This commit was manufactured by cvs2git to create tag 'v9_7_1b1'.

2010-07-13 02:28:38 +00:00
320 changed files with 23320 additions and 17101 deletions
@@ -1,94 +1,3 @@
-	--- 9.7.2b1 released ---
-
-2930.	[experimental]	New "rndc addzone" and "rndc delzone" commads
-			allow dynamic addition and deletion of zones.
-			To enable this feature, specify a "new-zone-file"
-			option at the view or options level in named.conf.
-			Zone configuration information for the new zones
-			will be written into that file.  To make the new
-			zones persist after a restart, "include" the file
-			into named.conf in the appropriate view.  (Note:
-			This feature is not yet documented, and its syntax
-			is expected to change.) [RT #19447]
-
-2929.	[bug]		Improved handling of GSS security contexts: 
-			 - added LRU expiration for generated TSIGs
-			 - added the ability to use a non-default realm
-                         - added new "realm" keyword in nsupdate
-			 - limited lifetime of generated keys to 1 hour
-			   or the lifetime of the context (whichever is
-			   smaller)
-			[RT #19737]
-
-2925.	[bug]		Named failed to accept uncachable negative responses
-			from insecure zones. [RT# 21555]
-
-2924.	[func]		'rndc  secroots'  dump a combined summary of the
-			current managed keys combined with trusted keys.
-			[RT #20904]
-
-2923.	[bug]		'dig +trace' could drop core after "connection
-			timeout". [RT #21514]
-
-2922.	[contrib]	Update zkt to version 1.0.
-
-2921.	[bug]		The resolver could attempt to destroy a fetch context
-			too soon.  [RT #19878]
-
-2920.	[func]		Allow 'filter-aaaa-on-v4' to be applied selectively
-			to IPv4 clients.  New acl 'filter-aaaa' (default any).
-
-2919.	[func]		Add autosign-ksk and autosign-zsk virtual time tests.
-			[RT #20840]
-
-2918.	[maint]		Add AAAA address for I.ROOT-SERVERS.NET.
-
-2917.	[func]		Virtual time test framework. [RT #20801]
-
-2916.	[func]		Add framework to use IPv6 in tests.
-			fd92:7065:b8e:ffff::1 ... fd92:7065:b8e:ffff::7
-
-2915.	[cleanup]	Be smarter about which objects we attempt to compile
-			based on configure options. [RT #21444]
-
-2914.	[bug]		Make the "autosign" system test more portable.
-			[RT #20997]
-
-2913.	[func]		Add pkcs#11 system tests. [RT #20784]
-
-2912.	[func]		Windows clients don't like UPDATE responses that clear
-			the zone section. [RT #20986]
-
-2911.	[bug]		dnssec-signzone didn't handle out of zone records well.
-			[RT #21367]
-
-2910.	[func]		Sanity check Kerberos credentials. [RT #20986]
-
-	--- 9.7.1 released ---
-
-	--- 9.7.1rc1 released ---
-
-2909.	[bug]		named-checkconf -p could die if "update-policy local;"
-			was specified in named.conf. [RT #21416]
-
-2908.	[bug]		It was possible for re-signing to stop after removing
-			a DNSKEY. [RT #21384]
-
-2907.	[bug]		The export version of libdns had undefined references.
-			[RT #21444]
-
-2906.	[bug]		Address RFC 5011 implementation issues. [RT #20903]
-
-2905.	[port]		aix: set use_atomic=yes with native compiler.
-			[RT #21402]
-
-2904.   [bug]           When using DLV, sub-zones of the zones in the DLV,
-			could be incorrectly marked as insecure instead of
-			secure leading to negative proofs failing.  This was
-			a unintended outcome from change 2890. [RT# 21392]
-
-2903.	[bug]		managed-keys-directory missing from namedconf.c.
-			[RT #21370]

 	--- 9.7.1b1 released ---

@@ -48,27 +48,6 @@ BIND 9
 	For a detailed list of user-visible changes from
 	previous releases, see the CHANGES file.

-BIND 9.7.2
-
-	BIND 9.7.2 will address bugs in 9.7.1, and also introduces
-        some new functionality:
-
-        - "rndc addzone" and "rndc delzone" allow adding and deleting
-          zones at runtime.  This requires the view to have the
-          "new-zone-file" option set to a filename.  Zone configuration
-          information for new zones is specified in the 'rndc addzone'
-          command line, and is stored in that file.  To make new
-	  zones persist after a restart, "include" the file
-	  into named.conf in the appropriate view.  (Note:
-	  This feature is not yet documented, and its syntax
-          is expected to change.)
-        - "rndc secroots" dumps a list of the current trusted and
-          managed DNSSEC keys for each view.
-        - "filter-aaaa-on-v4" can now be applied selectively to
-          some IPv4 clients but not others, using the "filter-aaaa"
-          ACL.  (This feature requires BIND 9 to be built with
-          the --enable-filter-aaaa configure option.)
-
 BIND 9.7.1

 	BIND 9.7.1 is a maintenance release, fixing bugs in 9.7.0.
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dighost.c,v 1.328.22.3 2010/06/24 07:29:07 marka Exp $ */
+/* $Id: dighost.c,v 1.328.22.2 2010/05/18 02:35:11 tbox Exp $ */

 /*! \file
 *  \note
@@ -2401,15 +2401,6 @@ force_timeout(dig_lookup_t *l, dig_query_t *query) {
 		      isc_result_totext(ISC_R_NOMEMORY));
 	}
 	isc_task_send(global_task, &event);
-
-	/*
-	 * The timer may have expired if, for example, get_address() takes
-	 * long time and the timer was running on a different thread.
-	 * We need to cancel the possible timeout event not to confuse
-	 * ourselves due to the duplicate events.
-	 */
-	if (l->timer != NULL)
-		isc_timer_detach(&l->timer);
 }


@@ -2433,7 +2424,7 @@ send_tcp_connect(dig_query_t *query) {
 	query->waiting_connect = ISC_TRUE;
 	query->lookup->current_query = query;
 	result = get_address(query->servname, port, &query->sockaddr);
-	if (result != ISC_R_SUCCESS) {
+	if (result == ISC_R_NOTFOUND) {
 		/*
 		 * This servname doesn't have an address.  Try the next server
 		 * by triggering an immediate 'timeout' (we lie, but the effect
@@ -2515,7 +2506,7 @@ send_udp(dig_query_t *query) {
 		/* XXX Check the sense of this, need assertion? */
 		query->waiting_connect = ISC_FALSE;
 		result = get_address(query->servname, port, &query->sockaddr);
-		if (result != ISC_R_SUCCESS) {
+		if (result == ISC_R_NOTFOUND) {
 			/* This servname doesn't have an address. */
 			force_timeout(l, query);
 			return;
@@ -29,7 +29,7 @@
 * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: dnssec-signzone.c,v 1.258.4.4 2010/06/03 23:49:23 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.258.4.2 2010/01/05 23:47:58 tbox Exp $ */

 /*! \file */

@@ -1655,15 +1655,6 @@ verifyzone(void) {

 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		if (!dns_name_issubdomain(name, gorigin)) {
-			dns_db_detachnode(gdb, &node);
-			result = dns_dbiterator_next(dbiter);
-			if (result == ISC_R_NOMORE)
-				done = ISC_TRUE;
-			else
-				check_result(result, "dns_dbiterator_next()");
-			continue;
-		}
 		if (delegation(name, node, NULL)) {
 			zonecut = dns_fixedname_name(&fzonecut);
 			dns_name_copy(name, zonecut, NULL);
@@ -1999,46 +1990,6 @@ add_ds(dns_name_t *name, dns_dbnode_t *node, isc_uint32_t nsttl) {
 	}
 }

-/*
- * Remove records of the given type and their signatures.
- */
-static void
-remove_records(dns_dbnode_t *node, dns_rdatatype_t which) {
-	isc_result_t result;
-	dns_rdatatype_t type, covers;
-	dns_rdatasetiter_t *rdsiter = NULL;
-	dns_rdataset_t rdataset;
-
-	dns_rdataset_init(&rdataset);
-
-	/*
-	 * Delete any records of the given type at the apex.
-	 */
-	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
-	check_result(result, "dns_db_allrdatasets()");
-	for (result = dns_rdatasetiter_first(rdsiter);
-	     result == ISC_R_SUCCESS;
-	     result = dns_rdatasetiter_next(rdsiter)) {
-		dns_rdatasetiter_current(rdsiter, &rdataset);
-		type = rdataset.type;
-		covers = rdataset.covers;
-		dns_rdataset_disassociate(&rdataset);
-		if (type == which || covers == which) {
-			if (which == dns_rdatatype_nsec && !update_chain)
-				fatal("Zone contains NSEC records.  Use -u "
-				      "to update to NSEC3.");
-			if (which == dns_rdatatype_nsec3param && !update_chain)
-				fatal("Zone contains NSEC3 chains.  Use -u "
-				      "to update to NSEC.");
-			result = dns_db_deleterdataset(gdb, node, gversion,
-						       type, covers);
-			check_result(result, "dns_db_deleterdataset()");
-			continue;
-		}
-	}
-	dns_rdatasetiter_destroy(&rdsiter);
-}
-
 /*%
 * Generate NSEC records for the zone and remove NSEC3/NSEC3PARAM records.
 */
@@ -2098,25 +2049,36 @@ nsecify(void) {
 	result = dns_dbiterator_first(dbiter);
 	check_result(result, "dns_dbiterator_first()");

+	result = dns_dbiterator_current(dbiter, &node, name);
+	check_dns_dbiterator_current(result);
+
+	/*
+	 * Delete any NSEC3PARAM records at the apex.
+	 */
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+	check_result(result, "dns_db_allrdatasets()");
+	for (result = dns_rdatasetiter_first(rdsiter);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdatasetiter_next(rdsiter)) {
+		dns_rdatasetiter_current(rdsiter, &rdataset);
+		type = rdataset.type;
+		covers = rdataset.covers;
+		dns_rdataset_disassociate(&rdataset);
+		if (type == dns_rdatatype_nsec3param ||
+		    covers == dns_rdatatype_nsec3param) {
+			result = dns_db_deleterdataset(gdb, node, gversion,
+						       type, covers);
+			check_result(result,
+				     "dns_db_deleterdataset(nsec3param/rrsig)");
+			continue;
+		}
+	}
+	dns_rdatasetiter_destroy(&rdsiter);
+	dns_db_detachnode(gdb, &node);
+
 	while (!done) {
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		/*
-		 * Skip out-of-zone records.
-		 */
-		if (!dns_name_issubdomain(name, gorigin)) {
-			result = dns_dbiterator_next(dbiter);
-			if (result == ISC_R_NOMORE)
-				done = ISC_TRUE;
-			else
-				check_result(result, "dns_dbiterator_next()");
-			dns_db_detachnode(gdb, &node);
-			continue;
-		}
-
-		if (dns_name_equal(name, gorigin))
-			remove_records(node, dns_rdatatype_nsec3param);
-
 		if (delegation(name, node, &nsttl)) {
 			zonecut = dns_fixedname_name(&fzonecut);
 			dns_name_copy(name, zonecut, NULL);
@@ -2489,6 +2451,8 @@ nsec3ify(unsigned int hashalg, unsigned int iterations,
 	dns_fixedname_t fname, fnextname, fzonecut;
 	dns_name_t *name, *nextname, *zonecut;
 	dns_rdataset_t rdataset;
+	dns_rdatasetiter_t *rdsiter = NULL;
+	dns_rdatatype_t type, covers;
 	int order;
 	isc_boolean_t active;
 	isc_boolean_t done = ISC_FALSE;
@@ -2513,25 +2477,40 @@ nsec3ify(unsigned int hashalg, unsigned int iterations,
 	result = dns_dbiterator_first(dbiter);
 	check_result(result, "dns_dbiterator_first()");

+	result = dns_dbiterator_current(dbiter, &node, name);
+	check_dns_dbiterator_current(result);
+
+	/*
+	 * Delete any NSEC records at the apex.
+	 */
+	result = dns_db_allrdatasets(gdb, node, gversion, 0, &rdsiter);
+	check_result(result, "dns_db_allrdatasets()");
+	for (result = dns_rdatasetiter_first(rdsiter);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdatasetiter_next(rdsiter)) {
+		dns_rdatasetiter_current(rdsiter, &rdataset);
+		type = rdataset.type;
+		covers = rdataset.covers;
+		dns_rdataset_disassociate(&rdataset);
+		if (type == dns_rdatatype_nsec ||
+		    covers == dns_rdatatype_nsec) {
+			if (!update_chain)
+				fatal("Zone contains NSEC records.  Use -u "
+				      "to update to NSEC3.");
+
+			result = dns_db_deleterdataset(gdb, node, gversion,
+						       type, covers);
+			check_result(result,
+				     "dns_db_deleterdataset(nsec3param/rrsig)");
+			continue;
+		}
+	}
+	dns_rdatasetiter_destroy(&rdsiter);
+	dns_db_detachnode(gdb, &node);
+
 	while (!done) {
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		/*
-		 * Skip out-of-zone records.
-		 */
-		if (!dns_name_issubdomain(name, gorigin)) {
-			result = dns_dbiterator_next(dbiter);
-			if (result == ISC_R_NOMORE)
-				done = ISC_TRUE;
-			else
-				check_result(result, "dns_dbiterator_next()");
-			dns_db_detachnode(gdb, &node);
-			continue;
-		}
-
-		if (dns_name_equal(name, gorigin))
-			remove_records(node, dns_rdatatype_nsec);
-
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2648,18 +2627,6 @@ nsec3ify(unsigned int hashalg, unsigned int iterations,
 	while (!done) {
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
-		/*
-		 * Skip out-of-zone records.
-		 */
-		if (!dns_name_issubdomain(name, gorigin)) {
-			result = dns_dbiterator_next(dbiter);
-			if (result == ISC_R_NOMORE)
-				done = ISC_TRUE;
-			else
-				check_result(result, "dns_dbiterator_next()");
-			dns_db_detachnode(gdb, &node);
-			continue;
-		}
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.109.2.2 2010/06/20 23:46:24 tbox Exp $
+# $Id: Makefile.in,v 1.109 2009/12/05 23:31:40 each Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -118,7 +118,7 @@ main.@O@: main.c
 		-DNS_LOCALSTATEDIR=\"${localstatedir}\" \
 		-DNS_SYSCONFDIR=\"${sysconfdir}\" -c ${srcdir}/main.c

-bind.keys.h: ${top_srcdir}/bind.keys ${top_srcdir}/bind.keys
+bind.keys.h: ${top_srcdir}/bind.keys
 	${PERL} ${srcdir}/bindkeys.pl < ${top_srcdir}/bind.keys > $@

 config.@O@: config.c bind.keys.h
@@ -1,7 +1,3 @@
-/*
- * Generated by bindkeys.pl 1.3.104.2 2010/06/20 23:46:24 tbox Exp  
- * From bind.keys 1.5.42.1 2010/06/20 07:32:24 marka Exp  
- */
 #define TRUSTED_KEYS "\
 trusted-keys {\n\
        # NOTE: This key is current as of October 2009.\n\
@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
 #
-# Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,37 +14,19 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: bindkeys.pl,v 1.3.104.2 2010/06/20 23:46:24 tbox Exp $
+# $Id: bindkeys.pl,v 1.3 2009/09/01 07:14:25 each Exp $

 use strict;
 use warnings;

-my $rev = '$Id: bindkeys.pl,v 1.3.104.2 2010/06/20 23:46:24 tbox Exp $';
-$rev =~ s/\$//g;
-$rev =~ s/,v//g;
-$rev =~ s/Id: //;
-
-my $keys = "";
-
 my $lines;
 while (<>) {
    chomp;
-    if (/\/\* .Id:.* \*\//) {
-	$keys = $_;
-        next;
-    }
    s/\"/\\\"/g;
    s/$/\\n\\/;
    $lines .= $_ . "\n";
 }

-$keys =~ s/\$//g;
-$keys =~ s/\/\* Id: //;
-$keys =~ s/\*\/.*//;
-$keys =~ s/,v//;
-
-print "/*\n * Generated by $rev \n * From $keys\n */\n";
-
 my $mkey = '#define MANAGED_KEYS "\\' . "\n" . $lines . "\"\n";

 $lines =~ s/managed-keys/trusted-keys/;
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: config.c,v 1.106.4.5 2010/06/25 03:51:06 marka Exp $ */
+/* $Id: config.c,v 1.106.4.2 2010/05/14 23:49:18 tbox Exp $ */

 /*! \file */

@@ -80,7 +80,6 @@ options {\n\
 	bindkeys-file \"" NS_SYSCONFDIR "/bind.keys\";\n\
 	port 53;\n\
 	recursing-file \"named.recursing\";\n\
-	secroots-file \"named.secroots\";\n\
 "
 #ifdef PATH_RANDOMDEV
 "\
@@ -162,7 +161,6 @@ options {\n\
 "
 #ifdef ALLOW_FILTER_AAAA_ON_V4
 "	filter-aaaa-on-v4 no;\n\
-	filter-aaaa { any; };\n\
 "
 #endif

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: control.c,v 1.36.50.3 2010/07/11 00:12:18 each Exp $ */
+/* $Id: control.c,v 1.36 2009/10/12 20:48:11 each Exp $ */

 /*! \file */

@@ -153,8 +153,6 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 	} else if (command_compare(command, NS_COMMAND_DUMPDB)) {
 		ns_server_dumpdb(ns_g_server, command);
 		result = ISC_R_SUCCESS;
-	} else if (command_compare(command, NS_COMMAND_SECROOTS)) {
-		result = ns_server_dumpsecroots(ns_g_server, command);
 	} else if (command_compare(command, NS_COMMAND_TRACE)) {
 		result = ns_server_setdebuglevel(ns_g_server, command);
 	} else if (command_compare(command, NS_COMMAND_NOTRACE)) {
@@ -191,10 +189,6 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 		result = ns_server_validation(ns_g_server, command);
 	} else if (command_compare(command, NS_COMMAND_SIGN)) {
 		result = ns_server_sign(ns_g_server, command);
-	} else if (command_compare(command, NS_COMMAND_ADDZONE)) {
-		result = ns_server_add_zone(ns_g_server, command);
-	} else if (command_compare(command, NS_COMMAND_DELZONE)) {
-		result = ns_server_del_zone(ns_g_server, command);
 	} else {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: control.h,v 1.27.50.3 2010/07/11 00:12:18 each Exp $ */
+/* $Id: control.h,v 1.27 2009/10/12 23:48:01 tbox Exp $ */

 #ifndef NAMED_CONTROL_H
 #define NAMED_CONTROL_H 1
@@ -42,7 +42,6 @@
 #define NS_COMMAND_DUMPSTATS	"stats"
 #define NS_COMMAND_QUERYLOG	"querylog"
 #define NS_COMMAND_DUMPDB	"dumpdb"
-#define NS_COMMAND_SECROOTS	"secroots"
 #define NS_COMMAND_TRACE	"trace"
 #define NS_COMMAND_NOTRACE	"notrace"
 #define NS_COMMAND_FLUSH	"flush"
@@ -59,8 +58,6 @@
 #define NS_COMMAND_NOTIFY	"notify"
 #define NS_COMMAND_VALIDATION	"validation"
 #define NS_COMMAND_SIGN 	"sign"
-#define NS_COMMAND_ADDZONE	"addzone"
-#define NS_COMMAND_DELZONE	"delzone"

 isc_result_t
 ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: globals.h,v 1.86.60.2 2010/06/26 23:46:27 tbox Exp $ */
+/* $Id: globals.h,v 1.86 2009/10/05 17:30:49 fdupont Exp $ */

 #ifndef NAMED_GLOBALS_H
 #define NAMED_GLOBALS_H 1
@@ -149,7 +149,6 @@ EXTERN int			ns_g_listen		INIT(3);
 EXTERN isc_time_t		ns_g_boottime;
 EXTERN isc_boolean_t		ns_g_memstatistics	INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_clienttest		INIT(ISC_FALSE);
-EXTERN isc_boolean_t		ns_g_nosoa		INIT(ISC_FALSE);

 #undef EXTERN
 #undef INIT
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: server.h,v 1.104.8.4 2010/07/11 00:12:18 each Exp $ */
+/* $Id: server.h,v 1.104.8.2 2010/05/14 23:49:20 tbox Exp $ */

 #ifndef NAMED_SERVER_H
 #define NAMED_SERVER_H 1
@@ -54,7 +54,6 @@ struct ns_server {
 	dns_acl_t		*blackholeacl;
 	char *			statsfile;	/*%< Statistics file name */
 	char *			dumpfile;	/*%< Dump file name */
-	char *			secrootsfile;	/*%< Secroots file name */
 	char *			bindkeysfile;	/*%< bind.keys file name */
 	char *			recfile;	/*%< Recursive file name */
 	isc_boolean_t		version_set;	/*%< User has set version */
@@ -245,12 +244,6 @@ ns_server_dumpstats(ns_server_t *server);
 isc_result_t
 ns_server_dumpdb(ns_server_t *server, char *args);

-/*%
- * Dump the current security roots to the secroots file.
- */
-isc_result_t
-ns_server_dumpsecroots(ns_server_t *server, char *args);
-
 /*%
 * Change or increment the server debug level.
 */
@@ -319,16 +312,4 @@ ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr);
 isc_result_t
 ns_server_validation(ns_server_t *server, char *args);

-/*%
- * Add a zone to a running process
- */
-isc_result_t
-ns_server_add_zone(ns_server_t *server, char *args);
-
-/*%
- * Deletes a zone from a running process
- */
-isc_result_t
-ns_server_del_zone(ns_server_t *server, char *args);
-
 #endif /* NAMED_SERVER_H */
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: main.c,v 1.175.60.3 2010/06/26 23:46:27 tbox Exp $ */
+/* $Id: main.c,v 1.175 2009/10/05 17:30:49 fdupont Exp $ */

 /*! \file */

@@ -500,15 +500,13 @@ parse_command_line(int argc, char *argv[]) {
 			/* XXXJAB should we make a copy? */
 			ns_g_chrootdir = isc_commandline_argument;
 			break;
-		case 'T':	/* NOT DOCUMENTED */
+		case 'T':
 			/*
 			 * clienttest: make clients single shot with their
 			 * 	       own memory context.
 			 */
 			if (!strcmp(isc_commandline_argument, "clienttest"))
 				ns_g_clienttest = ISC_TRUE;
-			else if (!strcmp(isc_commandline_argument, "nosoa"))
-				ns_g_nosoa = ISC_TRUE;
 			else if (!strcmp(isc_commandline_argument, "maxudp512"))
 				maxudp = 512;
 			else if (!strcmp(isc_commandline_argument, "maxudp1460"))
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: query.c,v 1.335.8.7 2010/06/26 23:46:27 tbox Exp $ */
+/* $Id: query.c,v 1.335.8.3 2010/03/12 23:49:51 tbox Exp $ */

 /*! \file */

@@ -56,7 +56,6 @@
 #include <dns/zt.h>

 #include <named/client.h>
-#include <named/globals.h>
 #include <named/log.h>
 #include <named/server.h>
 #include <named/sortlist.h>
@@ -2039,7 +2038,7 @@ query_addrrset(ns_client_t *client, dns_name_t **namep,

 static inline isc_result_t
 query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
-	     isc_boolean_t zero_ttl, isc_boolean_t isassociated)
+	     isc_boolean_t zero_ttl)
 {
 	dns_name_t *name;
 	dns_dbnode_t *node;
@@ -2056,12 +2055,6 @@ query_addsoa(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version,
 	rdataset = NULL;
 	node = NULL;

-	/*
-	 * Don't add the SOA record for test which set "-T nosoa".
-	 */
-	if (ns_g_nosoa && (!WANTDNSSEC(client) || !isassociated))
-		return (ISC_R_SUCCESS);
-
 	/*
 	 * Get resources and make 'name' be the database origin.
 	 */
@@ -3709,18 +3702,6 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 	return;
 }

-#ifdef ALLOW_FILTER_AAAA_ON_V4
-static isc_boolean_t
-is_v4_client(ns_client_t *client) {
-	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET)
-		return (ISC_TRUE);
-	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
-	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
-		return (ISC_TRUE);
-	return (ISC_FALSE);
-}
-#endif
-
 /*
 * Do the bulk of query processing for the current query of 'client'.
 * If 'event' is non-NULL, we are returning from recursion and 'qtype'
@@ -4351,8 +4332,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		/*
 		 * Add SOA.
 		 */
-		result = query_addsoa(client, db, version, ISC_FALSE,
-				      dns_rdataset_isassociated(rdataset));
+		result = query_addsoa(client, db, version, ISC_FALSE);
 		if (result != ISC_R_SUCCESS) {
 			QUERY_ERROR(result);
 			goto cleanup;
@@ -4400,11 +4380,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		    zone != NULL &&
 #endif
 		    dns_zone_getzeronosoattl(zone))
-			result = query_addsoa(client, db, version, ISC_TRUE,
-					  dns_rdataset_isassociated(rdataset));
+			result = query_addsoa(client, db, version, ISC_TRUE);
 		else
-			result = query_addsoa(client, db, version, ISC_FALSE,
-					  dns_rdataset_isassociated(rdataset));
+			result = query_addsoa(client, db, version, ISC_FALSE);
 		if (result != ISC_R_SUCCESS) {
 			QUERY_ERROR(result);
 			goto cleanup;
@@ -4664,7 +4642,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

 	if (type == dns_rdatatype_any) {
 #ifdef ALLOW_FILTER_AAAA_ON_V4
-		isc_boolean_t have_aaaa, have_a, have_sig, filter_aaaa;
+		isc_boolean_t have_aaaa, have_a, have_sig;

 		/*
 		 * The filter-aaaa-on-v4 option should
@@ -4676,14 +4654,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		have_aaaa = ISC_FALSE;
 		have_a = !authoritative;
 		have_sig = ISC_FALSE;
-		if (client->view->v4_aaaa != dns_v4_aaaa_ok &&
-		    is_v4_client(client) &&
-		    ns_client_checkaclsilent(client, NULL,
-					     client->view->v4_aaaa_acl,
-					     ISC_TRUE) == ISC_R_SUCCESS)
-			filter_aaaa = ISC_TRUE;
-		else
-			filter_aaaa = ISC_FALSE;
 #endif
 		/*
 		 * XXXRTH  Need to handle zonecuts with special case
@@ -4717,7 +4687,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 * Notice the presence of A and AAAAs so
 			 * that AAAAs can be hidden from IPv4 clients.
 			 */
-			if (filter_aaaa) {
+			if (client->view->v4_aaaa != dns_v4_aaaa_ok &&
+			    client->peeraddr_valid &&
+			    client->peeraddr.type.sa.sa_family == AF_INET) {
 				if (rdataset->type == dns_rdatatype_aaaa)
 					have_aaaa = ISC_TRUE;
 				else if (rdataset->type == dns_rdatatype_a)
@@ -4774,7 +4746,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		 * Filter AAAAs if there is an A and there is no signature
 		 * or we are supposed to break DNSSEC.
 		 */
-		if (filter_aaaa && have_aaaa && have_a &&
+		if (have_aaaa && have_a &&
 		    (!have_sig || !WANTDNSSEC(client) ||
 		     client->view->v4_aaaa == dns_v4_aaaa_break_dnssec))
 			client->attributes |= NS_CLIENTATTR_FILTER_AAAA;
@@ -4821,7 +4793,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 * Add SOA.
 				 */
 				result = query_addsoa(client, db, version,
-						      ISC_FALSE, ISC_FALSE);
+						      ISC_FALSE);
 				if (result == ISC_R_SUCCESS)
 					result = ISC_R_NOMORE;
 			} else {
@@ -4851,10 +4823,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		 * unneeded that it is best to keep it as short as possible.
 		 */
 		if (client->view->v4_aaaa != dns_v4_aaaa_ok &&
-		    is_v4_client(client) &&
-		    ns_client_checkaclsilent(client, NULL,
-					     client->view->v4_aaaa_acl,
-					     ISC_TRUE) == ISC_R_SUCCESS &&
+		    client->peeraddr_valid &&
+		    client->peeraddr.type.sa.sa_family == AF_INET &&
 		    (!WANTDNSSEC(client) ||
 		     sigrdataset == NULL ||
 		     !dns_rdataset_isassociated(sigrdataset) ||
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: server.c,v 1.556.8.18 2010/07/12 18:52:23 each Exp $ */
+/* $Id: server.c,v 1.556.8.12 2010/05/18 00:29:31 marka Exp $ */

 /*! \file */

@@ -24,9 +24,6 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <limits.h>
-#include <ctype.h>
-#include <sys/types.h>
-#include <sys/stat.h>

 #include <isc/app.h>
 #include <isc/base64.h>
@@ -294,15 +291,6 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx);
 static void
 end_reserved_dispatches(ns_server_t *server, isc_boolean_t all);

-/*
- * Stores config for building zones after the fact
- */
-static cfg_obj_t *nzf_config = NULL;
-static cfg_parser_t *nzf_parser = NULL;
-static const char *nzf_file = NULL;
-static const cfg_obj_t *nzf_option = NULL;
-static cfg_aclconfctx_t nzf_actx;
-
 /*%
 * Configure a single view ACL at '*aclp'.  Get its configuration from
 * 'vconfig' (for per-view configuration) and maybe from 'config'
@@ -2140,10 +2128,8 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,
 		else
 			INSIST(0);
 	}
-	CHECK(configure_view_acl(vconfig, config, "filter-aaaa", NULL,
-				 actx, ns_g_mctx, &view->v4_aaaa_acl));
-#endif

+#endif
 	obj = NULL;
 	result = ns_config_get(maps, "dnssec-enable", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4011,17 +3997,6 @@ load_configuration(const char *filename, ns_server_t *server,
 		}
 	}

-	/* Are we preserving config for adding zones dynamically? */
-	obj = NULL;
-	result = cfg_map_get(options, "new-zone-file", &obj);
-	if (obj && nzf_option == NULL) {
-		nzf_file = cfg_obj_asstring(obj);
-		if (nzf_file && *nzf_file) {
-			/* Remember this configuration */
-			nzf_option = config;
-		}
-	}
-
 	/*
 	 * Rescan the interface list to pick up changes in the
 	 * listen-on option.  It's important that we do this before we try
@@ -4117,20 +4092,6 @@ load_configuration(const char *filename, ns_server_t *server,
 		CHECK(configure_view(view, config, vconfig,
 				     &cachelist, bindkeys,
 				     ns_g_mctx, &aclconfctx, ISC_TRUE));
-
-		if (vconfig != NULL) {
-			/*
-			 * Are we preserving config for dynamically added
-			 * zones?
-			 */
-			const cfg_obj_t *voptions;
-			voptions = cfg_tuple_get(vconfig, "options");
-			obj = NULL;
-			result = cfg_map_get(voptions, "new-zone-file", &obj);
-			if (obj && nzf_option == NULL)
-				nzf_option = config;
-		}
-
 		dns_view_freeze(view);
 		dns_view_detach(&view);
 	}
@@ -4389,12 +4350,6 @@ load_configuration(const char *filename, ns_server_t *server,
 	CHECKM(setstring(server, &server->dumpfile, cfg_obj_asstring(obj)),
 	       "strdup");

-	obj = NULL;
-	result = ns_config_get(maps, "secroots-file", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	CHECKM(setstring(server, &server->secrootsfile, cfg_obj_asstring(obj)),
-	       "strdup");
-
 	obj = NULL;
 	result = ns_config_get(maps, "recursing-file", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -4452,16 +4407,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	if (v6portset != NULL)
 		isc_portset_destroy(ns_g_mctx, &v6portset);

-	/* Preserve config, we'll need it when adding zones */
-	if (nzf_option != NULL) {
-		nzf_parser = conf_parser;
-		conf_parser = NULL;
-		nzf_config = config;
-		config = NULL;
-		memcpy(&nzf_actx, &aclconfctx, sizeof(cfg_aclconfctx_t));
-	} else {
-		cfg_aclconfctx_destroy(&aclconfctx);
-	}
+	cfg_aclconfctx_destroy(&aclconfctx);

 	if (conf_parser != NULL) {
 		if (config != NULL)
@@ -4669,12 +4615,6 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 	cfg_obj_destroy(ns_g_parser, &ns_g_config);
 	cfg_parser_destroy(&ns_g_parser);

-	if (nzf_config) {
-		cfg_aclconfctx_destroy(&nzf_actx);
-		cfg_obj_destroy(nzf_parser, &nzf_config);
-		cfg_parser_destroy(&nzf_parser);
-	}
-
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
 	     view = view_next) {
@@ -4821,11 +4761,6 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {
 	CHECKFATAL(server->dumpfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
 		   "isc_mem_strdup");

-	server->secrootsfile = isc_mem_strdup(server->mctx, "named.secroots");
-	CHECKFATAL(server->secrootsfile == NULL ? ISC_R_NOMEMORY :
-						  ISC_R_SUCCESS,
-		   "isc_mem_strdup");
-
 	server->recfile = isc_mem_strdup(server->mctx, "named.recursing");
 	CHECKFATAL(server->recfile == NULL ? ISC_R_NOMEMORY : ISC_R_SUCCESS,
 		   "isc_mem_strdup");
@@ -4896,7 +4831,6 @@ ns_server_destroy(ns_server_t **serverp) {
 	isc_mem_free(server->mctx, server->statsfile);
 	isc_mem_free(server->mctx, server->bindkeysfile);
 	isc_mem_free(server->mctx, server->dumpfile);
-	isc_mem_free(server->mctx, server->secrootsfile);
 	isc_mem_free(server->mctx, server->recfile);

 	if (server->version != NULL)
@@ -5148,9 +5082,7 @@ next_token(char **stringp, const char *delim) {
 * set '*zonep' to NULL.
 */
 static isc_result_t
-zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep,
-	       const char **zonename)
-{
+zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep) {
 	char *input, *ptr;
 	const char *zonetxt;
 	char *classtxt;
@@ -5174,8 +5106,6 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep,
 	zonetxt = next_token(&input, " \t");
 	if (zonetxt == NULL)
 		return (ISC_R_SUCCESS);
-	if (zonename)
-		*zonename = zonetxt;

 	/* Look for the optional class name. */
 	classtxt = next_token(&input, " \t");
@@ -5236,7 +5166,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args) {
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;

-	result = zone_from_args(server, args, &zone, NULL);
+	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL)
@@ -5260,7 +5190,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 	dns_zonetype_t type;
 	const char *msg = NULL;

-	result = zone_from_args(server, args, &zone, NULL);
+	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL) {
@@ -5320,7 +5250,7 @@ ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 	dns_zone_t *zone = NULL;
 	const unsigned char msg[] = "zone notify queued";

-	result = zone_from_args(server, args, &zone, NULL);
+	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL)
@@ -5345,7 +5275,7 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 	const unsigned char msg2[] = "not a slave or stub zone";
 	dns_zonetype_t type;

-	result = zone_from_args(server, args, &zone, NULL);
+	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL)
@@ -5761,68 +5691,6 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 	return (result);
 }

-isc_result_t
-ns_server_dumpsecroots(ns_server_t *server, char *args) {
-	dns_view_t *view;
-	dns_keytable_t *secroots = NULL;
-	isc_result_t result;
-	char *ptr;
-	FILE *fp = NULL;
-	isc_time_t now;
-	char tbuf[64];
-
-	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
-	if (ptr == NULL)
-		return (ISC_R_UNEXPECTEDEND);
-	ptr = next_token(&args, " \t");
-
-	CHECKMF(isc_stdio_open(server->secrootsfile, "w", &fp),
-		"could not open secroots dump file", server->secrootsfile);
-	TIME_NOW(&now);
-	isc_time_formattimestamp(&now, tbuf, sizeof(tbuf));
-	fprintf(fp, "%s\n", tbuf);
-
- nextview:
-	for (view = ISC_LIST_HEAD(server->viewlist);
-	     view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
-		if (ptr != NULL && strcmp(view->name, ptr) != 0)
-			continue;
-		if (secroots != NULL)
-			dns_keytable_detach(&secroots);
-		result = dns_view_getsecroots(view, &secroots);
-		if (result == ISC_R_NOTFOUND) {
-			result = ISC_R_SUCCESS;
-			continue;
-		}
-		fprintf(fp, "\n Start view %s\n\n", view->name);
-		CHECK(dns_keytable_dump(secroots, fp));
-	}
-	if (ptr != NULL) {
-		ptr = next_token(&args, " \t");
-		if (ptr != NULL)
-			goto nextview;
-	}
-
- cleanup:
-	if (secroots != NULL)
-		dns_keytable_detach(&secroots);
-	if (fp != NULL)
-		(void)isc_stdio_close(fp);
-	if (result == ISC_R_SUCCESS)
-		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "dumpsecroots complete");
-	else
-		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "dumpsecroots failed: %s",
-			      dns_result_totext(result));
-	return (result);
-}
-
 isc_result_t
 ns_server_dumprecursing(ns_server_t *server) {
 	FILE *fp = NULL;
@@ -6441,7 +6309,7 @@ ns_server_sign(ns_server_t *server, char *args) {
 	dns_zonetype_t type;
 	isc_uint16_t keyopts;

-	result = zone_from_args(server, args, &zone, NULL);
+	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL)
@@ -6481,7 +6349,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
 	isc_boolean_t frozen;
 	const char *msg = NULL;

-	result = zone_from_args(server, args, &zone, NULL);
+	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL) {
@@ -6599,504 +6467,3 @@ ns_smf_add_message(isc_buffer_t *text) {
 	return (ISC_R_SUCCESS);
 }
 #endif /* HAVE_LIBSCF */
-
-/*
- * Act on an "addzone" command from the command channel.
- */
-isc_result_t
-ns_server_add_zone(ns_server_t *server, char *args) {
-	isc_result_t	     result;
-	isc_buffer_t	     argbuf;
-	size_t		     arglen, len;
-	cfg_parser_t	    *parser = NULL;
-	cfg_obj_t	    *config = NULL;
-	const cfg_obj_t     *vconfig = NULL;
-	const cfg_obj_t     *views = NULL;
-	const cfg_listelt_t *element;
-	const cfg_obj_t     *parms = NULL;
-	const cfg_obj_t     *obj = NULL;
-	const char	    *zonename;
-	const char	    *classname = NULL;
-	const char	    *argp;
-	const char	    *viewname = NULL;
-	dns_rdataclass_t     rdclass;
-	dns_view_t	    *view = 0;
-	isc_buffer_t	     buf, *nbuf = NULL;
-	dns_name_t	     dnsname;
-	const char	    *filename = 0;
-	const char	    *filepart = NULL;
-	char		     fnamebuf[512];
-	struct stat	     sb;
-	dns_zone_t	    *zone = NULL;
-	FILE		    *fp = NULL;
-
-	/* Are we accepting new zones? */
-	if (nzf_option == NULL)
-		return (ISC_R_FAILURE);
-
-	/* Try to parse the argument string */
-	arglen = strlen(args);
-	isc_buffer_init(&argbuf, args, arglen);
-	isc_buffer_add(&argbuf, strlen(args));
-	CHECK(cfg_parser_create(server->mctx, ns_g_lctx, &parser));
-	CHECK(cfg_parse_buffer(parser, &argbuf, &cfg_type_addzoneconf,
-			       &config));
-	CHECK(cfg_map_get(config, "addzone", &parms));
-
-	zonename = cfg_obj_asstring(cfg_tuple_get(parms, "name"));
-	isc_buffer_init(&buf, zonename, strlen(zonename));
-	isc_buffer_add(&buf, strlen(zonename));
-	dns_name_init(&dnsname, NULL);
-	isc_buffer_allocate(server->mctx, &nbuf, 256);
-	dns_name_setbuffer(&dnsname, nbuf);
-	CHECK(dns_name_fromtext(&dnsname, &buf, dns_rootname, ISC_FALSE, NULL));
-
-	/*
-	 * If new-zone-file indicates a directory rather than a file,
-	 * then "filepart" is the filename in the directory in which to
-	 * write the zone configuration text.
-	 */
-	obj = cfg_tuple_get(parms, "filepart");
-	if (obj && cfg_obj_isstring(obj))
-		filepart = cfg_obj_asstring(obj);
-
-	if (filepart != NULL && *filepart != '\0') {
-		/* No hidden fles or full paths */
-		if (*filepart == '.' ||
-#ifdef WIN32
-		    *filepart == '\\' ||
-#endif
-		    *filepart == '/')
-		{
-			result = ISC_R_INVALIDFILE;
-			goto cleanup;
-		}
-		/* No crawling up the directory tree */
-		if (strstr(filepart, "..") != NULL) {
-			result = ISC_R_INVALIDFILE;
-			goto cleanup;
-		}
-	}
-
-	/* Make sense of optional class argument */
-	obj = cfg_tuple_get(parms, "class");
-	CHECK(ns_config_getclass(obj, dns_rdataclass_in, &rdclass));
-	if (rdclass != dns_rdataclass_in && obj)
-		classname = cfg_obj_asstring(obj);
-
-	/* Make sense of optional view argument */
-	obj = cfg_tuple_get(parms, "view");
-	if (obj && cfg_obj_isstring(obj))
-		viewname = cfg_obj_asstring(obj);
-	if (viewname == NULL || *viewname == '\0')
-		viewname = "_default";
-	CHECK(dns_viewlist_find(&server->viewlist, viewname, rdclass, &view));
-
-	/* Zone shouldn't already exist */
-	result = dns_zt_find(view->zonetable, &dnsname, 0, NULL, &zone);
-	if (result == ISC_R_SUCCESS) {
-		result = ISC_R_EXISTS;
-		goto cleanup;
-	} else if (result == DNS_R_PARTIALMATCH) {
-		/* Create our sub-zone anyway */
-		dns_zone_detach(&zone);
-		zone = NULL;
-	}
-	else if (result != ISC_R_NOTFOUND)
-		goto cleanup;
-
-	/* Find configuration for this view */
-	(void)cfg_map_get(nzf_config, "view", &views);
-	for (element = cfg_list_first(views);
-	     element != NULL;
-	     element = cfg_list_next(element))
-	{
-		const char *vname;
-
-		vconfig = cfg_listelt_value(element);
-		vname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name"));
-		if (vname && !strcasecmp(vname, viewname)) {
-			/* What is save file for this view? */
-			if (vconfig != NULL) {
-				const cfg_obj_t *voptions;
-				voptions = cfg_tuple_get(vconfig, "options");
-				if (voptions) {
-					obj = NULL;
-					result = cfg_map_get(voptions,
-							     "new-zone-file",
-							     &obj);
-					if (result == ISC_R_SUCCESS)
-						filename =
-							cfg_obj_asstring(obj);
-				}
-			}
-			break;
-		}
-		vconfig = NULL;
-	}
-
-	/* Can we add and remove zones in this view? */
-	if (filename == NULL || *filename == '\0')
-		filename = nzf_file;
-
-	if (filename == NULL || *filename == '\0') {
-		/* No adding zones in this view */
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	/* Possibly contruct a full path */
-	if (filepart != NULL && *filepart != '\0') {
-		snprintf(fnamebuf, 512, "%s/%s", filename, filepart);
-		filename = fnamebuf;
-	}
-
-	/* Path must be an existing file */
-	if (stat(filename, &sb) < 0) {
-		result = ISC_R_FILENOTFOUND;
-		goto cleanup;
-	}
-	if (!S_ISREG(sb.st_mode)) {
-		result = ISC_R_FILENOTFOUND;
-		goto cleanup;
-	}
-
-	/* Mark zone unfrozen so that zone can be added. */
-	dns_view_thaw(view);
-	result = configure_zone(nzf_option, parms, vconfig,
-		server->mctx, view, &nzf_actx);
-	dns_view_freeze(view);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	/* Is it there yet? */
-	CHECK(dns_zt_find(view->zonetable, &dnsname, 0, NULL, &zone));
-
-	/*
-	 * Load the zone from the master file.  If this fails, we'll
-	 * need to undo the configuration we've done already.
-	 */
-	result = dns_zone_loadnew(zone);
-	if (result != ISC_R_SUCCESS) {
-		dns_db_t *dbp = NULL;
-
-		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "addzone failed; reverting.");
-
-		/* If the zone loaded partially, unload it */
-		if (dns_zone_getdb(zone, &dbp) == ISC_R_SUCCESS) {
-			dns_db_detach(&dbp);
-			dns_zone_unload(zone);
-		}
-
-		/* Remove the zone from the zone table */
-		dns_zt_unmount(view->zonetable, zone);
-		goto cleanup;
-	}
-
-	/* Write zone configuration out to our save file */
-	CHECK(isc_stdio_open(filename, "a", &fp));
-
-	/* Emit just the zone name from args */
-	CHECK(isc_stdio_write("zone ", 5, 1, fp, &len));
-	CHECK(isc_stdio_write(zonename, strlen(zonename), 1, fp, &len));
-	CHECK(isc_stdio_write(" ", 1, 1, fp, &len));
-
-	/* Classname, if not default */
-	if (classname != NULL && *classname != '\0') {
-		CHECK(isc_stdio_write(classname, strlen(classname), 1, fp,
-				      &len));
-		CHECK(isc_stdio_write(" ", 1, 1, fp, &len));
-	}
-
-	/* Find beginning of option block from args */
-	for (argp = args; *argp; argp++, arglen--) {
-		if (*argp == '{') {	/* Assume matching '}' */
-			/* Add that to our file */
-			CHECK(isc_stdio_write(argp, arglen, 1, fp, &len));
-
-			/* Make sure we end with a LF */
-			if (argp[arglen-1] != '\n') {
-				CHECK(isc_stdio_write("\n", 1, 1, fp, &len));
-			}
-			break;
-		}
-	}
-
-	CHECK(isc_stdio_close(fp));
-	fp = NULL;
-	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-				  NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-				  "zone %s added to view %s via addzone",
-				  zonename, viewname);
-
-	result = ISC_R_SUCCESS;
-
- cleanup:
-	if (fp != NULL)
-		isc_stdio_close(fp);
-	if (parser != NULL) {
-		if (config != NULL)
-			cfg_obj_destroy(parser, &config);
-		cfg_parser_destroy(&parser);
-	}
-	if (zone != NULL)
-		dns_zone_detach(&zone);
-	if (view != NULL)
-		dns_view_detach(&view);
-	if (nbuf != NULL)
-		isc_buffer_free(&nbuf);
-
-	return (result);
-}
-
-/*
- * Pull an optional quoted filepart out of an arglist, shuffling memory
- * so we can hand it off to zone_from_args() later
- */
-static char *
-extract_optional_qstring(char **args) {
-	char  *p = *args;
-	char  *str, *d;
-	char   quote;
-
-	/* Skip past the command name */
-	while (isspace(*p))
-		p++;
-	while (*p && !isspace(*p))
-		p++;
-
-	/* Look for an open quote */
-	while (isspace(*p))
-		p++;
-	if (*p != '\'' && *p !=  '"')
-		return (NULL);
-
-	/* Move that string to the front of the buf */
-	quote = *p++;
-	str = d = *args;
-	while (*p && *p != quote)
-		*d++ = *p++;
-	if (!*p)
-		return (NULL);  /* No matching close quote */
-
-	/* End that string */
-	*d++ = 0;
-	*args = d;
-
-	/* A bogus command name to placate zone_from_args() */
-	*d++ = 'X';
-
-	/* Cover over any remainder with spaces */
-	while (d <= p)
-		*d++ = ' ';
-
-	return (str);
-}
-
-/*
- * Act on a "delzone" command from the command channel.
- */
-isc_result_t
-ns_server_del_zone(ns_server_t *server, char *args) {
-	isc_result_t	       result;
-	dns_zone_t	      *zone = NULL;
-	dns_view_t	      *view = NULL;
-	const cfg_obj_t       *views = NULL;
-	const cfg_obj_t       *obj = NULL;
-	const cfg_obj_t       *vconfig = NULL;
-	dns_db_t	      *dbp = NULL;
-	const char	      *filename = NULL;
-	char		      *filepart = NULL;
-	char		       fnamebuf[512];
-	char		      *tmpname = NULL;
-	const cfg_listelt_t   *element;
-	char		       buf[1024];
-	const char	      *zonename = NULL;
-	size_t		       znamelen = 0;
-	FILE		      *ifp = NULL, *ofp = NULL;
-
-	/* Only accept removes if we're accepting adds */
-	if (nzf_option == NULL)
-		return (ISC_R_FAILURE);
-
-	/* Possibly a filename in quotes */
-	filepart = extract_optional_qstring(&args);
-	if (filepart != NULL && *filepart != '\0') {
-		/* No hidden fles or full paths */
-		if (*filepart == '.' ||
-#ifdef WIN32
-		    *filepart == '\\' ||
-#endif
-		    *filepart == '/')
-		{
-			result = ISC_R_INVALIDFILE;
-			goto cleanup;
-		}
-		/* No crawling up the directory tree */
-		if (strstr(filepart, "..") != NULL) {
-			result = ISC_R_INVALIDFILE;
-			goto cleanup;
-		}
-	}
-
-	/* Make sense of rest of params */
-	CHECK(zone_from_args(server, args, &zone, &zonename));
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	if (zone == NULL) {
-		result = ISC_R_UNEXPECTEDEND;
-		goto cleanup;
-	}
-
-	if (zonename != NULL && *zonename != '\0')
-		znamelen = strlen(zonename);
-
-	/* Dig out configuration for this zone */
-	view = dns_zone_getview(zone);
-	(void)cfg_map_get(nzf_config, "view", &views);
-	for (element = cfg_list_first(views);
-	     element != NULL;
-	     element = cfg_list_next(element))
-	{
-		const char *vname;
-
-		vconfig = cfg_listelt_value(element);
-		vname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name"));
-		if (vname != NULL && !strcasecmp(vname, view->name)) {
-			/* What is save file for this view? */
-			if (vconfig != NULL) {
-				const cfg_obj_t *voptions;
-				voptions = cfg_tuple_get(vconfig, "options");
-				if (voptions != NULL) {
-					obj = NULL;
-					result = cfg_map_get(voptions,
-							     "new-zone-file",
-							     &obj);
-					if (result == ISC_R_SUCCESS)
-						filename =
-							cfg_obj_asstring(obj);
-				}
-			}
-			break;
-		}
-		vconfig = NULL;
-	}
-
-	/* Can we add and remove zones in this view? */
-	if (filename == NULL || *filename == '\0')
-		filename = nzf_file;
-
-	if (filename == NULL || *filename == '\0') {
-		/* No adding zones in this view */
-		result = ISC_R_FAILURE;
-		goto cleanup;
-	}
-
-	/* Possibly contruct a full path */
-	if (filepart != NULL && *filepart != '\0') {
-		snprintf(fnamebuf, 512, "%s/%s", filename, filepart);
-		filename = fnamebuf;
-	}
-
-	/* Rewrite zone list */
-	result = isc_stdio_open(filename, "r", &ifp);
-	if (ifp != NULL && result == ISC_R_SUCCESS) {
-		char *found = NULL, *p;
-		size_t n;
-
-		/* Create a temporary file */
-		CHECK(isc_string_printf(buf, 1023, "%s.%d", filename,
-					getpid()));
-		if (!(tmpname = isc_mem_strdup(server->mctx, buf))) {
-			result = ISC_R_NOMEMORY;
-			goto cleanup;
-		}
-		CHECK(isc_stdio_open(tmpname, "w", &ofp));
-
-		/* Look for the entry for that zone */
-		while (fgets(buf, 1024, ifp)) {
-			/* A 'zone' line */
-			if (strncasecmp(buf, "zone", 4)) {
-				fputs(buf, ofp);
-				continue;
-			}
-			p = buf+4;
-
-			/* Locate a name */
-			while (*p && ((*p == '"') || isspace(*p)))
-				p++;
-
-			/* Is that the zone we're looking for */
-			if (strncasecmp(p, zonename, znamelen)) {
-				fputs(buf, ofp);
-				continue;
-			}
-
-			/* And nothing else? */
-			p += znamelen;
-			if (isspace(*p) || *p == '"' || *p == '{') {
-				/* This must be the entry */
-				found = p;
-				break;
-			}
-
-			/* Spit it out, keep looking */
-			fputs(buf, ofp);
-		}
-
-		/* Skip over an option block (matching # of braces) */
-		if (found) {
-			int obrace = 0, cbrace = 0;
-			while (1) {
-				while (*p) {
-					if (*p == '{') obrace++;
-					if (*p == '}') cbrace++;
-					p++;
-				}
-				if (obrace && (obrace == cbrace))
-					break;
-				if (!fgets(buf, 1024, ifp))
-					break;
-				p = buf;
-			}
-		}
-
-		/* Just spool the remainder of the file out */
-		while ((n = fread(buf, 1, 1024, ifp)) > 0)
-			fwrite(buf, 1, n, ofp);
-
-		/* Move temporary into place */
-		CHECK(isc_file_rename(tmpname, filename));
-	}
-
-	/* Stop answering for this zone */
-	if (dns_zone_getdb(zone, &dbp) == ISC_R_SUCCESS) {
-		dns_db_detach(&dbp);
-		dns_zone_unload(zone);
-	}
-
-	CHECK(dns_zt_unmount(view->zonetable, zone));
-
-	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-				  NS_LOGMODULE_SERVER, ISC_LOG_INFO,
-				  "zone %s removed via delzone", zonename);
-
-	result = ISC_R_SUCCESS;
-
- cleanup:
-	if (ifp != NULL)
-		isc_stdio_close(ifp);
-	if (ofp != NULL) {
-		isc_stdio_close(ofp);
-		isc_file_remove(tmpname);
-	}
-	if (tmpname != NULL)
-		isc_mem_free(server->mctx, tmpname);
-	if (zone != NULL)
-		dns_zone_detach(&zone);
-
-	return (result);
-}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: xfrout.c,v 1.136.132.2 2010/05/27 23:49:54 tbox Exp $ */
+/* $Id: xfrout.c,v 1.136 2009/06/30 02:52:32 each Exp $ */

 #include <config.h>

@@ -810,13 +810,11 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 #ifdef DLZ
 	{
 		/*
-		 * Normal zone table does not have a match.
-		 * Try the DLZ database
+		 * Normal zone table does not have a match.  Try the DLZ database
 		 */
 		if (client->view->dlzdatabase != NULL) {
 			result = dns_dlzallowzonexfr(client->view,
-						     question_name,
-						     &client->peeraddr,
+						     question_name, &client->peeraddr,
 						     &db);

 			if (result == ISC_R_NOPERM) {
@@ -1055,9 +1053,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {

 #ifdef DLZ
 	if (is_dlz)
-		CHECK(xfrout_ctx_create(mctx, client, request->id,
-					question_name, reqtype, question_class,
-					zone, db, ver, quota, stream,
+		CHECK(xfrout_ctx_create(mctx, client, request->id, question_name,
+					reqtype, question_class, zone, db, ver,
+					quota, stream,
 					dns_message_gettsigkey(request),
 					tsigbuf,
 					3600,
@@ -1067,9 +1065,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 					&xfr));
 	else
 #endif
-		CHECK(xfrout_ctx_create(mctx, client, request->id,
-					question_name, reqtype, question_class,
-					zone, db, ver, quota, stream,
+		CHECK(xfrout_ctx_create(mctx, client, request->id, question_name,
+					reqtype, question_class, zone, db, ver,
+					quota, stream,
 					dns_message_gettsigkey(request),
 					tsigbuf,
 					dns_zone_getmaxxfrout(zone),
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: zoneconf.c,v 1.161.4.2 2010/07/11 23:46:35 tbox Exp $ */
+/* $Id: zoneconf.c,v 1.161 2009/12/04 21:09:32 marka Exp $ */

 /*% */

@@ -558,28 +558,6 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS)
 		filename = cfg_obj_asstring(obj);

-	/*
-	 * Unless we're using some alternative database, a master zone
-	 * will be needing a master file.
-	 */
-	if (ztype == dns_zone_master && cpval == default_dbtype) {
-		if (filename == NULL) {
-			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "zone '%s': 'file' not specified",
-				      zname);
-			return (ISC_R_FAILURE);
-		}
-
-		if (!isc_file_exists(filename)) {
-			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
-				      "zone '%s': master file not found",
-				      zname);
-			return (ISC_R_NOTFOUND);
-		}
-	}
-
 	masterformat = dns_masterformat_text;
 	obj = NULL;
 	result= ns_config_get(maps, "masterfile-format", &obj);
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nsupdate.1,v 1.11.42.2 2010/07/10 02:41:30 tbox Exp $
+.\" $Id: nsupdate.1,v 1.11.42.1 2009/12/17 02:57:07 tbox Exp $
 .\"
 .hy 0
 .ad l
@@ -241,28 +241,6 @@ or
 \fB\-k\fR.
 .RE
 .PP
-\fBgsstsig\fR
-.RS 4
-Use GSS\-TSIG to sign the updated. This is equivalent to specifying
-\fB\-g\fR
-on the commandline.
-.RE
-.PP
-\fBoldgsstsig\fR
-.RS 4
-Use the Windows 2000 version of GSS\-TSIG to sign the updated. This is equivalent to specifying
-\fB\-o\fR
-on the commandline.
-.RE
-.PP
-\fBrealm\fR {[realm_name]}
-.RS 4
-When using GSS\-TSIG use
-\fIrealm_name\fR
-rather than the default realm in
-\fIkrb5.conf\fR. If no realm is specified the saved realm is cleared.
-.RE
-.PP
 \fBprereq nxdomain\fR {domain\-name}
 .RS 4
 Requires that no resource record of any type exists with name
@@ -435,7 +413,7 @@ RFC 2931,
 .PP
 The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2010 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: nsupdate.c,v 1.173.66.6 2010/07/09 23:46:27 tbox Exp $ */
+/* $Id: nsupdate.c,v 1.173.66.4 2010/05/18 06:24:27 marka Exp $ */

 /*! \file */

@@ -195,7 +195,6 @@ ddebug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 #ifdef GSSAPI
 static dns_fixedname_t fkname;
 static isc_sockaddr_t *kserver = NULL;
-static char *realm = NULL;
 static char servicename[DNS_NAME_FORMATSIZE];
 static dns_name_t *keyname;
 typedef struct nsu_gssinfo {
@@ -549,8 +548,7 @@ setup_keystr(void) {

 	debug("keycreate");
 	result = dns_tsigkey_create(keyname, hmacname, secret, secretlen,
-				    ISC_FALSE, NULL, 0, 0, mctx, NULL,
-				    &tsigkey);
+				    ISC_TRUE, NULL, 0, 0, mctx, NULL, &tsigkey);
 	if (result != ISC_R_SUCCESS)
 		fprintf(stderr, "could not create key from %s: %s\n",
 			keystr, dns_result_totext(result));
@@ -1464,7 +1462,7 @@ evaluate_key(char *cmdline) {
 	if (tsigkey != NULL)
 		dns_tsigkey_detach(&tsigkey);
 	result = dns_tsigkey_create(keyname, hmacname, secret, secretlen,
-				    ISC_FALSE, NULL, 0, 0, mctx, NULL,
+				    ISC_TRUE, NULL, 0, 0, mctx, NULL,
 				    &tsigkey);
 	isc_mem_free(mctx, secret);
 	if (result != ISC_R_SUCCESS) {
@@ -1502,31 +1500,6 @@ evaluate_zone(char *cmdline) {
 	return (STATUS_MORE);
 }

-static isc_uint16_t
-evaluate_realm(char *cmdline) {
-#ifdef GSSAPI
-	char *word;
-	char buf[1024];
-
-	word = nsu_strsep(&cmdline, " \t\r\n");
-	if (*word == 0) {
-		if (realm != NULL)
-			isc_mem_free(mctx, realm);
-		realm = NULL;
-		return (STATUS_MORE);
-	}
-
-	snprintf(buf, sizeof(buf), "@%s", word);
-	realm = isc_mem_strdup(mctx, buf);
-	if (realm == NULL)
-		fatal("out of memory");
-	return (STATUS_MORE);
-#else
-	UNUSED(cmdline);
-	return (STATUS_SYNTAX);
-#endif
-}
-
 static isc_uint16_t
 evaluate_ttl(char *cmdline) {
 	char *word;
@@ -1918,8 +1891,6 @@ get_next_command(void) {
 		usegsstsig = ISC_FALSE;
 		return (evaluate_key(cmdline));
 	}
-	if (strcasecmp(word, "realm") == 0)
-		return (evaluate_realm(cmdline));
 	if (strcasecmp(word, "gsstsig") == 0) {
 #ifdef GSSAPI
 		usegsstsig = ISC_TRUE;
@@ -2452,7 +2423,7 @@ start_gssrequest(dns_name_t *master)
 	servname = dns_fixedname_name(&fname);

 	result = isc_string_printf(servicename, sizeof(servicename),
-				   "DNS/%s%s", namestr, realm ? realm : "");
+				   "DNS/%s", namestr);
 	if (result != ISC_R_SUCCESS)
 		fatal("isc_string_printf(servicename) failed: %s",
 		      isc_result_totext(result));
@@ -2490,6 +2461,7 @@ start_gssrequest(dns_name_t *master)
 		      isc_result_totext(result));

 	/* Build first request. */
+
 	context = GSS_C_NO_CONTEXT;
 	result = dns_tkey_buildgssquery(rmsg, keyname, servname, NULL, 0,
 					&context, use_win2k_gsstsig);
@@ -2791,10 +2763,6 @@ cleanup(void) {
 		isc_mem_put(mctx, kserver, sizeof(isc_sockaddr_t));
 		kserver = NULL;
 	}
-	if (realm != NULL) {
-		isc_mem_free(mctx, realm);
-		realm = NULL;
-	}
 #endif

 	ddebug("Shutting down task manager");
@@ -2,7 +2,7 @@
               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
 - PERFORMANCE OF THIS SOFTWARE.
 -->

-<!-- $Id: nsupdate.docbook,v 1.41.42.3 2010/07/09 23:46:27 tbox Exp $ -->
+<!-- $Id: nsupdate.docbook,v 1.41.42.1 2009/12/16 07:12:49 each Exp $ -->
 <refentry id="man.nsupdate">
  <refentryinfo>
    <date>Aug 25, 2009</date>
@@ -41,7 +41,6 @@
      <year>2007</year>
      <year>2008</year>
      <year>2009</year>
-      <year>2010</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -383,45 +382,6 @@
          </listitem>
        </varlistentry>

-        <varlistentry>
-          <term>
-            <command>gsstsig</command>
-          </term>
-          <listitem>
-            <para>
-	      Use GSS-TSIG to sign the updated.  This is equivalent to
-	      specifying <option>-g</option> on the commandline.
-            </para>
-          </listitem>
-        </varlistentry>
-
-        <varlistentry>
-          <term>
-            <command>oldgsstsig</command>
-          </term>
-          <listitem>
-            <para>
-	      Use the Windows 2000 version of GSS-TSIG to sign the updated.
-	      This is equivalent to specifying <option>-o</option> on the
-	      commandline.
-            </para>
-          </listitem>
-        </varlistentry>
-
-        <varlistentry>
-          <term>
-            <command>realm</command>
-            <arg choice="req"><optional>realm_name</optional></arg>
-          </term>
-          <listitem>
-            <para>
-	      When using GSS-TSIG use <parameter>realm_name</parameter> rather
-	      than the default realm in <filename>krb5.conf</filename>.  If no
-	      realm is specified the saved realm is cleared.
-            </para>
-          </listitem>
-        </varlistentry>
-
        <varlistentry>
          <term>
              <command>prereq nxdomain</command>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nsupdate.html,v 1.48.42.2 2010/07/10 02:41:30 tbox Exp $ -->
+<!-- $Id: nsupdate.html,v 1.48.42.1 2009/12/17 02:57:07 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [<code class="option">-D</code>] [[<code class="option">-g</code>] |  [<code class="option">-o</code>] |  [<code class="option">-l</code>] |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543457"></a><h2>DESCRIPTION</h2>
+<a name="id2543453"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">nsupdate</strong></span>
      is used to submit Dynamic DNS Update requests as defined in RFC 2136
      to a name server.
@@ -192,7 +192,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543788"></a><h2>INPUT FORMAT</h2>
+<a name="id2543785"></a><h2>INPUT FORMAT</h2>
 <p><span><strong class="command">nsupdate</strong></span>
      reads input from
      <em class="parameter"><code>filename</code></em>
@@ -306,30 +306,6 @@
              overrides any key specified on the command line via
              <code class="option">-y</code> or <code class="option">-k</code>.
            </p></dd>
-<dt><span class="term">
-            <span><strong class="command">gsstsig</strong></span>
-          </span></dt>
-<dd><p>
-	      Use GSS-TSIG to sign the updated.  This is equivalent to
-	      specifying <code class="option">-g</code> on the commandline.
-            </p></dd>
-<dt><span class="term">
-            <span><strong class="command">oldgsstsig</strong></span>
-          </span></dt>
-<dd><p>
-	      Use the Windows 2000 version of GSS-TSIG to sign the updated.
-	      This is equivalent to specifying <code class="option">-o</code> on the
-	      commandline.
-            </p></dd>
-<dt><span class="term">
-            <span><strong class="command">realm</strong></span>
-             {[<span class="optional">realm_name</span>]}
-          </span></dt>
-<dd><p>
-	      When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather
-	      than the default realm in <code class="filename">krb5.conf</code>.  If no
-	      realm is specified the saved realm is cleared.
-            </p></dd>
 <dt><span class="term">
              <span><strong class="command">prereq nxdomain</strong></span>
               {domain-name}
@@ -480,7 +456,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544700"></a><h2>EXAMPLES</h2>
+<a name="id2544626"></a><h2>EXAMPLES</h2>
 <p>
      The examples below show how
      <span><strong class="command">nsupdate</strong></span>
@@ -534,7 +510,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544744"></a><h2>FILES</h2>
+<a name="id2544669"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -557,7 +533,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544827"></a><h2>SEE ALSO</h2>
+<a name="id2544753"></a><h2>SEE ALSO</h2>
 <p>
      <em class="citetitle">RFC 2136</em>,
      <em class="citetitle">RFC 3007</em>,
@@ -572,7 +548,7 @@
    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2542154"></a><h2>BUGS</h2>
+<a name="id2542148"></a><h2>BUGS</h2>
 <p>
      The TSIG key is redundantly stored in two separate files.
      This is a consequence of nsupdate using the DST library
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: rndc.c,v 1.126.66.4 2010/07/11 00:12:18 each Exp $ */
+/* $Id: rndc.c,v 1.126.66.1 2009/12/18 07:59:09 each Exp $ */

 /*! \file */

@@ -123,8 +123,6 @@ command is one of the following:\n\
  querylog	Toggle query logging.\n\
  dumpdb [-all|-cache|-zones] [view ...]\n\
 		Dump cache(s) to the dump file (named_dump.db).\n\
-  secroots [view ...]\n\
-		Write security roots to the secroots file.\n\
  stop		Save pending updates to master files and stop the server.\n\
  stop -p	Save pending updates to master files and stop the server\n\
 		reporting process id.\n\
@@ -143,10 +141,6 @@ command is one of the following:\n\
  validation newstate [view]\n\
 		Enable / disable DNSSEC validation.\n\
  *restart	Restart the server.\n\
-  addzone [\"file\"] zone [class [view]] { zone-options }\n\
-		Add zone to given view. Requires new-zone-file option.\n\
-  delzone [\"file\"] zone [class [view]]\n\
-		Removes zone from given view. Requires new-zone-file option.\n\
 \n\
 * == not yet implemented\n\
 Version: %s\n",
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2007, 2008, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: Makefile.in,v 1.31.268.2 2010/06/23 23:46:35 tbox Exp $
+# $Id: Makefile.in,v 1.31 2008/09/25 04:02:38 tbox Exp $

 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -21,7 +21,7 @@ top_srcdir =	@top_srcdir@

@BIND9_MAKE_INCLUDES@

-SUBDIRS =	filter-aaaa lwresd tkey 
+SUBDIRS =	lwresd tkey
 TARGETS =

@BIND9_MAKE_RULES@
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: keygen.sh,v 1.3.6.4 2010/06/07 04:47:26 marka Exp $
+# $Id: keygen.sh,v 1.3.6.3 2010/01/18 23:48:01 tbox Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -52,10 +52,6 @@ zone=bar
 zonefile="${zone}.db"
 infile="${zonefile}.in"
 cat $infile > $zonefile
-for i in Xbar.+005+30676.key Xbar.+005+30804.key Xbar.+005+30676.private \
-	 Xbar.+005+30804.private
-do
-	cp $i `echo $i | sed s/X/K/`
-done
+sh revkeys.shar > /dev/null
 $KEYGEN -3 -q -r $RANDFILE $zone > /dev/null
 $DSFROMKEY Kbar.+005+30804.key > dsset-bar.
@@ -0,0 +1,231 @@
+#!/bin/sh
+# This is a shell archive (produced by GNU sharutils 4.6.3).
+# To extract the files from this archive, save it to some FILE, remove
+# everything before the `#!/bin/sh' line above, then type `sh FILE'.
+#
+lock_dir=_sh31052
+# Made on 2010-01-08 23:17 PST by <each@pisces>.
+# Source directory was `/home/each/isc/bind9/bin/tests/system/autosign/ns2/keys'.
+#
+# Existing files will *not* be overwritten, unless `-c' is specified.
+#
+# This shar contains:
+# length mode       name
+# ------ ---------- ------------------------------------------
+#    538 -rw-r--r-- Kbar.+005+30676.key
+#   1774 -rw-r--r-- Kbar.+005+30676.private
+#    538 -rw-r--r-- Kbar.+005+30804.key
+#   1774 -rw-r--r-- Kbar.+005+30804.private
+#
+MD5SUM=${MD5SUM-md5sum}
+f=`${MD5SUM} --version | egrep '^md5sum .*(core|text)utils'`
+test -n "${f}" && md5check=true || md5check=false
+${md5check} || \
+  echo 'Note: not verifying md5sums.  Consider installing GNU coreutils.'
+save_IFS="${IFS}"
+IFS="${IFS}:"
+gettext_dir=FAILED
+locale_dir=FAILED
+first_param="$1"
+for dir in $PATH
+do
+  if test "$gettext_dir" = FAILED && test -f $dir/gettext \
+     && ($dir/gettext --version >/dev/null 2>&1)
+  then
+    case `$dir/gettext --version 2>&1 | sed 1q` in
+      *GNU*) gettext_dir=$dir ;;
+    esac
+  fi
+  if test "$locale_dir" = FAILED && test -f $dir/shar \
+     && ($dir/shar --print-text-domain-dir >/dev/null 2>&1)
+  then
+    locale_dir=`$dir/shar --print-text-domain-dir`
+  fi
+done
+IFS="$save_IFS"
+if test "$locale_dir" = FAILED || test "$gettext_dir" = FAILED
+then
+  echo=echo
+else
+  TEXTDOMAINDIR=$locale_dir
+  export TEXTDOMAINDIR
+  TEXTDOMAIN=sharutils
+  export TEXTDOMAIN
+  echo="$gettext_dir/gettext -s"
+fi
+if (echo "testing\c"; echo 1,2,3) | grep c >/dev/null
+then if (echo -n test; echo 1,2,3) | grep n >/dev/null
+     then shar_n= shar_c='
+'
+     else shar_n=-n shar_c= ; fi
+else shar_n= shar_c='\c' ; fi
+f=shar-touch.$$
+st1=200112312359.59
+st2=123123592001.59
+st2tr=123123592001.5 # old SysV 14-char limit
+st3=1231235901
+
+if touch -am -t ${st1} ${f} >/dev/null 2>&1 && \
+   test ! -f ${st1} && test -f ${f}; then
+  shar_touch='touch -am -t $1$2$3$4$5$6.$7 "$8"'
+
+elif touch -am ${st2} ${f} >/dev/null 2>&1 && \
+   test ! -f ${st2} && test ! -f ${st2tr} && test -f ${f}; then
+  shar_touch='touch -am $3$4$5$6$1$2.$7 "$8"'
+
+elif touch -am ${st3} ${f} >/dev/null 2>&1 && \
+   test ! -f ${st3} && test -f ${f}; then
+  shar_touch='touch -am $3$4$5$6$2 "$8"'
+
+else
+  shar_touch=:
+  echo
+  ${echo} 'WARNING: not restoring timestamps.  Consider getting and'
+  ${echo} 'installing GNU `touch'\'', distributed in GNU coreutils...'
+  echo
+fi
+rm -f ${st1} ${st2} ${st2tr} ${st3} ${f}
+#
+if test ! -d ${lock_dir}
+then : ; else ${echo} 'lock directory '${lock_dir}' exists'
+  exit 1
+fi
+if mkdir ${lock_dir}
+then ${echo} 'x - created lock directory `'${lock_dir}\''.'
+else ${echo} 'x - failed to create lock directory `'${lock_dir}\''.'
+  exit 1
+fi
+# ============= Kbar.+005+30676.key ==============
+if test -f 'Kbar.+005+30676.key' && test "$first_param" != -c; then
+  ${echo} 'x -SKIPPING Kbar.+005+30676.key (file already exists)'
+else
+${echo} 'x - extracting Kbar.+005+30676.key (text)'
+  sed 's/^X//' << 'SHAR_EOF' > 'Kbar.+005+30676.key' &&
+; This is a key-signing key, keyid 30676, for bar.
+; Created: Sat Dec 26 03:13:10 2009
+; Publish: Sat Dec 26 03:13:10 2009
+; Activate: Sat Dec 26 03:13:10 2009
+bar. IN DNSKEY 257 3 5 AwEAAc7ppysDZjlldTwsvcXcTTOYJd5TvW5RUWWYKRsee+ozwY6C7vNI 0Xp1PiY+H31GhcnNMCjQU00y8Vezo42oJ4kpRTDevL0STksExXi1/wG+ M4j1CFMh2wgJ/9XLFzHaEWzt4sflVBAVZVXa/qNkRWDXYjsr30MWyylA wHCIxEuyA+NxAL6UL+ZuFo1j84AvfwkGcMbXTcOBSCaHT6AJToSXAcCa X4fnKJIzG4RyJoN2GK4TVdj4qSzLxL1lRkYHNqJvcmMjezxUs9A5fHNI iBEBRPs7NKrQJxegAGVn9ALylKHyhJW6uyBjleOWUDom4ej2J1vGrpQT /KCA35toCvU=
+SHAR_EOF
+  (set 20 10 01 08 23 14 29 'Kbar.+005+30676.key'; eval "$shar_touch") &&
+  chmod 0644 'Kbar.+005+30676.key'
+if test $? -ne 0
+then ${echo} 'restore of Kbar.+005+30676.key failed'
+fi
+  if ${md5check}
+  then (
+       ${MD5SUM} -c >/dev/null 2>&1 || ${echo} 'Kbar.+005+30676.key: MD5 check failed'
+       ) << SHAR_EOF
+9c89adb7c9e6d5e2fd34f694b8752c95  Kbar.+005+30676.key
+SHAR_EOF
+  else
+test `LC_ALL=C wc -c < 'Kbar.+005+30676.key'` -ne 538 && \
+  ${echo} 'restoration warning:  size of Kbar.+005+30676.key is not 538'
+  fi
+fi
+# ============= Kbar.+005+30676.private ==============
+if test -f 'Kbar.+005+30676.private' && test "$first_param" != -c; then
+  ${echo} 'x -SKIPPING Kbar.+005+30676.private (file already exists)'
+else
+${echo} 'x - extracting Kbar.+005+30676.private (text)'
+  sed 's/^X//' << 'SHAR_EOF' > 'Kbar.+005+30676.private' &&
+Private-key-format: v1.3
+Algorithm: 5 (RSASHA1)
+Modulus: zumnKwNmOWV1PCy9xdxNM5gl3lO9blFRZZgpGx576jPBjoLu80jRenU+Jj4ffUaFyc0wKNBTTTLxV7OjjagniSlFMN68vRJOSwTFeLX/Ab4ziPUIUyHbCAn/1csXMdoRbO3ix+VUEBVlVdr+o2RFYNdiOyvfQxbLKUDAcIjES7ID43EAvpQv5m4WjWPzgC9/CQZwxtdNw4FIJodPoAlOhJcBwJpfh+cokjMbhHImg3YYrhNV2PipLMvEvWVGRgc2om9yYyN7PFSz0Dl8c0iIEQFE+zs0qtAnF6AAZWf0AvKUofKElbq7IGOV45ZQOibh6PYnW8aulBP8oIDfm2gK9Q==
+PublicExponent: AQAB
+PrivateExponent: BcfjYsFCjuH1x4ucdbW09ncOv8ppJXbiJkt9AoP0hFOT2c5wrJ1hNOGnrdvYd2CMBlpUOR+w5BxDP+cF78Q97ogXpcjjTwj+5PuqJLg4+qx8thvacrAkdXIKEsgMytjD2d4/ksQmeBiQ7zgiGyCHC7CYzvxnzXEKlgl4FuzLRy4SH1YiSTxKfw1ANKKHxmw8Xvav9ljubrzNdBEQNs6eJNkC6c3aGqiPFyTWGa90s6t1mwTXSxFqBUR1WlbfyYfuiAK2CAvFHeNo7VuC934ri7ceEq8jeOSuY0IqDq2pA3gVWVOyR4NFLXJWeDA3pjqi109t/WGg9IGydD/hsleP4Q==
+Prime1: /hz+WxAL+9bO1l/857ME/OhxImSp86Xi7eA920sAo5ukOIQAQ6hbaKemYxyUbwBmGHEX9d0GOU+xAgZWUU9PbZgXw0fdf+uw6Hrgfce0rWY+uJpUcVHfjLPFgMC/XYrfcVQ8tsCXqRsIbqL+ynsEkQ4vybLhlSAyFqGqYFk/Qt0=
+Prime2: 0HLxXynoSxUcNW15cbuMRHD34ri8sUQsqCtezofPWcCo/17jqf42W7X9YGO70+BvmG3awSr3LaLf862ovCR5+orwE2MqamAV6JZMyR7nvMNGSHTdg3Kk7Jv7T5Gu7Cg6K+on8pMRW3aIms4gs/Z16j0Gxz74ES9IP3vsvC+q6vk=
+Exponent1: NLeXHRUrJ0fdCSRIt1iwRDeEoPn5OA7GEUtgCcp5i3eSjhb0ZxTaQc/l+NHJCW4vwApWSi9cRy99LUpbResKM1ZGN8EE9rDStqgnQnDXztFTWcDKm+e8VNhGtPtHuARDbqNnJRK3Y+Gz0iAGc8Mpo14qE9IEcoeHXKKVUf+x3BE=
+Exponent2: dKCbJB+SdM/u5IXH+TZyGKkMSLIMATKfucfqV6vs+86rv5Yb0zUEvPNqPNAQe0+LoMF2L7YWblY+71wumHXgOaobAP3u8W2pVGUjuTOtfRPU8x1QAwfV9vye87oTINaxFXkBuNtITuBXNiY2bfprpw9WB4zXxuWpiruPjQsumiE=
+Coefficient: qk8HX5fy74Sx6z3niBfTM/SUEjcsnJCTTmsXy6e7nOXWBK5ihKkmMw7LDhaY4OwjXvaVQH0Z190dfyOkWYTbXInIyNNnqCD+xZXkuzuvsUwLNgvXEFhVnzrrj3ozNiizZsyeAhFCKcITz3ci15HB3y8ZLChGYBPFU1ui7MsSkc8=
+Created: 20091226021310
+Publish: 20091226021310
+Activate: 20091226021310
+SHAR_EOF
+  (set 20 10 01 08 23 14 29 'Kbar.+005+30676.private'; eval "$shar_touch") &&
+  chmod 0644 'Kbar.+005+30676.private'
+if test $? -ne 0
+then ${echo} 'restore of Kbar.+005+30676.private failed'
+fi
+  if ${md5check}
+  then (
+       ${MD5SUM} -c >/dev/null 2>&1 || ${echo} 'Kbar.+005+30676.private: MD5 check failed'
+       ) << SHAR_EOF
+c85dfac0b5c0cf2972878a65717af9ea  Kbar.+005+30676.private
+SHAR_EOF
+  else
+test `LC_ALL=C wc -c < 'Kbar.+005+30676.private'` -ne 1774 && \
+  ${echo} 'restoration warning:  size of Kbar.+005+30676.private is not 1774'
+  fi
+fi
+# ============= Kbar.+005+30804.key ==============
+if test -f 'Kbar.+005+30804.key' && test "$first_param" != -c; then
+  ${echo} 'x -SKIPPING Kbar.+005+30804.key (file already exists)'
+else
+${echo} 'x - extracting Kbar.+005+30804.key (text)'
+  sed 's/^X//' << 'SHAR_EOF' > 'Kbar.+005+30804.key' &&
+; This is a key-signing key, keyid 30804, for bar.
+; Created: Sat Dec 26 03:13:10 2009
+; Publish: Sat Dec 26 03:13:10 2009
+; Activate: Sat Dec 26 03:13:10 2009
+bar. IN DNSKEY 257 3 5 AwEAgc7ppysDZjlldTwsvcXcTTOYJd5TvW5RUWWYKRsee+ozwY6C7vNI 0Xp1PiY+H31GhcnNMCjQU00y8Vezo42oJ4kpRTDevL0STksExXi1/wG+ M4j1CFMh2wgJ/9XLFzHaEWzt4sflVBAVZVXa/qNkRWDXYjsr30MWyylA wHCIxEuyA+NxAL6UL+ZuFo1j84AvfwkGcMbXTcOBSCaHT6AJToSXAcCa X4fnKJIzG4RyJoN2GK4TVdj4qSzLxL1lRkYHNqJvcmMjezxUs9A5fHNI iBEBRPs7NKrQJxegAGVn9ALylKHyhJW6uyBjleOWUDom4ej2J1vGrpQT /KCA35toCvU=
+SHAR_EOF
+  (set 20 10 01 08 23 14 29 'Kbar.+005+30804.key'; eval "$shar_touch") &&
+  chmod 0644 'Kbar.+005+30804.key'
+if test $? -ne 0
+then ${echo} 'restore of Kbar.+005+30804.key failed'
+fi
+  if ${md5check}
+  then (
+       ${MD5SUM} -c >/dev/null 2>&1 || ${echo} 'Kbar.+005+30804.key: MD5 check failed'
+       ) << SHAR_EOF
+825116de64b44b14893cb3b8a48475bc  Kbar.+005+30804.key
+SHAR_EOF
+  else
+test `LC_ALL=C wc -c < 'Kbar.+005+30804.key'` -ne 538 && \
+  ${echo} 'restoration warning:  size of Kbar.+005+30804.key is not 538'
+  fi
+fi
+# ============= Kbar.+005+30804.private ==============
+if test -f 'Kbar.+005+30804.private' && test "$first_param" != -c; then
+  ${echo} 'x -SKIPPING Kbar.+005+30804.private (file already exists)'
+else
+${echo} 'x - extracting Kbar.+005+30804.private (text)'
+  sed 's/^X//' << 'SHAR_EOF' > 'Kbar.+005+30804.private' &&
+Private-key-format: v1.3
+Algorithm: 5 (RSASHA1)
+Modulus: zumnKwNmOWV1PCy9xdxNM5gl3lO9blFRZZgpGx576jPBjoLu80jRenU+Jj4ffUaFyc0wKNBTTTLxV7OjjagniSlFMN68vRJOSwTFeLX/Ab4ziPUIUyHbCAn/1csXMdoRbO3ix+VUEBVlVdr+o2RFYNdiOyvfQxbLKUDAcIjES7ID43EAvpQv5m4WjWPzgC9/CQZwxtdNw4FIJodPoAlOhJcBwJpfh+cokjMbhHImg3YYrhNV2PipLMvEvWVGRgc2om9yYyN7PFSz0Dl8c0iIEQFE+zs0qtAnF6AAZWf0AvKUofKElbq7IGOV45ZQOibh6PYnW8aulBP8oIDfm2gK9Q==
+PublicExponent: AQCB
+PrivateExponent: I5TcRq2sbSi1u5a+jL6VVBBu3nyY7p3NXeD1WYYYD66b8RWbgJdTtsZxgixD5sKKrW/xT68d3FUsIjs36w7yp5+g99q7lJ3v35VcMuLXbaKitS/LJdTZF/GIWwRs+DHdt+chh0QeNLzclq8ZfBeTAycFxwC7zVDLsqqcL6/JHiJhHT+dNEqj6/AIOgSYJzVeBI34LtZLW94IKf4dHLzREnLK6+64PFjpwjOG12O9klKfwHRIRN9WUsDG4AuzDSABH+qo2Zc6uJusC/D6HADbiG7tXmLYL6IxanWTbTrx4Hfp01fF+JQCuyOCRmN47X/nCumvDXKMn9Ve5+OlYi0vAQ==
+Prime1: /hz+WxAL+9bO1l/857ME/OhxImSp86Xi7eA920sAo5ukOIQAQ6hbaKemYxyUbwBmGHEX9d0GOU+xAgZWUU9PbZgXw0fdf+uw6Hrgfce0rWY+uJpUcVHfjLPFgMC/XYrfcVQ8tsCXqRsIbqL+ynsEkQ4vybLhlSAyFqGqYFk/Qt0=
+Prime2: 0HLxXynoSxUcNW15cbuMRHD34ri8sUQsqCtezofPWcCo/17jqf42W7X9YGO70+BvmG3awSr3LaLf862ovCR5+orwE2MqamAV6JZMyR7nvMNGSHTdg3Kk7Jv7T5Gu7Cg6K+on8pMRW3aIms4gs/Z16j0Gxz74ES9IP3vsvC+q6vk=
+Exponent1: JDLRyjRz53hTP7H2oaKgQYADs/UDswN2lwWpuag0wsPwQmeRAZZY2TiISPSu+3Mvh4XJ6r5UHQd5FbAN1v2mG4aYgWwoYwoxyvdTLcnQXciX2z+7877GcEyKHPno4fYXRqhVH4i1QjKaQl8dw9LFvzbVvGvvwsHGwQeqPprw7hk=
+Exponent2: vbnob7AZKqKhiVdEcnnhbeZBGcaKkTpE+RAkUL7spNQDiTPvJgo5fcTk/h6G7ijAXK0j62ZHZ3RS7RnaRa+KhO7usPcYMFiJ/VdAyRlIivhyi+WNQ2x4vSygwDy2VV9elljFeNe4dV1Cb+ssE8kAmbP52JjJD6MkhvVLd0u/jMk=
+Coefficient: qk8HX5fy74Sx6z3niBfTM/SUEjcsnJCTTmsXy6e7nOXWBK5ihKkmMw7LDhaY4OwjXvaVQH0Z190dfyOkWYTbXInIyNNnqCD+xZXkuzuvsUwLNgvXEFhVnzrrj3ozNiizZsyeAhFCKcITz3ci15HB3y8ZLChGYBPFU1ui7MsSkc8=
+Created: 20091226021310
+Publish: 20091226021310
+Activate: 20091226021310
+SHAR_EOF
+  (set 20 10 01 08 23 14 29 'Kbar.+005+30804.private'; eval "$shar_touch") &&
+  chmod 0644 'Kbar.+005+30804.private'
+if test $? -ne 0
+then ${echo} 'restore of Kbar.+005+30804.private failed'
+fi
+  if ${md5check}
+  then (
+       ${MD5SUM} -c >/dev/null 2>&1 || ${echo} 'Kbar.+005+30804.private: MD5 check failed'
+       ) << SHAR_EOF
+580cfb43bac6ed945896b464923676e7  Kbar.+005+30804.private
+SHAR_EOF
+  else
+test `LC_ALL=C wc -c < 'Kbar.+005+30804.private'` -ne 1774 && \
+  ${echo} 'restoration warning:  size of Kbar.+005+30804.private is not 1774'
+  fi
+fi
+if rm -fr ${lock_dir}
+then ${echo} 'x - removed lock directory `'${lock_dir}\''.'
+else ${echo} 'x - failed to remove lock directory `'${lock_dir}\''.'
+  exit 1
+fi
+exit 0
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.4.6.6 2010/06/07 04:47:26 marka Exp $
+# $Id: tests.sh,v 1.4.6.5 2010/05/19 07:47:11 marka Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -22,36 +22,19 @@ SYSTEMTESTTOP=..
 status=0
 n=0

+
 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"

-#
-#  The NSEC record at the apex of the zone and its RRSIG records are
-#  added as part of the last step in signing a zone.  We wait for the
-#  NSEC records to appear before proceeding with a counter to prevent
-#  infinite loops if there is a error.
-#
-echo "I:waiting for autosign changes to take effect"
-i=0
-while [ $i -lt 30 ]
-do
-	ret=0
-	for z in bar example private.secure.example
-	do
-		$DIG $DIGOPTS $z. @10.53.0.2 nsec > dig.out.ns2.test$n || ret=1
-		grep "NS SOA" dig.out.ns2.test$n > /dev/null || ret=1
-	done
-	for z in bar example
-	do 
-		$DIG $DIGOPTS $z. @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
-		grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
-	done
-	i=`expr $i + 1`
-	if [ $ret = 0 ]; then break; fi
-	echo "I:waiting ... ($i)"
-	sleep 2
-done
+echo "I:waiting 30 seconds for autosign changes to take effect"
+sleep 30
+
+echo "I:checking that zone transfer worked ($n)"
+ret=0
+$DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+$DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
+$PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
 n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; else echo "I:done"; fi
+if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

 echo "I:checking NSEC->NSEC3 conversion prerequisites ($n)"
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: good.conf,v 1.4.558.2 2010/06/02 01:27:20 tbox Exp $ */
+/* $Id: good.conf,v 1.4 2007/06/19 23:47:01 tbox Exp $ */

 /*
 * This is just a random selection of configuration options.
@@ -54,9 +54,3 @@ options {
 	serial-query-rate 100;
 	server-id none;
 };
-
-zone "example1" {
-	type master;
-	file "xxx";
-	update-policy local;
-};
@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.3.558.2 2010/06/02 01:27:20 tbox Exp $
+# $Id: tests.sh,v 1.3 2007/06/19 23:47:01 tbox Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -26,11 +26,6 @@ $CHECKCONF good.conf > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I: checking that named-checkconf prints a known good config"
-ret=0
-$CHECKCONF -p good.conf > /dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
 echo "I: checking that named-checkconf handles a known bad config"

 ret=1
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: conf.sh.in,v 1.43.8.6 2010/06/11 01:59:22 marka Exp $
+# $Id: conf.sh.in,v 1.43.8.2 2010/01/18 23:48:01 tbox Exp $

 #
 # Common configuration data for system tests, to be sourced into
@@ -37,38 +37,23 @@ RNDC=$TOP/bin/rndc/rndc
 NSUPDATE=$TOP/bin/nsupdate/nsupdate
 DDNSCONFGEN=$TOP/bin/confgen/ddns-confgen
 KEYGEN=$TOP/bin/dnssec/dnssec-keygen
-KEYFRLAB=$TOP/bin/dnssec/dnssec-keyfromlabel
 SIGNER=$TOP/bin/dnssec/dnssec-signzone
 REVOKE=$TOP/bin/dnssec/dnssec-revoke
 SETTIME=$TOP/bin/dnssec/dnssec-settime
 DSFROMKEY=$TOP/bin/dnssec/dnssec-dsfromkey
 CHECKZONE=$TOP/bin/check/named-checkzone
 CHECKCONF=$TOP/bin/check/named-checkconf
-PK11GEN="$TOP/bin/pkcs11/pkcs11-keygen -s 0 -p 1234"
-PK11LIST="$TOP/bin/pkcs11/pkcs11-list -s 0 -p 1234"
-PK11DEL="$TOP/bin/pkcs11/pkcs11-destroy -s 0 -p 1234"

 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # v6synth
-SUBDIRS="acl autosign cacheclean checkconf checknames dlv dnssec forward glue
-    ixfr limits lwresd masterfile masterformat metadata notify nsupdate
-    pending pkcs11 resolver rrsetorder sortlist smartsign stub tkey
-    unknown upforwd views xfer xferquota zonechecks"
+SUBDIRS="acl autosign cacheclean checkconf checknames dnssec forward glue ixfr
+    limits lwresd masterfile masterformat metadata notify nsupdate pending 
+    resolver rrsetorder sortlist smartsign stub tkey unknown upforwd views
+    xfer xferquota zonechecks"

 # PERL will be an empty string if no perl interpreter was found.
 PERL=@PERL@
-if test -n "$PERL"
-then
-	if $PERL -e "use IO::Socket::INET6;" 2> /dev/null
-	then
-		TESTSOCK6="$PERL $TOP/bin/tests/system/testsock6.pl"
-	else
-		TESTSOCK6=false
-	fi
-else
-	TESTSOCK6=false
-fi

-export NAMED LWRESD DIG NSUPDATE KEYGEN KEYFRLAB SIGNER KEYSIGNER KEYSETTOOL \
-       PERL SUBDIRS RNDC CHECKZONE PK11GEN PK11LIST PK11DEL TESTSOCK6
+export NAMED LWRESD DIG NSUPDATE KEYGEN SIGNER KEYSIGNER KEYSETTOOL PERL \
+    SUBDIRS RNDC CHECKZONE
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.5.476.2 2010/05/27 23:49:55 tbox Exp $
+# $Id: clean.sh,v 1.5 2007/09/26 03:22:43 marka Exp $

 rm -f random.data
 rm -f ns*/named.run
@@ -25,11 +25,4 @@ rm -f ns3/dlvset-*
 rm -f ns3/dsset-*
 rm -f ns3/keyset-*
 rm -f ns3/trusted.conf ns5/trusted.conf
-rm -f ns3/signer.err
-rm -f ns6/K*
-rm -f ns6/*.db
-rm -f ns6/*.signed
-rm -f ns6/dsset-*
-rm -f ns6/signer.err
 rm -f */named.memstats
-rm -f dig.out.ns*.test*
@@ -1,4 +1,4 @@
-; Copyright (C) 2004, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; Permission to use, copy, modify, and/or distribute this software for any
 ; purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.

-; $Id: child.db.in,v 1.4.558.2 2010/05/27 23:49:55 tbox Exp $
+; $Id: child.db.in,v 1.4 2007/06/19 23:47:02 tbox Exp $

 $TTL	120
@		SOA	ns hostmaster.ns 1 3600 1200 604800 60
@@ -20,5 +20,3 @@ $TTL	120
 ns		A	10.53.0.3
 foo		TXT	foo
 bar		TXT	bar
-grand		NS	ns.grand
-ns.grand	A	10.53.0.6
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,9 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: sign.sh,v 1.6.32.3 2010/05/27 23:49:55 tbox Exp $
-
-(cd ../ns6 && sh -e ./sign.sh)
+# $Id: sign.sh,v 1.6 2009/10/27 23:47:44 tbox Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -31,12 +29,12 @@ outfile=child1.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

-cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
+cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 
 echo "I: signed $zone"


@@ -47,12 +45,12 @@ outfile=child3.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

-cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
+cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"


@@ -63,12 +61,12 @@ outfile=child4.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"


@@ -79,12 +77,12 @@ outfile=child5.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

-cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
+cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"


@@ -94,12 +92,12 @@ zonefile=child7.utld.db
 outfile=child7.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

-cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
+cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"


@@ -109,12 +107,12 @@ zonefile=child8.utld.db
 outfile=child8.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"


@@ -125,12 +123,12 @@ outfile=child9.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"

 zone=child10.utld.
@@ -140,12 +138,12 @@ outfile=child10.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

 cat $infile $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"


@@ -155,12 +153,12 @@ zonefile=dlv.utld.db
 outfile=dlv.signed
 dlvzone=dlv.utld.

-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`

 cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile

-$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
+$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null
 echo "I: signed $zone"


@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,33 +14,6 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.4.558.2 2010/05/27 23:49:55 tbox Exp $
+# $Id: tests.sh,v 1.4 2007/06/19 23:47:02 tbox Exp $

-SYSTEMTESTTOP=..
-. $SYSTEMTESTTOP/conf.sh
-
-status=0
-n=0
-
-rm -f dig.out.*
-
-DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
-
-echo "I:checking that DNSKEY reference by DLV validates as secure ($n)"
-ret=0
-$DIG $DIGOPTS child1.utld dnskey @10.53.0.5 > dig.out.ns5.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I:checking that child DNSKEY reference by DLV validates as secure ($n)"
-ret=0
-$DIG $DIGOPTS grand.child1.utld dnskey @10.53.0.5 > dig.out.ns5.test$n || ret=1
-grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I:exit status: $status"
-exit $status
+exit 0
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007-2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: clean.sh,v 1.25.32.3 2010/06/25 03:51:06 marka Exp $
+# $Id: clean.sh,v 1.25 2009/10/27 23:47:44 tbox Exp $

 rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed */trusted.conf */tmp* */*.jnl */*.bk
 rm -f ns1/root.db ns2/example.db ns3/secure.example.db
@@ -37,6 +37,3 @@ rm -f ns3/optout.nsec3.example.db
 rm -f ns3/optout.optout.example.db
 rm -f ns3/secure.nsec3.example.db
 rm -f ns3/secure.optout.example.db
-rm -f */named.secroots
-rm -f ns1/managed.key.id
-rm -f signer/example.db
@@ -1,6 +1,6 @@
 #!/bin/sh -e
 #
-# Copyright (C) 2004, 2006-2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006-2009  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: sign.sh,v 1.30.32.3 2010/06/25 23:46:33 tbox Exp $
+# $Id: sign.sh,v 1.30 2009/10/28 00:27:10 marka Exp $

 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -53,9 +53,3 @@ cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns4/trusted.conf
 cp trusted.conf ../ns6/trusted.conf
 cp trusted.conf ../ns7/trusted.conf
-#
-#  Save keyid for managed key id test.
-#
-keyid=`expr $keyname : 'K.+001+\(.*\)'`
-keyid=`expr $keyid + 0`
-echo "$keyid" > managed.key.id
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.35.32.3 2010/07/11 01:18:17 each Exp $ */
+/* $Id: named.conf,v 1.35.32.2 2010/01/18 23:48:01 tbox Exp $ */

 // NS3

@@ -145,6 +145,11 @@ zone "multiple.example" {
 	allow-update { any; };
 };

+zone "mustbesecure.example" {
+	type master;
+	file "mustbesecure.example.db";
+};
+
 zone "rfc2335.example" {
 	type slave;
 	masters { 10.53.0.2; };
@@ -1,4 +1,4 @@
-; Copyright (C) 2004, 2007, 2008, 2010  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2004, 2007, 2008  Internet Systems Consortium, Inc. ("ISC")
 ; Copyright (C) 2000, 2001  Internet Software Consortium.
 ;
 ; Permission to use, copy, modify, and/or distribute this software for any
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.

-; $Id: secure.example.db.in,v 1.13.268.2 2010/06/26 23:46:27 tbox Exp $
+; $Id: secure.example.db.in,v 1.13 2008/09/25 04:02:38 tbox Exp $

 $TTL 300	; 5 minutes
@			IN SOA	mname1. . (
@@ -39,5 +39,3 @@ ns.private		A	10.53.0.2
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.2

-nosoa 			NS	ns.nosoa
-ns.nosoa		A	10.53.0.7
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.28.558.2 2010/06/25 23:46:33 tbox Exp $ */
+/* $Id: named.conf,v 1.28 2007/06/18 23:47:28 tbox Exp $ */

 // NS4

@@ -36,15 +36,6 @@ options {
 	dnssec-must-be-secure mustbesecure.example yes;
 };

-key rndc_key {
-        secret "1234abcd8765";
-        algorithm hmac-md5;
-};
-
-controls {
-        inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
-};
-
 zone "." {
 	type hint;
 	file "../../common/root.hint";
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006, 2008  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: named.conf,v 1.3.268.2 2010/06/26 23:46:27 tbox Exp $ */
+/* $Id: named.conf,v 1.3 2008/09/25 04:02:38 tbox Exp $ */

 // NS3

@@ -32,7 +32,6 @@ options {
 	notify yes;
 	dnssec-enable yes;
 	dnssec-validation yes;
-	minimal-responses yes;
 };

 zone "." {
@@ -70,9 +69,4 @@ zone "multiple.example" {
 	file "multiple.example.bk";
 };

-zone "nosoa.secure.example" {
-	type master;
-	file "nosoa.secure.example.db";
-};
-
 include "trusted.conf";
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: tests.sh,v 1.55.32.10 2010/06/28 01:37:20 marka Exp $
+# $Id: tests.sh,v 1.55.32.3 2010/01/18 23:48:01 tbox Exp $

 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -871,30 +871,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:checking a non-cachable NODATA works ($n)"
-ret=0
-$DIG $DIGOPTS +noauth a.nosoa.secure.example. txt @10.53.0.7 \
-	> dig.out.ns7.test$n || ret=1
-grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1
-$DIG $DIGOPTS +noauth a.nosoa.secure.example. txt @10.53.0.4 \
-	> dig.out.ns4.test$n || ret=1
-grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I:checking a non-cachable NXDOMAIN works ($n)"
-ret=0
-$DIG $DIGOPTS +noauth b.nosoa.secure.example. txt @10.53.0.7 \
-	> dig.out.ns7.test$n || ret=1
-grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1
-$DIG $DIGOPTS +noauth b.nosoa.secure.example. txt @10.53.0.4 \
-	> dig.out.ns4.test$n || ret=1
-grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 #
 # private.secure.example is served by the same server as its
 # grand parent and there is not a secure delegation from secure.example
@@ -928,48 +904,6 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

-echo "I:checking that we can sign a zone with out-of-zone records ($n)"
-ret=0
-(
-cd signer
-RANDFILE=../random.data
-zone=example
-key1=`$KEYGEN -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-key2=`$KEYGEN -r $RANDFILE -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-cat example.db.in $key1.key $key2.key > example.db
-$SIGNER -o example -f example.db example.db > /dev/null 2>&1
-) || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-echo "I:checking that we can sign a zone (NSEC3) with out-of-zone records ($n)"
-ret=0
-(
-cd signer
-RANDFILE=../random.data
-zone=example
-key1=`$KEYGEN -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-key2=`$KEYGEN -r $RANDFILE -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone`
-cat example.db.in $key1.key $key2.key > example.db
-$SIGNER -3 - -H 10 -o example -f example.db example.db > /dev/null 2>&1
-grep "IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG.example. 0 IN NSEC3 1 0 10 - IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG A NS SOA RRSIG DNSKEY NSEC3PARAM" example.db > /dev/null 
-) || ret=1
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
-# Test that "rndc secroots" is able to dump trusted keys
-echo "I:checking rndc secroots ($n)"
-ret=0
-$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 secroots 2>&1 | sed 's/^/I:ns1 /'
-keyid=`cat ns1/managed.key.id`
-linecount=`grep "./RSAMD5/$keyid ; trusted" ns4/named.secroots | wc -l`
-[ "$linecount" -eq 1 ] || ret=1
-linecount=`cat ns4/named.secroots | wc -l`
-[ "$linecount" -eq 5 ] || ret=1
-n=`expr $n + 1`
-if [ $ret != 0 ]; then echo "I:failed"; fi
-status=`expr $status + $ret`
-
 # Run a minimal update test if possible.  This is really just
 # a regression test for RT #2399; more tests should be added.

@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007-2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,14 +15,11 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: ifconfig.sh,v 1.57.132.2 2010/06/11 23:46:18 tbox Exp $
+# $Id: ifconfig.sh,v 1.57 2009/06/26 23:47:58 tbox Exp $

 #
 # Set up interface aliases for bind9 system tests.
 #
-# IPv4: 10.53.0.{1..7}				RFC 1918
-# IPv6: fd92:7065:b8e:ffff::{1..7}		ULA
-#

 config_guess=""
 for f in ./config.guess ../../../config.guess
@@ -57,11 +54,6 @@ case "$2" in
 *) base=""
 esac

-case "$3" in
-[0-9]|[1-9][0-9]|[1-9][0-9][0-9]) base6=$2;;
-*) base6=""
-esac
-
 case "$1" in

    start|up)
@@ -73,12 +65,6 @@ case "$1" in
 		else
 			int=$ns
 		fi
-		if test -n "$base6"
-		then
-			int6=`expr $ns + $base6 - 1`
-		else
-			int6=$ns
-		fi
 		case "$sys" in
 		    *-pc-solaris2.5.1)
 			ifconfig lo0:$int 10.53.0.$ns netmask 0xffffffff up
@@ -89,28 +75,18 @@ case "$1" in
 		    *-*-solaris2.[8-9]|*-*-solaris2.1[0-9])
    			/sbin/ifconfig lo0:$int plumb
 			/sbin/ifconfig lo0:$int 10.53.0.$ns up
-			if test -n "$int6"
-			then
-				/sbin/ifconfig lo0:$int6 inet6 plumb
-				/sbin/ifconfig lo0:$int6 \
-					inet6 fd92:7065:b8e:ffff::$ns up
-			fi
 			;;
 		    *-*-linux*)
 			ifconfig lo:$int 10.53.0.$ns up netmask 255.255.255.0
-			ifconfig lo inet6 add fd92:7065:b8e:ffff::$ns/64
 		        ;;
 		    *-unknown-freebsd*)
 			ifconfig lo0 10.53.0.$ns alias netmask 0xffffffff
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns alias
 			;;
 		    *-unknown-netbsd*)
 			ifconfig lo0 10.53.0.$ns alias netmask 255.255.255.0
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns alias
 			;;
 		    *-unknown-openbsd*)
 			ifconfig lo0 10.53.0.$ns alias netmask 255.255.255.0
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns alias
 			;;
 		    *-*-bsdi[3-5].*)
 			ifconfig lo0 add 10.53.0.$ns netmask 255.255.255.0
@@ -126,18 +102,15 @@ case "$1" in
 			;;
 		    *-ibm-aix4.*|*-ibm-aix5.*)
 			ifconfig lo0 alias 10.53.0.$ns
-			ifconfig lo0 inet6 alias -dad fd92:7065:b8e:ffff::$ns/64
 			;;
 		    hpux)
-			ifconfig lo0:$int 10.53.0.$ns netmask 255.255.255.0 up
-			ifconfig lo0:$int inet6 fd92:7065:b8e:ffff::$ns up
+			ifconfig lo0:$int 10.53.0.$ns up
 		        ;;
 		    *-sco3.2v*)
 			ifconfig lo0 alias 10.53.0.$ns
 			;;
 		    *-darwin*)
 			ifconfig lo0 alias 10.53.0.$ns
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns alias
 			;;
 	            *)
 			echo "Don't know how to set up interface.  Giving up."
@@ -165,27 +138,18 @@ case "$1" in
 		    *-*-solaris2.[8-9]|*-*-solaris2.1[0-9])
 			ifconfig lo0:$int 10.53.0.$ns down
 			ifconfig lo0:$int 10.53.0.$ns unplumb
-			if test -n "$int6"
-			then
-				ifconfig lo0:$int6 inet6 down
-				ifconfig lo0:$int6 inet6 unplumb
-			fi
 			;;
 		    *-*-linux*)
 			ifconfig lo:$int 10.53.0.$ns down
-			ifconfig lo inet6 del fd92:7065:b8e:ffff::$ns/64
 		        ;;
 		    *-unknown-freebsd*)
 			ifconfig lo0 10.53.0.$ns delete
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns delete
 			;;
 		    *-unknown-netbsd*)
 			ifconfig lo0 10.53.0.$ns delete
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns delete
 			;;
 		    *-unknown-openbsd*)
 			ifconfig lo0 10.53.0.$ns delete
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns delete
 			;;
 		    *-*-bsdi[3-5].*)
 			ifconfig lo0 remove 10.53.0.$ns
@@ -201,18 +165,15 @@ case "$1" in
 			;;
 		    *-ibm-aix4.*|*-ibm-aix5.*)
 			ifconfig lo0 delete 10.53.0.$ns
-			ifconfig lo0 delete inet6 fd92:7065:b8e:ffff::$ns/64
 			;;
 		    hpux)
-			ifconfig lo0:$int 0.0.0.0
-			ifconfig lo0:$int inet6 ::
+			ifconfig lo0:$int 10.53.0.$ns down
 		        ;;
 		    *-sco3.2v*)
 			ifconfig lo0 -alias 10.53.0.$ns
 			;;
 		    *darwin*)
 			ifconfig lo0 -alias 10.53.0.$ns
-			ifconfig lo0 inet6 fd92:7065:b8e:ffff::$ns delete
 			;;
 	            *)
 			echo "Don't know how to destroy interface.  Giving up."
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2004, 2007, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000, 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: run.sh,v 1.42.558.2 2010/06/08 23:49:11 tbox Exp $
+# $Id: run.sh,v 1.42 2007/06/19 23:47:00 tbox Exp $

 #
 # Run a system test.
@@ -70,18 +70,6 @@ else
    exit 0
 fi

-# Check for PKCS#11 support
-if
-    test ! -f $test/usepkcs11 || sh cleanpkcs11.sh
-then
-    : pkcs11 ok
-else
-    echo "I:Need PKCS#11 for $test, skipping test." >&2
-    echo "R:PKCS11ONLY" >&2
-    echo "E:$test:`date`" >&2
-    exit 0
-fi
-
 # Set up any dynamically generated test data
 if test -f $test/setup.sh
 then
@@ -1,6 +1,6 @@
 #!/usr/bin/perl -w
 #
-# Copyright (C) 2004-2008, 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: start.pl,v 1.13.396.2 2010/06/26 23:46:27 tbox Exp $
+# $Id: start.pl,v 1.13 2008/01/02 23:47:01 tbox Exp $

 # Framework for starting test servers.
 # Based on the type of server specified, check for port availability, remove
@@ -131,8 +131,6 @@ sub start_server {
 		} else {
 			$command .= "-m record,size,mctx ";
 			$command .= "-T clienttest ";
-			$command .= "-T nosoa " 
-				if (-e "$testdir/$server/named.nosoa");
 			$command .= "-c named.conf -d 99 -g";
 		}
 		$command .= " >named.run 2>&1 &";
@@ -1,4 +1,3 @@
-/* $Id: bind.keys,v 1.5.42.1 2010/06/20 07:32:24 marka Exp $ */
 managed-keys {
        # NOTE: This key is current as of October 2009.
        # If it fails to initialize correctly, it may have expired;
@@ -16,7 +16,7 @@
 * PERFORMANCE OF THIS SOFTWARE.
 */

-/* $Id: config.h.in,v 1.122.32.6 2010/06/03 03:57:24 marka Exp $ */
+/* $Id: config.h.in,v 1.122.32.3 2010/05/19 07:13:53 marka Exp $ */

 /*! \file */

@@ -193,15 +193,6 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H

-/* Define to 1 if you have the <kerberosv5/krb5.h> header file. */
-#undef HAVE_KERBEROSV5_KRB5_H
-
-/* Define to 1 if you have the <krb5.h> header file. */
-#undef HAVE_KRB5_H
-
-/* Define to 1 if you have the <krb5/krb5.h> header file. */
-#undef HAVE_KRB5_KRB5_H
-
 /* Define to 1 if you have the `c' library (-lc). */
 #undef HAVE_LIBC

@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 #
-# $Id: configure,v 1.473.22.10 2010/06/22 04:04:22 marka Exp $
+# $Id: configure,v 1.473.22.3 2010/05/19 07:13:53 marka Exp $
 #
 # Portions Copyright (C) 1996-2001  Nominum, Inc.
 #
@@ -29,7 +29,7 @@
 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
 # OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-# From configure.in Revision: 1.489.22.11 .
+# From configure.in Revision: 1.489.22.4 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.62.
 #
@@ -915,8 +915,6 @@ ISC_PLATFORM_NEEDSYSSELECTH
 LWRES_PLATFORM_NEEDSYSSELECTH
 USE_OPENSSL
 DST_OPENSSL_INC
-OPENSSLLINKOBJS
-OPENSSLLINKSRCS
 ISC_PLATFORM_OPENSSLHASH
 ISC_OPENSSL_INC
 USE_PKCS11
@@ -924,15 +922,12 @@ PKCS11_TOOLS
 PKCS11_PROVIDER
 ISC_PLATFORM_HAVEGSSAPI
 ISC_PLATFORM_GSSAPIHEADER
-ISC_PLATFORM_KRB5HEADER
 USE_GSSAPI
 DST_GSSAPI_INC
 DNS_GSSAPI_LIBS
 DNS_CRYPTO_LIBS
 ALWAYS_DEFINES
 ISC_PLATFORM_USETHREADS
-THREADOPTOBJS
-THREADOPTSRCS
 ISC_THREAD_DIR
 MKDEPCC
 MKDEPCFLAGS
@@ -4094,7 +4089,7 @@ ia64-*-hpux*)
  ;;
 *-*-irix6*)
  # Find out which ABI we are using.
-  echo '#line 4097 "configure"' > conftest.$ac_ext
+  echo '#line 4092 "configure"' > conftest.$ac_ext
  if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -7092,11 +7087,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7095: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7090: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:7099: \$? = $ac_status" >&5
+   echo "$as_me:7094: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -7382,11 +7377,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7385: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7380: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:7389: \$? = $ac_status" >&5
+   echo "$as_me:7384: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -7486,11 +7481,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7489: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7484: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:7493: \$? = $ac_status" >&5
+   echo "$as_me:7488: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -9886,7 +9881,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 9889 "configure"
+#line 9884 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -9986,7 +9981,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 9989 "configure"
+#line 9984 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -12399,11 +12394,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12402: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12397: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:12406: \$? = $ac_status" >&5
+   echo "$as_me:12401: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -12503,11 +12498,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12506: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12501: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:12510: \$? = $ac_status" >&5
+   echo "$as_me:12505: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -14086,11 +14081,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:14089: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:14084: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:14093: \$? = $ac_status" >&5
+   echo "$as_me:14088: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -14190,11 +14185,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:14193: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:14188: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:14197: \$? = $ac_status" >&5
+   echo "$as_me:14192: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -16409,11 +16404,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16412: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16407: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:16416: \$? = $ac_status" >&5
+   echo "$as_me:16411: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -16699,11 +16694,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16702: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16697: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:16706: \$? = $ac_status" >&5
+   echo "$as_me:16701: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -16803,11 +16798,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16806: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16801: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:16810: \$? = $ac_status" >&5
+   echo "$as_me:16805: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -23171,14 +23166,10 @@ case "$use_openssl" in
 $as_echo "no" >&6; }
 		DST_OPENSSL_INC=""
 		USE_OPENSSL=""
-		OPENSSLLINKOBJS=""
-		OPENSSLLINKSRCS=""
 		;;
 	auto)
 		DST_OPENSSL_INC=""
 		USE_OPENSSL=""
-		OPENSSLLINKOBJS=""
-		OPENSSLLINKSRCS=""
 		{ { $as_echo "$as_me:$LINENO: error: OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
 If you don't want OpenSSL, use --without-openssl" >&5
 $as_echo "$as_me: error: OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
@@ -23628,8 +23619,6 @@ done

 		CFLAGS="$saved_cflags"
 		LIBS="$saved_libs"
-		OPENSSLLINKOBJS='${OPENSSLLINKOBJS}'
-		OPENSSLLINKSRCS='${OPENSSLLINKSRCS}'

 		;;
 esac
@@ -23641,8 +23630,6 @@ esac



-
-
 DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DNS_OPENSSL_LIBS"

 #
@@ -23919,160 +23906,6 @@ $as_echo "$as_me: error: gssapi.h not found" >&2;}
   { (exit 1); exit 1; }; }
 		fi

-
-
-
-for ac_header in krb5.h krb5/krb5.h kerberosv5/krb5.h
-do
-as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
-if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
-  { $as_echo "$as_me:$LINENO: checking for $ac_header" >&5
-$as_echo_n "checking for $ac_header... " >&6; }
-if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
-  $as_echo_n "(cached) " >&6
-fi
-ac_res=`eval 'as_val=${'$as_ac_Header'}
-		 $as_echo "$as_val"'`
-	       { $as_echo "$as_me:$LINENO: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-else
-  # Is the header compilable?
-{ $as_echo "$as_me:$LINENO: checking $ac_header usability" >&5
-$as_echo_n "checking $ac_header usability... " >&6; }
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-$ac_includes_default
-#include <$ac_header>
-_ACEOF
-rm -f conftest.$ac_objext
-if { (ac_try="$ac_compile"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
-$as_echo "$ac_try_echo") >&5
-  (eval "$ac_compile") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then
-  ac_header_compiler=yes
-else
-  $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	ac_header_compiler=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-{ $as_echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
-$as_echo "$ac_header_compiler" >&6; }
-
-# Is the header present?
-{ $as_echo "$as_me:$LINENO: checking $ac_header presence" >&5
-$as_echo_n "checking $ac_header presence... " >&6; }
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-#include <$ac_header>
-_ACEOF
-if { (ac_try="$ac_cpp conftest.$ac_ext"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
-$as_echo "$ac_try_echo") >&5
-  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } >/dev/null && {
-	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       }; then
-  ac_header_preproc=yes
-else
-  $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-  ac_header_preproc=no
-fi
-
-rm -f conftest.err conftest.$ac_ext
-{ $as_echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
-$as_echo "$ac_header_preproc" >&6; }
-
-# So?  What about this header?
-case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
-  yes:no: )
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
-$as_echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
-$as_echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
-    ac_header_preproc=yes
-    ;;
-  no:yes:* )
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
-$as_echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header:     check for missing prerequisite headers?" >&5
-$as_echo "$as_me: WARNING: $ac_header:     check for missing prerequisite headers?" >&2;}
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
-$as_echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&5
-$as_echo "$as_me: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&2;}
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
-$as_echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
-    { $as_echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
-$as_echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
-
-    ;;
-esac
-{ $as_echo "$as_me:$LINENO: checking for $ac_header" >&5
-$as_echo_n "checking for $ac_header... " >&6; }
-if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
-  $as_echo_n "(cached) " >&6
-else
-  eval "$as_ac_Header=\$ac_header_preproc"
-fi
-ac_res=`eval 'as_val=${'$as_ac_Header'}
-		 $as_echo "$as_val"'`
-	       { $as_echo "$as_me:$LINENO: result: $ac_res" >&5
-$as_echo "$ac_res" >&6; }
-
-fi
-if test `eval 'as_val=${'$as_ac_Header'}
-		 $as_echo "$as_val"'` = yes; then
-  cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
-_ACEOF
- ISC_PLATFORM_KRB5HEADER="#define ISC_PLATFORM_KRB5HEADER <$ac_header>"
-fi
-
-done
-
-
-		if test "$ISC_PLATFORM_KRB5HEADER" = ""; then
-		    { { $as_echo "$as_me:$LINENO: error: krb5.h not found" >&5
-$as_echo "$as_me: error: krb5.h not found" >&2;}
-   { (exit 1); exit 1; }; }
-		fi
-
 		CPPFLAGS="$saved_cppflags"

 		#
@@ -24103,7 +23936,7 @@ $as_echo "$as_me: error: krb5.h not found" >&2;}
 		    "-lgssapi" \
 		    "-lgssapi -lkrb5 -ldes -lcrypt -lasn1 -lroken -lcom_err" \
 		    "-lgssapi -lkrb5 -lcrypto -lcrypt -lasn1 -lroken -lcom_err" \
-		    "-lgss -lkrb5"
+		    "-lgss"
 		do
 		    # Note that this does not include $saved_libs, because
 		    # on FreeBSD machines this configure script has added
@@ -24123,7 +23956,7 @@ cat >>conftest.$ac_ext <<_ACEOF
 int
 main ()
 {
-gss_acquire_cred();krb5_init_context()
+gss_acquire_cred();
  ;
  return 0;
 }
@@ -24231,7 +24064,6 @@ esac



-
 DNS_CRYPTO_LIBS="$DNS_GSSAPI_LIBS $DNS_CRYPTO_LIBS"

 #
@@ -25378,8 +25210,6 @@ then
 	fi
 	ALWAYS_DEFINES="-D_REENTRANT"
 	ISC_PLATFORM_USETHREADS="#define ISC_PLATFORM_USETHREADS 1"
-	THREADOPTOBJS='${THREADOPTOBJS}'
-	THREADOPTSRCS='${THREADOPTSRCS}'
 	thread_dir=pthreads
 	#
 	# We'd like to use sigwait() too
@@ -26211,15 +26041,11 @@ fi
 else
 	ISC_PLATFORM_USETHREADS="#undef ISC_PLATFORM_USETHREADS"
 	thread_dir=nothreads
-	THREADOPTOBJS=""
-	THREADOPTSRCS=""
 	ALWAYS_DEFINES=""
 fi



-
-
 ISC_THREAD_DIR=$thread_dir


@@ -32430,8 +32256,6 @@ fi
 fi

 rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-			else
-				use_atomic=yes
 			fi
 			;;
 		*)
@@ -34774,7 +34598,7 @@ ac_config_commands="$ac_config_commands chmod"
 # elsewhere if there's a good reason for doing so.
 #

-ac_config_files="$ac_config_files Makefile make/Makefile make/mkdep lib/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/nls/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/export/Makefile lib/export/isc/Makefile lib/export/isc/include/Makefile lib/export/isc/include/isc/Makefile lib/export/isc/unix/Makefile lib/export/isc/unix/include/Makefile lib/export/isc/unix/include/isc/Makefile lib/export/isc/nls/Makefile lib/export/isc/$thread_dir/Makefile lib/export/isc/$thread_dir/include/Makefile lib/export/isc/$thread_dir/include/isc/Makefile lib/export/dns/Makefile lib/export/dns/include/Makefile lib/export/dns/include/dns/Makefile lib/export/dns/include/dst/Makefile lib/export/irs/Makefile lib/export/irs/include/Makefile lib/export/irs/include/irs/Makefile lib/export/isccfg/Makefile lib/export/isccfg/include/Makefile lib/export/isccfg/include/isccfg/Makefile lib/export/samples/Makefile lib/export/samples/Makefile-postinstall lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/named/Makefile bin/named/unix/Makefile bin/rndc/Makefile bin/dig/Makefile bin/nsupdate/Makefile bin/tests/Makefile bin/tests/names/Makefile bin/tests/master/Makefile bin/tests/rbt/Makefile bin/tests/db/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/dst/Makefile bin/tests/mem/Makefile bin/tests/net/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/filter-aaaa/Makefile bin/tests/system/lwresd/Makefile bin/tests/system/tkey/Makefile bin/tests/headerdep_test.sh bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile bin/dnssec/Makefile bin/pkcs11/Makefile doc/Makefile doc/arm/Makefile doc/misc/Makefile isc-config.sh doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter"
+ac_config_files="$ac_config_files Makefile make/Makefile make/mkdep lib/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/nls/Makefile lib/isc/$thread_dir/Makefile lib/isc/$thread_dir/include/Makefile lib/isc/$thread_dir/include/isc/Makefile lib/isc/$arch/Makefile lib/isc/$arch/include/Makefile lib/isc/$arch/include/isc/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/export/Makefile lib/export/isc/Makefile lib/export/isc/include/Makefile lib/export/isc/include/isc/Makefile lib/export/isc/unix/Makefile lib/export/isc/unix/include/Makefile lib/export/isc/unix/include/isc/Makefile lib/export/isc/nls/Makefile lib/export/isc/$thread_dir/Makefile lib/export/isc/$thread_dir/include/Makefile lib/export/isc/$thread_dir/include/isc/Makefile lib/export/dns/Makefile lib/export/dns/include/Makefile lib/export/dns/include/dns/Makefile lib/export/dns/include/dst/Makefile lib/export/irs/Makefile lib/export/irs/include/Makefile lib/export/irs/include/irs/Makefile lib/export/isccfg/Makefile lib/export/isccfg/include/Makefile lib/export/isccfg/include/isccfg/Makefile lib/export/samples/Makefile lib/export/samples/Makefile-postinstall lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/lwres/Makefile lib/lwres/include/Makefile lib/lwres/include/lwres/Makefile lib/lwres/include/lwres/netdb.h lib/lwres/include/lwres/platform.h lib/lwres/man/Makefile lib/lwres/unix/Makefile lib/lwres/unix/include/Makefile lib/lwres/unix/include/lwres/Makefile lib/tests/Makefile lib/tests/include/Makefile lib/tests/include/tests/Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/named/Makefile bin/named/unix/Makefile bin/rndc/Makefile bin/dig/Makefile bin/nsupdate/Makefile bin/tests/Makefile bin/tests/names/Makefile bin/tests/master/Makefile bin/tests/rbt/Makefile bin/tests/db/Makefile bin/tests/tasks/Makefile bin/tests/timers/Makefile bin/tests/dst/Makefile bin/tests/mem/Makefile bin/tests/net/Makefile bin/tests/sockaddr/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/lwresd/Makefile bin/tests/system/tkey/Makefile bin/tests/headerdep_test.sh bin/tools/Makefile bin/dnssec/Makefile bin/pkcs11/Makefile doc/Makefile doc/arm/Makefile doc/misc/Makefile isc-config.sh doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-docbook-latex.xsl doc/xsl/isc-manpage.xsl doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter"


 #
@@ -35468,12 +35292,9 @@ do
    "bin/tests/sockaddr/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/sockaddr/Makefile" ;;
    "bin/tests/system/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/Makefile" ;;
    "bin/tests/system/conf.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/system/conf.sh" ;;
-    "bin/tests/system/filter-aaaa/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/filter-aaaa/Makefile" ;;
    "bin/tests/system/lwresd/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/lwresd/Makefile" ;;
    "bin/tests/system/tkey/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/system/tkey/Makefile" ;;
    "bin/tests/headerdep_test.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/headerdep_test.sh" ;;
-    "bin/tests/virtual-time/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tests/virtual-time/Makefile" ;;
-    "bin/tests/virtual-time/conf.sh") CONFIG_FILES="$CONFIG_FILES bin/tests/virtual-time/conf.sh" ;;
    "bin/tools/Makefile") CONFIG_FILES="$CONFIG_FILES bin/tools/Makefile" ;;
    "bin/dnssec/Makefile") CONFIG_FILES="$CONFIG_FILES bin/dnssec/Makefile" ;;
    "bin/pkcs11/Makefile") CONFIG_FILES="$CONFIG_FILES bin/pkcs11/Makefile" ;;
@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
 esyscmd([sed "s/^/# /" COPYRIGHT])dnl
 AC_DIVERT_POP()dnl

-AC_REVISION($Revision: 1.489.22.11 $)
+AC_REVISION($Revision: 1.489.22.4 $)

 AC_INIT(lib/dns/name.c)
 AC_PREREQ(2.59)
@@ -522,14 +522,10 @@ case "$use_openssl" in
 		AC_MSG_RESULT(no)
 		DST_OPENSSL_INC=""
 		USE_OPENSSL=""
-		OPENSSLLINKOBJS=""
-		OPENSSLLINKSRCS=""
 		;;
 	auto)
 		DST_OPENSSL_INC=""
 		USE_OPENSSL=""
-		OPENSSLLINKOBJS=""
-		OPENSSLLINKSRCS=""
 		AC_MSG_ERROR(
 [OpenSSL was not found in any of $openssldirs; use --with-openssl=/path
 If you don't want OpenSSL, use --without-openssl])
@@ -674,8 +670,6 @@ esac
 		AC_CHECK_FUNCS(EVP_sha256 EVP_sha512)
 		CFLAGS="$saved_cflags"
 		LIBS="$saved_libs"
-		OPENSSLLINKOBJS='${OPENSSLLINKOBJS}'
-		OPENSSLLINKSRCS='${OPENSSLLINKSRCS}'

 		;;
 esac
@@ -687,8 +681,6 @@ esac

 AC_SUBST(USE_OPENSSL)
 AC_SUBST(DST_OPENSSL_INC)
-AC_SUBST(OPENSSLLINKOBJS)
-AC_SUBST(OPENSSLLINKSRCS)
 DNS_CRYPTO_LIBS="$DNS_CRYPTO_LIBS $DNS_OPENSSL_LIBS"

 #
@@ -793,13 +785,6 @@ case "$use_gssapi" in
 		    AC_MSG_ERROR([gssapi.h not found])
 		fi

-		AC_CHECK_HEADERS(krb5.h krb5/krb5.h kerberosv5/krb5.h,
-		    [ISC_PLATFORM_KRB5HEADER="#define ISC_PLATFORM_KRB5HEADER <$ac_header>"])
-
-		if test "$ISC_PLATFORM_KRB5HEADER" = ""; then
-		    AC_MSG_ERROR([krb5.h not found])
-		fi
-
 		CPPFLAGS="$saved_cppflags"

 		#
@@ -830,7 +815,7 @@ case "$use_gssapi" in
 		    "-lgssapi" \
 		    "-lgssapi -lkrb5 -ldes -lcrypt -lasn1 -lroken -lcom_err" \
 		    "-lgssapi -lkrb5 -lcrypto -lcrypt -lasn1 -lroken -lcom_err" \
-		    "-lgss -lkrb5"
+		    "-lgss"
 		do
 		    # Note that this does not include $saved_libs, because
 		    # on FreeBSD machines this configure script has added
@@ -839,7 +824,7 @@ case "$use_gssapi" in
 		    # when you are trying to build with KTH in /usr/lib.
 		    LIBS="-L$use_gssapi/lib $TRY_LIBS"
 		    AC_MSG_CHECKING(linking as $TRY_LIBS)
-		    AC_TRY_LINK( , [gss_acquire_cred();krb5_init_context()],
+		    AC_TRY_LINK( , [gss_acquire_cred();],
 				gssapi_linked=yes, gssapi_linked=no)
 		    case $gssapi_linked in
 		    yes) AC_MSG_RESULT(yes); break ;;
@@ -901,7 +886,6 @@ esac

 AC_SUBST(ISC_PLATFORM_HAVEGSSAPI)
 AC_SUBST(ISC_PLATFORM_GSSAPIHEADER)
-AC_SUBST(ISC_PLATFORM_KRB5HEADER)

 AC_SUBST(USE_GSSAPI)
 AC_SUBST(DST_GSSAPI_INC)
@@ -1001,8 +985,6 @@ then
 	fi
 	ALWAYS_DEFINES="-D_REENTRANT"
 	ISC_PLATFORM_USETHREADS="#define ISC_PLATFORM_USETHREADS 1"
-	THREADOPTOBJS='${THREADOPTOBJS}'
-	THREADOPTSRCS='${THREADOPTSRCS}'
 	thread_dir=pthreads
 	#
 	# We'd like to use sigwait() too
@@ -1081,15 +1063,11 @@ then
 else
 	ISC_PLATFORM_USETHREADS="#undef ISC_PLATFORM_USETHREADS"
 	thread_dir=nothreads
-	THREADOPTOBJS=""
-	THREADOPTSRCS=""
 	ALWAYS_DEFINES=""
 fi

 AC_SUBST(ALWAYS_DEFINES)
 AC_SUBST(ISC_PLATFORM_USETHREADS)
-AC_SUBST(THREADOPTOBJS)
-AC_SUBST(THREADOPTSRCS)
 ISC_THREAD_DIR=$thread_dir
 AC_SUBST(ISC_THREAD_DIR)

@@ -2497,8 +2475,6 @@ case "$enable_atomic" in
 				 use_atomic=yes])
 				]
 				)
-			else
-				use_atomic=yes
 			fi
 			;;
 		*)
@@ -3282,12 +3258,9 @@ AC_CONFIG_FILES([
 	bin/tests/sockaddr/Makefile
 	bin/tests/system/Makefile
 	bin/tests/system/conf.sh
-	bin/tests/system/filter-aaaa/Makefile
 	bin/tests/system/lwresd/Makefile
 	bin/tests/system/tkey/Makefile
 	bin/tests/headerdep_test.sh
-	bin/tests/virtual-time/Makefile
-	bin/tests/virtual-time/conf.sh
 	bin/tools/Makefile
 	bin/dnssec/Makefile
 	bin/pkcs11/Makefile
@@ -1,112 +1,3 @@
-zkt 1.0 -- 15. June 2010
-
-* feat	"/dev/urandom" check added to checkconfig()
-
-* feat	Config compability switch (-C) added to zkt-conf
-
-* feat	zkt-ls has a new switch -s to change sorting of domains from
-	subdomain before parent to subdomain below the parent
-
-* feat	"zkt-ls -T" prints only parent trust anchor
-
-zkt 1.0rc1 -- 1. Apr 2010 (The 1.0 release was sponsored by DOMINIC(r) )
-
-* feat	Several config parameter are printed now in a more consistent and
-	user friendly form.
-	SerialFormat "Incremental" could be abbreviated as "inc" on input.
-
-* bug	use of AC_ARG_ENABLE macros changed in a way that it is possible
-	to use it as a "--disable-FEATURE" switch.
-
-* port	no longer checking for malloc() in configue script.
-	Mainly because it checks only if malloc(0) is allowed and we do
-	not need this.
-
-* port	--disable-color-mode added to configure script
-
-* bug	Makro PRINT_AGE_OF_YEAR renamed to PRINT_AGE_WITH_YEAR in configure.ac
-
-* misc	man page zkt-keyman added
-
-* misc	New command zkt-keyman added as replacement for dnssec-zkt's key
-	management functionality
-
-* misc	man page zkt-ls added
-
-* port	Check for ncurses added to Makefile.in
-
-* misc	Color mode (Option -C) added to zkt-ls (experimental)
-	New source file tcap.c.
-
-* misc	Deprecate "single linked list" version of ZKT. The binary tree
-	version is the default for years, so the VERSION string does no
-	longer contain a "T".  Now, if someone insist on the single link
-	list version (configure --disable-tree) a "S" is added to the
-	version string.
-	Anyway, the code for the single link list version does no longer
-	have the same functionality and will be removed in one of the later
-	releases.
-
-* misc	New command zkt-ls added as replacement for dnssec-zkt's key
-	listing functionality
-
-* func	New key algorithms RSASHA256 and RSAHSHA512 added to dki.[ch]
-	and zconf.c
-	New parameter NSEC3 added. Now it's possible to configure
-	an NSEC3_OPTOUT zone.
-
-* bug	Token parsing function gettok() fixed to recognize tokens
-	with dashes ("zone-statistics" was seen as "zone").
-	Thanks to Andreas Baess for finding this bug.
-	
-* bug	Fixed bug in (re)salting dynamic zones.
-	sig_zone() and gensalt() needs parameter change for this
-
-* func	New option -a added to zkt-conf
-
-* func	In zconf.c CONF_TIMEINT parameter are now able to recognize 
-	"unset" values (which is represented internaly as 0)
-
-* func	Set Max_TTL to sig lifetime for dynamic zones or if Max_TTL
-	is less than 1.
-	max_ttl checks in checkconfig() fixed.
-
-* func	printconfigdiff() added to zconf.c and used by zkt-conf.
-	Now local configs are printed as diff to site wide config.
-
-* misc	man page zkt-signer.8 changed to new command syntax
-
-* func	Per domain logging added. Use parameter LogDomainDir to
-	enable it. For more details see file README.logging.
-
-* func	distribute.sh supports new action type "distkeys" but is
-	currently not used
-
-* misc	LOG_FNAMETMPL changed and moved from config_zkt.h to log.h
-	
-* misc	Default soa serial format changed from "Incremental"
-	to "Unixtime"
-
-* func	dnssec-signer command renamed to zkt-signer. Man page updated.
-
-* func	New command zkt-conf added as replacement for dnssec-zkt -Z
-
-* misc	timeint2str() is now global (zconf.c)
-
-* func	zfparse.c - a rudimentary zone file parser
-	scans minimum and maximum ttl values; adds $INCLUDE dnskey.db
-
-zkt 0.99d -- Not released
-
-* func	Option SIG_DnsKeyKSK for DNSKEY signing with KSK only 
-	added (only useful with BIND9.7)
-
-* misc	For BIND 9.7 compability:
-	Run dnssec-signzone in compability mode ("-C") if
-	SigGenerateDS is true.
-	Run dnssec-keygen in compability mode ("-C -q")
-	Add option -u to dnssec-signzone if NSEC3 chaining is requested
-
 zkt 0.99c -- 1. Aug 2009

 * misc	dnssec-signer command line option vars changed to storage
@@ -613,7 +504,7 @@ zkt 0.63 -- 14. June 2005
 zkt 0.62 -- 13. May 2005

 * func	dnssec-signer: Option -o added.
-	Now it works a bit more like dnssec-signzone.
+	Now it works a little bit more like dnssec-signzone.

 * func	strlist.c: prepstrlist and unprepstrlist functions get a
 	second parameter for the delimiter.
@@ -18,44 +18,23 @@ CFLAGS	+=	-Wall #-DDBG
 CFLAGS	+=	-Wmissing-prototypes
 CFLAGS	+=	$(PROFILE) $(OPTIM)
 LDFLAGS	+=	$(PROFILE)
-LIBS	=	@LIBS@

 PROJECT =	@PACKAGE_TARNAME@
 VERSION =	@PACKAGE_VERSION@

 HEADER	=	dki.h misc.h domaincmp.h zconf.h config_zkt.h \
 		config.h.in strlist.h zone.h zkt.h debug.h \
-		ncparse.h log.h rollover.h nscomm.h soaserial.h \
-		zfparse.h tcap.h
+		ncparse.h log.h rollover.h nscomm.h soaserial.h
 SRC_ALL	=	dki.c misc.c domaincmp.c zconf.c log.c
 OBJ_ALL	=	$(SRC_ALL:.c=.o)

-SRC_SIG	=	zkt-signer.c zone.c ncparse.c rollover.c \
+SRC_SIG	=	dnssec-signer.c zone.c ncparse.c rollover.c \
 		nscomm.c soaserial.c
 OBJ_SIG	=	$(SRC_SIG:.c=.o)
-MAN_SIG	=	zkt-signer.8
-PROG_SIG=	zkt-signer
+MAN_SIG	=	dnssec-signer.8
+PROG_SIG=	dnssec-signer

-SRC_CNF	=	zkt-conf.c zfparse.c
-OBJ_CNF	=	$(SRC_CNF:.c=.o)
-MAN_CNF	=	zkt-conf.8
-PROG_CNF=	zkt-conf
-
-# shared sources
-SRC_KLS	=	strlist.c zkt.c tcap.c
-OBJ_KLS	=	$(SRC_KLS:.c=.o)
-
-SRC_KEY	=	zkt-keyman.c
-OBJ_KEY	=	$(SRC_KEY:.c=.o) $(OBJ_KLS)
-MAN_KEY	=	zkt-keyman.8
-PROG_KEY=	zkt-keyman
-
-SRC_LS	=	zkt-ls.c
-OBJ_LS	=	$(SRC_LS:.c=.o) $(OBJ_KLS)
-MAN_LS	=	zkt-ls.8
-PROG_LS=	zkt-ls
-
-SRC_ZKT	=	dnssec-zkt.c strlist.c zkt.c tcap.c
+SRC_ZKT	=	dnssec-zkt.c strlist.c zkt.c
 OBJ_ZKT	=	$(SRC_ZKT:.c=.o)
 MAN_ZKT	=	dnssec-zkt.8
 PROG_ZKT=	dnssec-zkt
@@ -65,20 +44,15 @@ OBJ_SER	=	$(SRC_SER:.c=.o)
 #MAN_SER	=	zkt-soaserial.8
 PROG_SER=	zkt-soaserial

-SRC_PRG	=	$(SRC_SIG) $(SRC_CNF) $(SRC_ZKT) $(SRC_LS) $(SRC_SER) $(SRC_KEY)
-OBJ_PRG	=	$(SRC_PRG:.c=.o)
-PROG_PRG=	$(PROG_SIG) $(PROG_CNF) $(PROG_ZKT) $(PROG_LS) $(PROG_SER) $(PROG_KEY)
-
-MAN_ALL	=	$(MAN_ZKT) $(MAN_SIG) $(MAN_LS) $(MAN_CNF) $(MAN_KEY)
+MAN_ALL	=	$(MAN_ZKT) $(MAN_SIG) #$(MAN_SER)
 OTHER	=	README README.logging TODO LICENSE CHANGELOG tags Makefile.in \
 		configure examples
-SAVE	=	$(HEADER) $(SRC_ALL) $(SRC_SIG) $(SRC_CNF) $(SRC_ZKT) $(SRC_KLS) \
-		$(SRC_LS) $(SRC_KEY) $(SRC_SER) $(OTHER) \
+SAVE	=	$(HEADER) $(SRC_ALL) $(SRC_SIG) $(SRC_ZKT) $(SRC_SER) $(OTHER) \
 		man configure.ac config.h.in doc
 #MNTSAVE	=	$(SAVE) configure.ac config.h.in doc 


-all:	 $(PROG_CNF) $(PROG_ZKT) $(PROG_LS) $(PROG_SIG) $(PROG_SER) $(PROG_KEY)
+all:	$(PROG_ZKT) $(PROG_SIG) $(PROG_SER)

 macos:		## for MAC OS (depreciated)
 macos:
@@ -94,27 +68,17 @@ linux:

 $(PROG_SIG):	$(OBJ_SIG) $(OBJ_ALL) Makefile
 	$(CC) $(LDFLAGS) $(OBJ_SIG) $(OBJ_ALL) -o $(PROG_SIG)
-	ln -f $(PROG_SIG) dnssec-signer
-
-$(PROG_CNF):	$(OBJ_CNF) $(OBJ_ALL) Makefile
-	$(CC) $(LDFLAGS) $(OBJ_CNF) $(OBJ_ALL) -o $(PROG_CNF)
-
-$(PROG_KEY):	$(OBJ_KEY) $(OBJ_ALL) Makefile
-	$(CC) $(LDFLAGS) $(LIBS) $(OBJ_KEY) $(OBJ_ALL) -o $(PROG_KEY)

 $(PROG_ZKT):	$(OBJ_ZKT) $(OBJ_ALL) Makefile
-	$(CC) $(LDFLAGS) $(LIBS) $(OBJ_ZKT) $(OBJ_ALL) -o $(PROG_ZKT)
-
-$(PROG_LS):	$(OBJ_LS) $(OBJ_ALL) Makefile
-	$(CC) $(LDFLAGS) $(LIBS) $(OBJ_LS) $(OBJ_ALL) -o $(PROG_LS)
+	$(CC) $(LDFLAGS) $(OBJ_ZKT) $(OBJ_ALL) -o $(PROG_ZKT)

 $(PROG_SER):	$(OBJ_SER) Makefile
 	$(CC) $(LDFLAGS) $(OBJ_SER) -o $(PROG_SER)

 install:	## install binaries in prefix/bin
-install:	$(PROG_PRG)
+install:	$(PROG_ZKT) $(PROG_SIG) $(PROG_SER)
 		test -d $(prefix)/bin || mkdir -p $(prefix)/bin
-		cp dnssec-signer $(PROG_PRG) $(prefix)/bin/
+		cp $(PROG_ZKT) $(PROG_SIG) $(PROG_SER) $(prefix)/bin/

 install-man:	## install man pages in mandir
 install-man:
@@ -124,13 +88,13 @@ install-man:


 tags:		## create tags file
-#tags:	$(SRC_ALL) $(SRC_PRG)
-tags:	$(SRC_ALL) $(SRC_SIG) $(SRC_CNF) $(SRC_KEY) $(SRC_LS) $(SRC_SER) $(SRC_KLS)
-	ctags $(SRC_ALL) $(SRC_SIG) $(SRC_CNF) $(SRC_KEY) $(SRC_LS) $(SRC_SER) $(SRC_KLS)
+tags:	$(SRC_ALL) $(SRC_SIG) $(SRC_ZKT) $(SRC_SER)
+	ctags $(SRC_ALL) $(SRC_SIG) $(SRC_ZKT) $(SRC_SER)

 clean:		## remove objectfiles and binaries
 clean:
-	-rm -f $(OBJ_PRG) $(OBJ_ALL) $(PROG_PRG)
+	-rm -f $(OBJ_SIG) $(OBJ_ZKT) $(OBJ_SER) $(OBJ_ALL) \
+	$(PROG_ZKT) $(PROG_SIG) $(PROG_SER)

 distclean:	## remove objectfiles, binaries and distribution files
 distclean:	clean
@@ -144,27 +108,16 @@ configure:	## create configure script
 configure:	configure.ac Makefile.in
 	autoconf && autoheader

-man:	man/$(MAN_KEY).html man/$(MAN_KEY).pdf \
-	man/$(MAN_SIG).html man/$(MAN_SIG).pdf \
-	man/$(MAN_LS).html man/$(MAN_LS).pdf \
-	man/$(MAN_CNF).html man/$(MAN_CNF).pdf
+man:	man/$(MAN_ZKT).html man/$(MAN_ZKT).pdf man/$(MAN_SIG).html man/$(MAN_SIG).pdf

-man/$(MAN_KEY).html: man/$(MAN_KEY)
-	groff -Thtml -man -mhtml man/$(MAN_KEY) > man/$(MAN_KEY).html
-man/$(MAN_KEY).pdf: man/$(MAN_KEY)
-	groff -Tps -man man/$(MAN_KEY) | ps2pdf - man/$(MAN_KEY).pdf
-man/$(MAN_LS).html: man/$(MAN_LS)
-	groff -Thtml -man -mhtml man/$(MAN_LS) > man/$(MAN_LS).html
-man/$(MAN_LS).pdf: man/$(MAN_LS)
-	groff -Tps -man man/$(MAN_LS) | ps2pdf - man/$(MAN_LS).pdf
+man/$(MAN_ZKT).html: man/$(MAN_ZKT)
+	groff -Thtml -man -mhtml man/$(MAN_ZKT) > man/$(MAN_ZKT).html
+man/$(MAN_ZKT).pdf: man/$(MAN_ZKT)
+	groff -Tps -man man/$(MAN_ZKT) | ps2pdf - man/$(MAN_ZKT).pdf
 man/$(MAN_SIG).html: man/$(MAN_SIG)
 	groff -Thtml -man -mhtml man/$(MAN_SIG) > man/$(MAN_SIG).html
 man/$(MAN_SIG).pdf: man/$(MAN_SIG)
 	groff -Tps -man man/$(MAN_SIG) | ps2pdf - man/$(MAN_SIG).pdf
-man/$(MAN_CNF).html: man/$(MAN_CNF)
-	groff -Thtml -man -mhtml man/$(MAN_CNF) > man/$(MAN_CNF).html
-man/$(MAN_CNF).pdf: man/$(MAN_CNF)
-	groff -Tps -man man/$(MAN_CNF) | ps2pdf - man/$(MAN_CNF).pdf
 	
 	
 $(PROJECT)-$(VERSION).tar.gz:	$(SAVE)
@@ -175,45 +128,31 @@ $(PROJECT)-$(VERSION).tar.gz:	$(SAVE)
 	)

 depend:
-	$(CC) -MM $(CFLAGS) $(SRC_PRG) $(SRC_ALL)
+	$(CC) -MM $(SRC_SIG) $(SRC_ZKT) $(SRC_SER) $(SRC_ALL)

 help:
 	@grep "^.*:[ 	]*##" Makefile

 ## all dependicies
 #:r !make depend
-#gcc -MM -g -DHAVE_CONFIG_H -I. -Wall  -Wmissing-prototypes   zkt-signer.c zone.c ncparse.c rollover.c nscomm.c soaserial.c zkt-conf.c zfparse.c dnssec-zkt.c strlist.c zkt.c tcap.c zkt-ls.c strlist.c zkt.c tcap.c zkt-soaserial.c dki.c misc.c domaincmp.c zconf.c log.c
-zkt-signer.o: zkt-signer.c config.h config_zkt.h zconf.h debug.h misc.h \
+#gcc -MM dnssec-signer.c zone.c ncparse.c rollover.c nscomm.c soaserial.c dnssec-zkt.c strlist.c zkt.c zkt-soaserial.c dki.c misc.c domaincmp.c zconf.c log.c
+dnssec-signer.o: dnssec-signer.c config_zkt.h zconf.h debug.h misc.h \
  ncparse.h nscomm.h zone.h dki.h log.h soaserial.h rollover.h
-zone.o: zone.c config.h config_zkt.h debug.h domaincmp.h misc.h zconf.h \
-  dki.h zone.h
+zone.o: zone.c config_zkt.h debug.h domaincmp.h misc.h zconf.h dki.h \
+  zone.h
 ncparse.o: ncparse.c debug.h misc.h zconf.h log.h ncparse.h
-rollover.o: rollover.c config.h config_zkt.h zconf.h debug.h misc.h \
-  zone.h dki.h log.h rollover.h
-nscomm.o: nscomm.c config.h config_zkt.h zconf.h nscomm.h zone.h dki.h \
-  log.h misc.h debug.h
-soaserial.o: soaserial.c config.h config_zkt.h zconf.h log.h debug.h \
-  soaserial.h
-zkt-conf.o: zkt-conf.c config.h config_zkt.h debug.h misc.h zconf.h \
-  zfparse.h
-zfparse.o: zfparse.c config.h config_zkt.h zconf.h log.h debug.h \
-  zfparse.h
-dnssec-zkt.o: dnssec-zkt.c config.h config_zkt.h debug.h misc.h zconf.h \
-  strlist.h dki.h zkt.h
+rollover.o: rollover.c config_zkt.h zconf.h debug.h misc.h zone.h dki.h \
+  log.h rollover.h
+nscomm.o: nscomm.c config_zkt.h zconf.h nscomm.h zone.h dki.h log.h \
+  misc.h debug.h
+soaserial.o: soaserial.c config_zkt.h zconf.h log.h debug.h soaserial.h
+dnssec-zkt.o: dnssec-zkt.c config_zkt.h debug.h misc.h zconf.h strlist.h \
+  dki.h zkt.h
 strlist.o: strlist.c strlist.h
-zkt.o: zkt.c config.h config_zkt.h dki.h misc.h zconf.h strlist.h \
-  domaincmp.h tcap.h zkt.h
-tcap.o: tcap.c config.h config_zkt.h tcap.h
-zkt-ls.o: zkt-ls.c config.h config_zkt.h debug.h misc.h zconf.h strlist.h \
-  dki.h tcap.h zkt.h
-strlist.o: strlist.c strlist.h
-zkt.o: zkt.c config.h config_zkt.h dki.h misc.h zconf.h strlist.h \
-  domaincmp.h tcap.h zkt.h
-tcap.o: tcap.c config.h config_zkt.h tcap.h
-zkt-soaserial.o: zkt-soaserial.c config.h config_zkt.h
-dki.o: dki.c config.h config_zkt.h debug.h domaincmp.h misc.h zconf.h \
-  dki.h
-misc.o: misc.c config.h config_zkt.h zconf.h log.h debug.h misc.h
+zkt.o: zkt.c config_zkt.h dki.h misc.h zconf.h strlist.h zkt.h
+zkt-soaserial.o: zkt-soaserial.c config_zkt.h
+dki.o: dki.c config_zkt.h debug.h domaincmp.h misc.h zconf.h dki.h
+misc.o: misc.c config_zkt.h zconf.h log.h debug.h misc.h
 domaincmp.o: domaincmp.c domaincmp.h
-zconf.o: zconf.c config.h config_zkt.h debug.h misc.h zconf.h dki.h
-log.o: log.c config.h config_zkt.h misc.h zconf.h debug.h log.h
+zconf.o: zconf.c config_zkt.h debug.h misc.h zconf.h dki.h
+log.o: log.c config_zkt.h misc.h zconf.h debug.h log.h
@@ -2,8 +2,8 @@
 #	README  dnssec zone key tool
 #
 #	(c) March 2005 - Aug 2009 by  Holger Zuleger  hznet
-#	(c) domaincmp() Aug 2005 by Karle Boss & H. Zuleger (kaho)
-#	(c) zconf.c by Jeroen Masar & Holger Zuleger
+#	(c) for domaincmp Aug 2005 by Karle Boss & H. Zuleger (kaho)
+#	(c) for zconf.c by Jeroen Masar & Holger Zuleger
 #

 For more information about the DNSSEC Zone Key Tool please
@@ -12,41 +12,35 @@ have a look at "http://www.hznet.de/dns/zkt/"
 You can also subscribe to the zkt-users@sourceforge.net mailing list
 on the following website: https://lists.sourceforge.net/lists/listinfo/zkt-users

-The ZKT software is licenced under BSD (see LICENCE file)
+The complete software stands under BSD licence (see LICENCE file)

 To build the software:
 a) Get the current version of zkt
-	$ wget http://www.hznet.de/dns/zkt/zkt-1.0.tar.gz
+	$ wget http://www.hznet.de/dns/zkt/zkt-0.99c.tar.gz

 b) Unpack
-	$ tar xzvf zkt-1.0.tar.gz
+	$ tar xzvf zkt-0.99c.tar.gz

-c) Change to source directory
-	$ cd zkt-1.0
+c) Change to dir
+	$ cd zkt-0.99c

 d) Run configure script
 	$ ./configure

-e) Compile
+e) (optional) Edit config_zkt.h
+
+f) Compile
 	$ make

-f) Install
+g) Install
 	# make install
 	# make install-man

-
-Prepare your setup:
-a) (optional) Install or rebuild the default dnssec.conf file 
-	$ zkt-conf -d -w	# Install new file
-		or
-	$ zkt-conf -s -w	# rebuild existing file
-
-b) (optional) Change default parameters
-	$ zkt-conf -s -O "Zonedir: /var/named/zones" -w
-		or use your prefered editor 
+h) (optional) Install and modify the default dnssec.conf file 
+	$ ./dnssec-zkt -c "" -Z > /var/named/dnssec.conf
 	$ vi /var/named/dnssec.conf

-c) Prepare one of your zone for zkt
-	$ cd /var/name/zones/net/example.net	# change dir to zone directory
-	$ cp <zonefile> zone.db 		# copy and rename existing zone file to "zone.db"
-	$ zkt-conf -w zone.db			# create local dnssec.conf file and include dnskey.db into zone file
+i) Prepare your zones for zkt
+	Have a look at the presentation I've held at the DE-CIX technical
+	meeting (http://www.hznet.de/dns/dnssec-decix050916.pdf)
+	It will give you an overview of how to configure a zone for zkt usage.
@@ -3,7 +3,6 @@
 #
 #	Introduction into the new logging feature 
 #	available since v0.96
-#	Per domain logging is enabled since v1.0
 #	

 In previous version of dnssec-signer every message was written
@@ -11,8 +10,8 @@ to the default stdout and stderr channels, and the logging itself
 was handled by a redirection of those chanels to the logger command
 or to a file.

-Since v0.96, the dnssec-signer command is able to log all messages
-by itself. File and SYSLOG logging is supported.
+Now, since version v0.96, the dnssec-signer command is able to log all
+messages by itself. File and SYSLOG logging is supported.

 To enable the logging into a file channel, you have to specify
 the file or directory name via the commandline option -L (--logfile)
@@ -20,14 +19,7 @@ or via the config file parameter "LogFile".
 	LogFile: ""|"<file>"|"<directory>"	(default is "")
 If a file is specified, than each run of dnssec-signer will append the
 messages to that file. If a directory is specified, than a file with a
-name of zkt-<ISOdate&timeUTC>+log" will be created on each dnssec-signer run.
-
-Since v1.0 per domain logging is possible.
-If the parameter "LogDomainDir:" is not empty, than the domain specific messages
-are written to a separate log file with a name like "zkt-<domainname>+log" in the
-directory specified by the parameter.
-If "LogDomainDir:" is set to ".", then the logfile will be created in the domain
-directory of the zone.
+name of zkt-<ISOdate&timeUTC>.log" will be created on each dnssec-signer run.

 Logging into the syslog channel could be enabled via the config file
 parameter "SyslogFacility".
@@ -103,3 +95,5 @@ Some recomended and useful logging settings
 	SyslogFacility: USER
 	SyslogLevel: NOTICE
 	VerboseLog: 2
+	
+- 
@@ -1,9 +1,7 @@
 TODO list as of zkt-0.99

 general:
-	Renaming to zkt-? and split of the functions of dnssec-zkt to
-	separate commands
-	Fixed in zkt-1.0 (zkt-conf command)
+	Renaming of the tools to zkt-* ? 

 dnssec-zkt:
 feat	option to specify the key age as remaining lifetime
@@ -25,22 +23,14 @@ dnssec-signer:
 	The dnssec maintainer is responsible for the lifeliness of the
 	data in the hosted domain.
 	In other words: It's highly recommended to use the
-	option -r when you use zkt-signer on a production zone.
+	option -r when you use dnssec-signer on a production zone.
 	Then the time of propagation is (more or less) equal to the timestamp
 	of the zone.db.signed file.

- bug	The max_TTL parameter should be set to the value found
- 	in the zone. A mechanism for setting up a dnssec.conf file
-	for the zone specific TTL values is needed.
-	Fixed in zkt-1.0 (zkt-conf command)
-
-zkt-conf:
- port	Option -C (compability) to create older config files
- misc	Change syntax of config parameters to a more uniq form (e.g. no "_" char)
-
-zkt-rollover:
- feat	New command to roll keys independent of zone signing
-	(Usefull for dynamic zones managed by BIND9.7)
+ bug	The max_TTL and Key_TTL parameter should be set to the value found
+ 	in the zone. A mechanism for setting up a dnssec.conf file for the
+	zone specific TTL values is needed.

 dki:
 feat	Use dynamic memory for dname in dki_t
+
@@ -9,18 +9,12 @@
 /* Define to 1 if the `closedir' function returns void instead of `int'. */
 #undef CLOSEDIR_VOID

-/* zkt-ls with colors */
-#undef COLOR_MODE
-
 /* set path of config file (defaults to /var/named) */
 #undef CONFIG_PATH

 /* Define to 1 if you have the `alarm' function. */
 #undef HAVE_ALARM

-/* Define to 1 if you have the <curses.h> header file. */
-#undef HAVE_CURSES_H
-
 /* Define to 1 if you have the <dirent.h> header file, and it defines `DIR'.
   */
 #undef HAVE_DIRENT_H
@@ -46,8 +40,9 @@
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H

-/* Define to 1 if you have the `ncurses' library (-lncurses). */
-#undef HAVE_LIBNCURSES
+/* Define to 1 if your system has a GNU libc compatible `malloc' function, and
+   to 0 otherwise. */
+#undef HAVE_MALLOC

 /* Define to 1 if you have the <memory.h> header file. */
 #undef HAVE_MEMORY_H
@@ -127,9 +122,6 @@
 /* Define to 1 if you have the <sys/types.h> header file. */
 #undef HAVE_SYS_TYPES_H

-/* Define to 1 if you have the <term.h> header file. */
-#undef HAVE_TERM_H
-
 /* Define to 1 if you have the `timegm' function. */
 #undef HAVE_TIMEGM

@@ -179,8 +171,8 @@
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION

-/* print age with year */
-#undef PRINT_AGE_WITH_YEAR
+/* print age of year */
+#undef PRINT_AGE_OF_YEAR

 /* print out timezone */
 #undef PRINT_TIMEZONE
@@ -200,9 +192,6 @@
 /* Use TREE data structure for dnssec-zkt */
 #undef USE_TREE

-/* ZKT copyright string */
-#undef ZKT_COPYRIGHT
-
 /* ZKT version string */
 #undef ZKT_VERSION

@@ -212,6 +201,9 @@
 /* Define to `int' if <sys/types.h> doesn't define. */
 #undef gid_t

+/* Define to rpl_malloc if the replacement function should be used. */
+#undef malloc
+
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t

@@ -37,6 +37,10 @@
 #ifndef CONFIG_ZKT_H
 # define CONFIG_ZKT_H

+#ifndef LOG_FNAMETMPL
+# define	LOG_FNAMETMPL	"/zkt-%04d-%02d-%02dT%02d%02d%02dZ.log"
+#endif
+
 /* don't change anything below this */
 /* the values here are determined or settable via the ./configure script */

@@ -48,10 +52,6 @@
 /* # define	HAVE_GETOPT_LONG	1	*/
 /* # define	HAVE_STRFTIME		1	*/

-#ifndef COLOR_MODE
-# define	COLOR_MODE	1
-#endif
-
 #ifndef TTL_IN_KEYFILE_ALLOWED
 # define	TTL_IN_KEYFILE_ALLOWED	1
 #endif
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for ZKT 1.0.
+# Generated by GNU Autoconf 2.61 for ZKT 0.99c.
 #
 # Report bugs to <Holger Zuleger hznet.de>.
 #
@@ -574,11 +574,11 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='ZKT'
 PACKAGE_TARNAME='zkt'
-PACKAGE_VERSION='1.0'
-PACKAGE_STRING='ZKT 1.0'
+PACKAGE_VERSION='0.99c'
+PACKAGE_STRING='ZKT 0.99c'
 PACKAGE_BUGREPORT='Holger Zuleger hznet.de'

-ac_unique_file="zkt-signer.c"
+ac_unique_file="dnssec-zkt.c"
 # Factoring default headers for most tests.
 ac_includes_default="\
 #include <stdio.h>
@@ -1179,7 +1179,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures ZKT 1.0 to adapt to many kinds of systems.
+\`configure' configures ZKT 0.99c to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1240,16 +1240,15 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of ZKT 1.0:";;
+     short | recursive ) echo "Configuration of ZKT 0.99c:";;
   esac
  cat <<\_ACEOF

 Optional Features:
  --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
  --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
-  --disable-color-mode    zkt without colors
  --enable-print-timezone print out timezone
-  --enable-print-age      print age with year
+  --enable-print-age      print age of year
  --enable-log-progname   log with progname
  --disable-log-timestamp do not log with timestamp
  --disable-log-level     do not log with level
@@ -1260,11 +1259,6 @@ Optional Features:
  --disable-tree          use single linked list instead of binary tree data
                          structure for dnssec-zkt

-Optional Packages:
-  --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
-  --without-PACKAGE       do not use PACKAGE (same as --with-PACKAGE=no)
-  --without-curses        Ignore presence of curses and disable color mode
-
 Some influential environment variables:
  CC          C compiler command
  CFLAGS      C compiler flags
@@ -1339,7 +1333,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-ZKT configure 1.0
+ZKT configure 0.99c
 generated by GNU Autoconf 2.61

 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1353,7 +1347,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by ZKT $as_me 1.0, which was
+It was created by ZKT $as_me 0.99c, which was
 generated by GNU Autoconf 2.61.  Invocation command line was

  $ $0 $@
@@ -2680,6 +2674,7 @@ fi


 if test -z "$SIGNZONE_PROG" ; then
+#        AC_MSG_ERROR([*** 'BIND dnssec-signzone dnssec-keygen' missing, please install or fix your \$PATH ***])
        { echo "$as_me:$LINENO: WARNING: *** 'BIND dnssec-signzone' missing, use default BIND_UTIL_PATH and BIND_VERSION setting out of config_zkt.h ***" >&5
 echo "$as_me: WARNING: *** 'BIND dnssec-signzone' missing, use default BIND_UTIL_PATH and BIND_VERSION setting out of config_zkt.h ***" >&2;}
 else
@@ -2691,7 +2686,7 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF

 	# define BIND_VERSION in config.h.in
-	bind_version=`$SIGNZONE_PROG 2>&1 | grep "Version:" | tr -cd "[0-9]\012" | sed "s/^\(...\).*/\1/"`
+	bind_version=`$SIGNZONE_PROG 2>&1 | grep "Version:" | tr -cd "0-9" | sed "s/^\(...\).*/\1/"`

 cat >>confdefs.h <<_ACEOF
 #define BIND_VERSION $bind_version
@@ -3590,118 +3585,13 @@ fi


 ### define configure arguments
-# Check whether --enable-color_mode was given.
-if test "${enable_color_mode+set}" = set; then
-  enableval=$enable_color_mode;
-fi
-
-color_mode=1
-if test "$enable_color_mode" = "no"; then
-  color_mode=0
-fi
-
-
-
-# Check whether --with-curses was given.
-if test "${with_curses+set}" = set; then
-  withval=$with_curses;
-fi
-
-
-if test "x$with_curses" != "xno"; then
-
-{ echo "$as_me:$LINENO: checking for tgetent in -lncurses" >&5
-echo $ECHO_N "checking for tgetent in -lncurses... $ECHO_C" >&6; }
-if test "${ac_cv_lib_ncurses_tgetent+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lncurses  $LIBS"
-cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char tgetent ();
-int
-main ()
-{
-return tgetent ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (ac_try="$ac_link"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_link") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest$ac_exeext &&
-       $as_test_x conftest$ac_exeext; then
-  ac_cv_lib_ncurses_tgetent=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	ac_cv_lib_ncurses_tgetent=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
-      conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ echo "$as_me:$LINENO: result: $ac_cv_lib_ncurses_tgetent" >&5
-echo "${ECHO_T}$ac_cv_lib_ncurses_tgetent" >&6; }
-if test $ac_cv_lib_ncurses_tgetent = yes; then
-  cat >>confdefs.h <<_ACEOF
-#define HAVE_LIBNCURSES 1
-_ACEOF
-
-  LIBS="-lncurses $LIBS"
-
-fi
-
-else
-  HAVE_LIB_NCURSES=0; color_mode=0
-fi
-
-
-
-cat >>confdefs.h <<_ACEOF
-#define COLOR_MODE $color_mode
-_ACEOF
-
-
-
 # Check whether --enable-printtimezone was given.
 if test "${enable_printtimezone+set}" = set; then
-  enableval=$enable_printtimezone;
+  enableval=$enable_printtimezone; printtimezone=$enableval
 fi

 printtimezone=0
-if test "$enable_printtimezone" = "yes"; then
-  printtimezone=1
-fi
-
+test "$printtimezone" = yes && printtimezone=1

 cat >>confdefs.h <<_ACEOF
 #define PRINT_TIMEZONE $printtimezone
@@ -3710,31 +3600,24 @@ _ACEOF

 # Check whether --enable-printyear was given.
 if test "${enable_printyear+set}" = set; then
-  enableval=$enable_printyear;
+  enableval=$enable_printyear; printyear=$enableval
 fi

-test "$printyear" = yes && printyear=1
 printyear=0
-if test "$enable_printyear" = "yes"; then
-  printyear=1
-fi
-
+test "$printyear" = yes && printyear=1

 cat >>confdefs.h <<_ACEOF
-#define PRINT_AGE_WITH_YEAR $printyear
+#define PRINT_AGE_OF_YEAR $printyear
 _ACEOF


 # Check whether --enable-logprogname was given.
 if test "${enable_logprogname+set}" = set; then
-  enableval=$enable_logprogname;
+  enableval=$enable_logprogname; logprogname=$enableval
 fi

 logprogname=0
-if test "$enable_logprogname" = "yes"; then
-  logprogname=1
-fi
-
+test "$logprogname" = yes && logprogname=1

 cat >>confdefs.h <<_ACEOF
 #define LOG_WITH_PROGNAME $logprogname
@@ -3743,14 +3626,11 @@ _ACEOF

 # Check whether --enable-logtimestamp was given.
 if test "${enable_logtimestamp+set}" = set; then
-  enableval=$enable_logtimestamp;
+  enableval=$enable_logtimestamp; logtimestamp=$enableval
 fi

 logtimestamp=1
-if test "$enable_logtimestamp" = "no"; then
-  logtimestamp=0
-fi
-
+test "$logtimestamp" = no && logtimestamp=0

 cat >>confdefs.h <<_ACEOF
 #define LOG_WITH_TIMESTAMP $logtimestamp
@@ -3759,14 +3639,11 @@ _ACEOF

 # Check whether --enable-loglevel was given.
 if test "${enable_loglevel+set}" = set; then
-  enableval=$enable_loglevel;
+  enableval=$enable_loglevel; loglevel=$enableval
 fi

 loglevel=1
-if test "$enable_loglevel" = "no"; then
-  loglevel=0
-fi
-
+test "$loglevel" = no && loglevel=0

 cat >>confdefs.h <<_ACEOF
 #define LOG_WITH_LEVEL $loglevel
@@ -3775,14 +3652,11 @@ _ACEOF

 # Check whether --enable-ttl_in_keyfile was given.
 if test "${enable_ttl_in_keyfile+set}" = set; then
-  enableval=$enable_ttl_in_keyfile;
+  enableval=$enable_ttl_in_keyfile; ttl_in_keyfile=$enableval
 fi

 ttl_in_keyfile=1
-if test "$enable_ttl_in_keyfile" = "no"; then
-  ttl_in_keyfile=0
-fi
-
+test "$ttl_in_keyfile" = no && ttl_in_keyfile=0

 cat >>confdefs.h <<_ACEOF
 #define TTL_IN_KEYFILE_ALLOWED $ttl_in_keyfile
@@ -3812,7 +3686,7 @@ _ACEOF


 usetree=1
-t=""
+t="T"
 # Check whether --enable-tree was given.
 if test "${enable_tree+set}" = set; then
  enableval=$enable_tree; usetree=$enableval
@@ -3821,7 +3695,7 @@ fi
 if test "$usetree" = no
 then
 	usetree=0
-	t="S"
+	t=""
 fi

 cat >>confdefs.h <<_ACEOF
@@ -3831,17 +3705,13 @@ _ACEOF


 cat >>confdefs.h <<_ACEOF
-#define ZKT_VERSION "$t$PACKAGE_VERSION"
-_ACEOF
-
-
-cat >>confdefs.h <<_ACEOF
-#define ZKT_COPYRIGHT "(c) Feb 2005 - Mar 2010 Holger Zuleger hznet.de"
+#define ZKT_VERSION "v$t$PACKAGE_VERSION (c) Feb 2005 - Aug 2009 Holger Zuleger hznet.de"
 _ACEOF


 ### Checks for libraries.

+
 ### Checks for header files.


@@ -4270,9 +4140,7 @@ fi



-
-
-for ac_header in fcntl.h netdb.h stdlib.h getopt.h string.h strings.h sys/socket.h sys/time.h sys/types.h syslog.h unistd.h utime.h term.h curses.h
+for ac_header in fcntl.h netdb.h stdlib.h getopt.h string.h strings.h sys/socket.h sys/time.h sys/types.h syslog.h unistd.h utime.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
 if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
@@ -4884,6 +4752,241 @@ esac
 fi


+for ac_header in stdlib.h
+do
+as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  { echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+else
+  # Is the header compilable?
+{ echo "$as_me:$LINENO: checking $ac_header usability" >&5
+echo $ECHO_N "checking $ac_header usability... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_header_compiler=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_header_compiler=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_compiler" >&5
+echo "${ECHO_T}$ac_header_compiler" >&6; }
+
+# Is the header present?
+{ echo "$as_me:$LINENO: checking $ac_header presence" >&5
+echo $ECHO_N "checking $ac_header presence... $ECHO_C" >&6; }
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#include <$ac_header>
+_ACEOF
+if { (ac_try="$ac_cpp conftest.$ac_ext"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_cpp conftest.$ac_ext") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } >/dev/null && {
+	 test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       }; then
+  ac_header_preproc=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+  ac_header_preproc=no
+fi
+
+rm -f conftest.err conftest.$ac_ext
+{ echo "$as_me:$LINENO: result: $ac_header_preproc" >&5
+echo "${ECHO_T}$ac_header_preproc" >&6; }
+
+# So?  What about this header?
+case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in
+  yes:no: )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&5
+echo "$as_me: WARNING: $ac_header: accepted by the compiler, rejected by the preprocessor!" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the compiler's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the compiler's result" >&2;}
+    ac_header_preproc=yes
+    ;;
+  no:yes:* )
+    { echo "$as_me:$LINENO: WARNING: $ac_header: present but cannot be compiled" >&5
+echo "$as_me: WARNING: $ac_header: present but cannot be compiled" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     check for missing prerequisite headers?" >&5
+echo "$as_me: WARNING: $ac_header:     check for missing prerequisite headers?" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: see the Autoconf documentation" >&5
+echo "$as_me: WARNING: $ac_header: see the Autoconf documentation" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&5
+echo "$as_me: WARNING: $ac_header:     section \"Present But Cannot Be Compiled\"" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: proceeding with the preprocessor's result" >&5
+echo "$as_me: WARNING: $ac_header: proceeding with the preprocessor's result" >&2;}
+    { echo "$as_me:$LINENO: WARNING: $ac_header: in the future, the compiler will take precedence" >&5
+echo "$as_me: WARNING: $ac_header: in the future, the compiler will take precedence" >&2;}
+    ( cat <<\_ASBOX
+## -------------------------------------- ##
+## Report this to Holger Zuleger hznet.de ##
+## -------------------------------------- ##
+_ASBOX
+     ) | sed "s/^/$as_me: WARNING:     /" >&2
+    ;;
+esac
+{ echo "$as_me:$LINENO: checking for $ac_header" >&5
+echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  eval "$as_ac_Header=\$ac_header_preproc"
+fi
+ac_res=`eval echo '${'$as_ac_Header'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+
+fi
+if test `eval echo '${'$as_ac_Header'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+{ echo "$as_me:$LINENO: checking for GNU libc compatible malloc" >&5
+echo $ECHO_N "checking for GNU libc compatible malloc... $ECHO_C" >&6; }
+if test "${ac_cv_func_malloc_0_nonnull+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  if test "$cross_compiling" = yes; then
+  ac_cv_func_malloc_0_nonnull=no
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+#if defined STDC_HEADERS || defined HAVE_STDLIB_H
+# include <stdlib.h>
+#else
+char *malloc ();
+#endif
+
+int
+main ()
+{
+return ! malloc (0);
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_link") 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  { (case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_try") 2>&5
+  ac_status=$?
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_func_malloc_0_nonnull=yes
+else
+  echo "$as_me: program exited with status $ac_status" >&5
+echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ac_cv_func_malloc_0_nonnull=no
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
+
+
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_func_malloc_0_nonnull" >&5
+echo "${ECHO_T}$ac_cv_func_malloc_0_nonnull" >&6; }
+if test $ac_cv_func_malloc_0_nonnull = yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define HAVE_MALLOC 1
+_ACEOF
+
+else
+  cat >>confdefs.h <<\_ACEOF
+#define HAVE_MALLOC 0
+_ACEOF
+
+   case " $LIBOBJS " in
+  *" malloc.$ac_objext "* ) ;;
+  *) LIBOBJS="$LIBOBJS malloc.$ac_objext"
+ ;;
+esac
+
+
+cat >>confdefs.h <<\_ACEOF
+#define malloc rpl_malloc
+_ACEOF
+
+fi
+
+
+
+



@@ -6505,7 +6608,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by ZKT $as_me 1.0, which was
+This file was extended by ZKT $as_me 0.99c, which was
 generated by GNU Autoconf 2.61.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -6554,7 +6657,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-ZKT config.status 1.0
+ZKT config.status 0.99c
 configured by $0, generated by GNU Autoconf 2.61,
  with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"

@@ -11,17 +11,16 @@
 #	2008-08-30	check for unsigned integer types
 #	2008-10-01	if BIND_UTIL_PATH check failed, use config_zkt.h setting as last resort
 #	2009-07-30	check for timegm() added
-#	2009-12-02	the tr command in bind_version= didn't work well under solaris
 #

-dnl AC_PREREQ(2.59)
+AC_PREREQ(2.59)

 ### Package name and current version
-AC_INIT(ZKT, 1.0, Holger Zuleger hznet.de)
-dnl AC_REVISION($Revision: 1.1.82.1 $)
+AC_INIT(ZKT, 0.99c, Holger Zuleger hznet.de)
+dnl AC_REVISION($Revision: 1.1 $)

 ### Files to test to check if src dir contains the package
-AC_CONFIG_SRCDIR([zkt-signer.c])
+AC_CONFIG_SRCDIR([dnssec-zkt.c])
 AC_CONFIG_HEADER([config.h])


@@ -31,13 +30,14 @@ AC_PROG_CC
 ### find out the path to BIND utils and version
 AC_PATH_PROG([SIGNZONE_PROG], dnssec-signzone)
 if test -z "$SIGNZONE_PROG" ; then
+#        AC_MSG_ERROR([*** 'BIND dnssec-signzone dnssec-keygen' missing, please install or fix your \$PATH ***])
        AC_MSG_WARN([*** 'BIND dnssec-signzone' missing, use default BIND_UTIL_PATH and BIND_VERSION setting out of config_zkt.h ***])
 else
 	bind_util_path=`dirname "$SIGNZONE_PROG"`
 	# define BIND_UTIL_PATH in config.h.in
 	AC_DEFINE_UNQUOTED(BIND_UTIL_PATH, "$bind_util_path/", Path to BIND utilities)
 	# define BIND_VERSION in config.h.in
-	bind_version=`$SIGNZONE_PROG 2>&1 | grep "Version:" | tr -cd "[[0-9]]\012" | sed "s/^\(...\).*/\1/"`
+	bind_version=`$SIGNZONE_PROG 2>&1 | grep "Version:" | tr -cd "0-9" | sed "s/^\(...\).*/\1/"`
 	AC_DEFINE_UNQUOTED(BIND_VERSION, $bind_version, BIND version as integer number without dots)
 fi

@@ -47,56 +47,39 @@ AC_CHECK_TYPE(ushort, unsigned short)
 AC_CHECK_TYPE(uchar, unsigned char)

 ### define configure arguments
-AC_ARG_ENABLE([color_mode], AS_HELP_STRING([--disable-color-mode], [zkt without colors]))
-color_mode=1
-AS_IF([test "$enable_color_mode" = "no"], [color_mode=0])
-
-AC_ARG_WITH([curses],
-    AS_HELP_STRING([--without-curses], [Ignore presence of curses and disable color mode]))
-
-AS_IF([test "x$with_curses" != "xno"],
-	[AC_CHECK_LIB([ncurses],[tgetent])],
-	        [HAVE_LIB_NCURSES=0; color_mode=0])
-
-AC_DEFINE_UNQUOTED(COLOR_MODE, $color_mode, zkt-ls with colors)
-
-
-dnl printtimezone is a default-disabled feature
-AC_ARG_ENABLE([printtimezone], AS_HELP_STRING( [--enable-print-timezone], [print out timezone]))
+AC_ARG_ENABLE([printtimezone], AC_HELP_STRING( [--enable-print-timezone], [print out timezone]), [printtimezone=$enableval])
 printtimezone=0
-AS_IF([test "$enable_printtimezone" = "yes"], [printtimezone=1])
+test "$printtimezone" = yes && printtimezone=1
 AC_DEFINE_UNQUOTED(PRINT_TIMEZONE, $printtimezone, print out timezone)

-AC_ARG_ENABLE([printyear], AS_HELP_STRING( [--enable-print-age], [print age with year]))
-test "$printyear" = yes && printyear=1
+AC_ARG_ENABLE([printyear], AC_HELP_STRING( [--enable-print-age], [print age of year]), [printyear=$enableval])
 printyear=0
-AS_IF([test "$enable_printyear" = "yes"], [printyear=1])
-AC_DEFINE_UNQUOTED(PRINT_AGE_WITH_YEAR, $printyear, print age with year)
+test "$printyear" = yes && printyear=1
+AC_DEFINE_UNQUOTED(PRINT_AGE_OF_YEAR, $printyear, print age of year)

-AC_ARG_ENABLE([logprogname], AS_HELP_STRING( [--enable-log-progname], [log with progname]))
+AC_ARG_ENABLE([logprogname], AC_HELP_STRING( [--enable-log-progname], [log with progname]), [logprogname=$enableval])
 logprogname=0
-AS_IF([test "$enable_logprogname" = "yes"], [logprogname=1])
+test "$logprogname" = yes && logprogname=1
 AC_DEFINE_UNQUOTED(LOG_WITH_PROGNAME, $logprogname, log with progname)

-dnl logtimestamp is a default-enabled feature
-AC_ARG_ENABLE([logtimestamp], AS_HELP_STRING([--disable-log-timestamp], [do not log with timestamp]))
+AC_ARG_ENABLE([logtimestamp], AC_HELP_STRING( [--disable-log-timestamp], [do not log with timestamp]), [logtimestamp=$enableval])
 logtimestamp=1
-AS_IF([test "$enable_logtimestamp" = "no"], [logtimestamp=0])
+test "$logtimestamp" = no && logtimestamp=0
 AC_DEFINE_UNQUOTED(LOG_WITH_TIMESTAMP, $logtimestamp, log with timestamp)

-AC_ARG_ENABLE([loglevel], AS_HELP_STRING([--disable-log-level], [do not log with level]))
+AC_ARG_ENABLE([loglevel], AC_HELP_STRING( [--disable-log-level], [do not log with level]), [loglevel=$enableval])
 loglevel=1
-AS_IF([test "$enable_loglevel" = "no"], [loglevel=0])
+test "$loglevel" = no && loglevel=0
 AC_DEFINE_UNQUOTED(LOG_WITH_LEVEL, $loglevel, log with level)

-AC_ARG_ENABLE([ttl_in_keyfile], AS_HELP_STRING([--disable-ttl-in-keyfiles], [do not allow TTL values in keyfiles]))
+AC_ARG_ENABLE([ttl_in_keyfile], AC_HELP_STRING( [--disable-ttl-in-keyfiles], [do not allow TTL values in keyfiles]), [ttl_in_keyfile=$enableval])
 ttl_in_keyfile=1
-AS_IF([test "$enable_ttl_in_keyfile" = "no"], [ttl_in_keyfile=0])
+test "$ttl_in_keyfile" = no && ttl_in_keyfile=0
 AC_DEFINE_UNQUOTED(TTL_IN_KEYFILE_ALLOWED, $ttl_in_keyfile, TTL in keyfiles allowed)

 configpath="/var/named"
 AC_ARG_ENABLE([configpath], 
-	AS_HELP_STRING( [--enable-configpath=PATH], [set path of config file (defaults to /var/named)]),
+	AC_HELP_STRING( [--enable-configpath=PATH], [set path of config file (defaults to /var/named)]),
 	[configpath=$enableval])
 case "$configpath" in
 yes)
@@ -111,26 +94,26 @@ esac
 AC_DEFINE_UNQUOTED(CONFIG_PATH, "$configpath/", [set path of config file (defaults to /var/named)])

 usetree=1
-t=""
+t="T"
 AC_ARG_ENABLE([tree], 
-	AS_HELP_STRING( [--disable-tree], [use single linked list instead of binary tree data structure for dnssec-zkt]),
+	AC_HELP_STRING( [--disable-tree], [use single linked list instead of binary tree data structure for dnssec-zkt]),
 	[usetree=$enableval])
 if test "$usetree" = no
 then
 	usetree=0
-	t="S"
+	t=""
 fi
 AC_DEFINE_UNQUOTED(USE_TREE, $usetree, Use TREE data structure for dnssec-zkt)

-AC_DEFINE_UNQUOTED(ZKT_VERSION, "$t$PACKAGE_VERSION", ZKT version string)
-AC_DEFINE_UNQUOTED(ZKT_COPYRIGHT, "(c) Feb 2005 - Mar 2010 Holger Zuleger hznet.de", ZKT copyright string)
+AC_DEFINE_UNQUOTED(ZKT_VERSION, "v$t$PACKAGE_VERSION (c) Feb 2005 - Aug 2009 Holger Zuleger hznet.de", ZKT version string)

 ### Checks for libraries.

+
 ### Checks for header files.
 AC_HEADER_DIRENT
 AC_HEADER_STDC
-AC_CHECK_HEADERS([fcntl.h netdb.h stdlib.h getopt.h string.h strings.h sys/socket.h sys/time.h sys/types.h syslog.h unistd.h utime.h term.h curses.h])
+AC_CHECK_HEADERS([fcntl.h netdb.h stdlib.h getopt.h string.h strings.h sys/socket.h sys/time.h sys/types.h syslog.h unistd.h utime.h])


 ### Checks for typedefs, structures, and compiler characteristics.
@@ -142,9 +125,9 @@ AC_TYPE_UID_T


 ### Checks for library functions.
-dnl AC_FUNC_MALLOC
 AC_FUNC_CLOSEDIR_VOID
 AC_FUNC_ERROR_AT_LINE
+AC_FUNC_MALLOC
 AC_FUNC_MKTIME
 AC_FUNC_STAT
 AC_FUNC_STRFTIME
@@ -227,11 +227,6 @@ void	dki_tfree (dki_t **tree)
 }
 #endif

-#if defined(BIND_VERSION) && BIND_VERSION >= 970
-# define	KEYGEN_COMPMODE	"-C -q "	/* this is the compability mode needed by BIND 9.7 */
-#else
-# define	KEYGEN_COMPMODE	""
-#endif
 /*****************************************************************
 **	dki_new ()
 **	create new keyfile
@@ -255,15 +250,15 @@ dki_t	*dki_new (const char *dir, const char *name, int ksk, int algo, int bitsiz
 	if ( rfile && *rfile )
 		snprintf (randfile, sizeof (randfile), "-r %.250s ", rfile);
 		
-	if ( algo == DK_ALGO_RSA || algo == DK_ALGO_RSASHA1 || algo == DK_ALGO_RSASHA256 || algo == DK_ALGO_RSASHA512 )
+	if ( algo == DK_ALGO_RSA || algo == DK_ALGO_RSASHA1 )
 		expflag = "-e ";

 	if ( dir && *dir )
-		snprintf (cmdline, sizeof (cmdline), "cd %s ; %s %s%s%s-n ZONE -a %s -b %d %s %s",
-			dir, KEYGENCMD, KEYGEN_COMPMODE, randfile, expflag, dki_algo2str(algo), bitsize, flag, name);
+		snprintf (cmdline, sizeof (cmdline), "cd %s ; %s %s%s-n ZONE -a %s -b %d %s %s",
+			dir, KEYGENCMD, randfile, expflag, dki_algo2str(algo), bitsize, flag, name);
 	else
-		snprintf (cmdline, sizeof (cmdline), "%s %s%s%s-n ZONE -a %s -b %d %s %s",
-			KEYGENCMD, KEYGEN_COMPMODE, randfile, expflag, dki_algo2str(algo), bitsize, flag, name);
+		snprintf (cmdline, sizeof (cmdline), "%s %s%s-n ZONE -a %s -b %d %s %s",
+			KEYGENCMD, randfile, expflag, dki_algo2str(algo), bitsize, flag, name);

 	dbg_msg (cmdline);

@@ -637,8 +632,6 @@ char	*dki_algo2str (int algo)
 	case DK_ALGO_RSASHA1:		return ("RSASHA1");
 	case DK_ALGO_NSEC3DSA:		return ("NSEC3DSA");
 	case DK_ALGO_NSEC3RSASHA1:	return ("NSEC3RSASHA1");
-	case DK_ALGO_RSASHA256:		return ("RSASHA256");
-	case DK_ALGO_RSASHA512:		return ("RSASHA512");
 	}
 	return ("unknown");
 }
@@ -658,8 +651,6 @@ char	*dki_algo2sstr (int algo)
 	case DK_ALGO_RSASHA1:		return ("RSASHA1");
 	case DK_ALGO_NSEC3DSA:		return ("N3DSA");
 	case DK_ALGO_NSEC3RSASHA1:	return ("N3RSA1");
-	case DK_ALGO_RSASHA256:		return ("RSASHA2");
-	case DK_ALGO_RSASHA512:		return ("RSASHA5");
 	}
 	return ("unknown");
 }
@@ -850,18 +841,6 @@ int	dki_namecmp (const dki_t *a, const dki_t *b)

 	return domaincmp (a->name, b->name);
 }
-
-/*****************************************************************
-**	dki_revnamecmp () 	return <0 | 0 | >0
-*****************************************************************/
-int	dki_revnamecmp (const dki_t *a, const dki_t *b)
-{
-	if ( a == NULL ) return -1;
-	if ( b == NULL ) return 1;
-
-	return domaincmp_dir (a->name, b->name, 0);
-}
-
 /*****************************************************************
 **	dki_tagcmp () 	return <0 | 0 | >0
 *****************************************************************/
@@ -1149,14 +1128,11 @@ const dki_t	*dki_search (const dki_t *list, int tag, const char *name)
 /*****************************************************************
 **	dki_tadd ()	add a key to the given tree
 *****************************************************************/
-dki_t	*dki_tadd (dki_t **tree, dki_t *new, int sub_before)
+dki_t	*dki_tadd (dki_t **tree, dki_t *new)
 {
 	dki_t	**p;

-	if ( sub_before )
-		p = tsearch (new, tree, dki_namecmp);
-	else
-		p = tsearch (new, tree, dki_revnamecmp);
+	p = tsearch (new, tree, dki_namecmp);
 	if ( *p == new )
 		dbg_val ("dki_tadd: New entry %s added\n", new->name);
 	else
@@ -55,17 +55,13 @@
 # define	MAX_PATHSIZE	(MAX_DNAMESIZE + 1 + MAX_FNAMESIZE)

 /* algorithm types */
-# define	DK_ALGO_RSA		1	/* RFC2537 */
-# define	DK_ALGO_DH		2	/* RFC2539 */
-# define	DK_ALGO_DSA		3	/* RFC2536 (mandatory) */
-# define	DK_ALGO_EC		4	/* */
-# define	DK_ALGO_RSASHA1		5	/* RFC3110 */
+# define	DK_ALGO_RSA	1	/* RFC2537 */
+# define	DK_ALGO_DH	2	/* RFC2539 */
+# define	DK_ALGO_DSA	3	/* RFC2536 (mandatory) */
+# define	DK_ALGO_EC	4	/* */
+# define	DK_ALGO_RSASHA1	5	/* RFC3110 */
 # define	DK_ALGO_NSEC3DSA	6	/* symlink to alg 3 RFC5155 */
 # define	DK_ALGO_NSEC3RSASHA1	7	/* symlink to alg 5 RFC5155 */
-# define	DK_ALGO_RSASHA256	8	/* RFCxxx */
-# define	DK_ALGO_RSASHA512	10	/* RFCxxx */
-# define	DK_ALGO_NSEC3RSASHA256	DK_ALGO_RSASHA256	/* same as non nsec algorithm RFCxxx */
-# define	DK_ALGO_NSEC3RSASHA512	DK_ALGO_RSASHA512	/* same as non nsec algorithm RFCxxx */

 /* protocol types */
 # define	DK_PROTO_DNS	3
@@ -141,10 +137,9 @@ dki_t	**tdelete (const dki_t *dkp, dki_t **tree, int(*compar)(const dki_t *, con
 void	twalk (const dki_t *root, void (*action)(const dki_t **nodep, VISIT which, int depth));

 extern	void	dki_tfree (dki_t **tree);
-extern	dki_t	*dki_tadd (dki_t **tree, dki_t *new, int sub_before);
+extern	dki_t	*dki_tadd (dki_t **tree, dki_t *new);
 extern	int	dki_tagcmp (const dki_t *a, const dki_t *b);
 extern	int	dki_namecmp (const dki_t *a, const dki_t *b);
-extern	int	dki_revnamecmp (const dki_t *a, const dki_t *b);
 extern	int	dki_allcmp (const dki_t *a, const dki_t *b);
 #endif

@@ -0,0 +1,913 @@
+/*****************************************************************
+**
+**	@(#) dnssec-signer.c  (c) Jan 2005  Holger Zuleger hznet.de
+**
+**	A wrapper around the BIND dnssec-signzone command which is able
+**	to resign a zone if necessary and doing a zone or key signing key rollover.
+**
+**	Copyright (c) 2005 - 2008, Holger Zuleger HZnet. All rights reserved.
+**	This software is open source.
+**
+**	Redistribution and use in source and binary forms, with or without
+**	modification, are permitted provided that the following conditions
+**	are met:
+**
+**	Redistributions of source code must retain the above copyright notice,
+**	this list of conditions and the following disclaimer.
+**
+**	Redistributions in binary form must reproduce the above copyright notice,
+**	this list of conditions and the following disclaimer in the documentation
+**	and/or other materials provided with the distribution.
+**
+**	Neither the name of Holger Zuleger HZnet nor the names of its contributors may
+**	be used to endorse or promote products derived from this software without
+**	specific prior written permission.
+**
+**	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+**	"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+**	TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+**	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+**	LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+**	CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+**	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+**	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+**	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+**	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+**	POSSIBILITY OF SUCH DAMAGE.
+**
+*****************************************************************/
+
+# include <stdio.h>
+# include <string.h>
+# include <stdlib.h>
+# include <assert.h>
+# include <dirent.h>
+# include <errno.h>	
+# include <unistd.h>	
+# include <ctype.h>	
+
+#ifdef HAVE_CONFIG_H
+# include <config.h>
+#endif
+# include "config_zkt.h"
+#if defined(HAVE_GETOPT_LONG) && HAVE_GETOPT_LONG
+# include <getopt.h>
+#endif
+# include "zconf.h"
+# include "debug.h"
+# include "misc.h"
+# include "ncparse.h"
+# include "nscomm.h"
+# include "soaserial.h"
+# include "zone.h"
+# include "dki.h"
+# include "rollover.h"
+# include "log.h"
+
+#if defined(BIND_VERSION) && BIND_VERSION >= 940
+# define	short_options	"c:L:V:D:N:o:O:dfHhnrv"
+#else
+# define	short_options	"c:L:V:D:N:o:O:fHhnrv"
+#endif
+#if defined(HAVE_GETOPT_LONG) && HAVE_GETOPT_LONG
+static struct option long_options[] = {
+	{"reload",		no_argument, NULL, 'r'},
+	{"force",		no_argument, NULL, 'f'},
+	{"noexec",		no_argument, NULL, 'n'},
+	{"verbose",		no_argument, NULL, 'v'},
+	{"directory",		no_argument, NULL, 'd'},
+	{"config",		required_argument, NULL, 'c'},
+	{"option",		required_argument, NULL, 'O'},
+	{"config-option",	required_argument, NULL, 'O'},
+	{"logfile",		required_argument, NULL, 'L' },
+	{"view",		required_argument, NULL, 'V' },
+	{"directory",		required_argument, NULL, 'D'},
+	{"named-conf",		required_argument, NULL, 'N'},
+	{"origin",		required_argument, NULL, 'o'},
+#if defined(BIND_VERSION) && BIND_VERSION >= 940
+	{"dynamic",		no_argument, NULL, 'd' },
+#endif
+	{"help",		no_argument, NULL, 'h'},
+	{0, 0, 0, 0}
+};
+#endif
+
+
+/**	function declaration	**/
+static	void	usage (char *mesg, zconf_t *conf);
+static	int	add2zonelist (const char *dir, const char *view, const char *zone, const char *file);
+static	int	parsedir (const char *dir, zone_t **zp, const zconf_t *conf);
+static	int	dosigning (zone_t *zonelist, zone_t *zp);
+static	int	check_keydb_timestamp (dki_t *keylist, time_t reftime);
+static	int	new_keysetfiles (const char *dir, time_t zone_signing_time);
+static	int	writekeyfile (const char *fname, const dki_t *list, int key_ttl);
+static	int	sign_zone (const char *dir, const char *domain, const char *file, const zconf_t *conf);
+static	void	register_key (dki_t *listp, const zconf_t *z);
+static	void	copy_keyset (const char *dir, const char *domain, const zconf_t *conf);
+
+/**	global command line options	**/
+extern  int	optopt;
+extern  int	opterr;
+extern  int	optind;
+extern  char	*optarg;
+const	char	*progname;
+static	const	char	*viewname = NULL;
+static	const	char	*logfile = NULL;
+static	const	char	*origin = NULL;
+static	const	char	*namedconf = NULL;
+static	const	char	*dirname = NULL;
+static	int	verbose = 0;
+static	int	force = 0;
+static	int	reloadflag = 0;
+static	int	noexec = 0;
+static	int	dynamic_zone = 0;	/* dynamic zone ? */
+static	zone_t	*zonelist = NULL;	/* must be static global because add2zonelist use it */
+static	zconf_t	*config;
+
+/**	macros **/
+#define	set_bind94_dynzone(dz)	((dz) = 1)
+#define	set_bind96_dynzone(dz)	((dz) = 6)
+#define	bind94_dynzone(dz)	( (dz) > 0 && (dz) < 6 )
+#define	bind96_dynzone(dz)	( (dz) >= 6 )
+
+int	main (int argc, char *const argv[])
+{
+	int	c;
+	int	errcnt;
+#if defined(HAVE_GETOPT_LONG) && HAVE_GETOPT_LONG
+	int	opt_index;
+#endif
+	char	errstr[255+1];
+	char	*p;
+	const	char	*defconfname;
+	zone_t	*zp;
+
+	progname = *argv;
+	if ( (p = strrchr (progname, '/')) )
+		progname = ++p;
+	viewname = getnameappendix (progname, "dnssec-signer");
+
+	defconfname = getdefconfname (viewname);
+	config = loadconfig ("", (zconf_t *)NULL);	/* load build-in config */
+	if ( fileexist (defconfname) )			/* load default config file */
+		config = loadconfig (defconfname, config);
+	if ( config == NULL )
+		fatal ("Couldn't load config: Out of memory\n");
+
+	zonelist = NULL;
+        opterr = 0;
+#if defined(HAVE_GETOPT_LONG) && HAVE_GETOPT_LONG
+	while ( (c = getopt_long (argc, argv, short_options, long_options, &opt_index)) != -1 )
+#else
+	while ( (c = getopt (argc, argv, short_options)) != -1 )
+#endif
+	{
+		switch ( c )
+		{
+		case 'V':		/* view name */
+			viewname = optarg;
+			defconfname = getdefconfname (viewname);
+			if ( fileexist (defconfname) )		/* load default config file */
+				config = loadconfig (defconfname, config);
+			if ( config == NULL )
+				fatal ("Out of memory\n");
+			break;
+		case 'c':		/* load config from file */
+			config = loadconfig (optarg, config);
+			if ( config == NULL )
+				fatal ("Out of memory\n");
+			break;
+		case 'O':		/* load config option from commandline */
+			config = loadconfig_fromstr (optarg, config);
+			if ( config == NULL )
+				fatal ("Out of memory\n");
+			break;
+		case 'o':
+			origin = optarg;
+			break;
+		case 'N':
+			namedconf = optarg;
+			break;
+		case 'D':
+			dirname = optarg;
+			break;
+		case 'L':		/* error log file|directory */
+			logfile = optarg;
+			break;
+		case 'f':
+			force++;
+			break;
+		case 'H':
+		case 'h':
+			usage (NULL, config);
+			break;
+#if defined(BIND_VERSION) && BIND_VERSION >= 940
+		case 'd':
+# if BIND_VERSION >= 960
+			set_bind96_dynzone (dynamic_zone);
+# else
+			set_bind94_dynzone(dynamic_zone);
+# endif
+			/* dynamic zone requires a name server reload... */
+			reloadflag = 0;		/* ...but "rndc thaw" reloads the zone anyway */
+			break;
+#endif
+		case 'n':
+			noexec = 1;
+			break;
+		case 'r':
+			if ( !dynamic_zone )	/* dynamic zones don't need a rndc reload (see "-d" */
+				reloadflag = 1;
+			break;
+		case 'v':
+			verbose++;
+			break;
+		case '?':
+			if ( isprint (optopt) )
+				snprintf (errstr, sizeof(errstr),
+					"Unknown option \"-%c\".\n", optopt);
+			else
+				snprintf (errstr, sizeof (errstr),
+					"Unknown option char \\x%x.\n", optopt);
+			usage (errstr, config);
+			break;
+		default:
+			abort();
+		}
+	}
+	dbg_line();
+
+	/* store some of the commandline parameter in the config structure */
+	setconfigpar (config, "--view", viewname);
+	setconfigpar (config, "-v", &verbose);
+	setconfigpar (config, "--noexec", &noexec);
+	if ( logfile == NULL )
+		logfile = config->logfile;
+
+	if ( lg_open (progname, config->syslogfacility, config->sysloglevel, config->zonedir, logfile, config->loglevel) < -1 )
+		fatal ("Couldn't open logfile %s in dir %s\n", logfile, config->zonedir);
+
+#if defined(DBG) && DBG
+	for ( zp = zonelist; zp; zp = zp->next )
+		zone_print ("in main: ", zp);
+#endif
+	lg_args (LG_NOTICE, argc, argv);
+
+	if ( origin )		/* option -o ? */
+	{
+		int	ret;
+
+		if ( (argc - optind) <= 0 )	/* no arguments left ? */
+			ret = zone_readdir (".", origin, NULL, &zonelist, config, dynamic_zone);
+		else
+			ret = zone_readdir (".", origin, argv[optind], &zonelist, config, dynamic_zone);
+
+		/* anyway, "delete" all (remaining) arguments */
+		optind = argc;
+
+		/* complain if nothing could read in */
+		if ( ret != 1 || zonelist == NULL )
+		{
+			lg_mesg (LG_FATAL, "\"%s\": couldn't read", origin);
+			fatal ("Couldn't read zone \"%s\"\n", origin);
+		}
+	}
+	if ( namedconf )	/* option -N ? */
+	{
+		char	dir[255+1];
+
+		memset (dir, '\0', sizeof (dir));
+		if ( config->zonedir )
+			strncpy (dir, config->zonedir, sizeof(dir));
+		if ( !parse_namedconf (namedconf, config->chroot_dir, dir, sizeof (dir), add2zonelist) )
+			fatal ("Can't read file %s as namedconf file\n", namedconf);
+		if ( zonelist == NULL )
+			fatal ("No signed zone found in file %s\n", namedconf);
+	}
+	if ( dirname )		/* option -D ? */
+	{
+		char	*dir = strdup (dirname);
+
+		p = dir + strlen (dir);
+		if ( p > dir )
+			p--;
+		if ( *p == '/' )
+			*p = '\0';	/* remove trailing path seperator */
+
+		if ( !parsedir (dir, &zonelist, config) )
+			fatal ("Can't read directory tree %s\n", dir);
+		if ( zonelist == NULL )
+			fatal ("No signed zone found in directory tree %s\n", dir);
+		free (dir);
+	}
+
+	/* none of the above: read current directory tree */
+	if ( zonelist == NULL )
+		parsedir (config->zonedir, &zonelist, config);
+
+	for ( zp = zonelist; zp; zp = zp->next )
+		if ( in_strarr (zp->zone, &argv[optind], argc - optind) )
+		{
+			dosigning (zonelist, zp);
+			verbmesg (1, zp->conf, "\n");
+		}
+
+	zone_freelist (&zonelist);
+
+	errcnt = lg_geterrcnt ();
+	lg_mesg (LG_NOTICE, "end of run: %d error%s occured", errcnt, errcnt == 1 ? "" : "s");
+	lg_close ();
+
+	return errcnt < 64 ? errcnt : 64;
+}
+
+# define	sopt_usage(mesg, value) fprintf (stderr, mesg, value)
+#if defined(HAVE_GETOPT_LONG) && HAVE_GETOPT_LONG
+# define	lopt_usage(mesg, value) fprintf (stderr, mesg, value)
+# define	loptstr(lstr, sstr)     lstr
+#else
+# define	lopt_usage(mesg, value)
+# define	loptstr(lstr, sstr)     sstr
+#endif
+static	void	usage (char *mesg, zconf_t *conf)
+{
+	fprintf (stderr, "%s version %s\n", progname, ZKT_VERSION);
+	fprintf (stderr, "\n");
+
+	fprintf (stderr, "usage: %s [-c file] [-O optstr] ", progname);
+	fprintf (stderr, "[-D directorytree] ");
+	fprintf (stderr, "[-fhnr] [-v [-v]] [zone ...]\n");
+
+	fprintf (stderr, "usage: %s [-c file] [-O optstr] ", progname);
+	fprintf (stderr, "-N named.conf ");
+	fprintf (stderr, "[-fhnr] [-v [-v]] [zone ...]\n");
+
+	fprintf (stderr, "usage: %s [-c file] [-O optstr] ", progname);
+	fprintf (stderr, "-o origin ");
+	fprintf (stderr, "[-fhnr] [-v [-v]] [zonefile.signed]\n");
+
+	fprintf (stderr, "\t-c file%s", loptstr (", --config=file\n", ""));
+	fprintf (stderr, "\t\t read config from <file> instead of %s\n", CONFIG_FILE);
+	fprintf (stderr, "\t-O optstr%s", loptstr (", --config-option=\"optstr\"\n", ""));
+	fprintf (stderr, "\t\t set config options on the commandline\n");
+	fprintf (stderr, "\t-L file|dir%s", loptstr (", --logfile=file|dir\n", ""));
+	fprintf (stderr, "\t\t specify file or directory for the log output\n");
+	fprintf (stderr, "\t-D dir%s", loptstr (", --directory=dir\n", ""));
+	fprintf (stderr, "\t\t parse the given directory tree for a list of secure zones \n");
+	fprintf (stderr, "\t-N file%s", loptstr (", --named-conf=file\n", ""));
+	fprintf (stderr, "\t\t get the list of secure zones out of the named like config file \n");
+	fprintf (stderr, "\t-o zone%s", loptstr (", --origin=zone", ""));
+	fprintf (stderr, "\tspecify the name of the zone \n");
+	fprintf (stderr, "\t\t The file to sign should be given as an argument (default is \"%s.signed\")\n", conf->zonefile);
+	fprintf (stderr, "\t-h%s\t print this help\n", loptstr (", --help", "\t"));
+	fprintf (stderr, "\t-f%s\t force re-signing\n", loptstr (", --force", "\t"));
+	fprintf (stderr, "\t-n%s\t no execution of external signing command\n", loptstr (", --noexec", "\t"));
+	// fprintf (stderr, "\t-r%s\t reload zone via <rndc reload zone> (or via the external distribution command)\n", loptstr (", --reload", "\t"));
+	fprintf (stderr, "\t-r%s\t reload zone via %s\n", loptstr (", --reload", "\t"), conf->dist_cmd ? conf->dist_cmd: "rndc");
+        fprintf (stderr, "\t-v%s\t be verbose (use twice to be very verbose)\n", loptstr (", --verbose", "\t"));
+
+        fprintf (stderr, "\t[zone]\t sign only those zones given as argument\n");
+
+        fprintf (stderr, "\n");
+        fprintf (stderr, "\tif neither -D nor -N nor -o is given, the directory tree specified\n");
+	fprintf (stderr, "\tin the dnssec config file (\"%s\") will be parsed\n", conf->zonedir);
+
+	if ( mesg && *mesg )
+		fprintf (stderr, "%s\n", mesg);
+	exit (127);
+}
+
+/**	fill zonelist with infos coming out of named.conf	**/
+static	int	add2zonelist (const char *dir, const char *view, const char *zone, const char *file)
+{
+#ifdef DBG
+	fprintf (stderr, "printzone ");
+	fprintf (stderr, "view \"%s\" " , view);
+	fprintf (stderr, "zone \"%s\" " , zone);
+	fprintf (stderr, "file ");
+	if ( dir && *dir )
+		fprintf (stderr, "%s/", dir);
+	fprintf (stderr, "%s", file);
+	fprintf (stderr, "\n");
+#endif
+	dbg_line ();
+	if ( view[0] != '\0' )	/* view found in named.conf */
+	{
+		if ( viewname == NULL || viewname[0] == '\0' )	/* viewname wasn't set on startup ? */
+		{
+			dbg_line ();
+			error ("zone \"%s\" in view \"%s\" found in name server config, but no matching view was set on startup\n", zone, view);
+			lg_mesg (LG_ERROR, "\"%s\" in view \"%s\" found in name server config, but no matching view was set on startup", zone, view);
+			return 0;
+		}
+		dbg_line ();
+		if ( strcmp (viewname, view) != 0 )	/* zone is _not_ in current view */
+			return 0;
+	}
+	return zone_readdir (dir, zone, file, &zonelist, config, dynamic_zone);
+}
+
+static	int	parsedir (const char *dir, zone_t **zp, const zconf_t *conf)
+{
+	DIR	*dirp;
+	struct  dirent  *dentp;
+	char	path[MAX_PATHSIZE+1];
+
+	dbg_val ("parsedir: (%s)\n", dir);
+	if ( !is_directory (dir) )
+		return 0;
+
+	dbg_line ();
+	zone_readdir (dir, NULL, NULL, zp, conf, dynamic_zone);
+
+	dbg_val ("parsedir: opendir(%s)\n", dir);
+	if ( (dirp = opendir (dir)) == NULL )
+		return 0;
+
+	while ( (dentp = readdir (dirp)) != NULL )
+	{
+		if ( is_dotfilename (dentp->d_name) )
+			continue;
+
+		pathname (path, sizeof (path), dir, dentp->d_name, NULL);
+		if ( !is_directory (path) )
+			continue;
+
+		dbg_val ("parsedir: recursive %s\n", path);
+		parsedir (path, zp, conf);
+	}
+	closedir (dirp);
+	return 1;
+}
+
+static	int	dosigning (zone_t *zonelist, zone_t *zp)
+{
+	char	path[MAX_PATHSIZE+1];
+	int	err;
+	int	newkey;
+	int	newkeysetfile;
+	int	use_unixtime;
+	time_t	currtime;
+	time_t	zfile_time;
+	time_t	zfilesig_time;
+	char	mesg[255+1];
+
+	verbmesg (1, zp->conf, "parsing zone \"%s\" in dir \"%s\"\n", zp->zone, zp->dir);
+
+	pathname (path, sizeof (path), zp->dir, zp->sfile, NULL);
+	dbg_val("parsezonedir fileexist (%s)\n", path);
+	if ( !fileexist (path) )
+	{
+		error ("Not a secure zone directory (%s)!\n", zp->dir);
+		lg_mesg (LG_ERROR, "\"%s\": not a secure zone directory (%s)!", zp->zone, zp->dir);
+		return 1;
+	}
+	zfilesig_time = file_mtime (path);
+
+	pathname (path, sizeof (path), zp->dir, zp->file, NULL);
+	dbg_val("parsezonedir fileexist (%s)\n", path);
+	if ( !fileexist (path) )
+	{
+		error ("No zone file found (%s)!\n", path);
+		lg_mesg (LG_ERROR, "\"%s\": no zone file found (%s)!", zp->zone, path);
+		return 2;
+	}
+	
+	zfile_time = file_mtime (path);
+	currtime = time (NULL);
+
+	/* check rfc5011 key signing keys, create new one if necessary */
+	dbg_msg("parsezonedir check rfc 5011 ksk ");
+	newkey = ksk5011status (&zp->keys, zp->dir, zp->zone, zp->conf);
+	if ( (newkey & 02) != 02 )	/* not a rfc 5011 zone ? */
+	{
+		verbmesg (2, zp->conf, "\t\t->not a rfc5011 zone, looking for a regular ksk rollover\n");
+		/* check key signing keys, create new one if necessary */
+		dbg_msg("parsezonedir check ksk ");
+		newkey |= kskstatus (zonelist, zp);
+	}
+	else
+		newkey &= ~02;		/* reset bit 2 */
+
+	/* check age of zone keys, probably retire (depreciate) or remove old keys */
+	dbg_msg("parsezonedir check zsk ");
+	newkey += zskstatus (&zp->keys, zp->dir, zp->zone, zp->conf);
+
+	/* check age of "dnskey.db" file against age of keyfiles */
+	pathname (path, sizeof (path), zp->dir, zp->conf->keyfile, NULL);
+	dbg_val("parsezonedir check_keydb_timestamp (%s)\n", path);
+	if ( !newkey )
+		newkey = check_keydb_timestamp (zp->keys, file_mtime (path));
+
+	newkeysetfile = 0;
+#if defined(ALWAYS_CHECK_KEYSETFILES) && ALWAYS_CHECK_KEYSETFILES	/* patch from Shane Wegner 15. June 2009 */
+	/* check if there is a new keyset- file */
+	if ( !newkey )
+		newkeysetfile = new_keysetfiles (zp->dir, zfilesig_time);
+#else
+	/* if we work in subdir mode, check if there is a new keyset- file */
+	if ( !newkey && zp->conf->keysetdir && strcmp (zp->conf->keysetdir, "..") == 0 )
+		newkeysetfile = new_keysetfiles (zp->dir, zfilesig_time);
+#endif
+
+	/**
+	** Check if it is time to do a re-sign. This is the case if
+	**	a) the command line flag -f is set, or
+	**	b) new keys are generated, or
+	**	c) we found a new KSK of a delegated domain, or
+	**	d) the "dnskey.db" file is newer than "zone.db" 
+	**	e) the "zone.db" is newer than "zone.db.signed" or
+	**	f) "zone.db.signed" is older than the re-sign interval
+	**/
+	mesg[0] = '\0';
+	if ( force )
+		snprintf (mesg, sizeof(mesg), "Option -f"); 
+	else if ( newkey )
+		snprintf (mesg, sizeof(mesg), "Modfied zone key set"); 
+	else if ( newkeysetfile )
+		snprintf (mesg, sizeof(mesg), "Modified KSK in delegated domain"); 
+	else if ( file_mtime (path) > zfilesig_time )
+		snprintf (mesg, sizeof(mesg), "Modified keys");
+	else if ( zfile_time > zfilesig_time )
+		snprintf (mesg, sizeof(mesg), "Zone file edited");
+	else if ( (currtime - zfilesig_time) > zp->conf->resign - (OFFSET) )
+		snprintf (mesg, sizeof(mesg), "re-signing interval (%s) reached",
+						str_delspace (age2str (zp->conf->resign)));
+	else if ( bind94_dynzone (dynamic_zone) )
+		snprintf (mesg, sizeof(mesg), "dynamic zone");
+
+	if ( *mesg )
+		verbmesg (1, zp->conf, "\tRe-signing necessary: %s\n", mesg);
+	else
+		verbmesg (1, zp->conf, "\tRe-signing not necessary!\n");
+
+	if ( *mesg )
+		lg_mesg (LG_NOTICE, "\"%s\": re-signing triggered: %s", zp->zone,  mesg);
+
+	dbg_line ();
+	if ( !(force || newkey || newkeysetfile || zfile_time > zfilesig_time ||	
+	     file_mtime (path) > zfilesig_time ||
+	     (currtime - zfilesig_time) > zp->conf->resign - (OFFSET) ||
+	      bind94_dynzone (dynamic_zone)) )
+	{
+		verbmesg (2, zp->conf, "\tCheck if there is a parent file to copy\n");
+		if ( zp->conf->keysetdir && strcmp (zp->conf->keysetdir, "..") == 0 )
+			copy_keyset (zp->dir, zp->zone, zp->conf);	/* copy the parent- file if it exist */
+		return 0;	/* nothing to do */
+	}
+
+	/* let's start signing the zone */
+	dbg_line ();
+
+	/* create new "dnskey.db" file  */
+	pathname (path, sizeof (path), zp->dir, zp->conf->keyfile, NULL);
+	verbmesg (1, zp->conf, "\tWriting key file \"%s\"\n", path);
+	if ( !writekeyfile (path, zp->keys, zp->conf->key_ttl) )
+	{
+		error ("Can't create keyfile %s \n", path);
+		lg_mesg (LG_ERROR, "\"%s\": can't create keyfile %s", zp->zone , path);
+	}
+
+	err = 1;
+	use_unixtime = ( zp->conf->serialform == Unixtime );
+	dbg_val1 ("Use unixtime = %d\n", use_unixtime);
+#if defined(BIND_VERSION) && BIND_VERSION >= 940
+	if ( !dynamic_zone && !use_unixtime ) /* increment serial number in static zone files */
+#else
+	if ( !dynamic_zone ) /* increment serial no in static zone files */
+#endif
+	{
+		pathname (path, sizeof (path), zp->dir, zp->file, NULL);
+		err = 0;
+		if ( noexec == 0 )
+		{
+			if ( (err = inc_serial (path, use_unixtime)) < 0 )
+			{
+				error ("could not increment serialno of domain %s in file %s: %s!\n",
+								zp->zone, path, inc_errstr (err));
+				lg_mesg (LG_ERROR,
+					"zone \"%s\": couldn't increment serialno in file %s: %s",
+							zp->zone, path, inc_errstr (err));
+			}
+			else 
+			verbmesg (1, zp->conf, "\tIncrementing serial number in file \"%s\"\n", path);
+		}
+		else 
+			verbmesg (1, zp->conf, "\tIncrementing serial number in file \"%s\"\n", path);
+	}
+
+	/* at last, sign the zone file */
+	if ( err > 0 )
+	{
+		time_t	timer;
+
+		verbmesg (1, zp->conf, "\tSigning zone \"%s\"\n", zp->zone);
+		logflush ();
+
+		/* dynamic zones uses incremental signing, so we have to */
+		/* prepare the old (signed) file as new input file */
+		if ( dynamic_zone )
+		{
+			char	zfile[MAX_PATHSIZE+1];
+
+			dyn_update_freeze (zp->zone, zp->conf, 1);	/* freeze dynamic zone ! */
+
+			pathname (zfile, sizeof (zfile), zp->dir, zp->file, NULL);
+			pathname (path, sizeof (path), zp->dir, zp->sfile, NULL);
+			if ( filesize (path) == 0L )    /* initial signing request ? */
+			{
+				verbmesg (1, zp->conf, "\tDynamic Zone signing: Initial signing request: Add DNSKEYs to zonefile\n");
+				copyfile (zfile, path, zp->conf->keyfile);
+			}
+#if 1
+			else if ( zfile_time > zfilesig_time )  /* zone.db is newer than signed file */
+			{
+				verbmesg (1, zp->conf, "\tDynamic Zone signing: zone file manually edited: Use it as new input file\n");
+				copyfile (zfile, path, NULL);
+			}
+#endif
+			verbmesg (1, zp->conf, "\tDynamic Zone signing: copy old signed zone file %s to new input file %s\n",
+										path, zfile); 
+
+			if ( newkey )	/* if we have new keys, they should be added to the zone file */
+				copyzonefile (path, zfile, zp->conf->keyfile);
+			else		/* else we can do a simple file copy */
+				copyfile (path, zfile, NULL);
+		}
+
+		timer = start_timer ();
+		if ( (err = sign_zone (zp->dir, zp->zone, zp->file, zp->conf)) < 0 )
+		{
+			error ("\tSigning of zone %s failed (%d)!\n", zp->zone, err);
+			lg_mesg (LG_ERROR, "\"%s\": signing failed!", zp->zone);
+		}
+		timer = stop_timer (timer);
+
+		if ( dynamic_zone )
+			dyn_update_freeze (zp->zone, zp->conf, 0);	/* thaw dynamic zone file */
+
+		if ( err >= 0 )
+		{
+		const	char	*tstr = str_delspace (age2str (timer));
+
+		if ( !tstr || *tstr == '\0' )
+			tstr = "0s";
+		verbmesg (1, zp->conf, "\tSigning completed after %s.\n", tstr);
+		}
+	}
+
+	copy_keyset (zp->dir, zp->zone, zp->conf);
+
+	if ( err >= 0 && reloadflag )
+	{
+		if ( zp->conf->dist_cmd )
+			dist_and_reload (zp);
+		else
+			reload_zone (zp->zone, zp->conf);
+
+		register_key (zp->keys, zp->conf);
+	}
+
+	return err;
+}
+
+static	void	register_key (dki_t *list, const zconf_t *z)
+{
+	dki_t	*dkp;
+	time_t	currtime;
+	time_t	age;
+
+	assert ( list != NULL );
+	assert ( z != NULL );
+
+	currtime = time (NULL);
+	for ( dkp = list; dkp && dki_isksk (dkp); dkp = dkp->next )
+	{
+		age = dki_age (dkp, currtime);
+#if 0
+		/* announce "new" and active key signing keys */
+		if ( REG_URL && *REG_URL && dki_status (dkp) == DKI_ACT && age <= z->resign * 4 )
+		{
+			if ( verbose )
+				logmesg ("\tRegister new KSK with tag %d for domain %s\n",
+								dkp->tag, dkp->name);
+		}
+#endif
+	}
+}
+
+/*
+ *	This function is not working with symbolic links to keyset- files,
+ *	because file_mtime() returns the mtime of the underlying file, and *not*
+ *	that of the symlink file.
+ *	This is bad, because the keyset-file will be newly generated by dnssec-signzone
+ *	on every re-signing call.
+ *	Instead, in the case of a hierarchical directory structure, we copy the file
+ *	(and so we change the timestamp) only if it was modified after the last
+ *	generation (checked with cmpfile(), see func sign_zone()).
+ */
+# define	KEYSET_FILE_PFX	"keyset-"
+static	int	new_keysetfiles (const char *dir, time_t zone_signing_time)
+{
+	DIR	*dirp;
+	struct  dirent  *dentp;
+	char	path[MAX_PATHSIZE+1];
+	int	newkeysetfile;
+
+	if ( (dirp = opendir (dir)) == NULL )
+		return 0;
+
+	newkeysetfile = 0;
+	dbg_val2 ("new_keysetfile (%s, %s)\n", dir, time2str (zone_signing_time, 's')); 
+	while ( !newkeysetfile && (dentp = readdir (dirp)) != NULL )
+	{
+		if ( strncmp (dentp->d_name, KEYSET_FILE_PFX, strlen (KEYSET_FILE_PFX)) != 0 )
+			continue;
+
+		pathname (path, sizeof (path), dir, dentp->d_name, NULL);
+		dbg_val2 ("newkeysetfile timestamp of %s = %s\n", path, time2str (file_mtime(path), 's')); 
+		if ( file_mtime (path) > zone_signing_time )
+			newkeysetfile = 1;
+	}
+	closedir (dirp);
+
+	return newkeysetfile;
+}
+
+static	int	check_keydb_timestamp (dki_t *keylist, time_t reftime)
+{
+	dki_t	*key;
+
+	assert ( keylist != NULL );
+	if ( reftime == 0 )
+		return 1;
+
+	for ( key = keylist; key; key = key->next )
+		if ( dki_time (key) > reftime )
+			return 1;
+
+	return 0;
+}
+
+static	int	writekeyfile (const char *fname, const dki_t *list, int key_ttl)
+{
+	FILE	*fp;
+	const	dki_t	*dkp;
+	time_t	curr = time (NULL);
+	int	ksk;
+
+	if ( (fp = fopen (fname, "w")) == NULL )
+		return 0;
+	fprintf (fp, ";\n");
+	fprintf (fp, ";\t!!! Don\'t edit this file by hand.\n");
+	fprintf (fp, ";\t!!! It will be generated by %s.\n", progname);
+	fprintf (fp, ";\n");
+	fprintf (fp, ";\t Last generation time %s\n", time2str (curr, 's'));
+	fprintf (fp, ";\n");
+
+	fprintf (fp, "\n");
+	fprintf (fp, ";  ***  List of Key Signing Keys  ***\n");
+	ksk = 1;
+	for ( dkp = list; dkp; dkp = dkp->next )
+	{
+		if ( ksk && !dki_isksk (dkp) )
+		{
+			fprintf (fp, "; ***  List of Zone Signing Keys  ***\n");
+			ksk = 0;
+		}
+		dki_prt_comment (dkp, fp);
+		dki_prt_dnskeyttl (dkp, fp, key_ttl);
+		putc ('\n', fp);
+	}
+	
+	fclose (fp);
+	return 1;
+}
+
+static	int	sign_zone (const char *dir, const char *domain, const char *file, const zconf_t *conf)
+{
+	char	cmd[2047+1];
+	char	str[1023+1];
+	char	rparam[254+1];
+	char	nsec3param[637+1];
+	char	keysetdir[254+1];
+	const	char	*gends;
+	const	char	*pseudo;
+	const	char	*param;
+	int	len;
+	FILE	*fp;
+
+	assert (conf != NULL);
+	assert (domain != NULL);
+
+	len = 0;
+	str[0] = '\0';
+	if ( conf->lookaside && conf->lookaside[0] )
+		len = snprintf (str, sizeof (str), "-l %.250s", conf->lookaside);
+
+	dbg_line();
+#if defined(BIND_VERSION) && BIND_VERSION >= 940
+	if ( !dynamic_zone && conf->serialform == Unixtime )
+		snprintf (str+len, sizeof (str) - len, " -N unixtime");
+#endif
+
+	gends = "";
+	if ( conf->sig_gends )
+		gends = "-g ";
+
+	pseudo = "";
+	if ( conf->sig_pseudo )
+		pseudo = "-p ";
+
+	param = "";
+	if ( conf->sig_param && conf->sig_param[0] )
+		param = conf->sig_param;
+
+	nsec3param[0] = '\0';
+#if defined(BIND_VERSION) && BIND_VERSION >= 960
+	if ( conf->k_algo == DK_ALGO_NSEC3DSA || conf->k_algo == DK_ALGO_NSEC3RSASHA1 )
+	{
+		char	salt[510+1];	/* salt has a maximum of 255 bytes == 510 hex nibbles */
+
+		if ( gensalt (salt, sizeof (salt), conf->saltbits) )
+			snprintf (nsec3param, sizeof (nsec3param), "-3 %s ", salt);
+	}
+#endif
+
+	dbg_line();
+	rparam[0] = '\0';
+	if ( conf->sig_random && conf->sig_random[0] )
+		snprintf (rparam, sizeof (rparam), "-r %.250s ", conf->sig_random);
+
+	dbg_line();
+	keysetdir[0] = '\0';
+	if ( conf->keysetdir && conf->keysetdir[0] && strcmp (conf->keysetdir, "..") != 0 )
+		snprintf (keysetdir, sizeof (keysetdir), "-d %.250s ", conf->keysetdir);
+
+	if ( dir == NULL || *dir == '\0' )
+		dir = ".";
+
+	dbg_line();
+#if defined(BIND_VERSION) && BIND_VERSION >= 940
+	if ( dynamic_zone )
+		snprintf (cmd, sizeof (cmd), "cd %s; %s %s %s%s%s%s%s-o %s -e +%ld %s -N increment -f %s.dsigned %s K*.private 2>&1",
+			dir, SIGNCMD, param, nsec3param, gends, pseudo, rparam, keysetdir, domain, conf->sigvalidity, str, file, file);
+	else
+#endif
+		snprintf (cmd, sizeof (cmd), "cd %s; %s %s %s%s%s%s%s-o %s -e +%ld %s %s K*.private 2>&1",
+			dir, SIGNCMD, param, nsec3param, gends, pseudo, rparam, keysetdir, domain, conf->sigvalidity, str, file);
+	verbmesg (2, conf, "\t  Run cmd \"%s\"\n", cmd);
+	*str = '\0';
+	if ( noexec == 0 )
+	{
+#if 0
+		if ( (fp = popen (cmd, "r")) == NULL || fgets (str, sizeof str, fp) == NULL )
+			return -1;
+#else
+		if ( (fp = popen (cmd, "r")) == NULL )
+			return -1;
+		str[0] = '\0';
+		while ( fgets (str, sizeof str, fp) != NULL )	/* eat up all output until the last line */
+			;
+#endif
+		pclose (fp);
+	}
+
+	dbg_line();
+	verbmesg (2, conf, "\t  Cmd dnssec-signzone return: \"%s\"\n", str_chop (str, '\n'));
+	len = strlen (str) - 6;
+	if ( len < 0 || strcmp (str+len, "signed") != 0 )
+		return -1;
+
+	return 0;
+}
+
+static	void	copy_keyset (const char *dir, const char *domain, const zconf_t *conf)
+{
+	char	fromfile[1024];
+	char	tofile[1024];
+	int	ret;
+
+	/* propagate "keyset"-file to parent dir */
+	if ( conf->keysetdir && strcmp (conf->keysetdir, "..") == 0 )
+	{
+		/* check if special parent-file exist (ksk rollover) */
+		snprintf (fromfile, sizeof (fromfile), "%s/parent-%s", dir, domain);
+		if ( !fileexist (fromfile) )	/* use "normal" keyset-file */
+			snprintf (fromfile, sizeof (fromfile), "%s/keyset-%s", dir, domain);
+
+		/* verbmesg (2, conf, "\t  check \"%s\" against parent dir\n", fromfile); */
+		snprintf (tofile, sizeof (tofile), "%s/../keyset-%s", dir, domain);
+		if ( cmpfile (fromfile, tofile) != 0 )
+		{
+			verbmesg (2, conf, "\t  copy \"%s\" to parent dir\n", fromfile);
+			if ( (ret = copyfile (fromfile, tofile, NULL)) != 0 )
+			{
+				error ("Couldn't copy \"%s\" to parent dir (%d:%s)\n",
+					fromfile, ret, strerror(errno));
+				lg_mesg (LG_ERROR, "\%s\": can't copy \"%s\" to parent dir (%d:%s)",
+					domain, fromfile, ret, strerror(errno));
+			}
+		}
+	}
+}
@@ -307,7 +307,6 @@ int	main (int argc, char *argv[])
 	/* it's better to do this before we read the whole directory tree */
 	if ( action == 'Z' )
 	{
-		fprintf (stderr, "The use of -Z is deprecated. Please use zkt-conf instead\n");
 		printconfig ("stdout", config);
 		return 0;
 	}
@@ -759,7 +758,7 @@ static	int	parsedirectory (const char *dir, dki_t **listp)
 			{
 				// fprintf (stderr, "parsedir: tssearch (%d %s)\n", dkp, dkp->name);
 #if defined (USE_TREE) && USE_TREE
-				dki_tadd (listp, dkp, 1);
+				dki_tadd (listp, dkp);
 #else
 				dki_add (listp, dkp);
 #endif
@@ -781,7 +780,7 @@ static	void	parsefile (const char *file, dki_t **listp)
 	{
 		if ( (dkp = dki_read (path, file)) )	/* read DNS key file ... */
 #if defined (USE_TREE) && USE_TREE
-			dki_tadd (listp, dkp, 1);		/* ... and add to tree */
+			dki_tadd (listp, dkp);		/* ... and add to tree */
 #else
 			dki_add (listp, dkp);		/* ... and add to list */
 #endif
@@ -0,0 +1,304 @@
+%!PS-Adobe-3.0
+%%Creator: groff version 1.19.2
+%%CreationDate: Mon Jul 14 23:23:30 2008
+%%DocumentNeededResources: font Times-Bold
+%%+ font Times-Roman
+%%+ font Courier
+%%+ font Symbol
+%%DocumentSuppliedResources: procset grops 1.19 2
+%%Pages: 1
+%%PageOrder: Ascend
+%%DocumentMedia: Default 595 842 0 () ()
+%%Orientation: Portrait
+%%EndComments
+%%BeginDefaults
+%%PageMedia: Default
+%%EndDefaults
+%%BeginProlog
+%%BeginResource: procset grops 1.19 2
+%!PS-Adobe-3.0 Resource-ProcSet
+/setpacking where{
+pop
+currentpacking
+true setpacking
+}if
+/grops 120 dict dup begin
+/SC 32 def
+/A/show load def
+/B{0 SC 3 -1 roll widthshow}bind def
+/C{0 exch ashow}bind def
+/D{0 exch 0 SC 5 2 roll awidthshow}bind def
+/E{0 rmoveto show}bind def
+/F{0 rmoveto 0 SC 3 -1 roll widthshow}bind def
+/G{0 rmoveto 0 exch ashow}bind def
+/H{0 rmoveto 0 exch 0 SC 5 2 roll awidthshow}bind def
+/I{0 exch rmoveto show}bind def
+/J{0 exch rmoveto 0 SC 3 -1 roll widthshow}bind def
+/K{0 exch rmoveto 0 exch ashow}bind def
+/L{0 exch rmoveto 0 exch 0 SC 5 2 roll awidthshow}bind def
+/M{rmoveto show}bind def
+/N{rmoveto 0 SC 3 -1 roll widthshow}bind def
+/O{rmoveto 0 exch ashow}bind def
+/P{rmoveto 0 exch 0 SC 5 2 roll awidthshow}bind def
+/Q{moveto show}bind def
+/R{moveto 0 SC 3 -1 roll widthshow}bind def
+/S{moveto 0 exch ashow}bind def
+/T{moveto 0 exch 0 SC 5 2 roll awidthshow}bind def
+/SF{
+findfont exch
+[exch dup 0 exch 0 exch neg 0 0]makefont
+dup setfont
+[exch/setfont cvx]cvx bind def
+}bind def
+/MF{
+findfont
+[5 2 roll
+0 3 1 roll
+neg 0 0]makefont
+dup setfont
+[exch/setfont cvx]cvx bind def
+}bind def
+/level0 0 def
+/RES 0 def
+/PL 0 def
+/LS 0 def
+/MANUAL{
+statusdict begin/manualfeed true store end
+}bind def
+/PLG{
+gsave newpath clippath pathbbox grestore
+exch pop add exch pop
+}bind def
+/BP{
+/level0 save def
+1 setlinecap
+1 setlinejoin
+72 RES div dup scale
+LS{
+90 rotate
+}{
+0 PL translate
+}ifelse
+1 -1 scale
+}bind def
+/EP{
+level0 restore
+showpage
+}def
+/DA{
+newpath arcn stroke
+}bind def
+/SN{
+transform
+.25 sub exch .25 sub exch
+round .25 add exch round .25 add exch
+itransform
+}bind def
+/DL{
+SN
+moveto
+SN
+lineto stroke
+}bind def
+/DC{
+newpath 0 360 arc closepath
+}bind def
+/TM matrix def
+/DE{
+TM currentmatrix pop
+translate scale newpath 0 0 .5 0 360 arc closepath
+TM setmatrix
+}bind def
+/RC/rcurveto load def
+/RL/rlineto load def
+/ST/stroke load def
+/MT/moveto load def
+/CL/closepath load def
+/Fr{
+setrgbcolor fill
+}bind def
+/setcmykcolor where{
+pop
+/Fk{
+setcmykcolor fill
+}bind def
+}if
+/Fg{
+setgray fill
+}bind def
+/FL/fill load def
+/LW/setlinewidth load def
+/Cr/setrgbcolor load def
+/setcmykcolor where{
+pop
+/Ck/setcmykcolor load def
+}if
+/Cg/setgray load def
+/RE{
+findfont
+dup maxlength 1 index/FontName known not{1 add}if dict begin
+{
+1 index/FID ne{def}{pop pop}ifelse
+}forall
+/Encoding exch def
+dup/FontName exch def
+currentdict end definefont pop
+}bind def
+/DEFS 0 def
+/EBEGIN{
+moveto
+DEFS begin
+}bind def
+/EEND/end load def
+/CNT 0 def
+/level1 0 def
+/PBEGIN{
+/level1 save def
+translate
+div 3 1 roll div exch scale
+neg exch neg exch translate
+0 setgray
+0 setlinecap
+1 setlinewidth
+0 setlinejoin
+10 setmiterlimit
+[]0 setdash
+/setstrokeadjust where{
+pop
+false setstrokeadjust
+}if
+/setoverprint where{
+pop
+false setoverprint
+}if
+newpath
+/CNT countdictstack def
+userdict begin
+/showpage{}def
+/setpagedevice{}def
+}bind def
+/PEND{
+countdictstack CNT sub{end}repeat
+level1 restore
+}bind def
+end def
+/setpacking where{
+pop
+setpacking
+}if
+%%EndResource
+%%EndProlog
+%%BeginSetup
+%%BeginFeature: *PageSize Default
+<< /PageSize [ 595 842 ] /ImagingBBox null >> setpagedevice
+%%EndFeature
+%%IncludeResource: font Times-Bold
+%%IncludeResource: font Times-Roman
+%%IncludeResource: font Courier
+%%IncludeResource: font Symbol
+grops begin/DEFS 1 dict def DEFS begin/u{.001 mul}bind def end/RES 72
+def/PL 841.89 def/LS false def/ENC0[/asciicircum/asciitilde/Scaron
+/Zcaron/scaron/zcaron/Ydieresis/trademark/quotesingle/Euro/.notdef
+/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef
+/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef/.notdef
+/.notdef/.notdef/.notdef/space/exclam/quotedbl/numbersign/dollar/percent
+/ampersand/quoteright/parenleft/parenright/asterisk/plus/comma/hyphen
+/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon
+/semicolon/less/equal/greater/question/at/A/B/C/D/E/F/G/H/I/J/K/L/M/N/O
+/P/Q/R/S/T/U/V/W/X/Y/Z/bracketleft/backslash/bracketright/circumflex
+/underscore/quoteleft/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y
+/z/braceleft/bar/braceright/tilde/.notdef/quotesinglbase/guillemotleft
+/guillemotright/bullet/florin/fraction/perthousand/dagger/daggerdbl
+/endash/emdash/ff/fi/fl/ffi/ffl/dotlessi/dotlessj/grave/hungarumlaut
+/dotaccent/breve/caron/ring/ogonek/quotedblleft/quotedblright/oe/lslash
+/quotedblbase/OE/Lslash/.notdef/exclamdown/cent/sterling/currency/yen
+/brokenbar/section/dieresis/copyright/ordfeminine/guilsinglleft
+/logicalnot/minus/registered/macron/degree/plusminus/twosuperior
+/threesuperior/acute/mu/paragraph/periodcentered/cedilla/onesuperior
+/ordmasculine/guilsinglright/onequarter/onehalf/threequarters
+/questiondown/Agrave/Aacute/Acircumflex/Atilde/Adieresis/Aring/AE
+/Ccedilla/Egrave/Eacute/Ecircumflex/Edieresis/Igrave/Iacute/Icircumflex
+/Idieresis/Eth/Ntilde/Ograve/Oacute/Ocircumflex/Otilde/Odieresis
+/multiply/Oslash/Ugrave/Uacute/Ucircumflex/Udieresis/Yacute/Thorn
+/germandbls/agrave/aacute/acircumflex/atilde/adieresis/aring/ae/ccedilla
+/egrave/eacute/ecircumflex/edieresis/igrave/iacute/icircumflex/idieresis
+/eth/ntilde/ograve/oacute/ocircumflex/otilde/odieresis/divide/oslash
+/ugrave/uacute/ucircumflex/udieresis/yacute/thorn/ydieresis]def
+/Courier@0 ENC0/Courier RE/Times-Roman@0 ENC0/Times-Roman RE
+/Times-Bold@0 ENC0/Times-Bold RE
+%%EndSetup
+%%Page: 1 1
+%%BeginPageSetup
+BP
+%%EndPageSetup
+/F0 10/Times-Bold@0 SF 2.5(1. DNS)72 84 R -.25(Ke)2.5 G 2.5(yS).25 G
+(tatus T)-2.5 E(ypes and Filenames)-.74 E -.25(Ke)189.22 105.6 S 63.235
+(yF).25 G 40.415(ilename used)-63.235 F -.25(fo)2.5 G 29.33(rd).25 G
+(nssec-zkt)-29.33 E -.74(Ty)168.35 117.6 S 12.5(pe Flags).74 F 23.57
+(public pri)16.95 F -.1(va)-.1 G 21.62(te signing?).1 F(label)40.72 E
+(Status)99.34 111.6 Q .4 LW 473.8 122.1 72 122.1 DL/F1 10/Times-Roman@0
+SF(acti)72 131.6 Q 70.67 -.15(ve Z)-.25 H 18.43(SK 256).15 F(.k)18.89 E
+26.69 -.15(ey .)-.1 H(pri).15 E -.25(va)-.25 G 46.605(te y).25 F/F2 10
+/Courier@0 SF(act ive)30.285 E F1 17.32(KSK 257)168.35 143.6 R(.k)18.89
+E 26.69 -.15(ey .)-.1 H(pri).15 E -.25(va)-.25 G 46.605(te y).25 F F2
+(act ive)30.285 E F1 54.96(published ZSK)72 158 R 16.39(256 .k)20.93 F
+26.69 -.15(ey .)-.1 H 34.985(published n).15 F F2(pub lished)30.285 E F1
+17.32(KSK 257)168.35 170 R(.k)18.89 E 26.69 -.15(ey .)-.1 H(pri).15 E
+-.25(va)-.25 G 46.605(te n).25 F F2(sta ndby)30.285 E F1
+(depreciated \(retired\))72 184.4 Q 18.43(ZSK 256)15 F(.k)18.89 E 26.69
+-.15(ey .)-.1 H 27.785(depreciated n).15 F F2(dep reciated)30.285 E F1
+(re)72 198.8 Q -.2(vo)-.25 G -.1(ke).2 G 64.69(dK).1 G 17.32(SK 385)
+-64.69 F(.k)18.89 E 26.69 -.15(ey .)-.1 H(pri).15 E -.25(va)-.25 G
+46.605(te y).25 F F2(rev oked)30.285 E F1(remo)72 213.2 Q -.15(ve)-.15 G
+61.66(dK).15 G 17.32(SK 257)-61.66 F(k*.k)18.89 E 16.69 -.15(ey k)-.1 H
+(*.pri).15 E -.25(va)-.25 G 36.605(te n).25 F F2(-)30.285 E F1 80.52
+(sep KSK)72 227.6 R 16.39(257 .k)19.82 F 26.69 -.15(ey -)-.1 H(n)75.695
+E F2(sep)30.285 E 394.3 96.1 394.3 230.1 DL 343.73 96.1 343.73 230.1 DL
+280.14 108.1 280.14 230.1 DL 234.56 96.1 234.56 230.1 DL 196.78 108.1
+196.78 230.1 DL 160.85 96.1 160.85 230.1 DL F0 2.5(2. K)72 257.6 R(ey r)
+-.25 E(ollo)-.18 E -.1(ve)-.1 G(r).1 E 2.5(2.1. Zone)72 285.2 R
+(signing k)2.5 E(ey r)-.1 E(ollo)-.18 E -.1(ve)-.1 G 2.5(r\().1 G(pr)
+-2.5 E(e-publish RFC4641\))-.18 E 57.47(action cr)75.34 306.8 R 27.035
+(eate change)-.18 F -.18(re)23.045 G(mo).18 E -.1(ve)-.1 G -.1(ke)72
+318.8 S 65.025(ys newk).1 F 24.395(ey sig)-.1 F -.1(ke)2.5 G 23.775(yo)
+.1 G(ld k)-23.775 E(ey)-.1 E 301.18 323.3 72 323.3 DL F1 23.62
+(zsk1 acti)72 332.8 R 12.8 -.15(ve a)-.25 H(cti).15 E 28.21 -.15(ve d)
+-.25 H(epreciated).15 E 62.1(zsk2 published)72 344.8 R(acti)15 E 35.41
+-.15(ve a)-.25 H(cti).15 E -.15(ve)-.25 G 12.5(RRSIG zsk1)72 360.4 R
+33.06(zsk1 zsk2)20.15 F(zsk2)42.76 E 262.41 297.3 262.41 362.9 DL 201.32
+297.3 201.32 362.9 DL 147.43 297.3 147.43 362.9 DL 108.95 309.3 108.95
+362.9 DL F0 2.5(2.2. K)72 390.4 R(ey signing k)-.25 E(ey r)-.1 E(ollo)
+-.18 E -.1(ve)-.1 G 2.5(r\().1 G(double signatur)-2.5 E 2.5(eR)-.18 G
+(FC4641\))-2.5 E 58.165(action cr)118.39 412 R 26.63(eate change)-.18 F
+-.18(re)21.945 G(mo).18 E -.1(ve)-.1 G -.1(ke)72 424 S 108.77(ys newk).1
+F 16.58(ey delegation)-.1 F(old k)15.265 E(ey)-.1 E 343.42 428.5 72
+428.5 DL F1(ksk)72 438 Q(1)5 I(acti)68.61 -5 M 12.8 -.15(ve a)-.25 H
+(cti).15 E 29.6 -.15(ve a)-.25 H(cti).15 E -.15(ve)-.25 G(ksk)72 450 Q
+(2)5 I(acti)107.09 -5 M 29.6 -.15(ve a)-.25 H(cti).15 E 33.21 -.15(ve a)
+-.25 H(cti).15 E -.15(ve)-.25 G(DNSKEY RRSIG)72 465.6 Q 17.09
+(ksk1 ksk1,ksk2)15 F 16.11(ksk1,ksk2 ksk2)15 F(DS at parent)72 481.2 Q
+(DS)37.51 E(1)5 I(DS)20.7 -5 M(1)5 I(DS)37.5 -5 M(2)5 I(DS)41.11 -5 M(2)
+5 I 304.65 402.5 304.65 483.7 DL 245.76 402.5 245.76 483.7 DL 190.48
+402.5 190.48 483.7 DL 152 414.5 152 483.7 DL F0 2.5(2.3. K)72 511.2 R
+(ey signing k)-.25 E(ey r)-.1 E(ollo)-.18 E -.1(ve)-.1 G 2.5(r\().1 G
+(rfc5011\))-2.5 E 63.465(action newk)118.39 532.8 R 19.855(ey change)-.1
+F(delegation)2.5 E -.1(ke)72 544.8 S 112.32(ys &).1 F -.18(ro)2.5 G(llo)
+.18 E -.1(ve)-.1 G 15.525(r&).1 G -.18(re)-13.025 G(mo).18 E .2 -.1
+(ve o)-.1 H(ld k).1 E(ey)-.1 E 341.33 549.3 72 549.3 DL F1(ksk)72 558.8
+Q(1)5 I(acti)68.61 -5 M 20.43 -.15(ve r)-.25 H -2.2 -.25(ev o).15 H -.1
+(ke).25 G<87>.1 -2.4 M(ksk)72 570.8 Q(2)5 I 12.5(standby acti)68.61 -5 N
+33.65 -.15(ve a)-.25 H(cti).15 E -.15(ve)-.25 G(ksk)72 582.8 Q(3)5 I
+(standby)114.72 -5 M<88>-2.4 I(standby)23.22 2.4 M(DNSKEY RRSIG)72 598.4
+Q 24.72(ksk1 ksk1,ksk2)15 F(ksk2)19.05 E -.15(Pa)72 614 S(rent DS).15 E
+(DS)46.82 E(1)5 I(DS)28.33 -5 M(1)5 I(DS)41.55 -5 M(2)5 I(DS)159.5 626 Q
+(2)5 I(DS)28.33 -5 M(2)5 I(DS)41.55 -5 M(3)5 I 257.44 523.3 257.44 628.5
+DL 198.11 523.3 198.11 628.5 DL 152 535.3 152 628.5 DL<87>72 645.2 Q(Ha)
+2.5 2.4 M .3 -.15(ve t)-.2 H 2.5(or).15 G(emain until the remo)-2.5 E .3
+-.15(ve h)-.15 H(old-do).15 E(wn time is e)-.25 E
+(xpired, which is 30days at a minimum.)-.15 E<88>72 660.8 Q -.4(Wi)2.5
+2.4 O(ll be the standby k).4 E .3 -.15(ey a)-.1 H(fter the hold-do).15 E
+(wn time is e)-.25 E(xpired)-.15 E(Add holdtime)72 675.2 Q/F3 10/Symbol
+SF(=)2.5 E F1(max\(30days, TTL of DNSKEY\))2.5 E 0 Cg EP
+%%Trailer
+end
+%%EOF
@@ -0,0 +1,616 @@
+
+
+
+Intended Status: Informational                            O. Gudmundsson
+Network Working Group                                OGUD Consulting LLC
+Internet-Draft                                                  J. Ihren
+Expires: August 21, 2008                                             AAB
+                                                       February 18, 2008
+
+
+                Names of States in the life of a DNSKEY
+                  draft-gudmundsson-life-of-dnskey-00
+
+Status of this Memo
+
+   By submitting this Internet-Draft, each author represents that any
+   applicable patent or other IPR claims of which he or she is aware
+   have been or will be disclosed, and any of which he or she becomes
+   aware will be disclosed, in accordance with Section 6 of BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF), its areas, and its working groups.  Note that
+   other groups may also distribute working documents as Internet-
+   Drafts.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   The list of current Internet-Drafts can be accessed at
+   http://www.ietf.org/ietf/1id-abstracts.txt.
+
+   The list of Internet-Draft Shadow Directories can be accessed at
+   http://www.ietf.org/shadow.html.
+
+   This Internet-Draft will expire on August 21, 2008.
+
+Copyright Notice
+
+   Copyright (C) The IETF Trust (2008).
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 1]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+Abstract
+
+   This document recommends a specific terminology to use when
+   expressing the state that a DNSKEY is in at particular time.  This
+   does not affect how the protocol operates in any way.
+
+
+Table of Contents
+
+   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
+   2.  DNSKEY timeline  . . . . . . . . . . . . . . . . . . . . . . .  4
+   3.  Life stages of a DNSKEY  . . . . . . . . . . . . . . . . . . .  5
+     3.1.  Generated  . . . . . . . . . . . . . . . . . . . . . . . .  5
+     3.2.  Published  . . . . . . . . . . . . . . . . . . . . . . . .  5
+       3.2.1.  Pre-Publication  . . . . . . . . . . . . . . . . . . .  5
+       3.2.2.  Out-Of-Band Publication  . . . . . . . . . . . . . . .  5
+     3.3.  Active . . . . . . . . . . . . . . . . . . . . . . . . . .  5
+     3.4.  Retired  . . . . . . . . . . . . . . . . . . . . . . . . .  5
+     3.5.  Removed  . . . . . . . . . . . . . . . . . . . . . . . . .  6
+       3.5.1.  Lame . . . . . . . . . . . . . . . . . . . . . . . . .  6
+       3.5.2.  Stale  . . . . . . . . . . . . . . . . . . . . . . . .  6
+     3.6.  Revoked  . . . . . . . . . . . . . . . . . . . . . . . . .  6
+   4.  Security considerations  . . . . . . . . . . . . . . . . . . .  7
+   5.  IANA considerations  . . . . . . . . . . . . . . . . . . . . .  8
+   6.  References . . . . . . . . . . . . . . . . . . . . . . . . . .  9
+     6.1.  Normative References . . . . . . . . . . . . . . . . . . .  9
+     6.2.  Informative References . . . . . . . . . . . . . . . . . .  9
+   Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 10
+   Intellectual Property and Copyright Statements . . . . . . . . . . 11
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 2]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+1.  Introduction
+
+   When the editors of this document where comparing their DNSSEC key
+   management projects they discovered that they where discussing
+   roughly the same thing but using different terminology.
+
+   This document presents a unified terminology to use when describing
+   the current state of a DNSKEY.
+
+   The DNSSEC standards documents ([1], [2] and [3]) do not address the
+   required states for the key management of a DNSSEC key.  The DNSSEC
+   Operational Practices [4] document does propose that keys be
+   published before use but uses inconsistent or confusing terms.  This
+   document assumes basic understanding of DNSSEC and key management.
+
+   The terms proposed in this document attempt to avoid any confusion
+   and make the states of keys to be as clear as possible.  The terms
+   used in this document are intended as a operational supplement to the
+   terms defined in Section 2 of [1].
+
+   To large extent this discussion is motivated by Trust anchor keys but
+   the same terminology can be used for zone signing keys.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 3]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+2.  DNSKEY timeline
+
+   The model in this document is that keys progress through a state
+   machine along a one-way path, keys never move to an earlier states.
+
+
+
+   GENERATED----------> PUBLISHED ---> ACTIVE ---> RETIRED --> REMOVED
+    |                   ^       |        |            |         ^
+    |                   |       |        |            v         |
+    +--> Pre-PUBLISHED--+       +--------+---------> REVOKED ---+
+
+
+   DNSKEY time line.
+
+   There are few more states that are defined below but these apply only
+   to the publisher of TA's and the consumer of TA's.  Two of these are
+   sub-sets of the Published state, the other two are error states.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 4]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+3.  Life stages of a DNSKEY
+
+3.1.  Generated
+
+   Once a key is generated it enters state Generated and stays there
+   until the next state.  While in this state only the owner of the key
+   is aware of its existence and can prepare for its future use.
+
+3.2.  Published
+
+   Once the key is added to the DNSKEY set of a zone the key is there
+   for the world to see, or published.  The key needs to remain in this
+   state for some time to propagate to all validators that have cached
+   the prior version of the DNSKEY set.  In the case of KSK the key
+   should remain in this state for a longer time as documented in DNSSEC
+   Timers RFC [5].
+
+3.2.1.  Pre-Publication
+
+   In certain circumstances a zone owner may want to give out a new
+   Trust Anchor before exposing the actual public key.  In this case the
+   zone can publish a DS record of the key.  This allows others to
+   configure the trust anchor but will not be able to use the key until
+   the key is published in the DNSKEY RRset.
+
+3.2.2.  Out-Of-Band Publication
+
+   In certain circumstances a domain may want to give out a new Trust
+   Anchor outside DNS to give others a long lead time to configure the
+   new key as trust anchor.  The reason people may want to do this is to
+   keep the size of the DNSKEY set smaller and only add new trust anchor
+   just before the key goes into use.  One likely use for this is the
+   DNS "." root key as it does not have a parent that can publish a DS
+   record for it.  The publication mechanism does not matter it can be
+   any one of web-site, advertisement in Financial Times and other
+   international publication, e-mail to DNS related mailing lists, etc..
+
+3.3.  Active
+
+   The key is in ACTIVE state while it is actively signing data in the
+   zone it resides in.  It is one of the the keys that are signing the
+   zone or parts of the zone.
+
+3.4.  Retired
+
+   When the key is no longer used for signing the zone it enters state
+   Retired.  In this state there may still be signatures by the key in
+   cached data from the zone available at recursive servers, but the
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 5]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+   authoritative servers for the zone do no longer carry any signatures
+   generated by the key.
+
+3.5.  Removed
+
+   Once the key is removed from the DNSKEY RRset it enters the state
+   Removed.  At this point all signatures by the key that may still be
+   temporarily valid will fail to verify once the validator refreshes
+   the DNSKEY RRset in its memory.
+
+   Therefore "removal" of a key is typically not done until all the
+   cached signatures have expired.  Entering this state too early may
+   cause number of validators to end up with STALE Trust Anchors.
+
+3.5.1.  Lame
+
+   A Trust Anchor is Lame if the parent continues to publish DS pointing
+   to the key after it has been removed from the DNSKEY RRset.  A Trust
+   Anchor is arguably Lame if there are no signatures by a Retired KSK
+   in the zone.
+
+3.5.2.  Stale
+
+   A Stale Trust Anchor is an old TA that remains in a validators list
+   of active key(s) after the key has been removed from the zone's
+   DNSKEY RRset.
+
+3.6.  Revoked
+
+   There are times when a zone wants to signal that a particular key
+   should not be used at all.  The mechanism to do this is to set the
+   REVOKE bit [5].  Any key in any of the while the key is the DNSSKEY
+   set can be exited to Revoked state.  After some time in the Revoke
+   state the key will be Removed.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 6]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+4.  Security considerations
+
+   TBD
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 7]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+5.  IANA considerations
+
+   This document does not have any IANA actions.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 8]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+6.  References
+
+6.1.  Normative References
+
+6.2.  Informative References
+
+   [1]  Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
+        "DNS Security Introduction and Requirements", RFC 4033,
+        March 2005.
+
+   [2]  Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
+        "Resource Records for the DNS Security Extensions", RFC 4034,
+        March 2005.
+
+   [3]  Arends, R., Austein, R., Larson, M., Massey, D., and S. Rose,
+        "Protocol Modifications for the DNS Security Extensions",
+        RFC 4035, March 2005.
+
+   [4]  Kolkman, O. and R. Gieben, "DNSSEC Operational Practices",
+        RFC 4641, September 2006.
+
+   [5]  StJohns, M., "Automated Updates of DNS Security (DNSSEC) Trust
+        Anchors", RFC 5011, September 2007.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008                [Page 9]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+Authors' Addresses
+
+   Olafur Gudmundsson
+   OGUD Consulting LLC
+   3821 Village Park Drive
+   Chevy Chase, MD  20815
+   USA
+
+   Email: ogud@ogud.com
+
+
+   Johan Ihren
+   Automatica, AB
+   Bellmansgatan 30
+   Stockholm,   SE-118 47
+   Sweden
+
+   Email: johani@automatica.se
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008               [Page 10]
+
+Internet-Draft           DNSSEC Key life stages.           February 2008
+
+
+Full Copyright Statement
+
+   Copyright (C) The IETF Trust (2008).
+
+   This document is subject to the rights, licenses and restrictions
+   contained in BCP 78, and except as set forth therein, the authors
+   retain all their rights.
+
+   This document and the information contained herein are provided on an
+   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
+   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
+   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
+   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
+   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+
+Intellectual Property
+
+   The IETF takes no position regarding the validity or scope of any
+   Intellectual Property Rights or other rights that might be claimed to
+   pertain to the implementation or use of the technology described in
+   this document or the extent to which any license under such rights
+   might or might not be available; nor does it represent that it has
+   made any independent effort to identify any such rights.  Information
+   on the procedures with respect to rights in RFC documents can be
+   found in BCP 78 and BCP 79.
+
+   Copies of IPR disclosures made to the IETF Secretariat and any
+   assurances of licenses to be made available, or the result of an
+   attempt made to obtain a general license or permission for the use of
+   such proprietary rights by implementers or users of this
+   specification can be obtained from the IETF on-line IPR repository at
+   http://www.ietf.org/ipr.
+
+   The IETF invites any interested party to bring to its attention any
+   copyrights, patents or patent applications, or other proprietary
+   rights that may cover technology that may be required to implement
+   this standard.  Please address the information to the IETF at
+   ietf-ipr@ietf.org.
+
+
+Acknowledgment
+
+   Funding for the RFC Editor function is provided by the IETF
+   Administrative Support Activity (IASA).
+
+
+
+
+
+Gudmundsson & Ihren      Expires August 21, 2008               [Page 11]
+
@@ -3,7 +3,6 @@
 **	@(#) domaincmp.c -- compare two domain names
 **
 **	Copyright (c) Aug 2005, Karle Boss, Holger Zuleger (kaho).
-**	isparentdomain() (c) Mar 2010 by Holger Zuleger
 **	All rights reserved.
 **	
 **	This software is open source.
@@ -56,31 +55,13 @@
 **      thus domaincmp ("z.example.net", "example.net") return < 0 !!
 *****************************************************************/
 int     domaincmp (const char *a, const char *b)
-{
-	return domaincmp_dir (a, b, 1);
-}
-
-/*****************************************************************
-**      int domaincmp_dir (a, b, subdomain_above)
-**      compare a and b as fqdns.
-**      return <0 | 0 | >0 as in strcmp
-**      A subdomain is less than the corresponding parent domain,
-**      thus domaincmp ("z.example.net", "example.net") return < 0 !!
-*****************************************************************/
-int     domaincmp_dir (const char *a, const char *b, int subdomain_above)
 {
 	register const  char    *pa;
 	register const  char    *pb;
-	int	dir;

 	if ( a == NULL ) return -1;
 	if ( b == NULL ) return 1;

-	if ( subdomain_above )
-		dir = 1;
-	else
-		dir = -1;
-
 	if ( *a == '.' )	/* skip a leading dot */
 		a++;
 	if ( *b == '.' )	/* same at the other string */
@@ -116,12 +97,12 @@ int     domaincmp_dir (const char *a, const char *b, int subdomain_above)
 	{
 		if ( pa > a )
 			if ( pa[-1] == '.' )
-				return -1 * dir;
+				return -1;
 			else
 				goto_labelstart (a, pa);
 		else if ( pb > b )
 			if ( pb[-1] == '.' )
-				return 1 * dir;
+				return 1;
 			else
 				goto_labelstart (b, pb);
 		else
@@ -135,130 +116,6 @@ int     domaincmp_dir (const char *a, const char *b, int subdomain_above)
 	return *pa - *pb;
 }

-/*****************************************************************
-**
-**	int	issubdomain ("child", "parent")
-**
-**	"child" and "parent" are standardized domain names in such
-**	a way that even both domain names are ending with a dot,
-**	or none of them.
-**
-**	returns 1 if "child" is a subdomain of "parent"
-**	returns 0 if "child" is not a subdomain of "parent"
-**
-*****************************************************************/
-int	issubdomain (const char *child, const char *parent)
-{
-	const	char	*p;
-	const	char	*cdot;
-	const	char	*pdot;
-	int	ccnt;
-	int	pcnt;
-
-	if ( !child || !parent || *child == '\0' || *parent == '\0' )
-		return 0;
-
-	pdot = cdot = NULL;
-	pcnt = 0;
-	for ( p = parent; *p; p++ )
-		if ( *p == '.' )
-		{
-			if ( pcnt == 0 )
-				pdot = p;
-			pcnt++;
-		}
-
-	ccnt = 0;
-	for ( p = child; *p; p++ )
-		if ( *p == '.' )
-		{
-			if ( ccnt == 0 )
-				cdot = p;
-			ccnt++;
-		}
-	if ( ccnt == 0 )	/* child is not a fqdn or is not deep enough ? */
-		return 0;
-	if ( pcnt == 0 )	/* parent is not a fqdn ? */
-		return 0;
-
-	if ( pcnt >= ccnt )	/* parent has more levels than child ? */
-		return 0;
-
-	/* is child a (one level) subdomain of parent ? */
-	if ( strcmp (cdot+1, parent) == 0 )	/* the domains are equal ? */
-		return 1;
-
-	return 0;
-}
-
-/*****************************************************************
-**
-**	int	isparentdomain ("child", "parent", level)
-**
-**	"child" and "parent" are standardized domain names in such
-**	a way that even both domain names are ending with a dot,
-**	or none of them.
-**
-**	returns 1 if "child" is a subdomain of "parent"
-**	returns 0 if "child" is not a subdomain of "parent"
-**	returns -1 if "child" and "parent" are the same domain
-**
-*****************************************************************/
-int	isparentdomain (const char *child, const char *parent, int level)
-{
-	const	char	*p;
-	const	char	*cdot;
-	const	char	*pdot;
-	int	ccnt;
-	int	pcnt;
-
-	if ( !child || !parent || *child == '\0' || *parent == '\0' )
-		return 0;
-
-	pdot = cdot = NULL;
-	pcnt = 0;
-	for ( p = parent; *p; p++ )
-		if ( *p == '.' )
-		{
-			if ( pcnt == 0 )
-				pdot = p;
-			pcnt++;
-		}
-
-	ccnt = 0;
-	for ( p = child; *p; p++ )
-		if ( *p == '.' )
-		{
-			if ( ccnt == 0 )
-				cdot = p;
-			ccnt++;
-		}
-	if ( ccnt == 0 || ccnt < level )	/* child is not a fqdn or is not deep enough ? */
-		return 0;
-	if ( pcnt == 0 )	/* parent is not a fqdn ? */
-		return 0;
-
-	if ( pcnt > ccnt )	/* parent has more levels than child ? */
-		return 0;
-
-	if ( pcnt == ccnt )	/* both are at the same level ? */
-	{
-		/* let's check the domain part */
-		if ( strcmp (cdot, pdot) == 0 )	/* the domains are equal ? */
-			return -1;
-		return 0;
-	}
-
-	if ( pcnt > ccnt )	/* parent has more levels than child ? */
-		return 0;
-
-	/* is child a (one level) subdomain of parent ? */
-	if ( strcmp (cdot+1, parent) == 0 )	/* the domains are equal ? */
-		return 1;
-
-	return 0;
-}
-
 #ifdef DOMAINCMP_TEST
 static  struct {
         char    *a;
@@ -293,8 +150,6 @@ static  struct {
         { "example.de.",        "xy.example.de.",       1 },
         { "example.de.",        "ab.example.de.",       1 },
         { "example.de",        "ab.example.de",       1 },
-         { "xy.example.de.",        "example.de.",       -1 },
-         { "ab.example.de.",        "example.de.",       -1 },
         { "ab.example.de",        "example.de",       -1 },
         { "ab.mast.de",          "axt.de",             1 },
         { "ab.mast.de",          "obt.de",             -1 },
@@ -322,9 +177,7 @@ main (int argc, char *argv[])
 			c = '>'; 
 		else 
 			c = '='; 
-		printf ("%-20s %-20s ", ex[i].a, ex[i].b);
-		printf ("%3d  ", issubdomain (ex[i].a, ex[i].b));
-		printf ("\t==> 0 %c ", c);
+		printf ("%-20s %-20s ==> %c 0 ", ex[i].a, ex[i].b, c);
 		fflush (stdout);
 		res = domaincmp (ex[i].a, ex[i].b);
 		printf ("%3d  ", res);
@@ -37,7 +37,4 @@
 #ifndef DOMAINCMP_H
 # define DOMAINCMP_H
 extern	int	domaincmp (const char *a, const char *b);
-extern	int	domaincmp_dir (const char *a, const char *b, int subdomain_above);
-extern	int	isparentdomain (const char *child, const char *parent, int level);
-extern	int	issubdomain (const char *child, const char *parent);
 #endif
@@ -0,0 +1,12 @@
+#!/bin/sh
+#
+#	Shell script to start the dnssec-signer
+#	command out of the example directory
+#
+
+if test ! -f dnssec.conf
+then
+	echo Please start this skript out of the flat or hierarchical sub directory
+	exit 1
+fi
+ZKT_CONFFILE=`pwd`/dnssec.conf ../../dnssec-signer "$@"
@@ -0,0 +1,12 @@
+#!/bin/sh
+#
+#	Shell script to start the dnssec-zkt command
+#	out of the example directory
+#
+
+if test ! -f dnssec.conf
+then
+	echo Please start this skript out of the flat or hierarchical sub directory
+	exit 1
+fi
+ZKT_CONFFILE=`pwd`/dnssec.conf ../../dnssec-zkt "$@"
@@ -0,0 +1,70 @@
+#################################################################
+#
+#	@(#) dist.sh -- distribute and reload command for dnssec-signer
+#
+#	(c) Jul 2008 Holger Zuleger  hznet.de
+#
+#	This shell script will be run by dnssec-signer as a distribution
+#	and reload command if:
+#
+#		a) the dnssec.conf file parameter Distribute_Cmd: points
+#		   to this file
+#	and
+#		b) the user running the dnssec-signer command is not
+#		   root (uid==0)
+#	and
+#		c) the owner of this shell script is the same as the
+#		   running user and the access rights don't allow writing
+#		   for anyone except the owner
+#	or
+#		d) the group of this shell script is the same as the
+#		   running user and the access rights don't allow writing
+#		   for anyone except the group
+#
+#################################################################
+
+# set path to rndc and scp
+PATH="/bin:/usr/bin:/usr/local/sbin"
+
+# remote server and directory
+server=localhost	# fqdn of remote name server
+dir=/var/named		# zone directory on remote name server
+
+progname=$0
+usage()
+{
+	echo "usage: $progname distribute|reload <domain> <path_to_zonefile> [<viewname>]" 1>&2
+	test $# -gt 0 && echo $* 1>&2
+	exit 1
+}
+
+if test $# -lt 3
+then
+	usage
+fi
+action="$1"
+domain="$2"
+zonefile="$3"
+view=""
+test $# -gt 3 && view="$4"
+
+case $action in
+distribute)
+	if test -n "$view"
+	then
+		echo "scp $zonefile $server:$dir/$view/$domain/"
+		: scp $zonefile $server:$dir/$view/$domain/
+	else
+		echo "scp $zonefile $server:$dir/$domain/"
+		: scp $zonefile $server:$dir/$domain/
+	fi
+	;;
+reload)
+	echo "rndc $action $domain $view"
+	: rndc $action $domain $view
+	;;
+*)
+	usage "illegal action $action"
+	;;
+esac
+
@@ -0,0 +1,14 @@
+#!/bin/sh
+#
+#	Shell script to start the dnssec-signer
+#	command out of the example directory
+#
+
+chroot `pwd` ZKT_CONFFILE=`pwd`/dnssec.conf ../../dnssec-signer "$@"
+
+if test ! -f dnssec.conf
+then
+	echo Please start this skript out of the flat or hierarchical sub directory
+	exit 1
+fi
+ZKT_CONFFILE=`pwd`/dnssec.conf ../../dnssec-signer "$@"
@@ -0,0 +1,43 @@
+#   
+#   	@(#) dnssec.conf vT0.99a (c) Feb 2005 - Jul 2009 Holger Zuleger hznet.de
+#   
+
+#   dnssec-zkt options
+Zonedir:	"."
+Recursive:	True
+PrintTime:	False
+PrintAge:	True
+LeftJustify:	False
+
+#   zone specific values
+ResignInterval:	2d	# (172800 seconds)
+Sigvalidity:	6d	# (518400 seconds)
+Max_TTL:	8h	# (28800 seconds)
+Propagation:	5m	# (300 seconds)
+KEY_TTL:	1h	# (3600 seconds)
+Serialformat:	incremental
+
+#   signing key parameters
+Key_algo:	RSASHA1	# (Algorithm ID 5)
+KSK_lifetime:	60d	# (5184000 seconds)
+KSK_bits:	1300
+KSK_randfile:	"/dev/urandom"
+ZSK_lifetime:	2w	# (1209600 seconds)
+ZSK_bits:	512
+ZSK_randfile:	"/dev/urandom"
+SaltBits:	24
+
+#   dnssec-signer options
+LogFile:	"zkt.log"
+LogLevel:	DEBUG
+SyslogFacility:	USER
+SyslogLevel:	NOTICE
+VerboseLog:	2
+Keyfile:	"dnskey.db"
+Zonefile:	"zone.db"
+KeySetDir:	"../keysets"
+DLV_Domain:	""
+Sig_Pseudorand:	True
+Sig_GenerateDS:	True
+Sig_Parameter:	"-n 1"
+Distribute_Cmd:	"./dist.sh"
@@ -0,0 +1,3 @@
+;%	generationtime=20080609224426
+;%	lifetime=60d
+dyn.example.net. IN DNSKEY  257 3 3 CNtFdVrUUJ9MPDyzGoPm+tSKUgnX4bble5+VNGd4RjwWpEDj8RhEAhQ7 LybJzr0wtHXT2Q/KS55xARkUtcH2TVO/ayMupa30pM38rd8uF38sm+AB KLEvCbPjaLZyW+s10di8nLp1aAxKFFfAEfXkIhl3Wm5g9CvjrMlrxAOf Ny/jtz4v+asIr6/d992V80G9wMKMvTMQoCr4Sp9s2JubW79i4RBVWgHH JMmtyqq+SqEkPhZvsTuo2sXgIH9vRS3XgfkGtw/KyTUM29bhZ2eB+Ldq +bggp1gbBDiSsxZPjxciizI/mCzXWbq8BdfZ6LsddMjAolJwCtaPCD4e 4infmw+YSxjGau+YGgI0Cc0uItzQmNNpSoejM3IWGV+SN/YuPJIzw8wi xDfO6kCNiPsW45Fvq31148cAvUvwiqYPQ3fONeOTdQjsJWLLdLTApVEH 10kjAGfa30Tm92lQhhG5ovWrWCMbFlw4Lbvlon+X2snWPNut0a1Pz4Wd clDcmNU8dxi1lFvGbcJ0E4qBoJVBIzDh4HX1
@@ -0,0 +1,7 @@
+Private-key-format: v1.2
+Algorithm: 3 (DSA)
+Prime(p): 4bble5+VNGd4RjwWpEDj8RhEAhQ7LybJzr0wtHXT2Q/KS55xARkUtcH2TVO/ayMupa30pM38rd8uF38sm+ABKLEvCbPjaLZyW+s10di8nLp1aAxKFFfAEfXkIhl3Wm5g9CvjrMlrxAOfNy/jtz4v+asIr6/d992V80G9wMKMvTM=
+Subprime(q): 20V1WtRQn0w8PLMag+b61IpSCdc=
+Base(g): EKAq+EqfbNibm1u/YuEQVVoBxyTJrcqqvkqhJD4Wb7E7qNrF4CB/b0Ut14H5BrcPysk1DNvW4Wdngfi3avm4IKdYGwQ4krMWT48XIosyP5gs11m6vAXX2ei7HXTIwKJScArWjwg+HuIp35sPmEsYxmrvmBoCNAnNLiLc0JjTaUo=
+Private_value(x): xY/GSk3U4oHIsvUiAs/9/n+6ttk=
+Public_value(y): h6MzchYZX5I39i48kjPDzCLEN87qQI2I+xbjkW+rfXXjxwC9S/CKpg9Dd84145N1COwlYst0tMClUQfXSSMAZ9rfROb3aVCGEbmi9atYIxsWXDgtu+Wif5faydY8263RrU/PhZ1yUNyY1Tx3GLWUW8ZtwnQTioGglUEjMOHgdfU=
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: 1hmOomNafbJ3H76e8V4qmFvlFWQuIkM+jbh+s79ZpErpCR7wBS5TswdoTeglX9UjP0D6hLmHfTcsdHQLLeMidQ==
+PublicExponent: AQAAAAE=
+PrivateExponent: dAiTob6wk4h5l6frfh49NAzd3RBsVRxqqCsMao52fJvlK06wmOb9PkqOaEMTDroJEGgN6zD/sWcGPK7nYwDMHQ==
+Prime1: 731n5xPK9UQqQsQtattcC4MxtL6+OP1CyLy8e2tsd/8=
+Prime2: 5NwPUBy32o2zzpw4TDH3omB6yk0fmFItJx4ek3RaBYs=
+Exponent1: jzq6en2c8SwS5uQwY3/vFY549HMSTxP58kyS/GJ9hqE=
+Exponent2: y52KLCquniy3EwUypKRkPZPftjBoqZkXeQLXSk4b850=
+Coefficient: vHnxG4D4n+IKETXrutOFT+iREDDcfj6GpYubIP/goZc=
@@ -0,0 +1,3 @@
+;%	generationtime=20080609224426
+;%	lifetime=14d
+dyn.example.net. IN DNSKEY  256 3 5 BQEAAAAB1hmOomNafbJ3H76e8V4qmFvlFWQuIkM+jbh+s79ZpErpCR7w BS5TswdoTeglX9UjP0D6hLmHfTcsdHQLLeMidQ==
@@ -0,0 +1,3 @@
+;%	generationtime=20081216133142
+;%	lifetime=14d
+dyn.example.net. IN DNSKEY  256 3 5 BQEAAAAB4uTFNj8nkYmnWy6LgUlNS2QCPzevMxDoizMthpHUkBf+8U6q Exelm+aQQYnoyoe5NrreKBzt3jmqUYnn19QKQw==
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: 4uTFNj8nkYmnWy6LgUlNS2QCPzevMxDoizMthpHUkBf+8U6qExelm+aQQYnoyoe5NrreKBzt3jmqUYnn19QKQw==
+PublicExponent: AQAAAAE=
+PrivateExponent: sW8IqcOjr/1xymzxbq91KQiCxBY/8nDvDO/m4Re6aTrTXr450nw8eBZZQuOnHsSEyc4YA8Gs8AwxO1IGAyjHYQ==
+Prime1: 94n25jivIMy9SIV890Kp6CIGfeG/6g9eBFG+igw5JPM=
+Prime2: 6qYnXtPI7mxsinhBVf+/2Ncv+V48/790y+jUhJXFGXE=
+Exponent1: 4uCtm1fxo8apOydY+plF8duFa4BQq2rZkG4XCKQFpo0=
+Exponent2: DBPT/6Xc9NryN5/MaOWZhmEWha//SPrGIHrcOwRhE8E=
+Coefficient: tmkhFA718p1qDTkmOa2MqYox+Cz1LsuNCraAK0srL1U=
@@ -0,0 +1,35 @@
+;
+;	!!! Don't edit this file by hand.
+;	!!! It will be generated by dnssec-signer.
+;
+;	 Last generation time Dec 18 2008 01:03:01
+;
+
+;  ***  List of Key Signing Keys  ***
+; dyn.example.net.  tag=42138  algo=DSA  generated Aug 05 2008 23:01:57
+dyn.example.net. 3600 IN DNSKEY  257 3 3 (
+			CNtFdVrUUJ9MPDyzGoPm+tSKUgnX4bble5+VNGd4RjwWpEDj8RhEAhQ7
+			LybJzr0wtHXT2Q/KS55xARkUtcH2TVO/ayMupa30pM38rd8uF38sm+AB
+			KLEvCbPjaLZyW+s10di8nLp1aAxKFFfAEfXkIhl3Wm5g9CvjrMlrxAOf
+			Ny/jtz4v+asIr6/d992V80G9wMKMvTMQoCr4Sp9s2JubW79i4RBVWgHH
+			JMmtyqq+SqEkPhZvsTuo2sXgIH9vRS3XgfkGtw/KyTUM29bhZ2eB+Ldq
+			+bggp1gbBDiSsxZPjxciizI/mCzXWbq8BdfZ6LsddMjAolJwCtaPCD4e
+			4infmw+YSxjGau+YGgI0Cc0uItzQmNNpSoejM3IWGV+SN/YuPJIzw8wi
+			xDfO6kCNiPsW45Fvq31148cAvUvwiqYPQ3fONeOTdQjsJWLLdLTApVEH
+			10kjAGfa30Tm92lQhhG5ovWrWCMbFlw4Lbvlon+X2snWPNut0a1Pz4Wd
+			clDcmNU8dxi1lFvGbcJ0E4qBoJVBIzDh4HX1
+		) ; key id = 42138
+
+; ***  List of Zone Signing Keys  ***
+; dyn.example.net.  tag=1355  algo=RSASHA1  generated Aug 05 2008 23:01:57
+dyn.example.net. 3600 IN DNSKEY  256 3 5 (
+			BQEAAAAB1hmOomNafbJ3H76e8V4qmFvlFWQuIkM+jbh+s79ZpErpCR7w
+			BS5TswdoTeglX9UjP0D6hLmHfTcsdHQLLeMidQ==
+		) ; key id = 1355
+
+; dyn.example.net.  tag=10643  algo=RSASHA1  generated Dec 16 2008 14:31:42
+dyn.example.net. 3600 IN DNSKEY  256 3 5 (
+			BQEAAAAB4uTFNj8nkYmnWy6LgUlNS2QCPzevMxDoizMthpHUkBf+8U6q
+			Exelm+aQQYnoyoe5NrreKBzt3jmqUYnn19QKQw==
+		) ; key id = 10643
+
@@ -0,0 +1,5 @@
+#   signing key parameters
+KSK_lifetime:	60d	# (5184000 seconds)
+KSK_algo:	DSA
+KSK_bits:	1024
+KSK_randfile:	"/dev/urandom"
@@ -0,0 +1,2 @@
+dyn.example.net.	IN DS 42138 3 1 0F49FCDB683D1903F69B6779DB55CA3472974879
+dyn.example.net.	IN DS 42138 3 2 94AC94BFE3AFA17F7485F5F741274074FF2E26A360D776D8884F2689 CCED34C6
@@ -0,0 +1,18 @@
+$ORIGIN .
+dyn.example.net		7200	IN DNSKEY 257 3 3 (
+					CNtFdVrUUJ9MPDyzGoPm+tSKUgnX4bble5+V
+					NGd4RjwWpEDj8RhEAhQ7LybJzr0wtHXT2Q/K
+					S55xARkUtcH2TVO/ayMupa30pM38rd8uF38s
+					m+ABKLEvCbPjaLZyW+s10di8nLp1aAxKFFfA
+					EfXkIhl3Wm5g9CvjrMlrxAOfNy/jtz4v+asI
+					r6/d992V80G9wMKMvTMQoCr4Sp9s2JubW79i
+					4RBVWgHHJMmtyqq+SqEkPhZvsTuo2sXgIH9v
+					RS3XgfkGtw/KyTUM29bhZ2eB+Ldq+bggp1gb
+					BDiSsxZPjxciizI/mCzXWbq8BdfZ6LsddMjA
+					olJwCtaPCD4e4infmw+YSxjGau+YGgI0Cc0u
+					ItzQmNNpSoejM3IWGV+SN/YuPJIzw8wixDfO
+					6kCNiPsW45Fvq31148cAvUvwiqYPQ3fONeOT
+					dQjsJWLLdLTApVEH10kjAGfa30Tm92lQhhG5
+					ovWrWCMbFlw4Lbvlon+X2snWPNut0a1Pz4Wd
+					clDcmNU8dxi1lFvGbcJ0E4qBoJVBIzDh4HX1
+					) ; key id = 42138
@@ -0,0 +1,115 @@
+; File written on Tue Dec 16 14:31:43 2008
+; dnssec_signzone version 9.6.0rc1
+dyn.example.net.	7200	IN SOA	ns1.example.net. hostmaster.example.net. (
+					9          ; serial
+					43200      ; refresh (12 hours)
+					1800       ; retry (30 minutes)
+					1209600    ; expire (2 weeks)
+					7200       ; minimum (2 hours)
+					)
+			7200	RRSIG	SOA 5 3 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					G4QPBPbeEnPfKggesblu+QPI6rlt8gOaqnJB
+					k/98pbkDxhgLmpPP9RdjD3bftSFRgOdPGN1Y
+					xE4AxSdo4AR5NA== )
+			7200	NS	ns1.example.net.
+			7200	NS	ns2.example.net.
+			7200	RRSIG	NS 5 3 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					le7/8D28Oia0Ai/aSZsno5TILSCaPKNnuauM
+					MGEGfCixiCXFIOCuND54qMpUR3wNEnTkHkyl
+					OBYt6dGy5pH0dw== )
+			7200	NSEC	localhost.dyn.example.net. NS SOA RRSIG NSEC DNSKEY
+			7200	RRSIG	NSEC 5 3 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					ovWzUD/vXa15hxBDTtMKP4TcJEpG3RX+2CrZ
+					ztcRdF9uy3JXI3+dEgmB+cPaDVW1AiNIrIYF
+					3MRaCHa4jhJISw== )
+$INCLUDE dnskey.db
+			3600	RRSIG	DNSKEY 3 3 3600 20081222123143 (
+					20081216123143 42138 dyn.example.net.
+					CL4xO8K27EV8Aq25hhFsk7Q5uL7sGO0HnsBH
+					tr6Iomd+JCqxBGvZSBg= )
+			3600	RRSIG	DNSKEY 5 3 3600 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					DkobINneyOshuB+T7nfnGx/O7JvEBRPT/svs
+					ysxDmzZ8CaPF04lskwrLPFcRfMhrGX2JFYjE
+					uIWUFMbDBVHilA== )
+localhost.dyn.example.net. 7200	IN A	127.0.0.1
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					HDt+/eQ8d52VglJFPDwO3W7Gez2TUbvdz8Gk
+					SVDqIjHSTvJWN3L0vnBdHXOYUT8WLIMtQXXm
+					Y+JU8nNWxrD8yQ== )
+			7200	NSEC	ns1.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					d+CMf40oITbKKIV2AE3JTmGKtxb1RJPEEm2p
+					z8RHSPFrdcC9ieJrdZIx1+Uxs5PjNbZcjdft
+					oiLcZ/pr+2QXew== )
+ns1.dyn.example.net.	7200	IN A	1.0.0.5
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					p99aPrpCC+FU8uRCJuRCo4aibhuFelbDXR1q
+					9WRVJBJiDV4FO6EH/tCBAUQmNT0fh+mERKNd
+					39Qjr5mH5gFcQw== )
+			7200	AAAA	2001:db8::53
+			7200	RRSIG	AAAA 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					ajT50HHhQUY5mD8SH1nPd+mf4HosL1lVvDVN
+					HTnpoqCjG0guDuRk/BCLTBj1MPcPDYlkdDcd
+					Rpv5xbYbYNu5qQ== )
+			7200	NSEC	ns2.dyn.example.net. A AAAA RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					lQESBjK8+FQmGgndAMbPvQ2WMomT3sa1ozPQ
+					/7ykGFFgM3YeUyA2h0AlUWHatLNDvMy2HeaM
+					C1ozcV9M/iHR0A== )
+ns2.dyn.example.net.	7200	IN A	1.2.0.6
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					OrkPhnVeL0kTY6hJzrBgXy1NGeiQQR+5ykSh
+					qFOOwR1C0YiBWGF3kkLE0ZAZ7XD+CPxc6Z/H
+					WL/+o/AVAtWrtg== )
+			7200	NSEC	x.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					ZE+qfvafm4vmGkkpcI1Z1ND2doEwnGELDiYQ
+					SpNu3bWTHDO6B8vHql1QayGPLzDH8licFAXL
+					FdyUOVHrXZMZNw== )
+x.dyn.example.net.	7200	IN A	1.2.3.4
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					kYuQrOUinJDCsIGlv+qAPROyDOP6vCI11Us4
+					V0c6HK18FaaNE0BeivHAMN9QkliHF9GjYVm2
+					JbklfT3DUMSuIA== )
+			7200	NSEC	y.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					AR2flkOCH0YPbmTGxPj4v8Ug/L2dasQElmZW
+					+NZK4vlyxwtGFowBDtcjiD10defZNP3Wuzus
+					YjuVA5JpZpTW8A== )
+y.dyn.example.net.	7200	IN A	1.2.3.5
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					HYDO2JtuRZWZ+XyDj7GZOlC3b2Y2rozEzzEf
+					OC/CChOsplwm1MDx+5nXPHM8wcIUUofrlq+b
+					lRLJfqwLt9erxg== )
+			7200	NSEC	z.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					mtz25BnhPmwYaHG2DLth2f3XTUeAMFDnmXby
+					/kUWbflanujxvWDnB2hFs4qKGeE+WL36F/aw
+					/Ui1oFyMOcdvPg== )
+z.dyn.example.net.	7200	IN A	1.2.3.6
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					CxCptk9vpGT/9oG9WXiLmgKrWrxvuxFkgjEu
+					gBsp7loIM6x3Pr+CDXdsvbjDW1DwsjYBPyCa
+					JL7B7wczIlxQrA== )
+			7200	NSEC	dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					hOjfx9YA8O7tSXycALMnI+cQw3hs4euTVNPf
+					fCiYukAFjwpQAmS8xVbtydTH7TVs5UcObyqB
+					8gsnXboAW9x07g== )
@@ -0,0 +1,221 @@
+; File written on Thu Dec 18 01:03:01 2008
+; dnssec_signzone version 9.6.0rc1
+dyn.example.net.	7200	IN SOA	ns1.example.net. hostmaster.example.net. (
+					10         ; serial
+					43200      ; refresh (12 hours)
+					1800       ; retry (30 minutes)
+					1209600    ; expire (2 weeks)
+					7200       ; minimum (2 hours)
+					)
+			7200	RRSIG	SOA 5 3 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					srn4ZqDvq1V4YWAn+s1UuC3pk9DFhyxo7w6h
+					6LnIeqAvnt6naBfgu0IHKt62fCMlq2LaW3n5
+					LYdW5XD0aMU2pA== )
+			7200	NS	ns1.example.net.
+			7200	NS	ns2.example.net.
+			7200	RRSIG	NS 5 3 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					le7/8D28Oia0Ai/aSZsno5TILSCaPKNnuauM
+					MGEGfCixiCXFIOCuND54qMpUR3wNEnTkHkyl
+					OBYt6dGy5pH0dw== )
+			7200	RRSIG	NS 5 3 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					IAaofnTCtf2xoxW+NxUyosdLTj2+ueDnv8tz
+					hgGwtzUeHn+AXZgwB3pe5AgMO+Y8WNg7AZJ7
+					TlJkTe3CnL6/Uw== )
+			7200	NSEC	localhost.dyn.example.net. NS SOA RRSIG NSEC DNSKEY
+			7200	RRSIG	NSEC 5 3 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					ovWzUD/vXa15hxBDTtMKP4TcJEpG3RX+2CrZ
+					ztcRdF9uy3JXI3+dEgmB+cPaDVW1AiNIrIYF
+					3MRaCHa4jhJISw== )
+			7200	RRSIG	NSEC 5 3 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					S0ngwduIYE7H5DZ9A8OfeY9h0Sb6mdBQpN2+
+					TzK3hsS6d92m7IoTkLMv8V1iGMY9cUasauwl
+					bzMUUgXpBSzFqA== )
+			3600	DNSKEY	256 3 5 (
+					BQEAAAAB1hmOomNafbJ3H76e8V4qmFvlFWQu
+					IkM+jbh+s79ZpErpCR7wBS5TswdoTeglX9Uj
+					P0D6hLmHfTcsdHQLLeMidQ==
+					) ; key id = 1355
+			3600	DNSKEY	256 3 5 (
+					BQEAAAAB4uTFNj8nkYmnWy6LgUlNS2QCPzev
+					MxDoizMthpHUkBf+8U6qExelm+aQQYnoyoe5
+					NrreKBzt3jmqUYnn19QKQw==
+					) ; key id = 10643
+			3600	DNSKEY	257 3 3 (
+					CNtFdVrUUJ9MPDyzGoPm+tSKUgnX4bble5+V
+					NGd4RjwWpEDj8RhEAhQ7LybJzr0wtHXT2Q/K
+					S55xARkUtcH2TVO/ayMupa30pM38rd8uF38s
+					m+ABKLEvCbPjaLZyW+s10di8nLp1aAxKFFfA
+					EfXkIhl3Wm5g9CvjrMlrxAOfNy/jtz4v+asI
+					r6/d992V80G9wMKMvTMQoCr4Sp9s2JubW79i
+					4RBVWgHHJMmtyqq+SqEkPhZvsTuo2sXgIH9v
+					RS3XgfkGtw/KyTUM29bhZ2eB+Ldq+bggp1gb
+					BDiSsxZPjxciizI/mCzXWbq8BdfZ6LsddMjA
+					olJwCtaPCD4e4infmw+YSxjGau+YGgI0Cc0u
+					ItzQmNNpSoejM3IWGV+SN/YuPJIzw8wixDfO
+					6kCNiPsW45Fvq31148cAvUvwiqYPQ3fONeOT
+					dQjsJWLLdLTApVEH10kjAGfa30Tm92lQhhG5
+					ovWrWCMbFlw4Lbvlon+X2snWPNut0a1Pz4Wd
+					clDcmNU8dxi1lFvGbcJ0E4qBoJVBIzDh4HX1
+					) ; key id = 42138
+			3600	RRSIG	DNSKEY 3 3 3600 20081222123143 (
+					20081216123143 42138 dyn.example.net.
+					CL4xO8K27EV8Aq25hhFsk7Q5uL7sGO0HnsBH
+					tr6Iomd+JCqxBGvZSBg= )
+			3600	RRSIG	DNSKEY 5 3 3600 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					DkobINneyOshuB+T7nfnGx/O7JvEBRPT/svs
+					ysxDmzZ8CaPF04lskwrLPFcRfMhrGX2JFYjE
+					uIWUFMbDBVHilA== )
+			3600	RRSIG	DNSKEY 5 3 3600 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					0W2AHhTCCVK1UAhfGkZTkrLuPfRNBgQHysKw
+					dHimxjMq/IlVwamPkmrW0NmYdt15C+E9SZja
+					HYu8RuXqyqxQzQ== )
+localhost.dyn.example.net. 7200	IN A	127.0.0.1
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					HDt+/eQ8d52VglJFPDwO3W7Gez2TUbvdz8Gk
+					SVDqIjHSTvJWN3L0vnBdHXOYUT8WLIMtQXXm
+					Y+JU8nNWxrD8yQ== )
+			7200	RRSIG	A 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					vTo/zPTFUEK92lpo3XTuSai3VsUO5FuYuS0T
+					L3w3iIQHOdOSHunPy2brF6BzsznZXLuYvDvr
+					cZuxxYJpYRrecg== )
+			7200	NSEC	ns1.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					d+CMf40oITbKKIV2AE3JTmGKtxb1RJPEEm2p
+					z8RHSPFrdcC9ieJrdZIx1+Uxs5PjNbZcjdft
+					oiLcZ/pr+2QXew== )
+			7200	RRSIG	NSEC 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					G/Tw47gQNzuCEJTLHbCOcrBoEEP28QrwzLdw
+					7Y+WXP7XFMsLDkdLGrsL6CGLDL/L9WBGU75x
+					QKKBPFshzJUeUQ== )
+ns1.dyn.example.net.	7200	IN A	1.0.0.5
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					p99aPrpCC+FU8uRCJuRCo4aibhuFelbDXR1q
+					9WRVJBJiDV4FO6EH/tCBAUQmNT0fh+mERKNd
+					39Qjr5mH5gFcQw== )
+			7200	RRSIG	A 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					QPGkC3aXCaNaGauAaEs5AWlBoftcP/HbrVGe
+					JlzZN2LbwwbTNDtvotnW7PeWJaaj6vRInkOt
+					TjSz43Sfn4FJvg== )
+			7200	AAAA	2001:db8::53
+			7200	RRSIG	AAAA 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					ajT50HHhQUY5mD8SH1nPd+mf4HosL1lVvDVN
+					HTnpoqCjG0guDuRk/BCLTBj1MPcPDYlkdDcd
+					Rpv5xbYbYNu5qQ== )
+			7200	RRSIG	AAAA 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					BXvwGdoLeAuj709j3KGvK7RvgQ4MbJmew8De
+					ZbTBaoVt4Z79Tf0m67Vj+VqHRgTDjyIvnSNZ
+					Bawk6lWw5dvroA== )
+			7200	NSEC	ns2.dyn.example.net. A AAAA RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					lQESBjK8+FQmGgndAMbPvQ2WMomT3sa1ozPQ
+					/7ykGFFgM3YeUyA2h0AlUWHatLNDvMy2HeaM
+					C1ozcV9M/iHR0A== )
+			7200	RRSIG	NSEC 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					fYIG2W8qnQYoahLfwJqLf4Tigl93xfqXZO20
+					qn/wPBW4jy+JnJ/ShptEZCeuyTTsVBw4ZnJI
+					7o15ZBW1UlZy9g== )
+ns2.dyn.example.net.	7200	IN A	1.2.0.6
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					OrkPhnVeL0kTY6hJzrBgXy1NGeiQQR+5ykSh
+					qFOOwR1C0YiBWGF3kkLE0ZAZ7XD+CPxc6Z/H
+					WL/+o/AVAtWrtg== )
+			7200	RRSIG	A 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					gDre5yf6WCDCute4lg1ktW9+mM4qPn5D5Oy6
+					hsu3+9NRjOdAdQhV9HMzdOODooIOvLGKINOY
+					6PFS66OvTcfNpA== )
+			7200	NSEC	x.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					ZE+qfvafm4vmGkkpcI1Z1ND2doEwnGELDiYQ
+					SpNu3bWTHDO6B8vHql1QayGPLzDH8licFAXL
+					FdyUOVHrXZMZNw== )
+			7200	RRSIG	NSEC 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					FZGn3y2M+YWoH6gk06gTUMZ49PIq+yDr708Y
+					fxPcEsRljuYU2GrmETQKJTDY1HjYomTBGoKm
+					StupQrHzOOasAA== )
+x.dyn.example.net.	7200	IN A	1.2.3.4
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					kYuQrOUinJDCsIGlv+qAPROyDOP6vCI11Us4
+					V0c6HK18FaaNE0BeivHAMN9QkliHF9GjYVm2
+					JbklfT3DUMSuIA== )
+			7200	RRSIG	A 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					pYCB8HDdv9WxX1GxNWdafGZGSKrveweoOixc
+					uddF++dPA1m+ro/6Qw28Cj5Coth7IKu+TyM0
+					JPWTJgOUck73zw== )
+			7200	NSEC	y.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					AR2flkOCH0YPbmTGxPj4v8Ug/L2dasQElmZW
+					+NZK4vlyxwtGFowBDtcjiD10defZNP3Wuzus
+					YjuVA5JpZpTW8A== )
+			7200	RRSIG	NSEC 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					Ant5JHyVUh8+mMG5+WGgimDGiItGVRWhb3B5
+					C4KYb7DM8+qJ98W0KPIxFT9Sj9bsKyyOzvf3
+					Bik/f7DSdcr6sg== )
+y.dyn.example.net.	7200	IN A	1.2.3.5
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					HYDO2JtuRZWZ+XyDj7GZOlC3b2Y2rozEzzEf
+					OC/CChOsplwm1MDx+5nXPHM8wcIUUofrlq+b
+					lRLJfqwLt9erxg== )
+			7200	RRSIG	A 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					1zS6xszu0hrKaJOLS6YOuFthmDCRp3PQIAjh
+					u6uPX6Kjpb8Svhdo7yFp7ukJU5OX6BEKiSon
+					qHajnJvPg72T6w== )
+			7200	NSEC	z.dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					mtz25BnhPmwYaHG2DLth2f3XTUeAMFDnmXby
+					/kUWbflanujxvWDnB2hFs4qKGeE+WL36F/aw
+					/Ui1oFyMOcdvPg== )
+			7200	RRSIG	NSEC 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					3fCQpAl+OjtWt9ZIpTrYVLhpZoaLqAJ8hy2v
+					ZTu9MtmmS3W/cdp6qdSi+bUZuiptGoxTBAjh
+					aC7QpOrobV9C/w== )
+z.dyn.example.net.	7200	IN A	1.2.3.6
+			7200	RRSIG	A 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					CxCptk9vpGT/9oG9WXiLmgKrWrxvuxFkgjEu
+					gBsp7loIM6x3Pr+CDXdsvbjDW1DwsjYBPyCa
+					JL7B7wczIlxQrA== )
+			7200	RRSIG	A 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					MAJ85Q1cFh7yqewaQyJ3YxS3KwTK/rxW+leY
+					HLwxfcijXkUrxVaRtO/gTcFdo4aTJjeDrPhV
+					ESwQbI+NNVkVRw== )
+			7200	NSEC	dyn.example.net. A RRSIG NSEC
+			7200	RRSIG	NSEC 5 4 7200 20081222123143 (
+					20081216123143 1355 dyn.example.net.
+					hOjfx9YA8O7tSXycALMnI+cQw3hs4euTVNPf
+					fCiYukAFjwpQAmS8xVbtydTH7TVs5UcObyqB
+					8gsnXboAW9x07g== )
+			7200	RRSIG	NSEC 5 4 7200 20081223230301 (
+					20081217230301 10643 dyn.example.net.
+					hRnT7XWT+KFHsxZ8rNiqWJ2/5WyLQRxht/QQ
+					NXaYz2OeSGfgsRmdHc6UfjeVLyeXYn7Tkikr
+					Pg7pX/nmF4eldQ== )
@@ -0,0 +1,30 @@
+;-----------------------------------------------------------------
+;
+;       @(#)    dyn.example.net/zone.org
+;
+;-----------------------------------------------------------------
+
+$TTL	7200
+
+@	IN SOA	ns1.example.net. hostmaster.example.net.  (
+				1       ; Serial	
+				43200	; Refresh
+				1800	; Retry
+				2W	; Expire
+				7200 )	; Minimum
+
+		IN  NS		ns1.example.net.
+		IN  NS		ns2.example.net.
+
+ns1		IN  A		1.0.0.5
+		IN  AAAA	2001:db8::53
+ns2		IN  A		1.2.0.6
+
+localhost	IN  A		127.0.0.1
+
+x		IN  A	1.2.3.4
+y		IN  A	1.2.3.5
+z		IN  A	1.2.3.6
+
+$INCLUDE dnskey.db
+
@@ -0,0 +1,3 @@
+;%	generationtime=20081116175850
+;%	lifetime=365d
+example.net. IN DNSKEY  257 3 5 BQEAAAABDG+2bUQuvTgeYA99bx5wXDsiaQnhJc5oFj+sQLmCvj6hGFfQ oUkI67jTMkIzQlflQ3UHBfAnQMeFAhhQLrG+/cMXldZN3360Q+YlSbGJ w2vVXcBr463AUAlENzSDS35D1x8zOgZOg34rL+1uFn0HBSI0xusYRAlU t9A3vJsLWcRyA1e/wVthbnx1DGbuy+fM5g1inAAbgmGwyaX5JT9+p0yB /Q==
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: DG+2bUQuvTgeYA99bx5wXDsiaQnhJc5oFj+sQLmCvj6hGFfQoUkI67jTMkIzQlflQ3UHBfAnQMeFAhhQLrG+/cMXldZN3360Q+YlSbGJw2vVXcBr463AUAlENzSDS35D1x8zOgZOg34rL+1uFn0HBSI0xusYRAlUt9A3vJsLWcRyA1e/wVthbnx1DGbuy+fM5g1inAAbgmGwyaX5JT9+p0yB/Q==
+PublicExponent: AQAAAAE=
+PrivateExponent: CfS81MH9GT1CGQtK94PvSgggeQnSullWOmqQsKGndfJVpv4AJj/XCaEhgboIVshezJmUdHf3RWSOkSYfHAID89fTFAYvL4ZVSmkha1EivkY+tOeohM9zBzs5CfE9fmAlMCmxEQsYggZtjuddncKCNC4IYSkV6ez21S//3vnGvUtic+2ywaXF03MwhjKkOed6g8ukZJnj7B9Z5wu3rdiyOe85IQ==
+Prime1: A7Wh1oSpETxNT/ptPVHSGIemIyNvALXSI5UcoWAADQbith5663r1GgXHk2YGbyg1HgyrCZFoME3ZoIOUQ6yfN6tlixhpWmQdLW+pz3lULlTFBQ==
+Prime2: A1pCUhsSF9J8i5Smp2KEO3Dw5LngamhRksJzKC4yfGMvjwJ/RHJByyVcUEtRhgLvd2C2uW89Z4nz8HM/HQI+u9uwIFM20SIFEzZceR62ghNamQ==
+Exponent1: Azf7LwilgmHe2xJwMfQIJP5OnNsaZ1zm7Gk2i4lyA8+3hHNWetR1QRKl5E3AnzIzwOM5VEm2nO2XZeyHKPVOol6DM390oFXvp0c2G+ROabyQnQ==
+Exponent2: ATQ6mNC7MpC5NlGdQ+XmlTkiNuCRuFf/jZeSiJkZWvTjwZXQUhRCFMiM7fYwx/b/cqnqZ7I/9VwzslorFu0T37GQaeugFNkrsDdRRvDOA7+qoQ==
+Coefficient: AkhsG+b3Bel4MQ9fF/CnsPxv0cdoTphpLZPUGPlG451hqWFzMANEcTsiDya2UHoa5FAK825+47hVdihTdZkJwMNMsoI2Xnr07AEurDapOvChrg==
@@ -0,0 +1,3 @@
+;%	generationtime=20090730151357
+;%	lifetime=84d
+example.net. IN DNSKEY  256 3 5 BQEAAAAB12pqReCbmKHzRtk4wbc6xRCSXZoA1G78HQ8W+LsPz3UTQxKZ WhmAhB2LZqK2t4rcoAhDVW0hZ6DSDuV/0kouMQ==
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: 12pqReCbmKHzRtk4wbc6xRCSXZoA1G78HQ8W+LsPz3UTQxKZWhmAhB2LZqK2t4rcoAhDVW0hZ6DSDuV/0kouMQ==
+PublicExponent: AQAAAAE=
+PrivateExponent: QGedp/HTzh6rYQGFLCnFHIM8mo5AxWZng293NH1AjxjGas5dmGZazN7l1XVRC3vsrkJnEo4vufmn3PiXEN5+cQ==
+Prime1: 9xNBI9Hnmg90Tt4dTmbd3vwYOnPMY3bUT8LK7ST9AW8=
+Prime2: 3zJmVknraflkD8SdS8KS30TnMdS45kfTLrLfGapkul8=
+Exponent1: 3QgVQB/5/207T9FsSmaLCerWRHXc2rhk2SzIgkizh+k=
+Exponent2: jFPAst+viSJxygltwZn3WPEL1+JeMFK99nilMa7YVLc=
+Coefficient: 7duJdlOhBkQ0IDwI5Hiedteo7phE7GPedy5MVHpPcjM=
@@ -0,0 +1,3 @@
+;%	generationtime=20090228113129
+;%	lifetime=60d
+example.net. IN DNSKEY  257 3 5 BQEAAAABCwxfQLjMaLsvSPFYMFyi/Z5l6f/y1fNROZtCrUSAFca8c4Dc +MK9phlqEtBihnMSBjFsuhyq1w++ubzZF3rVduVXP+loeEW5cGXneM4n m52unLpZfQu0B0h/zwDLrfmedyqqZYb7grXDqFwT0EnI4cL/Ybr40H7u SUyVyLM3c5a8V5RDA2t1PImy7UURv6qusCsRslw+mM5jG0S7Il5cqhug aQ==
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: CwxfQLjMaLsvSPFYMFyi/Z5l6f/y1fNROZtCrUSAFca8c4Dc+MK9phlqEtBihnMSBjFsuhyq1w++ubzZF3rVduVXP+loeEW5cGXneM4nm52unLpZfQu0B0h/zwDLrfmedyqqZYb7grXDqFwT0EnI4cL/Ybr40H7uSUyVyLM3c5a8V5RDA2t1PImy7UURv6qusCsRslw+mM5jG0S7Il5cqhugaQ==
+PublicExponent: AQAAAAE=
+PrivateExponent: BhlkW6GKcOvDGyVAj7rEqpvEVd+t8H3WkifdhulioLIppKBuJlzzhSORjGojm6KYwcQl78F/7kHgKn2S5jBVk0FZr3vUR7Z6wbO80Ic9lOaFMBz0uYvUIYLGpFJvsVAFWv9sOkLK5iwFs6JehrSgxDbMfyBd8hpdN7mWOYD51p5HJMVvdqAw82mZoELQdlWM5tUzZdyx0jnAPtnYV+IxVa5CgQ==
+Prime1: A41vXEkXlyvOuNbnByXKgw4BfHHp4LjpDsm4F35SD56Pvw1BFHtrgm/U7oJZQUBvyW2CcCe0Ria1iY4OjB/jdv2c4+GPhq1LizHquadfwHfAzw==
+Prime2: AxwrEOiIRMkPEobov43MiBtbFKGA7QnN7DOD/QTFOA8a7IMhUDHU7pQbJASXpUaLKLSrAMeRNKwSyHXq34WFUzP4HK6ubuLn2k5YxhWRDbwpRw==
+Exponent1: Ao+dprhY0qEAYGjF6wdwxyIDFAoU/g+1gwS566bRiIrYdXN9OoLRHHH7r3v8tfgjKckQAXbjVKfV9MYNpnW8jYqmSOvAXXjLtHtyBcJQOs89gQ==
+Exponent2: 9AwIcMdFNsAzAsXHLQwN3lvQUce4cpuxw/GKnKTu9rsmqtbz9Al4qLSTsXYxErdSZ7xwIxX/PYeCywc0zZjd5fbGGOBv/fApfRgECVQWSNpJ
+Coefficient: 1hDGT7Cnck4tyDJDUZHVK2ejowz2RlqzqN/BAMEfi+k3b/Ild6pdHNHu2mDYkFRqSIU4zVAVxeplrTKoXvVmmb8iWF/3jNLL/eKxYinNHe1P
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: pYc2cSHkPcRoLfvndzNke696mmWkmp9lsX3C7xkqd8eYwXWjw2ijRq0QPahQxqFYm/hhC77xJoVwSeOtXdmKiQ==
+PublicExponent: AQAAAAE=
+PrivateExponent: ZF1rC+0JIyhAQNFXPtcPW8S3iggmyY5AH+yXDDqpM1qx3a3NY5/BfuHFYDtsfHAB2DOjgqQmADly2B9NMhoJ4Q==
+Prime1: 2jtxQTZzjZuyqSRk4PBk/nx+VqrVFdSvHUyXb2EjNrU=
+Prime2: wizFiwOCJBiVDOjA0Zq9VuWk4+Fa7TNpkXp0//Y+NQU=
+Exponent1: ORIEM1AkgXP+KkRQcZI6qW+fXhrdUsegVW42eGRzEmk=
+Exponent2: YHsutgi+2qKtY/38Uu3e7bnHVhpUO7ZAcgPh00vd1yk=
+Coefficient: Z5qDNIXQpU91m32R1HPPK75ASx5ah4/Gd4jw/SHsnDk=
@@ -0,0 +1,3 @@
+;%	generationtime=20090615075841
+;%	lifetime=14d
+example.net. IN DNSKEY  256 3 5 BQEAAAABpYc2cSHkPcRoLfvndzNke696mmWkmp9lsX3C7xkqd8eYwXWj w2ijRq0QPahQxqFYm/hhC77xJoVwSeOtXdmKiQ==
@@ -0,0 +1,3 @@
+;%	generationtime=20090630093509
+;%	lifetime=14d
+example.net. IN DNSKEY  256 3 5 BQEAAAABzN3RkyF1Kvf3Go97BN7rNERR86F0nxfyHfXpMdwtqrMFSrkd IboUDtNZBsw+LJmadHRQZDfu79tEz8MUid7aOw==
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: zN3RkyF1Kvf3Go97BN7rNERR86F0nxfyHfXpMdwtqrMFSrkdIboUDtNZBsw+LJmadHRQZDfu79tEz8MUid7aOw==
+PublicExponent: AQAAAAE=
+PrivateExponent: a9MzQ8dBy0kkwjUECnf6X02Q8URTNL+8IuJIOjD0sVbtt04trek0iioQkWNVBn7m7o1vrIijQ4AuMe9xqyiRyQ==
+Prime1: /m1HDAGWnLeuYTLhlNxQBg+vUDjDPXOFXFvOg5Vkjlc=
+Prime2: ziIYCdlrKqZkIpyt6AuPsRDqs2kNlkiwWT8D4D7J3L0=
+Exponent1: Sd/Kn+FrTrMRZucUyXyGoKyfX6uReD4Kv0XYAqtk9+s=
+Exponent2: KAcgSeMQeZPaabpFZMR9O4h2j4WwD5PysJsQKq1i9DE=
+Coefficient: NBFD1eKzJOpi9G1tF88xmnNvNBbyEtgf0EuV4JAwTrs=
@@ -0,0 +1,45 @@
+;
+;	!!! Don't edit this file by hand.
+;	!!! It will be generated by dnssec-signer.
+;
+;	 Last generation time Jul 30 2009 17:13:57
+;
+
+;  ***  List of Key Signing Keys  ***
+; example.net.  tag=33840  algo=RSASHA1  generated Feb 28 2009 12:31:29
+example.net. 14400 IN DNSKEY  257 3 5 (
+			BQEAAAABCwxfQLjMaLsvSPFYMFyi/Z5l6f/y1fNROZtCrUSAFca8c4Dc
+			+MK9phlqEtBihnMSBjFsuhyq1w++ubzZF3rVduVXP+loeEW5cGXneM4n
+			m52unLpZfQu0B0h/zwDLrfmedyqqZYb7grXDqFwT0EnI4cL/Ybr40H7u
+			SUyVyLM3c5a8V5RDA2t1PImy7UURv6qusCsRslw+mM5jG0S7Il5cqhug
+			aQ==
+		) ; key id = 33840
+
+; example.net.  tag=7308  algo=RSASHA1  generated Feb 28 2009 12:31:29
+example.net. 14400 IN DNSKEY  257 3 5 (
+			BQEAAAABDG+2bUQuvTgeYA99bx5wXDsiaQnhJc5oFj+sQLmCvj6hGFfQ
+			oUkI67jTMkIzQlflQ3UHBfAnQMeFAhhQLrG+/cMXldZN3360Q+YlSbGJ
+			w2vVXcBr463AUAlENzSDS35D1x8zOgZOg34rL+1uFn0HBSI0xusYRAlU
+			t9A3vJsLWcRyA1e/wVthbnx1DGbuy+fM5g1inAAbgmGwyaX5JT9+p0yB
+			/Q==
+		) ; key id = 7308
+
+; ***  List of Zone Signing Keys  ***
+; example.net.  tag=34925  algo=RSASHA1  generated Jun 17 2009 16:36:16
+example.net. 14400 IN DNSKEY  256 3 5 (
+			BQEAAAABpYc2cSHkPcRoLfvndzNke696mmWkmp9lsX3C7xkqd8eYwXWj
+			w2ijRq0QPahQxqFYm/hhC77xJoVwSeOtXdmKiQ==
+		) ; key id = 34925
+
+; example.net.  tag=48089  algo=RSASHA1  generated Jun 30 2009 11:35:09
+example.net. 14400 IN DNSKEY  256 3 5 (
+			BQEAAAABzN3RkyF1Kvf3Go97BN7rNERR86F0nxfyHfXpMdwtqrMFSrkd
+			IboUDtNZBsw+LJmadHRQZDfu79tEz8MUid7aOw==
+		) ; key id = 48089
+
+; example.net.  tag=24545  algo=RSASHA1  generated Jul 30 2009 17:13:57
+example.net. 14400 IN DNSKEY  256 3 5 (
+			BQEAAAAB12pqReCbmKHzRtk4wbc6xRCSXZoA1G78HQ8W+LsPz3UTQxKZ
+			WhmAhB2LZqK2t4rcoAhDVW0hZ6DSDuV/0kouMQ==
+		) ; key id = 24545
+
@@ -0,0 +1,4 @@
+example.net.		IN DS 7308 5 1 16CD09D37EC1FEC2952BE41A5C5E2485C1B0C445
+example.net.		IN DS 7308 5 2 FD31B2F54526FAA8131A3311452729467FA7AD5D7D14CA6584B4C41B 0B384D8E
+example.net.		IN DS 33840 5 1 A554D150A7F958080235B9A361082937B65EB7C4
+example.net.		IN DS 33840 5 2 044406C788E4B659573DEED74F4EAEC9E7FAC431CB6932C39DABF704 30A6102B
@@ -0,0 +1,4 @@
+;%	generationtime=20080506212634
+;%	lifetime=60d
+;%	expirationtime=20090228113128
+example.net. IN DNSKEY  385 3 5 BQEAAAABDUi2uSUlDjESbnrnY5wd8+pXxhYVY4wCi2UVjhcehvIb2bF8 VJH2Q9/0ubQR1vQ2VJhsGUj3A7bdTfbMETPxKkZaDpc9lCYrm0z5HDrs lyx4bSb4JX/iCyhgYZXrTVb9WyLXjUtmDUktDjZgsyVshFHVJShBUSj+ YpnfQkndGViDAbJRycXDYEF1hCNmTK3KsR1JS9dXMKI3WidH+B9rLlBU 8w==
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: DUi2uSUlDjESbnrnY5wd8+pXxhYVY4wCi2UVjhcehvIb2bF8VJH2Q9/0ubQR1vQ2VJhsGUj3A7bdTfbMETPxKkZaDpc9lCYrm0z5HDrslyx4bSb4JX/iCyhgYZXrTVb9WyLXjUtmDUktDjZgsyVshFHVJShBUSj+YpnfQkndGViDAbJRycXDYEF1hCNmTK3KsR1JS9dXMKI3WidH+B9rLlBU8w==
+PublicExponent: AQAAAAE=
+PrivateExponent: AzPR74ljfqsl7qB92XeCowR3igYQrN59a2Z8VGB1PegjagkBltDzudzYyDKpvqdigjeFLL54f1MN5JCPo4J2Q6Ij49LAQ5GsXiEd/FWlwR+UztOcW/uZ3W6DNIwuMbSY7ruZmpv/zVPpyeY1PVXgCsJlX2Zj/Wt8QHASHp5rUugGQSPQfVSQ/mBdDXMZw2tEb3b10quziCmKuHegopRYeuNXwQ==
+Prime1: A+5jXfxmP0Mfnjr4m8BPrPkDyokgFXZB3dXibxeZqp4ypcwpXeO0xTf1FjSZeIOi2RJOzpym914IYa3wPx4zbxmsGeozr1hTIWE+6Xuz0qjE0w==
+Prime2: A2EOffOaSvEoTUf/0dF8Z9/dYxIrE9HBbXRjgrlPc+WoG57lCkjxe/KO5Eclg9o5nrTFcsxpsjrdxOAcIcyTIHsXW8YgxDAb1mFJ0V6tBsabYQ==
+Exponent1: vmRAN3zHGTV28Oj4gslB/xA58sDyieCkDrpGaGChsPo7yUPOEeZQ8ep/FDnQoZLhLCn6XkKcN4D99Yo3JxVECBJOHZp8HrFsfF9BzpXk2yH9
+Exponent2: Aj8x3YdZJ0/KzwX2m6G2qZ5WktmkDITa+XHxvSashqlBm2niBCRFN5kNQNhkIO5ZAFWKEPuHSB5BZWTzgj8jeB8mRoYtbPlJom4KbNtCiZ6BYQ==
+Coefficient: A87WfUPUBfYDuSAu6kcHLAyr0OnqoXnMeXSgyq28CJXdh3Vg39Al8me07wWeRDjMzfpZGdKEhxyvVIS8WhY3du0FYoGI5YhJMqaYq3XjwLfpsQ==
@@ -0,0 +1,4 @@
+;%	generationtime=20080415164557
+;%	lifetime=20d
+;%	expirationtime=20080506212633
+example.net. IN DNSKEY  385 3 5 BQEAAAABCrDt76ODmeteohszxggclH3vAXO/NXOnXjOzIivP5LaUL4/U uAtafg5JXypl/nCUVap9FG0K1ebCCBCMJaPCoi7pIgD5EgFzHPnxZo2w GvtmWYwK3MaBP4U8YzwpVbGpJIBAW+IZyM89LD6b2cvkJL5YEviPNfMp rMTLo7BOMVjMBpG2IuULOHq7dzyIe/ym/RXKuuYc5AVtHCBBfGKU/Wzn 0Q==
@@ -0,0 +1,10 @@
+Private-key-format: v1.2
+Algorithm: 5 (RSASHA1)
+Modulus: CrDt76ODmeteohszxggclH3vAXO/NXOnXjOzIivP5LaUL4/UuAtafg5JXypl/nCUVap9FG0K1ebCCBCMJaPCoi7pIgD5EgFzHPnxZo2wGvtmWYwK3MaBP4U8YzwpVbGpJIBAW+IZyM89LD6b2cvkJL5YEviPNfMprMTLo7BOMVjMBpG2IuULOHq7dzyIe/ym/RXKuuYc5AVtHCBBfGKU/Wzn0Q==
+PublicExponent: AQAAAAE=
+PrivateExponent: CWC6hC61oQC954Dcu2Z0NNmLk6Wnr33yh7VCuT7kh5fSOgA6Fm0qQgH+nvW2sv9fpy8JB4WBaa/CnysKkLwjDBFcWkrMw7wDR0KAiixe8bjXCZUy95x2t3B/o23jQtS/ejJgaSSOJFioRcPoT5sv9mm6QCe3ir3g9+3n4COrzf0DY1oGfDLzuhrYDT/AM5MuEjSamlblTPHHsKlI3UCl+AHDLQ==
+Prime1: A3ZcDeyxt/SDgmgg4Yk7v66MbFU4GWreYp4/MYhEDsE4jA0cqEY28cAoN8FyPCB1H1t10IVqOs7/LSKrWdXMUKUv57DPMHJp539Wx2HYLmVIfw==
+Prime2: AxZ8J01/Sbij24nloiVsDJdjFTAVApr4S6n/QRdBkWumQTLexnQ1ErcTEVc3Fn0po04ZToIO5JNINrWNdAuNiaHYLuiD4pkkHuSAmTajbVsnrw==
+Exponent1: Iw7WPWd3zZeJ/b3zQcQtSosUXUWFy430aEsQWimMnibFm+qOVpsjhRkTHW/yZp227Y4sVb/ZhzCZWFGr6qWe0sdHIv5Yx6SkvIxv4rUiHdOL
+Exponent2: AhiPWhKq+Iyy/HRZuWpIAalUZ7yE7FeHWFQYQLocatTCnY91VsgNxRLXRwcci6mflhIVoLBDHJal7x4SCRq0Xbze5PeMlMUhsDQdCT+QYTgCRw==
+Coefficient: Auw2b1lPzp3gWxpnDNZWeuiwGcWTd9fNfN/4kBrCbulFngYTNVBpqathFqdwtojYXHfM2HZDKHqmZVZgON+FfxvauGvTDWO6MTBxUleeBlLmcg==
--- a/Show More
+++ b/Show More