4571. [bug] Out-of-tree builds of backtrace_test failed.

(cherry picked from commit 3e48466e0a)
newcopyrights
2017-02-06 13:47:42 +11:00 · 2017-02-05 23:30:25 +00:00 · 2017-02-05 07:00:55 +00:00 · 2017-02-05 06:55:18 +00:00 · 2017-02-04 22:36:23 -08:00 · 2017-02-04 22:16:06 -08:00
670 changed files with 37654 additions and 16952 deletions
@@ -1,12 +1,78 @@
-	--- 9.9.9-P6 released ---
+	--- 9.9.10rc1 released ---
+
+4571.	[bug]		Out-of-tree builds of backtrace_test failed.
+
+4570.	[cleanup]	named did not correctly fall back to the built-in
+			initializing keys if the bind.keys file was present
+			but empty. [RT #44531]
+
+4568.	[contrib]	Added a --with-bind option to the dnsperf configure
+			script to specify BIND prefix path.
+
+4567.	[port]		Call getprotobyname and getservbyname prior to calling
+			chroot so that shared libraries get loaded. [RT #44537]
+
+4564.	[maint]		Update the built in managed keys to include the
+			upcoming root KSK. [RT #44579]
+
+4561.	[port]		Silence a warning in strict C99 compilers. [RT #44414]
+
+4560.	[bug]		mdig: add -m option to enable memory debugging rather
+			than having it on all the time. [RT #44509]
+
+4559.	[bug]		openssl_link.c didn't compile if ISC_MEM_TRACKLINES
+			was turned off.  [RT #44509]

 4558.	[bug]		Synthesised CNAME before matching DNAME was still
-			being cached when it should have been.  [RT #44318]
+			being cached when it should not have been.  [RT #44318]

 4557.	[security]	Combining dns64 and rpz can result in dereferencing
 			a NULL pointer (read).  (CVE-2017-3135) [RT#44434]

-	--- 9.9.9-P5 released ---
+4554.	[bug]		Remove double unlock in dns_dispatchmgr_setudp.
+			[RT #44336]
+
+4553.	[bug]		Named could deadlock there were multiple changes to
+			NSEC/NSEC3 parameters for a zone being processed at
+			the same time. [RT #42770]
+
+4552.	[bug]		Named could trigger a assertion when sending notify
+			messages. [RT #44019]
+
+4551.	[test]		Add system tests for integrity checks of MX and
+			SRV records. [RT #43953]
+
+4550.	[cleanup]	Increased the number of available master file
+			output style flags from 32 to 64. [RT #44043]
+
+	--- 9.9.10b1 released ---
+
+4543.	[bug]		dns_client_startupdate now delays sending the update
+			request until isc_app_ctxrun has been called.
+			[RT #43976]
+
+4541.	[bug]		rndc addzone should properly reject non master/slave
+			zones. [RT #43665]
+
+4539.	[bug]		Referencing a nonexistent zone with RPZ could lead
+			to a assertion failure when configuring. [RT #43787]
+
+4538.	[bug]		Call dns_client_startresolve from client->task.
+			[RT #43896]
+
+4537.	[bug]		Handle timeouts better in dig/host/nslookup. [RT #43576]
+
+4535.	[bug]		Address race condition in setting / testing of
+			DNS_REQUEST_F_SENDING. [RT #43889]
+
+4534.	[bug]		Only set RD, RA and CD in QUERY responses. [RT #43879]
+
+4533.	[bug]		dns_client_update should terminate on prerequisite
+			failures (NXDOMAIN, YXDOMAIN, NXRRSET, YXRRSET)
+			and also on BADZONE.  [RT #43865]
+
+4532.	[contrib]	Make gen-data-queryperf.py python 3 compatible.
+			[RT #43836]

 4530.	[bug]		Change 4489 broke the handling of CNAME -> DNAME
 			in responses resulting in SERVFAIL being returned.
@@ -15,34 +81,198 @@
 4528.	[bug]		Only set the flag bits for the i/o we are waiting
 			for on EPOLLERR or EPOLLHUP. [RT #43617]

+4527.	[doc]		Support DocBook XSL Stylesheets v1.79.1. [RT #43831]
+
+4526.	[doc]		Corrected errors and improved formatting of
+			grammar definitions in the ARM. [RT #43739]
+
+4525.	[doc]		Fixed outdated documentation on managed-keys.
+			[RT #43810]
+
+4524.	[bug]		The net zero test was broken causing IPv4 servers
+			with addresses ending in .0 to be rejected. [RT #43776]
+
+4523.	[doc]		Expand config doc for <querysource4> and
+			<querysource6>. [RT #43768]
+
+4522.	[bug]		Handle big gaps in log file version numbers better.
+			[RT #38688]
+
+4521.	[cleanup]	Log it as an error if an entropy source is not
+			found and there is no fallback available. [RT #43659]
+
+4520.	[cleanup]	Alphabetize more of the grammar when printing it
+			out. [RT #43755]
+
 4519.	[port]		win32: handle ERROR_MORE_DATA. [RT #43534]

 4517.	[security]	Named could mishandle authority sections that were
 			missing RRSIGs triggering an assertion failure.
 			(CVE-2016-9444) [RT # 43632]

+4515.	[port]		FreeBSD: Find readline headers when they are in
+			edit/readline/ instead of readline/. [RT #43658]
+
+4513.	[cleanup]	Minimum Python versions are now 2.7 and 3.2.
+			[RT #43566]
+
 4510.	[security]	Named mishandled some responses where covering RRSIG
 			records are returned without the requested data
 			resulting in a assertion failure. (CVE-2016-9147)
 			[RT #43548]

+4509.	[test]		Make the rrl system test more reliable on slower
+			machines by using mdig instead of dig. [RT #43280]
+
 4508.	[security]	Named incorrectly tried to cache TKEY records which
 			could trigger a assertion failure when there was
 			a class mismatch. (CVE-2016-9131) [RT #43522]

-	--- 9.9.9-P4 released ---
+4507.	[bug]		Named could incorrectly log 'allows updates by IP
+			address, which is insecure' [RT #43432]
+
+4505.	[port]		Use IP_PMTUDISC_OMIT if available. [RT #35494]
+
+4504.	[security]	Allow the maximum number of records in a zone to
+			be specified.  This provides a control for issues
+			raised in CVE-2016-6170. [RT #42143]
+
+4503.	[cleanup]	"make uninstall" now removes files installed by
+			BIND. (This currently excludes Python files
+			due to lack of support in setup.py.) [RT #42912]
+
+4502.	[func]		Report multiple and experimental options when printing
+			grammar. [RT #43134]
+
+4501.	[bug]		Fix 'dig -4 -6'/'dig -6 -4' error handling. [RT #43259]
+
+4500.	[bug]		Support modifier I64 in isc__print_printf. [RT #43526]
+
+4499.	[port]		MacOSX: silence deprecated function warning
+			by using arc4random_stir() when available
+			instead of arc4random_addrandom(). [RT #43503]
+
+4498.	[test]		Simplify prerequisite checks in system tests.
+			[RT #43516]
+
+4497.	[port]		Add support for OpenSSL 1.1.0. [RT #41284]
+
+4496.	[func]		dig: add +idnout to control whether labels are
+			display in punycode or not.  Requires idn support
+			to be enabled at compile time. [RT #43398]
+
+4494.	[bug]		Look for <editline/readline.h>. [RT #43429]
+
+4492.	[bug]		irs_resconf_load failed to initialize sortlistnxt
+			causing bad writes if resolv.conf contained a
+			sortlist directive. [RT #43459]
+
+4490.	[maint]		Added AAAA (2001:500:12::d0d) for G.ROOT-SERVERS.NET.

 4489.	[security]	It was possible to trigger assertions when processing
-			a response. (CVE-2016-8864) [RT #43465]
+			a response containing a DNAME answer. (CVE-2016-8864)
+			[RT #43465]

-	--- 9.9.9-P3 released ---
+4488.	[port]		Darwin: use -framework for Kerberos. [RT #43418]

-4467.	[security]	It was possible to trigger a assertion when rendering
-			a message. (CVE-2016-2776) [RT #43139]
+4486.	[bug]		Look in $prefix/lib/pythonX.Y/site-packages for
+			the python modules we install. [RT #43330]

-	--- 9.9.9-P2 released ---
+4485.	[bug]		Failure to find readline when requested should be
+			fatal to configure. [RT #43328]

-4406.	[bug]		getrrsetbyname with a non absolute name could
+4484.	[func]		Check prefixes in acls to make sure the address and
+			prefix lengths are consistent.  Warn only in
+			BIND 9.11 and earlier. [RT #43367]
+
+4483.	[bug]		Address use before require check and remove extraneous
+			dns_message_gettsigkey call in dns_tsig_sign.
+			[RT #43374]
+
+4476.	[test]		Fix reclimit test on slower machines. [RT #43283]
+
+4475.	[doc]		Update named-checkconf documentation. [RT #43153]
+
+4474.	[bug]		win32: call WSAStartup in fromtext_in_wks so that
+			getprotobyname and getservbyname work.  [RT #43197]
+
+4473.	[bug]		Only call fsync / _commit on regular files. [RT #43196]
+
+4472.	[bug]		Named could fail to find the correct NSEC3 records when
+			a zone was updated between looking for the answer and
+			looking for the NSEC3 records proving nonexistence
+			of the answer. [RT #43247]
+
+4471.	[cleanup]	Revert a query logging change inadvertently
+			backported from 9.11. [RT #43238]
+
+4467.	[security]	It was possible to trigger an assertion when
+			rendering a message. (CVE-2016-2776) [RT #43139]
+
+4466.	[bug]		Interface scanning didn't work on a Windows system
+			without a non local IPv6 addresses. [RT #43130]
+
+4464.	[bug]		Fix windows python support. [RT #43173]
+
+4461.	[bug]		win32: not all external data was properly marked
+			as external data for windows dll. [RT #43161]
+
+4458.	[cleanup]	Update assertions to be more correct, and also remove
+			use of a reserved word. [RT #43090]
+
+4457.	[maint]		Added AAAA (2001:500:a8::e) for E.ROOT-SERVERS.NET.
+
+4456.	[doc]		Add DOCTYPE and lang attribute to <html> tags.
+			[RT #42587]
+
+4448.	[bug]		win32: ::1 was not being found when iterating
+			interfaces. [RT #42993]
+
+4445.	[cleanup]	isc_errno_toresult() can now be used to call the
+			formerly private function isc__errno2result().
+			[RT #43050]
+
+4443.	[func]		Set TCP_MAXSEG in addition to IPV6_USE_MIN_MTU on
+			TCP sockets. [RT #42864]
+
+4441.	[cleanup]	Alphabetize host's help output. [RT #43031]
+
+4433.	[cleanup]	Report an error when passing an invalid option or
+			view name to "rndc dumpdb". [RT #42958]
+
+4432.	[test]		Hide rndc output on expected failures in logfileconfig
+			system test. [RT #27996]
+
+4431.	[bug]		named-checkconf now checks the rate-limit clause.
+			[RT #42970]
+
+4430.	[bug]		Lwresd died if a search list was not defined.
+			Found by 0x710DDDD At Alibaba Security. [RT #42895]
+
+4425.	[bug]		arpaname was not being installed into ${prefix}/bin.
+			RT #42910]
+
+4423.	[maint]		Added missing IPv6 address 2001:500:84::b for
+			B.ROOT-SERVERS.NET. [RT #42898]
+
+4422.	[port]		Silence clang warnings in dig.c and dighost.c.
+			[RT #42451]
+
+4418.	[bug]		Fix a compiler warning in GSSAPI code. [RT #42879]
+
+4414.	[bug]		Corrected a bug in the MIPS implementation of
+			isc_atomic_xadd(). [RT #41965]
+
+4413.	[bug]		GSSAPI negotiation could fail if GSS_S_CONTINUE_NEEDED
+			was returned. [RT #42733]
+
+4412.	[cleanup]	Make fixes for GCC 6. ISC_OFFSET_MAXIMUM macro was
+			removed. [RT #42721]
+
+4409.	[bug]		DNS64 should exclude mapped addresses by default when
+			an exclude acl is not defined. [RT #42810]
+
+4406.	[security]	getrrsetbyname with a non absolute name could
 			trigger an infinite recursion bug in lwresd
 			and named with lwres configured if when combined
 			with a search list entry the resulting name is
@@ -52,10 +282,44 @@
 			not remove a delegation in a NSEC3 signed zone using
 			OPTOUT via nsupdate. [RT #42702]

+4404.	[misc]		Allow krb5-config to be used when configuring gssapi.
+			[RT #42580]
+
+4403.	[bug]		Rename variables and arguments that shadow: basename,
+			clone and gai_error.
+
+4397.	[bug]		Update Windows python support. [RT #42538]
+
+4395.	[bug]		Improve out-of-tree installation of python modules.
+			[RT #42586]
+
 4387.	[bug]		Change 4336 was not complete leading to SERVFAIL
 			being return as NS records expired. [RT #42683]

-	--- 9.9.9-P1 released ---
+4384.	[bug]		Change 4256 accidentally disabled logging of the
+			rndc command. [RT #42654]
+
+4379.	[bug]		An INSIST could be triggered if a zone contains
+			RRSIG records with expiry fields that loop
+			using serial number arithmetic. [RT #40571]
+
+4378.	[contrib]	#include <isc/string.h> for strlcat in zone2ldap.c.
+			[RT #42525]
+
+4377.	[bug]		Don't reuse zero TTL responses beyond the current
+			client set (excludes ANY/SIG/RRSIG queries).
+			[RT #42142]
+
+4374.	[bug]		Use SAVE/RESTORE macros in query.c to reduce the
+			probability of reference counting errors as seen
+			in 4365. [RT #42405]
+
+4373.	[bug]		Address undefined behavior in getaddrinfo. [RT #42479]
+
+4372.	[bug]		Address undefined behavior in libt_api. [RT #42480]
+
+4369.	[bug]		Fix 'make' and 'make install' out-of-tree python
+			support. [RT #42484]

 4366.	[bug]		Address race condition when updating rbtnode bit
 			fields. [RT #42379]
@@ -63,6 +327,35 @@
 4363.	[port]		win32: Disable explicit triggering UAC when running
 			BINDInstall.

+4361.	[cleanup]	Where supported, file modification times returned
+			by isc_file_getmodtime() are now accurate to the
+			nanosecond. [RT #41968]
+
+4360.	[bug]		Silence spurious 'bad key type' message when there is
+			a existing TSIG key. [RT #42195]
+
+4359.	[bug]		Inherited 'also-notify' lists were not being checked
+			by named-checkconf. [RT #42174]
+
+4354.	[bug]		Check that the received HMAC length matches the
+			expected length prior to check the contents on the
+			control channel.  This prevents a OOB read error.
+			This was reported by Lian Yihan, <lianyihan@360.cn>.
+			[RT #42215]
+
+4353.	[cleanup]	Update PKCS#11 header files. [RT #42175]
+
+4352.	[cleanup]	The ISC DNSSEC Lookaside Validation (DLV) service
+			is scheduled to be disabled in 2017.  A warning is
+			now logged when named is configured to use it,
+			either explicitly or via "dnssec-lookaside auto;"
+			[RT #42207]
+
+4351.	[bug]		'dig +noignore' didn't work. [RT #42273]
+
+4348.	[cleanup]	Refactor dnssec-coverage and dnssec-checkds
+			functionality into an "isc" python module. [RT #39211]
+
 	--- 9.9.9 released ---

 	--- 9.9.9rc1 released ---
@@ -866,7 +1159,7 @@
 3995.	[bug]		receive_secure_serial holds the zone lock for too
 			long. [RT #37626]

-3990.	[testing]	Add tests for unknown DNSSEC algorithm handling.
+3990.	[test]		Add tests for unknown DNSSEC algorithm handling.
 			[RT #37541]

 3989.	[cleanup]	Remove redundant dns_db_resigned calls. [RT #35748]
@@ -1,4 +1,4 @@
-Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2017  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.

 Permission to use, copy, modify, and/or distribute this software for any
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2010, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2010, 2013-2017  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -31,6 +31,7 @@
      <year>2014</year>
      <year>2015</year>
      <year>2016</year>
+      <year>2017</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2009, 2011-2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2009, 2011-2016  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -64,6 +64,13 @@ install:: isc-config.sh installdirs
 	@LN@ ${DESTDIR}${mandir}/man1/isc-config.sh.1 ${DESTDIR}${mandir}/man1/bind9-config.1
 	${INSTALL_DATA} ${top_srcdir}/bind.keys ${DESTDIR}${sysconfdir}

+uninstall::
+	rm -f ${DESTDIR}${sysconfdir}/bind.keys
+	rm -f ${DESTDIR}${mandir}/man1/bind9-config.1
+	rm -f ${DESTDIR}${mandir}/man1/isc-config.sh.1
+	rm -f ${DESTDIR}${bindir}/bind9-config
+	rm -f ${DESTDIR}${bindir}/isc-config.sh
+
 tags:
 	rm -f TAGS
 	find lib bin -name "*.[ch]" -print | @ETAGS@ -
@@ -51,44 +51,19 @@ BIND 9
 	For up-to-date release notes and errata, see
 	http://www.isc.org/software/bind9/releasenotes

-BIND 9.9.9-P6
+BIND 9.9.10
+	
+	BIND 9.9.10 is a maintenance release and addresses the security
+	flaws disclosed in CVE-2016-2775, CVE-2016-2776, CVE-2016-6170,
+	CVE-2016-8864, CVE-2016-9131, CVE-2016-9147, CVE-2016-9444,
+	and CVE-2017-3135.

-	This version contains a fix for CVE-2017-3135, and a bug fix
-	for a regression in CNAME/DNAME caching that was introduced
-	in an earlier security release.
-
-BIND 9.9.9-P5
-
-	This version contains fixes for CVE-2016-9131, CVE-2016-9147,
-	CVE-2016-9444 and CVE-2016-9778.
-
-BIND 9.9.9-P4
-
-	This version contains a fix for CVE-2016-8864.
-
-BIND 9.9.9-P3
-
-	This version contains a fix for CVE-2016-2776.
-
-BIND 9.9.9-P2
-
-	This version contains a fix for CVE-2016-2775 and addresses
-	two regressions introduced with BIND 9.9.9.
-
-BIND 9.9.9-P1
-
-	This version contains two urgent fixes to BIND 9.9.9:
-	1) Windows installation was failing without manual updating
-	   of BINDinstall's attributes.
-	2) A race condition was causing instability in the rbt
-	   tree state.
-
-BIND 9.9.9
+BIND 9.9.91

 	BIND 9.9.9 is a maintenance release and addresses bugs found
 	in BIND 9.9.8 and earlier, as well as the security flaws
 	described in CVE-2015-8000, CVE-2015-8461, CVE-2015-8704,
-	CVE-2016-1285, and CVE-2016-1286.
+	CVE-2016-1285, CVE-2016-1286, CVE-2016-2775 and CVE-2016-2776.

 BIND 9.9.8

@@ -324,12 +299,15 @@ Building
 	configure command line.

 	For the server to support DNSSEC, you need to build it
-	with crypto support.  You must have OpenSSL 0.9.5a
+	with crypto support.  You must have OpenSSL 1.0.1t
 	or newer installed and specify "--with-openssl" on the
 	configure command line.  If OpenSSL is installed under
 	a nonstandard prefix, you can tell configure where to
 	look for it using "--with-openssl=/prefix".

+	Python requires 'argparse' to be available.  'argparse' is
+	a standard module as of Python 2.7 and Python 3.2.
+
 	On some platforms it is necessary to explicitly request large
 	file support to handle files bigger than 2GB.  This can be
 	done by "--enable-largefile" on the configure command line.
@@ -70,12 +70,6 @@
 /** define if gai_strerror() exists */
 #undef HAVE_GAISTRERROR

-/** define if arc4random() exists */
-#undef HAVE_ARC4RANDOM
-
-/** define if arc4random_addrandom() exists */
-#undef HAVE_ARC4RANDOM_ADDRANDOM
-
 /**
 * define if pthread_setconcurrency() should be called to tell the
 * OS how many threads we might want to run.
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2007, 2009, 2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2007, 2009, 2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -96,5 +96,12 @@ install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
 	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
 	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)

+uninstall::
+	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+	rm -f ${DESTDIR}${sbindir}/named-compilezone@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkconf@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkzone@EXEEXT@
+
 clean distclean::
 	rm -f ${TARGETS} r1.htm
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -48,7 +48,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-h\fR] [\fB\-v\fR] [\fB\-j\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename} [\fB\-p\fR] [\fB\-x\fR] [\fB\-z\fR]
+\fBnamed\-checkconf\fR [\fB\-hjvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -78,11 +78,26 @@ can be run on these files explicitly, however\&.
 Print the usage summary and exit\&.
 .RE
 .PP
+\-j
+.RS 4
+When loading a zonefile read the journal if it exists\&.
+.RE
+.PP
+\-p
+.RS 4
+Print out the
+named\&.conf
+and included files in canonical form if no errors were detected\&. See also the
+\fB\-x\fR
+option\&.
+.RE
+.PP
 \-t \fIdirectory\fR
 .RS 4
 Chroot to
 directory
-so that include directives in the configuration file are processed as if run by a similarly chrooted named\&.
+so that include directives in the configuration file are processed as if run by a similarly chrooted
+\fBnamed\fR\&.
 .RE
 .PP
 \-v
@@ -92,13 +107,6 @@ Print the version of the
 program and exit\&.
 .RE
 .PP
-\-p
-.RS 4
-Print out the
-named\&.conf
-and included files in canonical form if no errors were detected\&.
-.RE
-.PP
 \-x
 .RS 4
 When printing the configuration files in canonical form, obscure shared secrets by replacing them with strings of question marks (\*(Aq?\*(Aq)\&. This allows the contents of
@@ -113,11 +121,6 @@ Perform a test load of all master zones found in
 named\&.conf\&.
 .RE
 .PP
-\-j
-.RS 4
-When loading a zonefile read the journal if it exists\&.
-.RE
-.PP
 filename
 .RS 4
 The name of the configuration file to be checked\&. If not specified, it defaults to
@@ -137,7 +140,7 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000-2002 Internet Software Consortium.
 .br
@@ -68,7 +68,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;

 static void
 usage(void) {
-	fprintf(stderr, "usage: %s [-h] [-j] [-p] [-v] [-z] [-t directory] "
+	fprintf(stderr, "usage: %s [-hjvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n", program);
 	exit(1);
 }
@@ -1,7 +1,7 @@
 <!DOCTYPE book [
 <!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2009, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named-checkconf">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named-checkconf">
  <info>
    <date>2014-01-10</date>
  </info>
@@ -41,6 +41,7 @@
      <year>2009</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -59,14 +60,12 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>named-checkconf</command>
-      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-v</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-j</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-hjvz</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-p</option>
+	<arg choice="opt" rep="norepeat"><option>-x</option>
+      </arg></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="req" rep="norepeat">filename</arg>
-      <arg choice="opt" rep="norepeat"><option>-p</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-x</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
    </cmdsynopsis>
  </refsynopsisdiv>

@@ -93,7 +92,6 @@

  <refsection><info><title>OPTIONS</title></info>

-
    <variablelist>
      <varlistentry>
        <term>-h</term>
@@ -105,22 +103,10 @@
      </varlistentry>

      <varlistentry>
-        <term>-t <replaceable class="parameter">directory</replaceable></term>
+        <term>-j</term>
        <listitem>
          <para>
-            Chroot to <filename>directory</filename> so that include
-            directives in the configuration file are processed as if
-            run by a similarly chrooted named.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term>-v</term>
-        <listitem>
-          <para>
-            Print the version of the <command>named-checkconf</command>
-            program and exit.
+            When loading a zonefile read the journal if it exists.
          </para>
        </listitem>
      </varlistentry>
@@ -131,6 +117,28 @@
          <para>
 	    Print out the <filename>named.conf</filename> and included files
 	    in canonical form if no errors were detected.
+            See also the <option>-x</option> option.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-t <replaceable class="parameter">directory</replaceable></term>
+        <listitem>
+          <para>
+            Chroot to <filename>directory</filename> so that include
+            directives in the configuration file are processed as if
+            run by a similarly chrooted <command>named</command>.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-v</term>
+        <listitem>
+          <para>
+            Print the version of the <command>named-checkconf</command>
+            program and exit.
          </para>
        </listitem>
      </varlistentry>
@@ -160,15 +168,6 @@
        </listitem>
      </varlistentry>

-      <varlistentry>
-        <term>-j</term>
-        <listitem>
-          <para>
-            When loading a zonefile read the journal if it exists.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>filename</term>
        <listitem>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named-checkconf</title>
@@ -22,24 +23,45 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.named-checkconf"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">named-checkconf</span> &#8212; named configuration file syntax checking tool</p>
+<p>
+    <span class="application">named-checkconf</span>
+     &#8212; named configuration file syntax checking tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-h</code>] [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-p</code>] [<code class="option">-x</code>] [<code class="option">-z</code>]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">named-checkconf</code> 
+       [<code class="option">-hjvz</code>]
+       [<code class="option">-p</code>
+	 [<code class="option">-x</code>
+      ]]
+       [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>]
+       {filename}
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>named-checkconf</strong></span>
+
+    <p><span class="command"><strong>named-checkconf</strong></span>
      checks the syntax, but not the semantics, of a
      <span class="command"><strong>named</strong></span> configuration file.  The file is parsed
      and checked for syntax errors, along with all files included by it.
      If no file is specified, <code class="filename">/etc/named.conf</code> is read
      by default.
    </p>
-<p>
+    <p>
      Note: files that <span class="command"><strong>named</strong></span> reads in separate
      parser contexts, such as <code class="filename">rndc.key</code> and
      <code class="filename">bind.keys</code>, are not automatically read
@@ -49,32 +71,50 @@
      successful.  <span class="command"><strong>named-checkconf</strong></span> can be run
      on these files explicitly, however.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+          <p>
            Print the usage summary and exit.
-          </p></dd>
-<dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
-            Chroot to <code class="filename">directory</code> so that include
-            directives in the configuration file are processed as if
-            run by a similarly chrooted named.
-          </p></dd>
-<dt><span class="term">-v</span></dt>
-<dd><p>
-            Print the version of the <span class="command"><strong>named-checkconf</strong></span>
-            program and exit.
-          </p></dd>
+          </p>
+        </dd>
+<dt><span class="term">-j</span></dt>
+<dd>
+          <p>
+            When loading a zonefile read the journal if it exists.
+          </p>
+        </dd>
 <dt><span class="term">-p</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Print out the <code class="filename">named.conf</code> and included files
 	    in canonical form if no errors were detected.
-          </p></dd>
+            See also the <code class="option">-x</code> option.
+          </p>
+        </dd>
+<dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
+<dd>
+          <p>
+            Chroot to <code class="filename">directory</code> so that include
+            directives in the configuration file are processed as if
+            run by a similarly chrooted <span class="command"><strong>named</strong></span>.
+          </p>
+        </dd>
+<dt><span class="term">-v</span></dt>
+<dd>
+          <p>
+            Print the version of the <span class="command"><strong>named-checkconf</strong></span>
+            program and exit.
+          </p>
+        </dd>
 <dt><span class="term">-x</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    When printing the configuration files in canonical
            form, obscure shared secrets by replacing them with
            strings of question marks ('?'). This allows the
@@ -82,36 +122,46 @@
            files to be shared &#8212; for example, when submitting
            bug reports &#8212; without compromising private data.
            This option cannot be used without <code class="option">-p</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-z</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Perform a test load of all master zones found in
 	    <code class="filename">named.conf</code>.
-          </p></dd>
-<dt><span class="term">-j</span></dt>
-<dd><p>
-            When loading a zonefile read the journal if it exists.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">filename</span></dt>
-<dd><p>
+<dd>
+          <p>
            The name of the configuration file to be checked.  If not
            specified, it defaults to <code class="filename">/etc/named.conf</code>.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>RETURN VALUES</h2>
-<p><span class="command"><strong>named-checkconf</strong></span>
+
+    <p><span class="command"><strong>named-checkconf</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">named</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named-checkzone</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-</div>
+  </div>
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2009-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2009-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -318,7 +318,7 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2009-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2009-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000-2002 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2007, 2009-2011, 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2009-2011, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named-checkzone">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named-checkzone">
  <info>
    <date>2013-04-29</date>
  </info>
@@ -43,6 +43,7 @@
      <year>2013</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2009-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2009-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named-checkzone</title>
@@ -22,24 +23,90 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.named-checkzone"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">named-checkzone</span>, <span class="application">named-compilezone</span> &#8212; zone file validity checking or converting tool</p>
+<p>
+    <span class="application">named-checkzone</span>, 
+    <span class="application">named-compilezone</span>
+     &#8212; zone file validity checking or converting tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [<code class="option">-d</code>] [<code class="option">-h</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {zonename} {filename}</p></div>
-<div class="cmdsynopsis"><p><code class="command">named-compilezone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-f <em class="replaceable"><code>format</code></em></code>] [<code class="option">-F <em class="replaceable"><code>format</code></em></code>] [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-s <em class="replaceable"><code>style</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>] {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>} {zonename} {filename}</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">named-checkzone</code> 
+       [<code class="option">-d</code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-j</code>]
+       [<code class="option">-q</code>]
+       [<code class="option">-v</code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>format</code></em></code>]
+       [<code class="option">-F <em class="replaceable"><code>format</code></em></code>]
+       [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-M <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>]
+       [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>style</code></em></code>]
+       [<code class="option">-S <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-D</code>]
+       [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>]
+       {zonename}
+       {filename}
+    </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">named-compilezone</code> 
+       [<code class="option">-d</code>]
+       [<code class="option">-j</code>]
+       [<code class="option">-q</code>]
+       [<code class="option">-v</code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-C <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>format</code></em></code>]
+       [<code class="option">-F <em class="replaceable"><code>format</code></em></code>]
+       [<code class="option">-i <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-m <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>style</code></em></code>]
+       [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>mode</code></em></code>]
+       [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-D</code>]
+       [<code class="option">-W <em class="replaceable"><code>mode</code></em></code>]
+       {<code class="option">-o <em class="replaceable"><code>filename</code></em></code>}
+       {zonename}
+       {filename}
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>named-checkzone</strong></span>
+
+    <p><span class="command"><strong>named-checkzone</strong></span>
      checks the syntax and integrity of a zone file.  It performs the
      same checks as <span class="command"><strong>named</strong></span> does when loading a
      zone.  This makes <span class="command"><strong>named-checkzone</strong></span> useful for
      checking zone files before configuring them into a name server.
    </p>
-<p>
+    <p>
        <span class="command"><strong>named-compilezone</strong></span> is similar to
 	<span class="command"><strong>named-checkzone</strong></span>, but it always dumps the
        zone contents to a specified file in a specified format.
@@ -50,38 +117,53 @@
        least be as strict as those specified in the
 	<span class="command"><strong>named</strong></span> configuration file.
     </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-d</span></dt>
-<dd><p>
+<dd>
+          <p>
            Enable debugging.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+          <p>
            Print the usage summary and exit.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-q</span></dt>
-<dd><p>
+<dd>
+          <p>
            Quiet mode - exit code only.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-v</span></dt>
-<dd><p>
+<dd>
+          <p>
            Print the version of the <span class="command"><strong>named-checkzone</strong></span>
            program and exit.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-j</span></dt>
-<dd><p>
+<dd>
+          <p>
            When loading the zone file read the journal if it exists.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specify the class of the zone.  If not specified, "IN" is assumed.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-i <em class="replaceable"><code>mode</code></em></span></dt>
 <dd>
-<p>
+	  <p>
 	      Perform post-load zone integrity checks.  Possible modes are
 	      <span class="command"><strong>"full"</strong></span> (default),
 	      <span class="command"><strong>"full-sibling"</strong></span>,
@@ -89,19 +171,19 @@
 	      <span class="command"><strong>"local-sibling"</strong></span> and
 	      <span class="command"><strong>"none"</strong></span>.
 	  </p>
-<p>
+	  <p>
 	      Mode <span class="command"><strong>"full"</strong></span> checks that MX records
 	      refer to A or AAAA record (both in-zone and out-of-zone
 	      hostnames).  Mode <span class="command"><strong>"local"</strong></span> only
 	      checks MX records which refer to in-zone hostnames.
 	  </p>
-<p>
+	  <p>
 	      Mode <span class="command"><strong>"full"</strong></span> checks that SRV records
 	      refer to A or AAAA record (both in-zone and out-of-zone
 	      hostnames).  Mode <span class="command"><strong>"local"</strong></span> only
 	      checks SRV records which refer to in-zone hostnames.
 	  </p>
-<p>
+	  <p>
 	      Mode <span class="command"><strong>"full"</strong></span> checks that delegation NS
 	      records refer to A or AAAA record (both in-zone and out-of-zone
 	      hostnames).  It also checks that glue address records
@@ -110,31 +192,33 @@
 	      refer to in-zone hostnames or that some required glue exists,
 	      that is when the nameserver is in a child zone.
 	  </p>
-<p>
+	  <p>
 	      Mode <span class="command"><strong>"full-sibling"</strong></span> and
 	      <span class="command"><strong>"local-sibling"</strong></span> disable sibling glue
 	      checks but are otherwise the same as <span class="command"><strong>"full"</strong></span>
 	      and <span class="command"><strong>"local"</strong></span> respectively.
 	  </p>
-<p>
+	  <p>
 	      Mode <span class="command"><strong>"none"</strong></span> disables the checks.
 	  </p>
-</dd>
+	</dd>
 <dt><span class="term">-f <em class="replaceable"><code>format</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Specify the format of the zone file.
 	    Possible formats are <span class="command"><strong>"text"</strong></span> (default)
 	    and <span class="command"><strong>"raw"</strong></span>.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-F <em class="replaceable"><code>format</code></em></span></dt>
 <dd>
-<p>
+	  <p>
 	    Specify the format of the output file specified.
 	    For <span class="command"><strong>named-checkzone</strong></span>,
 	    this does not cause any effects unless it dumps the zone
 	    contents.
 	  </p>
-<p>
+	  <p>
 	    Possible formats are <span class="command"><strong>"text"</strong></span> (default)
 	    and <span class="command"><strong>"raw"</strong></span> or <span class="command"><strong>"raw=N"</strong></span>,
            which store the zone in a binary format for rapid loading
@@ -144,9 +228,10 @@
            <span class="command"><strong>named</strong></span>; if N is 1, the file can be read
            by release 9.9.0 or higher.  The default is 1.
 	  </p>
-</dd>
+	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Perform <span class="command"><strong>"check-names"</strong></span> checks with the
 	    specified failure mode.
            Possible modes are <span class="command"><strong>"fail"</strong></span>
@@ -154,29 +239,37 @@
            <span class="command"><strong>"warn"</strong></span>
 	    (default for <span class="command"><strong>named-checkzone</strong></span>) and
            <span class="command"><strong>"ignore"</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            When compiling a zone to 'raw' format, set the "source serial"
            value in the header to the specified serial number.  (This is
            expected to be used primarily for testing purposes.)
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-m <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specify whether MX records should be checked to see if they
            are addresses.  Possible modes are <span class="command"><strong>"fail"</strong></span>,
            <span class="command"><strong>"warn"</strong></span> (default) and
            <span class="command"><strong>"ignore"</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-M <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Check if a MX record refers to a CNAME.
            Possible modes are <span class="command"><strong>"fail"</strong></span>,
            <span class="command"><strong>"warn"</strong></span> (default) and
            <span class="command"><strong>"ignore"</strong></span>.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-n <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specify whether NS records should be checked to see if they
            are addresses.
 	    Possible modes are <span class="command"><strong>"fail"</strong></span>
@@ -184,24 +277,30 @@
            <span class="command"><strong>"warn"</strong></span>
 	    (default for <span class="command"><strong>named-checkzone</strong></span>) and
            <span class="command"><strong>"ignore"</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-o <em class="replaceable"><code>filename</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Write zone output to <code class="filename">filename</code>.
 	    If <code class="filename">filename</code> is <code class="filename">-</code> then
 	    write to standard out.
 	    This is mandatory for <span class="command"><strong>named-compilezone</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-r <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
            Check for records that are treated as different by DNSSEC but
 	    are semantically equal in plain DNS.
            Possible modes are <span class="command"><strong>"fail"</strong></span>,
            <span class="command"><strong>"warn"</strong></span> (default) and
            <span class="command"><strong>"ignore"</strong></span>.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>style</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Specify the style of the dumped zone file.
 	    Possible styles are <span class="command"><strong>"full"</strong></span> (default)
 	    and <span class="command"><strong>"relative"</strong></span>.
@@ -214,74 +313,101 @@
 	    contents.
 	    It also does not have any meaning if the output format
 	    is not text.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-S <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Check if a SRV record refers to a CNAME.
            Possible modes are <span class="command"><strong>"fail"</strong></span>,
            <span class="command"><strong>"warn"</strong></span> (default) and
            <span class="command"><strong>"ignore"</strong></span>.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Chroot to <code class="filename">directory</code> so that
            include
            directives in the configuration file are processed as if
            run by a similarly chrooted named.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Check if Sender Policy Framework (SPF) records exist
 	    and issues a warning if an SPF-formatted TXT record is
 	    not also present.  Possible modes are <span class="command"><strong>"warn"</strong></span>
 	    (default), <span class="command"><strong>"ignore"</strong></span>.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-w <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            chdir to <code class="filename">directory</code> so that
            relative
            filenames in master file $INCLUDE directives work.  This
            is similar to the directory clause in
            <code class="filename">named.conf</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-D</span></dt>
-<dd><p>
+<dd>
+          <p>
            Dump zone file in canonical format.
 	    This is always enabled for <span class="command"><strong>named-compilezone</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-W <em class="replaceable"><code>mode</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specify whether to check for non-terminal wildcards.
            Non-terminal wildcards are almost always the result of a
            failure to understand the wildcard matching algorithm (RFC 1034).
            Possible modes are <span class="command"><strong>"warn"</strong></span> (default)
            and
            <span class="command"><strong>"ignore"</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">zonename</span></dt>
-<dd><p>
+<dd>
+          <p>
            The domain name of the zone being checked.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">filename</span></dt>
-<dd><p>
+<dd>
+          <p>
            The name of the zone file.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>RETURN VALUES</h2>
-<p><span class="command"><strong>named-checkzone</strong></span>
+
+    <p><span class="command"><strong>named-checkzone</strong></span>
      returns an exit status of 1 if
      errors were detected and 0 otherwise.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">named</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named-checkconf</span>(8)
+      </span>,
      <em class="citetitle">RFC 1035</em>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-# Copyright (C) 2009, 2012, 2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009, 2012, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -97,5 +97,13 @@ install:: rndc-confgen@EXEEXT@ ddns-confgen@EXEEXT@ installdirs
 	${INSTALL_DATA} ${srcdir}/rndc-confgen.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/ddns-confgen.8 ${DESTDIR}${mandir}/man8

+uninstall::
+	rm -f ${DESTDIR}${mandir}/man8/tsig-keygen.8
+	rm -f ${DESTDIR}${sbindir}/tsig-keygen@EXEEXT@
+	rm -f ${DESTDIR}${mandir}/man8/ddns-confgen.8
+	rm -f ${DESTDIR}${mandir}/man8/rndc-confgen.8
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/ddns-confgen@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/rndc-confgen@EXEEXT@
+
 clean distclean maintainer-clean::
 	rm -f ${TARGETS}
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -155,5 +155,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2009, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.ddns-confgen">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.ddns-confgen">
  <info>
    <date>2009-09-18</date>
  </info>
@@ -40,6 +40,7 @@
      <year>2009</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>ddns-confgen</title>
@@ -21,17 +22,42 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.ddns-confgen"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">ddns-confgen</span> &#8212; ddns key generation tool</p>
+<p>
+    <span class="application">ddns-confgen</span>
+     &#8212; ddns key generation tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">ddns-confgen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em>  |   -z <em class="replaceable"><code>zone</code></em> ] [<code class="option">-q</code>] [name]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">ddns-confgen</code> 
+       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
+       [
+         -s <em class="replaceable"><code>name</code></em> 
+         |   -z <em class="replaceable"><code>zone</code></em> 
+      ]
+       [<code class="option">-q</code>]
+       [name]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>ddns-confgen</strong></span>
+
+    <p><span class="command"><strong>ddns-confgen</strong></span>
      generates a key for use by <span class="command"><strong>nsupdate</strong></span>
      and <span class="command"><strong>named</strong></span>.  It simplifies configuration
      of dynamic zones by generating a key and providing the
@@ -39,7 +65,8 @@
      syntax that will be needed to use it, including an example
      <span class="command"><strong>update-policy</strong></span> statement.
    </p>
-<p>
+
+    <p>
      If a domain name is specified on the command line, it will
      be used in the name of the generated key and in the sample
      <span class="command"><strong>named.conf</strong></span> syntax.  For example,
@@ -48,30 +75,39 @@
      <span class="command"><strong>named.conf</strong></span> command that could be used
      in the zone definition for "example.com".
    </p>
-<p>
+
+    <p>
      Note that <span class="command"><strong>named</strong></span> itself can configure a
      local DDNS key for use with <span class="command"><strong>nsupdate -l</strong></span>.
      <span class="command"><strong>ddns-confgen</strong></span> is only needed when a
      more elaborate configuration is required: for instance, if
      <span class="command"><strong>nsupdate</strong></span> is to be used from a remote system.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
            Specifies the algorithm to use for the TSIG key.  Available
            choices are: hmac-md5, hmac-sha1, hmac-sha224, hmac-sha256,
            hmac-sha384 and hmac-sha512.  The default is hmac-sha256.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints a short summary of the options and arguments to
 	    <span class="command"><strong>ddns-confgen</strong></span>.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyname</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Specifies the key name of the DDNS authentication key.
 	    The default is <code class="constant">ddns-key</code> when neither
 	    the <code class="option">-s</code> nor <code class="option">-z</code> option is
@@ -81,14 +117,18 @@
 	    <code class="constant">ddns-key.example.com.</code>
 	    The key name must have the format of a valid domain name,
 	    consisting of letters, digits, hyphens and periods.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-q</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Quiet mode:  Print only the key, with no explanatory text or
            usage examples.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
            Specifies a source of random data for generating the
            authorization.  If the operating system does not provide a
            <code class="filename">/dev/random</code> or equivalent device, the
@@ -98,9 +138,11 @@
            instead of the default.  The special value
            <code class="filename">keyboard</code> indicates that keyboard input
            should be used.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-s <em class="replaceable"><code>name</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Single host mode: The example <span class="command"><strong>named.conf</strong></span> text
 	    shows how to set an update policy for the specified
 	    <em class="replaceable"><code>name</code></em>
@@ -110,9 +152,11 @@
 	    Note that the "self" nametype cannot be used, since
 	    the name to be updated may differ from the key name.
 	    This option cannot be used with the <code class="option">-z</code> option.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-z <em class="replaceable"><code>zone</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    zone mode:  The example <span class="command"><strong>named.conf</strong></span> text
            shows how to set an update policy for the specified
 	    <em class="replaceable"><code>zone</code></em>
@@ -120,16 +164,26 @@
 	    names within
 	    that <em class="replaceable"><code>zone</code></em>.
 	    This option cannot be used with the <code class="option">-s</code> option.
-	  </p></dd>
+	  </p>
+	</dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+
+    <p><span class="citerefentry">
+	<span class="refentrytitle">nsupdate</span>(1)
+      </span>,
+      <span class="citerefentry">
+	<span class="refentrytitle">named.conf</span>(5)
+      </span>,
+      <span class="citerefentry">
+	<span class="refentrytitle">named</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -221,7 +221,7 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2001, 2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2009, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2001, 2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.rndc-confgen">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.rndc-confgen">
  <info>
    <date>2009-06-15</date>
  </info>
@@ -44,6 +44,7 @@
      <year>2009</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004, 2005, 2007, 2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007, 2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2001, 2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>rndc-confgen</title>
@@ -22,17 +23,42 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.rndc-confgen"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">rndc-confgen</span> &#8212; rndc key generation tool</p>
+<p>
+    <span class="application">rndc-confgen</span>
+     &#8212; rndc key generation tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">rndc-confgen</code> 
+       [<code class="option">-a</code>]
+       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
+       [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>]
+       [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>address</code></em></code>]
+       [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>]
+       [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>rndc-confgen</strong></span>
+
+    <p><span class="command"><strong>rndc-confgen</strong></span>
      generates configuration files
      for <span class="command"><strong>rndc</strong></span>.  It can be used as a
      convenient alternative to writing the
@@ -45,13 +71,17 @@
      avoid the need for a <code class="filename">rndc.conf</code> file
      and a <span class="command"><strong>controls</strong></span> statement altogether.
    </p>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a</span></dt>
 <dd>
-<p>
+          <p>
            Do automatic <span class="command"><strong>rndc</strong></span> configuration.
            This creates a file <code class="filename">rndc.key</code>
            in <code class="filename">/etc</code> (or whatever
@@ -66,7 +96,7 @@
            <span class="command"><strong>named</strong></span> on the local host
            with no further configuration.
          </p>
-<p>
+          <p>
            Running <span class="command"><strong>rndc-confgen -a</strong></span> allows
            BIND 9 and <span class="command"><strong>rndc</strong></span> to be used as
            drop-in
@@ -74,7 +104,7 @@
            with no changes to the existing BIND 8
            <code class="filename">named.conf</code> file.
          </p>
-<p>
+          <p>
            If a more elaborate configuration than that
            generated by <span class="command"><strong>rndc-confgen -a</strong></span>
            is required, for example if rndc is to be used remotely,
@@ -85,36 +115,47 @@
            <code class="filename">named.conf</code>
            as directed.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the size of the authentication key in bits.
            Must be between 1 and 512 bits; the default is 128.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>keyfile</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Used with the <span class="command"><strong>-a</strong></span> option to specify
            an alternate location for <code class="filename">rndc.key</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+          <p>
            Prints a short summary of the options and arguments to
            <span class="command"><strong>rndc-confgen</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyname</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the key name of the rndc authentication key.
            This must be a valid domain name.
            The default is <code class="constant">rndc-key</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the command channel port where <span class="command"><strong>named</strong></span>
            listens for connections from <span class="command"><strong>rndc</strong></span>.
            The default is 953.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies a source of random data for generating the
            authorization.  If the operating
            system does not provide a <code class="filename">/dev/random</code>
@@ -125,24 +166,30 @@
            data to be used instead of the default.  The special value
            <code class="filename">keyboard</code> indicates that keyboard
            input should be used.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>address</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the IP address where <span class="command"><strong>named</strong></span>
            listens for command channel connections from
            <span class="command"><strong>rndc</strong></span>.  The default is the loopback
            address 127.0.0.1.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-t <em class="replaceable"><code>chrootdir</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Used with the <span class="command"><strong>-a</strong></span> option to specify
            a directory where <span class="command"><strong>named</strong></span> will run
            chrooted.  An additional copy of the <code class="filename">rndc.key</code>
            will be written relative to this directory so that
            it will be found by the chrooted <span class="command"><strong>named</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Used with the <span class="command"><strong>-a</strong></span> option to set the
            owner
            of the <code class="filename">rndc.key</code> file generated.
@@ -150,33 +197,45 @@
            <span class="command"><strong>-t</strong></span> is also specified only the file
            in
            the chroot area has its owner changed.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>EXAMPLES</h2>
-<p>
+
+    <p>
      To allow <span class="command"><strong>rndc</strong></span> to be used with
      no manual configuration, run
    </p>
-<p><strong class="userinput"><code>rndc-confgen -a</code></strong>
+    <p><strong class="userinput"><code>rndc-confgen -a</code></strong>
    </p>
-<p>
+    <p>
      To print a sample <code class="filename">rndc.conf</code> file and
      corresponding <span class="command"><strong>controls</strong></span> and <span class="command"><strong>key</strong></span>
      statements to be manually inserted into <code class="filename">named.conf</code>,
      run
    </p>
-<p><strong class="userinput"><code>rndc-confgen</code></strong>
+    <p><strong class="userinput"><code>rndc-confgen</code></strong>
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">rndc</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">rndc.conf</span>(5)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2005, 2007, 2009, 2012, 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005, 2007, 2009, 2012, 2013, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -105,3 +105,11 @@ install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
 	for m in ${MANPAGES}; do \
 		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1; \
 		done
+
+uninstall::
+	for m in ${MANPAGES}; do \
+		rm -f ${DESTDIR}${mandir}/man1/$$m ; \
+	done
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/nslookup@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/host@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/dig@EXEEXT@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -406,6 +406,11 @@ Show [or do not show] the IP address and port number that supplied the answer wh
 option is enabled\&. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer\&.
 .RE
 .PP
+\fB+[no]idnout\fR
+.RS 4
+Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
+.RE
+.PP
 \fB+[no]ignore\fR
 .RS 4
 Ignore truncation in UDP responses instead of retrying with TCP\&. By default, TCP retries are performed\&.
@@ -684,7 +689,7 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000-2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -67,7 +67,7 @@ static char domainopt[DNS_NAME_MAXTEXT];
 static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
 	ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
 	multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE,
-	onesoa = ISC_FALSE;
+	onesoa = ISC_FALSE, ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
 static isc_uint32_t splitwidth = 0xffffffff;

 /*% rrcomments are neither explicitly enabled nor disabled by default */
@@ -200,6 +200,7 @@ help(void) {
 "                 +[no]edns[=###]     (Set EDNS version) [0]\n"
 "                 +[no]fail           (Don't try next server on SERVFAIL)\n"
 "                 +[no]identify       (ID responders in short answers)\n"
+"                 +[no]idnout         (convert IDN response)\n"
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)"
 "\n"
 "                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
@@ -681,7 +682,7 @@ cleanup:
 static void
 printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 	int i;
-	int remaining;
+	size_t remaining;
 	static isc_boolean_t first = ISC_TRUE;
 	char append[MXNAME];

@@ -917,13 +918,29 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 	case 'i':
 		switch (cmd[1]) {
 		case 'd': /* identify */
-			FULLCHECK("identify");
-			lookup->identify = state;
+			switch (cmd[2]) {
+			case 'e':
+				FULLCHECK("identify");
+				lookup->identify = state;
+				break;
+			case 'n':
+				FULLCHECK("idnout");
+#ifndef WITH_IDN
+				fprintf(stderr, ";; IDN support not enabled\n");
+#else
+				lookup->idnout = state;
+#endif
+				break;
+			default:
+				goto invalid_option;
+			}
 			break;
 		case 'g': /* ignore */
-		default: /* Inherits default for compatibility */
+		default: /*
+			  * Inherits default for compatibility (+[no]i*).
+			  */
 			FULLCHECK("ignore");
-			lookup->ignore = ISC_TRUE;
+			lookup->ignore = state;
 		}
 		break;
 	case 'k':
@@ -1350,7 +1367,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		*open_type_class = ISC_FALSE;
 		tr.base = value;
-		tr.length = strlen(value);
+		tr.length = (unsigned int) strlen(value);
 		result = dns_rdataclass_fromtext(&rdclass,
 						 (isc_textregion_t *)&tr);
 		if (result == ISC_R_SUCCESS) {
@@ -1401,7 +1418,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			result = ISC_R_SUCCESS;
 		} else {
 			tr.base = value;
-			tr.length = strlen(value);
+			tr.length = (unsigned int) strlen(value);
 			result = dns_rdatatype_fromtext(&rdtype,
 						(isc_textregion_t *)&tr);
 			if (result == ISC_R_SUCCESS &&
@@ -1523,11 +1540,22 @@ preparse_args(int argc, char **argv) {
 			continue;
 		option = &rv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
-			if (option[0] == 'm') {
+			switch (option[0]) {
+			case 'm':
 				memdebugging = ISC_TRUE;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
-				return;
+				break;
+			case '4':
+				if (ipv6only)
+					fatal("only one of -4 and -6 allowed");
+				ipv4only = ISC_TRUE;
+				break;
+			case '6':
+				if (ipv4only)
+					fatal("only one of -4 and -6 allowed");
+				ipv6only = ISC_TRUE;
+				break;
 			}
 			option = &option[1];
 		}
@@ -1680,7 +1708,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 					result = ISC_R_SUCCESS;
 				} else {
 					tr.base = rv[0];
-					tr.length = strlen(rv[0]);
+					tr.length =
+						(unsigned int) strlen(rv[0]);
 					result = dns_rdatatype_fromtext(&rdtype,
 						(isc_textregion_t *)&tr);
 					if (result == ISC_R_SUCCESS &&
@@ -1888,13 +1917,17 @@ main(int argc, char **argv) {
 	ISC_LIST_INIT(search_list);

 	debug("main()");
-	preparse_args(argc, argv);
 	progname = argv[0];
+	preparse_args(argc, argv);
 	result = isc_app_start();
 	check_result(result, "isc_app_start");
 	setup_libs();
+	setup_system(ipv4only, ipv6only);
 	parse_args(ISC_FALSE, ISC_FALSE, argc, argv);
-	setup_system();
+	if (keyfile[0] != 0)
+		setup_file_key();
+	else if (keysecret[0] != 0)
+		setup_text_key();
 	if (domainopt[0] != '\0') {
 		set_search_domain(domainopt);
 		usesearch = ISC_TRUE;
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2011, 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,8 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dig">
-
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dig">
  <info>
    <date>2014-02-12</date>
  </info>
@@ -50,6 +49,7 @@
      <year>2013</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -660,6 +660,17 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]idnout</option></term>
+	  <listitem>
+	    <para>
+	      Convert [do not convert] puny code on output.
+	      This requires IDN SUPPORT to have been enabled at
+	      compile time.  The default is to convert output.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]ignore</option></term>
 	  <listitem>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -466,9 +466,9 @@ reverse_octets(const char *in, char **p, char *end) {
 		result = append(".", 1, p, end);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-		len = (int)(dot - in);
+		len = (int) (dot - in);
 	} else {
-		len = strlen(in);
+		len = (int) strlen(in);
 	}
 	return (append(in, len, p, end));
 }
@@ -760,7 +760,6 @@ make_empty_lookup(void) {
 	looknew->sendmsg = NULL;
 	looknew->name = NULL;
 	looknew->oname = NULL;
-	looknew->timer = NULL;
 	looknew->xfr_q = NULL;
 	looknew->current_query = NULL;
 	looknew->doing_xfr = ISC_FALSE;
@@ -774,6 +773,11 @@ make_empty_lookup(void) {
 	looknew->besteffort = ISC_TRUE;
 	looknew->dnssec = ISC_FALSE;
 	looknew->nsid = ISC_FALSE;
+#ifdef WITH_IDN
+	looknew->idnout = ISC_TRUE;
+#else
+	looknew->idnout = ISC_FALSE;
+#endif
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = ISC_FALSE;
 #if DIG_SIGCHASE_TD
@@ -857,6 +861,7 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->besteffort = lookold->besteffort;
 	looknew->dnssec = lookold->dnssec;
 	looknew->nsid = lookold->nsid;
+	looknew->idnout = lookold->idnout;
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = lookold->sigchase;
 #if DIG_SIGCHASE_TD
@@ -928,12 +933,12 @@ requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 }


-static void
+void
 setup_text_key(void) {
 	isc_result_t result;
 	dns_name_t keyname;
 	isc_buffer_t secretbuf;
-	int secretsize;
+	unsigned int secretsize;
 	unsigned char *secretstore;

 	debug("setup_text_key()");
@@ -942,7 +947,7 @@ setup_text_key(void) {
 	dns_name_init(&keyname, NULL);
 	check_result(result, "dns_name_init");
 	isc_buffer_putstr(namebuf, keynametext);
-	secretsize = strlen(keysecret) * 3 / 4;
+	secretsize = (unsigned int) strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
 	if (secretstore == NULL)
 		fatal("memory allocation failure in %s:%d",
@@ -964,8 +969,8 @@ setup_text_key(void) {
 		goto failure;

 	result = dns_tsigkey_create(&keyname, hmacname, secretstore,
-				    secretsize, ISC_FALSE, NULL, 0, 0, mctx,
-				    NULL, &key);
+				    (int)secretsize, ISC_FALSE, NULL, 0, 0,
+				    mctx, NULL, &key);
 failure:
 	if (result != ISC_R_SUCCESS)
 		printf(";; Couldn't create key %s: %s\n",
@@ -1012,13 +1017,13 @@ parse_bits(char *arg, const char *desc, isc_uint32_t max) {
 void
 parse_hmac(const char *hmac) {
 	char buf[20];
-	int len;
+	size_t len;

 	REQUIRE(hmac != NULL);

 	len = strlen(hmac);
-	if (len >= (int) sizeof(buf))
-		fatal("unknown key type '%.*s'", len, hmac);
+	if (len >= sizeof(buf))
+		fatal("unknown key type '%.*s'", (int)len, hmac);
 	strlcpy(buf, hmac, sizeof(buf));

 	digestbits = 0;
@@ -1115,7 +1120,7 @@ read_confkey(void) {
 	return (result);
 }

-static void
+void
 setup_file_key(void) {
 	isc_result_t result;
 	dst_key_t *dstkey = NULL;
@@ -1218,13 +1223,31 @@ create_search_list(lwres_conf_t *confdata) {
 * settings.
 */
 void
-setup_system(void) {
+setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only) {
 	dig_searchlist_t *domain = NULL;
 	lwres_result_t lwresult;
 	unsigned int lwresflags;

 	debug("setup_system()");

+	if (ipv4only) {
+		if (have_ipv4) {
+			isc_net_disableipv6();
+			have_ipv6 = ISC_FALSE;
+		} else {
+			fatal("can't find IPv4 networking");
+		}
+	}
+
+	if (ipv6only) {
+		if (have_ipv6) {
+			isc_net_disableipv4();
+			have_ipv4 = ISC_FALSE;
+		} else {
+			fatal("can't find IPv6 networking");
+		}
+	}
+
 	lwresflags = LWRES_CONTEXT_SERVERMODE;
 	if (have_ipv4)
 		lwresflags |= LWRES_CONTEXT_USEIPV4;
@@ -1490,6 +1513,8 @@ clear_query(dig_query_t *query) {

 	debug("clear_query(%p)", query);

+	if (query->timer != NULL)
+		isc_timer_detach(&query->timer);
 	lookup = query->lookup;

 	if (lookup->current_query == query)
@@ -1583,8 +1608,6 @@ destroy_lookup(dig_lookup_t *lookup) {
 		debug("freeing buffer %p", lookup->querysig);
 		isc_buffer_free(&lookup->querysig);
 	}
-	if (lookup->timer != NULL)
-		isc_timer_detach(&lookup->timer);
 	if (lookup->sendspace != NULL)
 		isc_mempool_put(commctx, lookup->sendspace);

@@ -2028,7 +2051,7 @@ isc_boolean_t
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
 	isc_uint32_t id;
-	int len;
+	unsigned int len;
 	dig_server_t *serv;
 	dig_query_t *query;
 	isc_buffer_t b;
@@ -2040,7 +2063,8 @@ setup_lookup(dig_lookup_t *lookup) {
 #endif

 #ifdef WITH_IDN
-	result = dns_name_settotextfilter(output_filter);
+	result = dns_name_settotextfilter(lookup->idnout ?
+					  output_filter : NULL);
 	check_result(result, "dns_name_settotextfilter");
 #endif

@@ -2133,7 +2157,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		check_result(result, "dns_message_gettempname");
 		dns_name_init(lookup->oname, NULL);
 		/* XXX Helper funct to conv char* to name? */
-		len = strlen(lookup->origin->origin);
+		len = (unsigned int) strlen(lookup->origin->origin);
 		isc_buffer_init(&b, lookup->origin->origin, len);
 		isc_buffer_add(&b, len);
 		result = dns_name_fromtext(lookup->oname, &b, dns_rootname,
@@ -2155,7 +2179,7 @@ setup_lookup(dig_lookup_t *lookup) {

 			dns_fixedname_init(&fixed);
 			name = dns_fixedname_name(&fixed);
-			len = strlen(lookup->textname);
+			len = (unsigned int) strlen(lookup->textname);
 			isc_buffer_init(&b, lookup->textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
@@ -2189,14 +2213,14 @@ setup_lookup(dig_lookup_t *lookup) {
 			dns_name_clone(dns_rootname, lookup->name);
 		else {
 #ifdef WITH_IDN
-			len = strlen(idn_textname);
+			len = (unsigned int) strlen(idn_textname);
 			isc_buffer_init(&b, idn_textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(lookup->name, &b,
 						   dns_rootname, 0,
 						   &lookup->namebuf);
 #else
-			len = strlen(lookup->textname);
+			len = (unsigned int) strlen(lookup->textname);
 			isc_buffer_init(&b, lookup->textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(lookup->name, &b,
@@ -2338,6 +2362,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		debug("create query %p linked to lookup %p",
 		       query, lookup);
 		query->lookup = lookup;
+		query->timer = NULL;
 		query->waiting_connect = ISC_FALSE;
 		query->waiting_senddone = ISC_FALSE;
 		query->pending_free = ISC_FALSE;
@@ -2347,6 +2372,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->second_rr_rcvd = ISC_FALSE;
 		query->first_repeat_rcvd = ISC_FALSE;
 		query->warn_id = ISC_TRUE;
+		query->timedout = ISC_FALSE;
 		query->first_rr_serial = 0;
 		query->second_rr_serial = 0;
 		query->servname = serv->servername;
@@ -2451,8 +2477,6 @@ cancel_lookup(dig_lookup_t *lookup) {
 		}
 		query = next;
 	}
-	if (lookup->timer != NULL)
-		isc_timer_detach(&lookup->timer);
 	lookup->pending = ISC_FALSE;
 	lookup->retries = 0;
 }
@@ -2470,7 +2494,7 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 	 * just reset it.
 	 */
 	l = query->lookup;
-	if (ISC_LIST_NEXT(query, link) != NULL)
+	if (ISC_LINK_LINKED(query, link) && ISC_LIST_NEXT(query, link) != NULL)
 		local_timeout = SERVER_TIMEOUT;
 	else {
 		if (timeout == 0)
@@ -2480,21 +2504,21 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 	}
 	debug("have local timeout of %d", local_timeout);
 	isc_interval_set(&l->interval, local_timeout, 0);
-	if (l->timer != NULL)
-		isc_timer_detach(&l->timer);
+	if (query->timer != NULL)
+		isc_timer_detach(&query->timer);
 	result = isc_timer_create(timermgr, isc_timertype_once, NULL,
 				  &l->interval, global_task, connect_timeout,
-				  l, &l->timer);
+				  query, &query->timer);
 	check_result(result, "isc_timer_create");
 }

 static void
-force_timeout(dig_lookup_t *l, dig_query_t *query) {
+force_timeout(dig_query_t *query) {
 	isc_event_t *event;

 	debug("force_timeout ()");
 	event = isc_event_allocate(mctx, query, ISC_TIMEREVENT_IDLE,
-				   connect_timeout, l,
+				   connect_timeout, query,
 				   sizeof(isc_event_t));
 	if (event == NULL) {
 		fatal("isc_event_allocate: %s",
@@ -2508,8 +2532,8 @@ force_timeout(dig_lookup_t *l, dig_query_t *query) {
 	 * We need to cancel the possible timeout event not to confuse
 	 * ourselves due to the duplicate events.
 	 */
-	if (l->timer != NULL)
-		isc_timer_detach(&l->timer);
+	if (query->timer != NULL)
+		isc_timer_detach(&query->timer);
 }


@@ -2539,7 +2563,7 @@ send_tcp_connect(dig_query_t *query) {
 		 * by triggering an immediate 'timeout' (we lie, but the effect
 		 * is the same).
 		 */
-		force_timeout(l, query);
+		force_timeout(query);
 		return;
 	}

@@ -2549,7 +2573,10 @@ send_tcp_connect(dig_query_t *query) {
 		printf(";; Skipping server %s, incompatible "
 		       "address family\n", query->servname);
 		query->waiting_connect = ISC_FALSE;
-		next = ISC_LIST_NEXT(query, link);
+		if (ISC_LINK_LINKED(query, link))
+			next = ISC_LIST_NEXT(query, link);
+		else
+			next = NULL;
 		l = query->lookup;
 		clear_query(query);
 		if (next == NULL) {
@@ -2600,9 +2627,11 @@ send_tcp_connect(dig_query_t *query) {
 	 */
 	if (l->ns_search_only && !l->trace_root) {
 		debug("sending next, since searching");
-		next = ISC_LIST_NEXT(query, link);
-		if (ISC_LINK_LINKED(query, link))
+		if (ISC_LINK_LINKED(query, link)) {
+			next = ISC_LIST_NEXT(query, link);
 			ISC_LIST_DEQUEUE(l->q, query, link);
+		} else
+			next = NULL;
 		ISC_LIST_ENQUEUE(l->connecting, query, clink);
 		if (next != NULL)
 			send_tcp_connect(next);
@@ -2643,7 +2672,7 @@ send_udp(dig_query_t *query) {
 		result = get_address(query->servname, port, &query->sockaddr);
 		if (result != ISC_R_SUCCESS) {
 			/* This servname doesn't have an address. */
-			force_timeout(l, query);
+			force_timeout(query);
 			return;
 		}

@@ -2698,7 +2727,7 @@ send_udp(dig_query_t *query) {
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *query = NULL, *next, *cq;
+	dig_query_t *query = NULL, *cq;

 	UNUSED(task);
 	REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
@@ -2706,13 +2735,14 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 	debug("connect_timeout()");

 	LOCK_LOOKUP;
-	l = event->ev_arg;
-	query = l->current_query;
+	query = event->ev_arg;
+	l = query->lookup;
 	isc_event_free(&event);

 	INSIST(!free_now);

 	if ((query != NULL) && (query->lookup->current_query != NULL) &&
+	    ISC_LINK_LINKED(query->lookup->current_query, link) &&
 	    (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
 		debug("trying next server...");
 		cq = query->lookup->current_query;
@@ -2722,14 +2752,17 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			if (query->sock != NULL)
 				isc_socket_cancel(query->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
-			next = ISC_LIST_NEXT(cq, link);
-			if (next != NULL)
-				send_tcp_connect(next);
+			send_tcp_connect(ISC_LIST_NEXT(cq, link));
 		}
 		UNLOCK_LOOKUP;
 		return;
 	}

+	if (l->tcp_mode && query->sock != NULL) {
+		query->timedout = ISC_TRUE;
+		isc_socket_cancel(query->sock, NULL, ISC_SOCKCANCEL_ALL);
+	}
+
 	if (l->retries > 1) {
 		if (!l->tcp_mode) {
 			l->retries--;
@@ -2744,9 +2777,11 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			check_next_lookup(l);
 		}
 	} else {
-		fputs(l->cmdline, stdout);
-		printf(";; connection timed out; no servers could be "
-		       "reached\n");
+		if (!l->ns_search_only) {
+			fputs(l->cmdline, stdout);
+			printf(";; connection timed out; no servers could be "
+			       "reached\n");
+		}
 		cancel_lookup(l);
 		check_next_lookup(l);
 		if (exitcode < 9)
@@ -2912,6 +2947,7 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 */
 static void
 connect_done(isc_task_t *task, isc_event_t *event) {
+	char sockstr[ISC_SOCKADDR_FORMATSIZE];
 	isc_socketevent_t *sevent = NULL;
 	dig_query_t *query = NULL, *next;
 	dig_lookup_t *l;
@@ -2933,6 +2969,12 @@ connect_done(isc_task_t *task, isc_event_t *event) {

 	if (sevent->result == ISC_R_CANCELED) {
 		debug("in cancel handler");
+		isc_sockaddr_format(&query->sockaddr, sockstr, sizeof(sockstr));
+		if (query->timedout)
+			printf(";; Connection to %s(%s) for %s failed: %s.\n",
+			       sockstr, query->servname,
+			       query->lookup->textname,
+			       isc_result_totext(ISC_R_TIMEDOUT));
 		isc_socket_detach(&query->sock);
 		INSIST(sockcount > 0);
 		sockcount--;
@@ -2946,7 +2988,6 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 	if (sevent->result != ISC_R_SUCCESS) {
-		char sockstr[ISC_SOCKADDR_FORMATSIZE];

 		debug("unsuccessful connection: %s",
 		      isc_result_totext(sevent->result));
@@ -2957,8 +2998,8 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 			       query->servname, query->lookup->textname,
 			       isc_result_totext(sevent->result));
 		isc_socket_detach(&query->sock);
+		INSIST(sockcount > 0);
 		sockcount--;
-		INSIST(sockcount >= 0);
 		/* XXX Clean up exitcodes */
 		if (exitcode < 9)
 			exitcode = 9;
@@ -3187,8 +3228,8 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	INSIST(b == &query->recvbuf);
 	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);

-	if ((l->tcp_mode) && (l->timer != NULL))
-		isc_timer_touch(l->timer);
+	if ((l->tcp_mode) && (query->timer != NULL))
+		isc_timer_touch(query->timer);
 	if ((!l->pending && !l->ns_search_only) || cancel_now) {
 		debug("no longer pending.  Got %s",
 			isc_result_totext(sevent->result));
@@ -3473,7 +3514,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		 * the timeout to much longer, so brief network
 		 * outages won't cause the XFR to abort
 		 */
-		if (timeout != INT_MAX && l->timer != NULL) {
+		if (timeout != INT_MAX && query->timer != NULL) {
 			unsigned int local_timeout;

 			if (timeout == 0) {
@@ -3489,7 +3530,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 			}
 			debug("have local timeout of %d", local_timeout);
 			isc_interval_set(&l->interval, local_timeout, 0);
-			result = isc_timer_reset(l->timer,
+			result = isc_timer_reset(query->timer,
 						 isc_timertype_once,
 						 NULL,
 						 &l->interval,
@@ -3772,8 +3813,6 @@ cancel_all(void) {
 	}
 	cancel_now = ISC_TRUE;
 	if (current_lookup != NULL) {
-		if (current_lookup->timer != NULL)
-			isc_timer_detach(&current_lookup->timer);
 		for (q = ISC_LIST_HEAD(current_lookup->q);
 		     q != NULL;
 		     q = nq)
@@ -4175,27 +4214,33 @@ chase_scanname(dns_name_t *name, dns_rdatatype_t type, dns_rdatatype_t covers)
 	     msg = ISC_LIST_NEXT(msg, link)) {
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ANSWER)
 		    == ISC_R_SUCCESS)
+		{
 			rdataset = chase_scanname_section(msg->msg, name,
 							  type, covers,
 							  DNS_SECTION_ANSWER);
 			if (rdataset != NULL)
 				return (rdataset);
+		}
 		if (dns_message_firstname(msg->msg, DNS_SECTION_AUTHORITY)
 		    == ISC_R_SUCCESS)
+		{
 			rdataset =
 				chase_scanname_section(msg->msg, name,
 						       type, covers,
 						       DNS_SECTION_AUTHORITY);
 			if (rdataset != NULL)
 				return (rdataset);
+		}
 		if (dns_message_firstname(msg->msg, DNS_SECTION_ADDITIONAL)
 		    == ISC_R_SUCCESS)
+		{
 			rdataset =
 				chase_scanname_section(msg->msg, name, type,
 						       covers,
 						       DNS_SECTION_ADDITIONAL);
 			if (rdataset != NULL)
 				return (rdataset);
+		}
 	}

 	return (NULL);
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -65,56 +65,74 @@ is an optional argument which is either the name or IP address of the name serve
 \fBhost\fR
 should query instead of the server or servers listed in
 /etc/resolv\&.conf\&.
+.SH "OPTIONS"
 .PP
-The
+\-4
+.RS 4
+Use IPv4 only for query transport\&. See also the
+\fB\-6\fR
+option\&.
+.RE
+.PP
+\-6
+.RS 4
+Use IPv6 only for query transport\&. See also the
+\fB\-4\fR
+option\&.
+.RE
+.PP
+\-a
+.RS 4
+"All"\&. The
 \fB\-a\fR
-(all) option is equivalent to setting the
-\fB\-v\fR
-option and asking
-\fBhost\fR
-to make a query of type ANY\&.
+option is normally equivalent to
+\fB\-v \-t \fR\fBANY\fR\&. It also affects the behaviour of the
+\fB\-l\fR
+list zone option\&.
+.RE
 .PP
-When the
-\fB\-C\fR
-option is used,
+\-c \fIclass\fR
+.RS 4
+Query class: This can be used to lookup HS (Hesiod) or CH (Chaosnet) class resource records\&. The default class is IN (Internet)\&.
+.RE
+.PP
+\-C
+.RS 4
+Check consistency:
 \fBhost\fR
-will attempt to display the SOA records for zone
+will query the SOA records for zone
 \fIname\fR
 from all the listed authoritative name servers for that zone\&. The list of name servers is defined by the NS records that are found for the zone\&.
+.RE
 .PP
-The
-\fB\-c\fR
-option instructs to make a DNS query of class
-\fIclass\fR\&. This can be used to lookup Hesiod or Chaosnet class resource records\&. The default class is IN (Internet)\&.
-.PP
-Verbose output is generated by
-\fBhost\fR
-when the
-\fB\-d\fR
-or
+\-d
+.RS 4
+Print debugging traces\&. Equivalent to the
 \fB\-v\fR
-option is used\&. The two options are equivalent\&. They have been provided for backwards compatibility\&. In previous versions, the
-\fB\-d\fR
-option switched on debugging traces and
-\fB\-v\fR
-enabled verbose output\&.
+verbose option\&.
+.RE
 .PP
-List mode is selected by the
-\fB\-l\fR
-option\&. This makes
+\-i
+.RS 4
+Obsolete\&. Use the IP6\&.INT domain for reverse lookups of IPv6 addresses as defined in RFC1886 and deprecated in RFC4159\&. The default is to use IP6\&.ARPA as specified in RFC3596\&.
+.RE
+.PP
+\-l
+.RS 4
+List zone: The
 \fBhost\fR
-perform a zone transfer for zone
-\fIname\fR\&. Transfer the zone printing out the NS, PTR and address records (A/AAAA)\&. If combined with
-\fB\-a\fR
-all records will be printed\&.
+command performs a zone transfer of zone
+\fIname\fR
+and prints out the NS, PTR and address records (A/AAAA)\&.
+.sp
+Together, the
+\fB\-l \-a\fR
+options print all records in the zone\&.
+.RE
 .PP
-The
-\fB\-i\fR
-option specifies that reverse lookups of IPv6 addresses should use the IP6\&.INT domain as defined in RFC1886\&. The default is to use IP6\&.ARPA\&.
-.PP
-The
-\fB\-N\fR
-option sets the number of dots that have to be in
+\-N \fIndots\fR
+.RS 4
+The number of dots that have to be in
 \fIname\fR
 for it to be considered absolute\&. The default value is that defined using the ndots statement in
 /etc/resolv\&.conf, or 1 if no ndots statement is present\&. Names with fewer dots are interpreted as relative names and will be searched for in the domains listed in the
@@ -123,97 +141,106 @@ or
 \fBdomain\fR
 directive in
 /etc/resolv\&.conf\&.
+.RE
 .PP
-The number of UDP retries for a lookup can be changed with the
-\fB\-R\fR
-option\&.
-\fInumber\fR
-indicates how many times
-\fBhost\fR
-will repeat a query that does not get answered\&. The default number of retries is 1\&. If
-\fInumber\fR
-is negative or zero, the number of retries will default to 1\&.
-.PP
-Non\-recursive queries can be made via the
-\fB\-r\fR
-option\&. Setting this option clears the
-\fBRD\fR
-\(em recursion desired \(em bit in the query which
-\fBhost\fR
-makes\&. This should mean that the name server receiving the query will not attempt to resolve
+\-r
+.RS 4
+Non\-recursive query: Setting this option clears the RD (recursion desired) bit in the query\&. This should mean that the name server receiving the query will not attempt to resolve
 \fIname\fR\&. The
 \fB\-r\fR
 option enables
 \fBhost\fR
-to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that are usually referrals to other name servers\&.
+to mimic the behavior of a name server by making non\-recursive queries and expecting to receive answers to those queries that can be referrals to other name servers\&.
+.RE
 .PP
-By default,
+\-R \fInumber\fR
+.RS 4
+Number of retries for UDP queries: If
+\fInumber\fR
+is negative or zero, the number of retries will default to 1\&. The default value is 1\&.
+.RE
+.PP
+\-s
+.RS 4
+Do
+\fInot\fR
+send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior\&.
+.RE
+.PP
+\-t \fItype\fR
+.RS 4
+Query type: The
+\fItype\fR
+argument can be any recognized query type: CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc\&.
+.sp
+When no query type is specified,
+\fBhost\fR
+automatically selects an appropriate query type\&. By default, it looks for A, AAAA, and MX records\&. If the
+\fB\-C\fR
+option is given, queries will be made for SOA records\&. If
+\fIname\fR
+is a dotted\-decimal IPv4 address or colon\-delimited IPv6 address,
+\fBhost\fR
+will query for PTR records\&.
+.sp
+If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (like
+\fB\-t \fR\fBIXFR=12345678\fR)\&.
+.RE
+.PP
+\-T
+.RS 4
+TCP: By default,
 \fBhost\fR
 uses UDP when making queries\&. The
 \fB\-T\fR
 option makes it use a TCP connection when querying the name server\&. TCP will be automatically selected for queries that require it, such as zone transfer (AXFR) requests\&.
+.RE
 .PP
-The
-\fB\-4\fR
-option forces
-\fBhost\fR
-to only use IPv4 query transport\&. The
-\fB\-6\fR
-option forces
-\fBhost\fR
-to only use IPv6 query transport\&.
-.PP
-The
-\fB\-t\fR
-option is used to select the query type\&.
-\fItype\fR
-can be any recognized query type: CNAME, NS, SOA, SIG, KEY, AXFR, etc\&. When no query type is specified,
-\fBhost\fR
-automatically selects an appropriate query type\&. By default, it looks for A, AAAA, and MX records, but if the
-\fB\-C\fR
-option was given, queries will be made for SOA records, and if
-\fIname\fR
-is a dotted\-decimal IPv4 address or colon\-delimited IPv6 address,
-\fBhost\fR
-will query for PTR records\&. If a query type of IXFR is chosen the starting serial number can be specified by appending an equal followed by the starting serial number (e\&.g\&. \-t IXFR=12345678)\&.
-.PP
-The time to wait for a reply can be controlled through the
-\fB\-W\fR
-and
-\fB\-w\fR
-options\&. The
-\fB\-W\fR
-option makes
-\fBhost\fR
-wait for
-\fIwait\fR
-seconds\&. If
-\fIwait\fR
-is less than one, the wait interval is set to one second\&. When the
-\fB\-w\fR
-option is used,
-\fBhost\fR
-will effectively wait forever for a reply\&. The time to wait for a response will be set to the number of seconds given by the hardware\*(Aqs maximum value for an integer quantity\&.
-.PP
-The
-\fB\-s\fR
-option tells
-\fBhost\fR\fInot\fR
-to send the query to the next nameserver if any server responds with a SERVFAIL response, which is the reverse of normal stub resolver behavior\&.
-.PP
-The
-\fB\-m\fR
-can be used to set the memory usage debugging flags
+\-m \fIflag\fR
+.RS 4
+Memory usage debugging: the flag can be
 \fIrecord\fR,
-\fIusage\fR
-and
-\fItrace\fR\&.
+\fIusage\fR, or
+\fItrace\fR\&. You can specify the
+\fB\-m\fR
+option more than once to set multiple flags\&.
+.RE
 .PP
-The
-\fB\-V\fR
-option causes
+\-v
+.RS 4
+Verbose output\&. Equivalent to the
+\fB\-d\fR
+debug option\&.
+.RE
+.PP
+\-V
+.RS 4
+Print the version number and exit\&.
+.RE
+.PP
+\-w
+.RS 4
+Wait forever: The query timeout is set to the maximum possible\&. See also the
+\fB\-W\fR
+option\&.
+.RE
+.PP
+\-W \fIwait\fR
+.RS 4
+Timeout: Wait for up to
+\fIwait\fR
+seconds for a reply\&. If
+\fIwait\fR
+is less than one, the wait interval is set to one second\&.
+.sp
+By default,
 \fBhost\fR
-to print the version number and exit\&.
+will wait for 5 seconds for UDP responses and 10 seconds for TCP connections\&.
+.sp
+See also the
+\fB\-w\fR
+option\&.
+.RE
 .SH "IDN SUPPORT"
 .PP
 If
@@ -237,7 +264,7 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000-2002 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -59,6 +59,7 @@ static int seen_error = -1;
 static isc_boolean_t list_addresses = ISC_TRUE;
 static dns_rdatatype_t list_type = dns_rdatatype_a;
 static isc_boolean_t printed_server = ISC_FALSE;
+static isc_boolean_t ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;

 static const char *opcodetext[] = {
 	"QUERY",
@@ -145,14 +146,15 @@ show_usage(void) ISC_PLATFORM_NORETURN_POST;
 static void
 show_usage(void) {
 	fputs(
-"Usage: host [-aCdlriTwv] [-c class] [-N ndots] [-t type] [-W time]\n"
+"Usage: host [-aCdilrTvVw] [-c class] [-N ndots] [-t type] [-W time]\n"
 "            [-R number] [-m flag] hostname [server]\n"
 "       -a is equivalent to -v -t ANY\n"
 "       -c specifies query class for non-IN data\n"
 "       -C compares SOA records on authoritative nameservers\n"
 "       -d is equivalent to -v\n"
-"       -l lists all hosts in a domain, using AXFR\n"
 "       -i IP6.INT reverse lookups\n"
+"       -l lists all hosts in a domain, using AXFR\n"
+"       -m set memory debugging flag (trace|record|usage)\n"
 "       -N changes the number of dots allowed before root lookup is done\n"
 "       -r disables recursive processing\n"
 "       -R specifies number of retries for UDP packets\n"
@@ -160,12 +162,11 @@ show_usage(void) {
 "       -t specifies the query type\n"
 "       -T enables TCP/IP mode\n"
 "       -v enables verbose output\n"
+"       -V print version number and exit\n"
 "       -w specifies to wait forever for a reply\n"
 "       -W specifies how long to wait for a reply\n"
 "       -4 use IPv4 query transport only\n"
-"       -6 use IPv6 query transport only\n"
-"       -m set memory debugging flag (trace|record|usage)\n"
-"       -V print version number and exit\n", stderr);
+"       -6 use IPv6 query transport only\n", stderr);
 	exit(1);
 }

@@ -620,16 +621,24 @@ pre_parse_args(int argc, char **argv) {
 			memdebugging = ISC_TRUE;
 			if (strcasecmp("trace", isc_commandline_argument) == 0)
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
-			else if (!strcasecmp("record",
-					     isc_commandline_argument) == 0)
+			else if (strcasecmp("record",
+					    isc_commandline_argument) == 0)
 				isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 			else if (strcasecmp("usage",
 					    isc_commandline_argument) == 0)
 				isc_mem_debugging |= ISC_MEM_DEBUGUSAGE;
 			break;

-		case '4': break;
-		case '6': break;
+		case '4':
+			if (ipv6only)
+				fatal("only one of -4 and -6 allowed");
+			ipv4only = ISC_TRUE;
+			break;
+		case '6':
+			if (ipv4only)
+				fatal("only one of -4 and -6 allowed");
+			ipv6only = ISC_TRUE;
+			break;
 		case 'a': break;
 		case 'c': break;
 		case 'd': break;
@@ -823,18 +832,10 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			/* Handled by pre_parse_args(). */
 			break;
 		case '4':
-			if (have_ipv4) {
-				isc_net_disableipv6();
-				have_ipv6 = ISC_FALSE;
-			} else
-				fatal("can't find IPv4 networking");
+			/* Handled by pre_parse_args(). */
 			break;
 		case '6':
-			if (have_ipv6) {
-				isc_net_disableipv4();
-				have_ipv4 = ISC_FALSE;
-			} else
-				fatal("can't find IPv6 networking");
+			/* Handled by pre_parse_args(). */
 			break;
 		case 's':
 			lookup->servfail_stops = ISC_TRUE;
@@ -894,8 +895,12 @@ main(int argc, char **argv) {
 	result = isc_app_start();
 	check_result(result, "isc_app_start");
 	setup_libs();
+	setup_system(ipv4only, ipv6only);
 	parse_args(ISC_FALSE, argc, argv);
-	setup_system();
+	if (keyfile[0] != 0)
+		setup_file_key();
+	else if (keysecret[0] != 0)
+		setup_text_key();
 	result = isc_app_onrun(mctx, global_task, onrun_callback, NULL);
 	check_result(result, "isc_app_onrun");
 	isc_app_run();
@@ -1,7 +1,7 @@
 <!DOCTYPE book [
 <!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005, 2007-2009, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2009, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,7 +18,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.host">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.host">
  <info>
    <date>2009-01-20</date>
  </info>
@@ -47,6 +47,7 @@
      <year>2009</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -100,155 +101,269 @@
      <filename>/etc/resolv.conf</filename>.
    </para>

-    <para>
-      The <option>-a</option> (all) option is equivalent to setting the
-      <option>-v</option> option and asking <command>host</command> to make
-      a query of type ANY.
-    </para>
+  </refsection>

-    <para>
-      When the <option>-C</option> option is used, <command>host</command>
-      will attempt to display the SOA records for zone
-      <parameter>name</parameter> from all the listed
-      authoritative name
-      servers for that zone.  The list of name servers is defined by the NS
-      records that are found for the zone.
-    </para>
+  <refsection><info><title>OPTIONS</title></info>

-    <para>
-      The <option>-c</option> option instructs to make a DNS query of class
-      <parameter>class</parameter>.  This can be used to lookup
-      Hesiod or
-      Chaosnet class resource records.  The default class is IN (Internet).
-    </para>
+    <variablelist>

-    <para>
-      Verbose output is generated by <command>host</command> when
-      the
-      <option>-d</option> or <option>-v</option> option is used.  The two
-      options are equivalent.  They have been provided for backwards
-      compatibility.  In previous versions, the <option>-d</option> option
-      switched on debugging traces and <option>-v</option> enabled verbose
-      output.
-    </para>
+      <varlistentry>
+	<term>-4</term>
+	<listitem>
+	  <para>
+	    Use IPv4 only for query transport.
+	    See also the <option>-6</option> option.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      List mode is selected by the <option>-l</option> option.  This makes
-      <command>host</command> perform a zone transfer for zone
-      <parameter>name</parameter>.  Transfer the zone printing out
-      the NS, PTR
-      and address records (A/AAAA).  If combined with <option>-a</option>
-      all records will be printed.
-    </para>
+      <varlistentry>
+	<term>-6</term>
+	<listitem>
+	  <para>
+	    Use IPv6 only for query transport.
+	    See also the <option>-4</option> option.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The <option>-i</option>
-      option specifies that reverse lookups of IPv6 addresses should
-      use the IP6.INT domain as defined in RFC1886.
-      The default is to use IP6.ARPA.
-    </para>
+      <varlistentry>
+	<term>-a</term>
+	<listitem>
+	  <para>
+	    "All". The <option>-a</option> option is normally equivalent
+	    to <option>-v -t <literal>ANY</literal></option>.
+	    It also affects the behaviour of the <option>-l</option>
+	    list zone option.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The <option>-N</option> option sets the number of dots that have to be
-      in <parameter>name</parameter> for it to be considered
-      absolute.  The
-      default value is that defined using the ndots statement in
-      <filename>/etc/resolv.conf</filename>, or 1 if no ndots
-      statement is
-      present.  Names with fewer dots are interpreted as relative names and
-      will be searched for in the domains listed in the <type>search</type>
-      or <type>domain</type> directive in
-      <filename>/etc/resolv.conf</filename>.
-    </para>
+      <varlistentry>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
+	<listitem>
+	  <para>
+	    Query class: This can be used to lookup HS (Hesiod) or CH
+	    (Chaosnet) class resource records. The default class is IN
+	    (Internet).
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The number of UDP retries for a lookup can be changed with the
-      <option>-R</option> option.  <parameter>number</parameter>
-      indicates
-      how many times <command>host</command> will repeat a query
-      that does
-      not get answered.  The default number of retries is 1.  If
-      <parameter>number</parameter> is negative or zero, the
-      number of
-      retries will default to 1.
-    </para>
+      <varlistentry>
+	<term>-C</term>
+	<listitem>
+	  <para>
+	    Check consistency: <command>host</command> will query the
+	    SOA records for zone <parameter>name</parameter> from all
+	    the listed authoritative name servers for that zone. The
+	    list of name servers is defined by the NS records that are
+	    found for the zone.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      Non-recursive queries can be made via the <option>-r</option> option.
-      Setting this option clears the <type>RD</type> &mdash; recursion
-      desired &mdash; bit in the query which <command>host</command> makes.
-      This should mean that the name server receiving the query will not
-      attempt to resolve <parameter>name</parameter>.  The
-      <option>-r</option> option enables <command>host</command>
-      to mimic
-      the behavior of a name server by making non-recursive queries and
-      expecting to receive answers to those queries that are usually
-      referrals to other name servers.
-    </para>
+      <varlistentry>
+	<term>-d</term>
+	<listitem>
+	  <para>
+	    Print debugging traces.
+	    Equivalent to the <option>-v</option> verbose option.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      By default, <command>host</command> uses UDP when making
-      queries.  The
-      <option>-T</option> option makes it use a TCP connection when querying
-      the name server.  TCP will be automatically selected for queries that
-      require it, such as zone transfer (AXFR) requests.
-    </para>
+      <varlistentry>
+	<term>-i</term>
+	<listitem>
+	  <para>
+	    Obsolete.
+	    Use the IP6.INT domain for reverse lookups of IPv6
+	    addresses as defined in RFC1886 and deprecated in RFC4159.
+	    The default is to use IP6.ARPA as specified in RFC3596.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The <option>-4</option> option forces <command>host</command> to only
-      use IPv4 query transport.  The <option>-6</option> option forces
-      <command>host</command> to only use IPv6 query transport.
-    </para>
+      <varlistentry>
+	<term>-l</term>
+	<listitem>
+	  <para>
+	    List zone:
+	    The <command>host</command> command performs a zone transfer of
+	    zone <parameter>name</parameter> and prints out the NS,
+	    PTR and address records (A/AAAA).
+	  </para>
+	  <para>
+	    Together, the <option>-l -a</option>
+	    options print all records in the zone.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The <option>-t</option> option is used to select the query type.
-      <parameter>type</parameter> can be any recognized query
-      type: CNAME,
-      NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
-      <command>host</command> automatically selects an appropriate
-      query
-      type.  By default, it looks for A, AAAA, and MX records, but if the
-      <option>-C</option> option was given, queries will be made for SOA
-      records, and if <parameter>name</parameter> is a
-      dotted-decimal IPv4
-      address or colon-delimited IPv6 address, <command>host</command> will
-      query for PTR records.  If a query type of IXFR is chosen the starting
-      serial number can be specified by appending an equal followed by the
-      starting serial number (e.g. -t IXFR=12345678).
-    </para>
+      <varlistentry>
+	<term>-N <replaceable class="parameter">ndots</replaceable></term>
+	<listitem>
+	  <para>
+	    The number of dots that have to be
+	    in <parameter>name</parameter> for it to be considered
+	    absolute. The default value is that defined using the
+	    ndots statement in <filename>/etc/resolv.conf</filename>,
+	    or 1 if no ndots statement is present. Names with fewer
+	    dots are interpreted as relative names and will be
+	    searched for in the domains listed in
+	    the <type>search</type> or <type>domain</type> directive
+	    in <filename>/etc/resolv.conf</filename>.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The time to wait for a reply can be controlled through the
-      <option>-W</option> and <option>-w</option> options.  The
-      <option>-W</option> option makes <command>host</command>
-      wait for
-      <parameter>wait</parameter> seconds.  If <parameter>wait</parameter>
-      is less than one, the wait interval is set to one second.  When the
-      <option>-w</option> option is used, <command>host</command>
-      will
-      effectively wait forever for a reply.  The time to wait for a response
-      will be set to the number of seconds given by the hardware's maximum
-      value for an integer quantity.
-    </para>
+      <varlistentry>
+	<term>-r</term>
+	<listitem>
+	  <para>
+	    Non-recursive query:
+	    Setting this option clears the RD (recursion desired) bit
+	    in the query. This should mean that the name server
+	    receiving the query will not attempt to
+	    resolve <parameter>name</parameter>.
+	    The <option>-r</option> option
+	    enables <command>host</command> to mimic the behavior of a
+	    name server by making non-recursive queries and expecting
+	    to receive answers to those queries that can be
+	    referrals to other name servers.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The <option>-s</option> option tells <command>host</command>
-      <emphasis>not</emphasis> to send the query to the next nameserver
-      if any server responds with a SERVFAIL response, which is the
-      reverse of normal stub resolver behavior.
-    </para>
+      <varlistentry>
+	<term>-R <replaceable class="parameter">number</replaceable></term>
+	<listitem>
+	  <para>
+	    Number of retries for UDP queries:
+	    If <parameter>number</parameter> is negative or zero, the
+	    number of retries will default to 1. The default value is 1.
+	  </para>
+	</listitem>
+      </varlistentry>

-    <para>
-      The <option>-m</option> can be used to set the memory usage debugging
-      flags
-      <parameter>record</parameter>, <parameter>usage</parameter> and
-      <parameter>trace</parameter>.
-    </para>
+      <varlistentry>
+	<term>-s</term>
+	<listitem>
+	  <para>
+	    Do <emphasis>not</emphasis> send the query to the next
+	    nameserver if any server responds with a SERVFAIL
+	    response, which is the reverse of normal stub resolver
+	    behavior.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-t <replaceable class="parameter">type</replaceable></term>
+	<listitem>
+	  <para>
+	    Query type:
+	    The <parameter>type</parameter> argument can be any
+	    recognized query type: CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
+	  </para>
+	  <para>
+	    When no query type is specified, <command>host</command>
+	    automatically selects an appropriate query type. By default, it
+	    looks for A, AAAA, and MX records.
+	    If the <option>-C</option> option is given, queries will
+	    be made for SOA records.
+	    If <parameter>name</parameter> is a dotted-decimal IPv4
+	    address or colon-delimited IPv6
+	    address, <command>host</command> will query for PTR
+	    records.
+	  </para>
+	  <para>
+	    If a query type of IXFR is chosen the starting serial
+	    number can be specified by appending an equal followed by
+	    the starting serial number
+	    (like <option>-t <literal>IXFR=12345678</literal></option>).
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-T</term>
+	<listitem>
+	  <para>
+	    TCP:
+	    By default, <command>host</command> uses UDP when making
+	    queries. The <option>-T</option> option makes it use a TCP
+	    connection when querying the name server. TCP will be
+	    automatically selected for queries that require it, such
+	    as zone transfer (AXFR) requests.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-m <replaceable class="parameter">flag</replaceable></term>
+	<listitem>
+	  <para>
+	    Memory usage debugging: the flag can
+	    be <parameter>record</parameter>, <parameter>usage</parameter>,
+	    or <parameter>trace</parameter>. You can specify
+	    the <option>-m</option> option more than once to set
+	    multiple flags.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-v</term>
+	<listitem>
+	  <para>
+	    Verbose output.
+	    Equivalent to the <option>-d</option> debug option.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-V</term>
+	<listitem>
+	  <para>
+	    Print the version number and exit.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-w</term>
+	<listitem>
+	  <para>
+	    Wait forever: The query timeout is set to the maximum possible.
+	    See also the <option>-W</option> option.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+      <varlistentry>
+	<term>-W <replaceable class="parameter">wait</replaceable></term>
+	<listitem>
+	  <para>
+	    Timeout: Wait for up to <parameter>wait</parameter>
+	    seconds for a reply. If <parameter>wait</parameter> is
+	    less than one, the wait interval is set to one second.
+	  </para>
+	  <para>
+	    By default, <command>host</command> will wait for 5
+	    seconds for UDP responses and 10 seconds for TCP
+	    connections.
+	  </para>
+	  <para>
+	    See also the <option>-w</option> option.
+	  </para>
+	</listitem>
+      </varlistentry>
+
+    </variablelist>

-    <para>
-      The <option>-V</option> option causes <command>host</command>
-      to print the version number and exit.
-    </para>
  </refsection>

  <refsection><info><title>IDN SUPPORT</title></info>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2002 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>host</title>
@@ -22,24 +23,54 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.host"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p>host &#8212; DNS lookup utility</p>
+<p>
+    host
+     &#8212; DNS lookup utility
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrsTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-v</code>] [<code class="option">-V</code>] {name} [server]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">host</code> 
+       [<code class="option">-aCdlnrsTwv</code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>]
+       [<code class="option">-R <em class="replaceable"><code>number</code></em></code>]
+       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
+       [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>]
+       [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>]
+       [<code class="option">-4</code>]
+       [<code class="option">-6</code>]
+       [<code class="option">-v</code>]
+       [<code class="option">-V</code>]
+       {name}
+       [server]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>host</strong></span>
+
+
+    <p><span class="command"><strong>host</strong></span>
      is a simple utility for performing DNS lookups.
      It is normally used to convert names to IP addresses and vice versa.
      When no arguments or options are given,
      <span class="command"><strong>host</strong></span>
      prints a short summary of its command line arguments and options.
    </p>
-<p><em class="parameter"><code>name</code></em> is the domain name that is to be
+
+    <p><em class="parameter"><code>name</code></em> is the domain name that is to be
      looked
      up.  It can also be a dotted-decimal IPv4 address or a colon-delimited
      IPv6 address, in which case <span class="command"><strong>host</strong></span> will by
@@ -51,144 +82,219 @@
      should query instead of the server or servers listed in
      <code class="filename">/etc/resolv.conf</code>.
    </p>
-<p>
-      The <code class="option">-a</code> (all) option is equivalent to setting the
-      <code class="option">-v</code> option and asking <span class="command"><strong>host</strong></span> to make
-      a query of type ANY.
-    </p>
-<p>
-      When the <code class="option">-C</code> option is used, <span class="command"><strong>host</strong></span>
-      will attempt to display the SOA records for zone
-      <em class="parameter"><code>name</code></em> from all the listed
-      authoritative name
-      servers for that zone.  The list of name servers is defined by the NS
-      records that are found for the zone.
-    </p>
-<p>
-      The <code class="option">-c</code> option instructs to make a DNS query of class
-      <em class="parameter"><code>class</code></em>.  This can be used to lookup
-      Hesiod or
-      Chaosnet class resource records.  The default class is IN (Internet).
-    </p>
-<p>
-      Verbose output is generated by <span class="command"><strong>host</strong></span> when
-      the
-      <code class="option">-d</code> or <code class="option">-v</code> option is used.  The two
-      options are equivalent.  They have been provided for backwards
-      compatibility.  In previous versions, the <code class="option">-d</code> option
-      switched on debugging traces and <code class="option">-v</code> enabled verbose
-      output.
-    </p>
-<p>
-      List mode is selected by the <code class="option">-l</code> option.  This makes
-      <span class="command"><strong>host</strong></span> perform a zone transfer for zone
-      <em class="parameter"><code>name</code></em>.  Transfer the zone printing out
-      the NS, PTR
-      and address records (A/AAAA).  If combined with <code class="option">-a</code>
-      all records will be printed.
-    </p>
-<p>
-      The <code class="option">-i</code>
-      option specifies that reverse lookups of IPv6 addresses should
-      use the IP6.INT domain as defined in RFC1886.
-      The default is to use IP6.ARPA.
-    </p>
-<p>
-      The <code class="option">-N</code> option sets the number of dots that have to be
-      in <em class="parameter"><code>name</code></em> for it to be considered
-      absolute.  The
-      default value is that defined using the ndots statement in
-      <code class="filename">/etc/resolv.conf</code>, or 1 if no ndots
-      statement is
-      present.  Names with fewer dots are interpreted as relative names and
-      will be searched for in the domains listed in the <span class="type">search</span>
-      or <span class="type">domain</span> directive in
-      <code class="filename">/etc/resolv.conf</code>.
-    </p>
-<p>
-      The number of UDP retries for a lookup can be changed with the
-      <code class="option">-R</code> option.  <em class="parameter"><code>number</code></em>
-      indicates
-      how many times <span class="command"><strong>host</strong></span> will repeat a query
-      that does
-      not get answered.  The default number of retries is 1.  If
-      <em class="parameter"><code>number</code></em> is negative or zero, the
-      number of
-      retries will default to 1.
-    </p>
-<p>
-      Non-recursive queries can be made via the <code class="option">-r</code> option.
-      Setting this option clears the <span class="type">RD</span> &#8212; recursion
-      desired &#8212; bit in the query which <span class="command"><strong>host</strong></span> makes.
-      This should mean that the name server receiving the query will not
-      attempt to resolve <em class="parameter"><code>name</code></em>.  The
-      <code class="option">-r</code> option enables <span class="command"><strong>host</strong></span>
-      to mimic
-      the behavior of a name server by making non-recursive queries and
-      expecting to receive answers to those queries that are usually
-      referrals to other name servers.
-    </p>
-<p>
-      By default, <span class="command"><strong>host</strong></span> uses UDP when making
-      queries.  The
-      <code class="option">-T</code> option makes it use a TCP connection when querying
-      the name server.  TCP will be automatically selected for queries that
-      require it, such as zone transfer (AXFR) requests.
-    </p>
-<p>
-      The <code class="option">-4</code> option forces <span class="command"><strong>host</strong></span> to only
-      use IPv4 query transport.  The <code class="option">-6</code> option forces
-      <span class="command"><strong>host</strong></span> to only use IPv6 query transport.
-    </p>
-<p>
-      The <code class="option">-t</code> option is used to select the query type.
-      <em class="parameter"><code>type</code></em> can be any recognized query
-      type: CNAME,
-      NS, SOA, SIG, KEY, AXFR, etc.  When no query type is specified,
-      <span class="command"><strong>host</strong></span> automatically selects an appropriate
-      query
-      type.  By default, it looks for A, AAAA, and MX records, but if the
-      <code class="option">-C</code> option was given, queries will be made for SOA
-      records, and if <em class="parameter"><code>name</code></em> is a
-      dotted-decimal IPv4
-      address or colon-delimited IPv6 address, <span class="command"><strong>host</strong></span> will
-      query for PTR records.  If a query type of IXFR is chosen the starting
-      serial number can be specified by appending an equal followed by the
-      starting serial number (e.g. -t IXFR=12345678).
-    </p>
-<p>
-      The time to wait for a reply can be controlled through the
-      <code class="option">-W</code> and <code class="option">-w</code> options.  The
-      <code class="option">-W</code> option makes <span class="command"><strong>host</strong></span>
-      wait for
-      <em class="parameter"><code>wait</code></em> seconds.  If <em class="parameter"><code>wait</code></em>
-      is less than one, the wait interval is set to one second.  When the
-      <code class="option">-w</code> option is used, <span class="command"><strong>host</strong></span>
-      will
-      effectively wait forever for a reply.  The time to wait for a response
-      will be set to the number of seconds given by the hardware's maximum
-      value for an integer quantity.
-    </p>
-<p>
-      The <code class="option">-s</code> option tells <span class="command"><strong>host</strong></span>
-      <span class="emphasis"><em>not</em></span> to send the query to the next nameserver
-      if any server responds with a SERVFAIL response, which is the
-      reverse of normal stub resolver behavior.
-    </p>
-<p>
-      The <code class="option">-m</code> can be used to set the memory usage debugging
-      flags
-      <em class="parameter"><code>record</code></em>, <em class="parameter"><code>usage</code></em> and
-      <em class="parameter"><code>trace</code></em>.
-    </p>
-<p>
-      The <code class="option">-V</code> option causes <span class="command"><strong>host</strong></span>
-      to print the version number and exit.
-    </p>
-</div>
-<div class="refsection">
-<a name="id-1.8"></a><h2>IDN SUPPORT</h2>
-<p>
+
+  </div>
+
+  <div class="refsection">
+<a name="id-1.8"></a><h2>OPTIONS</h2>
+
+    <div class="variablelist"><dl class="variablelist">
+<dt><span class="term">-4</span></dt>
+<dd>
+	  <p>
+	    Use IPv4 only for query transport.
+	    See also the <code class="option">-6</code> option.
+	  </p>
+	</dd>
+<dt><span class="term">-6</span></dt>
+<dd>
+	  <p>
+	    Use IPv6 only for query transport.
+	    See also the <code class="option">-4</code> option.
+	  </p>
+	</dd>
+<dt><span class="term">-a</span></dt>
+<dd>
+	  <p>
+	    "All". The <code class="option">-a</code> option is normally equivalent
+	    to <code class="option">-v -t <code class="literal">ANY</code></code>.
+	    It also affects the behaviour of the <code class="option">-l</code>
+	    list zone option.
+	  </p>
+	</dd>
+<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
+<dd>
+	  <p>
+	    Query class: This can be used to lookup HS (Hesiod) or CH
+	    (Chaosnet) class resource records. The default class is IN
+	    (Internet).
+	  </p>
+	</dd>
+<dt><span class="term">-C</span></dt>
+<dd>
+	  <p>
+	    Check consistency: <span class="command"><strong>host</strong></span> will query the
+	    SOA records for zone <em class="parameter"><code>name</code></em> from all
+	    the listed authoritative name servers for that zone. The
+	    list of name servers is defined by the NS records that are
+	    found for the zone.
+	  </p>
+	</dd>
+<dt><span class="term">-d</span></dt>
+<dd>
+	  <p>
+	    Print debugging traces.
+	    Equivalent to the <code class="option">-v</code> verbose option.
+	  </p>
+	</dd>
+<dt><span class="term">-i</span></dt>
+<dd>
+	  <p>
+	    Obsolete.
+	    Use the IP6.INT domain for reverse lookups of IPv6
+	    addresses as defined in RFC1886 and deprecated in RFC4159.
+	    The default is to use IP6.ARPA as specified in RFC3596.
+	  </p>
+	</dd>
+<dt><span class="term">-l</span></dt>
+<dd>
+	  <p>
+	    List zone:
+	    The <span class="command"><strong>host</strong></span> command performs a zone transfer of
+	    zone <em class="parameter"><code>name</code></em> and prints out the NS,
+	    PTR and address records (A/AAAA).
+	  </p>
+	  <p>
+	    Together, the <code class="option">-l -a</code>
+	    options print all records in the zone.
+	  </p>
+	</dd>
+<dt><span class="term">-N <em class="replaceable"><code>ndots</code></em></span></dt>
+<dd>
+	  <p>
+	    The number of dots that have to be
+	    in <em class="parameter"><code>name</code></em> for it to be considered
+	    absolute. The default value is that defined using the
+	    ndots statement in <code class="filename">/etc/resolv.conf</code>,
+	    or 1 if no ndots statement is present. Names with fewer
+	    dots are interpreted as relative names and will be
+	    searched for in the domains listed in
+	    the <span class="type">search</span> or <span class="type">domain</span> directive
+	    in <code class="filename">/etc/resolv.conf</code>.
+	  </p>
+	</dd>
+<dt><span class="term">-r</span></dt>
+<dd>
+	  <p>
+	    Non-recursive query:
+	    Setting this option clears the RD (recursion desired) bit
+	    in the query. This should mean that the name server
+	    receiving the query will not attempt to
+	    resolve <em class="parameter"><code>name</code></em>.
+	    The <code class="option">-r</code> option
+	    enables <span class="command"><strong>host</strong></span> to mimic the behavior of a
+	    name server by making non-recursive queries and expecting
+	    to receive answers to those queries that can be
+	    referrals to other name servers.
+	  </p>
+	</dd>
+<dt><span class="term">-R <em class="replaceable"><code>number</code></em></span></dt>
+<dd>
+	  <p>
+	    Number of retries for UDP queries:
+	    If <em class="parameter"><code>number</code></em> is negative or zero, the
+	    number of retries will default to 1. The default value is 1.
+	  </p>
+	</dd>
+<dt><span class="term">-s</span></dt>
+<dd>
+	  <p>
+	    Do <span class="emphasis"><em>not</em></span> send the query to the next
+	    nameserver if any server responds with a SERVFAIL
+	    response, which is the reverse of normal stub resolver
+	    behavior.
+	  </p>
+	</dd>
+<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
+<dd>
+	  <p>
+	    Query type:
+	    The <em class="parameter"><code>type</code></em> argument can be any
+	    recognized query type: CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.
+	  </p>
+	  <p>
+	    When no query type is specified, <span class="command"><strong>host</strong></span>
+	    automatically selects an appropriate query type. By default, it
+	    looks for A, AAAA, and MX records.
+	    If the <code class="option">-C</code> option is given, queries will
+	    be made for SOA records.
+	    If <em class="parameter"><code>name</code></em> is a dotted-decimal IPv4
+	    address or colon-delimited IPv6
+	    address, <span class="command"><strong>host</strong></span> will query for PTR
+	    records.
+	  </p>
+	  <p>
+	    If a query type of IXFR is chosen the starting serial
+	    number can be specified by appending an equal followed by
+	    the starting serial number
+	    (like <code class="option">-t <code class="literal">IXFR=12345678</code></code>).
+	  </p>
+	</dd>
+<dt><span class="term">-T</span></dt>
+<dd>
+	  <p>
+	    TCP:
+	    By default, <span class="command"><strong>host</strong></span> uses UDP when making
+	    queries. The <code class="option">-T</code> option makes it use a TCP
+	    connection when querying the name server. TCP will be
+	    automatically selected for queries that require it, such
+	    as zone transfer (AXFR) requests.
+	  </p>
+	</dd>
+<dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
+<dd>
+	  <p>
+	    Memory usage debugging: the flag can
+	    be <em class="parameter"><code>record</code></em>, <em class="parameter"><code>usage</code></em>,
+	    or <em class="parameter"><code>trace</code></em>. You can specify
+	    the <code class="option">-m</code> option more than once to set
+	    multiple flags.
+	  </p>
+	</dd>
+<dt><span class="term">-v</span></dt>
+<dd>
+	  <p>
+	    Verbose output.
+	    Equivalent to the <code class="option">-d</code> debug option.
+	  </p>
+	</dd>
+<dt><span class="term">-V</span></dt>
+<dd>
+	  <p>
+	    Print the version number and exit.
+	  </p>
+	</dd>
+<dt><span class="term">-w</span></dt>
+<dd>
+	  <p>
+	    Wait forever: The query timeout is set to the maximum possible.
+	    See also the <code class="option">-W</code> option.
+	  </p>
+	</dd>
+<dt><span class="term">-W <em class="replaceable"><code>wait</code></em></span></dt>
+<dd>
+	  <p>
+	    Timeout: Wait for up to <em class="parameter"><code>wait</code></em>
+	    seconds for a reply. If <em class="parameter"><code>wait</code></em> is
+	    less than one, the wait interval is set to one second.
+	  </p>
+	  <p>
+	    By default, <span class="command"><strong>host</strong></span> will wait for 5
+	    seconds for UDP responses and 10 seconds for TCP
+	    connections.
+	  </p>
+	  <p>
+	    See also the <code class="option">-w</code> option.
+	  </p>
+	</dd>
+</dl></div>
+
+  </div>
+
+  <div class="refsection">
+<a name="id-1.9"></a><h2>IDN SUPPORT</h2>
+
+    <p>
      If <span class="command"><strong>host</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
      <span class="command"><strong>host</strong></span> appropriately converts character encoding of
@@ -199,17 +305,26 @@
      The IDN support is disabled if the variable is set when
      <span class="command"><strong>host</strong></span> runs.
    </p>
-</div>
-<div class="refsection">
-<a name="id-1.9"></a><h2>FILES</h2>
-<p><code class="filename">/etc/resolv.conf</code>
+  </div>
+
+  <div class="refsection">
+<a name="id-1.10"></a><h2>FILES</h2>
+
+    <p><code class="filename">/etc/resolv.conf</code>
    </p>
-</div>
-<div class="refsection">
-<a name="id-1.10"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
+  </div>
+
+  <div class="refsection">
+<a name="id-1.11"></a><h2>SEE ALSO</h2>
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dig</span>(1)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named</span>(8)
+      </span>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009, 2011-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -129,7 +129,8 @@ struct dig_lookup {
 		done_as_is,
 		besteffort,
 		dnssec,
-		nsid;   /*% Name Server ID (RFC 5001) */
+		nsid,   /*% Name Server ID (RFC 5001) */
+		idnout;
 #ifdef DIG_SIGCHASE
 isc_boolean_t	sigchase;
 #if DIG_SIGCHASE_TD
@@ -161,7 +162,6 @@ isc_boolean_t	sigchase;
 	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
-	isc_timer_t *timer;
 	isc_interval_t interval;
 	dns_message_t *sendmsg;
 	dns_name_t *oname;
@@ -196,7 +196,8 @@ struct dig_query {
 		second_rr_rcvd,
 		first_repeat_rcvd,
 		recv_made,
-		warn_id;
+		warn_id,
+		timedout;
 	isc_uint32_t first_rr_serial;
 	isc_uint32_t second_rr_serial;
 	isc_uint32_t msg_count;
@@ -221,6 +222,7 @@ struct dig_query {
 	isc_time_t time_recv;
 	isc_uint64_t byte_count;
 	isc_buffer_t sendbuf;
+	isc_timer_t *timer;
 };

 struct dig_server {
@@ -330,7 +332,7 @@ void
 setup_libs(void);

 void
-setup_system(void);
+setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only);

 isc_result_t
 parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
@@ -415,6 +417,9 @@ void
 chase_sig(dns_message_t *msg);
 #endif

+void setup_file_key(void);
+void setup_text_key(void);
+
 ISC_LANG_ENDDECLS

 #endif
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -27,7 +27,6 @@
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/string.h>
-#include <isc/timer.h>
 #include <isc/util.h>
 #include <isc/task.h>
 #include <isc/netaddr.h>
@@ -45,9 +44,20 @@
 #include <dig/dig.h>

 #if defined(HAVE_READLINE)
+#if defined(HAVE_EDIT_READLINE_READLINE_H)
+#include <edit/readline/readline.h>
+#if defined(HAVE_EDIT_READLINE_HISTORY_H)
+#include <edit/readline/history.h>
+#endif
+#elif defined(HAVE_EDITLINE_READLINE_H)
+#include <editline/readline.h>
+#elif defined(HAVE_READLINE_READLINE_H)
 #include <readline/readline.h>
+#if defined (HAVE_READLINE_HISTORY_H)
 #include <readline/history.h>
 #endif
+#endif
+#endif

 static isc_boolean_t short_form = ISC_TRUE,
 	tcpmode = ISC_FALSE,
@@ -866,8 +876,6 @@ flush_lookup_list(void) {
 		}
 		if (l->sendmsg != NULL)
 			dns_message_destroy(&l->sendmsg);
-		if (l->timer != NULL)
-			isc_timer_detach(&l->timer);
 		lp = l;
 		l = ISC_LIST_NEXT(l, link);
 		ISC_LIST_DEQUEUE(lookup_list, lp, link);
@@ -908,9 +916,12 @@ main(int argc, char **argv) {
 	setup_libs();
 	progname = argv[0];

+	setup_system(ISC_FALSE, ISC_FALSE);
 	parse_args(argc, argv);
-
-	setup_system();
+	if (keyfile[0] != 0)
+		setup_file_key();
+	else if (keysecret[0] != 0)
+		setup_text_key();
 	if (domainopt[0] != '\0')
 		set_search_domain(domainopt);
 	if (in_use)
@@ -43,7 +43,7 @@
 - SUCH DAMAGE.
 -->
 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.nslookup">
  <info>
    <date>2014-01-24</date>
  </info>
@@ -1,3 +1,4 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
 - Copyright (C) 2004-2007, 2010, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
@@ -13,25 +14,43 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>nslookup</title>
 <meta name="generator" content="DocBook XSL Stylesheets V1.78.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
-<a name="id-1"></a><div class="titlepage"></div>
-<div class="refnamediv">
+<a name="man.nslookup"></a><div class="titlepage"></div>
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p>nslookup &#8212; query Internet name servers interactively</p>
+<p>
+    nslookup
+     &#8212; query Internet name servers interactively
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">nslookup</code>  [<code class="option">-option</code>] [name | -] [server]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">nslookup</code> 
+       [<code class="option">-option</code>]
+       [name | -]
+       [server]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>Nslookup</strong></span>
+
+    <p><span class="command"><strong>Nslookup</strong></span>
      is a program to query Internet domain name servers.  <span class="command"><strong>Nslookup</strong></span>
      has two modes: interactive and non-interactive.  Interactive mode allows
      the user to query name servers for information about various hosts and
@@ -40,29 +59,37 @@
      used to print just the name and requested information for a host or
      domain.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>ARGUMENTS</h2>
-<p>
+
+    <p>
      Interactive mode is entered in the following cases:
      </p>
 <div class="orderedlist"><ol class="orderedlist" type="a">
-<li class="listitem"><p>
+<li class="listitem">
+          <p>
            when no arguments are given (the default name server will be used)
-          </p></li>
-<li class="listitem"><p>
+          </p>
+        </li>
+<li class="listitem">
+          <p>
            when the first argument is a hyphen (-) and the second argument is
            the host name or Internet address of a name server.
-          </p></li>
+          </p>
+        </li>
 </ol></div>
 <p>
    </p>
-<p>
+
+    <p>
      Non-interactive mode is used when the name or Internet address of the
      host to be looked up is given as the first argument. The optional second
      argument specifies the host name or address of a name server.
    </p>
-<p>
+
+    <p>
      Options can also be specified on the command line if they precede the
      arguments and are prefixed with a hyphen.  For example, to
      change the default query type to host information, and the initial
@@ -75,246 +102,299 @@ nslookup -query=hinfo  -timeout=10
 <p>
      
    </p>
-<p>
+    <p>
      The <code class="option">-version</code> option causes
      <span class="command"><strong>nslookup</strong></span> to print the version
      number and immediately exits.
    </p>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>INTERACTIVE COMMANDS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="constant">host</code> [<span class="optional">server</span>]</span></dt>
 <dd>
-<p>
+          <p>
            Look up information for host using the current default server or
            using server, if specified.  If host is an Internet address and
            the query type is A or PTR, the name of the host is returned.
            If host is a name and does not have a trailing period, the
            search list is used to qualify the name.
          </p>
-<p>
+
+          <p>
            To look up a host not in the current domain, append a period to
            the name.
          </p>
-</dd>
+        </dd>
 <dt><span class="term"><code class="constant">server</code> <em class="replaceable"><code>domain</code></em></span></dt>
-<dd><p></p></dd>
+<dd>
+          <p></p>
+        </dd>
 <dt><span class="term"><code class="constant">lserver</code> <em class="replaceable"><code>domain</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Change the default server to <em class="replaceable"><code>domain</code></em>; <code class="constant">lserver</code> uses the initial
            server to look up information about <em class="replaceable"><code>domain</code></em>, while <code class="constant">server</code> uses
            the current default server.  If an authoritative answer can't be
            found, the names of servers that might have the answer are
            returned.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">root</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            not implemented
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">finger</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            not implemented
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">ls</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            not implemented
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">view</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            not implemented
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">help</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            not implemented
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">?</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            not implemented
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">exit</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            Exits the program.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="constant">set</code>
          <em class="replaceable"><code>keyword[<span class="optional">=value</span>]</code></em></span></dt>
 <dd>
-<p>
+          <p>
            This command is used to change state information that affects
            the lookups.  Valid keywords are:
            </p>
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="constant">all</code></span></dt>
-<dd><p>
+<dd>
+                  <p>
                    Prints the current values of the frequently used
                    options to <span class="command"><strong>set</strong></span>.
                    Information about the  current default
                    server and host is also printed.
-                  </p></dd>
+                  </p>
+                </dd>
 <dt><span class="term"><code class="constant">class=</code><em class="replaceable"><code>value</code></em></span></dt>
 <dd>
-<p>
+                  <p>
                    Change the query class to one of:
                    </p>
 <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="constant">IN</code></span></dt>
-<dd><p>
+<dd>
+                          <p>
                            the Internet class
-                          </p></dd>
+                          </p>
+                        </dd>
 <dt><span class="term"><code class="constant">CH</code></span></dt>
-<dd><p>
+<dd>
+                          <p>
                            the Chaos class
-                          </p></dd>
+                          </p>
+                        </dd>
 <dt><span class="term"><code class="constant">HS</code></span></dt>
-<dd><p>
+<dd>
+                          <p>
                            the Hesiod class
-                          </p></dd>
+                          </p>
+                        </dd>
 <dt><span class="term"><code class="constant">ANY</code></span></dt>
-<dd><p>
+<dd>
+                          <p>
                            wildcard
-                          </p></dd>
+                          </p>
+                        </dd>
 </dl></div>
 <p>
                    The class specifies the protocol group of the information.

                  </p>
-<p>
+		  <p>
                    (Default = IN; abbreviation = cl)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt>
 <dd>
-<p>
+                  <p>
 		    Turn on or off the display of the full response packet and
 		    any intermediate response packets when searching.
                  </p>
-<p>
+		  <p>
                    (Default = nodebug; abbreviation = [<span class="optional">no</span>]deb)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>d2</code></span></dt>
 <dd>
-<p>
+                  <p>
                    Turn debugging mode on or off.  This displays more about
 	            what nslookup is doing.
                  </p>
-<p>
+		  <p>
                    (Default = nod2)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">domain=</code><em class="replaceable"><code>name</code></em></span></dt>
-<dd><p>
+<dd>
+                  <p>
                    Sets the search list to <em class="replaceable"><code>name</code></em>.
-                  </p></dd>
+                  </p>
+                </dd>
 <dt><span class="term"><code class="constant">
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>search</code></span></dt>
 <dd>
-<p>
+                  <p>
                    If the lookup request contains at least one period but
                    doesn't end with a trailing period, append the domain
                    names in the domain search list to the request until an
                    answer is received.
                  </p>
-<p>
+		  <p>
                    (Default = search)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">port=</code><em class="replaceable"><code>value</code></em></span></dt>
 <dd>
-<p>
+                  <p>
                    Change the default TCP/UDP name server port to <em class="replaceable"><code>value</code></em>.
                  </p>
-<p>
+		  <p>
                    (Default = 53; abbreviation = po)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">querytype=</code><em class="replaceable"><code>value</code></em></span></dt>
-<dd><p></p></dd>
+<dd>
+                  <p></p>
+                </dd>
 <dt><span class="term"><code class="constant">type=</code><em class="replaceable"><code>value</code></em></span></dt>
 <dd>
-<p>
+                  <p>
                    Change the type of the information query.
                  </p>
-<p>
+		  <p>
                    (Default = A; abbreviations = q, ty)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>recurse</code></span></dt>
 <dd>
-<p>
+                  <p>
                    Tell the name server to query other servers if it does not
                    have the
                    information.
                  </p>
-<p>
+		  <p>
                    (Default = recurse; abbreviation = [no]rec)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">ndots=</code><em class="replaceable"><code>number</code></em></span></dt>
-<dd><p>
+<dd>
+                  <p>
 		    Set the number of dots (label separators) in a domain
 		    that will disable searching.  Absolute names always
 		    stop searching.
-                  </p></dd>
+                  </p>
+                </dd>
 <dt><span class="term"><code class="constant">retry=</code><em class="replaceable"><code>number</code></em></span></dt>
-<dd><p>
+<dd>
+                  <p>
                    Set the number of retries to number.
-                  </p></dd>
+                  </p>
+                </dd>
 <dt><span class="term"><code class="constant">timeout=</code><em class="replaceable"><code>number</code></em></span></dt>
-<dd><p>
+<dd>
+                  <p>
                    Change the initial timeout interval for waiting for a
                    reply to number seconds.
-                  </p></dd>
+                  </p>
+                </dd>
 <dt><span class="term"><code class="constant">
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>vc</code></span></dt>
 <dd>
-<p>
+                  <p>
                    Always use a virtual circuit when sending requests to the
                    server.
                  </p>
-<p>
+		  <p>
                    (Default = novc)
                  </p>
-</dd>
+                </dd>
 <dt><span class="term"><code class="constant">
                    <em class="replaceable"><code>[<span class="optional">no</span>]</code></em>fail</code></span></dt>
 <dd>
-<p>
+                  <p>
 		    Try the next nameserver if a nameserver responds with
 		    SERVFAIL or a referral (nofail) or terminate query
 		    (fail) on such a response.
 		  </p>
-<p>
+		  <p>
                    (Default = nofail)
                  </p>
-</dd>
+	        </dd>
 </dl></div>
 <p>
          </p>
-</dd>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>RETURN VALUES</h2>
-<p>
+    <p>
      <span class="command"><strong>nslookup</strong></span> returns with an exit status of 1
      if any query failed, and 0 otherwise.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>FILES</h2>
-<p><code class="filename">/etc/resolv.conf</code>
+
+    <p><code class="filename">/etc/resolv.conf</code>
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.12"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
-      <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dig</span>(1)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">host</span>(1)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named</span>(8)
+      </span>.
    </p>
-</div>
+  </div>
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2005, 2007-2009, 2012-2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005, 2007-2009, 2012-2016  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -119,6 +119,10 @@ install:: ${TARGETS} installdirs
 	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
 	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done

+uninstall::
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done
+
 clean distclean::
 	rm -f ${TARGETS}

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -186,5 +186,5 @@ RFC 4509\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2008-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-dsfromkey">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-dsfromkey">
  <info>
    <date>2012-05-17</date>
  </info>
@@ -44,6 +44,7 @@
      <year>2012</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-dsfromkey</title>
@@ -21,158 +22,242 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-dsfromkey"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-dsfromkey</span> &#8212; DNSSEC DS RR generation tool</p>
+<p>
+    <span class="application">dnssec-dsfromkey</span>
+     &#8212; DNSSEC DS RR generation tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-C</code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
-<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
-<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-dsfromkey</code> 
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-1</code>]
+       [<code class="option">-2</code>]
+       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
+       [<code class="option">-C</code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
+       {keyfile}
+    </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-dsfromkey</code> 
+       {-s}
+       [<code class="option">-1</code>]
+       [<code class="option">-2</code>]
+       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-s</code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
+       [<code class="option">-A</code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       {dnsname}
+   </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-dsfromkey</code> 
+       [<code class="option">-h</code>]
+       [<code class="option">-V</code>]
+   </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-dsfromkey</strong></span>
+
+    <p><span class="command"><strong>dnssec-dsfromkey</strong></span>
      outputs the Delegation Signer (DS) resource record (RR), as defined in
      RFC 3658 and RFC 4509, for the given key(s).
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
-<dd><p>
+<dd>
+          <p>
            Use SHA-1 as the digest algorithm (the default is to use
            both SHA-1 and SHA-256).
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-2</span></dt>
-<dd><p>
+<dd>
+          <p>
            Use SHA-256 as the digest algorithm.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Select the digest algorithm. The value of
            <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
            SHA-256 (SHA256), GOST or SHA-384 (SHA384).
            These values are case insensitive.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-C</span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate CDS records rather than DS records.  This is mutually
 	    exclusive with generating lookaside records.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the TTL of the DS records.
-          </p></dd>
+          </p>
+	  </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Look for key files (or, in keyset mode,
            <code class="filename">keyset-</code> files) in
            <code class="option">directory</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Zone file mode: in place of the keyfile name, the argument is
            the DNS domain name of a zone master file, which can be read
            from <code class="option">file</code>.  If the zone name is the same as
            <code class="option">file</code>, then it may be omitted.
          </p>
-<p>
+          <p>
            If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
            the zone data is read from the standard input.  This makes it
            possible to use the output of the <span class="command"><strong>dig</strong></span>
            command as input, as in:
          </p>
-<p>
+          <p>
            <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-A</span></dt>
-<dd><p>
+<dd>
+          <p>
            Include ZSK's when generating DS records.  Without this option,
            only keys which have the KSK flag set will be converted to DS
            records and printed.  Useful only in zone file mode.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate a DLV set instead of a DS set.  The specified
            <code class="option">domain</code> is appended to the name for each
            record in the set.
            The DNSSEC Lookaside Validation (DLV) RR is described
            in RFC 4431.  This is mutually exclusive with generating
 	    CDS records.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-s</span></dt>
-<dd><p>
+<dd>
+          <p>
            Keyset mode: in place of the keyfile name, the argument is
            the DNS domain name of a keyset file.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the DNS class (default is IN).  Useful only
            in keyset or zone file mode.
-          </p></dd>
+          </p>
+	  </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+          <p>
            Prints usage information.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+          <p>
            Prints version information.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>EXAMPLE</h2>
-<p>
+
+    <p>
      To build the SHA-256 DS RR from the
      <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
      keyfile name, the following command would be issued:
    </p>
-<p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
+    <p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
    </p>
-<p>
+    <p>
      The command would print something like:
    </p>
-<p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
+    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>FILES</h2>
-<p>
+
+    <p>
      The keyfile can be designed by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
      <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
      <span class="refentrytitle">dnssec-keygen</span>(8).
    </p>
-<p>
+    <p>
      The keyset file name is built from the <code class="option">directory</code>,
      the string <code class="filename">keyset-</code> and the
      <code class="option">dnsname</code>.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>CAVEAT</h2>
-<p>
+
+    <p>
      A keyfile error can give a "file not found" even if the file exists.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.12"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dnssec-keygen</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">dnssec-signzone</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 3658</em>,
      <em class="citetitle">RFC 4431</em>.
      <em class="citetitle">RFC 4509</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -132,5 +132,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-importkey">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-importkey">
  <info>
    <date>2014-02-07</date>
  </info>
@@ -40,6 +40,7 @@
      <year>2013</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-importkey</title>
@@ -21,18 +22,52 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-importkey"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-importkey</span> &#8212; Import DNSKEY records from external systems so they can be managed.</p>
+<p>
+    <span class="application">dnssec-importkey</span>
+     &#8212; Import DNSKEY records from external systems so they can be managed.
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] {<code class="option">keyfile</code>}</p></div>
-<div class="cmdsynopsis"><p><code class="command">dnssec-importkey</code>  {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>} [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">dnsname</code>]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-importkey</code> 
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-V</code>]
+       {<code class="option">keyfile</code>}
+    </p></div>
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-importkey</code> 
+       {<code class="option">-f <em class="replaceable"><code>filename</code></em></code>}
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-V</code>]
+       [<code class="option">dnsname</code>]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-importkey</strong></span>
+
+    <p><span class="command"><strong>dnssec-importkey</strong></span>
      reads a public DNSKEY record and generates a pair of
      .key/.private files.  The DNSKEY record may be read from an
      existing .key file, in which case a corresponding .private file
@@ -40,7 +75,7 @@
      from the standard input, in which case both .key and .private
      files will be generated.
    </p>
-<p>
+    <p>
      The newly-created .private file does <span class="emphasis"><em>not</em></span>
      contain private key data, and cannot be used for signing.
      However, having a .private file makes it possible to set
@@ -49,53 +84,68 @@
      public key can be added to and removed from the DNSKEY RRset
      on schedule even if the true private key is stored offline.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-f <em class="replaceable"><code>filename</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Zone file mode: instead of a public keyfile name, the argument
 	    is the DNS domain name of a zone master file, which can be read
            from <code class="option">file</code>.  If the domain name is the same as
            <code class="option">file</code>, then it may be omitted.
          </p>
-<p>
+          <p>
            If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
            the zone data is read from the standard input.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the directory in which the key files are to reside.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the default TTL to use for this key when it is converted
            into a DNSKEY RR.  If the key is imported into a zone,
            this is the TTL that will be used for it, unless there was
            already a DNSKEY RRset in place, in which case the existing TTL
            would take precedence.  Setting the default TTL to
            <code class="literal">0</code> or <code class="literal">none</code> removes it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Emit usage message and exit.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints version information.
-	  </p></dd>
+	  </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>TIMING OPTIONS</h2>
-<p>
+
+    <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
      an offset from the present time.  For convenience, if such an offset
@@ -106,37 +156,51 @@
      is computed in seconds.  To explicitly prevent a date from being
      set, use 'none' or 'never'.
    </p>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which a key is to be published to the zone.
            After that date, the key will be included in the zone but will
            not be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be deleted.  After that
            date, the key will no longer be included in the zone.  (It
            may remain in the key repository, however.)
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>FILES</h2>
-<p>
+
+    <p>
      A keyfile can be designed by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
      <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
      <span class="refentrytitle">dnssec-keygen</span>(8).
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dnssec-keygen</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">dnssec-signzone</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 5011</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -284,5 +284,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2008-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-keyfromlabel">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-keyfromlabel">
  <info>
    <date>2014-02-27</date>
  </info>
@@ -44,6 +44,7 @@
      <year>2012</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-keyfromlabel</title>
@@ -21,17 +22,56 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-keyfromlabel</span> &#8212; DNSSEC key generation tool</p>
+<p>
+    <span class="application">dnssec-keyfromlabel</span>
+     &#8212; DNSSEC key generation tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code>  {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y</code>] {name}</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-keyfromlabel</code> 
+       {-l <em class="replaceable"><code>label</code></em>}
+       [<code class="option">-3</code>]
+       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
+       [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>]
+       [<code class="option">-G</code>]
+       [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>]
+       [<code class="option">-k</code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
+       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
+       [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
+       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-V</code>]
+       [<code class="option">-y</code>]
+       {name}
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
+
+    <p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
      generates a key pair of files that referencing a key object stored
      in a cryptographic hardware service module (HSM).  The private key
      file can be used for DNSSEC signing of zone data as if it were a
@@ -39,68 +79,80 @@
      but the key material is stored within the HSM, and the actual signing
      takes place there.
    </p>
-<p>
+    <p>
      The <code class="option">name</code> of the key is specified on the command
      line.  This must match the name of the zone for which the key is
      being generated.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
-<p>
+	  <p>
 	    Selects the cryptographic algorithm.  The value of
            <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 or ECDSAP384SHA384.
 	    These values are case insensitive.
 	  </p>
-<p>
+          <p>
            If no algorithm is specified, then RSASHA1 will be used by
            default, unless the <code class="option">-3</code> option is specified,
            in which case NSEC3RSASHA1 will be used instead.  (If
            <code class="option">-3</code> is used and an algorithm is specified,
            that algorithm will be checked for compatibility with NSEC3.)
          </p>
-<p>
+          <p>
            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
            algorithm, and DSA is recommended.
          </p>
-<p>
+          <p>
            Note 2: DH automatically sets the -k flag.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-3</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
            If this option is used and no algorithm is explicitly
            set on the command line, NSEC3RSASHA1 will be used by
            default.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the name of the crypto hardware (OpenSSL engine).
            When compiled with PKCS#11 support it defaults to "pkcs11".
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the label of the key pair in the crypto hardware.
            The label may be preceded by an optional OpenSSL engine name,
            separated by a colon, as in "pkcs11:keylabel".
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the owner type of the key.  The value of
            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
            a host (KEY)),
            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
            These values are case insensitive.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-C</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Compatibility mode:  generates an old-style key, without
 	    any metadata.  By default, <span class="command"><strong>dnssec-keyfromlabel</strong></span>
 	    will include the key's creation date in the metadata stored
@@ -108,53 +160,71 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Indicates that the DNS record containing the key should have
            the specified class.  If not specified, class IN is used.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Set the specified flag in the flag field of the KEY/DNSKEY record.
            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-G</span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate a key, but do not publish it or sign with it.  This
            option is incompatible with -P and -A.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+          <p>
            Prints a short summary of the options and arguments to
            <span class="command"><strong>dnssec-keyfromlabel</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the directory in which the key files are to be written.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-k</span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate KEY records rather than DNSKEY records.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the default TTL to use for this key when it is converted
            into a DNSKEY RR.  If the key is imported into a zone,
            this is the TTL that will be used for it, unless there was
            already a DNSKEY RRset in place, in which case the existing TTL
            would take precedence.  Setting the default TTL to
            <code class="literal">0</code> or <code class="literal">none</code> removes it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the protocol value for the key.  The protocol
            is a number between 0 and 255.  The default is 3 (DNSSEC).
            Other possible values for this argument are listed in
            RFC 2535 and its successors.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate a key as an explicit successor to an existing key.
 	    The name, algorithm, size, and type of the key will be set
 	    to match the predecessor. The activation date of the new
@@ -162,35 +232,47 @@
 	    one. The publication date will be set to the activation
 	    date minus the prepublication interval, which defaults to
 	    30 days.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Indicates the use of the key.  <code class="option">type</code> must be
            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
            is AUTHCONF.  AUTH refers to the ability to authenticate
            data, and CONF the ability to encrypt data.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints version information.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-y</span></dt>
-<dd><p>
+<dd>
+          <p>
            Allows DNSSEC key files to be generated even if the key ID
 	    would collide with that of an existing key, in the event of
 	    either key being revoked.  (This is only safe to use if you
            are sure you won't be using RFC 5011 trust anchor maintenance
            with either of the keys involved.)
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>TIMING OPTIONS</h2>
-<p>
+
+
+    <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
      an offset from the present time.  For convenience, if such an offset
@@ -201,42 +283,53 @@
      is computed in seconds.  To explicitly prevent a date from being
      set, use 'none' or 'never'.
    </p>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which a key is to be published to the zone.
            After that date, the key will be included in the zone but will
            not be used to sign it.  If not set, and if the -G option has
            not been used, the default is "now".
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be activated.  After that
            date, the key will be included in the zone and used to sign
            it.  If not set, and if the -G option has not been used, the
            default is "now".
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be revoked.  After that
            date, the key will be flagged as revoked.  It will be included
            in the zone and will be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be retired.  After that
            date, the key will still be included in the zone, but it
            will not be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be deleted.  After that
            date, the key will no longer be included in the zone.  (It
            may remain in the key repository, however.)
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Sets the prepublication interval for a key.  If set, then
            the publication and activation dates must be separated by at least
            this much time.  If the activation date is specified but the
@@ -245,67 +338,82 @@
            the publication date is specified but activation date isn't,
            then activation will be set to this much time after publication.
          </p>
-<p>
+          <p>
            If the key is being created as an explicit successor to another
            key, then the default prepublication interval is 30 days;
            otherwise it is zero.
          </p>
-<p>
+          <p>
            As with date offsets, if the argument is followed by one of
            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
            interval is measured in years, months, weeks, days, hours,
            or minutes, respectively.  Without a suffix, the interval is
            measured in seconds.
          </p>
-</dd>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>GENERATED KEY FILES</h2>
-<p>
+
+    <p>
      When <span class="command"><strong>dnssec-keyfromlabel</strong></span> completes
      successfully,
      it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
      to the standard output.  This is an identification string for
      the key files it has generated.
    </p>
-<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><code class="filename">nnnn</code> is the key name.
-        </p></li>
-<li class="listitem"><p><code class="filename">aaa</code> is the numeric representation
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+        <p><code class="filename">nnnn</code> is the key name.
+        </p>
+      </li>
+<li class="listitem">
+        <p><code class="filename">aaa</code> is the numeric representation
          of the algorithm.
-        </p></li>
-<li class="listitem"><p><code class="filename">iiiii</code> is the key identifier (or
+        </p>
+      </li>
+<li class="listitem">
+        <p><code class="filename">iiiii</code> is the key identifier (or
          footprint).
-        </p></li>
+        </p>
+      </li>
 </ul></div>
-<p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
+    <p><span class="command"><strong>dnssec-keyfromlabel</strong></span>
      creates two files, with names based
      on the printed string.  <code class="filename">Knnnn.+aaa+iiiii.key</code>
      contains the public key, and
      <code class="filename">Knnnn.+aaa+iiiii.private</code> contains the
      private key.
    </p>
-<p>
+    <p>
      The <code class="filename">.key</code> file contains a DNS KEY record
      that
      can be inserted into a zone file (directly or with a $INCLUDE
      statement).
    </p>
-<p>
+    <p>
      The <code class="filename">.private</code> file contains
      algorithm-specific
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dnssec-keygen</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">dnssec-signzone</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 4034</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -317,7 +317,7 @@ Both
 \&.key
 and
 \&.private
-files are generated for symmetric encryption algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
+files are generated for symmetric cryptography algorithms such as HMAC\-MD5, even though the public and private key are equivalent\&.
 .SH "EXAMPLE"
 .PP
 To generate a 768\-bit DSA key for the domain
@@ -347,7 +347,7 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000-2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-keygen">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-keygen">
  <info>
    <date>2014-02-07</date>
  </info>
@@ -48,6 +48,7 @@
      <year>2012</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -589,7 +590,7 @@
    </para>
    <para>
      Both <filename>.key</filename> and <filename>.private</filename>
-      files are generated for symmetric encryption algorithms such as
+      files are generated for symmetric cryptography algorithms such as
      HMAC-MD5, even though the public and private key are equivalent.
    </para>
  </refsection>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004, 2005, 2007-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-keygen</title>
@@ -22,34 +23,82 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-keygen"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-keygen</span> &#8212; DNSSEC key generation tool</p>
+<p>
+    <span class="application">dnssec-keygen</span>
+     &#8212; DNSSEC key generation tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-3</code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-C</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-k</code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-q</code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S <em class="replaceable"><code>key</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-z</code>] {name}</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-keygen</code> 
+       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
+       [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>]
+       [<code class="option">-3</code>]
+       [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-C</code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>]
+       [<code class="option">-G</code>]
+       [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-k</code>]
+       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
+       [<code class="option">-q</code>]
+       [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
+       [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
+       [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
+       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-V</code>]
+       [<code class="option">-z</code>]
+       {name}
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-keygen</strong></span>
+
+    <p><span class="command"><strong>dnssec-keygen</strong></span>
      generates keys for DNSSEC (Secure DNS), as defined in RFC 2535
      and RFC 4034.  It can also generate keys for use with
      TSIG (Transaction Signatures) as defined in RFC 2845, or TKEY
      (Transaction Key) as defined in RFC 2930.
    </p>
-<p>
+    <p>
      The <code class="option">name</code> of the key is specified on the command
      line.  For DNSSEC keys, this must match the name of the zone for
      which the key is being generated.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Selects the cryptographic algorithm.  For DNSSEC keys, the value
            of <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
 	    DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA512, ECCGOST,
@@ -59,26 +108,26 @@
            HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512.  These values are
            case insensitive.
          </p>
-<p>
+          <p>
            If no algorithm is specified, then RSASHA1 will be used by
            default, unless the <code class="option">-3</code> option is specified,
            in which case NSEC3RSASHA1 will be used instead.  (If
            <code class="option">-3</code> is used and an algorithm is specified,
            that algorithm will be checked for compatibility with NSEC3.)
          </p>
-<p>
+          <p>
            Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
            algorithm, and DSA is recommended.  For TSIG, HMAC-MD5 is
 	    mandatory.
          </p>
-<p>
+          <p>
            Note 2: DH, HMAC-MD5, and HMAC-SHA1 through HMAC-SHA512
            automatically set the -T KEY option.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Specifies the number of bits in the key.  The choice of key
            size depends on the algorithm used.  RSA keys must be
            between 512 and 2048 bits.  Diffie Hellman keys must be between
@@ -87,7 +136,7 @@
            between 1 and 512 bits. Elliptic curve algorithms don't need
            this parameter.
          </p>
-<p>
+          <p>
            The key size does not need to be specified if using a default
            algorithm.  The default key size is 1024 bits for zone signing
            keys (ZSK's) and 2048 bits for key signing keys (KSK's,
@@ -96,9 +145,10 @@
            then there is no default key size, and the <code class="option">-b</code>
            must be used.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the owner type of the key.  The value of
            <code class="option">nametype</code> must either be ZONE (for a DNSSEC
            zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
@@ -106,18 +156,22 @@
            USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
            These values are case insensitive.  Defaults to ZONE for DNSKEY
 	    generation.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-3</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Use an NSEC3-capable algorithm to generate a DNSSEC key.
            If this option is used and no algorithm is explicitly
            set on the command line, NSEC3RSASHA1 will be used by
            default. Note that RSASHA256, RSASHA512, ECCGOST,
 	    ECDSAP256SHA256 and ECDSAP384SHA384 algorithms
 	    are NSEC3-capable.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-C</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Compatibility mode:  generates an old-style key, without
 	    any metadata.  By default, <span class="command"><strong>dnssec-keygen</strong></span>
 	    will include the key's creation date in the metadata stored
@@ -125,51 +179,69 @@
 	    (publication date, activation date, etc).  Keys that include
 	    this data may be incompatible with older versions of BIND; the
 	    <code class="option">-C</code> option suppresses them.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Indicates that the DNS record containing the key should have
            the specified class.  If not specified, class IN is used.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Uses a crypto hardware (OpenSSL engine) for random number
            and, when supported, key generation. When compiled with PKCS#11
            support it defaults to pkcs11; the empty name resets it to
            no engine.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Set the specified flag in the flag field of the KEY/DNSKEY record.
            The only recognized flags are KSK (Key Signing Key) and REVOKE.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-G</span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate a key, but do not publish it or sign with it.  This
            option is incompatible with -P and -A.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-g <em class="replaceable"><code>generator</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            If generating a Diffie Hellman key, use this generator.
            Allowed values are 2 and 5.  If no generator
            is specified, a known prime from RFC 2539 will be used
            if possible; otherwise the default is 2.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+          <p>
            Prints a short summary of the options and arguments to
            <span class="command"><strong>dnssec-keygen</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the directory in which the key files are to be written.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-k</span></dt>
-<dd><p>
+<dd>
+          <p>
            Deprecated in favor of -T KEY.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the default TTL to use for this key when it is converted
            into a DNSKEY RR.  If the key is imported into a zone,
            this is the TTL that will be used for it, unless there was
@@ -178,16 +250,20 @@
            is no existing DNSKEY RRset, the TTL will default to the
            SOA TTL. Setting the default TTL to <code class="literal">0</code>
            or <code class="literal">none</code> is the same as leaving it unset.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the protocol value for the generated key.  The protocol
            is a number between 0 and 255.  The default is 3 (DNSSEC).
            Other possible values for this argument are listed in
            RFC 2535 and its successors.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-q</span></dt>
-<dd><p>
+<dd>
+          <p>
            Quiet mode: Suppresses unnecessary output, including
            progress indication.  Without this option, when
            <span class="command"><strong>dnssec-keygen</strong></span> is run interactively
@@ -199,9 +275,11 @@
            round of the Miller-Rabin primality test; a space
            means that the number has passed all the tests and is
            a satisfactory key.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the source of randomness.  If the operating
            system does not provide a <code class="filename">/dev/random</code>
            or equivalent device, the default source of randomness
@@ -211,9 +289,11 @@
            data to be used instead of the default.  The special value
            <code class="filename">keyboard</code> indicates that keyboard
            input should be used.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Create a new key which is an explicit successor to an
            existing key.  The name, algorithm, size, and type of the
            key will be set to match the existing key.  The activation
@@ -221,16 +301,19 @@
            the existing one.  The publication date will be set to the
            activation date minus the prepublication interval, which
            defaults to 30 days.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>strength</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the strength value of the key.  The strength is
            a number between 0 and 15, and currently has no defined
            purpose in DNSSEC.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>rrtype</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Specifies the resource record type to use for the key.
            <code class="option">rrtype</code> must be either DNSKEY or KEY.  The
            default is DNSKEY when using a DNSSEC algorithm, but it can be
@@ -242,27 +325,36 @@
            Using any TSIG algorithm (HMAC-* or DH) forces this option
            to KEY.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Indicates the use of the key.  <code class="option">type</code> must be
            one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF.  The default
            is AUTHCONF.  AUTH refers to the ability to authenticate
            data, and CONF the ability to encrypt data.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints version information.
-	  </p></dd>
+	  </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>TIMING OPTIONS</h2>
-<p>
+
+
+    <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
      an offset from the present time.  For convenience, if such an offset
@@ -273,44 +365,55 @@
      is computed in seconds.  To explicitly prevent a date from being
      set, use 'none' or 'never'.
    </p>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which a key is to be published to the zone.
            After that date, the key will be included in the zone but will
            not be used to sign it.  If not set, and if the -G option has
            not been used, the default is "now".
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be activated.  After that
            date, the key will be included in the zone and used to sign
            it.  If not set, and if the -G option has not been used, the
            default is "now".  If set, if and -P is not set, then
            the publication date will be set to the activation date
            minus the prepublication interval.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be revoked.  After that
            date, the key will be flagged as revoked.  It will be included
            in the zone and will be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be retired.  After that
            date, the key will still be included in the zone, but it
            will not be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be deleted.  After that
            date, the key will no longer be included in the zone.  (It
            may remain in the key repository, however.)
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Sets the prepublication interval for a key.  If set, then
            the publication and activation dates must be separated by at least
            this much time.  If the activation date is specified but the
@@ -319,42 +422,51 @@
            the publication date is specified but activation date isn't,
            then activation will be set to this much time after publication.
          </p>
-<p>
+          <p>
            If the key is being created as an explicit successor to another
            key, then the default prepublication interval is 30 days;
            otherwise it is zero.
          </p>
-<p>
+          <p>
            As with date offsets, if the argument is followed by one of
            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
            interval is measured in years, months, weeks, days, hours,
            or minutes, respectively.  Without a suffix, the interval is
            measured in seconds.
          </p>
-</dd>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>GENERATED KEYS</h2>
-<p>
+
+    <p>
      When <span class="command"><strong>dnssec-keygen</strong></span> completes
      successfully,
      it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
      to the standard output.  This is an identification string for
      the key it has generated.
    </p>
-<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
-<li class="listitem"><p><code class="filename">nnnn</code> is the key name.
-        </p></li>
-<li class="listitem"><p><code class="filename">aaa</code> is the numeric representation
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+        <p><code class="filename">nnnn</code> is the key name.
+        </p>
+      </li>
+<li class="listitem">
+        <p><code class="filename">aaa</code> is the numeric representation
          of the
          algorithm.
-        </p></li>
-<li class="listitem"><p><code class="filename">iiiii</code> is the key identifier (or
+        </p>
+      </li>
+<li class="listitem">
+        <p><code class="filename">iiiii</code> is the key identifier (or
          footprint).
-        </p></li>
+        </p>
+      </li>
 </ul></div>
-<p><span class="command"><strong>dnssec-keygen</strong></span>
+    <p><span class="command"><strong>dnssec-keygen</strong></span>
      creates two files, with names based
      on the printed string.  <code class="filename">Knnnn.+aaa+iiiii.key</code>
      contains the public key, and
@@ -362,53 +474,60 @@
      private
      key.
    </p>
-<p>
+    <p>
      The <code class="filename">.key</code> file contains a DNS KEY record
      that
      can be inserted into a zone file (directly or with a $INCLUDE
      statement).
    </p>
-<p>
+    <p>
      The <code class="filename">.private</code> file contains
      algorithm-specific
      fields.  For obvious security reasons, this file does not have
      general read permission.
    </p>
-<p>
+    <p>
      Both <code class="filename">.key</code> and <code class="filename">.private</code>
-      files are generated for symmetric encryption algorithms such as
+      files are generated for symmetric cryptography algorithms such as
      HMAC-MD5, even though the public and private key are equivalent.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>EXAMPLE</h2>
-<p>
+
+    <p>
      To generate a 768-bit DSA key for the domain
      <strong class="userinput"><code>example.com</code></strong>, the following command would be
      issued:
    </p>
-<p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
+    <p><strong class="userinput"><code>dnssec-keygen -a DSA -b 768 -n ZONE example.com</code></strong>
    </p>
-<p>
+    <p>
      The command would print a string of the form:
    </p>
-<p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
+    <p><strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
    </p>
-<p>
+    <p>
      In this example, <span class="command"><strong>dnssec-keygen</strong></span> creates
      the files <code class="filename">Kexample.com.+003+26160.key</code>
      and
      <code class="filename">Kexample.com.+003+26160.private</code>.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.12"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dnssec-signzone</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 2539</em>,
      <em class="citetitle">RFC 2845</em>,
      <em class="citetitle">RFC 4034</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -102,5 +102,5 @@ BIND 9 Administrator Reference Manual,
 RFC 5011\&.
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2009, 2011, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-revoke">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-revoke">
  <info>
    <date>2011-10-20</date>
  </info>
@@ -37,6 +37,7 @@
      <year>2011</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-revoke</title>
@@ -21,70 +22,116 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-revoke"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-revoke</span> &#8212; Set the REVOKED bit on a DNSSEC key</p>
+<p>
+    <span class="application">dnssec-revoke</span>
+     &#8212; Set the REVOKED bit on a DNSSEC key
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-revoke</code>  [<code class="option">-hr</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f</code>] [<code class="option">-R</code>] {keyfile}</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-revoke</code> 
+       [<code class="option">-hr</code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-V</code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
+       [<code class="option">-f</code>]
+       [<code class="option">-R</code>]
+       {keyfile}
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.6"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-revoke</strong></span>
+
+    <p><span class="command"><strong>dnssec-revoke</strong></span>
      reads a DNSSEC key file, sets the REVOKED bit on the key as defined
      in RFC 5011, and creates a new pair of key files containing the
      now-revoked key.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Emit usage message and exit.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the directory in which the key files are to reside.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-r</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    After writing the new keyset files remove the original keyset
 	    files.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints version information.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use the given OpenSSL engine. When compiled with PKCS#11 support
            it defaults to pkcs11; the empty name resets it to no engine.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-f</span></dt>
-<dd><p>
+<dd>
+          <p>
            Force overwrite: Causes <span class="command"><strong>dnssec-revoke</strong></span> to
            write the new key pair even if a file already exists matching
            the algorithm and key ID of the revoked key.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-R</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Print the key tag of the key with the REVOKE bit set but do
 	    not revoke the key.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dnssec-keygen</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 5011</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -192,5 +192,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2016  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
@@ -462,11 +462,12 @@ main(int argc, char **argv) {
 	if ((setdel && setinact && del < inact) ||
 	    (dst_key_gettime(key, DST_TIME_INACTIVE,
 			     &previnact) == ISC_R_SUCCESS &&
-	     setdel && !setinact && del < previnact) ||
+	     setdel && !setinact && !unsetinact && del < previnact) ||
 	    (dst_key_gettime(key, DST_TIME_DELETE,
 			     &prevdel) == ISC_R_SUCCESS &&
-	     setinact && !setdel && prevdel < inact) ||
-	    (!setdel && !setinact && prevdel < previnact))
+	     setinact && !setdel && !unsetdel && prevdel < inact) ||
+	    (!setdel && !unsetdel && !setinact && !unsetinact &&
+	     prevdel < previnact))
 		fprintf(stderr, "%s: warning: Key is scheduled to "
 				"be deleted before it is\n\t"
 				"scheduled to be inactive.\n",
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2009-2011, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-settime">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-settime">
  <info>
    <date>2014-02-07</date>
  </info>
@@ -42,6 +42,7 @@
      <year>2011</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-settime</title>
@@ -21,17 +22,45 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-settime"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-settime</span> &#8212; Set the key timing metadata for a DNSSEC key</p>
+<p>
+    <span class="application">dnssec-settime</span>
+     &#8212; Set the key timing metadata for a DNSSEC key
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-settime</code>  [<code class="option">-f</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-h</code>] [<code class="option">-V</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] {keyfile}</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-settime</code> 
+       [<code class="option">-f</code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-V</code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
+       {keyfile}
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-settime</strong></span>
+
+    <p><span class="command"><strong>dnssec-settime</strong></span>
      reads a DNSSEC private key file and sets the key timing metadata
      as specified by the <code class="option">-P</code>, <code class="option">-A</code>,
      <code class="option">-R</code>, <code class="option">-I</code>, and <code class="option">-D</code>
@@ -40,12 +69,12 @@
      determine when a key is to be published, whether it should be
      used for signing a zone, etc.
    </p>
-<p>
+    <p>
      If none of these options is set on the command line,
      then <span class="command"><strong>dnssec-settime</strong></span> simply prints the key timing
      metadata already stored in the key.
    </p>
-<p>
+    <p>
      When key metadata fields are changed, both files of a key
      pair (<code class="filename">Knnnn.+aaa+iiiii.key</code> and
      <code class="filename">Knnnn.+aaa+iiiii.private</code>) are regenerated.
@@ -54,12 +83,16 @@
      file.  The private file's permissions are always set to be
      inaccessible to anyone other than the owner (mode 0600).
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-f</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Force an update of an old-format key with no metadata fields.
            Without this option, <span class="command"><strong>dnssec-settime</strong></span> will
            fail when attempting to update a legacy key.  With this option,
@@ -68,13 +101,17 @@
            set to the present time.  If no other values are specified,
            then the key's publication and activation dates will also
            be set to the present time.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the directory in which the key files are to reside.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-L <em class="replaceable"><code>ttl</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the default TTL to use for this key when it is converted
            into a DNSKEY RR.  If the key is imported into a zone,
            this is the TTL that will be used for it, unless there was
@@ -83,29 +120,40 @@
            is no existing DNSKEY RRset, the TTL will default to the
            SOA TTL. Setting the default TTL to <code class="literal">0</code>
            or <code class="literal">none</code> removes it from the key.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Emit usage message and exit.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints version information.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use the given OpenSSL engine. When compiled with PKCS#11 support
            it defaults to pkcs11; the empty name resets it to no engine.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>TIMING OPTIONS</h2>
-<p>
+
+    <p>
      Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS.
      If the argument begins with a '+' or '-', it is interpreted as
      an offset from the present time.  For convenience, if such an offset
@@ -115,39 +163,51 @@
      days, hours, or minutes, respectively.  Without a suffix, the offset
      is computed in seconds.  To unset a date, use 'none' or 'never'.
    </p>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-P <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which a key is to be published to the zone.
            After that date, the key will be included in the zone but will
            not be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-A <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be activated.  After that
            date, the key will be included in the zone and used to sign
            it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-R <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be revoked.  After that
            date, the key will be flagged as revoked.  It will be included
            in the zone and will be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-I <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be retired.  After that
            date, the key will still be included in the zone, but it
            will not be used to sign it.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-D <em class="replaceable"><code>date/offset</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the date on which the key is to be deleted.  After that
            date, the key will no longer be included in the zone.  (It
            may remain in the key repository, however.)
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-S <em class="replaceable"><code>predecessor key</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Select a key for which the key being modified will be an
            explicit successor.  The name, algorithm, size, and type of the
            predecessor key must exactly match those of the key being
@@ -155,10 +215,11 @@
            to the inactivation date of the predecessor.  The publication
            date will be set to the activation date minus the prepublication
            interval, which defaults to 30 days.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Sets the prepublication interval for a key.  If set, then
            the publication and activation dates must be separated by at least
            this much time.  If the activation date is specified but the
@@ -167,34 +228,40 @@
            the publication date is specified but activation date isn't,
            then activation will be set to this much time after publication.
          </p>
-<p>
+          <p>
            If the key is being set to be an explicit successor to another
            key, then the default prepublication interval is 30 days;
            otherwise it is zero.
          </p>
-<p>
+          <p>
            As with date offsets, if the argument is followed by one of
            the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the
            interval is measured in years, months, weeks, days, hours,
            or minutes, respectively.  Without a suffix, the interval is
            measured in seconds.
          </p>
-</dd>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>PRINTING OPTIONS</h2>
-<p>
+
+    <p>
      <span class="command"><strong>dnssec-settime</strong></span> can also be used to print the
      timing metadata associated with a key.
    </p>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-u</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Print times in UNIX epoch format.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-p <em class="replaceable"><code>C/P/A/R/I/D/all</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Print a specific metadata value or set of metadata values.
            The <code class="option">-p</code> option may be followed by one or more
            of the following letters to indicate which value or values to print:
@@ -205,16 +272,24 @@
            <code class="option">I</code> for the inactivation date, or
            <code class="option">D</code> for the deletion date.
            To print all of the metadata, use <code class="option">-p all</code>.
-	  </p></dd>
+	  </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dnssec-keygen</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">dnssec-signzone</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 5011</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009, 2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -464,7 +464,7 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2009, 2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000-2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2009, 2011, 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2011, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-signzone">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-signzone">
  <info>
    <date>2013-12-11</date>
  </info>
@@ -48,6 +48,7 @@
      <year>2013</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-signzone</title>
@@ -22,17 +23,70 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-signzone"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-signzone</span> &#8212; DNSSEC zone signing tool</p>
+<p>
+    <span class="application">dnssec-signzone</span>
+     &#8212; DNSSEC zone signing tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>] [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>] [<code class="option">-P</code>] [<code class="option">-p</code>] [<code class="option">-R</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-S</code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>] [<code class="option">-t</code>] [<code class="option">-u</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>] [<code class="option">-x</code>] [<code class="option">-z</code>] [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>] [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>] [<code class="option">-A</code>] {zonefile} [key...]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-signzone</code> 
+       [<code class="option">-a</code>]
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-D</code>]
+       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
+       [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>]
+       [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>]
+       [<code class="option">-g</code>]
+       [<code class="option">-h</code>]
+       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-k <em class="replaceable"><code>key</code></em></code>]
+       [<code class="option">-L <em class="replaceable"><code>serial</code></em></code>]
+       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
+       [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>]
+       [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>]
+       [<code class="option">-j <em class="replaceable"><code>jitter</code></em></code>]
+       [<code class="option">-N <em class="replaceable"><code>soa-serial-format</code></em></code>]
+       [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
+       [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>]
+       [<code class="option">-P</code>]
+       [<code class="option">-p</code>]
+       [<code class="option">-R</code>]
+       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
+       [<code class="option">-S</code>]
+       [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>]
+       [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>]
+       [<code class="option">-t</code>]
+       [<code class="option">-u</code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-V</code>]
+       [<code class="option">-X <em class="replaceable"><code>extended end-time</code></em></code>]
+       [<code class="option">-x</code>]
+       [<code class="option">-z</code>]
+       [<code class="option">-3 <em class="replaceable"><code>salt</code></em></code>]
+       [<code class="option">-H <em class="replaceable"><code>iterations</code></em></code>]
+       [<code class="option">-A</code>]
+       {zonefile}
+       [key...]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-signzone</strong></span>
+
+    <p><span class="command"><strong>dnssec-signzone</strong></span>
      signs a zone.  It generates
      NSEC and RRSIG records and produces a signed version of the
      zone. The security status of delegations from the signed zone
@@ -40,34 +94,46 @@
      determined by the presence or absence of a
      <code class="filename">keyset</code> file for each child zone.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-a</span></dt>
-<dd><p>
+<dd>
+          <p>
            Verify all generated signatures.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the DNS class of the zone.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-C</span></dt>
-<dd><p>
+<dd>
+          <p>
            Compatibility mode: Generate a
            <code class="filename">keyset-<em class="replaceable"><code>zonename</code></em></code>
            file in addition to
            <code class="filename">dsset-<em class="replaceable"><code>zonename</code></em></code>
            when signing a zone, for use by older versions of
            <span class="command"><strong>dnssec-signzone</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Look for <code class="filename">dsset-</code> or
            <code class="filename">keyset-</code> files in <code class="option">directory</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-D</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Output only those record types automatically managed by
 	    <span class="command"><strong>dnssec-signzone</strong></span>, i.e. RRSIG, NSEC,
 	    NSEC3 and NSEC3PARAM records. If smart signing
@@ -76,37 +142,49 @@
 	    zone file with <span class="command"><strong>$INCLUDE</strong></span>. This option
 	    cannot be combined with <code class="option">-O raw</code> or serial
 	    number updating.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Uses a crypto hardware (OpenSSL engine) for the crypto operations
            it supports, for instance signing with private keys from
            a secure key store. When compiled with PKCS#11 support
            it defaults to pkcs11; the empty name resets it to no engine.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-g</span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate DS records for child zones from
            <code class="filename">dsset-</code> or <code class="filename">keyset-</code>
            file.  Existing DS records will be removed.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Key repository: Specify a directory to search for DNSSEC keys.
            If not specified, defaults to the current directory.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-k <em class="replaceable"><code>key</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Treat specified key as a key signing key ignoring any
            key flags.  This option may be specified multiple times.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate a DLV set in addition to the key (DNSKEY) and DS sets.
            The domain is appended to the name of the records.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>start-time</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specify the date and time when the generated RRSIG records
            become valid.  This can be either an absolute or relative
            time.  An absolute start time is indicated by a number
@@ -115,9 +193,11 @@
            indicated by +N, which is N seconds from the current time.
            If no <code class="option">start-time</code> is specified, the current
            time minus 1 hour (to allow for clock skew) is used.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-e <em class="replaceable"><code>end-time</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specify the date and time when the generated RRSIG records
            expire.  As with <code class="option">start-time</code>, an absolute
            time is indicated in YYYYMMDDHHMMSS notation.  A time relative
@@ -127,10 +207,11 @@
            specified, 30 days from the start time is used as a default.
            <code class="option">end-time</code> must be later than
            <code class="option">start-time</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-X <em class="replaceable"><code>extended end-time</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Specify the date and time when the generated RRSIG records
            for the DNSKEY RRset will expire.  This is to be used in cases
            when the DNSKEY signatures need to persist longer than
@@ -138,7 +219,7 @@
            of the KSK is kept offline and the KSK signature is to be
            refreshed manually.
          </p>
-<p>
+          <p>
            As with <code class="option">start-time</code>, an absolute
            time is indicated in YYYYMMDDHHMMSS notation.  A time relative
            to the start time is indicated with +N, which is N seconds from
@@ -149,28 +230,34 @@
            30 days from the start time.) <code class="option">extended end-time</code>
            must be later than <code class="option">start-time</code>.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-f <em class="replaceable"><code>output-file</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            The name of the output file containing the signed zone.  The
            default is to append <code class="filename">.signed</code> to
            the input filename.  If <code class="option">output-file</code> is
            set to <code class="literal">"-"</code>, then the signed zone is
            written to the standard output, with a default output
            format of "full".
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-h</span></dt>
-<dd><p>
+<dd>
+          <p>
            Prints a short summary of the options and arguments to
            <span class="command"><strong>dnssec-signzone</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints version information.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-i <em class="replaceable"><code>interval</code></em></span></dt>
 <dd>
-<p>
+          <p>
            When a previously-signed zone is passed as input, records
            may be resigned.  The <code class="option">interval</code> option
            specifies the cycle interval as an offset from the current
@@ -178,7 +265,7 @@
            cycle interval, it is retained.  Otherwise, it is considered
            to be expiring soon, and it will be replaced.
          </p>
-<p>
+          <p>
            The default cycle interval is one quarter of the difference
            between the signature end and start times.  So if neither
            <code class="option">end-time</code> or <code class="option">start-time</code>
@@ -189,9 +276,10 @@
            are due to expire in less than 7.5 days, they would be
            replaced.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            The format of the input zone file.
 	    Possible formats are <span class="command"><strong>"text"</strong></span> (default)
 	    and <span class="command"><strong>"raw"</strong></span>.
@@ -200,10 +288,11 @@
            format containing updates can be signed directly.
 	    The use of this option does not make much sense for
 	    non-dynamic zones.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-j <em class="replaceable"><code>jitter</code></em></span></dt>
 <dd>
-<p>
+          <p>
            When signing a zone with a fixed signature lifetime, all
            RRSIG records issued at the time of signing expires
            simultaneously.  If the zone is incrementally signed, i.e.
@@ -214,51 +303,66 @@
            expire time, thus spreading incremental signature
            regeneration over time.
          </p>
-<p>
+          <p>
            Signature lifetime jitter also to some extent benefits
            validators and servers by spreading out cache expiration,
            i.e. if large numbers of RRSIGs don't expire at the same time
            from all caches there will be less congestion than if all
            validators need to refetch at mostly the same time.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-L <em class="replaceable"><code>serial</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            When writing a signed zone to 'raw' format, set the "source serial"
            value in the header to the specified serial number.  (This is
            expected to be used primarily for testing purposes.)
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-n <em class="replaceable"><code>ncpus</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the number of threads to use.  By default, one
            thread is started for each detected CPU.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-N <em class="replaceable"><code>soa-serial-format</code></em></span></dt>
 <dd>
-<p>
+          <p>
            The SOA serial number format of the signed zone.
 	    Possible formats are <span class="command"><strong>"keep"</strong></span> (default),
            <span class="command"><strong>"increment"</strong></span> and
 	    <span class="command"><strong>"unixtime"</strong></span>.
          </p>
-<div class="variablelist"><dl class="variablelist">
+
+          <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><span class="command"><strong>"keep"</strong></span></span></dt>
-<dd><p>Do not modify the SOA serial number.</p></dd>
+<dd>
+                <p>Do not modify the SOA serial number.</p>
+	      </dd>
 <dt><span class="term"><span class="command"><strong>"increment"</strong></span></span></dt>
-<dd><p>Increment the SOA serial number using RFC 1982
-                      arithmetics.</p></dd>
+<dd>
+                <p>Increment the SOA serial number using RFC 1982
+                      arithmetics.</p>
+	      </dd>
 <dt><span class="term"><span class="command"><strong>"unixtime"</strong></span></span></dt>
-<dd><p>Set the SOA serial number to the number of seconds
-	        since epoch.</p></dd>
+<dd>
+                <p>Set the SOA serial number to the number of seconds
+	        since epoch.</p>
+	      </dd>
 </dl></div>
-</dd>
+
+        </dd>
 <dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            The zone origin.  If not specified, the name of the zone file
            is assumed to be the origin.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-O <em class="replaceable"><code>output-format</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            The format of the output file containing the signed zone.
 	    Possible formats are <span class="command"><strong>"text"</strong></span> (default)
 	    <span class="command"><strong>"full"</strong></span>, which is text output in a
@@ -270,33 +374,36 @@
            is 0, the raw file can be read by any version of
            <span class="command"><strong>named</strong></span>; if N is 1, the file can be
            read by release 9.9.0 or higher.  The default is 1.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-p</span></dt>
-<dd><p>
+<dd>
+          <p>
            Use pseudo-random data when signing the zone.  This is faster,
            but less secure, than using real random data.  This option
            may be useful when signing large zones or when the entropy
            source is limited.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-P</span></dt>
 <dd>
-<p>
+          <p>
 	    Disable post sign verification tests.
          </p>
-<p>
+          <p>
 	    The post sign verification test ensures that for each algorithm
 	    in use there is at least one non revoked self signed KSK key,
 	    that all revoked KSK keys are self signed, and that all records
 	    in the zone are signed by the algorithm.
 	    This option skips these tests.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-Q</span></dt>
 <dd>
-<p>
+          <p>
 	    Remove signatures from keys that are no longer active.
          </p>
-<p>
+          <p>
            Normally, when a previously-signed zone is passed as input
            to the signer, and a DNSKEY record has been removed and
            replaced with a new one, signatures from the old key
@@ -308,22 +415,23 @@
            enables ZSK rollover using the procedure described in
            RFC 4641, section 4.2.1.1 ("Pre-Publish Key Rollover").
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-R</span></dt>
 <dd>
-<p>
+          <p>
 	    Remove signatures from keys that are no longer published.
          </p>
-<p>
+          <p>
            This option is similar to <code class="option">-Q</code>, except it
            forces <span class="command"><strong>dnssec-signzone</strong></span> to signatures from
            keys that are no longer published. This enables ZSK rollover
            using the procedure described in RFC 4641, section 4.2.1.2
            ("Double Signature Zone Signing Key Rollover").
          </p>
-</dd>
+        </dd>
 <dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the source of randomness.  If the operating
            system does not provide a <code class="filename">/dev/random</code>
            or equivalent device, the default source of randomness
@@ -333,53 +441,65 @@
            data to be used instead of the default.  The special value
            <code class="filename">keyboard</code> indicates that keyboard
            input should be used.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-S</span></dt>
 <dd>
-<p>
+          <p>
            Smart signing: Instructs <span class="command"><strong>dnssec-signzone</strong></span> to
            search the key repository for keys that match the zone being
            signed, and to include them in the zone if appropriate.
          </p>
-<p>
+          <p>
            When a key is found, its timing metadata is examined to
            determine how it should be used, according to the following
            rules.  Each successive rule takes priority over the prior
            ones:
          </p>
-<div class="variablelist"><dl class="variablelist">
+          <div class="variablelist"><dl class="variablelist">
 <dt></dt>
-<dd><p>
+<dd>
+                <p>
                  If no timing metadata has been set for the key, the key is
                  published in the zone and used to sign the zone.
-                </p></dd>
+                </p>
+	      </dd>
 <dt></dt>
-<dd><p>
+<dd>
+                <p>
                  If the key's publication date is set and is in the past, the
                  key is published in the zone.
-                </p></dd>
+                </p>
+	      </dd>
 <dt></dt>
-<dd><p>
+<dd>
+                <p>
                  If the key's activation date is set and in the past, the
                  key is published (regardless of publication date) and
                  used to sign the zone.
-                </p></dd>
+                </p>
+	      </dd>
 <dt></dt>
-<dd><p>
+<dd>
+                <p>
                  If the key's revocation date is set and in the past, and the
                  key is published, then the key is revoked, and the revoked key
                  is used to sign the zone.
-                </p></dd>
+                </p>
+	      </dd>
 <dt></dt>
-<dd><p>
+<dd>
+                <p>
                  If either of the key's unpublication or deletion dates are set
                  and in the past, the key is NOT published or used to sign the
                  zone, regardless of any other metadata.
-                </p></dd>
+                </p>
+	      </dd>
 </dl></div>
-</dd>
+        </dd>
 <dt><span class="term">-T <em class="replaceable"><code>ttl</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies a TTL to be used for new DNSKEY records imported
            into the zone from the key repository.  If not
            specified, the default is the TTL value from the zone's SOA
@@ -391,81 +511,102 @@
            them, or if any of the imported DNSKEY records had a default
            TTL value.  In the event of a a conflict between TTL values in
            imported keys, the shortest one is used.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-t</span></dt>
-<dd><p>
+<dd>
+          <p>
            Print statistics at completion.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-u</span></dt>
-<dd><p>
+<dd>
+          <p>
            Update NSEC/NSEC3 chain when re-signing a previously signed
            zone.  With this option, a zone signed with NSEC can be
            switched to NSEC3, or a zone signed with NSEC3 can
            be switch to NSEC or to NSEC3 with different parameters.
            Without this option, <span class="command"><strong>dnssec-signzone</strong></span> will
            retain the existing chain when re-signing.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-x</span></dt>
-<dd><p>
+<dd>
+          <p>
            Only sign the DNSKEY RRset with key-signing keys, and omit
            signatures from zone-signing keys.  (This is similar to the
            <span class="command"><strong>dnssec-dnskey-kskonly yes;</strong></span> zone option in
            <span class="command"><strong>named</strong></span>.)
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-z</span></dt>
-<dd><p>
+<dd>
+          <p>
            Ignore KSK flag on key when determining what to sign.  This
            causes KSK-flagged keys to sign all records, not just the
            DNSKEY RRset.  (This is similar to the
            <span class="command"><strong>update-check-ksk no;</strong></span> zone option in
            <span class="command"><strong>named</strong></span>.)
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-3 <em class="replaceable"><code>salt</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Generate an NSEC3 chain with the given hex encoded salt.
 	    A dash (<em class="replaceable"><code>salt</code></em>) can
 	    be used to indicate that no salt is to be used when generating		    the NSEC3 chain.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-H <em class="replaceable"><code>iterations</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
 	    When generating an NSEC3 chain, use this many iterations.  The
 	    default is 10.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-A</span></dt>
 <dd>
-<p>
+          <p>
 	    When generating an NSEC3 chain set the OPTOUT flag on all
 	    NSEC3 records and do not generate NSEC3 records for insecure
 	    delegations.
          </p>
-<p>
+          <p>
 	    Using this option twice (i.e., <code class="option">-AA</code>)
 	    turns the OPTOUT flag off for all records.  This is useful
 	    when using the <code class="option">-u</code> option to modify an NSEC3
 	    chain which previously had OPTOUT set.
          </p>
-</dd>
+        </dd>
 <dt><span class="term">zonefile</span></dt>
-<dd><p>
+<dd>
+          <p>
            The file containing the zone to be signed.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">key</span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Specify which keys should be used to sign the zone.  If
 	    no keys are specified, then the zone will be examined
 	    for DNSKEY records at the zone apex.  If these are found and
 	    there are matching private keys, in the current directory,
 	    then these will be used for signing.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>EXAMPLE</h2>
-<p>
+
+    <p>
      The following command signs the <strong class="userinput"><code>example.com</code></strong>
      zone with the DSA key generated by <span class="command"><strong>dnssec-keygen</strong></span>
      (Kexample.com.+003+17247).  Because the <span class="command"><strong>-S</strong></span> option
@@ -478,13 +619,13 @@
 Kexample.com.+003+17247
 db.example.com.signed
 %</pre>
-<p>
+    <p>
      In the above example, <span class="command"><strong>dnssec-signzone</strong></span> creates
      the file <code class="filename">db.example.com.signed</code>.  This
      file should be referenced in a zone statement in a
      <code class="filename">named.conf</code> file.
    </p>
-<p>
+    <p>
      This example re-signs a previously signed zone with default parameters.
      The private keys are assumed to be in the current directory.
    </p>
@@ -492,13 +633,18 @@ db.example.com.signed
 % dnssec-signzone -o example.com db.example.com
 db.example.com.signed
 %</pre>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">dnssec-keygen</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 4033</em>, <em class="citetitle">RFC 4641</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -114,5 +114,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-verify">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-verify">
  <info>
    <date>2012-06-26</date>
  </info>
@@ -40,6 +40,7 @@
      <year>2012</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-verify</title>
@@ -21,31 +22,61 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.dnssec-verify"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">dnssec-verify</span> &#8212; DNSSEC zone verification tool</p>
+<p>
+    <span class="application">dnssec-verify</span>
+     &#8212; DNSSEC zone verification tool
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-verify</code>  [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-V</code>] [<code class="option">-x</code>] [<code class="option">-z</code>] {zonefile}</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">dnssec-verify</code> 
+       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
+       [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>]
+       [<code class="option">-I <em class="replaceable"><code>input-format</code></em></code>]
+       [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
+       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
+       [<code class="option">-V</code>]
+       [<code class="option">-x</code>]
+       [<code class="option">-z</code>]
+       {zonefile}
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>dnssec-verify</strong></span>
+
+    <p><span class="command"><strong>dnssec-verify</strong></span>
      verifies that a zone is fully signed for each algorithm found
      in the DNSKEY RRset for the zone, and that the NSEC / NSEC3
      chains are complete.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Specifies the DNS class of the zone.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-I <em class="replaceable"><code>input-format</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            The format of the input zone file.
 	    Possible formats are <span class="command"><strong>"text"</strong></span> (default)
 	    and <span class="command"><strong>"raw"</strong></span>.
@@ -54,32 +85,41 @@
            format containing updates can be verified independently.
 	    The use of this option does not make much sense for
 	    non-dynamic zones.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-o <em class="replaceable"><code>origin</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            The zone origin.  If not specified, the name of the zone file
            is assumed to be the origin.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Sets the debugging level.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Prints version information.
-	  </p></dd>
+	  </p>
+        </dd>
 <dt><span class="term">-x</span></dt>
-<dd><p>
+<dd>
+          <p>
            Only verify that the DNSKEY RRset is signed with key-signing
            keys.  Without this flag, it is assumed that the DNSKEY RRset
            will be signed by all active keys.  When this flag is set,
            it will not be an error if the DNSKEY RRset is not signed
            by zone-signing keys.  This corresponds to the <code class="option">-x</code>
            option in <span class="command"><strong>dnssec-signzone</strong></span>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-z</span></dt>
 <dd>
-<p>
+	  <p>
 	    Ignore the KSK flag on the keys when determining whether
            the zone if correctly signed.  Without this flag it is
 	    assumed that there will be a non-revoked, self-signed
@@ -87,7 +127,7 @@
 	    that RRsets other than DNSKEY RRset will be signed with
            a different DNSKEY without the KSK flag set.
 	  </p>
-<p>
+	  <p>
 	    With this flag set, we only require that for each algorithm,
            there will be at least one non-revoked, self-signed DNSKEY,
            regardless of the KSK flag state, and that other RRsets
@@ -96,20 +136,27 @@
            for both purposes.  This corresponds to the <code class="option">-z</code>
            option in <span class="command"><strong>dnssec-signzone</strong></span>.
 	  </p>
-</dd>
+	</dd>
 <dt><span class="term">zonefile</span></dt>
-<dd><p>
+<dd>
+          <p>
            The file containing the zone to be signed.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>SEE ALSO</h2>
-<p>
-      <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
+
+    <p>
+      <span class="citerefentry">
+        <span class="refentrytitle">dnssec-signzone</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
      <em class="citetitle">RFC 4033</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -29,6 +29,7 @@
 #include <isc/buffer.h>
 #include <isc/dir.h>
 #include <isc/entropy.h>
+#include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
 #include <isc/mem.h>
@@ -472,6 +473,8 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	isc_uint16_t id, oldid;
 	isc_uint32_t rid, roldid;
 	dns_secalg_t alg;
+	char filename[ISC_DIR_NAMEMAX];
+	isc_buffer_t fileb;

 	if (exact != NULL)
 		*exact = ISC_FALSE;
@@ -480,6 +483,28 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

+	/*
+	 * For HMAC and Diffie Hellman just check if there is a
+	 * direct collision as they can't be revoked.  Additionally
+	 * dns_dnssec_findmatchingkeys only handles DNSKEY which is
+	 * not used for HMAC.
+	 */
+	switch (alg) {
+	case DST_ALG_HMACMD5:
+	case DST_ALG_HMACSHA1:
+	case DST_ALG_HMACSHA224:
+	case DST_ALG_HMACSHA256:
+	case DST_ALG_HMACSHA384:
+	case DST_ALG_HMACSHA512:
+	case DST_ALG_DH:
+		isc_buffer_init(&fileb, filename, sizeof(filename));
+		result = dst_key_buildfilename(dstkey, DST_TYPE_PRIVATE,
+					       dir, &fileb);
+		if (result != ISC_R_SUCCESS)
+			return (ISC_TRUE);
+		return (isc_file_exists(filename));
+	}
+
 	ISC_LIST_INIT(matchkeys);
 	result = dns_dnssec_findmatchingkeys(name, dir, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND)
@@ -123,4 +123,4 @@ copy /Y dnssec-coverage.py ..\..\Build\$(Configuration)\dnssec-coverage.py
  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
  <ImportGroup Label="ExtensionTargets">
  </ImportGroup>
-</Project>
+</Project>
@@ -1,4 +1,4 @@
-# Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -180,6 +180,13 @@ install:: named@EXEEXT@ lwresd@EXEEXT@ installdirs
 	${INSTALL_DATA} ${srcdir}/lwresd.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/named.conf.5 ${DESTDIR}${mandir}/man5

+uninstall::
+	rm -f ${DESTDIR}${mandir}/man5/named.conf.5
+	rm -f ${DESTDIR}${mandir}/man8/lwresd.8
+	rm -f ${DESTDIR}${mandir}/man8/named.8
+	rm -f ${DESTDIR}${sbindir}/lwresd@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named@EXEEXT@
+
@DLZ_DRIVER_RULES@

 named-symtbl.@O@: named-symtbl.c
@@ -1,7 +1,3 @@
-/*
- * Generated by bindkeys.pl 1.7 2011/01/04 23:47:13 tbox Exp  
- * From bind.keys 1.7 2011/01/03 23:45:07 each Exp  
- */
 #define TRUSTED_KEYS "\
 # The bind.keys file is used to override the built-in DNSSEC trust anchors\n\
 # which are included as part of BIND 9.  As of the current release, the only\n\
@@ -19,34 +15,58 @@
 #\n\
 # This file is NOT expected to be user-configured.\n\
 #\n\
-# These keys are current as of January 2011.  If any key fails to\n\
+# These keys are current as of Feburary 2017.  If any key fails to\n\
 # initialize correctly, it may have expired.  In that event you should\n\
 # replace this file with a current version.  The latest version of\n\
 # bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\
 \n\
 trusted-keys {\n\
-	# ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\
-        # NOTE: This key is activated by setting \"dnssec-lookaside auto;\"\n\
-        # in named.conf.\n\
-	dlv.isc.org. 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\
-		brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\
-		1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\
-		ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\
-		Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\
-		QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\
-		TDN0YUuWrBNh\";\n\
+        # ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\
+        #\n\
+        # NOTE: The ISC DLV zone is being phased out as of February 2017;\n\
+        # the key will remain in place but the zone will be otherwise empty.\n\
+        # Configuring \"dnssec-lookaside auto;\" to activate this key is\n\
+        # harmless, but is no longer useful and is not recommended.\n\
+        dlv.isc.org. 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\
+                brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\
+                1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\
+                ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\
+                Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\
+                QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\
+                TDN0YUuWrBNh\";\n\
 \n\
-	# ROOT KEY: See https://data.iana.org/root-anchors/root-anchors.xml\n\
-	# for current trust anchor information.\n\
-        # NOTE: This key is activated by setting \"dnssec-validation auto;\"\n\
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml\n\
+        # for current trust anchor information.\n\
+        #\n\
+        # These keys are activated by setting \"dnssec-validation auto;\"\n\
        # in named.conf.\n\
-	. 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
-		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
-		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
-		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
-		W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
-		Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
-		QxA+Uk1ihz0=\";\n\
+        #\n\
+        # This key (19036) is to be phased out starting in 2017. It will\n\
+        # remain in the root zone for some time after its successor key\n\
+        # has been added. It will remain this file until it is removed from\n\
+        # the root zone.\n\
+        . 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
+                FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
+                bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
+                X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
+                W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
+                Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
+                QxA+Uk1ihz0=\";\n\
+\n\
+        # This key (20326) is to be published in the root zone in 2017.\n\
+        # Servers which were already using the old key (19036) should\n\
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers\n\
+        # being set up for the first time can use the contents of this\n\
+        # file as initializing keys; thereafter, the keys in the\n\
+        # managed key database will be trusted and maintained\n\
+        # automatically.\n\
+        . 257 3 8 \"AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3\n\
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv\n\
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF\n\
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e\n\
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd\n\
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN\n\
+                R1AkUTV74bU=\";\n\
 };\n\
 "

@@ -67,33 +87,57 @@ trusted-keys {\n\
 #\n\
 # This file is NOT expected to be user-configured.\n\
 #\n\
-# These keys are current as of January 2011.  If any key fails to\n\
+# These keys are current as of Feburary 2017.  If any key fails to\n\
 # initialize correctly, it may have expired.  In that event you should\n\
 # replace this file with a current version.  The latest version of\n\
 # bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\
 \n\
 managed-keys {\n\
-	# ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\
-        # NOTE: This key is activated by setting \"dnssec-lookaside auto;\"\n\
-        # in named.conf.\n\
-	dlv.isc.org. initial-key 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\
-		brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\
-		1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\
-		ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\
-		Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\
-		QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\
-		TDN0YUuWrBNh\";\n\
+        # ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\
+        #\n\
+        # NOTE: The ISC DLV zone is being phased out as of February 2017;\n\
+        # the key will remain in place but the zone will be otherwise empty.\n\
+        # Configuring \"dnssec-lookaside auto;\" to activate this key is\n\
+        # harmless, but is no longer useful and is not recommended.\n\
+        dlv.isc.org. initial-key 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\
+                brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\
+                1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\
+                ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\
+                Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\
+                QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\
+                TDN0YUuWrBNh\";\n\
 \n\
-	# ROOT KEY: See https://data.iana.org/root-anchors/root-anchors.xml\n\
-	# for current trust anchor information.\n\
-        # NOTE: This key is activated by setting \"dnssec-validation auto;\"\n\
+        # ROOT KEYS: See https://data.iana.org/root-anchors/root-anchors.xml\n\
+        # for current trust anchor information.\n\
+        #\n\
+        # These keys are activated by setting \"dnssec-validation auto;\"\n\
        # in named.conf.\n\
-	. initial-key 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
-		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
-		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
-		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
-		W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
-		Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
-		QxA+Uk1ihz0=\";\n\
+        #\n\
+        # This key (19036) is to be phased out starting in 2017. It will\n\
+        # remain in the root zone for some time after its successor key\n\
+        # has been added. It will remain this file until it is removed from\n\
+        # the root zone.\n\
+        . initial-key 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
+                FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
+                bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
+                X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
+                W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
+                Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
+                QxA+Uk1ihz0=\";\n\
+\n\
+        # This key (20326) is to be published in the root zone in 2017.\n\
+        # Servers which were already using the old key (19036) should\n\
+        # roll seamlessly to this new one via RFC 5011 rollover. Servers\n\
+        # being set up for the first time can use the contents of this\n\
+        # file as initializing keys; thereafter, the keys in the\n\
+        # managed key database will be trusted and maintained\n\
+        # automatically.\n\
+        . initial-key 257 3 8 \"AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3\n\
+                +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv\n\
+                ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF\n\
+                0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e\n\
+                oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd\n\
+                RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN\n\
+                R1AkUTV74bU=\";\n\
 };\n\
 "
@@ -1,6 +1,6 @@
 #!/usr/bin/env perl
 #
-# Copyright (C) 2009-2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009-2012, 2017  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,23 +14,13 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.

-# $Id: bindkeys.pl,v 1.7 2011/01/04 23:47:13 tbox Exp $
-
 use strict;
 use warnings;

-my $rev = '$Id: bindkeys.pl,v 1.7 2011/01/04 23:47:13 tbox Exp $';
-$rev =~ s/\$//g;
-$rev =~ s/,v//g;
-$rev =~ s/Id: //;
-
-my $keys = "";
-
 my $lines;
 while (<>) {
    chomp;
    if (/\/\* .Id:.* \*\//) {
-	$keys = $_;
 	next;
    }
    s/\"/\\\"/g;
@@ -38,13 +28,6 @@ while (<>) {
    $lines .= $_ . "\n";
 }

-$keys =~ s/\$//g;
-$keys =~ s/\/\* Id: //;
-$keys =~ s/\*\/.*//;
-$keys =~ s/,v//;
-
-print "/*\n * Generated by $rev \n * From $keys\n */\n";
-
 my $mkey = '#define MANAGED_KEYS "\\' . "\n" . $lines . "\"\n";

 $lines =~ s/managed-keys/trusted-keys/;
@@ -384,7 +384,7 @@ exit_check(ns_client_t *client) {
 		INSIST(client->newstate <= NS_CLIENTSTATE_READY);
 		if (client->nreads > 0)
 			dns_tcpmsg_cancelread(&client->tcpmsg);
-		if (! client->nreads == 0) {
+		if (client->nreads != 0) {
 			/* Still waiting for read cancel completion. */
 			return (ISC_TRUE);
 		}
@@ -938,7 +938,8 @@ ns_client_send(ns_client_t *client) {

 	CTRACE("send");

-	if ((client->attributes & NS_CLIENTATTR_RA) != 0)
+	if (client->message->opcode == dns_opcode_query &&
+	    (client->attributes & NS_CLIENTATTR_RA) != 0)
 		client->message->flags |= DNS_MESSAGEFLAG_RA;

 	if ((client->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -198,6 +198,7 @@ options {\n\
 	max-transfer-time-out 120;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
+	max-records 0;\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
 	min-retry-time 500;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
@@ -288,7 +289,9 @@ ns_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 }

 isc_result_t
-ns_config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
+ns_config_get(cfg_obj_t const * const *maps, const char *name,
+	      const cfg_obj_t **obj)
+{
 	int i;

 	for (i = 0;; i++) {
@@ -131,7 +131,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 		      NS_LOGMODULE_CONTROL, log_level,
 		      "received control channel command '%s'",
-		      command);
+		      cmdline);

 	if (command_compare(command, NS_COMMAND_RELOAD)) {
 		result = ns_server_reloadcommand(ns_g_server, lex, text);
@@ -192,7 +192,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 	} else if (command_compare(command, NS_COMMAND_QUERYLOG)) {
 		result = ns_server_togglequerylog(ns_g_server, lex);
 	} else if (command_compare(command, NS_COMMAND_DUMPDB)) {
-		ns_server_dumpdb(ns_g_server, lex);
+		ns_server_dumpdb(ns_g_server, lex, text);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NS_COMMAND_SECROOTS)) {
 		result = ns_server_dumpsecroots(ns_g_server, lex);
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009, 2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2001, 2002  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -31,10 +31,11 @@ isc_result_t
 ns_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);

 isc_result_t
-ns_config_get(const cfg_obj_t **maps, const char* name, const cfg_obj_t **obj);
+ns_config_get(cfg_obj_t const * const *maps, const char *name,
+	      const cfg_obj_t **obj);

 isc_result_t
-ns_checknames_get(const cfg_obj_t **maps, const char* name,
+ns_checknames_get(const cfg_obj_t **maps, const char *name,
 		  const cfg_obj_t **obj);

 int
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -161,12 +161,15 @@ EXTERN isc_boolean_t		ns_g_dropedns		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_noedns		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_nosoa		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_noaa		INIT(ISC_FALSE);
+EXTERN isc_boolean_t		ns_g_keepstderr		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_nonearest		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_notcp		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_disable6		INIT(ISC_FALSE);
 EXTERN isc_boolean_t		ns_g_disable4		INIT(ISC_FALSE);


+EXTERN dns_acl_t *		ns_g_mapped		INIT(NULL);
+
 #undef EXTERN
 #undef INIT

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -271,7 +271,7 @@ ns_server_dumpstats(ns_server_t *server);
 * Dump the current cache to the dump file.
 */
 isc_result_t
-ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex);
+ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text);

 /*%
 * Dump the current security roots to the secroots file.
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007, 2011, 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011, 2013, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -144,6 +144,22 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig)
 				 cfg_tuple_get(fileobj, "versions");
 		isc_int32_t versions = ISC_LOG_ROLLNEVER;
 		isc_offset_t size = 0;
+		isc_uint64_t maxoffset;
+
+		/*
+		 * isc_offset_t is a signed integer type, so the maximum
+		 * value is all 1s except for the MSB.
+		 */
+		switch (sizeof(isc_offset_t)) {
+		case 4:
+			maxoffset = 0x7fffffffULL;
+			break;
+		case 8:
+			maxoffset = 0x7fffffffffffffffULL;
+			break;
+		default:
+			INSIST(0);
+		}

 		type = ISC_LOG_TOFILE;

@@ -154,7 +170,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig)
 			versions = ISC_LOG_ROLLINFINITE;
 		if (sizeobj != NULL &&
 		    cfg_obj_isuint64(sizeobj) &&
-		    cfg_obj_asuint64(sizeobj) < ISC_OFFSET_MAXIMUM)
+		    cfg_obj_asuint64(sizeobj) < maxoffset)
 			size = (isc_offset_t)cfg_obj_asuint64(sizeobj);
 		dest.file.stream = NULL;
 		dest.file.name = cfg_obj_asstring(pathobj);
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -255,7 +255,7 @@ The default process\-id file\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005, 2007-2009, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2009, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.lwresd">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.lwresd">
  <info>
    <date>2009-01-20</date>
  </info>
@@ -45,6 +45,7 @@
      <year>2009</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004, 2005, 2007-2009, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007-2009, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwresd</title>
@@ -22,24 +23,57 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.lwresd"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">lwresd</span> &#8212; lightweight resolver daemon</p>
+<p>
+    <span class="application">lwresd</span>
+     &#8212; lightweight resolver daemon
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">lwresd</code> 
+       [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>]
+       [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>]
+       [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>]
+       [<code class="option">-f</code>]
+       [<code class="option">-g</code>]
+       [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>]
+       [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>]
+       [<code class="option">-P <em class="replaceable"><code>port</code></em></code>]
+       [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
+       [<code class="option">-s</code>]
+       [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
+       [<code class="option">-v</code>]
+       [<code class="option">-4</code>]
+       [<code class="option">-6</code>]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>lwresd</strong></span>
+
+
+    <p><span class="command"><strong>lwresd</strong></span>
      is the daemon providing name lookup
      services to clients that use the BIND 9 lightweight resolver
      library.  It is essentially a stripped-down, caching-only name
      server that answers queries using the BIND 9 lightweight
      resolver protocol rather than the DNS protocol.
    </p>
-<p><span class="command"><strong>lwresd</strong></span>
+
+    <p><span class="command"><strong>lwresd</strong></span>
      listens for resolver queries on a
      UDP port on the IPv4 loopback interface, 127.0.0.1.  This
      means that <span class="command"><strong>lwresd</strong></span> can only be used by
@@ -47,14 +81,14 @@
      number 921 is used for lightweight resolver requests and
      responses.
    </p>
-<p>
+    <p>
      Incoming lightweight resolver requests are decoded by the
      server which then resolves them using the DNS protocol.  When
      the DNS lookup completes, <span class="command"><strong>lwresd</strong></span> encodes
      the answers in the lightweight resolver format and returns
      them to the client that made the request.
    </p>
-<p>
+    <p>
      If <code class="filename">/etc/resolv.conf</code> contains any
      <code class="option">nameserver</code> entries, <span class="command"><strong>lwresd</strong></span>
      sends recursive DNS queries to those servers.  This is similar
@@ -64,60 +98,80 @@
      queries autonomously starting at the root name servers, using
      a built-in list of root server hints.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-4</span></dt>
-<dd><p>
+<dd>
+          <p>
            Use IPv4 only even if the host machine is capable of IPv6.
            <code class="option">-4</code> and <code class="option">-6</code> are mutually
            exclusive.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-6</span></dt>
-<dd><p>
+<dd>
+          <p>
            Use IPv6 only even if the host machine is capable of IPv4.
            <code class="option">-4</code> and <code class="option">-6</code> are mutually
            exclusive.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use <em class="replaceable"><code>config-file</code></em> as the
            configuration file instead of the default,
            <code class="filename">/etc/lwresd.conf</code>.
 	    
 	    <code class="option">-c</code> can not be used with <code class="option">-C</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use <em class="replaceable"><code>config-file</code></em> as the
            configuration file instead of the default,
            <code class="filename">/etc/resolv.conf</code>.
 	    <code class="option">-C</code> can not be used with <code class="option">-c</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Set the daemon's debug level to <em class="replaceable"><code>debug-level</code></em>.
            Debugging traces from <span class="command"><strong>lwresd</strong></span> become
            		more verbose as the debug level increases.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-f</span></dt>
-<dd><p>
+<dd>
+          <p>
            Run the server in the foreground (i.e. do not daemonize).
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-g</span></dt>
-<dd><p>
+<dd>
+          <p>
            Run the server in the foreground and force all logging
            to <code class="filename">stderr</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-i <em class="replaceable"><code>pid-file</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use <em class="replaceable"><code>pid-file</code></em> as the
            PID file instead of the default,
            <code class="filename">/var/run/lwresd/lwresd.pid</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Turn on memory usage debugging flags.  Possible flags are
            <em class="replaceable"><code>usage</code></em>,
            <em class="replaceable"><code>trace</code></em>,
@@ -126,54 +180,61 @@
            <em class="replaceable"><code>mctx</code></em>.
            These correspond to the ISC_MEM_DEBUGXXXX flags described in
            <code class="filename">&lt;isc/mem.h&gt;</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Create <em class="replaceable"><code>#cpus</code></em> worker threads
            to take advantage of multiple CPUs.  If not specified,
            <span class="command"><strong>lwresd</strong></span> will try to determine the
            number of CPUs present and create one thread per CPU.
            If it is unable to determine the number of CPUs, a
            single worker thread will be created.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-P <em class="replaceable"><code>port</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Listen for lightweight resolver queries on port
            <em class="replaceable"><code>port</code></em>.  If
            		not specified, the default is port 921.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Send DNS lookups to port <em class="replaceable"><code>port</code></em>.  If not
            specified, the default is port 53.  This provides a
            way of testing the lightweight resolver daemon with a
            name server that listens for queries on a non-standard
            port number.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-s</span></dt>
 <dd>
-<p>
+          <p>
            Write memory usage statistics to <code class="filename">stdout</code>
            on exit.
          </p>
-<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+          <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
-<p>
+            <p>
              This option is mainly of interest to BIND 9 developers
              and may be removed or changed in a future release.
            </p>
-</div>
-</dd>
+          </div>
+        </dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
-<p>Chroot
+          <p>Chroot
 	    to <em class="replaceable"><code>directory</code></em> after
            processing the command line arguments, but before
            reading the configuration file.
          </p>
-<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
+          <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Warning</h3>
-<p>
+            <p>
              This option should be used in conjunction with the
              <code class="option">-u</code> option, as chrooting a process
              running as root doesn't enhance security on most
@@ -181,39 +242,61 @@
              defined allows a process with root privileges to
              escape a chroot jail.
            </p>
-</div>
-</dd>
+          </div>
+        </dd>
 <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
-<dd><p>Setuid
+<dd>
+          <p>Setuid
 	    to <em class="replaceable"><code>user</code></em> after completing
            privileged operations, such as creating sockets that
            listen on privileged ports.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-v</span></dt>
-<dd><p>
+<dd>
+          <p>
            Report the version number and exit.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>FILES</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            The default configuration file.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="filename">/var/run/lwresd.pid</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            The default process-id file.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
-      <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">named</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">lwres</span>(3)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">resolver</span>(5)
+      </span>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000, 2001  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -48,7 +48,7 @@ ns_lwsearchlist_create(isc_mem_t *mctx, ns_lwsearchlist_t **listp) {
 	list = isc_mem_get(mctx, sizeof(ns_lwsearchlist_t));
 	if (list == NULL)
 		return (ISC_R_NOMEMORY);
-	
+
 	result = isc_mutex_init(&list->lock);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, list, sizeof(ns_lwsearchlist_t));
@@ -164,7 +164,6 @@ ns_lwsearchctx_next(ns_lwsearchctx_t *sctx) {
 		return (ISC_R_NOMORE);

 	if (sctx->searchname == NULL) {
-		INSIST (!sctx->exactfirst || sctx->doneexact);
 		if (sctx->exactfirst || sctx->doneexact)
 			return (ISC_R_NOMORE);
 		sctx->doneexact = ISC_TRUE;
@@ -100,9 +100,9 @@
 #define BACKTRACE_MAXFRAME 128
 #endif

-extern unsigned int dns_zone_mkey_hour;
-extern unsigned int dns_zone_mkey_day;
-extern unsigned int dns_zone_mkey_month;
+LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_hour;
+LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_day;
+LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;

 static isc_boolean_t	want_stats = ISC_FALSE;
 static char		program_name[ISC_DIR_NAMEMAX] = "named";
@@ -591,6 +591,9 @@ parse_command_line(int argc, char *argv[]) {
 					ns_main_earlyfatal("bad mkeytimer");
 			} else if (!strcmp(isc_commandline_argument, "notcp"))
 				ns_g_notcp = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument,
+					 "keepstderr"))
+				ns_g_keepstderr = ISC_TRUE;
 			else
 				fprintf(stderr, "unknown -T flag '%s\n",
 					isc_commandline_argument);
@@ -636,8 +639,15 @@ parse_command_line(int argc, char *argv[]) {
 #ifdef OPENSSL
 			printf("compiled with OpenSSL version: %s\n",
 			       OPENSSL_VERSION_TEXT);
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+    OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
+			printf("linked to OpenSSL version: %s\n",
+			       OpenSSL_version(OPENSSL_VERSION));
+
+#else
 			printf("linked to OpenSSL version: %s\n",
 			       SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 #endif
 #ifdef HAVE_LIBXML2
 			printf("compiled with libxml2 version: %s\n",
@@ -1031,6 +1041,9 @@ static void
 cleanup(void) {
 	destroy_managers();

+	if (ns_g_mapped != NULL)
+		dns_acl_detach(&ns_g_mapped);
+
 	ns_server_destroy(&ns_g_server);

 	isc_entropy_detach(&ns_g_entropy);
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009, 2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -357,7 +357,7 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2009, 2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
 .br
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -349,6 +349,7 @@ options {
 		( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
 	};
 	max\-journal\-size \fIsize_no_default\fR;
+	max\-records \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
@@ -429,6 +430,10 @@ view \fIstring\fR \fIoptional_class\fR {
 		\fIstring\fR \fIinteger\fR \fIinteger\fR \fIinteger\fR \fIquoted_string\fR;
 		[\&.\&.\&.]
 	};
+	managed\-keys {
+		\fIdomain_name\fR \fBinitial\-key\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR;
+		[\&.\&.\&.]
+	};
 	allow\-recursion { \fIaddress_match_element\fR; \&.\&.\&. };
 	allow\-recursion\-on { \fIaddress_match_element\fR; \&.\&.\&. };
 	sortlist { \fIaddress_match_element\fR; \&.\&.\&. };
@@ -524,6 +529,7 @@ view \fIstring\fR \fIoptional_class\fR {
 		( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
 	};
 	max\-journal\-size \fIsize_no_default\fR;
+	max\-records \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
@@ -615,6 +621,7 @@ zone \fIstring\fR \fIoptional_class\fR {
 		( \fIipv4_address\fR | \fIipv6_address\fR ) [ port \fIinteger\fR ]; \&.\&.\&.
 	};
 	max\-journal\-size \fIsize_no_default\fR;
+	max\-records \fIinteger\fR;
 	max\-transfer\-time\-in \fIinteger\fR;
 	max\-transfer\-time\-out \fIinteger\fR;
 	max\-transfer\-idle\-in \fIinteger\fR;
@@ -663,5 +670,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2011, 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
 -
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
    <date>2014-01-08</date>
  </info>
@@ -48,6 +48,7 @@
      <year>2013</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -338,6 +339,7 @@ options {
 	};

 	max-journal-size <replaceable>size_no_default</replaceable>;
+	max-records <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
@@ -425,6 +427,11 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 		<optional>...</optional>
 	};

+	managed-keys {
+		<replaceable>domain_name</replaceable> <constant>initial-key</constant> <replaceable>flags</replaceable> <replaceable>protocol</replaceable> <replaceable>algorithm</replaceable> <replaceable>key</replaceable>;
+		<optional>...</optional>
+	};
+
 	allow-recursion { <replaceable>address_match_element</replaceable>; ... };
 	allow-recursion-on { <replaceable>address_match_element</replaceable>; ... };
 	sortlist { <replaceable>address_match_element</replaceable>; ... };
@@ -527,6 +534,7 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	};

 	max-journal-size <replaceable>size_no_default</replaceable>;
+	max-records <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
@@ -624,6 +632,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	};

 	max-journal-size <replaceable>size_no_default</replaceable>;
+	max-records <replaceable>integer</replaceable>;
 	max-transfer-time-in <replaceable>integer</replaceable>;
 	max-transfer-time-out <replaceable>integer</replaceable>;
 	max-transfer-idle-in <replaceable>integer</replaceable>;
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
 - purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +14,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named.conf</title>
@@ -21,61 +22,84 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.named.conf"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><code class="filename">named.conf</code> &#8212; configuration file for named</p>
+<p>
+    <code class="filename">named.conf</code>
+     &#8212; configuration file for named
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">named.conf</code> 
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><code class="filename">named.conf</code> is the configuration file
+
+    <p><code class="filename">named.conf</code> is the configuration file
      for
      <span class="command"><strong>named</strong></span>.  Statements are enclosed
      in braces and terminated with a semi-colon.  Clauses in
      the statements are also semi-colon terminated.  The usual
      comment styles are supported:
    </p>
-<p>
+    <p>
      C style: /* */
    </p>
-<p>
+    <p>
      C++ style: // to end of line
    </p>
-<p>
+    <p>
      Unix style: # to end of line
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>ACL</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>KEY</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
 	secret <em class="replaceable"><code>string</code></em>;<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>MASTERS</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
 	<em class="replaceable"><code>ipv6_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] ) [<span class="optional"> key <em class="replaceable"><code>string</code></em> </span>]; ...<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>SERVER</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em> | <em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
 	edns <em class="replaceable"><code>boolean</code></em>;<br>
@@ -94,26 +118,32 @@ server
 	support-ixfr <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.12"></a><h2>TRUSTED-KEYS</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ...<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.13"></a><h2>MANAGED-KEYS</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 managed-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <code class="constant">initial-key</code> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ...<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.14"></a><h2>CONTROLS</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
 		[<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>]<br>
@@ -122,10 +152,12 @@ controls
 	unix <em class="replaceable"><code>unsupported</code></em>; // not implemented<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.15"></a><h2>LOGGING</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
 		file <em class="replaceable"><code>log_file</code></em>;<br>
@@ -140,10 +172,12 @@ logging
 	category <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>; ... };<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.16"></a><h2>LWRES</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 		( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>]; ...<br>
@@ -153,10 +187,12 @@ lwres
 	ndots <em class="replaceable"><code>integer</code></em>;<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.17"></a><h2>OPTIONS</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
 	avoid-v6-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -299,6 +335,7 @@ options
 	};<br>
 <br>
 	max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
@@ -358,10 +395,12 @@ options
 	use-ixfr <em class="replaceable"><code>boolean</code></em>; // obsolete<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.18"></a><h2>VIEW</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	match-destinations { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -384,6 +423,11 @@ view
 		<em class="replaceable"><code>string</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>;<br>
 		[<span class="optional">...</span>]<br>
 	};<br>
+<br>
+	managed-keys {<br>
+		<em class="replaceable"><code>domain_name</code></em> <code class="constant">initial-key</code> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>;<br>
+		[<span class="optional">...</span>]<br>
+	};<br>
 <br>
 	allow-recursion { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	allow-recursion-on { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -487,6 +531,7 @@ view
 	};<br>
 <br>
 	max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
@@ -522,10 +567,12 @@ view
 	max-ixfr-log-size <em class="replaceable"><code>size</code></em>; // obsolete<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.19"></a><h2>ZONE</h2>
-<div class="literallayout"><p><br>
+
+    <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint | redirect |<br>
 		forward | delegation-only );<br>
@@ -583,6 +630,7 @@ zone
 	};<br>
 <br>
 	max-journal-size <em class="replaceable"><code>size_no_default</code></em>;<br>
+	max-records <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-in <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-time-out <em class="replaceable"><code>integer</code></em>;<br>
 	max-transfer-idle-in <em class="replaceable"><code>integer</code></em>;<br>
@@ -619,19 +667,30 @@ zone
 	pubkey <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>integer</code></em> <em class="replaceable"><code>quoted_string</code></em>; // obsolete<br>
 };<br>
 </p></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.20"></a><h2>FILES</h2>
-<p><code class="filename">/etc/named.conf</code>
+
+    <p><code class="filename">/etc/named.conf</code>
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.21"></a><h2>SEE ALSO</h2>
-<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
+
+    <p><span class="citerefentry">
+        <span class="refentrytitle">named</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named-checkconf</span>(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">rndc</span>(8)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2009, 2011, 2013-2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2011, 2013-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named">
  <info>
    <date>2014-02-20</date>
  </info>
@@ -48,6 +48,7 @@
      <year>2013</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2009, 2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009, 2011, 2013-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named</title>
@@ -22,46 +23,88 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.named"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+
+  
+
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">named</span> &#8212; Internet domain name server</p>
+<p>
+    <span class="application">named</span>
+     &#8212; Internet domain name server
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-M <em class="replaceable"><code>option</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">named</code> 
+       [<code class="option">-4</code>]
+       [<code class="option">-6</code>]
+       [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>]
+       [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>]
+       [<code class="option">-E <em class="replaceable"><code>engine-name</code></em></code>]
+       [<code class="option">-f</code>]
+       [<code class="option">-g</code>]
+       [<code class="option">-M <em class="replaceable"><code>option</code></em></code>]
+       [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>]
+       [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>]
+       [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
+       [<code class="option">-s</code>]
+       [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>]
+       [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-U <em class="replaceable"><code>#listeners</code></em></code>]
+       [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
+       [<code class="option">-v</code>]
+       [<code class="option">-V</code>]
+       [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>named</strong></span>
+
+    <p><span class="command"><strong>named</strong></span>
      is a Domain Name System (DNS) server,
      part of the BIND 9 distribution from ISC.  For more
      information on the DNS, see RFCs 1033, 1034, and 1035.
    </p>
-<p>
+    <p>
      When invoked without arguments, <span class="command"><strong>named</strong></span>
      will
      read the default configuration file
      <code class="filename">/etc/named.conf</code>, read any initial
      data, and listen for queries.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-4</span></dt>
-<dd><p>
+<dd>
+          <p>
            Use IPv4 only even if the host machine is capable of IPv6.
            <code class="option">-4</code> and <code class="option">-6</code> are mutually
            exclusive.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-6</span></dt>
-<dd><p>
+<dd>
+          <p>
            Use IPv6 only even if the host machine is capable of IPv4.
            <code class="option">-4</code> and <code class="option">-6</code> are mutually
            exclusive.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use <em class="replaceable"><code>config-file</code></em> as the
            configuration file instead of the default,
            <code class="filename">/etc/named.conf</code>.  To
@@ -71,40 +114,52 @@
            <code class="option">directory</code> option in the configuration
            file, <em class="replaceable"><code>config-file</code></em> should be
            an absolute pathname.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Set the daemon's debug level to <em class="replaceable"><code>debug-level</code></em>.
            Debugging traces from <span class="command"><strong>named</strong></span> become
            more verbose as the debug level increases.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-E <em class="replaceable"><code>engine-name</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use a crypto hardware (OpenSSL engine) for the crypto operations
            it supports, for instance re-signing with private keys from
            a secure key store. When compiled with PKCS#11 support
            <em class="replaceable"><code>engine-name</code></em>
            defaults to pkcs11, the empty name resets it to no engine.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-f</span></dt>
-<dd><p>
+<dd>
+          <p>
            Run the server in the foreground (i.e. do not daemonize).
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-g</span></dt>
-<dd><p>
+<dd>
+          <p>
            Run the server in the foreground and force all logging
            to <code class="filename">stderr</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-M <em class="replaceable"><code>option</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Sets the default memory context options.  Currently
 	    the only supported option is
 	    <em class="replaceable"><code>external</code></em>,
 	    which causes the internal memory manager to be bypassed
 	    in favor of system-provided memory allocation functions.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-m <em class="replaceable"><code>flag</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
 	    Turn on memory usage debugging flags.  Possible flags are
 	    <em class="replaceable"><code>usage</code></em>,
 	    <em class="replaceable"><code>trace</code></em>,
@@ -113,43 +168,48 @@
 	    <em class="replaceable"><code>mctx</code></em>.
 	    These correspond to the ISC_MEM_DEBUGXXXX flags described in
 	    <code class="filename">&lt;isc/mem.h&gt;</code>.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-n <em class="replaceable"><code>#cpus</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Create <em class="replaceable"><code>#cpus</code></em> worker threads
            to take advantage of multiple CPUs.  If not specified,
            <span class="command"><strong>named</strong></span> will try to determine the
            number of CPUs present and create one thread per CPU.
            If it is unable to determine the number of CPUs, a
            single worker thread will be created.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Listen for queries on port <em class="replaceable"><code>port</code></em>.  If not
            specified, the default is port 53.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-s</span></dt>
 <dd>
-<p>
+          <p>
            Write memory usage statistics to <code class="filename">stdout</code> on exit.
          </p>
-<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+          <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
-<p>
+            <p>
              This option is mainly of interest to BIND 9 developers
              and may be removed or changed in a future release.
            </p>
-</div>
-</dd>
+          </div>
+        </dd>
 <dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt>
 <dd>
-<p>
+	  <p>
 	    Allow <span class="command"><strong>named</strong></span> to use up to
 	    <em class="replaceable"><code>#max-socks</code></em> sockets.
 	  </p>
-<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
+          <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Warning</h3>
-<p>
+            <p>
              This option should be unnecessary for the vast majority
              of users.
 	      The use of this option could even be harmful because the
@@ -164,18 +224,18 @@
 	      <span class="command"><strong>named</strong></span> reserves some file descriptors
 	      for its internal use.
            </p>
-</div>
-</dd>
+          </div>
+	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
-<p>Chroot
+          <p>Chroot
 	    to <em class="replaceable"><code>directory</code></em> after
            processing the command line arguments, but before
            reading the configuration file.
          </p>
-<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
+          <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Warning</h3>
-<p>
+            <p>
              This option should be used in conjunction with the
              <code class="option">-u</code> option, as chrooting a process
              running as root doesn't enhance security on most
@@ -183,10 +243,11 @@
              defined allows a process with root privileges to
              escape a chroot jail.
            </p>
-</div>
-</dd>
+          </div>
+        </dd>
 <dt><span class="term">-U <em class="replaceable"><code>#listeners</code></em></span></dt>
-<dd><p>
+<dd>
+          <p>
            Use <em class="replaceable"><code>#listeners</code></em>
            worker threads to listen for incoming UDP packets on each
            address.  If not specified, <span class="command"><strong>named</strong></span> will
@@ -199,17 +260,18 @@
            be increased as high as that value, but no higher.
            On Windows, the number of UDP listeners is hardwired to 1
            and this option has no effect.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-u <em class="replaceable"><code>user</code></em></span></dt>
 <dd>
-<p>Setuid
+          <p>Setuid
 	    to <em class="replaceable"><code>user</code></em> after completing
            privileged operations, such as creating sockets that
            listen on privileged ports.
          </p>
-<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+          <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
-<p>
+            <p>
              On Linux, <span class="command"><strong>named</strong></span> uses the kernel's
              		capability mechanism to drop all root privileges
              except the ability to <code class="function">bind(2)</code> to
@@ -222,63 +284,80 @@
              later, since previous kernels did not allow privileges
              to be retained after <code class="function">setuid(2)</code>.
            </p>
-</div>
-</dd>
+          </div>
+        </dd>
 <dt><span class="term">-v</span></dt>
-<dd><p>
+<dd>
+          <p>
            Report the version number and exit.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+          <p>
            Report the version number and build options, and exit.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">-x <em class="replaceable"><code>cache-file</code></em></span></dt>
 <dd>
-<p>
+          <p>
            Load data from <em class="replaceable"><code>cache-file</code></em> into the
            cache of the default view.
          </p>
-<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
+          <div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Warning</h3>
-<p>
+            <p>
              This option must not be used.  It is only of interest
              to BIND 9 developers and may be removed or changed in a
              future release.
            </p>
-</div>
-</dd>
+          </div>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>SIGNALS</h2>
-<p>
+
+    <p>
      In routine operation, signals should not be used to control
      the nameserver; <span class="command"><strong>rndc</strong></span> should be used
      instead.
    </p>
-<div class="variablelist"><dl class="variablelist">
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">SIGHUP</span></dt>
-<dd><p>
+<dd>
+          <p>
            Force a reload of the server.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term">SIGINT, SIGTERM</span></dt>
-<dd><p>
+<dd>
+          <p>
            Shut down the server.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-<p>
+
+    <p>
      The result of sending any other signals to the server is undefined.
    </p>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>CONFIGURATION</h2>
-<p>
+
+    <p>
      The <span class="command"><strong>named</strong></span> configuration file is too complex
      to describe in detail here.  A complete description is provided
      in the
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-<p>
+
+    <p>
      <span class="command"><strong>named</strong></span> inherits the <code class="function">umask</code>
      (file creation mode mask) from the parent process. If files
      created by <span class="command"><strong>named</strong></span>, such as journal files,
@@ -286,32 +365,59 @@
      should be set explicitly in the script used to start the
      <span class="command"><strong>named</strong></span> process.
    </p>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>FILES</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            The default configuration file.
-          </p></dd>
+          </p>
+        </dd>
 <dt><span class="term"><code class="filename">/var/run/named/named.pid</code></span></dt>
-<dd><p>
+<dd>
+          <p>
            The default process-id file.
-          </p></dd>
+          </p>
+        </dd>
 </dl></div>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.12"></a><h2>SEE ALSO</h2>
-<p><em class="citetitle">RFC 1033</em>,
+
+    <p><em class="citetitle">RFC 1033</em>,
      <em class="citetitle">RFC 1034</em>,
      <em class="citetitle">RFC 1035</em>,
-      <span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named-checkzone</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named-checkconf</span>
+	(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">named-checkzone</span>
+	(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">rndc</span>
+	(8)
+      </span>,
+      <span class="citerefentry">
+        <span class="refentrytitle">lwresd</span>
+	(8)
+      </span>,
+      <span class="citerefentry">
+	<span class="refentrytitle">named.conf</span>
+	(5)
+      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
    </p>
-</div>
+  </div>
+
 </div></body>
 </html>
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2017  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -165,6 +165,19 @@ client_trace(ns_client_t *client, int level, const char *message) {

 #define PENDINGOK(x)	(((x) & DNS_DBFIND_PENDINGOK) != 0)

+/*
+ * These have the same semantics as:
+ *
+ * 	foo_attach(b, a);
+ *	foo_detach(&a);
+ *
+ * without the locking and magic testing.
+ *
+ * We use SAVE and RESTORE as that shows the operation being performed.
+ */
+#define SAVE(a, b) do { INSIST(a == NULL); a = b; b = NULL; } while (0)
+#define RESTORE(a, b) SAVE(a, b)
+
 typedef struct client_additionalctx {
 	ns_client_t *client;
 	dns_rdataset_t *rdataset;
@@ -1436,8 +1449,7 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 		} else
 			need_addname = ISC_TRUE;
 		ISC_LIST_APPEND(fname->list, rdataset, link);
-		trdataset = rdataset;
-		rdataset = NULL;
+		SAVE(trdataset, rdataset);
 		added_something = ISC_TRUE;
 		/*
 		 * Note: we only add SIGs if we've added the type they cover,
@@ -3164,16 +3176,12 @@ query_addbestns(ns_client_t *client) {
 			goto cleanup;
 		if (USECACHE(client)) {
 			query_keepname(client, fname, dbuf);
-			zdb = db;
-			zfname = fname;
-			fname = NULL;
-			zrdataset = rdataset;
-			rdataset = NULL;
-			zsigrdataset = sigrdataset;
-			sigrdataset = NULL;
 			dns_db_detachnode(db, &node);
+			SAVE(zdb, db);
+			SAVE(zfname, fname);
+			SAVE(zrdataset, rdataset);
+			SAVE(zsigrdataset, sigrdataset);
 			version = NULL;
-			db = NULL;
 			dns_db_attach(client->view->cachedb, &db);
 			is_zone = ISC_FALSE;
 			goto db_find;
@@ -3204,8 +3212,6 @@ query_addbestns(ns_client_t *client) {

 	if (use_zone) {
 		query_releasename(client, &fname);
-		fname = zfname;
-		zfname = NULL;
 		/*
 		 * We've already done query_keepname() on
 		 * zfname, so we must set dbuf to NULL to
@@ -3216,10 +3222,15 @@ query_addbestns(ns_client_t *client) {
 		query_putrdataset(client, &rdataset);
 		if (sigrdataset != NULL)
 			query_putrdataset(client, &sigrdataset);
-		rdataset = zrdataset;
-		zrdataset = NULL;
-		sigrdataset = zsigrdataset;
-		zsigrdataset = NULL;
+
+		if (node != NULL)
+			dns_db_detachnode(db, &node);
+		dns_db_detach(&db);
+
+		RESTORE(db, zdb);
+		RESTORE(fname, zfname);
+		RESTORE(rdataset, zrdataset);
+		RESTORE(sigrdataset, zsigrdataset);
 	}

 	/*
@@ -3540,7 +3551,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 		/*
 		 * Add closest (provable) encloser NSEC3.
 		 */
-		query_findclosestnsec3(cname, db, NULL, client, rdataset,
+		query_findclosestnsec3(cname, db, version, client, rdataset,
 				       sigrdataset, fname, ISC_TRUE, cname);
 		if (!dns_rdataset_isassociated(rdataset))
 			goto cleanup;
@@ -3579,7 +3590,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 		else
 			dns_name_split(name, labels, NULL, wname);

-		query_findclosestnsec3(wname, db, NULL, client, rdataset,
+		query_findclosestnsec3(wname, db, version, client, rdataset,
 				       sigrdataset, fname, ISC_FALSE, NULL);
 		if (!dns_rdataset_isassociated(rdataset))
 			goto cleanup;
@@ -3619,7 +3630,7 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;

-		query_findclosestnsec3(wname, db, NULL, client, rdataset,
+		query_findclosestnsec3(wname, db, version, client, rdataset,
 				       sigrdataset, fname, nodata, NULL);
 		if (!dns_rdataset_isassociated(rdataset))
 			goto cleanup;
@@ -3894,7 +3905,7 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 			ns_client_killoldestquery(client);
 		}
 		if (result == ISC_R_SUCCESS && !client->mortal &&
-		    (client->attributes & NS_CLIENTATTR_TCP) == 0) {
+		    !TCP(client)) {
 			result = ns_client_replace(client);
 			if (result != ISC_R_SUCCESS) {
 				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
@@ -3930,7 +3941,7 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,

 	if (client->query.timerset == ISC_FALSE)
 		ns_client_settimeout(client, 60);
-	if ((client->attributes & NS_CLIENTATTR_TCP) == 0)
+	if (!TCP(client))
 		peeraddr = &client->peeraddr;
 	else
 		peeraddr = NULL;
@@ -4055,8 +4066,7 @@ rpz_rrset_find(ns_client_t *client, dns_rpz_type_t rpz_type,
 		st->r.db = NULL;
 		if (*rdatasetp != NULL)
 			query_putrdataset(client, rdatasetp);
-		*rdatasetp = st->r.r_rdataset;
-		st->r.r_rdataset = NULL;
+		RESTORE(*rdatasetp, st->r.r_rdataset);
 		result = st->r.r_result;
 		if (result == DNS_R_DELEGATION) {
 			CTRACE(ISC_LOG_ERROR, "RPZ recursing");
@@ -4470,6 +4480,7 @@ rpz_rewrite_name(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 	zone = NULL;
 	db = NULL;
 	node = NULL;
+	version = NULL;

 	for (rpz = ISC_LIST_HEAD(client->view->rpz_zones);
 	     rpz != NULL;
@@ -4605,24 +4616,21 @@ rpz_rewrite_name(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 			dns_name_copy(rpz_qname, st->qname, NULL);
 			if (*rdatasetp != NULL &&
 			    dns_rdataset_isassociated(*rdatasetp)) {
-				dns_rdataset_t *trdataset;
+				dns_rdataset_t *trdataset = NULL;

-				trdataset = st->m.rdataset;
-				st->m.rdataset = *rdatasetp;
-				*rdatasetp = trdataset;
+				SAVE(trdataset, st->m.rdataset);
+				SAVE(st->m.rdataset, *rdatasetp);
+				SAVE(*rdatasetp, trdataset);
 				st->m.ttl = ISC_MIN(st->m.rdataset->ttl,
 						    rpz->max_policy_ttl);
 			} else {
 				st->m.ttl = ISC_MIN(DNS_RPZ_TTL_DEFAULT,
 						    rpz->max_policy_ttl);
 			}
-			st->m.node = node;
-			node = NULL;
-			st->m.db = db;
-			db = NULL;
-			st->m.version = version;
-			st->m.zone = zone;
-			zone = NULL;
+			SAVE(st->m.node, node);
+			SAVE(st->m.db, db);
+			SAVE(st->m.version, version);
+			SAVE(st->m.zone, zone);
 		}
 	}

@@ -5499,12 +5507,12 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
 			     aaaaok, count)) {
 		for (i = 0; i < count; i++) {
 			if (aaaaok != NULL && !aaaaok[i]) {
-				client->query.dns64_aaaaok = aaaaok;
+				SAVE(client->query.dns64_aaaaok, aaaaok);
 				client->query.dns64_aaaaoklen = count;
 				break;
 			}
 		}
-		if (i == count && aaaaok != NULL)
+		if (aaaaok != NULL)
 			isc_mem_put(client->mctx, aaaaok,
 				    sizeof(isc_boolean_t) * count);
 		return (ISC_TRUE);
@@ -5779,32 +5787,27 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

 			is_zone = rpz_st->q.is_zone;
 			authoritative = rpz_st->q.authoritative;
-			zone = rpz_st->q.zone;
-			rpz_st->q.zone = NULL;
-			node = rpz_st->q.node;
-			rpz_st->q.node = NULL;
-			db = rpz_st->q.db;
-			rpz_st->q.db = NULL;
-			rdataset = rpz_st->q.rdataset;
-			rpz_st->q.rdataset = NULL;
-			sigrdataset = rpz_st->q.sigrdataset;
-			rpz_st->q.sigrdataset = NULL;
+			RESTORE(zone, rpz_st->q.zone);
+			RESTORE(node, rpz_st->q.node);
+			RESTORE(db, rpz_st->q.db);
+			RESTORE(rdataset, rpz_st->q.rdataset);
+			RESTORE(sigrdataset, rpz_st->q.sigrdataset);
 			qtype = rpz_st->q.qtype;

-			rpz_st->r.db = event->db;
 			if (event->node != NULL)
 				dns_db_detachnode(event->db, &event->node);
+			SAVE(rpz_st->r.db, event->db);
 			rpz_st->r.r_type = event->qtype;
-			rpz_st->r.r_rdataset = event->rdataset;
+			SAVE(rpz_st->r.r_rdataset, event->rdataset);
 			query_putrdataset(client, &event->sigrdataset);
 		} else {
 			authoritative = ISC_FALSE;

 			qtype = event->qtype;
-			db = event->db;
-			node = event->node;
-			rdataset = event->rdataset;
-			sigrdataset = event->sigrdataset;
+			RESTORE(db, event->db);
+			RESTORE(node, event->node);
+			RESTORE(rdataset, event->rdataset);
+			RESTORE(sigrdataset, event->sigrdataset);
 		}
 		INSIST(rdataset != NULL);

@@ -5881,6 +5884,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	want_restart = ISC_FALSE;
 	authoritative = ISC_FALSE;
 	version = NULL;
+	zversion = NULL;
 	need_wildcardproof = ISC_FALSE;
 	rpz = ISC_FALSE;

@@ -5936,9 +5940,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				dns_db_detach(&db);
 			if (zone != NULL)
 				dns_zone_detach(&zone);
-			version = tversion;
-			db = tdb;
-			zone = tzone;
+			version = NULL;
+			RESTORE(version, tversion);
+			RESTORE(db, tdb);
+			RESTORE(zone, tzone);
 			is_zone = ISC_TRUE;
 			result = ISC_R_SUCCESS;
 		} else {
@@ -6121,10 +6126,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			resp_result = ISC_R_SUCCESS;
 		}
 		rrl_result = dns_rrl(client->view, &client->peeraddr,
-				     ISC_TF((client->attributes
-					     & NS_CLIENTATTR_TCP) != 0),
-				     client->message->rdclass, qtype, tname,
-				     resp_result, client->now,
+				     TCP(client), client->message->rdclass,
+				     qtype, tname, resp_result, client->now,
 				     wouldlog, log_buf, sizeof(log_buf));
 		if (rrl_result != DNS_RRL_RESULT_OK) {
 			/*
@@ -6193,16 +6196,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			rpz_st->q.qtype = qtype;
 			rpz_st->q.is_zone = is_zone;
 			rpz_st->q.authoritative = authoritative;
-			rpz_st->q.zone = zone;
-			zone = NULL;
-			rpz_st->q.db = db;
-			db = NULL;
-			rpz_st->q.node = node;
-			node = NULL;
-			rpz_st->q.rdataset = rdataset;
-			rdataset = NULL;
-			rpz_st->q.sigrdataset = sigrdataset;
-			sigrdataset = NULL;
+			SAVE(rpz_st->q.zone, zone);
+			SAVE(rpz_st->q.db, db);
+			SAVE(rpz_st->q.node, node);
+			SAVE(rpz_st->q.rdataset, rdataset);
+			SAVE(rpz_st->q.sigrdataset, sigrdataset);
 			dns_name_copy(fname, rpz_st->fname, NULL);
 			rpz_st->q.result = result;
 			client->query.attributes |= NS_QUERYATTR_RECURSING;
@@ -6224,20 +6222,17 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			rpz_clean(&zone, &db, &node, NULL);
 			if (rpz_st->m.rdataset != NULL) {
 				query_putrdataset(client, &rdataset);
-				rdataset = rpz_st->m.rdataset;
-				rpz_st->m.rdataset = NULL;
+				RESTORE(rdataset, rpz_st->m.rdataset);
 			} else if (rdataset != NULL &&
 				   dns_rdataset_isassociated(rdataset)) {
 				dns_rdataset_disassociate(rdataset);
 			}
-			node = rpz_st->m.node;
-			rpz_st->m.node = NULL;
-			db = rpz_st->m.db;
-			rpz_st->m.db = NULL;
-			version = rpz_st->m.version;
-			rpz_st->m.version = NULL;
-			zone = rpz_st->m.zone;
-			rpz_st->m.zone = NULL;
+			version = NULL;
+
+			RESTORE(node, rpz_st->m.node);
+			RESTORE(db, rpz_st->m.db);
+			RESTORE(version, rpz_st->m.version);
+			RESTORE(zone, rpz_st->m.zone);

 			switch (rpz_st->m.policy) {
 			case DNS_RPZ_POLICY_NXDOMAIN:
@@ -6430,9 +6425,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 						dns_db_detach(&db);
 					if (zone != NULL)
 						dns_zone_detach(&zone);
-					version = tversion;
-					db = tdb;
-					zone = tzone;
+					version = NULL;
+					RESTORE(version, tversion);
+					RESTORE(db, tdb);
+					RESTORE(zone, tzone);
 					authoritative = ISC_TRUE;
 					goto db_find;
 				}
@@ -6495,17 +6491,12 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 * use it instead.
 				 */
 				query_keepname(client, fname, dbuf);
-				zdb = db;
-				zfname = fname;
-				fname = NULL;
-				zrdataset = rdataset;
-				rdataset = NULL;
-				zsigrdataset = sigrdataset;
-				sigrdataset = NULL;
 				dns_db_detachnode(db, &node);
-				zversion = version;
-				version = NULL;
-				db = NULL;
+				SAVE(zdb, db);
+				SAVE(zfname, fname);
+				SAVE(zversion, version);
+				SAVE(zrdataset, rdataset);
+				SAVE(zsigrdataset, sigrdataset);
 				dns_db_attach(client->view->cachedb, &db);
 				is_zone = ISC_FALSE;
 				goto db_find;
@@ -6530,8 +6521,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				 *    static-stub zone.
 				 */
 				query_releasename(client, &fname);
-				fname = zfname;
-				zfname = NULL;
 				/*
 				 * We've already done query_keepname() on
 				 * zfname, so we must set dbuf to NULL to
@@ -6543,12 +6532,12 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				if (sigrdataset != NULL)
 					query_putrdataset(client,
 							  &sigrdataset);
-				rdataset = zrdataset;
-				zrdataset = NULL;
-				sigrdataset = zsigrdataset;
-				zsigrdataset = NULL;
-				version = zversion;
-				zversion = NULL;
+				version = NULL;
+
+				RESTORE(fname, zfname);
+				RESTORE(version, zversion);
+				RESTORE(rdataset, zrdataset);
+				RESTORE(sigrdataset, zsigrdataset);
 				/*
 				 * We don't clean up zdb here because we
 				 * may still need it.  It will get cleaned
@@ -6643,10 +6632,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				query_putrdataset(client, &rdataset);
 			if (sigrdataset != NULL)
 				query_putrdataset(client, &sigrdataset);
-			rdataset = client->query.dns64_aaaa;
-			sigrdataset = client->query.dns64_sigaaaa;
-			client->query.dns64_aaaa = NULL;
-			client->query.dns64_sigaaaa = NULL;
+			RESTORE(rdataset, client->query.dns64_aaaa);
+			RESTORE(sigrdataset, client->query.dns64_sigaaaa);
 			if (fname == NULL) {
 				dbuf = query_getnamebuf(client);
 				if (dbuf == NULL) {
@@ -6683,15 +6670,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 * Look to see if there are A records for this
 			 * name.
 			 */
-			INSIST(client->query.dns64_aaaa == NULL);
-			INSIST(client->query.dns64_sigaaaa == NULL);
-			client->query.dns64_aaaa = rdataset;
-			client->query.dns64_sigaaaa = sigrdataset;
+			SAVE(client->query.dns64_aaaa, rdataset);
+			SAVE(client->query.dns64_sigaaaa, sigrdataset);
 			client->query.dns64_ttl = dns64_ttl(db, version);
 			query_releasename(client, &fname);
 			dns_db_detachnode(db, &node);
-			rdataset = NULL;
-			sigrdataset = NULL;
 			type = qtype = dns_rdatatype_a;
 			dns64 = ISC_TRUE;
 			goto db_find;
@@ -6951,10 +6934,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				query_putrdataset(client, &rdataset);
 			if (sigrdataset != NULL)
 				query_putrdataset(client, &sigrdataset);
-			rdataset = client->query.dns64_aaaa;
-			sigrdataset = client->query.dns64_sigaaaa;
-			client->query.dns64_aaaa = NULL;
-			client->query.dns64_sigaaaa = NULL;
+			RESTORE(rdataset, client->query.dns64_aaaa);
+			RESTORE(sigrdataset, client->query.dns64_sigaaaa);
 			if (fname == NULL) {
 				dbuf = query_getnamebuf(client);
 				if (dbuf == NULL) {
@@ -6988,10 +6969,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 * Look to see if there are A records for this
 			 * name.
 			 */
-			INSIST(client->query.dns64_aaaa == NULL);
-			INSIST(client->query.dns64_sigaaaa == NULL);
-			client->query.dns64_aaaa = rdataset;
-			client->query.dns64_sigaaaa = sigrdataset;
+
 			/*
 			 * If the ttl is zero we need to workout if we have just
 			 * decremented to zero or if there was no negative cache
@@ -7001,11 +6979,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				client->query.dns64_ttl = rdataset->ttl;
 			else if (dns_rdataset_first(rdataset) == ISC_R_SUCCESS)
 				client->query.dns64_ttl = 0;
+			SAVE(client->query.dns64_aaaa, rdataset);
+			SAVE(client->query.dns64_sigaaaa, sigrdataset);
 			query_releasename(client, &fname);
 			dns_db_detachnode(db, &node);
-			rdataset = NULL;
-			sigrdataset = NULL;
-			fname = NULL;
 			type = qtype = dns_rdatatype_a;
 			dns64 = ISC_TRUE;
 			goto db_find;
@@ -7024,6 +7001,37 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		goto cleanup;

 	case DNS_R_CNAME:
+		/*
+		 * If we have a zero ttl from the cache refetch it.
+		 */
+		if (!is_zone && event == NULL && rdataset->ttl == 0 &&
+		    RECURSIONOK(client))
+		{
+			if (dns_rdataset_isassociated(rdataset))
+				dns_rdataset_disassociate(rdataset);
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
+			if (node != NULL)
+				dns_db_detachnode(db, &node);
+
+			result = query_recurse(client, qtype,
+					       client->query.qname,
+					       NULL, NULL, resuming);
+			if (result == ISC_R_SUCCESS) {
+				client->query.attributes |=
+					NS_QUERYATTR_RECURSING;
+				if (dns64)
+					client->query.attributes |=
+						NS_QUERYATTR_DNS64;
+				if (dns64_exclude)
+					client->query.attributes |=
+					      NS_QUERYATTR_DNS64EXCLUDE;
+			} else
+				RECURSE_ERROR(result);
+			goto cleanup;
+		}
+
 		/*
 		 * Keep a copy of the rdataset.  We have to do this because
 		 * query_addrrset may clear 'rdataset' (to prevent the
@@ -7415,6 +7423,37 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		 * we know the answer.
 		 */

+		/*
+		 * If we have a zero ttl from the cache refetch it.
+		 */
+		if (!is_zone && event == NULL && rdataset->ttl == 0 &&
+		    RECURSIONOK(client))
+		{
+			if (dns_rdataset_isassociated(rdataset))
+				dns_rdataset_disassociate(rdataset);
+			if (sigrdataset != NULL &&
+			    dns_rdataset_isassociated(sigrdataset))
+				dns_rdataset_disassociate(sigrdataset);
+			if (node != NULL)
+				dns_db_detachnode(db, &node);
+
+			result = query_recurse(client, qtype,
+					       client->query.qname,
+					       NULL, NULL, resuming);
+			if (result == ISC_R_SUCCESS) {
+				client->query.attributes |=
+					NS_QUERYATTR_RECURSING;
+				if (dns64)
+					client->query.attributes |=
+						NS_QUERYATTR_DNS64;
+				if (dns64_exclude)
+					client->query.attributes |=
+					      NS_QUERYATTR_DNS64EXCLUDE;
+			} else
+				RECURSE_ERROR(result);
+			goto cleanup;
+		}
+
 #ifdef ALLOW_FILTER_AAAA_ON_V4
 		/*
 		 * Optionally hide AAAAs from IPv4 clients if there is an A.
@@ -7512,13 +7551,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 * Look to see if there are A records for this
 			 * name.
 			 */
-			client->query.dns64_aaaa = rdataset;
-			client->query.dns64_sigaaaa = sigrdataset;
 			client->query.dns64_ttl = rdataset->ttl;
+			SAVE(client->query.dns64_aaaa, rdataset);
+			SAVE(client->query.dns64_sigaaaa, sigrdataset);
 			query_releasename(client, &fname);
 			dns_db_detachnode(db, &node);
-			rdataset = NULL;
-			sigrdataset = NULL;
 			type = qtype = dns_rdatatype_a;
 			dns64_exclude = dns64 = ISC_TRUE;
 			goto db_find;
@@ -7757,8 +7794,7 @@ log_query(ns_client_t *client, unsigned int flags, unsigned int extflags) {
 		      classname, typename, WANTRECURSION(client) ? "+" : "-",
 		      (client->signer != NULL) ? "S": "",
 		      (client->opt != NULL) ? "E" : "",
-		      ((client->attributes & NS_CLIENTATTR_TCP) != 0) ?
-				 "T" : "",
+		      TCP(client) ? "T" : "",
 		      ((extflags & DNS_MESSAGEEXTFLAG_DO) != 0) ? "D" : "",
 		      ((flags & DNS_MESSAGEFLAG_CD) != 0) ? "C" : "",
 		      onbuf);
@@ -7956,8 +7992,7 @@ ns_query_start(ns_client_t *client) {
 	/*
 	 * Turn on minimal responses for EDNS/UDP bufsize 512 queries.
 	 */
-	if (client->opt != NULL && client->udpsize <= 512U &&
-	    (client->attributes & NS_CLIENTATTR_TCP) == 0)
+	if (client->opt != NULL && client->udpsize <= 512U && !TCP(client))
 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
 					     NS_QUERYATTR_NOADDITIONAL);

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2017  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -756,6 +756,29 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 	return (result);
 }

+/*%
+ * Check whether a key has been successfully loaded.
+ */
+static isc_boolean_t
+keyloaded(dns_view_t *view, dns_name_t *name) {
+	isc_result_t result;
+	dns_keytable_t *secroots = NULL;
+	dns_keynode_t *keynode = NULL;
+
+	result = dns_view_getsecroots(view, &secroots);
+	if (result != ISC_R_SUCCESS)
+		return (ISC_FALSE);
+
+	result = dns_keytable_find(secroots, name, &keynode);
+
+	if (keynode != NULL)
+		dns_keytable_detachkeynode(secroots, &keynode);
+	if (secroots != NULL)
+		dns_keytable_detach(&secroots);
+
+	return (ISC_TF(result == ISC_R_SUCCESS));
+}
+
 /*%
 * Configure DNSSEC keys for a view.
 *
@@ -821,21 +844,40 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		const cfg_obj_t *builtin_keys = NULL;
 		const cfg_obj_t *builtin_managed_keys = NULL;

-		isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
-			      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "using built-in DLV key for view %s",
-			      view->name);
-
 		/*
-		 * If bind.keys exists, it overrides the managed-keys
-		 * clause hard-coded in ns_g_config.
+		 * If bind.keys exists and is populated, it overrides
+		 * the managed-keys clause hard-coded in ns_g_config.
 		 */
 		if (bindkeys != NULL) {
+			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "obtaining DLV key for view %s "
+				      "from '%s'",
+				      view->name, ns_g_server->bindkeysfile);
+
 			(void)cfg_map_get(bindkeys, "trusted-keys",
 					  &builtin_keys);
 			(void)cfg_map_get(bindkeys, "managed-keys",
 					  &builtin_managed_keys);
-		} else {
+			if ((builtin_keys == NULL) &&
+			    (builtin_managed_keys == NULL))
+				isc_log_write(ns_g_lctx,
+					      DNS_LOGCATEGORY_SECURITY,
+					      NS_LOGMODULE_SERVER,
+					      ISC_LOG_WARNING,
+					      "dnssec-lookaside auto: "
+					      "WARNING: key for dlv.isc.org "
+					      "not found");
+		}
+
+		if ((builtin_keys == NULL) &&
+		    (builtin_managed_keys == NULL))
+		{
+			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "using built-in DLV key for view %s",
+				      view->name);
+
 			(void)cfg_map_get(ns_g_config, "trusted-keys",
 					  &builtin_keys);
 			(void)cfg_map_get(ns_g_config, "managed-keys",
@@ -848,27 +890,54 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 		if (builtin_managed_keys != NULL)
 			CHECK(load_view_keys(builtin_managed_keys, vconfig,
 					     view, ISC_TRUE, view->dlv, mctx));
+		if (!keyloaded(view, view->dlv)) {
+			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "DLV key not loaded");
+			result = ISC_R_FAILURE;
+			goto cleanup;
+		}
 	}

 	if (auto_root && view->rdclass == dns_rdataclass_in) {
 		const cfg_obj_t *builtin_keys = NULL;
 		const cfg_obj_t *builtin_managed_keys = NULL;

-		isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
-			      NS_LOGMODULE_SERVER, ISC_LOG_WARNING,
-			      "using built-in root key for view %s",
-			      view->name);
-
 		/*
-		 * If bind.keys exists, it overrides the managed-keys
-		 * clause hard-coded in ns_g_config.
+		 * If bind.keys exists and is populated, it overrides
+		 * the managed-keys clause hard-coded in ns_g_config.
 		 */
 		if (bindkeys != NULL) {
+			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "obtaining root key for view %s "
+				      "from '%s'",
+				      view->name, ns_g_server->bindkeysfile);
+
 			(void)cfg_map_get(bindkeys, "trusted-keys",
 					  &builtin_keys);
 			(void)cfg_map_get(bindkeys, "managed-keys",
 					  &builtin_managed_keys);
-		} else {
+
+			if ((builtin_keys == NULL) &&
+			    (builtin_managed_keys == NULL))
+				isc_log_write(ns_g_lctx,
+					      DNS_LOGCATEGORY_SECURITY,
+					      NS_LOGMODULE_SERVER,
+					      ISC_LOG_WARNING,
+					      "dnssec-validation auto: "
+					      "WARNING: root zone key "
+					      "not found");
+		}
+
+		if ((builtin_keys == NULL) &&
+		    (builtin_managed_keys == NULL))
+		{
+			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "using built-in root key for view %s",
+				      view->name);
+
 			(void)cfg_map_get(ns_g_config, "trusted-keys",
 					  &builtin_keys);
 			(void)cfg_map_get(ns_g_config, "managed-keys",
@@ -882,6 +951,14 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 			CHECK(load_view_keys(builtin_managed_keys, vconfig,
 					     view, ISC_TRUE, dns_rootname,
 					     mctx));
+
+		if (!keyloaded(view, dns_rootname)) {
+			isc_log_write(ns_g_lctx, DNS_LOGCATEGORY_SECURITY,
+				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
+				      "root key not loaded");
+			result = ISC_R_FAILURE;
+			goto cleanup;
+		}
 	}

 	CHECK(load_view_keys(view_keys, vconfig, view, ISC_FALSE,
@@ -2073,6 +2150,26 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 	return (result);
 }

+static isc_result_t
+create_mapped_acl(void) {
+	isc_result_t result;
+	dns_acl_t *acl = NULL;
+	struct in6_addr in6 = IN6ADDR_V4MAPPED_INIT;
+	isc_netaddr_t addr;
+
+	isc_netaddr_fromin6(&addr, &in6);
+
+	result = dns_acl_create(ns_g_mctx, 1, &acl);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	result = dns_iptable_addprefix(acl->iptable, &addr, 96, ISC_TRUE);
+	if (result == ISC_R_SUCCESS)
+		dns_acl_attach(acl, &ns_g_mapped);
+	dns_acl_detach(&acl);
+	return (result);
+}
+
 /*
 * Configure 'view' according to 'vconfig', taking defaults from 'config'
 * where values are missing in 'vconfig'.
@@ -2096,6 +2193,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	const cfg_obj_t *alternates;
 	const cfg_obj_t *zonelist;
 	const cfg_obj_t *dlz;
+	const cfg_obj_t *dlvobj = NULL;
 	unsigned int dlzargc;
 	char **dlzargv;
 	const cfg_obj_t *disabled;
@@ -2139,7 +2237,6 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	dns_acl_t *clients = NULL, *mapped = NULL, *excluded = NULL;
 	unsigned int query_timeout, ndisp;
 	struct cfg_context *nzctx;
-	dns_rpz_zone_t *rpz;

 	REQUIRE(DNS_VIEW_VALID(view));

@@ -2298,22 +2395,6 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 				     actx, ISC_FALSE));
 	}

-	for (rpz = ISC_LIST_HEAD(view->rpz_zones);
-	     rpz != NULL;
-	     rpz = ISC_LIST_NEXT(rpz, link))
-	{
-		if (!rpz->defined) {
-			char namebuf[DNS_NAME_FORMATSIZE];
-
-			dns_name_format(&rpz->origin, namebuf, sizeof(namebuf));
-			cfg_obj_log(obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
-				    "'%s' is not a master or slave zone",
-				    namebuf);
-			result = ISC_R_NOTFOUND;
-			goto cleanup;
-		}
-	}
-
 	/*
 	 * If we're allowing added zones, then load zone configuration
 	 * from the newzone file for zones that were added during previous
@@ -2510,6 +2591,13 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 							    mctx, 0, &excluded);
 				if (result != ISC_R_SUCCESS)
 					goto cleanup;
+			} else {
+				if (ns_g_mapped == NULL) {
+					result = create_mapped_acl();
+					if (result != ISC_R_SUCCESS)
+						goto cleanup;
+				}
+				dns_acl_attach(ns_g_mapped, &excluded);
 			}

 			obj = NULL;
@@ -3288,7 +3376,6 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	result = ns_config_get(optionmaps, "dnssec-lookaside", &obj);
 	if (result == ISC_R_SUCCESS) {
 		/* If set to "auto", use the version from the defaults */
-		const cfg_obj_t *dlvobj;
 		const char *dom;
 		dlvobj = cfg_listelt_value(cfg_list_first(obj));
 		dom = cfg_obj_asstring(cfg_tuple_get(dlvobj, "domain"));
@@ -3306,18 +3393,34 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	}

 	if (result == ISC_R_SUCCESS) {
+		dns_name_t *dlv, *iscdlv;
+		dns_fixedname_t f;
+		dns_fixedname_init(&f);
+
+		iscdlv = dns_fixedname_name(&f);
+		CHECK(dns_name_fromstring(iscdlv, "dlv.isc.org", 0, NULL));
+
 		for (element = cfg_list_first(obj);
 		     element != NULL;
 		     element = cfg_list_next(element))
 		{
-			dns_name_t *dlv;
-
 			obj = cfg_listelt_value(element);
 			obj = cfg_tuple_get(obj, "trust-anchor");
+
 			dlv = dns_fixedname_name(&view->dlv_fixed);
 			CHECK(dns_name_fromstring(dlv, cfg_obj_asstring(obj),
 						  DNS_NAME_DOWNCASE, NULL));
 			view->dlv = dns_fixedname_name(&view->dlv_fixed);
+
+			if (dns_name_equal(view->dlv, iscdlv)) {
+				if (auto_dlv)
+					obj = dlvobj;
+				cfg_obj_log(obj, ns_g_lctx, ISC_LOG_WARNING,
+					    "WARNING: the DLV server at "
+					    "'dlv.isc.org' is expected to "
+					    "cease operation by the end "
+					    "of January 2017");
+			}
 		}
 	} else
 		view->dlv = NULL;
@@ -3708,7 +3811,7 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,

 	if (ISC_LIST_EMPTY(addresses)) {
 		if (forwardtype != NULL)
-			cfg_obj_log(forwarders, ns_g_lctx, ISC_LOG_WARNING,
+			cfg_obj_log(forwardtype, ns_g_lctx, ISC_LOG_WARNING,
 				    "no forwarders seen; disabling "
 				    "forwarding");
 		fwdpolicy = dns_fwdpolicy_none;
@@ -5121,6 +5224,11 @@ load_configuration(const char *filename, ns_server_t *server,
 		result = cfg_parse_file(bindkeys_parser, server->bindkeysfile,
 					&cfg_type_bindkeys, &bindkeys);
 		CHECK(result);
+	} else {
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "unable to open '%s' using built-in keys",
+			      server->bindkeysfile);
 	}

 	/* Ensure exclusive access to configuration data. */
@@ -5652,13 +5760,18 @@ load_configuration(const char *filename, ns_server_t *server,
 				      "no source of entropy found");
 		} else {
 			const char *randomdev = cfg_obj_asstring(obj);
+			int level = ISC_LOG_ERROR;
 			result = isc_entropy_createfilesource(ns_g_entropy,
 							      randomdev);
+#ifdef PATH_RANDOMDEV
+			if (ns_g_fallbackentropy != NULL)
+				level = ISC_LOG_INFO;
+#endif
 			if (result != ISC_R_SUCCESS)
 				isc_log_write(ns_g_lctx,
 					      NS_LOGCATEGORY_GENERAL,
 					      NS_LOGMODULE_SERVER,
-					      ISC_LOG_INFO,
+					      level,
 					      "could not open entropy source "
 					      "%s: %s",
 					      randomdev,
@@ -7291,12 +7404,13 @@ dumpdone(void *arg, isc_result_t result) {
 }

 isc_result_t
-ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex) {
+ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex, isc_buffer_t *text) {
 	struct dumpcontext *dctx = NULL;
 	dns_view_t *view;
 	isc_result_t result;
 	char *ptr;
 	const char *sep;
+	isc_boolean_t found;

 	/* Skip the command name. */
 	ptr = next_token(lex, NULL);
@@ -7362,15 +7476,26 @@ ns_server_dumpdb(ns_server_t *server, isc_lex_t *lex) {
 	}

 nextview:
+	found = ISC_FALSE;
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (ptr != NULL && strcmp(view->name, ptr) != 0)
 			continue;
+		found = ISC_TRUE;
 		CHECK(add_view_tolist(dctx, view));
 	}
 	if (ptr != NULL) {
+		if (!found) {
+			putstr(text, "view '");
+			putstr(text, ptr);
+			putstr(text, "' not found");
+			putnull(text);
+			result = ISC_R_NOTFOUND;
+			dumpdone(dctx, result);
+			return (result);
+		}
 		ptr = next_token(lex, NULL);
 		if (ptr != NULL)
 			goto nextview;
@@ -8418,6 +8543,7 @@ ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 	const cfg_obj_t	    *views = NULL;
 	const cfg_obj_t     *parms = NULL;
 	const cfg_obj_t     *obj = NULL;
+	const cfg_obj_t     *zoptions = NULL;
 	const cfg_listelt_t *element;
 	const char	    *zonename;
 	const char	    *classname = NULL;
@@ -8451,6 +8577,28 @@ ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 	dnsname = dns_fixedname_name(&fname);
 	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0, NULL));

+	/* Check the zone type for ones that are not supported by addzone. */
+	zoptions = cfg_tuple_get(parms, "options");
+
+	obj = NULL;
+	(void)cfg_map_get(zoptions, "type", &obj);
+	if (obj == NULL) {
+		(void) putstr(text, "zone type not specified");
+		CHECK(ISC_R_FAILURE);
+	}
+
+	if (strcasecmp(cfg_obj_asstring(obj), "hint") == 0 ||
+	    strcasecmp(cfg_obj_asstring(obj), "forward") == 0 ||
+	    strcasecmp(cfg_obj_asstring(obj), "redirect") == 0 ||
+	    strcasecmp(cfg_obj_asstring(obj), "delegation-only") == 0)
+	{
+		(void) putstr(text, "'");
+		(void) putstr(text, cfg_obj_asstring(obj));
+		(void) putstr(text, "' zones not supported by ");
+		(void) putstr(text, "addzone");
+		CHECK(ISC_R_FAILURE);
+	}
+
 	/* Make sense of optional class argument */
 	obj = cfg_tuple_get(parms, "class");
 	CHECK(ns_config_getclass(obj, dns_rdataclass_in, &rdclass));
@@ -48,6 +48,7 @@
 #include <isc/strerror.h>
 #include <isc/string.h>

+#include <named/globals.h>
 #include <named/main.h>
 #include <named/os.h>
 #ifdef HAVE_LIBSCF
@@ -460,7 +461,7 @@ ns_os_daemonize(void) {
 			(void)close(STDOUT_FILENO);
 			(void)dup2(devnullfd, STDOUT_FILENO);
 		}
-		if (devnullfd != STDERR_FILENO) {
+		if (devnullfd != STDERR_FILENO && !ns_g_keepstderr) {
 			(void)close(STDERR_FILENO);
 			(void)dup2(devnullfd, STDERR_FILENO);
 		}
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -2455,6 +2455,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_rdata_dnskey_t dnskey;
 	isc_boolean_t had_dnskey;
 	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);
+	isc_uint32_t maxrecords;
+	isc_uint64_t records;

 	INSIST(event->ev_type == DNS_EVENT_UPDATE);

@@ -3108,6 +3110,20 @@ update_action(isc_task_t *task, isc_event_t *event) {
 			}
 		}

+		maxrecords = dns_zone_getmaxrecords(zone);
+		if (maxrecords != 0U) {
+			result = dns_db_getsize(db, ver, &records, NULL);
+			if (result == ISC_R_SUCCESS && records > maxrecords) {
+				update_log(client, zone, ISC_LOG_ERROR,
+					   "records in zone (%"
+					   ISC_PRINT_QUADFORMAT
+					   "u) exceeds max-records (%u)",
+					   records, maxrecords);
+				result = DNS_R_TOOMANYRECORDS;
+				goto failure;
+			}
+		}
+
 		journalfile = dns_zone_getjournal(zone);
 		if (journalfile != NULL) {
 			update_log(client, zone, LOGLEVEL_DEBUG,
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2013, 2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2013, 2015, 2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -1154,7 +1154,7 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
 	xfr->txmem = NULL;
 	xfr->txmemlen = 0;
 	xfr->nmsg = 0;
-	xfr->many_answers = many_answers,
+	xfr->many_answers = many_answers;
 	xfr->sends = 0;
 	xfr->shuttingdown = ISC_FALSE;
 	xfr->mnemonic = NULL;
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -935,6 +935,13 @@ ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			INSIST(0);
 	}

+	obj = NULL;
+	result = ns_config_get(maps, "max-records", &obj);
+	INSIST(result == ISC_R_SUCCESS && obj != NULL);
+	dns_zone_setmaxrecords(mayberaw, cfg_obj_asuint32(obj));
+	if (zone != mayberaw)
+		dns_zone_setmaxrecords(zone, 0);
+
 	if (raw != NULL && filename != NULL) {
 #define SIGNED ".signed"
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2006-2009, 2012-2015  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006-2009, 2012-2016  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2000-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and/or distribute this software for any
@@ -94,3 +94,7 @@ installdirs:
 install:: nsupdate@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} nsupdate@EXEEXT@ ${DESTDIR}${bindir}
 	${INSTALL_DATA} ${srcdir}/nsupdate.1 ${DESTDIR}${mandir}/man1
+
+uninstall::
+	rm -f ${DESTDIR}${mandir}/man1/nsupdate.1
+	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/nsupdate@EXEEXT@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -493,7 +493,7 @@ The TSIG key is redundantly stored in two separate files\&. This is a consequenc
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000-2003 Internet Software Consortium.
 .br
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 2000-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
@@ -88,9 +88,18 @@
 #include <bind9/getaddresses.h>

 #if defined(HAVE_READLINE)
+#if defined(HAVE_EDIT_READLINE_READLINE_H)
+#include <edit/readline/readline.h>
+#if defined(HAVE_EDIT_READLINE_HISTORY_H)
+#include <edit/readline/history.h>
+#endif
+#elif defined(HAVE_EDITLINE_READLINE_H)
+#include <editline/readline.h>
+#else
 #include <readline/readline.h>
 #include <readline/history.h>
 #endif
+#endif

 #ifdef HAVE_ADDRINFO
 #ifdef HAVE_GETADDRINFO
@@ -2902,13 +2911,15 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	tsigkey = NULL;
 	result = dns_tkey_gssnegotiate(tsigquery, rcvmsg, servname,
 				       &context, &tsigkey, gssring,
-				       use_win2k_gsstsig,
-				       &err_message);
+				       use_win2k_gsstsig, &err_message);
 	switch (result) {

 	case DNS_R_CONTINUE:
+		dns_message_destroy(&rcvmsg);
+		dns_request_destroy(&request);
 		send_gssrequest(kserver, tsigquery, &request, context);
-		break;
+		ddebug("Out of recvgss");
+		return;

 	case ISC_R_SUCCESS:
 		/*
@@ -2945,7 +2956,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 		break;

 	default:
-		fatal("dns_tkey_negotiategss: %s %s",
+		fatal("dns_tkey_gssnegotiate: %s %s",
 		      isc_result_totext(result),
 		      err_message != NULL ? err_message : "");
 	}
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2012, 2014-2016  Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003  Internet Software Consortium.
 -
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -16,7 +16,7 @@
 -->

 <!-- Converted by db4-upgrade version 1.0 -->
-<refentry xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="man.nsupdate">
+<refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.nsupdate">
  <info>
    <date>2014-04-18</date>
  </info>
@@ -47,6 +47,7 @@
      <year>2012</year>
      <year>2014</year>
      <year>2015</year>
+      <year>2016</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
    <copyright>
@@ -1,5 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2012, 2014-2016 Internet Systems Consortium, Inc. ("ISC")
 - Copyright (C) 2000-2003 Internet Software Consortium.
 - 
 - Permission to use, copy, modify, and/or distribute this software for any
@@ -14,7 +15,7 @@
 - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 - PERFORMANCE OF THIS SOFTWARE.
 -->
-<html>
+<html lang="en">
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>nsupdate</title>
@@ -22,17 +23,47 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry">
 <a name="man.nsupdate"></a><div class="titlepage"></div>
-<div class="refnamediv">
+  
+  
+  
+  <div class="refnamediv">
 <h2>Name</h2>
-<p><span class="application">nsupdate</span> &#8212; Dynamic DNS update utility</p>
+<p>
+    <span class="application">nsupdate</span>
+     &#8212; Dynamic DNS update utility
+  </p>
 </div>
-<div class="refsynopsisdiv">
+
+  
+
+  <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [<code class="option">-D</code>] [<code class="option">-L <em class="replaceable"><code>level</code></em></code>] [[<code class="option">-g</code>] |  [<code class="option">-o</code>] |  [<code class="option">-l</code>] |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [filename]</p></div>
-</div>
-<div class="refsection">
+    <div class="cmdsynopsis"><p>
+      <code class="command">nsupdate</code> 
+       [<code class="option">-d</code>]
+       [<code class="option">-D</code>]
+       [<code class="option">-L <em class="replaceable"><code>level</code></em></code>]
+       [
+	[<code class="option">-g</code>]
+	 |  [<code class="option">-o</code>]
+	 |  [<code class="option">-l</code>]
+	 |  [<code class="option">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></code>]
+	 |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]
+      ]
+       [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>]
+       [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>]
+       [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>]
+       [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>]
+       [<code class="option">-v</code>]
+       [<code class="option">-V</code>]
+       [filename]
+    </p></div>
+  </div>
+
+  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-<p><span class="command"><strong>nsupdate</strong></span>
+
+    <p><span class="command"><strong>nsupdate</strong></span>
      is used to submit Dynamic DNS Update requests as defined in RFC 2136
      to a name server.
      This allows resource records to be added or removed from a zone
@@ -41,27 +72,27 @@
      one
      resource record.
    </p>
-<p>
+    <p>
      Zones that are under dynamic control via
      <span class="command"><strong>nsupdate</strong></span>
      or a DHCP server should not be edited by hand.
      Manual edits could
      conflict with dynamic updates and cause data to be lost.
    </p>
-<p>
+    <p>
      The resource records that are dynamically added or removed with
      <span class="command"><strong>nsupdate</strong></span>
      have to be in the same zone.
      Requests are sent to the zone's master server.
      This is identified by the MNAME field of the zone's SOA record.
    </p>
-<p>
+    <p>
      Transaction signatures can be used to authenticate the Dynamic
      DNS updates.  These use the TSIG resource record type described
      in RFC 2845 or the SIG(0) record described in RFC 2535 and
      RFC 2931 or GSS-TSIG as described in RFC 3645.
    </p>
-<p>
+    <p>
      TSIG relies on
      a shared secret that should only be known to
      <span class="command"><strong>nsupdate</strong></span> and the name server.
@@ -76,33 +107,41 @@
      uses the <code class="option">-y</code> or <code class="option">-k</code> options
      to provide the TSIG shared secret.  These options are mutually exclusive.
    </p>
-<p>
+    <p>
      SIG(0) uses public key cryptography.
      To use a SIG(0) key, the public key must be stored in a KEY
      record in a zone served by the name server.
    </p>
-<p>
+    <p>
      GSS-TSIG uses Kerberos credentials.  Standard GSS-TSIG mode
      is switched on with the <code class="option">-g</code> flag.  A
      non-standards-compliant variant of GSS-TSIG used by Windows
      2000 can be switched on with the <code class="option">-o</code> flag.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-d</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Debug mode. This provides tracing information about the
 	    update requests that are made and the replies received
 	    from the name server.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-D</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Extra debug mode.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    The file containing the TSIG authentication key.
 	    Keyfiles may be in two formats: a single file containing
 	    a <code class="filename">named.conf</code>-format <span class="command"><strong>key</strong></span>
@@ -114,9 +153,11 @@
 	    The <code class="option">-k</code> may also be used to specify a SIG(0) key used
 	    to authenticate Dynamic DNS update requests.  In this case, the key
 	    specified is not an HMAC-MD5 key.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-l</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Local-host only mode. This sets the server address to
 	    localhost (disabling the <span class="command"><strong>server</strong></span> so that the server
 	    address cannot be overridden).  Connections to the local server will
@@ -125,23 +166,31 @@
 	    local master zone has set <span class="command"><strong>update-policy</strong></span> to
 	    <span class="command"><strong>local</strong></span>.  The location of this key file can be
 	    overridden with the <code class="option">-k</code> option.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-L <em class="replaceable"><code>level</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Set the logging debug level.  If zero, logging is disabled.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Set the port to use for connections to a name server. The
 	    default is 53.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-r <em class="replaceable"><code>udpretries</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    The number of UDP retries. The default is 3. If zero, only
 	    one update request will be made.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-R <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd><p>
+<dd>
+	<p>
 	  Where to obtain randomness. If the operating system
 	  does not provide a <code class="filename">/dev/random</code> or
 	  equivalent device, the default source of randomness is keyboard
@@ -150,34 +199,43 @@
 	  instead of the default.  The special value
 	  <code class="filename">keyboard</code> indicates that keyboard input
 	  should be used.  This option may be specified multiple times.
-	</p></dd>
+	</p>
+	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>timeout</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    The maximum time an update request can take before it is
 	    aborted. The default is 300 seconds. Zero can be used to
 	    disable the timeout.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-u <em class="replaceable"><code>udptimeout</code></em></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    The UDP retry interval. The default is 3 seconds. If zero,
 	    the interval will be computed from the timeout interval and
 	    number of UDP retries.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-v</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Use TCP even for small update requests.
 	    By default, <span class="command"><strong>nsupdate</strong></span>
 	    uses UDP to send update requests to the name server unless they are too
 	    large to fit in a UDP request in which case TCP will be used.
 	    TCP may be preferable when a batch of update requests is made.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-V</span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    Print the version number and exit.
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
 <dd>
-<p>
+	  <p>
 	    Literal TSIG authentication key.
 	    <em class="parameter"><code>keyname</code></em> is the name of the key, and
 	    <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
@@ -188,19 +246,23 @@
 	    <code class="literal">hmac-sha512</code>.  If <em class="parameter"><code>hmac</code></em>
 	    is not specified, the default is <code class="literal">hmac-md5</code>.
 	  </p>
-<p>
+	  <p>
 	    NOTE: Use of the <code class="option">-y</code> option is discouraged because the
 	    shared secret is supplied as a command line argument in clear text.
 	    This may be visible in the output from
-	    <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
+	    <span class="citerefentry">
+	      <span class="refentrytitle">ps</span>(1)
+	    </span>
 	    or in a history file maintained by the user's shell.
 	  </p>
-</dd>
+	</dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.9"></a><h2>INPUT FORMAT</h2>
-<p><span class="command"><strong>nsupdate</strong></span>
+
+    <p><span class="command"><strong>nsupdate</strong></span>
      reads input from
      <em class="parameter"><code>filename</code></em>
      or standard input.
@@ -214,7 +276,7 @@
      Updates will be rejected if the tests for the prerequisite conditions
      fail.
    </p>
-<p>
+    <p>
      Every update request consists of zero or more prerequisites
      and zero or more updates.
      This allows a suitably authenticated update request to proceed if some
@@ -224,7 +286,7 @@
      accumulated commands to be sent as one Dynamic DNS update request to the
      name server.
    </p>
-<p>
+    <p>
      The command formats and their meaning are as follows:
      </p>
 <div class="variablelist"><dl class="variablelist">
@@ -233,7 +295,8 @@
 	       {servername}
 	       [port]
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Sends all dynamic update requests to the name server
 	      <em class="parameter"><code>servername</code></em>.
 	      When no server statement is provided,
@@ -249,13 +312,15 @@
 	      If no port number is specified, the default DNS port number of
 	      53 is
 	      used.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>local</strong></span>
 	       {address}
 	       [port]
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Sends all dynamic update requests using the local
 	      <em class="parameter"><code>address</code></em>.

@@ -267,12 +332,14 @@
 	      can additionally be used to make requests come from a specific
 	      port.
 	      If no port number is specified, the system will assign one.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>zone</strong></span>
 	       {zonename}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Specifies that all updates are to be made to the zone
 	      <em class="parameter"><code>zonename</code></em>.
 	      If no
@@ -281,32 +348,38 @@
 	      <span class="command"><strong>nsupdate</strong></span>
 	      will attempt determine the correct zone to update based on the
 	      rest of the input.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>class</strong></span>
 	       {classname}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Specify the default class.
 	      If no <em class="parameter"><code>class</code></em> is specified, the
 	      default class is
 	      <em class="parameter"><code>IN</code></em>.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>ttl</strong></span>
 	       {seconds}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Specify the default time to live for records to be added.
 	      The value <em class="parameter"><code>none</code></em> will clear the default
 	      ttl.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>key</strong></span>
 	       [hmac:] {keyname}
 	       {secret}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Specifies that all updates are to be TSIG-signed using the
 	      <em class="parameter"><code>keyname</code></em> <em class="parameter"><code>secret</code></em> pair.
 	      If <em class="parameter"><code>hmac</code></em> is specified, then it sets the
@@ -314,55 +387,67 @@
 	      <code class="literal">hmac-md5</code>.  The <span class="command"><strong>key</strong></span>
 	      command overrides any key specified on the command line via
 	      <code class="option">-y</code> or <code class="option">-k</code>.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	    <span class="command"><strong>gsstsig</strong></span>
 	  </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Use GSS-TSIG to sign the updated.  This is equivalent to
 	      specifying <code class="option">-g</code> on the commandline.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	    <span class="command"><strong>oldgsstsig</strong></span>
 	  </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Use the Windows 2000 version of GSS-TSIG to sign the updated.
 	      This is equivalent to specifying <code class="option">-o</code> on the
 	      commandline.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	    <span class="command"><strong>realm</strong></span>
 	     {[<span class="optional">realm_name</span>]}
 	  </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      When using GSS-TSIG use <em class="parameter"><code>realm_name</code></em> rather
 	      than the default realm in <code class="filename">krb5.conf</code>.  If no
 	      realm is specified the saved realm is cleared.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>[<span class="optional">prereq</span>] nxdomain</strong></span>
 	       {domain-name}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Requires that no resource record of any type exists with name
 	      <em class="parameter"><code>domain-name</code></em>.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>[<span class="optional">prereq</span>] yxdomain</strong></span>
 	       {domain-name}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Requires that
 	      <em class="parameter"><code>domain-name</code></em>
 	      exists (has as at least one resource record, of any type).
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>[<span class="optional">prereq</span>] nxrrset</strong></span>
 	       {domain-name}
 	       [class]
 	       {type}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Requires that no resource record exists of the specified
 	      <em class="parameter"><code>type</code></em>,
 	      <em class="parameter"><code>class</code></em>
@@ -371,14 +456,16 @@
 	      If
 	      <em class="parameter"><code>class</code></em>
 	      is omitted, IN (internet) is assumed.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>[<span class="optional">prereq</span>] yxrrset</strong></span>
 	       {domain-name}
 	       [class]
 	       {type}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      This requires that a resource record of the specified
 	      <em class="parameter"><code>type</code></em>,
 	      <em class="parameter"><code>class</code></em>
@@ -388,7 +475,8 @@
 	      If
 	      <em class="parameter"><code>class</code></em>
 	      is omitted, IN (internet) is assumed.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>[<span class="optional">prereq</span>] yxrrset</strong></span>
 	       {domain-name}
@@ -396,7 +484,8 @@
 	       {type}
 	       {data...}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      The
 	      <em class="parameter"><code>data</code></em>
 	      from each set of prerequisites of this form
@@ -417,7 +506,8 @@
 	      are written in the standard text representation of the resource
 	      record's
 	      RDATA.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>[<span class="optional">update</span>] del[<span class="optional">ete</span>]</strong></span>
 	       {domain-name}
@@ -425,7 +515,8 @@
 	       [class]
 	       [type [data...]]
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Deletes any resource records named
 	      <em class="parameter"><code>domain-name</code></em>.
 	      If
@@ -438,7 +529,8 @@
 	      is not supplied.  The
 	      <em class="parameter"><code>ttl</code></em>
 	      is ignored, and is only allowed for compatibility.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>[<span class="optional">update</span>] add</strong></span>
 	       {domain-name}
@@ -447,62 +539,80 @@
 	       {type}
 	       {data...}
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Adds a new resource record with the specified
 	      <em class="parameter"><code>ttl</code></em>,
 	      <em class="parameter"><code>class</code></em>
 	      and
 	      <em class="parameter"><code>data</code></em>.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>show</strong></span>
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Displays the current message, containing all of the
 	      prerequisites and
 	      updates specified since the last send.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>send</strong></span>
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Sends the current message.  This is equivalent to entering a
 	      blank line.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>answer</strong></span>
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Displays the answer.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>debug</strong></span>
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Turn on debugging.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>version</strong></span>
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Print version number.
-	    </p></dd>
+	    </p>
+	  </dd>
 <dt><span class="term">
 	      <span class="command"><strong>help</strong></span>
 	    </span></dt>
-<dd><p>
+<dd>
+	    <p>
 	      Print a list of commands.
-	    </p></dd>
+	    </p>
+	  </dd>
 </dl></div>
 <p>
    </p>
-<p>
+
+    <p>
      Lines beginning with a semicolon are comments and are ignored.
    </p>
-</div>
-<div class="refsection">
+
+  </div>
+
+  <div class="refsection">
 <a name="id-1.10"></a><h2>EXAMPLES</h2>
-<p>
+
+    <p>
      The examples below show how
      <span class="command"><strong>nsupdate</strong></span>
      could be used to insert and delete resource records from the
@@ -523,7 +633,7 @@
 </pre>
 <p>
    </p>
-<p>
+    <p>
      Any A records for
      <span class="type">oldhost.example.com</span>
      are deleted.
@@ -540,7 +650,7 @@
 </pre>
 <p>
    </p>
-<p>
+    <p>
      The prerequisite condition gets the name server to check that there
      are no resource records of any type for
      <span class="type">nickname.example.com</span>.
@@ -553,33 +663,50 @@
      (The rule has been updated for DNSSEC in RFC 2535 to allow CNAMEs to have
      RRSIG, DNSKEY and NSEC records.)
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.11"></a><h2>FILES</h2>
-<div class="variablelist"><dl class="variablelist">
+
+
+    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    used to identify default name server
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term"><code class="constant">/var/run/named/session.key</code></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    sets the default TSIG key for use in local-only mode
-	  </p></dd>
+	  </p>
+	</dd>
 <dt><span class="term"><code class="constant">K{name}.+157.+{random}.key</code></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    base-64 encoding of HMAC-MD5 key created by
-	    <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
-	  </p></dd>
+	    <span class="citerefentry">
+	      <span class="refentrytitle">dnssec-keygen</span>(8)
+	    </span>.
+	  </p>
+	</dd>
 <dt><span class="term"><code class="constant">K{name}.+157.+{random}.private</code></span></dt>
-<dd><p>
+<dd>
+	  <p>
 	    base-64 encoding of HMAC-MD5 key created by
-	    <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
-	  </p></dd>
+	    <span class="citerefentry">
+	      <span class="refentrytitle">dnssec-keygen</span>(8)
+	    </span>.
+	  </p>
+	</dd>
 </dl></div>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.12"></a><h2>SEE ALSO</h2>
-<p>
+
+    <p>
      <em class="citetitle">RFC 2136</em>,
      <em class="citetitle">RFC 3007</em>,
      <em class="citetitle">RFC 2104</em>,
@@ -587,19 +714,27 @@
      <em class="citetitle">RFC 1034</em>,
      <em class="citetitle">RFC 2535</em>,
      <em class="citetitle">RFC 2931</em>,
-      <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">ddns-confgen</span>(8)</span>,
-      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
+      <span class="citerefentry">
+	<span class="refentrytitle">named</span>(8)
+      </span>,
+      <span class="citerefentry">
+	<span class="refentrytitle">ddns-confgen</span>(8)
+      </span>,
+      <span class="citerefentry">
+	<span class="refentrytitle">dnssec-keygen</span>(8)
+      </span>.
    </p>
-</div>
-<div class="refsection">
+  </div>
+
+  <div class="refsection">
 <a name="id-1.13"></a><h2>BUGS</h2>
-<p>
+
+    <p>
      The TSIG key is redundantly stored in two separate files.
      This is a consequence of nsupdate using the DST library
      for its cryptographic operations, and may change in future
      releases.
    </p>
-</div>
+  </div>
 </div></body>
 </html>
@@ -1,4 +1,4 @@
-# Copyright (C) 2009, 2012  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2009, 2012, 2016  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -70,5 +70,19 @@ install:: ${TARGETS} installdirs
 	${INSTALL_DATA} ${srcdir}/pkcs11-list.8 ${DESTDIR}${mandir}/man8
 	${INSTALL_DATA} ${srcdir}/pkcs11-destroy.8 ${DESTDIR}${mandir}/man8

+uninstall::
+	rm -f ${DESTDIR}${mandir}/man8/pkcs11-tokens.8
+	rm -f ${DESTDIR}${mandir}/man8/pkcs11-keygen.8
+	rm -f ${DESTDIR}${mandir}/man8/pkcs11-destroy.8
+	rm -f ${DESTDIR}${mandir}/man8/pkcs11-list.8
+	${LIBTOOL_MODE_UNINSTALL} rm -f /
+		${DESTDIR}${sbindir}/pkcs11-tokens@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f /
+		${DESTDIR}${sbindir}/pkcs11-keygen@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f /
+		${DESTDIR}${sbindir}/pkcs11-destroy@EXEEXT@
+	${LIBTOOL_MODE_UNINSTALL} rm -f /
+		${DESTDIR}${sbindir}/pkcs11-list@EXEEXT@
+
 clean distclean::
 	rm -f ${TARGETS}
@@ -1,19 +1,11 @@
-/* pkcs11.h include file for PKCS #11. */
-/* $Revision: 1.2 $ */
-
-/* License to copy and use this software is granted provided that it is
- * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
- * (Cryptoki)" in all material mentioning or referencing this software.
-
- * License is also granted to make and use derivative works provided that
- * such works are identified as "derived from the RSA Security Inc. PKCS #11
- * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 
- * referencing the derived work.
-
- * RSA Security Inc. makes no representations concerning either the 
- * merchantability of this software or the suitability of this software for
- * any particular purpose. It is provided "as is" without express or implied
- * warranty of any kind.
+/*
+ * PKCS #11 Cryptographic Token Interface Base Specification Version 2.40 Errata 01
+ * Committee Specification Draft 01 / Public Review Draft 01
+ * 09 December 2015
+ * Copyright (c) OASIS Open 2015. All Rights Reserved.
+ * Source: http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/errata01/csprd01/include/pkcs11-v2.40/
+ * Latest version of the specification: http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
+ * https://www.oasis-open.org/policies-guidelines/ipr
 */

 #ifndef _PKCS11_H_
@@ -24,14 +16,14 @@ extern "C" {
 #endif

 /* Before including this file (pkcs11.h) (or pkcs11t.h by
- * itself), 6 platform-specific macros must be defined.  These
+ * itself), 5 platform-specific macros must be defined.  These
 * macros are described below, and typical definitions for them
 * are also given.  Be advised that these definitions can depend
 * on both the platform and the compiler used (and possibly also
 * on whether a Cryptoki library is linked statically or
 * dynamically).
 *
- * In addition to defining these 6 macros, the packing convention
+ * In addition to defining these 5 macros, the packing convention
 * for Cryptoki structures should be set.  The Cryptoki
 * convention on packing is that structures should be 1-byte
 * aligned.
@@ -81,39 +73,7 @@ extern "C" {
 * #define CK_PTR *
 *
 *
- * 2. CK_DEFINE_FUNCTION(returnType, name): A macro which makes
- * an exportable Cryptoki library function definition out of a
- * return type and a function name.  It should be used in the
- * following fashion to define the exposed Cryptoki functions in
- * a Cryptoki library:
- *
- * CK_DEFINE_FUNCTION(CK_RV, C_Initialize)(
- *   CK_VOID_PTR pReserved
- * )
- * {
- *   ...
- * }
- *
- * If you're using Microsoft Developer Studio 5.0 to define a
- * function in a Win32 Cryptoki .dll, it might be defined by:
- *
- * #define CK_DEFINE_FUNCTION(returnType, name) \
- *   returnType __declspec(dllexport) name
- *
- * If you're using an earlier version of Microsoft Developer
- * Studio to define a function in a Win16 Cryptoki .dll, it
- * might be defined by:
- *
- * #define CK_DEFINE_FUNCTION(returnType, name) \
- *   returnType __export _far _pascal name
- *
- * In a UNIX environment, it might be defined by:
- *
- * #define CK_DEFINE_FUNCTION(returnType, name) \
- *   returnType name
- *
- *
- * 3. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
+ * 2. CK_DECLARE_FUNCTION(returnType, name): A macro which makes
 * an importable Cryptoki library function declaration out of a
 * return type and a function name.  It should be used in the
 * following fashion:
@@ -141,7 +101,7 @@ extern "C" {
 *   returnType name
 *
 *
- * 4. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
+ * 3. CK_DECLARE_FUNCTION_POINTER(returnType, name): A macro
 * which makes a Cryptoki API function pointer declaration or
 * function pointer type declaration out of a return type and a
 * function name.  It should be used in the following fashion:
@@ -178,7 +138,7 @@ extern "C" {
 *   returnType (* name)
 *
 *
- * 5. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
+ * 4. CK_CALLBACK_FUNCTION(returnType, name): A macro which makes
 * a function pointer type for an application callback out of
 * a return type for the callback and a name for the callback.
 * It should be used in the following fashion:
@@ -210,7 +170,7 @@ extern "C" {
 *   returnType (* name)
 *
 *
- * 6. NULL_PTR: This macro is the value of a NULL pointer.
+ * 5. NULL_PTR: This macro is the value of a NULL pointer.
 *
 * In any ANSI/ISO C environment (and in many others as well),
 * this should best be defined by
@@ -222,7 +182,8 @@ extern "C" {


 /* All the various Cryptoki types and #define'd values are in the
- * file pkcs11t.h. */
+ * file pkcs11t.h.
+ */
 #include "pkcs11t.h"

 #define __PASTE(x,y)      x##y
@@ -238,7 +199,8 @@ extern "C" {
  extern CK_DECLARE_FUNCTION(CK_RV, name)

 /* pkcs11f.h has all the information about the Cryptoki
- * function prototypes. */
+ * function prototypes.
+ */
 #include "pkcs11f.h"

 #undef CK_NEED_ARG_LIST
@@ -257,7 +219,8 @@ extern "C" {
  typedef CK_DECLARE_FUNCTION_POINTER(CK_RV, __PASTE(CK_,name))

 /* pkcs11f.h has all the information about the Cryptoki
- * function prototypes. */
+ * function prototypes.
+ */
 #include "pkcs11f.h"

 #undef CK_NEED_ARG_LIST
@@ -275,14 +238,15 @@ extern "C" {

 #define CK_PKCS11_FUNCTION_INFO(name) \
  __PASTE(CK_,name) name;
-  
+
 struct CK_FUNCTION_LIST {

  CK_VERSION    version;  /* Cryptoki version */

 /* Pile all the function pointers into the CK_FUNCTION_LIST. */
 /* pkcs11f.h has all the information about the Cryptoki
- * function prototypes. */
+ * function prototypes.
+ */
 #include "pkcs11f.h"

 };
@@ -296,4 +260,5 @@ struct CK_FUNCTION_LIST {
 }
 #endif

-#endif
+#endif /* _PKCS11_H_ */
+
@@ -1,26 +1,19 @@
-/* pkcs11f.h include file for PKCS #11. */
-/* $Revision: 1.2 $ */
-
-/* License to copy and use this software is granted provided that it is
- * identified as "RSA Security Inc. PKCS #11 Cryptographic Token Interface
- * (Cryptoki)" in all material mentioning or referencing this software.
-
- * License is also granted to make and use derivative works provided that
- * such works are identified as "derived from the RSA Security Inc. PKCS #11
- * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 
- * referencing the derived work.
-
- * RSA Security Inc. makes no representations concerning either the 
- * merchantability of this software or the suitability of this software for
- * any particular purpose. It is provided "as is" without express or implied
- * warranty of any kind.
+/*
+ * PKCS #11 Cryptographic Token Interface Base Specification Version 2.40 Errata 01
+ * Committee Specification Draft 01 / Public Review Draft 01
+ * 09 December 2015
+ * Copyright (c) OASIS Open 2015. All Rights Reserved.
+ * Source: http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/errata01/csprd01/include/pkcs11-v2.40/
+ * Latest version of the specification: http://docs.oasis-open.org/pkcs11/pkcs11-base/v2.40/pkcs11-base-v2.40.html
+ * https://www.oasis-open.org/policies-guidelines/ipr
 */

-/* This header file contains pretty much everything about all the */
-/* Cryptoki function prototypes.  Because this information is */
-/* used for more than just declaring function prototypes, the */
-/* order of the functions appearing herein is important, and */
-/* should not be altered. */
+/* This header file contains pretty much everything about all the
+ * Cryptoki function prototypes.  Because this information is
+ * used for more than just declaring function prototypes, the
+ * order of the functions appearing herein is important, and
+ * should not be altered.
+ */

 /* General-purpose */

@@ -30,13 +23,15 @@ CK_PKCS11_FUNCTION_INFO(C_Initialize)
 (
  CK_VOID_PTR   pInitArgs  /* if this is not NULL_PTR, it gets
                            * cast to CK_C_INITIALIZE_ARGS_PTR
-                            * and dereferenced */
+                            * and dereferenced
+                            */
 );
 #endif


 /* C_Finalize indicates that an application is done with the
- * Cryptoki library. */
+ * Cryptoki library.
+ */
 CK_PKCS11_FUNCTION_INFO(C_Finalize)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -59,7 +54,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
 #ifdef CK_NEED_ARG_LIST
 (
  CK_FUNCTION_LIST_PTR_PTR ppFunctionList  /* receives pointer to
-                                            * function list */
+                                            * function list
+                                            */
 );
 #endif

@@ -71,7 +67,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
 CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
 #ifdef CK_NEED_ARG_LIST
 (
-  CK_BBOOL       tokenPresent,  /* only slots with tokens? */
+  CK_BBOOL       tokenPresent,  /* only slots with tokens */
  CK_SLOT_ID_PTR pSlotList,     /* receives array of slot IDs */
  CK_ULONG_PTR   pulCount       /* receives number of slots */
 );
@@ -79,7 +75,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetSlotList)


 /* C_GetSlotInfo obtains information about a particular slot in
- * the system. */
+ * the system.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -90,7 +87,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)


 /* C_GetTokenInfo obtains information about a particular token
- * in the system. */
+ * in the system.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -101,7 +99,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)


 /* C_GetMechanismList obtains a list of mechanism types
- * supported by a token. */
+ * supported by a token.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -113,7 +112,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)


 /* C_GetMechanismInfo obtains information about a particular
- * mechanism possibly supported by a token. */
+ * mechanism possibly supported by a token.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -127,7 +127,6 @@ CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
 /* C_InitToken initializes a token. */
 CK_PKCS11_FUNCTION_INFO(C_InitToken)
 #ifdef CK_NEED_ARG_LIST
-/* pLabel changed from CK_CHAR_PTR to CK_UTF8CHAR_PTR for v2.10 */
 (
  CK_SLOT_ID      slotID,    /* ID of the token's slot */
  CK_UTF8CHAR_PTR pPin,      /* the SO's initial PIN */
@@ -165,7 +164,8 @@ CK_PKCS11_FUNCTION_INFO(C_SetPIN)
 /* Session management */

 /* C_OpenSession opens a session between an application and a
- * token. */
+ * token.
+ */
 CK_PKCS11_FUNCTION_INFO(C_OpenSession)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -179,7 +179,8 @@ CK_PKCS11_FUNCTION_INFO(C_OpenSession)


 /* C_CloseSession closes a session between an application and a
- * token. */
+ * token.
+ */
 CK_PKCS11_FUNCTION_INFO(C_CloseSession)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -208,7 +209,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)


 /* C_GetOperationState obtains the state of the cryptographic operation
- * in a session. */
+ * in a session.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -220,7 +222,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetOperationState)


 /* C_SetOperationState restores the state of the cryptographic
- * operation in a session. */
+ * operation in a session.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -270,7 +273,8 @@ CK_PKCS11_FUNCTION_INFO(C_CreateObject)


 /* C_CopyObject copies an object, creating a new object for the
- * copy. */
+ * copy.
+ */
 CK_PKCS11_FUNCTION_INFO(C_CopyObject)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -305,7 +309,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)


 /* C_GetAttributeValue obtains the value of one or more object
- * attributes. */
+ * attributes.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -318,7 +323,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)


 /* C_SetAttributeValue modifies the value of one or more object
- * attributes */
+ * attributes.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -331,7 +337,8 @@ CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)


 /* C_FindObjectsInit initializes a search for token and session
- * objects that match a template. */
+ * objects that match a template.
+ */
 CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -344,7 +351,8 @@ CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)

 /* C_FindObjects continues a search for token and session
 * objects that match a template, obtaining additional object
- * handles. */
+ * handles.
+ */
 CK_PKCS11_FUNCTION_INFO(C_FindObjects)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -357,7 +365,8 @@ CK_PKCS11_FUNCTION_INFO(C_FindObjects)


 /* C_FindObjectsFinal finishes a search for token and session
- * objects. */
+ * objects.
+ */
 CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -394,7 +403,8 @@ CK_PKCS11_FUNCTION_INFO(C_Encrypt)


 /* C_EncryptUpdate continues a multiple-part encryption
- * operation. */
+ * operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -408,7 +418,8 @@ CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)


 /* C_EncryptFinal finishes a multiple-part encryption
- * operation. */
+ * operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -444,7 +455,8 @@ CK_PKCS11_FUNCTION_INFO(C_Decrypt)


 /* C_DecryptUpdate continues a multiple-part decryption
- * operation. */
+ * operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -458,7 +470,8 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)


 /* C_DecryptFinal finishes a multiple-part decryption
- * operation. */
+ * operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -496,7 +509,8 @@ CK_PKCS11_FUNCTION_INFO(C_Digest)


 /* C_DigestUpdate continues a multiple-part message-digesting
- * operation. */
+ * operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -509,7 +523,8 @@ CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)

 /* C_DigestKey continues a multi-part message-digesting
 * operation, by digesting the value of a secret key as part of
- * the data already digested. */
+ * the data already digested.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DigestKey)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -520,7 +535,8 @@ CK_PKCS11_FUNCTION_INFO(C_DigestKey)


 /* C_DigestFinal finishes a multiple-part message-digesting
- * operation. */
+ * operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -537,7 +553,8 @@ CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
 /* C_SignInit initializes a signature (private key encryption)
 * operation, where the signature is (will be) an appendix to
 * the data, and plaintext cannot be recovered from the
- *signature. */
+ * signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SignInit)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -550,7 +567,8 @@ CK_PKCS11_FUNCTION_INFO(C_SignInit)

 /* C_Sign signs (encrypts with private key) data in a single
 * part, where the signature is (will be) an appendix to the
- * data, and plaintext cannot be recovered from the signature. */
+ * data, and plaintext cannot be recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_Sign)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -564,8 +582,9 @@ CK_PKCS11_FUNCTION_INFO(C_Sign)


 /* C_SignUpdate continues a multiple-part signature operation,
- * where the signature is (will be) an appendix to the data, 
- * and plaintext cannot be recovered from the signature. */
+ * where the signature is (will be) an appendix to the data,
+ * and plaintext cannot be recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -576,8 +595,9 @@ CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
 #endif


-/* C_SignFinal finishes a multiple-part signature operation, 
- * returning the signature. */
+/* C_SignFinal finishes a multiple-part signature operation,
+ * returning the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SignFinal)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -589,7 +609,8 @@ CK_PKCS11_FUNCTION_INFO(C_SignFinal)


 /* C_SignRecoverInit initializes a signature operation, where
- * the data can be recovered from the signature. */
+ * the data can be recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -601,7 +622,8 @@ CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)


 /* C_SignRecover signs data in a single operation, where the
- * data can be recovered from the signature. */
+ * data can be recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SignRecover)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -619,20 +641,22 @@ CK_PKCS11_FUNCTION_INFO(C_SignRecover)

 /* C_VerifyInit initializes a verification operation, where the
 * signature is an appendix to the data, and plaintext cannot
- *  cannot be recovered from the signature (e.g. DSA). */
+ * cannot be recovered from the signature (e.g. DSA).
+ */
 CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
 #ifdef CK_NEED_ARG_LIST
 (
  CK_SESSION_HANDLE hSession,    /* the session's handle */
  CK_MECHANISM_PTR  pMechanism,  /* the verification mechanism */
-  CK_OBJECT_HANDLE  hKey         /* verification key */ 
+  CK_OBJECT_HANDLE  hKey         /* verification key */
 );
 #endif


-/* C_Verify verifies a signature in a single-part operation, 
+/* C_Verify verifies a signature in a single-part operation,
 * where the signature is an appendix to the data, and plaintext
- * cannot be recovered from the signature. */
+ * cannot be recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_Verify)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -646,8 +670,9 @@ CK_PKCS11_FUNCTION_INFO(C_Verify)


 /* C_VerifyUpdate continues a multiple-part verification
- * operation, where the signature is an appendix to the data, 
- * and plaintext cannot be recovered from the signature. */
+ * operation, where the signature is an appendix to the data,
+ * and plaintext cannot be recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -659,7 +684,8 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)


 /* C_VerifyFinal finishes a multiple-part verification
- * operation, checking the signature. */
+ * operation, checking the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -671,7 +697,8 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)


 /* C_VerifyRecoverInit initializes a signature verification
- * operation, where the data is recovered from the signature. */
+ * operation, where the data is recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -683,7 +710,8 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)


 /* C_VerifyRecover verifies a signature in a single-part
- * operation, where the data is recovered from the signature. */
+ * operation, where the data is recovered from the signature.
+ */
 CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -700,7 +728,8 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
 /* Dual-function cryptographic operations */

 /* C_DigestEncryptUpdate continues a multiple-part digesting
- * and encryption operation. */
+ * and encryption operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -714,7 +743,8 @@ CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)


 /* C_DecryptDigestUpdate continues a multiple-part decryption and
- * digesting operation. */
+ * digesting operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -728,7 +758,8 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)


 /* C_SignEncryptUpdate continues a multiple-part signing and
- * encryption operation. */
+ * encryption operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -742,7 +773,8 @@ CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)


 /* C_DecryptVerifyUpdate continues a multiple-part decryption and
- * verify operation. */
+ * verify operation.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -759,7 +791,8 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
 /* Key management */

 /* C_GenerateKey generates a secret key, creating a new key
- * object. */
+ * object.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -772,31 +805,20 @@ CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
 #endif


-/* C_GenerateKeyPair generates a public-key/private-key pair, 
- * creating new key objects. */
+/* C_GenerateKeyPair generates a public-key/private-key pair,
+ * creating new key objects.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
 #ifdef CK_NEED_ARG_LIST
 (
-  CK_SESSION_HANDLE    hSession,                    /* session
-                                                     * handle */
-  CK_MECHANISM_PTR     pMechanism,                  /* key-gen
-                                                     * mech. */
-  CK_ATTRIBUTE_PTR     pPublicKeyTemplate,          /* template
-                                                     * for pub.
-                                                     * key */
-  CK_ULONG             ulPublicKeyAttributeCount,   /* # pub.
-                                                     * attrs. */
-  CK_ATTRIBUTE_PTR     pPrivateKeyTemplate,         /* template
-                                                     * for priv.
-                                                     * key */
-  CK_ULONG             ulPrivateKeyAttributeCount,  /* # priv.
-                                                     * attrs. */
-  CK_OBJECT_HANDLE_PTR phPublicKey,                 /* gets pub.
-                                                     * key
-                                                     * handle */
-  CK_OBJECT_HANDLE_PTR phPrivateKey                 /* gets
-                                                     * priv. key
-                                                     * handle */
+  CK_SESSION_HANDLE    hSession,                    /* session handle */
+  CK_MECHANISM_PTR     pMechanism,                  /* key-gen mech. */
+  CK_ATTRIBUTE_PTR     pPublicKeyTemplate,          /* template for pub. key */
+  CK_ULONG             ulPublicKeyAttributeCount,   /* # pub. attrs. */
+  CK_ATTRIBUTE_PTR     pPrivateKeyTemplate,         /* template for priv. key */
+  CK_ULONG             ulPrivateKeyAttributeCount,  /* # priv.  attrs. */
+  CK_OBJECT_HANDLE_PTR phPublicKey,                 /* gets pub. key handle */
+  CK_OBJECT_HANDLE_PTR phPrivateKey                 /* gets priv. key handle */
 );
 #endif

@@ -816,7 +838,8 @@ CK_PKCS11_FUNCTION_INFO(C_WrapKey)


 /* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
- * key object. */
+ * key object.
+ */
 CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -833,7 +856,8 @@ CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)


 /* C_DeriveKey derives a key from a base key, creating a new key
- * object. */
+ * object.
+ */
 CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -851,7 +875,8 @@ CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
 /* Random number generation */

 /* C_SeedRandom mixes additional seed material into the token's
- * random number generator. */
+ * random number generator.
+ */
 CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -878,7 +903,8 @@ CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)

 /* C_GetFunctionStatus is a legacy function; it obtains an
 * updated status of a function running in parallel with an
- * application. */
+ * application.
+ */
 CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -888,7 +914,8 @@ CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)


 /* C_CancelFunction is a legacy function; it cancels a function
- * running in parallel. */
+ * running in parallel.
+ */
 CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -897,11 +924,9 @@ CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
 #endif


-
-/* Functions added in for Cryptoki Version 2.01 or later */
-
 /* C_WaitForSlotEvent waits for a slot event (token insertion,
- * removal, etc.) to occur. */
+ * removal, etc.) to occur.
+ */
 CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
 #ifdef CK_NEED_ARG_LIST
 (
@@ -910,3 +935,4 @@ CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
  CK_VOID_PTR pRserved   /* reserved.  Should be NULL_PTR */
 );
 #endif
+
@@ -1,7 +1,7 @@
 Index: openssl/Configure
-diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Configure:1.18
--- openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1	Wed Dec 23 18:08:37 2015
-+++ openssl/Configure	Wed Dec 23 18:26:43 2015
+diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1.2.1 openssl/Configure:1.19
+--- openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1.2.1	Mon Jun 13 15:10:46 2016
+++ openssl/Configure	Mon Jun 13 15:20:23 2016
@@ -10,7 +10,7 @@
 
 # see INSTALL for instructions.
@@ -24,7 +24,7 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 # --with-krb5-dir  Declare where Kerberos 5 lives.  The libraries are expected
 #		to live in the subdirectory lib/ and the header files in
 #		include/.  A value is required.
-@@ -348,24 +354,23 @@
+@@ -355,24 +361,23 @@
 ####
 # *-generic* is endian-neutral target, but ./config is free to
 # throw in -D[BL]_ENDIAN, whichever appropriate...
@@ -62,7 +62,7 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 #### So called "highgprs" target for z/Architecture CPUs
 # "Highgprs" is kernel feature first implemented in Linux 2.6.32, see
 # /proc/cpuinfo. The idea is to preserve most significant bits of
-@@ -661,6 +666,10 @@
+@@ -668,6 +673,10 @@
 my $idx_arflags = $idx++;
 my $idx_multilib = $idx++;
 
@@ -73,7 +73,7 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 my $prefix="";
 my $libdir="";
 my $openssldir="";
-@@ -886,6 +895,14 @@
+@@ -895,6 +904,14 @@
 				$_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
 				$flags.=$_." ";
 				}
@@ -88,7 +88,7 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 			elsif (/^--prefix=(.*)$/)
 				{
 				$prefix=$1;
-@@ -1053,6 +1070,22 @@
+@@ -1062,6 +1079,22 @@
 	exit 0;
 }
 
@@ -111,7 +111,7 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 if ($target =~ m/^CygWin32(-.*)$/) {
 	$target = "Cygwin".$1;
 }
-@@ -1130,6 +1163,25 @@
+@@ -1139,6 +1172,25 @@
 	$exp_cflags .= " -DOPENSSL_EXPERIMENTAL_$ALGO";
 	}
 
@@ -137,7 +137,7 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 my $IsMK1MF=scalar grep /^$target$/,@MK1MF_Builds;
 
 $exe_ext=".exe" if ($target eq "Cygwin" || $target eq "DJGPP" || $target =~ /^mingw/);
-@@ -1219,6 +1271,8 @@
+@@ -1228,6 +1280,8 @@
 if ($flags ne "")	{ $cflags="$flags$cflags"; }
 else			{ $no_user_cflags=1;       }
 
@@ -146,7 +146,7 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 # Kerberos settings.  The flavor must be provided from outside, either through
 # the script "config" or manually.
 if (!$no_krb5)
-@@ -1617,6 +1671,7 @@
+@@ -1626,6 +1680,7 @@
 	s/^VERSION=.*/VERSION=$version/;
 	s/^MAJOR=.*/MAJOR=$major/;
 	s/^MINOR=.*/MINOR=$minor/;
@@ -155,9 +155,9 @@ diff -u openssl/Configure:1.9.2.1.2.1.2.1.2.1.2.1.2.1.4.1.2.1.4.1 openssl/Config
 	s/^SHLIB_VERSION_HISTORY=.*/SHLIB_VERSION_HISTORY=$shlib_version_history/;
 	s/^SHLIB_MAJOR=.*/SHLIB_MAJOR=$shlib_major/;
 Index: openssl/Makefile.org
-diff -u openssl/Makefile.org:1.5.2.1.2.1.2.1.2.1.2.1.2.1.10.1 openssl/Makefile.org:1.11
--- openssl/Makefile.org:1.5.2.1.2.1.2.1.2.1.2.1.2.1.10.1	Wed Dec 23 18:08:37 2015
-+++ openssl/Makefile.org	Wed Dec 23 18:26:43 2015
+diff -u openssl/Makefile.org:1.5.2.1.2.1.2.1.2.1.2.1.2.1.10.1.2.1 openssl/Makefile.org:1.12
+--- openssl/Makefile.org:1.5.2.1.2.1.2.1.2.1.2.1.2.1.10.1.2.1	Mon Jun 13 15:10:47 2016
+++ openssl/Makefile.org	Mon Jun 13 15:20:23 2016
@@ -26,6 +26,9 @@
 INSTALL_PREFIX=
 INSTALLTOP=/usr/local/ssl
@@ -170,7 +170,7 @@ diff -u openssl/Makefile.org:1.5.2.1.2.1.2.1.2.1.2.1.2.1.10.1 openssl/Makefile.o
 
 Index: openssl/README.pkcs11
 diff -u /dev/null openssl/README.pkcs11:1.8
--- /dev/null	Wed Dec 23 18:31:28 2015
+--- /dev/null	Mon Jun 13 15:26:28 2016
 +++ openssl/README.pkcs11	Fri Oct  4 14:16:43 2013
@@ -0,0 +1,266 @@
 +ISC modified
@@ -440,10 +440,10 @@ diff -u /dev/null openssl/README.pkcs11:1.8
 +Latest version should be always available on http://blogs.sun.com/janp.
 +
 Index: openssl/crypto/opensslconf.h
-diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1 openssl/crypto/opensslconf.h:1.9
--- openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1	Wed Dec 23 18:08:48 2015
-+++ openssl/crypto/opensslconf.h	Wed Dec 23 18:26:49 2015
-@@ -41,6 +41,9 @@
+diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1.2.1 openssl/crypto/opensslconf.h:1.10
+--- openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1.2.1	Mon Jun 13 15:10:49 2016
+++ openssl/crypto/opensslconf.h	Mon Jun 13 15:20:26 2016
+@@ -47,6 +47,9 @@
 
 #endif /* OPENSSL_DOING_MAKEDEPEND */
 
@@ -453,7 +453,7 @@ diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1 openssl/crypto/openssl
 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
 # define OPENSSL_NO_DYNAMIC_ENGINE
 #endif
-@@ -82,6 +85,8 @@
+@@ -94,6 +97,8 @@
 # endif
 #endif
 
@@ -462,7 +462,7 @@ diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1 openssl/crypto/openssl
 /* crypto/opensslconf.h.in */
 
 /* Generate 80386 code? */
-@@ -128,7 +133,7 @@
+@@ -140,7 +145,7 @@
  * This enables code handling data aligned at natural CPU word
  * boundary. See crypto/rc4/rc4_enc.c for further details.
  */
@@ -471,7 +471,7 @@ diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1 openssl/crypto/openssl
 #endif
 #endif
 
-@@ -136,7 +141,7 @@
+@@ -148,7 +153,7 @@
 /* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
  * %20 speed up (longs are 8 bytes, int's are 4). */
 #ifndef DES_LONG
@@ -480,7 +480,7 @@ diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1 openssl/crypto/openssl
 #endif
 #endif
 
-@@ -147,9 +152,9 @@
+@@ -159,9 +164,9 @@
 /* Should we define BN_DIV2W here? */
 
 /* Only one for the following should be defined */
@@ -492,7 +492,7 @@ diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1 openssl/crypto/openssl
 #endif
 
 #if defined(HEADER_RC4_LOCL_H) && !defined(CONFIG_HEADER_RC4_LOCL_H)
-@@ -161,7 +166,7 @@
+@@ -173,7 +178,7 @@
 
 #if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
 #define CONFIG_HEADER_BF_LOCL_H
@@ -501,7 +501,7 @@ diff -u openssl/crypto/opensslconf.h:1.6.2.1.4.1.10.1.6.1 openssl/crypto/openssl
 #endif /* HEADER_BF_LOCL_H */
 
 #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
-@@ -191,7 +196,7 @@
+@@ -203,7 +208,7 @@
 /* Unroll the inner loop, this sometimes helps, sometimes hinders.
  * Very mucy CPU dependant */
 #ifndef DES_UNROLL
@@ -618,7 +618,7 @@ diff -u openssl/crypto/engine/Makefile:1.8.2.1.4.1.16.1 openssl/crypto/engine/Ma
 tb_asnmth.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
 Index: openssl/crypto/engine/cryptoki.h
 diff -u /dev/null openssl/crypto/engine/cryptoki.h:1.4
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:29 2016
 +++ openssl/crypto/engine/cryptoki.h	Thu Dec 18 00:14:12 2008
@@ -0,0 +1,103 @@
 +/*
@@ -725,9 +725,9 @@ diff -u /dev/null openssl/crypto/engine/cryptoki.h:1.4
 +
 +#endif	/* _CRYPTOKI_H */
 Index: openssl/crypto/engine/eng_all.c
-diff -u openssl/crypto/engine/eng_all.c:1.5.2.1.4.1.16.1 openssl/crypto/engine/eng_all.c:1.7
--- openssl/crypto/engine/eng_all.c:1.5.2.1.4.1.16.1	Wed Dec 23 18:09:29 2015
-+++ openssl/crypto/engine/eng_all.c	Wed Dec 23 18:27:10 2015
+diff -u openssl/crypto/engine/eng_all.c:1.5.2.1.4.1.16.1.2.1 openssl/crypto/engine/eng_all.c:1.8
+--- openssl/crypto/engine/eng_all.c:1.5.2.1.4.1.16.1.2.1	Mon Jun 13 15:10:52 2016
+++ openssl/crypto/engine/eng_all.c	Mon Jun 13 15:20:31 2016
@@ -122,6 +122,14 @@
 # if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG)
     ENGINE_load_capi();
@@ -762,7 +762,7 @@ diff -u openssl/crypto/engine/engine.h:1.5.2.1.4.1.16.1 openssl/crypto/engine/en
  * Get and set global flags (ENGINE_TABLE_FLAG_***) for the implementation
 Index: openssl/crypto/engine/hw_pk11.c
 diff -u /dev/null openssl/crypto/engine/hw_pk11.c:1.33
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:29 2016
 +++ openssl/crypto/engine/hw_pk11.c	Fri Oct  4 14:07:41 2013
@@ -0,0 +1,4010 @@
 +/*
@@ -4777,7 +4777,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11.c:1.33
 +#endif	/* OPENSSL_NO_HW */
 Index: openssl/crypto/engine/hw_pk11_err.c
 diff -u /dev/null openssl/crypto/engine/hw_pk11_err.c:1.5
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:29 2016
 +++ openssl/crypto/engine/hw_pk11_err.c	Tue Jun 14 00:43:26 2011
@@ -0,0 +1,288 @@
 +/*
@@ -5070,7 +5070,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11_err.c:1.5
 +}
 Index: openssl/crypto/engine/hw_pk11_err.h
 diff -u /dev/null openssl/crypto/engine/hw_pk11_err.h:1.13
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:29 2016
 +++ openssl/crypto/engine/hw_pk11_err.h	Fri Oct  4 14:04:20 2013
@@ -0,0 +1,440 @@
 +/*
@@ -5515,7 +5515,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11_err.h:1.13
 +#endif /* HW_PK11_ERR_H */
 Index: openssl/crypto/engine/hw_pk11_pub.c
 diff -u /dev/null openssl/crypto/engine/hw_pk11_pub.c:1.42
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/hw_pk11_pub.c	Fri Oct  4 14:27:06 2013
@@ -0,0 +1,3556 @@
 +/*
@@ -9076,7 +9076,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11_pub.c:1.42
 +#endif	/* OPENSSL_NO_HW */
 Index: openssl/crypto/engine/hw_pk11ca.h
 diff -u /dev/null openssl/crypto/engine/hw_pk11ca.h:1.4
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/hw_pk11ca.h	Wed Jun 15 21:12:20 2011
@@ -0,0 +1,32 @@
 +/* Redefine all pk11/PK11 external symbols to pk11ca/PK11CA */
@@ -9113,7 +9113,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11ca.h:1.4
 +#define ENGINE_load_pk11		ENGINE_load_pk11ca
 Index: openssl/crypto/engine/hw_pk11so.c
 diff -u /dev/null openssl/crypto/engine/hw_pk11so.c:1.8
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/hw_pk11so.c	Fri Oct  4 14:05:16 2013
@@ -0,0 +1,1775 @@
 +/*
@@ -10893,7 +10893,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11so.c:1.8
 +#endif	/* OPENSSL_NO_HW */
 Index: openssl/crypto/engine/hw_pk11so.h
 diff -u /dev/null openssl/crypto/engine/hw_pk11so.h:1.4
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/hw_pk11so.h	Wed Jun 15 21:12:20 2011
@@ -0,0 +1,32 @@
 +/* Redefine all pk11/PK11 external symbols to pk11so/PK11SO */
@@ -10930,7 +10930,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11so.h:1.4
 +#define ENGINE_load_pk11		ENGINE_load_pk11so
 Index: openssl/crypto/engine/hw_pk11so_pub.c
 diff -u /dev/null openssl/crypto/engine/hw_pk11so_pub.c:1.10
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/hw_pk11so_pub.c	Fri Oct  4 14:05:38 2013
@@ -0,0 +1,1642 @@
 +/*
@@ -12577,7 +12577,7 @@ diff -u /dev/null openssl/crypto/engine/hw_pk11so_pub.c:1.10
 +#endif	/* OPENSSL_NO_HW */
 Index: openssl/crypto/engine/pkcs11.h
 diff -u /dev/null openssl/crypto/engine/pkcs11.h:1.1.1.1
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/pkcs11.h	Wed Oct 24 23:27:09 2007
@@ -0,0 +1,299 @@
 +/* pkcs11.h include file for PKCS #11. */
@@ -12881,7 +12881,7 @@ diff -u /dev/null openssl/crypto/engine/pkcs11.h:1.1.1.1
 +#endif
 Index: openssl/crypto/engine/pkcs11f.h
 diff -u /dev/null openssl/crypto/engine/pkcs11f.h:1.1.1.1
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/pkcs11f.h	Wed Oct 24 23:27:09 2007
@@ -0,0 +1,912 @@
 +/* pkcs11f.h include file for PKCS #11. */
@@ -13798,7 +13798,7 @@ diff -u /dev/null openssl/crypto/engine/pkcs11f.h:1.1.1.1
 +#endif
 Index: openssl/crypto/engine/pkcs11t.h
 diff -u /dev/null openssl/crypto/engine/pkcs11t.h:1.2
--- /dev/null	Wed Dec 23 18:31:29 2015
+--- /dev/null	Mon Jun 13 15:26:30 2016
 +++ openssl/crypto/engine/pkcs11t.h	Sat Aug 30 11:58:07 2008
@@ -0,0 +1,1885 @@
 +/* pkcs11t.h include file for PKCS #11. */
@@ -15687,19 +15687,19 @@ diff -u /dev/null openssl/crypto/engine/pkcs11t.h:1.2
 +
 +#endif
 Index: openssl/util/libeay.num
-diff -u openssl/util/libeay.num:1.8.2.1.4.1.2.1.4.1.6.1.4.1 openssl/util/libeay.num:1.14
--- openssl/util/libeay.num:1.8.2.1.4.1.2.1.4.1.6.1.4.1	Wed Dec 23 18:10:38 2015
-+++ openssl/util/libeay.num	Wed Dec 23 18:27:48 2015
-@@ -4314,3 +4314,5 @@
+diff -u openssl/util/libeay.num:1.8.2.1.4.1.2.1.4.1.6.1.4.1.2.1 openssl/util/libeay.num:1.15
+--- openssl/util/libeay.num:1.8.2.1.4.1.2.1.4.1.6.1.4.1.2.1	Mon Jun 13 15:11:04 2016
+++ openssl/util/libeay.num	Mon Jun 13 15:21:08 2016
+@@ -4316,3 +4316,5 @@
 BIO_s_datagram_sctp                     4680	EXIST::FUNCTION:DGRAM,SCTP
 BIO_dgram_is_sctp                       4681	EXIST::FUNCTION:SCTP
 BIO_dgram_sctp_notification_cb          4682	EXIST::FUNCTION:SCTP
 +ENGINE_load_pk11ca                      4683	EXIST::FUNCTION:HW_PKCS11CA,ENGINE
 +ENGINE_load_pk11so                      4683	EXIST::FUNCTION:HW_PKCS11SO,ENGINE
 Index: openssl/util/mk1mf.pl
-diff -u openssl/util/mk1mf.pl:1.9.2.1.4.1.10.1.2.1.4.1 openssl/util/mk1mf.pl:1.13
--- openssl/util/mk1mf.pl:1.9.2.1.4.1.10.1.2.1.4.1	Wed Dec 23 18:10:38 2015
-+++ openssl/util/mk1mf.pl	Wed Dec 23 18:27:48 2015
+diff -u openssl/util/mk1mf.pl:1.9.2.1.4.1.10.1.2.1.4.1.2.1 openssl/util/mk1mf.pl:1.14
+--- openssl/util/mk1mf.pl:1.9.2.1.4.1.10.1.2.1.4.1.2.1	Mon Jun 13 15:11:05 2016
+++ openssl/util/mk1mf.pl	Mon Jun 13 15:21:08 2016
@@ -114,6 +114,8 @@
 	no-ecdh					- No ECDH
 	no-engine				- No engine
@@ -15718,7 +15718,7 @@ diff -u openssl/util/mk1mf.pl:1.9.2.1.4.1.10.1.2.1.4.1 openssl/util/mk1mf.pl:1.1
 $cflags.=" -DOPENSSL_FIPS"    if $fips;
 $cflags.=" -DOPENSSL_NO_JPAKE"    if $no_jpake;
 $cflags.=" -DOPENSSL_NO_EC2M"    if $no_ec2m;
-@@ -345,6 +349,9 @@
+@@ -347,6 +351,9 @@
 		$dir=$val;
 		}
 
@@ -15728,7 +15728,7 @@ diff -u openssl/util/mk1mf.pl:1.9.2.1.4.1.10.1.2.1.4.1 openssl/util/mk1mf.pl:1.1
 	if ($key eq "KRB5_INCLUDES")
 		{ $cflags .= " $val";}
 
-@@ -1131,6 +1138,8 @@
+@@ -1136,6 +1143,8 @@
 		"no-gost" => \$no_gost,
 		"no-engine" => \$no_engine,
 		"no-hw" => \$no_hw,
@@ -15738,9 +15738,9 @@ diff -u openssl/util/mk1mf.pl:1.9.2.1.4.1.10.1.2.1.4.1 openssl/util/mk1mf.pl:1.1
 		"just-ssl" =>
 			[\$no_rc2, \$no_idea, \$no_des, \$no_bf, \$no_cast,
 Index: openssl/util/mkdef.pl
-diff -u openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1 openssl/util/mkdef.pl:1.11
--- openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1	Wed Mar  4 14:09:45 2015
-+++ openssl/util/mkdef.pl	Wed Mar  4 14:12:05 2015
+diff -u openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1.6.1 openssl/util/mkdef.pl:1.12
+--- openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1.6.1	Mon Jun 13 15:11:05 2016
+++ openssl/util/mkdef.pl	Mon Jun 13 15:21:08 2016
@@ -96,7 +96,7 @@
 			 # External "algorithms"
 			 "FP_API", "STDIO", "SOCK", "KRB5", "DGRAM",
@@ -15750,7 +15750,7 @@ diff -u openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1 openssl/util/mkdef.pl:1.11
 			 # RFC3779
 			 "RFC3779",
 			 # TLS
-@@ -139,6 +139,7 @@
+@@ -141,6 +141,7 @@
 my $no_md2; my $no_md4; my $no_md5; my $no_sha; my $no_ripemd; my $no_mdc2;
 my $no_rsa; my $no_dsa; my $no_dh; my $no_hmac=0; my $no_aes; my $no_krb5;
 my $no_ec; my $no_ecdsa; my $no_ecdh; my $no_engine; my $no_hw;
@@ -15758,7 +15758,7 @@ diff -u openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1 openssl/util/mkdef.pl:1.11
 my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated;
 my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng;
 my $no_jpake; my $no_srp; my $no_ssl2; my $no_ec2m; my $no_nistp_gcc; 
-@@ -245,6 +246,8 @@
+@@ -248,6 +249,8 @@
 	elsif (/^no-sctp$/)	{ $no_sctp=1; }
 	elsif (/^no-srtp$/)	{ $no_srtp=1; }
 	elsif (/^no-unit-test$/){ $no_unit_test=1; }
@@ -15767,7 +15767,7 @@ diff -u openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1 openssl/util/mkdef.pl:1.11
 	}
 
 
-@@ -1199,6 +1202,8 @@
+@@ -1202,6 +1205,8 @@
 			if ($keyword eq "KRB5" && $no_krb5) { return 0; }
 			if ($keyword eq "ENGINE" && $no_engine) { return 0; }
 			if ($keyword eq "HW" && $no_hw) { return 0; }
@@ -15777,9 +15777,9 @@ diff -u openssl/util/mkdef.pl:1.7.2.1.4.1.10.1.2.1 openssl/util/mkdef.pl:1.11
 			if ($keyword eq "STATIC_ENGINE" && $no_static_engine) { return 0; }
 			if ($keyword eq "GMP" && $no_gmp) { return 0; }
 Index: openssl/util/pl/VC-32.pl
-diff -u openssl/util/pl/VC-32.pl:1.7.2.1.4.1.2.1.4.1.10.1 openssl/util/pl/VC-32.pl:1.11
--- openssl/util/pl/VC-32.pl:1.7.2.1.4.1.2.1.4.1.10.1	Wed Dec 23 18:10:39 2015
-+++ openssl/util/pl/VC-32.pl	Wed Dec 23 18:27:48 2015
+diff -u openssl/util/pl/VC-32.pl:1.7.2.1.4.1.2.1.4.1.10.1.2.1 openssl/util/pl/VC-32.pl:1.12
+--- openssl/util/pl/VC-32.pl:1.7.2.1.4.1.2.1.4.1.10.1.2.1	Mon Jun 13 15:11:05 2016
+++ openssl/util/pl/VC-32.pl	Mon Jun 13 15:21:08 2016
@@ -48,7 +48,7 @@
     my $f = $shlib || $fips ?' /MD':' /MT';
     $lib_cflag='/Zl' if (!$shlib);	# remove /DEFAULTLIBs from static lib
--- a/Show More
+++ b/Show More