missed a line

missed a file
update
2011-12-05 17:27:27 +00:00 · 2011-12-05 17:24:16 +00:00 · 2011-12-05 17:15:58 +00:00 · 2011-12-05 16:57:27 +00:00 · 2011-12-03 00:15:48 +00:00 · 2011-12-02 23:45:51 +00:00
748 changed files with 139737 additions and 14289 deletions
@@ -0,0 +1,5 @@
+Content-Type: application/X-atf-atffile; version="1"
+
+prop: test-suite = bind9
+
+tp: lib
@@ -1,3 +1,438 @@
+	--- 9.7.5b1 released ---
+
+3234.	[bug]		'make depend' produced invalid makefiles. [RT #26830]
+
+3231.	[bug]		named could fail to send a uncompressable zone.
+			[RT #26796]
+
+3230.	[bug]		'dig axfr' failed to properly handle a multi-message
+			axfr with a serial of 0. [RT #26796]
+
+3229.	[bug]		Fix local variable to struct var assignment
+			found by CLANG warning.
+
+3228.   [tuning]        Dynamically grow symbol table to improve zone
+                        loading performance. [RT #26523]
+
+3227.	[bug]		Interim fix to make WKS's use of getprotobyname()
+			and getservbyname() self thread safe. [RT #26232]
+
+3226.	[bug]		Address minor resource leakages. [RT #26624]
+
+3221.	[bug]		Fixed a potential coredump on shutdown due to
+			referencing fetch context after it's been freed.
+			[RT #26720]
+
+3218.	[security]	Cache lookup could return RRSIG data associated with
+			nonexistent records, leading to an assertion
+			failure. [RT #26590]
+
+3216.   [bug]           resolver.c:validated() was not thread-safe. [RT #26478]
+
+3213.	[doc]		Clarify ixfr-from-differences behavior. [RT #25188]
+
+3212.	[bug]		rbtdb.c: failed to remove a node from the deadnodes
+			list prior to adding a reference to it leading a
+			possible assertion failure. [RT #23219]
+
+3209.	[func]		Add "dnssec-lookaside 'no'".  [RT #24858]
+
+3208.	[bug]		'dig -y' handle unknown tsig alorithm better.
+			[RT #25522]
+
+3207.	[contrib]	Fixed build error in Berkeley DB DLZ module. [RT #26444]
+
+3206.	[cleanup]	Add ISC information to log at start time. [RT #25484]
+
+3204.	[bug]		When a master server that has been marked as
+			unreachable sends a NOTIFY, mark it reachable
+			again. [RT #25960]
+
+3203.	[bug]		Increase log level to 'info' for validation failures
+			from expired or not-yet-valid RRSIGs. [RT #21796]
+
+3200.	[doc]		Some rndc functions were undocumented or were
+			missing from 'rndc -h' output. [RT #25555]
+
+3198.	[doc]		Clarified that dnssec-settime can alter keyfile
+			permissions. [RT #24866]
+
+3196.   [bug]           nsupdate: return nonzero exit code when target zone
+                        doesn't exist. [RT #25783]
+
+3195.	[cleanup]	Silence "file not found" warnings when loading
+			managed-keys zone. [RT #26340]
+
+3194.	[doc]		Updated RFC references in the 'empty-zones-enable'
+			documentation. [RT #25203]
+
+3193.	[cleanup]	Changed MAXZONEKEYS to DNS_MAXZONEKEYS, moved to
+			dnssec.h. [RT #26415]
+
+3192.	[bug]		A query structure could be used after being freed.
+			[RT #22208]
+
+3191.	[bug]		Print NULL records using "unknown" format. [RT #26392]
+
+3190.	[bug]		Underflow in error handling in isc_mutexblock_init.
+			[RT #26397]
+
+3189.	[test]		Added a summary report after system tests. [RT #25517]
+
+3188.	[bug]		zone.c:zone_refreshkeys() could fail to detach
+			references correctly when errors occurred, causing
+			a hang on shutdown. [RT #26372]
+
+3187.	[port]		win32: support for Visual Studio 2008.	[RT #26356]
+
+3179.	[port]		kfreebsd: build issues. [RT #26273]
+
+3175.   [bug]           Fix how DNSSEC positive wildcard responses from a
+			NSEC3 signed zone are validated.  Stop sending a
+			unnecessary NSEC3 record when generating such
+			responses. [RT #26200]
+
+3174.	[bug]		Always compute to revoked key tag from scratch.
+			[RT #26186]
+
+3173.	[port]		Correctly validate root DS responses. [RT #25726]
+
+3171.	[bug]		Exclusively lock the task when adding a zone using
+			'rndc addzone'.  [RT #25600]
+
+3169.	[func]		Catch db/version mis-matches when calling dns_db_*().
+			[RT #26017]
+
+3167.	[bug]		Negative answers from forwarders were not being
+			correctly tagged making them appear to not be cached.
+			[RT #25380]
+
+3162.   [test]          start.pl: modified to allow for "named.args" in
+                        ns*/ subdirectory to override stock arguments to
+                        named. Largely from RT#26044, but no separate ticket.
+
+3161.	[bug]		zone.c:del_sigs failed to always reset rdata leading
+			assertion failures. [RT #25880]
+
+3157.	[tuning]	Reduce the time spent in "rndc reconfig" by parsing
+			the config file before pausing the server. [RT #21373]
+
+3154.	[bug]		Attempting to print an empty rdataset could trigger
+			an assert. [RT #25452]
+
+3152.	[cleanup]	Some versions of gcc and clang failed due to
+			incorrect use of __builtin_expect. [RT #25183]
+
+3151.	[bug]		Queries for type RRSIG or SIG could be handled
+                        incorrectly.  [RT #21050]
+
+3149.	[tuning]	Improve scalability by allocating one zone
+			task per 100 zones at startup time.  (The
+			BIND9_ZONE_TASKS_HINT environment variable
+			which was established as a temporary measure
+			in change #3132 is no longer needed or
+			used.) [rt25541]
+
+3148.	[bug]		Processing of normal queries could be stalled when
+			forwarding a UPDATE message. [RT #24711]
+
+3146.   [test]		Fixed gcc4.6.0 errors in ATF. [RT #25598]
+
+3145.	[test]		Capture output of ATF unit tests in "./atf.out" if
+			there were any errors while running them. [RT #25527]
+
+3144.	[bug]		dns_dbiterator_seek() could trigger an assert when
+			used with a nonexistent database node. [RT #25358]
+
+3143.	[bug]		Silence clang compiler warnings. [RT #25174]
+
+3142.	[bug]		NAPTR is class agnostic. [RT #25429]
+
+3141.	[bug]		Silence spurious "zone serial (0) unchanged" messages
+			associated with empty zones. [RT #25079]
+
+3139.	[test]		Added tests from RFC 6234, RFC 2202, and RFC 1321
+			for the hashing algorithms (md5, sha1 - sha512, and
+			their hmac counterparts).  [RT #25067] 
+
+3138.	[bug]		Address memory leaks and out-of-order operations when
+			shutting named down. [RT #25210]
+
+3136.	[func]		Add RFC 1918 reverse zones to the list of built-in 
+			empty zones switched on by the 'empty-zones-enable'
+			option. [RT #24990]
+
+3134.	[bug]		Improve the accuracy of dnssec-signzone's signing
+			statistics. [RT #16030]
+
+3129.	[bug]		Named could crash on 'rndc reconfig' when
+			allow-new-zones was set to yes and named ACLs
+			were used, [RT #22739]
+
+	--- 9.7.4 released ---
+
+3135.	[port]		FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.
+			See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307
+			[RT #24950]
+
+3133.	[bug]		Change #3114 was incomplete. [RT #24577]
+
+3132.	[bug]		Workaround for excessive startup time with large
+			number of zones; allow setting of an environment
+			variable to tune the number of tasks, default is 8,
+			recommends 200 zones per task.  If you have 200000
+			zones set the BIND9_ZONE_TASKS_HINT environment
+			variable to 1000 before starting named:
+
+			csh: setenv BIND9_ZONE_TASKS_HINT 1000
+			sh:  BIND9_ZONE_TASKS_HINT=1000;
+			     export BIND9_ZONE_TASKS_HINT
+
+			Applicable to 9.7, 9.6, auto-tuned in 9.8 and up.
+			[RT #25084]
+
+	--- 9.7.4rc1 released ---
+
+3124.	[bug]		Use an rdataset attribute flag to indicate
+			negative-cache records rather than using rrtype 0;
+			this will prevent problems when that rrtype is
+			used in actual DNS packets. [RT #24777]
+
+3123.	[security]	Change #2912 exposed a latent flaw in
+			dns_rdataset_totext() that could cause named to
+			crash with an assertion failure. [RT #24777]
+
+3122.	[cleanup]	dnssec-settime: corrected usage message. [RT #24664]
+
+3121.   [security]      An authoritative name server sending a negative
+                        response containing a very large RRset could
+                        trigger an off-by-one error in the ncache code
+                        and crash named. [RT #24650]
+
+3120.	[bug]		Named could fail to validate zones listed in a DLV
+			that validated insecure without using DLV and had
+			DS records in the parent zone. [RT #24631]
+
+3119.	[bug]		When rolling to a new DNSSEC key, a private-type
+			record could be created and never marked complete.
+			[RT #23253]
+
+3118.	[bug]		nsupdate could dump core on shutdown when using
+			SIG(0) keys. [RT #24604]
+
+3117.	[cleanup]	Remove doc and parser references to the
+			never-implemented 'auto-dnssec create' option.
+			[RT #24533]
+
+3114.	[bug]		Retain expired RRSIGs in dynamic zones if key is
+			inactive and there is no replacement key. [RT #23136]
+
+3113.	[doc]		Document the relationship between serial-query-rate
+			and NOTIFY messages.
+
+3112.	[doc]		Add missing descriptions of the update policy name
+			types "ms-self", "ms-subdomain", "krb5-self" and
+			"krb5-subdomain", which allow machines to update
+			their own records, to the BIND 9 ARM.
+
+3111.	[bug]		Improved consistency checks for dnssec-enable and
+			dnssec-validation, added test cases to the
+			checkconf system test. [RT #24398]
+
+3110.	[bug]		dnssec-signzone: Wrong error message could appear
+			when attempting to sign with no KSK. [RT #24369]
+
+3107.	[bug]		dnssec-signzone: Report the correct number of ZSKs
+			when using -x. [RT #20852]
+
+3104.	[bug]		Better support for cross-compiling. [RT #24367]
+
+3101.	[bug]		Zones using automatic key maintenance could fail
+			to check the key repository for updates. [RT #23744]
+
+3099.	[test]		"dlz" system test now runs but gives R:SKIPPED if
+			not compiled with --with-dlz-filesystem.  [RT #24146]
+
+3097.	[test]		Add a tool to test handling of malformed packets.
+			[RT #24096]
+
+	--- 9.7.4b1 released ---
+
+3095.	[bug]		Handle isolated reserved ports in the port range.
+			[RT #23957]
+
+3092.	[bug]		Signatures for records at the zone apex could go
+			stale due to an incorrect timer setting. [RT #23769]
+
+3091.	[bug]		Fixed a bug in which zone keys that were published
+			and then subsequently activated could fail to trigger
+			automatic signing. [RT #22911]
+
+3088.	[bug]		Remove bin/tests/system/logfileconfig/ns1/named.conf
+			and add setup.sh in order to resolve changing
+			named.conf issue.  [RT #23687]
+
+3086.	[bug]		Running dnssec-settime -f on an old-style key will
+			now force an update to the new key format even if no
+			other change has been specified, using "-P now -A now"
+			as default values.  [RT #22474]
+
+3083.	[bug]		NOTIFY messages were not being sent when generating
+			a NSEC3 chain incrementally. [RT #23702]
+
+3081.	[bug]		Failure of DNAME substitution did not return
+			YXDOMAIN. [RT #23591]
+
+3080.	[cleanup]	Replaced compile time constant by STDTIME_ON_32BITS.
+			[RT #23587]
+
+3079.	[bug]		Handle isc_event_allocate failures in t_tasks.
+			[RT #23572]
+
+3077.	[bug]		zone.c:zone_refreshkeys() incorrectly called
+			dns_zone_attach(), use zone->irefs instead. [RT #23303]
+
+3075.	[bug]		dns_dnssec_findzonekeys{2} used a inconsistant
+			timestamp when determining which keys are active.
+			[RT #23642]
+
+3074.	[bug]		Make the adb cache read through for zone data and
+			glue learn for zone named is authoritative for.
+			[RT #22842]
+
+3073.	[bug]		managed-keys changes were not properly being recorded.
+			[RT #20256]
+
+3071.	[bug]		has_nsec could be used unintialised in
+			update.c:next_active. [RT #20256]
+
+3070.	[bug]		dnssec-signzone potential NULL pointer dereference.
+			[RT #20256]
+
+3069.	[cleanup]	Silence warnings messages from clang static analysis.
+			[RT #20256]
+
+3068.	[bug]		Named failed to build with a OpenSSL without engine
+			support. [RT #23473]
+
+3067.	[bug]		ixfr-from-differences {master|slave}; failed to
+			select the master/slave zones.  [RT #23580]
+
+3065.	[bug]		RRSIG could have time stamps too far in the future.
+			[RT #23356]
+
+3064.	[bug]		powerpc: add sync instructions to the end of atomic
+			operations. [RT #23469]
+
+3063.	[contrib]	More verbose error reporting from DLZ LDAP. [RT #23402]
+
+3059.	[test]		Added a regression test for change #3023.
+
+3058.	[bug]		Cause named to terminate at startup or rndc reconfig/
+			reload to fail, if a log file specified in the conf
+			file isn't a plain file. [RT #22771]
+
+3057.	[bug]		"rndc secroots" would abort after the first error
+			and so could miss some views. [RT #23488]
+
+3055.	[bug]		Load only the desired keys in the
+			"dnssec-lookaside auto" mode. [RT #23372]
+
+3053.	[bug]		Under a sustained high query load with a finite
+			max-cache-size, it was possible for cache memory
+			to be exhausted and not recovered. [RT #23371]
+
+3052.	[test]		Fixed last autosign test report. [RT #23256]
+
+3051.	[bug]		NS records obsure DNAME records at the bottom of the
+			zone if both are present. [RT #23035]
+
+3050.	[bug]		The autosign system test was timing dependent.
+			Wait for the initial autosigning to complete
+			before running the rest of the test. [RT #23035]
+
+3049.	[bug]		Save and restore the gid when creating creating
+			named.pid at startup. [RT #23290]
+
+3048.	[bug]		Fully separate view key mangement. [RT #23419]
+
+3047.	[bug]		DNSKEY NODATA responses not cached fixed in
+			validator.c. Tests added to dnssec system test.
+			[RT #22908]
+
+3046.	[bug]		Use RRSIG original TTL to compute validated RRset
+			and RRSIG TTL. [RT #23332]
+
+3044.	[bug]		Hold the socket manager lock while freeing the socket.
+			[RT #23333]
+
+3043.	[test]		Merged in the NetBSD ATF test framework (currently
+			version 0.12) for development of future unit tests.
+			Use configure --with-atf to build ATF internally
+			or configure --with-atf=prefix to use an external
+			copy.  [RT #23209]
+
+3042.	[bug]		dig +trace could fail attempting to use IPv6
+			addresses on systems with only IPv4 connectivity.
+			[RT #23297]
+
+3041.	[bug]		dnssec-signzone failed to generate new signatures on
+			ttl changes. [RT #23330]
+
+3040.	[bug]		Named failed to validate insecure zones where a node
+			with a CNAME existed between the trust anchor and the
+			top of the zone. [RT #23338]
+
+3037.	[doc]		Update COPYRIGHT to contain all the individual
+			copyright notices that cover various parts.
+
+3036.	[bug]		Check built-in zone arguments to see if the zone
+			is re-usable or not. [RT #21914]
+
+3035.	[cleanup]	Simplify by using strlcpy. [RT #22521]
+
+3034.	[cleanup]	nslookup: use strlcpy instead of safecopy. [RT #22521]
+
+3033.	[cleanup]	Add two INSIST(bucket != DNS_ADB_INVALIDBUCKET).
+			[RT #22521]
+
+3032.	[bug]		rdatalist.c: add missing REQUIREs. [RT #22521]
+
+3031.	[bug]		dns_rdataclass_format() handle a zero sized buffer.
+			[RT #22521]
+
+3030.	[bug]		dns_rdatatype_format() handle a zero sized buffer.
+			[RT #22521]
+
+3029.	[bug]		isc_netaddr_format() handle a zero sized buffer.
+			[RT #22521]
+
+3028.	[bug]		isc_sockaddr_format() handle a zero sized buffer.
+			[RT #22521]
+
+3027.	[bug]		Add documented REQUIREs to cfg_obj_asnetprefix() to
+			catch NULL pointer dereferences before they happen.
+			[RT #22521]
+
+3026.	[bug]		lib/isc/httpd.c: check that we have enough space
+			after calling grow_headerspace() and if not
+			re-call grow_headerspace() until we do. [RT #22521]
+
+3025.	[bug]		Fixed a possible deadlock due to zone resigning.
+			[RT #22964]
+
+3023.	[bug]		Named could be left in an inconsistent state when
+			receiving multiple AXFR response messages that were
+			not all TSIG-signed. [RT #23254]
+
+3021.	[bug]		Change #3010 was incomplete. [RT #22296]
+
+3020.	[bug]		auto-dnssec failed to correctly update the zone when
+			changing the DNSKEY RRset. [RT #23232]
+
+3019.	[test]		Test: check apex NSEC3 records after adding DNSKEY
+			record via UPDATE. [RT #23229]
+
 	--- 9.7.3 released ---

 3018.	[bug]		Named failed to check for the "none;" acl when deciding
@@ -74,12 +509,12 @@

 2976.	[bug]		named could die on exit after negotiating a GSS-TSIG
 			key. [RT #22573]
-			
-2975.	[bug]		rbtdb.c:cleanup_dead_nodes_callback() aquired the
+
+2975.	[bug]		rbtdb.c:cleanup_dead_nodes_callback() acquired the
 			wrong lock which could lead to server deadlock.
 			[RT #22614]

-2974.	[bug]		Some vaild UPDATE requests could fail due to a
+2974.	[bug]		Some valid UPDATE requests could fail due to a
 			consistency check examining the existing version
 			of the zone rather than the new version resulting
 			from the UPDATE. [RT #22413]
@@ -168,7 +603,7 @@
 2950.	[bug]		named failed to perform a SOA up to date check when
 			falling back to TCP on UDP timeouts when
 			ixfr-from-differences was set. [RT #21595]
-			
+
 2949.	[bug]		dns_view_setnewzones() contained a memory leak if
 			it was called multiple times. [RT #21942]

@@ -273,10 +708,10 @@
 			This feature is not yet documented, and its syntax
 			is expected to change.) [RT #19447]

-2929.	[bug]		Improved handling of GSS security contexts: 
+2929.	[bug]		Improved handling of GSS security contexts:
 			 - added LRU expiration for generated TSIGs
 			 - added the ability to use a non-default realm
-                         - added new "realm" keyword in nsupdate
+			 - added new "realm" keyword in nsupdate
 			 - limited lifetime of generated keys to 1 hour
 			   or the lifetime of the context (whichever is
 			   smaller)
@@ -344,7 +779,7 @@
 2905.	[port]		aix: set use_atomic=yes with native compiler.
 			[RT #21402]

-2904.   [bug]           When using DLV, sub-zones of the zones in the DLV,
+2904.	[bug]		When using DLV, sub-zones of the zones in the DLV,
 			could be incorrectly marked as insecure instead of
 			secure leading to negative proofs failing.  This was
 			a unintended outcome from change 2890. [RT# 21392]
@@ -359,17 +794,17 @@
 2901.	[port]		Use AC_C_FLEXIBLE_ARRAY_MEMBER. [RT #21316]

 2900.	[bug]		The placeholder negative caching element was not
-			properly constructed triggering a INSIST in 
+			properly constructed triggering a INSIST in
 			dns_ncache_towire(). [RT #21346]
-			
+
 2899.	[port]		win32: Support linking against OpenSSL 1.0.0.

-2898.	[bug]		nslookup leaked memory when -domain=value was 
+2898.	[bug]		nslookup leaked memory when -domain=value was
 			specified. [RT #21301]

 2897.	[bug]		NSEC3 chains could be left behind when transitioning
 			to insecure. [RT #21040]
-			
+
 2896.	[bug]		"rndc sign" failed to properly update the zone
 			when adding a DNSKEY for publication only. [RT #21045]

@@ -609,7 +1044,7 @@
 2819.	[cleanup]	Removed unnecessary DNS_POINTER_MAXHOPS define.
 			[RT #20771]

-2818.	[cleanup]	rndc could return an incorrect error code 
+2818.	[cleanup]	rndc could return an incorrect error code
 			when a zone was not found. [RT #20767]

 2817.	[cleanup]	Removed unnecessary isc_task_endexclusive() calls.
@@ -623,7 +1058,7 @@

 2814.	[func]		Provide a definitive error message when a master
 			zone is not loaded. [RT #20757]
- 
+
 2813.	[bug]		Better handling of unreadable DNSSEC key files.
 			[RT #20710]

@@ -672,7 +1107,7 @@

 			named-checkzone -r {ignore|warn|fail} (default warn)
 			named-compilezone -r {ignore|warn|fail} (default warn)
-			
+
 			named.conf: check-dup-records {ignore|warn|fail};

 2800.	[func]		Reject zones which have NS records which refer to
@@ -684,7 +1119,7 @@
 			"dnssec-secure-to-insecure", and "dnskey-ksk-only"
 			to "dnssec-dnskey-kskonly", for clarity. [RT #20586]

-2798.	[bug]		Addressed bugs in managed-keys initialization 
+2798.	[bug]		Addressed bugs in managed-keys initialization
 			and rollover. [RT #20683]

 2797.	[bug]		Don't decrement the dispatch manager's maxbuffers.
@@ -709,7 +1144,7 @@

 2790.	[bug]		Handle DS queries to stub zones. [RT #20440]

-2789.   [bug]           Fixed an INSIST in dispatch.c [RT #20576]
+2789.	[bug]		Fixed an INSIST in dispatch.c [RT #20576]

 2788.	[bug]		dnssec-signzone could sign with keys that were
 			not requested [RT #20625]
@@ -1026,7 +1461,7 @@

 2695.	[func]		DHCP/DDNS - update fdwatch code for use by
 			DHCP.  Modify the api to isc_sockfdwatch_t (the
-			callback funciton for isc_socket_fdwatchcreate)
+			callback functon for isc_socket_fdwatchcreate)
 			to include information about the direction (read
 			or write) and add isc_socket_fdwatchpoke.
 			[RT #20253]
@@ -1091,14 +1526,14 @@
 			  sets the time when a key is no longer used for
 			  signing but is still published.
 			- The "unpublished" date (-U) is deprecated in
-			  favor of "deleted" (-D).
+			  favour of "deleted" (-D).
 			[RT #20247]

 2676.	[bug]		--with-export-installdir should have been
 			--with-export-includedir. [RT #20252]

 2675.	[bug]		dnssec-signzone could crash if the key directory
-                        did not exist. [RT #20232]
+			did not exist. [RT #20232]

 	--- 9.7.0a3 released ---

@@ -1189,7 +1624,7 @@
 			64-bit systems. [RT #20076]

 2650.	[bug]		Assertion failure in dnssec-signzone when trying
-                        to read keyset-* files. [RT #20075]
+			to read keyset-* files. [RT #20075]

 2649.	[bug]		Set the domain for forward only zones. [RT #19944]

@@ -1261,7 +1696,7 @@
 2630.	[func]		Improved syntax for DDNS autoconfiguration:  use
 			"update-policy local;" to switch on local DDNS in a
 			zone. (The "ddns-autoconf" option has been removed.)
-                        [RT #19875]
+			[RT #19875]

 2629.	[port]		Check for seteuid()/setegid(), use setresuid()/
 			setresgid() if not present. [RT #19932]
@@ -1281,11 +1716,11 @@
 2624.	[func]		'named-checkconf -p' will print out the parsed
 			configuration. [RT #18871]

-2623.	[bug]		Named started seaches for DS non-optimally. [RT #19915]
+2623.	[bug]		Named started searches for DS non-optimally. [RT #19915]

 2622.	[bug]		Printing of named.conf grammar was broken. [RT #19919]

-2621.	[doc]		Made copyright boilterplate consistent.  [RT #19833]
+2621.	[doc]		Made copyright boilerplate consistent.  [RT #19833]

 2620.	[bug]		Delay thawing the zone until the reload of it has
 			completed successfully.  [RT #19750]
@@ -1605,7 +2040,7 @@
 2529.	[cleanup]	Upgrade libtool to silence complaints from recent
 			version of autoconf. [RT #18657]

-2528.   [cleanup]	Silence spurious configure warning about
+2528.	[cleanup]	Silence spurious configure warning about
 			--datarootdir [RT #19096]

 2527.	[placeholder]
@@ -1890,13 +2325,13 @@
 2441.	[bug]		isc_radix_insert() could copy radix tree nodes
 			incompletely. [RT #18573]

-2440.   [bug]		named-checkconf used an incorrect test to determine
+2440.	[bug]		named-checkconf used an incorrect test to determine
 			if an ACL was set to none.

-2439.   [bug]		Potential NULL dereference in dns_acl_isanyornone().
+2439.	[bug]		Potential NULL dereference in dns_acl_isanyornone().
 			[RT #18559]

-2438.   [bug]		Timeouts could be logged incorrectly under win32.
+2438.	[bug]		Timeouts could be logged incorrectly under win32.

 2437.	[bug]		Sockets could be closed too early, leading to
 			inconsistent states in the socket module. [RT #18298]
@@ -1910,7 +2345,7 @@

 2433.	[tuning]	Set initial timeout to 800ms.

-2432.   [bug]		More Windows socket handling improvements.  Stop
+2432.	[bug]		More Windows socket handling improvements.  Stop
 			using I/O events and use IO Completion Ports
 			throughout.  Rewrite the receive path logic to make
 			it easier to support multiple simultaneous
@@ -1945,11 +2380,11 @@
 			epoll and /dev/poll to be selected at compile
 			time. [RT #18277]

-2423.   [security]	Randomize server selection on queries, so as to
-                        make forgery a little more difficult.  Instead of
-                        always preferring the server with the lowest RTT,
-                        pick a server with RTT within the same 128
-                        millisecond band.  [RT #18441]
+2423.	[security]	Randomize server selection on queries, so as to
+			make forgery a little more difficult.  Instead of
+			always preferring the server with the lowest RTT,
+			pick a server with RTT within the same 128
+			millisecond band.  [RT #18441]

 2422.	[bug]		Handle the special return value of a empty node as
 			if it was a NXRRSET in the validator. [RT #18447]
@@ -1959,7 +2394,7 @@
 			Use caution: this option may not work for some
 			operating systems without rebuilding named.

-2420.   [bug]		Windows socket handling cleanup.  Let the io
+2420.	[bug]		Windows socket handling cleanup.  Let the io
 			completion event send out canceled read/write
 			done events, which keeps us from writing to memory
 			we no longer have ownership of.  Add debugging
@@ -2030,7 +2465,7 @@

 2399.	[placeholder]

-2398.	[bug]           Improve file descriptor management.  New,
+2398.	[bug]		Improve file descriptor management.  New,
 			temporary, named.conf option reserved-sockets,
 			default 512. [RT #18344]

@@ -2281,8 +2716,8 @@
 2316.	[port]		Missing #include <isc/print.h> in lib/dns/gssapictx.c.
 			[RT #17513]

-2315.   [bug]           Used incorrect address family for mapped IPv4
-                        addresses in acl.c. [RT #17519]
+2315.	[bug]		Used incorrect address family for mapped IPv4
+			addresses in acl.c. [RT #17519]

 2314.	[bug]		Uninitialized memory use on error path in
 			bin/named/lwdnoop.c.  [RT #17476]
@@ -2293,14 +2728,14 @@
 2312.	[cleanup]	Silence Coverity warning in lib/isc/unix/socket.c.
 			[RT #17458]

-2311.   [bug]           IPv6 addresses could match IPv4 ACL entries and
-                        vice versa. [RT #17462]
+2311.	[bug]		IPv6 addresses could match IPv4 ACL entries and
+			vice versa. [RT #17462]

 2310.	[bug]		dig, host, nslookup: flush stdout before emitting
 			debug/fatal messages.  [RT #17501]

-2309.   [cleanup]       Fix Coverity warnings in lib/dns/acl.c and iptable.c.
-                        [RT #17455]
+2309.	[cleanup]	Fix Coverity warnings in lib/dns/acl.c and iptable.c.
+			[RT #17455]

 2308.	[cleanup]	Silence Coverity warning in bin/named/controlconf.c.
 			[RT #17495]
@@ -2352,7 +2787,7 @@
 2292.	[bug]		Log if the working directory is not writable.
 			[RT #17312]

-2291.   [bug]           PR_SET_DUMPABLE may be set too late.  Also report
+2291.	[bug]		PR_SET_DUMPABLE may be set too late.  Also report
 			failure to set PR_SET_DUMPABLE. [RT #17312]

 2290.	[bug]		Let AD in the query signal that the client wants AD
@@ -2390,7 +2825,7 @@
 2280.	[func]		Allow the experimental http server to be reached
 			over IPv6 as well as IPv4. [RT #17332]

-2279.   [bug]           Use setsockopt(SO_NOSIGPIPE), when available,
+2279.	[bug]		Use setsockopt(SO_NOSIGPIPE), when available,
 			to protect applications from receiving spurious
 			SIGPIPE signals when using the resolver.

@@ -2425,9 +2860,9 @@

 	--- 9.5.0b1 released ---

-2267.   [bug]           Radix tree node_num value could be set incorrectly,
-                        causing positive ACL matches to look like negative
-                        ones.  [RT #17311]
+2267.	[bug]		Radix tree node_num value could be set incorrectly,
+			causing positive ACL matches to look like negative
+			ones.  [RT #17311]

 2266.	[bug]		client.c:get_clientmctx() returned the same mctx
 			once the pool of mctx's was filled. [RT #17218]
@@ -2443,7 +2878,7 @@
 2262.	[bug]		Error status from all but the last view could be
 			lost. [RT #17292]

-2261.   [bug]           Fix memory leak with "any" and "none" ACLs [RT #17272]
+2261.	[bug]		Fix memory leak with "any" and "none" ACLs [RT #17272]

 2260.	[bug]		Reported wrong clients-per-query when increasing the
 			value. [RT #17236]
@@ -13,9 +13,15 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.

-$Id: COPYRIGHT,v 1.15.188.2 2011/01/04 23:46:30 tbox Exp $
+$Id: COPYRIGHT,v 1.15.188.3 2011/02/22 06:36:35 marka Exp $

-Portions Copyright (C) 1996-2001  Nominum, Inc.
+	Portions of this code release fall under one or more of the
+	following Copyright notices.  Please see individual source
+	files for details.
+
+	For binary releases also see: OpenSSL-LICENSE.
+
+Copyright (C) 1996-2001  Nominum, Inc.

 Permission to use, copy, modify, and distribute this software for any
 purpose with or without fee is hereby granted, provided that the above
@@ -28,3 +34,485 @@ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 1995-2000 by Network Associates, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC AND NETWORK ASSOCIATES DISCLAIMS
+ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE
+FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
+
+The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+conceived and contributed by Rob Butler.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the
+above copyright notice and this permission notice appear in all
+copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
+DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1987, 1990, 1993, 1994
+     The Regents of the University of California.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. All advertising materials mentioning features or use of this software
+   must display the following acknowledgement:
+     This product includes software developed by the University of
+     California, Berkeley and its contributors.
+4. Neither the name of the University nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) The Internet Society 2005.  This version of
+this module is part of RFC 4178; see the RFC itself for
+full legal notices.
+
+(The above copyright notice is per RFC 3978 5.6 (a), q.v.)
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 2004 Masarykova universita
+(Masaryk University, Brno, Czech Republic)
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+3. Neither the name of the University nor the names of its contributors may
+   be used to endorse or promote products derived from this software
+   without specific prior written permission.
+ 
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1997 - 2003 Kungliga Tekniska Högskolan
+(Royal Institute of Technology, Stockholm, Sweden). 
+All rights reserved. 
+
+Redistribution and use in source and binary forms, with or without 
+modification, are permitted provided that the following conditions 
+are met: 
+
+1. Redistributions of source code must retain the above copyright 
+   notice, this list of conditions and the following disclaimer. 
+
+2. Redistributions in binary form must reproduce the above copyright 
+   notice, this list of conditions and the following disclaimer in the 
+   documentation and/or other materials provided with the distribution. 
+
+3. Neither the name of the Institute nor the names of its contributors 
+   may be used to endorse or promote products derived from this software 
+   without specific prior written permission. 
+
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+SUCH DAMAGE. 
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1998 Doug Rabson
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright ((c)) 2002, Rice University
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+
+    * Redistributions in binary form must reproduce the above
+    copyright notice, this list of conditions and the following
+    disclaimer in the documentation and/or other materials provided
+    with the distribution.
+
+    * Neither the name of Rice University (RICE) nor the names of its
+    contributors may be used to endorse or promote products derived
+    from this software without specific prior written permission.
+
+
+This software is provided by RICE and the contributors on an "as is"
+basis, without any representations or warranties of any kind, express
+or implied including, but not limited to, representations or
+warranties of non-infringement, merchantability or fitness for a
+particular purpose. In no event shall RICE or contributors be liable
+for any direct, indirect, incidental, special, exemplary, or
+consequential damages (including, but not limited to, procurement of
+substitute goods or services; loss of use, data, or profits; or
+business interruption) however caused and on any theory of liability,
+whether in contract, strict liability, or tort (including negligence
+or otherwise) arising in any way out of the use of this software, even
+if advised of the possibility of such damage.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1993 by Digital Equipment Corporation.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies, and that
+the name of Digital Equipment Corporation not be used in advertising or
+publicity pertaining to distribution of the document or software without
+specific, written prior permission.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright 2000 Aaron D. Gifford.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+ 
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1998 Doug Rabson.
+Copyright (c) 2001 Jake Burkholder.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the project nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1999-2000 by Nortel Networks Corporation
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NORTEL NETWORKS DISCLAIMS
+ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NORTEL NETWORKS
+BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES
+OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
+ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 2000-2002 Japan Network Information Center.  All rights reserved.
+ 
+By using this file, you agree to the terms and conditions set forth bellow.
+
+                        LICENSE TERMS AND CONDITIONS 
+
+The following License Terms and Conditions apply, unless a different
+license is obtained from Japan Network Information Center ("JPNIC"),
+a Japanese association, Kokusai-Kougyou-Kanda Bldg 6F, 2-3-4 Uchi-Kanda,
+Chiyoda-ku, Tokyo 101-0047, Japan.
+
+1. Use, Modification and Redistribution (including distribution of any
+   modified or derived work) in source and/or binary forms is permitted
+   under this License Terms and Conditions.
+
+2. Redistribution of source code must retain the copyright notices as they
+   appear in each source code file, this License Terms and Conditions.
+
+3. Redistribution in binary form must reproduce the Copyright Notice,
+   this License Terms and Conditions, in the documentation and/or other
+   materials provided with the distribution.  For the purposes of binary
+   distribution the "Copyright Notice" refers to the following language:
+   "Copyright (c) 2000-2002 Japan Network Information Center.  All rights
+   reserved."
+
+4. The name of JPNIC may not be used to endorse or promote products
+   derived from this Software without specific prior written approval of
+   JPNIC.
+
+5. Disclaimer/Limitation of Liability: THIS SOFTWARE IS PROVIDED BY JPNIC
+   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL JPNIC BE LIABLE
+   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+   CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+   BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+   OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+   ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+ -----------------------------------------------------------------------------
+
+Copyright (C) 2004  Nominet, Ltd.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NOMINET DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+ -----------------------------------------------------------------------------
+
+Portions Copyright RSA Security Inc.
+
+License to copy and use this software is granted provided that it is
+identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
+(Cryptoki)" in all material mentioning or referencing this software.
+
+License is also granted to make and use derivative works provided that
+such works are identified as "derived from the RSA Security Inc. PKCS #11
+Cryptographic Token Interface (Cryptoki)" in all material mentioning or
+referencing the derived work.
+
+RSA Security Inc. makes no representations concerning either the
+merchantability of this software or the suitability of this software for
+any particular purpose. It is provided "as is" without express or implied
+warranty of any kind.
+
+ -----------------------------------------------------------------------------
+
+Copyright (c) 1996, David Mazieres <dm@uun.org>
+Copyright (c) 2008, Damien Miller <djm@openbsd.org>
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+-----------------------------------------------------------------------------
+
+Copyright (c) 2000-2001 The OpenSSL Project.  All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+3. All advertising materials mentioning features or use of this
+   software must display the following acknowledgment:
+   "This product includes software developed by the OpenSSL Project
+   for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+
+4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+   endorse or promote products derived from this software without
+   prior written permission. For written permission, please contact
+   licensing@OpenSSL.org.
+
+5. Products derived from this software may not be called "OpenSSL"
+   nor may "OpenSSL" appear in their names without prior written
+   permission of the OpenSSL Project.
+
+6. Redistributions of any form whatsoever must retain the following
+   acknowledgment:
+   "This product includes software developed by the OpenSSL Project
+   for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+
+THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGE.
+
@@ -37,3 +37,32 @@
 2948.	[port]		MacOS: provide a mechanism to configure the test
 			interfaces at reboot. See bin/tests/system/README
 			for details.
+
+3013.	[bug]		The DNS64 ttl was not always being set as expected.
+			[RT #23034]
+
+3022.	[bug]		Fixed rpz SERVFAILs after failed zone transfers
+                        [RT #23246]
+
+3038.	[bug]		Install <dns/rpz.h>.  [RT #23342]
+
+3045.	[removed]	Replaced by change #3050.
+
+3054.	[bug]		Added elliptic curve support check in
+			GOST OpenSSL engine detection. [RT #23485]
+
+3072.	[bug]		dns_dns64_aaaaok() potential NULL pointer dereference.
+			[RT #20256]
+
+3082.	[port]		strtok_r is threads only. [RT #23747]
+
+3087.	[bug]		DDNS updates using SIG(0) with update-policy match
+			type "external" could cause a crash. [RT #23735]
+
+3093.	[bug]		Fix gssapi/kerberos dependencies [RT #23836]
+
+3094.	[doc]		Expand dns64 documentation.
+
+3096.	[bug]		Set KRB5_KTNAME before calling log_cred() in
+			dst_gssapi_acceptctx(). [RT #24004]
+
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.58 2009/11/26 20:52:44 marka Exp $
+# $Id: Makefile.in,v 1.58.8.4 2011/09/06 04:05:37 marka Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -21,7 +21,7 @@ top_srcdir =	@top_srcdir@

@BIND9_VERSION@

-SUBDIRS =	make lib bin doc @LIBEXPORT@
+SUBDIRS =	make unit lib bin doc @LIBEXPORT@
 TARGETS =

 MANPAGES =	isc-config.sh.1
@@ -64,7 +64,10 @@ tags:
 check: test

 test:
-	(cd bin/tests && ${MAKE} ${MAKEDEFS} test)
+	status=0; \
+	(cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
+	(test -f unit/unittest.sh && $(SHELL) unit/unittest.sh) || status=1; \
+	exit $$status

 FAQ: FAQ.xml
 	${XSLTPROC} doc/xsl/isc-docbook-text.xsl FAQ.xml | \
@@ -48,6 +48,15 @@ BIND 9
 	For a detailed list of user-visible changes from
 	previous releases, see the CHANGES file.

+BIND 9.7.5
+
+	BIND 9.7.5 includes a number of bug fixes and prevents a security
+	problem described in CVE-2011-4313
+
+BIND 9.7.4
+
+	BIND 9.7.4 is a maintenance release, fixing bugs in 9.7.3.
+
 BIND 9.7.3

 	BIND 9.7.3 is a maintenance release, fixing bugs in 9.7.2.
@@ -349,6 +358,48 @@ Documentation
 	in the other README files.


+Change Log
+
+	A detailed list of all changes to BIND 9 is included in the 
+	file CHANGES, with the most recent changes listed first.
+	Change notes include tags indicating the category of the
+	change that was made; these categories are:
+
+	   [func]	  New feature
+
+	   [bug]	  General bug fix
+
+	   [security]	  Fix for a significant security flaw
+
+	   [experimental] Used for new features when the syntax
+	   		  or other aspects of the design are still
+			  in flux and may change
+
+	   [port]	  Portability enhancement
+
+	   [maint]	  Updates to built-in data such as root
+			  server addresses and keys
+
+	   [tuning]	  Changes to built-in configuration defaults
+	   		  and constants to improve performanceo
+
+	   [protocol]	  Updates to the DNS protocol such as new
+			  RR types
+
+           [test]         Changes to the automatic tests, not
+                          affecting server functionality
+
+           [cleanup]      Minor corrections and refactoring
+
+	   [doc]	  Documentation
+
+	In general, [func] and [experimental] tags will only appear
+	in new-feature releases (i.e., those with version numbers
+	ending in zero).  Some new functionality may be backported to
+	older releases on a case-by-case basis.  All other change
+	types may be applied to all currently-supported releases.
+
+
 Bug Reports and Mailing Lists

 	Bugs reports should be sent to
@@ -1,318 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title></title><link rel="stylesheet" href="release-notes.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /></head><body><div class="article"><div class="titlepage"><hr /></div>
-
-  <div class="section" title="Introduction"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2549151"></a>Introduction</h2></div></div></div>
-    
-    <p>
-			BIND 9.7.3 is the current release of BIND 9.7.
-		</p>
-    <p>
-			This document summarizes changes from BIND 9.7.1 to BIND 9.7.3.
-			Please see the CHANGES file in the source code release for a
-			complete list of all changes.
-		</p>
-  </div>
-
-  <div class="section" title="Download"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3415638"></a>Download</h2></div></div></div>
-    
-    <p>
-                        The latest development version of BIND 9 software can always be found
-                        on our web site at
-      <a class="ulink" href="http://www.isc.org/downloads/development" target="_top">http://www.isc.org/downloads/development</a>.
-                There you will find additional information about each release,
-                        source code, and some pre-compiled versions for certain operating
-                        systems.
-		</p>
-  </div>
-
-  <div class="section" title="Support"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3415690"></a>Support</h2></div></div></div>
-    
-    <p>Product support information is available on
-      <a class="ulink" href="http://www.isc.org/services/support" target="_top">http://www.isc.org/services/support</a>
-      for paid support options.  Free support is provided by our user
- 			community via a mailing list.  Information on all public email
- 			lists is available at
-      <a class="ulink" href="https://lists.isc.org/mailman/listinfo" target="_top">https://lists.isc.org/mailman/listinfo</a>.
-    </p>
-  </div>
-
-  <div class="section" title="New Features"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3415627"></a>New Features</h2></div></div></div>
-    
-		<div class="section" title="9.7.2"><div class="titlepage"><div><div><h3 class="title"><a id="id3415698"></a>9.7.2</h3></div></div></div>
-			
-	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-					Zones may be dynamically added and removed with the
-					“rndc addzone” and “rndc delzone” commands.  These
-					dynamically added zones are written to a per-view
-					configuration file.  Do not rely on the configuration
-					file name nor contents as this will change in a future
-					release.  This is an experimental feature at this time.
-				</li><li class="listitem">
-					Added new “filter-aaaa-on-v4” access control list to
-					select which IPv4 clients have AAAA record filtering
-					applied.
-				</li><li class="listitem">
-					A new command “rndc secroots” was added to dump a combined
-					summary of the currently managed keys combined with statically
-					configured trust anchors.
-				</li><li class="listitem">
-					Added support to load new keys into managed zones without
-					signing immediately with "rndc loadkeys".  Added support
-					to link keys with "dnssec-keygen -S" and
-					"dnssec-settime -S".
-				</li></ul></div>
-		</div>
-  </div>
-
-  <div class="section" title="Feature Changes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3415770"></a>Feature Changes</h2></div></div></div>
-    
-		<div class="section" title="9.7.2"><div class="titlepage"><div><div><h3 class="title"><a id="id3415775"></a>9.7.2</h3></div></div></div>
-			
-	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-					Documentation improvements
-				</li><li class="listitem">
-					ORCHID prefixes were removed from the automatic empty
-					zone list.
-				</li><li class="listitem">
-					Improved handling of GSSAPI security contexts.  Specifically,
-					better memory management of cached contexts, limited lifetime
-					of a context to 1 hour, and added a “realm” command to
-					nsupdate to allow selection of a non-default realm name.
-				</li><li class="listitem">
-					The contributed tool “zkt” was updated to version 1.0.
-				</li></ul></div>
-		</div>
-  </div>
-
-  <div class="section" title="Security Fixes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3415805"></a>Security Fixes</h2></div></div></div>
-    
-		<div class="section" title="9.7.2-P3"><div class="titlepage"><div><div><h3 class="title"><a id="id3415810"></a>9.7.2-P3</h3></div></div></div>
-			
-			<div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-				 	Adding a NO DATA signed negative response to cache failed to clear
-				  any matching RRSIG records already in cache. A subsequent lookup
-				  of the cached NO DATA entry could crash named (INSIST) when the
-				  unexpected RRSIG was also returned with the NO DATA cache entry.
-				  [RT #22288] [CVE-2010-3613] [VU#706148]
-				</li><li class="listitem">
-					BIND, acting as a DNSSEC validator, was determining if the NS RRset
-				  is insecure based on a value that could mean either that the RRset
-				  is actually insecure or that there wasn't a matching key for the RRSIG
-				  in the DNSKEY RRset when resuming from validating the DNSKEY RRset.
-				  This can happen when in the middle of a DNSKEY algorithm rollover,
-				  when two different algorithms were used to sign a zone but only the
-				  new set of keys are in the zone DNSKEY RRset.
-					[RT #22309] [CVE-2010-3614] [VU#837744]
-				</li><li class="listitem">
-					<p>
-				 		When BIND is running as an authoritative server for a zone and
-				   	receives a query for that zone data, it first checks for allow-query
-				   	acls in the zone statement, then in that view, then in global
-				   	options. If none of these exist, it defaults to allowing any query
-				   	(allow-query {"any"};).
-					</p>
-					<p>
-			   		With this bug, if the allow-query is not set in the zone statement,
-				   	it failed to check in view or global options and fell back to the
-				   	default of allowing any query. This means that queries that the zone
-				   	owner did not wish to allow were incorrectly allowed.
-						[RT #22418] [CVE-2010-3615] [VU#510208]
-					</p>
-				</li></ul></div>
-		</div>
-		<div class="section" title="9.7.2-P2"><div class="titlepage"><div><div><h3 class="title"><a id="id3415862"></a>9.7.2-P2</h3></div></div></div>
-			
-			<div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-					A flaw where the wrong ACL was applied was fixed.  This flaw
-					allowed access to a cache via recursion even though the ACL
-					disallowed it.
-				</li></ul></div>
-		</div>
-		<div class="section" title="9.7.2-P1"><div class="titlepage"><div><div><h3 class="title"><a id="id3415878"></a>9.7.2-P1</h3></div></div></div>
-			
-	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-					If BIND, acting as a DNSSEC validating server, has two or more trust
-	        anchors configured in named.conf for the same zone (such as
-	        example.com) and the response for a record in that zone from the
-	        authoritative server includes a bad signature, the validating server
-	        will crash while trying to validate that query.
-				</li></ul></div>
-		</div>
-  </div>
-
-  <div class="section" title="Bug Fixes"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3415898"></a>Bug Fixes</h2></div></div></div>
-    
-		<div class="section" title="9.7.3"><div class="titlepage"><div><div><h3 class="title"><a id="id3415904"></a>9.7.3</h3></div></div></div>
-			
-	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-				BIND now builds with threads disabled in versions of NetBSD earlier
-				than 5.0 and with pthreads enabled by default in NetBSD versions 5.0
-				and higher. Also removes support for unproven-pthreads, mit-pthreads
-				and ptl2. [RT #19203]
-				</li><li class="listitem">
-				Added a regression test for fix 2896/RT #21045 ("rndc sign" failed
-				to properly update the zone when adding a DNSKEY for publication
-				only). [RT #21324]
-				</li><li class="listitem">
-				"nsupdate -l" now gives error message if "session.key" file is not
-				found. [RT #21670]
-				</li><li class="listitem">
-				HPUX now correctly defaults to using /dev/poll, which should
-				increase performance. [RT #21919]
-				</li><li class="listitem">
-				If named is running as a threaded application, after an "rndc stop"
-				command has been issued, other inbound TCP requests can cause named
-				to hang and never complete shutdown. [RT #22108]
-				</li><li class="listitem">
-				After an "rndc reconfig", the refresh timer for managed-keys is ignored, resulting in managed-keys
-				not being refreshed until named is restarted. [RT #22296]
-				</li><li class="listitem">
-				An NSEC3PARAM record placed inside a zone which is not properly
-				signed with NSEC3 could cause named to crash, if changed via dynamic
-				update. [RT #22363]				
-				</li><li class="listitem">
-				"rndc -h" now includes "loadkeys" option. [RT #22493]
-				</li><li class="listitem">
-				When performing a GSS-TSIG signed dynamic zone update, memory could be
-				leaked. This causes an unclean shutdown and may affect long-running
-				servers. [RT #22573]
-				</li><li class="listitem">
-				A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled allows
-				for a TCP DoS attack. Until there is a kernel fix, ISC is disabling
-				SO_ACCEPTFILTER support in BIND. [RT #22589]
-				</li><li class="listitem">
-When signing records, named didn't filter out any TTL changes
-to DNSKEY records. This resulted in an incomplete key set. TTL
-changes are now dealt with before signing.
-[RT #22590]
-				</li><li class="listitem">
-				Corrected a defect where a combination of dynamic updates and zone transfers incorrectly locked the in-memory zone database, causing
-				named to freeze. [RT #22614]
-				</li><li class="listitem">
-				Don't run MX checks (check-mx) when the MX record points to ".".
-[RT #22645]
-				</li><li class="listitem">
-				DST key reference counts can now be incremented via dst_key_attach.
-[RT #22672]
-				</li><li class="listitem">
-The IN6_IS_ADDR_LINKLOCAL and
-IN6_IS_ADDR_SITELOCAL macros in win32 were updated/corrected
-per current Windows OS. [RT #22724]
-				</li><li class="listitem">
-				"dnssec-settime -S" no longer tests prepublication interval validity
-				when the interval is set to 0. [RT #22761]
-				</li><li class="listitem">
-				isc_mutex_init_errcheck() in phtreads/mutex.c failed to destroy attr. [RT #22766]
-				</li><li class="listitem">
-				The Kerberos realm was being truncated when being pulled from the
-				the host prinicipal, make krb5-self updates fail. [RT #22770]
-				</li><li class="listitem">
-				named failed to preserve the case of domain names in RDATA which is not compressible when writing master files. [RT #22863]
-				</li><li class="listitem">
-The man page for dnssec-keyfromlabel incorrectly had "-U" rather
-than the correct option "-I". [RT #22887]
-				</li><li class="listitem">
-The "rndc" command usage statement was missing the "-b" option.
-[RT #22937]
-				</li><li class="listitem">
-There was a bug in how the clients-per-query code worked with some
-query patterns. This could result, in rare circumstances, in having all
-the client query slots filled with queries for the same DNS label,
-essentially ignoring the max-clients-per-query setting.
-[RT #22972]
-				</li><li class="listitem">
-The secure zone update feature in named is based on the zone
-being signed and configured for dynamic updates. A bug in the ACL
-processing for "allow-update { none; };" resulted in a zone that is
-supposed to be static being treated as a dynamic zone. Thus, name
-would try to sign/re-sign that zone erroneously. [RT #23120]
-				</li></ul></div>
-		</div>
-		<div class="section" title="9.7.2-P3"><div class="titlepage"><div><div><h3 class="title"><a id="id3415913"></a>9.7.2-P3</h3></div></div></div>
-			
-			<div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-					Microsoft changed the behavior of sockets between NT/XP based
-				  stacks vs Vista/windows7 stacks. Server 2003/2008 have the older
-				  behavior, 2008r2 has the new behavior. With the change, different
-				  error results are possible, so ISC adapted BIND to handle the new
-				  error results.
-				  This resolves an issue where sockets would shut down on
-				  Windows servers causing named to stop responding to queries.
-					[RT #21906]
-				</li><li class="listitem">
-				 	Windows has non-POSIX compliant behavior in its rename() and unlink()
-				  calls. This caused journal compaction to fail on Windows BIND servers
-				  with the log error: "dns_journal_compact failed: failure".
-					[RT #22434]
-				</li></ul></div>
-		</div>
-		<div class="section" title="9.7.2-P1"><div class="titlepage"><div><div><h3 class="title"><a id="id3416078"></a>9.7.2-P1</h3></div></div></div>
-			
-			<div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-					A bug, introduced in BIND 9.7.2, caused named to fail to start
-					if a master zone file was unreadable or missing.  This has
-					been corrected in 9.7.2-P1.
-				</li><li class="listitem">
-	        BIND previously accepted answers from authoritative servers that did
-	        not provide a "proper" response, such as not setting AA bit.  BIND was
-	        changed to be more strict in what it accepted but this caused
-	        operational issues.  This new strictness has been backed out in
-	        9.7.2-P1.
-	      </li></ul></div>
-		</div>
-		<div class="section" title="9.7.2"><div class="titlepage"><div><div><h3 class="title"><a id="id3416105"></a>9.7.2</h3></div></div></div>
-			
-	    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-					Removed a warning message when running BIND 9 under Windows
-					for when a TCP connection was aborted.  This is a common
-					occurrence and the warning was extraneous.
-				</li><li class="listitem">
-					Worked around a race condition in the cache database memory
-					handling.  Without this fix a DNS cache DB or ADB could
-					incorrectly stay in an over memory state, effectively refusing
-					further caching, which subsequently made a BIND 9 caching
-					server unworkable.
-				</li><li class="listitem">
-					Partially disabled change 2864 because it would cause
-					infinite attempts of RRSIG queries.
-				</li><li class="listitem">
-					BIND did not properly handle non-cacheable negative responses
-					from insecure zones. This caused several non-protocol-compliant
-					zones to become unresolvable.  BIND is now more accepting of
-					responses it receives from less strict servers.
-				</li></ul></div>
-		</div>
-  </div>
-
-  <div class="section" title="Known issues in this release"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3416145"></a>Known issues in this release</h2></div></div></div>
-    
-    <div class="itemizedlist"><ul class="itemizedlist" type="disc"><li class="listitem">
-        <p>
-          "make test" will fail on OSX and possibly other operating systems.
-          The failure occurs in a new test to check for allow-query ACLs.
-          The failure is caused because the source address is not specified on
-          the dig commands issued in the test.
-        </p>
-        <p>
-          If running "make test" is part of your usual acceptance process,
-          please edit the file <code class="code">bin/tests/system/allow_query/test.sh</code>
-          and add
-          </p><p>
-            <code class="code">-b 10.53.0.2</code>
-          </p><p>
-          to the <code class="code">DIGOPTS</code> line.
-        </p>
-      </li></ul></div>
-  </div>
-
-  <div class="section" title="Thank You"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3416192"></a>Thank You</h2></div></div></div>
-    
-    <p>
-      Thank you to everyone who assisted us in making this release possible.
-      If you would like to contribute to ISC to assist us in continuing to make
-      quality open source software, please visit our donations page at
-      <a class="ulink" href="http://www.isc.org/supportisc" target="_top">http://www.isc.org/supportisc</a>.
-    </p>
-  </div>
-</div></body></html>
@@ -1,220 +0,0 @@
-     __________________________________________________________________
-
-Introduction
-
-   BIND 9.7.3 is the current release of BIND 9.7.
-
-   This document summarizes changes from BIND 9.7.1 to BIND 9.7.3. Please
-   see the CHANGES file in the source code release for a complete list of
-   all changes.
-
-Download
-
-   The latest development version of BIND 9 software can always be found
-   on our web site at http://www.isc.org/downloads/development. There you
-   will find additional information about each release, source code, and
-   some pre-compiled versions for certain operating systems.
-
-Support
-
-   Product support information is available on
-   http://www.isc.org/services/support for paid support options. Free
-   support is provided by our user community via a mailing list.
-   Information on all public email lists is available at
-   https://lists.isc.org/mailman/listinfo.
-
-New Features
-
-9.7.2
-
-     * Zones may be dynamically added and removed with the "rndc addzone"
-       and "rndc delzone" commands. These dynamically added zones are
-       written to a per-view configuration file. Do not rely on the
-       configuration file name nor contents as this will change in a
-       future release. This is an experimental feature at this time.
-     * Added new "filter-aaaa-on-v4" access control list to select which
-       IPv4 clients have AAAA record filtering applied.
-     * A new command "rndc secroots" was added to dump a combined summary
-       of the currently managed keys combined with statically configured
-       trust anchors.
-     * Added support to load new keys into managed zones without signing
-       immediately with "rndc loadkeys". Added support to link keys with
-       "dnssec-keygen -S" and "dnssec-settime -S".
-
-Feature Changes
-
-9.7.2
-
-     * Documentation improvements
-     * ORCHID prefixes were removed from the automatic empty zone list.
-     * Improved handling of GSSAPI security contexts. Specifically, better
-       memory management of cached contexts, limited lifetime of a context
-       to 1 hour, and added a "realm" command to nsupdate to allow
-       selection of a non-default realm name.
-     * The contributed tool "zkt" was updated to version 1.0.
-
-Security Fixes
-
-9.7.2-P3
-
-     * Adding a NO DATA signed negative response to cache failed to clear
-       any matching RRSIG records already in cache. A subsequent lookup of
-       the cached NO DATA entry could crash named (INSIST) when the
-       unexpected RRSIG was also returned with the NO DATA cache entry.
-       [RT #22288] [CVE-2010-3613] [VU#706148]
-     * BIND, acting as a DNSSEC validator, was determining if the NS RRset
-       is insecure based on a value that could mean either that the RRset
-       is actually insecure or that there wasn't a matching key for the
-       RRSIG in the DNSKEY RRset when resuming from validating the DNSKEY
-       RRset. This can happen when in the middle of a DNSKEY algorithm
-       rollover, when two different algorithms were used to sign a zone
-       but only the new set of keys are in the zone DNSKEY RRset. [RT
-       #22309] [CVE-2010-3614] [VU#837744]
-     * When BIND is running as an authoritative server for a zone and
-       receives a query for that zone data, it first checks for
-       allow-query acls in the zone statement, then in that view, then in
-       global options. If none of these exist, it defaults to allowing any
-       query (allow-query {"any"};).
-       With this bug, if the allow-query is not set in the zone statement,
-       it failed to check in view or global options and fell back to the
-       default of allowing any query. This means that queries that the
-       zone owner did not wish to allow were incorrectly allowed. [RT
-       #22418] [CVE-2010-3615] [VU#510208]
-
-9.7.2-P2
-
-     * A flaw where the wrong ACL was applied was fixed. This flaw allowed
-       access to a cache via recursion even though the ACL disallowed it.
-
-9.7.2-P1
-
-     * If BIND, acting as a DNSSEC validating server, has two or more
-       trust anchors configured in named.conf for the same zone (such as
-       example.com) and the response for a record in that zone from the
-       authoritative server includes a bad signature, the validating
-       server will crash while trying to validate that query.
-
-Bug Fixes
-
-9.7.3
-
-     * BIND now builds with threads disabled in versions of NetBSD earlier
-       than 5.0 and with pthreads enabled by default in NetBSD versions
-       5.0 and higher. Also removes support for unproven-pthreads,
-       mit-pthreads and ptl2. [RT #19203]
-     * Added a regression test for fix 2896/RT #21045 ("rndc sign" failed
-       to properly update the zone when adding a DNSKEY for publication
-       only). [RT #21324]
-     * "nsupdate -l" now gives error message if "session.key" file is not
-       found. [RT #21670]
-     * HPUX now correctly defaults to using /dev/poll, which should
-       increase performance. [RT #21919]
-     * If named is running as a threaded application, after an "rndc stop"
-       command has been issued, other inbound TCP requests can cause named
-       to hang and never complete shutdown. [RT #22108]
-     * After an "rndc reconfig", the refresh timer for managed-keys is
-       ignored, resulting in managed-keys not being refreshed until named
-       is restarted. [RT #22296]
-     * An NSEC3PARAM record placed inside a zone which is not properly
-       signed with NSEC3 could cause named to crash, if changed via
-       dynamic update. [RT #22363]
-     * "rndc -h" now includes "loadkeys" option. [RT #22493]
-     * When performing a GSS-TSIG signed dynamic zone update, memory could
-       be leaked. This causes an unclean shutdown and may affect
-       long-running servers. [RT #22573]
-     * A bug in NetBSD and FreeBSD kernels with SO_ACCEPTFILTER enabled
-       allows for a TCP DoS attack. Until there is a kernel fix, ISC is
-       disabling SO_ACCEPTFILTER support in BIND. [RT #22589]
-     * When signing records, named didn't filter out any TTL changes to
-       DNSKEY records. This resulted in an incomplete key set. TTL changes
-       are now dealt with before signing. [RT #22590]
-     * Corrected a defect where a combination of dynamic updates and zone
-       transfers incorrectly locked the in-memory zone database, causing
-       named to freeze. [RT #22614]
-     * Don't run MX checks (check-mx) when the MX record points to ".".
-       [RT #22645]
-     * DST key reference counts can now be incremented via dst_key_attach.
-       [RT #22672]
-     * The IN6_IS_ADDR_LINKLOCAL and IN6_IS_ADDR_SITELOCAL macros in win32
-       were updated/corrected per current Windows OS. [RT #22724]
-     * "dnssec-settime -S" no longer tests prepublication interval
-       validity when the interval is set to 0. [RT #22761]
-     * isc_mutex_init_errcheck() in phtreads/mutex.c failed to destroy
-       attr. [RT #22766]
-     * The Kerberos realm was being truncated when being pulled from the
-       the host prinicipal, make krb5-self updates fail. [RT #22770]
-     * named failed to preserve the case of domain names in RDATA which is
-       not compressible when writing master files. [RT #22863]
-     * The man page for dnssec-keyfromlabel incorrectly had "-U" rather
-       than the correct option "-I". [RT #22887]
-     * The "rndc" command usage statement was missing the "-b" option. [RT
-       #22937]
-     * There was a bug in how the clients-per-query code worked with some
-       query patterns. This could result, in rare circumstances, in having
-       all the client query slots filled with queries for the same DNS
-       label, essentially ignoring the max-clients-per-query setting. [RT
-       #22972]
-     * The secure zone update feature in named is based on the zone being
-       signed and configured for dynamic updates. A bug in the ACL
-       processing for "allow-update { none; };" resulted in a zone that is
-       supposed to be static being treated as a dynamic zone. Thus, name
-       would try to sign/re-sign that zone erroneously. [RT #23120]
-
-9.7.2-P3
-
-     * Microsoft changed the behavior of sockets between NT/XP based
-       stacks vs Vista/windows7 stacks. Server 2003/2008 have the older
-       behavior, 2008r2 has the new behavior. With the change, different
-       error results are possible, so ISC adapted BIND to handle the new
-       error results. This resolves an issue where sockets would shut down
-       on Windows servers causing named to stop responding to queries. [RT
-       #21906]
-     * Windows has non-POSIX compliant behavior in its rename() and
-       unlink() calls. This caused journal compaction to fail on Windows
-       BIND servers with the log error: "dns_journal_compact failed:
-       failure". [RT #22434]
-
-9.7.2-P1
-
-     * A bug, introduced in BIND 9.7.2, caused named to fail to start if a
-       master zone file was unreadable or missing. This has been corrected
-       in 9.7.2-P1.
-     * BIND previously accepted answers from authoritative servers that
-       did not provide a "proper" response, such as not setting AA bit.
-       BIND was changed to be more strict in what it accepted but this
-       caused operational issues. This new strictness has been backed out
-       in 9.7.2-P1.
-
-9.7.2
-
-     * Removed a warning message when running BIND 9 under Windows for
-       when a TCP connection was aborted. This is a common occurrence and
-       the warning was extraneous.
-     * Worked around a race condition in the cache database memory
-       handling. Without this fix a DNS cache DB or ADB could incorrectly
-       stay in an over memory state, effectively refusing further caching,
-       which subsequently made a BIND 9 caching server unworkable.
-     * Partially disabled change 2864 because it would cause infinite
-       attempts of RRSIG queries.
-     * BIND did not properly handle non-cacheable negative responses from
-       insecure zones. This caused several non-protocol-compliant zones to
-       become unresolvable. BIND is now more accepting of responses it
-       receives from less strict servers.
-
-Known issues in this release
-
-     * "make test" will fail on OSX and possibly other operating systems.
-       The failure occurs in a new test to check for allow-query ACLs. The
-       failure is caused because the source address is not specified on
-       the dig commands issued in the test.
-       If running "make test" is part of your usual acceptance process,
-       please edit the file bin/tests/system/allow_query/test.sh and add
-       -b 10.53.0.2
-       to the DIGOPTS line.
-
-Thank You
-
-   Thank you to everyone who assisted us in making this release possible.
-   If you would like to contribute to ISC to assist us in continuing to
-   make quality open source software, please visit our donations page at
-   http://www.isc.org/supportisc.
@@ -0,0 +1,354 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!--
+ - Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ -
+ - Permission to use, copy, modify, and/or distribute this software for any
+ - purpose with or without fee is hereby granted, provided that the above
+ - copyright notice and this permission notice appear in all copies.
+ -
+ - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ - PERFORMANCE OF THIS SOFTWARE.
+-->
+
+<!-- $Id: RELEASE-NOTES-BIND-9.7.4.html,v 1.1.2.8 2011/07/23 23:46:45 tbox Exp $ -->
+
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title></title><link rel="stylesheet" href="release-notes.css" type="text/css" /><meta name="generator" content="DocBook XSL Stylesheets V1.71.1" /></head><body><div class="article" lang="en" xml:lang="en"><div class="titlepage"><hr /></div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3359852"></a>Introduction</h2></div></div></div>
+    
+    <p>
+			BIND 9.7.4 is the current production release of BIND 9.7.
+		</p>
+    <p>
+		This document summarizes changes from BIND 9.7.3 to BIND 9.7.4.
+		Please see the CHANGES file in the source code release for a
+		complete list of all changes.
+		</p>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2546702"></a>Download</h2></div></div></div>
+    
+    <p>
+                       The latest version of BIND 9 software can always be found
+                       on our web site at
+      <a href="http://www.isc.org/downloads/all" target="_top">http://www.isc.org/downloads/all</a>.
+               There you will find additional information about each release,
+               source code, and some pre-compiled versions for certain operating
+               systems.
+		</p>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2546736"></a>Support</h2></div></div></div>
+    
+    <p>Product support information is available on
+      <a href="http://www.isc.org/services/support" target="_top">http://www.isc.org/services/support</a>
+      for paid support options.  Free support is provided by our user
+ 			community via a mailing list.  Information on all public email
+ 			lists is available at
+      <a href="https://lists.isc.org/mailman/listinfo" target="_top">https://lists.isc.org/mailman/listinfo</a>.
+    </p>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3358885"></a>New Features</h2></div></div></div>
+    
+		<div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3358925"></a>9.7.4</h3></div></div></div>
+			
+	    <div class="itemizedlist"><ul type="disc"><li>
+A new test has been added to check the apex NSEC3 records after DNSKEY
+records have been added via dynamic update. [RT #23229]
+</li><li>
+Added a tool able to generate malformed packets to allow testing
+of how named handles them.
+[RT #24096]
+</li></ul></div>
+		</div>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3358973"></a>Security Fixes</h2></div></div></div>
+    
+		<div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3358993"></a>9.7.4</h3></div></div></div>
+			
+			<div class="itemizedlist"><ul type="disc"><li>
+named, set up to be a caching resolver, is vulnerable to a
+user querying a domain with very large resource record sets (RRSets)
+when trying to negatively cache the response. Due to an off-by-one
+error, caching the response could cause named to crash. [RT #24650]
+[CVE-2011-1910]
+</li><li>
+Change #2912 (see CHANGES) exposed a latent bug in the DNS message
+processing code that could allow certain UPDATE requests to crash named.
+[RT #24777] [CVE-2011-2464]
+</li></ul></div>
+		</div>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3359041"></a>Feature Changes</h2></div></div></div>
+    
+		<div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3359054"></a>9.7.4</h3></div></div></div>
+			
+	    <div class="itemizedlist"><ul type="disc"><li>
+Merged in the NetBSD ATF test framework (currently
+version 0.12) for development of future unit tests.
+Use configure --with-atf to build ATF internally
+or configure --with-atf=prefix to use an external
+copy. [RT #23209]
+</li><li>
+Added more verbose error reporting from DLZ LDAP. [RT #23402]
+</li><li>
+Replaced compile time constant with STDTIME_ON_32BITS.
+[RT #23587]
+</li></ul></div>
+		</div>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3359075"></a>Bug Fixes</h2></div></div></div>
+    
+		<div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id3359081"></a>9.7.4</h3></div></div></div>
+			
+	    <div class="itemizedlist"><ul type="disc"><li>
+<p>
+During RFC5011 processing some journal write errors were not detected.
+This could lead to managed-keys changes being committed but not 
+recorded in the journal files, causing potential inconsistencies  
+during later processing.  [RT #20256]
+</p>
+<p>
+A potential NULL pointer deference in the DNS64 code could cause 
+named to terminate unexpectedly. [RT #20256]
+</p>
+<p>
+A state variable relating to DNSSEC could fail to be set during 
+some infrequently-executed code paths, allowing it to be used whilst
+in an unitialized state during cache updates, with unpredictable results.
+[RT #20256]
+</p>
+<p>
+A potential NULL pointer deference in DNSSEC signing code could 
+cause named to terminate unexpectedly  [RT #20256]
+</p>
+<p>
+Several cosmetic code changes were made to silence warnings
+generated by a static code analysis tool. [RT #20256]
+</p>
+</li><li>
+When using the -x (sign with only KSK) option on dnssec-signzone,
+it could incorrectly count the number of ZSKs in the zone. (And in 9.9.0,
+some code cleanup and improved warning messages). [RT #20852]
+</li><li>
+When using _builtin in named.conf, named.conf changes were not found
+when reloading the config file. Now checks _builtin zone arguments
+to see if the zone is re-usable or not. [RT #21914]
+</li><li>
+After an "rndc reconfig", the refresh timer for managed-keys is
+ignored, resulting in managed-keys not being refreshed until named is
+restarted. [RT #22296]
+</li><li>
+Running dnssec-settime -f on an old-style key will
+now force the key to be rewritten to the new key format even if no
+other change has been specified, using "-P now -A now"
+as default values. [RT #22474]
+</li><li>
+After an external code review, a code cleanup was done. [RT #22521]
+</li><li>
+Cause named to terminate at startup or rndc reconfig
+reload to fail, if a log file specified in the
+conf file isn't a plain file. (RT #22771]
+</li><li>
+named now forces the ADB cache time for glue related data to zero  
+instead of relying on TTL.  This corrects problematic behavior in cases  
+where a server was authoritative for the A record of a nameserver for a  
+delegated zone and was queried to recursively resolve records within  
+that zone.  [RT #22842]
+</li><li>
+When a validating resolver got a NODATA response for DNSKEY, it was
+not caching the NODATA. Fixed and test added. [RT #22908]
+</li><li>
+Fixed a bug in which zone keys that were published
+and but not immediately activated, automatic signing could fail to trigger.
+[RT #22911]
+</li><li>
+Fixed a possible deadlock due to zone re-signing. [RT #22964]
+</li><li>
+Fixed precedence order bug with NS and DNAME records if both are present.
+(Also fixed timing of autosign test in 9.7+) [RT #23035]
+</li><li>
+When a DNSSEC signed dynamic zone's signatures need to be refreshed,
+named would first delete the old signatures in the zone. If a private
+key of the same algorithm isn't available to named, the signing would
+fail but the old signatures would already be deleted. named now checks
+if it can access the private key before deleting the old signatures and 
+leaves the old signature if no private key is found. [RT #23136]
+</li><li>
+When using auto-dnssec and updating DNSKEY records, named did correctly
+update the zone. [RT #23232]
+</li><li>
+When using "auto-dnssec maintain" and rolling to a new key, a
+private-type record (only used internally by named) could be created
+and not marked as complete. [RT #23253]
+</li><li>
+If a slave initiates a TSIG signed AXFR from the master and the master
+fails to correctly TSIG sign the final message, the slave would be left
+with the zone in an unclean state. named detected this error too late
+and named would crash with an INSIST. The order dependancy has been
+fixed. [RT #23254]
+</li><li>
+Fixed last autosign test report. [RT #23256]
+</li><li>
+named didn't save gid at startup and later assumed gid 0.
+named now saves/restores the gid when creating creating
+named.pid at startup. [RT #23290]
+</li><li>
+If the server has an IPv6 address but does not have IPv6 connectivity
+to the internet, dig +trace could fail attempting to use IPv6
+addresses. [RT #23297]
+</li><li>
+If named is configured with managed zones, the managed key maint timer
+can exercise a race condition that can crash the server.
+[RT #23303]
+</li><li>
+Changing TTL did not cause dnssec-signzone to generate new signatures.
+[RT #23330]
+</li><li>
+Have the validating resolver use RRSIG original TTL to compute
+validated RRset and RRSIG TTL. [RT #23332]
+</li><li>
+In "make test" bin/tests/resolver, hold the socket manager lock
+while freeing the socket.
+[RT #23333]
+</li><li>
+If named encountered a CNAME instead of a DS record when walking
+the chain of trust down from the trust anchor, it incorrectly stopped
+validating. [RT #23338]
+</li><li>
+RRSIG records could have time stamps too far in the future.
+[RT #23356]
+</li><li>
+named stores cached data in an in-memory database and keeps track of
+how recently the data is used with a heap. The heap is stored within the
+cache's memory space. Under a sustained high query load and with a small
+cache size, this could lead to the heap exhausting the cache space. This
+would result in cache misses and SERVFAILs, with named never releasing
+the cache memory the heap used up and never recovering.
+
+This fix removes the heap into its own memory space, preventing the heap
+from exhausting the cache space and allowing named to recover gracefully
+when the high query load abates. [RT #23371]
+</li><li>
+If "dnssec-lookaside auto" is turned on, named pulled in all keys
+defined in bind.keys, including the root key.
+named now only loads the desired keys.
+[RT #23372]
+</li><li>
+Fully separated key management on a per view basis. [RT #23419]
+</li><li>
+If running on a powerpc CPU and with atomic operations enabled,
+named could lock up. Added sync instructions to the end of atomic
+operations. [RT #23469]
+</li><li>
+If OpenSSL was built without engine support, named would have
+compile errors and fail to build.
+[RT #23473]
+</li><li>
+"rndc secroots" would abort on the first error
+and so could miss remaining views. [RT #23488]
+</li><li>
+Handle isc_event_allocate failures in t_tasks test.
+[RT #23572]
+</li><li>
+ixfr-from-differences {master|slave};
+failed to select the master/slave zones, resulting in on diff/journal
+file being created.
+[RT #23580]
+</li><li>
+If a DNAME substitution failed, named returned NOERROR. The correct
+response should be YXDOMAIN.
+[RT #23591]
+</li><li>
+dns_dnssec_findzonekeys{2} used a inconsistant
+timestamp when determining which keys are active. This could result in
+some RRsets not being signed/re-signed.
+[RT #23642]
+</li><li>
+Remove bin/tests/system/logfileconfig/ns1/named.conf and
+add setup.sh in order to resolve changing named.conf issue. [RT #23687]
+</li><li>
+NOTIFY messages were not being sent when generating
+a NSEC3 chain incrementally. [RT #23702]
+</li><li>
+Zones using automatic key maintenance could fail to check the key
+repository for updates. named now checks once per hour and the
+automatic check bug has been fixed. [RT #23744]
+</li><li>
+Signatures for records at the zone apex could go
+stale due to an incorrect timer setting. [RT #23769]
+</li><li>
+The autosign tests attempted to open ports within reserved ranges. Test
+now avoids those ports.
+[RT #23957]
+</li><li>
+named, acting as authoritative server for DLZ zones, was not correctly
+setting the authoritative (AA) bit.
+[RT #24146]
+</li><li>
+Clean up some cross-compiling issues and added two undocumented
+configure options, --with-gost and --with-rlimtype, to allow over-riding
+default settings (gost=no and rlimtype="long int") when cross-compiling.
+[RT #24367]
+</li><li>
+When trying sign with NSEC3, if dnssec-signzone couldn't find the
+KSK, it would give an incorrect error "NSEC3 iterations too big for
+weakest DNSKEY strength" rather than the correct "failed to find
+keys at the zone apex: not found" [RT #24369]
+</li><li>
+Improved consistency checks for dnssec-enable and
+dnssec-validation, added test cases to the
+checkconf system test. [RT #24398]
+</li><li>
+RT #23136 fixed a problem where named would delete old signatures even
+when the private key wasn't available to re-sign the zone, resulting in
+a zone with missing signatures. This fix (CHANGES 3114) did not
+completely fix all issues. [RT #24577]
+</li><li>
+nsupdate could dump core on shutdown when using SIG(0) keys. [RT #24604]
+</li><li>
+Named could fail to validate zones list in a DLV that validated insecure
+without using DLV and had DS records in the parent zone. [RT #24631]
+</li><li>
+A bug in FreeBSD kernels causes IPv6 UDP responses greater than
+1280 bytes to not fragment as they should. Until there is a kernel
+fix, named will work around this by setting IPV6_USE_MIN_MTU on a
+per packet basis. [RT #24950]
+</li><li>
+To avoid excessive startup time for configurations with large numbers
+of zones, an environment variable, BIND9_ZONE_TASKS_HINTS, may now
+be set prior to starting named.  Divide your number of zones by 200
+to find the recommended setting for this environment variable (i.e.,
+if you have 200000 zones, set BIND9_ZONE_TASKS_HINTS to 1000 before
+starting named). [RT #25084]
+</li></ul></div>
+		</div>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3359538"></a>Known issues in this release</h2></div></div></div>
+    
+    <div class="itemizedlist"><ul type="disc"><li>
+None
+      </li></ul></div>
+  </div>
+
+  <div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id3359961"></a>Thank You</h2></div></div></div>
+    
+    <p>
+      Thank you to everyone who assisted us in making this release possible.
+      If you would like to contribute to ISC to assist us in continuing to make
+      quality open source software, please visit our donations page at
+      <a href="http://www.isc.org/supportisc" target="_top">http://www.isc.org/supportisc</a>.
+    </p>
+  </div>
+</div></body></html>
@@ -0,0 +1,229 @@
+     __________________________________________________________________
+
+Introduction
+
+   BIND 9.7.4 is the current production release of BIND 9.7.
+
+   This document summarizes changes from BIND 9.7.3 to BIND 9.7.4. Please
+   see the CHANGES file in the source code release for a complete list of
+   all changes.
+
+Download
+
+   The latest version of BIND 9 software can always be found on our web
+   site at http://www.isc.org/downloads/all. There you will find
+   additional information about each release, source code, and some
+   pre-compiled versions for certain operating systems.
+
+Support
+
+   Product support information is available on
+   http://www.isc.org/services/support for paid support options. Free
+   support is provided by our user community via a mailing list.
+   Information on all public email lists is available at
+   https://lists.isc.org/mailman/listinfo.
+
+New Features
+
+9.7.4
+
+     * A new test has been added to check the apex NSEC3 records after
+       DNSKEY records have been added via dynamic update. [RT #23229]
+     * Added a tool able to generate malformed packets to allow testing of
+       how named handles them. [RT #24096]
+
+Security Fixes
+
+9.7.4
+
+     * named, set up to be a caching resolver, is vulnerable to a user
+       querying a domain with very large resource record sets (RRSets)
+       when trying to negatively cache the response. Due to an off-by-one
+       error, caching the response could cause named to crash. [RT #24650]
+       [CVE-2011-1910]
+     * Change #2912 (see CHANGES) exposed a latent bug in the DNS message
+       processing code that could allow certain UPDATE requests to crash
+       named. [RT #24777] [CVE-2011-2464]
+
+Feature Changes
+
+9.7.4
+
+     * Merged in the NetBSD ATF test framework (currently version 0.12)
+       for development of future unit tests. Use configure --with-atf to
+       build ATF internally or configure --with-atf=prefix to use an
+       external copy. [RT #23209]
+     * Added more verbose error reporting from DLZ LDAP. [RT #23402]
+     * Replaced compile time constant with STDTIME_ON_32BITS. [RT #23587]
+
+Bug Fixes
+
+9.7.4
+
+     * During RFC5011 processing some journal write errors were not
+       detected. This could lead to managed-keys changes being committed
+       but not recorded in the journal files, causing potential
+       inconsistencies during later processing. [RT #20256]
+       A potential NULL pointer deference in the DNS64 code could cause
+       named to terminate unexpectedly. [RT #20256]
+       A state variable relating to DNSSEC could fail to be set during
+       some infrequently-executed code paths, allowing it to be used
+       whilst in an unitialized state during cache updates, with
+       unpredictable results. [RT #20256]
+       A potential NULL pointer deference in DNSSEC signing code could
+       cause named to terminate unexpectedly [RT #20256]
+       Several cosmetic code changes were made to silence warnings
+       generated by a static code analysis tool. [RT #20256]
+     * When using the -x (sign with only KSK) option on dnssec-signzone,
+       it could incorrectly count the number of ZSKs in the zone. (And in
+       9.9.0, some code cleanup and improved warning messages). [RT
+       #20852]
+     * When using _builtin in named.conf, named.conf changes were not
+       found when reloading the config file. Now checks _builtin zone
+       arguments to see if the zone is re-usable or not. [RT #21914]
+     * After an "rndc reconfig", the refresh timer for managed-keys is
+       ignored, resulting in managed-keys not being refreshed until named
+       is restarted. [RT #22296]
+     * Running dnssec-settime -f on an old-style key will now force the
+       key to be rewritten to the new key format even if no other change
+       has been specified, using "-P now -A now" as default values. [RT
+       #22474]
+     * After an external code review, a code cleanup was done. [RT #22521]
+     * Cause named to terminate at startup or rndc reconfig reload to
+       fail, if a log file specified in the conf file isn't a plain file.
+       (RT #22771]
+     * named now forces the ADB cache time for glue related data to zero
+       instead of relying on TTL. This corrects problematic behavior in
+       cases where a server was authoritative for the A record of a
+       nameserver for a delegated zone and was queried to recursively
+       resolve records within that zone. [RT #22842]
+     * When a validating resolver got a NODATA response for DNSKEY, it was
+       not caching the NODATA. Fixed and test added. [RT #22908]
+     * Fixed a bug in which zone keys that were published and but not
+       immediately activated, automatic signing could fail to trigger. [RT
+       #22911]
+     * Fixed a possible deadlock due to zone re-signing. [RT #22964]
+     * Fixed precedence order bug with NS and DNAME records if both are
+       present. (Also fixed timing of autosign test in 9.7+) [RT #23035]
+     * When a DNSSEC signed dynamic zone's signatures need to be
+       refreshed, named would first delete the old signatures in the zone.
+       If a private key of the same algorithm isn't available to named,
+       the signing would fail but the old signatures would already be
+       deleted. named now checks if it can access the private key before
+       deleting the old signatures and leaves the old signature if no
+       private key is found. [RT #23136]
+     * When using auto-dnssec and updating DNSKEY records, named did
+       correctly update the zone. [RT #23232]
+     * When using "auto-dnssec maintain" and rolling to a new key, a
+       private-type record (only used internally by named) could be
+       created and not marked as complete. [RT #23253]
+     * If a slave initiates a TSIG signed AXFR from the master and the
+       master fails to correctly TSIG sign the final message, the slave
+       would be left with the zone in an unclean state. named detected
+       this error too late and named would crash with an INSIST. The order
+       dependancy has been fixed. [RT #23254]
+     * Fixed last autosign test report. [RT #23256]
+     * named didn't save gid at startup and later assumed gid 0. named now
+       saves/restores the gid when creating creating named.pid at startup.
+       [RT #23290]
+     * If the server has an IPv6 address but does not have IPv6
+       connectivity to the internet, dig +trace could fail attempting to
+       use IPv6 addresses. [RT #23297]
+     * If named is configured with managed zones, the managed key maint
+       timer can exercise a race condition that can crash the server. [RT
+       #23303]
+     * Changing TTL did not cause dnssec-signzone to generate new
+       signatures. [RT #23330]
+     * Have the validating resolver use RRSIG original TTL to compute
+       validated RRset and RRSIG TTL. [RT #23332]
+     * In "make test" bin/tests/resolver, hold the socket manager lock
+       while freeing the socket. [RT #23333]
+     * If named encountered a CNAME instead of a DS record when walking
+       the chain of trust down from the trust anchor, it incorrectly
+       stopped validating. [RT #23338]
+     * RRSIG records could have time stamps too far in the future. [RT
+       #23356]
+     * named stores cached data in an in-memory database and keeps track
+       of how recently the data is used with a heap. The heap is stored
+       within the cache's memory space. Under a sustained high query load
+       and with a small cache size, this could lead to the heap exhausting
+       the cache space. This would result in cache misses and SERVFAILs,
+       with named never releasing the cache memory the heap used up and
+       never recovering. This fix removes the heap into its own memory
+       space, preventing the heap from exhausting the cache space and
+       allowing named to recover gracefully when the high query load
+       abates. [RT #23371]
+     * If "dnssec-lookaside auto" is turned on, named pulled in all keys
+       defined in bind.keys, including the root key. named now only loads
+       the desired keys. [RT #23372]
+     * Fully separated key management on a per view basis. [RT #23419]
+     * If running on a powerpc CPU and with atomic operations enabled,
+       named could lock up. Added sync instructions to the end of atomic
+       operations. [RT #23469]
+     * If OpenSSL was built without engine support, named would have
+       compile errors and fail to build. [RT #23473]
+     * "rndc secroots" would abort on the first error and so could miss
+       remaining views. [RT #23488]
+     * Handle isc_event_allocate failures in t_tasks test. [RT #23572]
+     * ixfr-from-differences {master|slave}; failed to select the
+       master/slave zones, resulting in on diff/journal file being
+       created. [RT #23580]
+     * If a DNAME substitution failed, named returned NOERROR. The correct
+       response should be YXDOMAIN. [RT #23591]
+     * dns_dnssec_findzonekeys{2} used a inconsistant timestamp when
+       determining which keys are active. This could result in some RRsets
+       not being signed/re-signed. [RT #23642]
+     * Remove bin/tests/system/logfileconfig/ns1/named.conf and add
+       setup.sh in order to resolve changing named.conf issue. [RT #23687]
+     * NOTIFY messages were not being sent when generating a NSEC3 chain
+       incrementally. [RT #23702]
+     * Zones using automatic key maintenance could fail to check the key
+       repository for updates. named now checks once per hour and the
+       automatic check bug has been fixed. [RT #23744]
+     * Signatures for records at the zone apex could go stale due to an
+       incorrect timer setting. [RT #23769]
+     * The autosign tests attempted to open ports within reserved ranges.
+       Test now avoids those ports. [RT #23957]
+     * named, acting as authoritative server for DLZ zones, was not
+       correctly setting the authoritative (AA) bit. [RT #24146]
+     * Clean up some cross-compiling issues and added two undocumented
+       configure options, --with-gost and --with-rlimtype, to allow
+       over-riding default settings (gost=no and rlimtype="long int") when
+       cross-compiling. [RT #24367]
+     * When trying sign with NSEC3, if dnssec-signzone couldn't find the
+       KSK, it would give an incorrect error "NSEC3 iterations too big for
+       weakest DNSKEY strength" rather than the correct "failed to find
+       keys at the zone apex: not found" [RT #24369]
+     * Improved consistency checks for dnssec-enable and
+       dnssec-validation, added test cases to the checkconf system test.
+       [RT #24398]
+     * RT #23136 fixed a problem where named would delete old signatures
+       even when the private key wasn't available to re-sign the zone,
+       resulting in a zone with missing signatures. This fix (CHANGES
+       3114) did not completely fix all issues. [RT #24577]
+     * nsupdate could dump core on shutdown when using SIG(0) keys. [RT
+       #24604]
+     * Named could fail to validate zones list in a DLV that validated
+       insecure without using DLV and had DS records in the parent zone.
+       [RT #24631]
+     * A bug in FreeBSD kernels causes IPv6 UDP responses greater than
+       1280 bytes to not fragment as they should. Until there is a kernel
+       fix, named will work around this by setting IPV6_USE_MIN_MTU on a
+       per packet basis. [RT #24950]
+     * To avoid excessive startup time for configurations with large
+       numbers of zones, an environment variable, BIND9_ZONE_TASKS_HINTS,
+       may now be set prior to starting named. Divide your number of zones
+       by 200 to find the recommended setting for this environment
+       variable (i.e., if you have 200000 zones, set
+       BIND9_ZONE_TASKS_HINTS to 1000 before starting named). [RT #25084]
+
+Known issues in this release
+
+     * None
+
+Thank You
+
+   Thank you to everyone who assisted us in making this release possible.
+   If you would like to contribute to ISC to assist us in continuing to
+   make quality open source software, please visit our donations page at
+   http://www.isc.org/supportisc.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named-checkconf.c,v 1.51.4.3 2010/09/07 01:52:22 marka Exp $ */
+/* $Id: named-checkconf.c,v 1.51.4.5 2011/03/12 04:58:23 tbox Exp $ */

 /*! \file */

@@ -190,7 +190,7 @@ configure_zone(const char *vclass, const char *view,
 		if (obj != NULL)
 			maps[i++] = obj;
 	}
-	maps[i++] = NULL;
+	maps[i] = NULL;

 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: ddns-confgen.c,v 1.9 2009/09/29 15:06:05 fdupont Exp $ */
+/* $Id: ddns-confgen.c,v 1.9.66.2 2011/03/12 04:58:23 tbox Exp $ */

 /*! \file */

@@ -160,6 +160,7 @@ main(int argc, char **argv) {

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
+	POST(argv);

 	if (self_domain != NULL && zone != NULL)
 		usage(1);	/* -s and -z cannot coexist */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rndc-confgen.c,v 1.5 2009/09/29 15:06:05 fdupont Exp $ */
+/* $Id: rndc-confgen.c,v 1.5.66.2 2011/03/12 04:58:23 tbox Exp $ */

 /*! \file */

@@ -200,6 +200,7 @@ main(int argc, char **argv) {

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
+	POST(argv);

 	if (argc > 0)
 		usage(1);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dig.c,v 1.233.62.3 2010/05/13 00:42:26 marka Exp $ */
+/* $Id: dig.c,v 1.233.62.6 2011/03/11 07:11:51 marka Exp $ */

 /*! \file */

@@ -44,8 +44,6 @@
 #include <dns/result.h>
 #include <dns/tsig.h>

-#include <bind9/getaddresses.h>
-
 #include <dig/dig.h>

 #define ADD_STRING(b, s) { 				\
@@ -474,8 +472,6 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	if (!query->lookup->comments)
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;

-	result = ISC_R_SUCCESS;
-
 	result = isc_buffer_allocate(mctx, &buf, len);
 	check_result(result, "isc_buffer_allocate");

@@ -1428,30 +1424,6 @@ preparse_args(int argc, char **argv) {
 	}
 }

-static void
-getaddresses(dig_lookup_t *lookup, const char *host) {
-	isc_result_t result;
-	isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
-	isc_netaddr_t netaddr;
-	int count, i;
-	dig_server_t *srv;
-	char tmp[ISC_NETADDR_FORMATSIZE];
-
-	result = bind9_getaddresses(host, 0, sockaddrs,
-				    DIG_MAX_ADDRESSES, &count);
-	if (result != ISC_R_SUCCESS)
-	fatal("couldn't get address for '%s': %s",
-	      host, isc_result_totext(result));
-
-	for (i = 0; i < count; i++) {
-		isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
-		isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
-		srv = make_server(tmp, host);
-		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
-	}
-	addresscount = count;
-}
-
 static void
 parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	   int argc, char **argv) {
@@ -1546,7 +1518,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		if (strncmp(rv[0], "%", 1) == 0)
 			break;
 		if (strncmp(rv[0], "@", 1) == 0) {
-			getaddresses(lookup, &rv[0][1]);
+			addresscount = getaddresses(lookup, &rv[0][1]);
 		} else if (rv[0][0] == '+') {
 			plus_option(&rv[0][1], is_batchfile,
 				    lookup);
@@ -1583,7 +1555,6 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 						(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
 					    rdtype == dns_rdatatype_ixfr) {
-						result = DNS_R_UNKNOWN;
 						fprintf(stderr, ";; Warning, "
 							"ixfr requires a "
 							"serial number\n");
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dighost.c,v 1.328.22.6 2010/12/09 01:05:27 marka Exp $ */
+/* $Id: dighost.c,v 1.328.22.14 2011/12/01 01:03:07 marka Exp $ */

 /*! \file
 *  \note
@@ -66,6 +66,7 @@
 #include <dns/tsig.h>

 #include <dst/dst.h>
+#include <dst/result.h>

 #include <isc/app.h>
 #include <isc/base64.h>
@@ -81,6 +82,7 @@
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
+#include <isc/serial.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/timer.h>
@@ -566,10 +568,8 @@ make_server(const char *servname, const char *userarg) {
 	if (srv == NULL)
 		fatal("memory allocation failure in %s:%d",
 		      __FILE__, __LINE__);
-	strncpy(srv->servername, servname, MXNAME);
-	strncpy(srv->userarg, userarg, MXNAME);
-	srv->servername[MXNAME-1] = 0;
-	srv->userarg[MXNAME-1] = 0;
+	strlcpy(srv->servername, servname, MXNAME);
+	strlcpy(srv->userarg, userarg, MXNAME);
 	ISC_LINK_INIT(srv, link);
 	return (srv);
 }
@@ -744,7 +744,7 @@ make_empty_lookup(void) {
 	looknew->xfr_q = NULL;
 	looknew->current_query = NULL;
 	looknew->doing_xfr = ISC_FALSE;
-	looknew->ixfr_serial = ISC_FALSE;
+	looknew->ixfr_serial = 0;
 	looknew->trace = ISC_FALSE;
 	looknew->trace_root = ISC_FALSE;
 	looknew->identify = ISC_FALSE;
@@ -927,6 +927,11 @@ setup_text_key(void) {

 	secretsize = isc_buffer_usedlength(&secretbuf);

+	if (hmacname == NULL) {
+		result = DST_R_UNSUPPORTEDALG;
+		goto failure;
+	}
+
 	result = dns_name_fromtext(&keyname, namebuf, dns_rootname, 0, namebuf);
 	if (result != ISC_R_SUCCESS)
 		goto failure;
@@ -1767,8 +1772,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 			dns_rdata_freestruct(&ns);

 			/* Initialize lookup if we've not yet */
-			debug("found NS %d %s", numLookups, namestr);
-			numLookups++;
+			debug("found NS %s", namestr);
 			if (!success) {
 				success = ISC_TRUE;
 				lookup_counter++;
@@ -1790,9 +1794,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 				domain = dns_fixedname_name(&lookup->fdomain);
 				dns_name_copy(name, domain, NULL);
 			}
-			srv = make_server(namestr, namestr);
-			debug("adding server %s", srv->servername);
-			ISC_LIST_APPEND(lookup->my_server_list, srv, link);
+			debug("adding server %s", namestr);
+			numLookups += getaddresses(lookup, namestr);
 			dns_rdata_reset(&rdata);
 		}
 	}
@@ -1808,17 +1811,25 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 	if (numLookups > 1) {
 		isc_uint32_t i, j;
 		dig_serverlist_t my_server_list;
+		dig_server_t *next;

 		ISC_LIST_INIT(my_server_list);

-		for (i = numLookups; i > 0; i--) {
+		i = numLookups;
+		for (srv = ISC_LIST_HEAD(lookup->my_server_list);
+		     srv != NULL;
+		     srv = ISC_LIST_HEAD(lookup->my_server_list)) {
+			INSIST(i > 0);
 			isc_random_get(&j);
 			j %= i;
-			srv = ISC_LIST_HEAD(lookup->my_server_list);
-			while (j-- > 0)
-				srv = ISC_LIST_NEXT(srv, link);
+			next = ISC_LIST_NEXT(srv, link);
+			while (j-- > 0 && next != NULL) {
+				srv = next;
+				next = ISC_LIST_NEXT(srv, link);
+			}
 			ISC_LIST_DEQUEUE(lookup->my_server_list, srv, link);
 			ISC_LIST_APPEND(my_server_list, srv, link);
+			i--;
 		}
 		ISC_LIST_APPENDLIST(lookup->my_server_list,
 				    my_server_list, link);
@@ -1834,12 +1845,10 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 * Return ISC_TRUE iff there was another searchlist entry.
 */
 static isc_boolean_t
-next_origin(dns_message_t *msg, dig_query_t *query) {
+next_origin(dig_query_t *query) {
 	dig_lookup_t *lookup;
 	dig_searchlist_t *search;

-	UNUSED(msg);
-
 	INSIST(!free_now);

 	debug("next_origin()");
@@ -2861,8 +2870,10 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 	dns_rdataset_t *rdataset = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_soa_t soa;
-	isc_uint32_t serial;
+	isc_uint32_t ixfr_serial = query->lookup->ixfr_serial, serial;
 	isc_result_t result;
+	isc_boolean_t ixfr = query->lookup->rdtype == dns_rdatatype_ixfr;
+	isc_boolean_t axfr = query->lookup->rdtype == dns_rdatatype_axfr;

 	debug("check_for_more_data()");

@@ -2912,6 +2923,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 					query->second_rr_rcvd = ISC_TRUE;
 					query->second_rr_serial = 0;
 					debug("got the second rr as nonsoa");
+					axfr = ISC_TRUE;
 					goto next_rdata;
 				}

@@ -2921,6 +2933,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 				 */
 				if (rdata.type != dns_rdatatype_soa)
 					goto next_rdata;
+
 				/* Now we have an SOA.  Work with it. */
 				debug("got an SOA");
 				result = dns_rdata_tostruct(&rdata, &soa, NULL);
@@ -2930,15 +2943,17 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 				if (!query->first_soa_rcvd) {
 					query->first_soa_rcvd = ISC_TRUE;
 					query->first_rr_serial = serial;
-					debug("this is the first %d",
-					       query->lookup->ixfr_serial);
-					if (query->lookup->ixfr_serial >=
-					    serial)
+					debug("this is the first serial %u",
+					      serial);
+					if (ixfr && isc_serial_ge(ixfr_serial,
+								  serial)) {
+						debug("got up to date "
+						      "response");
 						goto doexit;
+					}
 					goto next_rdata;
 				}
-				if (query->lookup->rdtype ==
-				    dns_rdatatype_axfr) {
+				if (axfr) {
 					debug("doing axfr, got second SOA");
 					goto doexit;
 				}
@@ -2948,22 +2963,12 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 						      "empty zone");
 						goto doexit;
 					}
-					debug("this is the second %d",
-					       query->lookup->ixfr_serial);
+					debug("this is the second serial %u",
+					      serial);
 					query->second_rr_rcvd = ISC_TRUE;
 					query->second_rr_serial = serial;
 					goto next_rdata;
 				}
-				if (query->second_rr_serial == 0) {
-					/*
-					 * If the second RR was a non-SOA
-					 * record, and we're getting any
-					 * other SOA, then this is an
-					 * AXFR, and we're done.
-					 */
-					debug("done, since axfr");
-					goto doexit;
-				}
 				/*
 				 * If we get to this point, we're doing an
 				 * IXFR and have to start really looking
@@ -2979,7 +2984,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 					debug("done with ixfr");
 					goto doexit;
 				}
-				debug("meaningless soa %d", serial);
+				debug("meaningless soa %u", serial);
 			next_rdata:
 				result = dns_rdataset_next(rdataset);
 			} while (result == ISC_R_SUCCESS);
@@ -3356,7 +3361,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode != dns_rcode_noerror &&
 		    (l->origin != NULL || l->need_search)) {
-			if (!next_origin(msg, query) || showsearch) {
+			if (!next_origin(query) || showsearch) {
 				printmessage(query, msg, ISC_TRUE);
 				received(b->used, &sevent->address, query);
 			}
@@ -3541,6 +3546,31 @@ get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
 	return (ISC_R_SUCCESS);
 }

+int
+getaddresses(dig_lookup_t *lookup, const char *host) {
+	isc_result_t result;
+	isc_sockaddr_t sockaddrs[DIG_MAX_ADDRESSES];
+	isc_netaddr_t netaddr;
+	int count, i;
+	dig_server_t *srv;
+	char tmp[ISC_NETADDR_FORMATSIZE];
+
+	result = bind9_getaddresses(host, 0, sockaddrs,
+				    DIG_MAX_ADDRESSES, &count);
+	if (result != ISC_R_SUCCESS)
+		fatal("couldn't get address for '%s': %s",
+		      host, isc_result_totext(result));
+
+	for (i = 0; i < count; i++) {
+		isc_netaddr_fromsockaddr(&netaddr, &sockaddrs[i]);
+		isc_netaddr_format(&netaddr, tmp, sizeof(tmp));
+		srv = make_server(tmp, host);
+		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
+	}
+
+	return count;
+}
+
 /*%
 * Initiate either a TCP or UDP lookup
 */
@@ -4179,7 +4209,6 @@ opentmpkey(isc_mem_t *mctx, const char *file, char **tempp, FILE **fp) {
 	return (result);
 }

-
 isc_result_t
 get_trusted_key(isc_mem_t *mctx)
 {
@@ -4241,6 +4270,7 @@ get_trusted_key(isc_mem_t *mctx)
 		if (key != NULL)
 			dst_key_free(&key);
 	}
+	fclose(fp);
 	return (ISC_R_SUCCESS);
 }

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: host.c,v 1.120.66.2 2010/10/19 23:46:47 tbox Exp $ */
+/* $Id: host.c,v 1.120.66.5 2011/03/11 07:11:51 marka Exp $ */

 /*! \file */

@@ -521,6 +521,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 		if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
 			printf("%scd", did_flag ? " " : "");
 			did_flag = ISC_TRUE;
+			POST(did_flag);
 		}
 		printf("; QUERY: %u, ANSWER: %u, "
 		       "AUTHORITY: %u, ADDITIONAL: %u\n",
@@ -824,8 +825,8 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	if (isc_commandline_index >= argc)
 		show_usage();

-	strncpy(hostname, argv[isc_commandline_index], sizeof(hostname));
-	hostname[sizeof(hostname)-1]=0;
+	strlcpy(hostname, argv[isc_commandline_index], sizeof(hostname));
+
 	if (argc > isc_commandline_index + 1) {
 		set_nameserver(argv[isc_commandline_index+1]);
 		debug("server is %s", argv[isc_commandline_index+1]);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dig.h,v 1.111 2009/09/29 15:06:06 fdupont Exp $ */
+/* $Id: dig.h,v 1.111.66.2 2011/02/28 01:19:26 tbox Exp $ */

 #ifndef DIG_H
 #define DIG_H
@@ -288,6 +288,9 @@ extern int idnoptions;
 isc_result_t
 get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr);

+int
+getaddresses(dig_lookup_t *lookup, const char *host);
+
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
 	    isc_boolean_t strict);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nslookup.c,v 1.124 2009/10/20 01:04:03 marka Exp $ */
+/* $Id: nslookup.c,v 1.124.40.2 2011/02/21 23:46:37 tbox Exp $ */

 #include <config.h>

@@ -535,12 +535,6 @@ testclass(char *typetext) {
 	}
 }

-static void
-safecpy(char *dest, char *src, int size) {
-	strncpy(dest, src, size);
-	dest[size-1] = 0;
-}
-
 static void
 set_port(const char *value) {
 	isc_uint32_t n;
@@ -571,34 +565,34 @@ setoption(char *opt) {
 		show_settings(ISC_TRUE, ISC_FALSE);
 	} else if (strncasecmp(opt, "class=", 6) == 0) {
 		if (testclass(&opt[6]))
-			safecpy(defclass, &opt[6], sizeof(defclass));
+			strlcpy(defclass, &opt[6], sizeof(defclass));
 	} else if (strncasecmp(opt, "cl=", 3) == 0) {
 		if (testclass(&opt[3]))
-			safecpy(defclass, &opt[3], sizeof(defclass));
+			strlcpy(defclass, &opt[3], sizeof(defclass));
 	} else if (strncasecmp(opt, "type=", 5) == 0) {
 		if (testtype(&opt[5]))
-			safecpy(deftype, &opt[5], sizeof(deftype));
+			strlcpy(deftype, &opt[5], sizeof(deftype));
 	} else if (strncasecmp(opt, "ty=", 3) == 0) {
 		if (testtype(&opt[3]))
-			safecpy(deftype, &opt[3], sizeof(deftype));
+			strlcpy(deftype, &opt[3], sizeof(deftype));
 	} else if (strncasecmp(opt, "querytype=", 10) == 0) {
 		if (testtype(&opt[10]))
-			safecpy(deftype, &opt[10], sizeof(deftype));
+			strlcpy(deftype, &opt[10], sizeof(deftype));
 	} else if (strncasecmp(opt, "query=", 6) == 0) {
 		if (testtype(&opt[6]))
-			safecpy(deftype, &opt[6], sizeof(deftype));
+			strlcpy(deftype, &opt[6], sizeof(deftype));
 	} else if (strncasecmp(opt, "qu=", 3) == 0) {
 		if (testtype(&opt[3]))
-			safecpy(deftype, &opt[3], sizeof(deftype));
+			strlcpy(deftype, &opt[3], sizeof(deftype));
 	} else if (strncasecmp(opt, "q=", 2) == 0) {
 		if (testtype(&opt[2]))
-			safecpy(deftype, &opt[2], sizeof(deftype));
+			strlcpy(deftype, &opt[2], sizeof(deftype));
 	} else if (strncasecmp(opt, "domain=", 7) == 0) {
-		safecpy(domainopt, &opt[7], sizeof(domainopt));
+		strlcpy(domainopt, &opt[7], sizeof(domainopt));
 		set_search_domain(domainopt);
 		usesearch = ISC_TRUE;
 	} else if (strncasecmp(opt, "do=", 3) == 0) {
-		safecpy(domainopt, &opt[3], sizeof(domainopt));
+		strlcpy(domainopt, &opt[3], sizeof(domainopt));
 		set_search_domain(domainopt);
 		usesearch = ISC_TRUE;
 	} else if (strncasecmp(opt, "port=", 5) == 0) {
@@ -677,11 +671,11 @@ addlookup(char *opt) {
 	lookup = make_empty_lookup();
 	if (get_reverse(store, sizeof(store), opt, lookup->ip6_int, ISC_TRUE)
 	    == ISC_R_SUCCESS) {
-		safecpy(lookup->textname, store, sizeof(lookup->textname));
+		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
 		lookup->rdtypeset = ISC_TRUE;
 	} else {
-		safecpy(lookup->textname, opt, sizeof(lookup->textname));
+		strlcpy(lookup->textname, opt, sizeof(lookup->textname));
 		lookup->rdtype = rdtype;
 		lookup->rdtypeset = ISC_TRUE;
 	}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-dsfromkey.c,v 1.16.50.1 2010/01/13 19:31:51 each Exp $ */
+/* $Id: dnssec-dsfromkey.c,v 1.16.50.4 2011/09/03 05:52:55 each Exp $ */

 /*! \file */

@@ -265,12 +265,10 @@ emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
 		fatal("can't print class");

 	isc_buffer_usedregion(&nameb, &r);
-	isc_util_fwrite(r.base, 1, r.length, stdout);
-
-	putchar(' ');
+	printf("%.*s ", (int)r.length, r.base);

 	isc_buffer_usedregion(&classb, &r);
-	isc_util_fwrite(r.base, 1, r.length, stdout);
+	printf("%.*s", (int)r.length, r.base);

 	if (lookaside == NULL)
 		printf(" DS ");
@@ -278,8 +276,7 @@ emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
 		printf(" DLV ");

 	isc_buffer_usedregion(&textb, &r);
-	isc_util_fwrite(r.base, 1, r.length, stdout);
-	putchar('\n');
+	printf("%.*s\n", (int)r.length, r.base);
 }

 ISC_PLATFORM_NORETURN_PRE static void
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-keyfromlabel.c,v 1.29.8.2 2010/01/19 23:48:12 tbox Exp $ */
+/* $Id: dnssec-keyfromlabel.c,v 1.29.8.6 2011/11/30 00:53:34 marka Exp $ */

 /*! \file */

@@ -110,7 +110,8 @@ usage(void) {

 int
 main(int argc, char **argv) {
-	char		*algname = NULL, *nametype = NULL, *type = NULL;
+	char		*algname = NULL, *freeit = NULL;
+	char		*nametype = NULL, *type = NULL;
 	const char	*directory = NULL;
 #ifdef USE_PKCS11
 	const char	*engine = "pkcs11";
@@ -342,6 +343,9 @@ main(int argc, char **argv) {
 			algname = strdup(DEFAULT_NSEC3_ALGORITHM);
 		else
 			algname = strdup(DEFAULT_ALGORITHM);
+		if (algname == NULL)
+			fatal("strdup failed");
+		freeit = algname;
 		if (verbose > 0)
 			fprintf(stderr, "no algorithm specified; "
 				"defaulting to %s\n", algname);
@@ -513,10 +517,12 @@ main(int argc, char **argv) {
 	 * is a risk of ID collision due to this key or another key
 	 * being revoked.
 	 */
-	if (key_collision(dst_key_id(key), name, directory, alg, mctx, &exact))
-	{
+	if (key_collision(key, name, directory, mctx, &exact)) {
 		isc_buffer_clear(&buf);
 		ret = dst_key_buildfilename(key, 0, directory, &buf);
+		if (ret != ISC_R_SUCCESS)
+			fatal("dst_key_buildfilename returned: %s\n",
+			      isc_result_totext(ret));
 		if (exact)
 			fatal("%s: %s already exists\n", program, filename);

@@ -541,6 +547,9 @@ main(int argc, char **argv) {

 	isc_buffer_clear(&buf);
 	ret = dst_key_buildfilename(key, 0, NULL, &buf);
+	if (ret != ISC_R_SUCCESS)
+		fatal("dst_key_buildfilename returned: %s\n",
+		      isc_result_totext(ret));
 	printf("%s\n", filename);
 	dst_key_free(&key);

@@ -553,5 +562,8 @@ main(int argc, char **argv) {
 	isc_mem_free(mctx, label);
 	isc_mem_destroy(&mctx);

+	if (freeit != NULL)
+		free(freeit);
+
 	return (0);
 }
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Portions Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -29,7 +29,7 @@
 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-keygen.c,v 1.108.8.6 2010/08/16 23:46:30 tbox Exp $ */
+/* $Id: dnssec-keygen.c,v 1.108.8.10 2011/11/30 00:53:34 marka Exp $ */

 /*! \file */

@@ -195,7 +195,8 @@ progress(int p)

 int
 main(int argc, char **argv) {
-	char		*algname = NULL, *nametype = NULL, *type = NULL;
+	char		*algname = NULL, *freeit = NULL;
+	char		*nametype = NULL, *type = NULL;
 	char		*classname = NULL;
 	char		*endp;
 	dst_key_t	*key = NULL;
@@ -507,6 +508,9 @@ main(int argc, char **argv) {
 				algname = strdup(DEFAULT_NSEC3_ALGORITHM);
 			else
 				algname = strdup(DEFAULT_ALGORITHM);
+			if (algname == NULL)
+				fatal("strdup failed");
+			freeit = algname;
 			if (verbose > 0)
 				fprintf(stderr, "no algorithm specified; "
 						"defaulting to %s\n", algname);
@@ -959,8 +963,7 @@ main(int argc, char **argv) {
 		 * if there is a risk of ID collision due to this key
 		 * or another key being revoked.
 		 */
-		if (key_collision(dst_key_id(key), name, directory,
-				  alg, mctx, NULL)) {
+		if (key_collision(key, name, directory, mctx, NULL)) {
 			conflict = ISC_TRUE;
 			if (null_key) {
 				dst_key_free(&key);
@@ -969,12 +972,15 @@ main(int argc, char **argv) {

 			if (verbose > 0) {
 				isc_buffer_clear(&buf);
-				dst_key_buildfilename(key, 0, directory, &buf);
-				fprintf(stderr,
-					"%s: %s already exists, or might "
-					"collide with another key upon "
-					"revokation.  Generating a new key\n",
-					program, filename);
+				ret = dst_key_buildfilename(key, 0,
+							    directory, &buf);
+				if (ret == ISC_R_SUCCESS)
+					fprintf(stderr,
+						"%s: %s already exists, or "
+						"might collide with another "
+						"key upon revokation.  "
+						"Generating a new key\n",
+						program, filename);
 			}

 			dst_key_free(&key);
@@ -995,6 +1001,9 @@ main(int argc, char **argv) {

 	isc_buffer_clear(&buf);
 	ret = dst_key_buildfilename(key, 0, NULL, &buf);
+	if (ret != ISC_R_SUCCESS)
+		fatal("dst_key_buildfilename returned: %s\n",
+		      isc_result_totext(ret));
 	printf("%s\n", filename);
 	dst_key_free(&key);
 	if (prevkey != NULL)
@@ -1008,5 +1017,8 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);

+	if (freeit != NULL)
+		free(freeit);
+
 	return (0);
 }
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-revoke.8,v 1.8.24.1 2010/05/18 04:04:36 tbox Exp $
+.\" $Id: dnssec-revoke.8,v 1.8.24.2 2011/10/21 01:39:09 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -32,7 +32,7 @@
 dnssec\-revoke \- Set the REVOKED bit on a DNSSEC key
 .SH "SYNOPSIS"
 .HP 14
-\fBdnssec\-revoke\fR [\fB\-hr\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\fR] {keyfile}
+\fBdnssec\-revoke\fR [\fB\-hr\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\fR] [\fB\-R\fR] {keyfile}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-revoke\fR
@@ -70,6 +70,11 @@ Force overwrite: Causes
 \fBdnssec\-revoke\fR
 to write the new key pair even if a file already exists matching the algorithm and key ID of the revoked key.
 .RE
+.PP
+\-R
+.RS 4
+Print the key tag of the key with the REVOKE bit set but do not revoke the key.
+.RE
 .SH "SEE ALSO"
 .PP
 \fBdnssec\-keygen\fR(8),
@@ -79,5 +84,5 @@ RFC 5011.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2009 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-revoke.c,v 1.18.34.4 2010/05/06 23:49:37 tbox Exp $ */
+/* $Id: dnssec-revoke.c,v 1.18.34.6 2011/10/20 23:46:03 tbox Exp $ */

 /*! \file */

@@ -92,6 +92,7 @@ main(int argc, char **argv) {
 	isc_buffer_t buf;
 	isc_boolean_t force = ISC_FALSE;
 	isc_boolean_t remove = ISC_FALSE;
+	isc_boolean_t id = ISC_FALSE;

 	if (argc == 1)
 		usage();
@@ -104,7 +105,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = ISC_FALSE;

-	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rhv:")) != -1) {
+	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:")) != -1) {
 		switch (ch) {
 		    case 'E':
 			engine = isc_commandline_argument;
@@ -126,6 +127,9 @@ main(int argc, char **argv) {
 		    case 'r':
 			remove = ISC_TRUE;
 			break;
+		    case 'R':
+			id = ISC_TRUE;
+			break;
 		    case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0')
@@ -186,6 +190,10 @@ main(int argc, char **argv) {
 		fatal("Invalid keyfile name %s: %s",
 		      filename, isc_result_totext(result));

+	if (id) {
+		fprintf(stdout, "%u\n", dst_key_rid(key));
+		goto cleanup;
+	}
 	dst_key_format(key, keystr, sizeof(keystr));

 	if (verbose > 2)
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
               [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: dnssec-revoke.docbook,v 1.7 2009/11/03 21:44:46 each Exp $ -->
+<!-- $Id: dnssec-revoke.docbook,v 1.7.24.2 2011/10/20 23:46:04 tbox Exp $ -->
 <refentry id="man.dnssec-revoke">
  <refentryinfo>
    <date>June 1, 2009</date>
@@ -37,6 +37,7 @@
  <docinfo>
    <copyright>
      <year>2009</year>
+      <year>2011</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -49,6 +50,7 @@
      <arg><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg><option>-E <replaceable class="parameter">engine</replaceable></option></arg>
      <arg><option>-f</option></arg>
+      <arg><option>-R</option></arg>
      <arg choice="req">keyfile</arg>
    </cmdsynopsis>
  </refsynopsisdiv>
@@ -123,6 +125,16 @@
          </para>
        </listitem>
      </varlistentry>
+
+      <varlistentry>
+        <term>-R</term>
+        <listitem>
+          <para>
+	    Print the key tag of the key with the REVOKE bit set but do
+	    not revoke the key.
+          </para>
+        </listitem>
+      </varlistentry>
    </variablelist>
  </refsect1>

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-revoke.html,v 1.8.24.1 2010/05/18 04:04:36 tbox Exp $ -->
+<!-- $Id: dnssec-revoke.html,v 1.8.24.2 2011/10/21 01:39:09 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -28,10 +28,10 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code>  [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] {keyfile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code>  [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543373"></a><h2>DESCRIPTION</h2>
+<a name="id2543381"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-revoke</strong></span>
      reads a DNSSEC key file, sets the REVOKED bit on the key as defined
      in RFC 5011, and creates a new pair of key files containing the
@@ -39,7 +39,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543385"></a><h2>OPTIONS</h2>
+<a name="id2543393"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-h</span></dt>
 <dd><p>
@@ -69,17 +69,22 @@
            write the new key pair even if a file already exists matching
            the algorithm and key ID of the revoked key.
          </p></dd>
+<dt><span class="term">-R</span></dt>
+<dd><p>
+	    Print the key tag of the key with the REVOKE bit set but do
+	    not revoke the key.
+          </p></dd>
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543491"></a><h2>SEE ALSO</h2>
+<a name="id2543511"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 5011</em>.
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543515"></a><h2>AUTHOR</h2>
+<a name="id2543536"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-settime.8,v 1.9.24.6 2010/08/17 00:08:22 tbox Exp $
+.\" $Id: dnssec-settime.8,v 1.9.24.8 2011/11/04 01:37:24 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -52,14 +52,14 @@ simply prints the key timing metadata already stored in the key.
 .PP
 When key metadata fields are changed, both files of a key pair (\fIKnnnn.+aaa+iiiii.key\fR
 and
-\fIKnnnn.+aaa+iiiii.private\fR) are regenerated. Metadata fields are stored in the private file. A human\-readable description of the metadata is also placed in comments in the key file.
+\fIKnnnn.+aaa+iiiii.private\fR) are regenerated. Metadata fields are stored in the private file. A human\-readable description of the metadata is also placed in comments in the key file. The private file's permissions are always set to be inaccessible to anyone other than the owner (mode 0600).
 .SH "OPTIONS"
 .PP
 \-f
 .RS 4
 Force an update of an old\-format key with no metadata fields. Without this option,
 \fBdnssec\-settime\fR
-will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be set to the present time.
+will fail when attempting to update a legacy key. With this option, the key will be recreated in the new format, but with the original key data retained. The key's creation date will be set to the present time. If no other values are specified, then the key's publication and activation dates will also be set to the present time.
 .RE
 .PP
 \-K \fIdirectory\fR
@@ -162,5 +162,5 @@ RFC 5011.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-settime.c,v 1.19.34.9 2010/12/19 07:27:23 each Exp $ */
+/* $Id: dnssec-settime.c,v 1.19.34.12 2011/06/02 20:23:48 each Exp $ */

 /*! \file */

@@ -81,8 +81,7 @@ usage(void) {
 						     "deletion date\n");
 	fprintf(stderr, "Printing options:\n");
 	fprintf(stderr, "    -p C/P/A/R/I/D/all: print a particular time "
-						"value or values "
-						"[default: all]\n");
+						"value or values\n");
 	fprintf(stderr, "    -u:                 print times in unix epoch "
 						"format\n");
 	fprintf(stderr, "Output:\n");
@@ -513,6 +512,16 @@ main(int argc, char **argv) {
 	else if (unsetdel)
 		dst_key_unsettime(key, DST_TIME_DELETE);

+	/*
+	 * No metadata changes were made but we're forcing an upgrade
+	 * to the new format anyway: use "-P now -A now" as the default
+	 */
+	if (force && !changed) {
+		dst_key_settime(key, DST_TIME_PUBLISH, now);
+		dst_key_settime(key, DST_TIME_ACTIVATE, now);
+		changed = ISC_TRUE;
+	}
+
 	/*
 	 * Print out time values, if -p was used.
 	 */
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
               [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: dnssec-settime.docbook,v 1.7.24.4 2010/08/16 22:27:16 marka Exp $ -->
+<!-- $Id: dnssec-settime.docbook,v 1.7.24.7 2011/11/03 20:21:24 each Exp $ -->
 <refentry id="man.dnssec-settime">
  <refentryinfo>
    <date>July 15, 2009</date>
@@ -38,6 +38,7 @@
    <copyright>
      <year>2009</year>
      <year>2010</year>
+      <year>2011</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -81,7 +82,8 @@
      <filename>Knnnn.+aaa+iiiii.private</filename>) are regenerated.
      Metadata fields are stored in the private file.  A human-readable
      description of the metadata is also placed in comments in the key
-      file.
+      file.  The private file's permissions are always set to be
+      inaccessible to anyone other than the owner (mode 0600).
    </para>
  </refsect1>

@@ -98,7 +100,9 @@
            fail when attempting to update a legacy key.  With this option,
            the key will be recreated in the new format, but with the
            original key data retained.  The key's creation date will be
-            set to the present time. 
+            set to the present time.  If no other values are specified, 
+            then the key's publication and activation dates will also 
+            be set to the present time.
 	  </para>
        </listitem>
      </varlistentry>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-settime.html,v 1.9.24.6 2010/08/17 00:08:21 tbox Exp $ -->
+<!-- $Id: dnssec-settime.html,v 1.9.24.8 2011/11/04 01:37:24 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543419"></a><h2>DESCRIPTION</h2>
+<a name="id2543422"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-settime</strong></span>
      reads a DNSSEC private key file and sets the key timing metadata
      as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
@@ -52,11 +52,12 @@
      <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
      Metadata fields are stored in the private file.  A human-readable
      description of the metadata is also placed in comments in the key
-      file.
+      file.  The private file's permissions are always set to be
+      inaccessible to anyone other than the owner (mode 0600).
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543467"></a><h2>OPTIONS</h2>
+<a name="id2543470"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-f</span></dt>
 <dd><p>
@@ -65,7 +66,9 @@
            fail when attempting to update a legacy key.  With this option,
            the key will be recreated in the new format, but with the
            original key data retained.  The key's creation date will be
-            set to the present time. 
+            set to the present time.  If no other values are specified, 
+            then the key's publication and activation dates will also 
+            be set to the present time.
 	  </p></dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
@@ -87,7 +90,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543559"></a><h2>TIMING OPTIONS</h2>
+<a name="id2543562"></a><h2>TIMING OPTIONS</h2>
 <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
@@ -166,7 +169,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543698"></a><h2>PRINTING OPTIONS</h2>
+<a name="id2543769"></a><h2>PRINTING OPTIONS</h2>
 <p>
      <span><strong class="command">dnssec-settime</strong></span> can also be used to print the
      timing metadata associated with a key.
@@ -192,7 +195,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543912"></a><h2>SEE ALSO</h2>
+<a name="id2543847"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -200,7 +203,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543945"></a><h2>AUTHOR</h2>
+<a name="id2543880"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
    </p>
 </div>
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Portions Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -29,7 +29,7 @@
 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-signzone.c,v 1.258.4.4 2010/06/03 23:49:23 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.258.4.13 2011/08/26 23:45:30 tbox Exp $ */

 /*! \file */

@@ -338,7 +338,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	} else {
 		dns_dnsseckey_create(mctx, &pubkey, &key);
 	}
-	key->force_publish = ISC_TRUE;
+	key->force_publish = ISC_FALSE;
 	key->force_sign = ISC_FALSE;
 	ISC_LIST_APPEND(keylist, key, link);

@@ -486,32 +486,32 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			if (!expired)
 				keep = ISC_TRUE;
 		} else if (issigningkey(key)) {
-			if (!expired && setverifies(name, set, key->key,
-						    &sigrdata)) {
+			if (!expired && rrsig.originalttl == set->ttl &&
+			    setverifies(name, set, key->key, &sigrdata)) {
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = ISC_TRUE;
 				wassignedby[key->index] = ISC_TRUE;
 				nowsignedby[key->index] = ISC_TRUE;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
-					 sigstr,
-					 expired ? "expired" :
-						   "failed to verify");
+					 sigstr, expired ? "expired" :
+					 rrsig.originalttl != set->ttl ?
+					 "ttl change" : "failed to verify");
 				wassignedby[key->index] = ISC_TRUE;
 				resign = ISC_TRUE;
 			}
 		} else if (iszonekey(key)) {
-			if (!expired && setverifies(name, set, key->key,
-						    &sigrdata)) {
+			if (!expired && rrsig.originalttl == set->ttl &&
+			    setverifies(name, set, key->key, &sigrdata)) {
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = ISC_TRUE;
 				wassignedby[key->index] = ISC_TRUE;
 				nowsignedby[key->index] = ISC_TRUE;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
-					 sigstr,
-					 expired ? "expired" :
-						   "failed to verify");
+					 sigstr, expired ? "expired" :
+					 rrsig.originalttl != set->ttl ?
+					 "ttl change" : "failed to verify");
 				wassignedby[key->index] = ISC_TRUE;
 			}
 		} else if (!expired) {
@@ -522,7 +522,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		}

 		if (keep) {
-			nowsignedby[key->index] = ISC_TRUE;
+			if (key != NULL)
+				nowsignedby[key->index] = ISC_TRUE;
 			INCSTAT(nretained);
 			if (sigset.ttl != ttl) {
 				vbprintf(2, "\tfixing ttl %s\n", sigstr);
@@ -1387,6 +1388,13 @@ verifyset(dns_rdataset_t *rdataset, dns_name_t *name, dns_dbnode_t *node,

 		dns_rdataset_current(&sigrdataset, &rdata);
 		dns_rdata_tostruct(&rdata, &sig, NULL);
+		if (rdataset->ttl != sig.originalttl) {
+			dns_name_format(name, namebuf, sizeof(namebuf));
+			type_format(rdataset->type, typebuf, sizeof(typebuf));
+			fprintf(stderr, "TTL mismatch for %s %s keytag %u\n",
+				namebuf, typebuf, sig.keyid);
+			continue;
+		}
 		if ((set_algorithms[sig.algorithm] != 0) ||
 		    (ksk_algorithms[sig.algorithm] == 0))
 			continue;
@@ -1443,14 +1451,14 @@ verifynode(dns_name_t *name, dns_dbnode_t *node, isc_boolean_t delegation,
 /*%
 * Verify that certain things are sane:
 *
- *   The apex has a DNSKEY record with at least one KSK, and at least
+ *   The apex has a DNSKEY RRset with at least one KSK, and at least
 *   one ZSK if the -x flag was not used.
 *
- *   The DNSKEY record was signed with at least one of the KSKs in this
- *   set.
+ *   The DNSKEY record was signed with at least one of the KSKs in
+ *   the DNSKEY RRset.
 *
 *   The rest of the zone was signed with at least one of the ZSKs
- *   present in the DNSKEY RRSET.
+ *   present in the DNSKEY RRset.
 */
 static void
 verifyzone(void) {
@@ -1461,13 +1469,12 @@ verifyzone(void) {
 	dns_name_t *name, *nextname, *zonecut;
 	dns_rdata_dnskey_t dnskey;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdataset_t rdataset;
-	dns_rdataset_t sigrdataset;
+	dns_rdataset_t keyset, soaset;
+	dns_rdataset_t keysigs, soasigs;
 	int i;
 	isc_boolean_t done = ISC_FALSE;
 	isc_boolean_t first = ISC_TRUE;
 	isc_boolean_t goodksk = ISC_FALSE;
-	isc_boolean_t goodzsk = ISC_FALSE;
 	isc_result_t result;
 	unsigned char revoked_ksk[256];
 	unsigned char revoked_zsk[256];
@@ -1489,18 +1496,30 @@ verifyzone(void) {
 		fatal("failed to find the zone's origin: %s",
 		      isc_result_totext(result));

-	dns_rdataset_init(&rdataset);
-	dns_rdataset_init(&sigrdataset);
+	dns_rdataset_init(&keyset);
+	dns_rdataset_init(&keysigs);
+	dns_rdataset_init(&soaset);
+	dns_rdataset_init(&soasigs);
+
 	result = dns_db_findrdataset(gdb, node, gversion,
 				     dns_rdatatype_dnskey,
-				     0, 0, &rdataset, &sigrdataset);
-	dns_db_detachnode(gdb, &node);
+				     0, 0, &keyset, &keysigs);
 	if (result != ISC_R_SUCCESS)
 		fatal("cannot find DNSKEY rrset\n");

-	if (!dns_rdataset_isassociated(&sigrdataset))
+	result = dns_db_findrdataset(gdb, node, gversion,
+				     dns_rdatatype_soa,
+				     0, 0, &soaset, &soasigs);
+	dns_db_detachnode(gdb, &node);
+	if (result != ISC_R_SUCCESS)
+		fatal("cannot find SOA rrset\n");
+
+	if (!dns_rdataset_isassociated(&keysigs))
 		fatal("cannot find DNSKEY RRSIGs\n");

+	if (!dns_rdataset_isassociated(&soasigs))
+		fatal("cannot find SOA RRSIGs\n");
+
 	memset(revoked_ksk, 0, sizeof(revoked_ksk));
 	memset(revoked_zsk, 0, sizeof(revoked_zsk));
 	memset(standby_ksk, 0, sizeof(standby_ksk));
@@ -1517,10 +1536,10 @@ verifyzone(void) {
 	 * and one ZSK per algorithm in it (or, if -x was used, one
 	 * self-signing KSK).
 	 */
-	for (result = dns_rdataset_first(&rdataset);
+	for (result = dns_rdataset_first(&keyset);
 	     result == ISC_R_SUCCESS;
-	     result = dns_rdataset_next(&rdataset)) {
-		dns_rdataset_current(&rdataset, &rdata);
+	     result = dns_rdataset_next(&keyset)) {
+		dns_rdataset_current(&keyset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
 		check_result(result, "dns_rdata_tostruct");

@@ -1528,8 +1547,8 @@ verifyzone(void) {
 			;
 		else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
 			if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
-			    !dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
-						  &sigrdataset, ISC_FALSE,
+			    !dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+						  &keysigs, ISC_FALSE,
 						  mctx)) {
 				char namebuf[DNS_NAME_FORMATSIZE];
 				char buffer[1024];
@@ -1551,8 +1570,8 @@ verifyzone(void) {
 				 revoked_zsk[dnskey.algorithm] != 255)
 				revoked_zsk[dnskey.algorithm]++;
 		} else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) {
-			if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
-					      &sigrdataset, ISC_FALSE, mctx)) {
+			if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+					      &keysigs, ISC_FALSE, mctx)) {
 				if (ksk_algorithms[dnskey.algorithm] != 255)
 					ksk_algorithms[dnskey.algorithm]++;
 				goodksk = ISC_TRUE;
@@ -1560,8 +1579,8 @@ verifyzone(void) {
 				if (standby_ksk[dnskey.algorithm] != 255)
 					standby_ksk[dnskey.algorithm]++;
 			}
-		} else if (dns_dnssec_selfsigns(&rdata, gorigin, &rdataset,
-						&sigrdataset, ISC_FALSE,
+		} else if (dns_dnssec_selfsigns(&rdata, gorigin, &keyset,
+						&keysigs, ISC_FALSE,
 						mctx)) {
 #ifdef ALLOW_KSKLESS_ZONES
 			if (self_algorithms[dnskey.algorithm] != 255)
@@ -1569,7 +1588,10 @@ verifyzone(void) {
 #endif
 			if (zsk_algorithms[dnskey.algorithm] != 255)
 				zsk_algorithms[dnskey.algorithm]++;
-			goodzsk = ISC_TRUE;
+		} else if (dns_dnssec_signs(&rdata, gorigin, &soaset,
+					    &soasigs, ISC_FALSE, mctx)) {
+			if (zsk_algorithms[dnskey.algorithm] != 255)
+				zsk_algorithms[dnskey.algorithm]++;
 		} else {
 			if (standby_zsk[dnskey.algorithm] != 255)
 				standby_zsk[dnskey.algorithm]++;
@@ -1580,7 +1602,9 @@ verifyzone(void) {
 		dns_rdata_freestruct(&dnskey);
 		dns_rdata_reset(&rdata);
 	}
-	dns_rdataset_disassociate(&sigrdataset);
+	dns_rdataset_disassociate(&keysigs);
+	dns_rdataset_disassociate(&soaset);
+	dns_rdataset_disassociate(&soasigs);

 #ifdef ALLOW_KSKLESS_ZONES
 	if (!goodksk) {
@@ -1595,7 +1619,7 @@ verifyzone(void) {
 	}
 #else
 	if (!goodksk) {
-		fatal("no self signed KSK's found");
+		fatal("No self signed KSK's found");
 	}
 #endif

@@ -1669,7 +1693,7 @@ verifyzone(void) {
 			dns_name_copy(name, zonecut, NULL);
 			isdelegation = ISC_TRUE;
 		}
-		verifynode(name, node, isdelegation, &rdataset,
+		verifynode(name, node, isdelegation, &keyset,
 			   ksk_algorithms, bad_algorithms);
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
@@ -1706,13 +1730,13 @@ verifyzone(void) {
 	     result = dns_dbiterator_next(dbiter) ) {
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		verifynode(name, node, ISC_FALSE, &rdataset,
+		verifynode(name, node, ISC_FALSE, &keyset,
 			   ksk_algorithms, bad_algorithms);
 		dns_db_detachnode(gdb, &node);
 	}
 	dns_dbiterator_destroy(&dbiter);

-	dns_rdataset_disassociate(&rdataset);
+	dns_rdataset_disassociate(&keyset);

 	/*
 	 * If we made it this far, we have what we consider a properly signed
@@ -2192,6 +2216,7 @@ addnsec3param(const unsigned char *salt, size_t salt_length,
 	result = dns_rdata_fromstruct(&rdata, gclass,
 				      dns_rdatatype_nsec3param,
 				      &nsec3param, &b);
+	check_result(result, "dns_rdata_fromstruct()");
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.type = rdata.type;
 	rdatalist.covers = 0;
@@ -2801,7 +2826,7 @@ loadzonekeys(isc_boolean_t preserve_keys, isc_boolean_t load_public) {
 	}
 	keyttl = rdataset.ttl;

-	/* Load keys corresponding to the existing DNSKEY RRset */
+	/* Load keys corresponding to the existing DNSKEY RRset. */
 	result = dns_dnssec_keylistfromrdataset(gorigin, directory, mctx,
 						&rdataset, &keysigs, &soasigs,
 						preserve_keys, load_public,
@@ -3320,28 +3345,36 @@ removetempfile(void) {
 }

 static void
-print_stats(isc_time_t *timer_start, isc_time_t *timer_finish) {
-	isc_uint64_t runtime_us;   /* Runtime in microseconds */
-	isc_uint64_t runtime_ms;   /* Runtime in milliseconds */
+print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
+	    isc_time_t *sign_start, isc_time_t *sign_finish)
+{
+	isc_uint64_t time_us;      /* Time in microseconds */
+	isc_uint64_t time_ms;      /* Time in milliseconds */
 	isc_uint64_t sig_ms;	   /* Signatures per millisecond */

-	runtime_us = isc_time_microdiff(timer_finish, timer_start);
-
 	printf("Signatures generated:               %10d\n", nsigned);
 	printf("Signatures retained:                %10d\n", nretained);
 	printf("Signatures dropped:                 %10d\n", ndropped);
 	printf("Signatures successfully verified:   %10d\n", nverified);
 	printf("Signatures unsuccessfully verified: %10d\n", nverifyfailed);
-	runtime_ms = runtime_us / 1000;
-	printf("Runtime in seconds:                %7u.%03u\n",
-	       (unsigned int) (runtime_ms / 1000),
-	       (unsigned int) (runtime_ms % 1000));
-	if (runtime_us > 0) {
-		sig_ms = ((isc_uint64_t)nsigned * 1000000000) / runtime_us;
+
+	time_us = isc_time_microdiff(sign_finish, sign_start);
+	time_ms = time_us / 1000;
+	printf("Signing time in seconds:           %7u.%03u\n",
+	       (unsigned int) (time_ms / 1000),
+	       (unsigned int) (time_ms % 1000));
+	if (time_us > 0) {
+		sig_ms = ((isc_uint64_t)nsigned * 1000000000) / time_us;
 		printf("Signatures per second:             %7u.%03u\n",
 		       (unsigned int) sig_ms / 1000,
 		       (unsigned int) sig_ms % 1000);
 	}
+
+	time_us = isc_time_microdiff(timer_finish, timer_start);
+	time_ms = time_us / 1000;
+	printf("Runtime in seconds:                %7u.%03u\n",
+	       (unsigned int) (time_ms / 1000),
+	       (unsigned int) (time_ms % 1000));
 }

 int
@@ -3355,6 +3388,7 @@ main(int argc, char *argv[]) {
 	int ndskeys = 0;
 	char *endp;
 	isc_time_t timer_start, timer_finish;
+	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
 	isc_result_t result;
 	isc_log_t *log = NULL;
@@ -3805,6 +3839,8 @@ main(int argc, char *argv[]) {
 		nokeys = ISC_TRUE;
 	}

+	warnifallksk(gdb);
+
 	if (IS_NSEC3) {
 		unsigned int max;
 		result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
@@ -3814,8 +3850,6 @@ main(int argc, char *argv[]) {
 			      "strength. Maximum iterations allowed %u.", max);
 	}

-	warnifallksk(gdb);
-
 	gversion = NULL;
 	result = dns_db_newversion(gdb, &gversion);
 	check_result(result, "dns_db_newversion()");
@@ -3895,6 +3929,7 @@ main(int argc, char *argv[]) {
 		RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);

 	presign();
+	TIME_NOW(&sign_start);
 	signapex();
 	if (!finished) {
 		/*
@@ -3919,6 +3954,7 @@ main(int argc, char *argv[]) {
 	isc_taskmgr_destroy(&taskmgr);
 	isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	postsign();
+	TIME_NOW(&sign_finish);
 	verifyzone();

 	if (outputformat != dns_masterformat_text) {
@@ -3972,7 +4008,8 @@ main(int argc, char *argv[]) {

 	if (printstats) {
 		TIME_NOW(&timer_finish);
-		print_stats(&timer_start, &timer_finish);
+		print_stats(&timer_start, &timer_finish,
+			    &sign_start, &sign_finish);
 	}

 	return (0);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssectool.c,v 1.58.36.2 2010/01/19 23:48:13 tbox Exp $ */
+/* $Id: dnssectool.c,v 1.58.36.5 2011/10/21 03:56:55 marka Exp $ */

 /*! \file */

@@ -406,19 +406,24 @@ set_keyversion(dst_key_t *key) {
 }

 isc_boolean_t
-key_collision(isc_uint16_t id, dns_name_t *name, const char *dir,
-	      dns_secalg_t alg, isc_mem_t *mctx, isc_boolean_t *exact)
+key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
+	      isc_mem_t *mctx, isc_boolean_t *exact)
 {
 	isc_result_t result;
 	isc_boolean_t conflict = ISC_FALSE;
 	dns_dnsseckeylist_t matchkeys;
 	dns_dnsseckey_t *key = NULL;
-	isc_uint16_t oldid, diff;
-	isc_uint16_t bits = DNS_KEYFLAG_REVOKE;   /* flag bits to look for */
+	isc_uint16_t id, oldid;
+	isc_uint32_t rid, roldid;
+	dns_secalg_t alg;

 	if (exact != NULL)
 		*exact = ISC_FALSE;

+	id = dst_key_id(dstkey);
+	rid = dst_key_rid(dstkey);
+	alg = dst_key_alg(dstkey);
+
 	ISC_LIST_INIT(matchkeys);
 	result = dns_dnssec_findmatchingkeys(name, dir, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND)
@@ -430,10 +435,11 @@ key_collision(isc_uint16_t id, dns_name_t *name, const char *dir,
 			goto next;

 		oldid = dst_key_id(key->key);
-		diff = (oldid > id) ? (oldid - id) : (id - oldid);
-		if ((diff & ~bits) == 0) {
+		roldid = dst_key_rid(key->key);
+
+		if (oldid == rid || roldid == id || id == oldid) {
 			conflict = ISC_TRUE;
-			if (diff != 0) {
+			if (id != oldid) {
 				if (verbose > 1)
 					fprintf(stderr, "Key ID %d could "
 						"collide with %d\n",
@@ -461,4 +467,3 @@ key_collision(isc_uint16_t id, dns_name_t *name, const char *dir,

 	return (conflict);
 }
-
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssectool.h,v 1.29.36.2 2010/01/19 23:48:13 tbox Exp $ */
+/* $Id: dnssectool.h,v 1.29.36.4 2011/10/20 23:46:04 tbox Exp $ */

 #ifndef DNSSECTOOL_H
 #define DNSSECTOOL_H 1
@@ -78,6 +78,7 @@ void
 set_keyversion(dst_key_t *key);

 isc_boolean_t
-key_collision(isc_uint16_t id, dns_name_t *name, const char *dir,
-	      dns_secalg_t alg, isc_mem_t *mctx, isc_boolean_t *exact);
+key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
+	      isc_mem_t *mctx, isc_boolean_t *exact);
+
 #endif /* DNSSEC_DNSSECTOOL_H */
@@ -1,6 +1,6 @@
 /*
- * Generated by bindkeys.pl 1.3.104.2 2010/06/20 23:46:24 tbox Exp  
- * From bind.keys 1.5.42.2 2011/01/04 19:14:48 each Exp  
+ * Generated by bindkeys.pl 1.3.104.2 2010-06-20 23:46:24 tbox Exp  
+ * From bind.keys 1.5.42.3 2011-03-25 17:46:40 each Exp  
 */
 #define TRUSTED_KEYS "\
 # The bind.keys file is used to override built-in DNSSEC trust anchors\n\
@@ -41,8 +41,8 @@ trusted-keys {\n\
 \n\
 	# ROOT KEY: See https://data.iana.org/root-anchors/root-anchors.xml\n\
 	# for current trust anchor information.\n\
-        # NOTE: This key is activated by setting \"dnssec-validation auto;\"\n\
-        # in named.conf.\n\
+	# NOTE: This key not active; to use it, copy it into a managed-keys\n\
+	# statement in named.conf\n\
 	. initial-key 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
 		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
 		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
@@ -92,8 +92,8 @@ managed-keys {\n\
 \n\
 	# ROOT KEY: See https://data.iana.org/root-anchors/root-anchors.xml\n\
 	# for current trust anchor information.\n\
-        # NOTE: This key is activated by setting \"dnssec-validation auto;\"\n\
-        # in named.conf.\n\
+	# NOTE: This key not active; to use it, copy it into a managed-keys\n\
+	# statement in named.conf\n\
 	. initial-key 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
 		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
 		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
@@ -1,6 +1,6 @@
 /*
- * Generated by convertxsl.pl 1.14 2008/07/17 23:43:26 jinmei Exp  
- * From bind9.xsl 1.21 2009/01/27 23:47:54 tbox Exp 
+ * Generated by convertxsl.pl 1.14 2008-07-17 23:43:26 jinmei Exp  
+ * From bind9.xsl 1.21 2009-01-27 23:47:54 tbox Exp 
 */
 static char xslmsg[] =
 	"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
@@ -20,7 +20,7 @@ static char xslmsg[] =
 	" - PERFORMANCE OF THIS SOFTWARE.\n"
 	"-->\n"
 	"\n"
-	"<!-- \045Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp \045 -->\n"
+	"<!-- \045Id: bind9.xsl,v 1.21 2009-01-27 23:47:54 tbox Exp \045 -->\n"
 	"\n"
 	"<xsl:stylesheet version=\"1.0\"\n"
 	" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"\n"
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: client.c,v 1.266.36.2 2010/09/24 08:30:58 tbox Exp $ */
+/* $Id: client.c,v 1.266.36.5 2011/07/28 04:37:34 marka Exp $ */

 #include <config.h>

@@ -633,6 +633,7 @@ ns_client_endrequest(ns_client_t *client) {
 		dns_message_puttemprdataset(client->message, &client->opt);
 	}

+	client->signer = NULL;
 	client->udpsize = 512;
 	client->extflags = 0;
 	client->ednsversion = -1;
@@ -1312,6 +1313,12 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,

 	UNUSED(arg);

+	/*
+	 * ns_g_server->interfacemgr is task exclusive locked.
+	 */
+	if (ns_g_server->interfacemgr == NULL)
+		return (ISC_TRUE);
+
 	if (!ns_interfacemgr_listeningon(ns_g_server->interfacemgr, dstaddr))
 		return (ISC_FALSE);

@@ -2093,6 +2100,7 @@ client_create(ns_clientmgr_t *manager, ns_client_t **clientp) {
 	client->next = NULL;
 	client->shutdown = NULL;
 	client->shutdown_arg = NULL;
+	client->signer = NULL;
 	dns_name_init(&client->signername, NULL);
 	client->mortal = ISC_FALSE;
 	client->tcpquota = NULL;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: controlconf.c,v 1.60 2008/07/23 23:27:54 marka Exp $ */
+/* $Id: controlconf.c,v 1.60.290.2 2011/03/12 04:58:24 tbox Exp $ */

 /*! \file */

@@ -859,7 +859,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		cfg_obj_log(key, ns_g_lctx, ISC_LOG_WARNING,
 			    "secret for key '%s' on command channel: %s",
 			    keyid->keyname, isc_result_totext(result));
-		CHECK(result);
+		goto cleanup;
 	}

 	keyid->secret.length = isc_buffer_usedlength(&b);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: globals.h,v 1.86.60.3 2010/09/15 12:10:53 marka Exp $ */
+/* $Id: globals.h,v 1.86.60.5 2011/09/05 23:45:31 tbox Exp $ */

 #ifndef NAMED_GLOBALS_H
 #define NAMED_GLOBALS_H 1
@@ -26,6 +26,7 @@
 #include <isc/log.h>
 #include <isc/net.h>

+#include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>

 #include <dns/zone.h>
@@ -102,6 +103,7 @@ EXTERN const char *		lwresd_g_resolvconffile	INIT("/etc"
 EXTERN isc_boolean_t		ns_g_conffileset	INIT(ISC_FALSE);
 EXTERN isc_boolean_t		lwresd_g_useresolvconf	INIT(ISC_FALSE);
 EXTERN isc_uint16_t		ns_g_udpsize		INIT(4096);
+EXTERN cfg_aclconfctx_t *	ns_g_aclconfctx		INIT(NULL);

 /*
 * Initial resource limits.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: interfacemgr.c,v 1.95 2009/01/17 23:47:42 tbox Exp $ */
+/* $Id: interfacemgr.c,v 1.95.186.2 2011/03/12 04:58:24 tbox Exp $ */

 /*! \file */

@@ -379,7 +379,7 @@ ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 		}
 	}
 	*ifpret = ifp;
-	return (ISC_R_SUCCESS);
+	return (result);

 cleanup_interface:
 	ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
@@ -964,7 +964,6 @@ isc_boolean_t
 ns_interfacemgr_listeningon(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr) {
 	isc_sockaddr_t *old;

-	old = ISC_LIST_HEAD(mgr->listenon);
 	for (old = ISC_LIST_HEAD(mgr->listenon);
 	     old != NULL;
 	     old = ISC_LIST_NEXT(old, link))
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,12 +15,13 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: logconf.c,v 1.42 2007/06/19 23:46:59 tbox Exp $ */
+/* $Id: logconf.c,v 1.42.560.3 2011/03/05 23:51:37 tbox Exp $ */

 /*! \file */

 #include <config.h>

+#include <isc/file.h>
 #include <isc/offset.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
@@ -130,7 +131,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
 	}

 	type = ISC_LOG_TONULL;
-	
+
 	if (fileobj != NULL) {
 		const cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
 		const cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
@@ -140,7 +141,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
 		isc_offset_t size = 0;

 		type = ISC_LOG_TOFILE;
-		
+
 		if (versionsobj != NULL && cfg_obj_isuint32(versionsobj))
 			versions = cfg_obj_asuint32(versionsobj);
 		if (versionsobj != NULL && cfg_obj_isstring(versionsobj) &&
@@ -219,26 +220,38 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {

 	if (result == ISC_R_SUCCESS && type == ISC_LOG_TOFILE) {
 		FILE *fp;
-		
-		/*
-		 * Test that the file can be opened, since isc_log_open()
-		 * can't effectively report failures when called in
-		 * isc_log_doit().
-		 */
-		result = isc_stdio_open(dest.file.name, "a", &fp);
-		if (result != ISC_R_SUCCESS)
-			isc_log_write(ns_g_lctx, CFG_LOGCATEGORY_CONFIG,
-				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "logging channel '%s' file '%s': %s",
-				      channelname, dest.file.name,
-				      isc_result_totext(result));
-		else
-			(void)isc_stdio_close(fp);

 		/*
-		 * Allow named to continue by returning success.
-		 */
-		result = ISC_R_SUCCESS;
+		 * Test to make sure that file is a plain file.
+		 * Fix defect #22771
+		*/
+		result = isc_file_isplainfile(dest.file.name);
+		if (result == ISC_R_SUCCESS ||
+		    result == ISC_R_FILENOTFOUND) {
+			/*
+			 * Test that the file can be opened, since
+			 * isc_log_open() can't effectively report
+			 * failures when called in
+			 * isc_log_doit().
+			 */
+			result = isc_stdio_open(dest.file.name, "a", &fp);
+			if (result != ISC_R_SUCCESS) {
+				syslog(LOG_ERR,
+					"isc_stdio_open '%s' failed: %s",
+					dest.file.name,
+					isc_result_totext(result));
+				fprintf(stderr,
+					"isc_stdio_open '%s' failed: %s",
+					dest.file.name,
+					isc_result_totext(result));
+			} else
+				(void)isc_stdio_close(fp);
+		} else {
+			syslog(LOG_ERR, "isc_file_isplainfile '%s' failed: %s",
+				dest.file.name, isc_result_totext(result));
+			fprintf(stderr, "isc_file_isplainfile '%s' failed: %s",
+				dest.file.name, isc_result_totext(result));
+		}
 	}

 	return (result);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: main.c,v 1.175.60.4 2010/09/15 12:10:53 marka Exp $ */
+/* $Id: main.c,v 1.175.60.7 2011/11/05 00:46:11 each Exp $ */

 /*! \file */

@@ -546,6 +546,7 @@ parse_command_line(int argc, char *argv[]) {

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
+	POST(argv);

 	if (argc > 0) {
 		usage();
@@ -776,6 +777,25 @@ setup(void) {
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
 		      ISC_LOG_NOTICE, "built with %s", ns_g_configargs);

+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
+		      "----------------------------------------------------");
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
+		      "BIND 9 is maintained by Internet Systems Consortium,");
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
+		      "Inc. (ISC), a non-profit 501(c)(3) public-benefit ");
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
+		      "corporation.  Support and training for BIND 9 are ");
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
+		      "available at https://www.isc.org/support");
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,
+		      ISC_LOG_NOTICE,
+		      "----------------------------------------------------");
+
 	dump_symboltable();

 	/*
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.conf.5,v 1.41.4.1 2010/05/15 02:41:59 tbox Exp $
+.\" $Id: named.conf.5,v 1.41.4.3 2011/11/08 01:39:35 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -252,8 +252,7 @@ options {
 	disable\-algorithms \fIstring\fR { \fIstring\fR; ... };
 	dnssec\-enable \fIboolean\fR;
 	dnssec\-validation \fIboolean\fR;
-	dnssec\-lookaside \fIstring\fR trust\-anchor \fIstring\fR;
-	dnssec\-lookaside ( \fIauto\fR | \fIdomain\fR trust\-anchor \fIdomain\fR );
+	dnssec\-lookaside ( \fIauto\fR | \fIno\fR | \fIdomain\fR trust\-anchor \fIdomain\fR );
 	dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
 	dnssec\-accept\-expired \fIboolean\fR;
 	empty\-server \fIstring\fR;
@@ -411,7 +410,7 @@ view \fIstring\fR \fIoptional_class\fR {
 	disable\-algorithms \fIstring\fR { \fIstring\fR; ... };
 	dnssec\-enable \fIboolean\fR;
 	dnssec\-validation \fIboolean\fR;
-	dnssec\-lookaside \fIstring\fR trust\-anchor \fIstring\fR;
+	dnssec\-lookaside ( \fIauto\fR | \fIno\fR | \fIdomain\fR trust\-anchor \fIdomain\fR );
 	dnssec\-must\-be\-secure \fIstring\fR \fIboolean\fR;
 	dnssec\-accept\-expired \fIboolean\fR;
 	empty\-server \fIstring\fR;
@@ -570,5 +569,5 @@ zone \fIstring\fR \fIoptional_class\fR {
 \fBrndc\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2011 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: named.conf.docbook,v 1.44.4.2 2010/05/14 23:49:18 tbox Exp $ -->
+<!-- $Id: named.conf.docbook,v 1.44.4.4 2011/11/07 23:46:02 tbox Exp $ -->
 <refentry>
  <refentryinfo>
    <date>Aug 13, 2004</date>
@@ -43,6 +43,7 @@
      <year>2008</year>
      <year>2009</year>
      <year>2010</year>
+      <year>2011</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -282,8 +283,7 @@ options {
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
 	dnssec-enable <replaceable>boolean</replaceable>;
 	dnssec-validation <replaceable>boolean</replaceable>;
-	dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
-	dnssec-lookaside ( <replaceable>auto</replaceable> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> );
+	dnssec-lookaside ( <replaceable>auto</replaceable> | <replaceable>no</replaceable> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> );
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
 	dnssec-accept-expired <replaceable>boolean</replaceable>;

@@ -458,7 +458,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>; ... };
 	dnssec-enable <replaceable>boolean</replaceable>;
 	dnssec-validation <replaceable>boolean</replaceable>;
-	dnssec-lookaside <replaceable>string</replaceable> trust-anchor <replaceable>string</replaceable>;
+	dnssec-lookaside ( <replaceable>auto</replaceable> | <replaceable>no</replaceable> | <replaceable>domain</replaceable> trust-anchor <replaceable>domain</replaceable> );
 	dnssec-must-be-secure <replaceable>string</replaceable> <replaceable>boolean</replaceable>;
 	dnssec-accept-expired <replaceable>boolean</replaceable>;

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.conf.html,v 1.50.4.1 2010/05/15 02:41:59 tbox Exp $ -->
+<!-- $Id: named.conf.html,v 1.50.4.3 2011/11/08 01:39:35 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543349"></a><h2>DESCRIPTION</h2>
+<a name="id2543352"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">named.conf</code> is the configuration file
      for
      <span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543377"></a><h2>ACL</h2>
+<a name="id2543380"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543393"></a><h2>KEY</h2>
+<a name="id2543396"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543412"></a><h2>MASTERS</h2>
+<a name="id2543415"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543458"></a><h2>SERVER</h2>
+<a name="id2543461"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -97,7 +97,7 @@ server
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543526"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2543529"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -105,7 +105,7 @@ trusted-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543552"></a><h2>MANAGED-KEYS</h2>
+<a name="id2543555"></a><h2>MANAGED-KEYS</h2>
 <div class="literallayout"><p><br>
 managed-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <code class="constant">initial-key</code> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -113,7 +113,7 @@ managed-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543580"></a><h2>CONTROLS</h2>
+<a name="id2543584"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -125,7 +125,7 @@ controls
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543616"></a><h2>LOGGING</h2>
+<a name="id2543619"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -143,7 +143,7 @@ logging
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543654"></a><h2>LWRES</h2>
+<a name="id2543657"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -156,7 +156,7 @@ lwres
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543696"></a><h2>OPTIONS</h2>
+<a name="id2543699"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -249,8 +249,7 @@ options
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
 	dnssec-enable <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-validation <em class="replaceable"><code>boolean</code></em>;<br>
-	dnssec-lookaside <em class="replaceable"><code>string</code></em> trust-anchor <em class="replaceable"><code>string</code></em>;<br>
-	dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> | <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> );<br>
+	dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> | <em class="replaceable"><code>no</code></em> | <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> );<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
@@ -424,7 +423,7 @@ view
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
 	dnssec-enable <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-validation <em class="replaceable"><code>boolean</code></em>;<br>
-	dnssec-lookaside <em class="replaceable"><code>string</code></em> trust-anchor <em class="replaceable"><code>string</code></em>;<br>
+	dnssec-lookaside ( <em class="replaceable"><code>auto</code></em> | <em class="replaceable"><code>no</code></em> | <em class="replaceable"><code>domain</code></em> trust-anchor <em class="replaceable"><code>domain</code></em> );<br>
 	dnssec-must-be-secure <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-accept-expired <em class="replaceable"><code>boolean</code></em>;<br>
 <br>
@@ -499,7 +498,7 @@ view
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545209"></a><h2>ZONE</h2>
+<a name="id2545216"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint |<br>
@@ -594,12 +593,12 @@ zone
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545521"></a><h2>FILES</h2>
+<a name="id2545595"></a><h2>FILES</h2>
 <p><code class="filename">/etc/named.conf</code>
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545601"></a><h2>SEE ALSO</h2>
+<a name="id2545607"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
      <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: query.c,v 1.335.8.11 2010/09/24 05:54:05 marka Exp $ */
+/* $Id: query.c,v 1.335.8.19 2011/11/16 09:53:21 marka Exp $ */

 /*! \file */

@@ -634,6 +634,7 @@ query_validatezonedb(ns_client_t *client, dns_name_t *name,
 	 */

 	check_acl = ISC_TRUE;	/* Keep compiler happy. */
+	POST(check_acl);	/* Keep another compiler happy. */
 	queryacl = NULL;

 	/*
@@ -1280,11 +1281,9 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			goto addname;
 		if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
-			/*
-			 * Negative cache entries don't have sigrdatasets.
-			 */
-			INSIST(sigrdataset == NULL ||
-			       ! dns_rdataset_isassociated(sigrdataset));
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
 		}
 		if (result == ISC_R_SUCCESS) {
 			mname = NULL;
@@ -1325,8 +1324,9 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 			goto addname;
 		if (result == DNS_R_NCACHENXRRSET) {
 			dns_rdataset_disassociate(rdataset);
-			INSIST(sigrdataset == NULL ||
-			       ! dns_rdataset_isassociated(sigrdataset));
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
 		}
 		if (result == ISC_R_SUCCESS) {
 			mname = NULL;
@@ -1511,6 +1511,7 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 	need_addname = ISC_FALSE;
 	zone = NULL;
 	needadditionalcache = ISC_FALSE;
+	POST(needadditionalcache);
 	additionaltype = dns_rdatasetadditional_fromauth;
 	dns_name_init(&cfname, NULL);

@@ -1775,10 +1776,8 @@ query_addadditional2(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 		goto setcache;
 	if (result == DNS_R_NCACHENXRRSET) {
 		dns_rdataset_disassociate(rdataset);
-		/*
-		 * Negative cache entries don't have sigrdatasets.
-		 */
-		INSIST(! dns_rdataset_isassociated(sigrdataset));
+		if (dns_rdataset_isassociated(sigrdataset))
+			dns_rdataset_disassociate(sigrdataset);
 	}
 	if (result == ISC_R_SUCCESS) {
 		/* Remember the result as a cache */
@@ -2909,8 +2908,9 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 				       sigrdataset, fname, ISC_TRUE, cname);
 		if (!dns_rdataset_isassociated(rdataset))
 			goto cleanup;
-		query_addrrset(client, &fname, &rdataset, &sigrdataset,
-			       dbuf, DNS_SECTION_AUTHORITY);
+		if (!ispositive)
+			query_addrrset(client, &fname, &rdataset, &sigrdataset,
+				       dbuf, DNS_SECTION_AUTHORITY);

 		/*
 		 * Replace resources which were consumed by query_addrrset.
@@ -4252,13 +4252,13 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}
 		goto cleanup;
 	case DNS_R_EMPTYNAME:
-		result = DNS_R_NXRRSET;
 		/* FALLTHROUGH */
 	case DNS_R_NXRRSET:
 		INSIST(is_zone);
 		/*
 		 * Look for a NSEC3 record if we don't have a NSEC record.
 		 */
+ nxrrset_rrsig:
 		if (!dns_rdataset_isassociated(rdataset) &&
 		     WANTDNSSEC(client)) {
 			if ((fname->attributes & DNS_NAMEATTR_WILDCARD) == 0) {
@@ -4386,6 +4386,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 */
 			query_releasename(client, &fname);
 		}
+
 		/*
 		 * Add SOA.  If the query was for a SOA record force the
 		 * ttl to zero so that it is possible for clients to find
@@ -4603,18 +4604,19 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			goto cleanup;
 		}
 		result = dns_name_concatenate(prefix, tname, fname, NULL);
+
+		/*
+		 * RFC2672, section 4.1, subsection 3c says
+		 * we should return YXDOMAIN if the constructed
+		 * name would be too long.
+		 */
+		if (result == DNS_R_NAMETOOLONG)
+			client->message->rcode = dns_rcode_yxdomain;
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(client->message, &tname);
-			if (result == ISC_R_NOSPACE) {
-				/*
-				 * RFC2672, section 4.1, subsection 3c says
-				 * we should return YXDOMAIN if the constructed
-				 * name would be too long.
-				 */
-				client->message->rcode = dns_rcode_yxdomain;
-			}
 			goto cleanup;
 		}
+
 		query_keepname(client, fname, dbuf);
 		/*
 		 * Synthesize a CNAME for this DNAME.
@@ -4780,66 +4782,40 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		if (fname != NULL)
 			dns_message_puttempname(client->message, &fname);

-		if (n == 0 && is_zone) {
+		if (n == 0) {
 			/*
-			 * We didn't match any rdatasets.
+			 * No matching rdatasets found in cache. If we were
+			 * searching for RRSIG/SIG, that's probably okay;
+			 * otherwise this is an error condition.
 			 */
 			if ((qtype == dns_rdatatype_rrsig ||
 			     qtype == dns_rdatatype_sig) &&
 			    result == ISC_R_NOMORE) {
-				/*
-				 * XXXRTH  If this is a secure zone and we
-				 * didn't find any SIGs, we should generate
-				 * an error unless we were searching for
-				 * glue.  Ugh.
-				 */
 				if (!is_zone) {
-					/*
-					 * Note: this is dead code because
-					 * is_zone is always true due to the
-					 * condition above.  But naive
-					 * recursion would cause infinite
-					 * attempts of recursion because
-					 * the answer to (RR)SIG queries
-					 * won't be cached.  Until we figure
-					 * out what we should do and implement
-					 * it we intentionally keep this code
-					 * dead.
-					 */
 					authoritative = ISC_FALSE;
 					dns_rdatasetiter_destroy(&rdsiter);
-					if (RECURSIONOK(client)) {
-						result = query_recurse(client,
-								       qtype,
-								       NULL,
-								       NULL,
-								       resuming);
-						if (result == ISC_R_SUCCESS)
-						    client->query.attributes |=
-							NS_QUERYATTR_RECURSING;
-						else
-						    RECURSE_ERROR(result);
-					}
+					client->attributes &= ~NS_CLIENTATTR_RA;
 					goto addauth;
 				}
-				/*
-				 * We were searching for SIG records in
-				 * a nonsecure zone.  Send a "no error,
-				 * no data" response.
-				 */
-				/*
-				 * Add SOA.
-				 */
-				result = query_addsoa(client, db, version,
-						      ISC_FALSE, ISC_FALSE);
-				if (result == ISC_R_SUCCESS)
-					result = ISC_R_NOMORE;
-			} else {
-				/*
-				 * Something went wrong.
-				 */
+
+				if (dns_db_issecure(db)) {
+					char namebuf[DNS_NAME_FORMATSIZE];
+					dns_name_format(client->query.qname,
+							namebuf,
+							sizeof(namebuf));
+					ns_client_log(client,
+						      DNS_LOGCATEGORY_DNSSEC,
+						      NS_LOGMODULE_QUERY,
+						      ISC_LOG_WARNING,
+						      "missing signature "
+						      "for %s", namebuf);
+				}
+
+				dns_rdatasetiter_destroy(&rdsiter);
+				fname = query_newname(client, dbuf, &b);
+				goto nxrrset_rrsig;
+			} else
 				result = DNS_R_SERVFAIL;
-			}
 		}
 		dns_rdatasetiter_destroy(&rdsiter);
 		if (result != ISC_R_NOMORE) {
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: server.c,v 1.556.8.35 2011/02/03 00:28:08 each Exp $ */
+/* $Id: server.c,v 1.556.8.46 2011/11/07 01:20:50 marka Exp $ */

 /*! \file */

@@ -205,13 +205,15 @@ struct zonelistentry {

 /*%
 * Configuration context to retain for each view that allows
- * new zones to be added at runtime
+ * new zones to be added at runtime.
 */
 struct cfg_context {
 	isc_mem_t *			mctx;
-	cfg_obj_t *			config;
 	cfg_parser_t *			parser;
-	cfg_aclconfctx_t		actx;
+	cfg_obj_t *			config;
+	cfg_parser_t *			nzparser;
+	cfg_obj_t *			nzconfig;
+	cfg_aclconfctx_t *		actx;
 };

 /*
@@ -221,7 +223,6 @@ static const struct {
 	const char	*zone;
 	isc_boolean_t	rfc1918;
 } empty_zones[] = {
-#ifdef notyet
 	/* RFC 1918 */
 	{ "10.IN-ADDR.ARPA", ISC_TRUE },
 	{ "16.172.IN-ADDR.ARPA", ISC_TRUE },
@@ -241,7 +242,6 @@ static const struct {
 	{ "30.172.IN-ADDR.ARPA", ISC_TRUE },
 	{ "31.172.IN-ADDR.ARPA", ISC_TRUE },
 	{ "168.192.IN-ADDR.ARPA", ISC_TRUE },
-#endif

 	/* RFC 5735 and RFC 5737 */
 	{ "0.IN-ADDR.ARPA", ISC_FALSE },	/* THIS NETWORK */
@@ -303,7 +303,7 @@ static void
 end_reserved_dispatches(ns_server_t *server, isc_boolean_t all);

 static void
-cfgctx_destroy(void **cfgp);
+newzone_cfgctx_destroy(void **cfgp);

 /*%
 * Configure a single view ACL at '*aclp'.  Get its configuration from
@@ -601,7 +601,8 @@ dstkey_fromconfig(const cfg_obj_t *vconfig, const cfg_obj_t *key,

 static isc_result_t
 load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
-	       dns_view_t *view, isc_boolean_t managed, isc_mem_t *mctx)
+	       dns_view_t *view, isc_boolean_t managed,
+	       dns_name_t *keyname, isc_mem_t *mctx)
 {
 	const cfg_listelt_t *elt, *elt2;
 	const cfg_obj_t *key, *keylist;
@@ -629,6 +630,16 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 			if (result != ISC_R_SUCCESS)
 				goto cleanup;

+			/*
+			 * If keyname was specified, we only add that key.
+			 */
+			if (keyname != NULL &&
+			    !dns_name_equal(keyname, dst_key_name(dstkey)))
+			{
+				dst_key_free(&dstkey);
+				continue;
+			}
+
 			CHECK(dns_keytable_add(secroots, managed, &dstkey));
 		}
 	}
@@ -729,19 +740,22 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,

 		if (builtin_keys != NULL)
 			CHECK(load_view_keys(builtin_keys, vconfig, view,
-					     ISC_FALSE, mctx));
+					     ISC_FALSE, view->dlv, mctx));
 		if (builtin_managed_keys != NULL)
 			CHECK(load_view_keys(builtin_managed_keys, vconfig,
-					     view, ISC_TRUE, mctx));
+					     view, ISC_TRUE, view->dlv, mctx));
 	}

-	CHECK(load_view_keys(view_keys, vconfig, view, ISC_FALSE, mctx));
-	CHECK(load_view_keys(view_managed_keys, vconfig, view, ISC_TRUE, mctx));
+	CHECK(load_view_keys(view_keys, vconfig, view, ISC_FALSE,
+			     NULL, mctx));
+	CHECK(load_view_keys(view_managed_keys, vconfig, view, ISC_TRUE,
+			     NULL, mctx));
+
 	if (view->rdclass == dns_rdataclass_in) {
 		CHECK(load_view_keys(global_keys, vconfig, view, ISC_FALSE,
-				     mctx));
+				     NULL, mctx));
 		CHECK(load_view_keys(global_managed_keys, vconfig, view,
-				     ISC_TRUE, mctx));
+				     ISC_TRUE, NULL, mctx));
 	}

 	/*
@@ -796,18 +810,13 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,
 			      int af, dns_dispatch_t **dispatchp,
 			      isc_boolean_t is_firstview)
 {
-	isc_result_t result;
+	isc_result_t result = ISC_R_FAILURE;
 	dns_dispatch_t *disp;
 	isc_sockaddr_t sa;
 	unsigned int attrs, attrmask;
 	const cfg_obj_t *obj = NULL;
 	unsigned int maxdispatchbuffers;

-	/*
-	 * Make compiler happy.
-	 */
-	result = ISC_R_FAILURE;
-
 	switch (af) {
 	case AF_INET:
 		result = ns_config_get(maps, "query-source", &obj);
@@ -1297,8 +1306,7 @@ cache_sharable(dns_view_t *originview, dns_view_t *view,
 * global defaults in 'config' used exclusively.
 */
 static isc_result_t
-configure_view(dns_view_t *view, cfg_parser_t* parser,
-	       cfg_obj_t *config, cfg_obj_t *vconfig,
+configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	       ns_cachelist_t *cachelist, const cfg_obj_t *bindkeys,
 	       isc_mem_t *mctx, cfg_aclconfctx_t *actx,
 	       isc_boolean_t need_hints)
@@ -1330,7 +1338,7 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 	isc_uint32_t lame_ttl;
 	dns_tsig_keyring_t *ring = NULL;
 	dns_view_t *pview = NULL;	/* Production view */
-	isc_mem_t *cmctx;
+	isc_mem_t *cmctx = NULL, *hmctx = NULL;
 	dns_dispatch_t *dispatch4 = NULL;
 	dns_dispatch_t *dispatch6 = NULL;
 	isc_boolean_t reused_cache = ISC_FALSE;
@@ -1354,13 +1362,10 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 	isc_boolean_t auto_dlv = ISC_FALSE;
 	ns_cache_t *nsc;
 	isc_boolean_t zero_no_soattl;
-	cfg_parser_t *newzones_parser = NULL;
-	cfg_obj_t *nzfconf = NULL;
+	struct cfg_context *nzctx;

 	REQUIRE(DNS_VIEW_VALID(view));

-	cmctx = NULL;
-
 	if (config != NULL)
 		(void)cfg_map_get(config, "options", &options);

@@ -1391,6 +1396,7 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 		sep = "";
 		viewname = "";
 		forview = "";
+		POST(forview);
 	}

 	/*
@@ -1462,6 +1468,10 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 		(void)cfg_map_get(voptions, "zone", &zonelist);
 	else
 		(void)cfg_map_get(config, "zone", &zonelist);
+
+	/*
+	 * Load zone configuration
+	 */
 	for (element = cfg_list_first(zonelist);
 	     element != NULL;
 	     element = cfg_list_next(element))
@@ -1471,58 +1481,29 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 				     actx, ISC_FALSE));
 	}

-	/*
-	 * Are we allowing zones to be added and deleted dynamically?
-	 */
-	obj = NULL;
-	result = ns_config_get(maps, "allow-new-zones", &obj);
-	if (result == ISC_R_SUCCESS) {
-		isc_boolean_t allow = cfg_obj_asboolean(obj);
-		struct cfg_context *cfg = NULL;
-		if (allow) {
-			cfg = isc_mem_get(view->mctx, sizeof(*cfg));
-			if (cfg == NULL) {
-				result = ISC_R_NOMEMORY;
-				goto cleanup;
-			}
-			memset(cfg, 0, sizeof(*cfg));
-			isc_mem_attach(view->mctx, &cfg->mctx);
-			if (config != NULL)
-				cfg_obj_attach(config, &cfg->config);
-			cfg_parser_attach(parser, &cfg->parser);
-			cfg_aclconfctx_clone(actx, &cfg->actx);
-		}
-		dns_view_setnewzones(view, allow, cfg, cfgctx_destroy);
-	}
-
 	/*
 	 * If we're allowing added zones, then load zone configuration
 	 * from the newzone file for zones that were added during previous
 	 * runs.
 	 */
-	if (view->new_zone_file != NULL) {
+	nzctx = view->new_zone_config;
+	if (nzctx != NULL && nzctx->nzconfig != NULL) {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "loading additional zones for view '%s'",
 			      view->name);

-		CHECK(cfg_parser_create(view->mctx, ns_g_lctx,
-					&newzones_parser));
-		result = cfg_parse_file(newzones_parser, view->new_zone_file,
-					&cfg_type_newzones, &nzfconf);
-		if (result == ISC_R_SUCCESS) {
-			zonelist = NULL;
-			cfg_map_get(nzfconf, "zone", &zonelist);
-			for (element = cfg_list_first(zonelist);
-			     element != NULL;
-			     element = cfg_list_next(element))
-			{
-				const cfg_obj_t *zconfig =
-					cfg_listelt_value(element);
-				CHECK(configure_zone(config, zconfig, vconfig,
-						     mctx, view, actx,
-						     ISC_TRUE));
-			}
+		zonelist = NULL;
+		cfg_map_get(nzctx->nzconfig, "zone", &zonelist);
+
+		for (element = cfg_list_first(zonelist);
+		     element != NULL;
+		     element = cfg_list_next(element))
+		{
+			const cfg_obj_t *zconfig = cfg_listelt_value(element);
+			CHECK(configure_zone(config, zconfig, vconfig,
+					     mctx, view, actx,
+					     ISC_TRUE));
 		}
 	}

@@ -1726,13 +1707,21 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 			 * view but is not yet configured.  If it is not the
 			 * view name but not a forward reference either, then it
 			 * is simply a named cache that is not shared.
+			 *
+			 * We use two separate memory contexts for the
+			 * cache, for the main cache memory and the heap
+			 * memory.
 			 */
 			CHECK(isc_mem_create(0, 0, &cmctx));
 			isc_mem_setname(cmctx, "cache", NULL);
-			CHECK(dns_cache_create2(cmctx, ns_g_taskmgr,
+			CHECK(isc_mem_create(0, 0, &hmctx));
+			isc_mem_setname(hmctx, "cache_heap", NULL);
+			CHECK(dns_cache_create3(cmctx, hmctx, ns_g_taskmgr,
 						ns_g_timermgr, view->rdclass,
 						cachename, "rbt", 0, NULL,
 						&cache));
+			isc_mem_detach(&cmctx);
+			isc_mem_detach(&hmctx);
 		}
 		nsc = isc_mem_get(mctx, sizeof(*nsc));
 		if (nsc == NULL) {
@@ -2227,14 +2216,19 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 	if (result == ISC_R_SUCCESS) {
 		/* If set to "auto", use the version from the defaults */
 		const cfg_obj_t *dlvobj;
+		const char *dom;
 		dlvobj = cfg_listelt_value(cfg_list_first(obj));
-		if (!strcmp(cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain")),
-			    "auto") &&
-		    cfg_obj_isvoid(cfg_tuple_get(dlvobj, "trust-anchor"))) {
-			auto_dlv = ISC_TRUE;
-			obj = NULL;
-			result = cfg_map_get(ns_g_defaults,
-					     "dnssec-lookaside", &obj);
+		dom = cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain"));
+		if (cfg_obj_isvoid(cfg_tuple_get(dlvobj, "trust-anchor"))) {
+			/* If "no", skip; if "auto", use global default */
+			if (!strcasecmp(dom, "no"))
+				result = ISC_R_NOTFOUND;
+			else if (!strcasecmp(dom, "auto")) {
+				auto_dlv = ISC_TRUE;
+				obj = NULL;
+				result = cfg_map_get(ns_g_defaults,
+						     "dnssec-lookaside", &obj);
+			}
 		}
 	}

@@ -2491,7 +2485,8 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 			CHECK(dns_zone_create(&zone, mctx));
 			CHECK(dns_zone_setorigin(zone, name));
 			dns_zone_setview(zone, view);
-			CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr, zone));
+			CHECK(dns_zonemgr_managezone(ns_g_server->zonemgr,
+						     zone));
 			dns_zone_setclass(zone, view->rdclass);
 			dns_zone_settype(zone, dns_zone_master);
 			dns_zone_setstats(zone, ns_g_server->zonestats);
@@ -2534,16 +2529,12 @@ configure_view(dns_view_t *view, cfg_parser_t* parser,
 		dns_order_detach(&order);
 	if (cmctx != NULL)
 		isc_mem_detach(&cmctx);
+	if (hmctx != NULL)
+		isc_mem_detach(&hmctx);

 	if (cache != NULL)
 		dns_cache_detach(&cache);

-	if (newzones_parser != NULL) {
-		if (nzfconf != NULL)
-			cfg_obj_destroy(newzones_parser, &nzfconf);
-		cfg_parser_destroy(&newzones_parser);
-	}
-
 	return (result);
 }

@@ -2748,21 +2739,16 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
 	return (result);
 }

-/*
- * Create a new view and add it to the list.
- *
- * If 'vconfig' is NULL, create the default view.
- *
- * The view created is attached to '*viewp'.
- */
 static isc_result_t
-create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
-	    dns_view_t **viewp)
+get_viewinfo(const cfg_obj_t *vconfig, const char **namep,
+	     dns_rdataclass_t *classp)
 {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	const char *viewname;
 	dns_rdataclass_t viewclass;
-	dns_view_t *view = NULL;
+
+	REQUIRE(namep != NULL && *namep == NULL);
+	REQUIRE(classp != NULL);

 	if (vconfig != NULL) {
 		const cfg_obj_t *classobj = NULL;
@@ -2775,6 +2761,59 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 		viewname = "_default";
 		viewclass = dns_rdataclass_in;
 	}
+
+	*namep = viewname;
+	*classp = viewclass;
+
+	return (result);
+}
+
+/*
+ * Find a view based on its configuration info and attach to it.
+ *
+ * If 'vconfig' is NULL, attach to the default view.
+ */
+static isc_result_t
+find_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
+	  dns_view_t **viewp)
+{
+	isc_result_t result;
+	const char *viewname = NULL;
+	dns_rdataclass_t viewclass;
+	dns_view_t *view = NULL;
+
+	result = get_viewinfo(vconfig, &viewname, &viewclass);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	*viewp = view;
+	return (ISC_R_SUCCESS);
+}
+
+/*
+ * Create a new view and add it to the list.
+ *
+ * If 'vconfig' is NULL, create the default view.
+ *
+ * The view created is attached to '*viewp'.
+ */
+static isc_result_t
+create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
+	    dns_view_t **viewp)
+{
+	isc_result_t result;
+	const char *viewname = NULL;
+	dns_rdataclass_t viewclass;
+	dns_view_t *view = NULL;
+
+	result = get_viewinfo(vconfig, &viewname, &viewclass);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
 	result = dns_viewlist_find(viewlist, viewname, viewclass, &view);
 	if (result == ISC_R_SUCCESS)
 		return (ISC_R_EXISTS);
@@ -3063,6 +3102,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {

 	if (pview != NULL && pview->managed_keys != NULL) {
 		dns_zone_attach(pview->managed_keys, &view->managed_keys);
+		dns_zone_setview(pview->managed_keys, view);
 		dns_view_detach(&pview);
 		return (ISC_R_SUCCESS);
 	}
@@ -3731,11 +3771,99 @@ configure_session_key(const cfg_obj_t **maps, ns_server_t *server,
 	return (result);
 }

+static isc_result_t
+setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
+	       cfg_parser_t *parser, cfg_aclconfctx_t *actx)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_boolean_t allow = ISC_FALSE;
+	struct cfg_context *nzcfg = NULL;
+	cfg_parser_t *nzparser = NULL;
+	cfg_obj_t *nzconfig = NULL;
+	const cfg_obj_t *maps[4];
+	const cfg_obj_t *options = NULL, *voptions = NULL;
+	const cfg_obj_t *nz = NULL;
+	int i = 0;
+
+	REQUIRE (config != NULL);
+
+	if (vconfig != NULL)
+		voptions = cfg_tuple_get(vconfig, "options");
+	if (voptions != NULL)
+		maps[i++] = voptions;
+	result = cfg_map_get(config, "options", &options);
+	if (result == ISC_R_SUCCESS)
+		maps[i++] = options;
+	maps[i++] = ns_g_defaults;
+	maps[i] = NULL;
+
+	result = ns_config_get(maps, "allow-new-zones", &nz);
+	if (result == ISC_R_SUCCESS)
+		allow = cfg_obj_asboolean(nz);
+
+	if (!allow) {
+		dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
+		return (ISC_R_SUCCESS);
+	}
+
+	nzcfg = isc_mem_get(view->mctx, sizeof(*nzcfg));
+	if (nzcfg == NULL) {
+		dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
+		return (ISC_R_NOMEMORY);
+	}
+
+	dns_view_setnewzones(view, allow, nzcfg, newzone_cfgctx_destroy);
+
+	memset(nzcfg, 0, sizeof(*nzcfg));
+	isc_mem_attach(view->mctx, &nzcfg->mctx);
+	cfg_obj_attach(config, &nzcfg->config);
+	cfg_parser_attach(parser, &nzcfg->parser);
+	cfg_aclconfctx_attach(actx, &nzcfg->actx);
+
+	/*
+	 * Attempt to create a parser and parse the newzones
+	 * file.  If successful, preserve both; otherwise leave
+	 * them NULL.
+	 */
+	result = cfg_parser_create(view->mctx, ns_g_lctx, &nzparser);
+	if (result == ISC_R_SUCCESS)
+		result = cfg_parse_file(nzparser, view->new_zone_file,
+					&cfg_type_newzones, &nzconfig);
+	if (result == ISC_R_SUCCESS) {
+		cfg_parser_attach(nzparser, &nzcfg->nzparser);
+		cfg_obj_attach(nzconfig, &nzcfg->nzconfig);
+	}
+
+	if (nzparser != NULL) {
+		if (nzconfig != NULL)
+			cfg_obj_destroy(nzparser, &nzconfig);
+		cfg_parser_destroy(&nzparser);
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static int
+count_zones(const cfg_obj_t *conf) {
+	const cfg_obj_t *zonelist = NULL;
+	const cfg_listelt_t *element;
+	int n = 0;
+
+	REQUIRE(conf != NULL);
+
+	cfg_map_get(conf, "zone", &zonelist);
+	for (element = cfg_list_first(zonelist);
+	     element != NULL;
+	     element = cfg_list_next(element))
+		n++;
+
+	return (n);
+}
+
 static isc_result_t
 load_configuration(const char *filename, ns_server_t *server,
 		   isc_boolean_t first_time)
 {
-	cfg_aclconfctx_t aclconfctx;
 	cfg_obj_t *config = NULL, *bindkeys = NULL;
 	cfg_parser_t *conf_parser = NULL, *bindkeys_parser = NULL;
 	const cfg_listelt_t *element;
@@ -3763,15 +3891,18 @@ load_configuration(const char *filename, ns_server_t *server,
 	ns_cachelist_t cachelist, tmpcachelist;
 	unsigned int maxsocks;
 	ns_cache_t *nsc;
+	struct cfg_context *nzctx;
+	int num_zones = 0;
+	isc_boolean_t exclusive = ISC_FALSE;

-	cfg_aclconfctx_init(&aclconfctx);
 	ISC_LIST_INIT(viewlist);
 	ISC_LIST_INIT(builtin_viewlist);
 	ISC_LIST_INIT(cachelist);

-	/* Ensure exclusive access to configuration data. */
-	result = isc_task_beginexclusive(server->task);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	/* Create the ACL configuration context */
+	if (ns_g_aclconfctx != NULL)
+		cfg_aclconfctx_detach(&ns_g_aclconfctx);
+	CHECK(cfg_aclconfctx_create(ns_g_mctx, &ns_g_aclconfctx));

 	/*
 	 * Parse the global default pseudo-config file.
@@ -3836,7 +3967,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	if (result == ISC_R_SUCCESS)
 		maps[i++] = options;
 	maps[i++] = ns_g_defaults;
-	maps[i++] = NULL;
+	maps[i] = NULL;

 	/*
 	 * If bind.keys exists, load it.  If "dnssec-lookaside auto"
@@ -3863,6 +3994,13 @@ load_configuration(const char *filename, ns_server_t *server,
 		CHECK(result);
 	}

+	/* Ensure exclusive access to configuration data. */
+	if (!exclusive) {
+		result = isc_task_beginexclusive(server->task);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		exclusive = ISC_TRUE;
+	}
+
 	/*
 	 * Set process limits, which (usually) needs to be done as root.
 	 */
@@ -3923,8 +4061,9 @@ load_configuration(const char *filename, ns_server_t *server,
 	else
 		isc_quota_soft(&server->recursionquota, 0);

-	CHECK(configure_view_acl(NULL, config, "blackhole", NULL, &aclconfctx,
-				 ns_g_mctx, &server->blackholeacl));
+	CHECK(configure_view_acl(NULL, config, "blackhole", NULL,
+				 ns_g_aclconfctx, ns_g_mctx,
+				 &server->blackholeacl));
 	if (server->blackholeacl != NULL)
 		dns_dispatchmgr_setblackhole(ns_g_dispatchmgr,
 					     server->blackholeacl);
@@ -3934,7 +4073,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	server->aclenv.match_mapped = cfg_obj_asboolean(obj);

-	CHECKM(ns_statschannels_configure(ns_g_server, config, &aclconfctx),
+	CHECKM(ns_statschannels_configure(ns_g_server, config, ns_g_aclconfctx),
 	       "configuring statistics server(s)");

 	/*
@@ -4062,11 +4201,10 @@ load_configuration(const char *filename, ns_server_t *server,
 		if (options != NULL)
 			(void)cfg_map_get(options, "listen-on", &clistenon);
 		if (clistenon != NULL) {
-			result = ns_listenlist_fromconfig(clistenon,
-							  config,
-							  &aclconfctx,
-							  ns_g_mctx,
-							  &listenon);
+			/* check return code? */
+			(void)ns_listenlist_fromconfig(clistenon, config,
+						       ns_g_aclconfctx,
+						       ns_g_mctx, &listenon);
 		} else if (!ns_g_lwresdonly) {
 			/*
 			 * Not specified, use default.
@@ -4090,11 +4228,10 @@ load_configuration(const char *filename, ns_server_t *server,
 		if (options != NULL)
 			(void)cfg_map_get(options, "listen-on-v6", &clistenon);
 		if (clistenon != NULL) {
-			result = ns_listenlist_fromconfig(clistenon,
-							  config,
-							  &aclconfctx,
-							  ns_g_mctx,
-							  &listenon);
+			/* check return code? */
+			(void)ns_listenlist_fromconfig(clistenon, config,
+						       ns_g_aclconfctx,
+						       ns_g_mctx, &listenon);
 		} else if (!ns_g_lwresdonly) {
 			isc_boolean_t enable;
 			/*
@@ -4187,25 +4324,87 @@ load_configuration(const char *filename, ns_server_t *server,
 	 */
 	(void)configure_session_key(maps, server, ns_g_mctx);

-	/*
-	 * Configure and freeze all explicit views.  Explicit
-	 * views that have zones were already created at parsing
-	 * time, but views with no zones must be created here.
-	 */
 	views = NULL;
 	(void)cfg_map_get(config, "view", &views);
+
+	/*
+	 * Create the views and count all the configured zones in
+	 * order to correctly size the zone manager's task table.
+	 * (We only count zones for configured views; the built-in
+	 * "bind" view can be ignored as it only adds a negligible
+	 * number of zones.)
+	 *
+	 * If we're allowing new zones, we need to be able to find the
+	 * new zone file and count those as well.  So we setup the new
+	 * zone configuration context, but otherwise view configuration
+	 * waits until after the zone manager's task list has been sized.
+	 */
 	for (element = cfg_list_first(views);
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *vconfig = cfg_listelt_value(element);
+		const cfg_obj_t *voptions = cfg_tuple_get(vconfig, "options");
 		view = NULL;

 		CHECK(create_view(vconfig, &viewlist, &view));
 		INSIST(view != NULL);
-		CHECK(configure_view(view, conf_parser, config, vconfig,
-				     &cachelist, bindkeys,
-				     ns_g_mctx, &aclconfctx, ISC_TRUE));
+
+		num_zones += count_zones(voptions);
+		CHECK(setup_newzones(view, config, vconfig, conf_parser,
+				     ns_g_aclconfctx));
+
+		nzctx = view->new_zone_config;
+		if (nzctx != NULL && nzctx->nzconfig != NULL)
+			num_zones += count_zones(nzctx->nzconfig);
+
+		dns_view_detach(&view);
+	}
+
+	/*
+	 * If there were no explicit views then we do the default
+	 * view here.
+	 */
+	if (views == NULL) {
+		CHECK(create_view(NULL, &viewlist, &view));
+		INSIST(view != NULL);
+
+		num_zones = count_zones(config);
+
+		CHECK(setup_newzones(view, config, NULL,  conf_parser,
+				     ns_g_aclconfctx));
+
+		nzctx = view->new_zone_config;
+		if (nzctx != NULL && nzctx->nzconfig != NULL)
+			num_zones += count_zones(nzctx->nzconfig);
+
+		dns_view_detach(&view);
+	}
+
+	/*
+	 * Zones have been counted; set the zone manager task pool size.
+	 */
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "sizing zone task pool based on %d zones", num_zones);
+	CHECK(dns_zonemgr_setsize(ns_g_server->zonemgr, num_zones));
+
+	/*
+	 * Configure and freeze all explicit views.  Explicit
+	 * views that have zones were already created at parsing
+	 * time, but views with no zones must be created here.
+	 */
+	for (element = cfg_list_first(views);
+	     element != NULL;
+	     element = cfg_list_next(element))
+	{
+		cfg_obj_t *vconfig = cfg_listelt_value(element);
+
+		view = NULL;
+		CHECK(find_view(vconfig, &viewlist, &view));
+		CHECK(configure_view(view, config, vconfig,
+				     &cachelist, bindkeys, ns_g_mctx,
+				     ns_g_aclconfctx, ISC_TRUE));
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 	}
@@ -4215,16 +4414,11 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * were no explicit views.
 	 */
 	if (views == NULL) {
-		/*
-		 * No explicit views; there ought to be a default view.
-		 * There may already be one created as a side effect
-		 * of zone statements, or we may have to create one.
-		 * In either case, we need to configure and freeze it.
-		 */
-		CHECK(create_view(NULL, &viewlist, &view));
-		CHECK(configure_view(view, conf_parser, config, NULL,
+		view = NULL;
+		CHECK(find_view(NULL, &viewlist, &view));
+		CHECK(configure_view(view, config, NULL,
 				     &cachelist, bindkeys,
-				     ns_g_mctx, &aclconfctx, ISC_TRUE));
+				     ns_g_mctx, ns_g_aclconfctx, ISC_TRUE));
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 	}
@@ -4242,9 +4436,9 @@ load_configuration(const char *filename, ns_server_t *server,
 		cfg_obj_t *vconfig = cfg_listelt_value(element);

 		CHECK(create_view(vconfig, &builtin_viewlist, &view));
-		CHECK(configure_view(view, conf_parser, config, vconfig,
+		CHECK(configure_view(view, config, vconfig,
 				     &cachelist, bindkeys,
-				     ns_g_mctx, &aclconfctx, ISC_FALSE));
+				     ns_g_mctx, ns_g_aclconfctx, ISC_FALSE));
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 		view = NULL;
@@ -4285,7 +4479,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * Bind the control port(s).
 	 */
 	CHECKM(ns_controls_configure(ns_g_server->controls, config,
-				     &aclconfctx),
+				     ns_g_aclconfctx),
 	       "binding control channel(s)");

 	/*
@@ -4527,8 +4721,6 @@ load_configuration(const char *filename, ns_server_t *server,
 	if (v6portset != NULL)
 		isc_portset_destroy(ns_g_mctx, &v6portset);

-	cfg_aclconfctx_clear(&aclconfctx);
-
 	if (conf_parser != NULL) {
 		if (config != NULL)
 			cfg_obj_destroy(conf_parser, &config);
@@ -4576,7 +4768,8 @@ load_configuration(const char *filename, ns_server_t *server,
 		adjust_interfaces(server, ns_g_mctx);

 	/* Relinquish exclusive access to configuration data. */
-	isc_task_endexclusive(server->task);
+	if (exclusive)
+		isc_task_endexclusive(server->task);

 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
 		      ISC_LOG_DEBUG(1), "load_configuration: %s",
@@ -4735,6 +4928,9 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	end_reserved_dispatches(server, ISC_TRUE);
 	cleanup_session_key(server, server->mctx);

+	if (ns_g_aclconfctx != NULL)
+		cfg_aclconfctx_detach(&ns_g_aclconfctx);
+
 	cfg_obj_destroy(ns_g_parser, &ns_g_config);
 	cfg_parser_destroy(&ns_g_parser);

@@ -4786,8 +4982,8 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 void
 ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	isc_result_t result;
-
 	ns_server_t *server = isc_mem_get(mctx, sizeof(*server));
+
 	if (server == NULL)
 		fatal("allocating server object", ISC_R_NOMEMORY);

@@ -4860,6 +5056,8 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	CHECKFATAL(dns_zonemgr_create(ns_g_mctx, ns_g_taskmgr, ns_g_timermgr,
 				      ns_g_socketmgr, &server->zonemgr),
 		   "dns_zonemgr_create");
+	CHECKFATAL(dns_zonemgr_setsize(server->zonemgr, 1000),
+		   "dns_zonemgr_setsize");

 	server->statsfile = isc_mem_strdup(server->mctx, "named.stats");
 	CHECKFATAL(server->statsfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
@@ -4969,7 +5167,8 @@ ns_server_destroy(ns_server_t **serverp) {
 	if (server->server_id != NULL)
 		isc_mem_free(server->mctx, server->server_id);

-	dns_zonemgr_detach(&server->zonemgr);
+	if (server->zonemgr != NULL)
+		dns_zonemgr_detach(&server->zonemgr);

 	if (server->tkeyctx != NULL)
 		dns_tkeyctx_destroy(&server->tkeyctx);
@@ -5533,7 +5732,6 @@ ns_server_dumpstats(ns_server_t *server) {
 		"could not open statistics dump file", server->statsfile);

 	result = ns_stats_dump(server, fp);
-	CHECK(result);

 cleanup:
 	if (fp != NULL)
@@ -5721,6 +5919,7 @@ dumpdone(void *arg, isc_result_t result) {
 				fprintf(dctx->fp, "; %s\n",
 					dns_result_totext(result));
 				result = ISC_R_SUCCESS;
+				POST(result);
 				goto nextzone;
 			}
 			if (result != ISC_R_SUCCESS)
@@ -5846,28 +6045,29 @@ ns_server_dumpsecroots(ns_server_t *server, char *args) {
 	isc_time_formattimestamp(&now, tbuf, sizeof(tbuf));
 	fprintf(fp, "%s\n", tbuf);

- nextview:
-	for (view = ISC_LIST_HEAD(server->viewlist);
-	     view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
-		if (ptr != NULL && strcmp(view->name, ptr) != 0)
-			continue;
-		if (secroots != NULL)
-			dns_keytable_detach(&secroots);
-		result = dns_view_getsecroots(view, &secroots);
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_SUCCESS;
-			continue;
+	do {
+		for (view = ISC_LIST_HEAD(server->viewlist);
+		     view != NULL;
+		     view = ISC_LIST_NEXT(view, link))
+		{
+			if (ptr != NULL && strcmp(view->name, ptr) != 0)
+				continue;
+			if (secroots != NULL)
+				dns_keytable_detach(&secroots);
+			result = dns_view_getsecroots(view, &secroots);
+			if (result == ISC_R_NOTFOUND) {
+				result = ISC_R_SUCCESS;
+				continue;
+			}
+			fprintf(fp, "\n Start view %s\n\n", view->name);
+			result = dns_keytable_dump(secroots, fp);
+			if (result != ISC_R_SUCCESS)
+				fprintf(fp, " dumpsecroots failed: %s\n",
+					isc_result_totext(result));
 		}
-		fprintf(fp, "\n Start view %s\n\n", view->name);
-		CHECK(dns_keytable_dump(secroots, fp));
-	}
-	if (ptr != NULL) {
-		ptr = next_token(&args, " \t");
 		if (ptr != NULL)
-			goto nextview;
-	}
+			ptr = next_token(&args, " \t");
+	} while (ptr != NULL);

 cleanup:
 	if (secroots != NULL)
@@ -6772,13 +6972,14 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	CHECK(isc_stdio_open(view->new_zone_file, "a", &fp));

 	/* Mark view unfrozen so that zone can be added */
+	isc_task_beginexclusive(server->task);
 	dns_view_thaw(view);
 	result = configure_zone(cfg->config, parms, vconfig,
-				server->mctx, view, &cfg->actx, ISC_FALSE);
+				server->mctx, view, cfg->actx, ISC_FALSE);
 	dns_view_freeze(view);
-	if (result != ISC_R_SUCCESS) {
+	isc_task_endexclusive(server->task);
+	if (result != ISC_R_SUCCESS)
 		goto cleanup;
-	}

 	/* Is it there yet? */
 	CHECK(dns_zt_find(view->zonetable, &dnsname, 0, NULL, &zone));
@@ -7023,23 +7224,27 @@ ns_server_del_zone(ns_server_t *server, char *args) {
 }

 static void
-cfgctx_destroy(void **cfgp) {
+newzone_cfgctx_destroy(void **cfgp) {
 	struct cfg_context *cfg;
-	isc_mem_t *mctx;

 	REQUIRE(cfgp != NULL && *cfgp != NULL);
+
 	cfg = *cfgp;
-	mctx = cfg->mctx;
-	cfg->mctx = NULL;
+
+	if (cfg->actx != NULL)
+		cfg_aclconfctx_detach(&cfg->actx);

 	if (cfg->parser != NULL) {
 		if (cfg->config != NULL)
 			cfg_obj_destroy(cfg->parser, &cfg->config);
 		cfg_parser_destroy(&cfg->parser);
 	}
-	cfg_aclconfctx_clear(&cfg->actx);
+	if (cfg->nzparser != NULL) {
+		if (cfg->nzconfig != NULL)
+			cfg_obj_destroy(cfg->nzparser, &cfg->nzconfig);
+		cfg_parser_destroy(&cfg->nzparser);
+	}

-	isc_mem_put(mctx, cfg, sizeof(*cfg));
-	isc_mem_detach(&mctx);
+	isc_mem_putanddetach(&cfg->mctx, cfg, sizeof(*cfg));
 	*cfgp = NULL;
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: statschannel.c,v 1.24.40.2 2010/02/04 23:48:30 tbox Exp $ */
+/* $Id: statschannel.c,v 1.24.40.4 2011/03/12 04:58:24 tbox Exp $ */

 /*! \file */

@@ -638,7 +638,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {

 static void
 opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
-	FILE *fp = arg;
+	FILE *fp;
 	isc_buffer_t b;
 	char codebuf[64];
 	stats_dumparg_t *dumparg = arg;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: os.c,v 1.101 2009/08/13 07:04:38 marka Exp $ */
+/* $Id: os.c,v 1.101.110.3 2011/03/02 00:05:11 marka Exp $ */

 /*! \file */

@@ -790,6 +790,9 @@ ns_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {
 	free(f);

 	if (switch_user && runas_pw != NULL) {
+#ifndef HAVE_LINUXTHREADS
+		gid_t oldgid = getgid();
+#endif
 		/* Set UID/GID to the one we'll be running with eventually */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);

@@ -797,7 +800,7 @@ ns_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {

 #ifndef HAVE_LINUXTHREADS
 		/* Restore UID/GID to root */
-		setperms(0, 0);
+		setperms(0, oldgid);
 #endif /* HAVE_LINUXTHREADS */

 		if (fd == -1) {
@@ -950,7 +953,7 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
 		     isc_buffer_availablelength(text),
 		     "pid: %ld", (long)pid);
 	/* Only send a message if it is complete. */
-	if (n < isc_buffer_availablelength(text))
+	if (n > 0 && n < isc_buffer_availablelength(text))
 		isc_buffer_add(text, n);
 }

@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: update.c,v 1.176.4.11 2011/02/03 12:17:22 tbox Exp $ */
+/* $Id: update.c,v 1.176.4.16 2011/11/03 02:56:17 each Exp $ */

 #include <config.h>

@@ -1501,8 +1501,6 @@ check_soa_increment(dns_db_t *db, dns_dbversion_t *ver,
 * Incremental updating of NSECs and RRSIGs.
 */

-#define MAXZONEKEYS 32	/*%< Maximum number of zone keys supported. */
-
 /*%
 * We abuse the dns_diff_t type to represent a set of domain names
 * affected by the update.
@@ -1687,7 +1685,7 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 {
 	isc_result_t result;
 	dns_dbiterator_t *dbit = NULL;
-	isc_boolean_t has_nsec;
+	isc_boolean_t has_nsec = ISC_FALSE;
 	unsigned int wraps = 0;
 	isc_boolean_t secure = dns_db_issecure(db);

@@ -2126,7 +2124,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	dns_diff_t nsec_diff;
 	dns_diff_t nsec_mindiff;
 	isc_boolean_t flag, build_nsec, build_nsec3;
-	dst_key_t *zone_keys[MAXZONEKEYS];
+	dst_key_t *zone_keys[DNS_MAXZONEKEYS];
 	unsigned int nkeys = 0;
 	unsigned int i;
 	isc_stdtime_t now, inception, expire;
@@ -2149,7 +2147,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	dns_diff_init(client->mctx, &nsec_mindiff);

 	result = find_zone_keys(zone, db, newver, client->mctx,
-				MAXZONEKEYS, zone_keys, &nkeys);
+				DNS_MAXZONEKEYS, zone_keys, &nkeys);
 	if (result != ISC_R_SUCCESS) {
 		update_log(client, zone, ISC_LOG_ERROR,
 			   "could not get zone keys for secure dynamic update");
@@ -2390,7 +2388,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 								   name, diff));
 			}
 			CHECK(add_exposed_sigs(client, zone, db, newver, name,
-					       cut, diff, zone_keys, nkeys,
+					       cut, &sig_diff, zone_keys, nkeys,
 					       inception, expire, check_ksk,
 					       keyset_kskonly));
 		}
@@ -2549,7 +2547,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 						   privatetype, &nsec_diff));
 		} else {
 			CHECK(add_exposed_sigs(client, zone, db, newver, name,
-					       cut, diff, zone_keys, nkeys,
+					       cut, &sig_diff, zone_keys, nkeys,
 					       inception, expire, check_ksk,
 					       keyset_kskonly));
 			CHECK(dns_nsec3_addnsec3sx(db, newver, name, nsecttl,
@@ -3728,7 +3726,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	 * Check Requestor's Permissions.  It seems a bit silly to do this
 	 * only after prerequisite testing, but that is what RFC2136 says.
 	 */
-	result = ISC_R_SUCCESS;
 	if (ssutable == NULL)
 		CHECK(checkupdateacl(client, dns_zone_getupdateacl(zone),
 				     "update", zonename, ISC_FALSE, ISC_FALSE));
@@ -4461,6 +4458,12 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 	ns_client_t *evclient;

+	/*
+	 * This may take some time so replace this client.
+	 */
+	if (!client->mortal && (client->attributes & NS_CLIENTATTR_TCP) == 0)
+		CHECK(ns_client_replace(client));
+
 	event = (update_event_t *)
 		isc_event_allocate(client->mctx, client, DNS_EVENT_UPDATE,
 				   forward_action, NULL, sizeof(*event));
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: xfrout.c,v 1.136.132.2 2010/05/27 23:49:54 tbox Exp $ */
+/* $Id: xfrout.c,v 1.136.132.5 2011/12/01 01:03:07 marka Exp $ */

 #include <config.h>

@@ -1084,9 +1084,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {

 	CHECK(xfr->stream->methods->first(xfr->stream));

-	if (xfr->tsigkey != NULL) {
+	if (xfr->tsigkey != NULL)
 		dns_name_format(&xfr->tsigkey->name, keyname, sizeof(keyname));
-	} else
+	else
 		keyname[0] = '\0';
 	if (is_poll)
 		xfrout_log1(client, question_name, question_class,
@@ -1156,7 +1156,8 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	xfr = isc_mem_get(mctx, sizeof(*xfr));
 	if (xfr == NULL)
 		return (ISC_R_NOMEMORY);
-	xfr->mctx = mctx;
+	xfr->mctx = NULL;
+	isc_mem_attach(mctx, &xfr->mctx);
 	xfr->client = NULL;
 	ns_client_attach(client, &xfr->client);
 	xfr->id = id;
@@ -1305,6 +1306,13 @@ sendstream(xfrout_ctx_t *xfr) {
 		if (xfr->lasttsig != NULL)
 			isc_buffer_free(&xfr->lasttsig);

+		/*
+		 * Account for reserved space.
+		 */
+		if (xfr->tsigkey != NULL)
+			INSIST(msg->reserved != 0U);
+		isc_buffer_add(&xfr->buf, msg->reserved);
+
 		/*
 		 * Include a question section in the first message only.
 		 * BIND 8.2.1 will not recognize an IXFR if it does not
@@ -1343,9 +1351,13 @@ sendstream(xfrout_ctx_t *xfr) {
 			ISC_LIST_APPEND(qname->list, qrdataset, link);

 			dns_message_addname(msg, qname, DNS_SECTION_QUESTION);
-		}
-		else
+		} else {
+			/*
+			 * Reserve space for the 12-byte message header
+			 */
+			isc_buffer_add(&xfr->buf, 12);
 			msg->tcp_continuation = 1;
+		}
 	}

 	/*
@@ -1530,6 +1542,7 @@ sendstream(xfrout_ctx_t *xfr) {
 static void
 xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
 	xfrout_ctx_t *xfr = *xfrp;
+	ns_client_t *client = NULL;

 	INSIST(xfr->sends == 0);

@@ -1553,9 +1566,14 @@ xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
 	if (xfr->db != NULL)
 		dns_db_detach(&xfr->db);

+	/*
+	 * We want to detch the client after we have released the memory
+	 * context as ns_client_detach checks the memory reference count.
+	 */
+	ns_client_attach(xfr->client, &client);
 	ns_client_detach(&xfr->client);
-
-	isc_mem_put(xfr->mctx, xfr, sizeof(*xfr));
+	isc_mem_putanddetach(&xfr->mctx, xfr, sizeof(*xfr));
+	ns_client_detach(&client);

 	*xfrp = NULL;
 }
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: zoneconf.c,v 1.161.4.4 2010/09/15 03:36:41 marka Exp $ */
+/* $Id: zoneconf.c,v 1.161.4.8 2011/05/23 20:55:23 each Exp $ */

 /*% */

@@ -121,7 +121,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	/* First check to see if ACL is defined within the zone */
 	if (zconfig != NULL) {
 		maps[0] = cfg_tuple_get(zconfig, "options");
-		ns_config_get(maps, aclname, &aclobj);
+		(void)ns_config_get(maps, aclname, &aclobj);
 		if (aclobj != NULL) {
 			aclp = NULL;
 			goto parse_acl;
@@ -149,7 +149,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	maps[i++] = ns_g_defaults;
 	maps[i] = NULL;

-	result = ns_config_get(maps, aclname, &aclobj);
+	(void)ns_config_get(maps, aclname, &aclobj);
 	if (aclobj == NULL) {
 		(*clearzacl)(zone);
 		return (ISC_R_SUCCESS);
@@ -389,7 +389,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {
 	isc_result_t result;

 	result = cfg_map_get(map, "type", &obj);
-	INSIST(result == ISC_R_SUCCESS);
+	INSIST(result == ISC_R_SUCCESS && obj != NULL);
 	return (ns_config_getzonetype(obj));
 }

@@ -453,7 +453,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 		INSIST(0);
 	}
 	result = ns_checknames_get(maps, zone, objp);
-	INSIST(result == ISC_R_SUCCESS);
+	INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
 }

 isc_result_t
@@ -507,7 +507,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			maps[i++] = options;
 	}
 	maps[i++] = ns_g_defaults;
-	maps[i++] = NULL;
+	maps[i] = NULL;

 	if (vconfig != NULL)
 		RETERR(ns_config_getclass(cfg_tuple_get(vconfig, "class"),
@@ -609,7 +609,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 	obj = NULL;
 	result = ns_config_get(maps, "dialup", &obj);
-	INSIST(result == ISC_R_SUCCESS);
+	INSIST(result == ISC_R_SUCCESS && obj != NULL);
 	if (cfg_obj_isboolean(obj)) {
 		if (cfg_obj_asboolean(obj))
 			dialup = dns_dialuptype_yes;
@@ -632,7 +632,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 	obj = NULL;
 	result = ns_config_get(maps, "zone-statistics", &obj);
-	INSIST(result == ISC_R_SUCCESS);
+	INSIST(result == ISC_R_SUCCESS && obj != NULL);
 	zonestats_on = cfg_obj_asboolean(obj);
 	zoneqrystats = NULL;
 	if (zonestats_on) {
@@ -651,7 +651,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype != dns_zone_stub) {
 		obj = NULL;
 		result = ns_config_get(maps, "notify", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (cfg_obj_isboolean(obj)) {
 			if (cfg_obj_asboolean(obj))
 				notifytype = dns_notifytype_yes;
@@ -687,19 +687,19 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "notify-source", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));
 		ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "notify-source-v6", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));
 		ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "notify-to-soa", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
 				   cfg_obj_asboolean(obj));

@@ -712,17 +712,17 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "max-transfer-time-out", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setmaxxfrout(zone, cfg_obj_asuint32(obj) * 60);

 		obj = NULL;
 		result = ns_config_get(maps, "max-transfer-idle-out", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setidleout(zone, cfg_obj_asuint32(obj) * 60);

 		obj = NULL;
 		result =  ns_config_get(maps, "max-journal-size", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setjournalsize(zone, -1);
 		if (cfg_obj_isstring(obj)) {
 			const char *str = cfg_obj_asstring(obj);
@@ -746,13 +746,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "ixfr-from-differences", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (cfg_obj_isboolean(obj))
 			ixfrdiff = cfg_obj_asboolean(obj);
-		else if (strcasecmp(cfg_obj_asstring(obj), "master") &&
+		else if (!strcasecmp(cfg_obj_asstring(obj), "master") &&
 			 ztype == dns_zone_master)
 			ixfrdiff = ISC_TRUE;
-		else if (strcasecmp(cfg_obj_asstring(obj), "slave") &&
+		else if (!strcasecmp(cfg_obj_asstring(obj), "slave") &&
 			ztype == dns_zone_slave)
 			ixfrdiff = ISC_TRUE;
 		else
@@ -775,23 +775,23 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "notify-delay", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setnotifydelay(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "check-sibling", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSIBLING,
 				   cfg_obj_asboolean(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "zero-no-soa-ttl", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setzeronosoattl(zone, cfg_obj_asboolean(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "nsec3-test-zone", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
 				   cfg_obj_asboolean(obj));
 	}
@@ -820,7 +820,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "sig-validity-interval", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		{
 			const cfg_obj_t *validity, *resign;

@@ -851,28 +851,28 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "sig-signing-signatures", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setsignatures(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "sig-signing-nodes", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setnodes(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "sig-signing-type", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setprivatetype(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "update-check-ksk", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_UPDATECHECKKSK,
 				   cfg_obj_asboolean(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "dnssec-dnskey-kskonly", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_DNSKEYKSKONLY,
 				   cfg_obj_asboolean(obj));
 	} else if (ztype == dns_zone_slave) {
@@ -887,7 +887,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	 */
 	if (ztype == dns_zone_master) {
 		isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
-		isc_boolean_t create = ISC_FALSE;

 		obj = NULL;
 		result = ns_config_get(maps, "check-wildcard", &obj);
@@ -899,7 +898,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "check-dup-records", &obj);
-		INSIST(obj != NULL);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 			fail = ISC_FALSE;
 			check = ISC_TRUE;
@@ -914,7 +913,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "check-mx", &obj);
-		INSIST(obj != NULL);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 			fail = ISC_FALSE;
 			check = ISC_TRUE;
@@ -929,13 +928,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "check-integrity", &obj);
-		INSIST(obj != NULL);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKINTEGRITY,
 				   cfg_obj_asboolean(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "check-mx-cname", &obj);
-		INSIST(obj != NULL);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 			warn = ISC_TRUE;
 			ignore = ISC_FALSE;
@@ -950,7 +949,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "check-srv-cname", &obj);
-		INSIST(obj != NULL);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
 			warn = ISC_TRUE;
 			ignore = ISC_FALSE;
@@ -965,7 +964,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = ns_config_get(maps, "dnssec-secure-to-insecure", &obj);
-		INSIST(obj != NULL);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_SECURETOINSECURE,
 				   cfg_obj_asboolean(obj));

@@ -977,15 +976,12 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				allow = ISC_TRUE;
 			else if (strcasecmp(arg, "maintain") == 0)
 				allow = maint = ISC_TRUE;
-			else if (strcasecmp(arg, "create") == 0)
-				allow = maint = create = ISC_TRUE;
 			else if (strcasecmp(arg, "off") == 0)
 				;
 			else
 				INSIST(0);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, create);
 		}
 	}

@@ -997,7 +993,7 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	case dns_zone_stub:
 		count = 0;
 		obj = NULL;
-		result = cfg_map_get(zoptions, "masters", &obj);
+		(void)cfg_map_get(zoptions, "masters", &obj);
 		if (obj != NULL) {
 			addrs = NULL;
 			keynames = NULL;
@@ -1016,61 +1012,61 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (count > 1) {
 			obj = NULL;
 			result = ns_config_get(maps, "multi-master", &obj);
-			INSIST(result == ISC_R_SUCCESS);
+			INSIST(result == ISC_R_SUCCESS && obj != NULL);
 			multi = cfg_obj_asboolean(obj);
 		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_MULTIMASTER, multi);

 		obj = NULL;
 		result = ns_config_get(maps, "max-transfer-time-in", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setmaxxfrin(zone, cfg_obj_asuint32(obj) * 60);

 		obj = NULL;
 		result = ns_config_get(maps, "max-transfer-idle-in", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setidlein(zone, cfg_obj_asuint32(obj) * 60);

 		obj = NULL;
 		result = ns_config_get(maps, "max-refresh-time", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setmaxrefreshtime(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "min-refresh-time", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setminrefreshtime(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "max-retry-time", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setmaxretrytime(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "min-retry-time", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setminretrytime(zone, cfg_obj_asuint32(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "transfer-source", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setxfrsource4(zone, cfg_obj_assockaddr(obj)));
 		ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "transfer-source-v6", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setxfrsource6(zone, cfg_obj_assockaddr(obj)));
 		ns_add_reserved_dispatch(ns_g_server, cfg_obj_assockaddr(obj));

 		obj = NULL;
 		result = ns_config_get(maps, "alt-transfer-source", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setaltxfrsource4(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = ns_config_get(maps, "alt-transfer-source-v6", &obj);
-		INSIST(result == ISC_R_SUCCESS);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		RETERR(dns_zone_setaltxfrsource6(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nsupdate.c,v 1.173.66.12 2010/12/09 04:31:30 tbox Exp $ */
+/* $Id: nsupdate.c,v 1.173.66.16 2011/11/03 04:30:37 each Exp $ */

 /*! \file */

@@ -694,8 +694,10 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 				keyfile, isc_result_totext(result));
 			return;
 		}
-	} else
+	} else {
 		dst_key_attach(dstkey, &sig0key);
+		dst_key_free(&dstkey);
+	}
 }

 static void
@@ -2259,6 +2261,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	}
 	check_result(result, "dns_request_getresponse");
 	section = DNS_SECTION_ANSWER;
+	POST(section);
 	if (debugging)
 		show_message(stderr, rcvmsg, "Reply from SOA query:");

@@ -2276,6 +2279,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		dns_message_destroy(&soaquery);
 		ddebug("Out of recvsoa");
 		done_update();
+		seenerror = ISC_TRUE;
 		return;
 	}

@@ -2817,6 +2821,9 @@ cleanup(void) {
 	}
 #endif

+	if (sig0key != NULL)
+		dst_key_free(&sig0key);
+
 	ddebug("Shutting down task manager");
 	isc_taskmgr_destroy(&taskmgr);

@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rndc.c,v 1.126.66.7 2011/02/03 12:17:22 tbox Exp $ */
+/* $Id: rndc.c,v 1.126.66.8 2011/11/03 22:06:43 each Exp $ */

 /*! \file */

@@ -142,13 +142,17 @@ command is one of the following:\n\
 		Flush the given name from the server's cache(s)\n\
  status	Display status of the server.\n\
  recursing	Dump the queries that are currently recursing (named.recursing)\n\
+  tsig-list	List all currently active TSIG keys, including both statically\n\
+		configured and TKEY-negotiated keys.\n\
+  tsig-delete keyname [view]	\n\
+		Delete a TKEY-negotiated TSIG key.\n\
  validation newstate [view]\n\
 		Enable / disable DNSSEC validation.\n\
-  *restart	Restart the server.\n\
  addzone [\"file\"] zone [class [view]] { zone-options }\n\
 		Add zone to given view. Requires new-zone-file option.\n\
  delzone [\"file\"] zone [class [view]]\n\
 		Removes zone from given view. Requires new-zone-file option.\n\
+  *restart	Restart the server.\n\
 \n\
 * == not yet implemented\n\
 Version: %s\n",
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: adb_test.c,v 1.70 2009/09/02 23:48:01 tbox Exp $ */
+/* $Id: adb_test.c,v 1.70.104.2 2011/08/30 23:45:34 tbox Exp $ */

 /*! \file */

@@ -264,9 +264,8 @@ lookup(const char *target) {
 	result = dns_adb_createfind(adb, t2, lookup_callback, client,
 				    &client->name, dns_rootname, 0, options,
 				    now, NULL, view->dstport, &client->find);
-#if 0
-	check_result(result, "dns_adb_createfind()");
-#endif
+	if (result != ISC_R_SUCCESS)
+		printf("DNS_ADB_CREATEFIND -> %s\n", dns_result_totext(result));
 	dns_adb_dumpfind(client->find, stderr);

 	if ((client->find->options & DNS_ADBFIND_WANTEVENT) != 0) {
@@ -414,7 +413,9 @@ main(int argc, char **argv) {
 	dns_view_detach(&view);
 	adb = NULL;

+	fprintf(stderr, "Destroying socket manager\n");
 	isc_socketmgr_destroy(&socketmgr);
+	fprintf(stderr, "Destroying timer manager\n");
 	isc_timermgr_destroy(&timermgr);

 	fprintf(stderr, "Destroying task manager\n");
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001, 2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: cfg_test.c,v 1.21.154.1 2010/01/13 19:31:52 each Exp $ */
+/* $Id: cfg_test.c,v 1.21.154.3 2011/09/05 23:45:31 tbox Exp $ */

 /*! \file */

@@ -49,7 +49,7 @@ check_result(isc_result_t result, const char *format, ...) {
 static void
 output(void *closure, const char *text, int textlen) {
 	UNUSED(closure);
-	(void) isc_util_fwrite(text, 1, textlen, stdout);
+	(void) fwrite(text, 1, textlen, stdout);
 }

 static void
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_db.c,v 1.39 2009/09/01 00:22:25 jinmei Exp $ */
+/* $Id: t_db.c,v 1.39.104.2 2011/03/12 04:58:25 tbox Exp $ */

 #include <config.h>

@@ -118,7 +118,6 @@ t_dns_db_load(char **av) {
 	isc_result_t		exp_load_result;
 	isc_result_t		exp_find_result;

-	result = T_UNRESOLVED;
 	db = NULL;
 	mctx = NULL;
 	ectx = NULL;
@@ -292,8 +291,6 @@ t_dns_db_zc_x(char *filename, char *db_type, char *origin, char *class,
 	isc_buffer_t		origin_buffer;
 	dns_fixedname_t		dns_origin;

-	result = T_UNRESOLVED;
-
 	db = NULL;
 	mctx = NULL;
 	ectx = NULL;
@@ -769,8 +766,6 @@ t_dns_db_currentversion(char **av) {
 	dns_dbversion_t		*cversionp;
 	dns_dbversion_t		*nversionp;

-	result = T_UNRESOLVED;
-
 	filename = T_ARG(0);
 	db_type = T_ARG(1);
 	origin = T_ARG(2);
@@ -1050,8 +1045,6 @@ t_dns_db_newversion(char **av) {
 	dns_dbversion_t		*nversionp;
 	dns_rdatalist_t		rdatalist;

-	result = T_UNRESOLVED;
-
 	filename = T_ARG(0);
 	db_type = T_ARG(1);
 	origin = T_ARG(2);
@@ -1384,7 +1377,6 @@ t_dns_db_closeversion_1(char **av) {
 	existing_type = T_ARG(8);

 	nfails = 0;
-	result = T_UNRESOLVED;
 	db = NULL;
 	mctx = NULL;
 	ectx = NULL;
@@ -1796,7 +1788,6 @@ t_dns_db_closeversion_2(char **av) {
 	existing_type = T_ARG(8);

 	nfails = 0;
-	result = T_UNRESOLVED;
 	db = NULL;
 	mctx = NULL;
 	ectx = NULL;
@@ -2259,8 +2250,6 @@ t_dns_db_expirenode(char **av) {
 	mctx = NULL;
 	ectx = NULL;

-	result = T_UNRESOLVED;
-
 	/*
 	 * Find a node, mark it as stale, do a dns_db_find on the name and
 	 * expect it to fail.
@@ -2464,7 +2453,6 @@ t_dns_db_findnode_1(char **av) {
 	db = NULL;
 	mctx = NULL;
 	ectx = NULL;
-	result = T_UNRESOLVED;

 	t_info("testing using file %s and name %s\n", filename, find_name);

@@ -2526,6 +2514,13 @@ t_dns_db_findnode_1(char **av) {
 	isc_buffer_add(&name_buffer, len);
 	dns_result = dns_name_fromtext(dns_fixedname_name(&dns_name),
 				&name_buffer, NULL, 0, NULL);
+	if (dns_result != ISC_R_SUCCESS) {
+		t_info("dns_name_fromtext failed %s\n",
+			       dns_result_totext(dns_result));
+		dns_db_detach(&db);
+		isc_mem_destroy(&mctx);
+		return(T_UNRESOLVED);
+	}

 	dns_result = dns_db_findnode(db, dns_fixedname_name(&dns_name),
 				ISC_FALSE, &nodep);
@@ -2623,7 +2618,6 @@ t_dns_db_findnode_2(char **av) {
 	model = T_ARG(4);
 	newname = T_ARG(5);

-	result = T_UNRESOLVED;
 	db = NULL;
 	mctx = NULL;
 	ectx = NULL;
@@ -2682,6 +2676,15 @@ t_dns_db_findnode_2(char **av) {
 	isc_buffer_add(&name_buffer, len);
 	dns_result = dns_name_fromtext(dns_fixedname_name(&dns_name),
 				       &name_buffer, NULL, 0, NULL);
+	if (dns_result != ISC_R_SUCCESS) {
+		t_info("dns_name_fromtext returned %s\n",
+				dns_result_totext(dns_result));
+		dns_db_detach(&db);
+		isc_hash_destroy();
+		isc_entropy_detach(&ectx);
+		isc_mem_destroy(&mctx);
+		return(T_UNRESOLVED);
+	}

 	dns_result = dns_db_findnode(db, dns_fixedname_name(&dns_name),
 				     ISC_FALSE, &nodep);
@@ -2816,8 +2819,6 @@ t_dns_db_find_x(char **av) {
 	dns_rdatatype_t		rdatatype;
 	dns_dbversion_t		*cversionp;

-	result = T_UNRESOLVED;
-
 	dbfile = T_ARG(0);
 	dbtype = T_ARG(1);
 	dborigin = T_ARG(2);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: db_test.c,v 1.68 2009/09/02 23:48:01 tbox Exp $ */
+/* $Id: db_test.c,v 1.68.104.2 2011/08/29 23:45:33 tbox Exp $ */

 /*! \file
 * \author
@@ -70,14 +70,10 @@ static isc_boolean_t		ascending = ISC_TRUE;

 static void
 print_result(const char *message, isc_result_t result) {
-	size_t len;

-	if (message == NULL) {
-		len = 0;
+	if (message == NULL)
 		message = "";
-	}
-	len = strlen(message);
-	printf("%s%sresult %08x: %s\n", message, (len == 0U) ? "" : " ",
+	printf("%s%sresult %08x: %s\n", message, (*message == '\0') ? "" : " ",
 	       result, isc_result_totext(result));
 }

@@ -449,6 +445,7 @@ main(int argc, char *argv[]) {

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
+	POST(argv);

 	if (argc != 0)
 		printf("ignoring trailing arguments\n");
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,12 +14,13 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: gsstest.c,v 1.8 2009/09/02 23:48:01 tbox Exp $ */
+/* $Id: gsstest.c,v 1.8.104.5 2011/11/30 00:53:35 marka Exp $ */

 #include <config.h>

 #include <stdlib.h>
 #include <string.h>
+#include <time.h>

 #include <isc/app.h>
 #include <isc/base64.h>
@@ -101,23 +102,23 @@ console(isc_task_t *task, isc_event_t *event)

 	isc_event_free(&event);

-	while(1) {
+	for (;;) {
 		printf("\nCommand => ");
 		scanf("%s", buf);

-		if(strcmp(buf, "quit") == 0) {
+		if (strcmp(buf, "quit") == 0) {
 			isc_app_shutdown();
 			return;
 		}

-		if(strcmp(buf, "initctx") == 0) {
+		if (strcmp(buf, "initctx") == 0) {
 			ev = isc_event_allocate(mctx, (void *)1, 1, initctx1,
 						NULL, sizeof(*event));
 			isc_task_send(task, &ev);
 			return;
 		}

-		if(strcmp(buf, "query") == 0) {
+		if (strcmp(buf, "query") == 0) {
 			ev = isc_event_allocate(mctx, (void *)1, 1, sendquery,
 						NULL, sizeof(*event));
 			isc_task_send(task, &ev);
@@ -132,7 +133,7 @@ static void
 recvresponse(isc_task_t *task, isc_event_t *event) {
 	dns_requestevent_t *reqev = (dns_requestevent_t *)event;
 	isc_result_t result, result2;
-	dns_message_t *query, *response = NULL;
+	dns_message_t *query = NULL, *response = NULL;
 	isc_buffer_t outtoken;
 	isc_buffer_t outbuf;
 	char output[10 * 1024];
@@ -144,14 +145,14 @@ recvresponse(isc_task_t *task, isc_event_t *event) {

 	REQUIRE(reqev != NULL);

+	query = reqev->ev_arg;
+
 	if (reqev->result != ISC_R_SUCCESS) {
 		fprintf(stderr, "I:request event result: %s\n",
 			isc_result_totext(reqev->result));
 		goto end;
 	}

-	query = reqev->ev_arg;
-
 	response = NULL;
 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
 	CHECK("dns_message_create", result);
@@ -169,14 +170,14 @@ recvresponse(isc_task_t *task, isc_event_t *event) {

 	CHECK("dns_request_getresponse", result2);

-	if (response)
+	if (response != NULL)
 		dns_message_destroy(&response);

-end:
-	if (query)
+ end:
+	if (query != NULL)
 		dns_message_destroy(&query);

-	if (reqev->request)
+	if (reqev->request != NULL)
 		dns_request_destroy(&reqev->request);

 	isc_event_free(&event);
@@ -216,6 +217,8 @@ sendquery(isc_task_t *task, isc_event_t *event)
 	CHECK("dns_name_fromtext", result);

 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER, &message);
+	if (result != ISC_R_SUCCESS)
+		goto end;

 	message->opcode = dns_opcode_query;
 	message->rdclass = dns_rdataclass_in;
@@ -252,20 +255,20 @@ sendquery(isc_task_t *task, isc_event_t *event)

 	return;

-	end:
-		if (qname != NULL)
-			dns_message_puttempname(message, &qname);
-		if (qrdataset != NULL)
-			dns_message_puttemprdataset(message, &qrdataset);
-		if (message != NULL)
-			dns_message_destroy(&message);
+ end:
+	if (qname != NULL)
+		dns_message_puttempname(message, &qname);
+	if (qrdataset != NULL)
+		dns_message_puttemprdataset(message, &qrdataset);
+	if (message != NULL)
+		dns_message_destroy(&message);
 }

 static void
 initctx2(isc_task_t *task, isc_event_t *event) {
 	dns_requestevent_t *reqev = (dns_requestevent_t *)event;
 	isc_result_t result;
-	dns_message_t *query, *response = NULL;
+	dns_message_t *query = NULL, *response = NULL;
 	isc_buffer_t outtoken;
 	unsigned char array[DNS_NAME_MAXTEXT + 1];
 	dns_rdataset_t *rdataset;
@@ -276,14 +279,14 @@ initctx2(isc_task_t *task, isc_event_t *event) {

 	REQUIRE(reqev != NULL);

+	query = reqev->ev_arg;
+
 	if (reqev->result != ISC_R_SUCCESS) {
 		fprintf(stderr, "I:request event result: %s\n",
 			isc_result_totext(reqev->result));
 		goto end;
 	}

-	query = reqev->ev_arg;
-
 	response = NULL;
 	result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &response);
 	CHECK("dns_message_create", result);
@@ -314,7 +317,7 @@ initctx2(isc_task_t *task, isc_event_t *event) {
 	rdataset = ISC_LIST_HEAD(question_name->list);
 	INSIST(rdataset != NULL);
 	qtype = rdataset->type;
-	if(qtype == dns_rdatatype_tkey) {
+	if (qtype == dns_rdatatype_tkey) {
 		printf("Received TKEY response from server\n");
 		printf("Context completed\n");
 	} else {
@@ -324,14 +327,13 @@ initctx2(isc_task_t *task, isc_event_t *event) {
 		tsigkey = NULL;
 	}

-	if(response)
-		dns_message_destroy(&response);
+	dns_message_destroy(&response);

-end:
-	if(query)
+ end:
+	if (query != NULL)
 		dns_message_destroy(&query);

-	if(reqev->request)
+	if (reqev->request != NULL)
 		dns_request_destroy(&reqev->request);

 	isc_event_free(&event);
@@ -398,7 +400,7 @@ initctx1(isc_task_t *task, isc_event_t *event) {
 	CHECK("dns_request_create", result);

 	return;
-end:
+ end:
 	event = isc_event_allocate(mctx, (void *)1, 1, console, NULL,
 				   sizeof(*event));
 	isc_task_send(task, &event);return;
@@ -410,11 +412,11 @@ setup(void)
 	struct in_addr inaddr;
 	int c;

-	while (1) {
+	for (;;) {
 		printf("Server IP => ");
 		c = scanf("%s", serveraddress);

-		if(c == EOF || strcmp(serveraddress, "quit") == 0) {
+		if (c == EOF || strcmp(serveraddress, "quit") == 0) {
 			isc_app_shutdown();
 			return;
 		}
@@ -424,7 +426,7 @@ setup(void)
 			return;
 		}

-	};
+	}
 }

 int
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: log_test.c,v 1.26.558.2 2011/01/14 00:51:07 tbox Exp $ */
+/* $Id: log_test.c,v 1.26.558.3 2011/08/28 23:48:54 marka Exp $ */

 /* Principal Authors: DCL */

@@ -27,6 +27,7 @@
 #include <isc/commandline.h>
 #include <isc/mem.h>
 #include <isc/string.h>
+#include <isc/util.h>

 #include <dns/log.h>

@@ -94,6 +95,7 @@ main(int argc, char **argv) {

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
+	POST(argv);

 	if (argc > 0) {
 		fprintf(stderr, usage, progname);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_master.c,v 1.39 2009/09/01 00:22:25 jinmei Exp $ */
+/* $Id: t_master.c,v 1.39.104.2 2011/03/12 04:58:25 tbox Exp $ */

 #include <config.h>

@@ -77,7 +77,6 @@ test_master(char *testfile, char *origin, char *class, isc_result_t exp_result)
 	dns_rdataclass_t	rdataclass;
 	isc_textregion_t	textregion;

-	result = T_UNRESOLVED;
 	if (T1_mctx == NULL)
 		isc_result = isc_mem_create(0, 0, &T1_mctx);
 	else
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_names.c,v 1.50 2009/09/01 23:47:44 tbox Exp $ */
+/* $Id: t_names.c,v 1.50.104.2 2011/03/12 04:58:25 tbox Exp $ */

 #include <config.h>

@@ -179,7 +179,6 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 	int			c;
 	int			len;
 	int			cnt;
-	unsigned int		val;
 	unsigned char		*p;
 	FILE			*fp;

@@ -192,8 +191,8 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 	p = buf;
 	cnt = 0;
 	len = 0;
-	val = 0;
 	while ((c = getc(fp)) != EOF) {
+		unsigned int		val;
 		if (	(c == ' ') || (c == '\t') ||
 			(c == '\r') || (c == '\n'))
 				continue;
@@ -1678,8 +1677,6 @@ test_dns_name_fromtext(char *test_name1, char *test_name2, char *test_origin,
 	isc_result_t	dns_result;
 	dns_namereln_t	dns_namereln;

-	result = T_UNRESOLVED;
-
 	t_info("testing %s %s %s\n", test_name1, test_name2, test_origin);

 	isc_buffer_init(&binbuf1, junk1, BUFLEN);
@@ -1815,8 +1812,6 @@ test_dns_name_totext(char *test_name, isc_boolean_t omit_final) {
 	isc_result_t	dns_result;
 	dns_namereln_t	dns_namereln;

-	result = T_UNRESOLVED;
-
 	t_info("testing %s\n", test_name);

 	len = strlen(test_name);
@@ -1983,8 +1978,6 @@ test_dns_name_fromwire(char *datafile_name, int testname_offset, int downcase,
 	dns_namereln_t		dns_namereln;
 	dns_decompress_t	dctx;

-	result = T_UNRESOLVED;
-
 	t_info("testing using %s\n", datafile_name);
 	len = getmsg(datafile_name, buf1, BIGBUFLEN, &iscbuf1);

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nsecify.c,v 1.10 2009/09/02 23:48:01 tbox Exp $ */
+/* $Id: nsecify.c,v 1.10.104.2 2011/08/29 23:45:33 tbox Exp $ */

 #include <config.h>

@@ -157,6 +157,7 @@ nsecify(char *filename) {
 	result = dns_db_createiterator(db, 0, &dbiter);
 	check_result(result, "dns_db_createiterator()");
 	result = dns_dbiterator_first(dbiter);
+	check_result(result, "dns_dbiterator_first()");
 	node = NULL;
 	result = next_active(db, wversion, dbiter, name, &node);
 	while (result == ISC_R_SUCCESS) {
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: printmsg.c,v 1.29 2007/06/19 23:46:59 tbox Exp $ */
+/* $Id: printmsg.c,v 1.29.558.2 2011/08/25 23:45:28 tbox Exp $ */

 #include <config.h>

@@ -77,7 +77,9 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 	isc_region_t r;
 	dns_name_t empty_name;
 	char t[65536];
+#ifdef USEINITALWS
 	isc_boolean_t first;
+#endif
 	isc_boolean_t no_rdata;

 	if (sectionid == DNS_SECTION_QUESTION)
@@ -100,7 +102,9 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		dns_message_currentname(msg, sectionid, &name);

 		isc_buffer_init(&target, t, sizeof(t));
+#ifdef USEINITALWS
 		first = ISC_TRUE;
+#endif
 		print_name = name;

 		for (rdataset = ISC_LIST_HEAD(name->list);
@@ -159,7 +163,6 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset, dns_name_t *owner,

 isc_result_t
 printmessage(dns_message_t *msg) {
-	isc_boolean_t did_flag = ISC_FALSE;
 	isc_result_t result;
 	dns_rdataset_t *opt, *tsig;
 	dns_name_t *tsigname;
@@ -169,35 +172,21 @@ printmessage(dns_message_t *msg) {
 	printf(";; ->>HEADER<<- opcode: %s, status: %s, id: %u\n",
 	       opcodetext[msg->opcode], rcodetext[msg->rcode], msg->id);

-	printf(";; flags: ");
-	if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0) {
-		printf("qr");
-		did_flag = ISC_TRUE;
-	}
-	if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0) {
-		printf("%saa", did_flag ? " " : "");
-		did_flag = ISC_TRUE;
-	}
-	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
-		printf("%stc", did_flag ? " " : "");
-		did_flag = ISC_TRUE;
-	}
-	if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0) {
-		printf("%srd", did_flag ? " " : "");
-		did_flag = ISC_TRUE;
-	}
-	if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0) {
-		printf("%sra", did_flag ? " " : "");
-		did_flag = ISC_TRUE;
-	}
-	if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0) {
-		printf("%sad", did_flag ? " " : "");
-		did_flag = ISC_TRUE;
-	}
-	if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
-		printf("%scd", did_flag ? " " : "");
-		did_flag = ISC_TRUE;
-	}
+	printf(";; flags:");
+	if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)
+		printf(" qr");
+	if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0)
+		printf(" aa");
+	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0)
+		printf(" tc");
+	if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0)
+		printf(" rd");
+	if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0)
+		printf(" ra");
+	if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0)
+		printf(" ad");
+	if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0)
+		printf(" cd");
 	printf("; QUERY: %u, ANSWER: %u, AUTHORITY: %u, ADDITIONAL: %u\n",
 	       msg->counts[DNS_SECTION_QUESTION],
 	       msg->counts[DNS_SECTION_ANSWER],
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: t_rbt.c,v 1.33 2009/09/01 00:22:25 jinmei Exp $ */
+/* $Id: t_rbt.c,v 1.33.104.2 2011/03/12 04:58:25 tbox Exp $ */

 #include <config.h>

@@ -398,8 +398,7 @@ test_rbt_gen(char *filename, char *command, char *testname,
 				result = T_FAIL;
 			}
 		} else {
-			t_info("create_name failed %s\n",
-				dns_result_totext(dns_result));
+			t_info("create_name failed\n");
 			result = T_UNRESOLVED;
 		}
 	} else if ((strcmp(command, "delete") == 0) ||
@@ -1112,8 +1111,8 @@ t_dns_rbtnodechain_first(char *dbfile, char *expected_firstname,
 		t_info("dns_rbtnodechain_first unexpectedly returned %s\n",
 		       dns_result_totext(dns_result));

-	nfails = t_namechk(dns_result, &dns_name, expected_firstname,
-			   &dns_origin, expected_firstorigin, DNS_R_NEWORIGIN);
+	nfails += t_namechk(dns_result, &dns_name, expected_firstname,
+			    &dns_origin, expected_firstorigin, DNS_R_NEWORIGIN);

 	dns_fixedname_init(&dns_name);
 	dns_result = dns_rbtnodechain_next(&chain,
@@ -1303,8 +1302,8 @@ t_dns_rbtnodechain_last(char *dbfile, char *expected_lastname,
 		t_info("dns_rbtnodechain_last unexpectedly returned %s\n",
 		       dns_result_totext(dns_result));
 	}
-	nfails = t_namechk(dns_result, &dns_name, expected_lastname,
-			   &dns_origin, expected_lastorigin, DNS_R_NEWORIGIN);
+	nfails += t_namechk(dns_result, &dns_name, expected_lastname,
+			    &dns_origin, expected_lastorigin, DNS_R_NEWORIGIN);

 	t_info("testing for previous name of %s, origin of %s\n",
 	       expected_prevname, expected_prevorigin);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rbt_test.c,v 1.50 2009/09/02 23:48:01 tbox Exp $ */
+/* $Id: rbt_test.c,v 1.50.104.2 2011/08/28 23:45:27 tbox Exp $ */

 #include <config.h>

@@ -88,7 +88,7 @@ delete_name(void *data, void *arg) {

 	UNUSED(arg);
 	name = data;
-	isc_mem_put(mctx, data, sizeof(dns_name_t) + DNSNAMELEN);
+	isc_mem_put(mctx, name, sizeof(*name) + DNSNAMELEN);
 }

 static void
@@ -280,6 +280,7 @@ main(int argc, char **argv) {

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
+	POST(argv);

 	if (argc > 1) {
 		printf("Usage: %s [-m]\n", progname);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rdata_test.c,v 1.48 2007/06/19 23:46:59 tbox Exp $ */
+/* $Id: rdata_test.c,v 1.48.558.3 2011/08/28 09:15:08 marka Exp $ */

 #include <config.h>

@@ -185,8 +185,8 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		break;
 	}
 	case dns_rdatatype_naptr: {
-		dns_rdata_in_naptr_t in_naptr;
-		result = dns_rdata_tostruct(rdata, sp = &in_naptr, NULL);
+		dns_rdata_naptr_t naptr;
+		result = dns_rdata_tostruct(rdata, sp = &naptr, NULL);
 		break;
 	}
 	case dns_rdatatype_ns: {
@@ -447,8 +447,8 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		break;
 	}
 	case dns_rdatatype_naptr: {
-		dns_rdata_in_naptr_t in_naptr;
-		result = dns_rdata_tostruct(rdata, sp = &in_naptr, mctx);
+		dns_rdata_naptr_t naptr;
+		result = dns_rdata_tostruct(rdata, sp = &naptr, mctx);
 		break;
 	}
 	case dns_rdatatype_ns: {
@@ -738,8 +738,8 @@ viastruct(dns_rdata_t *rdata, isc_mem_t *mctx,
 		break;
 	}
 	case dns_rdatatype_naptr: {
-		dns_rdata_in_naptr_t in_naptr;
-		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &in_naptr, b);
+		dns_rdata_naptr_t naptr;
+		result = dns_rdata_fromstruct(rdata2, rdc, rdt, &naptr, b);
 		break;
 	}
 	case dns_rdatatype_ns: {
@@ -973,6 +973,15 @@ main(int argc, char *argv[]) {
 			type = token.value.as_ulong;
 			isc_buffer_init(&tbuf, outbuf, sizeof(outbuf));
 			result = dns_rdatatype_totext(type, &tbuf);
+			if (result != ISC_R_SUCCESS) {
+				fprintf(stdout,
+					"dns_rdatatype_totext "
+					"returned %s(%d)\n",
+					dns_result_totext(result), result);
+				fflush(stdout);
+				need_eol = 1;
+				continue;
+			}
 			fprintf(stdout, "type = %.*s(%d)\n",
 				(int)tbuf.used, (char*)tbuf.base, type);
 		} else if (token.type == isc_tokentype_string) {
@@ -1005,6 +1014,14 @@ main(int argc, char *argv[]) {
 			class = token.value.as_ulong;
 			isc_buffer_init(&tbuf, outbuf, sizeof(outbuf));
 			result = dns_rdatatype_totext(class, &tbuf);
+			if (result != ISC_R_SUCCESS) {
+				fprintf(stdout, "dns_rdatatype_totext "
+					"returned %s(%d)\n",
+					dns_result_totext(result), result);
+				fflush(stdout);
+				need_eol = 1;
+				continue;
+			}
 			fprintf(stdout, "class = %.*s(%d)\n",
 				(int)tbuf.used, (char*)tbuf.base, class);
 		} else if (token.type == isc_tokentype_string) {
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1998-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: shutdown_test.c,v 1.23 2007/06/19 23:46:59 tbox Exp $ */
+/* $Id: shutdown_test.c,v 1.23.558.2 2011/08/28 23:45:28 tbox Exp $ */

 #include <config.h>

@@ -168,7 +168,7 @@ new_task(isc_mem_t *mctx, const char *name) {
 int
 main(int argc, char *argv[]) {
 	unsigned int workers;
-	t_info *t1, *t2, *t3;
+	t_info *t1, *t2;
 	isc_task_t *task;
 	isc_mem_t *mctx, *mctx2;

@@ -197,7 +197,7 @@ main(int argc, char *argv[]) {
 	/*
 	 * Test run-triggered shutdown.
 	 */
-	t3 = new_task(mctx2, "foo");
+	(void)new_task(mctx2, "foo");

 	/*
 	 * Test implicit shutdown.
@@ -0,0 +1,9 @@
+These scripts generate a named.conf file with an arbitrary number of
+small zones, for testing startup performance.
+
+To generate a test server with 1000 zones, run:
+
+   $ sh setup.sh 1000 > named.conf
+
+Zones are generated with random names, and all of them load from the same
+file: smallzone.db.
@@ -0,0 +1,32 @@
+#!/usr/bin/perl
+#
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: makenames.pl,v 1.2.38.2 2011/09/02 20:22:22 each Exp $
+use strict;
+
+die "Usage: makenames.pl <num>" if (@ARGV == 0);
+
+my @chars = split("", "abcdefghijklmnopqrstuvwxyz123456789");
+
+srand; 
+for (my $i = 0; $i < @ARGV[0]; $i++) {
+        my $name = "";
+        for (my $j = 0; $j < 10; $j++) {
+                my $r = rand 35;
+                $name .= $chars[$r];
+        }
+        print "$name" . ".example\n";
+}
@@ -0,0 +1,64 @@
+#!/bin/sh
+#
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: setup.sh,v 1.3.32.3 2011/09/05 23:45:31 tbox Exp $
+
+if [ "$#" -ne 1 ]; then
+    echo "Usage: $0 <number of zones>"
+    exit 1
+fi
+
+. ../system/conf.sh
+
+cat << EOF
+options {
+        directory "`pwd`";
+        listen-on { localhost; };
+        listen-on-v6 { localhost; };
+	port 5300;
+        allow-query { any; };
+        allow-transfer { localhost; };
+        allow-recursion { none; };
+        recursion no;
+};
+
+key rndc_key {
+        secret "1234abcd8765";
+        algorithm hmac-md5;
+};
+
+controls {
+        inet 127.0.0.1 port 9953 allow { any; } keys { rndc_key; };
+};
+
+logging {
+        channel basic {
+                file "`pwd`/named.log" versions 3 size 100m;
+                severity info;
+                print-time yes;
+                print-severity no;
+                print-category no;
+        };
+        category default {
+                basic;
+        };
+};
+
+EOF
+
+$PERL makenames.pl $1 | while read zonename; do
+        echo "zone $zonename { type master; file \"smallzone.db\"; };"
+done
@@ -0,0 +1,33 @@
+; Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: smallzone.db,v 1.3.32.3 2011/09/05 23:45:31 tbox Exp $
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+z			A	10.0.0.26
+a.a.a.a			A	10.0.0.3
+*.e			A	10.0.0.6
@@ -1,2 +1,3 @@
 Makefile
 conf.sh
+systests.output
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007, 2008, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2008, 2010, 2011  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.31.268.2 2010/06/23 23:46:35 tbox Exp $
+# $Id: Makefile.in,v 1.31.268.4 2011/11/01 23:46:11 tbox Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -36,6 +36,7 @@ test: subdirs

 testclean clean distclean::
 	if test -f ./cleanall.sh; then sh ./cleanall.sh; fi
+	rm -f systests.output

 distclean::
 	rm -f conf.sh
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2010, 2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named2.conf,v 1.2.2.3 2010/09/24 05:54:06 marka Exp $ */
+/* $Id: named2.conf,v 1.2.2.5 2011/09/05 23:45:31 tbox Exp $ */

 controls { /* empty */ };

@@ -48,3 +48,15 @@ view external {
 		file "../../common/root.hint";
 	};
 };
+
+# This view is only here to test that configuration context is cleaned
+# up correctly when using multiple named ACLs (regression test for RT #22739)
+acl match { none; };
+acl nobody { none; };
+view extra {
+        match-clients { match; };
+        allow-new-zones yes;
+        allow-transfer { nobody; };
+        allow-query { nobody; };
+        allow-recursion { nobody; };
+};
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2010, 2011  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.2.2.4 2010/09/24 05:54:05 marka Exp $
+# $Id: tests.sh,v 1.2.2.6 2011/09/05 23:45:31 tbox Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -147,5 +147,14 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I:ensure the configuration context is cleaned up correctly ($n)"
+ret=0
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reconfig > /dev/null 2>&1 || ret=1
+sleep 5
+$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 status > /dev/null 2>&1 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
@@ -0,0 +1,393 @@
+#!/usr/bin/perl
+#
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: ans.pl,v 1.2.4.4 2011/03/18 04:40:19 each Exp $
+
+#
+# This is the name server from hell.  It provides canned
+# responses based on pattern matching the queries, and
+# can be reprogrammed on-the-fly over a TCP connection.
+#
+# The server listens for control connections on port 5301.
+# A control connection is a TCP stream of lines like
+#
+#  /pattern/
+#  name ttl type rdata
+#  name ttl type rdata
+#  ...
+#  /pattern/
+#  name ttl type rdata
+#  name ttl type rdata
+#  ...
+#
+# There can be any number of patterns, each associated
+# with any number of response RRs.  Each pattern is a
+# Perl regular expression.
+#
+# Each incoming query is converted into a string of the form
+# "qname qtype" (the printable query domain name, space,
+# printable query type) and matched against each pattern.
+#
+# The first pattern matching the query is selected, and
+# the RR following the pattern line are sent in the
+# answer section of the response.
+#
+# Each new control connection causes the current set of
+# patterns and responses to be cleared before adding new
+# ones.
+#
+# The server handles UDP and TCP queries.  Zone transfer
+# responses work, but must fit in a single 64 k message.
+#
+# Now you can add TSIG, just specify key/key data with:
+#
+#  /pattern <key> <key_data>/
+#  name ttl type rdata
+#  name ttl type rdata
+#
+#  Note that this data will still be sent with any request for
+#  pattern, only this data will be signed. Currently, this is only
+#  done for TCP.
+
+
+use IO::File;
+use IO::Socket;
+use Data::Dumper;
+use Net::DNS;
+use Net::DNS::Packet;
+use strict;
+
+# Ignore SIGPIPE so we won't fail if peer closes a TCP socket early
+local $SIG{PIPE} = 'IGNORE';
+
+# Flush logged output after every line
+local $| = 1;
+
+# We default to listening on 10.53.0.2 for historical reasons
+# XXX: we should also be able to specify IPv6
+my $server_addr = "10.53.0.2";
+if (@ARGV > 0) {
+        $server_addr = @ARGV[0];
+}
+
+# XXX: we should also be able to set the port numbers to listen on.
+my $ctlsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+   LocalPort => 5301, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
+
+my $udpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+   LocalPort => 5300, Proto => "udp", Reuse => 1) or die "$!";
+
+my $tcpsock = IO::Socket::INET->new(LocalAddr => "$server_addr",
+   LocalPort => 5300, Proto => "tcp", Listen => 5, Reuse => 1) or die "$!";
+
+print "listening on $server_addr:5300,5301.\n";
+
+my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
+print $pidf "$$\n" or die "cannot write pid file: $!";
+$pidf->close or die "cannot close pid file: $!";;
+sub rmpid { unlink "ans.pid"; exit 1; };
+
+$SIG{INT} = \&rmpid;
+$SIG{TERM} = \&rmpid;
+
+#my @answers = ();
+my @rules;
+sub handleUDP {
+        my ($buf) = @_;
+
+        my ($packet, $err) = new Net::DNS::Packet(\$buf, 0);
+        $err and die $err;
+
+        $packet->header->qr(1);
+        $packet->header->aa(1);
+
+        my @questions = $packet->question;
+        my $qname = $questions[0]->qname;
+        my $qtype = $questions[0]->qtype;
+
+        # get the existing signature if any, and clear the additional section
+        my $prev_tsig;
+        while (my $rr = $packet->pop("additional")) {
+                if ($rr->type eq "TSIG") {
+                        $prev_tsig = $rr;
+                }
+        }
+
+        my $r;
+        foreach $r (@rules) {
+                my $pattern = $r->{pattern};
+		my($dbtype, $key_name, $key_data) = split(/ /,$pattern);
+		print "[handleUDP] $dbtype, $key_name, $key_data \n";
+                if ("$qname $qtype" =~ /$dbtype/) {
+                        my $a;
+                        foreach $a (@{$r->{answer}}) {
+                                $packet->push("answer", $a);
+                        }
+			if(defined($key_name) && defined($key_data)) {
+				# Sign the packet
+				print "  Signing the response with " .
+                                      "$key_name/$key_data\n";
+                                my $tsig = Net::DNS::RR->
+                                        new("$key_name TSIG $key_data");
+
+                                # These kluges are necessary because Net::DNS
+                                # doesn't know how to sign responses.  We
+                                # clear compnames so that the TSIG key and
+                                # algorithm name won't be compressed, and
+                                # add one to arcount because the signing
+                                # function will attempt to decrement it,
+                                # which is incorrect in a response. Finally
+                                # we set request_mac to the previous digest.
+                                $packet->{"compnames"} = {};
+                                $packet->{"header"}{"arcount"} += 1;
+                                if (defined($prev_tsig)) {
+                                        my $rmac = pack('n H*',
+                                                $prev_tsig->mac_size,
+                                                $prev_tsig->mac);
+                                        $tsig->{"request_mac"} =
+                                                unpack("H*", $rmac);
+                                }
+                                
+				$packet->sign_tsig($tsig);
+			}
+                        last;
+                }
+        }
+        #$packet->print;
+
+        return $packet->data;
+}
+
+# namelen:
+# given a stream of data, reads a DNS-formatted name and returns its
+# total length, thus making it possible to skip past it.
+sub namelen {
+        my ($data) = @_;
+        my $len = 0;
+        my $label_len = 0;
+        do {
+                $label_len = unpack("c", $data);
+                $data = substr($data, $label_len + 1);
+                $len += $label_len + 1;
+        } while ($label_len != 0);
+        return ($len);
+}
+
+# packetlen:
+# given a stream of data, reads a DNS wire-format packet and returns
+# its total length, making it possible to skip past it.
+sub packetlen {
+        my ($data) = @_;
+        my $q;
+        my $rr;
+
+        my ($header, $offset) = Net::DNS::Header->parse(\$data);
+        for (1 .. $header->qdcount) {
+                ($q, $offset) = Net::DNS::Question->parse(\$data, $offset);
+        }
+        for (1 .. $header->ancount) {
+                ($rr, $offset) = Net::DNS::RR->parse(\$data, $offset);
+        }
+        for (1 .. $header->nscount) {
+                ($rr, $offset) = Net::DNS::RR->parse(\$data, $offset);
+        }
+        for (1 .. $header->arcount) {
+                ($rr, $offset) = Net::DNS::RR->parse(\$data, $offset);
+        }
+        return $offset;
+}
+
+# sign_tcp_continuation:
+# This is a hack to correct the problem that Net::DNS has no idea how
+# to sign multiple-message TCP responses.  Several data that are included
+# in the digest when signing a query or the first message of a response are
+# omitted when signing subsequent messages in a TCP stream.
+#
+# Net::DNS::Packet->sign_tsig() has the ability to use a custom signing
+# function (specified by calling Packet->sign_func()).  We use this
+# function as the signing function for TCP continuations, and it removes
+# the unwanted data from the digest before calling the default sign_hmac
+# function.
+sub sign_tcp_continuation {
+        my ($key, $data) = @_;
+
+        # copy out first two bytes: size of the previous MAC
+        my $rmacsize = unpack("n", $data);
+        $data = substr($data, 2);
+
+        # copy out previous MAC
+        my $rmac = substr($data, 0, $rmacsize);
+        $data = substr($data, $rmacsize);
+
+        # try parsing out the packet information
+        my $plen = packetlen($data);
+        my $pdata = substr($data, 0, $plen);
+        $data = substr($data, $plen);
+
+        # remove the keyname, ttl, class, and algorithm name
+        $data = substr($data, namelen($data));
+        $data = substr($data, 6);
+        $data = substr($data, namelen($data));
+
+        # preserve the TSIG data
+        my $tdata = substr($data, 0, 8);
+
+        # prepare a new digest and sign with it
+        $data = pack("n", $rmacsize) . $rmac . $pdata . $tdata;
+        return Net::DNS::RR::TSIG::sign_hmac($key, $data);
+}
+
+sub handleTCP {
+	my ($buf) = @_;
+
+	my ($packet, $err) = new Net::DNS::Packet(\$buf, 0);
+	$err and die $err;
+	
+	$packet->header->qr(1);
+	$packet->header->aa(1);
+	
+	my @questions = $packet->question;
+	my $qname = $questions[0]->qname;
+	my $qtype = $questions[0]->qtype;
+
+        # get the existing signature if any, and clear the additional section
+        my $prev_tsig;
+        my $signer;
+        while (my $rr = $packet->pop("additional")) {
+                if ($rr->type eq "TSIG") {
+                        $prev_tsig = $rr;
+                }
+        }
+
+	my @results = ();
+	my $count_these = 0;
+
+	my $r;
+	foreach $r (@rules) {
+		my $pattern = $r->{pattern};
+		my($dbtype, $key_name, $key_data) = split(/ /,$pattern);
+		print "[handleTCP] $dbtype, $key_name, $key_data \n";
+		if ("$qname $qtype" =~ /$dbtype/) {
+			$count_these++;
+			my $a;
+			foreach $a (@{$r->{answer}}) {
+				$packet->push("answer", $a);
+			}
+			if(defined($key_name) && defined($key_data)) {
+				# sign the packet
+				print "  Signing the data with " . 
+                                      "$key_name/$key_data\n";
+
+                                my $tsig = Net::DNS::RR->
+                                        new("$key_name TSIG $key_data");
+
+                                # These kluges are necessary because Net::DNS
+                                # doesn't know how to sign responses.  We
+                                # clear compnames so that the TSIG key and
+                                # algorithm name won't be compressed, and
+                                # add one to arcount because the signing
+                                # function will attempt to decrement it,
+                                # which is incorrect in a response. Finally
+                                # we set request_mac to the previous digest.
+                                $packet->{"compnames"} = {};
+                                $packet->{"header"}{"arcount"} += 1;
+                                if (defined($prev_tsig)) {
+                                        my $rmac = pack('n H*',
+                                                $prev_tsig->mac_size,
+                                                $prev_tsig->mac);
+                                        $tsig->{"request_mac"} =
+                                                unpack("H*", $rmac);
+                                }
+                                
+                                $tsig->sign_func($signer) if defined($signer);
+				$packet->sign_tsig($tsig);
+                                $signer = \&sign_tcp_continuation;
+
+                                my $copy =
+                                        Net::DNS::Packet->new(\($packet->data));
+                                $prev_tsig = $copy->pop("additional");
+			}
+			#$packet->print;
+			push(@results,$packet->data);
+			$packet = new Net::DNS::Packet(\$buf, 0);
+			$packet->header->qr(1);
+			$packet->header->aa(1);
+		}
+	}
+	print " A total of $count_these patterns matched\n";
+	return \@results;
+}
+
+# Main
+my $rin;
+my $rout;
+for (;;) {
+	$rin = '';
+	vec($rin, fileno($ctlsock), 1) = 1;
+	vec($rin, fileno($tcpsock), 1) = 1;
+	vec($rin, fileno($udpsock), 1) = 1;
+
+	select($rout = $rin, undef, undef, undef);
+
+	if (vec($rout, fileno($ctlsock), 1)) {
+		warn "ctl conn";
+		my $conn = $ctlsock->accept;
+		my $rule = ();
+		@rules = ();
+		while (my $line = $conn->getline) {
+			chomp $line;
+			if ($line =~ m!^/(.*)/$!) {
+				$rule = { pattern => $1, answer => [] };
+				push(@rules, $rule);
+			} else {
+				push(@{$rule->{answer}},
+				     new Net::DNS::RR($line));
+			}
+		}
+		$conn->close;
+                #print Dumper(@rules);
+                #print "+=+=+ $rules[0]->{'pattern'}\n";
+                #print "+=+=+ $rules[0]->{'answer'}->[0]->{'rname'}\n";
+                #print "+=+=+ $rules[0]->{'answer'}->[0]\n";
+	} elsif (vec($rout, fileno($udpsock), 1)) {
+		printf "UDP request\n";
+		my $buf;
+		$udpsock->recv($buf, 512);
+		my $result = handleUDP($buf);
+		my $num_chars = $udpsock->send($result);
+		print "  Sent $num_chars bytes via UDP\n";	
+	} elsif (vec($rout, fileno($tcpsock), 1)) {
+		my $conn = $tcpsock->accept;
+		my $buf;
+		for (;;) {
+			my $lenbuf;
+			my $n = $conn->sysread($lenbuf, 2);
+			last unless $n == 2;
+			my $len = unpack("n", $lenbuf);
+			$n = $conn->sysread($buf, $len);
+			last unless $n == $len;
+			print "TCP request\n";
+			my $result = handleTCP($buf);
+			foreach my $response (@$result) {
+				$len = length($response);
+				$n = $conn->syswrite(pack("n", $len), 2);
+				$n = $conn->syswrite($response, $len);
+				print "    Sent: $n chars via TCP\n";
+			}
+		}
+		$conn->close;
+	}
+}
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,11 +14,12 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.3.6.4 2010/12/18 02:15:17 each Exp $
+# $Id: clean.sh,v 1.3.6.7 2011/07/08 01:46:41 each Exp $

 rm -f */K* */dsset-* */*.signed */trusted.conf */tmp* */*.jnl */*.bk
 rm -f active.key inact.key del.key unpub.key standby.key rev.key
 rm -f nopriv.key vanishing.key del1.key del2.key
+rm -f delayksk.key delayzsk.key missingzsk.key inactivezsk.key
 rm -f nsupdate.out
 rm -f */core
 rm -f */example.bk
@@ -42,6 +43,7 @@ rm -f ns3/secure.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
 rm -f ns3/secure-to-insecure.example.db
+rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
 rm -f ns3/prepub.example.db
 rm -f ns3/prepub.example.db.in
 rm -f ns3/secure-to-insecure2.example.db
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: keygen.sh,v 1.3.6.3 2010/01/18 23:48:01 tbox Exp $
+# $Id: keygen.sh,v 1.3.6.5 2011/10/20 23:46:04 tbox Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -72,4 +72,4 @@ echo $zskinact > ../inact.key
 echo $zskunpub > ../unpub.key
 echo $zsknopriv > ../nopriv.key
 echo $zsksby > ../standby.key
-echo $kskrev > ../rev.key
+$REVOKE -R $kskrev > ../rev.key
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: keygen.sh,v 1.3.6.4 2010/06/07 04:47:26 marka Exp $
+# $Id: keygen.sh,v 1.3.6.6 2011/05/26 23:46:24 tbox Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -57,5 +57,5 @@ for i in Xbar.+005+30676.key Xbar.+005+30804.key Xbar.+005+30676.private \
 do
 	cp $i `echo $i | sed s/X/K/`
 done
-$KEYGEN -3 -q -r $RANDFILE $zone > /dev/null
+$KEYGEN -q -r $RANDFILE $zone > /dev/null
 $DSFROMKEY Kbar.+005+30804.key > dsset-bar.
@@ -0,0 +1,31 @@
+; Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: delay.example.db,v 1.1.6.2 2011/03/26 01:09:22 each Exp $
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2009102722 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+x			CNAME	a
@@ -0,0 +1,31 @@
+; Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: inaczsk.example.db.in,v 1.2.4.2 2011/07/08 01:46:41 each Exp $
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				1          ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+x			CNAME	a
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: keygen.sh,v 1.3.6.5 2010/12/15 18:44:16 each Exp $
+# $Id: keygen.sh,v 1.3.6.8 2011/07/08 01:46:41 each Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -205,3 +205,37 @@ zonefile="${zone}.db"
 $KEYGEN -3 -q -r $RANDFILE -fk $zone > /dev/null
 $KEYGEN -3 -q -r $RANDFILE $zone > /dev/null
 $SIGNER -S -3 beef -o $zone -f $zonefile $infile > /dev/null 2>&1
+
+#
+# A zone with a DNSKEY RRset that is published before it's activated
+#
+zone=delay.example
+zonefile="${zone}.db"
+ksk=`$KEYGEN -G -q -3 -r $RANDFILE -fk $zone`
+echo $ksk > ../delayksk.key
+zsk=`$KEYGEN -G -q -3 -r $RANDFILE $zone`
+echo $zsk > ../delayzsk.key
+
+#
+# A zone with signatures that are already expired, and the private ZSK
+# is missing.
+#
+zone=nozsk.example
+zonefile="${zone}.db"
+$KEYGEN -q -3 -r $RANDFILE -fk $zone > /dev/null
+zsk=`$KEYGEN -q -3 -r $RANDFILE $zone`
+$SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > /dev/null 2>&1
+echo $zsk > ../missingzsk.key
+rm -f ${zsk}.private
+
+#
+# A zone with signatures that are already expired, and the private ZSK
+# is inactive.
+#
+zone=inaczsk.example
+zonefile="${zone}.db"
+$KEYGEN -q -3 -r $RANDFILE -fk $zone > /dev/null
+zsk=`$KEYGEN -q -3 -r $RANDFILE $zone`
+$SIGNER -S -P -s now-1mo -e now-1mi -o $zone -f $zonefile ${zonefile}.in > /dev/null 2>&1
+echo $zsk > ../inactivezsk.key
+$SETTIME -I now $zsk > /dev/null
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.3.6.4 2010/12/15 18:44:16 each Exp $ */
+/* $Id: named.conf,v 1.3.6.7 2011/07/08 01:46:41 each Exp $ */

 // NS3

@@ -185,4 +185,24 @@ zone "prepub.example" {
 	auto-dnssec maintain;
 };

+zone "delay.example" {
+	type master;
+	file "delay.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
+zone "nozsk.example" {
+	type master;
+	file "nozsk.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
+zone "inaczsk.example" {
+	type master;
+	file "inaczsk.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
 include "trusted.conf";
@@ -0,0 +1,31 @@
+; Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: nozsk.example.db.in,v 1.2.4.2 2011/07/08 01:46:41 each Exp $
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				1          ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+x			CNAME	a
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.4.6.8 2010/12/15 18:44:16 each Exp $
+# $Id: tests.sh,v 1.4.6.27 2011/11/27 12:10:10 marka Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -26,6 +26,34 @@ n=0

 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"

+# convert private-type records to readable form
+showprivate () {
+    echo "-- $@ --"
+    $DIG $DIGOPTS +nodnssec +short @$2 -t type65534 $1 | cut -f3 -d' ' |
+        while read record; do
+            perl -e 'my $rdata = pack("H*", @ARGV[0]);
+                die "invalid record" unless length($rdata) == 5;
+                my ($alg, $key, $remove, $complete) = unpack("CnCC", $rdata);
+                my $action = "signing";
+                $action = "removing" if $remove;
+                my $state = " (incomplete)";
+                $state = " (complete)" if $complete;
+                print ("$action: alg: $alg, key: $key$state\n");' $record
+        done
+}
+
+# check that signing records are marked as complete
+checkprivate () {
+    ret=0
+    x=`showprivate "$@"`
+    echo $x | grep incomplete >&- 2>&- && ret=1
+    [ $ret = 1 ] && {
+        echo "$x"
+        echo "I:failed"
+    }
+    return $ret
+}
+
 #
 #  The NSEC record at the apex of the zone and its RRSIG records are
 #  added as part of the last step in signing a zone.  We wait for the
@@ -37,14 +65,24 @@ i=0
 while [ $i -lt 30 ]
 do
 	ret=0
-	for z in bar example private.secure.example
+	#
+	# Wait for the root DNSKEY RRset to be fully signed.
+	#
+	$DIG $DIGOPTS . @10.53.0.1 dnskey > dig.out.ns1.test$n || ret=1
+	grep "ANSWER: 10," dig.out.ns1.test$n > /dev/null || ret=1
+	for z in .
 	do
-		$DIG $DIGOPTS $z. @10.53.0.2 nsec > dig.out.ns2.test$n || ret=1
+		$DIG $DIGOPTS $z @10.53.0.1 nsec > dig.out.ns1.test$n || ret=1
+		grep "NS SOA" dig.out.ns1.test$n > /dev/null || ret=1
+	done
+	for z in bar. example. private.secure.example.
+	do
+		$DIG $DIGOPTS $z @10.53.0.2 nsec > dig.out.ns2.test$n || ret=1
 		grep "NS SOA" dig.out.ns2.test$n > /dev/null || ret=1
 	done
-	for z in bar example
+	for z in bar. example.
 	do 
-		$DIG $DIGOPTS $z. @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
+		$DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
 		grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
 	done
 	i=`expr $i + 1`
@@ -118,6 +156,42 @@ END
 echo "I:waiting for change to take effect"
 sleep 3

+echo "I:checking that expired RRSIGs from missing key are not deleted ($n)"
+ret=0
+missing=`sed 's/^K.*+007+0*\([0-9]\)/\1/' < missingzsk.key`
+$JOURNALPRINT ns3/nozsk.example.db.jnl | \
+   awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {exit 1}} END {exit 0}' id=$missing || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking that expired RRSIGs from inactive key are not deleted ($n)"
+ret=0
+inactive=`sed 's/^K.*+007+0*\([0-9]\)/\1/' < inactivezsk.key`
+$JOURNALPRINT ns3/inaczsk.example.db.jnl | \
+   awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {exit 1}} END {exit 0}' id=$inactive || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking that non-replaceable RRSIGs are logged only once ($n)"
+ret=0
+loglines=`grep "Key nozsk.example/NSEC3RSASHA1/$missing .* retaining signatures" ns3/named.run | wc -l`
+[ "$loglines" -eq 1 ] || ret=1
+loglines=`grep "Key inaczsk.example/NSEC3RSASHA1/$missing .* retaining signatures" ns3/named.run | wc -l`
+[ "$loglines" -eq 1 ] || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+# This test is above the rndc freeze/thaw calls because the apex node
+# will be resigned on thaw, increasing the serial number again.
+echo "I:checking serial is not incremented when signatures are unchanged ($n)"
+ret=0
+newserial=`$DIG $DIGOPTS +short soa nozsk.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}'`
+[ "$newserial" -eq 2 ] || ret=1
+newserial=`$DIG $DIGOPTS +short soa inaczsk.example @10.53.0.3 | awk '$0 !~ /SOA/ {print $3}'`
+[ "$newserial" -eq 2 ] || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 # Send rndc freeze command to ns1, ns2 and ns3, to force the dynamically
 # signed zones to be dumped to their zone files
 echo "I:dumping zone files"
@@ -560,8 +634,7 @@ status=`expr $status + $ret`

 echo "I:checking that revoked key is present ($n)"
 ret=0
-id=`sed 's/^K.+007+0*//' < rev.key`
-id=`expr $id + 128 % 65536`
+id=`cat rev.key`
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null || ret=1
 n=`expr $n + 1`
@@ -570,8 +643,7 @@ status=`expr $status + $ret`

 echo "I:checking that revoked key self-signs ($n)"
 ret=0
-id=`sed 's/^K.+007+0*//' < rev.key`
-id=`expr $id + 128 % 65536`
+id=`cat rev.key`
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
 n=`expr $n + 1`
@@ -580,7 +652,7 @@ status=`expr $status + $ret`

 echo "I:checking for unpublished key ($n)"
 ret=0
-id=`sed 's/^K.+007+0*//' < unpub.key`
+id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < unpub.key`
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
 n=`expr $n + 1`
@@ -589,7 +661,7 @@ status=`expr $status + $ret`

 echo "I:checking that standby key does not sign records ($n)"
 ret=0
-ed=`sed 's/^K.+007+0*//' < standby.key`
+id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < standby.key`
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
 n=`expr $n + 1`
@@ -598,7 +670,7 @@ status=`expr $status + $ret`

 echo "I:checking that deactivated key does not sign records  ($n)"
 ret=0
-id=`sed 's/^K.+007+0*//' < inact.key`
+id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < inact.key`
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
 n=`expr $n + 1`
@@ -607,7 +679,7 @@ status=`expr $status + $ret`

 echo "I:checking insertion of public-only key ($n)"
 ret=0
-id=`sed 's/^K.+007+0*//' < nopriv.key`
+id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < nopriv.key`
 file="ns1/`cat nopriv.key`.key"
 keydata=`grep DNSKEY $file`
 $NSUPDATE > /dev/null 2>&1 <<END	|| status=1
@@ -626,7 +698,7 @@ status=`expr $status + $ret`

 echo "I:checking key deletion ($n)"
 ret=0
-id=`sed 's/^K.+007+0*//' < del.key`
+id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < del.key`
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
 n=`expr $n + 1`
@@ -642,7 +714,7 @@ send
 END
 sleep 2
 $DIG $DIGOPTS axfr secure-to-insecure.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-egrep 'RRSIG.*'" $newid "'\. ' dig.out.ns3.test$n > /dev/null && ret=1
+egrep 'RRSIG' dig.out.ns3.test$n > /dev/null && ret=1
 egrep '(DNSKEY|NSEC)' dig.out.ns3.test$n > /dev/null && ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -656,7 +728,7 @@ $SETTIME -I now -D now $file > /dev/null
 $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 sign secure-to-insecure2.example. 2>&1 | sed 's/^/I:ns3 /'
 sleep 2
 $DIG $DIGOPTS axfr secure-to-insecure2.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
-egrep 'RRSIG.*'" $newid "'\. ' dig.out.ns3.test$n > /dev/null && ret=1
+egrep 'RRSIG' dig.out.ns3.test$n > /dev/null && ret=1
 egrep '(DNSKEY|NSEC3)' dig.out.ns3.test$n > /dev/null && ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -694,17 +766,19 @@ file="ns1/`cat vanishing.key`.private"
 rm -f $file

 echo "I:preparing ZSK roll"
+starttime=`$PERL -e 'print time(), "\n";'`
 oldfile=`cat active.key`
-oldid=`sed 's/^K.+007+0*//' < active.key`
+oldid=`sed 's/^K.+007+0*\([0-9]\)/\1/' < active.key`
 newfile=`cat standby.key`
-newid=`sed 's/^K.+007+0*//' < standby.key`
-$SETTIME -K ns1 -I now -D now+15 $oldfile > /dev/null
+newid=`sed 's/^K.+007+0*\([0-9]\)/\1/' < standby.key`
+$SETTIME -K ns1 -I now+2s -D now+25 $oldfile > /dev/null
 $SETTIME -K ns1 -i 0 -S $oldfile $newfile > /dev/null

 # note previous zone serial number
 oldserial=`$DIG $DIGOPTS +short soa . @10.53.0.1 | awk '{print $3}'`

 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . 2>&1 | sed 's/^/I:ns1 /'
+sleep 4

 echo "I:revoking key to duplicated key ID"
 $SETTIME -R now -K ns2 Kbar.+005+30676.key > /dev/null
@@ -731,6 +805,36 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

+echo "I:checking that signing records have been marked as complete ($n)"
+ret=0
+checkprivate . 10.53.0.1 || ret=1
+checkprivate bar 10.53.0.2 || ret=1
+checkprivate example 10.53.0.2 || ret=1
+checkprivate private.secure.example 10.53.0.3 || ret=1
+checkprivate nsec3.example 10.53.0.3 || ret=1
+checkprivate nsec3.nsec3.example 10.53.0.3 || ret=1
+checkprivate nsec3.optout.example 10.53.0.3 || ret=1
+checkprivate nsec3-to-nsec.example 10.53.0.3 || ret=1
+checkprivate nsec.example 10.53.0.3 || ret=1
+checkprivate oldsigs.example 10.53.0.3 || ret=1
+checkprivate optout.example 10.53.0.3 || ret=1
+checkprivate optout.nsec3.example 10.53.0.3 || ret=1
+checkprivate optout.optout.example 10.53.0.3 || ret=1
+checkprivate prepub.example 10.53.0.3 || ret=1
+checkprivate rsasha256.example 10.53.0.3 || ret=1
+checkprivate rsasha512.example 10.53.0.3 || ret=1
+checkprivate secure.example 10.53.0.3 || ret=1
+checkprivate secure.nsec3.example 10.53.0.3 || ret=1
+checkprivate secure.optout.example 10.53.0.3 || ret=1
+checkprivate secure-to-insecure2.example 10.53.0.3 || ret=1
+checkprivate secure-to-insecure.example 10.53.0.3 || ret=1
+checkprivate ttl1.example 10.53.0.3 || ret=1
+checkprivate ttl2.example 10.53.0.3 || ret=1
+checkprivate ttl3.example 10.53.0.3 || ret=1
+checkprivate ttl4.example 10.53.0.3 || ret=1
+n=`expr $n + 1`
+status=`expr $status + $ret`
+
 echo "I:forcing full sign"
 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 sign . 2>&1 | sed 's/^/I:ns1 /'

@@ -741,7 +845,6 @@ echo "I:checking former standby key has now signed fully ($n)"
 ret=0
 $DIG $DIGOPTS txt . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $newid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
-grep 'RRSIG.*'" $oldid "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -754,20 +857,82 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:waiting for former active key to be removed"
-sleep 10
+echo "I:checking delayed key publication/activation ($n)"
+ret=0
+zsk=`cat delayzsk.key`
+ksk=`cat delayksk.key`
+# publication and activation times should be unset
+$SETTIME -K ns3 -pA -pP $zsk | grep -v UNSET > /dev/null 2>&1 && ret=1
+$SETTIME -K ns3 -pA -pP $ksk | grep -v UNSET > /dev/null 2>&1 && ret=1
+$DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
+# DNSKEY not expected:
+awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

-echo "I:checking key was removed ($n)"
+echo "I:checking scheduled key publication, not activation ($n)"
+ret=0
+$SETTIME -K ns3 -P now+3s -A none $zsk > /dev/null 2>&1
+$SETTIME -K ns3 -P now+3s -A none $ksk > /dev/null 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 loadkeys delay.example. 2>&1 | sed 's/^/I:ns2 /'
+
+echo "I:waiting for changes to take effect"
+sleep 5
+
+$DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.test$n || ret=1
+# DNSKEY expected:
+awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.test$n || ret=1
+# RRSIG not expected:
+awk 'BEGIN {r=1} $4=="RRSIG" {r=0} END {exit r}' dig.out.ns3.test$n && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking scheduled key activation ($n)"
+ret=0
+$SETTIME -K ns3 -A now+3s $zsk > /dev/null 2>&1
+$SETTIME -K ns3 -A now+3s $ksk > /dev/null 2>&1
+$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 loadkeys delay.example. 2>&1 | sed 's/^/I:ns2 /'
+
+echo "I:waiting for changes to take effect"
+sleep 5
+
+$DIG $DIGOPTS +noall +answer dnskey delay.example. @10.53.0.3 > dig.out.ns3.1.test$n || ret=1
+# DNSKEY expected:
+awk 'BEGIN {r=1} $4=="DNSKEY" {r=0} END {exit r}' dig.out.ns3.1.test$n || ret=1
+# RRSIG expected:
+awk 'BEGIN {r=1} $4=="RRSIG" {r=0} END {exit r}' dig.out.ns3.1.test$n || ret=1
+$DIG $DIGOPTS +noall +answer a a.delay.example. @10.53.0.3 > dig.out.ns3.2.test$n || ret=1
+# A expected:
+awk 'BEGIN {r=1} $4=="A" {r=0} END {exit r}' dig.out.ns3.2.test$n || ret=1
+# RRSIG expected:
+awk 'BEGIN {r=1} $4=="RRSIG" {r=0} END {exit r}' dig.out.ns3.2.test$n || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking former active key was removed ($n)"
+#
+# Work out how long we need to sleep. Allow 4 seconds for the records
+# to be removed.
+#
+now=`$PERL -e 'print time(), "\n";'`
+sleep=`expr $starttime + 29 - $now`
+case $sleep in
+-*|0);;
+*) echo "I:waiting for timer to have activated"; sleep $sleep;;
+esac
 ret=0
 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
-grep '; key id =.*'"$oldid"'$' dig.out.ns1.test$n > /dev/null && ret=1
+grep '; key id = '"$oldid"'$' dig.out.ns1.test$n > /dev/null && ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 echo "I:checking private key file removal caused no immediate harm ($n)"
 ret=0
-id=`sed 's/^K.+007+0*//' < vanishing.key`
+id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < vanishing.key`
 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
 n=`expr $n + 1`
@@ -778,11 +943,56 @@ echo "I:checking revoked key with duplicate key ID (failure expected) ($n)"
 lret=0
 id=30676
 $DIG $DIGOPTS +multi dnskey bar @10.53.0.2 > dig.out.ns2.test$n || lret=1
-grep '; key id =.*'"$id"'$' dig.out.ns2.test$n || lret=1
+grep '; key id = '"$id"'$' dig.out.ns2.test$n > /dev/null || lret=1
 $DIG $DIGOPTS dnskey bar @10.53.0.4 > dig.out.ns4.test$n || lret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || lret=1
 n=`expr $n + 1`
-if [ $lret != 0 ]; then echo "I:failed"; fi
+if [ $lret != 0 ]; then echo "I:not yet implemented"; fi
+
+echo "I:checking key event timers are always set ($n)"
+# this is a regression test for a bug in which the next key event could
+# be scheduled for the present moment, and then never fire.  check for
+# visible evidence of this error in the logs:
+awk '/next key event/ {if ($1 == $8 && $2 == $9) exit 1}' */named.run || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+# this confirms that key events are never scheduled more than
+# a given number of seconds into the future, and that the last
+# event scheduled is precisely that far in the future.
+check_interval () {
+        awk '/next key event/ {print $2 ":" $9}' $1/named.run |
+	sed 's/\.//g' |
+            awk -F: '
+                     {
+                       x = ($6+ $5*60000 + $4*3600000) - ($3+ $2*60000 + $1*3600000);
+		       # abs(x) < 500 ms treat as 'now'
+		       if (x < 500 && x > -500)
+                         x = 0;
+		       # convert to seconds
+		       x = x/1000;
+		       # handle end of day roll over
+		       if (x < 0)
+			 x = x + 24*3600;
+		       # handle log timestamp being a few milliseconds later
+                       if (x != int(x))
+                         x = int(x + 1);
+                       if (int(x) > int(interval))
+                         exit (1);
+                     }
+                     END { if (int(x) != int(interval)) exit(1) }' interval=$2
+        return $?
+}
+
+echo "I:checking automatic key reloading interval ($n)"
+ret=0
+check_interval ns1 3600 || ret=1
+check_interval ns2 3600 || ret=1
+check_interval ns3 3600 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`

 echo "I:exit status: $status"

@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: named.conf,v 1.2.6.3 2011/08/09 04:11:29 tbox Exp $ */
+
+include "../../common/rndc.key";
+
+controls { inet 10.53.0.1 port 9953 allow { any; } keys { rndc_key; }; };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion yes;
+	notify no;
+};
@@ -0,0 +1,42 @@
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: tests.sh,v 1.2.6.3 2011/08/09 04:11:28 tbox Exp $
+
+status=0
+n=0
+
+n=`expr $n + 1`
+echo "I:Checking that reconfiguring empty zones is silent ($n)"
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig
+ret=0
+grep "automatic empty zone" ns1/named.run > /dev/null || ret=1
+grep "received control channel command 'reconfig'" ns1/named.run > /dev/null || ret=1
+grep "reloading configuration succeeded" ns1/named.run > /dev/null || ret=1
+sleep 1
+grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
+if [ $ret != 0 ] ; then echo I:failed; status=`expr $status + $ret`; fi
+
+n=`expr $n + 1`
+echo "I:Checking that reloading empty zones is silent ($n)"
+$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload > /dev/null
+ret=0
+grep "automatic empty zone" ns1/named.run > /dev/null || ret=1
+grep "received control channel command 'reload'" ns1/named.run > /dev/null || ret=1
+grep "reloading configuration succeeded" ns1/named.run > /dev/null || ret=1
+sleep 1
+grep "zone serial (0) unchanged." ns1/named.run > /dev/null && ret=1
+if [ $ret != 0 ] ; then echo I:failed; status=`expr $status + $ret`; fi
+
+exit $status
@@ -0,0 +1,19 @@
+#!/bin/sh
+#
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: clean.sh,v 1.1.4.2 2011/05/07 05:52:58 each Exp $
+
+rm -f good.conf.in good.conf.out
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dnssec.1,v 1.1.4.4 2011/05/08 07:05:12 marka Exp $ */
+
+options {
+        dnssec-validation yes;
+        dnssec-enable no;
+};
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dnssec.2,v 1.1.4.5 2011/11/07 01:20:50 marka Exp $ */
+
+options {
+        dnssec-validation yes;
+};
+
+view view1 {
+        match-clients { any; };
+        dnssec-enable no;
+};
+
+view view3 {
+        match-clients { none; };
+        auto-dnssec maintain;
+};
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dnssec.3,v 1.1.4.5 2011/11/07 01:20:50 marka Exp $ */
+
+options {
+        dnssec-validation yes;
+        dnssec-enable yes;
+};
+
+view view3 {
+        match-clients { none; };
+        dnssec-lookaside auto;
+};
+
+view view4 {
+        match-clients { none; };
+        dnssec-lookaside no;
+};
+
+view view5 {
+        match-clients { none; };
+        auto-dnssec off;
+};
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007, 2010, 2011  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,18 +14,25 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: good.conf,v 1.4.558.2 2010/06/02 01:27:20 tbox Exp $ */
+/* $Id: good.conf,v 1.4.558.4 2011/05/07 23:46:35 tbox Exp $ */

 /*
 * This is just a random selection of configuration options.
 */

+/* cut here */
 options {
-	avoid-v4-udp-ports { 100; };
-	avoid-v6-udp-ports { 100; };
-	blackhole { 10.0.0.0/8; };
-	coresize 1G;
-	datasize 100M;
+	avoid-v4-udp-ports {
+		100;
+	};
+	avoid-v6-udp-ports {
+		100;
+	};
+	blackhole {
+		10.0.0.0/8;
+	};
+	coresize 1073741824;
+	datasize 104857600;
 	deallocate-on-exit yes;
 	directory ".";
 	dump-file "named_dumpdb";
@@ -37,9 +44,15 @@ options {
 	host-statistics-max 100;
 	hostname none;
 	interface-interval 30;
-	listen-on port 90 { any; };
-	listen-on port 100 { 127.0.0.1; };
-	listen-on-v6 port 53 { none; };
+	listen-on port 90 {
+		"any";
+	};
+	listen-on port 100 {
+		127.0.0.1/32;
+	};
+	listen-on-v6 port 53 {
+		"none";
+	};
 	match-mapped-addresses yes;
 	memstatistics-file "named.memstats";
 	multiple-cnames no;
@@ -54,9 +67,27 @@ options {
 	serial-query-rate 100;
 	server-id none;
 };
-
-zone "example1" {
-	type master;
-	file "xxx";
-	update-policy local;
+view "first" {
+	match-clients {
+		"none";
+	};
+	zone "example1" {
+		type master;
+		file "xxx";
+		update-policy local;
+	};
+	dnssec-lookaside auto;
+	dnssec-validation yes;
+};
+view "second" {
+	match-clients {
+		"any";
+	};
+	zone "example1" {
+		type master;
+		file "yyy";
+		update-policy local;
+	};
+	dnssec-lookaside "." trust-anchor "dlv.isc.org.";
+	dnssec-validation yes;
 };
@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007, 2010, 2011  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.3.558.2 2010/06/02 01:27:20 tbox Exp $
+# $Id: tests.sh,v 1.3.558.5 2011/11/07 01:20:50 marka Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -20,7 +20,6 @@ SYSTEMTESTTOP=..
 status=0

 echo "I: checking that named-checkconf handles a known good config"
-
 ret=0
 $CHECKCONF good.conf > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
@@ -28,13 +27,26 @@ status=`expr $status + $ret`

 echo "I: checking that named-checkconf prints a known good config"
 ret=0
-$CHECKCONF -p good.conf > /dev/null 2>&1 || ret=1
+awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good.conf > good.conf.in
+[ -s good.conf.in ] || ret=1
+$CHECKCONF -p good.conf.in | grep -v '^good.conf.in:' > good.conf.out 2>&1 || ret=1
+cmp good.conf.in good.conf.out || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
-echo "I: checking that named-checkconf handles a known bad config"

-ret=1
-$CHECKCONF bad.conf > /dev/null 2>&1 || ret=0
+echo "I: checking that named-checkconf handles a known bad config"
+ret=0
+$CHECKCONF bad.conf > /dev/null 2>&1 && ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I: checking named-checkconf dnssec warnings"
+ret=0
+$CHECKCONF dnssec.1 2>&1 | grep 'validation yes.*enable no' > /dev/null || ret=1
+$CHECKCONF dnssec.2 2>&1 | grep 'auto-dnssec may only be ' > /dev/null || ret=1
+$CHECKCONF dnssec.2 2>&1 | grep 'validation yes.*enable no' > /dev/null || ret=1
+# this one should have no warnings
+$CHECKCONF dnssec.3 2>&1 | grep '.*' && ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

@@ -0,0 +1,17 @@
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: clean.sh,v 1.2.4.2 2011/03/02 04:30:52 marka Exp $
+
+rm -f test.out.*
@@ -0,0 +1,33 @@
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: tests.sh,v 1.2.4.2 2011/03/02 04:30:53 marka Exp $
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+status=0
+n=1
+
+for db in zones/good*.db
+do
+	echo "I:checking $db ($n)"
+	ret=0
+	$CHECKZONE example $db > test.out.$n 2>&1 || ret=1
+	n=`expr $n + 1`
+	if [ $ret != 0 ]; then echo "I:failed"; fi
+	status=`expr $status + $ret`
+done
+
+exit $status
@@ -0,0 +1,25 @@
+; Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: good1.db,v 1.2.4.2 2011/03/02 04:30:53 marka Exp $
+
+
+$TTL 600
+@		SOA     ns hostmaster 2011012708 3600 1200 604800 1200
+                NS      ns
+ns		A       192.0.2.1
+
+ns-and-dname	NS      ns.ns-and-dname
+		DNAME	example.com.
+ns.ns-and-dname	A       203.178.141.207
@@ -0,0 +1,22 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: rndc.key,v 1.2.4.3 2011/03/12 04:58:25 tbox Exp $ */
+
+key rndc_key {
+        secret "1234abcd8765";
+        algorithm hmac-md5;
+};
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: conf.sh.in,v 1.43.8.10 2010/12/07 03:01:37 marka Exp $
+# $Id: conf.sh.in,v 1.43.8.22 2011/12/05 16:57:25 each Exp $

 #
 # Common configuration data for system tests, to be sourced into
@@ -52,11 +52,12 @@ JOURNALPRINT=$TOP/bin/tools/named-journalprint
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # v6synth
-SUBDIRS="acl allow_query addzone autosign cacheclean checkconf checknames
-    dlv @DLZ_SYSTEM_TEST@ dnssec forward glue ixfr limits lwresd
-    masterfile masterformat metadata notify nsupdate pending pkcs11
-    resolver rrsetorder sortlist smartsign stub tkey unknown upforwd
-    views xfer xferquota zonechecks"
+SUBDIRS="acl allow_query addzone autosign builtin cacheclean checkconf
+	 checknames checkzone database dlv dlvauto dlz
+	 dname dnssec forward glue ixfr limits logfileconfig lwresd
+	 masterfile masterformat metadata notify nsupdate pending
+	 pkcs11 resolver rrsetorder sortlist smartsign stub tkey
+	 unknown upforwd views xfer xferquota zonechecks"

 # PERL will be an empty string if no perl interpreter was found.
 PERL=@PERL@
@@ -0,0 +1,20 @@
+#!/bin/sh
+#
+# Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+# $Id: clean.sh,v 1.2.4.3 2011/02/28 01:19:27 tbox Exp $
+
+rm -f ns1/named.conf ns1/named.run ns1/named.memstats
+rm -f dig.out.*
--- a/Show More
+++ b/Show More