regenerate

[v9_6] prep 9.6-ESV-R11rc2
[v9_6] fix config error
2014-01-17 03:23:36 +00:00 · 2014-01-16 19:01:29 -08:00 · 2014-01-16 17:23:51 -08:00 · 2014-01-17 11:18:22 +11:00 · 2014-01-16 23:45:13 +00:00 · 2014-01-17 10:09:53 +11:00
640 changed files with 28460 additions and 18830 deletions
@@ -1,3 +1,328 @@
+	--- 9.6-ESV-R11rc2 released ---
+
+3710.	[bug]		Address double dns_zone_detach when switching to
+			using automatic empty zones from regular zones.
+			[RT #35177]
+
+3706.	[contrib]	queryperf: Fixed a possible integer overflow when
+			printing results. [RT #35182]
+
+3704.	[protocol]	Accept integer timestamps in RRSIG records. [RT #35185]
+
+	--- 9.6-ESV-R11rc1 released ---
+
+3698.	[cleanup]	Replaced all uses of memcpy() with memmove().
+			[RT #35120]
+
+3697.	[bug]		Handle "." as a search list element when IDN support
+			is enabled. [RT #35133]
+
+3696.	[bug]		dig failed to handle AXFR style IXFR responses which
+			span multiple messages. [RT #35137]
+
+3693.	[security]	memcpy was incorrectly called with overlapping
+			ranges resulting in malformed names being generated
+			on some platforms.  This could cause INSIST failures
+			when serving NSEC3 signed zones (CVE-2014-0591).
+			[RT #35120]
+
+3692.	[bug]		Two calls to dns_db_getoriginnode were fatal if there
+			was no data at the node. [RT #35080]
+
+	--- 9.6-ESV-R11b1 released ---
+
+3679.	[bug]		dig could fail to clean up TCP sockets still
+			waiting on connect(). [RT #35074]
+
+3678.	[port]		Update config.guess and config.sub. [RT #35060]
+
+3677.	[bug]		'nsupdate' leaked memory if 'realm' was used multiple
+			times.  [RT #35073]
+
+3676.	[bug]		"named-checkconf -z" now checks zones of type
+			hint as well as master. [RT #35046]
+
+3675.	[misc]		Provide a place for third parties to add version
+			information for their extensions in the version
+			file by setting the EXTENSIONS variable.
+
+3670.	[bug]		Address read after free in server side of
+			lwres_getrrsetbyname. [RT #29075]
+
+3669.	[port]		freebsd: --with-gssapi needs -lhx509. [RT #35001]
+
+3668.	[bug]		Fix cast in lex.c which could see 0xff treated as eof.
+			[RT #34993]
+3667.	[test]		dig: add support to keep the TCP socket open between
+			successive queries (+[no]keepopen).  [RT #34918]
+
+3663.	[bug]		Address bugs in dns_rdata_fromstruct and
+			dns_rdata_tostruct for WKS and ISDN types. [RT #34910]
+
+3662.	[bug]		'host' could die if a UDP query timed out. [RT #34870]
+
+3660.	[cleanup]	Changed the name of "isc-config.sh" to "bind9-config".
+			[RT #23825]
+
+3658.	[port]		linux: Address platform specific compilation issue
+			when libcap-devel is installed. [RT #34838]
+
+3656.	[security]	Treat an all zero netmask as invalid when generating
+			the localnets acl. (The prior behavior could
+			allow unexpected matches when using some versions
+			of Winsock: CVE-2013-6320.) [RT #34687]
+
+3655.	[cleanup]	Simplify TCP message processing when requesting a
+			zone transfer.  [RT #34825]
+
+3654.	[bug]		Address race condition with manual notify requests.
+			[RT #34806]
+
+3653.	[func]		Create delegations for all "children" of empty zones
+			except "forward first". [RT #34826]
+
+3651.	[tuning]	Adjust when a master server is deemed unreachable.
+			[RT #27075]
+
+3650.	[tuning]	Use separate rate limiting queues for refresh and
+			notify requests. [RT #30589]
+
+3648.	[test]		Updated the ATF test framework to version 0.17.
+			[RT #25627]
+
+3646.	[bug]		Journal filename string could be set incorrectly,
+			causing garbage in log messages. [RT #34738]
+
+3645.	[protocol]	Use case sensitive compression when responding to
+			queries. [RT #34737]
+
+3644.	[protocol]	Check that EDNS subnet client options are well formed.
+			[RT #34718]
+
+3641.	[bug]		Handle changes to sig-validity-interval settings
+			better. [RT #34625]
+
+3640.	[bug]		ndots was not being checked when searching.  Only
+			continue searching on NXDOMAIN responses.  Add the
+			ability to specify ndots to nslookup. [RT #34711]
+
+	--- 9.6-ESV-R10 released ---
+
+3638.	[cleanup]	Add the ability to handle ENOPROTOOPT in case it is
+			encountered. [RT #34668]
+
+	--- 9.6-ESV-R10rc2 released ---
+
+3637.	[bug]		'allow-query-on' was checking the source address
+			rather than the destination address. [RT #34590]
+
+3636.	[bug]		Automatic empty zones now behave better with
+			forward only "zones" beneath them. [RT #34583]
+
+3634.	[func]		Report build-id in rndc status. Report build-id
+			when building from a git repository. [RT #20422]
+
+3633.	[cleanup]	Refactor OPT processing in named to make it easier
+			to support new EDNS options. [RT #34414]
+
+3631.	[bug]		Remove spurious warning about missing signatures when
+			qtype is SIG. [RT #34600]
+
+3630.	[bug]		Ensure correct ID computation for MD5 keys. [RT #33033]
+
+3625.	[bug]		Don't send notify messages to machines outside of the
+			test setup.
+
+	--- 9.6-ESV-R10rc1 released ---
+
+3615.	[cleanup]	"configure" now finishes by printing a summary
+			of optional BIND features and whether they are
+			active or inactive. ("configure --enable-full-report"
+			increases the verbosity of the summary.) [RT #31777]
+
+3614.	[port]		Check for <linux/types.h>. [RT #34162]
+
+3611.	[bug]		Improved resistance to a theoretical authentication
+			attack based on differential timing.  [RT #33939]
+
+3608.	[port]		win32: added todos.pl script to ensure all text files
+			the win32 build depends on are converted to DOS
+			newline format. [RT #22067]
+
+	--- 9.6-ESV-R10b1 released ---
+
+3605.	[port]		win32: Addressed several compatibility issues
+			with newer versions of Visual Studio. [RT #33916]
+
+3603.	[bug]		Install <isc/stat.h>. [RT #33956]
+
+3600.	[cleanup]	dig: Fixed a typo in the warning output when receiving
+			an oversized response. [RT #33910]
+
+3599.	[tuning]	Check for pointer equivalence in name comparisons.
+			[RT #18125]
+
+3594.	[maint]		Update config.guess and config.sub. [RT #33816]
+
+3592.	[doc]		Moved documentation of rndc command options to the
+			rndc man page. [RT #33506]
+
+3588.	[bug]		dig: addressed a memory leak in the sigchase code
+			that could cause a shutdown crash.  [RT #33733]
+
+3587.	[func]		'named -g' now checks the logging configuration but
+			does not use it. [RT #33473]
+
+3586.	[bug]		Handle errors in xmlDocDumpFormatMemoryEnc. [RT #33706]
+
+3584.	[security]	Caching data from an incompletely signed zone could
+			trigger an assertion failure in resolver.c
+			(CVE-2013-3919). [RT #33690]
+
+3583.	[bug]		Address memory leak in GSS-API processing [RT #33574]
+
+3581.	[bug]		Changed the tcp-listen-queue default to 10. [RT #33029]
+
+3580.	[bug]		Addressed a possible race in acache.c [RT #33602]
+
+3578.	[bug]		'rndc -c file' now fails if 'file' does not exist.
+			[RT #33571]
+
+3577.	[bug]		Handle zero TTL values better. [RT #33411]
+
+3576.	[bug]		Address a shutdown race when validating. [RT #33573]
+
+3574.	[doc]		The 'hostname' keyword was missing from server-id
+			description in the named.conf man page. [RT #33476]
+
+	--- 9.6-ESV-R9 released ---
+
+3568.	[cleanup]	Add a product description line to the version file,
+			to be reported by named -v/-V. [RT #33366]
+
+3567.	[bug]		Silence clang static analyzer warnings. [RT #33365]
+
+3563.	[contrib]	zone2sqlite failed with some table names. [RT #33375]
+
+3561.	[bug]		dig: issue a warning if an EDNS query returns FORMERR
+			or NOTIMP.  Adjust usage message. [RT #33363]
+
+	--- 9.6-ESV-R9rc2 released ---
+
+3560.	[bug]		isc-config.sh did not honor includedir and libdir
+			when set via configure. [RT #33345]
+
+3559.	[func]		Check that both forms of Sender Policy Framework
+			records exist or do not exist. [RT #33355]
+
+3558.	[bug]		IXFR of a DLZ stored zone was broken. [RT #33331]
+
+3556.	[maint]		Added AAAA for D.ROOT-SERVERS.NET.
+
+3555.	[bug]		Address theoretical race conditions in acache.c
+			(change #3553 was incomplete). [RT #33252]
+
+3553.	[bug]		Address suspected double free in acache. [RT #33252]
+
+3552.	[bug]		Wrong getopt option string for 'nsupdate -r'.
+			[RT #33280]
+
+3549.	[doc]		Documentation for "request-nsid" was missing.
+			[RT #33153]
+
+3548.	[bug]		The NSID request code in resolver.c was broken
+			resulting in invalid EDNS options being sent.
+			[RT #33153]
+
+3547.	[bug]		Some malformed unknown rdata records were not properly
+			detected and rejected. [RT #33129]
+
+3056.	[func]		Added support for URI resource record. [RT #23386]
+
+2565.	[func]		Add support for HIP record.  Includes new functions
+			dns_rdata_hip_first(), dns_rdata_hip_next()
+			and dns_rdata_hip_current().  [RT #19384]
+
+	--- 9.6-ESV-R9rc1 released ---
+
+3546.	[func]		Add EUI48 and EUI64 types. [RT #33082]
+
+3543.	[bug]		Update socket structure before attaching to socket
+			manager after accept. [RT #33084]
+
+3542.	[test]		masterformat system test was broken. [RT #33086]
+
+3541.	[bug]		Parts of libdns were not properly initialized when
+			built in libexport mode. [RT #33028]
+
+3540.	[test]		libt_api: t_info and t_assert were not thread safe.
+
+3539.	[port]		win32: timestamp format didn't match other platforms.
+
+3538.	[test]		Running "make test" now requires loopback interfaces
+			to be set up. [RT #32452]
+
+3535.	[bug]		Minor win32 cleanups. [RT #32962]
+
+3534.	[bug]		Extra text after an embedded NULL was ignored when
+			parsing zone files. [RT #32699]
+
+3533.	[contrib]	query-loc-0.4.0: memory leaks. [RT #32960]
+
+3532.	[contrib]	zkt: fixed buffer overrun, resource leaks. [RT #32960]
+
+3531.	[bug]		win32: A uninitialized value could be returned on out
+			of memory. [RT #32960]
+
+3530.	[contrib]	Better RTT tracking in queryperf. [RT #30128]
+
+3526.	[cleanup]	Set up dependencies for unit tests correctly during
+			build. [RT #32803]
+
+3520.	[bug]		'mctx' was not being referenced counted in some places
+			where it should have been.  [RT #32794]
+
+	--- 9.6-ESV-R9b2 released ---
+
+3517.	[bug]		Reorder destruction to avoid shutdown race. [RT #32777]
+
+3515.	[port]		'%T' is not portable in strftime(). [RT #32763]
+
+3509.	[cleanup]	Added a product line to version file to allow for
+			easy naming of different products (BIND
+			vs BIND ESV, for example). [RT #32755]
+
+3508.	[contrib]	queryperf was incorrectly rejecting the -T option.
+			[RT #32338]
+
+3503.	[doc]		Clarify size_spec syntax. [RT #32449]
+
+3499.	[doc]		Corrected ARM documentation of built-in zones.
+			[RT #32694]
+
+3498.	[bug]		zone statistics for zones which matched a potential
+			empty zone could have their zone-statistics setting
+			overridden.
+
+3489.	[bug]		--enable-developer now turns on ISC_LIST_CHECKINIT.
+			When cloning a rdataset do not copy the link contents.
+			[RT #32651]
+
+3487.	[bug]		Change 3444 was not complete.  There was a additional
+			place where the NOQNAME proof needed to be saved.
+			[RT #32629]
+
+3481.	[cleanup]	Removed use of const const in atf.
+
+3479.	[bug]		Address potential memory leaks in gssapi support
+			code. [RT #32405]
+
+3478.	[port]		Fix a build failure in strict C99 environments
+			[RT #32475]
+
+3474.	[bug]		nsupdate could assert when the local and remote
+			address families didn't match. [RT #22897]
+
 	--- 9.6-ESV-R9b1 released ---

 3465.	[bug]		Handle isolated reserved ports. [RT #31778]
@@ -86,7 +411,7 @@

 3419.	[bug]		Memory leak on validation cancel. [RT #31869]

-3415.	[bug]		named could die with a REQUIRE failure if a valdation
+3415.	[bug]		named could die with a REQUIRE failure if a validation
 			was canceled. [RT #31804]

 3412.	[bug]		Copy timeval structure from control message data.
@@ -162,7 +487,7 @@
 3381.	[contrib]	Update queryperf to support more RR types.
 			[RT #30762]

-3380.	[bug]		named could die if a non-existant master list was
+3380.	[bug]		named could die if a nonexistent master list was
 			referenced in a also-notify. [RT #31004]

 3379.	[bug]		isc_interval_zero and isc_time_epoch should be
@@ -277,8 +602,8 @@
 			bucket lock when finished with a fetch context.
 			[RT #29239]

-3314.	[bug]		The masters list could be updated while refesh_callback
-			and stub_callback were using it. [RT #26732]
+3314.	[bug]		The masters list could be updated while stub_callback
+			or refresh_callback were using it. [RT #26732]

 3313.	[protocol]	Add TLSA record type. [RT #28989]

@@ -1,4 +1,4 @@
-Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.

 Permission to use, copy, modify, and/or distribute this software for any
@@ -1,3 +1,213 @@
+3635.	[bug]		Signatures were not being removed from a zone with
+			only KSK keys for a algorithm. [RT #24439]
+
+3632.	[bug]		Signature from newly inactive keys were not being
+			removed. [RT #32178]
+
+3627.	[bug]		RPZ changes were not effective on slaves. [RT #34450]
+
+3624.	[bug]		Look for 'json_object_new_int64' when looking for a
+			the json library. [RT #34449]
+
+3622.	[tuning]	Eliminate an unnecessary lock when incrementing
+			cache statistics. [RT #34339]
+
+3621.	[security]	Incorrect bounds checking on private type 'keydata'
+			can lead to a remotely triggerable REQUIRE failure
+			(CVE-2013-4854). [RT #34238]
+
+3619.	[bug]		Fixed a bug in RPZ with "recursive-only no;"
+			[RT #33776]
+
+3617.	[bug]		Named was failing to answer queries during
+			"rndc reload" [RT #34098]
+
+3616.	[bug]		Change #3613 was incomplete. [RT #34177]
+
+3613.	[bug]		named could crash when deleting inline-signing
+			zones with "rndc delzone". [RT #34066]
+
+3612.	[port]		Check whether to use -ljson or -ljson-c. [RT #34115]
+
+3610.	[cleanup]	win32: Some executables had been omitted from the
+			installer. [RT #34116]
+
+3609.	[bug]		Corrected a possible deadlock in applications using
+			the export version of the isc_app API. [RT #33967]
+
+3607.	[bug]		dnssec-keygen had broken 'Invalid keyfile' error
+			message. [RT #34045]
+
+3604.	[bug]		Fixed a compile-time error when building with
+			JSON but not XML. [RT #33959]
+
+3602.	[contrib]	Added DLZ Perl module, allowing Perl scripts to
+			integrate with named and serve DNS data.
+			(Contributed by John Eaglesham of Yahoo.)
+
+3601.	[bug]		Added to PKCS#11 openssl patches a value len
+			attribute in DH derive key. [RT #33928]
+
+3598.	[cleanup]	Improved portability of map file code. [RT #33820]
+
+3597.	[bug]		Ensure automatic-resigning heaps are reconstructed
+			when loading zones in map format. [RT #33381]
+
+3596.	[port]		Updated win32 build documentation, added
+			dnssec-verify. [RT #22067]
+
+3595.	[port]		win32: Fix build problems introduced by change #3550.
+			[RT #33807]
+
+3590.	[bug]		When using RRL on recursive servers, defer
+			rate-limiting until after recursion is complete;
+			also, use correct rcode for slipped NXDOMAIN
+			responses.  [RT #33604]
+
+3582.	[bug]		Silence false positive warning regarding missing file
+			directive for inline slave zones.  [RT #33662]
+
+3579.	[maint]		Updates to PKCS#11 openssl patches, supporting
+			versions 0.9.8y, 1.0.0k, 1.0.1e [RT #33463]
+
+3573.	[bug]		"rndc addzone" and "rndc delzone" incorrectly handled
+			zone names containing punctuation marks and other
+			nonstandard characters. [RT #33419]
+
+3571.	[bug]		Address race condition in dns_client_startresolve().
+			[RT #33234]
+
+3570.	[bug]		Check internal pointers are valid when loading map
+			files. [RT #33403]
+
+3569.	[contrib]	Ported mysql DLZ driver to dynamically-loadable
+			module, and added multithread support. [RT #33394]
+
+3564.	[bug]		Improved handling of corrupted map files. [RT #33380]
+
+3557.	[bug]		Reloading redirect zones was broken. [RT #33292]
+
+3554.	[bug]		RRL failed to correctly rate-limit upward
+			referrals and failed to count dropped error
+			responses in the statistics. [RT #33225]
+
+3544.	[contrib]	check5011.pl: Script to report the status of
+			managed keys as recorded in managed-keys.bind.
+			Contributed by Tony Finch <dot@dotat.at>
+
+3551.	[bug]		resolver.querydscp[46] were uninitialized.  [RT #32686]
+
+3545.	[bug]		RRL slip behavior was incorrect when set to 1.
+			[RT #33111]
+
+3537.	[tuning]	Slave zones, when updated, now send NOTIFY messages
+			to peers before being dumped to disk rather than
+			after. [RT #27242]
+
+3527.	[compat]	Add a URI to allow applications to explicitly
+			request a particular XML schema from the statistics
+			channel, returning 404 if not supported. [RT #32481]
+
+3523.	[contrib]	Ported filesystem and ldap DLZ drivers to
+			dynamically-loadable modules, and added the
+			"wildcard" module based on a contribution from
+			Vadim Goncharov <vgoncharov@nic.ru>. [RT #23569]
+
+3522.	[bug]		DLZ lookups could fail to return SERVFAIL when
+			they ought to. [RT #32685]
+
+3521.	[bug]		Address memory leak in opensslecdsa_link.c. [RT #32249]
+
+3518.	[bug]		Increase the size of dns_rrl_key.s.rtype by one bit
+			so that all dns_rrl_rtype_t enum values fit regardless
+			of whether it is teated as signed or unsigned by
+			the compiler. [RT #32792]
+
+3514.	[bug]		The ranges for valid key sizes in ddns-confgen and
+			rndc-confgen were too constrained. Keys up to 512
+			bits are now allowed for most algorithms, and up
+			to 1024 bits for hmac-sha384 and hmac-sha512.
+			[RT #32753]
+
+3511.	[doc]		Improve documentation of redirect zones. [RT #32756]
+
+3507.	[bug]		Statistics channel XSL had a glitch when attempting
+			to chart query data before any queries had been
+			received. [RT #32620]
+
+3505.	[bug]		When setting "max-cache-size" and "max-acache-size",
+			larger values than 4 gigabytes could not be set
+			explicitly, though larger sizes were available
+			when setting cache size to 0. This has been
+			corrected; the full range is now available.
+			[RT #32358]
+
+3500.	[port]		Support NAPTR regular expression validation on
+			all platforms.  [RT #32688]
+
+3493.	[contrib]	Added BDBHPT dynamically-lodable DLZ module,
+			contributed by Mark Goldfinch. [RT #32549]
+
+3492.	[bug]		Fixed a regression in zone loading performance
+			due to lock contention. [RT #30399]
+
+3491.	[bug]		Slave zones using inline-signing must specify a
+			file name. [RT #31946]
+
+3490.	[bug]		When logging RDATA during update, truncate if it's
+			too long. [RT #32365]
+
+3489.	[bug]		--enable-developer now turns on ISC_LIST_CHECKINIT.
+			When cloning a rdataset do not copy the link contents.
+			[RT #32651]
+
+3488.	[bug]		Use after free error with DH generated keys. [RT #32649]
+
+3486.	[bug]		named could crash when using TKEY-negotiated keys
+			that had been deleted and then recreated. [RT #32506]
+
+3485.	[cleanup]	Only compile openssl_gostlink.c if we support GOST.
+
+3484.	[bug]		Some statistics were incorrectly rendered in XML.
+			[RT #32587]
+
+3480.	[bug]		Silence logging noise when setting up zone
+			statistics. [RT #32525]
+
+3476.	[bug]		"rndc zonestatus" could report a spurious "not
+			found" error on inline-signing zones. [RT #29226]
+
+3475.	[cleanup]	Changed name of 'map' zone file format (previously
+			'fast'). [RT #32458]
+
+3473.	[bug]		dnssec-signzone/verify could incorrectly report
+			an error condition due to an empty node above an
+			opt-out delegation lacking an NSEC3. [RT #32072]
+
+3472.	[bug]		The active-connections counter in the socket
+			statistics could underflow. [RT #31747]
+
+3471.	[bug]		The number of UDP dispatches now defaults to
+			the number of CPUs even if -n has been set to
+			a higher value. [RT #30964]
+
+3470.	[bug]		Slave zones could fail to dump when successfully
+			refreshing after an initial failure. [RT #31276]
+
+3469.	[bug]		Handle DLZ lookup failures more gracefully. Improve
+			backward compatibility between versions of DLZ dlopen
+			API. [RT #32275]
+
+3468.	[security]	RPZ rules to generate A records (but not AAAA records)
+			could trigger an assertion failure when used in
+			conjunction with DNS64 (CVE-2012-5689). [RT #32141]
+
+3467.	[bug]		Added checks in dnssec-keygen and dnssec-settime
+			to check for delete date < inactive date. [RT #31719]
+
+3466.	[contrib]	Corrected the DNS_CLIENTINFOMETHODS_VERSION check
+			in DLZ example driver. [RT #32275]
+
 3464.	[maint]		Updates to PKCS#11 openssl patches, supporting
 			versions 0.9.8x, 1.0.0j, 1.0.1c [RT #29749]

@@ -360,6 +570,10 @@

 3122.	[cleanup]	dnssec-settime: corrected usage message. [RT #24664]

+3119.	[bug]		When rolling to a new DNSSEC key, a private-type
+			record could be created and never marked complete.
+			[RT #23253]
+
 3117.	[cleanup]	Remove doc and parser references to the
 			never-implemented 'auto-dnssec create' option.
 			[RT #24533]
@@ -368,6 +582,13 @@
 			following a CNAME that points into the same zone.
 			[RT #24455]

+3114.	[bug]		Retain expired RRSIGs in dynamic zones if key is
+			inactive and there is no replacement key. [RT #23136]
+
+3111.	[bug]		Improved consistency checks for dnssec-enable and
+			dnssec-validation, added test cases to the
+			checkconf system test. [RT #24398]
+
 3108.	[cleanup]	dnssec-signzone: Clarified some error and
 			warning messages; removed #ifdef ALLOW_KSKLESS_ZONES
 			code (use -P instead). [RT #20852]
@@ -399,6 +620,9 @@

 3093.	[bug]		Fix gssapi/kerberos dependencies [RT #23836]

+3092.	[bug]		Signatures for records at the zone apex could go
+			stale due to an incorrect timer setting. [RT #23769]
+
 3091.	[bug]		Fixed a bug in which zone keys that were published
 			and then subsequently activated could fail to trigger
 			automatic signing. [RT #22911]
@@ -426,6 +650,9 @@
 3072.	[bug]		dns_dns64_aaaaok() potential NULL pointer dereference.
 			[RT #20256]

+3070.	[bug]		dnssec-signzone potential NULL pointer dereference.
+			[RT #20256]
+
 3057.	[bug]		"rndc secroots" would abort after the first error
 			and so could miss some views. [RT #23488]

@@ -438,8 +665,15 @@
 			Wait for the initial autosigning to complete
 			before running the rest of the test. [RT #23035]

+3049.	[bug]		Save and restore the gid when creating creating
+			named.pid at startup. [RT #23290]
+
 3048.	[bug]		Fully separate view key mangement. [RT #23419]

+3047.	[bug]		DNSKEY NODATA responses not cached fixed in
+			validator.c. Tests added to dnssec system test.
+			[RT #22908]
+
 3045.	[removed]	Replaced by change #3050.

 3038.	[bug]		Install <dns/rpz.h>.  [RT #23342]
@@ -510,6 +744,11 @@
 2977.	[bug]		'nsupdate -l' report if the session key is missing.
 			[RT #21670]

+2974.	[bug]		Some valid UPDATE requests could fail due to a
+			consistency check examining the existing version
+			of the zone rather than the new version resulting
+			from the UPDATE. [RT #22413]
+
 2973.	[bug]		bind.keys.h was being removed by the "make clean"
 			at the end of configure resulting in build failures
 			where there is very old version of perl installed.
@@ -521,6 +760,9 @@
 2961.	[bug]		Be still more selective about the non-authoritative
 			answers we apply change 2748 to. [RT #22074]

+2958.	[bug]		named failed to start with a missing master file.
+			[RT #22076]
+
 2949.	[bug]		dns_view_setnewzones() contained a memory leak if
 			it was called multiple times. [RT #21942]

@@ -642,6 +884,9 @@
 2832.	[bug]		Modify "struct stat" in lib/export/samples/nsprobe.c
 			to avoid redefinition in some OSs [RT 20831]

+2830.	[bug]		Changing the OPTOUT setting could take multiple
+			passes. [RT #20813]
+
 2829.	[bug]		Fixed potential node inconsistency in rbtdb.c.
 			[RT #20808]

@@ -1,6 +1,6 @@
 Frequently Asked Questions about BIND 9

-Copyright © 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright © 2004-2010, 2013 Internet Systems Consortium, Inc. ("ISC")

 Copyright © 2000-2003 Internet Software Consortium.

@@ -869,7 +869,7 @@ A: If you run Tiger(Mac OS 10.4) or later then this is all you need to do:
   Copy the key statement from /etc/rndc.conf into /etc/rndc.key, e.g.:

   key "rndc-key" {
-           algorithm hmac-md5;
+           algorithm hmac-sha256;
           secret "uvceheVuqf17ZwIcTydddw==";
   };

@@ -1,7 +1,7 @@
 <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
       "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []>
 <!--
- - Copyright (C) 2004-2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -31,6 +31,7 @@
      <year>2009</year>
      <year>2010</year>
      <year>2012</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1565,7 +1566,7 @@ rand_irqs="3 14 15"</programlisting>
 	<informalexample>
 	  <programlisting>
 key "rndc-key" {
-	algorithm hmac-md5;
+	algorithm hmac-sha256;
 	secret "uvceheVuqf17ZwIcTydddw==";
 };</programlisting>
 	</informalexample>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -54,15 +54,31 @@ installdirs:

 install:: isc-config.sh installdirs
 	${INSTALL_SCRIPT} isc-config.sh ${DESTDIR}${bindir}
+	rm -f ${DESTDIR}${bindir}/bind9-config
+	@LN@ ${DESTDIR}${bindir}/isc-config.sh ${DESTDIR}${bindir}/bind9-config
 	${INSTALL_DATA} ${srcdir}/isc-config.sh.1 ${DESTDIR}${mandir}/man1
+	rm -f ${DESTDIR}${mandir}/man1/bind9-config.1
+	@LN@ ${DESTDIR}${mandir}/man1/isc-config.sh.1 ${DESTDIR}${mandir}/man1/bind9-config.1

 tags:
 	rm -f TAGS
 	find lib bin -name "*.[ch]" -print | @ETAGS@ -

-check: test
+test check:
+	@if test -n "`${PERL} ${top_srcdir}/bin/tests/system/testsock.pl 2>&- || echo fail`"; then \
+	echo I: NOTE: The tests were not run because they require that; \
+	echo I:	the IP addresses 10.53.0.1 through 10.53.0.8 are configured; \
+	echo I:	as alias addresses on the loopback interface.  Please run; \
+	echo I:	\'bin/tests/system/ifconfig.sh up\' as root to configure; \
+	echo I:	them, then rerun the tests. Run make force-test to run the; \
+	echo I:	tests anyway.; \
+	exit 1; \
+	fi
+	${MAKE} test-force

-test:
+force-test: test-force
+
+test-force:
 	status=0; \
 	(cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
 	(test -f unit/unittest.sh && $(SHELL) unit/unittest.sh) || status=1; \
@@ -73,5 +89,8 @@ FAQ: FAQ.xml
 	LC_ALL=C ${W3M} -T text/html -dump -cols 72 >$@.tmp
 	mv $@.tmp $@

+unit::
+	sh ${top_srcdir}/unit/unittest.sh
+
 clean::
 	rm -f FAQ.tmp
@@ -45,8 +45,24 @@ BIND 9
 	For a detailed list of user-visible changes from
 	previous releases, see the CHANGES file.

-        For up-to-date release notes and errata, see
-        http://www.isc.org/software/bind9/releasenotes
+	For up-to-date release notes and errata, see
+	http://www.isc.org/software/bind9/releasenotes
+
+BIND 9.6-ESV-R11 (Extended Support Version)
+ 
+	BIND 9.6-ESV-R11 is a maintenance release, fixing bugs in
+	BIND 9.6-ESV-R10, and patches the security flaws described
+	in CVE-2013-6320 and CVE-2014-0591. It also includes the
+	following functional enhancement:
+
+	 - "named" now preserves the capitalization of names when
+	    responding to queries.
+
+BIND 9.6-ESV-R10 (Extended Support Version)
+
+	BIND 9.6-ESV-R10 is a maintenance release, fixing bugs in BIND
+	9.6-ESV-R9, and also patches the security flaw described in
+	CVE-2013-3919.

 BIND 9.6-ESV-R9 (Extended Support Version)

@@ -55,8 +71,8 @@ BIND 9.6-ESV-R9 (Extended Support Version)

 BIND 9.6-ESV-R8 (Extended Support Version)

-        BIND 9.6-ESV-R8 includes several bug fixes and patches security
-        flaws described in CVE-2012-1667, CVE-2012-3817 and CVE-2012-4244.
+	BIND 9.6-ESV-R8 includes several bug fixes and patches security
+	flaws described in CVE-2012-1667, CVE-2012-3817 and CVE-2012-4244.

 BIND 9.6-ESV-R7 (Extended Support Version)

@@ -81,21 +97,21 @@ BIND 9.6.3/BIND 9.6-ESV-R4
 BIND 9.6.2

 	BIND 9.6.2 is a maintenance release, fixing bugs in 9.6.1.
-        It also introduces support for the SHA-2 DNSSEC algorithms,
-        RSASHA256 and RSASHA512.
+	It also introduces support for the SHA-2 DNSSEC algorithms,
+	RSASHA256 and RSASHA512.

-        Known issues in this release:
+	Known issues in this release:

-        - A validating resolver that has been incorrectly configured with
-          an invalid trust anchor will be unable to resolve names covered
-          by that trust anchor.  In all current versions of BIND 9, such a
-          resolver will also generate significant unnecessary DNS traffic
-          while trying to validate.  The latter problem will be addressed
-          in future BIND 9 releases.  In the meantime, to avoid these
-          problems, exercise caution when configuring "trusted-keys":
-          make sure all keys are correct and current when you add them,
-          and update your configuration in a timely manner when keys
-          roll over.
+	- A validating resolver that has been incorrectly configured with
+	  an invalid trust anchor will be unable to resolve names covered
+	  by that trust anchor.  In all current versions of BIND 9, such a
+	  resolver will also generate significant unnecessary DNS traffic
+	  while trying to validate.  The latter problem will be addressed
+	  in future BIND 9 releases.  In the meantime, to avoid these
+	  problems, exercise caution when configuring "trusted-keys":
+	  make sure all keys are correct and current when you add them,
+	  and update your configuration in a timely manner when keys
+	  roll over.

 BIND 9.6.1

@@ -103,17 +119,17 @@ BIND 9.6.1

 BIND 9.6.0

-        BIND 9.6.0 includes a number of changes from BIND 9.5 and earlier
-        releases, including:
+	BIND 9.6.0 includes a number of changes from BIND 9.5 and earlier
+	releases, including:

-        Full NSEC3 support
+	Full NSEC3 support

-        Automatic zone re-signing
+	Automatic zone re-signing

 	New update-policy methods tcp-self and 6to4-self

-        The BIND 8 resolver library, libbind, has been removed from the
-        BIND 9 distribution and is now available as a separate download.
+	The BIND 8 resolver library, libbind, has been removed from the
+	BIND 9 distribution and is now available as a separate download.

 	Change the default pid file location from /var/run to
 	/var/run/{named,lwresd} for improved chroot/setuid support.
@@ -135,9 +151,9 @@ BIND 9.5.0

 	Use Doxygen to generate internal documentation.

-        Efficient LRU cache-cleaning mechanism.
+	Efficient LRU cache-cleaning mechanism.

-        NSID support.
+	NSID support.

 BIND 9.4.0

@@ -346,28 +362,28 @@ BIND 9.2.0
 	including:

 	  - The size of the cache can now be limited using the
-            "max-cache-size" option.
+	    "max-cache-size" option.

 	  - The server can now automatically convert RFC1886-style
 	    recursive lookup requests into RFC2874-style lookups, 
 	    when enabled using the new option "allow-v6-synthesis".
-            This allows stub resolvers that support AAAA records
-            but not A6 record chains or binary labels to perform
-            lookups in domains that make use of these IPv6 DNS
-            features.
+	    This allows stub resolvers that support AAAA records
+	    but not A6 record chains or binary labels to perform
+	    lookups in domains that make use of these IPv6 DNS
+	    features.

 	  - Performance has been improved.

 	  - The man pages now use the more portable "man" macros
 	    rather than the "mandoc" macros, and are installed
-            by "make install".
+	    by "make install".

-          - The named.conf parser has been completely rewritten.
-            It now supports "include" directives in more
-            places such as inside "view" statements, and it no
-            longer has any reserved words.
+	  - The named.conf parser has been completely rewritten.
+	    It now supports "include" directives in more
+	    places such as inside "view" statements, and it no
+	    longer has any reserved words.

-          - The "rndc status" command is now implemented.
+	  - The "rndc status" command is now implemented.

 	  - rndc can now be configured automatically.

@@ -430,7 +446,7 @@ BIND 9.2.0
 		--with-libtool does not work on AIX.

 	A bug in some versions of the Microsoft DNS server can cause zone
-        transfers from a BIND 9 server to a W2K server to fail.  For details,
+	transfers from a BIND 9 server to a W2K server to fail.  For details,
 	see the "Zone Transfers" section in doc/misc/migration.


@@ -452,9 +468,9 @@ Building
 		Ubuntu 7.04, 7.10
 		Windows XP/2003/2008

-        NOTE:  As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of
-        Windows, including Windows NT and Windows 2000, are no longer
-        supported.
+	NOTE:  As of BIND 9.5.1, 9.4.3, and 9.3.6, older versions of
+	Windows, including Windows NT and Windows 2000, are no longer
+	supported.

 	We have recent reports from the user community that a supported
 	version of BIND will build and run on the following systems:
@@ -507,7 +523,7 @@ Building
 				    -DDIG_SIGCHASE_BU=1)
 		Disable dropping queries from particular well known ports.
 		  -DNS_CLIENT_DROPPORT=0
-	        Sibling glue checking in named-checkzone is enabled by default.
+		Sibling glue checking in named-checkzone is enabled by default.
 		To disable the default check set.  -DCHECK_SIBLING=0
 		named-checkzone checks out-of-zone addresses by default.
 		To disable this default set.  -DCHECK_LOCAL=0
@@ -554,10 +570,10 @@ Building
 	on the configure command line.  The default is operating
 	system dependent.

-        Support for the "fixed" rrset-order option can be enabled
-        or disabled by specifying "--enable-fixed-rrset" or
-        "--disable-fixed-rrset" on the configure command line.
-        The default is "disabled", to reduce memory footprint.
+	Support for the "fixed" rrset-order option can be enabled
+	or disabled by specifying "--enable-fixed-rrset" or
+	"--disable-fixed-rrset" on the configure command line.
+	The default is "disabled", to reduce memory footprint.

 	If your operating system has integrated support for IPv6, it
 	will be used automatically.  If you have installed KAME IPv6
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -39,10 +39,13 @@

 #include <bind9/check.h>

+#include <dns/db.h>
 #include <dns/fixedname.h>
 #include <dns/log.h>
 #include <dns/name.h>
+#include <dns/rdataclass.h>
 #include <dns/result.h>
+#include <dns/rootns.h>
 #include <dns/zone.h>

 #include "check-tool.h"
@@ -151,6 +154,30 @@ config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	}
 }

+static isc_result_t
+configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_rdataclass_t rdclass;
+	isc_textregion_t r;
+
+	if (zfile == NULL)
+		return (ISC_R_FAILURE);
+
+	DE_CONST(zclass, r.base);
+	r.length = strlen(zclass);
+	result = dns_rdataclass_fromtext(&rdclass, &r);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	result = dns_rootns_create(mctx, rdclass, zfile, &db);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	dns_db_detach(&db);
+	return (ISC_R_SUCCESS);
+}
+
 /*% configure the zone */
 static isc_result_t
 configure_zone(const char *vclass, const char *view,
@@ -161,7 +188,7 @@ configure_zone(const char *vclass, const char *view,
 	isc_result_t result;
 	const char *zclass;
 	const char *zname;
-	const char *zfile;
+	const char *zfile = NULL;
 	const cfg_obj_t *maps[4];
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *classobj = NULL;
@@ -195,15 +222,26 @@ configure_zone(const char *vclass, const char *view,
 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL)
 		return (ISC_R_FAILURE);
-	if (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0)
+
+	cfg_map_get(zoptions, "file", &fileobj);
+	if (fileobj != NULL)
+		zfile = cfg_obj_asstring(fileobj);
+
+	/*
+	 * Check hints files for hint zones.
+	 * Skip loading checks for any type other than master.
+	 */
+	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0)
+		return (configure_hint(zfile, zclass, mctx));
+	else if ((strcasecmp(cfg_obj_asstring(typeobj), "master") != 0))
 		return (ISC_R_SUCCESS);
+
+	if (zfile == NULL)
+		return (ISC_R_FAILURE);
+
 	cfg_map_get(zoptions, "database", &dbobj);
 	if (dbobj != NULL)
 		return (ISC_R_SUCCESS);
-	cfg_map_get(zoptions, "file", &fileobj);
-	if (fileobj == NULL)
-		return (ISC_R_FAILURE);
-	zfile = cfg_obj_asstring(fileobj);

 	obj = NULL;
 	if (get_maps(maps, "check-mx", &obj)) {
@@ -276,6 +314,18 @@ configure_zone(const char *vclass, const char *view,
 			zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
 	}

+	obj = NULL;
+	if (get_maps(maps, "check-spf", &obj)) {
+		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
+			zone_options |= DNS_ZONEOPT_CHECKSPF;
+		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
+			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
+		} else
+			INSIST(0);
+	} else {
+		zone_options |= DNS_ZONEOPT_CHECKSPF;
+	}
+
 	obj = NULL;
 	if (get_checknames(maps, &obj)) {
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
@@ -311,7 +361,7 @@ configure_zone(const char *vclass, const char *view,
 	if (result != ISC_R_SUCCESS)
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			dns_result_totext(result));
-	return(result);
+	return (result);
 }

 /*% configure a view */
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -33,9 +33,9 @@
 named\-checkzone, named\-compilezone \- zone file validity checking or converting tool
 .SH "SYNOPSIS"
 .HP 16
-\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-h\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
+\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-h\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
 .HP 18
-\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {\fB\-o\ \fR\fB\fIfilename\fR\fR} {zonename} {filename}
+\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {\fB\-o\ \fR\fB\fIfilename\fR\fR} {zonename} {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkzone\fR
@@ -227,6 +227,14 @@ Chroot to
 so that include directives in the configuration file are processed as if run by a similarly chrooted named.
 .RE
 .PP
+\-T \fImode\fR
+.RS 4
+Check if Sender Policy Framework records (TXT and SPF) both exist or both don't exist. A warning is issued if they don't match. Possible modes are
+\fB"warn"\fR
+(default),
+\fB"ignore"\fR.
+.RE
+.PP
 \-w \fIdirectory\fR
 .RS 4
 chdir to
@@ -272,7 +280,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007, 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -144,17 +144,19 @@ main(int argc, char **argv) {
 	if (progmode == progmode_compile) {
 		zone_options |= (DNS_ZONEOPT_CHECKNS |
 				 DNS_ZONEOPT_FATALNS |
+				 DNS_ZONEOPT_CHECKSPF |
 				 DNS_ZONEOPT_CHECKNAMES |
 				 DNS_ZONEOPT_CHECKNAMESFAIL |
 				 DNS_ZONEOPT_CHECKWILDCARD);
-	}
+	} else
+		zone_options |= DNS_ZONEOPT_CHECKSPF;

 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)

 	isc_commandline_errprint = ISC_FALSE;

 	while ((c = isc_commandline_parse(argc, argv,
-					 "c:df:hi:jk:m:n:qs:t:o:vw:DF:M:S:W:"))
+				       "c:df:hi:jk:m:n:qs:t:o:vw:DF:M:S:T:W:"))
 	       != EOF) {
 		switch (c) {
 		case 'c':
@@ -343,6 +345,18 @@ main(int argc, char **argv) {
 			}
 			break;

+		case 'T':
+			if (ARGCMP("warn")) {
+				zone_options |= DNS_ZONEOPT_CHECKSPF;
+			} else if (ARGCMP("ignore")) {
+				zone_options &= ~DNS_ZONEOPT_CHECKSPF;
+			} else {
+				fprintf(stderr, "invalid argument to -T: %s\n",
+					isc_commandline_argument);
+				exit(1);
+			}
+			break;
+
 		case 'W':
 			if (ARGCMP("warn"))
 				zone_options |= DNS_ZONEOPT_CHECKWILDCARD;
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2007, 2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -38,6 +38,7 @@
      <year>2007</year>
      <year>2009</year>
      <year>2012</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -73,6 +74,7 @@
      <arg><option>-s <replaceable class="parameter">style</replaceable></option></arg>
      <arg><option>-S <replaceable class="parameter">mode</replaceable></option></arg>
      <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
+      <arg><option>-T <replaceable class="parameter">mode</replaceable></option></arg>
      <arg><option>-w <replaceable class="parameter">directory</replaceable></option></arg>
      <arg><option>-D</option></arg>
      <arg><option>-W <replaceable class="parameter">mode</replaceable></option></arg>
@@ -96,6 +98,7 @@
      <arg><option>-o <replaceable class="parameter">filename</replaceable></option></arg>
      <arg><option>-s <replaceable class="parameter">style</replaceable></option></arg>
      <arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
+      <arg><option>-T <replaceable class="parameter">mode</replaceable></option></arg>
      <arg><option>-w <replaceable class="parameter">directory</replaceable></option></arg>
      <arg><option>-D</option></arg>
      <arg><option>-W <replaceable class="parameter">mode</replaceable></option></arg>
@@ -364,6 +367,18 @@
        </listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-T <replaceable class="parameter">mode</replaceable></term>
+	<listitem>
+	  <para>
+	    Check if Sender Policy Framework records (TXT and SPF)
+	    both exist or both don't exist.  A warning is issued
+	    if they don't match.  Possible modes are
+	    <command>"warn"</command> (default), <command>"ignore"</command>.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
        <term>-w <replaceable class="parameter">directory</replaceable></term>
        <listitem>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007, 2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -29,11 +29,11 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
-<div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
+<div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
+<div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543677"></a><h2>DESCRIPTION</h2>
+<a name="id2543698"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
      checks the syntax and integrity of a zone file.  It performs the
      same checks as <span><strong class="command">named</strong></span> does when loading a
@@ -53,7 +53,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543713"></a><h2>OPTIONS</h2>
+<a name="id2543733"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -206,6 +206,13 @@
            directives in the configuration file are processed as if
            run by a similarly chrooted named.
          </p></dd>
+<dt><span class="term">-T <em class="replaceable"><code>mode</code></em></span></dt>
+<dd><p>
+	    Check if Sender Policy Framework records (TXT and SPF)
+	    both exist or both don't exist.  A warning is issued
+	    if they don't match.  Possible modes are
+	    <span><strong class="command">"warn"</strong></span> (default), <span><strong class="command">"ignore"</strong></span>.
+	  </p></dd>
 <dt><span class="term">-w <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
            chdir to <code class="filename">directory</code> so that
@@ -239,14 +246,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544333"></a><h2>RETURN VALUES</h2>
+<a name="id2544377"></a><h2>RETURN VALUES</h2>
 <p><span><strong class="command">named-checkzone</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544345"></a><h2>SEE ALSO</h2>
+<a name="id2544389"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
      <em class="citetitle">RFC 1035</em>,
@@ -254,7 +261,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544446"></a><h2>AUTHOR</h2>
+<a name="id2544422"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -20,11 +20,11 @@
 .\"     Title: dig
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
-.\"      Date: Jun 30, 2000
+.\"      Date: June 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
 .\"
-.TH "DIG" "1" "Jun 30, 2000" "BIND9" "BIND9"
+.TH "DIG" "1" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -57,7 +57,7 @@ allows multiple lookups to be issued from the command line.
 Unless it is told to query a specific name server,
 \fBdig\fR
 will try each of the servers listed in
-\fI/etc/resolv.conf\fR. If no usable server addreses are found,
+\fI/etc/resolv.conf\fR. If no usable server addresses are found,
 \fBdig\fR
 will send the query to the local host.
 .PP
@@ -509,6 +509,12 @@ When chasing DNSSEC signature chains perform a top\-down validation. Requires di
 .RS 4
 Include an EDNS name server ID request when sending a query.
 .RE
+.PP
+\fB+[no]keepopen\fR
+.RS 4
+Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup. The default is
+\fB+nokeepopen\fR.
+.RE
 .SH "MULTIPLE QUERIES"
 .PP
 The BIND 9 implementation of
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -185,7 +185,7 @@ help(void) {
 "                 +domain=###         (Set default domainname)\n"
 "                 +bufsize=###        (Set EDNS0 Max UDP packet size)\n"
 "                 +ndots=###          (Set NDOTS value)\n"
-"                 +edns=###           (Set EDNS version)\n"
+"                 +[no]edns[=###]     (Set EDNS version) [0]\n"
 "                 +[no]search         (Set whether to use searchlist)\n"
 "                 +[no]showsearch     (Search with intermediate results)\n"
 "                 +[no]defname        (Ditto)\n"
@@ -223,6 +223,7 @@ help(void) {
 #endif
 #endif
 "                 +[no]multiline      (Print records in an expanded format)\n"
+"                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
 "        local d-opts and servers (after host name) affect only that lookup.\n"
 "        -h                           (print help and exit)\n"
@@ -253,7 +254,7 @@ received(int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 		time(&tnow);
 		tmnow  = *localtime(&tnow);
 		if (strftime(time_str, sizeof(time_str),
-			     "%a %b %d %T %Z %Y", &tmnow) > 0U)
+			     "%a %b %d %H:%M:%S %Z %Y", &tmnow) > 0U)
 			printf(";; WHEN: %s\n", time_str);
 		if (query->lookup->doing_xfr) {
 			printf(";; XFR size: %u records (messages %u, "
@@ -524,8 +525,16 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 				printf(";; WARNING: recursion requested "
 				       "but not available\n");
 		}
+		if (msg != query->lookup->sendmsg &&
+		    query->lookup->edns != -1 && msg->opt == NULL &&
+		    (msg->rcode == dns_rcode_formerr ||
+		     msg->rcode == dns_rcode_notimp))
+			printf("\n;; WARNING: EDNS query returned status "
+			       "%s - retry with '%s+noedns'\n",
+			       rcode_totext(msg->rcode),
+			       query->lookup->dnssec ? "+nodnssec ": "");
 		if (msg != query->lookup->sendmsg && extrabytes != 0U)
-			printf(";; WARNING: Messages has %u extra byte%s at "
+			printf(";; WARNING: Message has %u extra byte%s at "
 			       "end\n", extrabytes, extrabytes != 0 ? "s" : "");
 	}

@@ -854,8 +863,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			lookup->edns = -1;
 			break;
 		}
-		if (value == NULL)
-			goto need_value;
+		if (value == NULL) {
+			lookup->edns = 0;
+			break;
+		}
 		lookup->edns = (isc_int16_t) parse_uint(value, "edns", 255);
 		break;
 	case 'f': /* fail */
@@ -874,6 +885,10 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 			lookup->ignore = ISC_TRUE;
 		}
 		break;
+	case 'k':
+		FULLCHECK("keepopen");
+		keep_open = state;
+		break;
 	case 'm': /* multiline */
 		FULLCHECK("multiline");
 		multiline = state;
@@ -22,7 +22,7 @@
 <refentry id="man.dig">

  <refentryinfo>
-    <date>Jun 30, 2000</date>
+    <date>June 30, 2000</date>
  </refentryinfo>

  <refmeta>
@@ -118,7 +118,7 @@
    <para>
      Unless it is told to query a specific name server,
      <command>dig</command> will try each of the servers listed in
-      <filename>/etc/resolv.conf</filename>. If no usable server addreses
+      <filename>/etc/resolv.conf</filename>. If no usable server addresses
      are found, <command>dig</command> will send the query to the local
      host.
    </para>
@@ -857,6 +857,16 @@
          </listitem>
        </varlistentry>

+        <varlistentry>
+          <term><option>+[no]keepopen</option></term>
+          <listitem>
+            <para>
+              Keep the TCP socket open between queries and reuse it rather
+	      than creating a new TCP socket for each lookup.  The default
+	      is <option>+nokeepopen</option>.
+            </para>
+          </listitem>
+        </varlistentry>

      </variablelist>

@@ -58,7 +58,7 @@
 <p>
      Unless it is told to query a specific name server,
      <span><strong class="command">dig</strong></span> will try each of the servers listed in
-      <code class="filename">/etc/resolv.conf</code>. If no usable server addreses
+      <code class="filename">/etc/resolv.conf</code>. If no usable server addresses
      are found, <span><strong class="command">dig</strong></span> will send the query to the local
      host.
    </p>
@@ -557,13 +557,19 @@
 <dd><p>
              Include an EDNS name server ID request when sending a query.
            </p></dd>
+<dt><span class="term"><code class="option">+[no]keepopen</code></span></dt>
+<dd><p>
+              Keep the TCP socket open between queries and reuse it rather
+	      than creating a new TCP socket for each lookup.  The default
+	      is <code class="option">+nokeepopen</code>.
+            </p></dd>
 </dl></div>
 <p>

    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545191"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2545208"></a><h2>MULTIPLE QUERIES</h2>
 <p>
      The BIND 9 implementation of <span><strong class="command">dig </strong></span>
      supports
@@ -609,7 +615,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545253"></a><h2>IDN SUPPORT</h2>
+<a name="id2545338"></a><h2>IDN SUPPORT</h2>
 <p>
      If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
@@ -623,14 +629,14 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545344"></a><h2>FILES</h2>
+<a name="id2545361"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 <p><code class="filename">${HOME}/.digrc</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545361"></a><h2>SEE ALSO</h2>
+<a name="id2545378"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -638,7 +644,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545398"></a><h2>BUGS</h2>
+<a name="id2545415"></a><h2>BUGS</h2>
 <p>
      There are probably too many query options.
    </p>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -46,8 +46,10 @@

 #include <dns/byaddr.h>
 #ifdef DIG_SIGCHASE
+#include <dns/callbacks.h>
 #include <dns/dnssec.h>
 #include <dns/ds.h>
+#include <dns/master.h>
 #include <dns/nsec.h>
 #include <isc/random.h>
 #include <ctype.h>
@@ -118,7 +120,8 @@ isc_boolean_t
 	usesearch = ISC_FALSE,
 	showsearch = ISC_FALSE,
 	qr = ISC_FALSE,
-	is_dst_up = ISC_FALSE;
+	is_dst_up = ISC_FALSE,
+	keep_open = ISC_FALSE;
 in_port_t port = 53;
 unsigned int timeout = 0;
 unsigned int extrabytes;
@@ -149,6 +152,9 @@ static void		idn_check_result(idn_result_t r, const char *msg);
 int  idnoptions	= 0;
 #endif

+isc_socket_t *keep = NULL;
+isc_sockaddr_t keepaddr;
+
 /*%
 * Exit Codes:
 *
@@ -172,6 +178,7 @@ isc_boolean_t validated = ISC_TRUE;
 isc_entropy_t *entp = NULL;
 isc_mempool_t *commctx = NULL;
 isc_boolean_t debugging = ISC_FALSE;
+isc_boolean_t debugtiming = ISC_FALSE;
 isc_boolean_t memdebugging = ISC_FALSE;
 char *progname = NULL;
 isc_mutex_t lookup_lock;
@@ -244,11 +251,10 @@ isc_result_t	  prove_nx(dns_message_t * msg, dns_name_t * name,
 			   dns_rdataset_t ** sigrdataset);
 static void	  nameFromString(const char *str, dns_name_t *p_ret);
 int		  inf_name(dns_name_t * name1, dns_name_t * name2);
-isc_result_t	  opentmpkey(isc_mem_t *mctx, const char *file,
-			     char **tempp, FILE **fp);
 isc_result_t	  removetmpkey(isc_mem_t *mctx, const char *file);
 void		  clean_trustedkey(void);
-void		  insert_trustedkey(dst_key_t **key);
+isc_result_t 	  insert_trustedkey(void *arg, dns_name_t *name,
+				    dns_rdataset_t *rdataset);
 #if DIG_SIGCHASE_BU
 isc_result_t	  getneededrr(dns_message_t *msg);
 void		  sigchase_bottom_up(dns_message_t *msg);
@@ -418,7 +424,7 @@ static isc_result_t
 append(const char *text, int len, char **p, char *end) {
 	if (len > end - *p)
 		return (ISC_R_NOSPACE);
-	memcpy(*p, text, len);
+	memmove(*p, text, len);
 	*p += len;
 	return (ISC_R_SUCCESS);
 }
@@ -511,9 +517,15 @@ fatal(const char *format, ...) {
 void
 debug(const char *format, ...) {
 	va_list args;
+	isc_time_t t;

 	if (debugging) {
 		fflush(stdout);
+		if (debugtiming) {
+			TIME_NOW(&t);
+			fprintf(stderr, "%d.%06d: ", isc_time_seconds(&t),
+				isc_time_nanoseconds(&t) / 1000);
+		}
 		va_start(args, format);
 		vfprintf(stderr, format, args);
 		va_end(args);
@@ -1139,12 +1151,14 @@ setup_libs(void) {

 	result = isc_mem_create(0, 0, &mctx);
 	check_result(result, "isc_mem_create");
+	isc_mem_setname(mctx, "dig", NULL);

 	result = isc_taskmgr_create(mctx, 1, 0, &taskmgr);
 	check_result(result, "isc_taskmgr_create");

 	result = isc_task_create(taskmgr, 0, &global_task);
 	check_result(result, "isc_task_create");
+	isc_task_setname(global_task, "dig", NULL);

 	result = isc_timermgr_create(mctx, &timermgr);
 	check_result(result, "isc_timermgr_create");
@@ -1694,6 +1708,9 @@ static isc_boolean_t
 next_origin(dns_message_t *msg, dig_query_t *query) {
 	dig_lookup_t *lookup;
 	dig_searchlist_t *search;
+	dns_fixedname_t fixed;
+	dns_name_t *name;
+	isc_result_t result;

 	UNUSED(msg);

@@ -1708,6 +1725,19 @@ next_origin(dns_message_t *msg, dig_query_t *query) {
 		 * about finding the next entry.
 		 */
 		return (ISC_FALSE);
+
+	/*
+	 * Check for a absolute name or ndots being met.
+	 */
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
+	result = dns_name_fromstring2(name, query->lookup->textname, NULL,
+				      0, NULL);
+	if (result == ISC_R_SUCCESS &&
+	    (dns_name_isabsolute(name) ||
+	     (int)dns_name_countlabels(name) > ndots))
+		return (ISC_FALSE);
+
 	if (query->lookup->origin == NULL && !query->lookup->need_search)
 		/*
 		 * Then we just did rootorg; there's nothing left.
@@ -2118,6 +2148,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->rr_count = 0;
 		query->msg_count = 0;
 		query->byte_count = 0;
+		query->ixfr_axfr = ISC_FALSE;
 		ISC_LIST_INIT(query->recvlist);
 		ISC_LIST_INIT(query->lengthlist);
 		query->sock = NULL;
@@ -2166,8 +2197,10 @@ send_done(isc_task_t *_task, isc_event_t *event) {

 	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
 	      b != NULL;
-	      b = ISC_LIST_HEAD(sevent->bufferlist))
+	      b = ISC_LIST_HEAD(sevent->bufferlist)) {
 		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+		isc_mem_free(mctx, b);
+	}

 	query = event->ev_arg;
 	query->waiting_senddone = ISC_FALSE;
@@ -2322,6 +2355,15 @@ send_tcp_connect(dig_query_t *query) {
 	}

 	INSIST(query->sock == NULL);
+
+	if (keep != NULL && isc_sockaddr_equal(&keepaddr, &query->sockaddr)) {
+		sockcount++;
+		isc_socket_attach(keep, &query->sock);
+		query->waiting_connect = ISC_FALSE;
+		launch_next_query(query, ISC_TRUE);
+		goto search;
+	}
+
 	result = isc_socket_create(socketmgr,
 				   isc_sockaddr_pf(&query->sockaddr),
 				   isc_sockettype_tcp, &query->sock);
@@ -2344,6 +2386,7 @@ send_tcp_connect(dig_query_t *query) {
 	result = isc_socket_connect(query->sock, &query->sockaddr,
 				    global_task, connect_done, query);
 	check_result(result, "isc_socket_connect");
+ search:
 	/*
 	 * If we're at the endgame of a nameserver search, we need to
 	 * immediately bring up all the queries.  Do it here.
@@ -2359,6 +2402,17 @@ send_tcp_connect(dig_query_t *query) {
 	}
 }

+static isc_buffer_t *
+clone_buffer(isc_buffer_t *source) {
+	isc_buffer_t *buffer;
+	buffer = isc_mem_allocate(mctx, sizeof(*buffer));
+	if (buffer == NULL)
+		fatal("memory allocation failure in %s:%d",
+		      __FILE__, __LINE__);
+	*buffer = *source;
+	return (buffer);
+}
+
 /*%
 * Send a UDP packet to the remote nameserver, possible starting the
 * recv action as well.  Also make sure that the timer is running and
@@ -2368,6 +2422,7 @@ static void
 send_udp(dig_query_t *query) {
 	dig_lookup_t *l = NULL;
 	isc_result_t result;
+	isc_buffer_t *sendbuf;

 	debug("send_udp(%p)", query);

@@ -2414,14 +2469,16 @@ send_udp(dig_query_t *query) {
 		debug("recvcount=%d", recvcount);
 	}
 	ISC_LIST_INIT(query->sendlist);
-	ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
+	sendbuf = clone_buffer(&query->sendbuf);
+	ISC_LIST_ENQUEUE(query->sendlist, sendbuf, link);
 	debug("sending a request");
 	TIME_NOW(&query->time_sent);
 	INSIST(query->sock != NULL);
 	query->waiting_senddone = ISC_TRUE;
-	result = isc_socket_sendtov(query->sock, &query->sendlist,
-				    global_task, send_done, query,
-				    &query->sockaddr, NULL);
+	result = isc_socket_sendtov2(query->sock, &query->sendlist,
+				     global_task, send_done, query,
+				     &query->sockaddr, NULL,
+				     ISC_SOCKFLAG_NORETRY);
 	check_result(result, "isc_socket_sendtov");
 	sendcount++;
 }
@@ -2583,6 +2640,7 @@ static void
 launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 	isc_result_t result;
 	dig_lookup_t *l;
+	isc_buffer_t *buffer;

 	INSIST(!free_now);

@@ -2606,9 +2664,15 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 	isc_buffer_putuint16(&query->slbuf, (isc_uint16_t) query->sendbuf.used);
 	ISC_LIST_INIT(query->sendlist);
 	ISC_LINK_INIT(&query->slbuf, link);
-	ISC_LIST_ENQUEUE(query->sendlist, &query->slbuf, link);
-	if (include_question)
-		ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
+	if (!query->first_soa_rcvd) {
+		buffer = clone_buffer(&query->slbuf);
+		ISC_LIST_ENQUEUE(query->sendlist, buffer, link);
+		if (include_question) {
+			buffer = clone_buffer(&query->sendbuf);
+			ISC_LIST_ENQUEUE(query->sendlist, buffer, link);
+		}
+	}
+
 	ISC_LINK_INIT(&query->lengthbuf, link);
 	ISC_LIST_ENQUEUE(query->lengthlist, &query->lengthbuf, link);

@@ -2708,6 +2772,12 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
+	if (keep_open) {
+		if (keep != NULL)
+			isc_socket_detach(&keep);
+		isc_socket_attach(query->sock, &keep);
+		keepaddr = query->sockaddr;
+	}
 	launch_next_query(query, ISC_TRUE);
 	isc_event_free(&event);
 	UNLOCK_LOOKUP;
@@ -2731,6 +2801,9 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 	isc_boolean_t ixfr = query->lookup->rdtype == dns_rdatatype_ixfr;
 	isc_boolean_t axfr = query->lookup->rdtype == dns_rdatatype_axfr;

+	if (ixfr)
+		axfr = query->ixfr_axfr;
+
 	debug("check_for_more_data()");

 	/*
@@ -2779,7 +2852,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 					query->second_rr_rcvd = ISC_TRUE;
 					query->second_rr_serial = 0;
 					debug("got the second rr as nonsoa");
-					axfr = ISC_TRUE;
+					axfr = query->ixfr_axfr = ISC_TRUE;
 					goto next_rdata;
 				}

@@ -3215,7 +3288,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	}

 	if (!l->doing_xfr || l->xfr_q == query) {
-		if (msg->rcode != dns_rcode_noerror &&
+		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
 			if (!next_origin(msg, query) || showsearch) {
 				printmessage(query, msg, ISC_TRUE);
@@ -3486,18 +3559,31 @@ cancel_all(void) {
 	if (current_lookup != NULL) {
 		if (current_lookup->timer != NULL)
 			isc_timer_detach(&current_lookup->timer);
-		q = ISC_LIST_HEAD(current_lookup->q);
-		while (q != NULL) {
-			debug("canceling query %p, belonging to %p",
-			      q, current_lookup);
+		for (q = ISC_LIST_HEAD(current_lookup->q);
+		     q != NULL;
+		     q = nq)
+		{
 			nq = ISC_LIST_NEXT(q, link);
-			if (q->sock != NULL) {
+			debug("canceling pending query %p, belonging to %p",
+			      q, current_lookup);
+			if (q->sock != NULL)
 				isc_socket_cancel(q->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
-			} else {
+			else
+				clear_query(q);
+		}
+		for (q = ISC_LIST_HEAD(current_lookup->connecting);
+		     q != NULL;
+		     q = nq)
+		{
+			nq = ISC_LIST_NEXT(q, clink);
+			debug("canceling connecting query %p, belonging to %p",
+			      q, current_lookup);
+			if (q->sock != NULL)
+				isc_socket_cancel(q->sock, NULL,
+						  ISC_SOCKCANCEL_ALL);
+			else
 				clear_query(q);
-			}
-			q = nq;
 		}
 	}
 	l = ISC_LIST_HEAD(lookup_list);
@@ -3524,6 +3610,8 @@ destroy_libs(void) {
 	isc_result_t result;
 #endif

+	if (keep != NULL)
+		isc_socket_detach(&keep);
 	debug("destroy_libs()");
 	if (global_task != NULL) {
 		debug("freeing task");
@@ -3673,7 +3761,7 @@ output_filter(isc_buffer_t *buffer, unsigned int used_org,
 	fromlen = isc_buffer_usedlength(buffer) - used_org;
 	if (fromlen >= MAXDLEN)
 		return (ISC_R_SUCCESS);
-	memcpy(tmp1, (char *)isc_buffer_base(buffer) + used_org, fromlen);
+	memmove(tmp1, (char *)isc_buffer_base(buffer) + used_org, fromlen);
 	end_with_dot = (tmp1[fromlen - 1] == '.') ? ISC_TRUE : ISC_FALSE;
 	if (absolute && !end_with_dot) {
 		fromlen++;
@@ -3702,7 +3790,7 @@ output_filter(isc_buffer_t *buffer, unsigned int used_org,
 		return (ISC_R_NOSPACE);

 	isc_buffer_subtract(buffer, isc_buffer_usedlength(buffer) - used_org);
-	memcpy(isc_buffer_used(buffer), tmp1, tolen);
+	memmove(isc_buffer_used(buffer), tmp1, tolen);
 	isc_buffer_add(buffer, tolen);

 	return (ISC_R_SUCCESS);
@@ -3722,7 +3810,8 @@ append_textname(char *name, const char *origin, size_t namesize) {
 	if (namelen + 1 + originlen >= namesize)
 		return idn_buffer_overflow;

-	name[namelen++] = '.';
+	if (*origin != '.')
+		name[namelen++] = '.';
 	(void)strcpy(name + namelen, origin);
 	return idn_success;
 }
@@ -3945,17 +4034,35 @@ sigchase_scanname(dns_rdatatype_t type, dns_rdatatype_t covers,
 	return (NULL);
 }

-void
-insert_trustedkey(dst_key_t **keyp)
+isc_result_t
+insert_trustedkey(void *arg, dns_name_t *name, dns_rdataset_t *rdataset)
 {
-	if (*keyp == NULL)
-		return;
-	if (tk_list.nb_tk >= MAX_TRUSTED_KEY)
-		return;
+	isc_result_t result;
+	dst_key_t *key;

-	tk_list.key[tk_list.nb_tk++] = *keyp;
-	*keyp = NULL;
-	return;
+	UNUSED(arg);
+
+	if (rdataset == NULL || rdataset->type != dns_rdatatype_dnskey)
+		return (ISC_R_SUCCESS);
+
+	for (result = dns_rdataset_first(rdataset);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(rdataset)) {
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		isc_buffer_t b;
+
+		dns_rdataset_current(rdataset, &rdata);
+		isc_buffer_init(&b, rdata.data, rdata.length);
+		isc_buffer_add(&b, rdata.length);
+		if (tk_list.nb_tk >= MAX_TRUSTED_KEY)
+			return (ISC_R_SUCCESS);
+		key = NULL;
+		result = dst_key_fromdns(name, rdata.rdclass, &b, mctx, &key);
+		if (result != ISC_R_SUCCESS)
+			continue;
+		tk_list.key[tk_list.nb_tk++] = key;
+	}
+	return (ISC_R_SUCCESS);
 }

 void
@@ -4001,87 +4108,12 @@ removetmpkey(isc_mem_t *mctx, const char *file)
 	return (result);
 }

-isc_result_t
-opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
-	FILE *f = NULL;
-	isc_result_t result;
-	char *tempname = NULL;
-	char *tempnamekey = NULL;
-	int tempnamelen;
-	int tempnamekeylen;
-	char *x;
-	char *cp;
-	isc_uint32_t which;
-
-	while (1) {
-		tempnamelen = strlen(file) + 20;
-		tempname = isc_mem_allocate(mctx, tempnamelen);
-		if (tempname == NULL)
-			return (ISC_R_NOMEMORY);
-		memset(tempname, 0, tempnamelen);
-
-		result = isc_file_mktemplate(file, tempname, tempnamelen);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
-
-		cp = tempname;
-		while (*cp != '\0')
-			cp++;
-		if (cp == tempname) {
-			isc_mem_free(mctx, tempname);
-			return (ISC_R_FAILURE);
-		}
-
-		x = cp--;
-		while (cp >= tempname && *cp == 'X') {
-			isc_random_get(&which);
-			*cp = alphnum[which % (sizeof(alphnum) - 1)];
-			x = cp--;
-		}
-
-		tempnamekeylen = tempnamelen+5;
-		tempnamekey = isc_mem_allocate(mctx, tempnamekeylen);
-		if (tempnamekey == NULL)
-			return (ISC_R_NOMEMORY);
-
-		memset(tempnamekey, 0, tempnamekeylen);
-		strlcpy(tempnamekey, tempname, tempnamelen);
-		strcat(tempnamekey ,".key");
-
-
-		if (isc_file_exists(tempnamekey)) {
-			isc_mem_free(mctx, tempnamekey);
-			isc_mem_free(mctx, tempname);
-			continue;
-		}
-
-		if ((f = fopen(tempnamekey, "w")) == NULL) {
-			printf("get_trusted_key(): trusted key not found %s\n",
-			       tempnamekey);
-			return (ISC_R_FAILURE);
-		}
-		break;
-	}
-	isc_mem_free(mctx, tempnamekey);
-	*tempp = tempname;
-	*fp = f;
-	return (ISC_R_SUCCESS);
-
- cleanup:
-	isc_mem_free(mctx, tempname);
-
-	return (result);
-}
-
 isc_result_t
 get_trusted_key(isc_mem_t *mctx)
 {
 	isc_result_t result;
 	const char *filename = NULL;
-	char *filetemp = NULL;
-	char buf[1500];
-	FILE *fp, *fptemp;
-	dst_key_t *key = NULL;
+	dns_rdatacallbacks_t callbacks;

 	result = isc_file_exists(trustedkey);
 	if (result !=  ISC_TRUE) {
@@ -4102,40 +4134,11 @@ get_trusted_key(isc_mem_t *mctx)
 		return (ISC_R_FAILURE);
 	}

-	if ((fp = fopen(filename, "r")) == NULL) {
-		printf("get_trusted_key(): trusted key not found %s\n",
-		       filename);
-		return (ISC_R_FAILURE);
-	}
-	while (fgets(buf, sizeof(buf), fp) != NULL) {
-		result = opentmpkey(mctx,"tmp_file", &filetemp, &fptemp);
-		if (result != ISC_R_SUCCESS) {
-			fclose(fp);
-			return (ISC_R_FAILURE);
-		}
-		if (fputs(buf, fptemp) < 0) {
-			fclose(fp);
-			fclose(fptemp);
-			return (ISC_R_FAILURE);
-		}
-		fclose(fptemp);
-		result = dst_key_fromnamedfile(filetemp, DST_TYPE_PUBLIC,
-					       mctx, &key);
-		removetmpkey(mctx, filetemp);
-		isc_mem_free(mctx, filetemp);
-		if (result !=  ISC_R_SUCCESS) {
-			fclose(fp);
-			return (ISC_R_FAILURE);
-		}
-#if 0
-		dst_key_tofile(key, DST_TYPE_PUBLIC,"/tmp");
-#endif
-		insert_trustedkey(&key);
-		if (key != NULL)
-			dst_key_free(&key);
-	}
-	fclose(fp);
-	return (ISC_R_SUCCESS);
+	dns_rdatacallbacks_init_stdio(&callbacks);
+	callbacks.add = insert_trustedkey;
+	return (dns_master_loadfile(filename, dns_rootname, dns_rootname,
+				    current_lookup->rdclass, 0, &callbacks,
+				    mctx));
 }


@@ -4149,7 +4152,7 @@ nameFromString(const char *str, dns_name_t *p_ret) {
 	REQUIRE(p_ret != NULL);
 	REQUIRE(str != NULL);

-	isc_buffer_init(&buffer, str, len);
+	isc_buffer_constinit(&buffer, str, len);
 	isc_buffer_add(&buffer, len);

 	dns_fixedname_init(&fixedname);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -638,6 +638,8 @@ pre_parse_args(int argc, char **argv) {
 		case 'w': break;
 		case 'C': break;
 		case 'D':
+			if (debugging)
+				debugtiming = ISC_TRUE;
 			debugging = ISC_TRUE;
 			break;
 		case 'N': break;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -202,6 +202,7 @@ struct dig_query {
 	isc_uint32_t second_rr_serial;
 	isc_uint32_t msg_count;
 	isc_uint32_t rr_count;
+	isc_boolean_t ixfr_axfr;
 	char *servname;
 	char *userarg;
 	isc_bufferlist_t sendlist,
@@ -275,7 +276,8 @@ extern isc_boolean_t validated;
 extern isc_taskmgr_t *taskmgr;
 extern isc_task_t *global_task;
 extern isc_boolean_t free_now;
-extern isc_boolean_t debugging, memdebugging;
+extern isc_boolean_t debugging, debugtiming, memdebugging;
+extern isc_boolean_t keep_open;

 extern char *progname;
 extern int tries;
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2012 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -216,6 +216,11 @@ Tell the name server to query other servers if it does not have the information.
 (Default = recurse; abbreviation = [no]rec)
 .RE
 .PP
+\fBndots=\fR\fInumber\fR
+.RS 4
+Set the number of dots (label separators) in a domain that will disable searching. Absolute names always stop searching.
+.RE
+.PP
 \fBretry=\fR\fInumber\fR
 .RS 4
 Set the number of retries to number.
@@ -254,5 +259,5 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .PP
 Andrew Cherenson
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007, 2010, 2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007, 2010, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -434,8 +434,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		dns_name_format(query->lookup->name,
 				nametext, sizeof(nametext));
 		printf("** server can't find %s: %s\n",
-		       (msg->rcode != dns_rcode_nxdomain) ? nametext :
-		       query->lookup->textname, rcode_totext(msg->rcode));
+		       nametext, rcode_totext(msg->rcode));
 		debug("returning with rcode == 0");

 		/* the lookup failed */
@@ -494,8 +493,8 @@ show_settings(isc_boolean_t full, isc_boolean_t serv_only) {
 	printf("  %s\t\t%s\n",
 	       usesearch ? "search" : "nosearch",
 	       recurse ? "recurse" : "norecurse");
-	printf("  timeout = %d\t\tretry = %d\tport = %d\n",
-	       timeout, tries, port);
+	printf("  timeout = %d\t\tretry = %d\tport = %d\tndots = %d\n",
+	       timeout, tries, port, ndots);
 	printf("  querytype = %-8s\tclass = %s\n", deftype, defclass);
 	printf("  srchlist = ");
 	for (listent = ISC_LIST_HEAD(search_list);
@@ -582,6 +581,14 @@ set_tries(const char *value) {
 		tries = n;
 }

+static void
+set_ndots(const char *value) {
+	isc_uint32_t n;
+	isc_result_t result = parse_uint(&n, value, 128, "ndots");
+	if (result == ISC_R_SUCCESS)
+		ndots = n;
+}
+
 static void
 setoption(char *opt) {
 	if (strncasecmp(opt, "all", 4) == 0) {
@@ -662,6 +669,8 @@ setoption(char *opt) {
 		nofail=ISC_FALSE;
 	} else if (strncasecmp(opt, "nofail", 3) == 0) {
 		nofail=ISC_TRUE;
+	} else if (strncasecmp(opt, "ndots=", 6) == 0) {
+		set_ndots(&opt[6]);
 	} else {
 		printf("*** Invalid option: %s\n", opt);
 	}
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2007, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -75,6 +75,7 @@
      <year>2007</year>
      <year>2010</year>
      <year>2012</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -410,6 +411,17 @@ nslookup -query=hinfo  -timeout=10
                </listitem>
              </varlistentry>

+              <varlistentry>
+                <term><constant>ndots=</constant><replaceable>number</replaceable></term>
+                <listitem>
+                  <para>
+		    Set the number of dots (label separators) in a domain
+		    that will disable searching.  Absolute names always
+		    stop searching.
+                  </para>
+                </listitem>
+              </varlistentry>
+
              <varlistentry>
                <term><constant>retry=</constant><replaceable>number</replaceable></term>
                <listitem>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007, 2010, 2012 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">nslookup</code>  [<code class="option">-option</code>] [name | -] [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543362"></a><h2>DESCRIPTION</h2>
+<a name="id2543365"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">Nslookup</strong></span>
      is a program to query Internet domain name servers.  <span><strong class="command">Nslookup</strong></span>
      has two modes: interactive and non-interactive.  Interactive mode allows
@@ -43,7 +43,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543378"></a><h2>ARGUMENTS</h2>
+<a name="id2543381"></a><h2>ARGUMENTS</h2>
 <p>
      Interactive mode is entered in the following cases:
      </p>
@@ -78,7 +78,7 @@ nslookup -query=hinfo  -timeout=10
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543421"></a><h2>INTERACTIVE COMMANDS</h2>
+<a name="id2543425"></a><h2>INTERACTIVE COMMANDS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>
 <dd>
@@ -249,6 +249,12 @@ nslookup -query=hinfo  -timeout=10
                    (Default = recurse; abbreviation = [no]rec)
                  </p>
 </dd>
+<dt><span class="term"><code class="constant">ndots=</code><em class="replaceable"><code>number</code></em></span></dt>
+<dd><p>
+		    Set the number of dots (label separators) in a domain
+		    that will disable searching.  Absolute names always
+		    stop searching.
+                  </p></dd>
 <dt><span class="term"><code class="constant">retry=</code><em class="replaceable"><code>number</code></em></span></dt>
 <dd><p>
                    Set the number of retries to number.
@@ -288,19 +294,19 @@ nslookup -query=hinfo  -timeout=10
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2546288"></a><h2>FILES</h2>
+<a name="id2546307"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2546299"></a><h2>SEE ALSO</h2>
+<a name="id2546318"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2546333"></a><h2>Author</h2>
+<a name="id2546353"></a><h2>Author</h2>
 <p>
      Andrew Cherenson
    </p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -230,7 +230,7 @@ Generate a NSEC3 chain with the given hex encoded salt. A dash (\fIsalt\fR) can
 .PP
 \-H \fIiterations\fR
 .RS 4
-When generating a NSEC3 chain use this many interations. The default is 100.
+When generating an NSEC3 chain, use this many iterations. The default is 100.
 .RE
 .PP
 \-A
@@ -304,7 +304,7 @@ RFC 4033.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
 * Portions Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -645,7 +645,7 @@ hashlist_add(hashlist_t *l, const unsigned char *hash, size_t len)
 			fatal("unable to grow hashlist: out of memory");
 	}
 	memset(l->hashbuf + l->entries * l->length, 0, l->length);
-	memcpy(l->hashbuf + l->entries * l->length, hash, len);
+	memmove(l->hashbuf + l->entries * l->length, hash, len);
 	l->entries++;
 }

@@ -1559,7 +1559,8 @@ verifyzone(void) {
 			fatal("no self signing keys found");
 		fprintf(stderr, "No self signing KSK found. Using self signed "
 			"ZSK's for active algorithm list.\n");
-		memcpy(ksk_algorithms, self_algorithms, sizeof(ksk_algorithms));
+		memmove(ksk_algorithms, self_algorithms,
+			sizeof(ksk_algorithms));
 		if (!allzsksigned)
 			fprintf(stderr, "warning: not all ZSK's are self "
 				"signed.\n");
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -44,6 +44,7 @@
      <year>2008</year>
      <year>2009</year>
      <year>2012</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -438,7 +439,7 @@
        <term>-H <replaceable class="parameter">iterations</replaceable></term>
        <listitem>
          <para>
-	    When generating a NSEC3 chain use this many interations.  The
+	    When generating an NSEC3 chain, use this many iterations.  The
 	    default is 100.
          </para>
        </listitem>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2009, 2012 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-p</code>] [<code class="option">-P</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543561"></a><h2>DESCRIPTION</h2>
+<a name="id2543564"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-signzone</strong></span>
      signs a zone.  It generates
      NSEC and RRSIG records and produces a signed version of the
@@ -43,7 +43,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543579"></a><h2>OPTIONS</h2>
+<a name="id2543582"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -249,7 +249,7 @@
          </p></dd>
 <dt><span class="term">-H <em class="replaceable"><code>iterations</code></em></span></dt>
 <dd><p>
-	    When generating a NSEC3 chain use this many interations.  The
+	    When generating an NSEC3 chain, use this many iterations.  The
 	    default is 100.
          </p></dd>
 <dt><span class="term">-A</span></dt>
@@ -273,7 +273,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544506"></a><h2>EXAMPLE</h2>
+<a name="id2544509"></a><h2>EXAMPLE</h2>
 <p>
      The following command signs the <strong class="userinput"><code>example.com</code></strong>
      zone with the DSA key generated by <span><strong class="command">dnssec-keygen</strong></span>
@@ -302,7 +302,7 @@ db.example.com.signed
 %</pre>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544557"></a><h2>KNOWN BUGS</h2>
+<a name="id2544561"></a><h2>KNOWN BUGS</h2>
 <p>
        <span><strong class="command">dnssec-signzone</strong></span> was designed so that it could
        sign a zone partially, using only a subset of the DNSSEC keys
@@ -327,14 +327,14 @@ db.example.com.signed
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544720"></a><h2>SEE ALSO</h2>
+<a name="id2544723"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 4033</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544744"></a><h2>AUTHOR</h2>
+<a name="id2544747"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2008, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -21,6 +21,10 @@ top_srcdir =	@top_srcdir@

@BIND9_VERSION@

+@BIND9_PRODUCT@
+
+@BIND9_DESCRIPTION@
+
@BIND9_SRCID@

@BIND9_CONFIGARGS@
@@ -109,6 +113,8 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
 main.@O@: main.c
 	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
 		-DVERSION=\"${VERSION}\" \
+		-DPRODUCT=\"${PRODUCT}\" \
+		-DDESCRIPTION=\"${DESCRIPTION}\" \
 		-DSRCID=\"${SRCID}\" \
 		-DCONFIGARGS="\"${CONFIGARGS}\"" \
 		-DNS_LOCALSTATEDIR=\"${localstatedir}\" \
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2010, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -89,7 +89,7 @@ put_txt(dns_sdblookup_t *lookup, const char *text) {
 	if (len > 255)
 		len = 255; /* Silently truncate */
 	buf[0] = len;
-	memcpy(&buf[1], text, len);
+	memmove(&buf[1], text, len);
 	return (dns_sdb_putrdata(lookup, dns_rdatatype_txt, 0, buf, len + 1));
 }

@@ -257,7 +257,7 @@ builtin_create(const char *zone, int argc, char **argv,
 			if (empty != NULL)
 				isc_mem_put(ns_g_mctx, empty, sizeof (*empty));
 		} else {
-			memcpy(empty, &empty_builtin, sizeof (empty_builtin));
+			memmove(empty, &empty_builtin, sizeof (empty_builtin));
 			empty->server = server;
 			empty->contact = contact;
 			*dbdata = empty;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -954,6 +954,7 @@ ns_client_send(ns_client_t *client) {
 	result = dns_compress_init(&cctx, -1, client->mctx);
 	if (result != ISC_R_SUCCESS)
 		goto done;
+	dns_compress_setsensitive(&cctx, ISC_TRUE);
 	cleanup_cctx = ISC_TRUE;

 	result = dns_message_renderbegin(client->message, &cctx, &buffer);
@@ -1170,62 +1171,30 @@ ns_client_error(ns_client_t *client, isc_result_t result) {

 static inline isc_result_t
 client_addopt(ns_client_t *client) {
-	dns_rdataset_t *rdataset;
-	dns_rdatalist_t *rdatalist;
-	dns_rdata_t *rdata;
+	char nsid[BUFSIZ], *nsidp;
 	isc_result_t result;
 	dns_view_t *view;
 	dns_resolver_t *resolver;
 	isc_uint16_t udpsize;
+	dns_ednsopt_t ednsopts[2];
+	int count = 0;
+	unsigned int flags;

 	REQUIRE(client->opt == NULL);	/* XXXRTH free old. */

-	rdatalist = NULL;
-	result = dns_message_gettemprdatalist(client->message, &rdatalist);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	rdata = NULL;
-	result = dns_message_gettemprdata(client->message, &rdata);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	rdataset = NULL;
-	result = dns_message_gettemprdataset(client->message, &rdataset);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	dns_rdataset_init(rdataset);
-
-	rdatalist->type = dns_rdatatype_opt;
-	rdatalist->covers = 0;
-
-	/*
-	 * Set the maximum UDP buffer size.
-	 */
 	view = client->view;
 	resolver = (view != NULL) ? view->resolver : NULL;
 	if (resolver != NULL)
 		udpsize = dns_resolver_getudpsize(resolver);
 	else
 		udpsize = ns_g_udpsize;
-	rdatalist->rdclass = udpsize;

-	/*
-	 * Set EXTENDED-RCODE, VERSION and Z to 0.
-	 */
-	rdatalist->ttl = (client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE);
+	flags = client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE;

 	/* Set EDNS options if applicable */
-	if (client->attributes & NS_CLIENTATTR_WANTNSID &&
+	if ((client->attributes & NS_CLIENTATTR_WANTNSID) != 0 &&
 	    (ns_g_server->server_id != NULL ||
 	     ns_g_server->server_usehostname)) {
-		/*
-		 * Space required for NSID data:
-		 *   2 bytes for opt code
-		 * + 2 bytes for NSID length
-		 * + NSID itself
-		 */
-		char nsid[BUFSIZ], *nsidp;
-		isc_buffer_t *buffer = NULL;
-
 		if (ns_g_server->server_usehostname) {
 			isc_result_t result;
 			result = ns_os_gethostname(nsid, sizeof(nsid));
@@ -1236,35 +1205,15 @@ client_addopt(ns_client_t *client) {
 		} else
 			nsidp = ns_g_server->server_id;

-		rdata->length = strlen(nsidp) + 4;
-		result = isc_buffer_allocate(client->mctx, &buffer,
-					     rdata->length);
-		if (result != ISC_R_SUCCESS)
-			goto no_nsid;
-
-		isc_buffer_putuint16(buffer, DNS_OPT_NSID);
-		isc_buffer_putuint16(buffer, strlen(nsidp));
-		isc_buffer_putstr(buffer, nsidp);
-		rdata->data = buffer->base;
-		dns_message_takebuffer(client->message, &buffer);
-	} else {
-no_nsid:
-		rdata->data = NULL;
-		rdata->length = 0;
+		ednsopts[count].code = DNS_OPT_NSID;
+		ednsopts[count].length = strlen(nsidp);
+		ednsopts[count].value = (unsigned char *)nsidp;
+		count++;
 	}
-
-	rdata->rdclass = rdatalist->rdclass;
-	rdata->type = rdatalist->type;
-	rdata->flags = 0;
-
-	ISC_LIST_INIT(rdatalist->rdata);
-	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
-	RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset)
-		      == ISC_R_SUCCESS);
-
-	client->opt = rdataset;
-
-	return (ISC_R_SUCCESS);
+ no_nsid:
+	result = dns_message_buildopt(client->message, &client->opt, 0,
+				      udpsize, flags, ednsopts, count);
+	return (result);
 }

 static inline isc_boolean_t
@@ -1345,6 +1294,83 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	return (ISC_TF(view == myview));
 }

+static isc_result_t
+process_opt(ns_client_t *client, dns_rdataset_t *opt) {
+	dns_rdata_t rdata;
+	isc_buffer_t optbuf;
+	isc_result_t result;
+	isc_uint16_t optcode;
+	isc_uint16_t optlen;
+
+	/*
+	 * Set the client's UDP buffer size.
+	 */
+	client->udpsize = opt->rdclass;
+
+	/*
+	 * If the requested UDP buffer size is less than 512,
+	 * ignore it and use 512.
+	 */
+	if (client->udpsize < 512)
+		client->udpsize = 512;
+
+	/*
+	 * Get the flags out of the OPT record.
+	 */
+	client->extflags = (isc_uint16_t)(opt->ttl & 0xFFFF);
+
+	/*
+	 * Do we understand this version of EDNS?
+	 *
+	 * XXXRTH need library support for this!
+	 */
+	client->ednsversion = (opt->ttl & 0x00FF0000) >> 16;
+	if (client->ednsversion > 0) {
+		isc_stats_increment(ns_g_server->nsstats,
+				    dns_nsstatscounter_badednsver);
+		result = client_addopt(client);
+		if (result == ISC_R_SUCCESS)
+			result = DNS_R_BADVERS;
+		ns_client_error(client, result);
+		goto cleanup;
+	}
+
+	/* Check for NSID request */
+	result = dns_rdataset_first(opt);
+	if (result == ISC_R_SUCCESS) {
+		dns_rdata_init(&rdata);
+		dns_rdataset_current(opt, &rdata);
+		isc_buffer_init(&optbuf, rdata.data, rdata.length);
+		isc_buffer_add(&optbuf, rdata.length);
+		while (isc_buffer_remaininglength(&optbuf) >= 4) {
+			optcode = isc_buffer_getuint16(&optbuf);
+			optlen = isc_buffer_getuint16(&optbuf);
+			switch (optcode) {
+			case DNS_OPT_NSID:
+				client->attributes |= NS_CLIENTATTR_WANTNSID;
+				isc_buffer_forward(&optbuf, optlen);
+				break;
+			default:
+				isc_buffer_forward(&optbuf, optlen);
+				break;
+			}
+		}
+	}
+
+	isc_stats_increment(ns_g_server->nsstats, dns_nsstatscounter_edns0in);
+
+	/*
+	 * Create an OPT for our reply.
+	 */
+	result = client_addopt(client);
+	if (result != ISC_R_SUCCESS) {
+		ns_client_error(client, result);
+		goto cleanup;
+	}
+ cleanup:
+	return (result);
+}
+
 /*
 * Handle an incoming request event from the socket (UDP case)
 * or tcpmsg (TCP case).
@@ -1367,8 +1393,6 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	dns_messageid_t id;
 	unsigned int flags;
 	isc_boolean_t notimp;
-	dns_rdata_t rdata;
-	isc_uint16_t optcode;

 	REQUIRE(event != NULL);
 	client = event->ev_arg;
@@ -1568,67 +1592,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	 */
 	opt = dns_message_getopt(client->message);
 	if (opt != NULL) {
-		/*
-		 * Set the client's UDP buffer size.
-		 */
-		client->udpsize = opt->rdclass;
-
-		/*
-		 * If the requested UDP buffer size is less than 512,
-		 * ignore it and use 512.
-		 */
-		if (client->udpsize < 512)
-			client->udpsize = 512;
-
-		/*
-		 * Get the flags out of the OPT record.
-		 */
-		client->extflags = (isc_uint16_t)(opt->ttl & 0xFFFF);
-
-		/*
-		 * Do we understand this version of EDNS?
-		 *
-		 * XXXRTH need library support for this!
-		 */
-		client->ednsversion = (opt->ttl & 0x00FF0000) >> 16;
-		if (client->ednsversion > 0) {
-			isc_stats_increment(ns_g_server->nsstats,
-					    dns_nsstatscounter_badednsver);
-			result = client_addopt(client);
-			if (result == ISC_R_SUCCESS)
-				result = DNS_R_BADVERS;
-			ns_client_error(client, result);
+		result = process_opt(client, opt);
+		if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		}
-
-		/* Check for NSID request */
-		result = dns_rdataset_first(opt);
-		if (result == ISC_R_SUCCESS) {
-			dns_rdata_init(&rdata);
-			dns_rdataset_current(opt, &rdata);
-			if (rdata.length >= 2) {
-				isc_buffer_t nsidbuf;
-				isc_buffer_init(&nsidbuf,
-						rdata.data, rdata.length);
-				isc_buffer_add(&nsidbuf, rdata.length);
-				optcode = isc_buffer_getuint16(&nsidbuf);
-				if (optcode == DNS_OPT_NSID)
-					client->attributes |=
-						NS_CLIENTATTR_WANTNSID;
-			}
-		}
-
-		isc_stats_increment(ns_g_server->nsstats,
-				    dns_nsstatscounter_edns0in);
-
-		/*
-		 * Create an OPT for our reply.
-		 */
-		result = client_addopt(client);
-		if (result != ISC_R_SUCCESS) {
-			ns_client_error(client, result);
-			goto cleanup;
-		}
 	}

 	if (client->message->rdclass == 0) {
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -87,7 +87,7 @@ options {\n\
 	statistics-file \"named.stats\";\n\
 	statistics-interval 60;\n\
 	tcp-clients 100;\n\
-	tcp-listen-queue 3;\n\
+	tcp-listen-queue 10;\n\
 #	tkey-dhkey <none>\n\
 #	tkey-gssapi-credential <none>\n\
 #	tkey-domain <none>\n\
@@ -136,6 +136,7 @@ options {\n\
 	check-names slave warn;\n\
 	check-names response ignore;\n\
 	check-mx warn;\n\
+	check-spf warn;\n\
 	acache-enable no;\n\
 	acache-cleaning-interval 60;\n\
 	max-acache-size 16M;\n\
@@ -516,7 +517,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 				if (new == NULL)
 					goto cleanup;
 				if (listcount != 0) {
-					memcpy(new, lists, oldsize);
+					memmove(new, lists, oldsize);
 					isc_mem_put(mctx, lists, oldsize);
 				}
 				lists = new;
@@ -551,7 +552,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 				if (new == NULL)
 					goto cleanup;
 				if (stackcount != 0) {
-					memcpy(new, stack, oldsize);
+					memmove(new, stack, oldsize);
 					isc_mem_put(mctx, stack, oldsize);
 				}
 				stack = new;
@@ -578,7 +579,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			if (new == NULL)
 				goto cleanup;
 			if (addrcount != 0) {
-				memcpy(new, addrs, oldsize);
+				memmove(new, addrs, oldsize);
 				isc_mem_put(mctx, addrs, oldsize);
 			}
 			addrs = new;
@@ -590,7 +591,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			if (new == NULL)
 				goto cleanup;
 			if (keycount != 0) {
-				memcpy(new, keys, oldsize);
+				memmove(new, keys, oldsize);
 				isc_mem_put(mctx, keys, oldsize);
 			}
 			keys = new;
@@ -638,7 +639,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			new = isc_mem_get(mctx, newsize);
 			if (new == NULL)
 				goto cleanup;
-			memcpy(new, addrs, newsize);
+			memmove(new, addrs, newsize);
 		} else
 			new = NULL;
 		isc_mem_put(mctx, addrs, oldsize);
@@ -651,7 +652,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			new = isc_mem_get(mctx, newsize);
 			if (new == NULL)
 				goto cleanup;
-			memcpy(new, keys,  newsize);
+			memmove(new, keys,  newsize);
 		} else
 			new = NULL;
 		isc_mem_put(mctx, keys, oldsize);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -149,7 +149,7 @@ free_listener(controllistener_t *listener) {
 	if (listener->acl != NULL)
 		dns_acl_detach(&listener->acl);

-	isc_mem_put(listener->mctx, listener, sizeof(*listener));
+	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }

 static void
@@ -367,7 +367,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		secret.rstart = isc_mem_get(listener->mctx, key->secret.length);
 		if (secret.rstart == NULL)
 			goto cleanup;
-		memcpy(secret.rstart, key->secret.base, key->secret.length);
+		memmove(secret.rstart, key->secret.base, key->secret.length);
 		secret.rend = secret.rstart + key->secret.length;
 		result = isccc_cc_fromwire(&ccregion, &request, &secret);
 		if (result == ISC_R_SUCCESS)
@@ -784,8 +784,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 				free_controlkey(keyid, mctx);
 				break;
 			}
-			memcpy(keyid->secret.base, isc_buffer_base(&b),
-			       keyid->secret.length);
+			memmove(keyid->secret.base, isc_buffer_base(&b),
+				keyid->secret.length);
 		}
 	}
 }
@@ -864,8 +864,8 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 			   "out of memory", keyid->keyname);
 		CHECK(ISC_R_NOMEMORY);
 	}
-	memcpy(keyid->secret.base, isc_buffer_base(&b),
-	       keyid->secret.length);
+	memmove(keyid->secret.base, isc_buffer_base(&b),
+		keyid->secret.length);
 	ISC_LIST_APPEND(*keyids, keyid, link);
 	keyid = NULL;
 	result = ISC_R_SUCCESS;
@@ -1066,8 +1066,9 @@ add_listener(ns_controls_t *cp, controllistener_t **listenerp,
 		result = ISC_R_NOMEMORY;

 	if (result == ISC_R_SUCCESS) {
+		listener->mctx = NULL;
+		isc_mem_attach(mctx, &listener->mctx);
 		listener->controls = cp;
-		listener->mctx = mctx;
 		listener->task = cp->server->task;
 		listener->address = *addr;
 		listener->sock = NULL;
@@ -63,6 +63,8 @@ EXTERN isc_timermgr_t *		ns_g_timermgr		INIT(NULL);
 EXTERN isc_socketmgr_t *	ns_g_socketmgr		INIT(NULL);
 EXTERN cfg_parser_t *		ns_g_parser		INIT(NULL);
 EXTERN const char *		ns_g_version		INIT(VERSION);
+EXTERN const char *		ns_g_product		INIT(PRODUCT);
+EXTERN const char *		ns_g_description	INIT(DESCRIPTION);
 EXTERN const char *		ns_g_srcid		INIT(SRCID);
 EXTERN const char *		ns_g_configargs		INIT(CONFIGARGS);
 EXTERN in_port_t		ns_g_port		INIT(0);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -79,11 +79,13 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	if (mgr == NULL)
 		return (ISC_R_NOMEMORY);

+	mgr->mctx = NULL;
+	isc_mem_attach(mctx, &mgr->mctx);
+
 	result = isc_mutex_init(&mgr->lock);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_mem;

-	mgr->mctx = mctx;
 	mgr->taskmgr = taskmgr;
 	mgr->socketmgr = socketmgr;
 	mgr->dispatchmgr = dispatchmgr;
@@ -115,7 +117,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	ns_listenlist_detach(&mgr->listenon4);
 	ns_listenlist_detach(&mgr->listenon6);
 cleanup_mem:
-	isc_mem_put(mctx, mgr, sizeof(*mgr));
+	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 	return (result);
 }

@@ -128,7 +130,7 @@ ns_interfacemgr_destroy(ns_interfacemgr_t *mgr) {
 	clearlistenon(mgr);
 	DESTROYLOCK(&mgr->lock);
 	mgr->magic = 0;
-	isc_mem_put(mgr->mctx, mgr, sizeof(*mgr));
+	isc_mem_putanddetach(&mgr->mctx, mgr, sizeof(*mgr));
 }

 dns_aclenv_t *
@@ -523,15 +525,22 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {
 		return (result);

 	if (result != ISC_R_SUCCESS) {
-		isc_log_write(IFMGR_COMMON_LOGARGS,
-			      ISC_LOG_WARNING,
+		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_WARNING,
 			      "omitting IPv4 interface %s from "
-			      "localnets ACL: %s",
-			      interface->name,
+			      "localnets ACL: %s", interface->name,
 			      isc_result_totext(result));
 		return (ISC_R_SUCCESS);
 	}

+	if (prefixlen == 0U) {
+		isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_WARNING,
+			      "omitting %s interface %s from localnets ACL: "
+			      "zero prefix length detected",
+			      (netaddr->family == AF_INET) ? "IPv4" : "IPv6",
+			      interface->name);
+		return (ISC_R_SUCCESS);
+	}
+
 	result = dns_iptable_addprefix(mgr->aclenv.localnets->iptable,
 				       netaddr, prefixlen, ISC_TRUE);
 	if (result != ISC_R_SUCCESS)
@@ -41,10 +41,10 @@

 /*%
 * Set up a logging category according to the named.conf data
- * in 'ccat' and add it to 'lctx'.
+ * in 'ccat' and add it to 'logconfig'.
 */
 static isc_result_t
-category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {
+category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 	isc_result_t result;
 	const char *catname;
 	isc_logcategory_t *category;
@@ -64,6 +64,9 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {
 		return (ISC_R_SUCCESS);
 	}

+	if (logconfig == NULL)
+		return (ISC_R_SUCCESS);
+
 	module = NULL;

 	destinations = cfg_tuple_get(ccat, "destinations");
@@ -74,7 +77,7 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {
 		const cfg_obj_t *channel = cfg_listelt_value(element);
 		const char *channelname = cfg_obj_asstring(channel);

-		result = isc_log_usechannel(lctx, channelname, category,
+		result = isc_log_usechannel(logconfig, channelname, category,
 					    module);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(ns_g_lctx, CFG_LOGCATEGORY_CONFIG,
@@ -89,10 +92,11 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {

 /*%
 * Set up a logging channel according to the named.conf data
- * in 'cchan' and add it to 'lctx'.
+ * in 'cchan' and add it to 'logconfig'.
 */
 static isc_result_t
-channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
+channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig)
+{
 	isc_result_t result;
 	isc_logdestination_t dest;
 	unsigned int type;
@@ -215,8 +219,11 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
 			level = cfg_obj_asuint32(severity);
 	}

-	result = isc_log_createchannel(lctx, channelname,
-				       type, level, &dest, flags);
+	if (logconfig == NULL)
+		result = ISC_R_SUCCESS;
+	else
+		result = isc_log_createchannel(logconfig, channelname,
+					       type, level, &dest, flags);

 	if (result == ISC_R_SUCCESS && type == ISC_LOG_TOFILE) {
 		FILE *fp;
@@ -226,32 +233,31 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
 		 * Fix defect #22771
 		*/
 		result = isc_file_isplainfile(dest.file.name);
-		if (result == ISC_R_SUCCESS ||
-		    result == ISC_R_FILENOTFOUND) {
+		if (result == ISC_R_SUCCESS || result == ISC_R_FILENOTFOUND) {
 			/*
 			 * Test that the file can be opened, since
 			 * isc_log_open() can't effectively report
-			 * failures when called in
-			 * isc_log_doit().
+			 * failures when called in isc_log_doit().
 			 */
 			result = isc_stdio_open(dest.file.name, "a", &fp);
 			if (result != ISC_R_SUCCESS) {
-				syslog(LOG_ERR,
-					"isc_stdio_open '%s' failed: %s",
-					dest.file.name,
-					isc_result_totext(result));
+				if (logconfig != NULL && !ns_g_nosyslog)
+					syslog(LOG_ERR,
+						"isc_stdio_open '%s' failed: "
+						"%s", dest.file.name,
+						isc_result_totext(result));
 				fprintf(stderr,
-					"isc_stdio_open '%s' failed: %s",
+					"isc_stdio_open '%s' failed: %s\n",
 					dest.file.name,
 					isc_result_totext(result));
 			} else
 				(void)isc_stdio_close(fp);
 			goto done;
 		}
-		if (!ns_g_nosyslog)
+		if (logconfig != NULL && !ns_g_nosyslog)
 			syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
 			       dest.file.name, isc_result_totext(result));
-		fprintf(stderr, "isc_file_isplainfile '%s' failed: %s",
+		fprintf(stderr, "isc_file_isplainfile '%s' failed: %s\n",
 			dest.file.name, isc_result_totext(result));
 	}

@@ -260,7 +266,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
 }

 isc_result_t
-ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
+ns_log_configure(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 	isc_result_t result;
 	const cfg_obj_t *channels = NULL;
 	const cfg_obj_t *categories = NULL;
@@ -269,7 +275,8 @@ ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
 	isc_boolean_t unmatched_set = ISC_FALSE;
 	const cfg_obj_t *catname;

-	CHECK(ns_log_setdefaultchannels(logconf));
+	if (logconfig != NULL)
+		CHECK(ns_log_setdefaultchannels(logconfig));

 	(void)cfg_map_get(logstmt, "channel", &channels);
 	for (element = cfg_list_first(channels);
@@ -277,7 +284,7 @@ ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
 	     element = cfg_list_next(element))
 	{
 		const cfg_obj_t *channel = cfg_listelt_value(element);
-		CHECK(channel_fromconf(channel, logconf));
+		CHECK(channel_fromconf(channel, logconfig));
 	}

 	(void)cfg_map_get(logstmt, "category", &categories);
@@ -286,7 +293,7 @@ ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
 	     element = cfg_list_next(element))
 	{
 		const cfg_obj_t *category = cfg_listelt_value(element);
-		CHECK(category_fromconf(category, logconf));
+		CHECK(category_fromconf(category, logconfig));
 		if (!default_set) {
 			catname = cfg_tuple_get(category, "name");
 			if (strcmp(cfg_obj_asstring(catname), "default") == 0)
@@ -299,16 +306,14 @@ ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
 		}
 	}

-	if (!default_set)
-		CHECK(ns_log_setdefaultcategory(logconf));
+	if (logconfig != NULL && !default_set)
+		CHECK(ns_log_setdefaultcategory(logconfig));

-	if (!unmatched_set)
-		CHECK(ns_log_setunmatchedcategory(logconf));
+	if (logconfig != NULL && !unmatched_set)
+		CHECK(ns_log_setunmatchedcategory(logconfig));

 	return (ISC_R_SUCCESS);

 cleanup:
-	if (logconf != NULL)
-		isc_logconfig_destroy(&logconf);
 	return (result);
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -41,11 +41,11 @@ lwaddr_netaddr_fromlwresaddr(isc_netaddr_t *na, lwres_addr_t *la) {

 	if (la->family == LWRES_ADDRTYPE_V4) {
 		struct in_addr ina;
-		memcpy(&ina.s_addr, la->address, 4);
+		memmove(&ina.s_addr, la->address, 4);
 		isc_netaddr_fromin(na, &ina);
 	} else {
 		struct in6_addr ina6;
-		memcpy(&ina6.s6_addr, la->address, 16);
+		memmove(&ina6.s6_addr, la->address, 16);
 		isc_netaddr_fromin6(na, &ina6);
 	}
 	return (ISC_R_SUCCESS);
@@ -77,11 +77,11 @@ lwaddr_lwresaddr_fromnetaddr(lwres_addr_t *la, isc_netaddr_t *na) {
 	if (na->family == AF_INET) {
 		la->family = LWRES_ADDRTYPE_V4;
 		la->length = 4;
-		memcpy(la->address, &na->type.in, 4);
+		memmove(la->address, &na->type.in, 4);
 	} else {
 		la->family = LWRES_ADDRTYPE_V6;
 		la->length = 16;
-		memcpy(la->address, &na->type.in6, 16);
+		memmove(la->address, &na->type.in6, 16);
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -226,12 +226,12 @@ ns_lwdclient_processgnba(ns_lwdclient_t *client, lwres_buffer_t *b) {
 		client->na.family = AF_INET;
 		if (req->addr.length != 4)
 			goto out;
-		memcpy(&client->na.type.in, req->addr.address, 4);
+		memmove(&client->na.type.in, req->addr.address, 4);
 	} else if (req->addr.family == LWRES_ADDRTYPE_V6) {
 		client->na.family = AF_INET6;
 		if (req->addr.length != 16)
 			goto out;
-		memcpy(&client->na.type.in6, req->addr.address, 16);
+		memmove(&client->na.type.in6, req->addr.address, 16);
 	} else {
 		goto out;
 	}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -124,8 +124,8 @@ iterate_node(lwres_grbnresponse_t *grbn, dns_db_t *db, dns_dbnode_t *node,
 			lens = isc_mem_get(mctx, size * sizeof(*lens));
 			if (lens == NULL)
 				goto out;
-			memcpy(rdatas, oldrdatas, used * sizeof(*rdatas));
-			memcpy(lens, oldlens, used * sizeof(*lens));
+			memmove(rdatas, oldrdatas, used * sizeof(*rdatas));
+			memmove(lens, oldlens, used * sizeof(*lens));
 			isc_mem_put(mctx, oldrdatas,
 				    oldsize * sizeof(*oldrdatas));
 			isc_mem_put(mctx, oldlens, oldsize * sizeof(*oldlens));
@@ -158,8 +158,8 @@ iterate_node(lwres_grbnresponse_t *grbn, dns_db_t *db, dns_dbnode_t *node,
 		newlens = isc_mem_get(mctx, used * sizeof(*lens));
 		if (newlens == NULL)
 			goto out;
-		memcpy(newrdatas, rdatas, used * sizeof(*rdatas));
-		memcpy(newlens, lens, used * sizeof(*lens));
+		memmove(newrdatas, rdatas, used * sizeof(*rdatas));
+		memmove(newlens, lens, used * sizeof(*lens));
 		isc_mem_put(mctx, rdatas, size * sizeof(*rdatas));
 		isc_mem_put(mctx, lens, size * sizeof(*lens));
 		grbn->rdatas = newrdatas;
@@ -204,6 +204,8 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 	lwres_grbnresponse_t *grbn;
 	int i;

+	REQUIRE(event != NULL);
+
 	UNUSED(task);

 	lwb.base = NULL;
@@ -324,9 +326,6 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 				 (grbn->nsigs == 1) ? "" : "s");
 	}

-	dns_lookup_destroy(&client->lookup);
-	isc_event_free(&event);
-
 	/*
 	 * Render the packet.
 	 */
@@ -362,6 +361,9 @@ lookup_done(isc_task_t *task, isc_event_t *event) {

 	NS_LWDCLIENT_SETSEND(client);

+	dns_lookup_destroy(&client->lookup);
+	isc_event_free(&event);
+
 	return;

 out:
@@ -384,8 +386,7 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 	if (lwb.base != NULL)
 		lwres_context_freemem(cm->lwctx, lwb.base, lwb.length);

-	if (event != NULL)
-		isc_event_free(&event);
+	isc_event_free(&event);

 	ns_lwdclient_log(50, "error constructing getrrsetbyname response");
 	ns_lwdclient_errorpktsend(client, LWRES_R_FAILURE);
@@ -474,11 +474,18 @@ parse_command_line(int argc, char *argv[]) {
 			ns_g_username = isc_commandline_argument;
 			break;
 		case 'v':
-			printf("BIND %s\n", ns_g_version);
+			printf("%s %s", ns_g_product, ns_g_version);
+			if (*ns_g_description != 0)
+				printf(" %s", ns_g_description);
+			printf("\n");
 			exit(0);
 		case 'V':
-			printf("BIND %s <id:%s> built with %s\n",
-			       ns_g_version, ns_g_srcid, ns_g_configargs);
+			printf("%s %s", ns_g_product, ns_g_version);
+			if (*ns_g_description != 0)
+				printf(" %s", ns_g_description);
+			printf(" <id:%s> built with %s\n", ns_g_srcid,
+				ns_g_configargs);
+			printf("\n");
 			exit(0);
 		case '?':
 			usage();
@@ -689,8 +696,8 @@ setup(void) {
 				   isc_result_totext(result));

 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "starting BIND %s%s", ns_g_version,
-		      saved_command_line);
+		      ISC_LOG_NOTICE, "starting %s %s%s", ns_g_product,
+		      ns_g_version, saved_command_line);

 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "built with %s", ns_g_configargs);
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2008, 2012 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2008, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -178,7 +178,7 @@ options {
 	random\-device \fIquoted_string\fR;
 	recursive\-clients \fIinteger\fR;
 	serial\-query\-rate \fIinteger\fR;
-	server\-id ( \fIquoted_string\fR | none |;
+	server\-id ( \fIquoted_string\fR | hostname | none );
 	stacksize \fIsize\fR;
 	statistics\-file \fIquoted_string\fR;
 	statistics\-interval \fIinteger\fR; // not yet implemented
@@ -544,5 +544,5 @@ zone \fIstring\fR \fIoptional_class\fR {
 \fBrndc\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2008, 2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2008, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -42,6 +42,7 @@
      <year>2007</year>
      <year>2008</year>
      <year>2012</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -207,7 +208,7 @@ options {
 	random-device <replaceable>quoted_string</replaceable>;
 	recursive-clients <replaceable>integer</replaceable>;
 	serial-query-rate <replaceable>integer</replaceable>;
-	server-id ( <replaceable>quoted_string</replaceable> | none |;
+	server-id ( <replaceable>quoted_string</replaceable> | hostname | none );
 	stacksize <replaceable>size</replaceable>;
 	statistics-file <replaceable>quoted_string</replaceable>;
 	statistics-interval <replaceable>integer</replaceable>; // not yet implemented
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2008, 2012 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2008, 2012, 2013 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543346"></a><h2>DESCRIPTION</h2>
+<a name="id2543349"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">named.conf</code> is the configuration file
      for
      <span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543373"></a><h2>ACL</h2>
+<a name="id2543377"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543389"></a><h2>KEY</h2>
+<a name="id2543393"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543409"></a><h2>MASTERS</h2>
+<a name="id2543412"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543454"></a><h2>SERVER</h2>
+<a name="id2543458"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -97,7 +97,7 @@ server
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543523"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2543526"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -105,7 +105,7 @@ trusted-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543548"></a><h2>CONTROLS</h2>
+<a name="id2543552"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -117,7 +117,7 @@ controls
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543584"></a><h2>LOGGING</h2>
+<a name="id2543587"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -135,7 +135,7 @@ logging
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543622"></a><h2>LWRES</h2>
+<a name="id2543625"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -148,7 +148,7 @@ lwres
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543664"></a><h2>OPTIONS</h2>
+<a name="id2543667"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -176,7 +176,7 @@ options
 	random-device <em class="replaceable"><code>quoted_string</code></em>;<br>
 	recursive-clients <em class="replaceable"><code>integer</code></em>;<br>
 	serial-query-rate <em class="replaceable"><code>integer</code></em>;<br>
-	server-id ( <em class="replaceable"><code>quoted_string</code></em> | none |;<br>
+	server-id ( <em class="replaceable"><code>quoted_string</code></em> | hostname | none );<br>
 	stacksize <em class="replaceable"><code>size</code></em>;<br>
 	statistics-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	statistics-interval <em class="replaceable"><code>integer</code></em>; // not yet implemented<br>
@@ -329,7 +329,7 @@ options
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544455"></a><h2>VIEW</h2>
+<a name="id2544459"></a><h2>VIEW</h2>
 <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -477,7 +477,7 @@ view
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545116"></a><h2>ZONE</h2>
+<a name="id2545121"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint |<br>
@@ -569,12 +569,12 @@ zone
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545413"></a><h2>FILES</h2>
+<a name="id2545417"></a><h2>FILES</h2>
 <p><code class="filename">/etc/named.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545425"></a><h2>SEE ALSO</h2>
+<a name="id2545429"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -57,6 +57,7 @@

 #include <named/client.h>
 #include <named/globals.h>
+#include <named/interfacemgr.h>
 #include <named/log.h>
 #include <named/server.h>
 #include <named/sortlist.h>
@@ -737,8 +738,9 @@ query_validatezonedb(ns_client_t *client, dns_name_t *name,
 			if (queryonacl == NULL)
 				queryonacl = client->view->queryonacl;

-			result = ns_client_checkaclsilent(client, NULL,
-							  queryonacl, ISC_TRUE);
+			result = ns_client_checkaclsilent(client,
+						      &client->interface->addr,
+							 queryonacl, ISC_TRUE);
 			if ((options & DNS_GETDB_NOLOG) == 0 &&
 			    result != ISC_R_SUCCESS)
 				ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -3399,12 +3401,12 @@ rdata_tonetaddr(const dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
 	switch (rdata->type) {
 	case dns_rdatatype_a:
 		INSIST(rdata->length == 4);
-		memcpy(&ina.s_addr, rdata->data, 4);
+		memmove(&ina.s_addr, rdata->data, 4);
 		isc_netaddr_fromin(netaddr, &ina);
 		return (ISC_R_SUCCESS);
 	case dns_rdatatype_aaaa:
 		INSIST(rdata->length == 16);
-		memcpy(in6a.s6_addr, rdata->data, 16);
+		memmove(in6a.s6_addr, rdata->data, 16);
 		isc_netaddr_fromin6(netaddr, &in6a);
 		return (ISC_R_SUCCESS);
 	default:
@@ -3677,8 +3679,7 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 	dns_fixedname_t fixed;
 	dns_hash_t hash;
 	dns_name_t name;
-	int order;
-	unsigned int count;
+	unsigned int skip = 0, labels;
 	dns_rdata_nsec3_t nsec3;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_boolean_t optout;
@@ -3691,6 +3692,7 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,

 	dns_name_init(&name, NULL);
 	dns_name_clone(qname, &name);
+	labels = dns_name_countlabels(&name);

 	/*
 	 * Map unknown algorithm to known value.
@@ -3722,13 +3724,14 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 		dns_rdata_reset(&rdata);
 		optout = ISC_TF((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0);
 		if (found != NULL && optout &&
-		    dns_name_fullcompare(&name, dns_db_origin(db), &order,
-					 &count) == dns_namereln_subdomain) {
+		    dns_name_issubdomain(&name, dns_db_origin(db)))
+		{
 			dns_rdataset_disassociate(rdataset);
 			if (dns_rdataset_isassociated(sigrdataset))
 				dns_rdataset_disassociate(sigrdataset);
-			count = dns_name_countlabels(&name) - 1;
-			dns_name_getlabelsequence(&name, 1, count, &name);
+			skip++;
+			dns_name_getlabelsequence(qname, skip, labels - skip,
+						  &name);
 			ns_client_log(client, DNS_LOGCATEGORY_DNSSEC,
 				      NS_LOGMODULE_QUERY, ISC_LOG_DEBUG(3),
 				      "looking for closest provable encloser");
@@ -3746,7 +3749,11 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 		ns_client_log(client, DNS_LOGCATEGORY_DNSSEC,
 			      NS_LOGMODULE_QUERY, ISC_LOG_WARNING,
 			      "expected covering NSEC3, got an exact match");
-	if (found != NULL)
+	if (found == qname) {
+		if (skip != 0U)
+			dns_name_getlabelsequence(qname, skip, labels - skip,
+						  found);
+	} else if (found != NULL)
 		dns_name_copy(&name, found, NULL);
 	return;
 }
@@ -4785,7 +4792,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 					goto addauth;
 				}

-				if (dns_db_issecure(db)) {
+				if (qtype == dns_rdatatype_rrsig &&
+				    dns_db_issecure(db)) {
 					char namebuf[DNS_NAME_FORMATSIZE];
 					dns_name_format(client->query.qname,
 							namebuf,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -68,11 +68,13 @@
 #include <dns/portlist.h>
 #include <dns/rbt.h>
 #include <dns/rdataclass.h>
+#include <dns/rdatalist.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
 #include <dns/resolver.h>
 #include <dns/rootns.h>
 #include <dns/secalg.h>
+#include <dns/soa.h>
 #include <dns/stats.h>
 #include <dns/tkey.h>
 #include <dns/tsig.h>
@@ -988,26 +990,22 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {
 	return (ISC_FALSE);
 }

-static void
-check_dbtype(dns_zone_t **zonep, unsigned int dbtypec, const char **dbargv,
+static isc_result_t
+check_dbtype(dns_zone_t *zone, unsigned int dbtypec, const char **dbargv,
 	     isc_mem_t *mctx)
 {
 	char **argv = NULL;
 	unsigned int i;
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;

-	result = dns_zone_getdbtype(*zonep, &argv, mctx);
-	if (result != ISC_R_SUCCESS) {
-		dns_zone_detach(zonep);
-		return;
-	}
+	CHECK(dns_zone_getdbtype(zone, &argv, mctx));

 	/*
 	 * Check that all the arguments match.
 	 */
 	for (i = 0; i < dbtypec; i++)
 		if (argv[i] == NULL || strcmp(argv[i], dbargv[i]) != 0) {
-			dns_zone_detach(zonep);
+			CHECK(ISC_R_FAILURE);
 			break;
 		}

@@ -1015,8 +1013,11 @@ check_dbtype(dns_zone_t **zonep, unsigned int dbtypec, const char **dbargv,
 	 * Check that there are not extra arguments.
 	 */
 	if (i == dbtypec && argv[i] != NULL)
-		dns_zone_detach(zonep);
+		result = ISC_R_FAILURE;
+
+ cleanup:
 	isc_mem_free(mctx, argv);
+	return (result);
 }

 static isc_result_t
@@ -1055,6 +1056,253 @@ cache_reusable(dns_view_t *originview, dns_view_t *view,
 	return (ISC_TRUE);
 }

+static isc_result_t
+add_soa(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
+	dns_name_t *origin, dns_name_t *contact)
+{
+	dns_dbnode_t *node = NULL;
+	dns_rdata_soa_t soa;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdatalist_t rdatalist;
+	dns_rdataset_t rdataset;
+	isc_buffer_t b;
+	isc_result_t result;
+	unsigned char buf[2 * DNS_NAME_MAXWIRE + 20];
+
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_init(&rdatalist);
+	isc_buffer_init(&b, buf, sizeof(buf));
+
+	soa.common.rdtype = dns_rdatatype_soa;
+	soa.common.rdclass = dns_db_class(db);
+	soa.mctx = NULL;
+	soa.serial = 0;
+	soa.refresh = 28800;
+	soa.retry = 7200;
+	soa.expire = 604800;
+	soa.minimum = 86400;
+	dns_name_init(&soa.origin, NULL);
+	dns_name_clone(origin, &soa.origin);
+	dns_name_init(&soa.contact, NULL);
+	dns_name_clone(contact, &soa.contact);
+
+	CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_soa,
+				   &soa, &b));
+
+	rdatalist.type = rdata.type;
+	rdatalist.covers = 0;
+	rdatalist.rdclass = rdata.rdclass;
+	rdatalist.ttl = 86400;
+	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
+	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	CHECK(dns_db_findnode(db, name, ISC_TRUE, &node));
+	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
+ cleanup:
+	if (node != NULL)
+		dns_db_detachnode(db, &node);
+	return (result);
+}
+
+static isc_result_t
+add_ns(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
+       dns_name_t *nsname)
+{
+	dns_dbnode_t *node = NULL;
+	dns_rdata_ns_t ns;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdatalist_t rdatalist;
+	dns_rdataset_t rdataset;
+	isc_result_t result;
+	isc_buffer_t b;
+	unsigned char buf[DNS_NAME_MAXWIRE];
+
+	isc_buffer_init(&b, buf, sizeof(buf));
+
+	dns_rdataset_init(&rdataset);
+	dns_rdatalist_init(&rdatalist);
+	ns.common.rdtype = dns_rdatatype_ns;
+	ns.common.rdclass = dns_db_class(db);
+	ns.mctx = NULL;
+	dns_name_init(&ns.name, NULL);
+	dns_name_clone(nsname, &ns.name);
+	CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db), dns_rdatatype_ns,
+				   &ns, &b));
+	rdatalist.type = rdata.type;
+	rdatalist.covers = 0;
+	rdatalist.rdclass = rdata.rdclass;
+	rdatalist.ttl = 86400;
+	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
+	CHECK(dns_rdatalist_tordataset(&rdatalist, &rdataset));
+	CHECK(dns_db_findnode(db, name, ISC_TRUE, &node));
+	CHECK(dns_db_addrdataset(db, node, version, 0, &rdataset, 0, NULL));
+ cleanup:
+	if (node != NULL)
+		dns_db_detachnode(db, &node);
+	return (result);
+}
+
+static isc_result_t
+create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
+		  const cfg_obj_t *zonelist, const char **empty_dbtype,
+		  int empty_dbtypec, isc_boolean_t zonestats_on)
+{
+	char namebuf[DNS_NAME_FORMATSIZE];
+	const cfg_listelt_t *element;
+	const cfg_obj_t *obj;
+	const cfg_obj_t *zconfig;
+	const cfg_obj_t *zoptions;
+	const char *rbt_dbtype[4] = { "rbt" };
+	const char *sep = ": view ";
+	const char *str;
+	const char *viewname = view->name;
+	dns_db_t *db = NULL;
+	dns_dbversion_t *version = NULL;
+	dns_fixedname_t cfixed;
+	dns_fixedname_t fixed;
+	dns_fixedname_t nsfixed;
+	dns_name_t *contact;
+	dns_name_t *ns;
+	dns_name_t *zname;
+	dns_zone_t *myzone = NULL;
+	int rbt_dbtypec = 1;
+	isc_result_t result;
+	dns_namereln_t namereln;
+	int order;
+	unsigned int nlabels;
+
+	dns_fixedname_init(&fixed);
+	zname = dns_fixedname_name(&fixed);
+	dns_fixedname_init(&nsfixed);
+	ns = dns_fixedname_name(&nsfixed);
+	dns_fixedname_init(&cfixed);
+	contact = dns_fixedname_name(&cfixed);
+
+	/*
+	 * Look for forward "zones" beneath this empty zone and if so
+	 * create a custom db for the empty zone.
+	 */
+	for (element = cfg_list_first(zonelist);
+	     element != NULL;
+	     element = cfg_list_next(element)) {
+
+		zconfig = cfg_listelt_value(element);
+		str = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
+		CHECK(dns_name_fromstring(zname, str, 0, NULL));
+		namereln = dns_name_fullcompare(zname, name, &order, &nlabels);
+		if (namereln != dns_namereln_subdomain)
+			continue;
+
+		zoptions = cfg_tuple_get(zconfig, "options");
+
+		obj = NULL;
+		(void)cfg_map_get(zoptions, "type", &obj);
+		INSIST(obj != NULL);
+		if (strcasecmp(cfg_obj_asstring(obj), "forward") == 0) {
+			obj = NULL;
+			(void)cfg_map_get(zoptions, "forward", &obj);
+			if (obj == NULL)
+				continue;
+			if (strcasecmp(cfg_obj_asstring(obj), "only") != 0)
+				continue;
+		}
+		if (db == NULL) {
+			CHECK(dns_db_create(view->mctx, "rbt", name,
+					    dns_dbtype_zone, view->rdclass,
+					    0, NULL, &db));
+			CHECK(dns_db_newversion(db, &version));
+			if (strcmp(empty_dbtype[2], "@") == 0)
+				dns_name_clone(name, ns);
+			else
+				CHECK(dns_name_fromstring(ns, empty_dbtype[2],
+							  0, NULL));
+			CHECK(dns_name_fromstring(contact, empty_dbtype[3],
+						  0, NULL));
+			CHECK(add_soa(db, version, name, ns, contact));
+			CHECK(add_ns(db, version, name, ns));
+		}
+		CHECK(add_ns(db, version, zname, dns_rootname));
+	}
+
+	/*
+	 * Is the existing zone the ok to use?
+	 */
+	if (zone != NULL) {
+		unsigned int typec;
+		const char **dbargv;
+
+		if (db != NULL) {
+			typec = rbt_dbtypec;
+			dbargv = rbt_dbtype;
+		} else {
+			typec = empty_dbtypec;
+			dbargv = empty_dbtype;
+		}
+
+		result = check_dbtype(zone, typec, dbargv, view->mctx);
+		if (result != ISC_R_SUCCESS)
+			zone = NULL;
+
+		if (zone != NULL && dns_zone_gettype(zone) != dns_zone_master)
+			zone = NULL;
+		if (zone != NULL && dns_zone_getfile(zone) != NULL)
+			zone = NULL;
+	}
+
+	if (zone == NULL) {
+		CHECK(dns_zone_create(&myzone, view->mctx));
+		zone = myzone;
+		CHECK(dns_zone_setorigin(zone, name));
+		CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
+		if (db == NULL)
+			CHECK(dns_zone_setdbtype(zone, empty_dbtypec,
+						 empty_dbtype));
+		dns_zone_setclass(zone, view->rdclass);
+		dns_zone_settype(zone, dns_zone_master);
+		dns_zone_setstats(zone, ns_g_server->zonestats);
+	}
+
+	dns_zone_setoption(zone, ~DNS_ZONEOPT_NOCHECKNS, ISC_FALSE);
+	dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS, ISC_TRUE);
+	dns_zone_setnotifytype(zone, dns_notifytype_no);
+	dns_zone_setdialup(zone, dns_dialuptype_no);
+	if (view->queryacl)
+		dns_zone_setqueryacl(zone, view->queryacl);
+	else
+		dns_zone_clearqueryacl(zone);
+	if (view->queryonacl)
+		dns_zone_setqueryonacl(zone, view->queryonacl);
+	else
+		dns_zone_clearqueryonacl(zone);
+	dns_zone_clearupdateacl(zone);
+	dns_zone_clearxfracl(zone);
+
+	CHECK(setquerystats(zone, view->mctx, zonestats_on));
+	if (db != NULL) {
+		dns_db_closeversion(db, &version, ISC_TRUE);
+		CHECK(dns_zone_replacedb(zone, db, ISC_FALSE));
+	}
+	dns_zone_setview(zone, view);
+	CHECK(dns_view_addzone(view, zone));
+
+	if (!strcmp(viewname, "_default")) {
+		sep = "";
+		viewname = "";
+	}
+	dns_name_format(name, namebuf, sizeof(namebuf));
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
+		      ISC_LOG_INFO, "automatic empty zone%s%s: %s",
+		      sep, viewname, namebuf);
+
+ cleanup:
+	if (myzone != NULL)
+		dns_zone_detach(&myzone);
+	if (version != NULL)
+		dns_db_closeversion(db, &version, ISC_FALSE);
+	if (db != NULL)
+		dns_db_detach(&db);
+	return (result);
+}
+
 /*
 * Configure 'view' according to 'vconfig', taking defaults from 'config'
 * where values are missing in 'vconfig'.
@@ -1105,7 +1353,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	isc_uint32_t max_clients_per_query;
 	const char *sep = ": view ";
 	const char *viewname = view->name;
-	const char *forview = " for view ";
 	isc_boolean_t rfc1918;
 	isc_boolean_t empty_zones_enable;
 	const cfg_obj_t *disablelist = NULL;
@@ -1138,8 +1385,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 	if (!strcmp(viewname, "_default")) {
 		sep = "";
 		viewname = "";
-		forview = "";
-		POST(forview);
 	}

 	/*
@@ -2001,7 +2246,6 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			 */
 			(void)dns_view_findzone(view, name, &zone);
 			if (zone != NULL) {
-				CHECK(setquerystats(zone, mctx, zonestats_on));
 				dns_zone_detach(&zone);
 				continue;
 			}
@@ -2046,43 +2290,13 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 			if (pview != NULL) {
 				(void)dns_view_findzone(pview, name, &zone);
 				dns_view_detach(&pview);
-				if (zone != NULL)
-					check_dbtype(&zone, empty_dbtypec,
-						     empty_dbtype, mctx);
-				if (zone != NULL) {
-					dns_zone_setview(zone, view);
-					CHECK(dns_view_addzone(view, zone));
-					CHECK(setquerystats(zone, mctx,
-							    zonestats_on));
-					dns_zone_detach(&zone);
-					continue;
-				}
 			}

-			CHECK(dns_zone_create(&zone, mctx));
-			CHECK(dns_zone_setorigin(zone, name));
-			dns_zone_setview(zone, view);
-			CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
-			dns_zone_setclass(zone, view->rdclass);
-			dns_zone_settype(zone, dns_zone_master);
-			dns_zone_setstats(zone, ns_g_server->zonestats);
-			CHECK(dns_zone_setdbtype(zone, empty_dbtypec,
-						 empty_dbtype));
-			if (view->queryacl != NULL)
-				dns_zone_setqueryacl(zone, view->queryacl);
-			if (view->queryonacl != NULL)
-				dns_zone_setqueryonacl(zone, view->queryonacl);
-			dns_zone_setdialup(zone, dns_dialuptype_no);
-			dns_zone_setnotifytype(zone, dns_notifytype_no);
-			dns_zone_setoption(zone, DNS_ZONEOPT_NOCHECKNS,
-					   ISC_TRUE);
-			CHECK(setquerystats(zone, mctx, zonestats_on));
-			CHECK(dns_view_addzone(view, zone));
-			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-				      "automatic empty zone%s%s: %s",
-				      sep, viewname,  empty);
-			dns_zone_detach(&zone);
+			CHECK(create_empty_zone(zone, name, view, zonelist,
+						empty_dbtype, empty_dbtypec,
+						zonestats_on));
+			if (zone != NULL)
+				dns_zone_detach(&zone);
 		}
 	}

@@ -3077,7 +3291,10 @@ load_configuration(const char *filename, ns_server_t *server,
 	dns_viewlist_t viewlist;
 	in_port_t listen_port, udpport_low, udpport_high;
 	int i;
+	int num_zones = 0;
+	isc_boolean_t exclusive = ISC_FALSE;
 	isc_interval_t interval;
+	isc_logconfig_t *logc = NULL;
 	isc_portset_t *v4portset = NULL;
 	isc_portset_t *v6portset = NULL;
 	isc_resourcevalue_t nfiles;
@@ -3087,8 +3304,6 @@ load_configuration(const char *filename, ns_server_t *server,
 	isc_uint32_t reserved;
 	isc_uint32_t udpsize;
 	unsigned int maxsocks;
-	int num_zones = 0;
-	isc_boolean_t exclusive = ISC_FALSE;

 	cfg_aclconfctx_init(&aclconfctx);
 	ISC_LIST_INIT(viewlist);
@@ -3345,8 +3560,8 @@ load_configuration(const char *filename, ns_server_t *server,
 	result = ns_config_get(maps, "tcp-listen-queue", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	ns_g_listen = cfg_obj_asuint32(obj);
-	if (ns_g_listen < 3)
-		ns_g_listen = 3;
+	if ((ns_g_listen > 0) && (ns_g_listen < 10))
+		ns_g_listen = 10;

 	/*
 	 * Configure the interface manager according to the "listen-on"
@@ -3670,13 +3885,30 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * unprivileged user, not root.
 	 */
 	if (ns_g_logstderr) {
+		const cfg_obj_t *logobj = NULL;
+
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "ignoring config file logging "
-			      "statement due to -g option");
+			      "not using config file logging "
+			      "statement for logging due to "
+			      "-g option");
+
+		(void)cfg_map_get(config, "logging", &logobj);
+		if (logobj != NULL) {
+			result = ns_log_configure(NULL, logobj);
+			if (result != ISC_R_SUCCESS) {
+				isc_log_write(ns_g_lctx,
+					      NS_LOGCATEGORY_GENERAL,
+					      NS_LOGMODULE_SERVER,
+					      ISC_LOG_ERROR,
+					      "checking logging configuration "
+					      "failed: %s",
+					      isc_result_totext(result));
+				goto cleanup;
+			}
+		}
 	} else {
 		const cfg_obj_t *logobj = NULL;
-		isc_logconfig_t *logc = NULL;

 		CHECKM(isc_logconfig_create(ns_g_lctx, &logc),
 		       "creating new logging configuration");
@@ -3695,11 +3927,9 @@ load_configuration(const char *filename, ns_server_t *server,
 			       "setting up default 'category default'");
 		}

-		result = isc_logconfig_use(ns_g_lctx, logc);
-		if (result != ISC_R_SUCCESS) {
-			isc_logconfig_destroy(&logc);
-			CHECKM(result, "installing logging configuration");
-		}
+		CHECKM(isc_logconfig_use(ns_g_lctx, logc),
+		       "installing logging configuration");
+		logc = NULL;

 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
@@ -3835,6 +4065,9 @@ load_configuration(const char *filename, ns_server_t *server,
 	result = ISC_R_SUCCESS;

 cleanup:
+	if (logc != NULL)
+		isc_logconfig_destroy(&logc);
+
 	if (v4portset != NULL)
 		isc_portset_destroy(ns_g_mctx, &v4portset);

@@ -5351,7 +5584,7 @@ ns_server_status(ns_server_t *server, isc_buffer_t *text) {

 	n = snprintf((char *)isc_buffer_used(text),
 		     isc_buffer_availablelength(text),
-		     "version: %s%s%s%s\n"
+		     "version: %s%s%s%s <id:%s>\n"
 #ifdef ISC_PLATFORM_USETHREADS
 		     "CPUs found: %u\n"
 		     "worker threads: %u\n"
@@ -5365,7 +5598,7 @@ ns_server_status(ns_server_t *server, isc_buffer_t *text) {
 		     "recursive clients: %d/%d/%d\n"
 		     "tcp clients: %d/%d\n"
 		     "server is up and running",
-		     ns_g_version, ob, alt, cb,
+		     ns_g_version, ob, alt, cb, ns_g_srcid,
 #ifdef ISC_PLATFORM_USETHREADS
 		     ns_g_cpus_detected, ns_g_cpus,
 #endif
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2013  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -955,6 +955,8 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	xmlFreeTextWriter(writer);

 	xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 1);
+	if (*buf == NULL)
+		goto error;
 	xmlFreeDoc(doc);
 	return (ISC_R_SUCCESS);

@@ -979,7 +981,7 @@ render_index(const char *url, const char *querystring, void *arg,
 	     isc_buffer_t *b, isc_httpdfree_t **freecb,
 	     void **freecb_args)
 {
-	unsigned char *msg;
+	unsigned char *msg = NULL;
 	int msglen;
 	ns_server_t *server = arg;
 	isc_result_t result;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -120,6 +120,9 @@ static isc_boolean_t non_root_caps = ISC_FALSE;
 #ifdef HAVE_SYS_CAPABILITY_H
 #include <sys/capability.h>
 #else
+#ifdef HAVE_LINUX_TYPES_H
+#include <linux/types.h>
+#endif
 /*%
 * We define _LINUX_FS_H to prevent it from being included.  We don't need
 * anything from it, and the files it includes cause warnings with 2.2
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -355,7 +355,6 @@ do_one_tuple(dns_difftuple_t **tuple, dns_db_t *db, dns_dbversion_t *ver,
 	 * Create a singleton diff.
 	 */
 	dns_diff_init(diff->mctx, &temp_diff);
-	temp_diff.resign = diff->resign;
 	ISC_LIST_APPEND(temp_diff.tuples, *tuple, link);

 	/*
@@ -2146,7 +2145,6 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	dns_diff_init(client->mctx, &affected);

 	dns_diff_init(client->mctx, &sig_diff);
-	sig_diff.resign = dns_zone_getsigresigninginterval(zone);
 	dns_diff_init(client->mctx, &nsec_diff);
 	dns_diff_init(client->mctx, &nsec_mindiff);

@@ -3140,7 +3138,7 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			 */
 			dns_rdata_clone(&tuple->rdata, &rdata);
 			INSIST(rdata.length <= sizeof(buf));
-			memcpy(buf, rdata.data, rdata.length);
+			memmove(buf, rdata.data, rdata.length);
 			buf[1] |= DNS_NSEC3FLAG_CREATE;
 			buf[1] &= ~DNS_NSEC3FLAG_UPDATE;
 			rdata.data = buf;
@@ -3217,7 +3215,7 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 		 */
 		dns_rdata_clone(&tuple->rdata, &rdata);
 		INSIST(rdata.length <= sizeof(buf));
-		memcpy(buf, rdata.data, rdata.length);
+		memmove(buf, rdata.data, rdata.length);
 		buf[1] |= DNS_NSEC3FLAG_REMOVE;
 		rdata.data = buf;

@@ -3422,7 +3420,7 @@ delete_chains(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	     result = dns_rdataset_next(&rdataset)) {
 		dns_rdataset_current(&rdataset, &rdata);
 		INSIST(rdata.length <= sizeof(buf));
-		memcpy(buf, rdata.data, rdata.length);
+		memmove(buf, rdata.data, rdata.length);

 		if (buf[1] == (DNS_NSEC3FLAG_REMOVE | DNS_NSEC3FLAG_NONSEC)) {
 			dns_rdata_reset(&rdata);
@@ -3860,7 +3858,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 				 * Set the NSEC3CHAIN creation flag.
 				 */
 				INSIST(rdata.length <= sizeof(buf));
-				memcpy(buf, rdata.data, rdata.length);
+				memmove(buf, rdata.data, rdata.length);
 				buf[1] |= DNS_NSEC3FLAG_UPDATE;
 				rdata.data = buf;
 				/*
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007, 2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -28,6 +28,11 @@
 #include <named/main.h>
 #include <named/server.h>

+/* In fact more bound to the platform toolset... */
+#if defined(_M_IX86) && (_MSC_VER < 1600)
+#define ISC_ADJUST_FDIV
+#endif
+
 /* Handle to SCM for updating service status */
 static SERVICE_STATUS_HANDLE hServiceStatus = 0;
 static BOOL foreground = FALSE;
@@ -199,7 +204,7 @@ _CRTIMP void __cdecl __getmainargs(int *, char ***, char ***, int,
 				   _startupinfo *);
 void __cdecl _setargv(void);

-#ifdef _M_IX86
+#ifdef ISC_ADJUST_FDIV
 /* Pentium FDIV adjustment */
 extern int _adjust_fdiv;
 extern int * _imp___adjust_fdiv;
@@ -236,7 +241,7 @@ void GetArgs(int *argc, char ***argv, char ***envp)
 	__getmainargs(argc, argv, envp, _dowildcard, &startinfo);
 	__initenv = *envp;

-#ifdef _M_IX86
+#ifdef ISC_ADJUST_FDIV
 	_adjust_fdiv = * _imp___adjust_fdiv;
 	_setdefaultprecision();
 #endif
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -1016,14 +1016,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 				  question_name, question_class);
 #ifdef DLZ
 			is_dlz = ISC_TRUE;
-			/*
-			 * DLZ only support full zone transfer, not incremental
-			 */
-			if (reqtype != dns_rdatatype_axfr) {
-				mnemonic = "AXFR-style IXFR";
-				reqtype = dns_rdatatype_axfr;
-			}
-
 		} else {
 			/*
 			 * not DLZ and not in normal zone table, we are
@@ -1036,11 +1028,13 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		/* zone table has a match */
 #endif
 		switch(dns_zone_gettype(zone)) {
+			/* Master and slave zones are OK for transfer. */
 			case dns_zone_master:
 			case dns_zone_slave:
-				break;	/* Master and slave zones are OK for transfer. */
+				break;
 			default:
-				FAILQ(DNS_R_NOTAUTH, "non-authoritative zone", question_name, question_class);
+				FAILQ(DNS_R_NOTAUTH, "non-authoritative zone",
+				      question_name, question_class);
 			}
 		CHECK(dns_zone_getdb(zone, &db));
 		dns_db_currentversion(db, &ver);
@@ -1185,7 +1179,11 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 			is_poll = ISC_TRUE;
 			goto have_stream;
 		}
+#ifdef DLZ
+		journalfile = is_dlz ? NULL : dns_zone_getjournal(zone);
+#else
 		journalfile = dns_zone_getjournal(zone);
+#endif
 		if (journalfile != NULL)
 			result = ixfr_rrstream_create(mctx,
 						      journalfile,
@@ -724,6 +724,17 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
 				   cfg_obj_asboolean(obj));

+		obj = NULL;
+		result = ns_config_get(maps, "check-spf", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
+			check = ISC_TRUE;
+		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
+			check = ISC_FALSE;
+		} else
+			INSIST(0);
+		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);
+
 		obj = NULL;
 		result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -755,13 +755,17 @@ setup_system(void) {
 		if (servers == NULL)
 			fatal("out of memory");
 		for (i = 0; i < ns_total; i++) {
-			if (lwconf->nameservers[i].family == LWRES_ADDRTYPE_V4) {
+			if (lwconf->nameservers[i].family == LWRES_ADDRTYPE_V4)
+			{
 				struct in_addr in4;
-				memcpy(&in4, lwconf->nameservers[i].address, 4);
-				isc_sockaddr_fromin(&servers[i], &in4, DNSDEFAULTPORT);
+				memmove(&in4,
+					lwconf->nameservers[i].address, 4);
+				isc_sockaddr_fromin(&servers[i], &in4,
+						    DNSDEFAULTPORT);
 			} else {
 				struct in6_addr in6;
-				memcpy(&in6, lwconf->nameservers[i].address, 16);
+				memmove(&in6,
+					lwconf->nameservers[i].address, 16);
 				isc_sockaddr_fromin6(&servers[i], &in6,
 						     DNSDEFAULTPORT);
 			}
@@ -848,7 +852,7 @@ get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
 	INSIST(count == 1);
 }

-#define PARSE_ARGS_FMT "dDMl:y:govk:rR::t:u:"
+#define PARSE_ARGS_FMT "dDMl:y:govk:r:R::t:u:"

 static void
 pre_parse_args(int argc, char **argv) {
@@ -1421,16 +1425,20 @@ evaluate_realm(char *cmdline) {
 #ifdef GSSAPI
 	char *word;
 	char buf[1024];
+	int n;

-	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (word == NULL || *word == 0) {
-		if (realm != NULL)
-			isc_mem_free(mctx, realm);
+	if (realm != NULL) {
+		isc_mem_free(mctx, realm);
 		realm = NULL;
-		return (STATUS_MORE);
 	}

-	snprintf(buf, sizeof(buf), "@%s", word);
+	word = nsu_strsep(&cmdline, " \t\r\n");
+	if (word == NULL || *word == 0)
+		return (STATUS_MORE);
+
+	n = snprintf(buf, sizeof(buf), "@%s", word);
+	if (n < 0 || (size_t)n >= sizeof(buf))
+		fatal("realm is too long");
 	realm = isc_mem_strdup(mctx, buf);
 	if (realm == NULL)
 		fatal("out of memory");
@@ -2370,7 +2378,7 @@ start_gssrequest(dns_name_t *master)
 	if (userserver == NULL)
 		get_address(namestr, DNSDEFAULTPORT, kserver);
 	else
-		(void)memcpy(kserver, userserver, sizeof(isc_sockaddr_t));
+		(void)memmove(kserver, userserver, sizeof(isc_sockaddr_t));

 	dns_fixedname_init(&fname);
 	servname = dns_fixedname_name(&fname);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2011, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -155,7 +155,7 @@ main(int argc, char **argv) {

 	result = isc_file_progname(*argv, program, sizeof(program));
 	if (result != ISC_R_SUCCESS)
-		memcpy(program, "rndc-confgen", 13);
+		memmove(program, "rndc-confgen", 13);
 	progname = program;

 	keyname = DEFAULT_KEYNAME;
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2013 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -20,11 +20,11 @@
 .\"     Title: rndc
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
-.\"      Date: June 30, 2000
+.\"      Date: June 7, 2013
 .\"    Manual: BIND9
 .\"    Source: BIND9
 .\"
-.TH "RNDC" "8" "June 30, 2000" "BIND9" "BIND9"
+.TH "RNDC" "8" "June 7, 2013" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -113,18 +113,172 @@ is specified,
 \fBrndc\fR
 will first look for a key clause in the server statement of the server being used, or if no server statement is present for that host, then the default\-key clause of the options statement. Note that the configuration file contains shared secrets which are used to send authenticated control commands to name servers. It should therefore not have general read or write access.
 .RE
+.SH "COMMANDS"
 .PP
-For the complete set of commands supported by
-\fBrndc\fR, see the BIND 9 Administrator Reference Manual or run
+A list of commands supported by
 \fBrndc\fR
-without arguments to see its help message.
+can be seen by running
+\fBrndc\fR
+without arguments.
+.PP
+Currently supported commands are:
+.PP
+\fBreload\fR
+.RS 4
+Reload configuration file and zones.
+.RE
+.PP
+\fBreload \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR
+.RS 4
+Reload the given zone.
+.RE
+.PP
+\fBrefresh \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR
+.RS 4
+Schedule zone maintenance for the given zone.
+.RE
+.PP
+\fBretransfer \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR
+.RS 4
+Retransfer the given zone from the master.
+.RE
+.PP
+\fBfreeze \fR\fB[\fIzone\fR [\fIclass\fR [\fIview\fR]]]\fR
+.RS 4
+Suspend updates to a dynamic zone. If no zone is specified, then all zones are suspended. This allows manual edits to be made to a zone normally updated by dynamic update. It also causes changes in the journal file to be synced into the master file, and the journal file to be removed. All dynamic update attempts will be refused while the zone is frozen.
+.RE
+.PP
+\fBthaw \fR\fB[\fIzone\fR [\fIclass\fR [\fIview\fR]]]\fR
+.RS 4
+Enable updates to a frozen dynamic zone. If no zone is specified, then all frozen zones are enabled. This causes the server to reload the zone from disk, and re\-enables dynamic updates after the load has completed. After a zone is thawed, dynamic updates will no longer be refused.
+.RE
+.PP
+\fBnotify \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR
+.RS 4
+Resend NOTIFY messages for the zone.
+.RE
+.PP
+\fBreconfig\fR
+.RS 4
+Reload the configuration file and load new zones, but do not reload existing zone files even if they have changed. This is faster than a full
+\fBreload\fR
+when there is a large number of zones because it avoids the need to examine the modification times of the zones files.
+.RE
+.PP
+\fBstats\fR
+.RS 4
+Write server statistics to the statistics file.
+.RE
+.PP
+\fBquerylog\fR [on|off]
+.RS 4
+Toggle query logging. Query logging can also be enabled by explicitly directing the
+\fBqueries\fR
+\fBcategory\fR
+to a
+\fBchannel\fR
+in the
+\fBlogging\fR
+section of
+\fInamed.conf\fR
+or by specifying
+\fBquerylog yes;\fR
+in the
+\fBoptions\fR
+section of
+\fInamed.conf\fR.
+.RE
+.PP
+\fBdumpdb \fR\fB[\-all|\-cache|\-zone]\fR\fB \fR\fB[\fIview ...\fR]\fR
+.RS 4
+Dump the server's caches (default) and/or zones to the dump file for the specified views. If no view is specified, all views are dumped.
+.RE
+.PP
+\fBstop \fR\fB[\-p]\fR
+.RS 4
+Stop the server, making sure any recent changes made through dynamic update or IXFR are first saved to the master files of the updated zones. If
+\fB\-p\fR
+is specified
+\fBnamed\fR's process id is returned. This allows an external process to determine when
+\fBnamed\fR
+had completed stopping.
+.RE
+.PP
+\fBhalt \fR\fB[\-p]\fR
+.RS 4
+Stop the server immediately. Recent changes made through dynamic update or IXFR are not saved to the master files, but will be rolled forward from the journal files when the server is restarted. If
+\fB\-p\fR
+is specified
+\fBnamed\fR's process id is returned. This allows an external process to determine when
+\fBnamed\fR
+had completed halting.
+.RE
+.PP
+\fBtrace\fR
+.RS 4
+Increment the servers debugging level by one.
+.RE
+.PP
+\fBtrace \fR\fB\fIlevel\fR\fR
+.RS 4
+Sets the server's debugging level to an explicit value.
+.RE
+.PP
+\fBnotrace\fR
+.RS 4
+Sets the server's debugging level to 0.
+.RE
+.PP
+\fBflush\fR
+.RS 4
+Flushes the server's cache.
+.RE
+.PP
+\fBflushname\fR \fIname\fR [\fIview\fR]
+.RS 4
+Flushes the given name from the server's cache.
+.RE
+.PP
+\fBstatus\fR
+.RS 4
+Display status of the server. Note that the number of zones includes the internal
+\fBbind/CH\fR
+zone and the default
+\fB./IN\fR
+hint zone if there is not an explicit root zone configured.
+.RE
+.PP
+\fBrecursing\fR
+.RS 4
+Dump the list of queries
+\fBnamed\fR
+is currently recursing on.
+.RE
+.PP
+\fBvalidation ( on | off | check ) \fR\fB[\fIview ...\fR]\fR\fB \fR
+.RS 4
+Enable, disable, or check the current status of DNSSEC validation. Note
+\fBdnssec\-enable\fR
+also needs to be set to
+\fByes\fR
+or
+\fBauto\fR
+to be effective. It defaults to enabled.
+.RE
+.PP
+\fBtsig\-list\fR
+.RS 4
+List the names of all TSIG keys currently configured for use by
+\fBnamed\fR
+in each view. The list both statically configured keys and dynamic TKEY\-negotiated keys.
+.RE
+.PP
+\fBtsig\-delete\fR \fIkeyname\fR [\fIview\fR]
+.RS 4
+Delete a given TKEY\-negotiated key from the server. (This does not apply to statically configured TSIG keys.)
+.RE
 .SH "LIMITATIONS"
 .PP
-\fBrndc\fR
-does not yet support all the commands of the BIND 8
-\fBndc\fR
-utility.
-.PP
 There is currently no way to provide the shared secret for a
 \fBkey_id\fR
 without using the configuration file.
@@ -142,7 +296,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2013 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -79,6 +79,7 @@ static unsigned char databuf[2048];
 static isccc_ccmsg_t ccmsg;
 static isccc_region_t secret;
 static isc_boolean_t failed = ISC_FALSE;
+static isc_boolean_t c_flag = ISC_FALSE;
 static isc_mem_t *mctx;
 static int sends, recvs, connects;
 static char *command;
@@ -458,6 +459,9 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 		conffile = admin_keyfile;
 		conftype = &cfg_type_rndckey;

+		if (c_flag)
+			fatal("%s does not exist", admin_conffile);
+
 		if (! isc_file_exists(conffile))
 			fatal("neither %s nor %s was found",
 			      admin_conffile, admin_keyfile);
@@ -684,7 +688,7 @@ main(int argc, char **argv) {

 	result = isc_file_progname(*argv, program, sizeof(program));
 	if (result != ISC_R_SUCCESS)
-		memcpy(program, "rndc", 5);
+		memmove(program, "rndc", 5);
 	progname = program;

 	admin_conffile = RNDC_CONFFILE;
@@ -716,6 +720,7 @@ main(int argc, char **argv) {

 		case 'c':
 			admin_conffile = isc_commandline_argument;
+			c_flag = ISC_TRUE;
 			break;

 		case 'k':
@@ -815,7 +820,7 @@ main(int argc, char **argv) {
 	p = args;
 	for (i = 0; i < argc; i++) {
 		size_t len = strlen(argv[i]);
-		memcpy(p, argv[i], len);
+		memmove(p, argv[i], len);
 		p += len;
 		*p++ = ' ';
 	}
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2013  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -21,7 +21,7 @@
 <!-- $Id: rndc.docbook,v 1.21 2007/12/14 20:39:14 marka Exp $ -->
 <refentry id="man.rndc">
  <refentryinfo>
-    <date>June 30, 2000</date>
+    <date>June 7, 2013</date>
  </refentryinfo>

  <refmeta>
@@ -40,6 +40,7 @@
      <year>2004</year>
      <year>2005</year>
      <year>2007</year>
+      <year>2013</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -194,22 +195,288 @@
      </varlistentry>

    </variablelist>
+  </refsect1>

+  <refsect1>
+    <title>COMMANDS</title>
    <para>
-      For the complete set of commands supported by <command>rndc</command>,
-      see the BIND 9 Administrator Reference Manual or run
-      <command>rndc</command> without arguments to see its help
-      message.
+      A list of commands supported by <command>rndc</command> can
+      be seen by running <command>rndc</command> without arguments.
+    </para>
+    <para>
+      Currently supported commands are:
    </para>

+    <variablelist>
+      <varlistentry>
+        <term><userinput>reload</userinput></term>
+        <listitem>
+          <para>
+            Reload configuration file and zones.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>reload <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+        <listitem>
+          <para>
+            Reload the given zone.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>refresh <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+        <listitem>
+          <para>
+            Schedule zone maintenance for the given zone.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>retransfer <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+        <listitem>
+          <para>
+            Retransfer the given zone from the master.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>freeze <optional><replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></optional></userinput></term>
+        <listitem>
+          <para>
+            Suspend updates to a dynamic zone.  If no zone is
+            specified, then all zones are suspended.  This allows
+            manual edits to be made to a zone normally updated by
+            dynamic update.  It also causes changes in the
+            journal file to be synced into the master file,
+            and the journal file to be removed.
+            All dynamic update attempts will be refused while
+            the zone is frozen.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>thaw <optional><replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></optional></userinput></term>
+        <listitem>
+          <para>
+            Enable updates to a frozen dynamic zone.  If no
+            zone is specified, then all frozen zones are
+            enabled.  This causes the server to reload the zone
+            from disk, and re-enables dynamic updates after the
+            load has completed.  After a zone is thawed,
+            dynamic updates will no longer be refused.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>notify <replaceable>zone</replaceable> <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+        <listitem>
+          <para>
+            Resend NOTIFY messages for the zone.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>reconfig</userinput></term>
+        <listitem>
+          <para>
+            Reload the configuration file and load new zones,
+            but do not reload existing zone files even if they
+            have changed.
+            This is faster than a full <command>reload</command> when there
+            is a large number of zones because it avoids the need
+            to examine the
+            modification times of the zones files.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>stats</userinput></term>
+        <listitem>
+          <para>
+            Write server statistics to the statistics file.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>querylog</userinput> <optional>on|off</optional> </term>
+        <listitem>
+          <para>
+            Toggle query logging.  Query logging can also be enabled
+            by explicitly directing the <command>queries</command>
+            <command>category</command> to a
+            <command>channel</command> in the
+            <command>logging</command> section of
+            <filename>named.conf</filename> or by specifying
+            <command>querylog yes;</command> in the
+            <command>options</command> section of
+            <filename>named.conf</filename>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>dumpdb <optional>-all|-cache|-zone</optional> <optional><replaceable>view ...</replaceable></optional></userinput></term>
+        <listitem>
+          <para>
+            Dump the server's caches (default) and/or zones to
+            the
+            dump file for the specified views.  If no view is
+            specified, all
+            views are dumped.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>stop <optional>-p</optional></userinput></term>
+        <listitem>
+          <para>
+            Stop the server, making sure any recent changes
+            made through dynamic update or IXFR are first saved to
+            the master files of the updated zones.
+            If <option>-p</option> is specified <command>named</command>'s process id is returned.
+            This allows an external process to determine when <command>named</command>
+            had completed stopping.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>halt <optional>-p</optional></userinput></term>
+        <listitem>
+          <para>
+            Stop the server immediately.  Recent changes
+            made through dynamic update or IXFR are not saved to
+            the master files, but will be rolled forward from the
+            journal files when the server is restarted.
+            If <option>-p</option> is specified <command>named</command>'s process id is returned.
+            This allows an external process to determine when <command>named</command>
+            had completed halting.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>trace</userinput></term>
+        <listitem>
+          <para>
+            Increment the servers debugging level by one.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>trace <replaceable>level</replaceable></userinput></term>
+        <listitem>
+          <para>
+            Sets the server's debugging level to an explicit
+            value.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>notrace</userinput></term>
+        <listitem>
+          <para>
+            Sets the server's debugging level to 0.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>flush</userinput></term>
+        <listitem>
+          <para>
+            Flushes the server's cache.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>flushname</userinput> <replaceable>name</replaceable> <optional><replaceable>view</replaceable></optional> </term>
+        <listitem>
+          <para>
+            Flushes the given name from the server's cache.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>status</userinput></term>
+        <listitem>
+          <para>
+            Display status of the server.
+            Note that the number of zones includes the internal <command>bind/CH</command> zone
+            and the default <command>./IN</command>
+            hint zone if there is not an
+            explicit root zone configured.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>recursing</userinput></term>
+        <listitem>
+          <para>
+            Dump the list of queries <command>named</command> is currently recursing
+            on.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>validation ( on | off | check ) <optional><replaceable>view ...</replaceable></optional> </userinput></term>
+        <listitem>
+          <para>
+            Enable, disable, or check the current status of
+            DNSSEC validation.
+            Note <command>dnssec-enable</command> also needs to be
+            set to <userinput>yes</userinput> or
+            <userinput>auto</userinput> to be effective.
+            It defaults to enabled.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>tsig-list</userinput></term>
+        <listitem>
+          <para>
+            List the names of all TSIG keys currently configured
+            for use by <command>named</command> in each view.  The
+            list both statically configured keys and dynamic
+            TKEY-negotiated keys.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><userinput>tsig-delete</userinput> <replaceable>keyname</replaceable> <optional><replaceable>view</replaceable></optional></term>
+        <listitem>
+          <para>
+            Delete a given TKEY-negotiated key from the server.
+            (This does not apply to statically configured TSIG
+            keys.)
+          </para>
+        </listitem>
+      </varlistentry>
+
+    </variablelist>
  </refsect1>

  <refsect1>
    <title>LIMITATIONS</title>
-    <para><command>rndc</command>
-      does not yet support all the commands of
-      the BIND 8 <command>ndc</command> utility.
-    </para>
    <para>
      There is currently no way to provide the shared secret for a
      <option>key_id</option> without using the configuration file.
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2013 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543414"></a><h2>DESCRIPTION</h2>
+<a name="id2543417"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc</strong></span>
      controls the operation of a name
      server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -61,7 +61,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543449"></a><h2>OPTIONS</h2>
+<a name="id2543452"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
 <dd><p>
@@ -125,19 +125,170 @@
            or write access.
          </p></dd>
 </dl></div>
-<p>
-      For the complete set of commands supported by <span><strong class="command">rndc</strong></span>,
-      see the BIND 9 Administrator Reference Manual or run
-      <span><strong class="command">rndc</strong></span> without arguments to see its help
-      message.
-    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543657"></a><h2>LIMITATIONS</h2>
-<p><span><strong class="command">rndc</strong></span>
-      does not yet support all the commands of
-      the BIND 8 <span><strong class="command">ndc</strong></span> utility.
+<a name="id2543649"></a><h2>COMMANDS</h2>
+<p>
+      A list of commands supported by <span><strong class="command">rndc</strong></span> can
+      be seen by running <span><strong class="command">rndc</strong></span> without arguments.
    </p>
+<p>
+      Currently supported commands are:
+    </p>
+<div class="variablelist"><dl>
+<dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
+<dd><p>
+            Reload configuration file and zones.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>reload <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
+<dd><p>
+            Reload the given zone.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>refresh <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
+<dd><p>
+            Schedule zone maintenance for the given zone.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>retransfer <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
+<dd><p>
+            Retransfer the given zone from the master.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
+<dd><p>
+            Suspend updates to a dynamic zone.  If no zone is
+            specified, then all zones are suspended.  This allows
+            manual edits to be made to a zone normally updated by
+            dynamic update.  It also causes changes in the
+            journal file to be synced into the master file,
+            and the journal file to be removed.
+            All dynamic update attempts will be refused while
+            the zone is frozen.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>thaw [<span class="optional"><em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
+<dd><p>
+            Enable updates to a frozen dynamic zone.  If no
+            zone is specified, then all frozen zones are
+            enabled.  This causes the server to reload the zone
+            from disk, and re-enables dynamic updates after the
+            load has completed.  After a zone is thawed,
+            dynamic updates will no longer be refused.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
+<dd><p>
+            Resend NOTIFY messages for the zone.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
+<dd><p>
+            Reload the configuration file and load new zones,
+            but do not reload existing zone files even if they
+            have changed.
+            This is faster than a full <span><strong class="command">reload</strong></span> when there
+            is a large number of zones because it avoids the need
+            to examine the
+            modification times of the zones files.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>stats</code></strong></span></dt>
+<dd><p>
+            Write server statistics to the statistics file.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>querylog</code></strong> [<span class="optional">on|off</span>] </span></dt>
+<dd><p>
+            Toggle query logging.  Query logging can also be enabled
+            by explicitly directing the <span><strong class="command">queries</strong></span>
+            <span><strong class="command">category</strong></span> to a
+            <span><strong class="command">channel</strong></span> in the
+            <span><strong class="command">logging</strong></span> section of
+            <code class="filename">named.conf</code> or by specifying
+            <span><strong class="command">querylog yes;</strong></span> in the
+            <span><strong class="command">options</strong></span> section of
+            <code class="filename">named.conf</code>.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
+<dd><p>
+            Dump the server's caches (default) and/or zones to
+            the
+            dump file for the specified views.  If no view is
+            specified, all
+            views are dumped.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
+<dd><p>
+            Stop the server, making sure any recent changes
+            made through dynamic update or IXFR are first saved to
+            the master files of the updated zones.
+            If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
+            This allows an external process to determine when <span><strong class="command">named</strong></span>
+            had completed stopping.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
+<dd><p>
+            Stop the server immediately.  Recent changes
+            made through dynamic update or IXFR are not saved to
+            the master files, but will be rolled forward from the
+            journal files when the server is restarted.
+            If <code class="option">-p</code> is specified <span><strong class="command">named</strong></span>'s process id is returned.
+            This allows an external process to determine when <span><strong class="command">named</strong></span>
+            had completed halting.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
+<dd><p>
+            Increment the servers debugging level by one.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
+<dd><p>
+            Sets the server's debugging level to an explicit
+            value.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>notrace</code></strong></span></dt>
+<dd><p>
+            Sets the server's debugging level to 0.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>flush</code></strong></span></dt>
+<dd><p>
+            Flushes the server's cache.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>flushname</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
+<dd><p>
+            Flushes the given name from the server's cache.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
+<dd><p>
+            Display status of the server.
+            Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
+            and the default <span><strong class="command">./IN</strong></span>
+            hint zone if there is not an
+            explicit root zone configured.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
+<dd><p>
+            Dump the list of queries <span><strong class="command">named</strong></span> is currently recursing
+            on.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>validation ( on | off | check ) [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>] </code></strong></span></dt>
+<dd><p>
+            Enable, disable, or check the current status of
+            DNSSEC validation.
+            Note <span><strong class="command">dnssec-enable</strong></span> also needs to be
+            set to <strong class="userinput"><code>yes</code></strong> or
+            <strong class="userinput"><code>auto</code></strong> to be effective.
+            It defaults to enabled.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>tsig-list</code></strong></span></dt>
+<dd><p>
+            List the names of all TSIG keys currently configured
+            for use by <span><strong class="command">named</strong></span> in each view.  The
+            list both statically configured keys and dynamic
+            TKEY-negotiated keys.
+          </p></dd>
+<dt><span class="term"><strong class="userinput"><code>tsig-delete</code></strong> <em class="replaceable"><code>keyname</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span></dt>
+<dd><p>
+            Delete a given TKEY-negotiated key from the server.
+            (This does not apply to statically configured TSIG
+            keys.)
+          </p></dd>
+</dl></div>
+</div>
+<div class="refsect1" lang="en">
+<a name="id2544382"></a><h2>LIMITATIONS</h2>
 <p>
      There is currently no way to provide the shared secret for a
      <code class="option">key_id</code> without using the configuration file.
@@ -147,7 +298,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543684"></a><h2>SEE ALSO</h2>
+<a name="id2544401"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -157,7 +308,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543739"></a><h2>AUTHOR</h2>
+<a name="id2544524"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2008, 2010, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2008, 2010, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -131,6 +131,10 @@ XSRCS =		adb_test.c \
 		wire_test.c \
 		zone_test.c

+# override all rule to make sure top directory targets are built before
+# processing subdirectories.
+all: ${TARGETS} subdirs testdirs
+
@BIND9_MAKE_RULES@

 all_tests: ${XTARGETS}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -613,10 +613,11 @@ main(int argc, char *argv[]) {
 		} else if (strstr(s, "!V") == s) {
 			DBI_CHECK(dbi);
 			v = atoi(&s[2]);
-			if (v >= dbi->rcount) {
+			if (v >= dbi->rcount || v < 0) {
 				printf("unknown open version %d\n", v);
 				continue;
-			} else if (dbi->rversions[v] == NULL) {
+			}
+			if (dbi->rversions[v] == NULL) {
 				printf("version %d is not open\n", v);
 				continue;
 			}
@@ -0,0 +1,16 @@
+randomfile
+Kdh.+002+18602.key
+Kdh.+002+18602.private
+Kdh.+002+48957.key
+Kdh.+002+48957.private
+Ktest.+001+00002.key
+Ktest.+001+54622.key
+Ktest.+001+54622.private
+Ktest.+003+23616.key
+Ktest.+003+23616.private
+Ktest.+003+49667.key
+dst_2_data
+t2_data_1
+t2_data_2
+t2_dsasig
+t2_rsasig
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2006-2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006-2008, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1999-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -49,7 +49,7 @@ dst_test@EXEEXT@: dst_test.@O@ ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 		dst_test.@O@ ${LIBS}

-t_dst@EXEEXT@: t_dst.@O@ ${DEPLIBS} ${TLIB}
+t_dst@EXEEXT@: t_dst.@O@ ${DEPLIBS} ${TLIB} randomfile
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 		t_dst.@O@ ${TLIB} ${LIBS}

@@ -57,9 +57,29 @@ gsstest@EXEEXT@: gsstest.@O@ ${DEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 		gsstest.@O@ ${LIBS}

-test: t_dst@EXEEXT@
+test: t_dst@EXEEXT@ randomfile
+	../genrandom@EXEEXT@ 100 randomfile
+	-@ ./t_dst@EXEEXT@ -q 1800 -a
+
+randomfile:
 	../genrandom@EXEEXT@ 100 randomfile
-	-@ ./t_dst@EXEEXT@ -b @srcdir@ -q 1800 -a

 clean distclean::
 	rm -f ${TARGETS} randomfile
+
+distclean::
+	rm -f Kdh.+002+18602.key
+	rm -f Kdh.+002+18602.private
+	rm -f Kdh.+002+48957.key
+	rm -f Kdh.+002+48957.private
+	rm -f Ktest.+001+00002.key
+	rm -f Ktest.+001+54622.key
+	rm -f Ktest.+001+54622.private
+	rm -f Ktest.+003+23616.key
+	rm -f Ktest.+003+23616.private
+	rm -f Ktest.+003+49667.key
+	rm -f dst_2_data
+	rm -f t2_data_1
+	rm -f t2_data_2
+	rm -f t2_dsasig
+	rm -f t2_rsasig
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -66,35 +66,35 @@ main(int argc, char **argv) {

 	s = "abc";
 	isc_sha1_init(&sha1);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_sha1_update(&sha1, buffer, strlen(s));
 	isc_sha1_final(&sha1, digest);
 	print_digest(s, "sha1", digest, ISC_SHA1_DIGESTLENGTH/4);

 	s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
 	isc_sha1_init(&sha1);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_sha1_update(&sha1, buffer, strlen(s));
 	isc_sha1_final(&sha1, digest);
 	print_digest(s, "sha1", digest, ISC_SHA1_DIGESTLENGTH/4);

 	s = "abc";
 	isc_sha224_init(&sha224);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_sha224_update(&sha224, buffer, strlen(s));
 	isc_sha224_final(digest, &sha224);
 	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);

 	s = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq";
 	isc_sha224_init(&sha224);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_sha224_update(&sha224, buffer, strlen(s));
 	isc_sha224_final(digest, &sha224);
 	print_digest(s, "sha224", digest, ISC_SHA224_DIGESTLENGTH/4);

 	s = "abc";
 	isc_md5_init(&md5);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_md5_update(&md5, buffer, strlen(s));
 	isc_md5_final(&md5, digest);
 	print_digest(s, "md5", digest, 4);
@@ -105,7 +105,7 @@ main(int argc, char **argv) {
 	s = "Hi There";
 	memset(key, 0x0b, 16);
 	isc_hmacmd5_init(&hmacmd5, key, 16);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
 	isc_hmacmd5_sign(&hmacmd5, digest);
 	print_digest(s, "hmacmd5", digest, 4);
@@ -113,7 +113,7 @@ main(int argc, char **argv) {
 	s = "what do ya want for nothing?";
 	strcpy((char *)key, "Jefe");
 	isc_hmacmd5_init(&hmacmd5, key, 4);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
 	isc_hmacmd5_sign(&hmacmd5, digest);
 	print_digest(s, "hmacmd5", digest, 4);
@@ -125,7 +125,7 @@ main(int argc, char **argv) {
 	    "\335\335\335\335\335\335\335\335\335\335";
 	memset(key, 0xaa, 16);
 	isc_hmacmd5_init(&hmacmd5, key, 16);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacmd5_update(&hmacmd5, buffer, strlen(s));
 	isc_hmacmd5_sign(&hmacmd5, digest);
 	print_digest(s, "hmacmd5", digest, 4);
@@ -136,7 +136,7 @@ main(int argc, char **argv) {
 	s = "Hi There";
 	memset(key, 0x0b, 20);
 	isc_hmacsha1_init(&hmacsha1, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
 	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
 	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
@@ -144,7 +144,7 @@ main(int argc, char **argv) {
 	s = "what do ya want for nothing?";
 	strcpy((char *)key, "Jefe");
 	isc_hmacsha1_init(&hmacsha1, key, 4);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
 	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
 	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
@@ -156,7 +156,7 @@ main(int argc, char **argv) {
 	    "\335\335\335\335\335\335\335\335\335\335";
 	memset(key, 0xaa, 20);
 	isc_hmacsha1_init(&hmacsha1, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha1_update(&hmacsha1, buffer, strlen(s));
 	isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
 	print_digest(s, "hmacsha1", digest, ISC_SHA1_DIGESTLENGTH/4);
@@ -167,7 +167,7 @@ main(int argc, char **argv) {
 	s = "Hi There";
 	memset(key, 0x0b, 20);
 	isc_hmacsha224_init(&hmacsha224, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
 	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
 	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
@@ -175,7 +175,7 @@ main(int argc, char **argv) {
 	s = "what do ya want for nothing?";
 	strcpy((char *)key, "Jefe");
 	isc_hmacsha224_init(&hmacsha224, key, 4);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
 	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
 	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
@@ -187,7 +187,7 @@ main(int argc, char **argv) {
 	    "\335\335\335\335\335\335\335\335\335\335";
 	memset(key, 0xaa, 20);
 	isc_hmacsha224_init(&hmacsha224, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha224_update(&hmacsha224, buffer, strlen(s));
 	isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
 	print_digest(s, "hmacsha224", digest, ISC_SHA224_DIGESTLENGTH/4);
@@ -198,7 +198,7 @@ main(int argc, char **argv) {
 	s = "Hi There";
 	memset(key, 0x0b, 20);
 	isc_hmacsha256_init(&hmacsha256, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
 	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
 	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
@@ -206,7 +206,7 @@ main(int argc, char **argv) {
 	s = "what do ya want for nothing?";
 	strcpy((char *)key, "Jefe");
 	isc_hmacsha256_init(&hmacsha256, key, 4);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
 	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
 	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
@@ -218,7 +218,7 @@ main(int argc, char **argv) {
 	    "\335\335\335\335\335\335\335\335\335\335";
 	memset(key, 0xaa, 20);
 	isc_hmacsha256_init(&hmacsha256, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha256_update(&hmacsha256, buffer, strlen(s));
 	isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
 	print_digest(s, "hmacsha256", digest, ISC_SHA256_DIGESTLENGTH/4);
@@ -229,7 +229,7 @@ main(int argc, char **argv) {
 	s = "Hi There";
 	memset(key, 0x0b, 20);
 	isc_hmacsha384_init(&hmacsha384, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
 	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
 	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
@@ -237,7 +237,7 @@ main(int argc, char **argv) {
 	s = "what do ya want for nothing?";
 	strcpy((char *)key, "Jefe");
 	isc_hmacsha384_init(&hmacsha384, key, 4);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
 	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
 	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
@@ -249,7 +249,7 @@ main(int argc, char **argv) {
 	    "\335\335\335\335\335\335\335\335\335\335";
 	memset(key, 0xaa, 20);
 	isc_hmacsha384_init(&hmacsha384, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha384_update(&hmacsha384, buffer, strlen(s));
 	isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
 	print_digest(s, "hmacsha384", digest, ISC_SHA384_DIGESTLENGTH/4);
@@ -260,7 +260,7 @@ main(int argc, char **argv) {
 	s = "Hi There";
 	memset(key, 0x0b, 20);
 	isc_hmacsha512_init(&hmacsha512, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
 	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
 	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
@@ -268,7 +268,7 @@ main(int argc, char **argv) {
 	s = "what do ya want for nothing?";
 	strcpy((char *)key, "Jefe");
 	isc_hmacsha512_init(&hmacsha512, key, 4);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
 	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
 	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
@@ -280,7 +280,7 @@ main(int argc, char **argv) {
 	    "\335\335\335\335\335\335\335\335\335\335";
 	memset(key, 0xaa, 20);
 	isc_hmacsha512_init(&hmacsha512, key, 20);
-	memcpy(buffer, s, strlen(s));
+	memmove(buffer, s, strlen(s));
 	isc_hmacsha512_update(&hmacsha512, buffer, strlen(s));
 	isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
 	print_digest(s, "hmacsha512", digest, ISC_SHA512_DIGESTLENGTH/4);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.58 2007/06/19 23:46:59 tbox Exp $ */
+/* $Id: named.conf,v 1.59 2011/03/03 14:10:26 fdupont Exp $ */

 /*
 * This is a worthless, nonrunnable example of a named.conf file that has
@@ -153,7 +153,7 @@ options {
 	min-retry-time 1111;
 	max-refresh-time 888;
 	min-refresh-time 777;
- 
+
 	max-ncache-ttl 333;
 	min-roots 15;
 	serial-queries 34;
@@ -287,7 +287,7 @@ view "test-view" in {
 	transfer-source 10.0.0.55;
 	transfer-source-v6 4:3:8:1:5:6:7:8;
 	query-source port * address 10.0.0.54  ;
- 	query-source-v6 address 6:6:6:6:6:6:6:6 port *;
+	query-source-v6 address 6:6:6:6:6:6:6:6 port *;
 	max-transfer-time-out 45;
 	max-transfer-idle-out 55;
 	cleaning-interval 100;
@@ -300,7 +300,7 @@ view "test-view" in {
 	min-retry-time 4;
 	max-refresh-time 999;
 	min-refresh-time 111;
- 
+
 	zone "view-zone.com" {
 		type master;
 		allow-update-forwarding { 10.0.0.34;};
@@ -337,7 +337,7 @@ zone "stub.demo.zone" {
 	min-retry-time 11;
 	max-refresh-time 12;
 	min-refresh-time 13;
- 
+
 	max-transfer-time-in 120;	// if not set, global option is used.
 	pubkey 257 255 1 "a useless key";
 	pubkey 257 255 1 "another useless key";
@@ -394,7 +394,7 @@ zone "non-default-acl.demo.zone" {
 		grant root.domain. name host.domain. a ns md mf cname soa mb mg
 			mr "null" wks ptr hinfo minfo mx txt rp afsdb x25
 			isdn rt nsap sig "key" px gpos aaaa loc nxt srv naptr kx
-			cert a6 dname opt unspec tkey tsig ;
+			cert a6 dname opt unspec uri tkey tsig ;
 		grant foo.bar.com. self foo.bar.com. a;
 	};
 };
@@ -614,7 +614,7 @@ logging {
 	 * channel may be assigned to each of them, and it must be a
 	 * file channel.  If you don't define them  yourself, they default to
 	 *
- 	 *	category eventlib { default_debug; };
+	 *	category eventlib { default_debug; };
 	 *
 	 *	category packet { default_debug; };
 	 */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -40,40 +40,6 @@

 static char	*Tokens[MAXTOKS + 1];

-#define BINDABLE(name) \
-	((name->attributes & (DNS_NAMEATTR_READONLY|DNS_NAMEATTR_DYNAMIC)) \
-	 == 0)
-
-static isc_result_t
-dns_name_fromstring2(dns_name_t *target, const char *src,
-		     const dns_name_t *origin, unsigned int options,
-		     isc_mem_t *mctx)
-{
-	isc_result_t result;
-	isc_buffer_t buf;
-	dns_fixedname_t fn;
-	dns_name_t *name;
-
-	REQUIRE(src != NULL);
-
-	isc_buffer_constinit(&buf, src, strlen(src));
-	isc_buffer_add(&buf, strlen(src));
-	if (BINDABLE(target) && target->buffer != NULL)
-		name = target;
-	else {
-		dns_fixedname_init(&fn);
-		name = dns_fixedname_name(&fn);
-	}
-
-	result = dns_name_fromtext(name, &buf, origin, options, NULL);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
-	if (name != target)
-		result = dns_name_dupwithoffsets(name, mctx, target);
-	return (result);
-}
-
 #ifdef	NEED_PBUF

 /*%
@@ -330,7 +296,7 @@ hname_to_tname(char *src, char *target, size_t len) {
 		 */
 		if (srclen >= len)
 			return (1);
-		memcpy(target, src, srclen + 1);
+		memmove(target, src, srclen + 1);
 		return (0);
 	}

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,8 +15,6 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id$ */
-
 #include <config.h>

 #include <stdlib.h>
@@ -279,6 +277,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		result = dns_rdata_tostruct(rdata, sp = &unspec, NULL);
 		break;
 	}
+	case dns_rdatatype_uri: {
+		dns_rdata_uri_t uri;
+		result = dns_rdata_tostruct(rdata, sp = &uri, NULL);
+		break;
+	}
 	case dns_rdatatype_wks: {
 		static dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_tostruct(rdata, sp = &in_wks, NULL);
@@ -541,6 +544,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		result = dns_rdata_tostruct(rdata, sp = &unspec, mctx);
 		break;
 	}
+	case dns_rdatatype_uri: {
+		dns_rdata_uri_t uri;
+		result = dns_rdata_tostruct(rdata, sp = &uri, mctx);
+		break;
+	}
 	case dns_rdatatype_wks: {
 		static dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_tostruct(rdata, sp = &in_wks, mctx);
@@ -833,6 +841,11 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &unspec, b);
 		break;
 	}
+	case dns_rdatatype_uri: {
+		dns_rdata_uri_t uri;
+		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &uri, b);
+		break;
+	}
 	case dns_rdatatype_wks: {
 		dns_rdata_in_wks_t in_wks;
 		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &in_wks, b);
@@ -1178,7 +1191,7 @@ main(int argc, char *argv[]) {
 		dns_rdata_init(&last);
 		region.base = malloc(region.length = rdata.length);
 		if (region.base) {
-			memcpy(region.base, rdata.data, rdata.length);
+			memmove(region.base, rdata.data, rdata.length);
 			dns_rdata_fromregion(&last, class, type, &region);
 			lasttype = type;
 			first = 0;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -174,9 +174,13 @@ main(int argc, char *argv[]) {

 	RUNTIME_CHECK(isc_app_start() == ISC_R_SUCCESS);

-	if (argc > 1)
+	if (argc > 1) {
 		workers = atoi(argv[1]);
-	else
+		if (workers < 1)
+			workers = 1;
+		if (workers > 8192)
+			workers = 8192;
+	} else
 		workers = 2;
 	printf("%d workers\n", workers);

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2008, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -263,9 +263,13 @@ main(int argc, char *argv[]) {
 	isc_result_t result;
 	int pf;

-	if (argc > 1)
+	if (argc > 1) {
 		workers = atoi(argv[1]);
-	else
+		if (workers < 1)
+			workers = 1;
+		if (workers > 8192)
+			workers = 8192;
+	} else
 		workers = 2;
 	printf("%d workers\n", workers);

@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named1.conf,v 1.2 2008/01/10 01:10:01 marka Exp $ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+	allow-query-on { 10.53.0.2; };
+};
+
+include "../../common/controls.conf";
+
+key one {
+	algorithm hmac-md5;
+	secret "1234abcd8765";
+};
+
+key two {
+	algorithm hmac-md5;
+	secret "1234abcd8765";
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
+
+zone "tsigzone" {
+	type master;
+	file "tsigzone.db";
+	allow-transfer { !key one; any; };
+};
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2008, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -140,5 +140,14 @@ $DIG $DIGOPTS tsigzone. \
    	@10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 -p 5300 > dig.out
 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }

+echo "I:testing allow-query-on ACL processing"
+cp -f ns2/named5.conf ns2/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
+sleep 5
+t=`expr $t + 1`
+$DIG +tcp soa example. \
+    	@10.53.0.2 -b 10.53.0.3 -p 5300 > dig.out
+grep "status: NOERROR" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
+
 echo "I:exit status: $status"
 exit $status
@@ -33,7 +33,7 @@ options {
 include "../../common/rndc.key";

 controls {
-        inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
 };

 zone "rt.example" {
@@ -27,13 +27,13 @@ options {
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	notify no;
-        minimal-responses no;
+	minimal-responses no;
 };

 include "../../common/rndc.key";

 controls {
-        inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
+	inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; };
 };

 zone "rt.example" {
@@ -21,7 +21,7 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
-        recursion no;
+	recursion no;
 };

 include "../../common/controls.conf";
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -23,10 +23,16 @@ SYSTEMTESTTOP=..
 status=0

 $DIG +nosea +nocomm +nocmd +noquest +noadd +noauth +nocomm +nostat \
+	+keepopen -b 10.53.0.7 +tcp \
 	-f dig.batch -p 5300 @10.53.0.2 > dig.out.ns2 || status=1
 grep ";" dig.out.ns2

-$PERL ../digcomp.pl dig.out.ns2 knowngood.dig.out || status=1
+$PERL ../digcomp.pl --lc dig.out.ns2 knowngood.dig.out || status=1
+
+echo "I:only one tcp socket was used"
+tcpclients=`grep "client 10.53.0.7#[0-9]*:" ns2/named.run | awk '{print $4}' | sort | uniq -c | wc -l`
+
+test $tcpclients -eq 1 || { status=1; echo "I:failed"; }

 echo "I:exit status: $status"
 exit $status
@@ -0,0 +1,17 @@
+#!/bin/sh
+#
+# Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+rm -f dig.n1.test1
@@ -0,0 +1,27 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns1
+ns1			A	10.53.0.1
+@			MX	0 mail.eXaMpLe.
+mAiL			A	10.53.0.1
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+	ixfr-from-differences yes;
+	check-integrity no;
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
@@ -0,0 +1,35 @@
+#!/bin/sh
+#
+# Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+DIGOPTS="+tcp +nosea +nostat +noquest +nocomm +nocmd"
+
+status=0
+n=0
+
+n=`expr $n + 1`
+echo "I:testing case sensitive responses ($n)"
+ret=0
+$DIG $DIGOPTS mx example. @10.53.0.1 -p 5300 > dig.n1.test$n
+grep "0.mail.eXaMpLe" dig.n1.test$n > /dev/null || ret=1
+grep "mAiL.example" dig.n1.test$n > /dev/null || ret=1
+test $ret -eq 0 || echo "I:failed"
+status=`expr $status + $ret`
+
+echo "I:exit status: $status"
+exit $status
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+zone "." {
+	type hint;
+	file "nonexistent.db";
+};
@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -38,6 +38,12 @@ $CHECKCONF badtsig.conf > /dev/null 2>&1
 if [ $? != 1 ]; then echo "I:failed"; ret=1; fi
 status=`expr $status + $ret`

+echo "I: checking that named-checkconf -z catches missing hint file"
+ret=0
+$CHECKCONF -z hint-nofile.conf > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I: range checking fields that do not allow zero"
 ret=0
 for field in max-retry-time min-retry-time max-refresh-time min-refresh-time; do
@@ -1,4 +1,4 @@
-# Copyright (C) 2011, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2011-2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -30,4 +30,28 @@ do
 	status=`expr $status + $ret`
 done

+for db in zones/bad*.db
+do
+	echo "I:checking $db ($n)"
+	ret=0
+	$CHECKZONE -i local example $db > test.out.$n 2>&1 && ret=1
+	n=`expr $n + 1`
+	if [ $ret != 0 ]; then echo "I:failed"; fi
+	status=`expr $status + $ret`
+done
+
+echo "I:checking with spf warnings ($n)"
+ret=0
+$CHECKZONE example zones/spf.db > test.out1.$n 2>&1 || ret=1
+$CHECKZONE -T ignore example zones/spf.db > test.out2.$n 2>&1 || ret=1
+grep "'x.example' found SPF/TXT" test.out1.$n > /dev/null || ret=1
+grep "'y.example' found SPF/SPF" test.out1.$n > /dev/null || ret=1
+grep "'example' found SPF/" test.out1.$n > /dev/null && ret=1
+grep "'x.example' found SPF/" test.out2.$n > /dev/null && ret=1
+grep "'y.example' found SPF/" test.out2.$n > /dev/null && ret=1
+grep "'example' found SPF/" test.out2.$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 exit $status
@@ -0,0 +1,21 @@
+; Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+@ 0 IN SOA . . 0 0 0 0 0
+@ 0 IN NS .
+@ 0 IN TXT "v=spf1 -all"
+@ 0 IN SPF "v=spf1 -all"
+x 0 IN TXT "v=spf1"
+y 0 IN SPF "v=spf1"
+y 0 IN TXT "a non spf record"
@@ -43,12 +43,14 @@ CHECKCONF=$TOP/bin/check/named-checkconf
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # v6synth
-SUBDIRS="acl additional allow_query builtin cacheclean checkconf
-	 checknames checkzone database dlv dlz dname dnssec formerr
+SUBDIRS="acl additional allow_query builtin cacheclean case checkconf
+	 checknames checkzone database dlv dlz dname dnssec
+	 emptyzones
+	 formerr
 	 forward glue ixfr limits logfileconfig lwresd masterfile
 	 masterformat notify nsupdate pending resolver rndc rrsetorder
-	 sortlist stub tkey unknown upforwd views wildcard xfer
-	 xferquota zonechecks"
+	 spf sortlist stub tkey unknown upforwd views wildcard xfer
+	 xferquota zero zonechecks"

 # PERL will be an empty string if no perl interpreter was found.
 PERL=@PERL@
@@ -65,4 +67,4 @@ else
 fi

 export NAMED LWRESD DIG NSUPDATE KEYGEN SIGNER KEYSIGNER KEYSETTOOL PERL \
-    SUBDIRS RNDC CHECKZONE TESTSOCK6
+    SUBDIRS RNDC CHECKZONE TESTSOCK6 SAMPLE
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# Copyright (C) 2004, 2007, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -21,6 +21,11 @@
 # Ignore "unimportant" differences, like ordering of NS lines, TTL's,
 # etc...

+$lc = 0;
+if ($ARGV[0] eq "--lc") {
+	$lc = 1;
+	shift;
+}
 $file1 = $ARGV[0];
 $file2 = $ARGV[1];

@@ -42,6 +47,10 @@ while (<FILE1>) {
 		$class = $2;
 		$type = $3;
 		$value = $4;
+		if ($lc) {
+			$name = lc($name);
+			$value = lc($value);
+		}
 		if ($type eq "SOA") {
 			$firstname = $name if ($firstname eq "");
 			if ($name eq $firstname) {
@@ -73,6 +82,10 @@ while (<FILE2>) {
 		$class = $2;
 		$type = $3;
 		$value = $4;
+		if ($lc) {
+			$name = lc($name);
+			$value = lc($value);
+		}
 		if (($name eq $firstname) && ($type eq "SOA")) {
 			$count--;
 			$name = "$name$count";
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2010-2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2010-2013  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -40,5 +40,35 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I:checking DLZ IXFR=2010062899 (less than serial) ($n)"
+ret=0
+$DIG $DIGOPTS ixfr=2010062899 example.com @10.53.0.1 +all > dig.out.ns1.test$n 
+grep "example.com..*IN.IXFR" dig.out.ns1.test$n > /dev/null || ret=1
+grep "example.com..*10.IN.DNAME.example.net." dig.out.ns1.test$n > /dev/null || ret=1
+grep "example.com..*10.IN.NS.example.com." dig.out.ns1.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking DLZ IXFR=2010062900 (equal serial) ($n)"
+ret=0
+$DIG $DIGOPTS ixfr=2010062900 example.com @10.53.0.1 +all > dig.out.ns1.test$n
+grep "example.com..*IN.IXFR" dig.out.ns1.test$n > /dev/null || ret=1
+grep "example.com..*10.IN.DNAME.example.net." dig.out.ns1.test$n > /dev/null && ret=1
+grep "example.com..*10.IN.NS.example.com." dig.out.ns1.test$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking DLZ IXFR=2010062901 (greater than serial) ($n)"
+ret=0
+$DIG $DIGOPTS ixfr=2010062901 example.com @10.53.0.1 +all > dig.out.ns1.test$n
+grep "example.com..*IN.IXFR" dig.out.ns1.test$n > /dev/null || ret=1
+grep "example.com..*10.IN.DNAME.example.net." dig.out.ns1.test$n > /dev/null && ret=1
+grep "example.com..*10.IN.NS.example.com." dig.out.ns1.test$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
@@ -45,6 +45,9 @@ rm -f signer/*.db
 rm -f ns2/algroll.db
 rm -f signer/example.db.after signer/example.db.before
 rm -f signer/example.db.changed
+rm -f ns3/split-smart.example.db
+rm -f ns3/siginterval.example.db
+rm -f ns3/inline.example.db.signed
 rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
 rm -f ns3/secure.below-cname.example.db
 rm -f ns3/expiring.example.db
@@ -52,3 +55,6 @@ rm -f ns6/optout-tld.db
 rm -f nosign.before
 rm -f signing.out*
 rm -f canonical?.*
+rm -f ns1/resolve.key
+rm -f ns3/siginterval.conf
+rm -f ns4/named_dump.db
--- a/Show More
+++ b/Show More