update to BIND v9.2.3. ok todd@

1 files changed, 352 insertions, 81 deletions

diff --git a/usr.sbin/bind/CHANGES b/usr.sbin/bind/CHANGES
index 651a68de711..fc40d82d20b 100644
--- a/usr.sbin/bind/CHANGES
+++ b/usr.sbin/bind/CHANGES
@@ -1,5 +1,27 @@
 
-	--- 9.2.2-P3 released ---
+	--- 9.2.3 released ---
+
+1525.	[bug]		dns_cache_create() could trigger a REQUIRE
+			failure in isc_mem_put() during error cleanup.
+
+1524.	[port]		AIX needs to be able to resolve all symbols when
+			creating shared libraries (--with-libtool).
+
+1523.	[bug]		Fix race condition in rbtdb. [RT# 9189]
+
+1522.	[bug]		dns_db_findnode() relax the requirements on 'name'.
+			[RT# 9286]
+
+1518.   [bug]           dns_nxt_buildrdata(), and hence dns_nxt_build(),
+			contained a off-by-one error when working out the
+			number of octets in the bitmap.
+
+1514.	[bug]		named: isc_hash_destroy() was being called too early.
+			[RT #9160]
+
+1513.	[doc]		Add "US" to root-delegation-only exclude list.
+
+	--- 9.2.3rc4 released ---
 
 1512.	[bug]		Extend the delegation-only logging to return query
 			type, class and responding nameserver.
@@ -7,7 +29,17 @@
 1511.	[bug]		delegation-only was generating false positives
 			on negative answers from subzones.
 
-	--- 9.2.2-P2 released ---
+	--- 9.2.3rc3 released ---
+
+1510.	[func]		New view option "root-delegation-only".  Apply
+			delegation-only check to all TLDs and root.
+			Note there are some TLDs that are NOT delegation
+			only (e.g. DE, LV, US and MUSEUM) these can be excluded
+			from the checks by using exclude.
+
+			root-delegation-only exclude {
+				"DE"; "LV"; "US"; "MUSEUM";
+			};
 
 1509.	[bug]		Hint zones should accept delegation-only.  Forward
 			zone should not accept delegation-only.
@@ -20,10 +52,248 @@
 
 1506.	[bug]		Wrong return type for dns_view_isdelegationonly().
 
-	--- 9.2.2-P1 released ---
+	--- 9.2.3rc2 released ---
+
+1505.	[bug]		Uninitialised rdataset in sdb. [RT #8750]
 
 1504.	[func]		New zone type "delegation-only".
 
+1503.	[port]		win32: install libeay32.dll outside of system32.
+
+	--- 9.2.3rc1 released ---
+
+1499.	[bug]		isc_random need to be seeded better if arc4random()
+			is not used.
+
+1498.	[port]		bsdos: 5.x support.
+
+1497.	[protocol]	dig, nslookup and host now perform nibble lookups
+			under IP6.ARPA, use -i for IP6.INT (dig and host).
+			lwres now uses IP6.ARPA.
+
+1496.	[port]		test for pthread_attr_setstacksize().
+
+1495.	[cleanup]	Replace hash functions with universal hash.
+
+1494.	[security]	Turn on RSA BLINDING as a precaution.
+
+1493.	[doc]		A6 and "bitstring" labels are now experimental.
+
+1492.	[cleanup]	Preserve rwlock quota context when upgrading /
+			downgrading. [RT #5599]
+
+1491.	[bug]		dns_master_dump*() would produce extraneous $ORIGIN
+			lines. [RT #6206]
+
+1490.	[bug]		Accept reading state as well as working state in
+			ns_client_next(). [RT #6813]
+			
+1489.	[compat]	Treat 'allow-update' on slave zones as a warning.
+			[RT #3469]
+
+1488.	[bug]		Don't override trust levels for glue addresses.
+			[RT #5764]
+
+1487.	[bug]		A REQUIRE() failure could be triggered if a zone was
+			queued for transfer and the zone was then removed.
+			[RT #6189]
+
+1486.	[bug]		isc_print_snprintf() '%%' consumed one too many format
+			characters. [RT# 8230]
+
+1485.	[bug]		gen failed to handle high type values. [RT #6225]
+
+1484.	[bug]		The number of records reported after a AXFR was wrong.
+			[RT #6229]
+
+1483.	[bug]		dig axfr failed if the message id in the answer failed
+			to match that in the request.  Only the id in the first
+			message is required to match. [RT #8138]
+
+1482.	[bug]		named could fail to start if the kernel supports
+			IPv6 but no interfaces are configured.  Similarly
+			for IPv4. [RT #6229]
+			
+1481.	[bug]		Refresh and stub queries failed to use masters keys
+			if specified. [RT #7391]
+
+1480.	[bug]		Provide replay protection for rndc commands.  Full
+			replay protection requires both rndc and named to
+			be updated.  Partial replay protection (limited
+			exposure after restart) is provided if just named
+			is updated.
+
+1479.	[bug]		cfg_create_tuple() failed to handle out of
+			memory cleanup.  parse_list() would leak memory
+			on syntax errors.
+
+1478.	[port]		ifconfig.sh didn't account for other virtual
+			interfaces.  It now takes a optional arguement
+			to specify the first interface number. [RT #3907]
+
+1477.	[bug]		memory leak using stub zones and TSIG.
+
+1476.	[port]		win32: port unreachables were blocking further i/o
+			on sockets (Windows 2000 SP2 and later).
+
+1473.	[bug]		create_map() and create_string() failed to handle out
+			of memory cleanup.  [RT #6813]
+
+1472.	[contrib]	idnkit-1.0 from JPNIC, replaces mdnkit.
+
+1471.	[bug]		libbind: updated to BIND 8.4.0.
+
+1470.	[bug]		Incorrect length passed to snprintf. [RT #5966]
+
+1466.	[bug]		lwresd configuration errors resulted in memory
+			and lock leaks.  [RT #5228]
+
+1465.	[bug]		isc_base64_decodestring() and isc_base64_tobuffer()
+			failed to check that trailing bits were zero allowing
+			some invalid base64 strings to be accepted.  [RT #5397]
+
+1464.	[bug]		Preserve "out of zone" data for outgoing zone
+			transfers. [RT #5192]
+
+1463.	[bug]		dns_rdata_from{wire,struct}() failed to catch bad
+			NXT bit maps. [RT #5577]
+
+1462.	[bug]		parse_sizeval() failed to check the token type.
+			[RT #5586]
+
+1461.	[bug]		Remove deadlock from rbtdb code. [RT #5599]
+
+1460.	[bug]		inet_pton() failed to reject certain malformed
+			IPv6 literals.
+
+1459.	[bug]		win32: we were leaking a bits in the exception
+			fd_set resulting in "Socket operation on non-socket"
+			errors from select(). [RT #2966]
+
+1456.	[contrib]	gen-data-queryperf.py from Stephane Bortzmeyer.
+
+1453.	[doc]		ARM: $GENERATE example wasn't accurate. [RT #5298]
+
+1452.	[bug]		Bad #ifdef, ISC_RFC2335 -> ISC_RFC2535.
+
+1451.	[bug]		rndc-confgen didn't exit with a error code for all
+			failures. [RT #5209]
+
+1450.	[bug]		Fetching expired glue failed under certain
+			circumstances.  [RT #5124]
+
+1449.	[bug]		query_addbestns() didn't handle running out of memory
+			gracefully.
+
+1448.	[bug]		Handle empty wildcards labels.
+
+1447.	[bug]		We were casting (unsigned int) to and from (void *).
+			rdataset->private4 is now rdataset->privateuint4
+			to reflect a type change.
+
+1445.	[bug]		DNS_ADBFIND_STARTATROOT broke stub zones.  This has
+			been replaced with DNS_ADBFIND_STARTATZONE which
+			causes the search to start using the closest zone.
+
+1439.	[bug]		Named could return NOERROR with certain NOTIFY
+			failures.  Return NOTAUTH if the NOTIFY zone is
+			not being served.
+
+1435.	[bug]		zmgr_resume_xfrs() was being called read locked
+			rather than write locked.  zmgr_resume_xfrs()
+			was not being called if the zone was being
+			shutdown.
+
+1437.	[bug]		Leave space for stdio to work in. [RT #5033]
+
+1434.	[bug]		"rndc reconfig" failed to initiate the initial
+			zone transfer of new slave zones.
+
+1431.	[bug]		isc_print_snprintf() "%s" with precision could walk off
+			end of argument. [RT #5191]
+
+1429.	[bug]		Prevent the cache getting locked to old servers.
+
+1424.	[bug]		EDNS version not being correctly printed.
+
+1423.	[contrib]	queryperf: added A6 and SRV.
+
+1420.	[port]		solaris: work around gcc optimiser bug.
+
+1419.	[port]		openbsd: use /dev/arandom. [RT #4950]
+
+1418.	[bug]		'rndc reconfig' did not cause new slaves to load.
+
+1416.	[bug]		Empty node should return NOERROR NODATA, not NXDOMAIN.
+			[RT #4715]
+
+1411.	[bug]		empty nodes should stop wildcard matches. [RT #4802]
+
+1408.	[bug]		distclean was not complete. [RT #4700]
+
+1407.	[bug]		lfsr incorrectly implements the shift register.
+			[RT #4617]
+
+1406.	[bug]		dispatch initialises one of the LFSR's with a incorrect
+			polynomial.  [RT #4617]
+
+1405.	[func]		Use arc4random() if available.
+
+1401.	[bug]		adb wasn't clearing state when the timer expired.
+
+1399.	[bug]		Use serial number arithmetic when testing SIG
+			timestamps. [RT #4268]
+
+1397.	[bug]		J.ROOT-SERVERS.NET is now 192.58.128.30.
+
+1389.	[bug]		named could fail to rotate long log files.  [RT #3666]
+
+1388.	[port]		irix: check for sys/sysctl.h and NET_RT_IFLIST before
+			defining HAVE_IFLIST_SYSCTL. [RT #3770]
+
+1387.	[bug]		named could crash due to an access to invalid memory
+			space (which caused an assertion failure) in
+			incremental cleaning.  [RT #3588]
+
+1385.	[bug]		Setting serial-query-rate to 10 would trigger a
+			REQUIRE failure.
+
+1384.	[bug]		host was incompatible with BIND 8 in its exit code and
+			in the output with the -l option.  [RT #3536]
+
+1373.	[bug]		Recovery from expired glue failed under certain
+			circumstances.
+
+1372.	[bug]		named crashes with an assertion failure on exit when
+			sharing the same port for listening and querying, and
+			changing listening addresses several times. [RT# 3509]
+
+1370.	[bug]		dig '+[no]recurse' was incorrectly documented.
+
+1369.	[bug]		Adding an NS record as the lexicographically last
+			record in a secure zone didn't work.
+
+1366.	[contrib]	queryperf usage was incomplete.  Add '-h' for help.
+
+1348.	[port]		win32: Rewrote code to use I/O Completion Ports
+			in socket.c and eliminating a host of socket
+			errors. Performance is enhanced.
+
+1333.	[contrib]	queryperf now reports a summary of returned
+			rcodes (-c), rcodes are printed in mnemonic form (-v).
+
+1299.	[bug]		Set AI_ADDRCONFIG when looking up addresses
+			via getaddrinfo() (affects dig, host, nslookup, rndc
+			and nsupdate).
+
+1199.	[doc]		ARM reference to RFC 2157 should have been RFC 1918.
+			[RT #2436]
+
+1122.	[tuning]	Resolution timeout reduced from 90 to 30 seconds.
+			[RT #2046]
+
+ 992.	[doc]		dig: ~/.digrc is now documented.
+
 	--- 9.2.2 released ---
 
 1428.	[port]		hpux: temporary work around of hpux 11.11 interface
@@ -31,7 +301,7 @@
 
 1427.	[bug]		Race condition in adb with threaded build.
 
-1426.   [cleanup]	Disable RFC2535 style DNSSEC.  This is incompatible
+1426.	[cleanup]	Disable RFC2535 style DNSSEC.  This is incompatible
 			with the forthcoming DS style DNSSEC.
 
 1425.	[port]		linux/libbind: define __USE_MISC when testing *_r()
@@ -48,18 +318,18 @@
 
 	--- 9.2.2rc1 released ---
 
-1357.	[bug]		--enable-libbind would fail when not built in the
+1360.	[bug]		--enable-libbind would fail when not built in the
 			source tree for certain OS's.
 
-1356.	[security]	Support patches OpenSSL libraries.
+1359.	[security]	Support patches OpenSSL libraries.
 			http://www.cert.org/advisories/CA-2002-23.html
 
-1355.	[bug]		It was possible to trigger a INSIST when debugging
+1358.	[bug]		It was possible to trigger a INSIST when debugging
 			large dynamic updates. [RT #3390]
 
-1354.	[bug]		nsupdate was extremely wasteful of memory.
+1357.	[bug]		nsupdate was extremely wasteful of memory.
 
-1355.	[tuning]	Reduce the number of events / quantum for zone tasks.
+1356.	[tuning]	Reduce the number of events / quantum for zone tasks.
 
 1354.	[doc]		lwres man pages had illegal nroff.
 
@@ -176,12 +446,12 @@
 
 1282.	[port]		libbind: hpux 11.11 interface scaning.
 
-1280.	[bug]		libbind: escape '(' and ')' when coverting to
+1280.	[bug]		libbind: escape '(' and ')' when converting to
 			presentation form.
 
 1279.	[port]		Darwin uses (unsigned long) for size_t. [RT #2590]
 
-1276.	[bug]		libbind: const pointer conficts in res_debug.c.
+1276.	[bug]		libbind: const pointer conflicts in res_debug.c.
 
 1275.	[port]		libbind: hpux: treat all hpux systems as BIG_ENDIAN.
 
@@ -198,7 +468,7 @@
 1269.	[port]		Openserver: ifconfig.sh support.
 
 1268.	[port]		Openserver: the value FD_SETSIZE depends on whether
-			<sys/param.h> is included or not.  Be consistant.
+			<sys/param.h> is included or not.  Be consistent.
 
 1266.	[bug]		ISC_LINK_INIT, ISC_LINK_UNLINK, ISC_LIST_DEQUEUE,
 			__ISC_LINK_UNLINKUNSAFE and __ISC_LIST_DEQUEUEUNSAFE
@@ -224,18 +494,18 @@
 1258.	[bug]		libbind: res_nametotype() and res_nametoclass() were
 			broken.
 
-1276.	[contrib]	'queryperf' now has EDNS (-e) + DNSSEC DO (-D) support.
+1257.	[bug]		Failure to write pid-file should not be fatal on
+			reload. [RT #2861]
+
+1256.	[contrib]	'queryperf' now has EDNS (-e) + DNSSEC DO (-D) support.
 
-1275.	[bug]		When verifying that an NXT proves nonexistence, check
+1255.	[bug]		When verifying that an NXT proves nonexistence, check
 			the rcode of the message and only do the matching NXT
 			check.  That is, for NXDOMAIN responses, check that
 			the name is in the range between the NXT owner and
 			next name, and for NOERROR NODATA responses, check
 			that the type is not present in the NXT bitmap.
 
-1257.	[bug]		Failure to write pid-file should not be fatal on
-			reload. [RT #2861]
-
 1253.	[bug]		The dnssec system test failed to remove the correct
 			files.
 
@@ -243,14 +513,14 @@
 			the answer was coming from against the address it was
 			sent to. [RT# 2692]
 
-1248.	[bug]		DESTDIR was not being propogated between makes.
+1248.	[bug]		DESTDIR was not being propagated between makes.
 
 1245.	[bug]		Treat ENOBUFS, ENOMEM and ENFILE as soft errors for
 			accept().
 
 1242.	[bug]		named-checkzone failed if a journal existed. [RT #2657]
 
-1241.	[bug]		Drop received UDP messsages with a zero source port
+1241.	[bug]		Drop received UDP messages with a zero source port
 			as these are invariably forged. [RT #2621]
 
 1209.	[bug]		Dig, host, nslookup were not checking the message ids
@@ -294,7 +564,7 @@
 			INSIST() failures.  [RT #2614]
 
 1238.	[bug]		It is possible to lockup the server when shutting down
-			if notifies are being processed. [RT #2591]
+			if notifies were being processed. [RT #2591]
 
 1237.	[bug]		nslookup: "set q=type" failed.
 
@@ -334,7 +604,7 @@
 			files behind.
 
 1212.	[port]		libbind: 64k answer buffers were causing stack space
-			to be exceeded for certian OS.  Use heap space instead.
+			to be exceeded for certain OS.  Use heap space instead.
 
 1211.	[bug]		dns_name_fromtext() incorrectly handled certain
 			valid octal bitlabels. [RT #2483]
@@ -361,13 +631,13 @@
 			server addresses before sending the update.
 
 1201.	[bug]		Require that if 'callbacks' is passed to
-			dns_rdata_fromtext(), callbacks->error and 
+			dns_rdata_fromtext(), callbacks->error and
 			callbacks->warn are initialized.
 
 1200.	[bug]		Log 'errno' that we are unable to convert to
 			isc_result_t. [RT #2404]
 
-1198.	[bug]		OPT printing style was not consistant with the way the
+1198.	[bug]		OPT printing style was not consistent with the way the
 			header fields are printed.  The DO bit was not reported
 			if set.  Report if any of the MBZ bits are set.
 
@@ -384,7 +654,7 @@
 
 1193.	[bug]		Best effort parsing didn't handle packet truncation.
 
-1191.   [bug]           A dynamic update removing the last non-apex name in
+1191.	[bug]		A dynamic update removing the last non-apex name in
 			a secure zone would fail. [RT #2399]
 
 1189.	[bug]		On some systems, malloc(0) returns NULL, which
@@ -394,8 +664,8 @@
 1188.	[bug]		Dynamic updates of a signed zone would fail if
 			some of the zone private keys were unavailable.
 
-1186.   [bug]           isc_hex_tobuffer(,,length = 0) failed to unget the
-                        EOL token when reading to end of line.
+1186.	[bug]		isc_hex_tobuffer(,,length = 0) failed to unget the
+			EOL token when reading to end of line.
 
 1185.	[bug]		libbind: don't assume statp->_u._ext.ext is valid
 			unless RES_INIT is set when calling res_*init().
@@ -424,7 +694,7 @@
 1173.	[bug]		Potential memory leaks in isc_log_create() and
 			isc_log_settag(). [RT #2336]
 
-1172.	[doc]		Add CERT, GPOS, KX, NAPTR, NSAP, PX and TXT to 
+1172.	[doc]		Add CERT, GPOS, KX, NAPTR, NSAP, PX and TXT to
 			table of RR types in ARM.
 
 1170.	[bug]		Don't attempt to print the token when a I/O error
@@ -474,7 +744,7 @@
 1140.	[bug]		rndc-confgen did not accept IPv6 addresses as arguments
 			to the -s option. [RT #2138]
 
-1136.	[bug]		CNAME records synthesized from DNAMEs did not
+1136.	[bug]		CNAME records synthesised from DNAMEs did not
 			have a TTL of zero as required by RFC2672.
 			[RT #2129]
 
@@ -519,7 +789,7 @@
 
 	--- 9.2.0 released ---
 
-1134.	[bug]		Multithreaded servers could deadlock in ferror()
+1134.	[bug]		Multi-threaded servers could deadlock in ferror()
 			when reloading zone files. [RT #1951, #1998]
 
 1133.	[bug]		IN6_IS_ADDR_LOOPBACK was not portably defined on
@@ -534,7 +804,7 @@
 			did not include the out-of-range number but the
 			following token. [RT #2076]
 
-1129.	[bug]		Multithreaded servers could crash under heavy
+1129.	[bug]		Multi-threaded servers could crash under heavy
 			resolution load due to a race condition. [RT #2018]
 
 1126.	[bug]		The server could access a freed event if shut
@@ -547,13 +817,13 @@
 
 1120.	[bug]		Errors in options were not fatal. [RT #2002]
 
-1118.	[bug]		On multithreaded servers, a race condition
+1118.	[bug]		On multi-threaded servers, a race condition
 			could cause an assertion failure in resolver.c
 			during resolver shutdown. [RT #2029]
 
 1117.	[port]		The configure check for in6addr_loopback incorrectly
 			succeeded on AIX 4.3 when compiling with -O2
-			because the test code was optimized away.
+			because the test code was optimised away.
 			[RT #2016]
 
 1116.	[bug]		Setting transfers in a server clause, transfers-in,
@@ -565,8 +835,8 @@
 1113.	[bug]		The allow-update-forwarding option was ignored
 			when specified in a view. [RT #2014]
 
-1111.	[bug]		Multithreaded servers could deadlock processing
-			recursive queries due to a locking hieararchy
+1111.	[bug]		Multi-threaded servers could deadlock processing
+			recursive queries due to a locking hierarchy
 			violation in adb.c. [RT #2017]
 
 	--- 9.2.0rc9 released ---
@@ -604,8 +874,8 @@
 
 1090.	[bug]		libbind: dns_ho.c:add_hostent() was not returning
 			the amount of memory consumed resulting in garbage
-			address being returned.	 Alignment calculations were   
-			wasting space.	We weren't suppressing duplicate
+			address being returned.  Alignment calculations were
+			wasting space.  We weren't suppressing duplicate
 			addresses.
 
 1088.	[port]		libbind: MPE/iX C.70 (incomplete)
@@ -620,7 +890,7 @@
 1084.	[cleanup]	libbind: gai_strerror() rewritten.
 
 1083.	[bug]		The default control channel listened on the
-			wildcard adress, not the loopback as documented.
+			wildcard address, not the loopback as documented.
 			[RT #1975]
 
 1082.	[bug]		The -g option to named incorrectly caused logging
@@ -650,6 +920,7 @@
 			are unable to scan the interface list. [RT #1921]
 
 1063.	[bug]		libbind: "make install" was failing on IRIX.
+			[RT #1919]
 
 1062.	[bug]		If the control channel listener socket was shut
 			down before server exit, the listener object could
@@ -779,7 +1050,7 @@
 1015.	[bug]		Log channels that had a "versions" option but no
 			"size" option failed to create numbered log
 			files. [RT #1783]
- 
+
 	--- 9.2.0rc4 released ---
 
 
@@ -822,7 +1093,7 @@
  986.	[bug]		"dig +noall" failed to clear stats and command
 			printing.
 
- 984.	[bug]		Multithreading should be enabled by default on
+ 984.	[bug]		Multi-threading should be enabled by default on
 			Solaris 2.7 and newer, but it wasn't.
 
 	--- 9.2.0rc2 released ---
@@ -1002,7 +1273,7 @@
 			[RT #1423]
 
  926.	[bug]		The resolver could deadlock with the ADB when
-			shutting down (multithreaded builds only).
+			shutting down (multi-threaded builds only).
 			[RT #1324]
 
  925.	[cleanup]	Remove openssl from the distribution; require that
@@ -1085,7 +1356,7 @@
  900.	[bug]		A config.guess update changed the system identification
 			string of FreeBSD systems; configure and
 			bin/tests/system/ifconfig.sh now recognize the new
-			string. 
+			string.
 
 	--- 9.2.0a2 released ---
 
@@ -1150,13 +1421,13 @@
 			"severity debug 0;" like it did in BIND 9.1.
 			[RT #1367]
 
- 864.	[cleanup]	Multithreading is now enabled by default on
+ 864.	[cleanup]	Multi-threading is now enabled by default on
 			OSF1, Solaris 2.7 and newer, AIX, IRIX, and HP-UX.
 
  863.	[bug]		If an error occurred while an outgoing zone transfer
 			was starting up, the server could access a domain
 			name that had already been freed when logging a
-			message saying that the transfer was starting. 
+			message saying that the transfer was starting.
 			[RT #1383]
 
  862.	[bug]		Use after realloc(), non portable pointer arithmetic in
@@ -1228,7 +1499,7 @@
 			just as <lwres/net.h> does.
 
  843.	[func]		If no controls statement is present in named.conf,
-			or if any inet phrase of a controls statement is 
+			or if any inet phrase of a controls statement is
 			lacking a keys clause, then a key will be automatically
 			generated by named and an rndc.conf-style file
 			named named.key will be written that uses it.  rndc
@@ -1251,7 +1522,7 @@
  838.	[port]		UnixWare 7.x.x is now suported by
 			bin/tests/system/ifconfig.sh.
 
- 837.	[cleanup]	Multithreading is now enabled by default only on
+ 837.	[cleanup]	Multi-threading is now enabled by default only on
 			OSF1, Solaris 2.7 and newer, and AIX.
 
  836.	[func]		Upgraded libtool to 1.4.
@@ -1294,7 +1565,7 @@
  826.	[bug]		Some IXFR protocol errors were not detected.
 
  825.	[bug]		zone.c:ns_query() detached from the wrong zone
-			reference. [RT #1264] 
+			reference. [RT #1264]
 
  824.	[bug]		Correct line numbers reported by dns_master_load().
 			[RT #1263]
@@ -1765,7 +2036,7 @@
 			a offset from the current time.
 
  673.	[func]		The server can now convert RFC1886-style recursive
-			lookup requests into RFC2874-style lookups, when 
+			lookup requests into RFC2874-style lookups, when
 			enabled using the new option "allow-v6-synthesis".
 
  672.	[bug]		The wrong time was in the "time signed" field when
@@ -1901,7 +2172,7 @@
 
  633.	[port]		Cope with rlim_t missing on BSD/OS systems. [RT #575]
 
- 632.	[bug]		The index array of the journal file was 
+ 632.	[bug]		The index array of the journal file was
 			corrupted as it was written to disk.
 
  631.	[port]		Build without thread support on systems without
@@ -1958,7 +2229,7 @@
  616.	[func]		dnssec-signzone -t output now includes performance
 			statistics.
 
- 615.	[bug]		dnssec-signzone did not like child keysets signed 
+ 615.	[bug]		dnssec-signzone did not like child keysets signed
 			by multiple keys.
 
  614.	[bug]		Checks for uninitialized link fields were prone
@@ -2018,7 +2289,7 @@
  598.	[bug]		An update-policy statement would cause the server
 			to assert while loading. [RT #536]
 
- 597.	[func]		dnssec-signzone is now multithreaded.
+ 597.	[func]		dnssec-signzone is now multi-threaded.
 
  596.	[bug]		DNS_RDATASLAB_FORCE and DNS_RDATASLAB_EXACT are
 			not mutually exclusive.
@@ -2046,10 +2317,10 @@
  590.	[doc]		There are now man pages for the lwres library in
 			doc/man/lwres.
 
- 589.	[bug]		The server could deadlock if a zone was updated 
+ 589.	[bug]		The server could deadlock if a zone was updated
 			while being transferred out.
 
- 588.	[bug]		ctx->in_use was not being correctly initialised when
+ 588.	[bug]		ctx->in_use was not being correctly initialized when
 			when pushing a file for $INCLUDE. [RT #523]
 
  587.	[func]		A warning is now printed if the "allow-update"
@@ -2155,15 +2426,15 @@
 			is now implemented.  Responses to queries without
 			this bit set will not contain any DNSSEC records.
 
- 555.	[bug]		A slave server attempting a zone transfer could 
+ 555.	[bug]		A slave server attempting a zone transfer could
 			crash with an assertion failure on certain
 			malformed responses from the master. [RT #457]
 
  554.	[bug]		In some cases, not all of the dnssec tools were
 			properly installed.
 
- 553.	[bug]		Incoming zone transfers deferred due to quota 
-			were not started when quota was increased but 
+ 553.	[bug]		Incoming zone transfers deferred due to quota
+			were not started when quota was increased but
 			only when a transfer in progress finished. [RT #456]
 
  552.	[bug]		We were not correctly detecting the end of all c-style
@@ -2229,7 +2500,7 @@
 
  529.	[bug]		521 contained a bug which caused zones to always
 			reload.	 [RT #410]
-	
+
  528.	[func]		The ISC_LIST_XXXX macros now perform sanity checks
 			on their arguments.  ISC_LIST_XXXXUNSAFE can be use
 			to skip the checks however use with caution.
@@ -2262,7 +2533,7 @@
 			reload. [RT #196]
 
  520.	[bug]		Upgraded libtool to 1.3.5, which makes shared
-			library builds almost work on AIX (and possibly 
+			library builds almost work on AIX (and possibly
 			others).
 
  519.	[bug]		dns_name_split() would improperly split some bitstring
@@ -2335,7 +2606,7 @@
 			This allows hosts with the same name as a class or
 			type to be looked up.
 
- 498.	[doc]		There is now a man page for "dig" 
+ 498.	[doc]		There is now a man page for "dig"
 			in doc/man/bin/dig.1.
 
  497.	[bug]		The error messages printed when an IP match list
@@ -2378,12 +2649,12 @@
 			send all of the messages at the same time.  Add
 			rate limiting of the transmitted messages.
 
- 484.	[bug]		When the server was reloaded after removing addresses 
+ 484.	[bug]		When the server was reloaded after removing addresses
 			from the named.conf "listen-on" statement, sockets
 			were still listening on the removed addresses due
 			to reference count loops. [RT #325]
 
- 483.	[bug]		nslookup: "set all" showed a "search" option but it 
+ 483.	[bug]		nslookup: "set all" showed a "search" option but it
 			was not settable.
 
  482.	[bug]		nslookup: a plain "server" or "lserver" should be
@@ -2419,7 +2690,7 @@
 			as CH. [RT #305]
 
  473.	[bug]		nsupdate overran the end of the list of name servers
-			when no servers could be reached, typically causing 
+			when no servers could be reached, typically causing
 			it to print the error message "dns_request_create:
 			not implemented".
 
@@ -2464,7 +2735,7 @@
 			[RT #305]
 
  457.	[bug]		Dig/host/hslookup didn't properly handle connect
-			timeouts in certain situations, causing an 
+			timeouts in certain situations, causing an
 			unnecessary warning message to be printed.
 
  456.	[bug]		Stub zones were not resetting the refresh and expire
@@ -2512,7 +2783,7 @@
 
  443.	[bug]		When loading a master file failed because of an
 			unrecognized RR type name, the error message
-			did not include the file name and line number. 
+			did not include the file name and line number.
 			[RT #285]
 
  442.	[bug]		TSIG signed messages that did not match any view
@@ -2535,7 +2806,7 @@
 			not logged at a high enough logging level to be
 			useful in diagnosing this situation. [RT #275]
 
- 435.	[bug]		dns_zone_dump() overwrote existing zone files 
+ 435.	[bug]		dns_zone_dump() overwrote existing zone files
 			rather than writing to a temporary file and
 			renaming.  This could lead to empty or partial
 			zone files being left around in certain error
@@ -2546,7 +2817,7 @@
  434.	[func]		New function isc_file_isabsolute().
 
  433.	[func]		isc_base64_decodestring() now accepts newlines
-			within the base64 data.	 This makes it possible 
+			within the base64 data.	 This makes it possible
 			to break up the key data in a "trusted-keys"
 			statement into multiple lines. [RT #284]
 
@@ -2608,7 +2879,7 @@
 
  417.	[func]		Add isc_app_block() and isc_app_unblock(), which
 			allow an application to handle signals while
-			blocking.		
+			blocking.
 
  416.	[bug]		Slave zones with no master file tried to use a
 			NULL pointer for a journal file name when they
@@ -2616,7 +2887,7 @@
 
  415.	[bug]		The logging code leaked file descriptors.
 
- 414.	[bug]		Server did not shut down until all incoming zone 
+ 414.	[bug]		Server did not shut down until all incoming zone
 			transfers were finished.
 
  413.	[bug]		Notify could attempt to use the zone database after
@@ -2663,7 +2934,7 @@
 			assertion failure trying to perform zone
 			maintenance on, or sending notifies from,
 			tentatively created zones whose	views were
-			never fully configured and lacked an address 
+			never fully configured and lacked an address
 			database and request manager.
 
  398.	[bug]		"dig" sometimes caught an assertion failure when
@@ -2672,7 +2943,7 @@
  397.	[func]		Added utility functions dns_view_gettsig() and
 			dns_view_getpeertsig().
 
- 396.	[doc]		There is now a man page for "nsupdate" 
+ 396.	[doc]		There is now a man page for "nsupdate"
 			in doc/man/bin/nsupdate.8.
 
  395.	[bug]		nslookup printed incorrect RR type mnemonics
@@ -2688,17 +2959,17 @@
 			descriptors.
 
  392.	[func]		Add ISC_R_FAMILYNOSUPPORT.  Returned when OS does
-			not support the given address family requested. 
+			not support the given address family requested.
 
  391.	[clarity]	ISC_R_FAMILY -> ISC_R_FAMILYMISMATCH.
 
  390.	[func]		The function dns_zone_setdbtype() now takes
-			an argc/argv style vector of words and sets 
+			an argc/argv style vector of words and sets
 			both the zone database type and its arguments,
 			making the functions dns_zone_adddbarg()
 			and dns_zone_cleardbargs() unnecessary.
 
- 389.	[bug]		Attempting to send a reqeust over IPv6 using 
+ 389.	[bug]		Attempting to send a reqeust over IPv6 using
 			dns_request_create() on a system without IPv6
 			support caused an assertion failure [RT #235].
 
@@ -2733,7 +3004,7 @@
  378.	[func]		named and lwresd will log the command line arguments
 			they were started with in the "starting ..." message.
 
- 377.	[bug]		When additional data lookups were refused due to 
+ 377.	[bug]		When additional data lookups were refused due to
 			"allow-query", the databases were still being
 			attached causing reference leaks.
 
@@ -2758,10 +3029,10 @@
  370.	[bug]		The error messages for rollforward failures were
 			overly terse.
 
- 369.	[func]		Support new named.conf options, view and zone 
-			statements: 
+ 369.	[func]		Support new named.conf options, view and zone
+			statements:
 
-				max-retry-time, min-retry-time, 
+				max-retry-time, min-retry-time,
 				max-refresh-time, min-refresh-time.
 
  368.	[func]		Restructure the internal ".bind" view so that more
@@ -2828,7 +3099,7 @@
  347.	[bug]		Don't crash if an argument is left off options in dig.
 
  346.	[func]		Add support for .digrc config file, in the
-			user's current directory
+			user's current directory.
 
  345.	[bug]		Large-scale changes/cleanups to dig:
 			* Significantly improve structure handling
@@ -3017,7 +3288,7 @@
 			enough to hold any legal domain name in presentation
 			format + terminating NULL.
 
- 301.	[bug]		Uninitialised pointer in host:printmessage(). [RT #159]
+ 301.	[bug]		Uninitialized pointer in host:printmessage(). [RT #159]
 
  300.	[bug]		Using both <isc/net.h> and <lwres/net.h> didn't work
 			on platforms lacking IPv6 because each included their
@@ -3046,7 +3317,7 @@
 			not constructed by dns_message_parse(),
 			dns_message_findname() failed to find anything
 			due to checking for attribute bits that are set
-			only in dns_message_parse().   This caused an
+			only in dns_message_parse().  This caused an
 			infinite loop when constructing the response to
 			an ANY query at a CNAME in a secure zone.
 
@@ -3190,7 +3461,7 @@
  257.	[bug]		The server detached the last zone manager reference
 			too early, while it could still be in use by queries.
 			This manifested itself as assertion failures during the
-			shutdown process for busy name servers [RT #133].
+			shutdown process for busy name servers. [RT #133]
 
  256.	[func]		isc_ratelimiter_t now has attach/detach semantics, and
 			isc_ratelimiter_shutdown guarantees that the rate
@@ -3909,7 +4180,7 @@
 			caller find the most-enclosing superdomain of
 			a name.
 
-  63	[func]		Generate NOTIFY messages.
+  63.	[func]		Generate NOTIFY messages.
 
   62.	[func]		Add UDP refresh support.