Vendor import of BIND 9.3.3

svn path=/vendor/bind9/dist/; revision=165071

contrib/bind9/CHANGES

@@ -1,5 +1,37 @@
 
-	--- 9.3.2-P2 released ---
+	--- 9.3.3 released ---
+
+2107.	[bug]		dighost.c: more cleanup of buffers. [RT #16499]
+
+2104.	[port]		Fix Solaris SMF error message.
+
+2103.	[port]		Add /usr/sfw to list of locations for OpenSSL
+			under Solaris.
+
+2102.	[port]		Silence solaris 10 warnings.
+
+2101.	[bug]		OpenSSL version checks were not quite right.
+			[RT #16476]
+
+2100.	[port]		win32: copy libeay32.dll to Build\Debug.
+
+2099.	[port]		win32: more manifiest issues.
+
+	--- 9.3.3rc3 released ---
+
+2096.	[bug]		libbind: handle applications that fail to detect
+			res_init() failures better.
+
+2095.	[port]		libbind: alway prototype inet_cidr_ntop_ipv6() and
+			net_cidr_ntop_ipv6(). [RT #16388]
+ 
+2094.	[contrib]	Update named-bootconf.  [RT# 16404]
+
+2092.	[bug]		win32: dig, host, nslookup.  Use registry config
+			if resolv.conf does not exist or no nameservers
+			listed. [RT #15877] 
+
+2091.	[port]		dighost.c: race condition on cleanup. [RT #16417]
 
 2090.	[port]		win32: Visual C++ 2005 command line manifest support.
 			[RT #16417]
@@ -12,15 +44,307 @@
 2088.	[security]	Change the default RSA exponent from 3 to 65537.
 			[RT #16391]
 
+2086.	[port]		libbind: FreeBSD now has get*by*_r() functions.
+			[RT #16403]
+
+2085.	[doc]		win32: added index.html and README to zip. [RT #16201]
+
+2084.	[contrib]	dbus update for 9.3.3rc2.
+
 2083.	[port]		win32: Visual C++ 2005 support.
 
-	--- 9.3.2-P1 released ---
+2082.	[doc]		Document 'cache-file' as a test only option.
+
+	--- 9.3.3rc2 released ---
+
+2081.	[port]		libbind: minor 64-bit portability fix in memcluster.c.
+			[RT #16360]
+
+2080.	[port]		libbind: res_init.c did not compile on older versions
+			of Solaris. [RT #16363]
+
+2076.	[bug]		Several files were missing #include <config.h>
+			causing build failures on OSF. [RT #16341]
+
+2074.	[bug]		dns_request_createvia2(), dns_request_createvia3(),
+			dns_request_createraw2() and dns_request_createraw3()
+			failed to send multiple UDP requests. [RT #16349]
 
 2066.	[security]	Handle SIG queries gracefully. [RT #16300]
 
+	--- 9.3.3rc1 released ---
+
+2071.	[port]		Test whether gcc accepts -fno-strict-aliasing.
+			[RT #16324]
+
+2070.	[bug]		The remote address was not always displayed when
+			reporting dispatch failures. [RT #16315]
+
+2069.	[bug]		Cross compiling was not working. [RT #16330]
+
+2067.	[bug]		'rndc' could close the socket too early triggering
+			a INSIST under Windows. [RT #16317]
+
+2065.	[bug]		libbind: probe for HPUX prototypes for
+			endprotoent_r() and endservent_r().  [RT 16313]
+
+2064.	[bug]		libbind: silence AIX compiler warnings. [RT #16218]
+
+2063.	[bug]		Change #1955 introduced a bug which caused the first
+			'rndc flush' call to not free memory. [RT #16244]
+
+2062.	[bug]		'dig +nssearch' was reusing a buffer before it had
+			been returned by the socket code. [RT #16307]
+
+2057.	[bug]		Make setting "ra" dependent on both allow-query and
+			allow-recursion. [RT #16290]
+
+2056.	[bug]		dig: ixfr= was not being treated case insensitively
+			at all times. [RT #15955]
+
+2055.	[bug]		Missing goto after dropping multicast query.
+			[RT #15944]
+
+2054.	[port]		freebsd: do not explicitly link against -lpthread.
+			[RT #16170]
+
+2053.	[port]		netbsd:libbind: silence compiler warnings. [RT #16220]
+
+2052.	[bug]		'rndc' improve connect failed message to report
+			the failing address. [RT #15978]
+
+2051.	[port]		More strtol() fixes. [RT #16249]
+
+2050.	[bug]		Parsing of NSAP records was not case insensitive.
+			[RT #16287]
+
+2049.	[bug]		Restore SOA before AXFR when falling back from
+			a attempted IXFR when transfering in a zone.
+			Allow a initial SOA query before attempting
+			a AXFR to be requested. [RT #16156]
+
+2048.	[bug]		It was possible to loop forever when using
+			avoid-v4-udp-ports / avoid-v6-udp-ports when
+			the OS always returned the same local port.
+			[RT #16182]
+
+2047.	[bug]		Failed to initialise the interface flags to zero.
+			[RT #16245]
+
+2043.	[port]		nsupdate/nslookup: Force the flushing of the prompt
+			for interactive sessions. [RT#16148]
+
+2038.	[bug]		dig/nslookup/host was unlinking from wrong list
+			when handling errors. [RT #16122]
+
+2037.	[func]		When unlinking the first or last element in a list
+			check that the list head points to the element to
+			be unlinked. [RT #15959]
+
+2036.	[bug]		'rndc recursing' could cause trigger a REQUIRE.
+			[RT #16075]
+
+2034.	[bug]		gcc: set -fno-strict-aliasing. [RT #16124]
+
+	--- 9.3.3b1 released ---
+
+2031.	[bug]		Emit a error message when "rndc refresh" is called on
+			a non slave/stub zone. [RT # 16073]
+
+2030.	[bug]		We were being overly conservative when disabling
+			openssl engine support. [RT #16030]
+
+2029.	[bug]		host printed out the server multiple times when
+			specified on the command line. [RT #15992]
+
+2028.	[port]		linux: socket.c compatability for old systems.
+			[RT #16015]
+
+2027.	[port]		libbind: Solaris x86 support. [RT #16020]
+
+2026.	[bug]		Rate limit the two recursive client exceeded messages.
+			[RT #16044]
+
+2024.	[bug]		named emited spurious "zone serial unchanged"
+			messages on reload. [RT #16027]
+
+2023.	[bug]		"make install" should create ${localstatedir}/run and
+			${sysconfdir} if they do not exist. [RT #16033]
+
+2016.	[bug]		Return a partial answer if recursion is not
+			allowed but requested and we had the answer
+			to the original qname. [RT #15945]
+
+2013.	[bug]		Handle unexpected TSIGs on unsigned AXFR/IXFR
+			responses more gracefully. [RT #15941]
+
+2009.	[bug]		libbind: coverity fixes. [RT #15808]
+
+2005.	[bug]		libbind: Retransmission timeouts should be
+			based on which attempt it is to the nameserver
+			and not the nameserver itself. [RT #13548]
+
+2004.	[bug]		dns_tsig_sign() could pass a NULL pointer to
+			dst_context_destroy() when cleaning up after a
+			error. [RT #15835]
+
+2003.	[bug]		libbind: The DNS name/address lookup functions could
+			occasionally follow a random pointer due to
+			structures not being completely zeroed. [RT #15806]
+
+2002.	[bug]		libbind: tighten the constraints on when
+			struct addrinfo._ai_pad exists.  [RT #15783]
+
+2000.	[bug]		memmove()/strtol() fix was incomplete. [RT #15812]
+
+1998.	[bug]		Restrict handling of fifos as sockets to just SunOS.
+			This allows named to connect to entropy gathering
+			daemons that use fifos instead of sockets. [RT #15840]
+
+1997.	[bug]		Named was failing to replace negative cache entries
+			when a positive one for the type was learnt.
+			[RT #15818]
+
+1995.	[bug]		'host' was reporting multiple "is an alias" messages.
+			[RT #15702]
+
+1994.	[port]		OpenSSL 0.9.8 support. [RT #15694]
+
+1993.	[bug]		Log messsage, via syslog, were missing the space
+			after the timestamp if "print-time yes" was specified.
+			[RT #15844]
+
+1991.	[cleanup]	The configuration data, once read, should be treated
+			as readonly.  Expand the use of const to enforce this
+			at compile time. [RT #15813]
+
+1990.	[bug]		libbind:  isc's override of broken gettimeofday()
+			implementions was not always effective.
+			[RT #15709]
+
+1989.	[bug]		win32: don't check the service password when
+			re-installing. [RT #15882]
+
+1985.	[protocol]	DLV has now been assigned a official type code of
+			32769. [RT #15807]
+
+			Note: care should be taken to ensure you upgrade
+			both named and dnssec-signzone at the same time for
+			zones with DLV records where named is the master
+			server for the zone.  Also any zones that contain
+			DLV records should be removed when upgrading a slave
+			zone.  You do not however have to upgrade all
+			servers for a zone with DLV records simultaniously.
+
+1982.	[bug]		DNSKEY was being accepted on the parent side of
+			a delegation.  KEY is still accepted there for
+			RFC 3007 validated updates. [RT #15620]
+
+1981.	[bug]		win32: condition.c:wait() could fail to reattain
+			the mutex lock.
+
+1979.	[port]		linux: allow named to drop core after changing
+			user ids. [RT #15753]
+
+1978.	[port]		Handle systems which have a broken recvmsg().
+			[RT #15742]
+
+1977.	[bug]		Silence noisy log message. [RT #15704]
+
+1976.	[bug]		Handle systems with no IPv4 addresses. [RT #15695]
+
+1975.	[bug]		libbind: isc_gethexstring() could misparse multi-line
+			hex strings with comments. [RT #15814]
+
+1974.	[doc]		List each of the zone types and associated zone
+			options seperately in the ARM.
+
+1972.	[contrib]	DBUS dynamic forwarders integation from
+			Jason Vas Dias <jvdias@redhat.com>.
+
+1971.	[port]		linux: make detection of missing IF_NAMESIZE more
+			robust. [RT #15443]
+
+1970.	[bug]		nsupdate: adjust UDP timeout when falling back to
+			unsigned SOA query. [RT #15775]
+
+1969.	[bug]		win32: the socket code was freeing the socket
+			structure too early. [RT #15776]
+
+1968.	[bug]		Missing lock in resolver.c:validated(). [RT #15739]
+
+1966.	[bug]		Don't set CD when we have fallen back to plain DNS.
+			[RT #15727]
+
+1963.	[port]		Tru64 4.0E doesn't support send() and recv(). 
+			[RT #15586]
+
+1962.	[bug]		Named failed to clear old update-policy when it
+			was removed. [RT #15491]
+
+1961.	[bug]		Check the port and address of responses forwarded
+			to dispatch. [RT #15474]
+
+1960.	[bug]		Update code should set NSEC ttls from SOA MINIMUM.
+			[RT #15465]
+
+1958.	[bug]		Named failed to update the zone's secure state
+			until the zone was reloaded. [RT #15412]
+
+1957.	[bug]		Dig mishandled responses to class ANY queries.
+			[RT #15402]
+
+1956.	[bug]		Improve cross compile support, 'gen' is now built
+			by native compiler.  See README for additional
+			cross compile support information. [RT #15148]
+
+1955.	[bug]		Pre-allocate the cache cleaning interator. [RT #14998]
+
+1952.	[port]		hpux: tell the linker to build a runtime link
+			path "-Wl,+b:". [RT #14816].
+
+1951.	[security]	Drop queries from particular well known ports.
+			Don't return FORMERR to queries from particular
+			well known ports.  [RT #15636]
+			
+1950.	[port]		Solaris 2.5.1 and earlier cannot bind() then connect()
+			a TCP socket. This prevents the source address being
+			set for TCP connections. [RT #15628]
+
+1948.	[bug]		If was possible to trigger a REQUIRE failure in
+			xfrin.c:maybe_free() if named ran out of memory.
+			[RT #15568]
+
+1946.	[bug]		resume_dslookup() could trigger a REQUIRE failure
+			when using forwarders. [RT #15549]
+
+1944.	[cleanup]	isc_hash_create() does not need a read/write lock.
+			[RT #15522]
+
+1943.	[bug]		Set the loadtime after rolling forward the journal.
+			[RT #15647]
+
+1942.	[bug]		If the name of a DNSKEY match that of one in
+			trusted-keys do not attempt to validate the DNSKEY
+			using the parents DS RRset. [RT #15649]
+
 1941.	[bug]		ncache_adderesult() should set eresult even if no
 			rdataset is passed to it. [RT #15642]
 
+1940.	[bug]		Fixed a number of error conditions reported by
+			Coverity.
+
+1939.	[bug]           The resolver could dereference a null pointer after
+			validation if all the queries have timed out.
+			[RT #15528]
+
+1938.	[bug]		The validator was not correctly handling unsecure
+			negative responses at or below a SEP. [RT #15528]
+
+1919.	[contrib]	queryperf: a set of new features: collecting/printing
+			response delays, printing intermediate results, and
+			adjusting query rate for the "target" qps.
+
 	--- 9.3.2 released ---
 
 	--- 9.3.2rc1 released ---
@@ -338,14 +662,14 @@
 
 1779.	[port]		OSF 5.1: libtool didn't handle -pthread correctly.
 
-1778.   [port]   	HUX 11.11: fix broken IN6ADDR_ANY_INIT and
+1778.	[port]		HUX 11.11: fix broken IN6ADDR_ANY_INIT and
 			IN6ADDR_LOOPBACK_INIT macros.
 
-1777.   [port]   	OSF 5.1: fix broken IN6ADDR_ANY_INIT and
+1777.	[port]		OSF 5.1: fix broken IN6ADDR_ANY_INIT and
 			IN6ADDR_LOOPBACK_INIT macros.
 
-1776.   [port]   	Solaris 2.9: fix broken IN6ADDR_ANY_INIT and
+1776.	[port]		Solaris 2.9: fix broken IN6ADDR_ANY_INIT and
-                        IN6ADDR_LOOPBACK_INIT macros.
+			IN6ADDR_LOOPBACK_INIT macros.
 
 1775.	[bug]		Only compile getnetent_r.c when threaded. [RT #13205]
 
@@ -1188,8 +1512,8 @@
 
 1414.	[func]		Support for KSK flag.
 
-1413.	[func]		Explictly request the (re-)generation of DS records from
+1413.	[func]		Explicitly request the (re-)generation of DS records
-			keysets (dnssec-signzone -g).
+			from keysets (dnssec-signzone -g).
 
 1412.	[func]		You can now specify servers to be tried if a nameserver
 			has IPv6 address and you only support IPv4 or the
@@ -5586,7 +5910,7 @@
 			<isc/bufferlist.h>, <isc/task.h>, <isc/mem.h> or
 			<isc/net.h>.
 
- 119.	[cleanup]	structure definitions for generic rdata stuctures do
+ 119.	[cleanup]	structure definitions for generic rdata structures do
 			not have _generic_ in their names.
 
  118.	[cleanup]	libdns.a is now namespace-clean, on NetBSD, excepting

contrib/bind9/COPYRIGHT

@@ -1,4 +1,4 @@
-Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.
 
 Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@ LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 PERFORMANCE OF THIS SOFTWARE.
 
-$Id: COPYRIGHT,v 1.6.2.2.8.3 2005/01/10 23:51:37 marka Exp $
+$Id: COPYRIGHT,v 1.6.2.2.8.4 2006/01/04 00:37:22 marka Exp $
 
 Portions Copyright (C) 1996-2001  Nominum, Inc.
 

contrib/bind9/FAQ

@@ -4,26 +4,36 @@ Frequently Asked Questions about BIND 9
 
 Q: Why doesn't -u work on Linux 2.2.x when I build with --enable-threads?
 
-A: Linux threads do not fully implement the Posix threads (pthreads) standard.
+A: Linux threads do not fully implement the Posix threads (pthreads) standard. In
-   In particular, setuid() operates only on the current thread, not the full
+   particular, setuid() operates only on the current thread, not the full process.
-   process. Because of this limitation, BIND 9 cannot use setuid() on Linux as
+   Because of this limitation, BIND 9 cannot use setuid() on Linux as it can on
-   it can on all other supported platforms. setuid() cannot be called before
+   all other supported platforms. setuid() cannot be called before creating
-   creating threads, since the server does not start listening on reserved
+   threads, since the server does not start listening on reserved ports until
-   ports until after threads have started.
+   after threads have started.
 
    In the 2.2.18 or 2.3.99-pre3 and newer kernels, the ability to preserve
    capabilities across a setuid() call is present. This allows BIND 9 to call
-   setuid() early, while retaining the ability to bind reserved ports. This is
+   setuid() early, while retaining the ability to bind reserved ports. This is a
-   a Linux-specific hack.
+   Linux-specific hack.
 
-   On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less
+   On a 2.2 kernel, BIND 9 does drop many root privileges, so it should be less of
-   of a security risk than a root process that has not dropped privileges.
+   a security risk than a root process that has not dropped privileges.
 
    If Linux threads ever work correctly, this restriction will go away.
 
    Configuring BIND9 with the --disable-threads option (the default) causes a
    non-threaded version to be built, which will allow -u to be used.
 
+Q: Why do I get the following errors:
+
+   general: errno2result.c:109: unexpected error:
+   general: unable to convert errno to isc_result: 14: Bad address
+   client: UDP client handler shutting down due to fatal receive error: unexpected error
+
+A: This is the result of a Linux kernel bug.
+
+   See: http://marc.theaimsgroup.com/?l=linux-netdev&m=113081708031466&w=2
+
 Q: Why does named log the warning message "no TTL specified - using SOA MINTTL
    instead"?
 
@@ -40,23 +50,26 @@ A: Your zone file is illegal according to RFC1035. It must either have a line
 Q: Why do I see 5 (or more) copies of named on Linux?
 
 A: Linux threads each show up as a process under ps. The approximate number of
-   threads running is n+4, where n is the number of CPUs. Note that the amount
+   threads running is n+4, where n is the number of CPUs. Note that the amount of
-   of memory used is not cumulative; if each process is using 10M of memory,
+   memory used is not cumulative; if each process is using 10M of memory, only a
-   only a total of 10M is used.
+   total of 10M is used.
+
+   Newer versions of Linux's ps command hide the individual threads and require -L
+   to display them.
 
 Q: Why does BIND 9 log "permission denied" errors accessing its configuration
    files or zones on my Linux system even though it is running as root?
 
-A: On Linux, BIND 9 drops most of its root privileges on startup. This
+A: On Linux, BIND 9 drops most of its root privileges on startup. This including
-   including the privilege to open files owned by other users. Therefore, if
+   the privilege to open files owned by other users. Therefore, if the server is
-   the server is running as root, the configuration files and zone files should
+   running as root, the configuration files and zone files should also be owned by
-   also be owned by root.
+   root.
 
-Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file
+Q: Why do I get errors like "dns_zone_load: zone foo/IN: loading master file bar:
-   bar: ran out of space"?
+   ran out of space"?
 
-A: This is often caused by TXT records with missing close quotes. Check that
+A: This is often caused by TXT records with missing close quotes. Check that all
-   all TXT records containing quoted strings have both open and close quotes.
+   TXT records containing quoted strings have both open and close quotes.
 
 Q: How do I produce a usable core file from a multithreaded named on Linux?
 
@@ -68,16 +81,16 @@ A: If the Linux kernel is 2.4.7 or newer, multithreaded core dumps are usable
 
 Q: How do I restrict people from looking up the server version?
 
-A: Put a "version" option containing something other than the real version in
+A: Put a "version" option containing something other than the real version in the
-   the "options" section of named.conf. Note doing this will not prevent
+   "options" section of named.conf. Note doing this will not prevent attacks and
-   attacks and may impede people trying to diagnose problems with your server.
+   may impede people trying to diagnose problems with your server. Also it is
-   Also it is possible to "fingerprint" nameservers to determine their version.
+   possible to "fingerprint" nameservers to determine their version.
 
 Q: How do I restrict only remote users from looking up the server version?
 
-A: The following view statement will intercept lookups as the internal view
+A: The following view statement will intercept lookups as the internal view that
-   that holds the version information will be matched last. The caveats of the
+   holds the version information will be matched last. The caveats of the previous
-   previous answer still apply, of course.
+   answer still apply, of course.
 
    view "chaos" chaos {
            match-clients { <those to be refused>; };
@@ -91,48 +104,45 @@ A: The following view statement will intercept lookups as the internal view
 Q: What do "no source of entropy found" or "could not open entropy source foo"
    mean?
 
-A: The server requires a source of entropy to perform certain operations,
+A: The server requires a source of entropy to perform certain operations, mostly
-   mostly DNSSEC related. These messages indicate that you have no source of
+   DNSSEC related. These messages indicate that you have no source of entropy. On
-   entropy. On systems with /dev/random or an equivalent, it is used by
+   systems with /dev/random or an equivalent, it is used by default. A source of
-   default. A source of entropy can also be defined using the random-device
+   entropy can also be defined using the random-device option in named.conf.
-   option in named.conf.
 
 Q: I installed BIND 9 and restarted named, but it's still BIND 8. Why?
 
 A: BIND 9 is installed under /usr/local by default. BIND 8 is often installed
    under /usr. Check that the correct named is running.
 
-Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers.
+Q: I'm trying to use TSIG to authenticate dynamic updates or zone transfers. I'm
-   I'm sure I have the keys set up correctly, but the server is rejecting the
+   sure I have the keys set up correctly, but the server is rejecting the TSIG.
-   TSIG. Why?
+   Why?
 
-A: This may be a clock skew problem. Check that the the clocks on the client
+A: This may be a clock skew problem. Check that the the clocks on the client and
-   and server are properly synchronised (e.g., using ntp).
+   server are properly synchronised (e.g., using ntp).
 
 Q: I'm trying to compile BIND 9, and "make" is failing due to files not being
    found. Why?
 
 A: Using a parallel or distributed "make" to build BIND 9 is not supported, and
-   doesn't work. If you are using one of these, use normal make or gmake
+   doesn't work. If you are using one of these, use normal make or gmake instead.
-   instead.
 
-Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging
+Q: I have a BIND 9 master and a BIND 8.2.3 slave, and the master is logging error
-   error messages like "notify to 10.0.0.1#53 failed: unexpected end of input".
+   messages like "notify to 10.0.0.1#53 failed: unexpected end of input". What's
-   What's wrong?
+   wrong?
 
-A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in
+A: This error message is caused by a known bug in BIND 8.2.3 and is fixed in BIND
-   BIND 8.2.4. It can be safely ignored - the notify has been acted on by the
+   8.2.4. It can be safely ignored - the notify has been acted on by the slave
-   slave despite the error message.
+   despite the error message.
 
 Q: I keep getting log messages like the following. Why?
 
    Dec 4 23:47:59 client 10.0.0.1#1355: updating zone 'example.com/IN': update
-   failed: 'RRset exists (value dependent)' prerequisite not satisfied
+   failed: 'RRset exists (value dependent)' prerequisite not satisfied (NXRRSET)
-   (NXRRSET)
 
-A: DNS updates allow the update request to test to see if certain conditions
+A: DNS updates allow the update request to test to see if certain conditions are
-   are met prior to proceeding with the update. The message above is saying
+   met prior to proceeding with the update. The message above is saying that
-   that conditions were not met and the update is not proceeding. See doc/rfc/
+   conditions were not met and the update is not proceeding. See doc/rfc/
    rfc2136.txt for more details on prerequisites.
 
 Q: I keep getting log messages like the following. Why?
@@ -140,11 +150,11 @@ Q: I keep getting log messages like the following. Why?
    Jun 21 12:00:00.000 client 10.0.0.1#1234: update denied
 
 A: Someone is trying to update your DNS data using the RFC2136 Dynamic Update
-   protocol. Windows 2000 machines have a habit of sending dynamic update
+   protocol. Windows 2000 machines have a habit of sending dynamic update requests
-   requests to DNS servers without being specifically configured to do so. If
+   to DNS servers without being specifically configured to do so. If the update
-   the update requests are coming from a Windows 2000 machine, see http://
+   requests are coming from a Windows 2000 machine, see http://
-   support.microsoft.com/support/kb/articles/q246/8/04.asp for information
+   support.microsoft.com/support/kb/articles/q246/8/04.asp for information about
-   about how to turn them off.
+   how to turn them off.
 
 Q: I see a log message like the following. Why?
 
@@ -152,59 +162,59 @@ Q: I see a log message like the following. Why?
 
 A: You are most likely running named as a non-root user, and that user does not
    have permission to write in /var/run. The common ways of fixing this are to
-   create a /var/run/named directory owned by the named user and set pid-file
+   create a /var/run/named directory owned by the named user and set pid-file to "
-   to "/var/run/named/named.pid", or set pid-file to "named.pid", which will
+   /var/run/named/named.pid", or set pid-file to "named.pid", which will put the
-   put the file in the directory specified by the directory option (which, in
+   file in the directory specified by the directory option (which, in this case,
-   this case, must be writable by the named user).
+   must be writable by the named user).
 
-Q: When I do a "dig . ns", many of the A records for the root servers are
+Q: When I do a "dig . ns", many of the A records for the root servers are missing.
-   missing. Why?
+   Why?
 
-A: This is normal and harmless. It is a somewhat confusing side effect of the
+A: This is normal and harmless. It is a somewhat confusing side effect of the way
-   way BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to
+   BIND 9 does RFC2181 trust ranking and of the efforts BIND 9 makes to avoid
-   avoid promoting glue into answers.
+   promoting glue into answers.
 
-   When BIND 9 first starts up and primes its cache, it receives the root
+   When BIND 9 first starts up and primes its cache, it receives the root server
-   server addresses as additional data in an authoritative response from a root
+   addresses as additional data in an authoritative response from a root server,
-   server, and these records are eligible for inclusion as additional data in
+   and these records are eligible for inclusion as additional data in responses.
-   responses. Subsequently it receives a subset of the root server addresses as
+   Subsequently it receives a subset of the root server addresses as additional
-   additional data in a non-authoritative (referral) response from a root
+   data in a non-authoritative (referral) response from a root server. This causes
-   server. This causes the addresses to now be considered non-authoritative
+   the addresses to now be considered non-authoritative (glue) data, which is not
-   (glue) data, which is not eligible for inclusion in responses.
+   eligible for inclusion in responses.
 
    The server does have a complete set of root server addresses cached at all
    times, it just may not include all of them as additional data, depending on
-   whether they were last received as answers or as glue. You can always look
+   whether they were last received as answers or as glue. You can always look up
-   up the addresses with explicit queries like "dig a.root-servers.net A".
+   the addresses with explicit queries like "dig a.root-servers.net A".
 
 Q: Zone transfers from my BIND 9 master to my Windows 2000 slave fail. Why?
 
-A: This may be caused by a bug in the Windows 2000 DNS server where DNS
+A: This may be caused by a bug in the Windows 2000 DNS server where DNS messages
-   messages larger than 16K are not handled properly. This can be worked around
+   larger than 16K are not handled properly. This can be worked around by setting
-   by setting the option "transfer-format one-answer;". Also check whether your
+   the option "transfer-format one-answer;". Also check whether your zone contains
-   zone contains domain names with embedded spaces or other special characters,
+   domain names with embedded spaces or other special characters, like "John\
-   like "John\032Doe\213s\032Computer", since such names have been known to
+   032Doe\213s\032Computer", since such names have been known to cause Windows
-   cause Windows 2000 slaves to incorrectly reject the zone.
+   2000 slaves to incorrectly reject the zone.
 
 Q: Why don't my zones reload when I do an "rndc reload" or SIGHUP?
 
-A: A zone can be updated either by editing zone files and reloading the server
+A: A zone can be updated either by editing zone files and reloading the server or
-   or by dynamic update, but not both. If you have enabled dynamic update for a
+   by dynamic update, but not both. If you have enabled dynamic update for a zone
-   zone using the "allow-update" option, you are not supposed to edit the zone
+   using the "allow-update" option, you are not supposed to edit the zone file by
-   file by hand, and the server will not attempt to reload it.
+   hand, and the server will not attempt to reload it.
 
 Q: I can query the nameserver from the nameserver but not from other machines.
    Why?
 
-A: This is usually the result of the firewall configuration stopping the
+A: This is usually the result of the firewall configuration stopping the queries
-   queries and / or the replies.
+   and / or the replies.
 
 Q: How can I make a server a slave for both an internal and an external view at
-   the same time? When I tried, both views on the slave were transferred from
+   the same time? When I tried, both views on the slave were transferred from the
-   the same view on the master.
+   same view on the master.
 
-A: You will need to give the master and slave multiple IP addresses and use
+A: You will need to give the master and slave multiple IP addresses and use those
-   those to make sure you reach the correct view on the other machine.
+   to make sure you reach the correct view on the other machine.
 
    Master: 10.0.1.1 (internal), 10.0.1.2 (external, IP alias)
        internal:
@@ -232,8 +242,8 @@ A: You will need to give the master and slave multiple IP addresses and use
            transfer-source 10.0.1.4;
            query-source address 10.0.1.4;
 
-   You put the external address on the alias so that all the other dns clients
+   You put the external address on the alias so that all the other dns clients on
-   on these boxes see the internal view by default.
+   these boxes see the internal view by default.
 
 A: BIND 9.3 and later: Use TSIG to select the appropriate view.
 
@@ -248,7 +258,7 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view.
            };
            view "external" {
                    match-clients { key external; any; };
-                   server 10.0.0.2 { keys external; };
+                   server 10.0.1.2 { keys external; };
                    recursion no;
                    ...
            };
@@ -264,7 +274,7 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view.
            };
            view "external" {
                    match-clients { key external; any; };
-                   server 10.0.0.1 { keys external; };
+                   server 10.0.1.1 { keys external; };
                    recursion no;
                    ...
            };
@@ -272,8 +282,8 @@ A: BIND 9.3 and later: Use TSIG to select the appropriate view.
 Q: I have FreeBSD 4.x and "rndc-confgen -a" just sits there.
 
 A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use
-   certain interrupts as a source of random events. You can make this permanent
+   certain interrupts as a source of random events. You can make this permanent by
-   by setting rand_irqs in /etc/rc.conf.
+   setting rand_irqs in /etc/rc.conf.
 
    /etc/rc.conf
    rand_irqs="3 14 15"
@@ -283,34 +293,33 @@ A: /dev/random is not configured. Use rndcontrol(8) to tell the kernel to use
 Q: Why is named listening on UDP port other than 53?
 
 A: Named uses a system selected port to make queries of other nameservers. This
-   behaviour can be overridden by using query-source to lock down the port and/
+   behaviour can be overridden by using query-source to lock down the port and/or
-   or address. See also notify-source and transfer-source.
+   address. See also notify-source and transfer-source.
 
-Q: I get error messages like "multiple RRs of singleton type" and "CNAME and
+Q: I get error messages like "multiple RRs of singleton type" and "CNAME and other
-   other data" when transferring a zone. What does this mean?
+   data" when transferring a zone. What does this mean?
 
 A: These indicate a malformed master zone. You can identify the exact records
-   involved by transferring the zone using dig then running named-checkzone on
+   involved by transferring the zone using dig then running named-checkzone on it.
-   it.
 
    dig axfr example.com @master-server > tmp
    named-checkzone example.com tmp
 
-   A CNAME record cannot exist with the same name as another record except for
+   A CNAME record cannot exist with the same name as another record except for the
-   the DNSSEC records which prove its existance (NSEC).
+   DNSSEC records which prove its existance (NSEC).
 
    RFC 1034, Section 3.6.2: "If a CNAME RR is present at a node, no other data
    should be present; this ensures that the data for a canonical name and its
-   aliases cannot be different. This rule also insures that a cached CNAME can
+   aliases cannot be different. This rule also insures that a cached CNAME can be
-   be used without checking with an authoritative server for other RR types."
+   used without checking with an authoritative server for other RR types."
 
-Q: I get error messages like "named.conf:99: unexpected end of input" where 99
+Q: I get error messages like "named.conf:99: unexpected end of input" where 99 is
-   is the last line of named.conf.
+   the last line of named.conf.
 
 A: Some text editors (notepad and wordpad) fail to put a line title indication
-   (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding"
+   (e.g. CR/LF) on the last line of a text file. This can be fixed by "adding" a
-   a blank line to the end of the file. Named expects to see EOF immediately
+   blank line to the end of the file. Named expects to see EOF immediately after
-   after EOL and treats text files where this is not met as truncated.
+   EOL and treats text files where this is not met as truncated.
 
 Q: I get warning messages like "zone example.com/IN: refresh: failure trying
    master 1.2.3.4#53: timed out".
@@ -319,15 +328,15 @@ A: Check that you can make UDP queries from the slave to the master
 
    dig +norec example.com soa @1.2.3.4
 
-   You could be generating queries faster than the slave can cope with. Lower
+   You could be generating queries faster than the slave can cope with. Lower the
-   the serial query rate.
+   serial query rate.
 
    serial-query-rate 5; // default 20
 
 Q: How do I share a dynamic zone between multiple views?
 
-A: You choose one view to be master and the second a slave and transfer the
+A: You choose one view to be master and the second a slave and transfer the zone
-   zone between views.
+   between views.
 
    Master 10.0.1.1:
            key "external" {
@@ -370,14 +379,14 @@ Q: I get a error message like "zone wireless.ietf56.ietf.org/IN: loading master
    file primaries/wireless.ietf56.ietf.org: no owner".
 
 A: This error is produced when a line in the master file contains leading white
-   space (tab/space) but the is no current record owner name to inherit the
+   space (tab/space) but the is no current record owner name to inherit the name
-   name from. Usually this is the result of putting white space before a
+   from. Usually this is the result of putting white space before a comment.
-   comment. Forgeting the "@" for the SOA record or indenting the master file.
+   Forgeting the "@" for the SOA record or indenting the master file.
 
 Q: Why are my logs in GMT (UTC).
 
-A: You are running chrooted (-t) and have not supplied local timzone
+A: You are running chrooted (-t) and have not supplied local timzone information
-   information in the chroot area.
+   in the chroot area.
 
    FreeBSD: /etc/localtime
    Solaris: /etc/TIMEZONE and /usr/share/lib/zoneinfo
@@ -395,23 +404,23 @@ Q: I get "rndc: connect failed: connection refused" when I try to run rndc.
 
 A: This is usually a configuration error.
 
-   First ensure that named is running and no errors are being reported at
+   First ensure that named is running and no errors are being reported at startup
-   startup (/var/log/messages or equivalent). Running "named -g <usual
+   (/var/log/messages or equivalent). Running "named -g <usual arguments>" from a
-   arguments>" from a title can help at this point.
+   title can help at this point.
 
    Secondly ensure that named is configured to use rndc either by "rndc-confgen
-   -a", rndc-confgen or manually. The Administrators Reference manual has
+   -a", rndc-confgen or manually. The Administrators Reference manual has details
-   details on how to do this.
+   on how to do this.
 
    Old versions of rndc-confgen used localhost rather than 127.0.0.1 in /etc/
    rndc.conf for the default server. Update /etc/rndc.conf if necessary so that
    the default server listed in /etc/rndc.conf matches the addresses used in
    named.conf. "localhost" has two address (127.0.0.1 and ::1).
 
-   If you use "rndc-confgen -a" and named is running with -t or -u ensure that
+   If you use "rndc-confgen -a" and named is running with -t or -u ensure that /
-   /etc/rndc.conf has the correct ownership and that a copy is in the chroot
+   etc/rndc.conf has the correct ownership and that a copy is in the chroot area.
-   area. You can do this by re-running "rndc-confgen -a" with appropriate -t
+   You can do this by re-running "rndc-confgen -a" with appropriate -t and -u
-   and -u arguments.
+   arguments.
 
 Q: I don't get RRSIG's returned when I use "dig +dnssec".
 
@@ -419,12 +428,11 @@ A: You need to ensure DNSSEC is enabled (dnssec-enable yes;).
 
 Q: I get "Error 1067" when starting named under Windows.
 
-A: This is the service manager saying that named exited. You need to examine
+A: This is the service manager saying that named exited. You need to examine the
-   the Application log in the EventViewer to find out why.
+   Application log in the EventViewer to find out why.
 
-   Common causes are that you failed to create "named.conf" (usually "C:\
+   Common causes are that you failed to create "named.conf" (usually "C:\windows\
-   windows\dns\etc\named.conf") or failed to specify the directory in
+   dns\etc\named.conf") or failed to specify the directory in named.conf.
-   named.conf.
 
    options {
            Directory "C:\windows\dns\etc";
@@ -439,11 +447,11 @@ A: These indicate a filesystem permission error preventing named creating /
 
    "dumping master file: sl/tmp-XXXX5il3sQ: open: permission denied"
 
-   Named needs write permission on the directory containing the file. Named
+   Named needs write permission on the directory containing the file. Named writes
-   writes the new cache file to a temporary file then renames it to the name
+   the new cache file to a temporary file then renames it to the name specified in
-   specified in named.conf to ensure that the contents are always complete.
+   named.conf to ensure that the contents are always complete. This is to prevent
-   This is to prevent named loading a partial zone in the event of power
+   named loading a partial zone in the event of power failure or similar
-   failure or similar interrupting the write of the master file.
+   interrupting the write of the master file.
 
    Note file names are relative to the directory specified in options and any
    chroot directory ([<chroot dir>/][<options dir>]).
@@ -489,8 +497,8 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
 
    If you are not using these private addresses then a client has queried for
    them. You can just ignore the messages, get the offending client to stop
-   sending you these messages as they are most probably leaking them or setup
+   sending you these messages as they are most probably leaking them or setup your
-   your own zones empty zones to serve answers to these queries.
+   own zones empty zones to serve answers to these queries.
 
    zone "10.IN-ADDR.ARPA" {
            type master;
@@ -523,3 +531,102 @@ A: If the IN-ADDR.ARPA name covered refers to a internal address space you are
 
    Future versions of named are likely to do this automatically.
 
+Q: I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
+
+   Why can't named update slave zone database files?
+
+   Why can't named create DDNS journal files or update the master zones from
+   journals?
+
+   Why can't named create custom log files?
+
+A: Red Hat Security Enhanced Linux (SELinux) policy security protections :
+
+   Red Hat have adopted the National Security Agency's SELinux security policy (
+   see http://www.nsa.gov/selinux ) and recommendations for BIND security , which
+   are more secure than running named in a chroot and make use of the bind-chroot
+   environment unecessary .
+
+   By default, named is not allowed by the SELinux policy to write, create or
+   delete any files EXCEPT in these directories:
+
+   $ROOTDIR/var/named/slaves
+   $ROOTDIR/var/named/data
+   $ROOTDIR/var/tmp
+
+
+   where $ROOTDIR may be set in /etc/sysconfig/named if bind-chroot is installed.
+
+   The SELinux policy particularly does NOT allow named to modify the $ROOTDIR/var
+   /named directory, the default location for master zone database files.
+
+   SELinux policy overrules file access permissions - so even if all the files
+   under /var/named have ownership named:named and mode rw-rw-r--, named will
+   still not be able to write or create files except in the directories above,
+   with SELinux in Enforcing mode.
+
+   So, to allow named to update slave or DDNS zone files, it is best to locate
+   them in $ROOTDIR/var/named/slaves, with named.conf zone statements such as:
+
+   zone "slave.zone." IN {
+           type slave;
+           file "slaves/slave.zone.db";
+           ...
+   };
+   zone "ddns.zone." IN  {
+           type master;
+           allow-updates {...};
+           file "slaves/ddns.zone.db";
+   };
+
+
+   To allow named to create its cache dump and statistics files, for example, you
+   could use named.conf options statements such as:
+
+   options {
+           ...
+           dump-file "/var/named/data/cache_dump.db";
+           statistics-file "/var/named/data/named_stats.txt";
+           ...
+   };
+
+
+   You can also tell SELinux to allow named to update any zone database files, by
+   setting the SELinux tunable boolean parameter 'named_write_master_zones=1',
+   using the system-config-securitylevel GUI, using the 'setsebool' command, or in
+   /etc/selinux/targeted/booleans.
+
+   You can disable SELinux protection for named entirely by setting the
+   'named_disable_trans=1' SELinux tunable boolean parameter.
+
+   The SELinux named policy defines these SELinux contexts for named:
+
+   named_zone_t : for zone database files       - $ROOTDIR/var/named/*
+   named_conf_t : for named configuration files - $ROOTDIR/etc/{named,rndc}.*
+   named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
+
+
+   If you want to retain use of the SELinux policy for named, and put named files
+   in different locations, you can do so by changing the context of the custom
+   file locations .
+
+   To create a custom configuration file location, eg. '/root/named.conf', to use
+   with the 'named -c' option, do:
+
+   # chcon system_u:object_r:named_conf_t /root/named.conf
+
+
+   To create a custom modifiable named data location, eg. '/var/log/named' for a
+   log file, do:
+
+   # chcon system_u:object_r:named_cache_t /var/log/named
+
+
+   To create a custom zone file location, eg. /root/zones/, do:
+
+   # chcon system_u:object_r:named_zone_t /root/zones/{.,*}
+
+
+   See these man-pages for more information : selinux(8), named_selinux(8), chcon
+   (1), setsebool(8)
+

contrib/bind9/FAQ.xml

@@ -1,7 +1,7 @@
 <!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
        "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" []>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: FAQ.xml,v 1.4.6.3 2005/11/02 22:53:51 marka Exp $ -->
+<!-- $Id: FAQ.xml,v 1.4.6.5 2006/02/27 21:11:40 marka Exp $ -->
 
 <article class="faq">
   <title>Frequently Asked Questions about BIND 9</title>
@@ -64,6 +64,26 @@
       </answer>
     </qandaentry>
 
+    <qandaentry>
+      <question>
+	<para>
+	  Why do I get the following errors:
+<programlisting>general: errno2result.c:109: unexpected error:
+general: unable to convert errno to isc_result: 14: Bad address
+client: UDP client handler shutting down due to fatal receive error: unexpected error</programlisting>
+	</para>
+      </question>
+      <answer>
+	<para>
+	  This is the result of a Linux kernel bug.
+	</para>
+	<para>
+	  See:
+	  <ulink url="http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2">http://marc.theaimsgroup.com/?l=linux-netdev&amp;m=113081708031466&amp;w=2</ulink>
+	</para>
+      </answer>
+    </qandaentry>
+
     <qandaentry>
       <question>
 	<para>
@@ -105,6 +125,10 @@ example.com. 86400 IN SOA ns hostmaster ( 1 3600 1800 1814400 3600 )</programlis
 	  is not cumulative; if each process is using 10M of memory,
 	  only a total of 10M is used.
 	</para>
+	<para>
+	  Newer versions of Linux's ps command hide the individual threads
+	  and require -L to display them.
+	</para>
       </answer>
     </qandaentry>
 
@@ -516,7 +540,7 @@ Master 10.0.1.1:
 	};
 	view "external" {
 		match-clients { key external; any; };
-		server 10.0.0.2 { keys external; };
+		server 10.0.1.2 { keys external; };
 		recursion no;
 		...
 	};
@@ -532,7 +556,7 @@ Slave 10.0.1.2:
 	};
 	view "external" {
 		match-clients { key external; any; };
-		server 10.0.0.1 { keys external; };
+		server 10.0.1.1 { keys external; };
 		recursion no;
 		...
 	};</programlisting>
@@ -997,11 +1021,177 @@ empty:
 	       1 3600 1200 604800 10800 )
 @ 10800 IN NS &lt;name-of-server&gt;.</programlisting>
 	</informalexample>
+	<para>
 	<note>
 	  Future versions of named are likely to do this automatically.
 	</note>
+	</para>
       </answer>
     </qandaentry>
 
+    <qandaentry>
+      <question>
+	<para>
+	   I'm running BIND on Red Hat Enterprise Linux or Fedora Core -
+	</para>
+	<para>
+	  Why can't named update slave zone database files?
+	</para>
+	<para>
+	  Why can't named create DDNS journal files or update
+	  the master zones from journals?
+	</para>
+	<para>
+	  Why can't named create custom log files?
+	</para>
+      </question>
+
+      <answer>
+	<para>
+	  Red Hat Security Enhanced Linux (SELinux) policy security
+	  protections :
+	</para>
+
+	<para>
+	   Red Hat have adopted the National Security Agency's
+	   SELinux security policy ( see http://www.nsa.gov/selinux
+	   ) and recommendations for BIND security , which are more
+	   secure than running named in a chroot and make use of
+	   the bind-chroot environment unecessary .
+	</para>
+
+	<para>
+	  By default, named is not allowed by the SELinux policy
+	  to write, create or delete any files EXCEPT in these
+	  directories:
+	  <informalexample>
+	    <programlisting>
+$ROOTDIR/var/named/slaves
+$ROOTDIR/var/named/data
+$ROOTDIR/var/tmp
+	    </programlisting>
+	  </informalexample>
+	  where $ROOTDIR may be set in /etc/sysconfig/named if
+	  bind-chroot is installed.
+	</para>
+
+	<para>
+	  The SELinux policy particularly does NOT allow named to modify
+	  the $ROOTDIR/var/named directory, the default location for master
+	  zone database files.
+	</para>
+
+	<para>
+	  SELinux policy overrules file access permissions - so
+	  even if all the files under /var/named have ownership
+	  named:named and mode rw-rw-r--, named will still not be
+	  able to write or create files except in the directories
+	  above, with SELinux in Enforcing mode.
+	</para>
+  
+	<para>
+	  So, to allow named to update slave or DDNS zone files,
+	  it is best to locate them in $ROOTDIR/var/named/slaves,
+	  with named.conf zone statements such as:
+	  <informalexample>
+	    <programlisting>
+zone "slave.zone." IN {
+	type slave;
+	file "slaves/slave.zone.db";
+	...
+};   
+zone "ddns.zone." IN  {
+	type master;
+	allow-updates {...};
+	file "slaves/ddns.zone.db";
+};
+	    </programlisting>
+	  </informalexample>
+	</para>
+
+	<para>
+	  To allow named to create its cache dump and statistics
+	  files, for example, you could use named.conf options
+	  statements such as:
+	  <informalexample>
+	    <programlisting>
+options {
+	...
+	dump-file "/var/named/data/cache_dump.db";
+	statistics-file "/var/named/data/named_stats.txt";
+	...
+};
+	    </programlisting>
+	  </informalexample>
+	</para>
+
+	<para>
+	  You can also tell SELinux to allow named to update any
+	  zone database files, by setting the SELinux tunable boolean
+	  parameter 'named_write_master_zones=1', using the
+	  system-config-securitylevel GUI, using the 'setsebool'
+	  command, or in /etc/selinux/targeted/booleans.
+	</para>
+  
+	<para>
+	  You can disable SELinux protection for named entirely by
+	  setting the 'named_disable_trans=1' SELinux tunable boolean
+	  parameter.
+	</para>
+    
+	<para>
+	  The SELinux named policy defines these SELinux contexts for named:
+	  <informalexample>
+	    <programlisting>
+named_zone_t : for zone database files       - $ROOTDIR/var/named/*
+named_conf_t : for named configuration files - $ROOTDIR/etc/{named,rndc}.*
+named_cache_t: for files modifiable by named - $ROOTDIR/var/{tmp,named/{slaves,data}}
+	    </programlisting>
+	  </informalexample>
+	</para>
+   
+	<para>
+	  If you want to retain use of the SELinux policy for named,
+	  and put named files in different locations, you can do
+	  so by changing the context of the custom file locations
+	  .
+	</para>
+
+	<para>
+	  To create a custom configuration file location, eg.
+	  '/root/named.conf', to use with the 'named -c' option,
+	  do:
+	  <informalexample>
+	    <programlisting>
+# chcon system_u:object_r:named_conf_t /root/named.conf
+	    </programlisting>
+	  </informalexample>
+	</para>
+  
+	<para>
+	  To create a custom modifiable named data location, eg.
+	  '/var/log/named' for a log file, do:
+	  <informalexample>
+	    <programlisting>
+# chcon system_u:object_r:named_cache_t /var/log/named
+	    </programlisting>
+	  </informalexample>
+	</para>
+   
+	<para>
+   To create a custom zone file location, eg. /root/zones/, do:
+	  <informalexample>
+	    <programlisting>
+# chcon system_u:object_r:named_zone_t /root/zones/{.,*}
+	    </programlisting>
+	  </informalexample>
+	</para>
+  
+	<para>
+	  See these man-pages for more information : selinux(8),
+	  named_selinux(8), chcon(1), setsebool(8)
+	</para>
+      </answer>
+    </qandaentry>
   </qandaset>
 </article>

contrib/bind9/Makefile.in

@@ -1,4 +1,4 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.41.2.2.2.2 2004/03/08 04:04:12 marka Exp $
+# $Id: Makefile.in,v 1.41.2.2.2.4 2006/05/19 00:04:00 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -44,7 +44,8 @@ maintainer-clean::
 	rm -f configure
 
 installdirs:
-	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir}
+	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${bindir} \
+	${DESTDIR}${localstatedir}/run ${DESTDIR}${sysconfdir}
 
 install:: isc-config.sh installdirs
 	${INSTALL_SCRIPT} isc-config.sh ${DESTDIR}${bindir}

contrib/bind9/README

@@ -194,6 +194,9 @@ BIND 9.2.0
 
 		--with-libtool does not work on AIX.
 
+		--with-libtool does not work on SunOS 4.  configure
+		requires "printf" which is not available.
+
 	A bug in the Windows 2000 DNS server can cause zone transfers
 	from a BIND 9 server to a W2K server to fail.  For details,
 	see the "Zone Transfers" section in doc/misc/migration.
@@ -226,7 +229,7 @@ Building
 	        Red Hat Linux 7.1
 		Debian GNU/Linux 2.2 and 3.0
 		Mandrake 8.1
-		OpenBSD 2.6, 2.8, 2.9
+		OpenBSD 2.6, 2.8, 2.9, 3.1, 3.6, 3.8
 		UnixWare 7.1.1
 		HP-UX 10.20
 		BSD/OS 4.2
@@ -265,10 +268,23 @@ Building
 		Enable DNSSEC signature chasing support in dig.
 		  -DDIG_SIGCHASE=1 (sets -DDIG_SIGCHASE_TD=1 and
 				    -DDIG_SIGCHASE_BU=1)
+		Disable dropping queries from particular well known ports.
+		  -DNS_CLIENT_DROPPORT=0
 
 	    LDFLAGS
 		Linker flags. Defaults to empty string.
 
+	The following need to be set when cross compiling.
+
+	    BUILD_CC
+		The native C compiler.
+	    BUILD_CFLAGS (optional)
+	    BUILD_CPPFLAGS (optional)
+		Possible Settings:
+		-DNEED_OPTARG=1		(optarg is not declared in <unistd.h>)
+	    BUILD_LDFLAGS (optional)
+	    BUILD_LIBS (optional)
+
 	To build shared libraries, specify "--with-libtool" on the
 	configure command line.
 

contrib/bind9/bin/check/named-checkconf.8

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named-checkconf.8,v 1.11.12.7 2005/10/13 02:33:41 marka Exp $
+.\" $Id: named-checkconf.8,v 1.11.12.8 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: named\-checkconf
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 14, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NAMED\-CHECKCONF" "8" "June 14, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -36,24 +39,24 @@ named\-checkconf \- named configuration file syntax checking tool
 \fBnamed\-checkconf\fR
 checks the syntax, but not the semantics, of a named configuration file.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-t \fIdirectory\fR
 chroot to
 \fIdirectory\fR
 so that include directives in the configuration file are processed as if run by a similarly chrooted named.
-.TP
+.TP 3n
 \-v
 Print the version of the
 \fBnamed\-checkconf\fR
 program and exit.
-.TP
+.TP 3n
 \-z
 Perform a check load the master zonefiles found in
 \fInamed.conf\fR.
-.TP
+.TP 3n
 \-j
 When loading a zonefile read the journal if it exists.
-.TP
+.TP 3n
 filename
 The name of the configuration file to be checked. If not specified, it defaults to
 \fI/etc/named.conf\fR.
@@ -68,3 +71,5 @@ BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/check/named-checkconf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named-checkconf.c,v 1.12.12.9 2005/03/03 06:33:38 marka Exp $ */
+/* $Id: named-checkconf.c,v 1.12.12.11 2006/03/02 00:37:20 marka Exp $ */
 
 #include <config.h>
 
@@ -60,9 +60,9 @@ usage(void) {
 }
 
 static isc_result_t
-directory_callback(const char *clausename, cfg_obj_t *obj, void *arg) {
+directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	isc_result_t result;
-	char *directory;
+	const char *directory;
 
 	REQUIRE(strcasecmp("directory", clausename) == 0);
 
@@ -85,18 +85,18 @@ directory_callback(const char *clausename, cfg_obj_t *obj, void *arg) {
 }
 
 static isc_result_t
-configure_zone(const char *vclass, const char *view, cfg_obj_t *zconfig,
+configure_zone(const char *vclass, const char *view,
-	       isc_mem_t *mctx)
+	       const cfg_obj_t *zconfig, isc_mem_t *mctx)
 {
 	isc_result_t result;
 	const char *zclass;
 	const char *zname;
 	const char *zfile;
-	cfg_obj_t *zoptions = NULL;
+	const cfg_obj_t *zoptions = NULL;
-	cfg_obj_t *classobj = NULL;
+	const cfg_obj_t *classobj = NULL;
-	cfg_obj_t *typeobj = NULL;
+	const cfg_obj_t *typeobj = NULL;
-	cfg_obj_t *fileobj = NULL;
+	const cfg_obj_t *fileobj = NULL;
-	cfg_obj_t *dbobj = NULL;
+	const cfg_obj_t *dbobj = NULL;
 
 	zname = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
 	classobj = cfg_tuple_get(zconfig, "class");
@@ -125,12 +125,12 @@ configure_zone(const char *vclass, const char *view, cfg_obj_t *zconfig,
 }
 
 static isc_result_t
-configure_view(const char *vclass, const char *view, cfg_obj_t *config,
+configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
-	       cfg_obj_t *vconfig, isc_mem_t *mctx)
+	       const cfg_obj_t *vconfig, isc_mem_t *mctx)
 {
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
-	cfg_obj_t *voptions;
+	const cfg_obj_t *voptions;
-	cfg_obj_t *zonelist;
+	const cfg_obj_t *zonelist;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
 
@@ -148,7 +148,7 @@ configure_view(const char *vclass, const char *view, cfg_obj_t *config,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *zconfig = cfg_listelt_value(element);
+		const cfg_obj_t *zconfig = cfg_listelt_value(element);
 		tresult = configure_zone(vclass, view, zconfig, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = tresult;
@@ -158,11 +158,11 @@ configure_view(const char *vclass, const char *view, cfg_obj_t *config,
 
 
 static isc_result_t
-load_zones_fromconfig(cfg_obj_t *config, isc_mem_t *mctx) {
+load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx) {
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
-	cfg_obj_t *classobj;
+	const cfg_obj_t *classobj;
-	cfg_obj_t *views;
+	const cfg_obj_t *views;
-	cfg_obj_t *vconfig;
+	const cfg_obj_t *vconfig;
 	const char *vclass;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;

contrib/bind9/bin/check/named-checkconf.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named-checkconf.html,v 1.5.2.1.4.12 2005/10/13 02:33:42 marka Exp $ -->
+<!-- $Id: named-checkconf.html,v 1.5.2.1.4.15 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named-checkconf</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">named-checkconf</span> &#8212; named configuration file syntax checking tool</p>
@@ -32,14 +32,14 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkconf</code>  [<code class="option">-v</code>] [<code class="option">-j</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] {filename} [<code class="option">-z</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525865"></a><h2>DESCRIPTION</h2>
+<a name="id2549430"></a><h2>DESCRIPTION</h2>
 <p>
         <span><strong class="command">named-checkconf</strong></span> checks the syntax, but not
 	the semantics, of a named configuration file.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525878"></a><h2>OPTIONS</h2>
+<a name="id2549443"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>
 <dd><p>
@@ -69,21 +69,21 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525970"></a><h2>RETURN VALUES</h2>
+<a name="id2549534"></a><h2>RETURN VALUES</h2>
 <p>
         <span><strong class="command">named-checkconf</strong></span> returns an exit status of 1 if
 	errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525982"></a><h2>SEE ALSO</h2>
+<a name="id2549547"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526006"></a><h2>AUTHOR</h2>
+<a name="id2549639"></a><h2>AUTHOR</h2>
 <p>
         <span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/check/named-checkzone.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named-checkzone.8,v 1.11.2.1.8.8 2005/10/13 02:33:41 marka Exp $
+.\" $Id: named-checkzone.8,v 1.11.2.1.8.11 2006/10/05 02:50:17 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: named\-checkzone
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 13, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NAMED\-CHECKZONE" "8" "June 13, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -40,61 +43,61 @@ does when loading a zone. This makes
 \fBnamed\-checkzone\fR
 useful for checking zone files before configuring them into a name server.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-d
 Enable debugging.
-.TP
+.TP 3n
 \-q
 Quiet mode \- exit code only.
-.TP
+.TP 3n
 \-v
 Print the version of the
 \fBnamed\-checkzone\fR
 program and exit.
-.TP
+.TP 3n
 \-j
 When loading the zone file read the journal if it exists.
-.TP
+.TP 3n
 \-c \fIclass\fR
 Specify the class of the zone. If not specified "IN" is assumed.
-.TP
+.TP 3n
 \-k \fImode\fR
 Perform
-\fB"check\-name"\fR
+\fB"check\-names"\fR
 checks with the specified failure mode. Possible modes are
 \fB"fail"\fR,
 \fB"warn"\fR
 (default) and
 \fB"ignore"\fR.
-.TP
+.TP 3n
 \-n \fImode\fR
 Specify whether NS records should be checked to see if they are addresses. Possible modes are
 \fB"fail"\fR,
 \fB"warn"\fR
 (default) and
 \fB"ignore"\fR.
-.TP
+.TP 3n
 \-o \fIfilename\fR
 Write zone output to
 \fIfilename\fR.
-.TP
+.TP 3n
 \-t \fIdirectory\fR
 chroot to
 \fIdirectory\fR
 so that include directives in the configuration file are processed as if run by a similarly chrooted named.
-.TP
+.TP 3n
 \-w \fIdirectory\fR
 chdir to
 \fIdirectory\fR
 so that relative filenames in master file $INCLUDE directives work. This is similar to the directory clause in
 \fInamed.conf\fR.
-.TP
+.TP 3n
 \-D
 Dump zone file in canonical format.
-.TP
+.TP 3n
 zonename
 The domain name of the zone being checked.
-.TP
+.TP 3n
 filename
 The name of the zone file.
 .SH "RETURN VALUES"
@@ -109,3 +112,5 @@ BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/check/named-checkzone.docbook

@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named-checkzone.docbook,v 1.3.2.2.8.11 2005/05/12 21:35:57 sra Exp $ -->
+<!-- $Id: named-checkzone.docbook,v 1.3.2.2.8.13 2006/09/30 23:58:36 marka Exp $ -->
 
 <refentry>
   <refentryinfo>
@@ -35,6 +35,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2006</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -134,7 +135,7 @@
         <term>-k <replaceable class="parameter">mode</replaceable></term>
 	<listitem>
 	  <para>
-	      Perform <command>"check-name"</command> checks with the specified failure mode.
+	      Perform <command>"check-names"</command> checks with the specified failure mode.
 	      Possible modes are <command>"fail"</command>,
 	      <command>"warn"</command> (default) and
 	      <command>"ignore"</command>.

contrib/bind9/bin/check/named-checkzone.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2002 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named-checkzone.html,v 1.5.2.2.4.13 2005/10/13 02:33:42 marka Exp $ -->
+<!-- $Id: named-checkzone.html,v 1.5.2.2.4.17 2006/10/05 02:50:17 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named-checkzone</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">named-checkzone</span> &#8212; zone file validity checking tool</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">named-checkzone</code>  [<code class="option">-d</code>] [<code class="option">-j</code>] [<code class="option">-q</code>] [<code class="option">-v</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-k <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-n <em class="replaceable"><code>mode</code></em></code>] [<code class="option">-o <em class="replaceable"><code>filename</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-w <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-D</code>] {zonename} {filename}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525922"></a><h2>DESCRIPTION</h2>
+<a name="id2549490"></a><h2>DESCRIPTION</h2>
 <p>
         <span><strong class="command">named-checkzone</strong></span> checks the syntax and integrity of
 	a zone file.  It performs the same checks as <span><strong class="command">named</strong></span>
@@ -42,7 +42,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525942"></a><h2>OPTIONS</h2>
+<a name="id2549510"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-d</span></dt>
 <dd><p>
@@ -67,7 +67,7 @@
 	  </p></dd>
 <dt><span class="term">-k <em class="replaceable"><code>mode</code></em></span></dt>
 <dd><p>
-	      Perform <span><strong class="command">"check-name"</strong></span> checks with the specified failure mode.
+	      Perform <span><strong class="command">"check-names"</strong></span> checks with the specified failure mode.
 	      Possible modes are <span><strong class="command">"fail"</strong></span>,
 	      <span><strong class="command">"warn"</strong></span> (default) and
 	      <span><strong class="command">"ignore"</strong></span>.
@@ -111,14 +111,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526187"></a><h2>RETURN VALUES</h2>
+<a name="id2549824"></a><h2>RETURN VALUES</h2>
 <p>
         <span><strong class="command">named-checkzone</strong></span> returns an exit status of 1 if
 	errors were detected and 0 otherwise.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526200"></a><h2>SEE ALSO</h2>
+<a name="id2549836"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <em class="citetitle">RFC 1035</em>,
@@ -126,7 +126,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526227"></a><h2>AUTHOR</h2>
+<a name="id2549863"></a><h2>AUTHOR</h2>
 <p>
         <span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/dig/dig.1

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dig.1,v 1.14.2.4.2.10 2005/10/13 02:33:42 marka Exp $
+.\" $Id: dig.1,v 1.14.2.4.2.11 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: dig
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "DIG" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -68,12 +71,14 @@ A typical invocation of
 \fBdig\fR
 looks like:
 .sp
+.RS 3n
 .nf
  dig @server name type 
 .fi
+.RE
 .sp
 where:
-.TP
+.TP 3n
 \fBserver\fR
 is the name or IP address of the name server to query. This can be an IPv4 address in dotted\-decimal notation or an IPv6 address in colon\-delimited notation. When the supplied
 \fIserver\fR
@@ -86,10 +91,10 @@ argument is provided,
 consults
 \fI/etc/resolv.conf\fR
 and queries the name servers listed there. The reply from the name server that responds is displayed.
-.TP
+.TP 3n
 \fBname\fR
 is the name of the resource record that is to be looked up.
-.TP
+.TP 3n
 \fBtype\fR
 indicates what type of query is required \(em ANY, A, MX, SIG, etc.
 \fItype\fR
@@ -197,18 +202,18 @@ Each query option is identified by a keyword preceded by a plus sign (+). Some k
 no
 to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form
 \fB+keyword=value\fR. The query options are:
-.TP
+.TP 3n
 \fB+[no]tcp\fR
 Use [do not use] TCP when querying name servers. The default behaviour is to use UDP unless an AXFR or IXFR query is requested, in which case a TCP connection is used.
-.TP
+.TP 3n
 \fB+[no]vc\fR
 Use [do not use] TCP when querying name servers. This alternate syntax to
 \fI+[no]tcp\fR
 is provided for backwards compatibility. The "vc" stands for "virtual circuit".
-.TP
+.TP 3n
 \fB+[no]ignore\fR
 Ignore truncation in UDP responses instead of retrying with TCP. By default, TCP retries are performed.
-.TP
+.TP 3n
 \fB+domain=somename\fR
 Set the search list to contain the single domain
 \fIsomename\fR, as if specified in a
@@ -217,35 +222,35 @@ directive in
 \fI/etc/resolv.conf\fR, and enable search list processing as if the
 \fI+search\fR
 option were given.
-.TP
+.TP 3n
 \fB+[no]search\fR
 Use [do not use] the search list defined by the searchlist or domain directive in
 \fIresolv.conf\fR
 (if any). The search list is not used by default.
-.TP
+.TP 3n
 \fB+[no]defname\fR
 Deprecated, treated as a synonym for
 \fI+[no]search\fR
-.TP
+.TP 3n
 \fB+[no]aaonly\fR
 Sets the "aa" flag in the query.
-.TP
+.TP 3n
 \fB+[no]aaflag\fR
 A synonym for
 \fI+[no]aaonly\fR.
-.TP
+.TP 3n
 \fB+[no]adflag\fR
 Set [do not set] the AD (authentic data) bit in the query. The AD bit currently has a standard meaning only in responses, not in queries, but the ability to set the bit in the query is provided for completeness.
-.TP
+.TP 3n
 \fB+[no]cdflag\fR
 Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
-.TP
+.TP 3n
 \fB+[no]cl\fR
 Display [do not display] the CLASS when printing the record.
-.TP
+.TP 3n
 \fB+[no]ttlid\fR
 Display [do not display] the TTL when printing the record.
-.TP
+.TP 3n
 \fB+[no]recurse\fR
 Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means
 \fBdig\fR
@@ -254,74 +259,74 @@ normally sends recursive queries. Recursion is automatically disabled when the
 or
 \fI+trace\fR
 query options are used.
-.TP
+.TP 3n
 \fB+[no]nssearch\fR
 When this option is set,
 \fBdig\fR
 attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone.
-.TP
+.TP 3n
 \fB+[no]trace\fR
 Toggle tracing of the delegation path from the root name servers for the name being looked up. Tracing is disabled by default. When tracing is enabled,
 \fBdig\fR
 makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
-.TP
+.TP 3n
 \fB+[no]cmd\fR
 toggles the printing of the initial comment in the output identifying the version of
 \fBdig\fR
 and the query options that have been applied. This comment is printed by default.
-.TP
+.TP 3n
 \fB+[no]short\fR
 Provide a terse answer. The default is to print the answer in a verbose form.
-.TP
+.TP 3n
 \fB+[no]identify\fR
 Show [or do not show] the IP address and port number that supplied the answer when the
 \fI+short\fR
 option is enabled. If short form answers are requested, the default is not to show the source address and port number of the server that provided the answer.
-.TP
+.TP 3n
 \fB+[no]comments\fR
 Toggle the display of comment lines in the output. The default is to print comments.
-.TP
+.TP 3n
 \fB+[no]stats\fR
 This query option toggles the printing of statistics: when the query was made, the size of the reply and so on. The default behaviour is to print the query statistics.
-.TP
+.TP 3n
 \fB+[no]qr\fR
 Print [do not print] the query as it is sent. By default, the query is not printed.
-.TP
+.TP 3n
 \fB+[no]question\fR
 Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
-.TP
+.TP 3n
 \fB+[no]answer\fR
 Display [do not display] the answer section of a reply. The default is to display it.
-.TP
+.TP 3n
 \fB+[no]authority\fR
 Display [do not display] the authority section of a reply. The default is to display it.
-.TP
+.TP 3n
 \fB+[no]additional\fR
 Display [do not display] the additional section of a reply. The default is to display it.
-.TP
+.TP 3n
 \fB+[no]all\fR
 Set or clear all display flags.
-.TP
+.TP 3n
 \fB+time=T\fR
 Sets the timeout for a query to
 \fIT\fR
 seconds. The default time out is 5 seconds. An attempt to set
 \fIT\fR
 to less than 1 will result in a query timeout of 1 second being applied.
-.TP
+.TP 3n
 \fB+tries=T\fR
 Sets the number of times to try UDP queries to server to
 \fIT\fR
 instead of the default, 3. If
 \fIT\fR
 is less than or equal to zero, the number of tries is silently rounded up to 1.
-.TP
+.TP 3n
 \fB+retry=T\fR
 Sets the number of times to retry UDP queries to server to
 \fIT\fR
 instead of the default, 2. Unlike
 \fI+tries\fR, this does not include the initial query.
-.TP
+.TP 3n
 \fB+ndots=D\fR
 Set the number of dots that have to appear in
 \fIname\fR
@@ -334,29 +339,29 @@ or
 \fBdomain\fR
 directive in
 \fI/etc/resolv.conf\fR.
-.TP
+.TP 3n
 \fB+bufsize=B\fR
 Set the UDP message buffer size advertised using EDNS0 to
 \fIB\fR
 bytes. The maximum and minimum sizes of this buffer are 65535 and 0 respectively. Values outside this range are rounded up or down appropriately.
-.TP
+.TP 3n
 \fB+[no]multiline\fR
 Print records like the SOA records in a verbose multi\-line format with human\-readable comments. The default is to print each record on a single line, to facilitate machine parsing of the
 \fBdig\fR
 output.
-.TP
+.TP 3n
 \fB+[no]fail\fR
 Do not try the next server if you receive a SERVFAIL. The default is to not try the next server which is the reverse of normal stub resolver behaviour.
-.TP
+.TP 3n
 \fB+[no]besteffort\fR
 Attempt to display the contents of messages which are malformed. The default is to not display malformed answers.
-.TP
+.TP 3n
 \fB+[no]dnssec\fR
 Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO) in the OPT record in the additional section of the query.
-.TP
+.TP 3n
 \fB+[no]sigchase\fR
 Chase DNSSEC signature chains. Requires dig be compiled with \-DDIG_SIGCHASE.
-.TP
+.TP 3n
 \fB+trusted\-key=####\fR
 Specifies a file containing trusted keys to be used with
 \fB+sigchase\fR. Each DNSKEY record must be on its own line.
@@ -370,7 +375,7 @@ then
 in the current directory.
 .sp
 Requires dig be compiled with \-DDIG_SIGCHASE.
-.TP
+.TP 3n
 \fB+[no]topdown\fR
 When chasing DNSSEC signature chains perform a top down validation. Requires dig be compiled with \-DDIG_SIGCHASE.
 .SH "MULTIPLE QUERIES"
@@ -389,9 +394,11 @@ A global set of query options, which should be applied to all queries, can also
 \fB+[no]cmd\fR
 option) can be overridden by a query\-specific set of query options. For example:
 .sp
+.RS 3n
 .nf
 dig +qr www.isc.org any \-x 127.0.0.1 isc.org ns +noqr
 .fi
+.RE
 .sp
 shows how
 \fBdig\fR
@@ -421,3 +428,5 @@ RFC1035.
 .SH "BUGS "
 .PP
 There are probably too many query options.
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/dig/dig.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dig.c,v 1.157.2.13.2.29 2005/10/14 01:38:40 marka Exp $ */
+/* $Id: dig.c,v 1.157.2.13.2.31 2006/07/22 23:52:57 marka Exp $ */
 
 #include <config.h>
 #include <stdlib.h>
@@ -1437,7 +1437,7 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			 * Anything which isn't an option
 			 */
 			if (open_type_class) {
-				if (strncmp(rv[0], "ixfr=", 5) == 0) {
+				if (strncasecmp(rv[0], "ixfr=", 5) == 0) {
 					rdtype = dns_rdatatype_ixfr;
 					result = ISC_R_SUCCESS;
 				} else {

contrib/bind9/bin/dig/dig.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dig.html,v 1.6.2.4.2.13 2005/10/13 02:33:43 marka Exp $ -->
+<!-- $Id: dig.html,v 1.6.2.4.2.15 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dig</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>dig &#8212; DNS lookup utility</p>
@@ -34,7 +34,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525976"></a><h2>DESCRIPTION</h2>
+<a name="id2549541"></a><h2>DESCRIPTION</h2>
 <p>
 <span><strong class="command">dig</strong></span> (domain information groper) is a flexible tool
 for interrogating DNS name servers.  It performs DNS lookups and
@@ -69,7 +69,7 @@ are applied before the command line arguments.
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526035"></a><h2>SIMPLE USAGE</h2>
+<a name="id2549600"></a><h2>SIMPLE USAGE</h2>
 <p>
 A typical invocation of <span><strong class="command">dig</strong></span> looks like:
 </p>
@@ -107,7 +107,7 @@ ANY, A, MX, SIG, etc.
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526114"></a><h2>OPTIONS</h2>
+<a name="id2549747"></a><h2>OPTIONS</h2>
 <p>
 The <code class="option">-b</code> option sets the source IP address of the query
 to <em class="parameter"><code>address</code></em>.  This must be a valid address on
@@ -188,7 +188,7 @@ being used.  In BIND, this is done by providing appropriate
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526365"></a><h2>QUERY OPTIONS</h2>
+<a name="id2549998"></a><h2>QUERY OPTIONS</h2>
 <p>
 <span><strong class="command">dig</strong></span> provides a number of query options which affect
 the way in which lookups are made and the results displayed.  Some of
@@ -446,7 +446,7 @@ Requires dig be compiled with -DDIG_SIGCHASE.
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527033"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2550666"></a><h2>MULTIPLE QUERIES</h2>
 <p>
 The BIND 9 implementation of <span><strong class="command">dig </strong></span> supports
 specifying multiple queries on the command line (in addition to
@@ -487,7 +487,7 @@ will not print the initial query when it looks up the NS records for
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527092"></a><h2>FILES</h2>
+<a name="id2550725"></a><h2>FILES</h2>
 <p>
 <code class="filename">/etc/resolv.conf</code>
 </p>
@@ -496,7 +496,7 @@ will not print the initial query when it looks up the NS records for
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527111"></a><h2>SEE ALSO</h2>
+<a name="id2550744"></a><h2>SEE ALSO</h2>
 <p>
 <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
 <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -505,7 +505,7 @@ will not print the initial query when it looks up the NS records for
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527149"></a><h2>BUGS </h2>
+<a name="id2550782"></a><h2>BUGS </h2>
 <p>
 There are probably too many query options. 
 </p>

contrib/bind9/bin/dig/dighost.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dighost.c,v 1.221.2.19.2.31 2005/10/14 01:38:40 marka Exp $ */
+/* $Id: dighost.c,v 1.221.2.19.2.36 2006/12/07 01:26:33 marka Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -314,6 +314,9 @@ cancel_lookup(dig_lookup_t *lookup);
 static void
 recv_done(isc_task_t *task, isc_event_t *event);
 
+static void
+send_udp(dig_query_t *query);
+
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event);
 
@@ -945,9 +948,8 @@ setup_system(void) {
 	if (lwresult != LWRES_R_SUCCESS)
 		fatal("lwres_context_create failed");
 
-	if (isc_file_exists(RESOLV_CONF))
+	lwresult = lwres_conf_parse(lwctx, RESOLV_CONF);
-		lwresult = lwres_conf_parse(lwctx, RESOLV_CONF);
+	if (lwresult != LWRES_R_SUCCESS && lwresult != LWRES_R_NOTFOUND)
-	if (lwresult != LWRES_R_SUCCESS)
 		fatal("parse of %s failed", RESOLV_CONF);
 
 	lwconf = lwres_conf_get(lwctx);
@@ -1194,7 +1196,10 @@ clear_query(dig_query_t *query) {
 	isc_mempool_put(commctx, query->recvspace);
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_invalidate(&query->lengthbuf);
-	isc_mem_free(mctx, query);
+	if (query->waiting_senddone)
+		query->pending_free = ISC_TRUE;
+	else
+		isc_mem_free(mctx, query);
 }
 
 /*
@@ -1219,9 +1224,10 @@ try_clear_lookup(dig_lookup_t *lookup) {
 				debug("query to %s still pending", q->servname);
 				q = ISC_LIST_NEXT(q, link);
 			}
-			return (ISC_FALSE);
 		}
+		return (ISC_FALSE);
 	}
+
 	/*
 	 * At this point, we know there are no queries on the lookup,
 	 * so can make it go away also.
@@ -1254,7 +1260,6 @@ try_clear_lookup(dig_lookup_t *lookup) {
 	return (ISC_TRUE);
 }
 
-
 /*
  * If we can, start the next lookup in the queue running.
  * This assumes that the lookup on the head of the queue hasn't been
@@ -1784,9 +1789,9 @@ setup_lookup(dig_lookup_t *lookup) {
 	check_result(result, "dns_compress_init");
 
 	debug("starting to render the message");
-	isc_buffer_init(&lookup->sendbuf, lookup->sendspace, COMMSIZE);
+	isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
 	result = dns_message_renderbegin(lookup->sendmsg, &cctx,
-					 &lookup->sendbuf);
+					 &lookup->renderbuf);
 	check_result(result, "dns_message_renderbegin");
 	if (lookup->udpsize > 0 || lookup->dnssec) {
 		if (lookup->udpsize == 0)
@@ -1809,7 +1814,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	/*
 	 * Force TCP mode if the request is larger than 512 bytes.
 	 */
-	if (isc_buffer_usedlength(&lookup->sendbuf) > 512)
+	if (isc_buffer_usedlength(&lookup->renderbuf) > 512)
 		lookup->tcp_mode = ISC_TRUE;
 
 	lookup->pending = ISC_FALSE;
@@ -1825,6 +1830,8 @@ setup_lookup(dig_lookup_t *lookup) {
 		       query, lookup);
 		query->lookup = lookup;
 		query->waiting_connect = ISC_FALSE;
+		query->waiting_senddone = ISC_FALSE;
+		query->pending_free = ISC_FALSE;
 		query->recv_made = ISC_FALSE;
 		query->first_pass = ISC_TRUE;
 		query->first_soa_rcvd = ISC_FALSE;
@@ -1848,6 +1855,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
 		isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
 		isc_buffer_init(&query->slbuf, query->slspace, 2);
+		query->sendbuf = lookup->renderbuf;
 
 		ISC_LINK_INIT(query, link);
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
@@ -1865,18 +1873,43 @@ setup_lookup(dig_lookup_t *lookup) {
  */
 static void
 send_done(isc_task_t *_task, isc_event_t *event) {
+	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
+	isc_buffer_t *b = NULL;
+	dig_query_t *query, *next;
+	dig_lookup_t *l;
+
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_SENDDONE);
 
 	UNUSED(_task);
 
 	LOCK_LOOKUP;
 
-	isc_event_free(&event);
-
 	debug("send_done()");
 	sendcount--;
 	debug("sendcount=%d", sendcount);
 	INSIST(sendcount >= 0);
+
+	for  (b = ISC_LIST_HEAD(sevent->bufferlist);
+	      b != NULL;
+	      b = ISC_LIST_HEAD(sevent->bufferlist)) 
+		ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+
+	query = event->ev_arg;
+	query->waiting_senddone = ISC_FALSE;
+	l = query->lookup;
+
+	if (l->ns_search_only && !l->trace_root) {
+		debug("sending next, since searching");
+		next = ISC_LIST_NEXT(query, link);
+		if (next != NULL)
+			send_udp(next);
+	}
+
+	isc_event_free(&event);
+
+	if (query->pending_free)
+		isc_mem_free(mctx, query);
+
 	check_if_done();
 	UNLOCK_LOOKUP;
 }
@@ -2020,7 +2053,6 @@ send_tcp_connect(dig_query_t *query) {
 static void
 send_udp(dig_query_t *query) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *next;
 	isc_result_t result;
 
 	debug("send_udp(%p)", query);
@@ -2062,27 +2094,16 @@ send_udp(dig_query_t *query) {
 		debug("recvcount=%d", recvcount);
 	}
 	ISC_LIST_INIT(query->sendlist);
-	ISC_LINK_INIT(&l->sendbuf, link);
+	ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
-	ISC_LIST_ENQUEUE(query->sendlist, &l->sendbuf,
-			 link);
 	debug("sending a request");
 	TIME_NOW(&query->time_sent);
 	INSIST(query->sock != NULL);
+	query->waiting_senddone = ISC_TRUE;
 	result = isc_socket_sendtov(query->sock, &query->sendlist,
 				    global_task, send_done, query,
 				    &query->sockaddr, NULL);
 	check_result(result, "isc_socket_sendtov");
 	sendcount++;
-	/*
-	 * If we're at the endgame of a nameserver search, we need to
-	 * immediately bring up all the queries.  Do it here.
-	 */
-	if (l->ns_search_only && !l->trace_root) {
-		debug("sending next, since searching");
-		next = ISC_LIST_NEXT(query, link);
-		if (next != NULL)
-			send_udp(next);
-	}
 }
 
 /*
@@ -2171,6 +2192,10 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	recvcount--;
 	INSIST(recvcount >= 0);
 
+	b = ISC_LIST_HEAD(sevent->bufferlist);
+	INSIST(b ==  &query->lengthbuf);
+	ISC_LIST_DEQUEUE(sevent->bufferlist, b, link);
+
 	if (sevent->result == ISC_R_CANCELED) {
 		isc_event_free(&event);
 		l = query->lookup;
@@ -2196,8 +2221,6 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
-	b = ISC_LIST_HEAD(sevent->bufferlist);
-	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->lengthbuf, link);
 	length = isc_buffer_getuint16(b);
 	if (length == 0) {
 		isc_event_free(&event);
@@ -2254,16 +2277,12 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 
 	isc_buffer_clear(&query->slbuf);
 	isc_buffer_clear(&query->lengthbuf);
-	isc_buffer_putuint16(&query->slbuf,
+	isc_buffer_putuint16(&query->slbuf, (isc_uint16_t) query->sendbuf.used);
-			     (isc_uint16_t) query->lookup->sendbuf.used);
 	ISC_LIST_INIT(query->sendlist);
 	ISC_LINK_INIT(&query->slbuf, link);
 	ISC_LIST_ENQUEUE(query->sendlist, &query->slbuf, link);
-	if (include_question) {
+	if (include_question)
-		ISC_LINK_INIT(&query->lookup->sendbuf, link);
+		ISC_LIST_ENQUEUE(query->sendlist, &query->sendbuf, link);
-		ISC_LIST_ENQUEUE(query->sendlist, &query->lookup->sendbuf,
-				 link);
-	}
 	ISC_LINK_INIT(&query->lengthbuf, link);
 	ISC_LIST_ENQUEUE(query->lengthlist, &query->lengthbuf, link);
 
@@ -2275,6 +2294,7 @@ launch_next_query(dig_query_t *query, isc_boolean_t include_question) {
 	if (!query->first_soa_rcvd) {
 		debug("sending a request in launch_next_query");
 		TIME_NOW(&query->time_sent);
+		query->waiting_senddone = ISC_TRUE;
 		result = isc_socket_sendv(query->sock, &query->sendlist,
 					  global_task, send_done, query);
 		check_result(result, "isc_socket_sendv");
@@ -2558,6 +2578,10 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	REQUIRE(event->ev_type == ISC_SOCKEVENT_RECVDONE);
 	sevent = (isc_socketevent_t *)event;
 
+	b = ISC_LIST_HEAD(sevent->bufferlist);
+	INSIST(b == &query->recvbuf);
+	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
+
 	if ((l->tcp_mode) && (l->timer != NULL))
 		isc_timer_touch(l->timer);
 	if ((!l->pending && !l->ns_search_only) || cancel_now) {
@@ -2591,9 +2615,6 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 		return;
 	}
 
-	b = ISC_LIST_HEAD(sevent->bufferlist);
-	ISC_LIST_DEQUEUE(sevent->bufferlist, &query->recvbuf, link);
-
 	if (!l->tcp_mode &&
 	    !isc_sockaddr_equal(&sevent->address, &query->sockaddr)) {
 		char buf1[ISC_SOCKADDR_FORMATSIZE];

contrib/bind9/bin/dig/host.1

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: host.1,v 1.11.2.1.4.7 2005/10/13 02:33:43 marka Exp $
+.\" $Id: host.1,v 1.11.2.1.4.8 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: host
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "HOST" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -183,3 +186,5 @@ will effectively wait forever for a reply. The time to wait for a response will
 .PP
 \fBdig\fR(1),
 \fBnamed\fR(8).
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/dig/host.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: host.c,v 1.76.2.5.2.13 2005/07/04 03:29:45 marka Exp $ */
+/* $Id: host.c,v 1.76.2.5.2.16 2006/05/23 04:43:47 marka Exp $ */
 
 #include <config.h>
 #include <limits.h>
@@ -37,6 +37,7 @@
 #include <dns/rdataclass.h>
 #include <dns/rdataset.h>
 #include <dns/rdatatype.h>
+#include <dns/rdatastruct.h>
 
 #include <dig/dig.h>
 
@@ -45,6 +46,7 @@ static isc_boolean_t default_lookups = ISC_TRUE;
 static int seen_error = -1;
 static isc_boolean_t list_addresses = ISC_TRUE;
 static dns_rdatatype_t list_type = dns_rdatatype_a;
+static isc_boolean_t printed_server = ISC_FALSE;
 
 static const char *opcodetext[] = {
 	"QUERY",
@@ -351,6 +353,32 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset, dns_name_t *owner,
 	return (ISC_R_SUCCESS);
 }
 
+static void
+chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
+	isc_result_t result;
+	dns_rdataset_t *rdataset;
+	dns_rdata_cname_t cname;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	unsigned int i = msg->counts[DNS_SECTION_ANSWER];
+
+ 	while (i-- > 0) {
+		rdataset = NULL;
+		result = dns_message_findname(msg, DNS_SECTION_ANSWER, qname,
+					      dns_rdatatype_cname, 0, NULL,
+					      &rdataset);
+		if (result != ISC_R_SUCCESS)
+			return;
+		result = dns_rdataset_first(rdataset);
+		check_result(result, "dns_rdataset_first");
+		dns_rdata_reset(&rdata);
+		dns_rdataset_current(rdataset, &rdata);
+		result = dns_rdata_tostruct(&rdata, &cname, NULL);
+		check_result(result, "dns_rdata_tostruct");
+		dns_name_copy(&cname.cname, qname, NULL);
+		dns_rdata_freestruct(&cname);
+	}
+}
+
 isc_result_t
 printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	isc_boolean_t did_flag = ISC_FALSE;
@@ -367,7 +395,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	 */
 	force_error = (seen_error == 1) ? 1 : 0;
 	seen_error = 1;
-	if (listed_server) {
+	if (listed_server && !printed_server) {
 		char sockstr[ISC_SOCKADDR_FORMATSIZE];
 
 		printf("Using domain server:\n");
@@ -376,6 +404,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 				    sizeof(sockstr));
 		printf("Address: %s\n", sockstr);
 		printf("Aliases: \n\n");
+		printed_server = ISC_TRUE;
 	}
 
 	if (msg->rcode != 0) {
@@ -389,10 +418,15 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
 		char namestr[DNS_NAME_FORMATSIZE];
 		dig_lookup_t *lookup;
+		dns_fixedname_t fixed;
+		dns_name_t *name;
 
 		/* Add AAAA and MX lookups. */
-
+		dns_fixedname_init(&fixed);
-		dns_name_format(query->lookup->name, namestr, sizeof(namestr));
+		name = dns_fixedname_name(&fixed);
+		dns_name_copy(query->lookup->name, name, NULL);
+		chase_cnamechain(msg, name);
+		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
 			strncpy(lookup->textname, namestr,

contrib/bind9/bin/dig/host.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: host.html,v 1.4.2.1.4.12 2005/10/13 02:33:44 marka Exp $ -->
+<!-- $Id: host.html,v 1.4.2.1.4.14 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>host</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>host &#8212; DNS lookup utility</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">host</code>  [<code class="option">-aCdlnrTwv</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-N <em class="replaceable"><code>ndots</code></em></code>] [<code class="option">-R <em class="replaceable"><code>number</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-W <em class="replaceable"><code>wait</code></em></code>] [<code class="option">-4</code>] [<code class="option">-6</code>] {name} [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525901"></a><h2>DESCRIPTION</h2>
+<a name="id2549466"></a><h2>DESCRIPTION</h2>
 <p>
 <span><strong class="command">host</strong></span>
 is a simple utility for performing DNS lookups.
@@ -155,13 +155,13 @@ value for an integer quantity.
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526241"></a><h2>FILES</h2>
+<a name="id2549874"></a><h2>FILES</h2>
 <p>
 <code class="filename">/etc/resolv.conf</code>
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526253"></a><h2>SEE ALSO</h2>
+<a name="id2549886"></a><h2>SEE ALSO</h2>
 <p>
 <span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
 <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>.

contrib/bind9/bin/dig/include/dig/dig.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dig.h,v 1.71.2.6.2.11 2005/07/04 03:29:45 marka Exp $ */
+/* $Id: dig.h,v 1.71.2.6.2.14 2006/12/07 01:26:33 marka Exp $ */
 
 #ifndef DIG_H
 #define DIG_H
@@ -146,7 +146,7 @@ isc_boolean_t	sigchase;
 	char onamespace[BUFSIZE];
 	isc_buffer_t namebuf;
 	isc_buffer_t onamebuf;
-	isc_buffer_t sendbuf;
+	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
 	isc_timer_t *timer;
@@ -173,6 +173,8 @@ isc_boolean_t	sigchase;
 struct dig_query {
 	dig_lookup_t *lookup;
 	isc_boolean_t waiting_connect,
+		pending_free,
+		waiting_senddone,
 		first_pass,
 		first_soa_rcvd,
 		second_rr_rcvd,
@@ -198,6 +200,7 @@ struct dig_query {
 	ISC_LINK(dig_query_t) link;
 	isc_sockaddr_t sockaddr;
 	isc_time_t time_sent;
+	isc_buffer_t sendbuf;
 };
 
 struct dig_server {

contrib/bind9/bin/dig/nslookup.1

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,14 +12,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nslookup.1,v 1.1.6.5 2005/10/13 02:33:43 marka Exp $
+.\" $Id: nslookup.1,v 1.1.6.7 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: nslookup
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NSLOOKUP" "1" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -39,26 +42,28 @@ has two modes: interactive and non\-interactive. Interactive mode allows the use
 .SH "ARGUMENTS"
 .PP
 Interactive mode is entered in the following cases:
-.TP 3
+.TP 3n
 1.
 when no arguments are given (the default name server will be used)
-.TP
+.TP 3n
 2.
 when the first argument is a hyphen (\-) and the second argument is the host name or Internet address of a name server.
+.sp
+.RE
 .PP
 Non\-interactive mode is used when the name or Internet address of the host to be looked up is given as the first argument. The optional second argument specifies the host name or address of a name server.
 .PP
 Options can also be specified on the command line if they precede the arguments and are prefixed with a hyphen. For example, to change the default query type to host information, and the initial timeout to 10 seconds, type:
-.IP .sp .nf nslookup \-query=hinfo \-timeout=10 .fi
+.sp .RS 3n .nf nslookup \-query=hinfo \-timeout=10 .fi .RE
 .SH "INTERACTIVE COMMANDS"
-.TP
+.TP 3n
 host [server]
 Look up information for host using the current default server or using server, if specified. If host is an Internet address and the query type is A or PTR, the name of the host is returned. If host is a name and does not have a trailing period, the search list is used to qualify the name.
 .sp
 To look up a host not in the current domain, append a period to the name.
-.TP
+.TP 3n
 \fBserver\fR \fIdomain\fR
-.TP
+.TP 3n
 \fBlserver\fR \fIdomain\fR
 Change the default server to
 \fIdomain\fR;
@@ -67,107 +72,107 @@ uses the initial server to look up information about
 \fIdomain\fR, while
 \fBserver\fR
 uses the current default server. If an authoritative answer can't be found, the names of servers that might have the answer are returned.
-.TP
+.TP 3n
 \fBroot\fR
 not implemented
-.TP
+.TP 3n
 \fBfinger\fR
 not implemented
-.TP
+.TP 3n
 \fBls\fR
 not implemented
-.TP
+.TP 3n
 \fBview\fR
 not implemented
-.TP
+.TP 3n
 \fBhelp\fR
 not implemented
-.TP
+.TP 3n
 \fB?\fR
 not implemented
-.TP
+.TP 3n
 \fBexit\fR
 Exits the program.
-.TP
+.TP 3n
 \fBset\fR \fIkeyword\fR\fI[=value]\fR
 This command is used to change state information that affects the lookups. Valid keywords are:
-.RS
+.RS 3n
-.TP
+.TP 3n
 \fBall\fR
 Prints the current values of the frequently used options to
 \fBset\fR. Information about the current default server and host is also printed.
-.TP
+.TP 3n
 \fBclass=\fR\fIvalue\fR
 Change the query class to one of:
-.RS
+.RS 3n
-.TP
+.TP 3n
 \fBIN\fR
 the Internet class
-.TP
+.TP 3n
 \fBCH\fR
 the Chaos class
-.TP
+.TP 3n
 \fBHS\fR
 the Hesiod class
-.TP
+.TP 3n
 \fBANY\fR
 wildcard
 .RE
-.IP
+.IP "" 3n
 The class specifies the protocol group of the information.
 .sp
 (Default = IN; abbreviation = cl)
-.TP
+.TP 3n
 \fB\fI[no]\fR\fR\fBdebug\fR
 Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer.
 .sp
 (Default = nodebug; abbreviation =
 [no]deb)
-.TP
+.TP 3n
 \fB\fI[no]\fR\fR\fBd2\fR
 Turn debugging mode on. A lot more information is printed about the packet sent to the server and the resulting answer.
 .sp
 (Default = nod2)
-.TP
+.TP 3n
 \fBdomain=\fR\fIname\fR
 Sets the search list to
 \fIname\fR.
-.TP
+.TP 3n
 \fB\fI[no]\fR\fR\fBsearch\fR
 If the lookup request contains at least one period but doesn't end with a trailing period, append the domain names in the domain search list to the request until an answer is received.
 .sp
 (Default = search)
-.TP
+.TP 3n
 \fBport=\fR\fIvalue\fR
 Change the default TCP/UDP name server port to
 \fIvalue\fR.
 .sp
 (Default = 53; abbreviation = po)
-.TP
+.TP 3n
 \fBquerytype=\fR\fIvalue\fR
-.TP
+.TP 3n
 \fBtype=\fR\fIvalue\fR
-Change the top of the information query.
+Change the type of the information query.
 .sp
 (Default = A; abbreviations = q, ty)
-.TP
+.TP 3n
 \fB\fI[no]\fR\fR\fBrecurse\fR
 Tell the name server to query other servers if it does not have the information.
 .sp
 (Default = recurse; abbreviation = [no]rec)
-.TP
+.TP 3n
 \fBretry=\fR\fInumber\fR
 Set the number of retries to number.
-.TP
+.TP 3n
 \fBtimeout=\fR\fInumber\fR
 Change the initial timeout interval for waiting for a reply to number seconds.
-.TP
+.TP 3n
 \fB\fI[no]\fR\fR\fBvc\fR
 Always use a virtual circuit when sending requests to the server.
 .sp
 (Default = novc)
 .RE
-.IP
+.IP "" 3n
 .SH "FILES"
 .PP
 \fI/etc/resolv.conf\fR
@@ -179,3 +184,5 @@ Always use a virtual circuit when sending requests to the server.
 .SH "AUTHOR"
 .PP
 Andrew Cherenson
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/dig/nslookup.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nslookup.c,v 1.90.2.4.2.10 2005/07/12 05:47:42 marka Exp $ */
+/* $Id: nslookup.c,v 1.90.2.4.2.12 2006/06/09 23:50:53 marka Exp $ */
 
 #include <config.h>
 
@@ -708,6 +708,7 @@ get_next_command(void) {
 	if (buf == NULL)
 		fatal("memory allocation failure");
 	fputs("> ", stderr);
+	fflush(stderr);
 	isc_app_block();
 	ptr = fgets(buf, COMMSIZE, stdin);
 	isc_app_unblock();

contrib/bind9/bin/dig/nslookup.docbook

@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  -
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: nslookup.docbook,v 1.3.6.5 2005/05/13 01:22:33 marka Exp $ -->
+<!-- $Id: nslookup.docbook,v 1.3.6.7 2006/01/06 00:01:42 marka Exp $ -->
 
 <!--
  - Copyright (c) 1985, 1989
@@ -68,6 +68,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2006</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -263,7 +264,7 @@ the lookups.  Valid keywords are:
 
   <varlistentry><term><constant>type=</constant><replaceable>value</replaceable></term>
   <listitem><para>
-  Change the top of the information query.
+  Change the type of the information query.
   </para><para>
   (Default = A; abbreviations = q, ty)
   </para></listitem></varlistentry>

contrib/bind9/bin/dig/nslookup.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -13,15 +13,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nslookup.html,v 1.1.6.9 2005/10/13 02:33:44 marka Exp $ -->
+<!-- $Id: nslookup.html,v 1.1.6.12 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>nslookup</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463728"></a><div class="titlepage"></div>
+<a name="id2482694"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>nslookup &#8212; query Internet name servers interactively</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">nslookup</code>  [<code class="option">-option</code>] [name | -] [server]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525973"></a><h2>DESCRIPTION</h2>
+<a name="id2549404"></a><h2>DESCRIPTION</h2>
 <p>
 <span><strong class="command">Nslookup</strong></span>
 is a program to query Internet domain name servers.  <span><strong class="command">Nslookup</strong></span>
@@ -43,7 +43,7 @@ domain.
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525990"></a><h2>ARGUMENTS</h2>
+<a name="id2549421"></a><h2>ARGUMENTS</h2>
 <p>
 Interactive mode is entered in the following cases:
 </p>
@@ -75,7 +75,7 @@ nslookup -query=hinfo  -timeout=10
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526033"></a><h2>INTERACTIVE COMMANDS</h2>
+<a name="id2549464"></a><h2>INTERACTIVE COMMANDS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">host [<span class="optional">server</span>]</span></dt>
 <dd>
@@ -200,7 +200,7 @@ the lookups.  Valid keywords are:
 <dt><span class="term"><code class="constant">type=</code><em class="replaceable"><code>value</code></em></span></dt>
 <dd>
 <p>
-  Change the top of the information query.
+  Change the type of the information query.
   </p>
 <p>
   (Default = A; abbreviations = q, ty)
@@ -241,13 +241,13 @@ the lookups.  Valid keywords are:
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526490"></a><h2>FILES</h2>
+<a name="id2549990"></a><h2>FILES</h2>
 <p>
 <code class="filename">/etc/resolv.conf</code>
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526503"></a><h2>SEE ALSO</h2>
+<a name="id2550003"></a><h2>SEE ALSO</h2>
 <p>
 <span class="citerefentry"><span class="refentrytitle">dig</span>(1)</span>,
 <span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
@@ -255,7 +255,7 @@ the lookups.  Valid keywords are:
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526538"></a><h2>Author</h2>
+<a name="id2550038"></a><h2>Author</h2>
 <p>
 Andrew Cherenson
 </p>

contrib/bind9/bin/dnssec/dnssec-keygen.8

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-keygen.8,v 1.19.12.9 2005/10/13 02:33:45 marka Exp $
+.\" $Id: dnssec-keygen.8,v 1.19.12.10 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: dnssec\-keygen
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "DNSSEC\-KEYGEN" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -36,7 +39,7 @@ dnssec\-keygen \- DNSSEC key generation tool
 \fBdnssec\-keygen\fR
 generates keys for DNSSEC (Secure DNS), as defined in RFC 2535 and RFC <TBA\\>. It can also generate keys for use with TSIG (Transaction Signatures), as defined in RFC 2845.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-a \fIalgorithm\fR
 Selects the cryptographic algorithm. The value of
 \fBalgorithm\fR
@@ -45,37 +48,37 @@ must be one of RSAMD5 (RSA) or RSASHA1, DSA, DH (Diffie Hellman), or HMAC\-MD5.
 Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement algorithm, and DSA is recommended. For TSIG, HMAC\-MD5 is mandatory.
 .sp
 Note 2: HMAC\-MD5 and DH automatically set the \-k flag.
-.TP
+.TP 3n
 \-b \fIkeysize\fR
 Specifies the number of bits in the key. The choice of key size depends on the algorithm used. RSAMD5 / RSASHA1 keys must be between 512 and 2048 bits. Diffie Hellman keys must be between 128 and 4096 bits. DSA keys must be between 512 and 1024 bits and an exact multiple of 64. HMAC\-MD5 keys must be between 1 and 512 bits.
-.TP
+.TP 3n
 \-n \fInametype\fR
 Specifies the owner type of the key. The value of
 \fBnametype\fR
 must either be ZONE (for a DNSSEC zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with a host (KEY)), USER (for a key associated with a user(KEY)) or OTHER (DNSKEY). These values are case insensitive.
-.TP
+.TP 3n
 \-c \fIclass\fR
 Indicates that the DNS record containing the key should have the specified class. If not specified, class IN is used.
-.TP
+.TP 3n
 \-e
 If generating an RSAMD5/RSASHA1 key, use a large exponent.
-.TP
+.TP 3n
 \-f \fIflag\fR
 Set the specified flag in the flag field of the KEY/DNSKEY record. The only recognized flag is KSK (Key Signing Key) DNSKEY.
-.TP
+.TP 3n
 \-g \fIgenerator\fR
 If generating a Diffie Hellman key, use this generator. Allowed values are 2 and 5. If no generator is specified, a known prime from RFC 2539 will be used if possible; otherwise the default is 2.
-.TP
+.TP 3n
 \-h
 Prints a short summary of the options and arguments to
 \fBdnssec\-keygen\fR.
-.TP
+.TP 3n
 \-k
 Generate KEY records rather than DNSKEY records.
-.TP
+.TP 3n
 \-p \fIprotocol\fR
 Sets the protocol value for the generated key. The protocol is a number between 0 and 255. The default is 3 (DNSSEC). Other possible values for this argument are listed in RFC 2535 and its successors.
-.TP
+.TP 3n
 \-r \fIrandomdev\fR
 Specifies the source of randomness. If the operating system does not provide a
 \fI/dev/random\fR
@@ -84,15 +87,15 @@ or equivalent device, the default source of randomness is keyboard input.
 specifies the name of a character device or file containing random data to be used instead of the default. The special value
 \fIkeyboard\fR
 indicates that keyboard input should be used.
-.TP
+.TP 3n
 \-s \fIstrength\fR
 Specifies the strength value of the key. The strength is a number between 0 and 15, and currently has no defined purpose in DNSSEC.
-.TP
+.TP 3n
 \-t \fItype\fR
 Indicates the use of the key.
 \fBtype\fR
 must be one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default is AUTHCONF. AUTH refers to the ability to authenticate data, and CONF the ability to encrypt data.
-.TP
+.TP 3n
 \-v \fIlevel\fR
 Sets the debugging level.
 .SH "GENERATED KEYS"
@@ -102,18 +105,20 @@ When
 completes successfully, it prints a string of the form
 \fIKnnnn.+aaa+iiiii\fR
 to the standard output. This is an identification string for the key it has generated.
-.TP 3
+.TP 3n
 \(bu
 \fInnnn\fR
 is the key name.
-.TP
+.TP 3n
 \(bu
 \fIaaa\fR
 is the numeric representation of the algorithm.
-.TP
+.TP 3n
 \(bu
 \fIiiiii\fR
 is the key identifier (or footprint).
+.sp
+.RE
 .PP
 \fBdnssec\-keygen\fR
 creates two file, with names based on the printed string.
@@ -162,3 +167,5 @@ RFC 2539.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/dnssec/dnssec-keygen.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-keygen.html,v 1.5.2.1.4.13 2005/10/13 02:33:45 marka Exp $ -->
+<!-- $Id: dnssec-keygen.html,v 1.5.2.1.4.15 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-keygen</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">dnssec-keygen</span> &#8212; DNSSEC key generation tool</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-keygen</code>  {-a <em class="replaceable"><code>algorithm</code></em>} {-b <em class="replaceable"><code>keysize</code></em>} {-n <em class="replaceable"><code>nametype</code></em>} [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-e</code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-g <em class="replaceable"><code>generator</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k</code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {name}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525956"></a><h2>DESCRIPTION</h2>
+<a name="id2549521"></a><h2>DESCRIPTION</h2>
 <p>
         <span><strong class="command">dnssec-keygen</strong></span> generates keys for DNSSEC
 	(Secure DNS), as defined in RFC 2535 and RFC &lt;TBA\&gt;.  It can also generate
@@ -41,7 +41,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525969"></a><h2>OPTIONS</h2>
+<a name="id2549533"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
@@ -144,7 +144,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526306"></a><h2>GENERATED KEYS</h2>
+<a name="id2549939"></a><h2>GENERATED KEYS</h2>
 <p>
         When <span><strong class="command">dnssec-keygen</strong></span> completes successfully,
 	it prints a string of the form <code class="filename">Knnnn.+aaa+iiiii</code>
@@ -187,7 +187,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526394"></a><h2>EXAMPLE</h2>
+<a name="id2550027"></a><h2>EXAMPLE</h2>
 <p>
         To generate a 768-bit DSA key for the domain
 	<strong class="userinput"><code>example.com</code></strong>, the following command would be
@@ -209,7 +209,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526440"></a><h2>SEE ALSO</h2>
+<a name="id2550073"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -219,7 +219,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526473"></a><h2>AUTHOR</h2>
+<a name="id2550106"></a><h2>AUTHOR</h2>
 <p>
         <span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/dnssec/dnssec-signzone.8

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: dnssec-signzone.8,v 1.23.2.1.4.10 2005/10/13 02:33:45 marka Exp $
+.\" $Id: dnssec-signzone.8,v 1.23.2.1.4.11 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: dnssec\-signzone
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "DNSSEC\-SIGNZONE" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -38,49 +41,49 @@ signs a zone. It generates NSEC and RRSIG records and produces a signed version
 \fIkeyset\fR
 file for each child zone.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-a
 Verify all generated signatures.
-.TP
+.TP 3n
 \-c \fIclass\fR
 Specifies the DNS class of the zone.
-.TP
+.TP 3n
 \-k \fIkey\fR
 Treat specified key as a key signing key ignoring any key flags. This option may be specified multiple times.
-.TP
+.TP 3n
 \-l \fIdomain\fR
 Generate a DLV set in addition to the key (DNSKEY) and DS sets. The domain is appended to the name of the records.
-.TP
+.TP 3n
 \-d \fIdirectory\fR
 Look for
 \fIkeyset\fR
 files in
 \fBdirectory\fR
 as the directory
-.TP
+.TP 3n
 \-g
 Generate DS records for child zones from keyset files. Existing DS records will be removed.
-.TP
+.TP 3n
 \-s \fIstart\-time\fR
 Specify the date and time when the generated RRSIG records become valid. This can be either an absolute or relative time. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative start time is indicated by +N, which is N seconds from the current time. If no
 \fBstart\-time\fR
 is specified, the current time minus 1 hour (to allow for clock skew) is used.
-.TP
+.TP 3n
 \-e \fIend\-time\fR
 Specify the date and time when the generated RRSIG records expire. As with
 \fBstart\-time\fR, an absolute time is indicated in YYYYMMDDHHMMSS notation. A time relative to the start time is indicated with +N, which is N seconds from the start time. A time relative to the current time is indicated with now+N. If no
 \fBend\-time\fR
 is specified, 30 days from the start time is used as a default.
-.TP
+.TP 3n
 \-f \fIoutput\-file\fR
 The name of the output file containing the signed zone. The default is to append
 \fI.signed\fR
 to the input file.
-.TP
+.TP 3n
 \-h
 Prints a short summary of the options and arguments to
 \fBdnssec\-signzone\fR.
-.TP
+.TP 3n
 \-i \fIinterval\fR
 When a previously signed zone is passed as input, records may be resigned. The
 \fBinterval\fR
@@ -93,16 +96,16 @@ or
 are specified,
 \fBdnssec\-signzone\fR
 generates signatures that are valid for 30 days, with a cycle interval of 7.5 days. Therefore, if any existing RRSIG records are due to expire in less than 7.5 days, they would be replaced.
-.TP
+.TP 3n
 \-n \fIncpus\fR
 Specifies the number of threads to use. By default, one thread is started for each detected CPU.
-.TP
+.TP 3n
 \-o \fIorigin\fR
 The zone origin. If not specified, the name of the zone file is assumed to be the origin.
-.TP
+.TP 3n
 \-p
 Use pseudo\-random data when signing the zone. This is faster, but less secure, than using real random data. This option may be useful when signing large zones or when the entropy source is limited.
-.TP
+.TP 3n
 \-r \fIrandomdev\fR
 Specifies the source of randomness. If the operating system does not provide a
 \fI/dev/random\fR
@@ -111,19 +114,19 @@ or equivalent device, the default source of randomness is keyboard input.
 specifies the name of a character device or file containing random data to be used instead of the default. The special value
 \fIkeyboard\fR
 indicates that keyboard input should be used.
-.TP
+.TP 3n
 \-t
 Print statistics at completion.
-.TP
+.TP 3n
 \-v \fIlevel\fR
 Sets the debugging level.
-.TP
+.TP 3n
 \-z
 Ignore KSK flag on key when determining what to sign.
-.TP
+.TP 3n
 zonefile
 The file containing the zone to be signed.
-.TP
+.TP 3n
 key
 The keys used to sign the zone. If no keys are specified, the default all zone keys that have private key files in the current directory.
 .SH "EXAMPLE"
@@ -155,3 +158,5 @@ RFC 2535.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/dnssec/dnssec-signzone.c

@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.139.2.2.4.21 2005/10/14 01:38:41 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.139.2.2.4.23 2006/01/04 23:50:19 marka Exp $ */
 
 #include <config.h>
 
@@ -1292,10 +1292,6 @@ nsecify(void) {
 				result = dns_dbiterator_next(dbiter);
 				continue;
 			}
-			if (result != ISC_R_SUCCESS) {
-				dns_db_detachnode(gdb, &nextnode);
-				break;
-			}
 			if (!dns_name_issubdomain(nextname, gorigin) ||
 			    (zonecut != NULL &&
 			     dns_name_issubdomain(nextname, zonecut)))

contrib/bind9/bin/dnssec/dnssec-signzone.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: dnssec-signzone.html,v 1.4.2.1.4.14 2005/10/13 02:33:46 marka Exp $ -->
+<!-- $Id: dnssec-signzone.html,v 1.4.2.1.4.16 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>dnssec-signzone</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">dnssec-signzone</span> &#8212; DNSSEC zone signing tool</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">dnssec-signzone</code>  [<code class="option">-a</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-d <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-e <em class="replaceable"><code>end-time</code></em></code>] [<code class="option">-f <em class="replaceable"><code>output-file</code></em></code>] [<code class="option">-g</code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>key</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-i <em class="replaceable"><code>interval</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nthreads</code></em></code>] [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>] [<code class="option">-p</code>] [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>] [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>] [<code class="option">-t</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-z</code>] {zonefile} [key...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525979"></a><h2>DESCRIPTION</h2>
+<a name="id2549544"></a><h2>DESCRIPTION</h2>
 <p>
         <span><strong class="command">dnssec-signzone</strong></span> signs a zone.  It generates
 	NSEC and RRSIG records and produces a signed version of the
@@ -43,7 +43,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525995"></a><h2>OPTIONS</h2>
+<a name="id2549560"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd><p>
@@ -179,7 +179,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526435"></a><h2>EXAMPLE</h2>
+<a name="id2550068"></a><h2>EXAMPLE</h2>
 <p>
         The following command signs the <strong class="userinput"><code>example.com</code></strong>
 	zone with the DSA key generated in the <span><strong class="command">dnssec-keygen</strong></span>
@@ -203,7 +203,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526485"></a><h2>SEE ALSO</h2>
+<a name="id2550118"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -211,7 +211,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526512"></a><h2>AUTHOR</h2>
+<a name="id2550145"></a><h2>AUTHOR</h2>
 <p>
         <span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/named/aclconf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: aclconf.c,v 1.27.12.5 2005/03/17 03:58:25 marka Exp $ */
+/* $Id: aclconf.c,v 1.27.12.7 2006/03/02 00:37:20 marka Exp $ */
 
 #include <config.h>
 
@@ -54,10 +54,10 @@ ns_aclconfctx_destroy(ns_aclconfctx_t *ctx) {
  * Find the definition of the named acl whose name is "name".
  */
 static isc_result_t
-get_acl_def(cfg_obj_t *cctx, char *name, cfg_obj_t **ret) {
+get_acl_def(const cfg_obj_t *cctx, const char *name, const cfg_obj_t **ret) {
 	isc_result_t result;
-	cfg_obj_t *acls = NULL;
+	const cfg_obj_t *acls = NULL;
-	cfg_listelt_t *elt;
+	const cfg_listelt_t *elt;
 	
 	result = cfg_map_get(cctx, "acl", &acls);
 	if (result != ISC_R_SUCCESS)
@@ -65,7 +65,7 @@ get_acl_def(cfg_obj_t *cctx, char *name, cfg_obj_t **ret) {
 	for (elt = cfg_list_first(acls);
 	     elt != NULL;
 	     elt = cfg_list_next(elt)) {
-		cfg_obj_t *acl = cfg_listelt_value(elt);
+		const cfg_obj_t *acl = cfg_listelt_value(elt);
 		const char *aclname = cfg_obj_asstring(cfg_tuple_get(acl, "name"));
 		if (strcasecmp(aclname, name) == 0) {
 			*ret = cfg_tuple_get(acl, "value");
@@ -76,15 +76,15 @@ get_acl_def(cfg_obj_t *cctx, char *name, cfg_obj_t **ret) {
 }
 
 static isc_result_t
-convert_named_acl(cfg_obj_t *nameobj, cfg_obj_t *cctx,
+convert_named_acl(const cfg_obj_t *nameobj, const cfg_obj_t *cctx,
 		  ns_aclconfctx_t *ctx, isc_mem_t *mctx,
 		  dns_acl_t **target)
 {
 	isc_result_t result;
-	cfg_obj_t *cacl = NULL;
+	const cfg_obj_t *cacl = NULL;
 	dns_acl_t *dacl;
 	dns_acl_t loop;
-	char *aclname = cfg_obj_asstring(nameobj);
+	const char *aclname = cfg_obj_asstring(nameobj);
 
 	/* Look for an already-converted version. */
 	for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
@@ -113,7 +113,7 @@ convert_named_acl(cfg_obj_t *nameobj, cfg_obj_t *cctx,
 	 */
 	memset(&loop, 0, sizeof(loop));
 	ISC_LINK_INIT(&loop, nextincache);
-	loop.name = aclname;
+	DE_CONST(aclname, loop.name);
 	loop.magic = LOOP_MAGIC;
 	ISC_LIST_APPEND(ctx->named_acl_cache, &loop, nextincache);
 	result = ns_acl_fromconfig(cacl, cctx, ctx, mctx, &dacl);
@@ -131,7 +131,7 @@ convert_named_acl(cfg_obj_t *nameobj, cfg_obj_t *cctx,
 }
 
 static isc_result_t
-convert_keyname(cfg_obj_t *keyobj, isc_mem_t *mctx, dns_name_t *dnsname) {
+convert_keyname(const cfg_obj_t *keyobj, isc_mem_t *mctx, dns_name_t *dnsname) {
 	isc_result_t result;
 	isc_buffer_t buf;
 	dns_fixedname_t fixname;
@@ -154,8 +154,8 @@ convert_keyname(cfg_obj_t *keyobj, isc_mem_t *mctx, dns_name_t *dnsname) {
 }
 
 isc_result_t
-ns_acl_fromconfig(cfg_obj_t *caml,
+ns_acl_fromconfig(const cfg_obj_t *caml,
-		  cfg_obj_t *cctx,
+		  const cfg_obj_t *cctx,
 		  ns_aclconfctx_t *ctx,
 		  isc_mem_t *mctx,
 		  dns_acl_t **target)
@@ -164,7 +164,7 @@ ns_acl_fromconfig(cfg_obj_t *caml,
 	unsigned int count;
 	dns_acl_t *dacl = NULL;
 	dns_aclelement_t *de;
-	cfg_listelt_t *elt;
+	const cfg_listelt_t *elt;
 
 	REQUIRE(target != NULL && *target == NULL);
 
@@ -183,7 +183,7 @@ ns_acl_fromconfig(cfg_obj_t *caml,
 	     elt != NULL;
 	     elt = cfg_list_next(elt))
 	{
-		cfg_obj_t *ce = cfg_listelt_value(elt);
+		const cfg_obj_t *ce = cfg_listelt_value(elt);
 		if (cfg_obj_istuple(ce)) {
 			/* This must be a negated element. */
 			ce = cfg_tuple_get(ce, "value");
@@ -215,7 +215,7 @@ ns_acl_fromconfig(cfg_obj_t *caml,
 				goto cleanup;
 		} else if (cfg_obj_isstring(ce)) {
 			/* ACL name */
-			char *name = cfg_obj_asstring(ce);
+			const char *name = cfg_obj_asstring(ce);
 			if (strcasecmp(name, "localhost") == 0) {
 				de->type = dns_aclelementtype_localhost;
 			} else if (strcasecmp(name, "localnets") == 0) {

contrib/bind9/bin/named/client.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.176.2.13.4.26 2005/07/27 02:53:14 marka Exp $ */
+/* $Id: client.c,v 1.176.2.13.4.31 2006/07/22 01:09:38 marka Exp $ */
 
 #include <config.h>
 
@@ -164,6 +164,12 @@ struct ns_clientmgr {
  * Must be greater than any valid state.
  */
 
+/*
+ * Enable ns_client_dropport() by default.
+ */
+#ifndef NS_CLIENT_DROPPORT
+#define NS_CLIENT_DROPPORT 1
+#endif
 
 static void client_read(ns_client_t *client);
 static void client_accept(ns_client_t *client);
@@ -285,8 +291,17 @@ exit_check(ns_client_t *client) {
 		}
 		/*
 		 * I/O cancel is complete.  Burn down all state
-		 * related to the current request.
+		 * related to the current request.  Ensure that
+		 * the client is on the active list and not the
+		 * recursing list.
 		 */
+		LOCK(&client->manager->lock);
+		if (client->list == &client->manager->recursing) {
+			ISC_LIST_UNLINK(*client->list, client, link);
+			ISC_LIST_APPEND(client->manager->active, client, link);
+			client->list = &client->manager->active;
+		}
+		UNLOCK(&client->manager->lock);
 		ns_client_endrequest(client);
 
 		client->state = NS_CLIENTSTATE_READING;
@@ -972,6 +987,34 @@ ns_client_send(ns_client_t *client) {
 	ns_client_next(client, result);
 }
 
+#if NS_CLIENT_DROPPORT
+#define DROPPORT_NO		0
+#define DROPPORT_REQUEST	1
+#define DROPPORT_RESPONSE	2
+/*%
+ * ns_client_dropport determines if certain requests / responses
+ * should be dropped based on the port number.
+ *
+ * Returns:
+ * \li	0:	Don't drop.
+ * \li	1:	Drop request.
+ * \li	2:	Drop (error) response.
+ */
+static int
+ns_client_dropport(in_port_t port) {
+	switch (port) {
+	case 7: /* echo */
+	case 13: /* daytime */
+	case 19: /* chargen */
+	case 37: /* time */
+		return (DROPPORT_REQUEST);
+	case 464: /* kpasswd */
+		return (DROPPORT_RESPONSE);
+	}
+	return (DROPPORT_NO);
+}
+#endif
+
 void
 ns_client_error(ns_client_t *client, isc_result_t result) {
 	dns_rcode_t rcode;
@@ -984,6 +1027,28 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 	message = client->message;
 	rcode = dns_result_torcode(result);
 
+#if NS_CLIENT_DROPPORT
+	/*
+	 * Don't send FORMERR to ports on the drop port list.
+	 */
+	if (rcode == dns_rcode_formerr &&
+	    ns_client_dropport(isc_sockaddr_getport(&client->peeraddr)) !=
+	    DROPPORT_NO) {
+		char buf[64];
+		isc_buffer_t b;
+
+		isc_buffer_init(&b, buf, sizeof(buf) - 1);
+		if (dns_rcode_totext(rcode, &b) != ISC_R_SUCCESS)
+			isc_buffer_putstr(&b, "UNKNOWN RCODE");
+		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
+			      "dropped error (%.*s) response: suspicious port",
+			      (int)isc_buffer_usedlength(&b), buf);
+		ns_client_next(client, ISC_R_SUCCESS);
+		return;
+	}
+#endif
+
 	/*
 	 * Message may be an in-progress reply that we had trouble
 	 * with, in which case QR will be set.  We need to clear QR before
@@ -1208,6 +1273,17 @@ client_request(isc_task_t *task, isc_event_t *event) {
 
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 
+#if NS_CLIENT_DROPPORT
+	if (ns_client_dropport(isc_sockaddr_getport(&client->peeraddr)) ==
+	    DROPPORT_REQUEST) {
+		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
+			      "dropped request: suspicious port");
+		ns_client_next(client, ISC_R_SUCCESS);
+		goto cleanup;
+	}
+#endif
+
 	ns_client_log(client, NS_LOGCATEGORY_CLIENT,
 		      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),
 		      "%s request",
@@ -1242,6 +1318,7 @@ client_request(isc_task_t *task, isc_event_t *event) {
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(2),
 			      "dropping multicast request");
 		ns_client_next(client, DNS_R_REFUSED);
+		goto cleanup;
 	}
 
 	result = dns_message_peekheader(buffer, &id, &flags);
@@ -1532,12 +1609,15 @@ client_request(isc_task_t *task, isc_event_t *event) {
 	 * Decide whether recursive service is available to this client.
 	 * We do this here rather than in the query code so that we can
 	 * set the RA bit correctly on all kinds of responses, not just
-	 * responses to ordinary queries.
+	 * responses to ordinary queries.  Note if you can't query the
+	 * cache there is no point in setting RA.
 	 */
 	ra = ISC_FALSE;
 	if (client->view->resolver != NULL &&
 	    client->view->recursion == ISC_TRUE &&
 	    ns_client_checkaclsilent(client, client->view->recursionacl,
+				     ISC_TRUE) == ISC_R_SUCCESS &&
+	    ns_client_checkaclsilent(client, client->view->queryacl,
 				     ISC_TRUE) == ISC_R_SUCCESS)
 		ra = ISC_TRUE;
 
@@ -2364,3 +2444,20 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {
 	}
 	UNLOCK(&manager->lock);
 }
+
+void
+ns_client_qnamereplace(ns_client_t *client, dns_name_t *name) {
+
+	if (client->manager != NULL)
+		LOCK(&client->manager->lock);
+	if (client->query.restarts > 0) {
+		/*
+		 * client->query.qname was dynamically allocated.
+		 */
+		dns_message_puttempname(client->message,
+					&client->query.qname);
+	}
+	client->query.qname = name;
+	if (client->manager != NULL)
+		UNLOCK(&client->manager->lock);
+}

contrib/bind9/bin/named/config.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.c,v 1.11.2.4.8.29 2004/10/05 02:52:26 marka Exp $ */
+/* $Id: config.c,v 1.11.2.4.8.32 2006/02/28 06:32:53 marka Exp $ */
 
 #include <config.h>
 
@@ -196,7 +196,7 @@ ns_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 }
 
 isc_result_t
-ns_config_get(cfg_obj_t **maps, const char *name, cfg_obj_t **obj) {
+ns_config_get(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 
 	for (i = 0;; i++) {
@@ -208,11 +208,13 @@ ns_config_get(cfg_obj_t **maps, const char *name, cfg_obj_t **obj) {
 }
 
 isc_result_t
-ns_checknames_get(cfg_obj_t **maps, const char *which, cfg_obj_t **obj) {
+ns_checknames_get(const cfg_obj_t **maps, const char *which,
-	cfg_listelt_t *element;
+		  const cfg_obj_t **obj)
-	cfg_obj_t *checknames;
+{
-	cfg_obj_t *type;
+	const cfg_listelt_t *element;
-	cfg_obj_t *value;
+	const cfg_obj_t *checknames;
+	const cfg_obj_t *type;
+	const cfg_obj_t *value;
 	int i;
 
 	for (i = 0;; i++) {
@@ -243,8 +245,8 @@ ns_checknames_get(cfg_obj_t **maps, const char *which, cfg_obj_t **obj) {
 }
 
 int
-ns_config_listcount(cfg_obj_t *list) {
+ns_config_listcount(const cfg_obj_t *list) {
-	cfg_listelt_t *e;
+	const cfg_listelt_t *e;
 	int i = 0;
 
 	for (e = cfg_list_first(list); e != NULL; e = cfg_list_next(e))
@@ -254,9 +256,9 @@ ns_config_listcount(cfg_obj_t *list) {
 }
 
 isc_result_t
-ns_config_getclass(cfg_obj_t *classobj, dns_rdataclass_t defclass,
+ns_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		   dns_rdataclass_t *classp) {
-	char *str;
+	const char *str;
 	isc_textregion_t r;
 	isc_result_t result;
 
@@ -265,7 +267,7 @@ ns_config_getclass(cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		return (ISC_R_SUCCESS);
 	}
 	str = cfg_obj_asstring(classobj);
-	r.base = str;
+	DE_CONST(str, r.base);
 	r.length = strlen(str);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS)
@@ -275,9 +277,9 @@ ns_config_getclass(cfg_obj_t *classobj, dns_rdataclass_t defclass,
 }
 
 isc_result_t
-ns_config_gettype(cfg_obj_t *typeobj, dns_rdatatype_t deftype,
+ns_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		   dns_rdatatype_t *typep) {
-	char *str;
+	const char *str;
 	isc_textregion_t r;
 	isc_result_t result;
 
@@ -286,7 +288,7 @@ ns_config_gettype(cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		return (ISC_R_SUCCESS);
 	}
 	str = cfg_obj_asstring(typeobj);
-	r.base = str;
+	DE_CONST(str, r.base);
 	r.length = strlen(str);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS)
@@ -296,9 +298,9 @@ ns_config_gettype(cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 }
 
 dns_zonetype_t
-ns_config_getzonetype(cfg_obj_t *zonetypeobj) {
+ns_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	dns_zonetype_t ztype = dns_zone_none;
-	char *str;
+	const char *str;
 
 	str = cfg_obj_asstring(zonetypeobj);
 	if (strcasecmp(str, "master") == 0)
@@ -313,14 +315,14 @@ ns_config_getzonetype(cfg_obj_t *zonetypeobj) {
 }
 
 isc_result_t
-ns_config_getiplist(cfg_obj_t *config, cfg_obj_t *list,
+ns_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
 		    in_port_t defport, isc_mem_t *mctx,
 		    isc_sockaddr_t **addrsp, isc_uint32_t *countp)
 {
 	int count, i = 0;
-	cfg_obj_t *addrlist;
+	const cfg_obj_t *addrlist;
-	cfg_obj_t *portobj;
+	const cfg_obj_t *portobj;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	isc_sockaddr_t *addrs;
 	in_port_t port;
 	isc_result_t result;
@@ -380,10 +382,12 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 }
 
 static isc_result_t
-get_masters_def(cfg_obj_t *cctx, char *name, cfg_obj_t **ret) {
+get_masters_def(const cfg_obj_t *cctx, const char *name,
+		const cfg_obj_t **ret)
+{
 	isc_result_t result;
-	cfg_obj_t *masters = NULL;
+	const cfg_obj_t *masters = NULL;
-	cfg_listelt_t *elt;
+	const cfg_listelt_t *elt;
 
 	result = cfg_map_get(cctx, "masters", &masters);
 	if (result != ISC_R_SUCCESS)
@@ -391,7 +395,7 @@ get_masters_def(cfg_obj_t *cctx, char *name, cfg_obj_t **ret) {
 	for (elt = cfg_list_first(masters);
 	     elt != NULL;
 	     elt = cfg_list_next(elt)) {
-		cfg_obj_t *list;
+		const cfg_obj_t *list;
 		const char *listname;
 
 		list = cfg_listelt_value(elt);
@@ -406,24 +410,24 @@ get_masters_def(cfg_obj_t *cctx, char *name, cfg_obj_t **ret) {
 }
 
 isc_result_t
-ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
+ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			  isc_sockaddr_t **addrsp, dns_name_t ***keysp,
+			  isc_mem_t *mctx, isc_sockaddr_t **addrsp,
-			  isc_uint32_t *countp)
+			  dns_name_t ***keysp, isc_uint32_t *countp)
 {
 	isc_uint32_t addrcount = 0, keycount = 0, i = 0;
 	isc_uint32_t listcount = 0, l = 0, j;
 	isc_uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
-	cfg_obj_t *addrlist;
+	const cfg_obj_t *addrlist;
-	cfg_obj_t *portobj;
+	const cfg_obj_t *portobj;
 	in_port_t port;
 	dns_fixedname_t fname;
 	isc_sockaddr_t *addrs = NULL;
 	dns_name_t **keys = NULL;
-	char **lists = NULL;
+	const char **lists = NULL;
 	struct {
-		cfg_listelt_t *element;
+		const cfg_listelt_t *element;
 		in_port_t port;
 	} *stack = NULL;
 
@@ -439,13 +443,14 @@ ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
 		if (val > ISC_UINT16_MAX) {
 			cfg_obj_log(portobj, ns_g_lctx, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
-			return (ISC_R_RANGE);
+			result = ISC_R_RANGE;
+			goto cleanup;
 		}
 		port = (in_port_t) val;
 	} else {
 		result = ns_config_getport(config, &port);
 		if (result != ISC_R_SUCCESS)
-			return (result);
+			goto cleanup;
 	}
 
 	result = ISC_R_NOMEMORY;
@@ -456,9 +461,9 @@ ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *addr;
+		const cfg_obj_t *addr;
-		cfg_obj_t *key;
+		const cfg_obj_t *key;
-		char *keystr;
+		const char *keystr;
 		isc_buffer_t b;
 
 		addr = cfg_tuple_get(cfg_listelt_value(element),
@@ -466,7 +471,7 @@ ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
 		key = cfg_tuple_get(cfg_listelt_value(element), "key");
 
 		if (!cfg_obj_issockaddr(addr)) {
-			char *listname = cfg_obj_asstring(addr);
+			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;
 
 			/* Grow lists? */
@@ -606,9 +611,9 @@ ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
 			if (new == NULL)
 				goto cleanup;
 			memcpy(new, addrs, newsize);
-			isc_mem_put(mctx, addrs, oldsize);
 		} else
 			new = NULL;
+		isc_mem_put(mctx, addrs, oldsize);
 		addrs = new;
 		addrcount = i;
 
@@ -619,9 +624,9 @@ ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
 			if (new == NULL)
 				goto cleanup;
 			memcpy(new, keys,  newsize);
-			isc_mem_put(mctx, keys, oldsize);
 		} else
 			new = NULL;
+		isc_mem_put(mctx, keys, oldsize);
 		keys = new;
 		keycount = i;
 	}
@@ -682,10 +687,10 @@ ns_config_putipandkeylist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 }
 
 isc_result_t
-ns_config_getport(cfg_obj_t *config, in_port_t *portp) {
+ns_config_getport(const cfg_obj_t *config, in_port_t *portp) {
-	cfg_obj_t *maps[3];
+	const cfg_obj_t *maps[3];
-	cfg_obj_t *options = NULL;
+	const cfg_obj_t *options = NULL;
-	cfg_obj_t *portobj = NULL;
+	const cfg_obj_t *portobj = NULL;
 	isc_result_t result;
 	int i;
 

contrib/bind9/bin/named/controlconf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: controlconf.c,v 1.28.2.9.2.6 2004/03/08 09:04:14 marka Exp $ */
+/* $Id: controlconf.c,v 1.28.2.9.2.10 2006/02/28 06:32:53 marka Exp $ */
 
 #include <config.h>
 
@@ -356,6 +356,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	{
 		ccregion.rstart = isc_buffer_base(&conn->ccmsg.buffer);
 		ccregion.rend = isc_buffer_used(&conn->ccmsg.buffer);
+		if (secret.rstart != NULL)
+			isc_mem_put(listener->mctx, secret.rstart,
+				    REGION_SIZE(secret));
 		secret.rstart = isc_mem_get(listener->mctx, key->secret.length);
 		if (secret.rstart == NULL)
 			goto cleanup;
@@ -371,8 +374,6 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 			 */
 			if (request != NULL)
 				isccc_sexpr_free(&request);
-			isc_mem_put(listener->mctx, secret.rstart,
-				    REGION_SIZE(secret));
 		} else {
 			log_invalid(&conn->ccmsg, result);
 			goto cleanup;
@@ -649,10 +650,12 @@ ns_controls_shutdown(ns_controls_t *controls) {
 }
 
 static isc_result_t
-cfgkeylist_find(cfg_obj_t *keylist, const char *keyname, cfg_obj_t **objp) {
+cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
-	cfg_listelt_t *element;
+	        const cfg_obj_t **objp)
+{
+	const cfg_listelt_t *element;
 	const char *str;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
 
 	for (element = cfg_list_first(keylist);
 	     element != NULL;
@@ -671,13 +674,13 @@ cfgkeylist_find(cfg_obj_t *keylist, const char *keyname, cfg_obj_t **objp) {
 }
 
 static isc_result_t
-controlkeylist_fromcfg(cfg_obj_t *keylist, isc_mem_t *mctx,
+controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		       controlkeylist_t *keyids)
 {
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	char *newstr = NULL;
 	const char *str;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
 	controlkey_t *key = NULL;
 
 	for (element = cfg_list_first(keylist);
@@ -712,11 +715,11 @@ controlkeylist_fromcfg(cfg_obj_t *keylist, isc_mem_t *mctx,
 }
 
 static void
-register_keys(cfg_obj_t *control, cfg_obj_t *keylist,
+register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	      controlkeylist_t *keyids, isc_mem_t *mctx, const char *socktext)
 {
 	controlkey_t *keyid, *next;
-	cfg_obj_t *keydef;
+	const cfg_obj_t *keydef;
 	char secret[1024];
 	isc_buffer_t b;
 	isc_result_t result;
@@ -736,10 +739,10 @@ register_keys(cfg_obj_t *control, cfg_obj_t *keylist,
 			ISC_LIST_UNLINK(*keyids, keyid, link);
 			free_controlkey(keyid, mctx);
 		} else {
-			cfg_obj_t *algobj = NULL;
+			const cfg_obj_t *algobj = NULL;
-			cfg_obj_t *secretobj = NULL;
+			const cfg_obj_t *secretobj = NULL;
-			char *algstr = NULL;
+			const char *algstr = NULL;
-			char *secretstr = NULL;
+			const char *secretstr = NULL;
 
 			(void)cfg_map_get(keydef, "algorithm", &algobj);
 			(void)cfg_map_get(keydef, "secret", &secretobj);
@@ -805,11 +808,11 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	isc_result_t result;
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *config = NULL;
-	cfg_obj_t *key = NULL;
+	const cfg_obj_t *key = NULL;
-	cfg_obj_t *algobj = NULL;
+	const cfg_obj_t *algobj = NULL;
-	cfg_obj_t *secretobj = NULL;
+	const cfg_obj_t *secretobj = NULL;
-	char *algstr = NULL;
+	const char *algstr = NULL;
-	char *secretstr = NULL;
+	const char *secretstr = NULL;
 	controlkey_t *keyid = NULL;
 	char secret[1024];
 	isc_buffer_t b;
@@ -888,12 +891,13 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
  * valid or both are NULL.
  */
 static void
-get_key_info(cfg_obj_t *config, cfg_obj_t *control,
+get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
-	     cfg_obj_t **global_keylistp, cfg_obj_t **control_keylistp)
+	     const cfg_obj_t **global_keylistp,
+	     const cfg_obj_t **control_keylistp)
 {
 	isc_result_t result;
-	cfg_obj_t *control_keylist = NULL;
+	const cfg_obj_t *control_keylist = NULL;
-	cfg_obj_t *global_keylist = NULL;
+	const cfg_obj_t *global_keylist = NULL;
 
 	REQUIRE(global_keylistp != NULL && *global_keylistp == NULL);
 	REQUIRE(control_keylistp != NULL && *control_keylistp == NULL);
@@ -912,15 +916,15 @@ get_key_info(cfg_obj_t *config, cfg_obj_t *control,
 }
 
 static void
-update_listener(ns_controls_t *cp,
+update_listener(ns_controls_t *cp, controllistener_t **listenerp,
-		controllistener_t **listenerp, cfg_obj_t *control,
+		const cfg_obj_t *control, const cfg_obj_t *config,
-		cfg_obj_t *config, isc_sockaddr_t *addr,
+		isc_sockaddr_t *addr, ns_aclconfctx_t *aclconfctx,
-		ns_aclconfctx_t *aclconfctx, const char *socktext)
+		const char *socktext)
 {
 	controllistener_t *listener;
-	cfg_obj_t *allow;
+	const cfg_obj_t *allow;
-	cfg_obj_t *global_keylist = NULL;
+	const cfg_obj_t *global_keylist = NULL;
-	cfg_obj_t *control_keylist = NULL;
+	const cfg_obj_t *control_keylist = NULL;
 	dns_acl_t *new_acl = NULL;
 	controlkeylist_t keys;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -977,18 +981,25 @@ update_listener(ns_controls_t *cp,
 		result = get_rndckey(listener->mctx, &listener->keys);
 	}
 
-	if (result != ISC_R_SUCCESS && global_keylist != NULL)
+	if (result != ISC_R_SUCCESS && global_keylist != NULL) {
 		/*
 		 * This message might be a little misleading since the
 		 * "new keys" might in fact be identical to the old ones,
 		 * but tracking whether they are identical just for the
 		 * sake of avoiding this message would be too much trouble.
 		 */
-		cfg_obj_log(control, ns_g_lctx, ISC_LOG_WARNING,
+		if (control != NULL)
-			    "couldn't install new keys for "
+			cfg_obj_log(control, ns_g_lctx, ISC_LOG_WARNING,
-			    "command channel %s: %s",
+				    "couldn't install new keys for "
-			    socktext, isc_result_totext(result));
+				    "command channel %s: %s",
-
+				    socktext, isc_result_totext(result));
+		else
+			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+				      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
+				      "couldn't install new keys for "
+				      "command channel %s: %s",
+				      socktext, isc_result_totext(result));
+	}
 
 	/*
 	 * Now, keep the old access list unless a new one can be made.
@@ -1005,26 +1016,33 @@ update_listener(ns_controls_t *cp,
 		dns_acl_detach(&listener->acl);
 		dns_acl_attach(new_acl, &listener->acl);
 		dns_acl_detach(&new_acl);
-	} else
 		/* XXXDCL say the old acl is still used? */
+	} else if (control != NULL)
 		cfg_obj_log(control, ns_g_lctx, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "command channel %s: %s",
 			    socktext, isc_result_totext(result));
+	else
+		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
+			      "couldn't install new acl for "
+			      "command channel %s: %s",
+			      socktext, isc_result_totext(result));
 
 	*listenerp = listener;
 }
 
 static void
 add_listener(ns_controls_t *cp, controllistener_t **listenerp,
-	     cfg_obj_t *control, cfg_obj_t *config, isc_sockaddr_t *addr,
+	     const cfg_obj_t *control, const cfg_obj_t *config,
-	     ns_aclconfctx_t *aclconfctx, const char *socktext)
+	     isc_sockaddr_t *addr, ns_aclconfctx_t *aclconfctx,
+	     const char *socktext)
 {
 	isc_mem_t *mctx = cp->server->mctx;
 	controllistener_t *listener;
-	cfg_obj_t *allow;
+	const cfg_obj_t *allow;
-	cfg_obj_t *global_keylist = NULL;
+	const cfg_obj_t *global_keylist = NULL;
-	cfg_obj_t *control_keylist = NULL;
+	const cfg_obj_t *control_keylist = NULL;
 	dns_acl_t *new_acl = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 
@@ -1135,13 +1153,13 @@ add_listener(ns_controls_t *cp, controllistener_t **listenerp,
 }
 
 isc_result_t
-ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
+ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,
 		      ns_aclconfctx_t *aclconfctx)
 {
 	controllistener_t *listener;
 	controllistenerlist_t new_listeners;
-	cfg_obj_t *controlslist = NULL;
+	const cfg_obj_t *controlslist = NULL;
-	cfg_listelt_t *element, *element2;
+	const cfg_listelt_t *element, *element2;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 
 	ISC_LIST_INIT(new_listeners);
@@ -1163,8 +1181,8 @@ ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
 		for (element = cfg_list_first(controlslist);
 		     element != NULL;
 		     element = cfg_list_next(element)) {
-			cfg_obj_t *controls;
+			const cfg_obj_t *controls;
-			cfg_obj_t *inetcontrols = NULL;
+			const cfg_obj_t *inetcontrols = NULL;
 
 			controls = cfg_listelt_value(element);
 			(void)cfg_map_get(controls, "inet", &inetcontrols);
@@ -1174,9 +1192,9 @@ ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
 			for (element2 = cfg_list_first(inetcontrols);
 			     element2 != NULL;
 			     element2 = cfg_list_next(element2)) {
-				cfg_obj_t *control;
+				const cfg_obj_t *control;
-				cfg_obj_t *obj;
+				const cfg_obj_t *obj;
-				isc_sockaddr_t *addr;
+				isc_sockaddr_t addr;
 
 				/*
 				 * The parser handles BIND 8 configuration file
@@ -1189,12 +1207,12 @@ ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
 				control = cfg_listelt_value(element2);
 
 				obj = cfg_tuple_get(control, "address");
-				addr = cfg_obj_assockaddr(obj);
+				addr = *cfg_obj_assockaddr(obj);
-				if (isc_sockaddr_getport(addr) == 0)
+				if (isc_sockaddr_getport(&addr) == 0)
-					isc_sockaddr_setport(addr,
+					isc_sockaddr_setport(&addr,
 							     NS_CONTROL_PORT);
 
-				isc_sockaddr_format(addr, socktext,
+				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));
 
 				isc_log_write(ns_g_lctx,
@@ -1205,7 +1223,7 @@ ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
 					      socktext);
 
 				update_listener(cp, &listener, control, config,
-						addr, aclconfctx, socktext);
+						&addr, aclconfctx, socktext);
 
 				if (listener != NULL)
 					/*
@@ -1219,7 +1237,7 @@ ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
 					 * This is a new listener.
 					 */
 					add_listener(cp, &listener, control,
-						     config, addr, aclconfctx,
+						     config, &addr, aclconfctx,
 						     socktext);
 
 				if (listener != NULL)

contrib/bind9/bin/named/include/named/aclconf.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: aclconf.h,v 1.12.208.1 2004/03/06 10:21:23 marka Exp $ */
+/* $Id: aclconf.h,v 1.12.208.3 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NS_ACLCONF_H
 #define NS_ACLCONF_H 1
@@ -49,8 +49,8 @@ ns_aclconfctx_destroy(ns_aclconfctx_t *ctx);
  */
 
 isc_result_t
-ns_acl_fromconfig(cfg_obj_t *caml,
+ns_acl_fromconfig(const cfg_obj_t *caml,
-		  cfg_obj_t *cctx,
+		  const cfg_obj_t *cctx,
 		  ns_aclconfctx_t *ctx,
 		  isc_mem_t *mctx,
 		  dns_acl_t **target);

contrib/bind9/bin/named/include/named/client.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.h,v 1.60.2.2.10.10 2005/07/29 00:13:08 marka Exp $ */
+/* $Id: client.h,v 1.60.2.2.10.12 2006/06/06 00:11:40 marka Exp $ */
 
 #ifndef NAMED_CLIENT_H
 #define NAMED_CLIENT_H 1
@@ -198,6 +198,12 @@ ns_client_next(ns_client_t *client, isc_result_t result);
  * return no response to the client.
  */
 
+void
+ns_client_qnamereplace(ns_client_t *client, dns_name_t *name);
+/*%
+ * Replace the qname.
+ */
+
 isc_boolean_t
 ns_client_shuttingdown(ns_client_t *client);
 /*

contrib/bind9/bin/named/include/named/config.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001, 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: config.h,v 1.4.12.4 2004/04/20 14:12:10 marka Exp $ */
+/* $Id: config.h,v 1.4.12.6 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NAMED_CONFIG_H
 #define NAMED_CONFIG_H 1
@@ -29,27 +29,28 @@ isc_result_t
 ns_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf);
 
 isc_result_t
-ns_config_get(cfg_obj_t **maps, const char* name, cfg_obj_t **obj);
+ns_config_get(const cfg_obj_t **maps, const char* name, const cfg_obj_t **obj);
 
 isc_result_t
-ns_checknames_get(cfg_obj_t **maps, const char* name, cfg_obj_t **obj);
+ns_checknames_get(const cfg_obj_t **maps, const char* name,
+		  const cfg_obj_t **obj);
 
 int
-ns_config_listcount(cfg_obj_t *list);
+ns_config_listcount(const cfg_obj_t *list);
 
 isc_result_t
-ns_config_getclass(cfg_obj_t *classobj, dns_rdataclass_t defclass,
+ns_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		   dns_rdataclass_t *classp);
 
 isc_result_t
-ns_config_gettype(cfg_obj_t *typeobj, dns_rdatatype_t deftype,
+ns_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		  dns_rdatatype_t *typep);
 
 dns_zonetype_t
-ns_config_getzonetype(cfg_obj_t *zonetypeobj);
+ns_config_getzonetype(const cfg_obj_t *zonetypeobj);
 
 isc_result_t
-ns_config_getiplist(cfg_obj_t *config, cfg_obj_t *list,
+ns_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
 		    in_port_t defport, isc_mem_t *mctx,
 		    isc_sockaddr_t **addrsp, isc_uint32_t *countp);
 
@@ -58,16 +59,16 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 		    isc_uint32_t count);
 
 isc_result_t
-ns_config_getipandkeylist(cfg_obj_t *config, cfg_obj_t *list, isc_mem_t *mctx,
+ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			  isc_sockaddr_t **addrsp, dns_name_t ***keys,
+			  isc_mem_t *mctx, isc_sockaddr_t **addrsp,
-			  isc_uint32_t *countp);
+			  dns_name_t ***keys, isc_uint32_t *countp);
 
 void
 ns_config_putipandkeylist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
 			  dns_name_t ***keys, isc_uint32_t count);
 
 isc_result_t
-ns_config_getport(cfg_obj_t *config, in_port_t *portp);
+ns_config_getport(const cfg_obj_t *config, in_port_t *portp);
 
 isc_result_t
 ns_config_getkeyalgorithm(const char *str, dns_name_t **name);

contrib/bind9/bin/named/include/named/control.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: control.h,v 1.6.2.2.2.7 2004/09/03 03:43:32 marka Exp $ */
+/* $Id: control.h,v 1.6.2.2.2.9 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NAMED_CONTROL_H
 #define NAMED_CONTROL_H 1
@@ -67,7 +67,7 @@ ns_controls_destroy(ns_controls_t **ctrlsp);
  */
 
 isc_result_t
-ns_controls_configure(ns_controls_t *controls, cfg_obj_t *config,
+ns_controls_configure(ns_controls_t *controls, const cfg_obj_t *config,
 		      ns_aclconfctx_t *aclconfctx);
 /*
  * Configure zero or more command channels into 'controls'

contrib/bind9/bin/named/include/named/globals.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: globals.h,v 1.59.68.5 2004/03/08 04:04:20 marka Exp $ */
+/* $Id: globals.h,v 1.59.68.7 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NAMED_GLOBALS_H
 #define NAMED_GLOBALS_H 1
@@ -75,7 +75,7 @@ EXTERN unsigned int		ns_g_debuglevel		INIT(0);
  * Current configuration information.
  */
 EXTERN cfg_obj_t *		ns_g_config		INIT(NULL);
-EXTERN cfg_obj_t *		ns_g_defaults		INIT(NULL);
+EXTERN const cfg_obj_t *	ns_g_defaults		INIT(NULL);
 EXTERN const char *		ns_g_conffile		INIT(NS_SYSCONFDIR
 							     "/named.conf");
 EXTERN const char *		ns_g_keyfile		INIT(NS_SYSCONFDIR

contrib/bind9/bin/named/include/named/logconf.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: logconf.h,v 1.10.208.1 2004/03/06 10:21:24 marka Exp $ */
+/* $Id: logconf.h,v 1.10.208.3 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NAMED_LOGCONF_H
 #define NAMED_LOGCONF_H 1
@@ -23,7 +23,7 @@
 #include <isc/log.h>
 
 isc_result_t
-ns_log_configure(isc_logconfig_t *logconf, cfg_obj_t *logstmt);
+ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt);
 /*
  * Set up the logging configuration in '*logconf' according to
  * the named.conf data in 'logstmt'.

contrib/bind9/bin/named/include/named/lwresd.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwresd.h,v 1.12.208.1 2004/03/06 10:21:25 marka Exp $ */
+/* $Id: lwresd.h,v 1.12.208.3 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NAMED_LWRESD_H
 #define NAMED_LWRESD_H 1
@@ -56,7 +56,7 @@ struct ns_lwreslistener {
  * Configure lwresd.
  */
 isc_result_t
-ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config);
+ns_lwresd_configure(isc_mem_t *mctx, const cfg_obj_t *config);
 
 isc_result_t
 ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,
@@ -72,7 +72,8 @@ ns_lwresd_shutdown(void);
  * Manager functions
  */
 isc_result_t
-ns_lwdmanager_create(isc_mem_t *mctx, cfg_obj_t *lwres, ns_lwresd_t **lwresdp);
+ns_lwdmanager_create(isc_mem_t *mctx, const cfg_obj_t *lwres,
+		      ns_lwresd_t **lwresdp);
 
 void
 ns_lwdmanager_attach(ns_lwresd_t *source, ns_lwresd_t **targetp);

contrib/bind9/bin/named/include/named/server.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.h,v 1.58.2.1.10.11 2004/03/08 04:04:21 marka Exp $ */
+/* $Id: server.h,v 1.58.2.1.10.13 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NAMED_SERVER_H
 #define NAMED_SERVER_H 1
@@ -208,6 +208,6 @@ ns_server_dumprecursing(ns_server_t *server);
  * Maintain a list of dispatches that require reserved ports.
  */
 void
-ns_add_reserved_dispatch(ns_server_t *server, isc_sockaddr_t *addr);
+ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr);
 
 #endif /* NAMED_SERVER_H */

contrib/bind9/bin/named/include/named/sortlist.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sortlist.h,v 1.4.208.1 2004/03/06 10:21:26 marka Exp $ */
+/* $Id: sortlist.h,v 1.4.208.3 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NAMED_SORTLIST_H
 #define NAMED_SORTLIST_H 1
@@ -28,7 +28,7 @@
  * Type for callback functions that rank addresses.
  */
 typedef int 
-(*dns_addressorderfunc_t)(isc_netaddr_t *address, void *arg);
+(*dns_addressorderfunc_t)(const isc_netaddr_t *address, const void *arg);
 
 /*
  * Return value type for setup_sortlist.
@@ -40,7 +40,8 @@ typedef enum {
 } ns_sortlisttype_t;
 
 ns_sortlisttype_t
-ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr, void **argp);
+ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr,
+		  const void **argp);
 /*
  * Find the sortlist statement in 'acl' that applies to 'clientaddr', if any.
  *
@@ -55,14 +56,14 @@ ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr, void **argp);
  */
 
 int
-ns_sortlist_addrorder1(isc_netaddr_t *addr, void *arg);
+ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg);
 /*
  * Find the sort order of 'addr' in 'arg', the matching element
  * of a 1-element top-level sortlist statement.
  */
 
 int
-ns_sortlist_addrorder2(isc_netaddr_t *addr, void *arg);
+ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg);
 /*
  * Find the sort order of 'addr' in 'arg', a topology-like
  * ACL forming the second element in a 2-element top-level
@@ -72,7 +73,7 @@ ns_sortlist_addrorder2(isc_netaddr_t *addr, void *arg);
 void
 ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, isc_netaddr_t *client_addr,
 			dns_addressorderfunc_t *orderp,
-			void **argp);
+			const void **argp);
 /*
  * Find the sortlist statement in 'acl' that applies to 'clientaddr', if any.
  * If a sortlist statement applies, return in '*orderp' a pointer to a function

contrib/bind9/bin/named/include/named/tkeyconf.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tkeyconf.h,v 1.9.208.1 2004/03/06 10:21:26 marka Exp $ */
+/* $Id: tkeyconf.h,v 1.9.208.3 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NS_TKEYCONF_H
 #define NS_TKEYCONF_H 1
@@ -28,8 +28,8 @@
 ISC_LANG_BEGINDECLS
 
 isc_result_t
-ns_tkeyctx_fromconfig(cfg_obj_t *options, isc_mem_t *mctx, isc_entropy_t *ectx,
+ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-		      dns_tkeyctx_t **tctxp);
+		      isc_entropy_t *ectx, dns_tkeyctx_t **tctxp);
 /*
  * 	Create a TKEY context and configure it, including the default DH key
  *	and default domain, according to 'options'.

contrib/bind9/bin/named/include/named/tsigconf.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tsigconf.h,v 1.9.208.1 2004/03/06 10:21:26 marka Exp $ */
+/* $Id: tsigconf.h,v 1.9.208.3 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NS_TSIGCONF_H
 #define NS_TSIGCONF_H 1
@@ -26,7 +26,7 @@
 ISC_LANG_BEGINDECLS
 
 isc_result_t
-ns_tsigkeyring_fromconfig(cfg_obj_t *config, cfg_obj_t *vconfig,
+ns_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			  isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
 /*
  * Create a TSIG key ring and configure it according to the 'key'

contrib/bind9/bin/named/include/named/zoneconf.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zoneconf.h,v 1.16.2.2.8.1 2004/03/06 10:21:27 marka Exp $ */
+/* $Id: zoneconf.h,v 1.16.2.2.8.3 2006/03/02 00:37:20 marka Exp $ */
 
 #ifndef NS_ZONECONF_H
 #define NS_ZONECONF_H 1
@@ -30,8 +30,9 @@
 ISC_LANG_BEGINDECLS
 
 isc_result_t
-ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
+ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-		  ns_aclconfctx_t *ac, dns_zone_t *zone);
+		  const cfg_obj_t *zconfig, ns_aclconfctx_t *ac,
+		  dns_zone_t *zone);
 /*
  * Configure or reconfigure a zone according to the named.conf
  * data in 'cctx' and 'czone'.
@@ -48,7 +49,7 @@ ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
  */
 
 isc_boolean_t
-ns_zone_reusable(dns_zone_t *zone, cfg_obj_t *zconfig);
+ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
 /*
  * If 'zone' can be safely reconfigured according to the configuration
  * data in 'zconfig', return ISC_TRUE.  If the configuration data is so

contrib/bind9/bin/named/interfacemgr.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: interfacemgr.c,v 1.59.2.5.8.15 2004/08/10 04:56:23 jinmei Exp $ */
+/* $Id: interfacemgr.c,v 1.59.2.5.8.18 2006/07/19 00:16:28 marka Exp $ */
 
 #include <config.h>
 
@@ -182,6 +182,7 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 	ifp->mgr = NULL;
 	ifp->generation = mgr->generation;
 	ifp->addr = *addr;
+	ifp->flags = 0;
 	strncpy(ifp->name, name, sizeof(ifp->name));
 	ifp->name[sizeof(ifp->name)-1] = '\0';
 	ifp->clientmgr = NULL;
@@ -717,9 +718,8 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 			 * See if the address matches the listen-on statement;
 			 * if not, ignore the interface.
 			 */
-			result = dns_acl_match(&listen_netaddr, NULL,
+			(void)dns_acl_match(&listen_netaddr, NULL, le->acl,
-					       le->acl, &mgr->aclenv,
+					    &mgr->aclenv, &match, NULL);
-					       &match, NULL);
 			if (match <= 0)
 				continue;
 
@@ -745,9 +745,9 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 				for (ele = ISC_LIST_HEAD(ext_listen->elts);
 				     ele != NULL;
 				     ele = ISC_LIST_NEXT(ele, link)) {
-					dns_acl_match(&listen_netaddr, NULL,
+					(void)dns_acl_match(&listen_netaddr,
-						      ele->acl, NULL,
+							    NULL, ele->acl,
-						      &match, NULL);
+							    NULL, &match, NULL);
 					if (match > 0 && ele->port == le->port)
 						break;
 					else

contrib/bind9/bin/named/logconf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: logconf.c,v 1.30.2.3.10.2 2004/03/06 10:21:18 marka Exp $ */
+/* $Id: logconf.c,v 1.30.2.3.10.4 2006/03/02 00:37:20 marka Exp $ */
 
 #include <config.h>
 
@@ -41,13 +41,13 @@
  * in 'ccat' and add it to 'lctx'.
  */
 static isc_result_t
-category_fromconf(cfg_obj_t *ccat, isc_logconfig_t *lctx) {
+category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *lctx) {
 	isc_result_t result;
 	const char *catname;
 	isc_logcategory_t *category;
 	isc_logmodule_t *module;
-	cfg_obj_t *destinations = NULL;
+	const cfg_obj_t *destinations = NULL;
-	cfg_listelt_t *element = NULL;
+	const cfg_listelt_t *element = NULL;
 
 	catname = cfg_obj_asstring(cfg_tuple_get(ccat, "name"));
 	category = isc_log_categorybyname(ns_g_lctx, catname);
@@ -68,8 +68,8 @@ category_fromconf(cfg_obj_t *ccat, isc_logconfig_t *lctx) {
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *channel = cfg_listelt_value(element);
+		const cfg_obj_t *channel = cfg_listelt_value(element);
-		char *channelname = cfg_obj_asstring(channel);
+		const char *channelname = cfg_obj_asstring(channel);
 
 		result = isc_log_usechannel(lctx, channelname, category,
 					    module);
@@ -89,18 +89,18 @@ category_fromconf(cfg_obj_t *ccat, isc_logconfig_t *lctx) {
  * in 'cchan' and add it to 'lctx'.
  */
 static isc_result_t
-channel_fromconf(cfg_obj_t *channel, isc_logconfig_t *lctx) {
+channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *lctx) {
 	isc_result_t result;
 	isc_logdestination_t dest;
 	unsigned int type;
 	unsigned int flags = 0;
 	int level;
 	const char *channelname;
-	cfg_obj_t *fileobj = NULL;
+	const cfg_obj_t *fileobj = NULL;
-	cfg_obj_t *syslogobj = NULL;
+	const cfg_obj_t *syslogobj = NULL;
-	cfg_obj_t *nullobj = NULL;
+	const cfg_obj_t *nullobj = NULL;
-	cfg_obj_t *stderrobj = NULL;
+	const cfg_obj_t *stderrobj = NULL;
-	cfg_obj_t *severity = NULL;
+	const cfg_obj_t *severity = NULL;
 	int i;
 
 	channelname = cfg_obj_asstring(cfg_map_getname(channel));
@@ -130,9 +130,10 @@ channel_fromconf(cfg_obj_t *channel, isc_logconfig_t *lctx) {
 	type = ISC_LOG_TONULL;
 	
 	if (fileobj != NULL) {
-		cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
+		const cfg_obj_t *pathobj = cfg_tuple_get(fileobj, "file");
-		cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
+		const cfg_obj_t *sizeobj = cfg_tuple_get(fileobj, "size");
-		cfg_obj_t *versionsobj = cfg_tuple_get(fileobj, "versions");
+		const cfg_obj_t *versionsobj =
+				 cfg_tuple_get(fileobj, "versions");
 		isc_int32_t versions = ISC_LOG_ROLLNEVER;
 		isc_offset_t size = 0;
 
@@ -157,7 +158,7 @@ channel_fromconf(cfg_obj_t *channel, isc_logconfig_t *lctx) {
 		type = ISC_LOG_TOSYSLOG;
 
 		if (cfg_obj_isstring(syslogobj)) {
-			char *facilitystr = cfg_obj_asstring(syslogobj);
+			const char *facilitystr = cfg_obj_asstring(syslogobj);
 			(void)isc_syslog_facilityfromstring(facilitystr,
 							    &facility);
 		}
@@ -174,9 +175,9 @@ channel_fromconf(cfg_obj_t *channel, isc_logconfig_t *lctx) {
 	 * Munge flags.
 	 */
 	{
-		cfg_obj_t *printcat = NULL;
+		const cfg_obj_t *printcat = NULL;
-		cfg_obj_t *printsev = NULL;
+		const cfg_obj_t *printsev = NULL;
-		cfg_obj_t *printtime = NULL;
+		const cfg_obj_t *printtime = NULL;
 
 		(void)cfg_map_get(channel, "print-category", &printcat);
 		(void)cfg_map_get(channel, "print-severity", &printsev);
@@ -193,7 +194,7 @@ channel_fromconf(cfg_obj_t *channel, isc_logconfig_t *lctx) {
 	level = ISC_LOG_INFO;
 	if (cfg_map_get(channel, "severity", &severity) == ISC_R_SUCCESS) {
 		if (cfg_obj_isstring(severity)) {
-			char *str = cfg_obj_asstring(severity);
+			const char *str = cfg_obj_asstring(severity);
 			if (strcasecmp(str, "critical") == 0)
 				level = ISC_LOG_CRITICAL;
 			else if (strcasecmp(str, "error") == 0)
@@ -242,13 +243,14 @@ channel_fromconf(cfg_obj_t *channel, isc_logconfig_t *lctx) {
 }
 
 isc_result_t
-ns_log_configure(isc_logconfig_t *logconf, cfg_obj_t *logstmt) {
+ns_log_configure(isc_logconfig_t *logconf, const cfg_obj_t *logstmt) {
 	isc_result_t result;
-	cfg_obj_t *channels = NULL;
+	const cfg_obj_t *channels = NULL;
-	cfg_obj_t *categories = NULL;
+	const cfg_obj_t *categories = NULL;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	isc_boolean_t default_set = ISC_FALSE;
 	isc_boolean_t unmatched_set = ISC_FALSE;
+	const cfg_obj_t *catname;
 
 	CHECK(ns_log_setdefaultchannels(logconf));
 
@@ -257,7 +259,7 @@ ns_log_configure(isc_logconfig_t *logconf, cfg_obj_t *logstmt) {
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *channel = cfg_listelt_value(element);
+		const cfg_obj_t *channel = cfg_listelt_value(element);
 		CHECK(channel_fromconf(channel, logconf));
 	}
 
@@ -266,15 +268,15 @@ ns_log_configure(isc_logconfig_t *logconf, cfg_obj_t *logstmt) {
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *category = cfg_listelt_value(element);
+		const cfg_obj_t *category = cfg_listelt_value(element);
 		CHECK(category_fromconf(category, logconf));
 		if (!default_set) {
-			cfg_obj_t *catname = cfg_tuple_get(category, "name");
+			catname = cfg_tuple_get(category, "name");
 			if (strcmp(cfg_obj_asstring(catname), "default") == 0)
 				default_set = ISC_TRUE;
 		}
 		if (!unmatched_set) {
-			cfg_obj_t *catname = cfg_tuple_get(category, "name");
+			catname = cfg_tuple_get(category, "name");
 			if (strcmp(cfg_obj_asstring(catname), "unmatched") == 0)
 				unmatched_set = ISC_TRUE;
 		}

contrib/bind9/bin/named/lwdgabn.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwdgabn.c,v 1.13.12.3 2004/03/08 04:04:19 marka Exp $ */
+/* $Id: lwdgabn.c,v 1.13.12.5 2006/03/02 00:37:20 marka Exp $ */
 
 #include <config.h>
 
@@ -120,7 +120,7 @@ sort_addresses(ns_lwdclient_t *client) {
 	rankedaddress *addrs;
 	isc_netaddr_t remote;
 	dns_addressorderfunc_t order;
-	void *arg;
+	const void *arg;
 	ns_lwresd_t *lwresd = client->clientmgr->listener->manager;
 	unsigned int i;
 	isc_result_t result;

contrib/bind9/bin/named/lwdgrbn.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwdgrbn.c,v 1.11.208.3 2004/03/08 04:04:19 marka Exp $ */
+/* $Id: lwdgrbn.c,v 1.11.208.5 2006/01/04 23:50:19 marka Exp $ */
 
 #include <config.h>
 
@@ -358,7 +358,7 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 	client->sendlength = r.length;
 	result = ns_lwdclient_sendreply(client, &r);
 	if (result != ISC_R_SUCCESS)
-		goto out;
+		goto out2;
 
 	NS_LWDCLIENT_SETSEND(client);
 
@@ -378,7 +378,7 @@ lookup_done(isc_task_t *task, isc_event_t *event) {
 	if (grbn->siglen != NULL)
 		isc_mem_put(cm->mctx, grbn->siglen,
 			    grbn->nsigs * sizeof(lwres_uint16_t));
-
+ out2:
 	if (client->lookup != NULL)
 		dns_lookup_destroy(&client->lookup);
 	if (lwb.base != NULL)

contrib/bind9/bin/named/lwresd.8

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwresd.8,v 1.13.208.5 2005/10/13 02:33:47 marka Exp $
+.\" $Id: lwresd.8,v 1.13.208.6 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: lwresd
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "LWRESD" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -57,41 +60,41 @@ entries are present, or if forwarding fails,
 \fBlwresd\fR
 resolves the queries autonomously starting at the root name servers, using a built\-in list of root server hints.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-C \fIconfig\-file\fR
 Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
 \fI/etc/resolv.conf\fR.
-.TP
+.TP 3n
 \-d \fIdebug\-level\fR
 Set the daemon's debug level to
 \fIdebug\-level\fR. Debugging traces from
 \fBlwresd\fR
 become more verbose as the debug level increases.
-.TP
+.TP 3n
 \-f
 Run the server in the foreground (i.e. do not daemonize).
-.TP
+.TP 3n
 \-g
 Run the server in the foreground and force all logging to
 \fIstderr\fR.
-.TP
+.TP 3n
 \-n \fI#cpus\fR
 Create
 \fI#cpus\fR
 worker threads to take advantage of multiple CPUs. If not specified,
 \fBlwresd\fR
 will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created.
-.TP
+.TP 3n
 \-P \fIport\fR
 Listen for lightweight resolver queries on port
 \fIport\fR. If not specified, the default is port 921.
-.TP
+.TP 3n
 \-p \fIport\fR
 Send DNS lookups to port
 \fIport\fR. If not specified, the default is port 53. This provides a way of testing the lightweight resolver daemon with a name server that listens for queries on a non\-standard port number.
-.TP
+.TP 3n
 \-s
 Write memory usage statistics to
 \fIstdout\fR
@@ -100,7 +103,7 @@ on exit.
 .B "Note:"
 This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.
 .RE
-.TP
+.TP 3n
 \-t \fIdirectory\fR
 \fBchroot()\fR
 to
@@ -114,20 +117,20 @@ option, as chrooting a process running as root doesn't enhance security on most
 \fBchroot()\fR
 is defined allows a process with root privileges to escape a chroot jail.
 .RE
-.TP
+.TP 3n
 \-u \fIuser\fR
 \fBsetuid()\fR
 to
 \fIuser\fR
 after completing privileged operations, such as creating sockets that listen on privileged ports.
-.TP
+.TP 3n
 \-v
 Report the version number and exit.
 .SH "FILES"
-.TP
+.TP 3n
 \fI/etc/resolv.conf\fR
 The default configuration file.
-.TP
+.TP 3n
 \fI/var/run/lwresd.pid\fR
 The default process\-id file.
 .SH "SEE ALSO"
@@ -138,3 +141,5 @@ The default process\-id file.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/named/lwresd.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwresd.c,v 1.37.2.2.2.5 2004/03/08 04:04:19 marka Exp $ */
+/* $Id: lwresd.c,v 1.37.2.2.2.8 2006/02/28 06:32:53 marka Exp $ */
 
 /*
  * Main program for the Lightweight Resolver Daemon.
@@ -285,14 +285,14 @@ ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,
  * Handle lwresd manager objects
  */
 isc_result_t
-ns_lwdmanager_create(isc_mem_t *mctx, cfg_obj_t *lwres,
+ns_lwdmanager_create(isc_mem_t *mctx, const cfg_obj_t *lwres,
 		     ns_lwresd_t **lwresdp)
 {
 	ns_lwresd_t *lwresd;
 	const char *vname;
 	dns_rdataclass_t vclass;
-	cfg_obj_t *obj, *viewobj, *searchobj;
+	const cfg_obj_t *obj, *viewobj, *searchobj;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	isc_result_t result;
 
 	INSIST(lwresdp != NULL && *lwresdp == NULL);
@@ -356,8 +356,8 @@ ns_lwdmanager_create(isc_mem_t *mctx, cfg_obj_t *lwres,
 		     element != NULL;
 		     element = cfg_list_next(element))
 		{
-			cfg_obj_t *search;
+			const cfg_obj_t *search;
-			char *searchstr;
+			const char *searchstr;
 			isc_buffer_t namebuf;
 			dns_fixedname_t fname;
 			dns_name_t *name;
@@ -407,6 +407,7 @@ ns_lwdmanager_create(isc_mem_t *mctx, cfg_obj_t *lwres,
 		ns_lwsearchlist_detach(&lwresd->search);
 	if (lwresd->mctx != NULL)
 		isc_mem_detach(&lwresd->mctx);
+	isc_mem_put(mctx, lwresd, sizeof(ns_lwresd_t));
 	return (result);
 }
 
@@ -744,11 +745,11 @@ configure_listener(isc_sockaddr_t *address, ns_lwresd_t *lwresd,
 }
 
 isc_result_t
-ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config) {
+ns_lwresd_configure(isc_mem_t *mctx, const cfg_obj_t *config) {
-	cfg_obj_t *lwreslist = NULL;
+	const cfg_obj_t *lwreslist = NULL;
-	cfg_obj_t *lwres = NULL;
+	const cfg_obj_t *lwres = NULL;
-	cfg_obj_t *listenerslist = NULL;
+	const cfg_obj_t *listenerslist = NULL;
-	cfg_listelt_t *element = NULL;
+	const cfg_listelt_t *element = NULL;
 	ns_lwreslistener_t *listener;
 	ns_lwreslistenerlist_t newlisteners;
 	isc_result_t result;

contrib/bind9/bin/named/lwresd.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwresd.html,v 1.4.2.1.4.8 2005/10/13 02:33:47 marka Exp $ -->
+<!-- $Id: lwresd.html,v 1.4.2.1.4.10 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwresd</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">lwresd</span> &#8212; lightweight resolver daemon</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">lwresd</code>  [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525920"></a><h2>DESCRIPTION</h2>
+<a name="id2549484"></a><h2>DESCRIPTION</h2>
 <p>
 	<span><strong class="command">lwresd</strong></span> is the daemon providing name lookup
 	services to clients that use the BIND 9 lightweight resolver
@@ -67,7 +67,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525969"></a><h2>OPTIONS</h2>
+<a name="id2549533"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>
 <dd><p>
@@ -159,7 +159,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526237"></a><h2>FILES</h2>
+<a name="id2549939"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -172,7 +172,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526277"></a><h2>SEE ALSO</h2>
+<a name="id2549978"></a><h2>SEE ALSO</h2>
 <p>
 	<span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
 	<span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
@@ -180,7 +180,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526315"></a><h2>AUTHOR</h2>
+<a name="id2550017"></a><h2>AUTHOR</h2>
 <p>
 	<span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/named/main.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: main.c,v 1.119.2.3.2.22 2005/04/29 01:04:47 marka Exp $ */
+/* $Id: main.c,v 1.119.2.3.2.25 2006/11/10 18:51:06 marka Exp $ */
 
 #include <config.h>
 
@@ -473,7 +473,7 @@ create_managers(void) {
 	result = isc_taskmgr_create(ns_g_mctx, ns_g_cpus, 0, &ns_g_taskmgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "ns_taskmgr_create() failed: %s",
+				 "isc_taskmgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
@@ -481,7 +481,7 @@ create_managers(void) {
 	result = isc_timermgr_create(ns_g_mctx, &ns_g_timermgr);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "ns_timermgr_create() failed: %s",
+				 "isc_timermgr_create() failed: %s",
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
@@ -856,7 +856,7 @@ main(int argc, char *argv[]) {
 		if (result == ISC_R_SUCCESS && instance != NULL) {
 			if (smf_disable_instance(instance, 0) != 0)
 				UNEXPECTED_ERROR(__FILE__, __LINE__,
-						 "smf_disable_instance() ",
+						 "smf_disable_instance() "
 						 "failed for %s : %s",
 						 instance,
 						 scf_strerror(scf_error()));

contrib/bind9/bin/named/named.8

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.8,v 1.17.208.6 2005/10/13 02:33:46 marka Exp $
+.\" $Id: named.8,v 1.17.208.9 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: named
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NAMED" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -41,21 +44,21 @@ When invoked without arguments,
 will read the default configuration file
 \fI/etc/named.conf\fR, read any initial data, and listen for queries.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-4
 Use IPv4 only even if the host machine is capable of IPv6.
 \fB\-4\fR
 and
 \fB\-6\fR
 are mutually exclusive.
-.TP
+.TP 3n
 \-6
 Use IPv6 only even if the host machine is capable of IPv4.
 \fB\-4\fR
 and
 \fB\-6\fR
 are mutually exclusive.
-.TP
+.TP 3n
 \-c \fIconfig\-file\fR
 Use
 \fIconfig\-file\fR
@@ -65,31 +68,31 @@ as the configuration file instead of the default,
 option in the configuration file,
 \fIconfig\-file\fR
 should be an absolute pathname.
-.TP
+.TP 3n
 \-d \fIdebug\-level\fR
 Set the daemon's debug level to
 \fIdebug\-level\fR. Debugging traces from
 \fBnamed\fR
 become more verbose as the debug level increases.
-.TP
+.TP 3n
 \-f
 Run the server in the foreground (i.e. do not daemonize).
-.TP
+.TP 3n
 \-g
 Run the server in the foreground and force all logging to
 \fIstderr\fR.
-.TP
+.TP 3n
 \-n \fI#cpus\fR
 Create
 \fI#cpus\fR
 worker threads to take advantage of multiple CPUs. If not specified,
 \fBnamed\fR
 will try to determine the number of CPUs present and create one thread per CPU. If it is unable to determine the number of CPUs, a single worker thread will be created.
-.TP
+.TP 3n
 \-p \fIport\fR
 Listen for queries on port
 \fIport\fR. If not specified, the default is port 53.
-.TP
+.TP 3n
 \-s
 Write memory usage statistics to
 \fIstdout\fR
@@ -98,7 +101,7 @@ on exit.
 .B "Note:"
 This option is mainly of interest to BIND 9 developers and may be removed or changed in a future release.
 .RE
-.TP
+.TP 3n
 \-t \fIdirectory\fR
 \fBchroot()\fR
 to
@@ -112,7 +115,7 @@ option, as chrooting a process running as root doesn't enhance security on most
 \fBchroot()\fR
 is defined allows a process with root privileges to escape a chroot jail.
 .RE
-.TP
+.TP 3n
 \-u \fIuser\fR
 \fBsetuid()\fR
 to
@@ -131,10 +134,10 @@ option only works when
 is run on kernel 2.2.18 or later, or kernel 2.3.99\-pre3 or later, since previous kernels did not allow privileges to be retained after
 \fBsetuid()\fR.
 .RE
-.TP
+.TP 3n
 \-v
 Report the version number and exit.
-.TP
+.TP 3n
 \-x \fIcache\-file\fR
 Load data from
 \fIcache\-file\fR
@@ -148,10 +151,10 @@ This option must not be used. It is only of interest to BIND 9 developers and ma
 In routine operation, signals should not be used to control the nameserver;
 \fBrndc\fR
 should be used instead.
-.TP
+.TP 3n
 SIGHUP
 Force a reload of the server.
-.TP
+.TP 3n
 SIGINT, SIGTERM
 Shut down the server.
 .PP
@@ -163,10 +166,10 @@ The
 configuration file is too complex to describe in detail here. A complete description is provided in the
 BIND 9 Administrator Reference Manual.
 .SH "FILES"
-.TP
+.TP 3n
 \fI/etc/named.conf\fR
 The default configuration file.
-.TP
+.TP 3n
 \fI/var/run/named.pid\fR
 The default process\-id file.
 .SH "SEE ALSO"
@@ -176,7 +179,10 @@ RFC 1034,
 RFC 1035,
 \fBrndc\fR(8),
 \fBlwresd\fR(8),
+\fBnamed.conf\fR(5),
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/named/named.conf.5

@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -12,15 +12,18 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.conf.5,v 1.1.4.6 2005/10/13 02:33:47 marka Exp $
+.\" $Id: named.conf.5,v 1.1.4.10 2006/09/13 02:56:20 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: \fInamed.conf\fR
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: Aug 13, 2004
-.TH "\\FINAMED.CONF\\FR" "5" "Aug 13, 2004" "BIND9" "BIND9"
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
+.TH "\fINAMED.CONF\fR" "5" "Aug 13, 2004" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -43,27 +46,34 @@ C++ style: // to end of line
 Unix style: # to end of line
 .SH "ACL"
 .sp
+.RS 3n
 .nf
 acl \fIstring\fR { \fIaddress_match_element\fR; ... };
 .fi
+.RE
 .SH "KEY"
 .sp
+.RS 3n
 .nf
 key \fIdomain_name\fR {
 	algorithm \fIstring\fR;
 	secret \fIstring\fR;
 };
 .fi
+.RE
 .SH "MASTERS"
 .sp
+.RS 3n
 .nf
 masters \fIstring\fR [ port \fIinteger\fR ] {
 	( \fImasters\fR | \fIipv4_address\fR [port \fIinteger\fR] |
 	\fIipv6_address\fR [port \fIinteger\fR] ) [ key \fIstring\fR ]; ...
 };
 .fi
+.RE
 .SH "SERVER"
 .sp
+.RS 3n
 .nf
 server ( \fIipv4_address\fR | \fIipv6_address\fR ) {
 	bogus \fIboolean\fR;
@@ -80,15 +90,19 @@ server ( \fIipv4_address\fR | \fIipv6_address\fR ) {
 	support\-ixfr \fIboolean\fR; // obsolete
 };
 .fi
+.RE
 .SH "TRUSTED\-KEYS"
 .sp
+.RS 3n
 .nf
 trusted\-keys {
 	\fIdomain_name\fR \fIflags\fR \fIprotocol\fR \fIalgorithm\fR \fIkey\fR; ... 
 };
 .fi
+.RE
 .SH "CONTROLS"
 .sp
+.RS 3n
 .nf
 controls {
 	inet ( \fIipv4_address\fR | \fIipv6_address\fR | * )
@@ -98,8 +112,10 @@ controls {
 	unix \fIunsupported\fR; // not implemented
 };
 .fi
+.RE
 .SH "LOGGING"
 .sp
+.RS 3n
 .nf
 logging {
 	channel \fIstring\fR {
@@ -115,8 +131,10 @@ logging {
 	category \fIstring\fR { \fIstring\fR; ... };
 };
 .fi
+.RE
 .SH "LWRES"
 .sp
+.RS 3n
 .nf
 lwres {
 	listen\-on [ port \fIinteger\fR ] {
@@ -127,8 +145,10 @@ lwres {
 	ndots \fIinteger\fR;
 };
 .fi
+.RE
 .SH "OPTIONS"
 .sp
+.RS 3n
 .nf
 options {
 	avoid\-v4\-udp\-ports { \fIport\fR; ... };
@@ -137,6 +157,7 @@ options {
 	coresize \fIsize\fR;
 	datasize \fIsize\fR;
 	directory \fIquoted_string\fR;
+	cache\-file \fIquoted_string\fR; // test option
 	dump\-file \fIquoted_string\fR;
 	files \fIsize\fR;
 	heartbeat\-interval \fIinteger\fR;
@@ -184,8 +205,8 @@ options {
 	rfc2308\-type1 \fIboolean\fR; // not yet implemented
 	additional\-from\-auth \fIboolean\fR;
 	additional\-from\-cache \fIboolean\fR;
-	query\-source \fIquerysource4\fR;
+	query\-source [ address ( \fIipv4_address\fR | * ) ] [ port ( \fIinteger\fR | * ) ];
-	query\-source\-v6 \fIquerysource6\fR;
+	query\-source\-v6 [ address ( \fIipv6_address\fR | * ) ] [ port ( \fIinteger\fR | * ) ];
 	cleaning\-interval \fIinteger\fR;
 	min\-roots \fIinteger\fR; // not implemented
 	lame\-ttl \fIinteger\fR;
@@ -260,8 +281,10 @@ options {
 	use\-id\-pool \fIboolean\fR; // obsolete
 };
 .fi
+.RE
 .SH "VIEW"
 .sp
+.RS 3n
 .nf
 view \fIstring\fR \fIoptional_class\fR {
 	match\-clients { \fIaddress_match_element\fR; ... };
@@ -295,8 +318,8 @@ view \fIstring\fR \fIoptional_class\fR {
 	rfc2308\-type1 \fIboolean\fR; // not yet implemented
 	additional\-from\-auth \fIboolean\fR;
 	additional\-from\-cache \fIboolean\fR;
-	query\-source \fIquerysource4\fR;
+	query\-source [ address ( \fIipv4_address\fR | * ) ] [ port ( \fIinteger\fR | * ) ];
-	query\-source\-v6 \fIquerysource6\fR;
+	query\-source\-v6 [ address ( \fIipv6_address\fR | * ) ] [ port ( \fIinteger\fR | * ) ];
 	cleaning\-interval \fIinteger\fR;
 	min\-roots \fIinteger\fR; // not implemented
 	lame\-ttl \fIinteger\fR;
@@ -363,8 +386,10 @@ view \fIstring\fR \fIoptional_class\fR {
 	max\-ixfr\-log\-size \fIsize\fR; // obsolete
 };
 .fi
+.RE
 .SH "ZONE"
 .sp
+.RS 3n
 .nf
 zone \fIstring\fR \fIoptional_class\fR {
 	type ( master | slave | stub | hint |
@@ -428,6 +453,7 @@ zone \fIstring\fR \fIoptional_class\fR {
 	pubkey \fIinteger\fR \fIinteger\fR \fIinteger\fR \fIquoted_string\fR; // obsolete
 };
 .fi
+.RE
 .SH "FILES"
 .PP
 \fI/etc/named.conf\fR
@@ -435,4 +461,6 @@ zone \fIstring\fR \fIoptional_class\fR {
 .PP
 \fBnamed\fR(8),
 \fBrndc\fR(8),
-\fBBIND 9 Adminstrators Reference Manual\fR().
+\fBBIND 9 Administrator Reference Manual\fR().
+.SH "COPYRIGHT"
+Copyright \(co 2004\-2006 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/named/named.conf.docbook

@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  -
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.conf.docbook,v 1.1.4.4 2005/05/13 01:22:33 marka Exp $ -->
+<!-- $Id: named.conf.docbook,v 1.1.4.8 2006/09/13 00:26:41 marka Exp $ -->
 
 <refentry>
   <refentryinfo>
@@ -34,6 +34,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2006</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -183,6 +184,7 @@ options {
 	coresize <replaceable>size</replaceable>;
 	datasize <replaceable>size</replaceable>;
 	directory <replaceable>quoted_string</replaceable>;
+	cache-file <replaceable>quoted_string</replaceable>; // test option
 	dump-file <replaceable>quoted_string</replaceable>;
 	files <replaceable>size</replaceable>;
 	heartbeat-interval <replaceable>integer</replaceable>;
@@ -230,8 +232,8 @@ options {
 	rfc2308-type1 <replaceable>boolean</replaceable>; // not yet implemented
 	additional-from-auth <replaceable>boolean</replaceable>;
 	additional-from-cache <replaceable>boolean</replaceable>;
-	query-source <replaceable>querysource4</replaceable>;
+	query-source <optional> address ( <replaceable>ipv4_address</replaceable> | * ) </optional> <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
-	query-source-v6 <replaceable>querysource6</replaceable>;
+	query-source-v6 <optional> address ( <replaceable>ipv6_address</replaceable> | * ) </optional> <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	cleaning-interval <replaceable>integer</replaceable>;
 	min-roots <replaceable>integer</replaceable>; // not implemented
 	lame-ttl <replaceable>integer</replaceable>;
@@ -357,8 +359,8 @@ view <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 	rfc2308-type1 <replaceable>boolean</replaceable>; // not yet implemented
 	additional-from-auth <replaceable>boolean</replaceable>;
 	additional-from-cache <replaceable>boolean</replaceable>;
-	query-source <replaceable>querysource4</replaceable>;
+	query-source <optional> address ( <replaceable>ipv4_address</replaceable> | * ) </optional> <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
-	query-source-v6 <replaceable>querysource6</replaceable>;
+	query-source-v6 <optional> address ( <replaceable>ipv6_address</replaceable> | * ) </optional> <optional> port ( <replaceable>integer</replaceable> | * ) </optional>;
 	cleaning-interval <replaceable>integer</replaceable>;
 	min-roots <replaceable>integer</replaceable>; // not implemented
 	lame-ttl <replaceable>integer</replaceable>;
@@ -530,7 +532,7 @@ zone <replaceable>string</replaceable> <replaceable>optional_class</replaceable>
 <refentrytitle>rndc</refentrytitle><manvolnum>8</manvolnum>
 </citerefentry>,
 <citerefentry>
-<refentrytitle>BIND 9 Adminstrators Reference Manual</refentrytitle>
+<refentrytitle>BIND 9 Administrator Reference Manual</refentrytitle>
 </citerefentry>.
 </para>
 </refsect1>

contrib/bind9/bin/named/named.conf.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -13,15 +13,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.conf.html,v 1.1.4.10 2005/10/13 02:33:48 marka Exp $ -->
+<!-- $Id: named.conf.html,v 1.1.4.15 2006/09/13 02:56:21 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named.conf</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><code class="filename">named.conf</code> &#8212; configuration file for named</p>
@@ -31,7 +31,7 @@
 <div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525889"></a><h2>DESCRIPTION</h2>
+<a name="id2549388"></a><h2>DESCRIPTION</h2>
 <p>
 	<code class="filename">named.conf</code> is the configuration file for
 	<span><strong class="command">named</strong></span>.  Statements are enclosed
@@ -50,14 +50,14 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525917"></a><h2>ACL</h2>
+<a name="id2549417"></a><h2>ACL</h2>
 <div class="literallayout"><p><br>
 acl <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 <br>
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525933"></a><h2>KEY</h2>
+<a name="id2549433"></a><h2>KEY</h2>
 <div class="literallayout"><p><br>
 key <em class="replaceable"><code>domain_name</code></em> {<br>
 	algorithm <em class="replaceable"><code>string</code></em>;<br>
@@ -66,7 +66,7 @@ key
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525953"></a><h2>MASTERS</h2>
+<a name="id2549452"></a><h2>MASTERS</h2>
 <div class="literallayout"><p><br>
 masters <em class="replaceable"><code>string</code></em> [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
 	( <em class="replaceable"><code>masters</code></em> | <em class="replaceable"><code>ipv4_address</code></em> [<span class="optional">port <em class="replaceable"><code>integer</code></em></span>] |<br>
@@ -75,7 +75,7 @@ masters
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525998"></a><h2>SERVER</h2>
+<a name="id2549498"></a><h2>SERVER</h2>
 <div class="literallayout"><p><br>
 server ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) {<br>
 	bogus <em class="replaceable"><code>boolean</code></em>;<br>
@@ -95,7 +95,7 @@ server
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526056"></a><h2>TRUSTED-KEYS</h2>
+<a name="id2549556"></a><h2>TRUSTED-KEYS</h2>
 <div class="literallayout"><p><br>
 trusted-keys {<br>
 	<em class="replaceable"><code>domain_name</code></em> <em class="replaceable"><code>flags</code></em> <em class="replaceable"><code>protocol</code></em> <em class="replaceable"><code>algorithm</code></em> <em class="replaceable"><code>key</code></em>; ... <br>
@@ -103,7 +103,7 @@ trusted-keys
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526082"></a><h2>CONTROLS</h2>
+<a name="id2549581"></a><h2>CONTROLS</h2>
 <div class="literallayout"><p><br>
 controls {<br>
 	inet ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> | * )<br>
@@ -115,7 +115,7 @@ controls
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526117"></a><h2>LOGGING</h2>
+<a name="id2549617"></a><h2>LOGGING</h2>
 <div class="literallayout"><p><br>
 logging {<br>
 	channel <em class="replaceable"><code>string</code></em> {<br>
@@ -133,7 +133,7 @@ logging
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526155"></a><h2>LWRES</h2>
+<a name="id2549655"></a><h2>LWRES</h2>
 <div class="literallayout"><p><br>
 lwres {<br>
 	listen-on [<span class="optional"> port <em class="replaceable"><code>integer</code></em> </span>] {<br>
@@ -146,7 +146,7 @@ lwres
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526197"></a><h2>OPTIONS</h2>
+<a name="id2549697"></a><h2>OPTIONS</h2>
 <div class="literallayout"><p><br>
 options {<br>
 	avoid-v4-udp-ports { <em class="replaceable"><code>port</code></em>; ... };<br>
@@ -155,6 +155,7 @@ options
 	coresize <em class="replaceable"><code>size</code></em>;<br>
 	datasize <em class="replaceable"><code>size</code></em>;<br>
 	directory <em class="replaceable"><code>quoted_string</code></em>;<br>
+	cache-file <em class="replaceable"><code>quoted_string</code></em>; // test option<br>
 	dump-file <em class="replaceable"><code>quoted_string</code></em>;<br>
 	files <em class="replaceable"><code>size</code></em>;<br>
 	heartbeat-interval <em class="replaceable"><code>integer</code></em>;<br>
@@ -202,8 +203,8 @@ options
 	rfc2308-type1 <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
 	additional-from-auth <em class="replaceable"><code>boolean</code></em>;<br>
 	additional-from-cache <em class="replaceable"><code>boolean</code></em>;<br>
-	query-source <em class="replaceable"><code>querysource4</code></em>;<br>
+	query-source [<span class="optional"> address ( <em class="replaceable"><code>ipv4_address</code></em> | * ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
-	query-source-v6 <em class="replaceable"><code>querysource6</code></em>;<br>
+	query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ipv6_address</code></em> | * ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	min-roots <em class="replaceable"><code>integer</code></em>; // not implemented<br>
 	lame-ttl <em class="replaceable"><code>integer</code></em>;<br>
@@ -289,7 +290,7 @@ options
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526858"></a><h2>VIEW</h2>
+<a name="id2550312"></a><h2>VIEW</h2>
 <div class="literallayout"><p><br>
 view <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	match-clients { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
@@ -328,8 +329,8 @@ view
 	rfc2308-type1 <em class="replaceable"><code>boolean</code></em>; // not yet implemented<br>
 	additional-from-auth <em class="replaceable"><code>boolean</code></em>;<br>
 	additional-from-cache <em class="replaceable"><code>boolean</code></em>;<br>
-	query-source <em class="replaceable"><code>querysource4</code></em>;<br>
+	query-source [<span class="optional"> address ( <em class="replaceable"><code>ipv4_address</code></em> | * ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
-	query-source-v6 <em class="replaceable"><code>querysource6</code></em>;<br>
+	query-source-v6 [<span class="optional"> address ( <em class="replaceable"><code>ipv6_address</code></em> | * ) </span>] [<span class="optional"> port ( <em class="replaceable"><code>integer</code></em> | * ) </span>];<br>
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	min-roots <em class="replaceable"><code>integer</code></em>; // not implemented<br>
 	lame-ttl <em class="replaceable"><code>integer</code></em>;<br>
@@ -407,7 +408,7 @@ view
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527269"></a><h2>ZONE</h2>
+<a name="id2550878"></a><h2>ZONE</h2>
 <div class="literallayout"><p><br>
 zone <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>optional_class</code></em> {<br>
 	type ( master | slave | stub | hint |<br>
@@ -483,17 +484,17 @@ zone
 </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527606"></a><h2>FILES</h2>
+<a name="id2551216"></a><h2>FILES</h2>
 <p>
 <code class="filename">/etc/named.conf</code>
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2527619"></a><h2>SEE ALSO</h2>
+<a name="id2551228"></a><h2>SEE ALSO</h2>
 <p>
 <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
 <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
-<span class="citerefentry"><span class="refentrytitle">BIND 9 Adminstrators Reference Manual</span></span>.
+<span class="citerefentry"><span class="refentrytitle">BIND 9 Administrator Reference Manual</span></span>.
 </p>
 </div>
 </div></body>

contrib/bind9/bin/named/named.docbook

@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.docbook,v 1.5.98.5 2005/05/13 01:22:33 marka Exp $ -->
+<!-- $Id: named.docbook,v 1.5.98.7 2006/01/17 23:49:30 marka Exp $ -->
 
 <refentry>
   <refentryinfo>
@@ -35,6 +35,7 @@
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2006</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -365,6 +366,10 @@
 	  <refentrytitle>lwresd</refentrytitle>
 	  <manvolnum>8</manvolnum>
         </citerefentry>,
+	<citerefentry>
+	  <refentrytitle>named.conf</refentrytitle>
+	  <manvolnum>5</manvolnum>
+	</citerefentry>,
 	<citetitle>BIND 9 Administrator Reference Manual</citetitle>.
     </para>
   </refsect1>

contrib/bind9/bin/named/named.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.html,v 1.4.2.1.4.9 2005/10/13 02:33:47 marka Exp $ -->
+<!-- $Id: named.html,v 1.4.2.1.4.13 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>named</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">named</span> &#8212; Internet domain name server</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525923"></a><h2>DESCRIPTION</h2>
+<a name="id2549491"></a><h2>DESCRIPTION</h2>
 <p>
 	<span><strong class="command">named</strong></span> is a Domain Name System (DNS) server,
 	part of the BIND 9 distribution from ISC.  For more
@@ -46,7 +46,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525948"></a><h2>OPTIONS</h2>
+<a name="id2549516"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -177,7 +177,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526297"></a><h2>SIGNALS</h2>
+<a name="id2550002"></a><h2>SIGNALS</h2>
 <p>
 	In routine operation, signals should not be used to control
 	the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -198,7 +198,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526412"></a><h2>CONFIGURATION</h2>
+<a name="id2550049"></a><h2>CONFIGURATION</h2>
 <p>
 	The <span><strong class="command">named</strong></span> configuration file is too complex
 	to describe in detail here.  A complete description is
@@ -207,7 +207,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526429"></a><h2>FILES</h2>
+<a name="id2550066"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -220,18 +220,19 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526469"></a><h2>SEE ALSO</h2>
+<a name="id2550105"></a><h2>SEE ALSO</h2>
 <p>
 	<em class="citetitle">RFC 1033</em>,
 	<em class="citetitle">RFC 1034</em>,
 	<em class="citetitle">RFC 1035</em>,
 	<span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
 	<span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>,
+	<span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
 	<em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526512"></a><h2>AUTHOR</h2>
+<a name="id2550157"></a><h2>AUTHOR</h2>
 <p>
 	<span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/named/query.c

@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.198.2.13.4.36.6.2 2006/10/04 07:06:01 marka Exp $ */
+/* $Id: query.c,v 1.198.2.13.4.43 2006/08/31 03:57:11 marka Exp $ */
 
 #include <config.h>
 
@@ -148,18 +148,6 @@ query_next(ns_client_t *client, isc_result_t result) {
 	ns_client_next(client, result);
 }
 
-static inline void
-query_maybeputqname(ns_client_t *client) {
-	if (client->query.restarts > 0) {
-		/*
-		 * client->query.qname was dynamically allocated.
-		 */
-		dns_message_puttempname(client->message,
-					&client->query.qname);
-		client->query.qname = NULL;
-	}
-}
-
 static inline void
 query_freefreeversions(ns_client_t *client, isc_boolean_t everything) {
 	ns_dbversion_t *dbversion, *dbversion_next;
@@ -240,8 +228,14 @@ query_reset(ns_client_t *client, isc_boolean_t everything) {
 		}
 	}
 
-	query_maybeputqname(client);
+	if (client->query.restarts > 0) {
-
+		/*
+		 * client->query.qname was dynamically allocated.
+		 */
+		dns_message_puttempname(client->message,
+					&client->query.qname);
+	}
+	client->query.qname = NULL;
 	client->query.attributes = (NS_QUERYATTR_RECURSIONOK |
 				    NS_QUERYATTR_CACHEOK |
 				    NS_QUERYATTR_SECURE);
@@ -2091,17 +2085,31 @@ query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,
 		result = isc_quota_attach(&ns_g_server->recursionquota,
 					  &client->recursionquota);
 		if  (result == ISC_R_SOFTQUOTA) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+			static isc_stdtime_t last = 0;
-				      NS_LOGMODULE_QUERY, ISC_LOG_WARNING,
+			isc_stdtime_t now;
-				      "recursive-clients soft limit exceeded, "
+			isc_stdtime_get(&now);
-				      "aborting oldest query");
+			if (now != last) {
+				last = now;
+				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+					      NS_LOGMODULE_QUERY,
+					      ISC_LOG_WARNING,
+					      "recursive-clients soft limit "
+					      "exceeded, aborting oldest query");
+			}
 			ns_client_killoldestquery(client);
 			result = ISC_R_SUCCESS;
 		} else if (result == ISC_R_QUOTA) {
-			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+			static isc_stdtime_t last = 0;
-				      NS_LOGMODULE_QUERY, ISC_LOG_WARNING,
+			isc_stdtime_t now;
-				      "no more recursive clients: %s",
+			isc_stdtime_get(&now);
-				      isc_result_totext(result));
+			if (now != last) {
+				last = now;
+				ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+					      NS_LOGMODULE_QUERY,
+					      ISC_LOG_WARNING,
+					      "no more recursive clients: %s",
+					      isc_result_totext(result));
+			}
 			ns_client_killoldestquery(client);
 		}
 		if (result == ISC_R_SUCCESS && !client->mortal &&
@@ -2182,7 +2190,7 @@ do { \
  *	ISC_R_NOTIMPLEMENTED	The rdata is not a known address type.
  */
 static isc_result_t
-rdata_tonetaddr(dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
+rdata_tonetaddr(const dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
 	struct in_addr ina;
 	struct in6_addr in6a;
 	
@@ -2208,7 +2216,7 @@ rdata_tonetaddr(dns_rdata_t *rdata, isc_netaddr_t *netaddr) {
  * sortlist statement.
  */
 static int
-query_sortlist_order_2element(dns_rdata_t *rdata, void *arg) {
+query_sortlist_order_2element(const dns_rdata_t *rdata, const void *arg) {
 	isc_netaddr_t netaddr;
 
 	if (rdata_tonetaddr(rdata, &netaddr) != ISC_R_SUCCESS)
@@ -2221,7 +2229,7 @@ query_sortlist_order_2element(dns_rdata_t *rdata, void *arg) {
  * of a 1-element top-level sortlist statement.
  */
 static int
-query_sortlist_order_1element(dns_rdata_t *rdata, void *arg) {
+query_sortlist_order_1element(const dns_rdata_t *rdata, const void *arg) {
 	isc_netaddr_t netaddr;
 
 	if (rdata_tonetaddr(rdata, &netaddr) != ISC_R_SUCCESS)
@@ -2237,7 +2245,7 @@ static void
 setup_query_sortlist(ns_client_t *client) {
 	isc_netaddr_t netaddr;
 	dns_rdatasetorderfunc_t order = NULL;
-	void *order_arg = NULL;
+	const void *order_arg = NULL;
 	
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 	switch (ns_sortlist_setup(client->view->sortlist,
@@ -2469,7 +2477,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	/*
 	 * First we must find the right database.
 	 */
-	options = 0;
+	options &= DNS_GETDB_NOLOG; /* Preserve DNS_GETDB_NOLOG. */
 	if (dns_rdatatype_atparent(qtype) &&
 	    !dns_name_equal(client->query.qname, dns_rootname))
 		options |= DNS_GETDB_NOEXACT;
@@ -2509,9 +2517,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		}
 	}
 	if (result != ISC_R_SUCCESS) {
-		if (result == DNS_R_REFUSED)
+		if (result == DNS_R_REFUSED) {
-			QUERY_ERROR(DNS_R_REFUSED);
+			if (!PARTIALANSWER(client))
-		else
+				QUERY_ERROR(DNS_R_REFUSED);
+		} else
 			QUERY_ERROR(DNS_R_SERVFAIL);
 		goto cleanup;
 	}
@@ -2995,9 +3004,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			goto cleanup;
 		}
 		dns_rdata_freestruct(&cname);
-		query_maybeputqname(client);
+		ns_client_qnamereplace(client, tname);
-		client->query.qname = tname;
 		want_restart = ISC_TRUE;
+		if (!WANTRECURSION(client))
+			options |= DNS_GETDB_NOLOG;
 		goto addauth;
 	case DNS_R_DNAME:
 		/*
@@ -3111,10 +3121,11 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		/*
 		 * Switch to the new qname and restart.
 		 */
-		query_maybeputqname(client);
+		ns_client_qnamereplace(client, fname);
-		client->query.qname = fname;
 		fname = NULL;
 		want_restart = ISC_TRUE;
+		if (!WANTRECURSION(client))
+			options |= DNS_GETDB_NOLOG;
 		goto addauth;
 	default:
 		/*

contrib/bind9/bin/named/server.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.339.2.15.2.65 2005/07/27 02:53:15 marka Exp $ */
+/* $Id: server.c,v 1.339.2.15.2.70 2006/05/24 04:30:24 marka Exp $ */
 
 #include <config.h>
 
@@ -167,25 +167,25 @@ static void
 ns_server_reload(isc_task_t *task, isc_event_t *event);
 
 static isc_result_t
-ns_listenelt_fromconfig(cfg_obj_t *listener, cfg_obj_t *config,
+ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 			ns_aclconfctx_t *actx,
 			isc_mem_t *mctx, ns_listenelt_t **target);
 static isc_result_t
-ns_listenlist_fromconfig(cfg_obj_t *listenlist, cfg_obj_t *config,
+ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 			 ns_aclconfctx_t *actx,
 			 isc_mem_t *mctx, ns_listenlist_t **target);
 
 static isc_result_t
-configure_forward(cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
+configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
-		  cfg_obj_t *forwarders, cfg_obj_t *forwardtype);
+		  const cfg_obj_t *forwarders, const cfg_obj_t *forwardtype);
 
 static isc_result_t
-configure_alternates(cfg_obj_t *config, dns_view_t *view,
+configure_alternates(const cfg_obj_t *config, dns_view_t *view,
-		     cfg_obj_t *alternates);
+		     const cfg_obj_t *alternates);
 
 static isc_result_t
-configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
+configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
-	       isc_mem_t *mctx, dns_view_t *view,
+	       const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
 	       ns_aclconfctx_t *aclconf);
 
 static void
@@ -197,13 +197,13 @@ end_reserved_dispatches(ns_server_t *server, isc_boolean_t all);
  * (for a global default).
  */
 static isc_result_t
-configure_view_acl(cfg_obj_t *vconfig, cfg_obj_t *config,
+configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 		   const char *aclname, ns_aclconfctx_t *actx,
 		   isc_mem_t *mctx, dns_acl_t **aclp)
 {
 	isc_result_t result;
-	cfg_obj_t *maps[3];
+	const cfg_obj_t *maps[3];
-	cfg_obj_t *aclobj = NULL;
+	const cfg_obj_t *aclobj = NULL;
 	int i = 0;
 
 	if (*aclp != NULL)
@@ -211,14 +211,14 @@ configure_view_acl(cfg_obj_t *vconfig, cfg_obj_t *config,
 	if (vconfig != NULL)
 		maps[i++] = cfg_tuple_get(vconfig, "options");
 	if (config != NULL) {
-		cfg_obj_t *options = NULL;
+		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL)
 			maps[i++] = options;
 	}
 	maps[i] = NULL;
 
-	result = ns_config_get(maps, aclname, &aclobj);
+	(void)ns_config_get(maps, aclname, &aclobj);
 	if (aclobj == NULL)
 		/*
 		 * No value available.  *aclp == NULL.
@@ -231,13 +231,13 @@ configure_view_acl(cfg_obj_t *vconfig, cfg_obj_t *config,
 }
 
 static isc_result_t
-configure_view_dnsseckey(cfg_obj_t *vconfig, cfg_obj_t *key,
+configure_view_dnsseckey(const cfg_obj_t *vconfig, const cfg_obj_t *key,
 			 dns_keytable_t *keytable, isc_mem_t *mctx)
 {
 	dns_rdataclass_t viewclass;
 	dns_rdata_dnskey_t keystruct;
 	isc_uint32_t flags, proto, alg;
-	char *keystr, *keynamestr;
+	const char *keystr, *keynamestr;
 	unsigned char keydata[4096];
 	isc_buffer_t keydatabuf;
 	unsigned char rrdata[4096];
@@ -258,7 +258,7 @@ configure_view_dnsseckey(cfg_obj_t *vconfig, cfg_obj_t *key,
 	if (vconfig == NULL)
 		viewclass = dns_rdataclass_in;
 	else {
-		cfg_obj_t *classobj = cfg_tuple_get(vconfig, "class");
+		const cfg_obj_t *classobj = cfg_tuple_get(vconfig, "class");
 		CHECK(ns_config_getclass(classobj, dns_rdataclass_in,
 					 &viewclass));
 	}
@@ -334,15 +334,15 @@ configure_view_dnsseckey(cfg_obj_t *vconfig, cfg_obj_t *key,
  * from 'vconfig' and 'config'.  The variable to be configured is '*target'.
  */
 static isc_result_t
-configure_view_dnsseckeys(cfg_obj_t *vconfig, cfg_obj_t *config,
+configure_view_dnsseckeys(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 			  isc_mem_t *mctx, dns_keytable_t **target)
 {
 	isc_result_t result;
-	cfg_obj_t *keys = NULL;
+	const cfg_obj_t *keys = NULL;
-	cfg_obj_t *voptions = NULL;
+	const cfg_obj_t *voptions = NULL;
-	cfg_listelt_t *element, *element2;
+	const cfg_listelt_t *element, *element2;
-	cfg_obj_t *keylist;
+	const cfg_obj_t *keylist;
-	cfg_obj_t *key;
+	const cfg_obj_t *key;
 	dns_keytable_t *keytable = NULL;
 
 	CHECK(dns_keytable_create(mctx, &keytable));
@@ -381,10 +381,10 @@ configure_view_dnsseckeys(cfg_obj_t *vconfig, cfg_obj_t *config,
 }
 
 static isc_result_t
-mustbesecure(cfg_obj_t *mbs, dns_resolver_t *resolver)
+mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)
 {
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
 	const char *str;
 	dns_fixedname_t fixed;
 	dns_name_t *name;
@@ -418,14 +418,14 @@ mustbesecure(cfg_obj_t *mbs, dns_resolver_t *resolver)
  * Get a dispatch appropriate for the resolver of a given view.
  */
 static isc_result_t
-get_view_querysource_dispatch(cfg_obj_t **maps,
+get_view_querysource_dispatch(const cfg_obj_t **maps,
 			      int af, dns_dispatch_t **dispatchp)
 {
 	isc_result_t result;
 	dns_dispatch_t *disp;
 	isc_sockaddr_t sa;
 	unsigned int attrs, attrmask;
-	cfg_obj_t *obj = NULL;
+	const cfg_obj_t *obj = NULL;
 
 	/*
 	 * Make compiler happy.
@@ -436,7 +436,6 @@ get_view_querysource_dispatch(cfg_obj_t **maps,
 	case AF_INET:
 		result = ns_config_get(maps, "query-source", &obj);
 		INSIST(result == ISC_R_SUCCESS);
-
 		break;
 	case AF_INET6:
 		result = ns_config_get(maps, "query-source-v6", &obj);
@@ -517,10 +516,10 @@ get_view_querysource_dispatch(cfg_obj_t **maps,
 }
 
 static isc_result_t
-configure_order(dns_order_t *order, cfg_obj_t *ent) {
+configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t rdtype;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
 	dns_fixedname_t fixed;
 	unsigned int mode = 0;
 	const char *str;
@@ -567,7 +566,7 @@ configure_order(dns_order_t *order, cfg_obj_t *ent) {
 	/*
 	 * "*" should match everything including the root (BIND 8 compat).
 	 * As dns_name_matcheswildcard(".", "*.") returns FALSE add a
-	 * explict entry for "." when the name is "*".
+	 * explicit entry for "." when the name is "*".
 	 */
 	if (addroot) {
 		result = dns_order_add(order, dns_rootname,
@@ -581,12 +580,12 @@ configure_order(dns_order_t *order, cfg_obj_t *ent) {
 }
 
 static isc_result_t
-configure_peer(cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
+configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
-	isc_sockaddr_t *sa;
+	const isc_sockaddr_t *sa;
 	isc_netaddr_t na;
 	dns_peer_t *peer;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
-	char *str;
+	const char *str;
 	isc_result_t result;
 
 	sa = cfg_obj_assockaddr(cfg_map_getname(cpeer));
@@ -664,10 +663,10 @@ configure_peer(cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 }
 
 static isc_result_t
-disable_algorithms(cfg_obj_t *disabled, dns_resolver_t *resolver) {
+disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	isc_result_t result;
-	cfg_obj_t *algorithms;
+	const cfg_obj_t *algorithms;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	const char *str;
 	dns_fixedname_t fixed;
 	dns_name_t *name;
@@ -688,7 +687,7 @@ disable_algorithms(cfg_obj_t *disabled, dns_resolver_t *resolver) {
 		isc_textregion_t r;
 		dns_secalg_t alg;
 
-		r.base = cfg_obj_asstring(cfg_listelt_value(element));
+		DE_CONST(cfg_obj_asstring(cfg_listelt_value(element)), r.base);
 		r.length = strlen(r.base);
 
 		result = dns_secalg_fromtext(&alg, &r);
@@ -717,21 +716,21 @@ disable_algorithms(cfg_obj_t *disabled, dns_resolver_t *resolver) {
  * global defaults in 'config' used exclusively.
  */
 static isc_result_t
-configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
+configure_view(dns_view_t *view, const cfg_obj_t *config,
-	       isc_mem_t *mctx, ns_aclconfctx_t *actx,
+	       const cfg_obj_t *vconfig, isc_mem_t *mctx, ns_aclconfctx_t *actx,
 	       isc_boolean_t need_hints)
 {
-	cfg_obj_t *maps[4];
+	const cfg_obj_t *maps[4];
-	cfg_obj_t *cfgmaps[3];
+	const cfg_obj_t *cfgmaps[3];
-	cfg_obj_t *options = NULL;
+	const cfg_obj_t *options = NULL;
-	cfg_obj_t *voptions = NULL;
+	const cfg_obj_t *voptions = NULL;
-	cfg_obj_t *forwardtype;
+	const cfg_obj_t *forwardtype;
-	cfg_obj_t *forwarders;
+	const cfg_obj_t *forwarders;
-	cfg_obj_t *alternates;
+	const cfg_obj_t *alternates;
-	cfg_obj_t *zonelist;
+	const cfg_obj_t *zonelist;
-	cfg_obj_t *disabled;
+	const cfg_obj_t *disabled;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	in_port_t port;
 	dns_cache_t *cache = NULL;
 	isc_result_t result;
@@ -792,7 +791,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *zconfig = cfg_listelt_value(element);
+		const cfg_obj_t *zconfig = cfg_listelt_value(element);
 		CHECK(configure_zone(config, zconfig, vconfig, mctx, view,
 				     actx));
 	}
@@ -1018,8 +1017,8 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	 * Configure the view's peer list.
 	 */
 	{
-		cfg_obj_t *peers = NULL;
+		const cfg_obj_t *peers = NULL;
-		cfg_listelt_t *element;
+		const cfg_listelt_t *element;
 		dns_peerlist_t *newpeers = NULL;
 
 		(void)ns_config_get(cfgmaps, "server", &peers);
@@ -1028,7 +1027,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		     element != NULL;
 		     element = cfg_list_next(element))
 		{
-			cfg_obj_t *cpeer = cfg_listelt_value(element);
+			const cfg_obj_t *cpeer = cfg_listelt_value(element);
 			dns_peer_t *peer;
 
 			CHECK(configure_peer(cpeer, mctx, &peer));
@@ -1043,8 +1042,8 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	 *	Configure the views rrset-order.
 	 */
 	{
-		cfg_obj_t *rrsetorder = NULL;
+		const cfg_obj_t *rrsetorder = NULL;
-		cfg_listelt_t *element;
+		const cfg_listelt_t *element;
 
 		(void)ns_config_get(maps, "rrset-order", &rrsetorder);
 		CHECK(dns_order_create(mctx, &order));
@@ -1052,7 +1051,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 		     element != NULL;
 		     element = cfg_list_next(element))
 		{
-			cfg_obj_t *ent = cfg_listelt_value(element);
+			const cfg_obj_t *ent = cfg_listelt_value(element);
 
 			CHECK(configure_order(order, ent));
 		}
@@ -1078,7 +1077,7 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	 * Configure the "match-recursive-only" option.
 	 */
 	obj = NULL;
-	(void) ns_config_get(maps, "match-recursive-only", &obj);
+	(void)ns_config_get(maps, "match-recursive-only", &obj);
 	if (obj != NULL && cfg_obj_asboolean(obj))
 		view->matchrecursiveonly = ISC_TRUE;
 	else
@@ -1275,8 +1274,8 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 			dns_fixedname_t fixed;
 			dns_name_t *name;
 			isc_buffer_t b;
-			char *str;
+			const char *str;
-			cfg_obj_t *exclude;
+			const cfg_obj_t *exclude;
 
 			dns_fixedname_init(&fixed);
 			name = dns_fixedname_name(&fixed);
@@ -1330,12 +1329,12 @@ configure_hints(dns_view_t *view, const char *filename) {
 }
 
 static isc_result_t
-configure_alternates(cfg_obj_t *config, dns_view_t *view,
+configure_alternates(const cfg_obj_t *config, dns_view_t *view,
-		     cfg_obj_t *alternates)
+		     const cfg_obj_t *alternates)
 {
-	cfg_obj_t *portobj;
+	const cfg_obj_t *portobj;
-	cfg_obj_t *addresses;
+	const cfg_obj_t *addresses;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	isc_result_t result = ISC_R_SUCCESS;
 	in_port_t port;
 
@@ -1368,14 +1367,14 @@ configure_alternates(cfg_obj_t *config, dns_view_t *view,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *alternate = cfg_listelt_value(element);
+		const cfg_obj_t *alternate = cfg_listelt_value(element);
 		isc_sockaddr_t sa;
 
 		if (!cfg_obj_issockaddr(alternate)) {
 			dns_fixedname_t fixed;
 			dns_name_t *name;
-			char *str = cfg_obj_asstring(cfg_tuple_get(alternate,
+			const char *str = cfg_obj_asstring(cfg_tuple_get(
-								   "name"));
+							   alternate, "name"));
 			isc_buffer_t buffer;
 			in_port_t myport = port;
 
@@ -1415,12 +1414,12 @@ configure_alternates(cfg_obj_t *config, dns_view_t *view,
 }
 
 static isc_result_t
-configure_forward(cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
+configure_forward(const cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
-		  cfg_obj_t *forwarders, cfg_obj_t *forwardtype)
+		  const cfg_obj_t *forwarders, const cfg_obj_t *forwardtype)
 {
-	cfg_obj_t *portobj;
+	const cfg_obj_t *portobj;
-	cfg_obj_t *faddresses;
+	const cfg_obj_t *faddresses;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	dns_fwdpolicy_t fwdpolicy = dns_fwdpolicy_none;
 	isc_sockaddrlist_t addresses;
 	isc_sockaddr_t *sa;
@@ -1458,7 +1457,7 @@ configure_forward(cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *forwarder = cfg_listelt_value(element);
+		const cfg_obj_t *forwarder = cfg_listelt_value(element);
 		sa = isc_mem_get(view->mctx, sizeof(isc_sockaddr_t));
 		if (sa == NULL) {
 			result = ISC_R_NOMEMORY;
@@ -1481,7 +1480,7 @@ configure_forward(cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
 		if (forwardtype == NULL)
 			fwdpolicy = dns_fwdpolicy_first;
 		else {
-			char *forwardstr = cfg_obj_asstring(forwardtype);
+			const char *forwardstr = cfg_obj_asstring(forwardtype);
 			if (strcasecmp(forwardstr, "first") == 0)
 				fwdpolicy = dns_fwdpolicy_first;
 			else if (strcasecmp(forwardstr, "only") == 0)
@@ -1523,14 +1522,16 @@ configure_forward(cfg_obj_t *config, dns_view_t *view, dns_name_t *origin,
  * The view created is attached to '*viewp'.
  */
 static isc_result_t
-create_view(cfg_obj_t *vconfig, dns_viewlist_t *viewlist, dns_view_t **viewp) {
+create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
+	    dns_view_t **viewp)
+{
 	isc_result_t result;
 	const char *viewname;
 	dns_rdataclass_t viewclass;
 	dns_view_t *view = NULL;
 
 	if (vconfig != NULL) {
-		cfg_obj_t *classobj = NULL;
+		const cfg_obj_t *classobj = NULL;
 
 		viewname = cfg_obj_asstring(cfg_tuple_get(vconfig, "name"));
 		classobj = cfg_tuple_get(vconfig, "class");
@@ -1560,19 +1561,19 @@ create_view(cfg_obj_t *vconfig, dns_viewlist_t *viewlist, dns_view_t **viewp) {
  * Configure or reconfigure a zone.
  */
 static isc_result_t
-configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
+configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
-	       isc_mem_t *mctx, dns_view_t *view,
+	       const cfg_obj_t *vconfig, isc_mem_t *mctx, dns_view_t *view,
 	       ns_aclconfctx_t *aclconf)
 {
 	dns_view_t *pview = NULL;	/* Production view */
 	dns_zone_t *zone = NULL;	/* New or reused zone */
 	dns_zone_t *dupzone = NULL;
-	cfg_obj_t *options = NULL;
+	const cfg_obj_t *options = NULL;
-	cfg_obj_t *zoptions = NULL;
+	const cfg_obj_t *zoptions = NULL;
-	cfg_obj_t *typeobj = NULL;
+	const cfg_obj_t *typeobj = NULL;
-	cfg_obj_t *forwarders = NULL;
+	const cfg_obj_t *forwarders = NULL;
-	cfg_obj_t *forwardtype = NULL;
+	const cfg_obj_t *forwardtype = NULL;
-	cfg_obj_t *only = NULL;
+	const cfg_obj_t *only = NULL;
 	isc_result_t result;
 	isc_result_t tresult;
 	isc_buffer_t buffer;
@@ -1629,7 +1630,7 @@ configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
 	 * configure it and return.
 	 */
 	if (strcasecmp(ztypestr, "hint") == 0) {
-		cfg_obj_t *fileobj = NULL;
+		const cfg_obj_t *fileobj = NULL;
 		if (cfg_map_get(zoptions, "file", &fileobj) != ISC_R_SUCCESS) {
 			isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 				      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
@@ -1639,7 +1640,7 @@ configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
 			goto cleanup;
 		}
 		if (dns_name_equal(origin, dns_rootname)) {
-			char *hintsfile = cfg_obj_asstring(fileobj);
+			const char *hintsfile = cfg_obj_asstring(fileobj);
 
 			result = configure_hints(view, hintsfile);
 			if (result != ISC_R_SUCCESS) {
@@ -1795,9 +1796,10 @@ configure_zone(cfg_obj_t *config, cfg_obj_t *zconfig, cfg_obj_t *vconfig,
  * Configure a single server quota.
  */
 static void
-configure_server_quota(cfg_obj_t **maps, const char *name, isc_quota_t *quota)
+configure_server_quota(const cfg_obj_t **maps, const char *name,
+		       isc_quota_t *quota)
 {
-	cfg_obj_t *obj = NULL;
+	const cfg_obj_t *obj = NULL;
 	isc_result_t result;
 
 	result = ns_config_get(maps, name, &obj);
@@ -1810,9 +1812,9 @@ configure_server_quota(cfg_obj_t **maps, const char *name, isc_quota_t *quota)
  * parsed.  This can be extended to support other options if necessary.
  */
 static isc_result_t
-directory_callback(const char *clausename, cfg_obj_t *obj, void *arg) {
+directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	isc_result_t result;
-	char *directory;
+	const char *directory;
 
 	REQUIRE(strcasecmp("directory", clausename) == 0);
 
@@ -1891,8 +1893,7 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr) {
 
  clean:
 	INSIST(lelt == NULL);
-	if (src_acl != NULL)
+	dns_acl_detach(&src_acl);
-		dns_acl_detach(&src_acl);
 
 	return (result);
 }
@@ -2049,7 +2050,7 @@ setstring(ns_server_t *server, char **field, const char *value) {
  * or NULL if whether 'obj' is a string or void value, respectively.
  */
 static isc_result_t
-setoptstring(ns_server_t *server, char **field, cfg_obj_t *obj) {
+setoptstring(ns_server_t *server, char **field, const cfg_obj_t *obj) {
 	if (cfg_obj_isvoid(obj))
 		return (setstring(server, field, NULL));
 	else
@@ -2057,11 +2058,12 @@ setoptstring(ns_server_t *server, char **field, cfg_obj_t *obj) {
 }
 
 static void
-set_limit(cfg_obj_t **maps, const char *configname, const char *description,
+set_limit(const cfg_obj_t **maps, const char *configname,
-	  isc_resource_t resourceid, isc_resourcevalue_t defaultvalue)
+	  const char *description, isc_resource_t resourceid,
+	  isc_resourcevalue_t defaultvalue)
 {
-	cfg_obj_t *obj = NULL;
+	const cfg_obj_t *obj = NULL;
-	char *resource;
+	const char *resource;
 	isc_resourcevalue_t value;
 	isc_result_t result;
 
@@ -2092,7 +2094,7 @@ set_limit(cfg_obj_t **maps, const char *configname, const char *description,
 		  ns_g_init ## resource)
 
 static void
-set_limits(cfg_obj_t **maps) {
+set_limits(const cfg_obj_t **maps) {
 	SETLIMIT("stacksize", stacksize, "stack size");
 	SETLIMIT("datasize", datasize, "data size");
 	SETLIMIT("coresize", coresize, "core size");
@@ -2101,15 +2103,15 @@ set_limits(cfg_obj_t **maps) {
 
 static isc_result_t
 portlist_fromconf(dns_portlist_t *portlist, unsigned int family,
-		  cfg_obj_t *ports)
+		  const cfg_obj_t *ports)
 {
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	isc_result_t result = ISC_R_SUCCESS;
 
 	for (element = cfg_list_first(ports);
 	     element != NULL;
 	     element = cfg_list_next(element)) {
-		cfg_obj_t *obj = cfg_listelt_value(element);
+		const cfg_obj_t *obj = cfg_listelt_value(element);
 		in_port_t port = (in_port_t)cfg_obj_asuint32(obj);
 		
 		result = dns_portlist_add(portlist, family, port);
@@ -2126,13 +2128,13 @@ load_configuration(const char *filename, ns_server_t *server,
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config;
-	cfg_obj_t *options;
+	const cfg_obj_t *options;
-	cfg_obj_t *views;
+	const cfg_obj_t *views;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
-	cfg_obj_t *v4ports, *v6ports;
+	const cfg_obj_t *v4ports, *v6ports;
-	cfg_obj_t *maps[3];
+	const cfg_obj_t *maps[3];
-	cfg_obj_t *builtin_views;
+	const cfg_obj_t *builtin_views;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	dns_view_t *view = NULL;
 	dns_view_t *view_next;
 	dns_viewlist_t viewlist;
@@ -2319,7 +2321,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * statement.
 	 */
 	{
-		cfg_obj_t *clistenon = NULL;
+		const cfg_obj_t *clistenon = NULL;
 		ns_listenlist_t *listenon = NULL;
 
 		clistenon = NULL;
@@ -2353,7 +2355,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * Ditto for IPv6.
 	 */
 	{
-		cfg_obj_t *clistenon = NULL;
+		const cfg_obj_t *clistenon = NULL;
 		ns_listenlist_t *listenon = NULL;
 
 		if (options != NULL)
@@ -2438,7 +2440,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *vconfig = cfg_listelt_value(element);
+		const cfg_obj_t *vconfig = cfg_listelt_value(element);
 		view = NULL;
 
 		CHECK(create_view(vconfig, &viewlist, &view));
@@ -2478,7 +2480,7 @@ load_configuration(const char *filename, ns_server_t *server,
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *vconfig = cfg_listelt_value(element);
+		const cfg_obj_t *vconfig = cfg_listelt_value(element);
 		CHECK(create_view(vconfig, &viewlist, &view));
 		CHECK(configure_view(view, config, vconfig, ns_g_mctx,
 				     &aclconfctx, ISC_FALSE));
@@ -2582,7 +2584,7 @@ load_configuration(const char *filename, ns_server_t *server,
 			      "ignoring config file logging "
 			      "statement due to -g option");
 	} else {
-		cfg_obj_t *logobj = NULL;
+		const cfg_obj_t *logobj = NULL;
 		isc_logconfig_t *logc = NULL;
 
 		CHECKM(isc_logconfig_create(ns_g_lctx, &logc),
@@ -2621,8 +2623,8 @@ load_configuration(const char *filename, ns_server_t *server,
 	 * compatibility.
 	 */
 	if (first_time) {
-		cfg_obj_t *logobj = NULL;
+		const cfg_obj_t *logobj = NULL;
-		cfg_obj_t *categories = NULL;
+		const cfg_obj_t *categories = NULL;
 
 		obj = NULL;
 		if (ns_config_get(maps, "querylog", &obj) == ISC_R_SUCCESS) {
@@ -2634,13 +2636,13 @@ load_configuration(const char *filename, ns_server_t *server,
 				(void)cfg_map_get(logobj, "category",
 						  &categories);
 			if (categories != NULL) {
-				cfg_listelt_t *element;
+				const cfg_listelt_t *element;
 				for (element = cfg_list_first(categories);
 				     element != NULL;
 				     element = cfg_list_next(element))
 				{
-					cfg_obj_t *catobj;
+					const cfg_obj_t *catobj;
-					char *str;
+					const char *str;
 
 					obj = cfg_listelt_value(element);
 					catobj = cfg_tuple_get(obj, "name");
@@ -3133,7 +3135,7 @@ end_reserved_dispatches(ns_server_t *server, isc_boolean_t all) {
 }
 
 void
-ns_add_reserved_dispatch(ns_server_t *server, isc_sockaddr_t *addr) {
+ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr) {
 	ns_dispatch_t *dispatch;
 	in_port_t port;
 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
@@ -3458,20 +3460,29 @@ isc_result_t
 ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) {
 	isc_result_t result;
 	dns_zone_t *zone = NULL;
-	const unsigned char msg[] = "zone refresh queued";
+	const unsigned char msg1[] = "zone refresh queued";
+	const unsigned char msg2[] = "not a slave or stub zone";
+	dns_zonetype_t type;
 
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	if (zone == NULL)
 		return (ISC_R_UNEXPECTEDEND);
-	
-	dns_zone_refresh(zone);
-	dns_zone_detach(&zone);
-	if (sizeof(msg) <= isc_buffer_availablelength(text))
-		isc_buffer_putmem(text, msg, sizeof(msg));
 
-	return (ISC_R_SUCCESS);
+	type = dns_zone_gettype(zone);
+	if (type == dns_zone_slave || type == dns_zone_stub) {
+		dns_zone_refresh(zone);
+		dns_zone_detach(&zone);
+		if (sizeof(msg1) <= isc_buffer_availablelength(text))
+			isc_buffer_putmem(text, msg1, sizeof(msg1));
+		return (ISC_R_SUCCESS);
+	}
+		
+	dns_zone_detach(&zone);
+	if (sizeof(msg2) <= isc_buffer_availablelength(text))
+		isc_buffer_putmem(text, msg2, sizeof(msg2));
+	return (ISC_R_FAILURE);
 }	
 
 isc_result_t
@@ -3486,12 +3497,12 @@ ns_server_togglequerylog(ns_server_t *server) {
 }
 
 static isc_result_t
-ns_listenlist_fromconfig(cfg_obj_t *listenlist, cfg_obj_t *config,
+ns_listenlist_fromconfig(const cfg_obj_t *listenlist, const cfg_obj_t *config,
 			 ns_aclconfctx_t *actx,
 			 isc_mem_t *mctx, ns_listenlist_t **target)
 {
 	isc_result_t result;
-	cfg_listelt_t *element;
+	const cfg_listelt_t *element;
 	ns_listenlist_t *dlist = NULL;
 
 	REQUIRE(target != NULL && *target == NULL);
@@ -3505,7 +3516,7 @@ ns_listenlist_fromconfig(cfg_obj_t *listenlist, cfg_obj_t *config,
 	     element = cfg_list_next(element))
 	{
 		ns_listenelt_t *delt = NULL;
-		cfg_obj_t *listener = cfg_listelt_value(element);
+		const cfg_obj_t *listener = cfg_listelt_value(element);
 		result = ns_listenelt_fromconfig(listener, config, actx,
 						 mctx, &delt);
 		if (result != ISC_R_SUCCESS)
@@ -3525,12 +3536,12 @@ ns_listenlist_fromconfig(cfg_obj_t *listenlist, cfg_obj_t *config,
  * data structure.
  */
 static isc_result_t
-ns_listenelt_fromconfig(cfg_obj_t *listener, cfg_obj_t *config,
+ns_listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 			ns_aclconfctx_t *actx,
 			isc_mem_t *mctx, ns_listenelt_t **target)
 {
 	isc_result_t result;
-	cfg_obj_t *portobj;
+	const cfg_obj_t *portobj;
 	in_port_t port;
 	ns_listenelt_t *delt = NULL;
 	REQUIRE(target != NULL && *target == NULL);
@@ -3823,6 +3834,11 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 	char *ptr;
 	const char *sep;
 
+	/* Skip the command name. */
+	ptr = next_token(&args, " \t");
+	if (ptr == NULL)
+		return (ISC_R_UNEXPECTEDEND);
+
 	dctx = isc_mem_get(server->mctx, sizeof(*dctx));
 	if (dctx == NULL)
 		return (ISC_R_NOMEMORY);
@@ -3845,11 +3861,6 @@ ns_server_dumpdb(ns_server_t *server, char *args) {
 	CHECKMF(isc_stdio_open(server->dumpfile, "w", &dctx->fp),
 		"could not open dump file", server->dumpfile);
 
-	/* Skip the command name. */
-	ptr = next_token(&args, " \t");
-	if (ptr == NULL)
-		return (ISC_R_UNEXPECTEDEND);
-
 	sep = (args == NULL) ? "" : ": ";
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 		      NS_LOGMODULE_SERVER, ISC_LOG_INFO,

contrib/bind9/bin/named/sortlist.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sortlist.c,v 1.5.12.4 2004/03/08 04:04:19 marka Exp $ */
+/* $Id: sortlist.c,v 1.5.12.6 2006/03/02 00:37:20 marka Exp $ */
 
 #include <config.h>
 
@@ -30,7 +30,9 @@
 #include <named/sortlist.h>
 
 ns_sortlisttype_t
-ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr, void **argp) {
+ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr,
+		  const void **argp)
+{
 	unsigned int i;
 
 	if (acl == NULL)
@@ -44,7 +46,7 @@ ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr, void **argp) {
 		dns_aclelement_t *e = &acl->elements[i];
 		dns_aclelement_t *try_elt;
 		dns_aclelement_t *order_elt = NULL;
-		dns_aclelement_t *matched_elt = NULL;
+		const dns_aclelement_t *matched_elt = NULL;
 
 		if (e->type == dns_aclelementtype_nestedacl) {
 			dns_acl_t *inner = e->u.nestedacl;
@@ -106,8 +108,8 @@ ns_sortlist_setup(dns_acl_t *acl, isc_netaddr_t *clientaddr, void **argp) {
 }
 
 int
-ns_sortlist_addrorder2(isc_netaddr_t *addr, void *arg) {
+ns_sortlist_addrorder2(const isc_netaddr_t *addr, const void *arg) {
-	dns_acl_t *sortacl = (dns_acl_t *) arg;
+	const dns_acl_t *sortacl = (const dns_acl_t *) arg;
 	int match;
 
 	(void)dns_acl_match(addr, NULL, sortacl,
@@ -122,8 +124,8 @@ ns_sortlist_addrorder2(isc_netaddr_t *addr, void *arg) {
 }
 
 int
-ns_sortlist_addrorder1(isc_netaddr_t *addr, void *arg) {
+ns_sortlist_addrorder1(const isc_netaddr_t *addr, const void *arg) {
-	dns_aclelement_t *matchelt = (dns_aclelement_t *) arg;
+	const dns_aclelement_t *matchelt = (const dns_aclelement_t *) arg;
 	if (dns_aclelement_match(addr, NULL, matchelt,
 				 &ns_g_server->aclenv,
 				 NULL)) {
@@ -136,7 +138,7 @@ ns_sortlist_addrorder1(isc_netaddr_t *addr, void *arg) {
 void
 ns_sortlist_byaddrsetup(dns_acl_t *sortlist_acl, isc_netaddr_t *client_addr,
 		       dns_addressorderfunc_t *orderp,
-		       void **argp)
+		       const void **argp)
 {
 	ns_sortlisttype_t sortlisttype;
 

contrib/bind9/bin/named/tkeyconf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tkeyconf.c,v 1.19.208.2 2004/06/11 00:30:51 marka Exp $ */
+/* $Id: tkeyconf.c,v 1.19.208.4 2006/03/02 00:37:20 marka Exp $ */
 
 #include <config.h>
 
@@ -42,17 +42,17 @@
 
 
 isc_result_t
-ns_tkeyctx_fromconfig(cfg_obj_t *options, isc_mem_t *mctx, isc_entropy_t *ectx,
+ns_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-		       dns_tkeyctx_t **tctxp)
+		      isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
 {
 	isc_result_t result;
 	dns_tkeyctx_t *tctx = NULL;
-	char *s;
+	const char *s;
 	isc_uint32_t n;
 	dns_fixedname_t fname;
 	dns_name_t *name;
 	isc_buffer_t b;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
 	int type;
 
 	result = dns_tkeyctx_create(mctx, ectx, &tctx);

contrib/bind9/bin/named/tsigconf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tsigconf.c,v 1.21.208.4 2004/03/08 04:04:19 marka Exp $ */
+/* $Id: tsigconf.c,v 1.21.208.6 2006/03/02 00:37:20 marka Exp $ */
 
 #include <config.h>
 
@@ -35,10 +35,12 @@
 #include <named/tsigconf.h>
 
 static isc_result_t
-add_initial_keys(cfg_obj_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) {
+add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
-	cfg_listelt_t *element;
+		 isc_mem_t *mctx)
-	cfg_obj_t *key = NULL;
+{
-	char *keyid = NULL;
+	const cfg_listelt_t *element;
+	const cfg_obj_t *key = NULL;
+	const char *keyid = NULL;
 	unsigned char *secret = NULL;
 	int secretalloc = 0;
 	int secretlen = 0;
@@ -49,14 +51,14 @@ add_initial_keys(cfg_obj_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) {
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *algobj = NULL;
+		const cfg_obj_t *algobj = NULL;
-		cfg_obj_t *secretobj = NULL;
+		const cfg_obj_t *secretobj = NULL;
 		dns_name_t keyname;
 		dns_name_t *alg;
-		char *algstr;
+		const char *algstr;
 		char keynamedata[1024];
 		isc_buffer_t keynamesrc, keynamebuf;
-		char *secretstr;
+		const char *secretstr;
 		isc_buffer_t secretbuf;
 
 		key = cfg_listelt_value(element);
@@ -129,11 +131,11 @@ add_initial_keys(cfg_obj_t *list, dns_tsig_keyring_t *ring, isc_mem_t *mctx) {
 }
 
 isc_result_t
-ns_tsigkeyring_fromconfig(cfg_obj_t *config, cfg_obj_t *vconfig,
+ns_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			  isc_mem_t *mctx, dns_tsig_keyring_t **ringp)
 {
-	cfg_obj_t *maps[3];
+	const cfg_obj_t *maps[3];
-	cfg_obj_t *keylist;
+	const cfg_obj_t *keylist;
 	dns_tsig_keyring_t *ring = NULL;
 	isc_result_t result;
 	int i;

contrib/bind9/bin/named/unix/os.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: os.c,v 1.46.2.4.8.22 2005/05/20 01:37:19 marka Exp $ */
+/* $Id: os.c,v 1.46.2.4.8.24 2006/02/03 23:51:37 marka Exp $ */
 
 #include <config.h>
 #include <stdarg.h>
@@ -497,6 +497,13 @@ ns_os_changeuser(void) {
 #if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
 	linux_minprivs();
 #endif
+#if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
+	/*
+	 * Restore the ability of named to drop core after the setuid()
+	 * call has disabled it.
+	 */
+	prctl(PR_SET_DUMPABLE,1,0,0,0);
+#endif
 }
 
 void

contrib/bind9/bin/named/update.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.88.2.5.2.27 2005/10/08 00:21:06 marka Exp $ */
+/* $Id: update.c,v 1.88.2.5.2.29 2006/01/06 00:01:42 marka Exp $ */
 
 #include <config.h>
 
@@ -36,6 +36,7 @@
 #include <dns/rdataclass.h>
 #include <dns/rdataset.h>
 #include <dns/rdatasetiter.h>
+#include <dns/rdatastruct.h>
 #include <dns/rdatatype.h>
 #include <dns/soa.h>
 #include <dns/ssu.h>
@@ -1517,7 +1518,8 @@ next_active(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
  */
 static isc_result_t
 add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
-	dns_dbversion_t *ver, dns_name_t *name, dns_diff_t *diff)
+	 dns_dbversion_t *ver, dns_name_t *name, dns_ttl_t nsecttl,
+	 dns_diff_t *diff)
 {
 	isc_result_t result;
 	dns_dbnode_t *node = NULL;
@@ -1552,8 +1554,7 @@ add_nsec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 * Add the new NSEC and record the change.
 	 */
 	CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, name,
-				   3600,	/* XXXRTH */
+				   nsecttl, &rdata, &tuple));
-				   &rdata, &tuple));
 	CHECK(do_one_tuple(&tuple, db, ver, diff));
 	INSIST(tuple == NULL);
 
@@ -1678,6 +1679,11 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	unsigned int nkeys = 0;
 	unsigned int i;
 	isc_stdtime_t now, inception, expire;
+	dns_ttl_t nsecttl;
+	dns_rdata_soa_t soa;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdataset_t rdataset;
+	dns_dbnode_t *node = NULL;
 
 	dns_diff_init(client->mctx, &diffnames);
 	dns_diff_init(client->mctx, &affected);
@@ -1698,6 +1704,20 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	inception = now - 3600; /* Allow for some clock skew. */
 	expire = now + sigvalidityinterval;
 
+	/*
+	 * Get the NSEC's TTL from the SOA MINIMUM field.
+	 */
+	CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
+	dns_rdataset_init(&rdataset);
+	CHECK(dns_db_findrdataset(db, node, newver, dns_rdatatype_soa, 0,
+                                  (isc_stdtime_t) 0, &rdataset, NULL));
+	CHECK(dns_rdataset_first(&rdataset));
+	dns_rdataset_current(&rdataset, &rdata);
+	CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));
+	nsecttl = soa.minimum;
+	dns_rdataset_disassociate(&rdataset);
+	dns_db_detachnode(db, &node);
+
 	/*
 	 * Find all RRsets directly affected by the update, and
 	 * update their RRSIGs.  Also build a list of names affected
@@ -1901,8 +1921,8 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 			 * there is other data, and if there is other data,
 			 * there are other RRSIGs.
 			 */
-			CHECK(add_nsec(client, zone, db, newver,
+			CHECK(add_nsec(client, zone, db, newver, &t->name,
-				      &t->name, &nsec_diff));
+				       nsecttl, &nsec_diff));
 		}
 	}
 

contrib/bind9/bin/named/zoneconf.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zoneconf.c,v 1.87.2.4.10.15 2005/09/06 02:12:39 marka Exp $ */
+/* $Id: zoneconf.c,v 1.87.2.4.10.19 2006/02/28 06:32:53 marka Exp $ */
 
 #include <config.h>
 
@@ -55,15 +55,15 @@
  * Convenience function for configuring a single zone ACL.
  */
 static isc_result_t
-configure_zone_acl(cfg_obj_t *zconfig, cfg_obj_t *vconfig, cfg_obj_t *config,
+configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
-		   const char *aclname, ns_aclconfctx_t *actx,
+		   const cfg_obj_t *config, const char *aclname,
-		   dns_zone_t *zone, 
+		   ns_aclconfctx_t *actx, dns_zone_t *zone, 
 		   void (*setzacl)(dns_zone_t *, dns_acl_t *),
 		   void (*clearzacl)(dns_zone_t *))
 {
 	isc_result_t result;
-	cfg_obj_t *maps[4];
+	const cfg_obj_t *maps[4];
-	cfg_obj_t *aclobj = NULL;
+	const cfg_obj_t *aclobj = NULL;
 	int i = 0;
 	dns_acl_t *dacl = NULL;
 
@@ -72,7 +72,7 @@ configure_zone_acl(cfg_obj_t *zconfig, cfg_obj_t *vconfig, cfg_obj_t *config,
 	if (vconfig != NULL)
 		maps[i++] = cfg_tuple_get(vconfig, "options");
 	if (config != NULL) {
-		cfg_obj_t *options = NULL;
+		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL)
 			maps[i++] = options;
@@ -98,16 +98,18 @@ configure_zone_acl(cfg_obj_t *zconfig, cfg_obj_t *vconfig, cfg_obj_t *config,
  * Parse the zone update-policy statement.
  */
 static isc_result_t
-configure_zone_ssutable(cfg_obj_t *zconfig, dns_zone_t *zone) {
+configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone) {
-	cfg_obj_t *updatepolicy = NULL;
+	const cfg_obj_t *updatepolicy = NULL;
-	cfg_listelt_t *element, *element2;
+	const cfg_listelt_t *element, *element2;
 	dns_ssutable_t *table = NULL;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
 	isc_result_t result;
 
 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);
-	if (updatepolicy == NULL)
+	if (updatepolicy == NULL) {
+		dns_zone_setssutable(zone, NULL);
 		return (ISC_R_SUCCESS);
+	}
 
 	result = dns_ssutable_create(mctx, &table);
 	if (result != ISC_R_SUCCESS)
@@ -117,13 +119,13 @@ configure_zone_ssutable(cfg_obj_t *zconfig, dns_zone_t *zone) {
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		cfg_obj_t *stmt = cfg_listelt_value(element);
+		const cfg_obj_t *stmt = cfg_listelt_value(element);
-		cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
+		const cfg_obj_t *mode = cfg_tuple_get(stmt, "mode");
-		cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
+		const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
-		cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
+		const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
-		cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
+		const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
-		cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
+		const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
-		char *str;
+		const char *str;
 		isc_boolean_t grant = ISC_FALSE;
 		unsigned int mtype = DNS_SSUMATCHTYPE_NAME;
 		dns_fixedname_t fname, fident;
@@ -191,14 +193,14 @@ configure_zone_ssutable(cfg_obj_t *zconfig, dns_zone_t *zone) {
 		     element2 != NULL;
 		     element2 = cfg_list_next(element2))
 		{
-			cfg_obj_t *typeobj;
+			const cfg_obj_t *typeobj;
 			isc_textregion_t r;
 
 			INSIST(i < n);
 
 			typeobj = cfg_listelt_value(element2);
 			str = cfg_obj_asstring(typeobj);
-			r.base = str;
+			DE_CONST(str, r.base);
 			r.length = strlen(str);
 
 			result = dns_rdatatype_fromtext(&types[i++], &r);
@@ -237,8 +239,8 @@ configure_zone_ssutable(cfg_obj_t *zconfig, dns_zone_t *zone) {
  * Convert a config file zone type into a server zone type.
  */
 static inline dns_zonetype_t
-zonetype_fromconfig(cfg_obj_t *map) {
+zonetype_fromconfig(const cfg_obj_t *map) {
-	cfg_obj_t *obj = NULL;
+	const cfg_obj_t *obj = NULL;
 	isc_result_t result;
 
 	result = cfg_map_get(map, "type", &obj);
@@ -293,7 +295,9 @@ strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
 }
 
 static void
-checknames(dns_zonetype_t ztype, cfg_obj_t **maps, cfg_obj_t **objp) {
+checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
+	   const cfg_obj_t **objp)
+{
 	const char *zone = NULL;
 	isc_result_t result;
 
@@ -308,17 +312,18 @@ checknames(dns_zonetype_t ztype, cfg_obj_t **maps, cfg_obj_t **objp) {
 }
 
 isc_result_t
-ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
+ns_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-		  ns_aclconfctx_t *ac, dns_zone_t *zone)
+		  const cfg_obj_t *zconfig, ns_aclconfctx_t *ac,
+		  dns_zone_t *zone)
 {
 	isc_result_t result;
-	char *zname;
+	const char *zname;
 	dns_rdataclass_t zclass;
 	dns_rdataclass_t vclass;
-	cfg_obj_t *maps[5];
+	const cfg_obj_t *maps[5];
-	cfg_obj_t *zoptions = NULL;
+	const cfg_obj_t *zoptions = NULL;
-	cfg_obj_t *options = NULL;
+	const cfg_obj_t *options = NULL;
-	cfg_obj_t *obj;
+	const cfg_obj_t *obj;
 	const char *filename = NULL;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
 	isc_sockaddr_t *addrs;
@@ -428,7 +433,7 @@ ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
 		else
 			dialup = dns_dialuptype_no;
 	} else {
-		char *dialupstr = cfg_obj_asstring(obj);
+		const char *dialupstr = cfg_obj_asstring(obj);
 		if (strcasecmp(dialupstr, "notify") == 0)
 			dialup = dns_dialuptype_notify;
 		else if (strcasecmp(dialupstr, "notify-passive") == 0)
@@ -462,7 +467,7 @@ ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
 			else
 				notifytype = dns_notifytype_no;
 		} else {
-			char *notifystr = cfg_obj_asstring(obj);
+			const char *notifystr = cfg_obj_asstring(obj);
 			if (strcasecmp(notifystr, "explicit") == 0)
 				notifytype = dns_notifytype_explicit;
 			else
@@ -612,6 +617,7 @@ ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
 	switch (ztype) {
 	case dns_zone_slave:
 	case dns_zone_stub:
+		count = 0;
 		obj = NULL;
 		result = cfg_map_get(zoptions, "masters", &obj);
 		if (obj != NULL) {
@@ -715,9 +721,9 @@ ns_zone_configure(cfg_obj_t *config, cfg_obj_t *vconfig, cfg_obj_t *zconfig,
 }
 
 isc_boolean_t
-ns_zone_reusable(dns_zone_t *zone, cfg_obj_t *zconfig) {
+ns_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
-	cfg_obj_t *zoptions = NULL;
+	const cfg_obj_t *zoptions = NULL;
-	cfg_obj_t *obj = NULL;
+	const cfg_obj_t *obj = NULL;
 	const char *cfilename;
 	const char *zfilename;
 

contrib/bind9/bin/nsupdate/nsupdate.8

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: nsupdate.8,v 1.24.2.2.2.8 2005/10/13 02:33:48 marka Exp $
+.\" $Id: nsupdate.8,v 1.24.2.2.2.9 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: nsupdate
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: Jun 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "NSUPDATE" "8" "Jun 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -30,7 +33,7 @@
 nsupdate \- Dynamic DNS update utility
 .SH "SYNOPSIS"
 .HP 9
-\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fIkeyname:secret\fR\fR] [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename]
+\fBnsupdate\fR [\fB\-d\fR] [[\fB\-y\ \fR\fB\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [filename]
 .SH "DESCRIPTION"
 .PP
 \fBnsupdate\fR
@@ -79,7 +82,8 @@ reads the shared secret from the file
 must also be present. When the
 \fB\-y\fR
 option is used, a signature is generated from
-\fIkeyname:secret.\fR\fIkeyname\fR
+\fIkeyname:secret.\fR
+\fIkeyname\fR
 is the name of the key, and
 \fIsecret\fR
 is the base64 encoded shared secret. Use of the
@@ -123,7 +127,7 @@ Every update request consists of zero or more prerequisites and zero or more upd
 command) causes the accumulated commands to be sent as one Dynamic DNS update request to the name server.
 .PP
 The command formats and their meaning are as follows:
-.TP
+.TP 3n
 .HP 7 \fBserver\fR {servername} [port]
 Sends all dynamic update requests to the name server
 \fIservername\fR. When no server statement is provided,
@@ -133,7 +137,7 @@ will send updates to the master server of the correct zone. The MNAME field of t
 is the port number on
 \fIservername\fR
 where the dynamic update requests get sent. If no port number is specified, the default DNS port number of 53 is used.
-.TP
+.TP 3n
 .HP 6 \fBlocal\fR {address} [port]
 Sends all dynamic update requests using the local
 \fIaddress\fR. When no local statement is provided,
@@ -141,7 +145,7 @@ Sends all dynamic update requests using the local
 will send updates using an address and port chosen by the system.
 \fIport\fR
 can additionally be used to make requests come from a specific port. If no port number is specified, the system will assign one.
-.TP
+.TP 3n
 .HP 5 \fBzone\fR {zonename}
 Specifies that all updates are to be made to the zone
 \fIzonename\fR. If no
@@ -149,32 +153,33 @@ Specifies that all updates are to be made to the zone
 statement is provided,
 \fBnsupdate\fR
 will attempt determine the correct zone to update based on the rest of the input.
-.TP
+.TP 3n
 .HP 6 \fBclass\fR {classname}
 Specify the default class. If no
 \fIclass\fR
 is specified the default class is
 \fIIN\fR.
-.TP
+.TP 3n
 .HP 4 \fBkey\fR {name} {secret}
 Specifies that all updates are to be TSIG signed using the
-\fIkeyname\fR\fIkeysecret\fR
+\fIkeyname\fR
+\fIkeysecret\fR
 pair. The
 \fBkey\fR
 command overrides any key specified on the command line via
 \fB\-y\fR
 or
 \fB\-k\fR.
-.TP
+.TP 3n
 .HP 16 \fBprereq nxdomain\fR {domain\-name}
 Requires that no resource record of any type exists with name
 \fIdomain\-name\fR.
-.TP
+.TP 3n
 .HP 16 \fBprereq yxdomain\fR {domain\-name}
 Requires that
 \fIdomain\-name\fR
 exists (has as at least one resource record, of any type).
-.TP
+.TP 3n
 .HP 15 \fBprereq nxrrset\fR {domain\-name} [class] {type}
 Requires that no resource record exists of the specified
 \fItype\fR,
@@ -183,7 +188,7 @@ and
 \fIdomain\-name\fR. If
 \fIclass\fR
 is omitted, IN (internet) is assumed.
-.TP
+.TP 3n
 .HP 15 \fBprereq yxrrset\fR {domain\-name} [class] {type}
 This requires that a resource record of the specified
 \fItype\fR,
@@ -193,7 +198,7 @@ and
 must exist. If
 \fIclass\fR
 is omitted, IN (internet) is assumed.
-.TP
+.TP 3n
 .HP 15 \fBprereq yxrrset\fR {domain\-name} [class] {type} {data...}
 The
 \fIdata\fR
@@ -207,7 +212,7 @@ are combined to form a set of RRs. This set of RRs must exactly match the set of
 \fIdomain\-name\fR. The
 \fIdata\fR
 are written in the standard text representation of the resource record's RDATA.
-.TP
+.TP 3n
 .HP 14 \fBupdate delete\fR {domain\-name} [ttl] [class] [type\ [data...]]
 Deletes any resource records named
 \fIdomain\-name\fR. If
@@ -219,20 +224,20 @@ is provided, only matching resource records will be removed. The internet class
 is not supplied. The
 \fIttl\fR
 is ignored, and is only allowed for compatibility.
-.TP
+.TP 3n
 .HP 11 \fBupdate add\fR {domain\-name} {ttl} [class] {type} {data...}
 Adds a new resource record with the specified
 \fIttl\fR,
 \fIclass\fR
 and
 \fIdata\fR.
-.TP
+.TP 3n
 .HP 5 \fBshow\fR
 Displays the current message, containing all of the prerequisites and updates specified since the last send.
-.TP
+.TP 3n
 .HP 5 \fBsend\fR
 Sends the current message. This is equivalent to entering a blank line.
-.TP
+.TP 3n
 .HP 7 \fBanswer\fR
 Displays the answer.
 .PP
@@ -246,12 +251,14 @@ could be used to insert and delete resource records from the
 zone. Notice that the input in each example contains a trailing blank line so that a group of commands are sent as one dynamic update request to the master name server for
 \fBexample.com\fR.
 .sp
+.RS 3n
 .nf
 # nsupdate
 > update delete oldhost.example.com A
 > update add newhost.example.com 86400 A 172.16.1.1
 > send
 .fi
+.RE
 .sp
 .PP
 Any A records for
@@ -260,25 +267,27 @@ are deleted. and an A record for
 \fBnewhost.example.com\fR
 it IP address 172.16.1.1 is added. The newly\-added record has a 1 day TTL (86400 seconds)
 .sp
+.RS 3n
 .nf
 # nsupdate
 > prereq nxdomain nickname.example.com
 > update add nickname.example.com 86400 CNAME somehost.example.com
 > send
 .fi
+.RE
 .sp
 .PP
 The prerequisite condition gets the name server to check that there are no resource records of any type for
 \fBnickname.example.com\fR. If there are, the update request fails. If this name does not exist, a CNAME for it is added. This ensures that when the CNAME is added, it cannot conflict with the long\-standing rule in RFC1034 that a name must not exist as any other record type if it exists as a CNAME. (The rule has been updated for DNSSEC in RFC2535 to allow CNAMEs to have RRSIG, DNSKEY and NSEC records.)
 .SH "FILES"
-.TP
+.TP 3n
 \fB/etc/resolv.conf\fR
 used to identify default name server
-.TP
+.TP 3n
 \fBK{name}.+157.+{random}.key\fR
 base\-64 encoding of HMAC\-MD5 key created by
 \fBdnssec\-keygen\fR(8).
-.TP
+.TP 3n
 \fBK{name}.+157.+{random}.private\fR
 base\-64 encoding of HMAC\-MD5 key created by
 \fBdnssec\-keygen\fR(8).
@@ -296,3 +305,5 @@ base\-64 encoding of HMAC\-MD5 key created by
 .SH "BUGS"
 .PP
 The TSIG key is redundantly stored in two separate files. This is a consequence of nsupdate using the DST library for its cryptographic operations, and may change in future releases.
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/nsupdate/nsupdate.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.103.2.15.2.20 2005/03/17 03:58:26 marka Exp $ */
+/* $Id: nsupdate.c,v 1.103.2.15.2.23 2006/06/09 07:29:24 marka Exp $ */
 
 #include <config.h>
 
@@ -1343,8 +1343,10 @@ get_next_command(void) {
 	char *word;
 
 	ddebug("get_next_command()");
-	if (interactive)
+	if (interactive) {
 		fprintf(stdout, "> ");
+		fflush(stdout);
+	}
 	isc_app_block();
 	cmdline = fgets(cmdlinebuf, MAXCMD, input);
 	isc_app_unblock();
@@ -1665,7 +1667,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		result = dns_request_createvia3(requestmgr, soaquery,
 						localaddr, addr, 0, NULL,
 						FIND_TIMEOUT * 20,
-						FIND_TIMEOUT * 20, 3,
+						FIND_TIMEOUT, 3,
 						global_task, recvsoa, reqinfo,
 						&request);
 		check_result(result, "dns_request_createvia");

contrib/bind9/bin/nsupdate/nsupdate.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: nsupdate.html,v 1.9.2.3.2.12 2005/10/13 02:33:49 marka Exp $ -->
+<!-- $Id: nsupdate.html,v 1.9.2.3.2.15 2006/06/29 13:02:30 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>nsupdate</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>nsupdate &#8212; Dynamic DNS update utility</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsupdate</code>  [<code class="option">-d</code>] [[<code class="option">-y <em class="replaceable"><code>keyname:secret</code></em></code>] |  [<code class="option">-k <em class="replaceable"><code>keyfile</code></em></code>]] [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>] [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>] [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>] [<code class="option">-v</code>] [filename]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525896"></a><h2>DESCRIPTION</h2>
+<a name="id2549461"></a><h2>DESCRIPTION</h2>
 <p>
 <span><strong class="command">nsupdate</strong></span>
 is used to submit Dynamic DNS Update requests as defined in RFC2136
@@ -160,7 +160,7 @@ and number of UDP retries.
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526121"></a><h2>INPUT FORMAT</h2>
+<a name="id2549686"></a><h2>INPUT FORMAT</h2>
 <p>
 <span><strong class="command">nsupdate</strong></span>
 reads input from
@@ -317,7 +317,7 @@ are written in the standard text representation of the resource record's
 RDATA.
 </p></dd>
 <dt><span class="term">
-<div class="cmdsynopsis"><p><code class="command">update delete</code>  {domain-name} [ttl] [class] [type  [data...]]</p></div>
+<div class="cmdsynopsis"><p><code class="command">update delete</code>  {domain-name} [ttl] [class] [type [data...]]</p></div>
 </span></dt>
 <dd><p>
 Deletes any resource records named
@@ -370,7 +370,7 @@ Lines beginning with a semicolon are comments and are ignored.
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526749"></a><h2>EXAMPLES</h2>
+<a name="id2550382"></a><h2>EXAMPLES</h2>
 <p>
 The examples below show how
 <span><strong class="command">nsupdate</strong></span>
@@ -423,7 +423,7 @@ RRSIG, DNSKEY and NSEC records.)
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526793"></a><h2>FILES</h2>
+<a name="id2550426"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">/etc/resolv.conf</code></span></dt>
 <dd><p>
@@ -442,7 +442,7 @@ base-64 encoding of HMAC-MD5 key created by
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525155"></a><h2>SEE ALSO</h2>
+<a name="id2549061"></a><h2>SEE ALSO</h2>
 <p>
 <span class="citerefentry"><span class="refentrytitle">RFC2136</span></span>,
 <span class="citerefentry"><span class="refentrytitle">RFC3007</span></span>,
@@ -456,7 +456,7 @@ base-64 encoding of HMAC-MD5 key created by
 </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525226"></a><h2>BUGS</h2>
+<a name="id2549132"></a><h2>BUGS</h2>
 <p>
 The TSIG key is redundantly stored in two separate files.
 This is a consequence of nsupdate using the DST library

contrib/bind9/bin/rndc/rndc-confgen.8

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc-confgen.8,v 1.3.2.5.2.7 2005/10/13 02:33:50 marka Exp $
+.\" $Id: rndc-confgen.8,v 1.3.2.5.2.8 2006/06/29 13:02:31 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: rndc\-confgen
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: Aug 27, 2001
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "RNDC\-CONFGEN" "8" "Aug 27, 2001" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -53,7 +56,7 @@ file and a
 \fBcontrols\fR
 statement altogether.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-a
 Do automatic
 \fBrndc\fR
@@ -97,30 +100,30 @@ option and set up a
 and
 \fInamed.conf\fR
 as directed.
-.TP
+.TP 3n
 \-b \fIkeysize\fR
 Specifies the size of the authentication key in bits. Must be between 1 and 512 bits; the default is 128.
-.TP
+.TP 3n
 \-c \fIkeyfile\fR
 Used with the
 \fB\-a\fR
 option to specify an alternate location for
 \fIrndc.key\fR.
-.TP
+.TP 3n
 \-h
 Prints a short summary of the options and arguments to
 \fBrndc\-confgen\fR.
-.TP
+.TP 3n
 \-k \fIkeyname\fR
 Specifies the key name of the rndc authentication key. This must be a valid domain name. The default is
 \fBrndc\-key\fR.
-.TP
+.TP 3n
 \-p \fIport\fR
 Specifies the command channel port where
 \fBnamed\fR
 listens for connections from
 \fBrndc\fR. The default is 953.
-.TP
+.TP 3n
 \-r \fIrandomfile\fR
 Specifies a source of random data for generating the authorization. If the operating system does not provide a
 \fI/dev/random\fR
@@ -129,13 +132,13 @@ or equivalent device, the default source of randomness is keyboard input.
 specifies the name of a character device or file containing random data to be used instead of the default. The special value
 \fIkeyboard\fR
 indicates that keyboard input should be used.
-.TP
+.TP 3n
 \-s \fIaddress\fR
 Specifies the IP address where
 \fBnamed\fR
 listens for command channel connections from
 \fBrndc\fR. The default is the loopback address 127.0.0.1.
-.TP
+.TP 3n
 \-t \fIchrootdir\fR
 Used with the
 \fB\-a\fR
@@ -145,7 +148,7 @@ will run chrooted. An additional copy of the
 \fIrndc.key\fR
 will be written relative to this directory so that it will be found by the chrooted
 \fBnamed\fR.
-.TP
+.TP 3n
 \-u \fIuser\fR
 Used with the
 \fB\-a\fR
@@ -181,3 +184,5 @@ BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/rndc/rndc-confgen.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc-confgen.html,v 1.3.2.5.2.11 2005/10/13 02:33:51 marka Exp $ -->
+<!-- $Id: rndc-confgen.html,v 1.3.2.5.2.13 2006/06/29 13:02:31 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>rndc-confgen</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">rndc-confgen</span> &#8212; rndc key generation tool</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525911"></a><h2>DESCRIPTION</h2>
+<a name="id2549476"></a><h2>DESCRIPTION</h2>
 <p>
         <span><strong class="command">rndc-confgen</strong></span> generates configuration files
 	for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -48,7 +48,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525957"></a><h2>OPTIONS</h2>
+<a name="id2549522"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -57,7 +57,7 @@
 	      This creates a file <code class="filename">rndc.key</code>
 	      in <code class="filename">/etc</code> (or whatever
               <code class="varname">sysconfdir</code>
-	      was specified as when <span class="acronym">BIND</span> was built)
+	      was specified as when <acronym class="acronym">BIND</acronym> was built)
               that is read by both <span><strong class="command">rndc</strong></span>
               and <span><strong class="command">named</strong></span> on startup.  The
 	      <code class="filename">rndc.key</code> file defines a default
@@ -148,7 +148,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526270"></a><h2>EXAMPLES</h2>
+<a name="id2549972"></a><h2>EXAMPLES</h2>
 <p>
         To allow <span><strong class="command">rndc</strong></span> to be used with
 	no manual configuration, run
@@ -167,7 +167,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526314"></a><h2>SEE ALSO</h2>
+<a name="id2550016"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
@@ -176,7 +176,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526357"></a><h2>AUTHOR</h2>
+<a name="id2550058"></a><h2>AUTHOR</h2>
 <p>
         <span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/rndc/rndc.8

@@ -13,14 +13,17 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.8,v 1.24.206.5 2005/10/13 02:33:49 marka Exp $
+.\" $Id: rndc.8,v 1.24.206.6 2006/06/29 13:02:30 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: rndc
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 30, 2000
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
 .TH "RNDC" "8" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
@@ -50,13 +53,13 @@ named the only supported authentication algorithm is HMAC\-MD5, which uses a sha
 \fBrndc\fR
 reads a configuration file to determine how to contact the name server and decide what algorithm and key it should use.
 .SH "OPTIONS"
-.TP
+.TP 3n
 \-c \fIconfig\-file\fR
 Use
 \fIconfig\-file\fR
 as the configuration file instead of the default,
 \fI/etc/rndc.conf\fR.
-.TP
+.TP 3n
 \-k \fIkey\-file\fR
 Use
 \fIkey\-file\fR
@@ -66,20 +69,20 @@ as the key file instead of the default,
 will be used to authenticate commands sent to the server if the
 \fIconfig\-file\fR
 does not exist.
-.TP
+.TP 3n
 \-s \fIserver\fR
 \fIserver\fR
 is the name or address of the server which matches a server statement in the configuration file for
 \fBrndc\fR. If no server is supplied on the command line, the host named by the default\-server clause in the option statement of the configuration file will be used.
-.TP
+.TP 3n
 \-p \fIport\fR
 Send commands to TCP port
 \fIport\fR
 instead of BIND 9's default control channel port, 953.
-.TP
+.TP 3n
 \-V
 Enable verbose logging.
-.TP
+.TP 3n
 \-y \fIkeyid\fR
 Use the key
 \fIkeyid\fR
@@ -111,8 +114,11 @@ Several error messages could be clearer.
 .PP
 \fBrndc.conf\fR(5),
 \fBnamed\fR(8),
-\fBnamed.conf\fR(5)\fBndc\fR(8),
+\fBnamed.conf\fR(5)
+\fBndc\fR(8),
 BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/rndc/rndc.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rndc.c,v 1.77.2.5.2.15 2005/03/17 03:58:27 marka Exp $ */
+/* $Id: rndc.c,v 1.77.2.5.2.19 2006/08/04 03:03:08 marka Exp $ */
 
 /*
  * Principal Author: DCL
@@ -154,6 +154,11 @@ rndc_senddone(isc_task_t *task, isc_event_t *event) {
 	if (sevent->result != ISC_R_SUCCESS)
 		fatal("send failed: %s", isc_result_totext(sevent->result));
 	isc_event_free(&event);
+	if (sends == 0 && recvs == 0) {
+		isc_socket_detach(&sock);
+		isc_task_shutdown(task);
+		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+	}
 }
 
 static void
@@ -204,9 +209,11 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 
 	isc_event_free(&event);
 	isccc_sexpr_free(&response);
-	isc_socket_detach(&sock);
+	if (sends == 0 && recvs == 0) {
-	isc_task_shutdown(task);
+		isc_socket_detach(&sock);
-	RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+		isc_task_shutdown(task);
+		RUNTIME_CHECK(isc_app_shutdown() == ISC_R_SUCCESS);
+	}
 }
 
 static void
@@ -288,6 +295,7 @@ rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
 
 static void
 rndc_connected(isc_task_t *task, isc_event_t *event) {
+	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *data;
@@ -301,17 +309,19 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 	connects--;
 
 	if (sevent->result != ISC_R_SUCCESS) {
+		isc_sockaddr_format(&serveraddrs[currentaddr], socktext,
+				    sizeof(socktext));
 		if (sevent->result != ISC_R_CANCELED &&
-		    currentaddr < nserveraddrs)
+		    ++currentaddr < nserveraddrs)
 		{
-			notify("connection failed: %s",
+			notify("connection failed: %s: %s", socktext,
 			       isc_result_totext(sevent->result));
 			isc_socket_detach(&sock);
 			isc_event_free(&event);
-			rndc_startconnect(&serveraddrs[currentaddr++], task);
+			rndc_startconnect(&serveraddrs[currentaddr], task);
 			return;
 		} else
-			fatal("connect failed: %s",
+			fatal("connect failed: %s: %s", socktext,
 			      isc_result_totext(sevent->result));
 	}
 
@@ -369,7 +379,7 @@ rndc_start(isc_task_t *task, isc_event_t *event) {
 	get_addresses(servername, (in_port_t) remoteport);
 
 	currentaddr = 0;
-	rndc_startconnect(&serveraddrs[currentaddr++], task);
+	rndc_startconnect(&serveraddrs[currentaddr], task);
 }
 
 static void
@@ -378,17 +388,17 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 {
 	isc_result_t result;
 	const char *conffile = admin_conffile;
-	cfg_obj_t *defkey = NULL;
+	const cfg_obj_t *defkey = NULL;
-	cfg_obj_t *options = NULL;
+	const cfg_obj_t *options = NULL;
-	cfg_obj_t *servers = NULL;
+	const cfg_obj_t *servers = NULL;
-	cfg_obj_t *server = NULL;
+	const cfg_obj_t *server = NULL;
-	cfg_obj_t *keys = NULL;
+	const cfg_obj_t *keys = NULL;
-	cfg_obj_t *key = NULL;
+	const cfg_obj_t *key = NULL;
-	cfg_obj_t *defport = NULL;
+	const cfg_obj_t *defport = NULL;
-	cfg_obj_t *secretobj = NULL;
+	const cfg_obj_t *secretobj = NULL;
-	cfg_obj_t *algorithmobj = NULL;
+	const cfg_obj_t *algorithmobj = NULL;
 	cfg_obj_t *config = NULL;
-	cfg_listelt_t *elt;
+	const cfg_listelt_t *elt;
 	const char *secretstr;
 	const char *algorithm;
 	static char secretarray[1024];
@@ -420,7 +430,7 @@ parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
 	if (key_only && servername == NULL)
 		servername = "127.0.0.1";
 	else if (servername == NULL && options != NULL) {
-		cfg_obj_t *defserverobj = NULL;
+		const cfg_obj_t *defserverobj = NULL;
 		(void)cfg_map_get(options, "default-server", &defserverobj);
 		if (defserverobj != NULL)
 			servername = cfg_obj_asstring(defserverobj);

contrib/bind9/bin/rndc/rndc.conf.5

@@ -13,15 +13,18 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: rndc.conf.5,v 1.21.206.5 2005/10/13 02:33:50 marka Exp $
+.\" $Id: rndc.conf.5,v 1.21.206.6 2006/06/29 13:02:31 marka Exp $
 .\"
 .hy 0
 .ad l
-.\" ** You probably do not want to edit this file directly **
+.\"     Title: \fIrndc.conf\fR
-.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
+.\"    Author: 
-.\" Instead of manually editing it, you probably should edit the DocBook XML
+.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
-.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
+.\"      Date: June 30, 2000
-.TH "\\FIRNDC.CONF\\FR" "5" "June 30, 2000" "BIND9" "BIND9"
+.\"    Manual: BIND9
+.\"    Source: BIND9
+.\"
+.TH "\fIRNDC.CONF\fR" "5" "June 30, 2000" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -98,6 +101,7 @@ program, also known as
 does not ship with BIND 9 but is available on many systems. See the EXAMPLE section for sample command lines for each.
 .SH "EXAMPLE"
 .sp
+.RS 3n
 .nf
     options {
         default\-server  localhost;
@@ -111,6 +115,7 @@ does not ship with BIND 9 but is available on many systems. See the EXAMPLE sect
         secret          "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
       };
 .fi
+.RE
 .PP
 In the above example,
 \fBrndc\fR
@@ -152,3 +157,5 @@ BIND 9 Administrator Reference Manual.
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
+.SH "COPYRIGHT"
+Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")

contrib/bind9/bin/rndc/rndc.conf.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.conf.html,v 1.5.2.1.4.10 2005/10/13 02:33:51 marka Exp $ -->
+<!-- $Id: rndc.conf.html,v 1.5.2.1.4.13 2006/06/29 13:02:31 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>rndc.conf</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><code class="filename">rndc.conf</code> &#8212; rndc configuration file</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525833"></a><h2>DESCRIPTION</h2>
+<a name="id2549398"></a><h2>DESCRIPTION</h2>
 <p>
         <code class="filename">rndc.conf</code> is the configuration file
 	for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
@@ -105,7 +105,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525968"></a><h2>EXAMPLE</h2>
+<a name="id2549601"></a><h2>EXAMPLE</h2>
 <pre class="programlisting">
     options {
         default-server  localhost;
@@ -151,7 +151,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526028"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2549730"></a><h2>NAME SERVER CONFIGURATION</h2>
 <p>
         The name server must be configured to accept rndc connections and
 	to recognize the key specified in the <code class="filename">rndc.conf</code>
@@ -161,7 +161,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526049"></a><h2>SEE ALSO</h2>
+<a name="id2549750"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
@@ -170,7 +170,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526091"></a><h2>AUTHOR</h2>
+<a name="id2549793"></a><h2>AUTHOR</h2>
 <p>
         <span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/bin/rndc/rndc.html

@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: rndc.html,v 1.7.2.1.4.10 2005/10/13 02:33:50 marka Exp $ -->
+<!-- $Id: rndc.html,v 1.7.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>rndc</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2463721"></a><div class="titlepage"></div>
+<a name="id2482688"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p><span class="application">rndc</span> &#8212; name server control utility</p>
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525886"></a><h2>DESCRIPTION</h2>
+<a name="id2549451"></a><h2>DESCRIPTION</h2>
 <p>
         <span><strong class="command">rndc</strong></span> controls the operation of a name
 	server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -61,7 +61,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2525927"></a><h2>OPTIONS</h2>
+<a name="id2549492"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-c <em class="replaceable"><code>config-file</code></em></span></dt>
 <dd><p>
@@ -123,7 +123,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526109"></a><h2>LIMITATIONS</h2>
+<a name="id2549811"></a><h2>LIMITATIONS</h2>
 <p>
         <span><strong class="command">rndc</strong></span> does not yet support all the commands of
 	the BIND 8 <span><strong class="command">ndc</strong></span> utility.
@@ -137,7 +137,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526138"></a><h2>SEE ALSO</h2>
+<a name="id2549840"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -147,7 +147,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2526190"></a><h2>AUTHOR</h2>
+<a name="id2549892"></a><h2>AUTHOR</h2>
 <p>
         <span class="corpauthor">Internet Systems Consortium</span>
     </p>

contrib/bind9/config.threads.in

@@ -140,6 +140,31 @@ then
 			fi
 		fi
 		;;
+		*-freebsd*)
+			# We don't want to set -lpthread as that break
+			# the ability to choose threads library at final
+			# link time and is not valid for all architectures.
+			
+			PTHREAD=
+			if test "X$GCC" = "Xyes"; then
+				saved_cc="$CC"
+				CC="$CC -pthread"
+				AC_MSG_CHECKING(for gcc -pthread support);
+				AC_TRY_LINK([#include <pthread.h>],
+					    [printf("%x\n", pthread_create);],
+					    PTHREAD="yes"
+					    AC_MSG_RESULT(yes),
+					    AC_MSG_RESULT(no))
+				CC="$saved_cc"
+			fi
+			if test "X$PTHREAD" != "Xyes"; then
+				AC_CHECK_LIB(pthread, pthread_create,,
+				AC_CHECK_LIB(thr, thread_create,,
+				AC_CHECK_LIB(c_r, pthread_create,,
+				AC_CHECK_LIB(c, pthread_create,,
+				AC_MSG_ERROR("could not find thread libraries")))))
+			fi
+			;;
 		*)
 			AC_CHECK_LIB(pthread, pthread_create,,
 				AC_CHECK_LIB(pthread, __pthread_create,,

contrib/bind9/configure.in

@@ -18,7 +18,7 @@ AC_DIVERT_PUSH(1)dnl
 esyscmd([sed "s/^/# /" COPYRIGHT])dnl
 AC_DIVERT_POP()dnl
 
-AC_REVISION($Revision: 1.294.2.23.2.51.4.3 $)
+AC_REVISION($Revision: 1.294.2.23.2.73 $)
 
 AC_INIT(lib/dns/name.c)
 AC_PREREQ(2.13)
@@ -364,7 +364,7 @@ AC_ARG_WITH(openssl,
                           (Required for DNSSEC)],
     use_openssl="$withval", use_openssl="auto")
 
-openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg"
+openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
 if test "$use_openssl" = "auto"
 then
 	for d in $openssldirs
@@ -417,6 +417,9 @@ case "$use_openssl" in
 			*-solaris*)
 				DNS_OPENSSL_LIBS="-L$use_openssl/lib -R$use_openssl/lib -lcrypto"
 				;;
+			*-hp-hpux*)
+				DNS_OPENSSL_LIBS="-L$use_openssl/lib -Wl,+b: -lcrypto"
+				;;
 			*)
 				DNS_OPENSSL_LIBS="-L$use_openssl/lib -lcrypto"
 				;;
@@ -463,9 +466,19 @@ shared library configuration (e.g., LD_LIBRARY_PATH).)],
 		[AC_MSG_RESULT(assuming it does work on target platform)]
 		)
 		 
+		AC_CHECK_FUNC(DH_generate_parameters,
+			      AC_DEFINE(HAVE_DH_GENERATE_PARAMETERS, 1,
+					[Define if libcrypto has DH_generate_parameters]))
+		AC_CHECK_FUNC(RSA_generate_key,
+			      AC_DEFINE(HAVE_RSA_GENERATE_KEY, 1,
+					[Define if libcrypto has RSA_generate_key]))
+		AC_CHECK_FUNC(DSA_generate_parameters,
+			      AC_DEFINE(HAVE_DSA_GENERATE_PARAMETERS, 1,
+					[Define if libcrypto has DSA_generate_parameters]))
+
 AC_ARG_ENABLE(openssl-version-check,
 [AC_HELP_STRING([--enable-openssl-version-check],
-	[Check OpenSSL Version @<:@default=yes@:>@])])
+        [Check OpenSSL Version @<:@default=yes@:>@])])
 case "$enable_openssl_version_check" in
 yes|'')
 		AC_MSG_CHECKING(OpenSSL library version)
@@ -473,9 +486,9 @@ yes|'')
 #include <stdio.h>
 #include <openssl/opensslv.h>
 int main() {
-	if ((OPENSSL_VERSION_NUMBER >= 0x009070cfL &&
+        if ((OPENSSL_VERSION_NUMBER >= 0x009070cfL &&
-	     OPENSSL_VERSION_NUMBER < 0x009080000L) ||
+	     OPENSSL_VERSION_NUMBER < 0x00908000L) ||
-	    OPENSSL_VERSION_NUMBER >= 0x0090804fL)
+	     OPENSSL_VERSION_NUMBER >= 0x0090804fL)
                 return (0);
 	printf("\n\nFound   OPENSSL_VERSION_NUMBER %#010x\n",
 		OPENSSL_VERSION_NUMBER);
@@ -601,16 +614,61 @@ sinclude(config.threads.in)dnl
 
 if $use_threads
 then
+	if test "X$GCC" = "Xyes"; then
+		case "$host" in
+		*-freebsd*)
+			CC="$CC -pthread"
+			CCOPT="$CCOPT -pthread"
+			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+			;;
+		*-openbsd*)
+			CC="$CC -pthread"
+			CCOPT="$CCOPT -pthread"
+			;;
+		*-solaris*)
+			LIBS="$LIBS -lthread"
+			;;
+		*-ibm-aix*)
+			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+			;;
+		esac
+	else
+		case $host in
+		*-dec-osf*)
+			CC="$CC -pthread"
+			CCOPT="$CCOPT -pthread"
+			;;
+		*-solaris*)
+			CC="$CC -mt"
+			CCOPT="$CCOPT -mt"
+			;;
+		*-ibm-aix*)
+			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+			;;
+		*-sco-sysv*uw*|*-*-sysv*UnixWare*)
+			CC="$CC -Kthread"
+			CCOPT="$CCOPT -Kthread"
+			;;
+		*-*-sysv*OpenUNIX*)
+			CC="$CC -Kpthread"
+			CCOPT="$CCOPT -Kpthread"
+			;;
+		esac
+	fi
+	ALWAYS_DEFINES="-D_REENTRANT"
+	ISC_PLATFORM_USETHREADS="#define ISC_PLATFORM_USETHREADS 1"
+	thread_dir=pthreads
 	#
 	# We'd like to use sigwait() too
 	#
-	AC_CHECK_LIB(c, sigwait,
+	AC_CHECK_FUNC(sigwait,
-		     AC_DEFINE(HAVE_SIGWAIT),
+		      AC_DEFINE(HAVE_SIGWAIT),
-		     AC_CHECK_LIB(pthread, sigwait,
+		      AC_CHECK_LIB(c, sigwait,
-				  AC_DEFINE(HAVE_SIGWAIT),
+		      AC_DEFINE(HAVE_SIGWAIT),
-				  AC_CHECK_LIB(pthread, _Psigwait,
+		      AC_CHECK_LIB(pthread, sigwait,
-					       AC_DEFINE(HAVE_SIGWAIT),))
+				   AC_DEFINE(HAVE_SIGWAIT),
-	)
+				   AC_CHECK_LIB(pthread, _Psigwait,
+					        AC_DEFINE(HAVE_SIGWAIT),))))
 
 	AC_CHECK_FUNC(pthread_attr_getstacksize,
 		      AC_DEFINE(HAVE_PTHREAD_ATTR_GETSTACKSIZE),)
@@ -674,50 +732,6 @@ then
 	#
 	AC_CHECK_FUNC(sysconf, AC_DEFINE(HAVE_SYSCONF),)
 
-	if test "X$GCC" = "Xyes"; then
-		case "$host" in
-		*-freebsd*)
-			CC="$CC -pthread"
-			CCOPT="$CCOPT -pthread"
-			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
-			;;
-		*-openbsd*)
-			CC="$CC -pthread"
-			CCOPT="$CCOPT -pthread"
-			;;
-		*-solaris*)
-			LIBS="$LIBS -lthread"
-			;;
-		*-ibm-aix*)
-			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
-			;;
-		esac
-	else
-		case $host in
-		*-dec-osf*)
-			CC="$CC -pthread"
-			CCOPT="$CCOPT -pthread"
-			;;
-		*-solaris*)
-			CC="$CC -mt"
-			CCOPT="$CCOPT -mt"
-			;;
-		*-ibm-aix*)
-			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
-			;;
-		*-sco-sysv*uw*|*-*-sysv*UnixWare*)
-			CC="$CC -Kthread"
-			CCOPT="$CCOPT -Kthread"
-			;;
-		*-*-sysv*OpenUNIX*)
-			CC="$CC -Kpthread"
-			CCOPT="$CCOPT -Kpthread"
-			;;
-		esac
-	fi
-	ALWAYS_DEFINES="-D_REENTRANT"
-	ISC_PLATFORM_USETHREADS="#define ISC_PLATFORM_USETHREADS 1"
-	thread_dir=pthreads
 else
 	ISC_PLATFORM_USETHREADS="#undef ISC_PLATFORM_USETHREADS"
 	thread_dir=nothreads
@@ -777,7 +791,18 @@ MKDEPCFLAGS="-M"
 IRIX_DNSSEC_WARNINGS_HACK=""
 
 if test "X$GCC" = "Xyes"; then
-	STD_CWARNINGS="$STD_CWARNINGS -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings -Wformat"
+	AC_MSG_CHECKING(if "$CC" supports -fno-strict-aliasing)
+	SAVE_CFLAGS=$CFLAGS
+	CFLAGS=-fno-strict-aliasing
+	AC_TRY_COMPILE(,, [FNOSTRICTALIASING=yes],[FNOSTRICTALIASING=no])
+	CFLAGS=$SAVE_CFLAGS
+	if test "$FNOSTRICTALIASING" = "yes"; then
+		AC_MSG_RESULT(yes)
+	STD_CWARNINGS="$STD_CWARNINGS -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings -Wformat -Wpointer-arith -fno-strict-aliasing"
+	else
+		AC_MSG_RESULT(no)
+	STD_CWARNINGS="$STD_CWARNINGS -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings -Wformat -Wpointer-arith"
+	fi
 	case "$host" in
 	*-hp-hpux*)
 		LDFLAGS="-Wl,+vnocompatwarnings $LDFLAGS"
@@ -1555,11 +1580,11 @@ AC_SUBST(ISC_PLATFORM_NEEDMEMMOVE)
 
 AC_CHECK_FUNC(strtoul,
 	[ISC_PLATFORM_NEEDSTRTOUL="#undef ISC_PLATFORM_NEEDSTRTOUL"
-	 LWRES_PLATFORM_NEEDSTRTOUL="#undef ISC_PLATFORM_NEEDSTRTOUL"
+	 LWRES_PLATFORM_NEEDSTRTOUL="#undef LWRES_PLATFORM_NEEDSTRTOUL"
 	 GENRANDOMLIB=""],
 	[ISC_PLATFORM_NEEDSTRTOUL="#define ISC_PLATFORM_NEEDSTRTOUL 1"
-	 LWRES_PLATFORM_NEEDSTRTOUL="#define ISC_PLATFORM_NEEDSTRTOUL 1"
+	 LWRES_PLATFORM_NEEDSTRTOUL="#define LWRES_PLATFORM_NEEDSTRTOUL 1"
-	 "GENRANDOMLIB=${ISCLIBS}"])
+	 GENRANDOMLIB='${ISCLIBS}'])
 AC_SUBST(ISC_PLATFORM_NEEDSTRTOUL)
 AC_SUBST(LWRES_PLATFORM_NEEDSTRTOUL)
 AC_SUBST(GENRANDOMLIB)
@@ -1674,6 +1699,7 @@ AC_TRY_COMPILE([
 [optarg = 0;],
 [AC_MSG_RESULT(yes)],
 [AC_MSG_RESULT(no)
+GEN_NEED_OPTARG="-DNEED_OPTARG=1"
 AC_DEFINE(NEED_OPTARG, 1, [Defined if extern char *optarg is not declared.])])
 
 #
@@ -1736,6 +1762,17 @@ case "$host" in
 		;;
 esac
 
+#
+# Some hosts need msg_namelen to match the size of the socket structure.
+# Some hosts don't set msg_namelen appropriately on return from recvmsg().
+#
+case $host in
+*os2*|*hp-mpeix*)
+	AC_DEFINE(BROKEN_RECVMSG, 1,
+		  [Define if recvmsg() does not meet all of the BSD socket API specifications.])
+	;;
+esac
+
 #
 # Microsoft has their own way of handling shared libraries that requires
 # additional qualifiers on extern variables.  Unix systems don't need it.
@@ -1753,7 +1790,7 @@ AC_SUBST(ISC_PLATFORM_BRACEPTHREADONCEINIT)
 ISC_PLATFORM_BRACEPTHREADONCEINIT="#undef ISC_PLATFORM_BRACEPTHREADONCEINIT"
 
 case "$host" in
-	*-aix5.1.*)
+	*-aix5.[[123]].*)
 		hack_shutup_pthreadonceinit=yes
 		;;
 	*-bsdi3.1*)
@@ -1769,6 +1806,9 @@ case "$host" in
 	[*-solaris2.[89]])
 		hack_shutup_pthreadonceinit=yes
 		;;
+	*-solaris2.10)
+		hack_shutup_pthreadonceinit=yes
+		;;
 esac
 
 case "$hack_shutup_pthreadonceinit" in
@@ -1849,6 +1889,16 @@ case "$host" in
 	;;
 esac
 #
+# Solaris 2.5.1 and earlier cannot bind() then connect() a TCP socket.
+# This prevents the source address being set.
+#
+case "$host" in
+*-solaris2.[[012345]]|*-solaris2.5.1)
+	AC_DEFINE(BROKEN_TCP_BIND_BEFORE_CONNECT, 1,
+		  [Define if you cannot bind() before connect() for TCP sockets.])
+	;;
+esac
+#
 # The following sections deal with tools used for formatting
 # the documentation.  They are all optional, unless you are
 # a developer editing the documentation source.
@@ -2024,6 +2074,28 @@ LIBBIND9_API=$srcdir/lib/bind9/api
 AC_SUBST_FILE(LIBLWRES_API)
 LIBLWRES_API=$srcdir/lib/lwres/api
 
+if test "$cross_compiling" = "yes"; then
+	if test -z "$BUILD_CC"; then
+		AC_ERROR([BUILD_CC not set])
+	fi
+	BUILD_CFLAGS="$BUILD_CFLAGS"
+	BUILD_CPPFLAGS="$BUILD_CPPFLAGS"
+	BUILD_LDFLAGS="$BUILD_LDFLAGS"
+	BUILD_LIBS="$BUILD_LIBS"
+else
+	BUILD_CC="$CC" 
+	BUILD_CFLAGS="$CFLAGS" 
+	BUILD_CPPFLAGS="$CPPFLAGS $GEN_NEED_OPTARG"
+	BUILD_LDFLAGS="$LDFLAGS"
+	BUILD_LIBS="$LIBS"
+fi
+
+AC_SUBST(BUILD_CC)
+AC_SUBST(BUILD_CFLAGS)
+AC_SUBST(BUILD_CPPFLAGS)
+AC_SUBST(BUILD_LDFLAGS)
+AC_SUBST(BUILD_LIBS)
+
 AC_OUTPUT(
 	make/rules
 	make/includes

contrib/bind9/doc/arm/Bv9ARM.ch01.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch01.html,v 1.12.2.2.8.9 2005/10/13 02:33:58 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch01.html,v 1.12.2.2.8.15 2006/07/20 02:33:31 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 1. Introduction </title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
@@ -45,51 +45,51 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2545879">Scope of Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569434">Scope of Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2545905">Organization of This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569460">Organization of This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2545976">Conventions Used in This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569736">Conventions Used in This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2546234">The Domain Name System (<span class="acronym">DNS</span>)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569994">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546254">DNS Fundamentals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570014">DNS Fundamentals</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2544105">Domains and Domain Names</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570323">Domains and Domain Names</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546579">Zones</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570407">Zones</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546653">Authoritative Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570550">Authoritative Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546950">Caching Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570642">Caching Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2547076">Name Servers in Multiple Roles</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570699">Name Servers in Multiple Roles</a></span></dt>
 </dl></dd>
 </dl>
 </div>
-<p>The Internet Domain Name System (<span class="acronym">DNS</span>) consists of the syntax
+<p>The Internet Domain Name System (<acronym class="acronym">DNS</acronym>) consists of the syntax
   to specify the names of entities in the Internet in a hierarchical
   manner, the rules used for delegating authority over names, and the
   system implementation that actually maps names to Internet
-  addresses.  <span class="acronym">DNS</span> data is maintained in a group of distributed
+  addresses.  <acronym class="acronym">DNS</acronym> data is maintained in a group of distributed
   hierarchical databases.</p>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2545879"></a>Scope of Document</h2></div></div></div>
+<a name="id2569434"></a>Scope of Document</h2></div></div></div>
-<p>The Berkeley Internet Name Domain (<span class="acronym">BIND</span>) implements an
+<p>The Berkeley Internet Name Domain (<acronym class="acronym">BIND</acronym>) implements a
     domain name server for a number of operating systems. This
     document provides basic information about the installation and
-    care of the Internet Software Consortium (<span class="acronym">ISC</span>)
+    care of the Internet Software Consortium (<acronym class="acronym">ISC</acronym>)
-    <span class="acronym">BIND</span> version 9 software package for system
+    <acronym class="acronym">BIND</acronym> version 9 software package for system
     administrators.</p>
 <p>This version of the manual corresponds to BIND version 9.3.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2545905"></a>Organization of This Document</h2></div></div></div>
+<a name="id2569460"></a>Organization of This Document</h2></div></div></div>
 <p>In this document, <span class="emphasis"><em>Section 1</em></span> introduces
-    the basic <span class="acronym">DNS</span> and <span class="acronym">BIND</span> concepts. <span class="emphasis"><em>Section 2</em></span>
+    the basic <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym> concepts. <span class="emphasis"><em>Section 2</em></span>
-    describes resource requirements for running <span class="acronym">BIND</span> in various
+    describes resource requirements for running <acronym class="acronym">BIND</acronym> in various
     environments. Information in <span class="emphasis"><em>Section 3</em></span> is
     <span class="emphasis"><em>task-oriented</em></span> in its presentation and is
     organized functionally, to aid in the process of installing the
-    <span class="acronym">BIND</span> 9 software. The task-oriented section is followed by
+    <acronym class="acronym">BIND</acronym> 9 software. The task-oriented section is followed by
     <span class="emphasis"><em>Section 4</em></span>, which contains more advanced
     concepts that the system administrator may need for implementing
     certain options. <span class="emphasis"><em>Section 5</em></span>
-    describes the <span class="acronym">BIND</span> 9 lightweight
+    describes the <acronym class="acronym">BIND</acronym> 9 lightweight
     resolver.  The contents of <span class="emphasis"><em>Section 6</em></span> are
     organized as in a reference manual to aid in the ongoing
     maintenance of the software. <span class="emphasis"><em>Section 7
@@ -98,12 +98,12 @@
     main body of the document is followed by several
     <span class="emphasis"><em>Appendices</em></span> which contain useful reference
     information, such as a <span class="emphasis"><em>Bibliography</em></span> and
-    historic information related to <span class="acronym">BIND</span> and the Domain Name
+    historic information related to <acronym class="acronym">BIND</acronym> and the Domain Name
     System.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2545976"></a>Conventions Used in This Document</h2></div></div></div>
+<a name="id2569736"></a>Conventions Used in This Document</h2></div></div></div>
 <p>In this document, we use the following general typographic
     conventions:</p>
 <div class="informaltable"><table border="1">
@@ -140,7 +140,7 @@ input</p></td>
 </tbody>
 </table></div>
 <p>The following conventions are used in descriptions of the
-<span class="acronym">BIND</span> configuration file:</p>
+<acronym class="acronym">BIND</acronym> configuration file:</p>
 <div class="informaltable"><table border="1">
 <colgroup>
 <col>
@@ -169,15 +169,15 @@ describe:</em></span></p></td>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2546234"></a>The Domain Name System (<span class="acronym">DNS</span>)</h2></div></div></div>
+<a name="id2569994"></a>The Domain Name System (<acronym class="acronym">DNS</acronym>)</h2></div></div></div>
 <p>The purpose of this document is to explain the installation
-and upkeep of the <span class="acronym">BIND</span> software package, and we
+and upkeep of the <acronym class="acronym">BIND</acronym> software package, and we
 begin by reviewing the fundamentals of the Domain Name System
-(<span class="acronym">DNS</span>) as they relate to <span class="acronym">BIND</span>.
+(<acronym class="acronym">DNS</acronym>) as they relate to <acronym class="acronym">BIND</acronym>.
 </p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2546254"></a>DNS Fundamentals</h3></div></div></div>
+<a name="id2570014"></a>DNS Fundamentals</h3></div></div></div>
 <p>The Domain Name System (DNS) is the hierarchical, distributed
 database.  It stores information for mapping Internet host names to IP
 addresses and vice versa, mail routing information, and other data
@@ -185,14 +185,14 @@ used by Internet applications.</p>
 <p>Clients look up information in the DNS by calling a
 <span class="emphasis"><em>resolver</em></span> library, which sends queries to one or
 more <span class="emphasis"><em>name servers</em></span> and interprets the responses.
-The <span class="acronym">BIND</span> 9 software distribution contains a
+The <acronym class="acronym">BIND</acronym> 9 software distribution contains a
 name server, <span><strong class="command">named</strong></span>, and two resolver
 libraries, <span><strong class="command">liblwres</strong></span> and <span><strong class="command">libbind</strong></span>.
 </p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2544105"></a>Domains and Domain Names</h3></div></div></div>
+<a name="id2570323"></a>Domains and Domain Names</h3></div></div></div>
 <p>The data stored in the DNS is identified by <span class="emphasis"><em>domain
 names</em></span> that are organized as a tree according to
 organizational or administrative boundaries. Each node of the tree,
@@ -220,7 +220,7 @@ server</em></span>, which answers queries about the zone using the
 <span class="emphasis"><em>DNS protocol</em></span>.
 </p>
 <p>The data associated with each domain name is stored in the
-form of <span class="emphasis"><em>resource records</em></span> (<span class="acronym">RR</span>s).
+form of <span class="emphasis"><em>resource records</em></span> (<acronym class="acronym">RR</acronym>s).
 Some of the supported resource record types are described in
 <a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them" title="Types of Resource Records and When to Use Them">the section called &#8220;Types of Resource Records and When to Use Them&#8221;</a>.</p>
 <p>For more detailed information about the design of the DNS and
@@ -229,12 +229,12 @@ the DNS protocol, please refer to the standards documents listed in
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2546579"></a>Zones</h3></div></div></div>
+<a name="id2570407"></a>Zones</h3></div></div></div>
 <p>To properly operate a name server, it is important to understand
 the difference between a <span class="emphasis"><em>zone</em></span>
 and a <span class="emphasis"><em>domain</em></span>.</p>
 <p>As we stated previously, a zone is a point of delegation in
-the <span class="acronym">DNS</span> tree. A zone consists of
+the <acronym class="acronym">DNS</acronym> tree. A zone consists of
 those contiguous parts of the domain
 tree for which a name server has complete information and over which
 it has authority. It contains all domain names from a certain point
@@ -252,7 +252,7 @@ only delegations for the <code class="literal">aaa.example.com</code> and
 <code class="literal">bbb.example.com</code> zones.  A zone can map
 exactly to a single domain, but could also include only part of a
 domain, the rest of which could be delegated to other
-name servers. Every name in the <span class="acronym">DNS</span> tree is a
+name servers. Every name in the <acronym class="acronym">DNS</acronym> tree is a
 <span class="emphasis"><em>domain</em></span>, even if it is
 <span class="emphasis"><em>terminal</em></span>, that is, has no
 <span class="emphasis"><em>subdomains</em></span>.  Every subdomain is a domain and
@@ -260,7 +260,7 @@ every domain except the root is also a subdomain. The terminology is
 not intuitive and we suggest that you read RFCs 1033, 1034 and 1035 to
 gain a complete understanding of this difficult and subtle
 topic.</p>
-<p>Though <span class="acronym">BIND</span> is called a "domain name server",
+<p>Though <acronym class="acronym">BIND</acronym> is called a "domain name server",
 it deals primarily in terms of zones. The master and slave
 declarations in the <code class="filename">named.conf</code> file specify
 zones, not domains. When you ask some other site if it is willing to
@@ -269,7 +269,7 @@ actually asking for slave service for some collection of zones.</p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2546653"></a>Authoritative Name Servers</h3></div></div></div>
+<a name="id2570550"></a>Authoritative Name Servers</h3></div></div></div>
 <p>Each zone is served by at least
 one <span class="emphasis"><em>authoritative name server</em></span>,
 which contains the complete data for the zone.
@@ -282,7 +282,7 @@ easy to identify when debugging DNS configurations using tools like
 <span><strong class="command">dig</strong></span> (<a href="Bv9ARM.ch03.html#diagnostic_tools" title="Diagnostic Tools">the section called &#8220;Diagnostic Tools&#8221;</a>).</p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2546676"></a>The Primary Master</h4></div></div></div>
+<a name="id2570572"></a>The Primary Master</h4></div></div></div>
 <p>
 The authoritative server where the master copy of the zone data is maintained is
 called the <span class="emphasis"><em>primary master</em></span> server, or simply the
@@ -293,7 +293,7 @@ the <span class="emphasis"><em>zone file</em></span> or <span class="emphasis"><
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2546902"></a>Slave Servers</h4></div></div></div>
+<a name="id2570594"></a>Slave Servers</h4></div></div></div>
 <p>The other authoritative servers, the <span class="emphasis"><em>slave</em></span>
 servers (also known as <span class="emphasis"><em>secondary</em></span> servers) load
 the zone contents from another server using a replication process
@@ -304,7 +304,7 @@ may itself act as a master to a subordinate slave server.</p>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2546921"></a>Stealth Servers</h4></div></div></div>
+<a name="id2570613"></a>Stealth Servers</h4></div></div></div>
 <p>Usually all of the zone's authoritative servers are listed in 
 NS records in the parent zone.  These NS records constitute
 a <span class="emphasis"><em>delegation</em></span> of the zone from the parent.
@@ -329,7 +329,7 @@ with the outside world.</p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2546950"></a>Caching Name Servers</h3></div></div></div>
+<a name="id2570642"></a>Caching Name Servers</h3></div></div></div>
 <p>The resolver libraries provided by most operating systems are 
 <span class="emphasis"><em>stub resolvers</em></span>, meaning that they are not capable of
 performing the full DNS resolution process by themselves by talking
@@ -343,12 +343,12 @@ caching are intimately connected, the terms
 <span class="emphasis"><em>recursive server</em></span> and
 <span class="emphasis"><em>caching server</em></span> are often used synonymously.</p>
 <p>The length of time for which a record may be retained in
-in the cache of a caching name server is controlled by the 
+the cache of a caching name server is controlled by the 
 Time To Live (TTL) field associated with each resource record.
 </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2547050"></a>Forwarding</h4></div></div></div>
+<a name="id2570674"></a>Forwarding</h4></div></div></div>
 <p>Even a caching name server does not necessarily perform
 the complete recursive lookup itself.  Instead, it can
 <span class="emphasis"><em>forward</em></span> some or all of the queries
@@ -360,9 +360,9 @@ and they are queried in turn until the list is exhausted or an answer
 is found. Forwarders are typically used when you do not
 wish all the servers at a given site to interact directly with the rest of
 the Internet servers. A typical scenario would involve a number
-of internal <span class="acronym">DNS</span> servers and an Internet firewall. Servers unable
+of internal <acronym class="acronym">DNS</acronym> servers and an Internet firewall. Servers unable
 to pass packets through the firewall would forward to the server
-that can do it, and that server would query the Internet <span class="acronym">DNS</span> servers
+that can do it, and that server would query the Internet <acronym class="acronym">DNS</acronym> servers
 on the internal server's behalf. An added benefit of using the forwarding
 feature is that the central machine develops a much more complete
 cache of information that all the clients can take advantage
@@ -371,8 +371,8 @@ of.</p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2547076"></a>Name Servers in Multiple Roles</h3></div></div></div>
+<a name="id2570699"></a>Name Servers in Multiple Roles</h3></div></div></div>
-<p>The <span class="acronym">BIND</span> name server can simultaneously act as
+<p>The <acronym class="acronym">BIND</acronym> name server can simultaneously act as
 a master for some zones, a slave for other zones, and as a caching
 (recursive) server for a set of local clients.</p>
 <p>However, since the functions of authoritative name service
@@ -404,7 +404,7 @@ be placed inside a firewall.</p>
 <tr>
 <td width="40%" align="left" valign="top">BIND 9 Administrator Reference Manual </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
-<td width="40%" align="right" valign="top"> Chapter 2. <span class="acronym">BIND</span> Resource Requirements</td>
+<td width="40%" align="right" valign="top"> Chapter 2. <acronym class="acronym">BIND</acronym> Resource Requirements</td>
 </tr>
 </table>
 </div>

contrib/bind9/doc/arm/Bv9ARM.ch02.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch02.html,v 1.10.2.1.8.8 2005/10/13 02:33:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch02.html,v 1.10.2.1.8.12 2006/06/29 13:02:31 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 2. BIND Resource Requirements</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch01.html" title="Chapter 1. Introduction ">
@@ -28,7 +28,7 @@
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
 <div class="navheader">
 <table width="100%" summary="Navigation header">
-<tr><th colspan="3" align="center">Chapter 2. <span class="acronym">BIND</span> Resource Requirements</th></tr>
+<tr><th colspan="3" align="center">Chapter 2. <acronym class="acronym">BIND</acronym> Resource Requirements</th></tr>
 <tr>
 <td width="20%" align="left">
 <a accesskey="p" href="Bv9ARM.ch01.html">Prev</a> </td>
@@ -41,44 +41,44 @@
 </div>
 <div class="chapter" lang="en">
 <div class="titlepage"><div><div><h2 class="title">
-<a name="Bv9ARM.ch02"></a>Chapter 2. <span class="acronym">BIND</span> Resource Requirements</h2></div></div></div>
+<a name="Bv9ARM.ch02"></a>Chapter 2. <acronym class="acronym">BIND</acronym> Resource Requirements</h2></div></div></div>
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547108">Hardware requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570868">Hardware requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547132">CPU Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570892">CPU Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547143">Memory Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570903">Memory Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547158">Name Server Intensive Environment Issues</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570918">Name Server Intensive Environment Issues</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547303">Supported Operating Systems</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570995">Supported Operating Systems</a></span></dt>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2547108"></a>Hardware requirements</h2></div></div></div>
+<a name="id2570868"></a>Hardware requirements</h2></div></div></div>
-<p><span class="acronym">DNS</span> hardware requirements have traditionally been quite modest.
+<p><acronym class="acronym">DNS</acronym> hardware requirements have traditionally been quite modest.
 For many installations, servers that have been pensioned off from
-active duty have performed admirably as <span class="acronym">DNS</span> servers.</p>
+active duty have performed admirably as <acronym class="acronym">DNS</acronym> servers.</p>
-<p>The DNSSEC and IPv6 features of <span class="acronym">BIND</span> 9 may prove to be quite
+<p>The DNSSEC and IPv6 features of <acronym class="acronym">BIND</acronym> 9 may prove to be quite
 CPU intensive however, so organizations that make heavy use of these
 features may wish to consider larger systems for these applications.
-<span class="acronym">BIND</span> 9 is fully multithreaded, allowing full utilization of
+<acronym class="acronym">BIND</acronym> 9 is fully multithreaded, allowing full utilization of
 multiprocessor systems for installations that need it.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2547132"></a>CPU Requirements</h2></div></div></div>
+<a name="id2570892"></a>CPU Requirements</h2></div></div></div>
-<p>CPU requirements for <span class="acronym">BIND</span> 9 range from i486-class machines
+<p>CPU requirements for <acronym class="acronym">BIND</acronym> 9 range from i486-class machines
 for serving of static zones without caching, to enterprise-class
 machines if you intend to process many dynamic updates and DNSSEC
 signed zones, serving many thousands of queries per second.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2547143"></a>Memory Requirements</h2></div></div></div>
+<a name="id2570903"></a>Memory Requirements</h2></div></div></div>
 <p>The memory of the server has to be large enough to fit the
 cache and zones loaded off disk.  The <span><strong class="command">max-cache-size</strong></span>
 option can be used to limit the amount of memory used by the cache,
-at the expense of reducing cache hit rates and causing more <span class="acronym">DNS</span>
+at the expense of reducing cache hit rates and causing more <acronym class="acronym">DNS</acronym>
 traffic. It is still good practice to have enough memory to load
 all zone and cache data into memory &#8212; unfortunately, the best way
 to determine this for a given installation is to watch the name server
@@ -88,7 +88,7 @@ fast as they are being inserted.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2547158"></a>Name Server Intensive Environment Issues</h2></div></div></div>
+<a name="id2570918"></a>Name Server Intensive Environment Issues</h2></div></div></div>
 <p>For name server intensive environments, there are two alternative
 configurations that may be used. The first is where clients and
 any second-level internal name servers query a main name server, which
@@ -102,8 +102,8 @@ as none of the name servers share their cached data.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2547303"></a>Supported Operating Systems</h2></div></div></div>
+<a name="id2570995"></a>Supported Operating Systems</h2></div></div></div>
-<p>ISC <span class="acronym">BIND</span> 9 compiles and runs on a large number
+<p>ISC <acronym class="acronym">BIND</acronym> 9 compiles and runs on a large number
 of Unix-like operating system and on Windows NT / 2000.  For an up-to-date
 list of supported systems, see the README file in the top level directory
 of the BIND 9 source distribution.</p>

contrib/bind9/doc/arm/Bv9ARM.ch03.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch03.html,v 1.26.2.5.4.11 2005/10/13 02:33:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch03.html,v 1.26.2.5.4.17 2006/06/29 13:02:31 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 3. Name Server Configuration</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch02.html" title="Chapter 2. BIND Resource Requirements">
@@ -47,14 +47,14 @@
 <dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547334">A Caching-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2571026">A Caching-only Name Server</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547350">An Authoritative-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2571042">An Authoritative-only Name Server</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2547372">Load Balancing</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2571064">Load Balancing</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2547656">Name Server Operations</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2571484">Name Server Operations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547661">Tools for Use With the Name Server Daemon</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2571490">Tools for Use With the Name Server Daemon</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2548915">Signals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2572723">Signals</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -66,7 +66,7 @@ option setting.</p>
 <a name="sample_configuration"></a>Sample Configurations</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2547334"></a>A Caching-only Name Server</h3></div></div></div>
+<a name="id2571026"></a>A Caching-only Name Server</h3></div></div></div>
 <p>The following sample configuration is appropriate for a caching-only
 name server for use by clients internal to a corporation.  All queries
 from outside clients are refused using the <span><strong class="command">allow-query</strong></span>
@@ -89,7 +89,7 @@ zone "0.0.127.in-addr.arpa" {
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2547350"></a>An Authoritative-only Name Server</h3></div></div></div>
+<a name="id2571042"></a>An Authoritative-only Name Server</h3></div></div></div>
 <p>This sample configuration is for an authoritative-only server
 that is the master server for "<code class="filename">example.com</code>"
 and a slave for the subdomain "<code class="filename">eng.example.com</code>".</p>
@@ -128,9 +128,9 @@ zone "eng.example.com" {
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2547372"></a>Load Balancing</h2></div></div></div>
+<a name="id2571064"></a>Load Balancing</h2></div></div></div>
 <p>A primitive form of load balancing can be achieved in
-the <span class="acronym">DNS</span> by using multiple A records for one name.</p>
+the <acronym class="acronym">DNS</acronym> by using multiple A records for one name.</p>
 <p>For example, if you have three WWW servers with network addresses
 of 10.0.0.1, 10.0.0.2 and 10.0.0.3, a set of records such as the
 following means that clients will connect to each machine one third
@@ -174,7 +174,7 @@ of the time:</p>
 </tr>
 </tbody>
 </table></div>
-<p>When a resolver queries for these records, <span class="acronym">BIND</span> will rotate
+<p>When a resolver queries for these records, <acronym class="acronym">BIND</acronym> will rotate
     them and respond to the query with the records in a different
     order.  In the example above, clients will randomly receive
     records in the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Most clients
@@ -184,15 +184,15 @@ of the time:</p>
     <span><strong class="command">options</strong></span> statement, see
     <a href="Bv9ARM.ch06.html#rrset_ordering">RRset Ordering</a>.
     This substatement is not supported in
-    <span class="acronym">BIND</span> 9, and only the ordering scheme described above is
+    <acronym class="acronym">BIND</acronym> 9, and only the ordering scheme described above is
     available.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2547656"></a>Name Server Operations</h2></div></div></div>
+<a name="id2571484"></a>Name Server Operations</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2547661"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
+<a name="id2571490"></a>Tools for Use With the Name Server Daemon</h3></div></div></div>
 <p>There are several indispensable diagnostic, administrative
 and monitoring tools available to the system administrator for controlling
 and debugging the name server daemon. We describe several in this
@@ -237,7 +237,7 @@ and non-interactive. Interactive mode allows the user to query name servers
 for information about various hosts and domains or to print a list
 of hosts in a domain. Non-interactive mode is used to print just
 the name and requested information for a host or domain.</p>
-<div class="cmdsynopsis"><p><code class="command">nslookup</code>  [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] |  [-  [server]]]</p></div>
+<div class="cmdsynopsis"><p><code class="command">nslookup</code>  [-option...] [[<em class="replaceable"><code>host-to-find</code></em>] |  [- [server]]]</p></div>
 <p>Interactive mode is entered when no arguments are given (the
 default name server will be used) or when the first argument is a
 hyphen (`-') and the second argument is the host name or Internet address
@@ -283,7 +283,7 @@ of a server.</p>
               If you run <span><strong class="command">rndc</strong></span> without any options
               it will display a usage message as follows:</p>
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [-c <em class="replaceable"><code>config</code></em>] [-s <em class="replaceable"><code>server</code></em>] [-p <em class="replaceable"><code>port</code></em>] [-y <em class="replaceable"><code>key</code></em>]  <em class="replaceable"><code>command</code></em>  [<em class="replaceable"><code>command</code></em>...]</p></div>
-<p><span><strong class="command">command</strong></span> is one of the following:</p>
+<p>The <span><strong class="command">command</strong></span> is one of the following:</p>
 <div class="variablelist"><dl>
 <dt><span class="term"><strong class="userinput"><code>reload</code></strong></span></dt>
 <dd><p>Reload configuration file and zones.</p></dd>
@@ -302,7 +302,7 @@ of a server.</p>
 <dt><span class="term"><strong class="userinput"><code>freeze [<span class="optional"><em class="replaceable"><code>zone</code></em>
        [<span class="optional"><em class="replaceable"><code>class</code></em>
            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
-<dd><p>Suspend updates to a dynamic zone.  If no zone is specified
+<dd><p>Suspend updates to a dynamic zone.  If no zone is specified,
 	then all zones are suspended.  This allows manual
     edits to be made to a zone normally updated by dynamic update.  It
     also causes changes in the journal file to be synced into the master
@@ -312,14 +312,10 @@ of a server.</p>
        [<span class="optional"><em class="replaceable"><code>class</code></em>
            [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</span>]</code></strong></span></dt>
 <dd><p>Enable updates to a frozen dynamic zone.  If no zone is
-    specified then all frozen zones are enabled.  This causes
+    specified, then all frozen zones are enabled.  This causes
     the server to reload the zone from disk, and re-enables dynamic updates
     after the load has completed.  After a zone is thawed, dynamic updates
     will no longer be refused.</p></dd>
-<dt><span class="term"><strong class="userinput"><code>notify <em class="replaceable"><code>zone</code></em>
-       [<span class="optional"><em class="replaceable"><code>class</code></em>
-           [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
-<dd><p>Resend NOTIFY messages for the zone</p></dd>
 <dt><span class="term"><strong class="userinput"><code>reconfig</code></strong></span></dt>
 <dd><p>Reload the configuration file and load new zones,
    but do not reload existing zone files even if they have changed.
@@ -337,17 +333,20 @@ of a server.</p>
    <code class="filename">named.conf</code>.</p></dd>
 <dt><span class="term"><strong class="userinput"><code>dumpdb [<span class="optional">-all|-cache|-zone</span>] [<span class="optional"><em class="replaceable"><code>view ...</code></em></span>]</code></strong></span></dt>
 <dd><p>Dump the server's caches (default) and / or zones to the
-	 dump file for the specified views.  If no view is specified all
+	 dump file for the specified views.  If no view is specified, all
 	 views are dumped.</p></dd>
 <dt><span class="term"><strong class="userinput"><code>stop [<span class="optional">-p</span>]</code></strong></span></dt>
 <dd><p>Stop the server, making sure any recent changes
    made through dynamic update or IXFR are first saved to the master files
-   of the updated zones.  If -p is specified named's process id is returned.</p></dd>
+   of the updated zones.  If -p is specified named's process id is returned.
+   This allows an external process to determine when named had completed stopping.</p></dd>
 <dt><span class="term"><strong class="userinput"><code>halt [<span class="optional">-p</span>]</code></strong></span></dt>
 <dd><p>Stop the server immediately.  Recent changes
    made through dynamic update or IXFR are not saved to the master files,
    but will be rolled forward from the journal files when the server
-   is restarted.  If -p is specified named's process id is returned.</p></dd>
+   is restarted.  If -p is specified named's process id is returned.
+   This allows an external process to determine when named had completed
+   stopping.</p></dd>
 <dt><span class="term"><strong class="userinput"><code>trace</code></strong></span></dt>
 <dd><p>Increment the servers debugging level by one. </p></dd>
 <dt><span class="term"><strong class="userinput"><code>trace <em class="replaceable"><code>level</code></em></code></strong></span></dt>
@@ -361,15 +360,15 @@ of a server.</p>
 <dd><p>Flushes the given name from the server's cache.</p></dd>
 <dt><span class="term"><strong class="userinput"><code>status</code></strong></span></dt>
 <dd><p>Display status of the server.
-Note the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
+Note that the number of zones includes the internal <span><strong class="command">bind/CH</strong></span> zone
-and the default <span><strong class="command">./IN</strong></span> hint zone if there is not a
+and the default <span><strong class="command">./IN</strong></span> hint zone if there is not an
 explicit root zone configured.</p></dd>
 <dt><span class="term"><strong class="userinput"><code>recursing</code></strong></span></dt>
 <dd><p>Dump the list of queries named is currently recursing
    on.
    </p></dd>
 </dl></div>
-<p>In <span class="acronym">BIND</span> 9.2, <span><strong class="command">rndc</strong></span>
+<p>In <acronym class="acronym">BIND</acronym> 9.2, <span><strong class="command">rndc</strong></span>
 supports all the commands of the BIND 8 <span><strong class="command">ndc</strong></span>
 utility except <span><strong class="command">ndc start</strong></span> and
 <span><strong class="command">ndc restart</strong></span>, which were also
@@ -386,7 +385,7 @@ option.  If the configuration file is not found,
 <span><strong class="command">rndc</strong></span> will also look in
 <code class="filename">/etc/rndc.key</code> (or whatever
 <code class="varname">sysconfdir</code> was defined when
-the <span class="acronym">BIND</span> build was configured).
+the <acronym class="acronym">BIND</acronym> build was configured).
 The <code class="filename">rndc.key</code> file is generated by
 running <span><strong class="command">rndc-confgen -a</strong></span> as described in
 <a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage" title="controls Statement Definition and Usage">the section called &#8220;<span><strong class="command">controls</strong></span> Statement Definition and Usage&#8221;</a>.</p>
@@ -412,7 +411,7 @@ the name of a key as its argument, as defined by a <span><strong class="command"
 <span><strong class="command">rndc</strong></span> should connect if no
 port is given on the command line or in a
 <span><strong class="command">server</strong></span> statement.</p>
-<p>The <span><strong class="command">key</strong></span> statement defines an key to be used
+<p>The <span><strong class="command">key</strong></span> statement defines a key to be used
 by <span><strong class="command">rndc</strong></span> when authenticating with
 <span><strong class="command">named</strong></span>.  Its syntax is identical to the
 <span><strong class="command">key</strong></span> statement in named.conf.
@@ -474,7 +473,7 @@ a <code class="filename">rndc.key</code> file and not modify
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2548915"></a>Signals</h3></div></div></div>
+<a name="id2572723"></a>Signals</h3></div></div></div>
 <p>Certain UNIX signals cause the name server to take specific
 actions, as described in the following table.  These signals can
 be sent using the <span><strong class="command">kill</strong></span> command.</p>
@@ -515,7 +514,7 @@ reload the database. </p></td>
 </td>
 </tr>
 <tr>
-<td width="40%" align="left" valign="top">Chapter 2. <span class="acronym">BIND</span> Resource Requirements </td>
+<td width="40%" align="left" valign="top">Chapter 2. <acronym class="acronym">BIND</acronym> Resource Requirements </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
 <td width="40%" align="right" valign="top"> Chapter 4. Advanced DNS Features</td>
 </tr>

contrib/bind9/doc/arm/Bv9ARM.ch04.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch04.html,v 1.30.2.6.2.14 2005/10/13 02:33:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch04.html,v 1.30.2.6.2.24 2006/11/15 04:33:41 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 4. Advanced DNS Features</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch03.html" title="Chapter 3. Name Server Configuration">
@@ -49,40 +49,40 @@
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549203">Split DNS</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2573147">Split DNS</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549627">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573709">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549830">Copying the Shared Secret to Both Machines</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573776">Copying the Shared Secret to Both Machines</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549838">Informing the Servers of the Key's Existence</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573784">Informing the Servers of the Key's Existence</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549878">Instructing the Server to Use the Key</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573824">Instructing the Server to Use the Key</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549998">TSIG Key Based Access Control</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573876">TSIG Key Based Access Control</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550042">Errors</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573920">Errors</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2550056">TKEY</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2573933">TKEY</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2550173">SIG(0)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2573982">SIG(0)</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550308">Generating Keys</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574049">Generating Keys</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550375">Signing the Zone</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574116">Signing the Zone</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550450">Configuring Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574259">Configuring Servers</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2550473">IPv6 Support in <span class="acronym">BIND</span> 9</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2574396">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550600">Address Lookups Using AAAA Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574455">Address Lookups Using AAAA Records</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550620">Address to Name Lookups Using Nibble Format</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574475">Address to Name Lookups Using Nibble Format</a></span></dt>
 </dl></dd>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="notify"></a>Notify</h2></div></div></div>
-<p><span class="acronym">DNS</span> NOTIFY is a mechanism that allows master
+<p><acronym class="acronym">DNS</acronym> NOTIFY is a mechanism that allows master
 servers to notify their slave servers of changes to a zone's data. In
 response to a <span><strong class="command">NOTIFY</strong></span> from a master server, the
 slave will check to see that its version of the zone is the
 current version and, if not, initiate a zone transfer.</p>
-<p><span class="acronym">DNS</span>
+<p><acronym class="acronym">DNS</acronym>
 For more information about
 <span><strong class="command">NOTIFY</strong></span>, see the description of the
 <span><strong class="command">notify</strong></span> option in <a href="Bv9ARM.ch06.html#boolean_options" title="Boolean Options">the section called &#8220;Boolean Options&#8221;</a> and
@@ -130,7 +130,7 @@ protocol is specified in RFC 1996.
     journalled in a similar way.</p>
 <p>The zone files of dynamic zones cannot normally be edited by
     hand because they are not guaranteed to contain the most recent
-    dynamic changes - those are only in the journal file.
+    dynamic changes &#8212; those are only in the journal file.
     The only way to ensure that the zone file of a dynamic zone
     is up to date is to run <span><strong class="command">rndc stop</strong></span>.</p>
 <p>If you have to make changes to a dynamic zone
@@ -139,7 +139,7 @@ protocol is specified in RFC 1996.
     <span><strong class="command">rndc freeze <em class="replaceable"><code>zone</code></em></strong></span>.
     This will also remove the zone's <code class="filename">.jnl</code> file
     and update the master file.  Edit the zone file.  Run
-    <span><strong class="command">rndc unfreeze <em class="replaceable"><code>zone</code></em></strong></span>
+    <span><strong class="command">rndc thaw <em class="replaceable"><code>zone</code></em></strong></span>
     to reload the changed zone and re-enable dynamic updates.</p>
 </div>
 </div>
@@ -150,7 +150,7 @@ protocol is specified in RFC 1996.
 slave servers to transfer only changed data, instead of having to
 transfer the entire zone. The IXFR protocol is specified in RFC
 1995. See <a href="Bv9ARM.ch09.html#proposed_standards">Proposed Standards</a>.</p>
-<p>When acting as a master, <span class="acronym">BIND</span> 9
+<p>When acting as a master, <acronym class="acronym">BIND</acronym> 9
 supports IXFR for those zones
 where the necessary change history information is available. These
 include master zones maintained by dynamic update and slave zones
@@ -160,7 +160,7 @@ transfer (AXFR), IXFR is supported only if the option
 <span><strong class="command">ixfr-from-differences</strong></span> is set
 to <strong class="userinput"><code>yes</code></strong>.
 </p>
-<p>When acting as a slave, <span class="acronym">BIND</span> 9 will 
+<p>When acting as a slave, <acronym class="acronym">BIND</acronym> 9 will 
 attempt to use IXFR unless
 it is explicitly disabled. For more information about disabling
 IXFR, see the description of the <span><strong class="command">request-ixfr</strong></span> clause
@@ -168,7 +168,7 @@ of the <span><strong class="command">server</strong></span> statement.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2549203"></a>Split DNS</h2></div></div></div>
+<a name="id2573147"></a>Split DNS</h2></div></div></div>
 <p>Setting up different views, or visibility, of the DNS space to
 internal and external resolvers is usually referred to as a <span class="emphasis"><em>Split
 DNS</em></span> setup. There are several reasons an organization
@@ -243,7 +243,7 @@ internal clients will now be able to:</p>
 <li>Look up any hostnames in the <code class="literal">site1.internal</code> and 
 <code class="literal">site2.internal</code> domains.</li>
 <li>Look up any hostnames on the Internet.</li>
-<li>Exchange mail with internal AND external people.</li>
+<li>Exchange mail with both internal AND external people.</li>
 </ul></div>
 <p>Hosts on the Internet will be able to:</p>
 <div class="itemizedlist"><ul type="disc">
@@ -254,7 +254,7 @@ internal clients will now be able to:</p>
 </ul></div>
 <p>Here is an example configuration for the setup we just
     described above. Note that this is only configuration information;
-    for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called &#8220;Sample Configurations&#8221;</a></p>
+    for information on how to configure your zone files, see <a href="Bv9ARM.ch03.html#sample_configuration" title="Sample Configurations">the section called &#8220;Sample Configurations&#8221;</a>.</p>
 <p>Internal DNS server config:</p>
 <pre class="programlisting">
 
@@ -355,13 +355,13 @@ nameserver 172.16.72.4
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="tsig"></a>TSIG</h2></div></div></div>
 <p>This is a short guide to setting up Transaction SIGnatures
-(TSIG) based transaction security in <span class="acronym">BIND</span>. It describes changes
+(TSIG) based transaction security in <acronym class="acronym">BIND</acronym>. It describes changes
 to the configuration file as well as what changes are required for
 different features, including the process of creating transaction
-keys and using transaction signatures with <span class="acronym">BIND</span>.</p>
+keys and using transaction signatures with <acronym class="acronym">BIND</acronym>.</p>
-<p><span class="acronym">BIND</span> primarily supports TSIG for server to server communication.
+<p><acronym class="acronym">BIND</acronym> primarily supports TSIG for server to server communication.
 This includes zone transfer, notify, and recursive query messages.
-Resolvers based on newer versions of <span class="acronym">BIND</span> 8 have limited support
+Resolvers based on newer versions of <acronym class="acronym">BIND</acronym> 8 have limited support
 for TSIG.</p>
 <p>TSIG might be most useful for dynamic update. A primary
     server for a dynamic zone should use access control to control
@@ -372,18 +372,18 @@ for TSIG.</p>
     <code class="option">-y</code> command line options.</p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2549627"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
+<a name="id2573709"></a>Generate Shared Keys for Each Pair of Hosts</h3></div></div></div>
 <p>A shared secret is generated to be shared between <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host2</em></span>.
 An arbitrary key name is chosen: "host1-host2.". The key name must
 be the same on both hosts.</p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2549643"></a>Automatic Generation</h4></div></div></div>
+<a name="id2573725"></a>Automatic Generation</h4></div></div></div>
-<p>The following command will generate a 128 bit (16 byte) HMAC-MD5
+<p>The following command will generate a 128-bit (16 byte) HMAC-MD5
 key as described above. Longer keys are better, but shorter keys
 are easier to read. Note that the maximum key length is 512 bits;
-keys longer than that will be digested with MD5 to produce a 128
+keys longer than that will be digested with MD5 to produce a
-bit key.</p>
+128-bit key.</p>
 <p><strong class="userinput"><code>dnssec-keygen -a hmac-md5 -b 128 -n HOST host1-host2.</code></strong></p>
 <p>The key is in the file <code class="filename">Khost1-host2.+157+00000.private</code>.
 Nothing directly uses this file, but the base-64 encoded string
@@ -395,7 +395,7 @@ be used as the shared secret.</p>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2549677"></a>Manual Generation</h4></div></div></div>
+<a name="id2573760"></a>Manual Generation</h4></div></div></div>
 <p>The shared secret is simply a random sequence of bits, encoded
 in base-64. Most ASCII strings are valid base-64 strings (assuming
 the length is a multiple of 4 and only valid characters are used),
@@ -406,13 +406,13 @@ a similar program to generate base-64 encoded data.</p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2549830"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
+<a name="id2573776"></a>Copying the Shared Secret to Both Machines</h3></div></div></div>
 <p>This is beyond the scope of DNS. A secure transport mechanism
 should be used. This could be secure FTP, ssh, telephone, etc.</p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2549838"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
+<a name="id2573784"></a>Informing the Servers of the Key's Existence</h3></div></div></div>
 <p>Imagine <span class="emphasis"><em>host1</em></span> and <span class="emphasis"><em>host 2</em></span> are
 both servers. The following is added to each server's <code class="filename">named.conf</code> file:</p>
 <pre class="programlisting">
@@ -421,7 +421,7 @@ key host1-host2. {
   secret "La/E5CjG9O+os1jq0a2jdA==";
 };
 </pre>
-<p>The algorithm, hmac-md5, is the only one supported by <span class="acronym">BIND</span>.
+<p>The algorithm, hmac-md5, is the only one supported by <acronym class="acronym">BIND</acronym>.
 The secret is the one generated above. Since this is a secret, it
 is recommended that either <code class="filename">named.conf</code> be non-world
 readable, or the key directive be added to a non-world readable
@@ -433,7 +433,7 @@ response is signed by the same key.</p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2549878"></a>Instructing the Server to Use the Key</h3></div></div></div>
+<a name="id2573824"></a>Instructing the Server to Use the Key</h3></div></div></div>
 <p>Since keys are shared between two hosts only, the server must
 be told when keys are to be used. The following is added to the <code class="filename">named.conf</code> file
 for <span class="emphasis"><em>host1</em></span>, if the IP address of <span class="emphasis"><em>host2</em></span> is
@@ -456,8 +456,8 @@ sign request messages to <span class="emphasis"><em>host1</em></span>.</p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2549998"></a>TSIG Key Based Access Control</h3></div></div></div>
+<a name="id2573876"></a>TSIG Key Based Access Control</h3></div></div></div>
-<p><span class="acronym">BIND</span> allows IP addresses and ranges to be specified in ACL
+<p><acronym class="acronym">BIND</acronym> allows IP addresses and ranges to be specified in ACL
 definitions and
 <span><strong class="command">allow-{ query | transfer | update }</strong></span> directives.
 This has been extended to allow TSIG keys also. The above key would
@@ -474,13 +474,14 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2550042"></a>Errors</h3></div></div></div>
+<a name="id2573920"></a>Errors</h3></div></div></div>
 <p>The processing of TSIG signed messages can result in
-      several errors. If a signed message is sent to a non-TSIG aware
+      several errors. If a signed message is sent to a non-TSIG
-      server, a FORMERR will be returned, since the server will not
+      aware server, a FORMERR (format error) will be returned, since
-      understand the record. This is a result of misconfiguration,
+      the server will not understand the record. This is a result
-      since the server must be explicitly configured to send a TSIG
+      of misconfiguration, since the server must be explicitly
-      signed message to a specific server.</p>
+      configured to send a TSIG signed message to a specific
+      server.</p>
 <p>If a TSIG aware server receives a message signed by an
       unknown key, the response will be unsigned with the TSIG
       extended error code set to BADKEY. If a TSIG aware server
@@ -491,16 +492,16 @@ allow-update { key host1-host2. ;};
       the TSIG extended error code set to BADTIME, and the time values
       will be adjusted so that the response can be successfully
       verified. In any of these cases, the message's rcode is set to
-      NOTAUTH.</p>
+      NOTAUTH (not authenticated).</p>
 </div>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2550056"></a>TKEY</h2></div></div></div>
+<a name="id2573933"></a>TKEY</h2></div></div></div>
 <p><span><strong class="command">TKEY</strong></span> is a mechanism for automatically
     generating a shared secret between two hosts.  There are several
     "modes" of <span><strong class="command">TKEY</strong></span> that specify how the key is
-    generated or assigned.  <span class="acronym">BIND</span> 9
+    generated or assigned.  <acronym class="acronym">BIND</acronym> 9
     implements only one of these modes,
     the Diffie-Hellman key exchange.  Both hosts are required to have
     a Diffie-Hellman KEY record (although this record is not required
@@ -523,29 +524,30 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2550173"></a>SIG(0)</h2></div></div></div>
+<a name="id2573982"></a>SIG(0)</h2></div></div></div>
-<p><span class="acronym">BIND</span> 9 partially supports DNSSEC SIG(0)
+<p><acronym class="acronym">BIND</acronym> 9 partially supports DNSSEC SIG(0)
     transaction signatures as specified in RFC 2535 and RFC2931.  SIG(0)
     uses public/private keys to authenticate messages.  Access control
     is performed in the same manner as TSIG keys; privileges can be
     granted or denied based on the key name.</p>
 <p>When a SIG(0) signed message is received, it will only be
     verified if the key is known and trusted by the server; the server
-    will not attempt to locate and/or validate the key.</p>
+    will not attempt to locate and / or validate the key.</p>
 <p>SIG(0) signing of multiple-message TCP streams is not
     supported.</p>
-<p>The only tool shipped with <span class="acronym">BIND</span> 9 that
+<p>The only tool shipped with <acronym class="acronym">BIND</acronym> 9 that
     generates SIG(0) signed messages is <span><strong class="command">nsupdate</strong></span>.</p>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="DNSSEC"></a>DNSSEC</h2></div></div></div>
 <p>Cryptographic authentication of DNS information is possible
-    through the DNS Security (<span class="emphasis"><em>DNSSEC-bis</em></span>) extensions,
+    through the DNS Security (<span class="emphasis"><em>DNSSEC-bis</em></span>)
-    defined in RFC &lt;TBA&gt;. This section describes the creation and use
+    extensions, defined in RFC 4033, RFC4034 and RFC4035.  This
-    of DNSSEC signed zones.</p>
+    section describes the creation and use of DNSSEC signed
+    zones.</p>
 <p>In order to set up a DNSSEC secure zone, there are a series
-    of steps which must be followed.  <span class="acronym">BIND</span> 9 ships
+    of steps which must be followed.  <acronym class="acronym">BIND</acronym> 9 ships
     with several tools
     that are used in this process, which are explained in more detail
     below.  In all cases, the <code class="option">-h</code> option prints a
@@ -557,7 +559,7 @@ allow-update { key host1-host2. ;};
 <p>There must also be communication with the administrators of
     the parent and/or child zone to transmit keys.  A zone's security
     status must be indicated by the parent zone for a DNSSEC capable 
-    resolver to trust its data.  This is done through the presense
+    resolver to trust its data.  This is done through the presence
     or absence of a <code class="literal">DS</code> record at the delegation
     point.</p>
 <p>For other servers to trust data in this zone, they must
@@ -565,7 +567,7 @@ allow-update { key host1-host2. ;};
     zone key of another zone above this one in the DNS tree.</p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2550308"></a>Generating Keys</h3></div></div></div>
+<a name="id2574049"></a>Generating Keys</h3></div></div></div>
 <p>The <span><strong class="command">dnssec-keygen</strong></span> program is used to
       generate keys.</p>
 <p>A secure zone must contain one or more zone keys.  The
@@ -576,7 +578,7 @@ allow-update { key host1-host2. ;};
       It is recommended that zone keys use a cryptographic algorithm
       designated as "mandatory to implement" by the IETF; currently
       the only one is RSASHA1.</p>
-<p>The following command will generate a 768 bit RSASHA1 key for
+<p>The following command will generate a 768-bit RSASHA1 key for
       the <code class="filename">child.example</code> zone:</p>
 <p><strong class="userinput"><code>dnssec-keygen -a RSASHA1 -b 768 -n ZONE child.example.</code></strong></p>
 <p>Two output files will be produced:
@@ -598,7 +600,7 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2550375"></a>Signing the Zone</h3></div></div></div>
+<a name="id2574116"></a>Signing the Zone</h3></div></div></div>
 <p>The <span><strong class="command">dnssec-signzone</strong></span> program is used to
       sign a zone.</p>
 <p>Any <code class="filename">keyset</code> files corresponding
@@ -606,7 +608,7 @@ allow-update { key host1-host2. ;};
       generate <code class="literal">NSEC</code> and <code class="literal">RRSIG</code>
       records for the zone, as well as <code class="literal">DS</code> for
       the child zones if <code class="literal">'-d'</code> is specified.
-      If <code class="literal">'-d'</code> is not specified then DS RRsets for
+      If <code class="literal">'-d'</code> is not specified, then DS RRsets for
       the secure child zones need to be added manually.</p>
 <p>The following command signs the zone, assuming it is in a
       file called <code class="filename">zone.child.example</code>.  By
@@ -625,48 +627,122 @@ allow-update { key host1-host2. ;};
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2550450"></a>Configuring Servers</h3></div></div></div>
+<a name="id2574259"></a>Configuring Servers</h3></div></div></div>
-<p>Unlike <span class="acronym">BIND</span> 8, 
+<p>
-<span class="acronym">BIND</span> 9 does not verify signatures on load,
+	  To enable <span><strong class="command">named</strong></span> to respond appropriately
-so zone keys for authoritative zones do not need to be specified
+	  to DNS requests from DNSSEC aware clients,
-in the configuration file.</p>
+	  <span><strong class="command">dnssec-enable</strong></span> must be set to yes.
-<p>The public key for any security root must be present in
+          </p>
-the configuration file's <span><strong class="command">trusted-keys</strong></span>
+<p>
-statement, as described later in this document. </p>
+	  To enable <span><strong class="command">named</strong></span> to validate answers from
+	  other servers <span><strong class="command">dnssec-enable</strong></span> and
+	  some <span><strong class="command">trusted-keys</strong></span> must be configured
+	  into <code class="filename">named.conf</code>.
+          </p>
+<p>
+	  <span><strong class="command">trusted-keys</strong></span> are copies of DNSKEY RRs
+	  for zones that are used to form the first link in the
+	  cryptographic chain of trust.  All keys listed in
+	  <span><strong class="command">trusted-keys</strong></span> (and corresponding zones)
+	  are deemed to exist and only the listed keys will be used
+	  to validated the DNSKEY RRset that they are from.
+	</p>
+<p>
+	  <span><strong class="command">trusted-keys</strong></span> are described in more detail
+	  later in this document.
+	</p>
+<p>
+	  Unlike <acronym class="acronym">BIND</acronym> 8, <acronym class="acronym">BIND</acronym>
+	  9 does not verify signatures on load, so zone keys for
+	  authoritative zones do not need to be specified in the
+	  configuration file.
+	</p>
+<p>
+	  After DNSSEC gets established, a typical DNSSEC configuration
+	  will look something like the following.  It has a one or
+	  more public keys for the root.  This allows answers from
+	  outside the organization to be validated.  It will also
+	  have several keys for parts of the namespace the organization
+	  controls.  These are here to ensure that named is immune
+	  to compromises in the DNSSEC components of the security
+	  of parent zones.
+	</p>
+<pre class="programlisting">
+trusted-keys {
+
+	/* Root Key */
+"." 257 3 3 "BNY4wrWM1nCfJ+CXd0rVXyYmobt7sEEfK3clRbGaTwSJxrGkxJWoZu6I7PzJu/
+	     E9gx4UC1zGAHlXKdE4zYIpRhaBKnvcC2U9mZhkdUpd1Vso/HAdjNe8LmMlnzY3
+	     zy2Xy4klWOADTPzSv9eamj8V18PHGjBLaVtYvk/ln5ZApjYghf+6fElrmLkdaz
+	     MQ2OCnACR817DF4BBa7UR/beDHyp5iWTXWSi6XmoJLbG9Scqc7l70KDqlvXR3M
+	     /lUUVRbkeg1IPJSidmK3ZyCllh4XSKbje/45SKucHgnwU5jefMtq66gKodQj+M
+	     iA21AfUVe7u99WzTLzY3qlxDhxYQQ20FQ97S+LKUTpQcq27R7AT3/V5hRQxScI
+	     Nqwcz4jYqZD2fQdgxbcDTClU0CRBdiieyLMNzXG3";
+
+/* Key for our organization's forward zone */
+example.com. 257 3 5 "AwEAAaxPMcR2x0HbQV4WeZB6oEDX+r0QM65KbhTjrW1ZaARmPhEZZe
+                      3Y9ifgEuq7vZ/zGZUdEGNWy+JZzus0lUptwgjGwhUS1558Hb4JKUbb
+	              OTcM8pwXlj0EiX3oDFVmjHO444gLkBO UKUf/mC7HvfwYH/Be22GnC
+		      lrinKJp1Og4ywzO9WglMk7jbfW33gUKvirTHr25GL7STQUzBb5Usxt
+		      8lgnyTUHs1t3JwCY5hKZ6CqFxmAVZP20igTixin/1LcrgX/KMEGd/b
+		      iuvF4qJCyduieHukuY3H4XMAcR+xia2 nIUPvm/oyWR8BW/hWdzOvn
+		      SCThlHf3xiYleDbt/o1OTQ09A0=";
+
+/* Key for our reverse zone. */
+2.0.192.IN-ADDRPA.NET. 257 3 5 "AQOnS4xn/IgOUpBPJ3bogzwcxOdNax071L18QqZnQQQA
+                                VVr+iLhGTnNGp3HoWQLUIzKrJVZ3zggy3WwNT6kZo6c0
+				tszYqbtvchmgQC8CzKojM/W16i6MG/ea fGU3siaOdS0
+				yOI6BgPsw+YZdzlYMaIJGf4M4dyoKIhzdZyQ2bYQrjyQ
+				4LB0lC7aOnsMyYKHHYeRv PxjIQXmdqgOJGq+vsevG06
+			        zW+1xgYJh9rCIfnm1GX/KMgxLPG2vXTD/RnLX+D3T3UL
+				7HJYHJhAZD5L59VvjSPsZJHeDCUyWYrvPZesZDIRvhDD
+				52SKvbheeTJUm6EhkzytNN2SN96QRk8j/iI8ib";
+};
+
+options {
+	...
+	dnssec-enable yes;
+};
+</pre>
+<div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
+<h3 class="title">Note</h3>
+	  None of the keys listed in this example are valid.  In particular,
+	  the root key is not valid.
+	</div>
 </div>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2550473"></a>IPv6 Support in <span class="acronym">BIND</span> 9</h2></div></div></div>
+<a name="id2574396"></a>IPv6 Support in <acronym class="acronym">BIND</acronym> 9</h2></div></div></div>
-<p><span class="acronym">BIND</span> 9 fully supports all currently defined forms of IPv6
+<p><acronym class="acronym">BIND</acronym> 9 fully supports all currently defined forms of IPv6
     name to address and address to name lookups.  It will also use
     IPv6 addresses to make queries when running on an IPv6 capable
     system.</p>
-<p>For forward lookups, <span class="acronym">BIND</span> 9 supports only AAAA
+<p>For forward lookups, <acronym class="acronym">BIND</acronym> 9 supports only AAAA
     records.  The use of A6 records is deprecated by RFC 3363, and the
-    support for forward lookups in <span class="acronym">BIND</span> 9 is
+    support for forward lookups in <acronym class="acronym">BIND</acronym> 9 is
     removed accordingly.
-    However, authoritative <span class="acronym">BIND</span> 9 name servers still
+    However, authoritative <acronym class="acronym">BIND</acronym> 9 name servers still
     load zone files containing A6 records correctly, answer queries
     for A6 records, and accept zone transfer for a zone containing A6
     records.</p>
-<p>For IPv6 reverse lookups, <span class="acronym">BIND</span> 9 supports
+<p>For IPv6 reverse lookups, <acronym class="acronym">BIND</acronym> 9 supports
     the traditional "nibble" format used in the
     <span class="emphasis"><em>ip6.arpa</em></span> domain, as well as the older, deprecated
     <span class="emphasis"><em>ip6.int</em></span> domain.
-    <span class="acronym">BIND</span> 9 formerly
+    <acronym class="acronym">BIND</acronym> 9 formerly
     supported the "binary label" (also known as "bitstring") format.
     The support of binary labels, however, is now completely removed
     according to the changes in RFC 3363.
-    Any applications in <span class="acronym">BIND</span> 9 do not understand
+    Any applications in <acronym class="acronym">BIND</acronym> 9 do not understand
     the format any more, and will return an error if given.
-    In particular, an authoritative <span class="acronym">BIND</span> 9 name
+    In particular, an authoritative <acronym class="acronym">BIND</acronym> 9 name
     server rejects to load a zone file containing binary labels.</p>
 <p>For an overview of the format and structure of IPv6 addresses,
     see <a href="Bv9ARM.ch09.html#ipv6addresses" title="IPv6 addresses (AAAA)">the section called &#8220;IPv6 addresses (AAAA)&#8221;</a>.</p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2550600"></a>Address Lookups Using AAAA Records</h3></div></div></div>
+<a name="id2574455"></a>Address Lookups Using AAAA Records</h3></div></div></div>
 <p>The AAAA record is a parallel to the IPv4 A record.  It
       specifies the entire address in a single record.  For
       example,</p>
@@ -681,7 +757,7 @@ host            3600    IN      AAAA    2001:db8::1
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2550620"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div>
+<a name="id2574475"></a>Address to Name Lookups Using Nibble Format</h3></div></div></div>
 <p>When looking up an address in nibble format, the address
       components are simply reversed, just as in IPv4, and
       <code class="literal">ip6.arpa.</code> is appended to the resulting name.
@@ -708,7 +784,7 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 <tr>
 <td width="40%" align="left" valign="top">Chapter 3. Name Server Configuration </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
-<td width="40%" align="right" valign="top"> Chapter 5. The <span class="acronym">BIND</span> 9 Lightweight Resolver</td>
+<td width="40%" align="right" valign="top"> Chapter 5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</td>
 </tr>
 </table>
 </div>

contrib/bind9/doc/arm/Bv9ARM.ch05.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch05.html,v 1.24.2.5.2.12 2005/10/13 02:34:00 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch05.html,v 1.24.2.5.2.17 2006/06/29 13:02:31 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 5. The BIND 9 Lightweight Resolver</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch04.html" title="Chapter 4. Advanced DNS Features">
@@ -28,7 +28,7 @@
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
 <div class="navheader">
 <table width="100%" summary="Navigation header">
-<tr><th colspan="3" align="center">Chapter 5. The <span class="acronym">BIND</span> 9 Lightweight Resolver</th></tr>
+<tr><th colspan="3" align="center">Chapter 5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</th></tr>
 <tr>
 <td width="20%" align="left">
 <a accesskey="p" href="Bv9ARM.ch04.html">Prev</a> </td>
@@ -41,17 +41,17 @@
 </div>
 <div class="chapter" lang="en">
 <div class="titlepage"><div><div><h2 class="title">
-<a name="Bv9ARM.ch05"></a>Chapter 5. The <span class="acronym">BIND</span> 9 Lightweight Resolver</h2></div></div></div>
+<a name="Bv9ARM.ch05"></a>Chapter 5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</h2></div></div></div>
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2550652">The Lightweight Resolver Library</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2574507">The Lightweight Resolver Library</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2550652"></a>The Lightweight Resolver Library</h2></div></div></div>
+<a name="id2574507"></a>The Lightweight Resolver Library</h2></div></div></div>
 <p>Traditionally applications have been linked with a stub resolver
 library that sends recursive DNS queries to a local caching name
 server.</p>
@@ -60,7 +60,7 @@ such as following A6 chains and DNAME records, and simultaneous
 lookup of IPv4 and IPv6 addresses.  Though most of the complexity was
 then removed, these are hard or impossible
 to implement in a traditional stub resolver.</p>
-<p>Instead, <span class="acronym">BIND</span> 9 provides resolution services to local clients
+<p>Instead, <acronym class="acronym">BIND</acronym> 9 provides resolution services to local clients
 using a combination of a lightweight resolver library and a resolver
 daemon process running on the local host.  These communicate using
 a simple UDP-based protocol, the "lightweight resolver protocol"
@@ -107,7 +107,7 @@ be configured to act as a lightweight resolver daemon using the
 <tr>
 <td width="40%" align="left" valign="top">Chapter 4. Advanced DNS Features </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
-<td width="40%" align="right" valign="top"> Chapter 6. <span class="acronym">BIND</span> 9 Configuration Reference</td>
+<td width="40%" align="right" valign="top"> Chapter 6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</td>
 </tr>
 </table>
 </div>

contrib/bind9/doc/arm/Bv9ARM.ch07.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch07.html,v 1.50.2.9.2.24 2005/10/13 02:34:02 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch07.html,v 1.50.2.9.2.33 2006/09/13 02:56:21 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 7. BIND 9 Security Considerations</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch06.html" title="Chapter 6. BIND 9 Configuration Reference">
@@ -28,7 +28,7 @@
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
 <div class="navheader">
 <table width="100%" summary="Navigation header">
-<tr><th colspan="3" align="center">Chapter 7. <span class="acronym">BIND</span> 9 Security Considerations</th></tr>
+<tr><th colspan="3" align="center">Chapter 7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</th></tr>
 <tr>
 <td width="20%" align="left">
 <a accesskey="p" href="Bv9ARM.ch06.html">Prev</a> </td>
@@ -41,16 +41,16 @@
 </div>
 <div class="chapter" lang="en">
 <div class="titlepage"><div><div><h2 class="title">
-<a name="Bv9ARM.ch07"></a>Chapter 7. <span class="acronym">BIND</span> 9 Security Considerations</h2></div></div></div>
+<a name="Bv9ARM.ch07"></a>Chapter 7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</h2></div></div></div>
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2567222"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> (for
+<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2591971"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> (for
 UNIX servers)</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2567366">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592046">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2567424">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592172">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
 </dl>
@@ -68,13 +68,14 @@ your name server, without cluttering up your config files with huge
 lists of IP addresses.</p>
 <p>It is a <span class="emphasis"><em>good idea</em></span> to use ACLs, and to
 control access to your server. Limiting access to your server by
-outside parties can help prevent spoofing and DoS attacks against
+outside parties can help prevent spoofing and denial of service (DoS)
-your server.</p>
+attacks against your server.</p>
 <p>Here is an example of how to properly apply ACLs:</p>
 <pre class="programlisting">
 // Set up an ACL named "bogusnets" that will block RFC1918 space,
 // which is commonly used in spoofing attacks.
 acl bogusnets { 0.0.0.0/8; 1.0.0.0/8; 2.0.0.0/8; 192.0.2.0/24; 224.0.0.0/3; 10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16; };
+
 // Set up an ACL called our-nets. Replace this with the real IP numbers.
 acl our-nets { x.x.x.x/24; x.x.x.x/21; }; 
 options {
@@ -86,6 +87,7 @@ options {
   blackhole { bogusnets; };
   ...
 };
+
 zone "example.com" {
   type master;
   file "m/example.com";
@@ -100,28 +102,28 @@ see the <span class="emphasis"><em>AUSCERT</em></span> advisory at
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567222"></a><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> (for
+<a name="id2591971"></a><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> (for
 UNIX servers)</h2></div></div></div>
-<p>On UNIX servers, it is possible to run <span class="acronym">BIND</span> in a <span class="emphasis"><em>chrooted</em></span> environment
+<p>On UNIX servers, it is possible to run <acronym class="acronym">BIND</acronym> in a <span class="emphasis"><em>chrooted</em></span> environment
-(<span><strong class="command">chroot()</strong></span>) by specifying the "<code class="option">-t</code>"
+(using the <span><strong class="command">chroot()</strong></span> function) by specifying the "<code class="option">-t</code>"
-option. This can help improve system security by placing <span class="acronym">BIND</span> in
+option. This can help improve system security by placing <acronym class="acronym">BIND</acronym> in
 a "sandbox", which will limit the damage done if a server is compromised.</p>
-<p>Another useful feature in the UNIX version of <span class="acronym">BIND</span> is the
+<p>Another useful feature in the UNIX version of <acronym class="acronym">BIND</acronym> is the
 ability to run the daemon as an unprivileged user ( <code class="option">-u</code> <em class="replaceable"><code>user</code></em> ).
 We suggest running as an unprivileged user when using the <span><strong class="command">chroot</strong></span> feature.</p>
-<p>Here is an example command line to load <span class="acronym">BIND</span> in a <span><strong class="command">chroot()</strong></span> sandbox, 
+<p>Here is an example command line to load <acronym class="acronym">BIND</acronym> in a <span><strong class="command">chroot</strong></span> sandbox, 
 <span><strong class="command">/var/named</strong></span>, and to run <span><strong class="command">named</strong></span> <span><strong class="command">setuid</strong></span> to
 user 202:</p>
 <p><strong class="userinput"><code>/usr/local/bin/named -u 202 -t /var/named</code></strong></p>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567366"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
+<a name="id2592046"></a>The <span><strong class="command">chroot</strong></span> Environment</h3></div></div></div>
-<p>In order for a <span><strong class="command">chroot()</strong></span> environment to
+<p>In order for a <span><strong class="command">chroot</strong></span> environment to
 work properly in a particular directory
 (for example, <code class="filename">/var/named</code>),
 you will need to set up an environment that includes everything
-<span class="acronym">BIND</span> needs to run.
+<acronym class="acronym">BIND</acronym> needs to run.
-From <span class="acronym">BIND</span>'s point of view, <code class="filename">/var/named</code> is
+From <acronym class="acronym">BIND</acronym>'s point of view, <code class="filename">/var/named</code> is
 the root of the filesystem.  You will need to adjust the values of options like
 like <span><strong class="command">directory</strong></span> and <span><strong class="command">pid-file</strong></span> to account
 for this.
@@ -134,18 +136,18 @@ However, depending on your operating system, you may need
 to set up things like
 <code class="filename">/dev/zero</code>,
 <code class="filename">/dev/random</code>,
-<code class="filename">/dev/log</code>, and/or
+<code class="filename">/dev/log</code>, and
 <code class="filename">/etc/localtime</code>.
 </p>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567424"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
+<a name="id2592172"></a>Using the <span><strong class="command">setuid</strong></span> Function</h3></div></div></div>
 <p>Prior to running the <span><strong class="command">named</strong></span> daemon, use
 the <span><strong class="command">touch</strong></span> utility (to change file access and
 modification times) or the <span><strong class="command">chown</strong></span> utility (to
 set the user id and/or group id) on files
-to which you want <span class="acronym">BIND</span>
+to which you want <acronym class="acronym">BIND</acronym>
 to write.  Note that if the <span><strong class="command">named</strong></span> daemon is running as an
 unprivileged user, it will not be able to bind to new restricted ports if the
 server is reloaded.</p>
@@ -156,7 +158,7 @@ server is reloaded.</p>
 <a name="dynamic_update_security"></a>Dynamic Update Security</h2></div></div></div>
 <p>Access to the dynamic
 update facility should be strictly limited.  In earlier versions of
-<span class="acronym">BIND</span> the only way to do this was based on the IP
+<acronym class="acronym">BIND</acronym>, the only way to do this was based on the IP
 address of the host requesting the update, by listing an IP address or
 network prefix in the <span><strong class="command">allow-update</strong></span> zone option.
 This method is insecure since the source address of the update UDP packet
@@ -172,7 +174,7 @@ cryptographically authenticated by means of transaction signatures
 list only TSIG key names, not IP addresses or network
 prefixes. Alternatively, the new <span><strong class="command">update-policy</strong></span>
 option can be used.</p>
-<p>Some sites choose to keep all dynamically updated DNS data
+<p>Some sites choose to keep all dynamically-updated DNS data
 in a subdomain and delegate that subdomain to a separate zone. This
 way, the top-level zone containing critical data such as the IP addresses
 of public web and mail servers need not allow dynamic update at
@@ -190,7 +192,7 @@ all.</p>
 </td>
 </tr>
 <tr>
-<td width="40%" align="left" valign="top">Chapter 6. <span class="acronym">BIND</span> 9 Configuration Reference </td>
+<td width="40%" align="left" valign="top">Chapter 6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
 <td width="40%" align="right" valign="top"> Chapter 8. Troubleshooting</td>
 </tr>

contrib/bind9/doc/arm/Bv9ARM.ch08.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch08.html,v 1.50.2.9.2.24 2005/10/13 02:34:02 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch08.html,v 1.50.2.9.2.33 2006/09/13 02:56:22 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Chapter 8. Troubleshooting</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch07.html" title="Chapter 7. BIND 9 Security Considerations">
@@ -45,18 +45,18 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2567630">Common Problems</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592243">Common Problems</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2567636">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2592248">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2567648">Incrementing and Changing the Serial Number</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592260">Incrementing and Changing the Serial Number</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2567665">Where Can I Get Help?</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592277">Where Can I Get Help?</a></span></dt>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567630"></a>Common Problems</h2></div></div></div>
+<a name="id2592243"></a>Common Problems</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567636"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div>
+<a name="id2592248"></a>It's not working; how can I figure out what's wrong?</h3></div></div></div>
 <p>The best solution to solving installation and
       configuration issues is to take preventative measures by setting
       up logging files beforehand. The log files provide a
@@ -66,7 +66,7 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567648"></a>Incrementing and Changing the Serial Number</h2></div></div></div>
+<a name="id2592260"></a>Incrementing and Changing the Serial Number</h2></div></div></div>
 <p>Zone serial numbers are just numbers-they aren't date
     related.  A lot of people set them to a number that represents a
     date, usually of the form YYYYMMDDRR. A number of people have been
@@ -87,19 +87,19 @@
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567665"></a>Where Can I Get Help?</h2></div></div></div>
+<a name="id2592277"></a>Where Can I Get Help?</h2></div></div></div>
-<p>The Internet Software Consortium (<span class="acronym">ISC</span>) offers a wide range
+<p>The Internet Software Consortium (<acronym class="acronym">ISC</acronym>) offers a wide range
-    of support and service agreements for <span class="acronym">BIND</span> and <span class="acronym">DHCP</span> servers. Four
+    of support and service agreements for <acronym class="acronym">BIND</acronym> and <acronym class="acronym">DHCP</acronym> servers. Four
     levels of premium support are available and each level includes
-    support for all <span class="acronym">ISC</span> programs, significant discounts on products
+    support for all <acronym class="acronym">ISC</acronym> programs, significant discounts on products
     and training, and a recognized priority on bug fixes and
-    non-funded feature requests. In addition, <span class="acronym">ISC</span> offers a standard
+    non-funded feature requests. In addition, <acronym class="acronym">ISC</acronym> offers a standard
     support agreement package which includes services ranging from bug
     fix announcements to remote support. It also includes training in
-    <span class="acronym">BIND</span> and <span class="acronym">DHCP</span>.</p>
+    <acronym class="acronym">BIND</acronym> and <acronym class="acronym">DHCP</acronym>.</p>
 <p>To discuss arrangements for support, contact
     <a href="mailto:info@isc.org" target="_top">info@isc.org</a> or visit the
-    <span class="acronym">ISC</span> web page at <a href="http://www.isc.org/services/support/" target="_top">http://www.isc.org/services/support/</a>
+    <acronym class="acronym">ISC</acronym> web page at <a href="http://www.isc.org/services/support/" target="_top">http://www.isc.org/services/support/</a>
     to read more.</p>
 </div>
 </div>
@@ -114,7 +114,7 @@
 </td>
 </tr>
 <tr>
-<td width="40%" align="left" valign="top">Chapter 7. <span class="acronym">BIND</span> 9 Security Considerations </td>
+<td width="40%" align="left" valign="top">Chapter 7. <acronym class="acronym">BIND</acronym> 9 Security Considerations </td>
 <td width="20%" align="center"><a accesskey="h" href="Bv9ARM.html">Home</a></td>
 <td width="40%" align="right" valign="top"> Appendix A. Appendices</td>
 </tr>

contrib/bind9/doc/arm/Bv9ARM.ch09.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.ch09.html,v 1.50.2.9.2.25 2005/10/13 02:34:03 marka Exp $ -->
+<!-- $Id: Bv9ARM.ch09.html,v 1.50.2.9.2.35 2006/11/15 04:33:42 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Appendix A. Appendices</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="up" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="prev" href="Bv9ARM.ch08.html" title="Chapter 8. Troubleshooting">
@@ -43,83 +43,86 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2567795">Acknowledgments</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2592339">Acknowledgments</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2567800">A Brief History of the <span class="acronym">DNS</span> and <span class="acronym">BIND</span></a></span></dt></dl></dd>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2592344">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#historical_dns_information">General <span class="acronym">DNS</span> Reference Information</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#historical_dns_information">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2570087">Other Documents About <span class="acronym">BIND</span></a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2594702">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt>
 </dl></dd>
 </dl>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id2567795"></a>Acknowledgments</h2></div></div></div>
+<a name="id2592339"></a>Acknowledgments</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2567800"></a>A Brief History of the <span class="acronym">DNS</span> and <span class="acronym">BIND</span></h3></div></div></div>
+<a name="id2592344"></a>A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></h3></div></div></div>
 <p>Although the "official" beginning of the Domain Name
       System occurred in 1984 with the publication of RFC 920, the
       core of the new system was described in 1983 in RFCs 882 and
       883. From 1984 to 1987, the ARPAnet (the precursor to today's
       Internet) became a testbed of experimentation for developing the
-      new naming/addressing scheme in an rapidly expanding,
+      new naming/addressing scheme in a rapidly expanding,
       operational network environment.  New RFCs were written and
       published in 1987 that modified the original documents to
       incorporate improvements based on the working model. RFC 1034,
       "Domain Names-Concepts and Facilities", and RFC 1035, "Domain
       Names-Implementation and Specification" were published and
-      became the standards upon which all <span class="acronym">DNS</span> implementations are
+      became the standards upon which all <acronym class="acronym">DNS</acronym> implementations are
       built.
 </p>
 <p>The first working domain name server, called "Jeeves", was
 written in 1983-84 by Paul Mockapetris for operation on DEC Tops-20
 machines located at the University of Southern California's Information
 Sciences Institute (USC-ISI) and SRI International's Network Information
-Center (SRI-NIC). A <span class="acronym">DNS</span> server for Unix machines, the Berkeley Internet
+Center (SRI-NIC). A <acronym class="acronym">DNS</acronym> server for Unix machines, the Berkeley Internet
-Name Domain (<span class="acronym">BIND</span>) package, was written soon after by a group of
+Name Domain (<acronym class="acronym">BIND</acronym>) package, was written soon after by a group of
 graduate students at the University of California at Berkeley under
 a grant from the US Defense Advanced Research Projects Administration
-(DARPA). Versions of <span class="acronym">BIND</span> through 4.8.3 were maintained by the Computer
+(DARPA).
+</p>
+<p>
+Versions of <acronym class="acronym">BIND</acronym> through 4.8.3 were maintained by the Computer
 Systems Research Group (CSRG) at UC Berkeley. Douglas Terry, Mark
-Painter, David Riggle and Songnian Zhou made up the initial <span class="acronym">BIND</span>
+Painter, David Riggle and Songnian Zhou made up the initial <acronym class="acronym">BIND</acronym>
 project team. After that, additional work on the software package
 was done by Ralph Campbell. Kevin Dunlap, a Digital Equipment Corporation
-employee on loan to the CSRG, worked on <span class="acronym">BIND</span> for 2 years, from 1985
+employee on loan to the CSRG, worked on <acronym class="acronym">BIND</acronym> for 2 years, from 1985
-to 1987. Many other people also contributed to <span class="acronym">BIND</span> development
+to 1987. Many other people also contributed to <acronym class="acronym">BIND</acronym> development
 during that time: Doug Kingston, Craig Partridge, Smoot Carl-Mitchell,
-Mike Muuss, Jim Bloom and Mike Schwartz. <span class="acronym">BIND</span> maintenance was subsequently
+Mike Muuss, Jim Bloom and Mike Schwartz. <acronym class="acronym">BIND</acronym> maintenance was subsequently
 handled by Mike Karels and O. Kure.</p>
-<p><span class="acronym">BIND</span> versions 4.9 and 4.9.1 were released by Digital Equipment
+<p><acronym class="acronym">BIND</acronym> versions 4.9 and 4.9.1 were released by Digital Equipment
 Corporation (now Compaq Computer Corporation). Paul Vixie, then
-a DEC employee, became <span class="acronym">BIND</span>'s primary caretaker. Paul was assisted
+a DEC employee, became <acronym class="acronym">BIND</acronym>'s primary caretaker. He was assisted
 by Phil Almquist, Robert Elz, Alan Barrett, Paul Albitz, Bryan Beecher, Andrew
 Partan, Andy Cherenson, Tom Limoncelli, Berthold Paffrath, Fuat
 Baran, Anant Kumar, Art Harkin, Win Treese, Don Lewis, Christophe
 Wolfhugel, and others.</p>
-<p><span class="acronym">BIND</span> Version 4.9.2 was sponsored by Vixie Enterprises. Paul
+<p><acronym class="acronym">BIND</acronym> version 4.9.2 was sponsored by Vixie Enterprises. Paul
-Vixie became <span class="acronym">BIND</span>'s principal architect/programmer.</p>
+Vixie became <acronym class="acronym">BIND</acronym>'s principal architect/programmer.</p>
-<p><span class="acronym">BIND</span> versions from 4.9.3 onward have been developed and maintained
+<p><acronym class="acronym">BIND</acronym> versions from 4.9.3 onward have been developed and maintained
 by the Internet Software Consortium with support being provided
 by ISC's sponsors. As co-architects/programmers, Bob Halley and
-Paul Vixie released the first production-ready version of <span class="acronym">BIND</span> version
+Paul Vixie released the first production-ready version of <acronym class="acronym">BIND</acronym> version
 8 in May 1997.</p>
-<p><span class="acronym">BIND</span> development work is made possible today by the sponsorship
+<p><acronym class="acronym">BIND</acronym> development work is made possible today by the sponsorship
 of several corporations, and by the tireless work efforts of numerous
 individuals.</p>
 </div>
 </div>
 <div class="sect1" lang="en">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="historical_dns_information"></a>General <span class="acronym">DNS</span> Reference Information</h2></div></div></div>
+<a name="historical_dns_information"></a>General <acronym class="acronym">DNS</acronym> Reference Information</h2></div></div></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="ipv6addresses"></a>IPv6 addresses (AAAA)</h3></div></div></div>
 <p>IPv6 addresses are 128-bit identifiers for interfaces and
-sets of interfaces which were introduced in the <span class="acronym">DNS</span> to facilitate
+sets of interfaces which were introduced in the <acronym class="acronym">DNS</acronym> to facilitate
 scalable Internet routing. There are three types of addresses: <span class="emphasis"><em>Unicast</em></span>,
 an identifier for a single interface; <span class="emphasis"><em>Anycast</em></span>,
 an identifier for a set of interfaces; and <span class="emphasis"><em>Multicast</em></span>,
@@ -248,7 +251,7 @@ of zeros that can fit, and can be used only once in an address.</p>
 <div class="titlepage"><div><div><h3 class="title">
 <a name="rfcs"></a>Request for Comments (RFCs)</h3></div></div></div>
 <p>Specification documents for the Internet protocol suite, including
-the <span class="acronym">DNS</span>, are published as part of the Request for Comments (RFCs)
+the <acronym class="acronym">DNS</acronym>, are published as part of the Request for Comments (RFCs)
 series of technical notes. The standards themselves are defined
 by the Internet Engineering Task Force (IETF) and the Internet Engineering
 Steering Group (IESG). RFCs can be obtained online via FTP at 
@@ -258,23 +261,41 @@ the number of the RFC). RFCs are also available via the Web at
 </p>
 <div class="bibliography">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2568712"></a>Bibliography</h4></div></div></div>
+<a name="id2593259"></a>Bibliography</h4></div></div></div>
 <div class="bibliodiv">
 <h3 class="title">Standards</h3>
-<div class="biblioentry"><p>[<span class="abbrev">RFC974</span>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC1034</span>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p></div>
+<a name="id2593270"></a><p>[<abbr class="abbrev">RFC974</abbr>] <span class="author"><span class="firstname">C.</span> <span class="surname">Partridge</span>. </span><span class="title"><i>Mail Routing and the Domain System</i>. </span><span class="pubdate">January 1986. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1035</span>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Implementation and
+</div>
-Specification</i>. </span><span class="pubdate">November 1987. </span></p></div>
+<div class="biblioentry">
+<a name="id2593293"></a><p>[<abbr class="abbrev">RFC1034</abbr>] <span class="author"><span class="firstname">P.V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Concepts and Facilities</i>. </span><span class="pubdate">November 1987. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2593317"></a><p>[<abbr class="abbrev">RFC1035</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>Domain Names &#8212; Implementation and
+Specification</i>. </span><span class="pubdate">November 1987. </span></p>
+</div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">
 <a name="proposed_standards"></a>Proposed Standards</h3>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2181</span>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <span class="acronym">DNS</span> Specification</i>. </span><span class="pubdate">July 1997. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC2308</span>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <span class="acronym">DNS</span> Queries</i>. </span><span class="pubdate">March 1998. </span></p></div>
+<a name="id2593354"></a><p>[<abbr class="abbrev">RFC2181</abbr>] <span class="author"><span class="firstname">R., R. Bush</span> <span class="surname">Elz</span>. </span><span class="title"><i>Clarifications to the <acronym class="acronym">DNS</acronym> Specification</i>. </span><span class="pubdate">July 1997. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1995</span>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <span class="acronym">DNS</span></i>. </span><span class="pubdate">August 1996. </span></p></div>
+</div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1996</span>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC2136</span>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p></div>
+<a name="id2593380"></a><p>[<abbr class="abbrev">RFC2308</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Andrews</span>. </span><span class="title"><i>Negative Caching of <acronym class="acronym">DNS</acronym> Queries</i>. </span><span class="pubdate">March 1998. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2845</span>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <span class="acronym">DNS</span> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p></div>
+</div>
+<div class="biblioentry">
+<a name="id2593405"></a><p>[<abbr class="abbrev">RFC1995</abbr>] <span class="author"><span class="firstname">M.</span> <span class="surname">Ohta</span>. </span><span class="title"><i>Incremental Zone Transfer in <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">August 1996. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2593430"></a><p>[<abbr class="abbrev">RFC1996</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A Mechanism for Prompt Notification of Zone Changes</i>. </span><span class="pubdate">August 1996. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2593522"></a><p>[<abbr class="abbrev">RFC2136</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">S.</span> <span class="surname">Thomson</span>, <span class="firstname">Y.</span> <span class="surname">Rekhter</span>, and <span class="firstname">J.</span> <span class="surname">Bound</span>. </span><span class="title"><i>Dynamic Updates in the Domain Name System</i>. </span><span class="pubdate">April 1997. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2593577"></a><p>[<abbr class="abbrev">RFC2845</abbr>] <span class="authorgroup"><span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">O.</span> <span class="surname">Gudmundsson</span>, <span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>, and <span class="firstname">B.</span> <span class="surname">Wellington</span>. </span><span class="title"><i>Secret Key Transaction Authentication for <acronym class="acronym">DNS</acronym> (TSIG)</i>. </span><span class="pubdate">May 2000. </span></p>
+</div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">Proposed Standards Still Under Development</h3>
@@ -283,64 +304,120 @@ Specification</i>. </span><span class="pubdate">November 1987. </span></p></div>
 <p><span class="emphasis"><em>Note:</em></span> the following list of
 RFCs are undergoing major revision by the IETF.</p>
 </div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1886</span>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i><span class="acronym">DNS</span> Extensions to support IP version 6</i>. </span><span class="pubdate">December 1995. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC2065</span>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p></div>
+<a name="id2593653"></a><p>[<abbr class="abbrev">RFC1886</abbr>] <span class="authorgroup"><span class="firstname">S.</span> <span class="surname">Thomson</span> and <span class="firstname">C.</span> <span class="surname">Huitema</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Extensions to support IP version 6</i>. </span><span class="pubdate">December 1995. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2137</span>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p></div>
+</div>
+<div class="biblioentry">
+<a name="id2593691"></a><p>[<abbr class="abbrev">RFC2065</abbr>] <span class="authorgroup"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span> and <span class="firstname">C.</span> <span class="surname">Kaufman</span>. </span><span class="title"><i>Domain Name System Security Extensions</i>. </span><span class="pubdate">January 1997. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2593731"></a><p>[<abbr class="abbrev">RFC2137</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Eastlake</span>, <span class="lineage">3rd</span>. </span><span class="title"><i>Secure Domain Name System Dynamic Update</i>. </span><span class="pubdate">April 1997. </span></p>
+</div>
 </div>
 <div class="bibliodiv">
-<h3 class="title">Other Important RFCs About <span class="acronym">DNS</span> Implementation</h3>
+<h3 class="title">Other Important RFCs About <acronym class="acronym">DNS</acronym> Implementation</h3>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1535</span>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely Deployed <span class="acronym">DNS</span> Software.</i>. </span><span class="pubdate">October 1993. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC1536</span>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <span class="acronym">DNS</span> Implementation Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p></div>
+<a name="id2593767"></a><p>[<abbr class="abbrev">RFC1535</abbr>] <span class="author"><span class="firstname">E.</span> <span class="surname">Gavron</span>. </span><span class="title"><i>A Security Problem and Proposed Correction With Widely Deployed <acronym class="acronym">DNS</acronym> Software.</i>. </span><span class="pubdate">October 1993. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1982</span>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p></div>
+</div>
+<div class="biblioentry">
+<a name="id2593793"></a><p>[<abbr class="abbrev">RFC1536</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Kumar</span>, <span class="firstname">J.</span> <span class="surname">Postel</span>, <span class="firstname">C.</span> <span class="surname">Neuman</span>, <span class="firstname">P.</span> <span class="surname">Danzig</span>, and <span class="firstname">S.</span> <span class="surname">Miller</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Implementation Errors and Suggested Fixes</i>. </span><span class="pubdate">October 1993. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2593860"></a><p>[<abbr class="abbrev">RFC1982</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Elz</span> and <span class="firstname">R.</span> <span class="surname">Bush</span>. </span><span class="title"><i>Serial Number Arithmetic</i>. </span><span class="pubdate">August 1996. </span></p>
+</div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">Resource Record Types</h3>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1183</span>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <span class="acronym">DNS</span> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC1706</span>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><span class="acronym">DNS</span> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p></div>
+<a name="id2593901"></a><p>[<abbr class="abbrev">RFC1183</abbr>] <span class="authorgroup"><span class="firstname">C.F.</span> <span class="surname">Everhart</span>, <span class="firstname">L. A.</span> <span class="surname">Mamakos</span>, <span class="firstname">R.</span> <span class="surname">Ullmann</span>, and <span class="firstname">P.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i>New <acronym class="acronym">DNS</acronym> RR Definitions</i>. </span><span class="pubdate">October 1990. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2168</span>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using
+</div>
-the Domain Name System</i>. </span><span class="pubdate">June 1997. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC1876</span>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the Domain
+<a name="id2593959"></a><p>[<abbr class="abbrev">RFC1706</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">R.</span> <span class="surname">Colella</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> NSAP Resource Records</i>. </span><span class="pubdate">October 1994. </span></p>
-Name System</i>. </span><span class="pubdate">January 1996. </span></p></div>
+</div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2052</span>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <span class="acronym">DNS</span> RR for Specifying the Location of
+<div class="biblioentry">
-Services.</i>. </span><span class="pubdate">October 1996. </span></p></div>
+<a name="id2593996"></a><p>[<abbr class="abbrev">RFC2168</abbr>] <span class="authorgroup"><span class="firstname">R.</span> <span class="surname">Daniel</span> and <span class="firstname">M.</span> <span class="surname">Mealling</span>. </span><span class="title"><i>Resolution of Uniform Resource Identifiers using
-<div class="biblioentry"><p>[<span class="abbrev">RFC2163</span>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <span class="acronym">DNS</span> to Distribute MIXER
+the Domain Name System</i>. </span><span class="pubdate">June 1997. </span></p>
-Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998. </span></p></div>
+</div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2230</span>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <span class="acronym">DNS</span></i>. </span><span class="pubdate">October 1997. </span></p></div>
+<div class="biblioentry">
+<a name="id2594032"></a><p>[<abbr class="abbrev">RFC1876</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Davis</span>, <span class="firstname">P.</span> <span class="surname">Vixie</span>, <span class="firstname">T.</span>, and <span class="firstname">I.</span> <span class="surname">Dickinson</span>. </span><span class="title"><i>A Means for Expressing Location Information in the Domain
+Name System</i>. </span><span class="pubdate">January 1996. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594086"></a><p>[<abbr class="abbrev">RFC2052</abbr>] <span class="authorgroup"><span class="firstname">A.</span> <span class="surname">Gulbrandsen</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>A <acronym class="acronym">DNS</acronym> RR for Specifying the Location of
+Services.</i>. </span><span class="pubdate">October 1996. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594125"></a><p>[<abbr class="abbrev">RFC2163</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Allocchio</span>. </span><span class="title"><i>Using the Internet <acronym class="acronym">DNS</acronym> to Distribute MIXER
+Conformant Global Address Mapping</i>. </span><span class="pubdate">January 1998. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594152"></a><p>[<abbr class="abbrev">RFC2230</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Atkinson</span>. </span><span class="title"><i>Key Exchange Delegation Record for the <acronym class="acronym">DNS</acronym></i>. </span><span class="pubdate">October 1997. </span></p>
+</div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">
-<span class="acronym">DNS</span> and the Internet</h3>
+<acronym class="acronym">DNS</acronym> and the Internet</h3>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1101</span>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><span class="acronym">DNS</span> Encoding of Network Names and Other Types</i>. </span><span class="pubdate">April 1989. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC1123</span>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and Support</i>. </span><span class="pubdate">October 1989. </span></p></div>
+<a name="id2594186"></a><p>[<abbr class="abbrev">RFC1101</abbr>] <span class="author"><span class="firstname">P. V.</span> <span class="surname">Mockapetris</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Network Names and Other Types</i>. </span><span class="pubdate">April 1989. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1591</span>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p></div>
+</div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2317</span>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p></div>
+<div class="biblioentry">
+<a name="id2594212"></a><p>[<abbr class="abbrev">RFC1123</abbr>] <span class="author"><span class="surname">Braden</span>. </span><span class="title"><i>Requirements for Internet Hosts - Application and Support</i>. </span><span class="pubdate">October 1989. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594235"></a><p>[<abbr class="abbrev">RFC1591</abbr>] <span class="author"><span class="firstname">J.</span> <span class="surname">Postel</span>. </span><span class="title"><i>Domain Name System Structure and Delegation</i>. </span><span class="pubdate">March 1994. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594257"></a><p>[<abbr class="abbrev">RFC2317</abbr>] <span class="authorgroup"><span class="firstname">H.</span> <span class="surname">Eidnes</span>, <span class="firstname">G.</span> <span class="surname">de Groot</span>, and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Classless IN-ADDR.ARPA Delegation</i>. </span><span class="pubdate">March 1998. </span></p>
+</div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">
-<span class="acronym">DNS</span> Operations</h3>
+<acronym class="acronym">DNS</acronym> Operations</h3>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1537</span>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <span class="acronym">DNS</span> Data File Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p></div>
+<div class="biblioentry">
-<div class="biblioentry"><p>[<span class="abbrev">RFC1912</span>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <span class="acronym">DNS</span> Operational and Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p></div>
+<a name="id2594311"></a><p>[<abbr class="abbrev">RFC1537</abbr>] <span class="author"><span class="firstname">P.</span> <span class="surname">Beertema</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Data File Configuration Errors</i>. </span><span class="pubdate">October 1993. </span></p>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2010</span>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p></div>
+</div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2219</span>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <span class="acronym">DNS</span> Aliases for Network Services.</i>. </span><span class="pubdate">October 1997. </span></p></div>
+<div class="biblioentry">
+<a name="id2594337"></a><p>[<abbr class="abbrev">RFC1912</abbr>] <span class="author"><span class="firstname">D.</span> <span class="surname">Barr</span>. </span><span class="title"><i>Common <acronym class="acronym">DNS</acronym> Operational and Configuration Errors</i>. </span><span class="pubdate">February 1996. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594363"></a><p>[<abbr class="abbrev">RFC2010</abbr>] <span class="authorgroup"><span class="firstname">B.</span> <span class="surname">Manning</span> and <span class="firstname">P.</span> <span class="surname">Vixie</span>. </span><span class="title"><i>Operational Criteria for Root Name Servers.</i>. </span><span class="pubdate">October 1996. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594400"></a><p>[<abbr class="abbrev">RFC2219</abbr>] <span class="authorgroup"><span class="firstname">M.</span> <span class="surname">Hamilton</span> and <span class="firstname">R.</span> <span class="surname">Wright</span>. </span><span class="title"><i>Use of <acronym class="acronym">DNS</acronym> Aliases for Network Services.</i>. </span><span class="pubdate">October 1997. </span></p>
+</div>
 </div>
 <div class="bibliodiv">
-<h3 class="title">Other <span class="acronym">DNS</span>-related RFCs</h3>
+<h3 class="title">Other <acronym class="acronym">DNS</acronym>-related RFCs</h3>
 <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
 <h3 class="title">Note</h3>
 <p>Note: the following list of RFCs, although
-<span class="acronym">DNS</span>-related, are not concerned with implementing software.</p>
+<acronym class="acronym">DNS</acronym>-related, are not concerned with implementing software.</p>
+</div>
+<div class="biblioentry">
+<a name="id2594459"></a><p>[<abbr class="abbrev">RFC1464</abbr>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String Attributes</i>. </span><span class="pubdate">May 1993. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594482"></a><p>[<abbr class="abbrev">RFC1713</abbr>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <acronym class="acronym">DNS</acronym> Debugging</i>. </span><span class="pubdate">November 1994. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594506"></a><p>[<abbr class="abbrev">RFC1794</abbr>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Support for Load Balancing</i>. </span><span class="pubdate">April 1995. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594531"></a><p>[<abbr class="abbrev">RFC2240</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594553"></a><p>[<abbr class="abbrev">RFC2345</abbr>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p>
+</div>
+<div class="biblioentry">
+<a name="id2594599"></a><p>[<abbr class="abbrev">RFC2352</abbr>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p>
 </div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1464</span>] <span class="author"><span class="firstname">R.</span> <span class="surname">Rosenbaum</span>. </span><span class="title"><i>Using the Domain Name System To Store Arbitrary String Attributes</i>. </span><span class="pubdate">May 1993. </span></p></div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1713</span>] <span class="author"><span class="firstname">A.</span> <span class="surname">Romao</span>. </span><span class="title"><i>Tools for <span class="acronym">DNS</span> Debugging</i>. </span><span class="pubdate">November 1994. </span></p></div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1794</span>] <span class="author"><span class="firstname">T.</span> <span class="surname">Brisco</span>. </span><span class="title"><i><span class="acronym">DNS</span> Support for Load Balancing</i>. </span><span class="pubdate">April 1995. </span></p></div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2240</span>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Legal Basis for Domain Name Allocation</i>. </span><span class="pubdate">November 1997. </span></p></div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2345</span>] <span class="authorgroup"><span class="firstname">J.</span> <span class="surname">Klensin</span>, <span class="firstname">T.</span> <span class="surname">Wolf</span>, and <span class="firstname">G.</span> <span class="surname">Oglesby</span>. </span><span class="title"><i>Domain Names and Company Name Retrieval</i>. </span><span class="pubdate">May 1998. </span></p></div>
-<div class="biblioentry"><p>[<span class="abbrev">RFC2352</span>] <span class="author"><span class="firstname">O.</span> <span class="surname">Vaughan</span>. </span><span class="title"><i>A Convention For Using Legal Names as Domain Names</i>. </span><span class="pubdate">May 1998. </span></p></div>
 </div>
 <div class="bibliodiv">
 <h3 class="title">Obsolete and Unimplemented Experimental RRs</h3>
-<div class="biblioentry"><p>[<span class="abbrev">RFC1712</span>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><span class="acronym">DNS</span> Encoding of Geographical
+<div class="biblioentry">
-Location</i>. </span><span class="pubdate">November 1994. </span></p></div>
+<a name="id2594630"></a><p>[<abbr class="abbrev">RFC1712</abbr>] <span class="authorgroup"><span class="firstname">C.</span> <span class="surname">Farrell</span>, <span class="firstname">M.</span> <span class="surname">Schulze</span>, <span class="firstname">S.</span> <span class="surname">Pleitner</span>, and <span class="firstname">D.</span> <span class="surname">Baldoni</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> Encoding of Geographical
+Location</i>. </span><span class="pubdate">November 1994. </span></p>
+</div>
 </div>
 </div>
 </div>
@@ -358,12 +435,14 @@ after which they are deleted unless updated by their authors.
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2570087"></a>Other Documents About <span class="acronym">BIND</span></h3></div></div></div>
+<a name="id2594702"></a>Other Documents About <acronym class="acronym">BIND</acronym></h3></div></div></div>
 <p></p>
 <div class="bibliography">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2570097"></a>Bibliography</h4></div></div></div>
+<a name="id2594712"></a>Bibliography</h4></div></div></div>
-<div class="biblioentry"><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><span class="acronym">DNS</span> and <span class="acronym">BIND</span></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p></div>
+<div class="biblioentry">
+<a name="id2594714"></a><p><span class="authorgroup"><span class="firstname">Paul</span> <span class="surname">Albitz</span> and <span class="firstname">Cricket</span> <span class="surname">Liu</span>. </span><span class="title"><i><acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></i>. </span><span class="copyright">Copyright © 1998 Sebastopol, CA: O'Reilly and Associates. </span></p>
+</div>
 </div>
 </div>
 </div>

contrib/bind9/doc/arm/Bv9ARM.html

@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2006 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,12 +14,12 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: Bv9ARM.html,v 1.60.2.9.2.26 2005/10/13 02:33:59 marka Exp $ -->
+<!-- $Id: Bv9ARM.html,v 1.60.2.9.2.38 2006/11/15 04:33:42 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>BIND 9 Administrator Reference Manual</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.69.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
 <link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
 <link rel="next" href="Bv9ARM.ch01.html" title="Chapter 1. Introduction ">
 </head>
@@ -40,8 +40,8 @@
 <div class="titlepage">
 <div>
 <div><h1 class="title">
-<a name="id2463864"></a>BIND 9 Administrator Reference Manual</h1></div>
+<a name="id2482844"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="copyright">Copyright © 2004, 2005 Internet Systems Consortium, Inc. ("ISC")</p></div>
+<div><p class="copyright">Copyright © 2004-2006 Internet Systems Consortium, Inc. ("ISC")</p></div>
 <div><p class="copyright">Copyright © 2000-2003 Internet Software Consortium.</p></div>
 </div>
 <hr>
@@ -51,39 +51,39 @@
 <dl>
 <dt><span class="chapter"><a href="Bv9ARM.ch01.html">1. Introduction </a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2545879">Scope of Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569434">Scope of Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2545905">Organization of This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569460">Organization of This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2545976">Conventions Used in This Document</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569736">Conventions Used in This Document</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2546234">The Domain Name System (<span class="acronym">DNS</span>)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch01.html#id2569994">The Domain Name System (<acronym class="acronym">DNS</acronym>)</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546254">DNS Fundamentals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570014">DNS Fundamentals</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2544105">Domains and Domain Names</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570323">Domains and Domain Names</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546579">Zones</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570407">Zones</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546653">Authoritative Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570550">Authoritative Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2546950">Caching Name Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570642">Caching Name Servers</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2547076">Name Servers in Multiple Roles</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch01.html#id2570699">Name Servers in Multiple Roles</a></span></dt>
 </dl></dd>
 </dl></dd>
-<dt><span class="chapter"><a href="Bv9ARM.ch02.html">2. <span class="acronym">BIND</span> Resource Requirements</a></span></dt>
+<dt><span class="chapter"><a href="Bv9ARM.ch02.html">2. <acronym class="acronym">BIND</acronym> Resource Requirements</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547108">Hardware requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570868">Hardware requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547132">CPU Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570892">CPU Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547143">Memory Requirements</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570903">Memory Requirements</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547158">Name Server Intensive Environment Issues</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570918">Name Server Intensive Environment Issues</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2547303">Supported Operating Systems</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch02.html#id2570995">Supported Operating Systems</a></span></dt>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch03.html">3. Name Server Configuration</a></span></dt>
 <dd><dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch03.html#sample_configuration">Sample Configurations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547334">A Caching-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2571026">A Caching-only Name Server</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547350">An Authoritative-only Name Server</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2571042">An Authoritative-only Name Server</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2547372">Load Balancing</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2571064">Load Balancing</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2547656">Name Server Operations</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch03.html#id2571484">Name Server Operations</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2547661">Tools for Use With the Name Server Daemon</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2571490">Tools for Use With the Name Server Daemon</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2548915">Signals</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch03.html#id2572723">Signals</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch04.html">4. Advanced DNS Features</a></span></dt>
@@ -92,111 +92,111 @@
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#dynamic_update">Dynamic Update</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch04.html#journal">The journal file</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#incremental_zone_transfers">Incremental Zone Transfers (IXFR)</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2549203">Split DNS</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2573147">Split DNS</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#tsig">TSIG</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549627">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573709">Generate Shared Keys for Each Pair of Hosts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549830">Copying the Shared Secret to Both Machines</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573776">Copying the Shared Secret to Both Machines</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549838">Informing the Servers of the Key's Existence</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573784">Informing the Servers of the Key's Existence</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549878">Instructing the Server to Use the Key</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573824">Instructing the Server to Use the Key</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2549998">TSIG Key Based Access Control</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573876">TSIG Key Based Access Control</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550042">Errors</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2573920">Errors</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2550056">TKEY</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2573933">TKEY</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2550173">SIG(0)</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2573982">SIG(0)</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch04.html#DNSSEC">DNSSEC</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550308">Generating Keys</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574049">Generating Keys</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550375">Signing the Zone</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574116">Signing the Zone</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550450">Configuring Servers</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574259">Configuring Servers</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2550473">IPv6 Support in <span class="acronym">BIND</span> 9</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch04.html#id2574396">IPv6 Support in <acronym class="acronym">BIND</acronym> 9</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550600">Address Lookups Using AAAA Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574455">Address Lookups Using AAAA Records</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2550620">Address to Name Lookups Using Nibble Format</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch04.html#id2574475">Address to Name Lookups Using Nibble Format</a></span></dt>
 </dl></dd>
 </dl></dd>
-<dt><span class="chapter"><a href="Bv9ARM.ch05.html">5. The <span class="acronym">BIND</span> 9 Lightweight Resolver</a></span></dt>
+<dt><span class="chapter"><a href="Bv9ARM.ch05.html">5. The <acronym class="acronym">BIND</acronym> 9 Lightweight Resolver</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2550652">The Lightweight Resolver Library</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch05.html#id2574507">The Lightweight Resolver Library</a></span></dt>
 <dt><span class="sect1"><a href="Bv9ARM.ch05.html#lwresd">Running a Resolver Daemon</a></span></dt>
 </dl></dd>
-<dt><span class="chapter"><a href="Bv9ARM.ch06.html">6. <span class="acronym">BIND</span> 9 Configuration Reference</a></span></dt>
+<dt><span class="chapter"><a href="Bv9ARM.ch06.html">6. <acronym class="acronym">BIND</acronym> 9 Configuration Reference</a></span></dt>
 <dd><dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch06.html#configuration_file_elements">Configuration File Elements</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#address_match_lists">Address Match Lists</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2551817">Comment Syntax</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2575672">Comment Syntax</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch06.html#Configuration_File_Grammar">Configuration File Grammar</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552302"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576157"><span><strong class="command">acl</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#acl"><span><strong class="command">acl</strong></span> Statement Definition and
 Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552471"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576326"><span><strong class="command">controls</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#controls_statement_definition_and_usage"><span><strong class="command">controls</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552808"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576672"><span><strong class="command">include</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552823"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576686"><span><strong class="command">include</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552845"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576709"><span><strong class="command">key</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2552867"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576730"><span><strong class="command">key</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553006"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2576870"><span><strong class="command">logging</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2553269"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2577064"><span><strong class="command">logging</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2554474"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578270"><span><strong class="command">lwres</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2554547"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578343"><span><strong class="command">lwres</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2554610"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578406"><span><strong class="command">masters</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2554653"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578518"><span><strong class="command">masters</strong></span> Statement Definition and Usage </a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2554668"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2578533"><span><strong class="command">options</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#options"><span><strong class="command">options</strong></span> Statement Definition and Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_grammar"><span><strong class="command">server</strong></span> Statement Grammar</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#server_statement_definition_and_usage"><span><strong class="command">server</strong></span> Statement Definition and Usage</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2562233"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586290"><span><strong class="command">trusted-keys</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2562281"><span><strong class="command">trusted-keys</strong></span> Statement Definition
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586338"><span><strong class="command">trusted-keys</strong></span> Statement Definition
-and Usage</a></span></dt>
+	    and Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#view_statement_grammar"><span><strong class="command">view</strong></span> Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2562349"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2586420"><span><strong class="command">view</strong></span> Statement Definition and Usage</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#zone_statement_grammar"><span><strong class="command">zone</strong></span>
 Statement Grammar</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2563022"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2587635"><span><strong class="command">zone</strong></span> Statement Definition and Usage</a></span></dt>
 </dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2564557">Zone File</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch06.html#id2589173">Zone File</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them">Types of Resource Records and When to Use Them</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2565990">Discussion of MX Records</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2590605">Discussion of MX Records</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch06.html#Setting_TTLs">Setting TTLs</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566487">Inverse Mapping in IPv4</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591102">Inverse Mapping in IPv4</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566593">Other Zone File Directives</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591208">Other Zone File Directives</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2566761"><span class="acronym">BIND</span> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch06.html#id2591377"><acronym class="acronym">BIND</acronym> Master File Extension: the  <span><strong class="command">$GENERATE</strong></span> Directive</a></span></dt>
 </dl></dd>
 </dl></dd>
-<dt><span class="chapter"><a href="Bv9ARM.ch07.html">7. <span class="acronym">BIND</span> 9 Security Considerations</a></span></dt>
+<dt><span class="chapter"><a href="Bv9ARM.ch07.html">7. <acronym class="acronym">BIND</acronym> 9 Security Considerations</a></span></dt>
 <dd><dl>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#Access_Control_Lists">Access Control Lists</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2567222"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> (for
+<dt><span class="sect1"><a href="Bv9ARM.ch07.html#id2591971"><span><strong class="command">chroot</strong></span> and <span><strong class="command">setuid</strong></span> (for
 UNIX servers)</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2567366">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592046">The <span><strong class="command">chroot</strong></span> Environment</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2567424">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch07.html#id2592172">Using the <span><strong class="command">setuid</strong></span> Function</a></span></dt>
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch07.html#dynamic_update_security">Dynamic Update Security</a></span></dt>
 </dl></dd>
 <dt><span class="chapter"><a href="Bv9ARM.ch08.html">8. Troubleshooting</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2567630">Common Problems</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592243">Common Problems</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2567636">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch08.html#id2592248">It's not working; how can I figure out what's wrong?</a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2567648">Incrementing and Changing the Serial Number</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592260">Incrementing and Changing the Serial Number</a></span></dt>
-<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2567665">Where Can I Get Help?</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch08.html#id2592277">Where Can I Get Help?</a></span></dt>
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Appendices</a></span></dt>
 <dd><dl>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2567795">Acknowledgments</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#id2592339">Acknowledgments</a></span></dt>
-<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2567800">A Brief History of the <span class="acronym">DNS</span> and <span class="acronym">BIND</span></a></span></dt></dl></dd>
+<dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2592344">A Brief History of the <acronym class="acronym">DNS</acronym> and <acronym class="acronym">BIND</acronym></a></span></dt></dl></dd>
-<dt><span class="sect1"><a href="Bv9ARM.ch09.html#historical_dns_information">General <span class="acronym">DNS</span> Reference Information</a></span></dt>
+<dt><span class="sect1"><a href="Bv9ARM.ch09.html#historical_dns_information">General <acronym class="acronym">DNS</acronym> Reference Information</a></span></dt>
 <dd><dl><dt><span class="sect2"><a href="Bv9ARM.ch09.html#ipv6addresses">IPv6 addresses (AAAA)</a></span></dt></dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bibliography">Bibliography (and Suggested Reading)</a></span></dt>
 <dd><dl>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#rfcs">Request for Comments (RFCs)</a></span></dt>
 <dt><span class="sect2"><a href="Bv9ARM.ch09.html#internet_drafts">Internet Drafts</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2570087">Other Documents About <span class="acronym">BIND</span></a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2594702">Other Documents About <acronym class="acronym">BIND</acronym></a></span></dt>
 </dl></dd>
 </dl></dd>
 </dl>

contrib/bind9/lib/bind/Makefile.in

@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,15 +13,12 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.12.2.5.2.9 2005/07/29 00:13:08 marka Exp $
+# $Id: Makefile.in,v 1.12.2.5.2.11 2006/06/24 00:25:38 marka Exp $
 
 srcdir =        @srcdir@
 VPATH =         @srcdir@
 top_srcdir =    @top_srcdir@
 
-# Attempt to disable parallel processing.
-.NOTPARALLEL:
-.NO_PARALLEL:
 
 @LIBBIND_API@
 
@@ -99,6 +96,10 @@ OBJS=	${BSDOBJS} ${DSTOBJS} ${INETOBJS} ${IRSOBJS} ${ISCOBJS} \
 
 @BIND9_MAKE_RULES@
 
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
+
 libbind.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@

contrib/bind9/lib/bind/api

@@ -1,3 +1,3 @@
 LIBINTERFACE = 4
-LIBREVISION = 2
+LIBREVISION = 7
 LIBAGE = 0

contrib/bind9/lib/bind/config.h.in

@@ -4,6 +4,7 @@
 #undef HAVE_INTTYPES_H
 #undef HAVE_STROPTS_H
 #undef HAVE_SYS_TIMERS_H
+#undef HAVE_SYS_SELECT_H
 #undef SYS_CDEFS_H
 #undef _POSIX_PTHREAD_SEMANTICS
 #undef POSIX_GETPWUID_R

contrib/bind9/lib/bind/configure.in

@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-AC_REVISION($Revision: 1.83.2.5.2.22 $)
+AC_REVISION($Revision: 1.83.2.5.2.31 $)
 
 AC_INIT(resolv/herror.c)
 AC_PREREQ(2.13)
@@ -319,16 +319,68 @@ sinclude(../../config.threads.in)dnl
 
 if $use_threads
 then
+	if test "X$GCC" = "Xyes"; then
+		case "$host" in
+		*-freebsd*)
+			CC="$CC -pthread"
+			CCOPT="$CCOPT -pthread"
+			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+			;;
+		*-openbsd*)
+			CC="$CC -pthread"
+			CCOPT="$CCOPT -pthread"
+			;;
+		*-solaris*)
+			LIBS="$LIBS -lthread"
+			;;
+		*-ibm-aix*)
+			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+			;;
+		esac
+	else
+		case $host in
+		*-dec-osf*)
+			CC="$CC -pthread"
+			CCOPT="$CCOPT -pthread"
+			;;
+		*-solaris*)
+			CC="$CC -mt"
+			CCOPT="$CCOPT -mt"
+			;;
+		*-ibm-aix*)
+			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
+			;;
+		*-UnixWare*)
+			CC="$CC -Kthread"
+			CCOPT="$CCOPT -Kthread"
+			;;
+		esac
+	fi
+	AC_DEFINE(_REENTRANT)
+	ALWAYS_DEFINES="-D_REENTRANT"
+	DO_PTHREADS="#define DO_PTHREADS 1"
+	WANT_IRS_THREADSGR_OBJS="\${WANT_IRS_THREADSGR_OBJS}"
+	WANT_IRS_THREADSPW_OBJS="\${WANT_IRS_THREADSPW_OBJS}"
+	case $host in
+	ia64-hp-hpux11.*)
+		WANT_IRS_THREADS_OBJS="";;
+	*)
+		WANT_IRS_THREADS_OBJS="\${WANT_IRS_THREADS_OBJS}";;
+	esac
+	WANT_THREADS_OBJS="\${WANT_THREADS_OBJS}"
+	thread_dir=pthreads
+
 	#
 	# We'd like to use sigwait() too
 	#
-	AC_CHECK_LIB(c, sigwait,
+	AC_CHECK_FUNC(sigwait,
-		     AC_DEFINE(HAVE_SIGWAIT),
+		      AC_DEFINE(HAVE_SIGWAIT),
-		     AC_CHECK_LIB(pthread, sigwait,
+		      AC_CHECK_LIB(c, sigwait,
-				  AC_DEFINE(HAVE_SIGWAIT),
+		      AC_DEFINE(HAVE_SIGWAIT),
-				  AC_CHECK_LIB(pthread, _Psigwait,
+		      AC_CHECK_LIB(pthread, sigwait,
-					       AC_DEFINE(HAVE_SIGWAIT),))
+				   AC_DEFINE(HAVE_SIGWAIT),
-	)
+				   AC_CHECK_LIB(pthread, _Psigwait,
+					        AC_DEFINE(HAVE_SIGWAIT),))))
 
 	AC_CHECK_FUNC(pthread_attr_getstacksize,
 		      AC_DEFINE(HAVE_PTHREAD_ATTR_GETSTACKSIZE),)
@@ -388,56 +440,6 @@ then
 	#
 	AC_CHECK_FUNC(sysconf, AC_DEFINE(HAVE_SYSCONF),)
 
-	if test "X$GCC" = "Xyes"; then
-		case "$host" in
-		*-freebsd*)
-			CC="$CC -pthread"
-			CCOPT="$CCOPT -pthread"
-			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
-			;;
-		*-openbsd*)
-			CC="$CC -pthread"
-			CCOPT="$CCOPT -pthread"
-			;;
-		*-solaris*)
-			LIBS="$LIBS -lthread"
-			;;
-		*-ibm-aix*)
-			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
-			;;
-		esac
-	else
-		case $host in
-		*-dec-osf*)
-			CC="$CC -pthread"
-			CCOPT="$CCOPT -pthread"
-			;;
-		*-solaris*)
-			CC="$CC -mt"
-			CCOPT="$CCOPT -mt"
-			;;
-		*-ibm-aix*)
-			STD_CDEFINES="$STD_CDEFINES -D_THREAD_SAFE"
-			;;
-		*-UnixWare*)
-			CC="$CC -Kthread"
-			CCOPT="$CCOPT -Kthread"
-			;;
-		esac
-	fi
-	AC_DEFINE(_REENTRANT)
-	ALWAYS_DEFINES="-D_REENTRANT"
-	DO_PTHREADS="#define DO_PTHREADS 1"
-	WANT_IRS_THREADSGR_OBJS="\${WANT_IRS_THREADSGR_OBJS}"
-	WANT_IRS_THREADSPW_OBJS="\${WANT_IRS_THREADSPW_OBJS}"
-	case $host in
-	ia64-hp-hpux11.*)
-		WANT_IRS_THREADS_OBJS="";;
-	*)
-		WANT_IRS_THREADS_OBJS="\${WANT_IRS_THREADS_OBJS}";;
-	esac
-	WANT_THREADS_OBJS="\${WANT_THREADS_OBJS}"
-	thread_dir=pthreads
 else
 	ALWAYS_DEFINES=""
 	DO_PTHREADS="#undef DO_PTHREADS"
@@ -513,7 +515,18 @@ MKDEPCFLAGS="-M"
 IRIX_DNSSEC_WARNINGS_HACK=""
 
 if test "X$GCC" = "Xyes"; then
-	STD_CWARNINGS="$STD_CWARNINGS -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings"
+        AC_MSG_CHECKING(if "$CC" supports -fno-strict-aliasing)
+        SAVE_CFLAGS=$CFLAGS
+        CFLAGS=-fno-strict-aliasing
+        AC_TRY_COMPILE(,, [FNOSTRICTALIASING=yes],[FNOSTRICTALIASING=no])
+        CFLAGS=$SAVE_CFLAGS
+        if test "$FNOSTRICTALIASING" = "yes"; then
+                AC_MSG_RESULT(yes)
+		STD_CWARNINGS="$STD_CWARNINGS -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings -Wformat -Wpointer-arith -fno-strict-aliasing"
+        else
+                AC_MSG_RESULT(no)
+		STD_CWARNINGS="$STD_CWARNINGS -W -Wall -Wmissing-prototypes -Wcast-qual -Wwrite-strings -Wformat -Wpointer-arith"
+        fi
 else
 	case $host in
 	*-dec-osf*)
@@ -1397,6 +1410,24 @@ AC_TRY_COMPILE(
 #undef __USE_MISC
 #define __USE_MISC
 [#include <netdb.h>
+int getnetbyaddr_r (in_addr_t, int, struct netent *, struct netent_data *);
+],
+[return (0)],
+[
+NET_R_ARGS="#define NET_R_ARGS struct netent_data *ndptr"
+NET_R_BAD="#define NET_R_BAD (-1)"
+NET_R_COPY="#define NET_R_COPY ndptr"
+NET_R_COPY_ARGS="#define NET_R_COPY_ARGS struct netent_data *ndptr"
+NET_R_OK="#define NET_R_OK 0"
+NET_R_SETANSWER="#undef NET_R_SETANSWER"
+NET_R_RETURN="#define NET_R_RETURN int"
+GETNETBYADDR_ADDR_T="#define GETNETBYADDR_ADDR_T long"
+NETENT_DATA="#define NETENT_DATA 1"
+],
+AC_TRY_COMPILE(
+#undef __USE_MISC
+#define __USE_MISC
+[#include <netdb.h>
 int getnetbyaddr_r (long, int, struct netent *, struct netent_data *);
 ],
 [return (0)],
@@ -1435,6 +1466,7 @@ NETENT_DATA="#undef NETENT_DATA"
 )
 )
 )
+)
 ,
 NET_R_ARGS="#define NET_R_ARGS char *buf, int buflen"
 NET_R_BAD="#define NET_R_BAD NULL"
@@ -1901,9 +1933,28 @@ AC_SUBST(NGR_R_RETURN)
 AC_SUBST(NGR_R_PRIVATE)
 
 AC_CHECK_FUNC(endnetgrent_r,
+AC_TRY_COMPILE(
+[
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+void endnetgrent_r(void **ptr);
+]
+,
+[return (0);]
+,
+[
+NGR_R_END_RESULT="#define NGR_R_END_RESULT(x)  /* empty */"
+NGR_R_END_RETURN="#define NGR_R_END_RETURN void"
+NGR_R_ENT_ARGS="#define NGR_R_ENT_ARGS NGR_R_ARGS"
+]
+,
+[
 NGR_R_END_RESULT="#define NGR_R_END_RESULT(x)  return (x)"
 NGR_R_END_RETURN="#define NGR_R_END_RETURN int"
 NGR_R_ENT_ARGS="#define NGR_R_ENT_ARGS NGR_R_ARGS"
+]
+)
 ,
 NGR_R_END_RESULT="#define NGR_R_END_RESULT(x)  /*empty*/"
 NGR_R_END_RETURN="#define NGR_R_END_RETURN void"
@@ -1960,6 +2011,7 @@ PROTO_R_COPY_ARGS="#define PROTO_R_COPY_ARGS PROTO_R_ARGS"
 PROTO_R_OK="#define PROTO_R_OK pptr"
 PROTO_R_SETANSWER="#undef PROTO_R_SETANSWER"
 PROTO_R_RETURN="#define PROTO_R_RETURN struct protoent *"
+PROTOENT_DATA="#undef PROTOENT_DATA"
 ]
 ,
 AC_TRY_COMPILE(
@@ -1981,8 +2033,32 @@ PROTO_R_COPY_ARGS="#define PROTO_R_COPY_ARGS char *buf, size_t buflen"
 PROTO_R_OK="#define PROTO_R_OK 0"
 PROTO_R_SETANSWER="#define PROTO_R_SETANSWER 1"
 PROTO_R_RETURN="#define PROTO_R_RETURN int"
+PROTOENT_DATA="#undef PROTOENT_DATA"
 ]
 ,
+AC_TRY_COMPILE(
+[
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+int getprotoent_r (struct protoent *, struct protoent_data *prot_data);
+
+]
+,
+[return (0);]
+,
+[
+PROTO_R_ARGS="#define PROTO_R_ARGS struct protoent_data *prot_data"
+PROTO_R_BAD="#define PROTO_R_BAD (-1)"
+PROTO_R_COPY="#define PROTO_R_COPY prot_data"
+PROTO_R_COPY_ARGS="#define PROTO_R_COPY_ARGS struct protoent_data *pdptr"
+PROTO_R_OK="#define PROTO_R_OK 0"
+PROTO_R_SETANSWER="#undef PROTO_R_SETANSWER"
+PROTO_R_RETURN="#define PROTO_R_RETURN int"
+PROTOENT_DATA="#define PROTOENT_DATA 1"
+]
+,
+)
 )
 )
 ,
@@ -1993,7 +2069,9 @@ PROTO_R_COPY_ARGS="#define PROTO_R_COPY_ARGS PROTO_R_ARGS"
 PROTO_R_OK="#define PROTO_R_OK pptr"
 PROTO_R_SETANSWER="#undef PROTO_R_SETANSWER"
 PROTO_R_RETURN="#define PROTO_R_RETURN struct protoent *"
+PROTOENT_DATA="#undef PROTOENT_DATA"
 )
+;;
 esac
 AC_SUBST(PROTO_R_ARGS)
 AC_SUBST(PROTO_R_BAD)
@@ -2002,6 +2080,7 @@ AC_SUBST(PROTO_R_COPY_ARGS)
 AC_SUBST(PROTO_R_OK)
 AC_SUBST(PROTO_R_SETANSWER)
 AC_SUBST(PROTO_R_RETURN)
+AC_SUBST(PROTOENT_DATA)
 
 case $host in
 ia64-hp-hpux11.*)
@@ -2022,18 +2101,57 @@ void endprotoent_r(void);
 PROTO_R_END_RESULT="#define PROTO_R_END_RESULT(x) /*empty*/"
 PROTO_R_END_RETURN="#define PROTO_R_END_RETURN void"
 PROTO_R_ENT_ARGS="#undef PROTO_R_ENT_ARGS"
+PROTO_R_ENT_UNUSED="#undef PROTO_R_ENT_UNUSED"
 ]
 ,
+AC_TRY_COMPILE(
+[
+#undef _REENTRANT
+#define _REENTRANT
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+void endprotoent_r(struct protoent_data *);
+]
+,,
+[
+PROTO_R_END_RESULT="#define PROTO_R_END_RESULT(x) /*empty*/"
+PROTO_R_END_RETURN="#define PROTO_R_END_RETURN void"
+PROTO_R_ENT_ARGS="#define PROTO_R_ENT_ARGS struct protoent_data *proto_data"
+PROTO_R_ENT_UNUSED="#define PROTO_R_ENT_UNUSED UNUSED(proto_data)"
+]
+,
+AC_TRY_COMPILE(
+[
+#undef _REENTRANT
+#define _REENTRANT
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+int endprotoent_r(struct protoent_data *);
+]
+,,
+[
+PROTO_R_END_RESULT="#define PROTO_R_END_RESULT(x) return(0)"
+PROTO_R_END_RETURN="#define PROTO_R_END_RETURN int"
+PROTO_R_ENT_ARGS="#define PROTO_R_ENT_ARGS struct protoent_data *proto_data"
+PROTO_R_ENT_UNUSED="#define PROTO_R_ENT_UNUSED UNUSED(proto_data)"
+]
+,
+)
+)
 )
 ,
 PROTO_R_END_RESULT="#define PROTO_R_END_RESULT(x) /*empty*/"
 PROTO_R_END_RETURN="#define PROTO_R_END_RETURN void"
 PROTO_R_ENT_ARGS="#undef PROTO_R_ENT_ARGS /*empty*/"
+PROTO_R_ENT_UNUSED="#undef PROTO_R_ENT_UNUSED"
 )
 esac
 AC_SUBST(PROTO_R_END_RESULT)
 AC_SUBST(PROTO_R_END_RETURN)
 AC_SUBST(PROTO_R_ENT_ARGS)
+AC_SUBST(PROTO_R_ENT_UNUSED)
 
 case $host in
 ia64-hp-hpux11.*)
@@ -2052,6 +2170,19 @@ void               setprotoent_r __P((int));
 PROTO_R_SET_RESULT="#undef PROTO_R_SET_RESULT"
 PROTO_R_SET_RETURN="#define PROTO_R_SET_RETURN void"
 ,
+AC_TRY_COMPILE(
+[
+#undef _REENTRANT
+#define _REENTRANT
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+int setprotoent_r (int, struct protoent_data *);
+],[],
+PROTO_R_SET_RESULT="#define PROTO_R_SET_RESULT (0)"
+PROTO_R_SET_RETURN="#define PROTO_R_SET_RETURN int"
+,
+)
 )
 ,
 PROTO_R_SET_RESULT="#undef PROTO_R_SET_RESULT"
@@ -2186,6 +2317,25 @@ SERV_R_SETANSWER="#define SERV_R_SETANSWER 1"
 SERV_R_RETURN="#define SERV_R_RETURN int"
 ]
 ,
+AC_TRY_COMPILE([
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+int
+getservent_r (struct servent *, struct servent_data *serv_data);
+],[return (0);],
+[
+SERV_R_ARGS="#define SERV_R_ARGS struct servent_data *serv_data"
+SERV_R_BAD="#define SERV_R_BAD (-1)"
+SERV_R_COPY="#define SERV_R_COPY serv_data"
+SERV_R_COPY_ARGS="#define SERV_R_COPY_ARGS struct servent_data *sdptr"
+SERV_R_OK="#define SERV_R_OK (0)"
+SERV_R_SETANSWER="#undef SERV_R_SETANSWER"
+SERV_R_RETURN="#define SERV_R_RETURN int"
+SERVENT_DATA="#define SERVENT_DATA 1"
+]
+,
+)
 )
 )
 ,
@@ -2205,6 +2355,7 @@ AC_SUBST(SERV_R_COPY_ARGS)
 AC_SUBST(SERV_R_OK)
 AC_SUBST(SERV_R_SETANSWER)
 AC_SUBST(SERV_R_RETURN)
+AC_SUBST(SERVENT_DATA)
 
 case $host in
 ia64-hp-hpux11.*)
@@ -2226,18 +2377,59 @@ void endservent_r(void);
 SERV_R_END_RESULT="#define SERV_R_END_RESULT(x) /*empty*/"
 SERV_R_END_RETURN="#define SERV_R_END_RETURN void "
 SERV_R_ENT_ARGS="#undef SERV_R_ENT_ARGS /*empty*/"
+SERV_R_ENT_UNUSED="#undef SERV_R_ENT_UNUSED /*empty*/"
 ]
 ,
+AC_TRY_COMPILE(
+[
+#undef _REENTRANT
+#define _REENTRANT
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+void endservent_r(struct servent_data *serv_data);
+]
+,
+,
+[
+SERV_R_END_RESULT="#define SERV_R_END_RESULT(x) /*empty*/"
+SERV_R_END_RETURN="#define SERV_R_END_RETURN void "
+SERV_R_ENT_ARGS="#define SERV_R_ENT_ARGS struct servent_data *serv_data"
+SERV_R_ENT_UNUSED="#define SERV_R_ENT_UNUSED UNUSED(serv_data)"
+]
+,
+AC_TRY_COMPILE(
+[
+#undef _REENTRANT
+#define _REENTRANT
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+int endservent_r(struct servent_data *serv_data);
+]
+,
+,
+[
+SERV_R_END_RESULT="#define SERV_R_END_RESULT(x) return(x)"
+SERV_R_END_RETURN="#define SERV_R_END_RETURN int "
+SERV_R_ENT_ARGS="#define SERV_R_ENT_ARGS struct servent_data *serv_data"
+SERV_R_ENT_UNUSED="#define SERV_R_ENT_UNUSED UNUSED(serv_data)"
+]
+,
+)
+)
 )
 ,
 SERV_R_END_RESULT="#define SERV_R_END_RESULT(x) /*empty*/"
 SERV_R_END_RETURN="#define SERV_R_END_RETURN void "
 SERV_R_ENT_ARGS="#undef SERV_R_ENT_ARGS /*empty*/"
+SERV_R_ENT_UNUSED="#undef SERV_R_ENT_UNUSED /*empty*/"
 )
 esac
 AC_SUBST(SERV_R_END_RESULT)
 AC_SUBST(SERV_R_END_RETURN)
 AC_SUBST(SERV_R_ENT_ARGS)
+AC_SUBST(SERV_R_ENT_UNUSED)
 
 case $host in
 ia64-hp-hpux11.*)
@@ -2251,7 +2443,7 @@ AC_TRY_COMPILE(
 #undef __USE_MISC
 #define __USE_MISC
 #include <netdb.h>
-void            setservent_r(int);
+void setservent_r(int);
 ]
 ,,
 [
@@ -2259,6 +2451,22 @@ SERV_R_SET_RESULT="#undef SERV_R_SET_RESULT"
 SERV_R_SET_RETURN="#define SERV_R_SET_RETURN void"
 ]
 ,
+AC_TRY_COMPILE(
+[
+#undef _REENTRANT
+#define _REENTRANT
+#undef __USE_MISC
+#define __USE_MISC
+#include <netdb.h>
+int setservent_r(int, struct servent_data *);
+]
+,,
+[
+SERV_R_SET_RESULT="#define SERV_R_SET_RESULT (0)"
+SERV_R_SET_RETURN="#define SERV_R_SET_RETURN int"
+]
+,
+)
 )
 ,
 SERV_R_SET_RESULT="#undef SERV_R_SET_RESULT"
@@ -2345,6 +2553,9 @@ case "$host" in
 		hack_shutup_pthreadmutexinit=yes
 		hack_shutup_in6addr_init_macros=yes
 		;;
+	*-aix5.[[23]].*)
+		hack_shutup_in6addr_init_macros=yes
+		;;
 	*-bsdi3.1*)
 		hack_shutup_sputaux=yes
 		;;
@@ -2368,6 +2579,9 @@ case "$host" in
 	*-solaris2.9)
 		hack_shutup_in6addr_init_macros=yes
 		;;
+	*-solaris2.10)
+		hack_shutup_in6addr_init_macros=yes
+		;;
 esac
 
 case "$hack_shutup_pthreadmutexinit" in
@@ -2409,7 +2623,7 @@ esac
 
 case "$hack_shutup_in6addr_init_macros" in
 	yes)
-		AC_DEFINE(BROKEN_IN6ADDR_INIT_MACROS)
+		AC_DEFINE(BROKEN_IN6ADDR_INIT_MACROS, 1, [Defined if IN6ADDR_ANY_INIT and IN6ADDR_LOOPBACK_INIT need to be redefined.] )
 		;;
 esac
 

contrib/bind9/lib/bind/dst/dst_api.c

@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.4.2.6.8.3 2005/10/11 00:48:14 marka Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.4.2.6.8.4 2006/03/10 00:17:21 marka Exp $";
 #endif
 
 /*
@@ -170,6 +170,10 @@ dst_s_get_key_struct(const char *name, const int alg, const int flags,
 
 	memset(new_key, 0, sizeof(*new_key));
 	new_key->dk_key_name = strdup(name);
+	if (new_key->dk_key_name == NULL) {
+		free(new_key);
+		return (NULL);
+	}
 	new_key->dk_alg = alg;
 	new_key->dk_flags = flags;
 	new_key->dk_proto = protocol;
@@ -655,11 +659,13 @@ dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
 			 alg));
 		return (NULL);
 	}
-	if ((key_st = dst_s_get_key_struct(in_name, alg, 0, 0, 0)) == NULL)
-		return (NULL);
 
 	if (in_name == NULL)
 		return (NULL);
+
+	if ((key_st = dst_s_get_key_struct(in_name, alg, 0, 0, 0)) == NULL)
+		return (NULL);
+
 	key_st->dk_id = dst_s_dns_key_id(rdata, len);
 	key_st->dk_flags = dst_s_get_int16(rdata);
 	key_st->dk_proto = (u_int16_t) rdata[DST_KEY_PROT];
@@ -772,13 +778,11 @@ dst_buffer_to_key(const char *key_name,		/* name of the key */
 		return (NULL);
 	}
 
-	dkey = dst_s_get_key_struct(key_name, alg, flags, 
+	dkey = dst_s_get_key_struct(key_name, alg, flags, protocol, -1);
-					     protocol, -1);
 
-	if (dkey == NULL)
+	if (dkey == NULL || dkey->dk_func == NULL ||
-		return (NULL);
+	    dkey->dk_func->from_dns_key == NULL) 
-	if (dkey->dk_func == NULL || dkey->dk_func->from_dns_key == NULL)
+		return (dst_free_key(dkey));
-		return NULL;
 
 	if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
 		EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
@@ -1013,7 +1017,6 @@ dst_free_key(DST_KEY *f_key)
 	else {
 		EREPORT(("dst_free_key(): Unknown key alg %d\n",
 			 f_key->dk_alg));
-		free(f_key->dk_KEY_struct);	/* SHOULD NOT happen */
 	}
 	if (f_key->dk_KEY_struct) {
 		free(f_key->dk_KEY_struct);

contrib/bind9/lib/bind/dst/hmac_link.c

@@ -1,6 +1,6 @@
 #ifdef HMAC_MD5
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.2.2.1.4.1 2005/07/28 07:43:16 marka Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.2.2.1.4.2 2006/03/10 00:17:21 marka Exp $";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -93,6 +93,9 @@ dst_hmac_md5_sign(const int mode, DST_KEY *d_key, void **context,
 	int sign_len = 0;
 	MD5_CTX *ctx = NULL;
 
+	if (d_key == NULL || d_key->dk_KEY_struct == NULL)
+		return (-1);
+
 	if (mode & SIG_MODE_INIT) 
 		ctx = (MD5_CTX *) malloc(sizeof(*ctx));
 	else if (context)
@@ -100,8 +103,6 @@ dst_hmac_md5_sign(const int mode, DST_KEY *d_key, void **context,
 	if (ctx == NULL) 
 		return (-1);
 
-	if (d_key == NULL || d_key->dk_KEY_struct == NULL)
-		return (-1);
 	key = (HMAC_Key *) d_key->dk_KEY_struct;
 
 	if (mode & SIG_MODE_INIT) {
@@ -160,6 +161,9 @@ dst_hmac_md5_verify(const int mode, DST_KEY *d_key, void **context,
 	HMAC_Key *key;
 	MD5_CTX *ctx = NULL;
 
+	if (d_key == NULL || d_key->dk_KEY_struct == NULL)
+		return (-1);
+
 	if (mode & SIG_MODE_INIT) 
 		ctx = (MD5_CTX *) malloc(sizeof(*ctx));
 	else if (context)
@@ -167,9 +171,6 @@ dst_hmac_md5_verify(const int mode, DST_KEY *d_key, void **context,
 	if (ctx == NULL) 
 		return (-1);
 
-	if (d_key == NULL || d_key->dk_KEY_struct == NULL)
-		return (-1);
-
 	key = (HMAC_Key *) d_key->dk_KEY_struct;
 	if (mode & SIG_MODE_INIT) {
 		MD5Init(ctx);
@@ -272,7 +273,7 @@ dst_buffer_to_hmac_md5(DST_KEY *dkey, const u_char *key, const int keylen)
 
 static int
 dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
-			    const int buff_len)
+			        const int buff_len)
 {
 	char *bp;
 	int len, b_len, i, key_len;
@@ -289,7 +290,7 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
 	/* write file header */
 	sprintf(buff, key_file_fmt_str, KEY_FILE_FORMAT, KEY_HMAC_MD5, "HMAC");
 
-	bp = (char *) strchr(buff, '\0');
+	bp = buff + strlen(buff);
 	b_len = buff_len - (bp - buff);
 
 	memset(key, 0, HMAC_LEN);
@@ -334,9 +335,9 @@ dst_hmac_md5_key_from_file_format(DST_KEY *dkey, const char *buff,
 {
 	const char *p = buff, *eol;
 	u_char key[HMAC_LEN+1];	/* b64_pton needs more than 64 bytes do decode
-							 * it should probably be fixed rather than doing
+				 * it should probably be fixed rather than doing
-							 * this
+				 * this
-							 */
+				 */
 	u_char *tmp;
 	int key_len, len;
 
@@ -355,6 +356,8 @@ dst_hmac_md5_key_from_file_format(DST_KEY *dkey, const char *buff,
 		return (-4);
 	len = eol - p;
 	tmp = malloc(len + 2);
+	if (tmp == NULL)
+		return (-5);
 	memcpy(tmp, p, len);
 	*(tmp + len) = 0x0;
 	key_len = b64_pton((char *)tmp, key, HMAC_LEN+1);	/* see above */

contrib/bind9/lib/bind/include/arpa/nameser_compat.h

@@ -32,7 +32,7 @@
 
 /*
  *      from nameser.h	8.1 (Berkeley) 6/2/93
- *	$Id: nameser_compat.h,v 1.1.2.3.4.2 2004/07/01 04:43:41 marka Exp $
+ *	$Id: nameser_compat.h,v 1.1.2.3.4.3 2006/05/19 02:38:15 marka Exp $
  */
 
 #ifndef _ARPA_NAMESER_COMPAT_
@@ -52,8 +52,9 @@
 #define	PDP_ENDIAN	3412	/* LSB first in word, MSW first in long (pdp)*/
 
 #if defined(vax) || defined(ns32000) || defined(sun386) || defined(i386) || \
-    defined(MIPSEL) || defined(_MIPSEL) || defined(BIT_ZERO_ON_RIGHT) || \
+    defined(__i386__) || defined(__i386) || defined(__amd64__) || \
-    defined(__alpha__) || defined(__alpha) || \
+    defined(__x86_64__) || defined(MIPSEL) || defined(_MIPSEL) || \
+    defined(BIT_ZERO_ON_RIGHT) || defined(__alpha__) || defined(__alpha) || \
     (defined(__Lynx__) && defined(__x86__))
 #define BYTE_ORDER	LITTLE_ENDIAN
 #endif

contrib/bind9/lib/bind/include/isc/list.h

@@ -66,12 +66,16 @@
 		INSIST(LINKED(elt, link));\
 		if ((elt)->link.next != NULL) \
 			(elt)->link.next->link.prev = (elt)->link.prev; \
-		else \
+		else { \
+			INSIST((list).tail == (elt)); \
 			(list).tail = (elt)->link.prev; \
+		} \
 		if ((elt)->link.prev != NULL) \
 			(elt)->link.prev->link.next = (elt)->link.next; \
-		else \
+		else { \
+			INSIST((list).head == (elt)); \
 			(list).head = (elt)->link.next; \
+		} \
 		INIT_LINK_TYPE(elt, link, type); \
 	} while (0)
 #define UNLINK(list, elt, link) \