive hash of testname1 should match a
 #	case insensitive hash of testname2, otherwise cishm != 0
 #
-a.b.c.d	a.b.c.d.	0	0
+a.b.c.d	A.B.C.D	0	1
@@ -25,8 +25,10 @@
 #include <isc/buffer.h>
 #include <isc/mem.h>
 #include <isc/string.h>
+#include <isc/util.h>

 #include <dns/compress.h>
+#include <dns/fixedname.h>
 #include <dns/name.h>
 #include <dns/result.h>

@@ -38,6 +40,39 @@

 static char	*Tokens[MAXTOKS + 1];

+#define BINDABLE(name) \
+	((name->attributes & (DNS_NAMEATTR_READONLY|DNS_NAMEATTR_DYNAMIC)) \
+	 == 0)
+
+static isc_result_t
+dns_name_fromstring2(dns_name_t *target, const char *src,
+		     const dns_name_t *origin, unsigned int options,
+		     isc_mem_t *mctx)
+{
+	isc_result_t result;
+	isc_buffer_t buf;
+	dns_fixedname_t fn;
+	dns_name_t *name;
+
+	REQUIRE(src != NULL);
+
+	isc_buffer_constinit(&buf, src, strlen(src));
+	isc_buffer_add(&buf, strlen(src));
+	if (BINDABLE(target) && target->buffer != NULL)
+		name = target;
+	else {
+		dns_fixedname_init(&fn);
+		name = dns_fixedname_name(&fn);
+	}
+
+	result = dns_name_fromtext(name, &buf, origin, options, NULL);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	if (name != target)
+		result = dns_name_dupwithoffsets(name, mctx, target);
+	return (result);
+}

 #ifdef	NEED_PBUF

@@ -166,7 +201,7 @@ chkdata(unsigned char *buf, size_t buflen, char *exp_data,
 		else {
 			t_info("bad data at position %lu, "
 			       "got 0x%.2x, expected 0x%.2x\n",
-			       (unsigned long)cnt, *p, *q);
+			       (unsigned long)cnt, *p, *v);
 			result = cnt + 1;
 		}
 		(void)free(data);
@@ -184,13 +219,14 @@ chkdata(unsigned char *buf, size_t buflen, char *exp_data,
 * setup the buffer and return the data length.
 */
 static int
-getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
+getmsg(char *datafile_name, isc_buffer_t *pbuf)
 {
 	int			c;
-	int			len;
-	int			cnt;
+	unsigned int		len;
+	unsigned int		cnt;
 	unsigned char		*p;
 	FILE			*fp;
+	unsigned int		buflen;

 	fp = fopen(datafile_name, "r");
 	if (fp == NULL) {
@@ -198,7 +234,8 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 		return (0);
 	}

-	p = buf;
+	p = isc_buffer_used(pbuf);
+	buflen = isc_buffer_availablelength(pbuf);
 	cnt = 0;
 	len = 0;
 	while ((c = getc(fp)) != EOF) {
@@ -247,7 +284,6 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 	}

 	*p = '\0';
-	isc_buffer_init(pbuf, buf, cnt);
 	isc_buffer_add(pbuf, cnt);
 	return (cnt);
 }
@@ -330,41 +366,6 @@ hname_to_tname(char *src, char *target, size_t len) {

 #endif	/* NEED_HNAME_TO_TNAME */

-/*%
- * initialize a dns_name_t from a text name, hiding all
- * buffer and other object initialization from the caller
- *
- */
-
-static isc_result_t
-dname_from_tname(char *name, dns_name_t *dns_name) {
-	int		len;
-	isc_buffer_t	txtbuf;
-	isc_buffer_t	*binbuf;
-	unsigned char	*junk;
-	isc_result_t	result;
-
-	len = strlen(name);
-	isc_buffer_init(&txtbuf, name, len);
-	isc_buffer_add(&txtbuf, len);
-	junk = (unsigned char *)malloc(sizeof(unsigned char) * BUFLEN);
-	binbuf = (isc_buffer_t *)malloc(sizeof(isc_buffer_t));
-	if ((junk != NULL) && (binbuf != NULL)) {
-		isc_buffer_init(binbuf, junk, BUFLEN);
-		dns_name_init(dns_name, NULL);
-		dns_name_setbuffer(dns_name, binbuf);
-		result = dns_name_fromtext(dns_name,  &txtbuf,
-						NULL, ISC_FALSE, NULL);
-	} else {
-		result = ISC_R_NOSPACE;
-		if (junk != NULL)
-			(void)free(junk);
-		if (binbuf != NULL)
-			(void)free(binbuf);
-	}
-	return (result);
-}
-
 static const char *a3 =	"dns_name_init initializes 'name' to the empty name";

 static void
@@ -625,8 +626,10 @@ test_dns_name_hash(char *test_name1, char *test_name2,
 	isc_boolean_t	match;
 	unsigned int	hash1;
 	unsigned int	hash2;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t	fixed1;
+	dns_fixedname_t	fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	isc_result_t	result;

 	rval = T_UNRESOLVED;
@@ -634,12 +637,17 @@ test_dns_name_hash(char *test_name1, char *test_name2,

 	t_info("testing names %s and %s\n", test_name1, test_name2);

-	result = dname_from_tname(test_name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	result = dns_name_fromstring2(dns_name1, test_name1, NULL, 0, NULL);
 	if (result == ISC_R_SUCCESS) {
-		result = dname_from_tname(test_name2, &dns_name2);
+		result = dns_name_fromstring2(dns_name2, test_name2, NULL,
+					      0, NULL);
 		if (result == ISC_R_SUCCESS) {
-			hash1 = dns_name_hash(&dns_name1, ISC_TRUE);
-			hash2 = dns_name_hash(&dns_name2, ISC_TRUE);
+			hash1 = dns_name_hash(dns_name1, ISC_TRUE);
+			hash2 = dns_name_hash(dns_name2, ISC_TRUE);
 			match = ISC_FALSE;
 			if (hash1 == hash2)
 				match = ISC_TRUE;
@@ -647,8 +655,8 @@ test_dns_name_hash(char *test_name1, char *test_name2,
 				++failures;
 				t_info("hash mismatch when ISC_TRUE\n");
 			}
-			hash1 = dns_name_hash(&dns_name1, ISC_FALSE);
-			hash2 = dns_name_hash(&dns_name2, ISC_FALSE);
+			hash1 = dns_name_hash(dns_name1, ISC_FALSE);
+			hash2 = dns_name_hash(dns_name2, ISC_FALSE);
 			match = ISC_FALSE;
 			if (hash1 == hash2)
 				match = ISC_TRUE;
@@ -661,11 +669,11 @@ test_dns_name_hash(char *test_name1, char *test_name2,
 			else
 				rval = T_FAIL;
 		} else {
-			t_info("dns_fromtext %s failed, result = %s\n",
+			t_info("dns_name_fromstring2 %s failed, result = %s\n",
 				test_name2, dns_result_totext(result));
 		}
 	} else {
-		t_info("dns_fromtext %s failed, result = %s\n",
+		t_info("dns_name_fromstring2 %s failed, result = %s\n",
 				test_name1, dns_result_totext(result));
 	}
 	return (rval);
@@ -767,8 +775,10 @@ test_dns_name_fullcompare(char *name1, char *name2,
 	int		nfails;
 	int		order;
 	unsigned int	nlabels;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	isc_result_t	dns_result;
 	dns_namereln_t	dns_reln;

@@ -779,11 +789,16 @@ test_dns_name_fullcompare(char *name1, char *name2,
 	t_info("testing names %s and %s for relation %s\n", name1, name2,
 	       dns_namereln_to_text(exp_dns_reln));

-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			dns_reln = dns_name_fullcompare(&dns_name1, &dns_name2,
+			dns_reln = dns_name_fullcompare(dns_name1, dns_name2,
 					&order, &nlabels);

 			if (dns_reln != exp_dns_reln) {
@@ -815,11 +830,11 @@ test_dns_name_fullcompare(char *name1, char *name2,
 			else
 				result = T_FAIL;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}

@@ -908,8 +923,10 @@ test_dns_name_compare(char *name1, char *name2, int exp_order) {
 	int		result;
 	int		order;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;

 	result = T_UNRESOLVED;

@@ -917,11 +934,16 @@ test_dns_name_compare(char *name1, char *name2, int exp_order) {
 	       exp_order == 0 ? "==": (exp_order == -1 ? "<" : ">"),
 	       name2);

-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			order = dns_name_compare(&dns_name1, &dns_name2);
+			order = dns_name_compare(dns_name1, dns_name2);
 			/*
 			 * Normalize order.
 			 */
@@ -936,11 +958,11 @@ test_dns_name_compare(char *name1, char *name2, int exp_order) {
 			} else
 				result = T_PASS;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 					dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 				dns_result_totext(result));
 	}

@@ -1011,19 +1033,26 @@ test_dns_name_rdatacompare(char *name1, char *name2, int exp_order) {
 	int		result;
 	int		order;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;

 	result = T_UNRESOLVED;

 	t_info("testing %s %s %s\n", name1,
 	       exp_order == 0 ? "==": (exp_order == -1 ? "<" : ">"), name2);

-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			order = dns_name_rdatacompare(&dns_name1, &dns_name2);
+			order = dns_name_rdatacompare(dns_name1, dns_name2);
 			/*
 			 * Normalize order.
 			 */
@@ -1038,11 +1067,11 @@ test_dns_name_rdatacompare(char *name1, char *name2, int exp_order) {
 			} else
 				result = T_PASS;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}

@@ -1114,19 +1143,26 @@ test_dns_name_issubdomain(char *name1, char *name2, isc_boolean_t exp_rval) {
 	int		result;
 	isc_boolean_t	rval;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;

 	result = T_UNRESOLVED;

 	t_info("testing %s %s a subdomain of %s\n", name1,
 	       exp_rval == 0 ? "is not" : "is", name2);

-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			rval = dns_name_issubdomain(&dns_name1, &dns_name2);
+			rval = dns_name_issubdomain(dns_name1, dns_name2);

 			if (rval != exp_rval) {
 				t_info("expected return value of %s, got %s\n",
@@ -1136,11 +1172,11 @@ test_dns_name_issubdomain(char *name1, char *name2, isc_boolean_t exp_rval) {
 			} else
 				result = T_PASS;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}

@@ -1207,15 +1243,18 @@ test_dns_name_countlabels(char *test_name, unsigned int exp_nlabels) {
 	int		result;
 	unsigned int	nlabels;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name;
+	dns_fixedname_t	fixed;
+	dns_name_t	*dns_name;

 	result = T_UNRESOLVED;

 	t_info("testing %s\n", test_name);

-	dns_result = dname_from_tname(test_name, &dns_name);
+	dns_fixedname_init(&fixed);
+	dns_name = dns_fixedname_name(&fixed);
+	dns_result = dns_name_fromstring2(dns_name, test_name, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		nlabels = dns_name_countlabels(&dns_name);
+		nlabels = dns_name_countlabels(dns_name);

 		if (nlabels != exp_nlabels) {
 			t_info("expected %d, got %d\n", exp_nlabels, nlabels);
@@ -1223,7 +1262,7 @@ test_dns_name_countlabels(char *test_name, unsigned int exp_nlabels) {
 		} else
 			result = T_PASS;
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(dns_result));
 	}

@@ -1297,8 +1336,10 @@ test_dns_name_getlabel(char *test_name1, int label1_pos, char *test_name2,
 	unsigned int	cnt;
 	unsigned char	*p;
 	unsigned char	*q;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	dns_label_t	dns_label1;
 	dns_label_t	dns_label2;
 	isc_result_t	dns_result;
@@ -1308,12 +1349,18 @@ test_dns_name_getlabel(char *test_name1, int label1_pos, char *test_name2,

 	t_info("testing with %s and %s\n", test_name1, test_name2);

-	dns_result = dname_from_tname(test_name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, test_name1, NULL,
+					  0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(test_name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, test_name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			dns_name_getlabel(&dns_name1, label1_pos, &dns_label1);
-			dns_name_getlabel(&dns_name2, label2_pos, &dns_label2);
+			dns_name_getlabel(dns_name1, label1_pos, &dns_label1);
+			dns_name_getlabel(dns_name2, label2_pos, &dns_label2);
 			if (dns_label1.length != dns_label2.length) {
 				t_info("label lengths differ\n");
 				++nfails;
@@ -1332,11 +1379,11 @@ test_dns_name_getlabel(char *test_name1, int label1_pos, char *test_name2,
 			else
 				result = T_FAIL;
 		} else {
-			t_info("dname_from_tname failed, result == %s",
+			t_info("dns_name_fromstring2 failed, result == %s",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s",
+		t_info("dns_name_fromstring2 failed, result == %s",
 		       dns_result_totext(result));
 	}
 	return (result);
@@ -1410,8 +1457,10 @@ test_dns_name_getlabelsequence(char *test_name1, int label1_start,
 	unsigned int	cnt;
 	unsigned char	*p;
 	unsigned char	*q;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	dns_name_t	dns_targetname1;
 	dns_name_t	dns_targetname2;
 	isc_result_t	dns_result;
@@ -1422,16 +1471,22 @@ test_dns_name_getlabelsequence(char *test_name1, int label1_start,

 	nfails = 0;
 	result = T_UNRESOLVED;
-	dns_result = dname_from_tname(test_name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, test_name1, NULL,
+					  0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(test_name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, test_name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
 			t_info("testing %s %s\n", test_name1, test_name2);
 			dns_name_init(&dns_targetname1, NULL);
 			dns_name_init(&dns_targetname2, NULL);
-			dns_name_getlabelsequence(&dns_name1, label1_start,
+			dns_name_getlabelsequence(dns_name1, label1_start,
 						  range, &dns_targetname1);
-			dns_name_getlabelsequence(&dns_name2, label2_start,
+			dns_name_getlabelsequence(dns_name2, label2_start,
 						  range, &dns_targetname2);

 			/*
@@ -1462,11 +1517,11 @@ test_dns_name_getlabelsequence(char *test_name1, int label1_start,
 			else
 				result = T_FAIL;
 		} else {
-			t_info("dname_from_tname failed, result == %s",
+			t_info("dns_name_fromstring2 failed, result == %s",
 			       dns_result_totext(dns_result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s",
+		t_info("dns_name_fromstring2 failed, result == %s",
 		       dns_result_totext(dns_result));
 	}
 	return (result);
@@ -1533,7 +1588,8 @@ test_dns_name_fromregion(char *test_name) {
 	int		order;
 	unsigned int	nlabels;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
+	dns_fixedname_t fixed1;
+	dns_name_t	*dns_name1;
 	dns_name_t	dns_name2;
 	dns_namereln_t	dns_namereln;
 	isc_region_t	region;
@@ -1542,21 +1598,23 @@ test_dns_name_fromregion(char *test_name) {

 	t_info("testing %s\n", test_name);

-	dns_result = dname_from_tname(test_name, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_result = dns_name_fromstring2(dns_name1, test_name, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {

-		dns_name_toregion(&dns_name1, &region);
+		dns_name_toregion(dns_name1, &region);

 		dns_name_init(&dns_name2, NULL);
 		dns_name_fromregion(&dns_name2, &region);
-		dns_namereln = dns_name_fullcompare(&dns_name1, &dns_name2,
+		dns_namereln = dns_name_fullcompare(dns_name1, &dns_name2,
 						    &order, &nlabels);
 		if (dns_namereln == dns_namereln_equal)
 			result = T_PASS;
 		else
 			result = T_FAIL;
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}
 	return (result);
@@ -1985,14 +2043,18 @@ test_dns_name_fromwire(char *datafile_name, int testname_offset, int downcase,
 	char			buf2[BUFLEN];
 	isc_buffer_t		iscbuf1;
 	isc_buffer_t		iscbuf2;
+	dns_fixedname_t		fixed2;
 	dns_name_t		dns_name1;
-	dns_name_t		dns_name2;
+	dns_name_t		*dns_name2;
 	isc_result_t		dns_result;
 	dns_namereln_t		dns_namereln;
 	dns_decompress_t	dctx;

 	t_info("testing using %s\n", datafile_name);
-	len = getmsg(datafile_name, buf1, BIGBUFLEN, &iscbuf1);
+	isc_buffer_init(&iscbuf1, buf1, sizeof(buf1));
+	len = getmsg(datafile_name, &iscbuf1);
+	if (len == 0)
+		return (T_FAIL);

 	isc_buffer_setactive(&iscbuf1, len);
 	iscbuf1.current = testname_offset;
@@ -2007,10 +2069,13 @@ test_dns_name_fromwire(char *datafile_name, int testname_offset, int downcase,

 	if ((dns_result == exp_result) && (exp_result == ISC_R_SUCCESS)) {

-		dns_result = dname_from_tname(exp_name, &dns_name2);
+		dns_fixedname_init(&fixed2);
+		dns_name2 = dns_fixedname_name(&fixed2);
+		dns_result = dns_name_fromstring2(dns_name2, exp_name, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
 			dns_namereln = dns_name_fullcompare(&dns_name1,
-							    &dns_name2,
+							    dns_name2,
 							    &order, &nlabels);
 			if (dns_namereln != dns_namereln_equal) {
 				t_info("dns_name_fullcompare  returned %s\n",
@@ -2165,7 +2230,8 @@ static const char *a52 =

 static int
 test_dns_name_towire(char *testname, unsigned int dc_method, char *exp_data,
-		     int exp_data_len, isc_result_t exp_result, size_t buflen)
+		     size_t exp_data_len, isc_result_t exp_result,
+		     size_t buflen)
 {
 	int			result;
 	int			val;
@@ -2235,6 +2301,7 @@ t_dns_name_towire_x(const char *testfile, size_t buflen) {
 	int		result;
 	unsigned int	dc_method;
 	isc_result_t	exp_result;
+	size_t		exp_data_len;
 	char		*p;
 	FILE		*fp;

@@ -2264,11 +2331,12 @@ t_dns_name_towire_x(const char *testfile, size_t buflen) {

 				dc_method = t_dc_method_fromtext(Tokens[3]);
 				exp_result = t_dns_result_fromtext(Tokens[4]);
+				exp_data_len = strtoul(Tokens[3], NULL, 10);

 				result = test_dns_name_towire(Tokens[0],
 							      dc_method,
 							      Tokens[2],
-							      atoi(Tokens[3]),
+							      exp_data_len,
 							      exp_result,
 							      buflen);
 			} else {
@@ -1056,6 +1056,12 @@ t_dns_rbtnodechain_first(char *dbfile, char *expected_firstname,
 	dns_fixedname_t		dns_origin;
 	isc_result_t		expected_result;

+	REQUIRE(dbfile != NULL);
+	REQUIRE(expected_firstname != NULL);
+	REQUIRE(expected_firstorigin != NULL);
+	REQUIRE(expected_nextname != NULL);
+	REQUIRE(expected_nextorigin != NULL);
+
 	result = T_UNRESOLVED;

 	nfails = 0;
@@ -1247,6 +1253,12 @@ t_dns_rbtnodechain_last(char *dbfile, char *expected_lastname,
 	dns_fixedname_t		dns_origin;
 	isc_result_t		expected_result;

+	REQUIRE(dbfile != NULL);
+	REQUIRE(expected_lastname != NULL);
+	REQUIRE(expected_lastorigin != NULL);
+	REQUIRE(expected_prevname != NULL);
+	REQUIRE(expected_prevorigin != NULL);
+
 	result = T_UNRESOLVED;

 	nfails = 0;
@@ -55,19 +55,19 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,

 	switch (rdata->type) {
 	case dns_rdatatype_a6: {
-		dns_rdata_in_a6_t in_a6;
+		static dns_rdata_in_a6_t in_a6;
 		result = dns_rdata_tostruct(rdata, sp = &in_a6, NULL);
 		break;
 	}
 	case dns_rdatatype_a: {
 		switch (rdata->rdclass) {
 		case dns_rdataclass_hs: {
-			dns_rdata_hs_a_t hs_a;
+			static dns_rdata_hs_a_t hs_a;
 			result = dns_rdata_tostruct(rdata, sp = &hs_a, NULL);
 			break;
 		}
 		case dns_rdataclass_in: {
-			dns_rdata_in_a_t in_a;
+			static dns_rdata_in_a_t in_a;
 			result = dns_rdata_tostruct(rdata, sp = &in_a, NULL);
 			break;
 		}
@@ -78,12 +78,12 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		break;
 	}
 	case dns_rdatatype_aaaa: {
-		dns_rdata_in_aaaa_t in_aaaa;
+		static dns_rdata_in_aaaa_t in_aaaa;
 		result = dns_rdata_tostruct(rdata, sp = &in_aaaa, NULL);
 		break;
 	}
 	case dns_rdatatype_afsdb: {
-		dns_rdata_afsdb_t afsdb;
+		static dns_rdata_afsdb_t afsdb;
 		result = dns_rdata_tostruct(rdata, sp = &afsdb, NULL);
 		break;
 	}
@@ -94,7 +94,7 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 	case dns_rdatatype_apl: {
 		switch (rdata->rdclass) {
 		case dns_rdataclass_in: {
-			dns_rdata_in_apl_t in_apl;
+			static dns_rdata_in_apl_t in_apl;
 			result = dns_rdata_tostruct(rdata, sp = &in_apl, NULL);
 			break;
 		}
@@ -105,202 +105,202 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		break;
 	}
 	case dns_rdatatype_cert: {
-		dns_rdata_cert_t cert;
+		static dns_rdata_cert_t cert;
 		result = dns_rdata_tostruct(rdata, sp = &cert, NULL);
 		break;
 	}
 	case dns_rdatatype_cname: {
-		dns_rdata_cname_t cname;
+		static dns_rdata_cname_t cname;
 		result = dns_rdata_tostruct(rdata, sp = &cname, NULL);
 		break;
 	}
 	case dns_rdatatype_dname: {
-		dns_rdata_dname_t dname;
+		static dns_rdata_dname_t dname;
 		result = dns_rdata_tostruct(rdata, sp = &dname, NULL);
 		break;
 	}
 	case dns_rdatatype_gpos: {
-		dns_rdata_gpos_t gpos;
+		static dns_rdata_gpos_t gpos;
 		result = dns_rdata_tostruct(rdata, sp = &gpos, NULL);
 		break;
 	}
 	case dns_rdatatype_hinfo: {
-		dns_rdata_hinfo_t hinfo;
+		static dns_rdata_hinfo_t hinfo;
 		result = dns_rdata_tostruct(rdata, sp = &hinfo, NULL);
 		break;
 	}
 	case dns_rdatatype_isdn: {
-		dns_rdata_isdn_t isdn;
+		static dns_rdata_isdn_t isdn;
 		result = dns_rdata_tostruct(rdata, sp = &isdn, NULL);
 		break;
 	}
 	case dns_rdatatype_key: {
-		dns_rdata_key_t key;
+		static dns_rdata_key_t key;
 		result = dns_rdata_tostruct(rdata, sp = &key, NULL);
 		break;
 	}
 	case dns_rdatatype_kx: {
-		dns_rdata_in_kx_t in_kx;
+		static dns_rdata_in_kx_t in_kx;
 		result = dns_rdata_tostruct(rdata, sp = &in_kx, NULL);
 		break;
 	}
 	case dns_rdatatype_loc: {
-		dns_rdata_loc_t loc;
+		static dns_rdata_loc_t loc;
 		result = dns_rdata_tostruct(rdata, sp = &loc, NULL);
 		break;
 	}
 	case dns_rdatatype_mb: {
-		dns_rdata_mb_t mb;
+		static dns_rdata_mb_t mb;
 		result = dns_rdata_tostruct(rdata, sp = &mb, NULL);
 		break;
 	}
 	case dns_rdatatype_md: {
-		dns_rdata_md_t md;
+		static dns_rdata_md_t md;
 		result = dns_rdata_tostruct(rdata, sp = &md, NULL);
 		break;
 	}
 	case dns_rdatatype_mf: {
-		dns_rdata_mf_t mf;
+		static dns_rdata_mf_t mf;
 		result = dns_rdata_tostruct(rdata, sp = &mf, NULL);
 		break;
 	}
 	case dns_rdatatype_mg: {
-		dns_rdata_mg_t mg;
+		static dns_rdata_mg_t mg;
 		result = dns_rdata_tostruct(rdata, sp = &mg, NULL);
 		break;
 	}
 	case dns_rdatatype_minfo: {
-		dns_rdata_minfo_t minfo;
+		static dns_rdata_minfo_t minfo;
 		result = dns_rdata_tostruct(rdata, sp = &minfo, NULL);
 		break;
 	}
 	case dns_rdatatype_mr: {
-		dns_rdata_mr_t mr;
+		static dns_rdata_mr_t mr;
 		result = dns_rdata_tostruct(rdata, sp = &mr, NULL);
 		break;
 	}
 	case dns_rdatatype_mx: {
-		dns_rdata_mx_t mx;
+		static dns_rdata_mx_t mx;
 		result = dns_rdata_tostruct(rdata, sp = &mx, NULL);
 		break;
 	}
 	case dns_rdatatype_naptr: {
-		dns_rdata_naptr_t naptr;
+		static dns_rdata_naptr_t naptr;
 		result = dns_rdata_tostruct(rdata, sp = &naptr, NULL);
 		break;
 	}
 	case dns_rdatatype_ns: {
-		dns_rdata_ns_t ns;
+		static dns_rdata_ns_t ns;
 		result = dns_rdata_tostruct(rdata, sp = &ns, NULL);
 		break;
 	}
 	case dns_rdatatype_nsap: {
-		dns_rdata_in_nsap_t in_nsap;
+		static dns_rdata_in_nsap_t in_nsap;
 		result = dns_rdata_tostruct(rdata, sp = &in_nsap, NULL);
 		break;
 	}
 	case dns_rdatatype_nsap_ptr: {
-		dns_rdata_in_nsap_ptr_t in_nsap_ptr;
+		static dns_rdata_in_nsap_ptr_t in_nsap_ptr;
 		result = dns_rdata_tostruct(rdata, sp = &in_nsap_ptr, NULL);
 		break;
 	}
 	case dns_rdatatype_null: {
-		dns_rdata_null_t null;
+		static dns_rdata_null_t null;
 		result = dns_rdata_tostruct(rdata, sp = &null, NULL);
 		break;
 	}
 	case dns_rdatatype_nxt: {
-		dns_rdata_nxt_t nxt;
+		static dns_rdata_nxt_t nxt;
 		result = dns_rdata_tostruct(rdata, sp = &nxt, NULL);
 		break;
 	}
 	case dns_rdatatype_opt: {
-		dns_rdata_opt_t opt;
+		static dns_rdata_opt_t opt;
 		result = dns_rdata_tostruct(rdata, sp = &opt, NULL);
 		break;
 	}
 	case dns_rdatatype_ptr: {
-		dns_rdata_ptr_t ptr;
+		static dns_rdata_ptr_t ptr;
 		result = dns_rdata_tostruct(rdata, sp = &ptr, NULL);
 		break;
 	}
 	case dns_rdatatype_px: {
-		dns_rdata_in_px_t in_px;
+		static dns_rdata_in_px_t in_px;
 		result = dns_rdata_tostruct(rdata, sp = &in_px, NULL);
 		break;
 	}
 	case dns_rdatatype_rp: {
-		dns_rdata_rp_t rp;
+		static dns_rdata_rp_t rp;
 		result = dns_rdata_tostruct(rdata, sp = &rp, NULL);
 		break;
 	}
 	case dns_rdatatype_rt: {
-		dns_rdata_rt_t rt;
+		static dns_rdata_rt_t rt;
 		result = dns_rdata_tostruct(rdata, sp = &rt, NULL);
 		break;
 	}
 	case dns_rdatatype_sig: {
-		dns_rdata_sig_t sig;
+		static dns_rdata_sig_t sig;
 		result = dns_rdata_tostruct(rdata, sp = &sig, NULL);
 		break;
 	}
 	case dns_rdatatype_soa: {
-		dns_rdata_soa_t soa;
+		static dns_rdata_soa_t soa;
 		result = dns_rdata_tostruct(rdata, sp = &soa, NULL);
 		break;
 	}
 	case dns_rdatatype_srv: {
-		dns_rdata_in_srv_t in_srv;
+		static dns_rdata_in_srv_t in_srv;
 		result = dns_rdata_tostruct(rdata, sp = &in_srv, NULL);
 		break;
 	}
 	case dns_rdatatype_tkey: {
-		dns_rdata_tkey_t tkey;
+		static dns_rdata_tkey_t tkey;
 		result = dns_rdata_tostruct(rdata, sp = &tkey, NULL);
 		break;
 	}
 	case dns_rdatatype_tsig: {
-		dns_rdata_any_tsig_t tsig;
+		static dns_rdata_any_tsig_t tsig;
 		result = dns_rdata_tostruct(rdata, sp = &tsig, NULL);
 		break;
 	}
 	case dns_rdatatype_txt: {
-		dns_rdata_txt_t txt;
+		static dns_rdata_txt_t txt;
 		result = dns_rdata_tostruct(rdata, sp = &txt, NULL);
 		break;
 	}
 	case dns_rdatatype_spf: {
-		dns_rdata_spf_t spf;
+		static dns_rdata_spf_t spf;
 		result = dns_rdata_tostruct(rdata, sp = &spf, NULL);
 		break;
 	}
 	case dns_rdatatype_unspec: {
-		dns_rdata_unspec_t unspec;
+		static dns_rdata_unspec_t unspec;
 		result = dns_rdata_tostruct(rdata, sp = &unspec, NULL);
 		break;
 	}
 	case dns_rdatatype_wks: {
-		dns_rdata_in_wks_t in_wks;
+		static dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_tostruct(rdata, sp = &in_wks, NULL);
 		break;
 	}
 	case dns_rdatatype_x25: {
-		dns_rdata_x25_t x25;
+		static dns_rdata_x25_t x25;
 		result = dns_rdata_tostruct(rdata, sp = &x25, NULL);
 		break;
 	}
 	case dns_rdatatype_nsec: {
-		dns_rdata_nsec_t nsec;
+		static dns_rdata_nsec_t nsec;
 		result = dns_rdata_tostruct(rdata, sp = &nsec, NULL);
 		break;
 	}
 	case dns_rdatatype_rrsig: {
-		dns_rdata_rrsig_t rrsig;
+		static dns_rdata_rrsig_t rrsig;
 		result = dns_rdata_tostruct(rdata, sp = &rrsig, NULL);
 		break;
 	}
 	case dns_rdatatype_dnskey: {
-		dns_rdata_dnskey_t dnskey;
+		static dns_rdata_dnskey_t dnskey;
 		result = dns_rdata_tostruct(rdata, sp = &dnskey, NULL);
 		break;
 	}
@@ -317,19 +317,19 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,

 	switch (rdata->type) {
 	case dns_rdatatype_a6: {
-		dns_rdata_in_a6_t in_a6;
+		static dns_rdata_in_a6_t in_a6;
 		result = dns_rdata_tostruct(rdata, sp = &in_a6, mctx);
 		break;
 	}
 	case dns_rdatatype_a: {
 		switch (rdata->rdclass) {
 		case dns_rdataclass_hs: {
-			dns_rdata_hs_a_t hs_a;
+			static dns_rdata_hs_a_t hs_a;
 			result = dns_rdata_tostruct(rdata, sp = &hs_a, mctx);
 			break;
 		}
 		case dns_rdataclass_in: {
-			dns_rdata_in_a_t in_a;
+			static dns_rdata_in_a_t in_a;
 			result = dns_rdata_tostruct(rdata, sp = &in_a, mctx);
 			break;
 		}
@@ -340,12 +340,12 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		break;
 	}
 	case dns_rdatatype_aaaa: {
-		dns_rdata_in_aaaa_t in_aaaa;
+		static dns_rdata_in_aaaa_t in_aaaa;
 		result = dns_rdata_tostruct(rdata, sp = &in_aaaa, mctx);
 		break;
 	}
 	case dns_rdatatype_afsdb: {
-		dns_rdata_afsdb_t afsdb;
+		static dns_rdata_afsdb_t afsdb;
 		result = dns_rdata_tostruct(rdata, sp = &afsdb, mctx);
 		break;
 	}
@@ -356,7 +356,7 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 	case dns_rdatatype_apl: {
 		switch (rdata->rdclass) {
 		case dns_rdataclass_in: {
-			dns_rdata_in_apl_t in_apl;
+			static dns_rdata_in_apl_t in_apl;
 			result = dns_rdata_tostruct(rdata, sp = &in_apl, mctx);
 			break;
 		}
@@ -367,202 +367,202 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		break;
 	}
 	case dns_rdatatype_cert: {
-		dns_rdata_cert_t cert;
+		static dns_rdata_cert_t cert;
 		result = dns_rdata_tostruct(rdata, sp = &cert, mctx);
 		break;
 	}
 	case dns_rdatatype_cname: {
-		dns_rdata_cname_t cname;
+		static dns_rdata_cname_t cname;
 		result = dns_rdata_tostruct(rdata, sp = &cname, mctx);
 		break;
 	}
 	case dns_rdatatype_dname: {
-		dns_rdata_dname_t dname;
+		static dns_rdata_dname_t dname;
 		result = dns_rdata_tostruct(rdata, sp = &dname, mctx);
 		break;
 	}
 	case dns_rdatatype_gpos: {
-		dns_rdata_gpos_t gpos;
+		static dns_rdata_gpos_t gpos;
 		result = dns_rdata_tostruct(rdata, sp = &gpos, mctx);
 		break;
 	}
 	case dns_rdatatype_hinfo: {
-		dns_rdata_hinfo_t hinfo;
+		static dns_rdata_hinfo_t hinfo;
 		result = dns_rdata_tostruct(rdata, sp = &hinfo, mctx);
 		break;
 	}
 	case dns_rdatatype_isdn: {
-		dns_rdata_isdn_t isdn;
+		static dns_rdata_isdn_t isdn;
 		result = dns_rdata_tostruct(rdata, sp = &isdn, mctx);
 		break;
 	}
 	case dns_rdatatype_key: {
-		dns_rdata_key_t key;
+		static dns_rdata_key_t key;
 		result = dns_rdata_tostruct(rdata, sp = &key, mctx);
 		break;
 	}
 	case dns_rdatatype_kx: {
-		dns_rdata_in_kx_t in_kx;
+		static dns_rdata_in_kx_t in_kx;
 		result = dns_rdata_tostruct(rdata, sp = &in_kx, mctx);
 		break;
 	}
 	case dns_rdatatype_loc: {
-		dns_rdata_loc_t loc;
+		static dns_rdata_loc_t loc;
 		result = dns_rdata_tostruct(rdata, sp = &loc, mctx);
 		break;
 	}
 	case dns_rdatatype_mb: {
-		dns_rdata_mb_t mb;
+		static dns_rdata_mb_t mb;
 		result = dns_rdata_tostruct(rdata, sp = &mb, mctx);
 		break;
 	}
 	case dns_rdatatype_md: {
-		dns_rdata_md_t md;
+		static dns_rdata_md_t md;
 		result = dns_rdata_tostruct(rdata, sp = &md, mctx);
 		break;
 	}
 	case dns_rdatatype_mf: {
-		dns_rdata_mf_t mf;
+		static dns_rdata_mf_t mf;
 		result = dns_rdata_tostruct(rdata, sp = &mf, mctx);
 		break;
 	}
 	case dns_rdatatype_mg: {
-		dns_rdata_mg_t mg;
+		static dns_rdata_mg_t mg;
 		result = dns_rdata_tostruct(rdata, sp = &mg, mctx);
 		break;
 	}
 	case dns_rdatatype_minfo: {
-		dns_rdata_minfo_t minfo;
+		static dns_rdata_minfo_t minfo;
 		result = dns_rdata_tostruct(rdata, sp = &minfo, mctx);
 		break;
 	}
 	case dns_rdatatype_mr: {
-		dns_rdata_mr_t mr;
+		static dns_rdata_mr_t mr;
 		result = dns_rdata_tostruct(rdata, sp = &mr, mctx);
 		break;
 	}
 	case dns_rdatatype_mx: {
-		dns_rdata_mx_t mx;
+		static dns_rdata_mx_t mx;
 		result = dns_rdata_tostruct(rdata, sp = &mx, mctx);
 		break;
 	}
 	case dns_rdatatype_naptr: {
-		dns_rdata_naptr_t naptr;
+		static dns_rdata_naptr_t naptr;
 		result = dns_rdata_tostruct(rdata, sp = &naptr, mctx);
 		break;
 	}
 	case dns_rdatatype_ns: {
-		dns_rdata_ns_t ns;
+		static dns_rdata_ns_t ns;
 		result = dns_rdata_tostruct(rdata, sp = &ns, mctx);
 		break;
 	}
 	case dns_rdatatype_nsap: {
-		dns_rdata_in_nsap_t in_nsap;
+		static dns_rdata_in_nsap_t in_nsap;
 		result = dns_rdata_tostruct(rdata, sp = &in_nsap, mctx);
 		break;
 	}
 	case dns_rdatatype_nsap_ptr: {
-		dns_rdata_in_nsap_ptr_t in_nsap_ptr;
+		static dns_rdata_in_nsap_ptr_t in_nsap_ptr;
 		result = dns_rdata_tostruct(rdata, sp = &in_nsap_ptr, mctx);
 		break;
 	}
 	case dns_rdatatype_null: {
-		dns_rdata_null_t null;
+		static dns_rdata_null_t null;
 		result = dns_rdata_tostruct(rdata, sp = &null, mctx);
 		break;
 	}
 	case dns_rdatatype_nxt: {
-		dns_rdata_nxt_t nxt;
+		static dns_rdata_nxt_t nxt;
 		result = dns_rdata_tostruct(rdata, sp = &nxt, mctx);
 		break;
 	}
 	case dns_rdatatype_opt: {
-		dns_rdata_opt_t opt;
+		static dns_rdata_opt_t opt;
 		result = dns_rdata_tostruct(rdata, sp = &opt, mctx);
 		break;
 	}
 	case dns_rdatatype_ptr: {
-		dns_rdata_ptr_t ptr;
+		static dns_rdata_ptr_t ptr;
 		result = dns_rdata_tostruct(rdata, sp = &ptr, mctx);
 		break;
 	}
 	case dns_rdatatype_px: {
-		dns_rdata_in_px_t in_px;
+		static dns_rdata_in_px_t in_px;
 		result = dns_rdata_tostruct(rdata, sp = &in_px, mctx);
 		break;
 	}
 	case dns_rdatatype_rp: {
-		dns_rdata_rp_t rp;
+		static dns_rdata_rp_t rp;
 		result = dns_rdata_tostruct(rdata, sp = &rp, mctx);
 		break;
 	}
 	case dns_rdatatype_rt: {
-		dns_rdata_rt_t rt;
+		static dns_rdata_rt_t rt;
 		result = dns_rdata_tostruct(rdata, sp = &rt, mctx);
 		break;
 	}
 	case dns_rdatatype_sig: {
-		dns_rdata_sig_t sig;
+		static dns_rdata_sig_t sig;
 		result = dns_rdata_tostruct(rdata, sp = &sig, mctx);
 		break;
 	}
 	case dns_rdatatype_soa: {
-		dns_rdata_soa_t soa;
+		static dns_rdata_soa_t soa;
 		result = dns_rdata_tostruct(rdata, sp = &soa, mctx);
 		break;
 	}
 	case dns_rdatatype_srv: {
-		dns_rdata_in_srv_t in_srv;
+		static dns_rdata_in_srv_t in_srv;
 		result = dns_rdata_tostruct(rdata, sp = &in_srv, mctx);
 		break;
 	}
 	case dns_rdatatype_tkey: {
-		dns_rdata_tkey_t tkey;
+		static dns_rdata_tkey_t tkey;
 		result = dns_rdata_tostruct(rdata, sp = &tkey, mctx);
 		break;
 	}
 	case dns_rdatatype_tsig: {
-		dns_rdata_any_tsig_t tsig;
+		static dns_rdata_any_tsig_t tsig;
 		result = dns_rdata_tostruct(rdata, sp = &tsig, mctx);
 		break;
 	}
 	case dns_rdatatype_txt: {
-		dns_rdata_txt_t txt;
+		static dns_rdata_txt_t txt;
 		result = dns_rdata_tostruct(rdata, sp = &txt, mctx);
 		break;
 	}
 	case dns_rdatatype_spf: {
-		dns_rdata_spf_t spf;
+		static dns_rdata_spf_t spf;
 		result = dns_rdata_tostruct(rdata, sp = &spf, mctx);
 		break;
 	}
 	case dns_rdatatype_unspec: {
-		dns_rdata_unspec_t unspec;
+		static dns_rdata_unspec_t unspec;
 		result = dns_rdata_tostruct(rdata, sp = &unspec, mctx);
 		break;
 	}
 	case dns_rdatatype_wks: {
-		dns_rdata_in_wks_t in_wks;
+		static dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_tostruct(rdata, sp = &in_wks, mctx);
 		break;
 	}
 	case dns_rdatatype_x25: {
-		dns_rdata_x25_t x25;
+		static dns_rdata_x25_t x25;
 		result = dns_rdata_tostruct(rdata, sp = &x25, mctx);
 		break;
 	}
 	case dns_rdatatype_nsec: {
-		dns_rdata_nsec_t nsec;
+		static dns_rdata_nsec_t nsec;
 		result = dns_rdata_tostruct(rdata, sp = &nsec, mctx);
 		break;
 	}
 	case dns_rdatatype_rrsig: {
-		dns_rdata_rrsig_t rrsig;
+		static dns_rdata_rrsig_t rrsig;
 		result = dns_rdata_tostruct(rdata, sp = &rrsig, mctx);
 		break;
 	}
 	case dns_rdatatype_dnskey: {
-		dns_rdata_dnskey_t dnskey;
+		static dns_rdata_dnskey_t dnskey;
 		result = dns_rdata_tostruct(rdata, sp = &dnskey, mctx);
 		break;
 	}
@@ -262,7 +262,7 @@ main(int argc, char *argv[]) {

 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
-	isc_buffer_init(&b, "child.example.", strlen("child.example."));
+	isc_buffer_constinit(&b, "child.example.", strlen("child.example."));
 	isc_buffer_add(&b, strlen("child.example."));
 	result = dns_name_fromtext(name, &b, dns_rootname, ISC_FALSE, NULL);
 	CHECK("dns_name_fromtext", result);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2008, 2012  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -205,8 +205,9 @@ my_listen(isc_task_t *task, isc_event_t *event) {
 		/*
 		 * Queue another listen on this socket.
 		 */
-		isc_socket_accept(event->ev_sender, task, my_listen,
-				  event->ev_arg);
+		RUNTIME_CHECK(isc_socket_accept(event->ev_sender, task,
+						my_listen, event->ev_arg)
+			      == ISC_R_SUCCESS);

 		region.base = isc_mem_get(mctx, 20);
 		region.length = 20;
@@ -0,0 +1,26 @@
+#!/bin/sh
+#
+# Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: clean.sh,v 1.6 2007/09/26 03:22:44 marka Exp $
+
+#
+# Clean up after tests.
+#
+
+rm -f dig.out.*
+rm -f */named.memstats
+rm -f */named.conf
+rm -f */named.run
@@ -0,0 +1,2 @@
+# this server runs named with only one worker thread
+-m record,size,mctx -c named.conf -d 99 -g -T clienttest -n 1
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.5 2007/06/19 23:47:06 tbox Exp $ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	recursion no;
+	additional-from-auth no;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	notify no;
+	minimal-responses yes;
+};
+
+include "../../common/rndc.key";
+
+controls {
+        inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "rt.example" {
+	type master;
+	file "rt.db";
+};
+
+zone "naptr.example" {
+	type master;
+	file "naptr.db";
+};
+
+zone "rt2.example" {
+	type master;
+	file "rt2.db";
+};
+
+zone "naptr2.example" {
+	type master;
+	file "naptr2.db";
+};
+
+zone "nid.example" {
+	type master;
+	file "nid.db";
+};
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.5 2007/06/19 23:47:06 tbox Exp $ */
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	recursion no;
+	additional-from-auth no;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	notify no;
+        minimal-responses no;
+};
+
+include "../../common/rndc.key";
+
+controls {
+        inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+};
+
+zone "rt.example" {
+	type master;
+	file "rt.db";
+};
+
+zone "naptr.example" {
+	type master;
+	file "naptr.db";
+};
+
+zone "rt2.example" {
+	type master;
+	file "rt2.db";
+};
+
+zone "naptr2.example" {
+	type master;
+	file "naptr2.db";
+};
+
+zone "nid.example" {
+	type master;
+	file "nid.db";
+};
@@ -0,0 +1,23 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+$TTL 86400
+@ IN SOA ns1 hostmaster ( 2 8H 2H 4W 1D );
+    NS ns1
+ns1 A 127.0.0.0
+
+nap IN NAPTR 50 50 "S" "SIPS+D2T" "" server
+server SRV 0 0 5061 server
+server A 192.168.2.9
+server AAAA 192::9
@@ -0,0 +1,23 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+$TTL 86400
+@ IN SOA ns1 hostmaster ( 2 8H 2H 4W 1D );
+    NS ns1
+ns1 A 127.0.0.0
+
+nap IN NAPTR 50 50 "S" "SIPS+D2T" "" server.hang3a.zone.
+www AAAA 192::99
+www A 192.168.2.99
+www X25 100099
@@ -0,0 +1,24 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+$TTL 86400
+@ IN SOA ns1 hostmaster ( 2 8H 2H 4W 1D );
+    NS ns1
+ns1 A 127.0.0.0
+
+ns1 NID 2 0:0:0:0
+ns1 L64 2 0:0:0:0
+ns1 L32 2 0.0.0.0
+nid2 NID 2 0:0:0:1
+nid2 LP 2 ns1
@@ -0,0 +1,23 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+$TTL 86400
+@ IN SOA ns1 hostmaster ( 2 8H 2H 4W 1D );
+    NS ns1
+ns1 A 127.0.0.0
+
+rt RT 2 www
+www AAAA 192::99
+www A 192.168.2.99
+www X25 100099
@@ -0,0 +1,23 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+$TTL 86400
+@ IN SOA ns1 hostmaster ( 2 8H 2H 4W 1D );
+    NS ns1
+ns1 A 127.0.0.0
+
+rt RT 2 www.hang3b.zone.
+server SRV 0 0 5061 server
+server A 192.168.2.9
+server AAAA 192::9
@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+cp -f ns1/named1.conf ns1/named.conf
@@ -0,0 +1,121 @@
+#!/bin/sh
+#
+# Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: tests.sh,v 1.7 2011/11/06 23:46:40 tbox Exp $
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+status=0
+n=0
+
+dotests() {
+    n=`expr $n + 1`
+    echo "I:test with RT, single zone ($n)"
+    ret=0
+    $DIG -t RT rt.rt.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+    if [ $ret -eq 1 ] ; then
+            echo "I: failed"; status=1
+    fi
+
+    n=`expr $n + 1`
+    echo "I:test with RT, two zones ($n)"
+    ret=0
+    $DIG -t RT rt.rt2.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+    if [ $ret -eq 1 ] ; then
+            echo "I: failed"; status=1
+    fi
+
+    n=`expr $n + 1`
+    echo "I:test with NAPTR, single zone ($n)"
+    ret=0
+    $DIG -t NAPTR nap.naptr.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+    if [ $ret -eq 1 ] ; then
+            echo "I: failed"; status=1
+    fi
+
+    n=`expr $n + 1`
+    echo "I:test with NAPTR, two zones ($n)"
+    ret=0
+    $DIG -t NAPTR nap.hang3b.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+    if [ $ret -eq 1 ] ; then
+            echo "I: failed"; status=1
+    fi
+
+    n=`expr $n + 1`
+    echo "I:test with LP ($n)"
+    ret=0
+    $DIG -t LP nid2.nid.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+    if [ $minimal = no ] ; then
+      grep "L64" dig.out.$n > /dev/null || ret=1
+      grep "L32" dig.out.$n > /dev/null || ret=1
+    else
+      grep "L64" dig.out.$n > /dev/null && ret=1
+      grep "L32" dig.out.$n > /dev/null && ret=1
+    fi
+    if [ $ret -eq 1 ] ; then
+            echo "I: failed"; status=1
+    fi
+
+    n=`expr $n + 1`
+    echo "I:test with NID ($n)"
+    ret=0
+    $DIG -t NID ns1.nid.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+    if [ $minimal = no ] ; then
+      # change && to || when we support NID additional processing
+      grep "L64" dig.out.$n > /dev/null && ret=1
+      grep "L32" dig.out.$n > /dev/null && ret=1
+    else
+      grep "L64" dig.out.$n > /dev/null && ret=1
+      grep "L32" dig.out.$n > /dev/null && ret=1
+    fi
+    if [ $ret -eq 1 ] ; then
+            echo "I: failed"; status=1
+    fi
+
+    n=`expr $n + 1`
+    echo "I:test with NID + LP ($n)"
+    ret=0
+    $DIG -t NID nid2.nid.example @10.53.0.1 -p 5300 > dig.out.$n || ret=1
+    if [ $minimal = no ] ; then
+      # change && to || when we support NID additional processing
+      grep "LP" dig.out.$n > /dev/null && ret=1
+      grep "L64" dig.out.$n > /dev/null && ret=1
+      grep "L32" dig.out.$n > /dev/null && ret=1
+    else
+      grep "LP" dig.out.$n > /dev/null && ret=1
+      grep "L64" dig.out.$n > /dev/null && ret=1
+      grep "L32" dig.out.$n > /dev/null && ret=1
+    fi
+    if [ $ret -eq 1 ] ; then
+            echo "I: failed"; status=1
+    fi
+}
+
+echo "I:testing with 'minimal-responses yes;'"
+minimal=yes
+dotests
+
+echo "I:reconfiguring server"
+cp ns1/named2.conf ns1/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig 2>&1 | sed 's/^/I:ns1 /'
+sleep 2
+
+echo "I:testing with 'minimal-responses no;'"
+minimal=no
+dotests
+
+exit $status
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+controls { /* empty */ };
+
+options {
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+        recursion no;
+};
+
+include "../../common/controls.conf";
+
+view "internal" {
+	allow-query-on { any; };
+
+	zone "." {
+		type hint;
+		file "../../common/root.hint";
+	};
+
+	zone "normal.example" {
+		type master;
+		file "normal.db";
+	};
+
+	zone "aclnotallow.example" {
+		type master;
+		file "aclnotallow.db";
+		allow-query-on { none; };
+	};
+};
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -612,6 +612,23 @@ grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+# Test 57 - zones over views, zones disallow, query refused (allow-query-on)
+n=`expr $n + 1`
+cp -f ns2/named57.conf ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
+sleep 5
+
+echo "I:test $n: zones over views, allow-query-on"
+ret=0
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.1.$n || ret=1
+grep 'status: NOERROR' dig.out.ns2.1.$n > /dev/null || ret=1
+grep '^a.normal.example' dig.out.ns2.1.$n > /dev/null || ret=1
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclnotallow.example a > dig.out.ns2.2.$n || ret=1
+grep 'status: REFUSED' dig.out.ns2.2.$n > /dev/null || ret=1
+grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status

@@ -107,9 +107,16 @@ $SIG{TERM} = \&rmpid;
 my @rules;
 sub handleUDP {
 	my ($buf) = @_;
+	my $request;

-	my ($request, $err) = new Net::DNS::Packet(\$buf, 0);
-	$err and die $err;
+	if ($Net::DNS::VERSION > 0.68) {
+		$request = new Net::DNS::Packet(\$buf, 0);
+		$@ and die $@;
+	} else {
+		my $err;
+		($request, $err) = new Net::DNS::Packet(\$buf, 0);
+		$err and die $err;
+	}

 	my @questions = $request->question;
 	my $qname = $questions[0]->qname;
@@ -155,11 +162,13 @@ sub handleUDP {
 				# function will attempt to decrement it,
 				# which is incorrect in a response. Finally
 				# we set request_mac to the previous digest.
-				$packet->{"compnames"} = {};
-				$packet->{"header"}{"arcount"} += 1;
+				$packet->{"compnames"} = {}
+					if ($Net::DNS::VERSION < 0.70);
+				$packet->{"header"}{"arcount"} += 1
+					if ($Net::DNS::VERSION < 0.70);
 				if (defined($prev_tsig)) {
 					my $rmac = pack('n H*',
-						$prev_tsig->mac_size,
+						length($prev_tsig->mac)/2,
 						$prev_tsig->mac);
 					$tsig->{"request_mac"} =
 						unpack("H*", $rmac);
@@ -288,9 +297,16 @@ sub sign_tcp_continuation {

 sub handleTCP {
 	my ($buf) = @_;
+	my $request;

-	my ($request, $err) = new Net::DNS::Packet(\$buf, 0);
-	$err and die $err;
+	if ($Net::DNS::VERSION > 0.68) {
+		$request = new Net::DNS::Packet(\$buf, 0);
+		$@ and die $@;
+	} else {
+		my $err;
+		($request, $err) = new Net::DNS::Packet(\$buf, 0);
+		$err and die $err;
+	}
 	
 	my @questions = $request->question;
 	my $qname = $questions[0]->qname;
@@ -306,6 +322,7 @@ sub handleTCP {
 	# get the existing signature if any, and clear the additional section
 	my $prev_tsig;
 	my $signer;
+	my $continuation = 0;
 	while (my $rr = $request->pop("additional")) {
 		if ($rr->type eq "TSIG") {
 			$prev_tsig = $rr;
@@ -342,19 +359,25 @@ sub handleTCP {
 				# function will attempt to decrement it,
 				# which is incorrect in a response. Finally
 				# we set request_mac to the previous digest.
-				$packet->{"compnames"} = {};
-				$packet->{"header"}{"arcount"} += 1;
+				$packet->{"compnames"} = {}
+					if ($Net::DNS::VERSION < 0.70);
+				$packet->{"header"}{"arcount"} += 1
+					if ($Net::DNS::VERSION < 0.70);
 				if (defined($prev_tsig)) {
 					my $rmac = pack('n H*',
-						$prev_tsig->mac_size,
+						length($prev_tsig->mac)/2,
 						$prev_tsig->mac);
 					$tsig->{"request_mac"} =
 						unpack("H*", $rmac);
 				}
 				
 				$tsig->sign_func($signer) if defined($signer);
+				$tsig->continuation($continuation)
+					if ($Net::DNS::VERSION >= 0.71);
 				$packet->sign_tsig($tsig);
-				$signer = \&sign_tcp_continuation;
+				$signer = \&sign_tcp_continuation
+					if ($Net::DNS::VERSION < 0.70);
+				$continuation = 1;

 				my $copy =
 					Net::DNS::Packet->new(\($packet->data));
@@ -1,4 +1,4 @@
-; Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
 ; Copyright (C) 2001  Internet Software Consortium.
 ;
 ; Permission to use, copy, modify, and/or distribute this software for any
@@ -606,7 +606,6 @@ NS0			IN	A	202.12.30.131
 ns1			IN	A	202.12.30.33
 $ORIGIN WIDE.AD.JP.
 NS			IN	A	203.178.136.63
-$ORIGIN co.JP.
 			IN	MX	10 integra.s-integra.co.jp.
 $ORIGIN s-integra.co.JP.
 integra			IN	A	210.162.202.34
@@ -1175,7 +1174,6 @@ $ORIGIN ADVSYS.CO.UK.
 BARNEY			IN	A	194.72.124.2
 $ORIGIN WR.UMIST.AC.UK.
 AARDVARK		IN	A	130.88.146.3
-$ORIGIN UCL.AC.UK.
 			IN	A	128.16.5.31
 			IN	MX	10 bells.cs.ucl.ac.uk.
 			IN	MX	11 haig.cs.ucl.ac.uk.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,6 +14,8 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

+/* $Id$ */
+
 /* Bad secret */
 key "badtsig" {
 	algorithm hmac-md5;
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,4 +14,6 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

+# $Id$
+
 rm -f badzero.conf
@@ -1,4 +1,4 @@
-# Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -24,7 +24,17 @@ for db in zones/good*.db
 do
 	echo "I:checking $db ($n)"
 	ret=0
-	$CHECKZONE example $db > test.out.$n 2>&1 || ret=1
+	$CHECKZONE -i local example $db > test.out.$n 2>&1 || ret=1
+	n=`expr $n + 1`
+	if [ $ret != 0 ]; then echo "I:failed"; fi
+	status=`expr $status + $ret`
+done
+
+for db in zones/bad*.db
+do
+	echo "I:checking $db ($n)"
+	ret=0
+	$CHECKZONE -i local example $db > test.out.$n 2>&1 && ret=1
 	n=`expr $n + 1`
 	if [ $ret != 0 ]; then echo "I:failed"; fi
 	status=`expr $status + $ret`
@@ -35,4 +35,5 @@ status=0
 for d in $SUBDIRS
 do
   test ! -f $d/clean.sh || ( cd $d && sh clean.sh )
+   test -d $d && find $d -type d -exec rmdir '{}' \; 2> /dev/null
 done
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -43,11 +43,12 @@ CHECKCONF=$TOP/bin/check/named-checkconf
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # v6synth
-SUBDIRS="acl allow_query builtin cacheclean checkconf checknames checkzone
-	 database dlv dlz dname dnssec forward glue ixfr
-	 limits logfileconfig lwresd masterfile masterformat notify
-	 nsupdate pending resolver rndc rrsetorder sortlist stub tkey
-	 unknown upforwd views xfer xferquota zonechecks"
+SUBDIRS="acl additional allow_query builtin cacheclean checkconf
+	 checknames checkzone database dlv dlz dname dnssec formerr
+	 forward glue ixfr limits logfileconfig lwresd masterfile
+	 masterformat notify nsupdate pending resolver rndc rrsetorder
+	 sortlist stub tkey unknown upforwd views wildcard xfer
+	 xferquota zonechecks"

 # PERL will be an empty string if no perl interpreter was found.
 PERL=@PERL@
@@ -64,4 +65,4 @@ else
 fi

 export NAMED LWRESD DIG NSUPDATE KEYGEN SIGNER KEYSIGNER KEYSETTOOL PERL \
-    SUBDIRS RNDC CHECKZONE TESTSOCK6
+    SUBDIRS RNDC CHECKZONE TESTSOCK6 SAMPLE
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007, 2008, 2010-2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2008, 2010-2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -34,15 +34,21 @@ rm -f ns3/optout-unknown.example.db ns3/optout.example.db
 rm -f ns3/expired.example.db ns3/update-nsec3.example.db
 rm -f ns7/multiple.example.bk ns7/nsec3.example.bk ns7/optout.example.bk
 rm -f */named.memstats
+rm -f */named.run
 rm -f ns3/nsec3.nsec3.example.db
 rm -f ns3/nsec3.optout.example.db
 rm -f ns3/optout.nsec3.example.db
 rm -f ns3/optout.optout.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
-rm -f signer/example.db
+rm -f signer/*.db
 rm -f ns2/algroll.db
 rm -f signer/example.db.after signer/example.db.before
 rm -f signer/example.db.changed
 rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
 rm -f ns3/secure.below-cname.example.db
+rm -f ns3/expiring.example.db
+rm -f ns6/optout-tld.db
+rm -f nosign.before
+rm -f signing.out*
+rm -f canonical?.*
@@ -1,4 +1,4 @@
-; Copyright (C) 2004, 2007, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2004, 2007, 2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 ; Copyright (C) 2000, 2001  Internet Software Consortium.
 ;
 ; Permission to use, copy, modify, and/or distribute this software for any
@@ -32,3 +32,5 @@ dlv.			NS	ns2.dlv.
 ns2.dlv.		A	10.53.0.2
 algroll			NS	ns2.algroll
 ns2.algroll.		A	10.53.0.2
+optout-tld		NS	ns6.optout-tld.
+ns6.optout-tld.		A	10.53.0.6
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# Copyright (C) 2004, 2006-2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006-2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -27,14 +27,16 @@ infile=root.db.in
 zonefile=root.db

 (cd ../ns2 && sh sign.sh )
+(cd ../ns6 && sh sign.sh )

 cp ../ns2/dsset-example. .
 cp ../ns2/dsset-dlv. .
 grep "8 [12] " ../ns2/dsset-algroll. > dsset-algroll.
+cp ../ns6/dsset-optout-tld. .

 keyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`

-cat $infile $keyname.key dsset-example. dsset-dlv. dsset-algroll. > $zonefile
+cat $infile $keyname.key dsset-example. dsset-dlv. dsset-algroll. dsset-optout-tld. > $zonefile

 $SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null

@@ -44,3 +44,7 @@ ns.nosoa		A	10.53.0.7

 normalthenrrsig		A	10.0.0.28
 rrsigonly		A	10.0.0.29
+
+cnameandkey		CNAME	@
+cnamenokey		CNAME	@
+dnameandkey		DNAME	@
@@ -26,9 +26,11 @@ zone=secure.example.
 infile=secure.example.db.in
 zonefile=secure.example.db

+cnameandkey=`$KEYGEN -k -r $RANDFILE -a RSASHA1 -b 768 -n host cnameandkey.$zone`
+dnameandkey=`$KEYGEN -k -r $RANDFILE -a RSASHA1 -b 768 -n host dnameandkey.$zone`
 keyname=`$KEYGEN -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`

-cat $infile $keyname.key >$zonefile
+cat $infile $cnameandkey.key $dnameandkey.key $keyname.key >$zonefile

 $SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null

@@ -0,0 +1 @@
+-m record,size,mctx -c named.conf -d 99 -g -T nonearest -T clienttest
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007, 2013  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -42,4 +42,9 @@ zone "." {
 	file "../../common/root.hint";
 };

+zone "optout-tld" {
+	type master;
+	file "optout-tld.db.signed";
+};
+
 include "trusted.conf";
@@ -0,0 +1,26 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: example.db.in,v 1.2 2010/06/03 06:29:03 marka Exp $
+$TTL 60
+optout-tld. 60 IN SOA example. . 0 0 0 0 0
+optout-tld. 60 IN NS ns6.optout-tld.
+ns6.optout-tld. 60 IN A 10.53.0.6
+a 60 PTR example.
+b 60 PTR example.
+a.b.c.d 60 NS example.
+e 60 PTR example.
+f 60 PTR example.
+g 60 PTR example.
+h 60 PTR example.
@@ -0,0 +1,32 @@
+#!/bin/sh -e
+#
+# Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: sign.sh,v 1.43 2011/11/04 05:36:28 each Exp $
+
+SYSTEMTESTTOP=../..
+. $SYSTEMTESTTOP/conf.sh
+
+RANDFILE=../random.data
+
+zone=optout-tld
+infile=optout-tld.db.in
+zonefile=optout-tld.db
+
+keyname=`$KEYGEN -r $RANDFILE -a RSASHA256 -b 768 -n zone $zone`
+
+cat $infile $keyname.key >$zonefile
+
+$SIGNER -P -3 - -A -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`-m record,size,mctx -c named.conf -d 99 -g -T nonearest -T clienttest`