This commit was manufactured by cvs2git to create branch

'v9_6_ESV_R4_patch'.
9.6-ESV-R4
2011-03-28 08:49:25 +00:00 · 2011-03-28 08:49:24 +00:00 · 2011-03-28 08:41:26 +00:00 · 2011-01-31 00:15:37 +00:00 · 2011-01-31 00:15:35 +00:00 · 2011-01-30 23:59:40 +00:00
31 changed files with 829 additions and 364 deletions
@@ -1,3 +1,36 @@
+
+	--- 9.6-ESV-R4 released ---
+
+	--- 9.6.3 released ---
+
+3009.	[bug]		clients-per-query code didn't work as expected with
+			particular query patterns. [RT #22972]
+
+	--- 9.6.3rc1 released ---
+
+3007.	[bug]		Named failed to preserve the case of domain names in
+			rdata which is not compressible when writing master
+			files.  [RT #22863]
+
+3002.	[bug]		isc_mutex_init_errcheck() failed to destroy attr.
+			[RT #22766]
+
+2996.	[security]	Temporarily disable SO_ACCEPTFILTER support.
+			[RT #22589]
+
+2995.	[bug]		The Kerberos realm was not being correctly extracted
+			from the signer's identity. [RT #22770]
+
+2994.	[port]		NetBSD: use pthreads by default on NetBSD >= 5.0, and
+			do not use threads on earlier versions.  Also kill
+			the unproven-pthreads, mit-pthreads, and ptl2 support.
+
+2984.	[bug]		Don't run MX checks when the target of the MX record
+			is ".".  [RT #22645]
+
+2817.	[cleanup]	Removed unnecessary isc_task_endexclusive() calls.
+			[RT #20768]
+
 	--- 9.6.3b1 released ---

 2982.	[bug]		Reference count dst keys.  dst_key_attach() can be used
@@ -15,56 +48,14 @@

 2976.	[bug]		named could die on exit after negotiating a GSS-TSIG
 			key. [RT #22573]
-			
+
 2975.	[bug]		rbtdb.c:cleanup_dead_nodes_callback() aquired the
 			wrong lock which could lead to server deadlock.
 			[RT #22614]

-2972.	[bug]		win32: address windows socket errors. [RT #21906]
-
-2971.	[bug]		Fixed a bug that caused journal files not to be
-			compacted on Windows systems as a result of
-			non-POSIX-compliant rename() semantics. [RT #22434]
-
-2970.	[security]	Adding a NO DATA negative cache entry failed to clear
-			any matching RRSIG records.  A subsequent lookup of
-			of NO DATA cache entry could trigger a INSIST when the
-			unexpected RRSIG was also returned with the NO DATA
-			cache entry.
-
-			CVE-2010-3613, VU#706148. [RT #22288]
-
-2969.	[security]	Fix acl type processing so that allow-query works
-			in options and view statements.  Also add a new
-			set of tests to verify proper functioning.
-
-			CVE-2010-3615, VU#510208. [RT #22418]
-
-2968.	[security]	Named could fail to prove a data set was insecure
-			before marking it as insecure.  One set of conditions
-			that can trigger this occurs naturally when rolling
-			DNSKEY algorithms.
-
-			CVE-2010-3614, VU#837744. [RT #22309]
-
-2967.	[bug]		'host -D' now turns on debugging messages earlier.
-			[RT #22361]
-
-2966.	[bug]		isc_print_vsnprintf() failed to check if there was
-			space available in the buffer when adding a left
-			justified character with a non zero width,
-			(e.g. "%-1c"). [RT #22270]
-
 2965.	[func]		Test HMAC functions using test data from RFC 2104 and
 			RFC 4634. [RT #21702]

-2964.	[bug]		view->queryacl was being overloaded.  Seperate the
-			usage into view->queryacl, view->cacheacl and
-			view->queryonacl. [RT #22114]
-
-2962.	[port]		win32: add more dependencies to BINDBuild.dsw.
-			[RT #22062]
-
 2960.	[func]		Check that named accepts non-authoritative answers.
 			[RT #21594]

@@ -84,17 +75,10 @@
 			exact match" message when returning a wildcard
 			no data response. [RT #21744]

-2952.	[port]		win32: named-checkzone and named-checkconf failed
-			to initialise winsock. [RT #21932]
-
-2951.	[bug]		named failed to generate a correct signed response
-			in a optout, delegation only zone with no secure
-			delegations. [RT #22007]
-
 2950.	[bug]		named failed to perform a SOA up to date check when
 			falling back to TCP on UDP timeouts when
 			ixfr-from-differences was set. [RT #21595]
- 
+
 2946.	[doc]		Document the default values for the minimum and maximum
 			zone refresh and retry values in the ARM. [RT #21886]

@@ -109,27 +93,6 @@
 2941.	[bug]		sdb and sdlz (dlz's zone database) failed to support
 			DNAME at the zone apex.  [RT #21610]

-2939.	[func]		Check that named successfully skips NSEC3 records
-			that fail to match the NSEC3PARAM record currently
-			in use. [RT# 21868]
-
-2937.	[bug]		Worked around an apparent race condition in over
-			memory conditions.  Without this fix a DNS cache DB or
-			ADB could incorrectly stay in an over memory state,
-			effectively refusing further caching, which
-			subsequently made a BIND 9 caching server unworkable.
-			This fix prevents this problem from happening by
-			polling the state of the memory context, rather than
-			making a copy of the state, which appeared to cause
-			a race.  This is a "workaround" in that it doesn't
-			solve the possible race per se, but several experiments
-			proved this change solves the symptom.  Also, the
-			polling overhead hasn't been reported to be an issue.
-			This bug should only affect a caching server that
-			specifies a finite max-cache-size.  It's also quite
-			likely that the bug happens only when enabling threads,
-			but it's not confirmed yet. [RT #21818]
-
 2935.	[bug]		nsupdate: improve 'file not found' error message.
 			[RT #21871]

@@ -150,7 +113,7 @@
 			revisit the issue and complete the fix later.
 			[RT #21710]

-2929.	[bug]		Improved handling of GSS security contexts: 
+2929.	[bug]		Improved handling of GSS security contexts:
 			 - added LRU expiration for generated TSIGs
 			 - added the ability to use a non-default realm
                         - added new "realm" keyword in nsupdate
@@ -159,17 +122,11 @@
 			   smaller)
 			[RT #19737]

-2925.	[bug]		Named failed to accept uncachable negative responses
-			from insecure zones. [RT# 21555]
-
 2923.	[bug]		'dig +trace' could drop core after "connection
 			timeout". [RT #21514]

 2922.	[contrib]	Update zkt to version 1.0.

-2921.	[bug]		The resolver could attempt to destroy a fetch context
-			too soon.  [RT #19878]
-
 2918.	[maint]		Add AAAA address for I.ROOT-SERVERS.NET.

 2916.	[func]		Add framework to use IPv6 in tests.
@@ -199,13 +156,9 @@

 2901.	[port]		Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316]

-2900.	[bug]		The placeholder negative caching element was not
-			properly constructed triggering a INSIST in 
-			dns_ncache_towire(). [RT #21346]
-			
 2899.	[port]		win32: Support linking against OpenSSL 1.0.0.

-2898.	[bug]		nslookup leaked memory when -domain=value was 
+2898.	[bug]		nslookup leaked memory when -domain=value was
 			specified. [RT #21301]

 2894.	[contrib]	DLZ LDAP support now use '$' not '%'. [RT #21294]
@@ -213,9 +166,6 @@
 2891.	[maint]		Update empty-zones list to match
 			draft-ietf-dnsop-default-local-zones-13. [RT# 21099]

-2890.	[bug]		Handle the introduction of new trusted-keys and
-			DS, DLV RRsets better. [RT #21097]
-
 2889.	[bug]		Elements of the grammar where not properly reported.
 			[RT #21046]

@@ -242,9 +192,6 @@
 2877.	[bug]		The validator failed to skip obviously mismatching
 			RRSIGs. [RT #21138]

-2876.	[bug]		Named could return SERVFAIL for negative responses
-			from unsigned zones. [RT #21131]
-
 2875.	[bug]		dns_time64_fromtext() could accept non digits.
 			[RT #21033]

@@ -254,9 +201,6 @@

 2870.	[maint]		Add AAAA address for L.ROOT-SERVERS.NET.

-2869.	[bug]		Fix arguments to dns_keytable_findnextkeynode() call.
-			[RT #20877]
-
 2868.	[cleanup]	Run "make clean" at the end of configure to ensure
 			any changes made by configure are integrated.
 			Use --with-make-clean=no to disable.  [RT #20994]
@@ -292,11 +236,108 @@

 2853.	[bug]		add_sigs() could run out of scratch space. [RT #21015]

-2852.	[bug]		Handle broken DNSSEC trust chains better. [RT #15619]
-
 2851.	[doc]		nslookup.1, removed <informalexample> from the docbook
 			source as it produced bad nroff.  [RT #21007]

+	--- 9.6-ESV-R3 released ---
+
+2972.	[bug]		win32: address windows socket errors. [RT #21906]
+
+2971.	[bug]		Fixed a bug that caused journal files not to be
+			compacted on Windows systems as a result of
+			non-POSIX-compliant rename() semantics. [RT #22434]
+
+2970.	[security]	Adding a NO DATA negative cache entry failed to clear
+			any matching RRSIG records.  A subsequent lookup of
+			of NO DATA cache entry could trigger a INSIST when the
+			unexpected RRSIG was also returned with the NO DATA
+			cache entry.
+
+			CVE-2010-3613, VU#706148. [RT #22288]
+
+2969.	[security]	Fix acl type processing so that allow-query works
+			in options and view statements.  Also add a new
+			set of tests to verify proper functioning.
+
+			CVE-2010-3615, VU#510208. [RT #22418]
+
+2968.	[security]	Named could fail to prove a data set was insecure
+			before marking it as insecure.  One set of conditions
+			that can trigger this occurs naturally when rolling
+			DNSKEY algorithms.
+
+			CVE-2010-3614, VU#837744. [RT #22309]
+
+2967.	[bug]		'host -D' now turns on debugging messages earlier.
+			[RT #22361]
+
+2966.	[bug]		isc_print_vsnprintf() failed to check if there was
+			space available in the buffer when adding a left
+			justified character with a non zero width,
+			(e.g. "%-1c"). [RT #22270]
+
+2964.	[bug]		view->queryacl was being overloaded.  Seperate the
+			usage into view->queryacl, view->cacheacl and
+			view->queryonacl. [RT #22114]
+
+2962.	[port]		win32: add more dependencies to BINDBuild.dsw.
+			[RT #22062]
+
+2952.	[port]		win32: named-checkzone and named-checkconf failed
+			to initialise winsock. [RT #21932]
+
+2951.	[bug]		named failed to generate a correct signed response
+			in a optout, delegation only zone with no secure
+			delegations. [RT #22007]
+
+	--- 9.6-ESV-R2 released ---
+
+2939.	[func]		Check that named successfully skips NSEC3 records
+			that fail to match the NSEC3PARAM record currently
+			in use. [RT# 21868]
+
+2937.	[bug]		Worked around an apparent race condition in over
+			memory conditions.  Without this fix a DNS cache DB or
+			ADB could incorrectly stay in an over memory state,
+			effectively refusing further caching, which
+			subsequently made a BIND 9 caching server unworkable.
+			This fix prevents this problem from happening by
+			polling the state of the memory context, rather than
+			making a copy of the state, which appeared to cause
+			a race.  This is a "workaround" in that it doesn't
+			solve the possible race per se, but several experiments
+			proved this change solves the symptom.  Also, the
+			polling overhead hasn't been reported to be an issue.
+			This bug should only affect a caching server that
+			specifies a finite max-cache-size.  It's also quite
+			likely that the bug happens only when enabling threads,
+			but it's not confirmed yet. [RT #21818]
+
+2925.	[bug]		Named failed to accept uncachable negative responses
+			from insecure zones. [RT# 21555]
+
+2921.	[bug]		The resolver could attempt to destroy a fetch context
+			too soon.  [RT #19878]
+
+2900.	[bug]		The placeholder negative caching element was not
+			properly constructed triggering a INSIST in
+			dns_ncache_towire(). [RT #21346]
+
+2890.	[bug]		Handle the introduction of new trusted-keys and
+			DS, DLV RRsets better. [RT #21097]
+
+2869.	[bug]		Fix arguments to dns_keytable_findnextkeynode() call.
+			[RT #20877]
+
+	--- 9.6-ESV-R1 released ---
+
+2876.	[bug]		Named could return SERVFAIL for negative responses
+			from unsigned zones. [RT #21131]
+
+	--- 9.6-ESV released ---
+
+2852.	[bug]		Handle broken DNSSEC trust chains better. [RT #15619]
+
 	--- 9.6.2 released ---

 2850.	[bug]		If isc_heap_insert() failed due to memory shortage
@@ -337,10 +378,10 @@

 2823.	[bug]		rbtdb.c:getsigningtime() was missing locks. [RT #20781]

-2819.	[cleanup]	Removed unnecessary DNS_POINTER_MAXHOPS define
+2819.	[cleanup]	Removed unnecessary DNS_POINTER_MAXHOPS define.
 			[RT #20771]

-2818.	[cleanup]	rndc could return an incorrect error code 
+2818.	[cleanup]	rndc could return an incorrect error code
 			when a zone was not found. [RT #20767]

 2815.	[bug]		Exclusively lock the task when freezing a zone.
@@ -556,7 +597,7 @@

 2621.	[doc]		Made copyright boilterplate consistent.  [RT #19833]

-2920.	[bug]		Delay thawing the zone until the reload of it has
+2620.	[bug]		Delay thawing the zone until the reload of it has
 			completed successfully.  [RT #19750]

 2618.	[bug]		The sdb and sdlz db_interator_seek() methods could
@@ -1,4 +1,4 @@
-Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.

 Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.

-$Id: COPYRIGHT,v 1.14.176.2 2010/01/07 23:47:36 tbox Exp $
+$Id: COPYRIGHT,v 1.14.176.3 2011/01/04 23:45:42 tbox Exp $

 Portions Copyright (C) 1996-2001  Nominum, Inc.

@@ -1,3 +1,215 @@
+3005.   [port]          Solaris: Work around the lack of
+                        gsskrb5_register_acceptor_identity() by setting
+                        the KRB5_KTNAME environment variable to the
+                        contents of tkey-gssapi-keytab.  Also fixed
+                        test errors on MacOSX.  [RT #22853]
+
+3003.   [experimental]  Added update-policy match type "external",
+                        enabling named to defer the decision of whether to
+                        allow a dynamic update to an external daemon.
+                        (Contributed by Andrew Tridgell.) [RT #22758]
+
+3000.   [bug]           More TKEY/GSS fixes:
+                         - nsupdate can now get the default realm from
+                           the user's Kerberos principal
+                         - corrected gsstest compilation flags
+                         - improved documentation
+                         - fixed some NULL dereferences
+                        [RT #22795]
+
+2992.   [contrib]       contrib/check-secure-delegation.pl:  A simple tool
+                        for looking at a secure delegation. [RT #22059]
+
+2991.   [contrib]       contrib/zone-edit.sh: A simple zone editing tool for
+                        dynamic zones. [RT #22365]
+
+2990.   [bug]           'dnssec-settime -S' no longer tests prepublication
+                        interval validity when the interval is set to 0.
+                        [RT #22761]
+
+2988.   [experimental]  Added a "dlopen" DLZ driver, allowing the creation
+                        of external DLZ drivers that can be loaded as
+                        shared objects at runtime rather than linked with
+                        named.  Currently this is switched on via a
+                        compile-time option, "configure --with-dlz-dlopen".
+                        Note: the syntax for configuring DLZ zones
+                        is likely to be refined in future releases.
+                        (Contributed by Andrew Tridgell of the Samba
+                        project.) [RT #22629]
+
+2985.   [bug]           Add a regression test for change #2896. [RT #21324]
+
+2983.   [bug]           Include "loadkeys" in rndc help output. [RT #22493]
+
+2980.   [bug]           named didn't properly handle UPDATES that changed the
+                        TTL of the NSEC3PARAM RRset. [RT #22363]
+
+2977.   [bug]           'nsupdate -l' report if the session key is missing.
+                        [RT #21670]
+
+2973.   [bug]           bind.keys.h was being removed by the "make clean"
+                        at the end of configure resulting in build failures
+                        where there is very old version of perl installed.
+                        Move it to "make maintainer-clean". [RT #22230]
+
+2963.   [security]      The allow-query acl was being applied instead of the
+                        allow-query-cache acl to cache lookups. [RT #22114]
+
+2961.   [bug]           Be still more selective about the non-authoritative
+                        answers we apply change 2748 to. [RT #22074]
+
+2949.   [bug]           dns_view_setnewzones() contained a memory leak if
+                        it was called multiple times. [RT #21942]
+
+2948.   [port]          MacOS: provide a mechanism to configure the test
+                        interfaces at reboot. See bin/tests/system/README
+                        for details.
+
+2940.   [port]          Remove connection aborted error message on
+                        Windows. [RT #21549]
+
+2938.   [bug]           When generating signed responses, from a signed zone
+                        that uses NSEC3, named would use a uninitialised
+                        pointer if it needed to skip a NSEC3 record because
+                        it didn't match the selected NSEC3PARAM record for
+                        zone. [RT# 21868]
+
+2930.   [experimental]  New "rndc addzone" and "rndc delzone" commads
+                        allow dynamic addition and deletion of zones.
+                        To enable this feature, specify a "new-zone-file"
+                        option at the view or options level in named.conf.
+                        Zone configuration information for the new zones
+                        will be written into that file.  To make the new
+                        zones persist after a restart, "include" the file
+                        into named.conf in the appropriate view.  (Note:
+                        This feature is not yet documented, and its syntax
+                        is expected to change.) [RT #19447]
+
+2928.   [bug]           Be more selective about the non-authoritative
+                        answer we apply change 2748 to. [RT #21594]
+
+2914.   [bug]           Make the "autosign" system test more portable.
+                        [RT #20997]
+
+2909.   [bug]           named-checkconf -p could die if "update-policy local;"
+                        was specified in named.conf. [RT #21416]
+
+2907.   [bug]           The export version of libdns had undefined references.
+                        [RT #21444]
+
+2906.   [bug]           Address RFC 5011 implementation issues. [RT #20903]
+
+2903.   [bug]           managed-keys-directory missing from namedconf.c.
+                        [RT #21370]
+
+2897.   [bug]           NSEC3 chains could be left behind when transitioning
+                        to insecure. [RT #21040]
+
+2896.   [bug]           "rndc sign" failed to properly update the zone
+                        when adding a DNSKEY for publication only. [RT #21045]
+
+2893.   [bug]           Improve managed keys support.  New named.conf option
+                        managed-keys-directory. [RT #20924]
+
+2892.   [bug]           Handle REVOKED keys better. [RT #20961]
+
+2887.   [bug]           Report the keytag times in UTC in the .key file,
+                        local time is presented as a comment within the
+                        comment.  [RT #21223]
+
+2886.   [bug]           ctime() is not thread safe. [RT #21223]
+
+2880.   [cleanup]       Make the output of dnssec-keygen and dnssec-revoke
+                        consistent. [RT #21078]
+
+2873.   [bug]           Cancelling a dynamic update via the dns/client module
+                        could trigger an assertion failure. [RT #21133]
+
+2872.   [bug]           Modify dns/client.c:dns_client_createx() to only
+                        require one of IPv4 or IPv6 rather than both.
+                        [RT #21122]
+
+2871.   [bug]           Type mismatch in mem_api.c between the definition and
+                        the header file, causing build failure with
+                        --enable-exportlib. [RT #21138]
+
+2861.   [doc]           dnssec-settime man pages didn't correctly document the
+                        inactivation time. [RT #21039]
+
+2860.   [bug]           named-checkconf's usage was out of date. [RT #21039]
+
+2848.   [doc]           Moved README.dnssec, README.libdns, README.pkcs11 and
+                        README.rfc5011 into the ARM. [RT #20899]
+
+2847.   [cleanup]       Corrected usage message in dnssec-settime. [RT #20921]
+
+2845.   [bug]           RFC 5011 client could crash on shutdown. [RT #20903]
+
+2841.   [bug]           Change 2836 was not complete. [RT #20883]
+
+2839.   [bug]           A KSK revoked by named could not be deleted.
+                        [RT #20881]
+
+2836.   [bug]           Keys that were scheduled to become active could
+                        be delayed. [RT #20874]
+
+2835.   [bug]           Key inactivity dates were inadvertently stored in
+                        the private key file with the outdated tag
+                        "Unpublish" rather than "Inactive".  This has been
+                        fixed; however, any existing keys that had Inactive
+                        dates set will now need to have them reset, using
+                        'dnssec-settime -I'. [RT #20868]
+
+2833.   [cleanup]       Fix usage messages in dnssec-keygen and dnssec-settime.
+                        [RT #20851]
+
+2832.   [bug]           Modify "struct stat" in lib/export/samples/nsprobe.c
+                        to avoid redefinition in some OSs [RT 20831]
+
+2824.   [bug]           "rndc sign" was not being run by the correct task.
+                        [RT #20759]
+
+2821.   [doc]           Add note that named-checkconf doesn't automatically
+                        read rndc.key and bind.keys [RT #20758]
+
+2816.   [bug]           previous_closest_nsec() could fail to return
+                        data for NSEC3 nodes [RT #29730]
+
+2811.   [cleanup]       Add "rndc sign" to list of commands in rndc usage
+                        output. [RT #20733]
+
+2809.   [cleanup]       Restored accidentally-deleted text in usage output
+                        in dnssec-settime and dnssec-revoke [RT #20739]
+
+2808.   [bug]           Remove the attempt to install atomic.h from lib/isc.
+                        atomic.h is correctly installed by the architecture
+                        specific subdirectories.  [RT #20722]
+
+2807.   [bug]           Fixed a possible ASSERT when reconfiguring zone
+                        keys. [RT #20720]
+
+2806.   [bug]           "rdnc sign" could delay re-signing the DNSKEY
+                        when it had changed. [RT #20703]
+
+2805.   [bug]           Fixed namespace problems encountered when building
+                        external programs using non-exported BIND9 libraries
+                        (i.e., built without --enable-exportlib). [RT #20679]
+
+2804.   [bug]           Send notifies when a zone is signed with "rndc sign"
+                        or as a result of a scheduled key change. [RT #20700]
+
+2803.   [port]          win32: Install named-journalprint, nsec3hash, arpaname
+                        and genrandom under windows. [RT #20670]
+
+2802.   [cleanup]       Rename journalprint to named-journalprint. [RT #20670]
+
+2799.   [cleanup]       Changed the "secure-to-insecure" option to
+                        "dnssec-secure-to-insecure", and "dnskey-ksk-only"
+                        to "dnssec-dnskey-kskonly", for clarity. [RT #20586]
+
+2798.   [bug]           Addressed bugs in managed-keys initialization
+                        and rollover. [RT #20683]
+
 2796.	[bug]		Missing dns_rdataset_disassociate() call in
 			dns_nsec3_delnsec3sx(). [RT #20681]

@@ -64,6 +276,11 @@
 2753.   [bug]           Removed an unnecessary warning that could appear when
                        building an NSEC chain. [RT #20589]

+2776.   [bug]           Change #2762 was not correct. [RT #20647]
+
+2762.   [bug]           DLV validation failed with a local slave DLV zone.
+                        [RT #20577]
+
 2752.   [bug]           Locking violation. [RT #20587]

 2751.   [bug]           Fixed a memory leak in dnssec-keyfromlabel. [RT #20588]
@@ -122,6 +339,8 @@
 			Also, added warnings when revoking a ZSK, as this is
 			not defined by protocol (but is legal).  [RT #19943]

+2685.	[contrib]	Update contrib/zkt to version 0.99c. [RT #20054]
+
 2684.	[cleanup]	dig: formalize +ad and +cd as synonyms for
 			+adflag and +cdflag.  [RT #19305]

@@ -156,6 +375,9 @@
 2657.	[cleanup]	Lower "journal file <path> does not exist, creating it"
 			log level to debug 1. [RT #20058]

+2655.   [doc]           Document that key-directory does not affect
+                        bind.keys, rndc.key or session.key.  [RT #20155]
+
 2654.   [bug]           Improve error reporting on duplicated names for
                        deny-answer-xxx. [RT #20164]

@@ -202,3 +424,11 @@
 			response arrives from a zone thought to be secure:
 			"insecurity proof failed" instead of "not
 			insecure". [RT #19400]
+
+2537.   [func]          Added more statistics counters including those on socket
+                        I/O events and query RTT histograms. [RT #18802]
+
+2525.   [func]          New logging category "query-errors" to provide detailed
+                        internal information about query failures, especially
+                        about server failures. [RT #19027]
+
@@ -0,0 +1,165 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title></title><link rel="stylesheet" href="release-notes.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article"><div class="titlepage"><hr /></div>
+
+  <div class="section" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3026830"></a>Introduction</h2></div></div></div>
+    
+    <p>
+			BIND 9.6.3 is the current release of BIND 9.6.
+		</p>
+    <p>
+			This document summarizes changes from BIND 9.6.2-P2 to BIND 9.6.3.
+			Please see the CHANGES file in the source code release for a
+			complete list of all changes.
+		</p>
+  </div>
+
+  <div class="section" title="Download"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3893341"></a>Download</h2></div></div></div>
+    
+    <p>
+			The latest development version of BIND 9 software can always be found
+	 		on our web site at
+      <a class="ulink" href="http://www.isc.org/downloads/development" target="_top">http://www.isc.org/downloads/development</a>.
+  		There you will find additional information about each release,
+ 			source code, and some pre-compiled versions for certain operating
+ 			systems.
+		</p>
+  </div>
+
+  <div class="section" title="Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3026768"></a>Support</h2></div></div></div>
+    
+    <p>Product support information is available on
+      <a class="ulink" href="http://www.isc.org/services/support" target="_top">http://www.isc.org/services/support</a>
+      for paid support options.  Free support is provided by our user
+ 			community via a mailing list.  Information on all public email
+ 			lists is available at
+      <a class="ulink" href="https://lists.isc.org/mailman/listinfo" target="_top">https://lists.isc.org/mailman/listinfo</a>.
+    </p>
+  </div>
+
+  <div class="section" title="New Features"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3893404"></a>New Features</h2></div></div></div>
+    
+		<div class="section" title="9.6.3"><div class="titlepage"><div><div><h3 class="title"><a id="id3893409"></a>9.6.3</h3></div></div></div>
+			
+			<p>None.</p>
+		</div>
+	</div>
+
+  <div class="section" title="Feature Changes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3893420"></a>Feature Changes</h2></div></div></div>
+    
+		<div class="section" title="9.6.3"><div class="titlepage"><div><div><h3 class="title"><a id="id3893425"></a>9.6.3</h3></div></div></div>
+			
+			<p>None.</p>
+		</div>
+  </div>
+
+  <div class="section" title="Security Fixes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3893436"></a>Security Fixes</h2></div></div></div>
+    
+		<div class="section" title="9.6.2-P3"><div class="titlepage"><div><div><h3 class="title"><a id="id3893441"></a>9.6.2-P3</h3></div></div></div>
+			
+	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
+				 	Adding a NO DATA signed negative response to cache failed to clear
+				  any matching RRSIG records already in cache. A subsequent lookup
+				  of the cached NO DATA entry could crash named (INSIST) when the
+				  unexpected RRSIG was also returned with the NO DATA cache entry.
+				  [RT #22288] [CVE-2010-3613] [VU#706148]
+				</li><li class="listitem">
+					BIND, acting as a DNSSEC validator, was determining if the NS RRset
+				  is insecure based on a value that could mean either that the RRset
+				  is actually insecure or that there wasn't a matching key for the RRSIG
+				  in the DNSKEY RRset when resuming from validating the DNSKEY RRset.
+				  This can happen when in the middle of a DNSKEY algorithm rollover,
+				  when two different algorithms were used to sign a zone but only the
+				  new set of keys are in the zone DNSKEY RRset.
+					[RT #22309] [CVE-2010-3614] [VU#837744]
+				</li></ul></div>
+		</div>
+  </div>
+
+  <div class="section" title="Bug Fixes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3026756"></a>Bug Fixes</h2></div></div></div>
+    
+			<div class="section" title="9.6.3"><div class="titlepage"><div><div><h3 class="title"><a id="id3026817"></a>9.6.3</h3></div></div></div>
+			
+	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
+				BIND now builds with threads disabled in versions of NetBSD earlier
+                                than 5.0 and with pthreads enabled by default in NetBSD versions 5.0
+                                and higher. Also removes support for unproven-pthreads, mit-pthreads
+                                and ptl2. [RT #19203]
+				</li><li class="listitem">
+				HPUX now correctly defaults to using /dev/poll, which should
+				increase performance. [RT #21919]
+				</li><li class="listitem">
+			        If named is running as a threaded application, after an "rndc stop"
+			        command has been issued, other inbound TCP requests can cause named
+			        to hang and never complete shutdown. [RT #22108]
+				</li><li class="listitem">
+				When performing a GSS-TSIG signed dynamic zone update, memory could be
+				leaked. This causes an unclean shutdown and may affect long-running
+				servers. [RT #22573]
+				</li><li class="listitem">
+                                A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled allows
+                                for a TCP DoS attack. Until there is a kernel fix, ISC is disabling
+                                SO_ACCEPTFILTER support in BIND. [RT #22589]
+				</li><li class="listitem">
+				Corrected a defect where a combination of dynamic updates and zone 
+				transfers incorrectly locked the in-memory zone database, causing
+				named to freeze. [RT #22614]
+				</li><li class="listitem">
+                                Don't run MX checks (check-mx) when the MX record points to ".".
+                                [RT #22645]
+				</li><li class="listitem">
+                                DST key reference counts can now be incremented via dst_key_attach.
+                                [RT #22672]
+				</li><li class="listitem">
+				isc_mutex_init_errcheck() in phtreads/mutex.c failed to destroy attr. [RT #22766]
+				</li><li class="listitem">
+                                 The Kerberos realm was being truncated when being pulled from the
+                                 the host prinicipal, make krb5-self updates fail. [RT #22770]
+				</li><li class="listitem">
+				named failed to preserve the case of domain names in RDATA which is not compressible when writing master files. [RT #22863]
+				</li><li class="listitem">
+There was a bug in how the clients-per-query code worked with some
+query patterns. This could result, in rare circumstances, in having all
+the client query slots filled with queries for the same DNS label,
+essentially ignoring the max-clients-per-query setting.
+[RT #22972]
+				</li></ul></div>
+		</div>
+		<div class="section" title="9.6.2-P3"><div class="titlepage"><div><div><h3 class="title"><a id="id3893557"></a>9.6.2-P3</h3></div></div></div>
+			
+	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
+					Worked around a race condition in the cache database memory
+					handling.  Without this fix a DNS cache DB or ADB could
+					incorrectly stay in an over memory state, effectively refusing
+					further caching, which subsequently made a BIND 9 caching
+					server unworkable.
+					[RT #21818]
+				</li><li class="listitem">
+					Microsoft changed the behavior of sockets between NT/XP based
+				  stacks vs Vista/windows7 stacks. Server 2003/2008 have the older
+				  behavior, 2008r2 has the new behavior. With the change, different
+				  error results are possible, so ISC adapted BIND to handle the new
+				  error results.
+				  This resolves an issue where sockets would shut down on
+				  Windows servers causing named to stop responding to queries.
+					[RT #21906]
+				</li><li class="listitem">
+				 	Windows has non-POSIX compliant behavior in its rename() and unlink()
+				  calls. This caused journal compaction to fail on Windows BIND servers
+				  with the log error: "dns_journal_compact failed: failure".
+					[RT #22434]
+				</li></ul></div>
+
+		</div>
+  </div>
+
+  <div class="section" title="Thank You"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3893594"></a>Thank You</h2></div></div></div>
+    
+    <p>
+      Thank you to everyone who assisted us in making this release possible.
+      If you would like to contribute to ISC to assist us in continuing to make
+      quality open source software, please visit our donations page at
+      <a class="ulink" href="http://www.isc.org/supportisc" target="_top">http://www.isc.org/supportisc</a>.
+    </p>
+  </div>
+</div></body></html>
@@ -0,0 +1,118 @@
+     __________________________________________________________________
+
+Introduction
+
+   BIND 9.6.3 is the current release of BIND 9.6.
+
+   This document summarizes changes from BIND 9.6.2-P2 to BIND 9.6.3.
+   Please see the CHANGES file in the source code release for a complete
+   list of all changes.
+
+Download
+
+   The latest development version of BIND 9 software can always be found
+   on our web site at http://www.isc.org/downloads/development. There you
+   will find additional information about each release, source code, and
+   some pre-compiled versions for certain operating systems.
+
+Support
+
+   Product support information is available on
+   http://www.isc.org/services/support for paid support options. Free
+   support is provided by our user community via a mailing list.
+   Information on all public email lists is available at
+   https://lists.isc.org/mailman/listinfo.
+
+New Features
+
+9.6.3
+
+   None.
+
+Feature Changes
+
+9.6.3
+
+   None.
+
+Security Fixes
+
+9.6.2-P3
+
+     * Adding a NO DATA signed negative response to cache failed to clear
+       any matching RRSIG records already in cache. A subsequent lookup of
+       the cached NO DATA entry could crash named (INSIST) when the
+       unexpected RRSIG was also returned with the NO DATA cache entry.
+       [RT #22288] [CVE-2010-3613] [VU#706148]
+     * BIND, acting as a DNSSEC validator, was determining if the NS RRset
+       is insecure based on a value that could mean either that the RRset
+       is actually insecure or that there wasn't a matching key for the
+       RRSIG in the DNSKEY RRset when resuming from validating the DNSKEY
+       RRset. This can happen when in the middle of a DNSKEY algorithm
+       rollover, when two different algorithms were used to sign a zone
+       but only the new set of keys are in the zone DNSKEY RRset. [RT
+       #22309] [CVE-2010-3614] [VU#837744]
+
+Bug Fixes
+
+9.6.3
+
+     * BIND now builds with threads disabled in versions of NetBSD earlier
+       than 5.0 and with pthreads enabled by default in NetBSD versions
+       5.0 and higher. Also removes support for unproven-pthreads,
+       mit-pthreads and ptl2. [RT #19203]
+     * HPUX now correctly defaults to using /dev/poll, which should
+       increase performance. [RT #21919]
+     * If named is running as a threaded application, after an "rndc stop"
+       command has been issued, other inbound TCP requests can cause named
+       to hang and never complete shutdown. [RT #22108]
+     * When performing a GSS-TSIG signed dynamic zone update, memory could
+       be leaked. This causes an unclean shutdown and may affect
+       long-running servers. [RT #22573]
+     * A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled
+       allows for a TCP DoS attack. Until there is a kernel fix, ISC is
+       disabling SO_ACCEPTFILTER support in BIND. [RT #22589]
+     * Corrected a defect where a combination of dynamic updates and zone
+       transfers incorrectly locked the in-memory zone database, causing
+       named to freeze. [RT #22614]
+     * Don't run MX checks (check-mx) when the MX record points to ".".
+       [RT #22645]
+     * DST key reference counts can now be incremented via dst_key_attach.
+       [RT #22672]
+     * isc_mutex_init_errcheck() in phtreads/mutex.c failed to destroy
+       attr. [RT #22766]
+     * The Kerberos realm was being truncated when being pulled from the
+       the host prinicipal, make krb5-self updates fail. [RT #22770]
+     * named failed to preserve the case of domain names in RDATA which is
+       not compressible when writing master files. [RT #22863]
+     * There was a bug in how the clients-per-query code worked with some
+       query patterns. This could result, in rare circumstances, in having
+       all the client query slots filled with queries for the same DNS
+       label, essentially ignoring the max-clients-per-query setting. [RT
+       #22972]
+
+9.6.2-P3
+
+     * Worked around a race condition in the cache database memory
+       handling. Without this fix a DNS cache DB or ADB could incorrectly
+       stay in an over memory state, effectively refusing further caching,
+       which subsequently made a BIND 9 caching server unworkable. [RT
+       #21818]
+     * Microsoft changed the behavior of sockets between NT/XP based
+       stacks vs Vista/windows7 stacks. Server 2003/2008 have the older
+       behavior, 2008r2 has the new behavior. With the change, different
+       error results are possible, so ISC adapted BIND to handle the new
+       error results. This resolves an issue where sockets would shut down
+       on Windows servers causing named to stop responding to queries. [RT
+       #21906]
+     * Windows has non-POSIX compliant behavior in its rename() and
+       unlink() calls. This caused journal compaction to fail on Windows
+       BIND servers with the log error: "dns_journal_compact failed:
+       failure". [RT #22434]
+
+Thank You
+
+   Thank you to everyone who assisted us in making this release possible.
+   If you would like to contribute to ISC to assist us in continuing to
+   make quality open source software, please visit our donations page at
+   http://www.isc.org/supportisc.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: server.c,v 1.520.12.19 2010/11/16 02:43:23 sar Exp $ */
+/* $Id: server.c,v 1.520.12.21 2011/01/14 23:45:49 tbox Exp $ */

 /*! \file */

@@ -5282,10 +5282,8 @@ ns_server_tsigdelete(ns_server_t *server, char *command, isc_buffer_t *text) {
 	n = snprintf((char *)isc_buffer_used(text),
 		     isc_buffer_availablelength(text),
 		     "%d tsig keys deleted.\n", foundkeys);
-	if (n >= isc_buffer_availablelength(text)) {
-		isc_task_endexclusive(server->task);
+	if (n >= isc_buffer_availablelength(text))
 		return (ISC_R_NOSPACE);
-	}
 	isc_buffer_add(text, n);

 	return (ISC_R_SUCCESS);
@@ -5401,10 +5399,8 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t *text) {
 		n = snprintf((char *)isc_buffer_used(text),
 			     isc_buffer_availablelength(text),
 			     "no tsig keys found.\n");
-		if (n >= isc_buffer_availablelength(text)) {
-			isc_task_endexclusive(server->task);
+		if (n >= isc_buffer_availablelength(text))
 			return (ISC_R_NOSPACE);
-		}
 		isc_buffer_add(text, n);
 	}

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: ntservice.c,v 1.12.332.2 2009/06/23 23:47:11 tbox Exp $ */
+/* $Id: ntservice.c,v 1.12.332.4 2011/01/13 22:29:39 tbox Exp $ */

 #include <config.h>
 #include <stdio.h>
@@ -70,7 +70,8 @@ int bindmain()
 	while (argv[i]) {
 		if (!strcmp(argv[i], "-f") ||
 		    !strcmp(argv[i], "-g") ||
-		    !strcmp(argv[i], "-v")) {
+		    !strcmp(argv[i], "-v") ||
+		    !strcmp(argv[i], "-V")) {
 			foreground = TRUE;
 			break;
 		}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: log_test.c,v 1.26 2007/06/19 23:46:59 tbox Exp $ */
+/* $Id: log_test.c,v 1.26.332.2 2011/01/14 00:50:31 tbox Exp $ */

 /* Principal Authors: DCL */

@@ -306,16 +306,16 @@ main(int argc, char **argv) {
 	isc_log_write1(lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_RBTDB,
 		       ISC_LOG_CRITICAL, "%s", message);
 	isc_log_write1(lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_RBTDB,
-		       ISC_LOG_CRITICAL, message);
+		       ISC_LOG_CRITICAL, "%s", message);

 	isc_log_setduplicateinterval(lcfg, 1);
 	message = "This message should appear twice on stderr";

 	isc_log_write1(lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_RBTDB,
-		       ISC_LOG_CRITICAL, message);
+		       ISC_LOG_CRITICAL, "%s", message);
 	sleep(2);
 	isc_log_write1(lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_RBTDB,
-		       ISC_LOG_CRITICAL, message);
+		       ISC_LOG_CRITICAL, "%s", message);

 	/*
 	 * Review where everything went.
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.23.48.5 2010/09/07 01:12:24 marka Exp $
+# $Id: clean.sh,v 1.23.48.6 2010/12/18 02:23:31 each Exp $

 rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed */trusted.conf */tmp* */*.jnl */*.bk
 rm -f ns1/root.db ns2/example.db ns3/secure.example.db
@@ -40,3 +40,4 @@ rm -f ns3/optout.optout.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
 rm -f signer/example.db
+rm -f ns2/algroll.db
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.2.4.3 2009/12/30 08:34:30 jinmei Exp $
+# $Id: clean.sh,v 1.2.4.5 2010/12/18 23:46:09 tbox Exp $

 rm -rf */*.signed
 rm -rf */*.jnl
@@ -28,3 +28,7 @@ rm -rf ns2/example.db
 rm -rf ns2/example.com.db
 rm -rf random.data
 rm -rf nsupdate.out.test
+rm -f ns1/keyset-.
+rm -f ns2/keyset-example.
+rm -f ns2/keyset-example.com.
+
@@ -14,12 +14,15 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.1.84.2 2010/11/17 23:45:45 tbox Exp $
+# $Id: clean.sh,v 1.1.84.4 2010/12/18 23:46:09 tbox Exp $

 #
 # Clean up after resolver tests.
 #
 rm -f */named.memstats
+rm -f dig.out dig.*.out.*
 rm -f ns6/K*
 rm -f ns6/example.net.db.signed ns6/example.net.db
-
+rm -f ns6/keyset-example.net. ns6/dsset-example.net.
+rm -f ns6/example.net.db.signed.jnl
+rm -f random.data
@@ -1,7 +1,27 @@
-/* $Id: bind.keys,v 1.2.2.3 2010/06/20 07:32:07 marka Exp $ */
+/* $Id: bind.keys,v 1.2.2.4 2011/01/04 19:15:12 each Exp $ */
+# This file contains current trust anchors for the DNS root zone (".")
+# and for the ISC DNSSEC Lookaside Validation zone ("dlv.isc.org").  It is
+# provided within BIND 9 for convenience of configuration.  To use these
+# keys, copy the trusted-keys statement below into named.conf, or else set
+# named.conf to "include" this file.
+#
+# These keys are current as of January 2011.  If any key fails to
+# work correctly, it may have expired.  In that event, you should
+# replace this file with a current version.  The latest version of
+# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.
+#
+# (NOTE: If this file is used via the "include" directive in named.conf,
+# then it is NOT advisable to modify it.  In BIND 9.7 and higher, this file
+# is used directly by named.  Upgrades to BIND may overwrite the file and
+# eliminate any user-configured keys.  Furthermore, in those versions of
+# BIND, this file can only be used for a specific set of domain names, and
+# any other trust anchors configured here would be ignored.  So, while it
+# is possible to use this file for other trust anchors in BIND 9.6, doing
+# so may lead to problems when you upgrade.)
 trusted-keys {
-        # NOTE: This key is current as of September 2009.
-        # If it doesn't work, it may have expired; see
-	# https://www.isc.org/solutions/dlv for a replacement
+	# ISC DLV: See https://www.isc.org/solutions/dlv for details.
 	dlv.isc.org. 257 3 5 "BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2 brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+ 1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5 ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt TDN0YUuWrBNh";
+	# ROOT KEY: See https://data.iana.org/root-anchors/root-anchors.xml
+	# for current trust anchor information.
+	. 257 3 8 "AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=";
 };
@@ -33,15 +33,11 @@ case $host in
 *-*-sysv*OpenUNIX*)
        # UnixWare
 	use_threads=true ;;
+*-netbsd[1234].*)
+	# NetBSD earlier than NetBSD 5.0 has poor pthreads.  Don't use it by default.
+	use_threads=false ;;
 *-netbsd*)
-	if test -r /usr/lib/libpthread.so ; then
-	    use_threads=true
-	else
-	    # Socket I/O optimizations introduced in 9.2 expose a
-	    # bug in unproven-pthreads; see PR #12650
-	    use_threads=false
-	fi
-	;;
+	use_threads=true ;;
 *-openbsd*)
 	# OpenBSD users have reported that named dumps core on
 	# startup when built with threads.
@@ -92,54 +88,6 @@ then
 	# Search for / configure pthreads in a system-dependent fashion.
 	#
 	case "$host" in
-	  *-netbsd*)
-		# NetBSD has multiple pthreads implementations.	 The
-		# recommended one to use is "unproven-pthreads".  The
-		# older "mit-pthreads" may also work on some NetBSD
-		# versions.  The PTL2 thread library does not
-		# currently work with bind9, but can be chosen with
-		# the --with-ptl2 option for those who wish to
-		# experiment with it.
-		CC="gcc"
-		AC_MSG_CHECKING(which NetBSD thread library to use)
-
-		AC_ARG_WITH(ptl2,
-[  --with-ptl2		on NetBSD, use the ptl2 thread library (experimental)],
-		    use_ptl2="$withval", use_ptl2="no")
-
-		: ${LOCALBASE:=/usr/pkg}
-
-		if test "X$use_ptl2" = "Xyes"
-		then
-			AC_MSG_RESULT(PTL2)
-			AC_MSG_WARN(
-[linking with PTL2 is highly experimental and not expected to work])
-			CC=ptlgcc
-		else
-			if test -r /usr/lib/libpthread.so
-			then
-				AC_MSG_RESULT(native)
-				LIBS="-lpthread $LIBS"
-			else
-				if test ! -d $LOCALBASE/pthreads
-				then
-					AC_MSG_RESULT(none)
-					AC_MSG_ERROR("could not find thread libraries")
-				fi
-
-				if $use_threads
-				then
-					AC_MSG_RESULT(mit-pthreads/unproven-pthreads)
-					pkg="$LOCALBASE/pthreads"
-					lib1="-L$pkg/lib -Wl,-R$pkg/lib"
-					lib2="-lpthread -lm -lgcc -lpthread"
-					LIBS="$lib1 $lib2 $LIBS"
-					CPPFLAGS="$CPPFLAGS -I$pkg/include"
-					STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
-				fi
-			fi
-		fi
-		;;
 		*-freebsd*)
 			# We don't want to set -lpthread as that break
 			# the ability to choose threads library at final
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 #
-# $Id: configure,v 1.443.26.22 2010/12/03 00:59:55 marka Exp $
+# $Id: configure,v 1.443.26.23 2010/12/21 04:33:58 marka Exp $
 #
 # Portions Copyright (C) 1996-2001  Nominum, Inc.
 #
@@ -1043,7 +1043,6 @@ with_pkcs11
 with_gssapi
 with_randomdev
 enable_threads
-with_ptl2
 with_libxml2
 enable_largefile
 with_purify
@@ -1733,7 +1732,6 @@ Optional Packages:
  --with-pkcs11           Build with PKCS11 support
  --with-gssapi=PATH      Specify path for system-supplied GSSAPI
  --with-randomdev=PATH   Specify path for random device
-  --with-ptl2		on NetBSD, use the ptl2 thread library (experimental)
  --with-libxml2=PATH     Build with libxml2 library yes|no|path
  --with-purify=PATH      use Rational purify
  --with-libtool          use GNU libtool
@@ -4442,7 +4440,7 @@ ia64-*-hpux*)
  ;;
 *-*-irix6*)
  # Find out which ABI we are using.
-  echo '#line 4445 "configure"' > conftest.$ac_ext
+  echo '#line 4443 "configure"' > conftest.$ac_ext
  if { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_compile\""; } >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -6736,11 +6734,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:6739: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:6737: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:6743: \$? = $ac_status" >&5
+   echo "$as_me:6741: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -7026,11 +7024,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7029: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7027: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:7033: \$? = $ac_status" >&5
+   echo "$as_me:7031: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -7130,11 +7128,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7133: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7131: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:7137: \$? = $ac_status" >&5
+   echo "$as_me:7135: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -9155,7 +9153,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 9158 "configure"
+#line 9156 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -9255,7 +9253,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 9258 "configure"
+#line 9256 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -11600,11 +11598,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11603: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11601: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:11607: \$? = $ac_status" >&5
+   echo "$as_me:11605: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -11704,11 +11702,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:11707: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:11705: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:11711: \$? = $ac_status" >&5
+   echo "$as_me:11709: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -13287,11 +13285,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13290: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13288: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:13294: \$? = $ac_status" >&5
+   echo "$as_me:13292: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -13391,11 +13389,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13394: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13392: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:13398: \$? = $ac_status" >&5
+   echo "$as_me:13396: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -15556,11 +15554,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:15559: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:15557: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:15563: \$? = $ac_status" >&5
+   echo "$as_me:15561: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -15846,11 +15844,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:15849: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:15847: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:15853: \$? = $ac_status" >&5
+   echo "$as_me:15851: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -15950,11 +15948,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:15953: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:15951: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:15957: \$? = $ac_status" >&5
+   echo "$as_me:15955: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -21159,15 +21157,11 @@ case $host in
 *-*-sysv*OpenUNIX*)
        # UnixWare
 	use_threads=true ;;
+*-netbsd1234.*)
+	# NetBSD earlier than NetBSD 5.0 has poor pthreads.  Don't use it by default.
+	use_threads=false ;;
 *-netbsd*)
-	if test -r /usr/lib/libpthread.so ; then
-	    use_threads=true
-	else
-	    # Socket I/O optimizations introduced in 9.2 expose a
-	    # bug in unproven-pthreads; see PR #12650
-	    use_threads=false
-	fi
-	;;
+	use_threads=true ;;
 *-openbsd*)
 	# OpenBSD users have reported that named dumps core on
 	# startup when built with threads.
@@ -21223,64 +21217,6 @@ then
 	# Search for / configure pthreads in a system-dependent fashion.
 	#
 	case "$host" in
-	  *-netbsd*)
-		# NetBSD has multiple pthreads implementations.	 The
-		# recommended one to use is "unproven-pthreads".  The
-		# older "mit-pthreads" may also work on some NetBSD
-		# versions.  The PTL2 thread library does not
-		# currently work with bind9, but can be chosen with
-		# the --with-ptl2 option for those who wish to
-		# experiment with it.
-		CC="gcc"
-		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking which NetBSD thread library to use" >&5
-$as_echo_n "checking which NetBSD thread library to use... " >&6; }
-
-
-# Check whether --with-ptl2 was given.
-if test "${with_ptl2+set}" = set; then :
-  withval=$with_ptl2; use_ptl2="$withval"
-else
-  use_ptl2="no"
-fi
-
-
-		: ${LOCALBASE:=/usr/pkg}
-
-		if test "X$use_ptl2" = "Xyes"
-		then
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: PTL2" >&5
-$as_echo "PTL2" >&6; }
-			{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: linking with PTL2 is highly experimental and not expected to work" >&5
-$as_echo "$as_me: WARNING: linking with PTL2 is highly experimental and not expected to work" >&2;}
-			CC=ptlgcc
-		else
-			if test -r /usr/lib/libpthread.so
-			then
-				{ $as_echo "$as_me:${as_lineno-$LINENO}: result: native" >&5
-$as_echo "native" >&6; }
-				LIBS="-lpthread $LIBS"
-			else
-				if test ! -d $LOCALBASE/pthreads
-				then
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: none" >&5
-$as_echo "none" >&6; }
-					as_fn_error $? "\"could not find thread libraries\"" "$LINENO" 5
-				fi
-
-				if $use_threads
-				then
-					{ $as_echo "$as_me:${as_lineno-$LINENO}: result: mit-pthreads/unproven-pthreads" >&5
-$as_echo "mit-pthreads/unproven-pthreads" >&6; }
-					pkg="$LOCALBASE/pthreads"
-					lib1="-L$pkg/lib -Wl,-R$pkg/lib"
-					lib2="-lpthread -lm -lgcc -lpthread"
-					LIBS="$lib1 $lib2 $LIBS"
-					CPPFLAGS="$CPPFLAGS -I$pkg/include"
-					STD_CINCLUDES="$STD_CINCLUDES -I$pkg/include"
-				fi
-			fi
-		fi
-		;;
 		*-freebsd*)
 			# We don't want to set -lpthread as that break
 			# the ability to choose threads library at final
@@ -1,6 +1,6 @@
-# $Id: SRCID,v 1.1.4.259 2010/12/09 05:15:17 tbox Exp $
+# $Id: SRCID,v 1.1.4.286 2011/01/31 00:15:35 tbox Exp $
 # 
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
-SRCID="( $Date: 2010/12/09 05:15:17 $ )"
+SRCID="( $Date: 2011/01/31 00:15:35 $ )"
@@ -1,3 +1,3 @@
 LIBINTERFACE = 59
-LIBREVISION = 0
+LIBREVISION = 2
 LIBAGE = 1
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: gssapictx.c,v 1.12.118.4 2010/07/09 05:15:05 each Exp $ */
+/* $Id: gssapictx.c,v 1.12.118.5 2010/12/22 02:37:55 marka Exp $ */

 #include <config.h>

@@ -358,7 +358,7 @@ dst_gssapi_identitymatchesrealmkrb5(dns_name_t *signer, dns_name_t *name,
 	if (rname == NULL)
 		return (isc_boolean_false);
 	*rname = '\0';
-	rname += 2;
+	rname++;

 	/*
 	 * Find the host portion of the signer's name.  We do this by
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: zone.h,v 1.160.50.6 2009/10/05 21:57:00 each Exp $ */
+/* $Id: zone.h,v 1.160.50.8 2010/12/14 23:46:09 tbox Exp $ */

 #ifndef DNS_ZONE_H
 #define DNS_ZONE_H 1
@@ -1654,7 +1654,7 @@ void
 dns_zone_setcheckmx(dns_zone_t *zone, dns_checkmxfunc_t checkmx);
 /*%<
 *	Set the post load integrity callback function 'checkmx'.
- *	'checkmx' will be called if the MX is not within the zone.
+ *	'checkmx' will be called if the MX TARGET is not within the zone.
 *
 * Require:
 *	'zone' to be a valid zone.
@@ -1673,8 +1673,8 @@ dns_zone_setchecksrv(dns_zone_t *zone, dns_checkmxfunc_t checksrv);
 void
 dns_zone_setcheckns(dns_zone_t *zone, dns_checknsfunc_t checkns);
 /*%<
- *	Set the post load integrity callback function 'checkmx'.
- *	'checkmx' will be called if the MX is not within the zone.
+ *	Set the post load integrity callback function 'checkns'.
+ *	'checkns' will be called if the NS TARGET is not within the zone.
 *
 * Require:
 *	'zone' to be a valid zone.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rdata.c,v 1.199.50.2 2009/02/16 23:47:15 tbox Exp $ */
+/* $Id: rdata.c,v 1.199.50.4 2011/01/13 04:48:21 tbox Exp $ */

 /*! \file */

@@ -1135,6 +1135,11 @@ name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target) {
 	if (l1 == l2)
 		goto return_false;

+	/* Master files should be case preserving. */
+	dns_name_getlabelsequence(name, l1 - l2, l2, target);
+	if (!dns_name_caseequal(origin, target))
+		goto return_false;
+
 	dns_name_getlabelsequence(name, 0, l1 - l2, target);
 	return (ISC_TRUE);

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: ipseckey_45.c,v 1.4.332.3 2009/09/18 21:55:48 jinmei Exp $ */
+/* $Id: ipseckey_45.c,v 1.4.332.5 2011/01/13 04:48:23 tbox Exp $ */

 #ifndef RDATA_GENERIC_IPSECKEY_45_C
 #define RDATA_GENERIC_IPSECKEY_45_C
@@ -120,8 +120,6 @@ static inline isc_result_t
 totext_ipseckey(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
-	dns_name_t prefix;
-	isc_boolean_t sub;
 	char buf[sizeof("255 ")];
 	unsigned short num;
 	unsigned short gateway;
@@ -130,7 +128,6 @@ totext_ipseckey(ARGS_TOTEXT) {
 	REQUIRE(rdata->length >= 3);

 	dns_name_init(&name, NULL);
-	dns_name_init(&prefix, NULL);

 	if (rdata->data[1] > 3U)
 		return (ISC_R_NOTIMPLEMENTED);
@@ -183,8 +180,7 @@ totext_ipseckey(ARGS_TOTEXT) {

 	case 3:
 		dns_name_fromregion(&name, &region);
-		sub = name_prefix(&name, tctx->origin, &prefix);
-		RETERR(dns_name_totext(&prefix, sub, target));
+		RETERR(dns_name_totext(&name, ISC_FALSE, target));
 		isc_region_consume(&region, name_length(&name));
 		break;
 	}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2008, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nsec_47.c,v 1.11 2008/07/15 23:47:21 tbox Exp $ */
+/* $Id: nsec_47.c,v 1.11.82.2 2011/01/13 04:48:23 tbox Exp $ */

 /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */

@@ -88,20 +88,18 @@ totext_nsec(ARGS_TOTEXT) {
 	isc_region_t sr;
 	unsigned int i, j, k;
 	dns_name_t name;
-	dns_name_t prefix;
-	isc_boolean_t sub;
 	unsigned int window, len;

 	REQUIRE(rdata->type == 47);
 	REQUIRE(rdata->length != 0);

+	UNUSED(tctx);
+
 	dns_name_init(&name, NULL);
-	dns_name_init(&prefix, NULL);
 	dns_rdata_toregion(rdata, &sr);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	RETERR(dns_name_totext(&name, ISC_FALSE, target));


 	for (i = 0; i < sr.length; i += len) {
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rrsig_46.c,v 1.10 2007/06/19 23:47:17 tbox Exp $ */
+/* $Id: rrsig_46.c,v 1.10.332.2 2011/01/13 04:48:23 tbox Exp $ */

 /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */

@@ -134,8 +134,6 @@ totext_rrsig(ARGS_TOTEXT) {
 	unsigned long exp;
 	unsigned long foot;
 	dns_name_t name;
-	dns_name_t prefix;
-	isc_boolean_t sub;

 	REQUIRE(rdata->type == 46);
 	REQUIRE(rdata->length != 0);
@@ -217,11 +215,9 @@ totext_rrsig(ARGS_TOTEXT) {
 	 * Signer.
 	 */
 	dns_name_init(&name, NULL);
-	dns_name_init(&prefix, NULL);
 	dns_name_fromregion(&name, &sr);
 	isc_region_consume(&sr, name_length(&name));
-	sub = name_prefix(&name, tctx->origin, &prefix);
-	RETERR(dns_name_totext(&prefix, sub, target));
+	RETERR(dns_name_totext(&name, ISC_FALSE, target));

 	/*
 	 * Sig.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: resolver.c,v 1.384.14.28 2010/06/23 23:46:05 tbox Exp $ */
+/* $Id: resolver.c,v 1.384.14.30 2011/01/27 23:45:47 tbox Exp $ */

 /*! \file */

@@ -7443,6 +7443,13 @@ static inline isc_boolean_t
 fctx_match(fetchctx_t *fctx, dns_name_t *name, dns_rdatatype_t type,
 	   unsigned int options)
 {
+	/*
+	 * Don't match fetch contexts that are shutting down.
+	 */
+	if (fctx->cloned || fctx->state == fetchstate_done ||
+	    ISC_LIST_EMPTY(fctx->events))
+		return (ISC_FALSE);
+
 	if (fctx->type != type || fctx->options != options)
 		return (ISC_FALSE);
 	return (dns_name_equal(&fctx->name, name));
@@ -7577,17 +7584,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
 		}
 	}

-	/*
-	 * If we didn't have a fetch, would attach to a done fetch, this
-	 * fetch has already cloned its results, or if the fetch has gone
-	 * "idle" (no one was interested in it), we need to start a new
-	 * fetch instead of joining with the existing one.
-	 */
-	if (fctx == NULL ||
-	    fctx->state == fetchstate_done ||
-	    fctx->cloned ||
-	    ISC_LIST_EMPTY(fctx->events)) {
-		fctx = NULL;
+	if (fctx == NULL) {
 		result = fctx_create(res, name, type, domain, nameservers,
 				     options, bucketnum, &fctx);
 		if (result != ISC_R_SUCCESS)
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: zone.c,v 1.483.36.22 2010/12/02 23:40:28 marka Exp $ */
+/* $Id: zone.c,v 1.483.36.23 2010/12/14 00:48:22 marka Exp $ */

 /*! \file */

@@ -1701,6 +1701,12 @@ zone_check_mx(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 	dns_name_t *foundname;
 	int level;

+	/*
+	 * "." means the services does not exist.
+	 */
+	if (dns_name_equal(name, dns_rootname))
+		return (ISC_TRUE);
+
 	/*
 	 * Outside of zone.
 	 */
@@ -1,3 +1,3 @@
 LIBINTERFACE = 54
-LIBREVISION = 0
+LIBREVISION = 1
 LIBAGE = 4
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: mutex.c,v 1.16 2008/04/04 23:47:01 tbox Exp $ */
+/* $Id: mutex.c,v 1.16.112.2 2011/01/04 23:45:43 tbox Exp $ */

 /*! \file */

@@ -234,10 +234,13 @@ isc_mutex_init_errcheck(isc_mutex_t *mp)
 	if (pthread_mutexattr_init(&attr) != 0)
 		return (ISC_R_UNEXPECTED);

-	if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK) != 0)
+	if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK) != 0) {
+		pthread_mutexattr_destroy(&attr);
 		return (ISC_R_UNEXPECTED);
+	}

 	err = pthread_mutex_init(mp, &attr) != 0)
+	pthread_mutexattr_destroy(&attr);
 	if (err == ENOMEM)
 		return (ISC_R_NOMEMORY);
 	return ((err == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED);
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: socket.c,v 1.308.12.16 2010/12/03 22:03:41 each Exp $ */
+/* $Id: socket.c,v 1.308.12.17 2010/12/22 03:28:13 marka Exp $ */

 /*! \file */

@@ -4738,9 +4738,16 @@ isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *sockaddr,
 	return (ISC_R_SUCCESS);
 }

+/*
+ * Enable this only for specific OS versions, and only when they have repaired
+ * their problems with it.  Until then, this is is broken and needs to be
+ * diabled by default.  See RT22589 for details.
+ */
+#undef ENABLE_ACCEPTFILTER
+
 isc_result_t
 isc_socket_filter(isc_socket_t *sock, const char *filter) {
-#ifdef SO_ACCEPTFILTER
+#if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER)
 	char strbuf[ISC_STRERRORSIZE];
 	struct accept_filter_arg afa;
 #else
@@ -4750,7 +4757,7 @@ isc_socket_filter(isc_socket_t *sock, const char *filter) {

 	REQUIRE(VALID_SOCKET(sock));

-#ifdef SO_ACCEPTFILTER
+#if defined(SO_ACCEPTFILTER) && defined(ENABLE_ACCEPTFILTER)
 	bzero(&afa, sizeof(afa));
 	strncpy(afa.af_name, filter, sizeof(afa.af_name));
 	if (setsockopt(sock->fd, SOL_SOCKET, SO_ACCEPTFILTER,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2010  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_api.c,v 1.63.156.2 2009/03/02 23:47:11 tbox Exp $ */
+/* $Id: t_api.c,v 1.63.156.4 2010/12/21 23:46:09 tbox Exp $ */

 /*! \file */

@@ -243,15 +243,6 @@ main(int argc, char **argv) {
 	sa.sa_flags = 0;
 	sigfillset(&sa.sa_mask);

-#ifdef SIGCHLD
-	/*
-	 * This is mostly here for NetBSD's pthread implementation, until
-	 * people catch up to the latest unproven-pthread package.
-	 */
-	sa.sa_handler = SIG_DFL;
-	(void)sigaction(SIGCHLD, &sa, NULL);
-#endif
-
 	sa.sa_handler = t_sighandler;
 	(void)sigaction(SIGINT,  &sa, NULL);
 	(void)sigaction(SIGALRM, &sa, NULL);
@@ -1,7 +1,7 @@
 ./.cvsignore					X	1998,1999,2000,2001,2004
-./CHANGES					X	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
-./COPYRIGHT					TXT	1996,1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
-./EXCLUDED					X	2009
+./CHANGES					X	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011
+./COPYRIGHT					TXT	1996,1997,1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011
+./EXCLUDED					X	2009,2011
 ./FAQ						X	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./FAQ.xml					SGML	2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./KNOWN-DEFECTS					X	2009
@@ -10,6 +10,9 @@
 ./README					X	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./README.idnkit					X	2005,2009
 ./README.pkcs11					X	2008
+./RELEASE-NOTES-BIND-9.6.3.html			X	2011
+./RELEASE-NOTES-BIND-9.6.3.pdf			X	2011
+./RELEASE-NOTES-BIND-9.6.3.txt			X	2011
 ./acconfig.h					C	1999,2000,2001,2002,2003,2004,2005,2007,2009
 ./aclocal.m4					X	1999,2000,2001
 ./bin/.cvsignore				X	1998,1999,2000,2001
@@ -158,7 +161,7 @@
 ./bin/named/named.html				HTML	DOCBOOK
 ./bin/named/notify.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007
 ./bin/named/query.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
-./bin/named/server.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
+./bin/named/server.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011
 ./bin/named/sortlist.c				C	2000,2001,2004,2005,2006,2007
 ./bin/named/statschannel.c			C	2008,2009,2010
 ./bin/named/tkeyconf.c				C	1999,2000,2001,2004,2005,2006,2007
@@ -173,7 +176,7 @@
 ./bin/named/win32/named.dsp			X	2001,2004,2005,2008
 ./bin/named/win32/named.dsw			X	2001
 ./bin/named/win32/named.mak			X	2001,2002,2004,2005,2006,2008
-./bin/named/win32/ntservice.c			C	1999,2000,2001,2002,2004,2006,2007,2009
+./bin/named/win32/ntservice.c			C	1999,2000,2001,2002,2004,2006,2007,2009,2011
 ./bin/named/win32/os.c				C	1999,2000,2001,2002,2004,2005,2007,2008
 ./bin/named/xfrout.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./bin/named/zoneconf.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009
@@ -330,7 +333,7 @@
 ./bin/tests/keyboard_test.c			C	2000,2001,2004,2005,2007
 ./bin/tests/lex_test.c				C	1998,1999,2000,2001,2004,2005,2007
 ./bin/tests/lfsr_test.c				C	1999,2000,2001,2004,2005,2007
-./bin/tests/log_test.c				C	1999,2000,2001,2004,2007
+./bin/tests/log_test.c				C	1999,2000,2001,2004,2007,2011
 ./bin/tests/lwres_test.c			C	2000,2001,2004,2005,2007
 ./bin/tests/lwresconf_test.c			C	2000,2001,2004,2007
 ./bin/tests/master/.cvsignore			X	1999,2000,2001
@@ -757,7 +760,7 @@
 ./bin/tests/system/nsupdate/setup.sh		SH	2000,2001,2004,2007
 ./bin/tests/system/nsupdate/tests.sh		SH	2000,2001,2004,2007
 ./bin/tests/system/nsupdate/update_test.pl	PERL	2000,2001,2004,2007
-./bin/tests/system/pending/clean.sh		SH	2009
+./bin/tests/system/pending/clean.sh		SH	2009,2010
 ./bin/tests/system/pending/ns1/named.conf	CONF-C	2009
 ./bin/tests/system/pending/ns1/root.db.in	ZONE	2009,2010
 ./bin/tests/system/pending/ns1/sign.sh		SH	2009,2010
@@ -1021,12 +1024,12 @@
 ./bin/win32/BINDInstall/res/BINDInstall.ico	X	2001
 ./bin/win32/BINDInstall/res/BINDInstall.rc2	X	2001
 ./bin/win32/BINDInstall/resource.h		X	2001,2005,2009
-./bind.keys					X	2009,2010
+./bind.keys					X	2009,2010,2011
 ./config.guess					X	1998,1999,2000,2001,2004,2009
 ./config.h.in					X	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./config.h.win32				C	1999,2000,2001,2004,2006,2007,2008,2009
 ./config.sub					X	1998,1999,2000,2001,2004
-./config.threads.in				X	2005,2006
+./config.threads.in				X	2005,2006,2010
 ./configure					X	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./configure.in					SH	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./conftools/perllib/dnsconf/DNSConf-macros.h	C	2000,2001,2004,2007
@@ -1638,7 +1641,7 @@
 ./doc/misc/sdb					TXT.BRIEF	2000,2001,2004
 ./doc/misc/sort-options.pl			PERL	2007
 ./doc/private/CHANGES				X	2000,2001
-./doc/private/SRCID				X	2009,2010
+./doc/private/SRCID				X	2009,2010,2011
 ./doc/private/branches				X	2002,2003,2004,2005,2006,2007,2008
 ./doc/private/bugfix-by-assertion		X	2001
 ./doc/private/delete-list			X	2005,2006,2007,2008
@@ -1699,7 +1702,7 @@
 ./lib/dns/acache.c				C	2004,2005,2006,2007,2008
 ./lib/dns/acl.c					C	1999,2000,2001,2002,2004,2005,2006,2007,2008,2009
 ./lib/dns/adb.c					C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
-./lib/dns/api					X	1999,2000,2001,2006,2008,2009,2010
+./lib/dns/api					X	1999,2000,2001,2006,2008,2009,2010,2011
 ./lib/dns/byaddr.c				C	2000,2001,2002,2003,2004,2005,2007
 ./lib/dns/cache.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009
 ./lib/dns/callbacks.c				C	1999,2000,2001,2004,2005,2007
@@ -1800,7 +1803,7 @@
 ./lib/dns/include/dns/version.h			C	2001,2004,2005,2006,2007
 ./lib/dns/include/dns/view.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./lib/dns/include/dns/xfrin.h			C	1999,2000,2001,2003,2004,2005,2006,2007,2009
-./lib/dns/include/dns/zone.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009
+./lib/dns/include/dns/zone.h			C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./lib/dns/include/dns/zonekey.h			C	2001,2004,2005,2006,2007
 ./lib/dns/include/dns/zt.h			C	1999,2000,2001,2002,2004,2005,2006,2007
 ./lib/dns/include/dst/.cvsignore		X	2000,2001,2004
@@ -1836,7 +1839,7 @@
 ./lib/dns/rbtdb64.c				C	1999,2000,2001,2004,2005,2007
 ./lib/dns/rbtdb64.h				C	1999,2000,2001,2004,2005,2007
 ./lib/dns/rcode.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2010
-./lib/dns/rdata.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009
+./lib/dns/rdata.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2011
 ./lib/dns/rdata/any_255/tsig_250.c		C	1999,2000,2001,2002,2003,2004,2005,2007
 ./lib/dns/rdata/any_255/tsig_250.h		C	1999,2000,2001,2004,2005,2007
 ./lib/dns/rdata/ch_3/a_1.c			C	2005,2007
@@ -1859,7 +1862,7 @@
 ./lib/dns/rdata/generic/gpos_27.h		C	1999,2000,2001,2004,2005,2007
 ./lib/dns/rdata/generic/hinfo_13.c		C	1998,1999,2000,2001,2002,2004,2007
 ./lib/dns/rdata/generic/hinfo_13.h		C	1998,1999,2000,2001,2004,2007
-./lib/dns/rdata/generic/ipseckey_45.c		C	2005,2007,2009
+./lib/dns/rdata/generic/ipseckey_45.c		C	2005,2007,2009,2011
 ./lib/dns/rdata/generic/ipseckey_45.h		C	2005,2007
 ./lib/dns/rdata/generic/isdn_20.c		C	1999,2000,2001,2002,2004,2005,2007
 ./lib/dns/rdata/generic/isdn_20.h		C	1999,2000,2001,2004,2005,2007
@@ -1887,7 +1890,7 @@
 ./lib/dns/rdata/generic/nsec3_50.h		C	2008
 ./lib/dns/rdata/generic/nsec3param_51.c		C	2008,2009
 ./lib/dns/rdata/generic/nsec3param_51.h		C	2008
-./lib/dns/rdata/generic/nsec_47.c		C	2003,2004,2007,2008
+./lib/dns/rdata/generic/nsec_47.c		C	2003,2004,2007,2008,2011
 ./lib/dns/rdata/generic/nsec_47.h		C	2003,2004,2005,2007,2008
 ./lib/dns/rdata/generic/null_10.c		C	1998,1999,2000,2001,2002,2004,2007
 ./lib/dns/rdata/generic/null_10.h		C	1998,1999,2000,2001,2004,2005,2007
@@ -1901,7 +1904,7 @@
 ./lib/dns/rdata/generic/ptr_12.h		C	1998,1999,2000,2001,2004,2005,2007
 ./lib/dns/rdata/generic/rp_17.c			C	1999,2000,2001,2004,2005,2007
 ./lib/dns/rdata/generic/rp_17.h			C	1999,2000,2001,2004,2005,2007
-./lib/dns/rdata/generic/rrsig_46.c		C	2003,2004,2005,2007
+./lib/dns/rdata/generic/rrsig_46.c		C	2003,2004,2005,2007,2011
 ./lib/dns/rdata/generic/rrsig_46.h		C	2003,2004,2005,2007
 ./lib/dns/rdata/generic/rt_21.c			C	1999,2000,2001,2003,2004,2005,2007
 ./lib/dns/rdata/generic/rt_21.h			C	1999,2000,2001,2004,2005,2007
@@ -1955,7 +1958,7 @@
 ./lib/dns/rdatasetiter.c			C	1999,2000,2001,2004,2005,2007
 ./lib/dns/rdataslab.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
 ./lib/dns/request.c				C	2000,2001,2002,2004,2005,2006,2007,2008,2009
-./lib/dns/resolver.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
+./lib/dns/resolver.c				C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011
 ./lib/dns/result.c				C	1998,1999,2000,2001,2002,2003,2004,2005,2007,2008,2010
 ./lib/dns/rootns.c				C	1999,2000,2001,2002,2004,2005,2007,2008,2010
 ./lib/dns/sdb.c					C	2000,2001,2003,2004,2005,2006,2007,2008,2009,2010
@@ -1999,7 +2002,7 @@
 ./lib/isc/alpha/include/isc/.cvsignore		X	2007
 ./lib/isc/alpha/include/isc/Makefile.in		MAKE	2007
 ./lib/isc/alpha/include/isc/atomic.h		C	2005,2007,2009
-./lib/isc/api					X	1999,2000,2001,2006,2008,2009,2010
+./lib/isc/api					X	1999,2000,2001,2006,2008,2009,2010,2011
 ./lib/isc/assertions.c				C	1997,1998,1999,2000,2001,2004,2005,2007,2008
 ./lib/isc/base32.c				C	2008,2009
 ./lib/isc/base64.c				C	1998,1999,2000,2001,2003,2004,2005,2007,2009
@@ -2165,7 +2168,7 @@
 ./lib/isc/pthreads/include/isc/mutex.h		C	1998,1999,2000,2001,2002,2004,2005,2007
 ./lib/isc/pthreads/include/isc/once.h		C	1999,2000,2001,2004,2005,2007
 ./lib/isc/pthreads/include/isc/thread.h		C	1998,1999,2000,2001,2004,2005,2007
-./lib/isc/pthreads/mutex.c			C	2000,2001,2002,2004,2005,2007,2008
+./lib/isc/pthreads/mutex.c			C	2000,2001,2002,2004,2005,2007,2008,2011
 ./lib/isc/pthreads/thread.c			C	2000,2001,2003,2004,2005,2007
 ./lib/isc/quota.c				C	2000,2001,2004,2005,2007
 ./lib/isc/radix.c				C	2007,2008,2009
@@ -2503,7 +2506,7 @@
 ./lib/tests/include/tests/.cvsignore		X	1999,2000,2001
 ./lib/tests/include/tests/Makefile.in		MAKE	1999,2000,2001,2004,2007
 ./lib/tests/include/tests/t_api.h		C	1999,2000,2001,2004,2005,2006,2007
-./lib/tests/t_api.c				C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2009
+./lib/tests/t_api.c				C	1999,2000,2001,2002,2003,2004,2005,2007,2008,2009,2010
 ./lib/win32/bindevt/bindevt.c			C	2000,2001,2004,2007
 ./lib/win32/bindevt/bindevt.dsp			X	2001
 ./lib/win32/bindevt/bindevt.dsw			X	2001
@@ -2530,7 +2533,7 @@
 ./util/check-instincludes.sh			SH	2000,2001,2004,2007
 ./util/check-pullups.pl				PERL	2001,2002,2003,2004,2007
 ./util/check-sources.pl				PERL	2000,2001,2004,2007
-./util/copyrights				X	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010
+./util/copyrights				X	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011
 ./util/kit.sh					SH	2000,2001,2002,2003,2004,2007,2008,2009
 ./util/mandoc2docbook.pl			PERL	2001,2004,2007
 ./util/mdnbuildtest.sh				SH	2000,2001,2004,2007
@@ -2545,7 +2548,7 @@
 ./util/update-drafts.pl				PERL	2000,2001,2004,2007
 ./util/update_branches				PERL	2005,2007
 ./util/update_copyrights			PERL	1998,1999,2000,2001,2004,2005,2006,2007,2008,2009,2010
-./version					X	1998,1999,2000,2001,2003,2005,2006,2007,2008,2009,2010
+./version					X	1998,1999,2000,2001,2003,2005,2006,2007,2008,2009,2010,2011
 ./win32utils/BINDBuild.dsw			X	2001,2005,2006,2008,2010
 ./win32utils/BuildAll.bat			BAT	2001,2002,2004,2005,2006,2007,2008
 ./win32utils/BuildOpenSSL.bat			BAT	2007
@@ -1,10 +1,10 @@
-# $Id: version,v 1.43.12.9 2010/09/10 05:18:12 marka Exp $
+# $Id: version,v 1.43.12.11.2.2 2011/03/28 08:49:24 marka Exp $
 # 
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
 MAJORVER=9
 MINORVER=6
-PATCHVER=3
-RELEASETYPE=b
-RELEASEVER=1
+PATCHVER=
+RELEASETYPE=-ESV
+RELEASEVER=-R4
Author	SHA1	Message	Date
cvs2git	36b886ae36	This commit was manufactured by cvs2git to create branch 'v9_6_ESV_R4_patch'.	2011-03-28 08:49:25 +00:00
Mark Andrews	20a5a0874f	9.6-ESV-R4	2011-03-28 08:49:24 +00:00
Mark Andrews	c3ab09c9a1	9.6-ESV-R4	2011-03-28 08:41:26 +00:00
cvs2git	5eb117549e	This commit was manufactured by cvs2git to create branch 'v9_6_esv_branch_r4'.	2011-01-31 00:15:37 +00:00
Automatic Updater	70f21f30ce	update	2011-01-31 00:15:35 +00:00
Automatic Updater	0a138c4a5c	update	2011-01-30 23:59:40 +00:00
Automatic Updater	76dcfcf342	update	2011-01-30 08:15:13 +00:00
Mark Andrews	b05340b569	9.6.3	2011-01-30 08:06:17 +00:00
Automatic Updater	33e68243d3	update	2011-01-30 07:15:14 +00:00
Mark Andrews	350f45bed8	9.6.3	2011-01-30 06:39:08 +00:00
Automatic Updater	eca23eb55a	update	2011-01-28 00:15:19 +00:00
Automatic Updater	92306578c0	update copyright notice	2011-01-27 23:45:47 +00:00
Automatic Updater	3f495c603a	newcopyrights	2011-01-27 23:30:19 +00:00
Automatic Updater	0125c38a9f	update	2011-01-27 03:15:55 +00:00
Mark Andrews	1be3bd3c8f	3009. [bug] clients-per-query code didn't work as expected with particular query patterns. [RT #22972]	2011-01-27 02:29:47 +00:00
Automatic Updater	d11e8b7bd5	update	2011-01-15 00:15:23 +00:00
Automatic Updater	dfd490c2e1	update copyright notice	2011-01-14 23:45:49 +00:00
Automatic Updater	619457ae43	newcopyrights	2011-01-14 23:30:21 +00:00
Automatic Updater	eb7b89e4d6	update	2011-01-14 06:15:16 +00:00
Mark Andrews	0ea03569a2	9.6.3rc1	2011-01-14 05:39:42 +00:00
Mark Andrews	02ebc8afce	9.6.3rc1	2011-01-14 05:31:29 +00:00
Automatic Updater	d2008d55e3	update	2011-01-14 05:15:11 +00:00
Mark Andrews	0654815406	2817. [cleanup] Removed unnecessary isc_task_endexclusive() calls. [RT #20768]	2011-01-14 05:04:13 +00:00
Automatic Updater	cc0619d249	update	2011-01-14 01:15:20 +00:00
Mark Andrews	dbb2c2bb65	9.6.3rc1	2011-01-14 00:52:40 +00:00
Automatic Updater	55586734ec	update copyright notice	2011-01-14 00:50:31 +00:00
Automatic Updater	9244ba322f	newcopyrights	2011-01-14 00:49:15 +00:00
Mark Andrews	dc76cdcf0a	silence: warning: format not a string literal and no format arguments	2011-01-14 00:45:15 +00:00
Automatic Updater	1c3a9e9ac9	update	2011-01-13 23:15:39 +00:00
Automatic Updater	2ec440d467	update copyright notice	2011-01-13 22:29:39 +00:00
Automatic Updater	d6585f5971	newcopyrights	2011-01-13 22:28:25 +00:00
Automatic Updater	505872703a	update	2011-01-13 22:15:10 +00:00
Mark Andrews	d65827b914	add -V	2011-01-13 22:04:18 +00:00
Automatic Updater	49ffb8a48d	update	2011-01-13 05:15:40 +00:00
Automatic Updater	166b841b92	update copyright notice	2011-01-13 04:48:23 +00:00
Automatic Updater	9a9b9fda53	newcopyrights	2011-01-13 04:46:49 +00:00
Automatic Updater	24a41cc969	update	2011-01-13 03:15:22 +00:00
Mark Andrews	503b8fe694	spelling	2011-01-13 02:40:19 +00:00
Automatic Updater	20d2b48cc8	update	2011-01-13 02:15:22 +00:00
Mark Andrews	b41db83139	3007. [bug] Named failed to preserve the case of domain names in rdata which is no compressable when writing master files. [RT #22863]	2011-01-13 02:14:46 +00:00
Mark Andrews	0219620a50	3007. [bug] Named failed to preserve the case of domain names in rdata which is no compressable when writing master files. [RT #22863]	2011-01-13 02:06:13 +00:00
Automatic Updater	a9fd75ff6d	update	2011-01-06 00:15:29 +00:00
Automatic Updater	40c14bb835	newcopyrights	2011-01-05 23:30:28 +00:00
Automatic Updater	d3bf84be87	update	2011-01-05 00:15:24 +00:00
Automatic Updater	c2cc63809b	update copyright notice	2011-01-04 23:45:43 +00:00
Automatic Updater	7436a1ff88	newcopyrights	2011-01-04 23:30:21 +00:00
Automatic Updater	de08bfa92e	update	2011-01-04 20:15:15 +00:00
Evan Hunt	c48e2bd48c	Updated comments, added root key. [rt21727]	2011-01-04 19:15:12 +00:00
Automatic Updater	1602b83429	update	2011-01-04 05:15:13 +00:00
Mark Andrews	4df4d06b91	3002. [bug] isc_mutex_init_errcheck() failed to destroy attr. [RT #22766]	2011-01-04 04:37:17 +00:00
Automatic Updater	98e5ad45e3	update	2010-12-22 04:15:46 +00:00
Mark Andrews	168d13317a	2996. [security] Temporarily disable SO_ACCEPTFILTER support. [RT #22589]	2010-12-22 03:28:13 +00:00
Automatic Updater	926e4ac975	update	2010-12-22 03:15:25 +00:00
Mark Andrews	d8bf1487c7	2995. [bug] The Kerberos realm was not being correctly extracted from the signer's identity. [RT #22770]	2010-12-22 02:37:55 +00:00
Automatic Updater	cc34738b4a	update	2010-12-22 00:15:16 +00:00
Automatic Updater	14ae0b7399	update copyright notice	2010-12-21 23:46:09 +00:00
Automatic Updater	b2d1144d34	newcopyrights	2010-12-21 23:30:15 +00:00
Automatic Updater	3637335ed2	update	2010-12-21 05:15:10 +00:00
Mark Andrews	d7cd3a9af7	regen	2010-12-21 04:33:58 +00:00
Mark Andrews	bbbdd230ad	2994. [port] NetBSD: use pthreads by default on NetBSD >= 5.0, and do not use threads on earlier versions. Also kill the unproven-pthreads, mit-pthreads, and ptl2 support.	2010-12-21 04:33:18 +00:00
Automatic Updater	f35adf567d	update	2010-12-19 00:15:27 +00:00
Automatic Updater	90ba68da1c	update copyright notice	2010-12-18 23:46:09 +00:00
Automatic Updater	ba0a4eed4c	newcopyrights	2010-12-18 23:30:22 +00:00
Automatic Updater	838a7fd19d	update	2010-12-18 03:15:48 +00:00
Evan Hunt	995d8d0bcc	Added files to clean.sh scripts that have been left around after tests run. Skipping the ticket/review steps because the change is trivial.	2010-12-18 02:23:31 +00:00
Automatic Updater	8de80e73e7	update	2010-12-15 00:15:17 +00:00
Automatic Updater	27ee4b8ca4	update copyright notice	2010-12-14 23:46:09 +00:00
Automatic Updater	a0e286c661	newcopyrights	2010-12-14 23:30:15 +00:00
Automatic Updater	70e92842e2	update	2010-12-14 01:15:10 +00:00
Mark Andrews	8c5ba02091	2984. [bug] Don't run MX checks when the target of the MX record is ".". [RT #22645]	2010-12-14 00:48:23 +00:00
Automatic Updater	003048fd6b	update	2010-12-09 08:15:16 +00:00