update to BIND v9.2.3. ok todd@

166 files changed, 4207 insertions, 2612 deletions

diff --git a/usr.sbin/bind/CHANGES b/usr.sbin/bind/CHANGES
index 651a68de711..fc40d82d20b 100644
--- a/usr.sbin/bind/CHANGES
+++ b/usr.sbin/bind/CHANGES
@@ -1,5 +1,27 @@
 
-	--- 9.2.2-P3 released ---
+	--- 9.2.3 released ---
+
+1525.	[bug]		dns_cache_create() could trigger a REQUIRE
+			failure in isc_mem_put() during error cleanup.
+
+1524.	[port]		AIX needs to be able to resolve all symbols when
+			creating shared libraries (--with-libtool).
+
+1523.	[bug]		Fix race condition in rbtdb. [RT# 9189]
+
+1522.	[bug]		dns_db_findnode() relax the requirements on 'name'.
+			[RT# 9286]
+
+1518.   [bug]           dns_nxt_buildrdata(), and hence dns_nxt_build(),
+			contained a off-by-one error when working out the
+			number of octets in the bitmap.
+
+1514.	[bug]		named: isc_hash_destroy() was being called too early.
+			[RT #9160]
+
+1513.	[doc]		Add "US" to root-delegation-only exclude list.
+
+	--- 9.2.3rc4 released ---
 
 1512.	[bug]		Extend the delegation-only logging to return query
 			type, class and responding nameserver.
@@ -7,7 +29,17 @@
 1511.	[bug]		delegation-only was generating false positives
 			on negative answers from subzones.
 
-	--- 9.2.2-P2 released ---
+	--- 9.2.3rc3 released ---
+
+1510.	[func]		New view option "root-delegation-only".  Apply
+			delegation-only check to all TLDs and root.
+			Note there are some TLDs that are NOT delegation
+			only (e.g. DE, LV, US and MUSEUM) these can be excluded
+			from the checks by using exclude.
+
+			root-delegation-only exclude {
+				"DE"; "LV"; "US"; "MUSEUM";
+			};
 
 1509.	[bug]		Hint zones should accept delegation-only.  Forward
 			zone should not accept delegation-only.
@@ -20,10 +52,248 @@
 
 1506.	[bug]		Wrong return type for dns_view_isdelegationonly().
 
-	--- 9.2.2-P1 released ---
+	--- 9.2.3rc2 released ---
+
+1505.	[bug]		Uninitialised rdataset in sdb. [RT #8750]
 
 1504.	[func]		New zone type "delegation-only".
 
+1503.	[port]		win32: install libeay32.dll outside of system32.
+
+	--- 9.2.3rc1 released ---
+
+1499.	[bug]		isc_random need to be seeded better if arc4random()
+			is not used.
+
+1498.	[port]		bsdos: 5.x support.
+
+1497.	[protocol]	dig, nslookup and host now perform nibble lookups
+			under IP6.ARPA, use -i for IP6.INT (dig and host).
+			lwres now uses IP6.ARPA.
+
+1496.	[port]		test for pthread_attr_setstacksize().
+
+1495.	[cleanup]	Replace hash functions with universal hash.
+
+1494.	[security]	Turn on RSA BLINDING as a precaution.
+
+1493.	[doc]		A6 and "bitstring" labels are now experimental.
+
+1492.	[cleanup]	Preserve rwlock quota context when upgrading /
+			downgrading. [RT #5599]
+
+1491.	[bug]		dns_master_dump*() would produce extraneous $ORIGIN
+			lines. [RT #6206]
+
+1490.	[bug]		Accept reading state as well as working state in
+			ns_client_next(). [RT #6813]
+			
+1489.	[compat]	Treat 'allow-update' on slave zones as a warning.
+			[RT #3469]
+
+1488.	[bug]		Don't override trust levels for glue addresses.
+			[RT #5764]
+
+1487.	[bug]		A REQUIRE() failure could be triggered if a zone was
+			queued for transfer and the zone was then removed.
+			[RT #6189]
+
+1486.	[bug]		isc_print_snprintf() '%%' consumed one too many format
+			characters. [RT# 8230]
+
+1485.	[bug]		gen failed to handle high type values. [RT #6225]
+
+1484.	[bug]		The number of records reported after a AXFR was wrong.
+			[RT #6229]
+
+1483.	[bug]		dig axfr failed if the message id in the answer failed
+			to match that in the request.  Only the id in the first
+			message is required to match. [RT #8138]
+
+1482.	[bug]		named could fail to start if the kernel supports
+			IPv6 but no interfaces are configured.  Similarly
+			for IPv4. [RT #6229]
+			
+1481.	[bug]		Refresh and stub queries failed to use masters keys
+			if specified. [RT #7391]
+
+1480.	[bug]		Provide replay protection for rndc commands.  Full
+			replay protection requires both rndc and named to
+			be updated.  Partial replay protection (limited
+			exposure after restart) is provided if just named
+			is updated.
+
+1479.	[bug]		cfg_create_tuple() failed to handle out of
+			memory cleanup.  parse_list() would leak memory
+			on syntax errors.
+
+1478.	[port]		ifconfig.sh didn't account for other virtual
+			interfaces.  It now takes a optional arguement
+			to specify the first interface number. [RT #3907]
+
+1477.	[bug]		memory leak using stub zones and TSIG.
+
+1476.	[port]		win32: port unreachables were blocking further i/o
+			on sockets (Windows 2000 SP2 and later).
+
+1473.	[bug]		create_map() and create_string() failed to handle out
+			of memory cleanup.  [RT #6813]
+
+1472.	[contrib]	idnkit-1.0 from JPNIC, replaces mdnkit.
+
+1471.	[bug]		libbind: updated to BIND 8.4.0.
+
+1470.	[bug]		Incorrect length passed to snprintf. [RT #5966]
+
+1466.	[bug]		lwresd configuration errors resulted in memory
+			and lock leaks.  [RT #5228]
+
+1465.	[bug]		isc_base64_decodestring() and isc_base64_tobuffer()
+			failed to check that trailing bits were zero allowing
+			some invalid base64 strings to be accepted.  [RT #5397]
+
+1464.	[bug]		Preserve "out of zone" data for outgoing zone
+			transfers. [RT #5192]
+
+1463.	[bug]		dns_rdata_from{wire,struct}() failed to catch bad
+			NXT bit maps. [RT #5577]
+
+1462.	[bug]		parse_sizeval() failed to check the token type.
+			[RT #5586]
+
+1461.	[bug]		Remove deadlock from rbtdb code. [RT #5599]
+
+1460.	[bug]		inet_pton() failed to reject certain malformed
+			IPv6 literals.
+
+1459.	[bug]		win32: we were leaking a bits in the exception
+			fd_set resulting in "Socket operation on non-socket"
+			errors from select(). [RT #2966]
+
+1456.	[contrib]	gen-data-queryperf.py from Stephane Bortzmeyer.
+
+1453.	[doc]		ARM: $GENERATE example wasn't accurate. [RT #5298]
+
+1452.	[bug]		Bad #ifdef, ISC_RFC2335 -> ISC_RFC2535.
+
+1451.	[bug]		rndc-confgen didn't exit with a error code for all
+			failures. [RT #5209]
+
+1450.	[bug]		Fetching expired glue failed under certain
+			circumstances.  [RT #5124]
+
+1449.	[bug]		query_addbestns() didn't handle running out of memory
+			gracefully.
+
+1448.	[bug]		Handle empty wildcards labels.
+
+1447.	[bug]		We were casting (unsigned int) to and from (void *).
+			rdataset->private4 is now rdataset->privateuint4
+			to reflect a type change.
+
+1445.	[bug]		DNS_ADBFIND_STARTATROOT broke stub zones.  This has
+			been replaced with DNS_ADBFIND_STARTATZONE which
+			causes the search to start using the closest zone.
+
+1439.	[bug]		Named could return NOERROR with certain NOTIFY
+			failures.  Return NOTAUTH if the NOTIFY zone is
+			not being served.
+
+1435.	[bug]		zmgr_resume_xfrs() was being called read locked
+			rather than write locked.  zmgr_resume_xfrs()
+			was not being called if the zone was being
+			shutdown.
+
+1437.	[bug]		Leave space for stdio to work in. [RT #5033]
+
+1434.	[bug]		"rndc reconfig" failed to initiate the initial
+			zone transfer of new slave zones.
+
+1431.	[bug]		isc_print_snprintf() "%s" with precision could walk off
+			end of argument. [RT #5191]
+
+1429.	[bug]		Prevent the cache getting locked to old servers.
+
+1424.	[bug]		EDNS version not being correctly printed.
+
+1423.	[contrib]	queryperf: added A6 and SRV.
+
+1420.	[port]		solaris: work around gcc optimiser bug.
+
+1419.	[port]		openbsd: use /dev/arandom. [RT #4950]
+
+1418.	[bug]		'rndc reconfig' did not cause new slaves to load.
+
+1416.	[bug]		Empty node should return NOERROR NODATA, not NXDOMAIN.
+			[RT #4715]
+
+1411.	[bug]		empty nodes should stop wildcard matches. [RT #4802]
+
+1408.	[bug]		distclean was not complete. [RT #4700]
+
+1407.	[bug]		lfsr incorrectly implements the shift register.
+			[RT #4617]
+
+1406.	[bug]		dispatch initialises one of the LFSR's with a incorrect
+			polynomial.  [RT #4617]
+
+1405.	[func]		Use arc4random() if available.
+
+1401.	[bug]		adb wasn't clearing state when the timer expired.
+
+1399.	[bug]		Use serial number arithmetic when testing SIG
+			timestamps. [RT #4268]
+
+1397.	[bug]		J.ROOT-SERVERS.NET is now 192.58.128.30.
+
+1389.	[bug]		named could fail to rotate long log files.  [RT #3666]
+
+1388.	[port]		irix: check for sys/sysctl.h and NET_RT_IFLIST before
+			defining HAVE_IFLIST_SYSCTL. [RT #3770]
+
+1387.	[bug]		named could crash due to an access to invalid memory
+			space (which caused an assertion failure) in
+			incremental cleaning.  [RT #3588]
+
+1385.	[bug]		Setting serial-query-rate to 10 would trigger a
+			REQUIRE failure.
+
+1384.	[bug]		host was incompatible with BIND 8 in its exit code and
+			in the output with the -l option.  [RT #3536]
+
+1373.	[bug]		Recovery from expired glue failed under certain
+			circumstances.
+
+1372.	[bug]		named crashes with an assertion failure on exit when
+			sharing the same port for listening and querying, and
+			changing listening addresses several times. [RT# 3509]
+
+1370.	[bug]		dig '+[no]recurse' was incorrectly documented.
+
+1369.	[bug]		Adding an NS record as the lexicographically last
+			record in a secure zone didn't work.
+
+1366.	[contrib]	queryperf usage was incomplete.  Add '-h' for help.
+
+1348.	[port]		win32: Rewrote code to use I/O Completion Ports
+			in socket.c and eliminating a host of socket
+			errors. Performance is enhanced.
+
+1333.	[contrib]	queryperf now reports a summary of returned
+			rcodes (-c), rcodes are printed in mnemonic form (-v).
+
+1299.	[bug]		Set AI_ADDRCONFIG when looking up addresses
+			via getaddrinfo() (affects dig, host, nslookup, rndc
+			and nsupdate).
+
+1199.	[doc]		ARM reference to RFC 2157 should have been RFC 1918.
+			[RT #2436]
+
+1122.	[tuning]	Resolution timeout reduced from 90 to 30 seconds.
+			[RT #2046]
+
+ 992.	[doc]		dig: ~/.digrc is now documented.
+
 	--- 9.2.2 released ---
 
 1428.	[port]		hpux: temporary work around of hpux 11.11 interface
@@ -31,7 +301,7 @@
 
 1427.	[bug]		Race condition in adb with threaded build.
 
-1426.   [cleanup]	Disable RFC2535 style DNSSEC.  This is incompatible
+1426.	[cleanup]	Disable RFC2535 style DNSSEC.  This is incompatible
 			with the forthcoming DS style DNSSEC.
 
 1425.	[port]		linux/libbind: define __USE_MISC when testing *_r()
@@ -48,18 +318,18 @@
 
 	--- 9.2.2rc1 released ---
 
-1357.	[bug]		--enable-libbind would fail when not built in the
+1360.	[bug]		--enable-libbind would fail when not built in the
 			source tree for certain OS's.
 
-1356.	[security]	Support patches OpenSSL libraries.
+1359.	[security]	Support patches OpenSSL libraries.
 			http://www.cert.org/advisories/CA-2002-23.html
 
-1355.	[bug]		It was possible to trigger a INSIST when debugging
+1358.	[bug]		It was possible to trigger a INSIST when debugging
 			large dynamic updates. [RT #3390]
 
-1354.	[bug]		nsupdate was extremely wasteful of memory.
+1357.	[bug]		nsupdate was extremely wasteful of memory.
 
-1355.	[tuning]	Reduce the number of events / quantum for zone tasks.
+1356.	[tuning]	Reduce the number of events / quantum for zone tasks.
 
 1354.	[doc]		lwres man pages had illegal nroff.
 
@@ -176,12 +446,12 @@
 
 1282.	[port]		libbind: hpux 11.11 interface scaning.
 
-1280.	[bug]		libbind: escape '(' and ')' when coverting to
+1280.	[bug]		libbind: escape '(' and ')' when converting to
 			presentation form.
 
 1279.	[port]		Darwin uses (unsigned long) for size_t. [RT #2590]
 
-1276.	[bug]		libbind: const pointer conficts in res_debug.c.
+1276.	[bug]		libbind: const pointer conflicts in res_debug.c.
 
 1275.	[port]		libbind: hpux: treat all hpux systems as BIG_ENDIAN.
 
@@ -198,7 +468,7 @@
 1269.	[port]		Openserver: ifconfig.sh support.
 
 1268.	[port]		Openserver: the value FD_SETSIZE depends on whether
-			<sys/param.h> is included or not.  Be consistant.
+			<sys/param.h> is included or not.  Be consistent.
 
 1266.	[bug]		ISC_LINK_INIT, ISC_LINK_UNLINK, ISC_LIST_DEQUEUE,
 			__ISC_LINK_UNLINKUNSAFE and __ISC_LIST_DEQUEUEUNSAFE
@@ -224,18 +494,18 @@
 1258.	[bug]		libbind: res_nametotype() and res_nametoclass() were
 			broken.
 
-1276.	[contrib]	'queryperf' now has EDNS (-e) + DNSSEC DO (-D) support.
+1257.	[bug]		Failure to write pid-file should not be fatal on
+			reload. [RT #2861]
+
+1256.	[contrib]	'queryperf' now has EDNS (-e) + DNSSEC DO (-D) support.
 
-1275.	[bug]		When verifying that an NXT proves nonexistence, check
+1255.	[bug]		When verifying that an NXT proves nonexistence, check
 			the rcode of the message and only do the matching NXT
 			check.  That is, for NXDOMAIN responses, check that
 			the name is in the range between the NXT owner and
 			next name, and for NOERROR NODATA responses, check
 			that the type is not present in the NXT bitmap.
 
-1257.	[bug]		Failure to write pid-file should not be fatal on
-			reload. [RT #2861]
-
 1253.	[bug]		The dnssec system test failed to remove the correct
 			files.
 
@@ -243,14 +513,14 @@
 			the answer was coming from against the address it was
 			sent to. [RT# 2692]
 
-1248.	[bug]		DESTDIR was not being propogated between makes.
+1248.	[bug]		DESTDIR was not being propagated between makes.
 
 1245.	[bug]		Treat ENOBUFS, ENOMEM and ENFILE as soft errors for
 			accept().
 
 1242.	[bug]		named-checkzone failed if a journal existed. [RT #2657]
 
-1241.	[bug]		Drop received UDP messsages with a zero source port
+1241.	[bug]		Drop received UDP messages with a zero source port
 			as these are invariably forged. [RT #2621]
 
 1209.	[bug]		Dig, host, nslookup were not checking the message ids
@@ -294,7 +564,7 @@
 			INSIST() failures.  [RT #2614]
 
 1238.	[bug]		It is possible to lockup the server when shutting down
-			if notifies are being processed. [RT #2591]
+			if notifies were being processed. [RT #2591]
 
 1237.	[bug]		nslookup: "set q=type" failed.
 
@@ -334,7 +604,7 @@
 			files behind.
 
 1212.	[port]		libbind: 64k answer buffers were causing stack space
-			to be exceeded for certian OS.  Use heap space instead.
+			to be exceeded for certain OS.  Use heap space instead.
 
 1211.	[bug]		dns_name_fromtext() incorrectly handled certain
 			valid octal bitlabels. [RT #2483]
@@ -361,13 +631,13 @@
 			server addresses before sending the update.
 
 1201.	[bug]		Require that if 'callbacks' is passed to
-			dns_rdata_fromtext(), callbacks->error and 
+			dns_rdata_fromtext(), callbacks->error and
 			callbacks->warn are initialized.
 
 1200.	[bug]		Log 'errno' that we are unable to convert to
 			isc_result_t. [RT #2404]
 
-1198.	[bug]		OPT printing style was not consistant with the way the
+1198.	[bug]		OPT printing style was not consistent with the way the
 			header fields are printed.  The DO bit was not reported
 			if set.  Report if any of the MBZ bits are set.
 
@@ -384,7 +654,7 @@
 
 1193.	[bug]		Best effort parsing didn't handle packet truncation.
 
-1191.   [bug]           A dynamic update removing the last non-apex name in
+1191.	[bug]		A dynamic update removing the last non-apex name in
 			a secure zone would fail. [RT #2399]
 
 1189.	[bug]		On some systems, malloc(0) returns NULL, which
@@ -394,8 +664,8 @@
 1188.	[bug]		Dynamic updates of a signed zone would fail if
 			some of the zone private keys were unavailable.
 
-1186.   [bug]           isc_hex_tobuffer(,,length = 0) failed to unget the
-                        EOL token when reading to end of line.
+1186.	[bug]		isc_hex_tobuffer(,,length = 0) failed to unget the
+			EOL token when reading to end of line.
 
 1185.	[bug]		libbind: don't assume statp->_u._ext.ext is valid
 			unless RES_INIT is set when calling res_*init().
@@ -424,7 +694,7 @@
 1173.	[bug]		Potential memory leaks in isc_log_create() and
 			isc_log_settag(). [RT #2336]
 
-1172.	[doc]		Add CERT, GPOS, KX, NAPTR, NSAP, PX and TXT to 
+1172.	[doc]		Add CERT, GPOS, KX, NAPTR, NSAP, PX and TXT to
 			table of RR types in ARM.
 
 1170.	[bug]		Don't attempt to print the token when a I/O error
@@ -474,7 +744,7 @@
 1140.	[bug]		rndc-confgen did not accept IPv6 addresses as arguments
 			to the -s option. [RT #2138]
 
-1136.	[bug]		CNAME records synthesized from DNAMEs did not
+1136.	[bug]		CNAME records synthesised from DNAMEs did not
 			have a TTL of zero as required by RFC2672.
 			[RT #2129]
 
@@ -519,7 +789,7 @@
 
 	--- 9.2.0 released ---
 
-1134.	[bug]		Multithreaded servers could deadlock in ferror()
+1134.	[bug]		Multi-threaded servers could deadlock in ferror()
 			when reloading zone files. [RT #1951, #1998]
 
 1133.	[bug]		IN6_IS_ADDR_LOOPBACK was not portably defined on
@@ -534,7 +804,7 @@
 			did not include the out-of-range number but the
 			following token. [RT #2076]
 
-1129.	[bug]		Multithreaded servers could crash under heavy
+1129.	[bug]		Multi-threaded servers could crash under heavy
 			resolution load due to a race condition. [RT #2018]
 
 1126.	[bug]		The server could access a freed event if shut
@@ -547,13 +817,13 @@
 
 1120.	[bug]		Errors in options were not fatal. [RT #2002]
 
-1118.	[bug]		On multithreaded servers, a race condition
+1118.	[bug]		On multi-threaded servers, a race condition
 			could cause an assertion failure in resolver.c
 			during resolver shutdown. [RT #2029]
 
 1117.	[port]		The configure check for in6addr_loopback incorrectly
 			succeeded on AIX 4.3 when compiling with -O2
-			because the test code was optimized away.
+			because the test code was optimised away.
 			[RT #2016]
 
 1116.	[bug]		Setting transfers in a server clause, transfers-in,
@@ -565,8 +835,8 @@
 1113.	[bug]		The allow-update-forwarding option was ignored
 			when specified in a view. [RT #2014]
 
-1111.	[bug]		Multithreaded servers could deadlock processing
-			recursive queries due to a locking hieararchy
+1111.	[bug]		Multi-threaded servers could deadlock processing
+			recursive queries due to a locking hierarchy
 			violation in adb.c. [RT #2017]
 
 	--- 9.2.0rc9 released ---
@@ -604,8 +874,8 @@
 
 1090.	[bug]		libbind: dns_ho.c:add_hostent() was not returning
 			the amount of memory consumed resulting in garbage
-			address being returned.	 Alignment calculations were   
-			wasting space.	We weren't suppressing duplicate
+			address being returned.  Alignment calculations were
+			wasting space.  We weren't suppressing duplicate
 			addresses.
 
 1088.	[port]		libbind: MPE/iX C.70 (incomplete)
@@ -620,7 +890,7 @@
 1084.	[cleanup]	libbind: gai_strerror() rewritten.
 
 1083.	[bug]		The default control channel listened on the
-			wildcard adress, not the loopback as documented.
+			wildcard address, not the loopback as documented.
 			[RT #1975]
 
 1082.	[bug]		The -g option to named incorrectly caused logging
@@ -650,6 +920,7 @@
 			are unable to scan the interface list. [RT #1921]
 
 1063.	[bug]		libbind: "make install" was failing on IRIX.
+			[RT #1919]
 
 1062.	[bug]		If the control channel listener socket was shut
 			down before server exit, the listener object could
@@ -779,7 +1050,7 @@
 1015.	[bug]		Log channels that had a "versions" option but no
 			"size" option failed to create numbered log
 			files. [RT #1783]
- 
+
 	--- 9.2.0rc4 released ---
 
 
@@ -822,7 +1093,7 @@
  986.	[bug]		"dig +noall" failed to clear stats and command
 			printing.
 
- 984.	[bug]		Multithreading should be enabled by default on
+ 984.	[bug]		Multi-threading should be enabled by default on
 			Solaris 2.7 and newer, but it wasn't.
 
 	--- 9.2.0rc2 released ---
@@ -1002,7 +1273,7 @@
 			[RT #1423]
 
  926.	[bug]		The resolver could deadlock with the ADB when
-			shutting down (multithreaded builds only).
+			shutting down (multi-threaded builds only).
 			[RT #1324]
 
  925.	[cleanup]	Remove openssl from the distribution; require that
@@ -1085,7 +1356,7 @@
  900.	[bug]		A config.guess update changed the system identification
 			string of FreeBSD systems; configure and
 			bin/tests/system/ifconfig.sh now recognize the new
-			string. 
+			string.
 
 	--- 9.2.0a2 released ---
 
@@ -1150,13 +1421,13 @@
 			"severity debug 0;" like it did in BIND 9.1.
 			[RT #1367]
 
- 864.	[cleanup]	Multithreading is now enabled by default on
+ 864.	[cleanup]	Multi-threading is now enabled by default on
 			OSF1, Solaris 2.7 and newer, AIX, IRIX, and HP-UX.
 
  863.	[bug]		If an error occurred while an outgoing zone transfer
 			was starting up, the server could access a domain
 			name that had already been freed when logging a
-			message saying that the transfer was starting. 
+			message saying that the transfer was starting.
 			[RT #1383]
 
  862.	[bug]		Use after realloc(), non portable pointer arithmetic in
@@ -1228,7 +1499,7 @@
 			just as <lwres/net.h> does.
 
  843.	[func]		If no controls statement is present in named.conf,
-			or if any inet phrase of a controls statement is 
+			or if any inet phrase of a controls statement is
 			lacking a keys clause, then a key will be automatically
 			generated by named and an rndc.conf-style file
 			named named.key will be written that uses it.  rndc
@@ -1251,7 +1522,7 @@
  838.	[port]		UnixWare 7.x.x is now suported by
 			bin/tests/system/ifconfig.sh.
 
- 837.	[cleanup]	Multithreading is now enabled by default only on
+ 837.	[cleanup]	Multi-threading is now enabled by default only on
 			OSF1, Solaris 2.7 and newer, and AIX.
 
  836.	[func]		Upgraded libtool to 1.4.
@@ -1294,7 +1565,7 @@
  826.	[bug]		Some IXFR protocol errors were not detected.
 
  825.	[bug]		zone.c:ns_query() detached from the wrong zone
-			reference. [RT #1264] 
+			reference. [RT #1264]
 
  824.	[bug]		Correct line numbers reported by dns_master_load().
 			[RT #1263]
@@ -1765,7 +2036,7 @@
 			a offset from the current time.
 
  673.	[func]		The server can now convert RFC1886-style recursive
-			lookup requests into RFC2874-style lookups, when 
+			lookup requests into RFC2874-style lookups, when
 			enabled using the new option "allow-v6-synthesis".
 
  672.	[bug]		The wrong time was in the "time signed" field when
@@ -1901,7 +2172,7 @@
 
  633.	[port]		Cope with rlim_t missing on BSD/OS systems. [RT #575]
 
- 632.	[bug]		The index array of the journal file was 
+ 632.	[bug]		The index array of the journal file was
 			corrupted as it was written to disk.
 
  631.	[port]		Build without thread support on systems without
@@ -1958,7 +2229,7 @@
  616.	[func]		dnssec-signzone -t output now includes performance
 			statistics.
 
- 615.	[bug]		dnssec-signzone did not like child keysets signed 
+ 615.	[bug]		dnssec-signzone did not like child keysets signed
 			by multiple keys.
 
  614.	[bug]		Checks for uninitialized link fields were prone
@@ -2018,7 +2289,7 @@
  598.	[bug]		An update-policy statement would cause the server
 			to assert while loading. [RT #536]
 
- 597.	[func]		dnssec-signzone is now multithreaded.
+ 597.	[func]		dnssec-signzone is now multi-threaded.
 
  596.	[bug]		DNS_RDATASLAB_FORCE and DNS_RDATASLAB_EXACT are
 			not mutually exclusive.
@@ -2046,10 +2317,10 @@
  590.	[doc]		There are now man pages for the lwres library in
 			doc/man/lwres.
 
- 589.	[bug]		The server could deadlock if a zone was updated 
+ 589.	[bug]		The server could deadlock if a zone was updated
 			while being transferred out.
 
- 588.	[bug]		ctx->in_use was not being correctly initialised when
+ 588.	[bug]		ctx->in_use was not being correctly initialized when
 			when pushing a file for $INCLUDE. [RT #523]
 
  587.	[func]		A warning is now printed if the "allow-update"
@@ -2155,15 +2426,15 @@
 			is now implemented.  Responses to queries without
 			this bit set will not contain any DNSSEC records.
 
- 555.	[bug]		A slave server attempting a zone transfer could 
+ 555.	[bug]		A slave server attempting a zone transfer could
 			crash with an assertion failure on certain
 			malformed responses from the master. [RT #457]
 
  554.	[bug]		In some cases, not all of the dnssec tools were
 			properly installed.
 
- 553.	[bug]		Incoming zone transfers deferred due to quota 
-			were not started when quota was increased but 
+ 553.	[bug]		Incoming zone transfers deferred due to quota
+			were not started when quota was increased but
 			only when a transfer in progress finished. [RT #456]
 
  552.	[bug]		We were not correctly detecting the end of all c-style
@@ -2229,7 +2500,7 @@
 
  529.	[bug]		521 contained a bug which caused zones to always
 			reload.	 [RT #410]
-	
+
  528.	[func]		The ISC_LIST_XXXX macros now perform sanity checks
 			on their arguments.  ISC_LIST_XXXXUNSAFE can be use
 			to skip the checks however use with caution.
@@ -2262,7 +2533,7 @@
 			reload. [RT #196]
 
  520.	[bug]		Upgraded libtool to 1.3.5, which makes shared
-			library builds almost work on AIX (and possibly 
+			library builds almost work on AIX (and possibly
 			others).
 
  519.	[bug]		dns_name_split() would improperly split some bitstring
@@ -2335,7 +2606,7 @@
 			This allows hosts with the same name as a class or
 			type to be looked up.
 
- 498.	[doc]		There is now a man page for "dig" 
+ 498.	[doc]		There is now a man page for "dig"
 			in doc/man/bin/dig.1.
 
  497.	[bug]		The error messages printed when an IP match list
@@ -2378,12 +2649,12 @@
 			send all of the messages at the same time.  Add
 			rate limiting of the transmitted messages.
 
- 484.	[bug]		When the server was reloaded after removing addresses 
+ 484.	[bug]		When the server was reloaded after removing addresses
 			from the named.conf "listen-on" statement, sockets
 			were still listening on the removed addresses due
 			to reference count loops. [RT #325]
 
- 483.	[bug]		nslookup: "set all" showed a "search" option but it 
+ 483.	[bug]		nslookup: "set all" showed a "search" option but it
 			was not settable.
 
  482.	[bug]		nslookup: a plain "server" or "lserver" should be
@@ -2419,7 +2690,7 @@
 			as CH. [RT #305]
 
  473.	[bug]		nsupdate overran the end of the list of name servers
-			when no servers could be reached, typically causing 
+			when no servers could be reached, typically causing
 			it to print the error message "dns_request_create:
 			not implemented".
 
@@ -2464,7 +2735,7 @@
 			[RT #305]
 
  457.	[bug]		Dig/host/hslookup didn't properly handle connect
-			timeouts in certain situations, causing an 
+			timeouts in certain situations, causing an
 			unnecessary warning message to be printed.
 
  456.	[bug]		Stub zones were not resetting the refresh and expire
@@ -2512,7 +2783,7 @@
 
  443.	[bug]		When loading a master file failed because of an
 			unrecognized RR type name, the error message
-			did not include the file name and line number. 
+			did not include the file name and line number.
 			[RT #285]
 
  442.	[bug]		TSIG signed messages that did not match any view
@@ -2535,7 +2806,7 @@
 			not logged at a high enough logging level to be
 			useful in diagnosing this situation. [RT #275]
 
- 435.	[bug]		dns_zone_dump() overwrote existing zone files 
+ 435.	[bug]		dns_zone_dump() overwrote existing zone files
 			rather than writing to a temporary file and
 			renaming.  This could lead to empty or partial
 			zone files being left around in certain error
@@ -2546,7 +2817,7 @@
  434.	[func]		New function isc_file_isabsolute().
 
  433.	[func]		isc_base64_decodestring() now accepts newlines
-			within the base64 data.	 This makes it possible 
+			within the base64 data.	 This makes it possible
 			to break up the key data in a "trusted-keys"
 			statement into multiple lines. [RT #284]
 
@@ -2608,7 +2879,7 @@
 
  417.	[func]		Add isc_app_block() and isc_app_unblock(), which
 			allow an application to handle signals while
-			blocking.		
+			blocking.
 
  416.	[bug]		Slave zones with no master file tried to use a
 			NULL pointer for a journal file name when they
@@ -2616,7 +2887,7 @@
 
  415.	[bug]		The logging code leaked file descriptors.
 
- 414.	[bug]		Server did not shut down until all incoming zone 
+ 414.	[bug]		Server did not shut down until all incoming zone
 			transfers were finished.
 
  413.	[bug]		Notify could attempt to use the zone database after
@@ -2663,7 +2934,7 @@
 			assertion failure trying to perform zone
 			maintenance on, or sending notifies from,
 			tentatively created zones whose	views were
-			never fully configured and lacked an address 
+			never fully configured and lacked an address
 			database and request manager.
 
  398.	[bug]		"dig" sometimes caught an assertion failure when
@@ -2672,7 +2943,7 @@
  397.	[func]		Added utility functions dns_view_gettsig() and
 			dns_view_getpeertsig().
 
- 396.	[doc]		There is now a man page for "nsupdate" 
+ 396.	[doc]		There is now a man page for "nsupdate"
 			in doc/man/bin/nsupdate.8.
 
  395.	[bug]		nslookup printed incorrect RR type mnemonics
@@ -2688,17 +2959,17 @@
 			descriptors.
 
  392.	[func]		Add ISC_R_FAMILYNOSUPPORT.  Returned when OS does
-			not support the given address family requested. 
+			not support the given address family requested.
 
  391.	[clarity]	ISC_R_FAMILY -> ISC_R_FAMILYMISMATCH.
 
  390.	[func]		The function dns_zone_setdbtype() now takes
-			an argc/argv style vector of words and sets 
+			an argc/argv style vector of words and sets
 			both the zone database type and its arguments,
 			making the functions dns_zone_adddbarg()
 			and dns_zone_cleardbargs() unnecessary.
 
- 389.	[bug]		Attempting to send a reqeust over IPv6 using 
+ 389.	[bug]		Attempting to send a reqeust over IPv6 using
 			dns_request_create() on a system without IPv6
 			support caused an assertion failure [RT #235].
 
@@ -2733,7 +3004,7 @@
  378.	[func]		named and lwresd will log the command line arguments
 			they were started with in the "starting ..." message.
 
- 377.	[bug]		When additional data lookups were refused due to 
+ 377.	[bug]		When additional data lookups were refused due to
 			"allow-query", the databases were still being
 			attached causing reference leaks.
 
@@ -2758,10 +3029,10 @@
  370.	[bug]		The error messages for rollforward failures were
 			overly terse.
 
- 369.	[func]		Support new named.conf options, view and zone 
-			statements: 
+ 369.	[func]		Support new named.conf options, view and zone
+			statements:
 
-				max-retry-time, min-retry-time, 
+				max-retry-time, min-retry-time,
 				max-refresh-time, min-refresh-time.
 
  368.	[func]		Restructure the internal ".bind" view so that more
@@ -2828,7 +3099,7 @@
  347.	[bug]		Don't crash if an argument is left off options in dig.
 
  346.	[func]		Add support for .digrc config file, in the
-			user's current directory
+			user's current directory.
 
  345.	[bug]		Large-scale changes/cleanups to dig:
 			* Significantly improve structure handling
@@ -3017,7 +3288,7 @@
 			enough to hold any legal domain name in presentation
 			format + terminating NULL.
 
- 301.	[bug]		Uninitialised pointer in host:printmessage(). [RT #159]
+ 301.	[bug]		Uninitialized pointer in host:printmessage(). [RT #159]
 
  300.	[bug]		Using both <isc/net.h> and <lwres/net.h> didn't work
 			on platforms lacking IPv6 because each included their
@@ -3046,7 +3317,7 @@
 			not constructed by dns_message_parse(),
 			dns_message_findname() failed to find anything
 			due to checking for attribute bits that are set
-			only in dns_message_parse().   This caused an
+			only in dns_message_parse().  This caused an
 			infinite loop when constructing the response to
 			an ANY query at a CNAME in a secure zone.
 
@@ -3190,7 +3461,7 @@
  257.	[bug]		The server detached the last zone manager reference
 			too early, while it could still be in use by queries.
 			This manifested itself as assertion failures during the
-			shutdown process for busy name servers [RT #133].
+			shutdown process for busy name servers. [RT #133]
 
  256.	[func]		isc_ratelimiter_t now has attach/detach semantics, and
 			isc_ratelimiter_shutdown guarantees that the rate
@@ -3909,7 +4180,7 @@
 			caller find the most-enclosing superdomain of
 			a name.
 
-  63	[func]		Generate NOTIFY messages.
+  63.	[func]		Generate NOTIFY messages.
 
   62.	[func]		Add UDP refresh support.
 
diff --git a/usr.sbin/bind/EXCLUDED b/usr.sbin/bind/EXCLUDED
index 08141e7f520..eecb1f9d6ce 100644
--- a/usr.sbin/bind/EXCLUDED
+++ b/usr.sbin/bind/EXCLUDED
@@ -1,60 +1,63 @@
+
 1007.	[port]		config.guess, config.sub from autoconf-2.52.
 
 1008.	[port]		libtool.m4, ltmain.sh from libtool-1.4.2.
 
 1009.	[port]		OpenUNIX 8 support. [RT #1728]
 
+1011.	[cleanup]	Removed isc_dir_current().
+
 1024.	[port]		Compilation failed on HP-UX 11.11 due to
 			incompatible use of the SIOCGLIFCONF macro
 			name. [RT #1831]
 			[needs more work]
 
-1025.   [bug]           Don't use multicast addresses to resolve iterative
-                        queries. [RT #101]
+1025.	[bug]		Don't use multicast addresses to resolve iterative
+			queries. [RT #101]
 
-1034.   [bug]           Ignore the RD bit on multicast queries as specified
-                        in RFC 1123. [RT #137]
+1034.	[bug]		Ignore the RD bit on multicast queries as specified
+			in RFC 1123. [RT #137]
 
-1035.   [bug]           If we respond to multicast queries (which we
-                        currently do not), respond from a unicast address
-                        as specified in RFC 1123. [RT #137]
+1035.	[bug]		If we respond to multicast queries (which we
+			currently do not), respond from a unicast address
+			as specified in RFC 1123. [RT #137]
 
-1037.   [bug]           Negative responses whose authority section contain
-                        SOA or NS records whose owner names are not equal
-                        equal to or parents of the query name should be
-                        rejected. [RT #1862]
+1037.	[bug]		Negative responses whose authority section contain
+			SOA or NS records whose owner names are not equal
+			equal to or parents of the query name should be
+			rejected. [RT #1862]
 
 1073.	[bug]		The ADB cache cleaning should also be space driven.
 			[RT #1915, #1938]
 			[ New function dns_adb_setadbsize() ]
 
-1079.   [bug]           BIND 8 compatibility: accept bare elements at top
-                        level of sort list treating them as if they were
-                        a single element list. [RT #1963]
+1079.	[bug]		BIND 8 compatibility: accept bare elements at top
+			level of sort list treating them as if they were
+			a single element list. [RT #1963]
 
-1080.   [bug]           BIND 8 compatibility: accept bare IP prefixes
-                        as the second element of a two-element top level
-                        sort list statement. [RT #1964]
+1080.	[bug]		BIND 8 compatibility: accept bare IP prefixes
+			as the second element of a two-element top level
+			sort list statement. [RT #1964]
 
 1105.	[port]		OpenUNIX 8 enable threads by default. [RT #1970]
 			[Functional change]
 
-1110.	[bug]           dig should only accept valid abbreviations of +options.
-                        [RT #2003]
+1110.	[bug]		dig should only accept valid abbreviations of +options.
+			[RT #2003]
 			[Potentially breaks scripts.  Leave to 9.3.0.]
 
-1143.   [bug]           When a trusted-keys statement was present and named
-                        was built without crypto support, it would leak memory.
+1143.	[bug]		When a trusted-keys statement was present and named
+			was built without crypto support, it would leak memory.
 			[ Not applicable to 9.2 ]
 
-1150.   [bug]           named incorrectly accepted TTL values
-                        containing plus or minus signs, such as
-                        1d+1h-1s.
+1150.	[bug]		named incorrectly accepted TTL values
+			containing plus or minus signs, such as
+			1d+1h-1s.
 			[ Uses new function isc_parse_uint32() ]
 
-1151.   [bug]           nslookup failed to check that the arguments to   
-                        the port, timeout, and retry options were
-                        valid integers and in range. [RT #2099]
+1151.	[bug]		nslookup failed to check that the arguments to
+			the port, timeout, and retry options were
+			valid integers and in range. [RT #2099]
 			[ Uses new function isc_parse_uint32() ]
 
 1159.	[bug]		MD and MF are not permitted to be loaded by RFC1123
@@ -67,52 +70,93 @@
 			dns_rdataset_towire(), dns_rdataset_towirepartial()
 			and dns_rdataset_towirepartial() ]
 
-1192.   [bug]           The seconds fields in LOC records were restricted
-                        to three decimal places.  More decimal places should
-                        be allowed but warned about.
+1192.	[bug]		The seconds fields in LOC records were restricted
+			to three decimal places.  More decimal places should
+			be allowed but warned about.
+
+1209.	[bug]		Dig, host, nslookup were not checking the message ids
+			on the responses. [RT #2454]
 
-1209.   [bug]           Dig, host, nslookup were not checking the message ids
-                        on the responses. [RT #2454]
+1224.	[bug]		'rrset-order' and 'sortlist' should be additive
+			not exclusive.
+			[tightly coupled with 'cyclic' and 'random' support]
 
-1233.   [bug]           The flags field of a KEY record can be expressed in
-                        hex as well as decimal.
+1233.	[bug]		The flags field of a KEY record can be expressed in
+			hex as well as decimal.
 			[ Not applicable to 9.2.x ]
 
-1234.   [bug]           'rrset-order' and 'sortlist' should be additive
-                        not exclusive.
+1234.	[bug]		contrib/sdb: 'zonetodb' failed to call
+			dns_result_register().  DNS_R_SEENINCLUDE should not
+			be fatal.
 
-1271.   [bug]           "recursion available: {denied,approved}" was too
-                        confusing.
+1243.	[bug]		It was possible to trigger a REQUIRE() in
+			dns_message_findtype(). [RT #2659]
 
-1348.   [port]          Win32: Rewrote code to use I/O Completion Ports
-                        in socket.c and eliminating a host of socket
-                        errors. Performance is enhanced.
-			[review for 9.2.3]
+1247.	[bug]		Don't reset the interface index for link/site local
+			addresses. [RT #2576]
+			[depends on new functions]
 
-1255.   [bug]           When verifying that an NXT proves nonexistence, check
-                        the rcode of the message and only do the matching NXT
-                        check.  That is, for NXDOMAIN responses, check that
-                        the name is in the range between the NXT owner and
-                        next name, and for NOERROR NODATA responses, check
-                        that the type is not present in the NXT bitmap.
+1255.	[bug]		When verifying that an NXT proves nonexistence, check
+			the rcode of the message and only do the matching NXT
+			check.  That is, for NXDOMAIN responses, check that
+			the name is in the range between the NXT owner and
+			next name, and for NOERROR NODATA responses, check
+			that the type is not present in the NXT bitmap.
 			[required changes from DS support]
 
-1322.   [bug]           dnssec-signzone usage message was misleading.
-			[DS specific]
-
-1247.   [bug]           Don't reset the interface index for link/site local
-                        addresses. [RT #2576]
-			[depends on new functions]
+1271.	[bug]		"recursion available: {denied,approved}" was too
+			confusing.
 
-1224.   [bug]           'rrset-order' and 'sortlist' should be additive
-                        not exclusive.
-			[tightly coupled with 'cyclic' and 'random' support]
+1321.	[bug]		If the last RRset in a zone is glue, dnssec-signzone
+			would incorrectly duplicate its output and sign it.
+			[DS specific]
 
-1321.   [bug]           If the last RRset in a zone is glue, dnssec-signzone
-                        would incorrectly duplicate its output and sign it.
+1322.	[bug]		dnssec-signzone usage message was misleading.
 			[DS specific]
 
-1328.   [bug]           The validator could incorrectly verify an invalid
-                        negative proof.
+1328.	[bug]		The validator could incorrectly verify an invalid
+			negative proof.
 			[DS specific]
 
+1355.	[bug]		Fix DNSSEC wildcard proof for CNAME/DNAME.
+
+1362.	[bug]		remove IFF_RUNNING test when scanning interfaces.
+
+1371.	[bug]		notify-source-v6, transfer-source-v6 and
+			query-source-v6 with explicit addresses and using the
+			same ports as named was listening on could interfere
+			with nameds ability to answer queries sent to those
+			addresses.
+
+1386.	[bug]		named-checkzone -z stopped on errors in a zone.
+			[RT #3653]
+
+1392.	[bug]		named-checkzone: update usage.
+
+1393.	[port]		Bind to individual IPv6 interfaces if IPV6_IPV6ONLY
+			is not available in the kernel to prevent accidently
+			listening on IPv4 interfaces.
+
+1398.	[doc]		ARM: notify-also should have been also-notify.
+			[RT #4345]
+
+1400.	[bug]		Block the addition of wildcard NS records by IXFR
+			or UPDATE. [RT #3502]
+
+1404.	[bug]		libbind: ns_name_ntol() could overwrite a zero length
+			buffer.
+
+1409.	[bug]		DS should have attribute DNS_RDATATYPEATTR_DNSSEC.
+
+1430.	[port]		linux: IPv6 interface scanning support.
+
+1433.	[bug]		named could trigger a REQUIRE failure if it could
+			not get a file descriptor when attempting to write
+			a master file. [RT #4347]
+
+1454.	[port]		Use getifaddrs() if available for interface scanning.
+			--disable-getifaddrs to override.  Glibc currently
+			has a getifaddrs() that does not support IPv6.
+			Use --enable-getifaddrs=glibc to force the use of
+			this version under linux machines.
+
diff --git a/usr.sbin/bind/Makefile.bsd-wrapper b/usr.sbin/bind/Makefile.bsd-wrapper
index 5fde30344ff..59306d85794 100644
--- a/usr.sbin/bind/Makefile.bsd-wrapper
+++ b/usr.sbin/bind/Makefile.bsd-wrapper
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile.bsd-wrapper,v 1.7 2003/02/28 19:43:20 art Exp $
+#	$OpenBSD: Makefile.bsd-wrapper,v 1.8 2003/11/18 14:14:04 jakob Exp $
 
 .include <bsd.own.mk>
 
@@ -8,8 +8,7 @@ CONFIGURE_OPTS=	--prefix=/usr \
 		--sysconfdir=/etc \
 		--disable-shared \
 		--disable-threads \
-		--without-openssl \
-		--with-randomdev=/dev/arandom
+		--without-openssl
 
 PROG=	bin/check/named-checkconf \
 	bin/check/named-checkzone \
diff --git a/usr.sbin/bind/Makefile.in b/usr.sbin/bind/Makefile.in
index 3fb0fdd8461..e456fe9f425 100644
--- a/usr.sbin/bind/Makefile.in
+++ b/usr.sbin/bind/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 1998-2001  Internet Software Consortium.
+# Copyright (C) 1998-2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: Makefile.in,v 1.41 2001/07/13 01:38:49 gson Exp $
+# $ISC: Makefile.in,v 1.41.2.2 2003/07/22 04:03:31 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -27,9 +27,16 @@ TARGETS =
 @BIND9_MAKE_RULES@
 
 distclean::
+	@if [ "X@LIBBIND@" = "X" ] ; then \
+		i=lib/bind; \
+		echo "making $@ in `pwd`/$$i"; \
+		(cd $$i; ${MAKE} ${MAKEDEFS} $@) || exit 1; \
+	fi
+
+distclean::
 	rm -f config.cache config.h config.log config.status TAGS
-	rm -f libtool isc-config.sh
-	rm -f util/conf.sh
+	rm -f libtool isc-config.sh configure.lineno
+	rm -f util/conf.sh docutil/docbook2man-wrapper.sh
 
 # XXX we should clean libtool stuff too.  Only do this after we add rules
 # to make it.
diff --git a/usr.sbin/bind/README b/usr.sbin/bind/README
index a07465bfaa6..fa2d4d381b7 100644
--- a/usr.sbin/bind/README
+++ b/usr.sbin/bind/README
@@ -10,8 +10,7 @@ BIND 9
 
 		- IP version 6
 			Answers DNS queries on IPv6 sockets
-			IPv6 resource records (A6, DNAME, etc.)
-			Bitstring Labels
+			IPv6 resource records (AAAA)
 			Experimental IPv6 Resolver Library
 
 		- DNS Protocol Enhancements
@@ -29,7 +28,7 @@ BIND 9
 
 
 	BIND version 9 development has been underwritten by the following
-	organizations:
+	organisations:
 
 		Sun Microsystems, Inc.
 		Hewlett Packard
@@ -43,17 +42,16 @@ BIND 9
 		Stichting NLnet - NLnet Foundation
 		Nominum, Inc.
 
-BIND 9.2.2-P3
 
-	Fix a false positive with delegation-only.
-
-BIND 9.2.2-P2
-
-	Fix problems identified with delegation-only.
+BIND 9.2.3
+	
+	BIND 9.2.3 is a maintenance release, containing fixes for
+	a number of bugs in 9.2.2.
 
-BIND 9.2.2-P1
+	A new zone type delegation-only is now supported.
+	A new view option root-delegation-only is now supported.
 
-	 A new zone type delegation-only is now supported.
+	libbind: corresponds to that from BIND 8.4.0.
 
 BIND 9.2.2
 
@@ -188,9 +186,6 @@ Building
 		Solaris 2.6, 7, 8
 		Windows NT/W2K
 
-	HP-UX 11.11 is not yet supported due to its incompatible
-	SIOCGLIFCONF ioctl.
-
 	Additionally, we have unverified reports of success building
 	previous versions of BIND 9 from users of the following systems:
 
@@ -300,7 +295,6 @@ Building
 	on your system, and some require Perl; see bin/tests/system/README
 	for details.
 
-
 Documentation
 
 	The BIND 9 Administrator Reference Manual is included with the
@@ -326,6 +320,10 @@ Bug Reports and Mailing Lists
 
 		bind9-bugs@isc.org
 
+	Configuration questions should be sent to the BIND 9 Users
+	mailing list.  Compilation questions should be sent to the
+	BIND 9 Users mailing list.
+
 	To join the BIND 9 Users mailing list, send mail to
 
 		bind9-users-request@isc.org
diff --git a/usr.sbin/bind/acconfig.h b/usr.sbin/bind/acconfig.h
index 809c78506e2..c1280f56b5e 100644
--- a/usr.sbin/bind/acconfig.h
+++ b/usr.sbin/bind/acconfig.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: acconfig.h,v 1.35.2.1 2001/10/22 23:28:07 gson Exp $ */
+/* $ISC: acconfig.h,v 1.35.2.5 2003/08/05 00:42:53 marka Exp $ */
 
 /***
  *** This file is not to be included by any public header files, because
@@ -53,7 +53,7 @@
 /* define if catgets() is available */
 #undef HAVE_CATGETS
 
-/* define if you have the NET_RT_IFLIST sysctl variable. */
+/* define if you have the NET_RT_IFLIST sysctl variable and sys/sysctl.h */
 #undef HAVE_IFLIST_SYSCTL
 
 /* define if you need to #define _XPG4_2 before including sys/socket.h */
@@ -133,5 +133,8 @@ int sigwait(const unsigned int *set, int *sig);
 /* define if pthread_attr_getstacksize() is available */
 #undef HAVE_PTHREAD_ATTR_GETSTACKSIZE
 
+/* define if pthread_attr_setstacksize() is available */
+#undef HAVE_PTHREAD_ATTR_SETSTACKSIZE
+
 /* define if you have strerror in the C library. */
 #undef HAVE_STRERROR
diff --git a/usr.sbin/bind/bin/dig/dig.1 b/usr.sbin/bind/bin/dig/dig.1
index e830053646a..d4fd67dd5b1 100644
--- a/usr.sbin/bind/bin/dig/dig.1
+++ b/usr.sbin/bind/bin/dig/dig.1
@@ -48,6 +48,10 @@ Unless it is told to query a specific name server,
 .PP
 When no command line arguments or options are given, will perform an
 NS query for "." (the root).
+.PP
+It is possible to set per user defaults for \fBdig\fR via
+\fI${HOME}/.digrc\fR. This file is read and any options in it
+are applied before the command line arguements.
 .SH "SIMPLE USAGE"
 .PP
 A typical invocation of \fBdig\fR looks like:
@@ -200,7 +204,7 @@ completeness.
 Set [do not set] the CD (checking disabled) bit in the query. This
 requests the server to not perform DNSSEC validation of responses.
 .TP
-\fB+[no]recursive\fR
+\fB+[no]recurse\fR
 Toggle the setting of the RD (recursion desired) bit in the query.
 This bit is set by default, which means \fBdig\fR
 normally sends recursive queries. Recursion is automatically disabled
@@ -352,6 +356,8 @@ isc.org.
 .SH "FILES"
 .PP
 \fI/etc/resolv.conf\fR
+.PP
+\fI${HOME}/.digrc\fR
 .SH "SEE ALSO"
 .PP
 \fBhost\fR(1),
diff --git a/usr.sbin/bind/bin/dig/dig.c b/usr.sbin/bind/bin/dig/dig.c
index 71045bbff95..ad656342c37 100644
--- a/usr.sbin/bind/bin/dig/dig.c
+++ b/usr.sbin/bind/bin/dig/dig.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002  Internet Software Consortium.
+ * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dig.c,v 1.157.2.7 2002/03/12 03:55:57 marka Exp $ */
+/* $ISC: dig.c,v 1.157.2.13 2003/07/30 00:42:25 marka Exp $ */
 
 #include <config.h>
 #include <stdlib.h>
@@ -84,7 +84,7 @@ static char *argv0;
 static char domainopt[DNS_NAME_MAXTEXT];
 
 static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
-	nibble = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
+	ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
 	multiline = ISC_FALSE;
 
 static const char *opcodetext[] = {
@@ -154,7 +154,7 @@ help(void) {
 "                 (Use ixfr=version for type ixfr)\n"
 "        q-opt    is one of:\n"
 "                 -x dot-notation     (shortcut for in-addr lookups)\n"
-"                 -n                  (nibble form for reverse IPv6 lookups)\n"
+"                 -i                  (IP6.INT reverse IPv6 lookups)\n"
 "                 -f filename         (batch mode)\n"
 "                 -b address          (bind to source address)\n"
 "                 -p port             (specify port number)\n"
@@ -174,7 +174,7 @@ help(void) {
 "                 +ndots=###          (Set NDOTS value)\n"
 "                 +[no]search         (Set whether to use searchlist)\n"
 "                 +[no]defname        (Ditto)\n"
-"                 +[no]recursive      (Recursive mode)\n"
+"                 +[no]recurse        (Recursive mode)\n"
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)"
 "\n"
 "                 +[no]fail           (Don't try next server on SERVFAIL)\n"
@@ -681,8 +681,6 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 				goto invalid_option;
 			lookup->udpsize = (isc_uint16_t) parse_uint(value,
 						    "buffer size", COMMSIZE);
-			if (lookup->udpsize > COMMSIZE)
-				lookup->udpsize = COMMSIZE;
 			break;
 		default:
 			goto invalid_option;
@@ -892,7 +890,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 	struct in6_addr in6;
 
 	cmd = option[0];
-	if (strlen(option) > 1) {
+	if (strlen(option) > 1U) {
 		value_from_next = ISC_FALSE;
 		value = &option[1];
 	} else {
@@ -907,11 +905,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		help();
 		exit(0);
 		break;
+	case 'i':
+		ip6_int = ISC_TRUE;
+		return (ISC_FALSE);
 	case 'm': /* memdebug */
 		/* memdebug is handled in preparse_args() */
 		return (ISC_FALSE);
 	case 'n':
-		nibble = ISC_TRUE;
+		/* deprecated */
 		return (ISC_FALSE);
 	case '4':
 		if (have_ipv4)
@@ -1020,13 +1021,15 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		return (value_from_next);
 	case 'x':
 		*lookup = clone_lookup(default_lookup, ISC_TRUE);
-		if (get_reverse(textname, value, nibble) == ISC_R_SUCCESS) {
+		if (get_reverse(textname, value, ip6_int, ISC_TRUE)
+		    == ISC_R_SUCCESS)
+		{
 			strlcpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
 			debug("looking up %s", (*lookup)->textname);
 			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
 						(*lookup)->ns_search_only);
-			(*lookup)->nibble = nibble;
+			(*lookup)->ip6_int = ip6_int;
 			if (!(*lookup)->rdtypeset)
 				(*lookup)->rdtype = dns_rdatatype_ptr;
 			if (!(*lookup)->rdclassset)
diff --git a/usr.sbin/bind/bin/dig/dig.docbook b/usr.sbin/bind/bin/dig/dig.docbook
index 9a71afecc6f..4a2e5a4e154 100644
--- a/usr.sbin/bind/bin/dig/dig.docbook
+++ b/usr.sbin/bind/bin/dig/dig.docbook
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: dig.docbook,v 1.4.2.2.4.2 2003/02/17 07:05:02 marka Exp $ -->
+<!-- $ISC: dig.docbook,v 1.4.2.7 2003/05/12 02:50:15 marka Exp $ -->
 
 <refentry>
 
@@ -98,6 +98,12 @@ When no command line arguments or options are given, will perform an
 NS query for "." (the root).
 </para>
 
+<para>
+It is possible to set per user defaults for <command>dig</command> via
+<filename>${HOME}/.digrc</filename>.  This file is read and any options in it
+are applied before the command line arguements.
+</para>
+
 </refsect1>
 
 <refsect1>
@@ -309,7 +315,7 @@ Set [do not set] the CD (checking disabled) bit in the query.  This
 requests the server to not perform DNSSEC validation of responses.
 </para></listitem></varlistentry>
 
-<varlistentry><term><option>+[no]recursive</option></term>
+<varlistentry><term><option>+[no]recurse</option></term>
 <listitem><para>
 Toggle the setting of the RD (recursion desired) bit in the query.
 This bit is set by default, which means <command>dig</command>
@@ -470,7 +476,7 @@ The default is to not display malformed answers.
 <varlistentry><term><option>+[no]dnssec</option></term>
 <listitem><para>
 Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO)
-in the the OPT record in the additional section of the query.
+in the OPT record in the additional section of the query.
 </para>
 
 </variablelist>
@@ -527,6 +533,9 @@ will not print the initial query when it looks up the NS records for
 <para>
 <filename>/etc/resolv.conf</filename>
 </para>
+<para>
+<filename>${HOME}/.digrc</filename>
+</para>
 </refsect1>
 
 <refsect1>
diff --git a/usr.sbin/bind/bin/dig/dig.html b/usr.sbin/bind/bin/dig/dig.html
index d6db1c82820..5ad1cdc3f1b 100644
--- a/usr.sbin/bind/bin/dig/dig.html
+++ b/usr.sbin/bind/bin/dig/dig.html
@@ -186,11 +186,21 @@ CLASS="FILENAME"
 ><P
 >When no command line arguments or options are given, will perform an
 NS query for "." (the root).</P
+><P
+>It is possible to set per user defaults for <B
+CLASS="COMMAND"
+>dig</B
+> via
+<TT
+CLASS="FILENAME"
+>${HOME}/.digrc</TT
+>.  This file is read and any options in it
+are applied before the command line arguements.</P
 ></DIV
 ><DIV
 CLASS="REFSECT1"
 ><A
-NAME="AEN65"
+NAME="AEN68"
 ></A
 ><H2
 >SIMPLE USAGE</H2
@@ -287,7 +297,7 @@ CLASS="COMMAND"
 ><DIV
 CLASS="REFSECT1"
 ><A
-NAME="AEN94"
+NAME="AEN97"
 ></A
 ><H2
 >OPTIONS</H2
@@ -501,7 +511,7 @@ CLASS="FILENAME"
 ><DIV
 CLASS="REFSECT1"
 ><A
-NAME="AEN144"
+NAME="AEN147"
 ></A
 ><H2
 >QUERY OPTIONS</H2
@@ -669,7 +679,7 @@ requests the server to not perform DNSSEC validation of responses.</P
 ><DT
 ><TT
 CLASS="OPTION"
->+[no]recursive</TT
+>+[no]recurse</TT
 ></DT
 ><DD
 ><P
@@ -988,7 +998,7 @@ CLASS="OPTION"
 ><DD
 ><P
 >Requests DNSSEC records be sent by setting the DNSSEC OK bit (DO)
-in the the OPT record in the additional section of the query.</P
+in the OPT record in the additional section of the query.</P
 ></DD
 ></DL
 ></DIV
@@ -997,7 +1007,7 @@ in the the OPT record in the additional section of the query.</P
 ><DIV
 CLASS="REFSECT1"
 ><A
-NAME="AEN335"
+NAME="AEN338"
 ></A
 ><H2
 >MULTIPLE QUERIES</H2
@@ -1081,7 +1091,7 @@ CLASS="LITERAL"
 ><DIV
 CLASS="REFSECT1"
 ><A
-NAME="AEN353"
+NAME="AEN356"
 ></A
 ><H2
 >FILES</H2
@@ -1090,11 +1100,16 @@ NAME="AEN353"
 CLASS="FILENAME"
 >/etc/resolv.conf</TT
 ></P
+><P
+><TT
+CLASS="FILENAME"
+>${HOME}/.digrc</TT
+></P
 ></DIV
 ><DIV
 CLASS="REFSECT1"
 ><A
-NAME="AEN357"
+NAME="AEN362"
 ></A
 ><H2
 >SEE ALSO</H2
@@ -1128,7 +1143,7 @@ CLASS="CITETITLE"
 ><DIV
 CLASS="REFSECT1"
 ><A
-NAME="AEN370"
+NAME="AEN375"
 ></A
 ><H2
 >BUGS </H2
diff --git a/usr.sbin/bind/bin/dig/dighost.c b/usr.sbin/bind/bin/dig/dighost.c
index 67364c7d861..e2da013640c 100644
--- a/usr.sbin/bind/bin/dig/dighost.c
+++ b/usr.sbin/bind/bin/dig/dighost.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002  Internet Software Consortium.
+ * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dighost.c,v 1.221.2.14 2002/08/06 02:40:11 marka Exp $ */
+/* $ISC: dighost.c,v 1.221.2.19 2003/07/25 04:36:43 marka Exp $ */
 
 /*
  * Notice to programmers:  Do not use this code as an example of how to
@@ -117,6 +117,7 @@ int lookup_counter = 0;
  *   10  Internal error
  */
 int exitcode = 0;
+int fatalexit = 0;
 char keynametext[MXNAME];
 char keyfile[MXNAME] = "";
 char keysecret[MXNAME] = "";
@@ -201,54 +202,85 @@ hex_dump(isc_buffer_t *b) {
 		printf("\n");
 }
 
+/*
+ * Append 'len' bytes of 'text' at '*p', failing with
+ * ISC_R_NOSPACE if that would advance p past 'end'.
+ */
+static isc_result_t
+append(const char *text, int len, char **p, char *end) {
+	if (len > end - *p)
+		return (ISC_R_NOSPACE);
+	memcpy(*p, text, len);
+	*p += len;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+reverse_octets(const char *in, char **p, char *end) {
+	char *dot = strchr(in, '.');
+	int len;
+	if (dot != NULL) {
+		isc_result_t result;
+		result = reverse_octets(dot + 1, p, end);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		result = append(".", 1, p, end);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		len = dot - in;
+	} else {
+		len = strlen(in);
+	}
+	return (append(in, len, p, end));
+}
 
 isc_result_t
-get_reverse(char *reverse, char *value, isc_boolean_t nibble) {
-	int adrs[4];
-	char working[MXNAME];
-	int remaining;
-	int i, n;
+get_reverse(char *reverse, char *value, isc_boolean_t ip6_int,
+	    isc_boolean_t strict)
+{
+	int r;
 	isc_result_t result;
+	isc_netaddr_t addr;
 
-	result = DNS_R_BADDOTTEDQUAD;
-	reverse[0] = 0;
-
-	debug("get_reverse(%s)", value);
-	if (strspn(value, "0123456789.") == strlen(value)) {
-		n = sscanf(value, "%d.%d.%d.%d",
-			   &adrs[0], &adrs[1],
-			   &adrs[2], &adrs[3]);
-		if (n == 0) {
-			return (DNS_R_BADDOTTEDQUAD);
-		}
-		reverse[MXNAME - 1] = 0;
-		for (i = n - 1; i >= 0; i--) {
-			snprintf(working, sizeof(working), "%d.",
-				 adrs[i]);
-			remaining = MXNAME - strlen(reverse) - 1;
-			strncat(reverse, working, remaining);
-		}
-		remaining = MXNAME - strlen(reverse) - 1;
-		strncat(reverse, "in-addr.arpa.", remaining);
-		result = ISC_R_SUCCESS;
-	} else if (strspn(value, "0123456789abcdefABCDEF:") 
-		   == strlen(value)) {
-		isc_netaddr_t addr;
+	addr.family = AF_INET6;
+	r = inet_pton(AF_INET6, value, &addr.type.in6);
+	if (r > 0) {
+		/* This is a valid IPv6 address. */
 		dns_fixedname_t fname;
 		dns_name_t *name;
-		
-		addr.family = AF_INET6;
-		n = inet_pton(AF_INET6, value, &addr.type.in6);
-		if (n <= 0)
-			return (DNS_R_BADDOTTEDQUAD);
+		unsigned int options = DNS_BYADDROPT_IPV6NIBBLE;
+
+		if (ip6_int)
+			options |= DNS_BYADDROPT_IPV6INT;
 		dns_fixedname_init(&fname);
 		name = dns_fixedname_name(&fname);
-		result = dns_byaddr_createptrname(&addr, nibble, name);
+		result = dns_byaddr_createptrname2(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, MXNAME);
+		return (ISC_R_SUCCESS);
+	} else {
+		/*
+		 * Not a valid IPv6 address.  Assume IPv4.
+		 * If 'strict' is not set, construct the
+		 * in-addr.arpa name by blindly reversing
+		 * octets whether or not they look like integers,
+		 * so that this can be used for RFC2317 names
+		 * and such.
+		 */
+		char *p = reverse;
+		char *end = reverse + MXNAME;
+		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1)
+			return (DNS_R_BADDOTTEDQUAD);
+		result = reverse_octets(value, &p, end);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		/* Append .in-addr.arpa. and a terminating NUL. */
+		result = append(".in-addr.arpa.", 15, &p, end);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		return (ISC_R_SUCCESS);
 	}
-	return (result);
 }
 
 void
@@ -262,6 +294,8 @@ fatal(const char *format, ...) {
 	fprintf(stderr, "\n");
 	if (exitcode < 10)
 		exitcode = 10;
+	if (fatalexit != 0)
+		exitcode = fatalexit;
 	exit(exitcode);
 }
 
@@ -378,7 +412,7 @@ make_empty_lookup(void) {
 	looknew->retries = tries;
 	looknew->nsfound = 0;
 	looknew->tcp_mode = ISC_FALSE;
-	looknew->nibble = ISC_FALSE;
+	looknew->ip6_int = ISC_FALSE;
 	looknew->comments = ISC_TRUE;
 	looknew->stats = ISC_TRUE;
 	looknew->section_question = ISC_TRUE;
@@ -1395,6 +1429,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->first_soa_rcvd = ISC_FALSE;
 		query->second_rr_rcvd = ISC_FALSE;
 		query->first_repeat_rcvd = ISC_FALSE;
+		query->warn_id = ISC_TRUE;
 		query->first_rr_serial = 0;
 		query->second_rr_serial = 0;
 		query->servname = serv->servername;
@@ -1700,14 +1735,15 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			      l->retries);
 			l->retries--;
 			n = requeue_lookup(l, ISC_TRUE);
-			n->origin = query->lookup->origin;
 			cancel_lookup(l);
+			check_next_lookup(l);
 		}
 	} else {
 		fputs(l->cmdline, stdout);
 		printf(";; connection timed out; no servers could be "
 		       "reached\n");
 		cancel_lookup(l);
+		check_next_lookup(l);
 		if (exitcode < 9)
 			exitcode = 9;
 	}
@@ -2003,7 +2039,7 @@ check_for_more_data(dig_query_t *query, dns_message_t *msg,
 					query->second_rr_rcvd = ISC_TRUE;
 					query->second_rr_serial = 0;
 					debug("got the second rr as nonsoa");
-					continue;
+					goto next_rdata;
 				}
 
 				/*
@@ -2187,25 +2223,35 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 
  	result = dns_message_peekheader(b, &id, &msgflags);
 	if (result != ISC_R_SUCCESS || l->sendmsg->id != id) {
+		match = ISC_FALSE;
 		if (l->tcp_mode) {
-			if (result == ISC_R_SUCCESS)
-				printf(";; ERROR: ID mismatch: "
-				       "expected ID %u, got %u\n",
-				       l->sendmsg->id, id);
-			else
+			isc_boolean_t fail = ISC_TRUE;
+			if (result == ISC_R_SUCCESS) {
+				if (!query->first_soa_rcvd ||
+				     query->warn_id)
+					printf(";; %s: ID mismatch: "
+					       "expected ID %u, got %u\n",
+					       query->first_soa_rcvd ?
+					       "WARNING" : "ERROR",
+					       l->sendmsg->id, id);
+				if (query->first_soa_rcvd)
+					fail = ISC_FALSE;
+				query->warn_id = ISC_FALSE;
+			} else
 				printf(";; ERROR: short (< header size) message\n");
-			isc_event_free(&event);
-			clear_query(query);
-			check_next_lookup(l);
-			UNLOCK_LOOKUP;
-			return;
-		}
-		if (result == ISC_R_SUCCESS)
+			if (fail) {
+				isc_event_free(&event);
+				clear_query(query);
+				check_next_lookup(l);
+				UNLOCK_LOOKUP;
+				return;
+			}
+			match = ISC_TRUE;
+		} else if (result == ISC_R_SUCCESS)
 			printf(";; Warning: ID mismatch: "
 			       "expected ID %u, got %u\n", l->sendmsg->id, id);
 		else
 			printf(";; Warning: short (< header size) message received\n");
-		match = ISC_FALSE;
 	}
 
 	if (!match) {
@@ -2482,11 +2528,25 @@ get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
 			hints.ai_family = PF_INET;
 		else if (!have_ipv4)
 			hints.ai_family = PF_INET6;
-		else
+		else {
 			hints.ai_family = PF_UNSPEC;
+#ifdef AI_ADDRCONFIG
+			hints.ai_flags = AI_ADDRCONFIG;
+#endif
+		}
 		debug ("before getaddrinfo()");
 		isc_app_block();
+#ifdef AI_ADDRCONFIG
+ again:
+#endif
 		result = getaddrinfo(host, NULL, &hints, &res);
+#ifdef AI_ADDRCONFIG
+		if (result == EAI_BADFLAGS &&
+		    (hints.ai_flags & AI_ADDRCONFIG) != 0) {
+			hints.ai_flags &= ~AI_ADDRCONFIG;
+			goto again;
+		}
+#endif
 		isc_app_unblock();
 		if (result != 0) {
 			fatal("Couldn't find server '%s': %s",
diff --git a/usr.sbin/bind/bin/dig/host.c b/usr.sbin/bind/bin/dig/host.c
index 82435a1450f..e4252a4bdfe 100644
--- a/usr.sbin/bind/bin/dig/host.c
+++ b/usr.sbin/bind/bin/dig/host.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002  Internet Software Consortium.
+ * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: host.c,v 1.76.2.2 2002/02/08 03:57:04 marka Exp $ */
+/* $ISC: host.c,v 1.76.2.5 2003/07/25 04:36:44 marka Exp $ */
 
 #include <config.h>
 #include <stdlib.h>
@@ -51,8 +51,11 @@ extern int ndots;
 extern int tries;
 extern char *progname;
 extern isc_task_t *global_task;
+extern int fatalexit;
 
 static isc_boolean_t short_form = ISC_TRUE, listed_server = ISC_FALSE;
+static isc_boolean_t list_addresses = ISC_TRUE;
+static dns_rdatatype_t list_type = dns_rdatatype_a;
 
 static const char *opcodetext[] = {
 	"QUERY",
@@ -209,7 +212,7 @@ show_usage(void) {
 "       -C compares SOA records on authoritative nameservers\n"
 "       -d is equivalent to -v\n"
 "       -l lists all hosts in a domain, using AXFR\n"
-"       -n Use the nibble form of IPv6 reverse lookup\n"
+"       -i Use the old IN6.INT form of IPv6 reverse lookup\n"
 "       -N changes the number of dots allowed before root lookup is done\n"
 "       -r disables recursive processing\n"
 "       -R specifies number of retries for UDP packets\n"
@@ -332,6 +335,16 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		for (rdataset = ISC_LIST_HEAD(name->list);
 		     rdataset != NULL;
 		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
+			if (query->lookup->rdtype == dns_rdatatype_axfr &&
+			    !((!list_addresses &&
+			       (list_type == dns_rdatatype_any ||
+			        rdataset->type == list_type)) ||
+			      (list_addresses &&
+			       (rdataset->type == dns_rdatatype_a ||
+			        rdataset->type == dns_rdatatype_aaaa ||
+				rdataset->type == dns_rdatatype_ns ||
+				rdataset->type == dns_rdatatype_ptr))))
+				continue;
 			if (!short_form) {
 				result = dns_rdataset_totext(rdataset,
 							     print_name,
@@ -542,7 +555,7 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	int c;
 	char store[MXNAME];
 	isc_textregion_t tr;
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
 
@@ -550,13 +563,14 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 
 	lookup = make_empty_lookup();
 
-	while ((c = isc_commandline_parse(argc, argv, "lvwrdt:c:aTCN:R:W:Dn"))
+	while ((c = isc_commandline_parse(argc, argv, "ilvwrdt:c:aTCN:R:W:Dn"))
 	       != EOF) {
 		switch (c) {
 		case 'l':
 			lookup->tcp_mode = ISC_TRUE;
 			lookup->rdtype = dns_rdatatype_axfr;
 			lookup->rdtypeset = ISC_TRUE;
+			fatalexit = 3;
 			break;
 		case 'v':
 		case 'd':
@@ -571,13 +585,22 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			result = dns_rdatatype_fromtext(&rdtype,
 						   (isc_textregion_t *)&tr);
 
-			if (result != ISC_R_SUCCESS)
-				fprintf(stderr,"Warning: invalid type: %s\n",
-					isc_commandline_argument);
-			else {
+			if (result != ISC_R_SUCCESS) {
+				fatalexit = 2;
+				fatal("invalid type: %s\n",
+				      isc_commandline_argument);
+			} 
+			if (!lookup->rdtypeset ||
+			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = rdtype;
-				lookup->rdtypeset = ISC_TRUE;
-			}
+			if (rdtype == dns_rdatatype_axfr) {
+				/* -l -t any -v */
+				list_type = dns_rdatatype_any;
+				short_form = ISC_FALSE;
+				lookup->tcp_mode = ISC_TRUE;
+			} else
+				list_type = rdtype;
+			list_addresses = ISC_FALSE;
 			break;
 		case 'c':
 			tr.base = isc_commandline_argument;
@@ -585,21 +608,28 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			result = dns_rdataclass_fromtext(&rdclass,
 						   (isc_textregion_t *)&tr);
 
-			if (result != ISC_R_SUCCESS)
-				fprintf(stderr,"Warning: invalid class: %s\n",
-					isc_commandline_argument);
-			else {
+			if (result != ISC_R_SUCCESS) {
+				fatalexit = 2;
+				fatal("invalid class: %s\n",
+				      isc_commandline_argument);
+			} else {
 				lookup->rdclass = rdclass;
 				lookup->rdclassset = ISC_TRUE;
 			}
 			break;
 		case 'a':
-			lookup->rdtype = dns_rdatatype_any;
+			if (!lookup->rdtypeset ||
+			    lookup->rdtype != dns_rdatatype_axfr)
+				lookup->rdtype = dns_rdatatype_any;
+			list_type = dns_rdatatype_any;
+			list_addresses = ISC_FALSE;
 			lookup->rdtypeset = ISC_TRUE;
 			short_form = ISC_FALSE;
 			break;
+		case 'i':
+			lookup->ip6_int = ISC_TRUE;
+			break;
 		case 'n':
-			lookup->nibble = ISC_TRUE;
 			break;
 		case 'w':
 			/*
@@ -653,7 +683,9 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	}
 
 	lookup->pending = ISC_FALSE;
-	if (get_reverse(store, hostname, lookup->nibble) == ISC_R_SUCCESS) {
+	if (get_reverse(store, hostname, lookup->ip6_int, ISC_TRUE)
+	    == ISC_R_SUCCESS)
+	{
 		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
 		lookup->rdtypeset = ISC_TRUE;
@@ -673,6 +705,8 @@ main(int argc, char **argv) {
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
+	
+	fatalexit = 1;
 
 	debug("main()");
 	progname = argv[0];
diff --git a/usr.sbin/bind/bin/dig/host.docbook b/usr.sbin/bind/bin/dig/host.docbook
index 05b6c2efd4b..467bbc8c405 100644
--- a/usr.sbin/bind/bin/dig/host.docbook
+++ b/usr.sbin/bind/bin/dig/host.docbook
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: host.docbook,v 1.2.10.2 2003/02/17 07:05:03 marka Exp $ -->
+<!-- $ISC: host.docbook,v 1.2.2.2 2003/03/06 04:38:10 marka Exp $ -->
 
 <refentry>
 
diff --git a/usr.sbin/bind/bin/dig/include/dig/dig.h b/usr.sbin/bind/bin/dig/include/dig/dig.h
index 26616169419..4a46ab46485 100644
--- a/usr.sbin/bind/bin/dig/include/dig/dig.h
+++ b/usr.sbin/bind/bin/dig/include/dig/dig.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dig.h,v 1.71.2.3 2001/11/15 01:24:13 marka Exp $ */
+/* $ISC: dig.h,v 1.71.2.6 2003/07/25 04:36:44 marka Exp $ */
 
 #ifndef DIG_H
 #define DIG_H
@@ -99,7 +99,7 @@ struct dig_lookup {
 		trace, /* dig +trace */
 		trace_root, /* initial query for either +trace or +nssearch */
 		tcp_mode,
-		nibble,
+		ip6_int,
 		comments,
 		stats,
 		section_question,
@@ -152,7 +152,8 @@ struct dig_query {
 		first_soa_rcvd,
 		second_rr_rcvd,
 		first_repeat_rcvd,
-		recv_made;
+		recv_made,
+		warn_id;
 	isc_uint32_t first_rr_serial;
 	isc_uint32_t second_rr_serial;
 	isc_uint32_t rr_count;
@@ -189,7 +190,8 @@ void
 get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr);
 
 isc_result_t
-get_reverse(char *reverse, char *value, isc_boolean_t nibble);
+get_reverse(char *reverse, char *value, isc_boolean_t ip6int,
+	    isc_boolean_t strict);
 
 void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
diff --git a/usr.sbin/bind/bin/dig/nslookup.c b/usr.sbin/bind/bin/dig/nslookup.c
index c4efb3f6819..0070b19b7a4 100644
--- a/usr.sbin/bind/bin/dig/nslookup.c
+++ b/usr.sbin/bind/bin/dig/nslookup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002  Internet Software Consortium.
+ * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: nslookup.c,v 1.90.2.3 2002/03/20 22:45:11 marka Exp $ */
+/* $ISC: nslookup.c,v 1.90.2.5 2003/10/09 07:32:30 marka Exp $ */
 
 #include <config.h>
 
@@ -626,7 +626,9 @@ addlookup(char *opt) {
 		rdclass = dns_rdataclass_in;
 	}
 	lookup = make_empty_lookup();
-	if (get_reverse(store, opt, lookup->nibble) == ISC_R_SUCCESS) {
+	if (get_reverse(store, opt, lookup->ip6_int, ISC_TRUE)
+	    == ISC_R_SUCCESS)
+	{
 		safecpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
 		lookup->rdtypeset = ISC_TRUE;
diff --git a/usr.sbin/bind/bin/dnssec/dnssec-makekeyset.docbook b/usr.sbin/bind/bin/dnssec/dnssec-makekeyset.docbook
index 3448a149338..444afbfe8b7 100644
--- a/usr.sbin/bind/bin/dnssec/dnssec-makekeyset.docbook
+++ b/usr.sbin/bind/bin/dnssec/dnssec-makekeyset.docbook
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: dnssec-makekeyset.docbook,v 1.2.2.1.6.2 2003/02/17 07:05:03 marka Exp $ -->
+<!-- $ISC: dnssec-makekeyset.docbook,v 1.2.2.3 2003/03/06 04:38:13 marka Exp $ -->
 
 <refentry>
   <refentryinfo>
diff --git a/usr.sbin/bind/bin/dnssec/dnssec-signkey.c b/usr.sbin/bind/bin/dnssec/dnssec-signkey.c
index 0f09c668402..677e781d279 100644
--- a/usr.sbin/bind/bin/dnssec/dnssec-signkey.c
+++ b/usr.sbin/bind/bin/dnssec/dnssec-signkey.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Portions Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dnssec-signkey.c,v 1.50.2.1 2001/10/05 00:21:46 bwelling Exp $ */
+/* $ISC: dnssec-signkey.c,v 1.50.2.3 2003/10/09 07:32:31 marka Exp $ */
 
 #include <config.h>
 
@@ -259,7 +259,7 @@ main(int argc, char *argv[]) {
 
 	setup_logging(verbose, mctx, &log);
 
-	if (strlen(argv[0]) < 8 || strncmp(argv[0], "keyset-", 7) != 0)
+	if (strlen(argv[0]) < 8U || strncmp(argv[0], "keyset-", 7) != 0)
 		fatal("keyset file '%s' must start with keyset-", argv[0]);
 
 	db = NULL;
diff --git a/usr.sbin/bind/bin/dnssec/dnssec-signkey.docbook b/usr.sbin/bind/bin/dnssec/dnssec-signkey.docbook
index e23c1faad96..39eb7ec135e 100644
--- a/usr.sbin/bind/bin/dnssec/dnssec-signkey.docbook
+++ b/usr.sbin/bind/bin/dnssec/dnssec-signkey.docbook
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: dnssec-signkey.docbook,v 1.2.120.2 2003/02/17 07:05:03 marka Exp $ -->
+<!-- $ISC: dnssec-signkey.docbook,v 1.2.2.2 2003/03/06 04:38:13 marka Exp $ -->
 
 <refentry>
   <refentryinfo>
diff --git a/usr.sbin/bind/bin/dnssec/dnssec-signzone.c b/usr.sbin/bind/bin/dnssec/dnssec-signzone.c
index 06576336b97..47b456ffea6 100644
--- a/usr.sbin/bind/bin/dnssec/dnssec-signzone.c
+++ b/usr.sbin/bind/bin/dnssec/dnssec-signzone.c
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dnssec-signzone.c,v 1.139.2.1.6.3 2003/02/17 07:05:03 marka Exp $ */
+/* $ISC: dnssec-signzone.c,v 1.139.2.2 2003/03/06 04:38:13 marka Exp $ */
 
 #include <config.h>
 
diff --git a/usr.sbin/bind/bin/dnssec/dnssec-signzone.docbook b/usr.sbin/bind/bin/dnssec/dnssec-signzone.docbook
index b1f023c306c..5cea47eddf0 100644
--- a/usr.sbin/bind/bin/dnssec/dnssec-signzone.docbook
+++ b/usr.sbin/bind/bin/dnssec/dnssec-signzone.docbook
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: dnssec-signzone.docbook,v 1.2.52.2 2003/02/17 07:05:03 marka Exp $ -->
+<!-- $ISC: dnssec-signzone.docbook,v 1.2.2.2 2003/03/06 04:38:13 marka Exp $ -->
 
 <refentry>
   <refentryinfo>
diff --git a/usr.sbin/bind/bin/dnssec/dnssectool.c b/usr.sbin/bind/bin/dnssec/dnssectool.c
index 10fbe976fb9..14632df2ab9 100644
--- a/usr.sbin/bind/bin/dnssec/dnssectool.c
+++ b/usr.sbin/bind/bin/dnssec/dnssectool.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dnssectool.c,v 1.31.2.2 2001/11/27 22:41:49 gson Exp $ */
+/* $ISC: dnssectool.c,v 1.31.2.4 2003/10/09 07:32:31 marka Exp $ */
 
 #include <config.h>
 
@@ -244,7 +244,7 @@ strtotime(char *str, isc_int64_t now, isc_int64_t base) {
 		if (*endp != '\0')
 			fatal("time value %s is invalid", str);
 		val = now + offset;
-	} else if (strlen(str) == 8) {
+	} else if (strlen(str) == 8U) {
 		char timestr[15];
 		snprintf(timestr, sizeof(timestr), "%s000000", str);
 		result = dns_time64_fromtext(timestr, &val);
diff --git a/usr.sbin/bind/bin/named/client.c b/usr.sbin/bind/bin/named/client.c
index 0a73e2d0ab1..edb4af4f5f8 100644
--- a/usr.sbin/bind/bin/named/client.c
+++ b/usr.sbin/bind/bin/named/client.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: client.c,v 1.176.2.11.4.2 2003/02/17 07:05:04 marka Exp $ */
+/* $ISC: client.c,v 1.176.2.13 2003/07/18 06:14:30 marka Exp $ */
 
 #include <config.h>
 
@@ -589,7 +589,8 @@ ns_client_next(ns_client_t *client, isc_result_t result) {
 	int newstate;
 
 	REQUIRE(NS_CLIENT_VALID(client));
-	REQUIRE(client->state == NS_CLIENTSTATE_WORKING);
+	REQUIRE(client->state == NS_CLIENTSTATE_WORKING ||
+		client->state == NS_CLIENTSTATE_READING);
 
 	CTRACE("next");
 
diff --git a/usr.sbin/bind/bin/named/control.c b/usr.sbin/bind/bin/named/control.c
index 983f473abf8..c7ab6ec8ff8 100644
--- a/usr.sbin/bind/bin/named/control.c
+++ b/usr.sbin/bind/bin/named/control.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001  Internet Software Consortium.
+ * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: control.c,v 1.7 2001/05/31 01:21:06 bwelling Exp $ */
+/* $ISC: control.c,v 1.7.2.2 2003/07/22 04:03:33 marka Exp $ */
 
 #include <config.h>
 
@@ -110,6 +110,8 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 		result = ns_server_flushcache(ns_g_server, command);
 	} else if (command_compare(command, NS_COMMAND_STATUS)) {
 		result = ns_server_status(ns_g_server, text);
+	} else if (command_compare(command, NS_COMMAND_NULL)) {
+		result = ISC_R_SUCCESS;
 	} else {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_CONTROL, ISC_LOG_WARNING,
diff --git a/usr.sbin/bind/bin/named/controlconf.c b/usr.sbin/bind/bin/named/controlconf.c
index d43df11674d..cb2f951aee4 100644
--- a/usr.sbin/bind/bin/named/controlconf.c
+++ b/usr.sbin/bind/bin/named/controlconf.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001  Internet Software Consortium.
+ * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: controlconf.c,v 1.28.2.7 2001/11/27 22:38:14 gson Exp $ */
+/* $ISC: controlconf.c,v 1.28.2.9 2003/07/22 04:03:33 marka Exp $ */
 
 #include <config.h>
 
@@ -45,6 +45,7 @@
 #include <isccc/events.h>
 #include <isccc/result.h>
 #include <isccc/sexpr.h>
+#include <isccc/symtab.h>
 #include <isccc/util.h>
 
 #include <dns/keyvalues.h>
@@ -86,6 +87,7 @@ struct controlconnection {
 	isc_timer_t *			timer;
 	unsigned char			buffer[2048];
 	controllistener_t *		listener;
+	isc_uint32_t			nonce;
 	ISC_LINK(controlconnection_t)	link;
 };
 
@@ -107,11 +109,14 @@ struct ns_controls {
 	ns_server_t			*server;
 	controllistenerlist_t 		listeners;
 	isc_boolean_t			shuttingdown;
+	isccc_symtab_t			*symtab;
 };
 
 static void control_newconn(isc_task_t *task, isc_event_t *event);
 static void control_recvmessage(isc_task_t *task, isc_event_t *event);
 
+#define CLOCKSKEW 300
+
 static void
 free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
 	if (key->keyname != NULL)
@@ -327,6 +332,10 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	char textarray[1024];
 	isc_result_t result;
 	isc_result_t eresult;
+	isccc_sexpr_t *_ctrl;
+	isccc_time_t sent;
+	isccc_time_t exp;
+	isc_uint32_t nonce;
 
 	REQUIRE(event->ev_type == ISCCC_EVENT_CCMSG);
 
@@ -387,10 +396,64 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		goto cleanup;
 	}
 
+	isc_stdtime_get(&now);
+
+	/*
+	 * Limit exposure to replay attacks.
+	 */
+	_ctrl = isccc_alist_lookup(request, "_ctrl");
+	if (_ctrl == NULL) {
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
+		goto cleanup;
+	}
+
+	if (isccc_cc_lookupuint32(_ctrl, "_tim", &sent) == ISC_R_SUCCESS) {
+		if ((sent + CLOCKSKEW) < now || (sent - CLOCKSKEW) > now) {
+			log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);
+			goto cleanup;
+		}
+	} else {
+		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
+		goto cleanup;
+	}
+
+	/*
+	 * Expire messages that are too old.
+	 */
+	if (isccc_cc_lookupuint32(_ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
+	    now > exp) {
+		log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);
+		goto cleanup;
+	}
+
+	/*
+	 * Duplicate suppression (required for UDP).
+	 */
+	isccc_cc_cleansymtab(listener->controls->symtab, now);
+	result = isccc_cc_checkdup(listener->controls->symtab, request, now);
+	if (result != ISC_R_SUCCESS) {
+		if (result == ISC_R_EXISTS)
+                        result = ISCCC_R_DUPLICATE; 
+		log_invalid(&conn->ccmsg, result);
+		goto cleanup;
+	}
+
+	if (conn->nonce != 0 &&
+	    (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS ||
+	     conn->nonce != nonce)) {
+		log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);
+		goto cleanup;
+	}
+
+	/*
+	 * Establish nonce.
+	 */
+	while (conn->nonce == 0)
+		isc_random_get(&conn->nonce);
+
 	isc_buffer_init(&text, textarray, sizeof(textarray));
 	eresult = ns_control_docommand(request, &text);
 
-	isc_stdtime_get(&now);
 	result = isccc_cc_createresponse(request, now, now + 60, &response);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
@@ -416,6 +479,11 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		}
 	}
 
+	_ctrl = isccc_alist_lookup(response, "_ctrl");
+	if (_ctrl == NULL ||
+	    isccc_cc_defineuint32(_ctrl, "_nonce", conn->nonce) == NULL)
+		goto cleanup;
+
 	ccregion.rstart = conn->buffer + 4;
 	ccregion.rend = conn->buffer + sizeof(conn->buffer);
 	result = isccc_cc_towire(response, &ccregion, &secret);
@@ -491,6 +559,7 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) {
 		goto cleanup;
 
 	conn->listener = listener;
+	conn->nonce = 0;
 	ISC_LINK_INIT(conn, link);
 
 	result = isccc_ccmsg_readmessage(&conn->ccmsg, listener->task,
@@ -1230,12 +1299,20 @@ ns_controls_configure(ns_controls_t *cp, cfg_obj_t *config,
 isc_result_t
 ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp) {
 	isc_mem_t *mctx = server->mctx;
+	isc_result_t result;
 	ns_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));
+
 	if (controls == NULL)
 		return (ISC_R_NOMEMORY);
 	controls->server = server;
 	ISC_LIST_INIT(controls->listeners);
 	controls->shuttingdown = ISC_FALSE;
+	controls->symtab = NULL;
+	result = isccc_cc_createsymtab(&controls->symtab);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(server->mctx, controls, sizeof(*controls));
+		return (result);
+	}
 	*ctrlsp = controls;
 	return (ISC_R_SUCCESS);
 }
@@ -1246,6 +1323,7 @@ ns_controls_destroy(ns_controls_t **ctrlsp) {
 
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));
 
+	isccc_symtab_destroy(&controls->symtab);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));
 	*ctrlsp = NULL;
 }
diff --git a/usr.sbin/bind/bin/named/include/named/control.h b/usr.sbin/bind/bin/named/include/named/control.h
index f42fd94495a..fff0ea0ae4e 100644
--- a/usr.sbin/bind/bin/named/include/named/control.h
+++ b/usr.sbin/bind/bin/named/include/named/control.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001  Internet Software Consortium.
+ * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: control.h,v 1.6 2001/05/08 04:09:40 bwelling Exp $ */
+/* $ISC: control.h,v 1.6.2.2 2003/07/22 04:03:35 marka Exp $ */
 
 #ifndef NAMED_CONTROL_H
 #define NAMED_CONTROL_H 1
@@ -43,6 +43,7 @@
 #define NS_COMMAND_NOTRACE	"notrace"
 #define NS_COMMAND_FLUSH	"flush"
 #define NS_COMMAND_STATUS	"status"
+#define NS_COMMAND_NULL		"null"
 
 isc_result_t
 ns_controls_create(ns_server_t *server, ns_controls_t **ctrlsp);
diff --git a/usr.sbin/bind/bin/named/lwdgnba.c b/usr.sbin/bind/bin/named/lwdgnba.c
index bf9fbda5c8b..7b264a298ea 100644
--- a/usr.sbin/bind/bin/named/lwdgnba.c
+++ b/usr.sbin/bind/bin/named/lwdgnba.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: lwdgnba.c,v 1.13 2001/08/08 22:54:19 gson Exp $ */
+/* $ISC: lwdgnba.c,v 1.13.2.2 2003/10/09 07:32:32 marka Exp $ */
 
 #include <config.h>
 
@@ -66,7 +66,8 @@ byaddr_done(isc_task_t *task, isc_event_t *event) {
 		isc_event_free(&event);
 		bevent = NULL;
 
-		if ((client->options & DNS_BYADDROPT_IPV6NIBBLE) != 0) {
+		if (client->na.family != AF_INET6 ||
+		    (client->options & DNS_BYADDROPT_IPV6NIBBLE) == 0) {
 			if (result == DNS_R_NCACHENXDOMAIN ||
 			    result == DNS_R_NCACHENXRRSET ||
 			    result == DNS_R_NXDOMAIN ||
@@ -79,10 +80,12 @@ byaddr_done(isc_task_t *task, isc_event_t *event) {
 		}
 
 		/*
-		 * Fall back to nibble reverse if the default of bitstrings
-		 * fails.
+		 * Fall back to IP6.INT nibble then IP6.ARPA bitstring.
 		 */
-		client->options |= DNS_BYADDROPT_IPV6NIBBLE;
+		if ((client->options & DNS_BYADDROPT_IPV6INT) == 0)
+			client->options |= DNS_BYADDROPT_IPV6INT;
+		else
+			client->options &= ~DNS_BYADDROPT_IPV6NIBBLE;
 
 		start_byaddr(client);
 		return;
@@ -220,7 +223,10 @@ ns_lwdclient_processgnba(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	if (req->addr.address == NULL)
 		goto out;
 
-	client->options = 0;
+	/*
+	 * Start with IP6.ARPA NIBBLE lookups.
+	 */
+	client->options = DNS_BYADDROPT_IPV6NIBBLE;
 	if (req->addr.family == LWRES_ADDRTYPE_V4) {
 		client->na.family = AF_INET;
 		if (req->addr.length != 4)
@@ -249,7 +255,6 @@ ns_lwdclient_processgnba(ns_lwdclient_t *client, lwres_buffer_t *b) {
 	 * going to build up.
 	 */
 	init_gnba(client);
-	client->options = 0;
 
 	/*
 	 * Start the find.
diff --git a/usr.sbin/bind/bin/named/lwresd.c b/usr.sbin/bind/bin/named/lwresd.c
index 10f5e3d7ba5..94bf4e141d2 100644
--- a/usr.sbin/bind/bin/named/lwresd.c
+++ b/usr.sbin/bind/bin/named/lwresd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: lwresd.c,v 1.37 2001/08/07 01:58:55 marka Exp $ */
+/* $ISC: lwresd.c,v 1.37.2.2 2003/07/22 04:03:34 marka Exp $ */
 
 /*
  * Main program for the Lightweight Resolver Daemon.
@@ -432,6 +432,7 @@ ns_lwdmanager_detach(ns_lwresd_t **lwresdp) {
 	INSIST(VALID_LWRESD(*lwresdp));
 
 	lwresd = *lwresdp;
+	*lwresdp = NULL;
 
 	LOCK(&lwresd->lock);
 	INSIST(lwresd->refs > 0);
@@ -450,7 +451,6 @@ ns_lwdmanager_detach(ns_lwresd_t **lwresdp) {
 	lwresd->magic = 0;
 	isc_mem_put(mctx, lwresd, sizeof(*lwresd));
 	isc_mem_detach(&mctx);
-	lwresdp = NULL;
 }
 
 
@@ -495,7 +495,7 @@ ns_lwreslistener_detach(ns_lwreslistener_t **listenerp) {
 	if (listener->manager != NULL)
 		ns_lwdmanager_detach(&listener->manager);
 
-	if (listener->sock != 0)
+	if (listener->sock != NULL)
 		isc_socket_detach(&listener->sock);
 
 	listener->magic = 0;
@@ -563,18 +563,21 @@ listener_bind(ns_lwreslistener_t *listener, isc_sockaddr_t *address) {
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_LWRESD, ISC_LOG_WARNING,
-			      "failed to create socket: %s",
+			      "failed to create lwres socket: %s",
 			      isc_result_totext(result));
 		return (result);
 	}
 
 	result = isc_socket_bind(sock, &listener->address);
 	if (result != ISC_R_SUCCESS) {
+		char socktext[ISC_SOCKADDR_FORMATSIZE];
+		isc_sockaddr_format(&listener->address, socktext,
+				    sizeof(socktext));
 		isc_socket_detach(&sock);
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_LWRESD, ISC_LOG_WARNING,
-			      "failed to bind socket: %s",
-			      isc_result_totext(result));
+			      "failed to add lwres socket: %s: %s",
+			      socktext, isc_result_totext(result));
 		return (result);
 	}
 	listener->sock = sock;
@@ -698,8 +701,10 @@ configure_listener(isc_sockaddr_t *address, ns_lwresd_t *lwresd,
 	 */
 	if (oldlistener == NULL) {
 		result = listener_bind(listener, address);
-		if (result != ISC_R_SUCCESS)
-			return (result);
+		if (result != ISC_R_SUCCESS) {
+			ns_lwreslistener_detach(&listener);
+			return (ISC_R_SUCCESS);
+		}
 	} else
 		listener_copysock(oldlistener, listener);
 
@@ -711,7 +716,7 @@ configure_listener(isc_sockaddr_t *address, ns_lwresd_t *lwresd,
 			      "lwres: failed to start %s: %s", socktext,
 			      isc_result_totext(result));
 		ns_lwreslistener_detach(&listener);
-		return (result);
+		return (ISC_R_SUCCESS);
 	}
 
 	if (oldlistener != NULL) {
@@ -742,6 +747,9 @@ ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config) {
 	ns_lwreslistenerlist_t newlisteners;
 	isc_result_t result;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
+	isc_sockaddr_t *addrs = NULL;
+	ns_lwresd_t *lwresd = NULL;
+	isc_uint32_t count = 0;
 
 	REQUIRE(mctx != NULL);
 	REQUIRE(config != NULL);
@@ -767,16 +775,10 @@ ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config) {
 	     element != NULL;
 	     element = cfg_list_next(element))
 	{
-		ns_lwresd_t *lwresd;
 		in_port_t port;
-		isc_sockaddr_t *addrs = NULL;
-		isc_uint32_t count;
 
 		lwres = cfg_listelt_value(element);
-		lwresd = NULL;
-		result = ns_lwdmanager_create(mctx, lwres, &lwresd);
-		if (result != ISC_R_SUCCESS)
-			return (result);
+		CHECK(ns_lwdmanager_create(mctx, lwres, &lwresd));
 
 		port = lwresd_g_listenport;
 		if (port == 0)
@@ -790,33 +792,19 @@ ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config) {
 
 			localhost.s_addr = htonl(INADDR_LOOPBACK);
 			isc_sockaddr_fromin(&address, &localhost, port);
-			result = configure_listener(&address, lwresd,
-						    mctx, &newlisteners);
+			CHECK(configure_listener(&address, lwresd, mctx,
+						 &newlisteners));
 		} else {
 			isc_uint32_t i;
 
-			result = ns_config_getiplist(config, listenerslist,
-						     port, mctx,
-						     &addrs, &count);
-			if (result != ISC_R_SUCCESS)
-				goto failure;
-			
-			for (i = 0; i < count; i++) {
-				result = configure_listener(&addrs[i], lwresd,
-							    mctx,
-							    &newlisteners);
-				if (result != ISC_R_SUCCESS)
-					goto failure;
-			}
-		}
-
-	failure:
-		if (addrs != NULL)
+			CHECK(ns_config_getiplist(config, listenerslist,
+						  port, mctx, &addrs, &count));
+			for (i = 0; i < count; i++)
+				CHECK(configure_listener(&addrs[i], lwresd,
+							 mctx, &newlisteners));
 			ns_config_putiplist(mctx, &addrs, count);
-
+		}
 		ns_lwdmanager_detach(&lwresd);
-		if (result != ISC_R_SUCCESS)
-			return (result);
 	}
 
 	/*
@@ -827,21 +815,30 @@ ns_lwresd_configure(isc_mem_t *mctx, cfg_obj_t *config) {
 	while (!ISC_LIST_EMPTY(listeners)) {
 		listener = ISC_LIST_HEAD(listeners);
 		ISC_LIST_UNLINK(listeners, listener, link);
-		listener_shutdown(listener);
-		ns_lwreslistener_detach(&listener);
 
 		isc_sockaddr_format(&listener->address,
 				    socktext, sizeof(socktext));
+
+		listener_shutdown(listener);
+		ns_lwreslistener_detach(&listener);
+
 		isc_log_write(ns_g_lctx, ISC_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_LWRESD, ISC_LOG_NOTICE,
 			      "lwres no longer listening on %s", socktext);
-
 	}
+
+ cleanup:
 	ISC_LIST_APPENDLIST(listeners, newlisteners, link);
 
+	if (addrs != NULL)
+		ns_config_putiplist(mctx, &addrs, count);
+
+	if (lwresd != NULL)
+		ns_lwdmanager_detach(&lwresd);
+
 	UNLOCK(&listeners_lock);
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 void
diff --git a/usr.sbin/bind/bin/named/main.c b/usr.sbin/bind/bin/named/main.c
index c8d12b04c44..5a3ebbd4024 100644
--- a/usr.sbin/bind/bin/named/main.c
+++ b/usr.sbin/bind/bin/named/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: main.c,v 1.119.2.2 2002/08/05 06:57:01 marka Exp $ */
+/* $ISC: main.c,v 1.119.2.5 2003/10/09 07:32:33 marka Exp $ */
 
 #include <config.h>
 
@@ -28,6 +28,7 @@
 #include <isc/dir.h>
 #include <isc/entropy.h>
 #include <isc/file.h>
+#include <isc/hash.h>
 #include <isc/os.h>
 #include <isc/platform.h>
 #include <isc/resource.h>
@@ -38,6 +39,7 @@
 #include <isccc/result.h>
 
 #include <dns/dispatch.h>
+#include <dns/name.h>
 #include <dns/result.h>
 #include <dns/view.h>
 
@@ -432,6 +434,14 @@ create_managers(void) {
 		return (ISC_R_UNEXPECTED);
 	}
 
+	result = isc_hash_create(ns_g_mctx, ns_g_entropy, DNS_NAME_MAXWIRE);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_hash_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -449,6 +459,13 @@ destroy_managers(void) {
 	isc_taskmgr_destroy(&ns_g_taskmgr);
 	isc_timermgr_destroy(&ns_g_timermgr);
 	isc_socketmgr_destroy(&ns_g_socketmgr);
+
+	/*
+	 * isc_hash_destroy() cannot be called as long as a resolver may be
+	 * running.  Calling this after isc_taskmgr_destroy() ensures the
+	 * call is safe.
+	 */
+	isc_hash_destroy();
 }
 
 static void
diff --git a/usr.sbin/bind/bin/named/notify.c b/usr.sbin/bind/bin/named/notify.c
index 745bb5ffa1d..fbb436349b1 100644
--- a/usr.sbin/bind/bin/named/notify.c
+++ b/usr.sbin/bind/bin/named/notify.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: notify.c,v 1.24 2001/03/31 01:03:26 bwelling Exp $ */
+/* $ISC: notify.c,v 1.24.2.2 2003/07/22 04:03:34 marka Exp $ */
 
 #include <config.h>
 
@@ -84,7 +84,7 @@ ns_notify_start(ns_client_t *client) {
 	result = dns_message_firstname(request, DNS_SECTION_QUESTION);
 	if (result != ISC_R_SUCCESS) {
 		notify_log(ISC_LOG_INFO, "notify question section empty");
-		goto failure;
+		goto formerr;
 	}
 
 	/*
@@ -96,7 +96,7 @@ ns_notify_start(ns_client_t *client) {
 	if (ISC_LIST_NEXT(zone_rdataset, link) != NULL) {
 		notify_log(ISC_LOG_INFO,
 			   "notify question section contains multiple RRs");
-		goto failure;
+		goto formerr;
 	}
 
 	/* The zone section must have exactly one name. */
@@ -111,36 +111,39 @@ ns_notify_start(ns_client_t *client) {
 	if (zone_rdataset->type != dns_rdatatype_soa) {
 		notify_log(ISC_LOG_INFO,
 			   "notify question section contains no SOA");
-		goto failure;
+		goto formerr;
 	}
 
+	dns_name_format(zonename, str, sizeof(str));
 	result = dns_zt_find(client->view->zonetable, zonename, 0, NULL,
 			     &zone);
-	if (result != ISC_R_SUCCESS) {
-		dns_name_format(zonename, str, sizeof(str));
-		notify_log(ISC_LOG_INFO,
-			   "received notify for zone '%s': not authoritative",
-			   str);
-		goto failure;
-	}
+	if (result != ISC_R_SUCCESS)
+		goto notauth;
 
 	switch(dns_zone_gettype(zone)) {
 	case dns_zone_master:
 	case dns_zone_slave:
 	case dns_zone_stub:	/* Allow dialup passive to work. */
+		notify_log(ISC_LOG_INFO, "received notify for zone '%s'", str);
 		respond(client, dns_zone_notifyreceive(zone,
 			ns_client_getsockaddr(client), request));
 		break;
 	default:
-		dns_name_format(zonename, str, sizeof(str));
-		notify_log(ISC_LOG_INFO,
-			   "received notify for zone '%s': not authoritative",
-			   str);
-		goto failure;
+		goto notauth;
 	}
 	dns_zone_detach(&zone);
 	return;
 
+ notauth:
+	notify_log(ISC_LOG_INFO,
+		   "received notify for zone '%s': not authoritative",
+		   str);
+	result = DNS_R_NOTAUTH;
+	goto failure;
+
+ formerr:
+	result = DNS_R_FORMERR;
+
  failure:
 	if (zone != NULL)
 		dns_zone_detach(&zone);
diff --git a/usr.sbin/bind/bin/named/query.c b/usr.sbin/bind/bin/named/query.c
index 018d71f737b..0976e0a6eb8 100644
--- a/usr.sbin/bind/bin/named/query.c
+++ b/usr.sbin/bind/bin/named/query.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: query.c,v 1.198.2.8.4.2 2003/02/17 07:05:04 marka Exp $ */
+/* $ISC: query.c,v 1.198.2.14 2003/09/02 02:27:53 marka Exp $ */
 
 #include <config.h>
 
@@ -1148,6 +1148,12 @@ query_addadditional(void *arg, dns_name_t *name, dns_rdatatype_t qtype) {
 	if (client->query.gluedb == NULL)
 		goto cleanup;
 
+	/*
+	 * Don't poision caches using the bailiwick protection model.
+	 */
+	if (!dns_name_issubdomain(name, dns_db_origin(client->query.gluedb)))
+		goto cleanup;
+
 	dns_db_attach(client->query.gluedb, &db);
 	result = dns_db_find(db, name, version, type,
 			     client->query.dboptions | DNS_DBFIND_GLUEOK,
@@ -1934,7 +1940,9 @@ query_addbestns(ns_client_t *client) {
 			zdb = db;
 			zfname = fname;
 			zrdataset = rdataset;
+			rdataset = NULL;
 			zsigrdataset = sigrdataset;
+			sigrdataset = NULL;
 			dns_db_detachnode(db, &node);
 			version = NULL;
 			db = NULL;
@@ -1995,7 +2003,8 @@ query_addbestns(ns_client_t *client) {
 		       DNS_SECTION_AUTHORITY);
 
  cleanup:
-	query_putrdataset(client, &rdataset);
+	if (rdataset != NULL)
+		query_putrdataset(client, &rdataset);
 	if (sigrdataset != NULL)
 		query_putrdataset(client, &sigrdataset);
 	if (fname != NULL)
@@ -2372,6 +2381,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	dns_zone_t *zone;
 	dns_rdata_cname_t cname;
 	dns_rdata_dname_t dname;
+	isc_boolean_t empty_wild;
 
 	CTRACE("query_find");
 
@@ -2394,6 +2404,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	zdb = NULL;
 	version = NULL;
 	zone = NULL;
+	empty_wild = ISC_FALSE;
 
 	if (event != NULL) {
 		/*
@@ -2696,7 +2707,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				zdb = db;
 				zfname = fname;
 				zrdataset = rdataset;
+				rdataset = NULL;
 				zsigrdataset = sigrdataset;
+				sigrdataset = NULL;
 				dns_db_detachnode(db, &node);
 				version = NULL;
 				db = NULL;
@@ -2782,6 +2795,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			}
 		}
 		goto cleanup;
+	case DNS_R_EMPTYNAME:
+		result = DNS_R_NXRRSET;
+		/* FALLTHROUGH */
 	case DNS_R_NXRRSET:
 		INSIST(is_zone);
 		if (dns_rdataset_isassociated(rdataset)) {
@@ -2817,6 +2833,9 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 					       NULL, DNS_SECTION_AUTHORITY);
 		}
 		goto cleanup;
+	case DNS_R_EMPTYWILD:
+		empty_wild = ISC_TRUE;
+		/* FALLTHROUGH */
 	case DNS_R_NXDOMAIN:
 		INSIST(is_zone);
 		if (dns_rdataset_isassociated(rdataset)) {
@@ -2860,7 +2879,10 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		/*
 		 * Set message rcode.
 		 */
-		client->message->rcode = dns_rcode_nxdomain;
+		if (empty_wild)
+			client->message->rcode = dns_rcode_noerror;
+		else
+			client->message->rcode = dns_rcode_nxdomain;
 		goto cleanup;
 	case DNS_R_NCACHENXDOMAIN:
 	case DNS_R_NCACHENXRRSET:
@@ -3192,7 +3214,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 	/*
 	 * General cleanup.
 	 */
-	query_putrdataset(client, &rdataset);
+	if (rdataset != NULL)
+		query_putrdataset(client, &rdataset);
 	if (sigrdataset != NULL)
 		query_putrdataset(client, &sigrdataset);
 	if (fname != NULL)
diff --git a/usr.sbin/bind/bin/named/server.c b/usr.sbin/bind/bin/named/server.c
index 46fd65c1a3b..fee23ff2c15 100644
--- a/usr.sbin/bind/bin/named/server.c
+++ b/usr.sbin/bind/bin/named/server.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: server.c,v 1.339.2.8.4.3 2003/02/18 03:27:58 marka Exp $ */
+/* $ISC: server.c,v 1.339.2.18 2003/09/19 13:40:42 marka Exp $ */
 
 #include <config.h>
 
@@ -26,6 +26,7 @@
 #include <isc/dir.h>
 #include <isc/entropy.h>
 #include <isc/file.h>
+#include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/print.h>
 #include <isc/resource.h>
@@ -163,7 +164,7 @@ configure_view_acl(cfg_obj_t *vconfig, cfg_obj_t *config,
 	return (result);
 }
 
-#ifdef ISC_RFC2335
+#ifdef ISC_RFC2535
 static isc_result_t
 configure_view_dnsseckey(cfg_obj_t *vconfig, cfg_obj_t *key,
 			 dns_keytable_t *keytable, isc_mem_t *mctx)
@@ -398,9 +399,24 @@ get_view_querysource_dispatch(cfg_obj_t **maps,
 				     1000, 32768, 16411, 16433,
 				     attrs, attrmask, &disp);
 	if (result != ISC_R_SUCCESS) {
+		isc_sockaddr_t any;
+		char buf[ISC_SOCKADDR_FORMATSIZE];
+
+		switch (af) {
+		case AF_INET:
+			isc_sockaddr_any(&any);
+			break;
+		case AF_INET6:
+			isc_sockaddr_any6(&any);
+			break;
+		}
+		if (isc_sockaddr_equal(&sa, &any))
+			return (ISC_R_SUCCESS);
+		isc_sockaddr_format(&sa, buf, sizeof(buf));
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "could not get query source dispatcher");
+			      "could not get query source dispatcher (%s)",
+			      buf);
 		return (result);
 	}
 
@@ -850,6 +866,35 @@ configure_view(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig,
 	if (view->maxncachettl > 7 * 24 * 3600)
 		view->maxncachettl = 7 * 24 * 3600;
 
+	obj = NULL;
+	result = ns_config_get(maps, "root-delegation-only", &obj);
+	if (result == ISC_R_SUCCESS) {
+		dns_view_setrootdelonly(view, ISC_TRUE);
+		if (!cfg_obj_isvoid(obj)) {
+			dns_fixedname_t fixed;
+			dns_name_t *name;
+			isc_buffer_t b;
+			char *str;
+			cfg_obj_t *exclude;
+
+			dns_fixedname_init(&fixed);
+			name = dns_fixedname_name(&fixed);
+			for (element = cfg_list_first(obj);
+			     element != NULL;
+			     element = cfg_list_next(element)) {
+				exclude = cfg_listelt_value(element);
+				str = cfg_obj_asstring(exclude);
+				isc_buffer_init(&b, str, strlen(str));
+				isc_buffer_add(&b, strlen(str));
+				CHECK(dns_name_fromtext(name, &b, dns_rootname,
+							ISC_FALSE, NULL));
+				CHECK(dns_view_excludedelegationonly(view,
+								     name));
+			}
+		}
+	} else
+		dns_view_setrootdelonly(view, ISC_FALSE);
+
 	result = ISC_R_SUCCESS;
 
  cleanup:
@@ -921,7 +966,7 @@ create_version_zone(cfg_obj_t **maps, dns_zonemgr_t *zmgr, dns_view_t *view) {
 	INSIST(result == ISC_R_SUCCESS);
 	versiontext = cfg_obj_asstring(obj);
 	len = strlen(versiontext);
-	if (len > 255)
+	if (len > 255U)
 		len = 255; /* Silently truncate. */
 	buf[0] = len;
 	memcpy(buf + 1, versiontext, len);
@@ -957,7 +1002,7 @@ create_version_zone(cfg_obj_t **maps, dns_zonemgr_t *zmgr, dns_view_t *view) {
 	CHECK(dns_zone_replacedb(zone, db, ISC_FALSE));
 
 	CHECK(dns_view_addzone(view, zone));
-
+			
 	result = ISC_R_SUCCESS;
 
  cleanup:
@@ -2213,6 +2258,12 @@ load_new_zones(ns_server_t *server, isc_boolean_t stop) {
 	{
 		CHECK(dns_view_loadnew(view, stop));
 	}
+	/*
+	 * Force zone maintenance.  Do this after loading
+	 * so that we know when we need to force AXFR of
+	 * slave zones whose master files are missing.
+	 */
+	CHECK(dns_zonemgr_forcemaint(server->zonemgr));
  cleanup:
 	isc_task_endexclusive(server->task);	
 	return (result);
@@ -2259,6 +2310,8 @@ run_server(isc_task_t *task, isc_event_t *event) {
 		CHECKFATAL(load_configuration(ns_g_conffile, server, ISC_TRUE),
 			   "loading configuration");
 
+	isc_hash_init();
+
 	CHECKFATAL(load_zones(server, ISC_FALSE),
 		   "loading zones");
 
@@ -2796,7 +2849,7 @@ ns_server_dumpstats(ns_server_t *server) {
 	fprintf(fp, "+++ Statistics Dump +++ (%lu)\n", (unsigned long)now);
 	
 	for (i = 0; i < ncounters; i++)
-		fprintf(fp, "%s %" ISC_PRINT_QUADFORMAT "d\n",
+		fprintf(fp, "%s %" ISC_PRINT_QUADFORMAT "u\n",
 			dns_statscounter_names[i],
 			server->querystats[i]);
 	
@@ -2817,7 +2870,7 @@ ns_server_dumpstats(ns_server_t *server) {
 			viewname = view->name;
 			for (i = 0; i < ncounters; i++) {
 				fprintf(fp, "%s %" ISC_PRINT_QUADFORMAT
-					"d %s",
+					"u %s",
 					dns_statscounter_names[i],
 					zonestats[i],
 					zonename);
@@ -2942,11 +2995,11 @@ ns_server_status(ns_server_t *server, isc_buffer_t *text) {
 					  DNS_ZONESTATE_SOAQUERY);
 	n = snprintf((char *)isc_buffer_used(text),
 		     isc_buffer_availablelength(text),
-		     "number of zones: %d\n"
+		     "number of zones: %u\n"
 		     "debug level: %d\n"
-		     "xfers running: %d\n"
-		     "xfers deferred: %d\n"
-		     "soa queries in progress: %d\n"
+		     "xfers running: %u\n"
+		     "xfers deferred: %u\n"
+		     "soa queries in progress: %u\n"
 		     "query logging is %s\n"
 		     "server is up and running",
 		     zonecount, ns_g_debuglevel, xferrunning, xferdeferred,
diff --git a/usr.sbin/bind/bin/named/update.c b/usr.sbin/bind/bin/named/update.c
index e4f05f749a7..8e2844cca43 100644
--- a/usr.sbin/bind/bin/named/update.c
+++ b/usr.sbin/bind/bin/named/update.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: update.c,v 1.88.2.3 2002/02/08 03:57:15 marka Exp $ */
+/* $ISC: update.c,v 1.88.2.5 2003/07/22 04:03:34 marka Exp $ */
 
 #include <config.h>
 
@@ -1247,6 +1247,8 @@ namelist_append_subdomain(dns_db_t *db, dns_name_t *name, dns_diff_t *affected)
 			break;
 		CHECK(namelist_append_name(affected, child));
 	}
+	if (result == ISC_R_NOMORE)
+		result = ISC_R_SUCCESS;
  failure:
 	if (dbit != NULL)
 		dns_dbiterator_destroy(&dbit);
diff --git a/usr.sbin/bind/bin/named/xfrout.c b/usr.sbin/bind/bin/named/xfrout.c
index 7006052323b..268ac92846b 100644
--- a/usr.sbin/bind/bin/named/xfrout.c
+++ b/usr.sbin/bind/bin/named/xfrout.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: xfrout.c,v 1.101.2.3 2001/10/30 01:28:29 marka Exp $ */
+/* $ISC: xfrout.c,v 1.101.2.5 2003/07/22 04:03:35 marka Exp $ */
 
 #include <config.h>
 
@@ -167,26 +167,37 @@ db_rr_iterator_init(db_rr_iterator_t *it, dns_db_t *db, dns_dbversion_t *ver,
 static isc_result_t
 db_rr_iterator_first(db_rr_iterator_t *it) {
 	it->result = dns_dbiterator_first(it->dbit);
-	if (it->result != ISC_R_SUCCESS)
-		return (it->result);
-	it->result = dns_dbiterator_current(it->dbit, &it->node,
+	/*
+	 * The top node may be empty when out of zone glue exists.
+	 * Walk the tree to find the first node with data.
+	 */
+	while (it->result == ISC_R_SUCCESS) {
+		it->result = dns_dbiterator_current(it->dbit, &it->node,
 				    dns_fixedname_name(&it->fixedname));
-	if (it->result != ISC_R_SUCCESS)
-		return (it->result);
-
-	it->result = dns_db_allrdatasets(it->db, it->node,
-					 it->ver, it->now,
-					 &it->rdatasetit);
-	if (it->result != ISC_R_SUCCESS)
-		return (it->result);
+		if (it->result != ISC_R_SUCCESS)
+			return (it->result);
 
-	it->result = dns_rdatasetiter_first(it->rdatasetit);
-	if (it->result != ISC_R_SUCCESS)
-		return (it->result);
+		it->result = dns_db_allrdatasets(it->db, it->node,
+						 it->ver, it->now,
+						 &it->rdatasetit);
+		if (it->result != ISC_R_SUCCESS)
+			return (it->result);
 
-	dns_rdatasetiter_current(it->rdatasetit, &it->rdataset);
+		it->result = dns_rdatasetiter_first(it->rdatasetit);
+		if (it->result != ISC_R_SUCCESS) {
+			/*
+			 * This node is empty. Try next node.
+			 */
+			dns_rdatasetiter_destroy(&it->rdatasetit);
+			dns_db_detachnode(it->db, &it->node);
+			it->result = dns_dbiterator_next(it->dbit);
+			continue;
+		}
+		dns_rdatasetiter_current(it->rdatasetit, &it->rdataset);
 
-	it->result = dns_rdataset_first(&it->rdataset);
+		it->result = dns_rdataset_first(&it->rdataset);
+		return (it->result);
+	}
 	return (it->result);
 }
 
diff --git a/usr.sbin/bind/bin/nsupdate/nsupdate.c b/usr.sbin/bind/bin/nsupdate/nsupdate.c
index 0ba3bf8f646..055ddd82eac 100644
--- a/usr.sbin/bind/bin/nsupdate/nsupdate.c
+++ b/usr.sbin/bind/bin/nsupdate/nsupdate.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002  Internet Software Consortium.
+ * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: nsupdate.c,v 1.103.2.11 2002/08/06 04:23:20 marka Exp $ */
+/* $ISC: nsupdate.c,v 1.103.2.15 2003/07/25 03:31:42 marka Exp $ */
 
 #include <config.h>
 
@@ -32,6 +32,7 @@
 #include <isc/commandline.h>
 #include <isc/entropy.h>
 #include <isc/event.h>
+#include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -88,7 +89,7 @@ extern int h_errno;
 #define INITTEXT (2 * 1024)
 #define MAXTEXT (128 * 1024)
 #define FIND_TIMEOUT 5
-#define TTL_MAX 2147483647	/* Maximum signed 32 bit integer. */
+#define TTL_MAX 2147483647U	/* Maximum signed 32 bit integer. */
 
 #define DNSDEFAULTPORT 53
 
@@ -490,6 +491,10 @@ setup_system(void) {
 	result = isc_entropy_create(mctx, &entp);
 	check_result(result, "isc_entropy_create");
 
+	result = isc_hash_create(mctx, entp, DNS_NAME_MAXWIRE);
+	check_result(result, "isc_hash_create");
+	isc_hash_init();
+
 	result = dns_dispatchmgr_create(mctx, entp, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");
 
@@ -592,11 +597,25 @@ get_address(char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
 			hints.ai_family = PF_INET;
 		else if (!have_ipv4)
 			hints.ai_family = PF_INET6;
-		else
+		else {
 			hints.ai_family = PF_UNSPEC;
+#ifdef AI_ADDRCONFIG
+			hints.ai_flags = AI_ADDRCONFIG;
+#endif
+		}
 		debug ("before getaddrinfo()");
 		isc_app_block();
+#ifdef AI_ADDRCONFIG
+ again:
+#endif
 		result = getaddrinfo(host, NULL, &hints, &res);
+#ifdef AI_ADDRCONFIG
+		if (result == EAI_BADFLAGS &&
+		    (hints.ai_flags & AI_ADDRCONFIG) != 0) {
+			hints.ai_flags &= ~AI_ADDRCONFIG;
+			goto again;
+		}
+#endif
 		isc_app_unblock();
 		if (result != 0) {
 			fatal("couldn't find server '%s': %s",
@@ -1158,7 +1177,7 @@ update_addordelete(char *cmdline, isc_boolean_t isdelete) {
 	if (isdelete)
 		ttl = 0;
 	else if (ttl > TTL_MAX) {
-		fprintf(stderr, "ttl '%s' is out of range (0 to %d)\n",
+		fprintf(stderr, "ttl '%s' is out of range (0 to %u)\n",
 			word, TTL_MAX);
 		goto failure;
 	}
@@ -1810,6 +1829,9 @@ cleanup(void) {
 	ddebug("Shutting down timer manager");
 	isc_timermgr_destroy(&timermgr);
 
+	ddebug("Destroying hash context");
+	isc_hash_destroy();
+
 	ddebug("Destroying memory context");
 	if (memdebugging)
 		isc_mem_stats(mctx, stderr);
diff --git a/usr.sbin/bind/bin/nsupdate/nsupdate.docbook b/usr.sbin/bind/bin/nsupdate/nsupdate.docbook
index 03d1086c1b7..9ceffa4d033 100644
--- a/usr.sbin/bind/bin/nsupdate/nsupdate.docbook
+++ b/usr.sbin/bind/bin/nsupdate/nsupdate.docbook
@@ -1,6 +1,6 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
 <!--
- - Copyright (C) 2001  Internet Software Consortium.
+ - Copyright (C) 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: nsupdate.docbook,v 1.8.2.1 2001/11/27 18:57:40 gson Exp $ -->
+<!-- $ISC: nsupdate.docbook,v 1.8.2.3 2003/07/22 04:03:36 marka Exp $ -->
 
 <refentry>
 <refentryinfo>
@@ -222,7 +222,7 @@ Sends all dynamic update requests using the local
 
 When no local statement is provided,
 <command>nsupdate</command>
-will send updates using an address and port choosen by the system.
+will send updates using an address and port chosen by the system.
 <parameter>port</parameter>
 can additionally be used to make requests come from a specific port.
 If no port number is specified, the system will assign one.
diff --git a/usr.sbin/bind/bin/nsupdate/nsupdate.html b/usr.sbin/bind/bin/nsupdate/nsupdate.html
index 7fabc927169..e3c67d4a1d4 100644
--- a/usr.sbin/bind/bin/nsupdate/nsupdate.html
+++ b/usr.sbin/bind/bin/nsupdate/nsupdate.html
@@ -387,7 +387,7 @@ When no local statement is provided,
 CLASS="COMMAND"
 >nsupdate</B
 >
-will send updates using an address and port choosen by the system.
+will send updates using an address and port chosen by the system.
 <TT
 CLASS="PARAMETER"
 ><I
diff --git a/usr.sbin/bind/bin/rndc/rndc-confgen.8 b/usr.sbin/bind/bin/rndc/rndc-confgen.8
index df1fb0d5f18..113708ba3be 100644
--- a/usr.sbin/bind/bin/rndc/rndc-confgen.8
+++ b/usr.sbin/bind/bin/rndc/rndc-confgen.8
@@ -13,7 +13,7 @@
 .\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 .\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $ISC: rndc-confgen.8,v 1.3.2.2.4.2 2003/02/17 07:05:06 marka Exp $
+.\" $ISC: rndc-confgen.8,v 1.3.2.6 2003/10/09 07:32:35 marka Exp $
 
 .TH "RNDC-CONFGEN" "8" "Aug 27, 2001" "BIND9" ""
 .SH NAME
diff --git a/usr.sbin/bind/bin/rndc/rndc-confgen.c b/usr.sbin/bind/bin/rndc/rndc-confgen.c
index 5ac27f03d13..383414009d3 100644
--- a/usr.sbin/bind/bin/rndc/rndc-confgen.c
+++ b/usr.sbin/bind/bin/rndc/rndc-confgen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001  Internet Software Consortium.
+ * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rndc-confgen.c,v 1.9.2.4 2001/11/30 01:10:09 gson Exp $ */
+/* $ISC: rndc-confgen.c,v 1.9.2.6 2003/07/22 04:03:37 marka Exp $ */
 
 #include <config.h>
 
@@ -269,11 +269,8 @@ main(int argc, char **argv) {
 			char *buf;
 			len = strlen(chrootdir) + strlen(keyfile) + 2;
 			buf = isc_mem_get(mctx, len);
-			if (buf == NULL) {
-				fprintf(stderr, "isc_mem_get(%d) failed\n",
-					len);
-				goto cleanup;
-			}
+			if (buf == NULL)
+				fatal("isc_mem_get(%d) failed\n", len);
 			snprintf(buf, len, "%s/%s", chrootdir, keyfile);
 			
 			write_key_file(buf, user, keyname, &key_txtbuffer);
@@ -315,7 +312,6 @@ options {\n\
 		       serveraddr, port, serveraddr, keyname);
 	}
 
- cleanup:
 	if (show_final_mem)
 		isc_mem_stats(mctx, stderr);
 
diff --git a/usr.sbin/bind/bin/rndc/rndc-confgen.docbook b/usr.sbin/bind/bin/rndc/rndc-confgen.docbook
index c7a057006d3..5c9e7971198 100644
--- a/usr.sbin/bind/bin/rndc/rndc-confgen.docbook
+++ b/usr.sbin/bind/bin/rndc/rndc-confgen.docbook
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: rndc-confgen.docbook,v 1.3.8.1 2003/02/17 01:29:29 marka Exp $ -->
+<!-- $ISC: rndc-confgen.docbook,v 1.3.2.1 2003/02/07 02:39:01 marka Exp $ -->
 
 <refentry>
   <refentryinfo>
diff --git a/usr.sbin/bind/bin/rndc/rndc-confgen.html b/usr.sbin/bind/bin/rndc/rndc-confgen.html
index e4278c48260..8c8c2762f22 100644
--- a/usr.sbin/bind/bin/rndc/rndc-confgen.html
+++ b/usr.sbin/bind/bin/rndc/rndc-confgen.html
@@ -15,7 +15,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: rndc-confgen.html,v 1.3.2.2.4.2 2003/02/17 07:05:06 marka Exp $ -->
+<!-- $ISC: rndc-confgen.html,v 1.3.2.6 2003/10/09 07:32:35 marka Exp $ -->
 
 <HTML
 ><HEAD
diff --git a/usr.sbin/bind/bin/rndc/rndc.c b/usr.sbin/bind/bin/rndc/rndc.c
index 212e2fae85f..d75d20e53c6 100644
--- a/usr.sbin/bind/bin/rndc/rndc.c
+++ b/usr.sbin/bind/bin/rndc/rndc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rndc.c,v 1.77.2.2 2001/11/28 23:37:50 gson Exp $ */
+/* $ISC: rndc.c,v 1.77.2.5 2003/07/22 04:03:37 marka Exp $ */
 
 /*
  * Principal Author: DCL
@@ -86,6 +86,7 @@ static char *command;
 static char *args;
 static char program[256];
 static isc_socket_t *sock = NULL;
+static isc_uint32_t serial;
 
 static void
 usage(int status) {
@@ -150,11 +151,25 @@ get_address(const char *host, in_port_t port, isc_sockaddr_t *sockaddr) {
 			hints.ai_family = PF_INET;
 		else if (isc_net_probeipv4() != ISC_R_SUCCESS)
 			hints.ai_family = PF_INET6;
-		else
+		else {
 			hints.ai_family = PF_UNSPEC;
+#ifdef AI_ADDRCONFIG
+			hints.ai_flags = AI_ADDRCONFIG;
+#endif
+		}
 		hints.ai_socktype = SOCK_STREAM;
 		isc_app_block();
+#ifdef AI_ADDRCONFIG
+ again:
+#endif
 		result = getaddrinfo(host, NULL, &hints, &res);
+#ifdef AI_ADDRCONFIG
+		if (result == EAI_BADFLAGS &&
+		    (hints.ai_flags & AI_ADDRCONFIG) != 0) {
+			hints.ai_flags &= ~AI_ADDRCONFIG;
+			goto again;
+		}
+#endif
 		isc_app_unblock();
 		if (result != 0)
 			fatal("Couldn't find server '%s': %s",
@@ -244,6 +259,83 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
 }
 
 static void
+rndc_recvnonce(isc_task_t *task, isc_event_t *event) {
+	isccc_sexpr_t *response = NULL;
+	isccc_sexpr_t *_ctrl;
+	isccc_region_t source;
+	isc_result_t result;
+	isc_uint32_t nonce;
+	isccc_sexpr_t *request = NULL;
+	isccc_time_t now;
+	isc_region_t r;
+	isccc_sexpr_t *data;
+	isccc_region_t message;
+	isc_uint32_t len;
+	isc_buffer_t b;
+
+	recvs--;
+
+	if (ccmsg.result == ISC_R_EOF)
+		fatal("connection to remote host closed\n"
+		      "This may indicate that the remote server is using "
+		      "an older version of \n"
+		      "the command protocol, this host is not authorized "
+		      "to connect,\nor the key is invalid.");
+
+	if (ccmsg.result != ISC_R_SUCCESS)
+		fatal("recv failed: %s", isc_result_totext(ccmsg.result));
+
+	source.rstart = isc_buffer_base(&ccmsg.buffer);
+	source.rend = isc_buffer_used(&ccmsg.buffer);
+
+	DO("parse message", isccc_cc_fromwire(&source, &response, &secret));
+
+	_ctrl = isccc_alist_lookup(response, "_ctrl");
+	if (_ctrl == NULL)
+		fatal("_ctrl section missing");
+	nonce = 0;
+	if (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS)
+		nonce = 0;
+
+	isc_stdtime_get(&now);
+
+	DO("create message", isccc_cc_createmessage(1, NULL, NULL, ++serial,
+						    now, now + 60, &request));
+	data = isccc_alist_lookup(request, "_data");
+	if (data == NULL)
+		fatal("_data section missing");
+	if (isccc_cc_definestring(data, "type", args) == NULL)
+		fatal("out of memory");
+	if (nonce != 0) {
+		_ctrl = isccc_alist_lookup(request, "_ctrl");
+		if (_ctrl == NULL)
+			fatal("_ctrl section missing");
+		if (isccc_cc_defineuint32(_ctrl, "_nonce", nonce) == NULL)
+			fatal("out of memory");
+	}
+	message.rstart = databuf + 4;
+	message.rend = databuf + sizeof(databuf);
+	DO("render message", isccc_cc_towire(request, &message, &secret));
+	len = sizeof(databuf) - REGION_SIZE(message);
+	isc_buffer_init(&b, databuf, 4);
+	isc_buffer_putuint32(&b, len - 4);
+	r.length = len;
+	r.base = databuf;
+
+	isccc_ccmsg_cancelread(&ccmsg);
+	DO("schedule recv", isccc_ccmsg_readmessage(&ccmsg, task,
+						    rndc_recvdone, NULL));
+	recvs++;
+	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
+					   NULL));
+	sends++;
+
+	isc_event_free(&event);
+	isccc_sexpr_free(&response);
+	return;
+}
+
+static void
 rndc_connected(isc_task_t *task, isc_event_t *event) {
 	isc_socketevent_t *sevent = (isc_socketevent_t *)event;
 	isccc_sexpr_t *request = NULL;
@@ -252,7 +344,6 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 	isccc_region_t message;
 	isc_region_t r;
 	isc_uint32_t len;
-	isc_uint32_t serial;
 	isc_buffer_t b;
 	isc_result_t result;
 
@@ -262,13 +353,12 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 		fatal("connect failed: %s", isc_result_totext(sevent->result));
 
 	isc_stdtime_get(&now);
-	isc_random_get(&serial);
-	DO("create message", isccc_cc_createmessage(1, NULL, NULL, serial,
+	DO("create message", isccc_cc_createmessage(1, NULL, NULL, ++serial,
 						    now, now + 60, &request));
 	data = isccc_alist_lookup(request, "_data");
 	if (data == NULL)
 		fatal("_data section missing");
-	if (isccc_cc_definestring(data, "type", args) == NULL)
+	if (isccc_cc_definestring(data, "type", "null") == NULL)
 		fatal("out of memory");
 	message.rstart = databuf + 4;
 	message.rend = databuf + sizeof(databuf);
@@ -283,13 +373,12 @@ rndc_connected(isc_task_t *task, isc_event_t *event) {
 	isccc_ccmsg_setmaxsize(&ccmsg, 1024);
 
 	DO("schedule recv", isccc_ccmsg_readmessage(&ccmsg, task,
-						    rndc_recvdone, NULL));
+						    rndc_recvnonce, NULL));
 	recvs++;
 	DO("send message", isc_socket_send(sock, &r, task, rndc_senddone,
 					   NULL));
 	sends++;
 	isc_event_free(&event);
-	
 }
 
 static void
@@ -538,6 +627,8 @@ main(int argc, char **argv) {
 	if (argc < 1)
 		usage(1);
 
+	isc_random_get(&serial);
+
 	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	DO("create socket manager", isc_socketmgr_create(mctx, &socketmgr));
 	DO("create task manager", isc_taskmgr_create(mctx, 1, 0, &taskmgr));
diff --git a/usr.sbin/bind/bin/tests/rbt_test.txt b/usr.sbin/bind/bin/tests/rbt_test.txt
index c2863fd11ab..2376ad4650f 100644
--- a/usr.sbin/bind/bin/tests/rbt_test.txt
+++ b/usr.sbin/bind/bin/tests/rbt_test.txt
@@ -1,4 +1,4 @@
-# Copyright (C) 1999-2001  Internet Software Consortium.
+# Copyright (C) 1999-2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,81 +13,81 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: rbt_test.txt,v 1.13 2001/01/09 21:41:33 bwelling Exp $
-
-add a.vix.com
-add b.vix.com
-add c.vix.com
-print
-add a.b.c.d.e.f.vix.com
-add b.b.c.d.e.f.vix.com
-add c.b.c.d.e.f.vix.com
-print
-add a.d.e.f.vix.com
-add q.d.e.f.vix.com
-add d.e.f.vix.com
-print
-add g.h.vix.com
-print
-search q.d.e.f.vix.com
-search just-parent.a.vix.com
-search no-real-parent.vix.com
-search does.not.exist.at.all
-forward
-backward
-# existing name
-check vix.com.
-# greater than stop node, which has down pointer
-check zzz.com.
-# less than lowest in level (would be left link from stop node)
-check 0.vix.com
-# greater than stop node, no down pointer
-check d.vix.com
-# superdomain stored in existing node
-check f.vix.com
-# common ancestor stored in existing node; existing is successor
-check a.e.f.vix.com
-# common ancestor stored in existing node; existing is less but not predecessor
-check z.e.f.vix.com
-#
-check g.vix.com
-#
-check i.vix.com
-#
-check b.c.vix.com
-nuke d.e.f.vix.com
-print
-add x.a.vix.com
-add y.x.a.vix.com
-print
-delete a.vix.com
-delete x.a.vix.com
-print
-delete b.vix.com
-delete c.vix.com
-print
-delete y.x.a.vix.com
-print
-delete g.h.vix.com.
-add \[b100000].vix.com.
-add \[b010000].vix.com.
-add \[b001000].vix.com.
-add \[b000100].vix.com.
-add \[b000010].vix.com.
-add \[b000001].vix.com.
-p
-search \[b000100].vix.com.
-# zap the entire tree
-add vix.com.
-nuke vix.com.
-add a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.
-add b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.
-print
-add .
-# zap it again
-nuke .
-# test splitting of maximal bitstring
-add \[xFFFF/16].\[xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF/256].com
-add \[xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF/128].com
-print
-quit
+# $ISC: rbt_test.txt,v 1.13.2.2 2003/07/22 04:03:37 marka Exp $

+

+add a.vix.com

+add b.vix.com

+add c.vix.com

+print

+add a.b.c.d.e.f.vix.com

+add b.b.c.d.e.f.vix.com

+add c.b.c.d.e.f.vix.com

+print

+add a.d.e.f.vix.com

+add q.d.e.f.vix.com

+add d.e.f.vix.com

+print

+add g.h.vix.com

+print

+search q.d.e.f.vix.com

+search just-parent.a.vix.com

+search no-real-parent.vix.com

+search does.not.exist.at.all

+forward

+backward

+# existing name

+check vix.com.

+# greater than stop node, which has down pointer

+check zzz.com.

+# less than lowest in level (would be left link from stop node)

+check 0.vix.com

+# greater than stop node, no down pointer

+check d.vix.com

+# superdomain stored in existing node

+check f.vix.com

+# common ancestor stored in existing node; existing is successor

+check a.e.f.vix.com

+# common ancestor stored in existing node; existing is less but not predecessor

+check z.e.f.vix.com

+#

+check g.vix.com

+#

+check i.vix.com

+#

+check b.c.vix.com

+nuke d.e.f.vix.com

+print

+add x.a.vix.com

+add y.x.a.vix.com

+print

+delete a.vix.com

+delete x.a.vix.com

+print

+delete b.vix.com

+delete c.vix.com

+print

+delete y.x.a.vix.com

+print

+delete g.h.vix.com.

+add \[b100000].vix.com.

+add \[b010000].vix.com.

+add \[b001000].vix.com.

+add \[b000100].vix.com.

+add \[b000010].vix.com.

+add \[b000001].vix.com.

+p

+search \[b000100].vix.com.

+# zap the entire tree

+add vix.com.

+nuke vix.com.

+add a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.

+add b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.x.y.z.a.b.c.d.e.f.g.h.i.j.k.l.m.n.o.p.q.r.s.t.u.v.w.

+print

+add .

+# zap it again

+nuke .

+# test splitting of maximal bitstring

+add \[xFFFF/16].\[xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF/256].com

+add \[xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF/128].com

+print

+quit

diff --git a/usr.sbin/bind/bin/tests/system/conf.sh.in b/usr.sbin/bind/bin/tests/system/conf.sh.in
index d0c5764ec1b..330da41ff4f 100644
--- a/usr.sbin/bind/bin/tests/system/conf.sh.in
+++ b/usr.sbin/bind/bin/tests/system/conf.sh.in
@@ -15,7 +15,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: conf.sh.in,v 1.23.10.2 2003/02/17 07:05:06 marka Exp $
+# $ISC: conf.sh.in,v 1.23.2.2 2003/05/19 05:46:24 marka Exp $
 
 #
 # Common configuration data for system tests, to be sourced into
@@ -43,9 +43,9 @@ KEYSETTOOL=$TOP/bin/dnssec/dnssec-makekeyset
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 #
-# dnssec and lwresd are missing from SUBDIRS as RFC 2535 support is disabled
+# dnssec is missing from SUBDIRS as RFC 2535 support is disabled
 # 
-SUBDIRS="cacheclean forward glue ixfr limits \
+SUBDIRS="cacheclean forward glue ixfr limits lwresd \
     masterfile notify nsupdate resolver sortlist stub tkey \
     unknown upforwd v6synth views xfer xferquota"
 
diff --git a/usr.sbin/bind/bin/tests/system/ifconfig.sh b/usr.sbin/bind/bin/tests/system/ifconfig.sh
index 273f4c2123e..3683f9a688e 100644
--- a/usr.sbin/bind/bin/tests/system/ifconfig.sh
+++ b/usr.sbin/bind/bin/tests/system/ifconfig.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2000-2002  Internet Software Consortium.
+# Copyright (C) 2000-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: ifconfig.sh,v 1.35.2.5 2002/08/02 03:05:39 marka Exp $
+# $ISC: ifconfig.sh,v 1.35.2.8 2003/07/30 01:55:50 marka Exp $
 
 #
 # Set up interface aliases for bind9 system tests.
@@ -31,24 +31,35 @@ case `uname -a` in
   *) sys=`../../../config.guess` ;;
 esac
 
+case "$2" in
+[0-9]|[1-9][0-9]|[1-9][0-9][0-9]) base=$2;;
+*) base=""
+esac
+
 case "$1" in
 
     start|up)
 	for ns in 1 2 3 4 5
 	do
+		if test -n "$base"
+		then
+			int=`expr $ns + $base - 1`
+		else
+			int=$ns
+		fi
 		case "$sys" in
 		    *-pc-solaris2.5.1)
-			ifconfig lo0:$ns 10.53.0.$ns netmask 0xffffffff up
+			ifconfig lo0:$int 10.53.0.$ns netmask 0xffffffff up
 			;;
 		    *-sun-solaris2.[6-7])
-			ifconfig lo0:$ns 10.53.0.$ns netmask 0xffffffff up
+			ifconfig lo0:$int 10.53.0.$ns netmask 0xffffffff up
 			;;
 		    *-*-solaris2.8)
-    			ifconfig lo0:$ns plumb
-			ifconfig lo0:$ns 10.53.0.$ns up
+    			ifconfig lo0:$int plumb
+			ifconfig lo0:$int 10.53.0.$ns up
 			;;
 		    *-*-linux*)
-			ifconfig lo:$ns 10.53.0.$ns up netmask 255.255.255.0
+			ifconfig lo:$int 10.53.0.$ns up netmask 255.255.255.0
 		        ;;
 		    *-unknown-freebsd*)
 			ifconfig lo0 10.53.0.$ns alias netmask 0xffffffff
@@ -56,7 +67,7 @@ case "$1" in
 		    *-unknown-netbsd*)
 			ifconfig lo0 10.53.0.$ns alias netmask 255.255.255.0
 			;;
-		    *-pc-bsdi[3-4].*)
+		    *-*-bsdi[3-5].*)
 			ifconfig lo0 add 10.53.0.$ns netmask 255.255.255.0
 			;;
 		    *-dec-osf[4-5].*)
@@ -72,7 +83,7 @@ case "$1" in
 			ifconfig lo0 alias 10.53.0.$ns
 			;;
 		    hpux)
-			ifconfig lo0:$ns 10.53.0.$ns up
+			ifconfig lo0:$int 10.53.0.$ns up
 		        ;;
 		    *-sco3.2v*)
 			ifconfig lo0 alias 10.53.0.$ns
@@ -90,19 +101,25 @@ case "$1" in
     stop|down)
 	for ns in 5 4 3 2 1
 	do
+		if test -n "$base"
+		then
+			int=`expr $ns + $base - 1`
+		else
+			int=$ns	
+		fi
 		case "$sys" in
 		    *-pc-solaris2.5.1)
-			ifconfig lo0:$ns 0.0.0.0 down
+			ifconfig lo0:$int 0.0.0.0 down
 			;;
 		    *-sun-solaris2.[6-7])
-			ifconfig lo0:$ns 10.53.0.$ns down
+			ifconfig lo0:$int 10.53.0.$ns down
 			;;
 		    *-*-solaris2.8)
-			ifconfig lo0:$ns 10.53.0.$ns down
-			ifconfig lo0:$ns 10.53.0.$ns unplumb
+			ifconfig lo0:$int 10.53.0.$ns down
+			ifconfig lo0:$int 10.53.0.$ns unplumb
 			;;
 		    *-*-linux*)
-			ifconfig lo:$ns 10.53.0.$ns down
+			ifconfig lo:$int 10.53.0.$ns down
 		        ;;
 		    *-unknown-freebsd*)
 			ifconfig lo0 10.53.0.$ns delete
@@ -110,7 +127,7 @@ case "$1" in
 		    *-unknown-netbsd*)
 			ifconfig lo0 10.53.0.$ns delete
 			;;
-		    *-pc-bsdi[3-4].*)
+		    *-*-bsdi[3-5].*)
 			ifconfig lo0 remove 10.53.0.$ns
 			;;
 		    *-dec-osf[4-5].*)
@@ -126,7 +143,7 @@ case "$1" in
 			ifconfig lo0 delete 10.53.0.$ns
 			;;
 		    hpux)
-			ifconfig lo0:$ns 10.53.0.$ns down
+			ifconfig lo0:$int 10.53.0.$ns down
 		        ;;
 		    *-sco3.2v*)
 			ifconfig lo0 -alias 10.53.0.$ns
@@ -143,6 +160,6 @@ case "$1" in
 	;;
 
 	*)
-		echo "Usage: $0 { up | down }"
+		echo "Usage: $0 { up | down } [base]"
 		exit 1
 esac
diff --git a/usr.sbin/bind/bin/tests/system/lwresd/lwtest.c b/usr.sbin/bind/bin/tests/system/lwresd/lwtest.c
index 5e1343ff6e0..75bbd0c2c3e 100644
--- a/usr.sbin/bind/bin/tests/system/lwresd/lwtest.c
+++ b/usr.sbin/bind/bin/tests/system/lwresd/lwtest.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002  Internet Software Consortium.
+ * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: lwtest.c,v 1.22.2.2 2002/08/05 06:57:07 marka Exp $ */
+/* $ISC: lwtest.c,v 1.22.2.4 2003/07/22 04:03:38 marka Exp $ */
 
 #include <config.h>
 
@@ -757,12 +757,21 @@ main(void) {
 	test_getnameinfo("1122:3344:5566:7788:99aa:bbcc:ddee:ff00",
 			 AF_INET6, "dname.example1");
 
+#ifdef ISC_RFC_2535
 	test_getrrsetbyname("a", 1, 1, 1, 0, 1);
 	test_getrrsetbyname("a.example1.", 1, 1, 1, 0, 1);
 	test_getrrsetbyname("e.example1.", 1, 1, 1, 1, 1);
 	test_getrrsetbyname("e.example1.", 1, 255, 1, 1, 0);
 	test_getrrsetbyname("e.example1.", 1, 24, 1, 0, 1);
 	test_getrrsetbyname("", 1, 1, 0, 0, 0);
+#else
+	test_getrrsetbyname("a", 1, 1, 1, 0, 1);
+	test_getrrsetbyname("a.example1.", 1, 1, 1, 0, 1);
+	test_getrrsetbyname("e.example1.", 1, 1, 1, 0, 1);
+	test_getrrsetbyname("e.example1.", 1, 255, 1, 0, 0);
+	/* test_getrrsetbyname("e.example1.", 1, 24, 1, 0, 1); */
+	test_getrrsetbyname("", 1, 1, 0, 0, 0);
+#endif
 
 	if (fails == 0)
 		printf("I:ok\n");
diff --git a/usr.sbin/bind/config.h.in b/usr.sbin/bind/config.h.in
index 89b8af5ac42..0f66e27b681 100644
--- a/usr.sbin/bind/config.h.in
+++ b/usr.sbin/bind/config.h.in
@@ -1,6 +1,6 @@
-/* config.h.in.  Generated automatically from configure.in by autoheader.  */
+/* config.h.in.  Generated from configure.in by autoheader.  */
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,32 +16,13 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: config.h.in,v 1.47.2.1 2001/10/22 23:28:08 gson Exp $ */
+/* $ISC: config.h.in,v 1.47.2.4 2003/08/05 00:44:43 marka Exp $ */
 
 /***
  *** This file is not to be included by any public header files, because
  *** it does not get installed.
  ***/
 
-/* Define to empty if the keyword does not work.  */
-#undef const
-
-/* Define as __inline if that's what the C compiler calls it.  */
-#undef inline
-
-/* Define to `unsigned' if <sys/types.h> doesn't define.  */
-#undef size_t
-
-/* Define if you have the ANSI C header files.  */
-#undef STDC_HEADERS
-
-/* Define if you can safely include both <sys/time.h> and <time.h>.  */
-#undef TIME_WITH_SYS_TIME
-
-/* Define if your processor stores words with the most significant
-   byte first (like Motorola and SPARC, unlike Intel and VAX).  */
-#undef WORDS_BIGENDIAN
-
 /* define to `int' if <sys/types.h> doesn't define.  */
 #undef ssize_t
 
@@ -72,9 +53,17 @@
 /* define if catgets() is available */
 #undef HAVE_CATGETS
 
-/* define if you have the NET_RT_IFLIST sysctl variable. */
+/* define if you have the NET_RT_IFLIST sysctl variable and sys/sysctl.h */
 #undef HAVE_IFLIST_SYSCTL
 
+/* define if you need to #define _XPG4_2 before including sys/socket.h */
+#undef NEED_XPG4_2_BEFORE_SOCKET_H
+
+/* define if you need to #define _XOPEN_SOURCE_ENTENDED before including
+ * sys/socket.h
+ */
+#undef NEED_XSE_BEFORE_SOCKET_H
+
 /* define if chroot() is available */
 #undef HAVE_CHROOT
 
@@ -123,19 +112,19 @@ int sigwait(const unsigned int *set, int *sig);
 /* Shut up warnings from gcc -Wcast-qual on BSD/OS 4.1. */
 #undef SHUTUP_STDARG_CAST
 #if defined(SHUTUP_STDARG_CAST) && defined(__GNUC__)
-#include <stdarg.h>  /* Grr.  Must be included *every time*. */
+#include <stdarg.h>		/* Grr.  Must be included *every time*. */
 /*
  * The silly continuation line is to keep configure from
  * commenting out the #undef.
  */
 #undef \
- va_start
-#define va_start(ap, last) \
- do { \
-  union { const void *konst; long *var; } _u; \
-  _u.konst = &(last); \
-  ap = (va_list)(_u.var + __va_words(__typeof(last))); \
- } while (0)
+	va_start
+#define	va_start(ap, last) \
+	do { \
+		union { const void *konst; long *var; } _u; \
+		_u.konst = &(last); \
+		ap = (va_list)(_u.var + __va_words(__typeof(last))); \
+	} while (0)
 #endif /* SHUTUP_STDARG_CAST && __GNUC__ */
 
 /* define if the system has a random number generating device */
@@ -144,41 +133,112 @@ int sigwait(const unsigned int *set, int *sig);
 /* define if pthread_attr_getstacksize() is available */
 #undef HAVE_PTHREAD_ATTR_GETSTACKSIZE
 
+/* define if pthread_attr_setstacksize() is available */
+#undef HAVE_PTHREAD_ATTR_SETSTACKSIZE
+
 /* define if you have strerror in the C library. */
 #undef HAVE_STRERROR
 
-/* Define if you have the <dlfcn.h> header file.  */
+/* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
-/* Define if you have the <fcntl.h> header file.  */
+/* Define to 1 if you have the <fcntl.h> header file. */
 #undef HAVE_FCNTL_H
 
-/* Define if you have the <linux/capability.h> header file.  */
+/* Define to 1 if you have the <inttypes.h> header file. */
+#undef HAVE_INTTYPES_H
+
+/* Define to 1 if you have the `c' library (-lc). */
+#undef HAVE_LIBC
+
+/* Define to 1 if you have the `c_r' library (-lc_r). */
+#undef HAVE_LIBC_R
+
+/* Define to 1 if you have the `nsl' library (-lnsl). */
+#undef HAVE_LIBNSL
+
+/* Define to 1 if you have the `pthread' library (-lpthread). */
+#undef HAVE_LIBPTHREAD
+
+/* Define to 1 if you have the `socket' library (-lsocket). */
+#undef HAVE_LIBSOCKET
+
+/* Define to 1 if you have the <linux/capability.h> header file. */
 #undef HAVE_LINUX_CAPABILITY_H
 
-/* Define if you have the <sys/prctl.h> header file.  */
+/* Define to 1 if you have the <memory.h> header file. */
+#undef HAVE_MEMORY_H
+
+/* Define to 1 if you have the <stdint.h> header file. */
+#undef HAVE_STDINT_H
+
+/* Define to 1 if you have the <stdlib.h> header file. */
+#undef HAVE_STDLIB_H
+
+/* Define to 1 if you have the <strings.h> header file. */
+#undef HAVE_STRINGS_H
+
+/* Define to 1 if you have the <string.h> header file. */
+#undef HAVE_STRING_H
+
+/* Define to 1 if you have the <sys/prctl.h> header file. */
 #undef HAVE_SYS_PRCTL_H
 
-/* Define if you have the <sys/select.h> header file.  */
+/* Define to 1 if you have the <sys/select.h> header file. */
 #undef HAVE_SYS_SELECT_H
 
-/* Define if you have the <sys/sockio.h> header file.  */
+/* Define to 1 if you have the <sys/sockio.h> header file. */
 #undef HAVE_SYS_SOCKIO_H
 
-/* Define if you have the <sys/sysctl.h> header file.  */
+/* Define to 1 if you have the <sys/stat.h> header file. */
+#undef HAVE_SYS_STAT_H
+
+/* Define to 1 if you have the <sys/sysctl.h> header file. */
 #undef HAVE_SYS_SYSCTL_H
 
-/* Define if you have the <sys/time.h> header file.  */
+/* Define to 1 if you have the <sys/time.h> header file. */
 #undef HAVE_SYS_TIME_H
 
-/* Define if you have the <unistd.h> header file.  */
+/* Define to 1 if you have the <sys/types.h> header file. */
+#undef HAVE_SYS_TYPES_H
+
+/* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
-/* Define if you have the nsl library (-lnsl).  */
-#undef HAVE_LIBNSL
+/* Define to the address where bug reports for this package should be sent. */
+#undef PACKAGE_BUGREPORT
 
-/* Define if you have the pthread library (-lpthread).  */
-#undef HAVE_LIBPTHREAD
+/* Define to the full name of this package. */
+#undef PACKAGE_NAME
 
-/* Define if you have the socket library (-lsocket).  */
-#undef HAVE_LIBSOCKET
+/* Define to the full name and version of this package. */
+#undef PACKAGE_STRING
+
+/* Define to the one symbol short name of this package. */
+#undef PACKAGE_TARNAME
+
+/* Define to the version of this package. */
+#undef PACKAGE_VERSION
+
+/* Define to 1 if you have the ANSI C header files. */
+#undef STDC_HEADERS
+
+/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
+#undef TIME_WITH_SYS_TIME
+
+/* Define to 1 if your processor stores words with the most significant byte
+   first (like Motorola and SPARC, unlike Intel and VAX). */
+#undef WORDS_BIGENDIAN
+
+/* Define to empty if `const' does not conform to ANSI C. */
+#undef const
+
+/* Define as `__inline' if that's what the C compiler calls it, or to nothing
+   if it is not supported. */
+#undef inline
+
+/* Define to `unsigned' if <sys/types.h> does not define. */
+#undef size_t
+
+/* Define to `int' if <sys/types.h> does not define. */
+#undef ssize_t
diff --git a/usr.sbin/bind/configure b/usr.sbin/bind/configure
index c60f495a4d8..7249eb4dfea 100644
--- a/usr.sbin/bind/configure
+++ b/usr.sbin/bind/configure
@@ -3955,7 +3955,7 @@ case "$use_randomdev" in
 	unspec)
 		case "$host" in
 			*-openbsd*)
-				devrandom=/dev/srandom
+				devrandom=/dev/arandom
 				;;
 			*)
 				devrandom=/dev/random
@@ -4119,9 +4119,11 @@ case $host in
 	use_threads=false ;;
 *-freebsd*)
 	use_threads=false ;;
-*-bsdi*)
-	# Thread signals do not appear to work reliably on BSDI.
+*-bsdi234*)
+	# Thread signals do not work reliably on some versions of BSD/OS.
 	use_threads=false ;;
+*-bsdi5*)
+	use_threads=true ;;
 *-linux*)
    	# Threads are disabled on Linux by default because most
 	# Linux kernels produce unusable core dumps from multithreaded
@@ -4147,7 +4149,7 @@ case "$enable_threads" in
 		# Use system-dependent default
 		;;
 	*)
-	    	{ { echo "$as_me:4150: error: --enable-threads takes yes or no" >&5
+	    	{ { echo "$as_me:4152: error: --enable-threads takes yes or no" >&5
 echo "$as_me: error: --enable-threads takes yes or no" >&2;}
    { (exit 1); exit 1; }; }
 		;;
@@ -4155,10 +4157,10 @@ esac
 
 if $use_threads
 then
-	echo "$as_me:4158: result: yes" >&5
+	echo "$as_me:4160: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 else
-	echo "$as_me:4161: result: no" >&5
+	echo "$as_me:4163: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -4177,7 +4179,7 @@ then
 		# the --with-ptl2 option for those who wish to
 		# experiment with it.
 		CC="gcc"
-		echo "$as_me:4180: checking which NetBSD thread library to use" >&5
+		echo "$as_me:4182: checking which NetBSD thread library to use" >&5
 echo $ECHO_N "checking which NetBSD thread library to use... $ECHO_C" >&6
 
 # Check whether --with-ptl2 or --without-ptl2 was given.
@@ -4192,24 +4194,24 @@ fi;
 
 		if test "X$use_ptl2" = "Xyes"
 		then
-			echo "$as_me:4195: result: PTL2" >&5
+			echo "$as_me:4197: result: PTL2" >&5
 echo "${ECHO_T}PTL2" >&6
-			{ echo "$as_me:4197: WARNING: linking with PTL2 is highly experimental and not expected to work" >&5
+			{ echo "$as_me:4199: WARNING: linking with PTL2 is highly experimental and not expected to work" >&5
 echo "$as_me: WARNING: linking with PTL2 is highly experimental and not expected to work" >&2;}
 			CC=ptlgcc
 		else
 			if test ! -d $LOCALBASE/pthreads
 			then
-				echo "$as_me:4203: result: none" >&5
+				echo "$as_me:4205: result: none" >&5
 echo "${ECHO_T}none" >&6
-				{ { echo "$as_me:4205: error: \"could not find thread libraries\"" >&5
+				{ { echo "$as_me:4207: error: \"could not find thread libraries\"" >&5
 echo "$as_me: error: \"could not find thread libraries\"" >&2;}
    { (exit 1); exit 1; }; }
 			fi
 
 			if $use_threads
 			then
-				echo "$as_me:4212: result: mit-pthreads/unproven-pthreads" >&5
+				echo "$as_me:4214: result: mit-pthreads/unproven-pthreads" >&5
 echo "${ECHO_T}mit-pthreads/unproven-pthreads" >&6
 				pkg="$LOCALBASE/pthreads"
 				lib1="-L$pkg/lib -Wl,-R$pkg/lib"
@@ -4222,7 +4224,7 @@ echo "${ECHO_T}mit-pthreads/unproven-pthreads" >&6
 		;;
 		*)
 
-echo "$as_me:4225: checking for pthread_create in -lpthread" >&5
+echo "$as_me:4227: checking for pthread_create in -lpthread" >&5
 echo $ECHO_N "checking for pthread_create in -lpthread... $ECHO_C" >&6
 if test "${ac_cv_lib_pthread_pthread_create+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4230,7 +4232,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lpthread  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4233 "configure"
+#line 4235 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4249,16 +4251,16 @@ pthread_create ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4252: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4254: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4255: \$? = $ac_status" >&5
+  echo "$as_me:4257: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4258: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4260: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4261: \$? = $ac_status" >&5
+  echo "$as_me:4263: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_pthread_pthread_create=yes
 else
@@ -4269,7 +4271,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4272: result: $ac_cv_lib_pthread_pthread_create" >&5
+echo "$as_me:4274: result: $ac_cv_lib_pthread_pthread_create" >&5
 echo "${ECHO_T}$ac_cv_lib_pthread_pthread_create" >&6
 if test $ac_cv_lib_pthread_pthread_create = yes; then
   cat >>confdefs.h <<EOF
@@ -4280,7 +4282,7 @@ EOF
 
 else
 
-echo "$as_me:4283: checking for __pthread_create in -lpthread" >&5
+echo "$as_me:4285: checking for __pthread_create in -lpthread" >&5
 echo $ECHO_N "checking for __pthread_create in -lpthread... $ECHO_C" >&6
 if test "${ac_cv_lib_pthread___pthread_create+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4288,7 +4290,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lpthread  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4291 "configure"
+#line 4293 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4307,16 +4309,16 @@ __pthread_create ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4310: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4312: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4313: \$? = $ac_status" >&5
+  echo "$as_me:4315: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4316: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4318: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4319: \$? = $ac_status" >&5
+  echo "$as_me:4321: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_pthread___pthread_create=yes
 else
@@ -4327,7 +4329,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4330: result: $ac_cv_lib_pthread___pthread_create" >&5
+echo "$as_me:4332: result: $ac_cv_lib_pthread___pthread_create" >&5
 echo "${ECHO_T}$ac_cv_lib_pthread___pthread_create" >&6
 if test $ac_cv_lib_pthread___pthread_create = yes; then
   cat >>confdefs.h <<EOF
@@ -4338,7 +4340,7 @@ EOF
 
 else
 
-echo "$as_me:4341: checking for __pthread_create_system in -lpthread" >&5
+echo "$as_me:4343: checking for __pthread_create_system in -lpthread" >&5
 echo $ECHO_N "checking for __pthread_create_system in -lpthread... $ECHO_C" >&6
 if test "${ac_cv_lib_pthread___pthread_create_system+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4346,7 +4348,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lpthread  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4349 "configure"
+#line 4351 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4365,16 +4367,16 @@ __pthread_create_system ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4368: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4370: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4371: \$? = $ac_status" >&5
+  echo "$as_me:4373: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4374: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4376: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4377: \$? = $ac_status" >&5
+  echo "$as_me:4379: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_pthread___pthread_create_system=yes
 else
@@ -4385,7 +4387,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4388: result: $ac_cv_lib_pthread___pthread_create_system" >&5
+echo "$as_me:4390: result: $ac_cv_lib_pthread___pthread_create_system" >&5
 echo "${ECHO_T}$ac_cv_lib_pthread___pthread_create_system" >&6
 if test $ac_cv_lib_pthread___pthread_create_system = yes; then
   cat >>confdefs.h <<EOF
@@ -4396,7 +4398,7 @@ EOF
 
 else
 
-echo "$as_me:4399: checking for pthread_create in -lc_r" >&5
+echo "$as_me:4401: checking for pthread_create in -lc_r" >&5
 echo $ECHO_N "checking for pthread_create in -lc_r... $ECHO_C" >&6
 if test "${ac_cv_lib_c_r_pthread_create+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4404,7 +4406,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lc_r  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4407 "configure"
+#line 4409 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4423,16 +4425,16 @@ pthread_create ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4426: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4428: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4429: \$? = $ac_status" >&5
+  echo "$as_me:4431: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4432: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4434: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4435: \$? = $ac_status" >&5
+  echo "$as_me:4437: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_c_r_pthread_create=yes
 else
@@ -4443,7 +4445,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4446: result: $ac_cv_lib_c_r_pthread_create" >&5
+echo "$as_me:4448: result: $ac_cv_lib_c_r_pthread_create" >&5
 echo "${ECHO_T}$ac_cv_lib_c_r_pthread_create" >&6
 if test $ac_cv_lib_c_r_pthread_create = yes; then
   cat >>confdefs.h <<EOF
@@ -4454,7 +4456,7 @@ EOF
 
 else
 
-echo "$as_me:4457: checking for pthread_create in -lc" >&5
+echo "$as_me:4459: checking for pthread_create in -lc" >&5
 echo $ECHO_N "checking for pthread_create in -lc... $ECHO_C" >&6
 if test "${ac_cv_lib_c_pthread_create+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4462,7 +4464,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lc  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4465 "configure"
+#line 4467 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4481,16 +4483,16 @@ pthread_create ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4484: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4486: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4487: \$? = $ac_status" >&5
+  echo "$as_me:4489: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4490: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4492: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4493: \$? = $ac_status" >&5
+  echo "$as_me:4495: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_c_pthread_create=yes
 else
@@ -4501,7 +4503,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4504: result: $ac_cv_lib_c_pthread_create" >&5
+echo "$as_me:4506: result: $ac_cv_lib_c_pthread_create" >&5
 echo "${ECHO_T}$ac_cv_lib_c_pthread_create" >&6
 if test $ac_cv_lib_c_pthread_create = yes; then
   cat >>confdefs.h <<EOF
@@ -4511,7 +4513,7 @@ EOF
   LIBS="-lc $LIBS"
 
 else
-  { { echo "$as_me:4514: error: \"could not find thread libraries\"" >&5
+  { { echo "$as_me:4516: error: \"could not find thread libraries\"" >&5
 echo "$as_me: error: \"could not find thread libraries\"" >&2;}
    { (exit 1); exit 1; }; }
 fi
@@ -4533,7 +4535,7 @@ then
 	#
 	# We'd like to use sigwait() too
 	#
-	echo "$as_me:4536: checking for sigwait in -lc" >&5
+	echo "$as_me:4538: checking for sigwait in -lc" >&5
 echo $ECHO_N "checking for sigwait in -lc... $ECHO_C" >&6
 if test "${ac_cv_lib_c_sigwait+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4541,7 +4543,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lc  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4544 "configure"
+#line 4546 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4560,16 +4562,16 @@ sigwait ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4563: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4565: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4566: \$? = $ac_status" >&5
+  echo "$as_me:4568: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4569: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4571: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4572: \$? = $ac_status" >&5
+  echo "$as_me:4574: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_c_sigwait=yes
 else
@@ -4580,7 +4582,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4583: result: $ac_cv_lib_c_sigwait" >&5
+echo "$as_me:4585: result: $ac_cv_lib_c_sigwait" >&5
 echo "${ECHO_T}$ac_cv_lib_c_sigwait" >&6
 if test $ac_cv_lib_c_sigwait = yes; then
   cat >>confdefs.h <<\EOF
@@ -4588,7 +4590,7 @@ if test $ac_cv_lib_c_sigwait = yes; then
 EOF
 
 else
-  echo "$as_me:4591: checking for sigwait in -lpthread" >&5
+  echo "$as_me:4593: checking for sigwait in -lpthread" >&5
 echo $ECHO_N "checking for sigwait in -lpthread... $ECHO_C" >&6
 if test "${ac_cv_lib_pthread_sigwait+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4596,7 +4598,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lpthread  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4599 "configure"
+#line 4601 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4615,16 +4617,16 @@ sigwait ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4618: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4620: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4621: \$? = $ac_status" >&5
+  echo "$as_me:4623: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4624: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4626: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4627: \$? = $ac_status" >&5
+  echo "$as_me:4629: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_pthread_sigwait=yes
 else
@@ -4635,7 +4637,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4638: result: $ac_cv_lib_pthread_sigwait" >&5
+echo "$as_me:4640: result: $ac_cv_lib_pthread_sigwait" >&5
 echo "${ECHO_T}$ac_cv_lib_pthread_sigwait" >&6
 if test $ac_cv_lib_pthread_sigwait = yes; then
   cat >>confdefs.h <<\EOF
@@ -4643,7 +4645,7 @@ if test $ac_cv_lib_pthread_sigwait = yes; then
 EOF
 
 else
-  echo "$as_me:4646: checking for _Psigwait in -lpthread" >&5
+  echo "$as_me:4648: checking for _Psigwait in -lpthread" >&5
 echo $ECHO_N "checking for _Psigwait in -lpthread... $ECHO_C" >&6
 if test "${ac_cv_lib_pthread__Psigwait+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4651,7 +4653,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lpthread  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4654 "configure"
+#line 4656 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4670,16 +4672,16 @@ _Psigwait ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4673: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4675: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4676: \$? = $ac_status" >&5
+  echo "$as_me:4678: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4679: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4681: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4682: \$? = $ac_status" >&5
+  echo "$as_me:4684: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_pthread__Psigwait=yes
 else
@@ -4690,7 +4692,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4693: result: $ac_cv_lib_pthread__Psigwait" >&5
+echo "$as_me:4695: result: $ac_cv_lib_pthread__Psigwait" >&5
 echo "${ECHO_T}$ac_cv_lib_pthread__Psigwait" >&6
 if test $ac_cv_lib_pthread__Psigwait = yes; then
   cat >>confdefs.h <<\EOF
@@ -4703,13 +4705,13 @@ fi
 
 fi
 
-	echo "$as_me:4706: checking for pthread_attr_getstacksize" >&5
+	echo "$as_me:4708: checking for pthread_attr_getstacksize" >&5
 echo $ECHO_N "checking for pthread_attr_getstacksize... $ECHO_C" >&6
 if test "${ac_cv_func_pthread_attr_getstacksize+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 4712 "configure"
+#line 4714 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char pthread_attr_getstacksize (); below.  */
@@ -4740,16 +4742,16 @@ f = pthread_attr_getstacksize;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4743: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4745: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4746: \$? = $ac_status" >&5
+  echo "$as_me:4748: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4749: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4751: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4752: \$? = $ac_status" >&5
+  echo "$as_me:4754: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_pthread_attr_getstacksize=yes
 else
@@ -4759,7 +4761,7 @@ ac_cv_func_pthread_attr_getstacksize=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:4762: result: $ac_cv_func_pthread_attr_getstacksize" >&5
+echo "$as_me:4764: result: $ac_cv_func_pthread_attr_getstacksize" >&5
 echo "${ECHO_T}$ac_cv_func_pthread_attr_getstacksize" >&6
 if test $ac_cv_func_pthread_attr_getstacksize = yes; then
   cat >>confdefs.h <<\EOF
@@ -4768,6 +4770,71 @@ EOF
 
 fi
 
+	echo "$as_me:4773: checking for pthread_attr_setstacksize" >&5
+echo $ECHO_N "checking for pthread_attr_setstacksize... $ECHO_C" >&6
+if test "${ac_cv_func_pthread_attr_setstacksize+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+#line 4779 "configure"
+#include "confdefs.h"
+/* System header to define __stub macros and hopefully few prototypes,
+    which can conflict with char pthread_attr_setstacksize (); below.  */
+#include <assert.h>
+/* Override any gcc2 internal prototype to avoid an error.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+/* We use char because int might match the return type of a gcc2
+   builtin and then its argument prototype would still apply.  */
+char pthread_attr_setstacksize ();
+char (*f) ();
+
+int
+main ()
+{
+/* The GNU C library defines this for functions which it implements
+    to always fail with ENOSYS.  Some functions are actually named
+    something starting with __ and the normal name is an alias.  */
+#if defined (__stub_pthread_attr_setstacksize) || defined (__stub___pthread_attr_setstacksize)
+choke me
+#else
+f = pthread_attr_setstacksize;
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (eval echo "$as_me:4810: \"$ac_link\"") >&5
+  (eval $ac_link) 2>&5
+  ac_status=$?
+  echo "$as_me:4813: \$? = $ac_status" >&5
+  (exit $ac_status); } &&
+         { ac_try='test -s conftest$ac_exeext'
+  { (eval echo "$as_me:4816: \"$ac_try\"") >&5
+  (eval $ac_try) 2>&5
+  ac_status=$?
+  echo "$as_me:4819: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  ac_cv_func_pthread_attr_setstacksize=yes
+else
+  echo "$as_me: failed program was:" >&5
+cat conftest.$ac_ext >&5
+ac_cv_func_pthread_attr_setstacksize=no
+fi
+rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
+fi
+echo "$as_me:4829: result: $ac_cv_func_pthread_attr_setstacksize" >&5
+echo "${ECHO_T}$ac_cv_func_pthread_attr_setstacksize" >&6
+if test $ac_cv_func_pthread_attr_setstacksize = yes; then
+  cat >>confdefs.h <<\EOF
+#define HAVE_PTHREAD_ATTR_SETSTACKSIZE 1
+EOF
+
+fi
+
 	#
 	# Additional OS-specific issues related to pthreads and sigwait.
 	#
@@ -4776,7 +4843,7 @@ fi
 		# One more place to look for sigwait.
 		#
 		*-freebsd*)
-			echo "$as_me:4779: checking for sigwait in -lc_r" >&5
+			echo "$as_me:4846: checking for sigwait in -lc_r" >&5
 echo $ECHO_N "checking for sigwait in -lc_r... $ECHO_C" >&6
 if test "${ac_cv_lib_c_r_sigwait+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -4784,7 +4851,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lc_r  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 4787 "configure"
+#line 4854 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -4803,16 +4870,16 @@ sigwait ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4806: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4873: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4809: \$? = $ac_status" >&5
+  echo "$as_me:4876: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4812: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4879: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4815: \$? = $ac_status" >&5
+  echo "$as_me:4882: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_c_r_sigwait=yes
 else
@@ -4823,7 +4890,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:4826: result: $ac_cv_lib_c_r_sigwait" >&5
+echo "$as_me:4893: result: $ac_cv_lib_c_r_sigwait" >&5
 echo "${ECHO_T}$ac_cv_lib_c_r_sigwait" >&6
 if test $ac_cv_lib_c_r_sigwait = yes; then
   cat >>confdefs.h <<\EOF
@@ -4863,13 +4930,13 @@ EOF
 #define _POSIX_PTHREAD_SEMANTICS 1
 EOF
 
-			echo "$as_me:4866: checking for pthread_setconcurrency" >&5
+			echo "$as_me:4933: checking for pthread_setconcurrency" >&5
 echo $ECHO_N "checking for pthread_setconcurrency... $ECHO_C" >&6
 if test "${ac_cv_func_pthread_setconcurrency+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 4872 "configure"
+#line 4939 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char pthread_setconcurrency (); below.  */
@@ -4900,16 +4967,16 @@ f = pthread_setconcurrency;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4903: \"$ac_link\"") >&5
+if { (eval echo "$as_me:4970: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4906: \$? = $ac_status" >&5
+  echo "$as_me:4973: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4909: \"$ac_try\"") >&5
+  { (eval echo "$as_me:4976: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4912: \$? = $ac_status" >&5
+  echo "$as_me:4979: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_pthread_setconcurrency=yes
 else
@@ -4919,7 +4986,7 @@ ac_cv_func_pthread_setconcurrency=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:4922: result: $ac_cv_func_pthread_setconcurrency" >&5
+echo "$as_me:4989: result: $ac_cv_func_pthread_setconcurrency" >&5
 echo "${ECHO_T}$ac_cv_func_pthread_setconcurrency" >&6
 if test $ac_cv_func_pthread_setconcurrency = yes; then
   cat >>confdefs.h <<\EOF
@@ -4943,13 +5010,13 @@ EOF
 	#
 	# Look for sysconf to allow detection of the number of processors.
 	#
-	echo "$as_me:4946: checking for sysconf" >&5
+	echo "$as_me:5013: checking for sysconf" >&5
 echo $ECHO_N "checking for sysconf... $ECHO_C" >&6
 if test "${ac_cv_func_sysconf+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 4952 "configure"
+#line 5019 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char sysconf (); below.  */
@@ -4980,16 +5047,16 @@ f = sysconf;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:4983: \"$ac_link\"") >&5
+if { (eval echo "$as_me:5050: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:4986: \$? = $ac_status" >&5
+  echo "$as_me:5053: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:4989: \"$ac_try\"") >&5
+  { (eval echo "$as_me:5056: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:4992: \$? = $ac_status" >&5
+  echo "$as_me:5059: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_sysconf=yes
 else
@@ -4999,7 +5066,7 @@ ac_cv_func_sysconf=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:5002: result: $ac_cv_func_sysconf" >&5
+echo "$as_me:5069: result: $ac_cv_func_sysconf" >&5
 echo "${ECHO_T}$ac_cv_func_sysconf" >&6
 if test $ac_cv_func_sysconf = yes; then
   cat >>confdefs.h <<\EOF
@@ -5061,13 +5128,13 @@ ISC_THREAD_DIR=$thread_dir
 # even if compiled with --disable-threads.  getc_unlocked might also not
 # be defined.
 #
-echo "$as_me:5064: checking for flockfile" >&5
+echo "$as_me:5131: checking for flockfile" >&5
 echo $ECHO_N "checking for flockfile... $ECHO_C" >&6
 if test "${ac_cv_func_flockfile+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 5070 "configure"
+#line 5137 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char flockfile (); below.  */
@@ -5098,16 +5165,16 @@ f = flockfile;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:5101: \"$ac_link\"") >&5
+if { (eval echo "$as_me:5168: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:5104: \$? = $ac_status" >&5
+  echo "$as_me:5171: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:5107: \"$ac_try\"") >&5
+  { (eval echo "$as_me:5174: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:5110: \$? = $ac_status" >&5
+  echo "$as_me:5177: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_flockfile=yes
 else
@@ -5117,7 +5184,7 @@ ac_cv_func_flockfile=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:5120: result: $ac_cv_func_flockfile" >&5
+echo "$as_me:5187: result: $ac_cv_func_flockfile" >&5
 echo "${ECHO_T}$ac_cv_func_flockfile" >&6
 if test $ac_cv_func_flockfile = yes; then
   cat >>confdefs.h <<\EOF
@@ -5126,13 +5193,13 @@ EOF
 
 fi
 
-echo "$as_me:5129: checking for getc_unlocked" >&5
+echo "$as_me:5196: checking for getc_unlocked" >&5
 echo $ECHO_N "checking for getc_unlocked... $ECHO_C" >&6
 if test "${ac_cv_func_getc_unlocked+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 5135 "configure"
+#line 5202 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char getc_unlocked (); below.  */
@@ -5163,16 +5230,16 @@ f = getc_unlocked;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:5166: \"$ac_link\"") >&5
+if { (eval echo "$as_me:5233: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:5169: \$? = $ac_status" >&5
+  echo "$as_me:5236: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:5172: \"$ac_try\"") >&5
+  { (eval echo "$as_me:5239: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:5175: \$? = $ac_status" >&5
+  echo "$as_me:5242: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_getc_unlocked=yes
 else
@@ -5182,7 +5249,7 @@ ac_cv_func_getc_unlocked=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:5185: result: $ac_cv_func_getc_unlocked" >&5
+echo "$as_me:5252: result: $ac_cv_func_getc_unlocked" >&5
 echo "${ECHO_T}$ac_cv_func_getc_unlocked" >&6
 if test $ac_cv_func_getc_unlocked = yes; then
   cat >>confdefs.h <<\EOF
@@ -5194,13 +5261,13 @@ fi
 #
 # Indicate what the final decision was regarding threads.
 #
-echo "$as_me:5197: checking whether to build with threads" >&5
+echo "$as_me:5264: checking whether to build with threads" >&5
 echo $ECHO_N "checking whether to build with threads... $ECHO_C" >&6
 if $use_threads; then
-	echo "$as_me:5200: result: yes" >&5
+	echo "$as_me:5267: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 else
-	echo "$as_me:5203: result: no" >&5
+	echo "$as_me:5270: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -5267,13 +5334,13 @@ fi
 #
 # NLS
 #
-echo "$as_me:5270: checking for catgets" >&5
+echo "$as_me:5337: checking for catgets" >&5
 echo $ECHO_N "checking for catgets... $ECHO_C" >&6
 if test "${ac_cv_func_catgets+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 5276 "configure"
+#line 5343 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char catgets (); below.  */
@@ -5304,16 +5371,16 @@ f = catgets;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:5307: \"$ac_link\"") >&5
+if { (eval echo "$as_me:5374: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:5310: \$? = $ac_status" >&5
+  echo "$as_me:5377: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:5313: \"$ac_try\"") >&5
+  { (eval echo "$as_me:5380: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:5316: \$? = $ac_status" >&5
+  echo "$as_me:5383: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_catgets=yes
 else
@@ -5323,7 +5390,7 @@ ac_cv_func_catgets=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:5326: result: $ac_cv_func_catgets" >&5
+echo "$as_me:5393: result: $ac_cv_func_catgets" >&5
 echo "${ECHO_T}$ac_cv_func_catgets" >&6
 if test $ac_cv_func_catgets = yes; then
   cat >>confdefs.h <<\EOF
@@ -5347,7 +5414,7 @@ case "$host" in
 		;;
 	*)
 
-echo "$as_me:5350: checking for socket in -lsocket" >&5
+echo "$as_me:5417: checking for socket in -lsocket" >&5
 echo $ECHO_N "checking for socket in -lsocket... $ECHO_C" >&6
 if test "${ac_cv_lib_socket_socket+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -5355,7 +5422,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lsocket  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 5358 "configure"
+#line 5425 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -5374,16 +5441,16 @@ socket ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:5377: \"$ac_link\"") >&5
+if { (eval echo "$as_me:5444: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:5380: \$? = $ac_status" >&5
+  echo "$as_me:5447: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:5383: \"$ac_try\"") >&5
+  { (eval echo "$as_me:5450: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:5386: \$? = $ac_status" >&5
+  echo "$as_me:5453: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_socket_socket=yes
 else
@@ -5394,7 +5461,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:5397: result: $ac_cv_lib_socket_socket" >&5
+echo "$as_me:5464: result: $ac_cv_lib_socket_socket" >&5
 echo "${ECHO_T}$ac_cv_lib_socket_socket" >&6
 if test $ac_cv_lib_socket_socket = yes; then
   cat >>confdefs.h <<EOF
@@ -5405,7 +5472,7 @@ EOF
 
 fi
 
-echo "$as_me:5408: checking for inet_ntoa in -lnsl" >&5
+echo "$as_me:5475: checking for inet_ntoa in -lnsl" >&5
 echo $ECHO_N "checking for inet_ntoa in -lnsl... $ECHO_C" >&6
 if test "${ac_cv_lib_nsl_inet_ntoa+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -5413,7 +5480,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lnsl  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 5416 "configure"
+#line 5483 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -5432,16 +5499,16 @@ inet_ntoa ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:5435: \"$ac_link\"") >&5
+if { (eval echo "$as_me:5502: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:5438: \$? = $ac_status" >&5
+  echo "$as_me:5505: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:5441: \"$ac_try\"") >&5
+  { (eval echo "$as_me:5508: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:5444: \$? = $ac_status" >&5
+  echo "$as_me:5511: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_nsl_inet_ntoa=yes
 else
@@ -5452,7 +5519,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:5455: result: $ac_cv_lib_nsl_inet_ntoa" >&5
+echo "$as_me:5522: result: $ac_cv_lib_nsl_inet_ntoa" >&5
 echo "${ECHO_T}$ac_cv_lib_nsl_inet_ntoa" >&6
 if test $ac_cv_lib_nsl_inet_ntoa = yes; then
   cat >>confdefs.h <<EOF
@@ -5469,7 +5536,7 @@ esac
 #
 # Purify support
 #
-echo "$as_me:5472: checking whether to use purify" >&5
+echo "$as_me:5539: checking whether to use purify" >&5
 echo $ECHO_N "checking whether to use purify... $ECHO_C" >&6
 
 # Check whether --with-purify or --without-purify was given.
@@ -5486,7 +5553,7 @@ case "$use_purify" in
 	yes)
 		# Extract the first word of "purify", so it can be a program name with args.
 set dummy purify; ac_word=$2
-echo "$as_me:5489: checking for $ac_word" >&5
+echo "$as_me:5556: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_path_purify_path+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -5503,7 +5570,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   if $as_executable_p "$ac_dir/$ac_word"; then
    ac_cv_path_purify_path="$ac_dir/$ac_word"
-   echo "$as_me:5506: found $ac_dir/$ac_word" >&5
+   echo "$as_me:5573: found $ac_dir/$ac_word" >&5
    break
 fi
 done
@@ -5515,10 +5582,10 @@ fi
 purify_path=$ac_cv_path_purify_path
 
 if test -n "$purify_path"; then
-  echo "$as_me:5518: result: $purify_path" >&5
+  echo "$as_me:5585: result: $purify_path" >&5
 echo "${ECHO_T}$purify_path" >&6
 else
-  echo "$as_me:5521: result: no" >&5
+  echo "$as_me:5588: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -5530,18 +5597,18 @@ esac
 
 case "$use_purify" in
 	no)
-		echo "$as_me:5533: result: no" >&5
+		echo "$as_me:5600: result: no" >&5
 echo "${ECHO_T}no" >&6
 		PURIFY=""
 		;;
 	*)
 		if test -f $purify_path || test $purify_path = purify; then
-			echo "$as_me:5539: result: $purify_path" >&5
+			echo "$as_me:5606: result: $purify_path" >&5
 echo "${ECHO_T}$purify_path" >&6
 			PURIFYFLAGS="`echo $PURIFYOPTIONS`"
 			PURIFY="$purify_path $PURIFYFLAGS"
 		else
-			{ { echo "$as_me:5544: error: $purify_path not found.
+			{ { echo "$as_me:5611: error: $purify_path not found.
 
 Please choose the proper path with the following command:
 
@@ -5649,7 +5716,7 @@ fi;
 ac_prog=ld
 if test "$GCC" = yes; then
   # Check if gcc -print-prog-name=ld gives a path.
-  echo "$as_me:5652: checking for ld used by GCC" >&5
+  echo "$as_me:5719: checking for ld used by GCC" >&5
 echo $ECHO_N "checking for ld used by GCC... $ECHO_C" >&6
   case $host in
   *-*-mingw*)
@@ -5679,10 +5746,10 @@ echo $ECHO_N "checking for ld used by GCC... $ECHO_C" >&6
     ;;
   esac
 elif test "$with_gnu_ld" = yes; then
-  echo "$as_me:5682: checking for GNU ld" >&5
+  echo "$as_me:5749: checking for GNU ld" >&5
 echo $ECHO_N "checking for GNU ld... $ECHO_C" >&6
 else
-  echo "$as_me:5685: checking for non-GNU ld" >&5
+  echo "$as_me:5752: checking for non-GNU ld" >&5
 echo $ECHO_N "checking for non-GNU ld... $ECHO_C" >&6
 fi
 if test "${lt_cv_path_LD+set}" = set; then
@@ -5712,16 +5779,16 @@ fi
 
 LD="$lt_cv_path_LD"
 if test -n "$LD"; then
-  echo "$as_me:5715: result: $LD" >&5
+  echo "$as_me:5782: result: $LD" >&5
 echo "${ECHO_T}$LD" >&6
 else
-  echo "$as_me:5718: result: no" >&5
+  echo "$as_me:5785: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
-test -z "$LD" && { { echo "$as_me:5721: error: no acceptable ld found in \$PATH" >&5
+test -z "$LD" && { { echo "$as_me:5788: error: no acceptable ld found in \$PATH" >&5
 echo "$as_me: error: no acceptable ld found in \$PATH" >&2;}
    { (exit 1); exit 1; }; }
-echo "$as_me:5724: checking if the linker ($LD) is GNU ld" >&5
+echo "$as_me:5791: checking if the linker ($LD) is GNU ld" >&5
 echo $ECHO_N "checking if the linker ($LD) is GNU ld... $ECHO_C" >&6
 if test "${lt_cv_prog_gnu_ld+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -5733,23 +5800,23 @@ else
   lt_cv_prog_gnu_ld=no
 fi
 fi
-echo "$as_me:5736: result: $lt_cv_prog_gnu_ld" >&5
+echo "$as_me:5803: result: $lt_cv_prog_gnu_ld" >&5
 echo "${ECHO_T}$lt_cv_prog_gnu_ld" >&6
 with_gnu_ld=$lt_cv_prog_gnu_ld
 
-echo "$as_me:5740: checking for $LD option to reload object files" >&5
+echo "$as_me:5807: checking for $LD option to reload object files" >&5
 echo $ECHO_N "checking for $LD option to reload object files... $ECHO_C" >&6
 if test "${lt_cv_ld_reload_flag+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   lt_cv_ld_reload_flag='-r'
 fi
-echo "$as_me:5747: result: $lt_cv_ld_reload_flag" >&5
+echo "$as_me:5814: result: $lt_cv_ld_reload_flag" >&5
 echo "${ECHO_T}$lt_cv_ld_reload_flag" >&6
 reload_flag=$lt_cv_ld_reload_flag
 test -n "$reload_flag" && reload_flag=" $reload_flag"
 
-echo "$as_me:5752: checking for BSD-compatible nm" >&5
+echo "$as_me:5819: checking for BSD-compatible nm" >&5
 echo $ECHO_N "checking for BSD-compatible nm... $ECHO_C" >&6
 if test "${lt_cv_path_NM+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -5785,21 +5852,21 @@ fi
 fi
 
 NM="$lt_cv_path_NM"
-echo "$as_me:5788: result: $NM" >&5
+echo "$as_me:5855: result: $NM" >&5
 echo "${ECHO_T}$NM" >&6
 
-echo "$as_me:5791: checking whether ln -s works" >&5
+echo "$as_me:5858: checking whether ln -s works" >&5
 echo $ECHO_N "checking whether ln -s works... $ECHO_C" >&6
 LN_S=$as_ln_s
 if test "$LN_S" = "ln -s"; then
-  echo "$as_me:5795: result: yes" >&5
+  echo "$as_me:5862: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 else
-  echo "$as_me:5798: result: no, using $LN_S" >&5
+  echo "$as_me:5865: result: no, using $LN_S" >&5
 echo "${ECHO_T}no, using $LN_S" >&6
 fi
 
-echo "$as_me:5802: checking how to recognise dependant libraries" >&5
+echo "$as_me:5869: checking how to recognise dependant libraries" >&5
 echo $ECHO_N "checking how to recognise dependant libraries... $ECHO_C" >&6
 if test "${lt_cv_deplibs_check_method+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -5967,13 +6034,13 @@ sysv4 | sysv4.2uw2* | sysv4.3* | sysv5*)
 esac
 
 fi
-echo "$as_me:5970: result: $lt_cv_deplibs_check_method" >&5
+echo "$as_me:6037: result: $lt_cv_deplibs_check_method" >&5
 echo "${ECHO_T}$lt_cv_deplibs_check_method" >&6
 file_magic_cmd=$lt_cv_file_magic_cmd
 deplibs_check_method=$lt_cv_deplibs_check_method
 
 # Check for command to grab the raw symbol name followed by C symbol from nm.
-echo "$as_me:5976: checking command to parse $NM output" >&5
+echo "$as_me:6043: checking command to parse $NM output" >&5
 echo $ECHO_N "checking command to parse $NM output... $ECHO_C" >&6
 if test "${lt_cv_sys_global_symbol_pipe+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6050,17 +6117,17 @@ void nm_test_func(){}
 int main(){nm_test_var='a';nm_test_func();return(0);}
 EOF
 
-  if { (eval echo "$as_me:6053: \"$ac_compile\"") >&5
+  if { (eval echo "$as_me:6120: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:6056: \$? = $ac_status" >&5
+  echo "$as_me:6123: \$? = $ac_status" >&5
   (exit $ac_status); }; then
     # Now try to grab the symbols.
     nlist=conftest.nm
-    if { (eval echo "$as_me:6060: \"$NM conftest.$ac_objext \| $lt_cv_sys_global_symbol_pipe \> $nlist\"") >&5
+    if { (eval echo "$as_me:6127: \"$NM conftest.$ac_objext \| $lt_cv_sys_global_symbol_pipe \> $nlist\"") >&5
   (eval $NM conftest.$ac_objext \| $lt_cv_sys_global_symbol_pipe \> $nlist) 2>&5
   ac_status=$?
-  echo "$as_me:6063: \$? = $ac_status" >&5
+  echo "$as_me:6130: \$? = $ac_status" >&5
   (exit $ac_status); } && test -s "$nlist"; then
       # Try sorting and uniquifying the output.
       if sort "$nlist" | uniq > "$nlist"T; then
@@ -6112,10 +6179,10 @@ EOF
 	  save_CFLAGS="$CFLAGS"
 	  LIBS="conftstm.$ac_objext"
 	  CFLAGS="$CFLAGS$no_builtin_flag"
-	  if { (eval echo "$as_me:6115: \"$ac_link\"") >&5
+	  if { (eval echo "$as_me:6182: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:6118: \$? = $ac_status" >&5
+  echo "$as_me:6185: \$? = $ac_status" >&5
   (exit $ac_status); } && test -s conftest; then
 	    pipe_works=yes
 	  fi
@@ -6153,33 +6220,33 @@ else
   global_symbol_to_cdecl="$lt_cv_global_symbol_to_cdecl"
 fi
 if test -z "$global_symbol_pipe$global_symbol_to_cdecl"; then
-  echo "$as_me:6156: result: failed" >&5
+  echo "$as_me:6223: result: failed" >&5
 echo "${ECHO_T}failed" >&6
 else
-  echo "$as_me:6159: result: ok" >&5
+  echo "$as_me:6226: result: ok" >&5
 echo "${ECHO_T}ok" >&6
 fi
 
 for ac_header in dlfcn.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
-echo "$as_me:6166: checking for $ac_header" >&5
+echo "$as_me:6233: checking for $ac_header" >&5
 echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
 if eval "test \"\${$as_ac_Header+set}\" = set"; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 6172 "configure"
+#line 6239 "configure"
 #include "confdefs.h"
 #include <$ac_header>
 _ACEOF
-if { (eval echo "$as_me:6176: \"$ac_cpp conftest.$ac_ext\"") >&5
+if { (eval echo "$as_me:6243: \"$ac_cpp conftest.$ac_ext\"") >&5
   (eval $ac_cpp conftest.$ac_ext) 2>conftest.er1
   ac_status=$?
   egrep -v '^ *\+' conftest.er1 >conftest.err
   rm -f conftest.er1
   cat conftest.err >&5
-  echo "$as_me:6182: \$? = $ac_status" >&5
+  echo "$as_me:6249: \$? = $ac_status" >&5
   (exit $ac_status); } >/dev/null; then
   if test -s conftest.err; then
     ac_cpp_err=$ac_c_preproc_warn_flag
@@ -6198,7 +6265,7 @@ else
 fi
 rm -f conftest.err conftest.$ac_ext
 fi
-echo "$as_me:6201: result: `eval echo '${'$as_ac_Header'}'`" >&5
+echo "$as_me:6268: result: `eval echo '${'$as_ac_Header'}'`" >&5
 echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
 if test `eval echo '${'$as_ac_Header'}'` = yes; then
   cat >>confdefs.h <<EOF
@@ -6212,7 +6279,7 @@ done
 case $deplibs_check_method in
 file_magic*)
   if test "$file_magic_cmd" = '$MAGIC_CMD'; then
-    echo "$as_me:6215: checking for ${ac_tool_prefix}file" >&5
+    echo "$as_me:6282: checking for ${ac_tool_prefix}file" >&5
 echo $ECHO_N "checking for ${ac_tool_prefix}file... $ECHO_C" >&6
 if test "${lt_cv_path_MAGIC_CMD+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6267,16 +6334,16 @@ fi
 
 MAGIC_CMD="$lt_cv_path_MAGIC_CMD"
 if test -n "$MAGIC_CMD"; then
-  echo "$as_me:6270: result: $MAGIC_CMD" >&5
+  echo "$as_me:6337: result: $MAGIC_CMD" >&5
 echo "${ECHO_T}$MAGIC_CMD" >&6
 else
-  echo "$as_me:6273: result: no" >&5
+  echo "$as_me:6340: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
 if test -z "$lt_cv_path_MAGIC_CMD"; then
   if test -n "$ac_tool_prefix"; then
-    echo "$as_me:6279: checking for file" >&5
+    echo "$as_me:6346: checking for file" >&5
 echo $ECHO_N "checking for file... $ECHO_C" >&6
 if test "${lt_cv_path_MAGIC_CMD+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6331,10 +6398,10 @@ fi
 
 MAGIC_CMD="$lt_cv_path_MAGIC_CMD"
 if test -n "$MAGIC_CMD"; then
-  echo "$as_me:6334: result: $MAGIC_CMD" >&5
+  echo "$as_me:6401: result: $MAGIC_CMD" >&5
 echo "${ECHO_T}$MAGIC_CMD" >&6
 else
-  echo "$as_me:6337: result: no" >&5
+  echo "$as_me:6404: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -6350,7 +6417,7 @@ esac
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}ranlib", so it can be a program name with args.
 set dummy ${ac_tool_prefix}ranlib; ac_word=$2
-echo "$as_me:6353: checking for $ac_word" >&5
+echo "$as_me:6420: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_prog_RANLIB+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6365,7 +6432,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   $as_executable_p "$ac_dir/$ac_word" || continue
 ac_cv_prog_RANLIB="${ac_tool_prefix}ranlib"
-echo "$as_me:6368: found $ac_dir/$ac_word" >&5
+echo "$as_me:6435: found $ac_dir/$ac_word" >&5
 break
 done
 
@@ -6373,10 +6440,10 @@ fi
 fi
 RANLIB=$ac_cv_prog_RANLIB
 if test -n "$RANLIB"; then
-  echo "$as_me:6376: result: $RANLIB" >&5
+  echo "$as_me:6443: result: $RANLIB" >&5
 echo "${ECHO_T}$RANLIB" >&6
 else
-  echo "$as_me:6379: result: no" >&5
+  echo "$as_me:6446: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -6385,7 +6452,7 @@ if test -z "$ac_cv_prog_RANLIB"; then
   ac_ct_RANLIB=$RANLIB
   # Extract the first word of "ranlib", so it can be a program name with args.
 set dummy ranlib; ac_word=$2
-echo "$as_me:6388: checking for $ac_word" >&5
+echo "$as_me:6455: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_prog_ac_ct_RANLIB+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6400,7 +6467,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   $as_executable_p "$ac_dir/$ac_word" || continue
 ac_cv_prog_ac_ct_RANLIB="ranlib"
-echo "$as_me:6403: found $ac_dir/$ac_word" >&5
+echo "$as_me:6470: found $ac_dir/$ac_word" >&5
 break
 done
 
@@ -6409,10 +6476,10 @@ fi
 fi
 ac_ct_RANLIB=$ac_cv_prog_ac_ct_RANLIB
 if test -n "$ac_ct_RANLIB"; then
-  echo "$as_me:6412: result: $ac_ct_RANLIB" >&5
+  echo "$as_me:6479: result: $ac_ct_RANLIB" >&5
 echo "${ECHO_T}$ac_ct_RANLIB" >&6
 else
-  echo "$as_me:6415: result: no" >&5
+  echo "$as_me:6482: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -6424,7 +6491,7 @@ fi
 if test -n "$ac_tool_prefix"; then
   # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args.
 set dummy ${ac_tool_prefix}strip; ac_word=$2
-echo "$as_me:6427: checking for $ac_word" >&5
+echo "$as_me:6494: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_prog_STRIP+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6439,7 +6506,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   $as_executable_p "$ac_dir/$ac_word" || continue
 ac_cv_prog_STRIP="${ac_tool_prefix}strip"
-echo "$as_me:6442: found $ac_dir/$ac_word" >&5
+echo "$as_me:6509: found $ac_dir/$ac_word" >&5
 break
 done
 
@@ -6447,10 +6514,10 @@ fi
 fi
 STRIP=$ac_cv_prog_STRIP
 if test -n "$STRIP"; then
-  echo "$as_me:6450: result: $STRIP" >&5
+  echo "$as_me:6517: result: $STRIP" >&5
 echo "${ECHO_T}$STRIP" >&6
 else
-  echo "$as_me:6453: result: no" >&5
+  echo "$as_me:6520: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -6459,7 +6526,7 @@ if test -z "$ac_cv_prog_STRIP"; then
   ac_ct_STRIP=$STRIP
   # Extract the first word of "strip", so it can be a program name with args.
 set dummy strip; ac_word=$2
-echo "$as_me:6462: checking for $ac_word" >&5
+echo "$as_me:6529: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_prog_ac_ct_STRIP+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6474,7 +6541,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   $as_executable_p "$ac_dir/$ac_word" || continue
 ac_cv_prog_ac_ct_STRIP="strip"
-echo "$as_me:6477: found $ac_dir/$ac_word" >&5
+echo "$as_me:6544: found $ac_dir/$ac_word" >&5
 break
 done
 
@@ -6483,10 +6550,10 @@ fi
 fi
 ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP
 if test -n "$ac_ct_STRIP"; then
-  echo "$as_me:6486: result: $ac_ct_STRIP" >&5
+  echo "$as_me:6553: result: $ac_ct_STRIP" >&5
 echo "${ECHO_T}$ac_ct_STRIP" >&6
 else
-  echo "$as_me:6489: result: no" >&5
+  echo "$as_me:6556: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -6510,11 +6577,11 @@ test "x$enable_libtool_lock" != xno && enable_libtool_lock=yes
 case $host in
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 6513 "configure"' > conftest.$ac_ext
-  if { (eval echo "$as_me:6514: \"$ac_compile\"") >&5
+  echo '#line 6580 "configure"' > conftest.$ac_ext
+  if { (eval echo "$as_me:6581: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:6517: \$? = $ac_status" >&5
+  echo "$as_me:6584: \$? = $ac_status" >&5
   (exit $ac_status); }; then
     case `/usr/bin/file conftest.$ac_objext` in
     *32-bit*)
@@ -6535,7 +6602,7 @@ case $host in
   # On SCO OpenServer 5, we need -belf to get full-featured binaries.
   SAVE_CFLAGS="$CFLAGS"
   CFLAGS="$CFLAGS -belf"
-  echo "$as_me:6538: checking whether the C compiler needs -belf" >&5
+  echo "$as_me:6605: checking whether the C compiler needs -belf" >&5
 echo $ECHO_N "checking whether the C compiler needs -belf... $ECHO_C" >&6
 if test "${lt_cv_cc_needs_belf+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6548,7 +6615,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
      cat >conftest.$ac_ext <<_ACEOF
-#line 6551 "configure"
+#line 6618 "configure"
 #include "confdefs.h"
 
 int
@@ -6560,16 +6627,16 @@ main ()
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:6563: \"$ac_link\"") >&5
+if { (eval echo "$as_me:6630: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:6566: \$? = $ac_status" >&5
+  echo "$as_me:6633: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:6569: \"$ac_try\"") >&5
+  { (eval echo "$as_me:6636: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:6572: \$? = $ac_status" >&5
+  echo "$as_me:6639: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   lt_cv_cc_needs_belf=yes
 else
@@ -6585,7 +6652,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 fi
-echo "$as_me:6588: result: $lt_cv_cc_needs_belf" >&5
+echo "$as_me:6655: result: $lt_cv_cc_needs_belf" >&5
 echo "${ECHO_T}$lt_cv_cc_needs_belf" >&6
   if test x"$lt_cv_cc_needs_belf" != x"yes"; then
     # this is probably gcc 2.8.0, egcs 1.0 or newer; no need for -belf
@@ -6680,7 +6747,7 @@ compiler="$2"
 
 ## FIXME: this should be a separate macro
 ##
-echo "$as_me:6683: checking for objdir" >&5
+echo "$as_me:6750: checking for objdir" >&5
 echo $ECHO_N "checking for objdir... $ECHO_C" >&6
 rm -f .libs 2>/dev/null
 mkdir .libs 2>/dev/null
@@ -6691,7 +6758,7 @@ else
   objdir=_libs
 fi
 rmdir .libs 2>/dev/null
-echo "$as_me:6694: result: $objdir" >&5
+echo "$as_me:6761: result: $objdir" >&5
 echo "${ECHO_T}$objdir" >&6
 ##
 ## END FIXME
@@ -6711,7 +6778,7 @@ test -z "$pic_mode" && pic_mode=default
 # We assume here that the value for lt_cv_prog_cc_pic will not be cached
 # in isolation, and that seeing it set (from the cache) indicates that
 # the associated values are set (in the cache) correctly too.
-echo "$as_me:6714: checking for $compiler option to produce PIC" >&5
+echo "$as_me:6781: checking for $compiler option to produce PIC" >&5
 echo $ECHO_N "checking for $compiler option to produce PIC... $ECHO_C" >&6
 if test "${lt_cv_prog_cc_pic+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6858,14 +6925,14 @@ else
 fi
 
 if test -z "$lt_cv_prog_cc_pic"; then
-  echo "$as_me:6861: result: none" >&5
+  echo "$as_me:6928: result: none" >&5
 echo "${ECHO_T}none" >&6
 else
-  echo "$as_me:6864: result: $lt_cv_prog_cc_pic" >&5
+  echo "$as_me:6931: result: $lt_cv_prog_cc_pic" >&5
 echo "${ECHO_T}$lt_cv_prog_cc_pic" >&6
 
   # Check to make sure the pic_flag actually works.
-  echo "$as_me:6868: checking if $compiler PIC flag $lt_cv_prog_cc_pic works" >&5
+  echo "$as_me:6935: checking if $compiler PIC flag $lt_cv_prog_cc_pic works" >&5
 echo $ECHO_N "checking if $compiler PIC flag $lt_cv_prog_cc_pic works... $ECHO_C" >&6
   if test "${lt_cv_prog_cc_pic_works+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6873,7 +6940,7 @@ else
       save_CFLAGS="$CFLAGS"
     CFLAGS="$CFLAGS $lt_cv_prog_cc_pic -DPIC"
     cat >conftest.$ac_ext <<_ACEOF
-#line 6876 "configure"
+#line 6943 "configure"
 #include "confdefs.h"
 
 int
@@ -6885,16 +6952,16 @@ main ()
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:6888: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:6955: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:6891: \$? = $ac_status" >&5
+  echo "$as_me:6958: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:6894: \"$ac_try\"") >&5
+  { (eval echo "$as_me:6961: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:6897: \$? = $ac_status" >&5
+  echo "$as_me:6964: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
         case $host_os in
       hpux9* | hpux10* | hpux11*)
@@ -6930,7 +6997,7 @@ fi
     lt_cv_prog_cc_pic=" $lt_cv_prog_cc_pic"
   fi
 
-  echo "$as_me:6933: result: $lt_cv_prog_cc_pic_works" >&5
+  echo "$as_me:7000: result: $lt_cv_prog_cc_pic_works" >&5
 echo "${ECHO_T}$lt_cv_prog_cc_pic_works" >&6
 fi
 ##
@@ -6938,11 +7005,11 @@ fi
 
 # Check for any special shared library compilation flags.
 if test -n "$lt_cv_prog_cc_shlib"; then
-  { echo "$as_me:6941: WARNING: \`$CC' requires \`$lt_cv_prog_cc_shlib' to build shared libraries" >&5
+  { echo "$as_me:7008: WARNING: \`$CC' requires \`$lt_cv_prog_cc_shlib' to build shared libraries" >&5
 echo "$as_me: WARNING: \`$CC' requires \`$lt_cv_prog_cc_shlib' to build shared libraries" >&2;}
   if echo "$old_CC $old_CFLAGS " | egrep -e "[ 	]$lt_cv_prog_cc_shlib[ 	]" >/dev/null; then :
   else
-   { echo "$as_me:6945: WARNING: add \`$lt_cv_prog_cc_shlib' to the CC or CFLAGS env variable and reconfigure" >&5
+   { echo "$as_me:7012: WARNING: add \`$lt_cv_prog_cc_shlib' to the CC or CFLAGS env variable and reconfigure" >&5
 echo "$as_me: WARNING: add \`$lt_cv_prog_cc_shlib' to the CC or CFLAGS env variable and reconfigure" >&2;}
     lt_cv_prog_cc_can_build_shared=no
   fi
@@ -6950,7 +7017,7 @@ fi
 
 ## FIXME: this should be a separate macro
 ##
-echo "$as_me:6953: checking if $compiler static flag $lt_cv_prog_cc_static works" >&5
+echo "$as_me:7020: checking if $compiler static flag $lt_cv_prog_cc_static works" >&5
 echo $ECHO_N "checking if $compiler static flag $lt_cv_prog_cc_static works... $ECHO_C" >&6
 if test "${lt_cv_prog_cc_static_works+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -6959,7 +7026,7 @@ else
   save_LDFLAGS="$LDFLAGS"
   LDFLAGS="$LDFLAGS $lt_cv_prog_cc_static"
   cat >conftest.$ac_ext <<_ACEOF
-#line 6962 "configure"
+#line 7029 "configure"
 #include "confdefs.h"
 
 int
@@ -6971,16 +7038,16 @@ main ()
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:6974: \"$ac_link\"") >&5
+if { (eval echo "$as_me:7041: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:6977: \$? = $ac_status" >&5
+  echo "$as_me:7044: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:6980: \"$ac_try\"") >&5
+  { (eval echo "$as_me:7047: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:6983: \$? = $ac_status" >&5
+  echo "$as_me:7050: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   lt_cv_prog_cc_static_works=yes
 else
@@ -6994,7 +7061,7 @@ fi
 
 # Belt *and* braces to stop my trousers falling down:
 test "X$lt_cv_prog_cc_static_works" = Xno && lt_cv_prog_cc_static=
-echo "$as_me:6997: result: $lt_cv_prog_cc_static_works" >&5
+echo "$as_me:7064: result: $lt_cv_prog_cc_static_works" >&5
 echo "${ECHO_T}$lt_cv_prog_cc_static_works" >&6
 
 pic_flag="$lt_cv_prog_cc_pic"
@@ -7009,7 +7076,7 @@ can_build_shared="$lt_cv_prog_cc_can_build_shared"
 ## FIXME: this should be a separate macro
 ##
 # Check to see if options -o and -c are simultaneously supported by compiler
-echo "$as_me:7012: checking if $compiler supports -c -o file.$ac_objext" >&5
+echo "$as_me:7079: checking if $compiler supports -c -o file.$ac_objext" >&5
 echo $ECHO_N "checking if $compiler supports -c -o file.$ac_objext... $ECHO_C" >&6
 if test "${lt_cv_compiler_c_o+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -7029,7 +7096,7 @@ chmod -w .
 save_CFLAGS="$CFLAGS"
 CFLAGS="$CFLAGS -o out/conftest2.$ac_objext"
 compiler_c_o=no
-if { (eval echo configure:7032: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>out/conftest.err; } && test -s out/conftest2.$ac_objext; then
+if { (eval echo configure:7099: \"$ac_compile\") 1>&5; (eval $ac_compile) 2>out/conftest.err; } && test -s out/conftest2.$ac_objext; then
   # The compiler can only warn and ignore the option if not recognized
   # So say no if there are warnings
   if test -s out/conftest.err; then
@@ -7053,12 +7120,12 @@ $rm -r conftest 2>/dev/null
 fi
 
 compiler_c_o=$lt_cv_compiler_c_o
-echo "$as_me:7056: result: $compiler_c_o" >&5
+echo "$as_me:7123: result: $compiler_c_o" >&5
 echo "${ECHO_T}$compiler_c_o" >&6
 
 if test x"$compiler_c_o" = x"yes"; then
   # Check to see if we can write to a .lo
-  echo "$as_me:7061: checking if $compiler supports -c -o file.lo" >&5
+  echo "$as_me:7128: checking if $compiler supports -c -o file.lo" >&5
 echo $ECHO_N "checking if $compiler supports -c -o file.lo... $ECHO_C" >&6
   if test "${lt_cv_compiler_o_lo+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -7068,7 +7135,7 @@ else
   save_CFLAGS="$CFLAGS"
   CFLAGS="$CFLAGS -c -o conftest.lo"
   cat >conftest.$ac_ext <<_ACEOF
-#line 7071 "configure"
+#line 7138 "configure"
 #include "confdefs.h"
 
 int
@@ -7080,16 +7147,16 @@ int some_variable = 0;
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:7083: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:7150: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:7086: \$? = $ac_status" >&5
+  echo "$as_me:7153: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:7089: \"$ac_try\"") >&5
+  { (eval echo "$as_me:7156: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:7092: \$? = $ac_status" >&5
+  echo "$as_me:7159: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
       # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -7109,7 +7176,7 @@ rm -f conftest.$ac_objext conftest.$ac_ext
 fi
 
   compiler_o_lo=$lt_cv_compiler_o_lo
-  echo "$as_me:7112: result: $compiler_c_lo" >&5
+  echo "$as_me:7179: result: $compiler_c_lo" >&5
 echo "${ECHO_T}$compiler_c_lo" >&6
 else
   compiler_o_lo=no
@@ -7123,7 +7190,7 @@ fi
 hard_links="nottested"
 if test "$compiler_c_o" = no && test "$need_locks" != no; then
   # do not overwrite the value of need_locks provided by the user
-  echo "$as_me:7126: checking if we can lock with hard links" >&5
+  echo "$as_me:7193: checking if we can lock with hard links" >&5
 echo $ECHO_N "checking if we can lock with hard links... $ECHO_C" >&6
   hard_links=yes
   $rm conftest*
@@ -7131,10 +7198,10 @@ echo $ECHO_N "checking if we can lock with hard links... $ECHO_C" >&6
   touch conftest.a
   ln conftest.a conftest.b 2>&5 || hard_links=no
   ln conftest.a conftest.b 2>/dev/null && hard_links=no
-  echo "$as_me:7134: result: $hard_links" >&5
+  echo "$as_me:7201: result: $hard_links" >&5
 echo "${ECHO_T}$hard_links" >&6
   if test "$hard_links" = no; then
-    { echo "$as_me:7137: WARNING: \`$CC' does not support \`-c -o', so \`make -j' may be unsafe" >&5
+    { echo "$as_me:7204: WARNING: \`$CC' does not support \`-c -o', so \`make -j' may be unsafe" >&5
 echo "$as_me: WARNING: \`$CC' does not support \`-c -o', so \`make -j' may be unsafe" >&2;}
     need_locks=warn
   fi
@@ -7148,14 +7215,14 @@ fi
 ##
 if test "$GCC" = yes; then
   # Check to see if options -fno-rtti -fno-exceptions are supported by compiler
-  echo "$as_me:7151: checking if $compiler supports -fno-rtti -fno-exceptions" >&5
+  echo "$as_me:7218: checking if $compiler supports -fno-rtti -fno-exceptions" >&5
 echo $ECHO_N "checking if $compiler supports -fno-rtti -fno-exceptions... $ECHO_C" >&6
   echo "int some_variable = 0;" > conftest.$ac_ext
   save_CFLAGS="$CFLAGS"
   CFLAGS="$CFLAGS -fno-rtti -fno-exceptions -c conftest.$ac_ext"
   compiler_rtti_exceptions=no
   cat >conftest.$ac_ext <<_ACEOF
-#line 7158 "configure"
+#line 7225 "configure"
 #include "confdefs.h"
 
 int
@@ -7167,16 +7234,16 @@ int some_variable = 0;
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:7170: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:7237: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:7173: \$? = $ac_status" >&5
+  echo "$as_me:7240: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:7176: \"$ac_try\"") >&5
+  { (eval echo "$as_me:7243: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:7179: \$? = $ac_status" >&5
+  echo "$as_me:7246: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
       # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings
@@ -7192,7 +7259,7 @@ cat conftest.$ac_ext >&5
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
   CFLAGS="$save_CFLAGS"
-  echo "$as_me:7195: result: $compiler_rtti_exceptions" >&5
+  echo "$as_me:7262: result: $compiler_rtti_exceptions" >&5
 echo "${ECHO_T}$compiler_rtti_exceptions" >&6
 
   if test "$compiler_rtti_exceptions" = "yes"; then
@@ -7207,7 +7274,7 @@ fi
 ## FIXME: this should be a separate macro
 ##
 # See if the linker supports building shared libraries.
-echo "$as_me:7210: checking whether the linker ($LD) supports shared libraries" >&5
+echo "$as_me:7277: checking whether the linker ($LD) supports shared libraries" >&5
 echo $ECHO_N "checking whether the linker ($LD) supports shared libraries... $ECHO_C" >&6
 
 allow_undefined_flag=
@@ -7539,7 +7606,7 @@ else
         hardcode_libdir_flag_spec='${wl}-bnolibpath ${wl}-blibpath:$libdir:/usr/lib:/lib'
         # Warning - without using the other run time loading flags, -berok will
         #           link without error, but may produce a broken library.
-        allow_undefined_flag='${wl}-berok"
+        allow_undefined_flag='${wl}-berok'
         # This is a bit strange, but is similar to how AIX traditionally builds
         # it's shared libraries.
         archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs $compiler_flags ${allow_undefined_flag} '"\${wl}$no_entry_flag \${wl}$exp_sym_flag:\$export_symbols"' ~$AR -crlo $objdir/$libname$release.a $objdir/$soname'
@@ -7819,7 +7886,7 @@ else
     ;;
   esac
 fi
-echo "$as_me:7822: result: $ld_shlibs" >&5
+echo "$as_me:7889: result: $ld_shlibs" >&5
 echo "${ECHO_T}$ld_shlibs" >&6
 test "$ld_shlibs" = no && can_build_shared=no
 ##
@@ -7828,7 +7895,7 @@ test "$ld_shlibs" = no && can_build_shared=no
 ## FIXME: this should be a separate macro
 ##
 # Check hardcoding attributes.
-echo "$as_me:7831: checking how to hardcode library paths into programs" >&5
+echo "$as_me:7898: checking how to hardcode library paths into programs" >&5
 echo $ECHO_N "checking how to hardcode library paths into programs... $ECHO_C" >&6
 hardcode_action=
 if test -n "$hardcode_libdir_flag_spec" || \
@@ -7852,7 +7919,7 @@ else
   # directories.
   hardcode_action=unsupported
 fi
-echo "$as_me:7855: result: $hardcode_action" >&5
+echo "$as_me:7922: result: $hardcode_action" >&5
 echo "${ECHO_T}$hardcode_action" >&6
 ##
 ## END FIXME
@@ -7861,15 +7928,15 @@ echo "${ECHO_T}$hardcode_action" >&6
 ##
 striplib=
 old_striplib=
-echo "$as_me:7864: checking whether stripping libraries is possible" >&5
+echo "$as_me:7931: checking whether stripping libraries is possible" >&5
 echo $ECHO_N "checking whether stripping libraries is possible... $ECHO_C" >&6
 if test -n "$STRIP" && $STRIP -V 2>&1 | grep "GNU strip" >/dev/null; then
   test -z "$old_striplib" && old_striplib="$STRIP --strip-debug"
   test -z "$striplib" && striplib="$STRIP --strip-unneeded"
-  echo "$as_me:7869: result: yes" >&5
+  echo "$as_me:7936: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 else
-  echo "$as_me:7872: result: no" >&5
+  echo "$as_me:7939: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 ##
@@ -7881,7 +7948,7 @@ test -z "$deplibs_check_method" && deplibs_check_method=unknown
 ## FIXME: this should be a separate macro
 ##
 # PORTME Fill in your ld.so characteristics
-echo "$as_me:7884: checking dynamic linker characteristics" >&5
+echo "$as_me:7951: checking dynamic linker characteristics" >&5
 echo $ECHO_N "checking dynamic linker characteristics... $ECHO_C" >&6
 library_names_spec=
 libname_spec='lib$name'
@@ -7960,7 +8027,7 @@ beos*)
   shlibpath_var=LIBRARY_PATH
   ;;
 
-bsdi4*)
+bsdi45*)
   version_type=linux
   need_version=no
   library_names_spec='${libname}${release}.so$versuffix ${libname}${release}.so$major $libname.so'
@@ -8263,7 +8330,7 @@ sysv4*MP*)
   dynamic_linker=no
   ;;
 esac
-echo "$as_me:8266: result: $dynamic_linker" >&5
+echo "$as_me:8333: result: $dynamic_linker" >&5
 echo "${ECHO_T}$dynamic_linker" >&6
 test "$dynamic_linker" = no && can_build_shared=no
 ##
@@ -8272,9 +8339,9 @@ test "$dynamic_linker" = no && can_build_shared=no
 ## FIXME: this should be a separate macro
 ##
 # Report the final consequences.
-echo "$as_me:8275: checking if libtool supports shared libraries" >&5
+echo "$as_me:8342: checking if libtool supports shared libraries" >&5
 echo $ECHO_N "checking if libtool supports shared libraries... $ECHO_C" >&6
-echo "$as_me:8277: result: $can_build_shared" >&5
+echo "$as_me:8344: result: $can_build_shared" >&5
 echo "${ECHO_T}$can_build_shared" >&6
 ##
 ## END FIXME
@@ -8314,7 +8381,7 @@ else
    ;;
 
   *)
-    echo "$as_me:8317: checking for dlopen in -ldl" >&5
+    echo "$as_me:8384: checking for dlopen in -ldl" >&5
 echo $ECHO_N "checking for dlopen in -ldl... $ECHO_C" >&6
 if test "${ac_cv_lib_dl_dlopen+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -8322,7 +8389,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldl  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 8325 "configure"
+#line 8392 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -8341,16 +8408,16 @@ dlopen ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:8344: \"$ac_link\"") >&5
+if { (eval echo "$as_me:8411: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:8347: \$? = $ac_status" >&5
+  echo "$as_me:8414: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:8350: \"$ac_try\"") >&5
+  { (eval echo "$as_me:8417: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:8353: \$? = $ac_status" >&5
+  echo "$as_me:8420: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_dl_dlopen=yes
 else
@@ -8361,18 +8428,18 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:8364: result: $ac_cv_lib_dl_dlopen" >&5
+echo "$as_me:8431: result: $ac_cv_lib_dl_dlopen" >&5
 echo "${ECHO_T}$ac_cv_lib_dl_dlopen" >&6
 if test $ac_cv_lib_dl_dlopen = yes; then
   lt_cv_dlopen="dlopen" lt_cv_dlopen_libs="-ldl"
 else
-  echo "$as_me:8369: checking for dlopen" >&5
+  echo "$as_me:8436: checking for dlopen" >&5
 echo $ECHO_N "checking for dlopen... $ECHO_C" >&6
 if test "${ac_cv_func_dlopen+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 8375 "configure"
+#line 8442 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char dlopen (); below.  */
@@ -8403,16 +8470,16 @@ f = dlopen;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:8406: \"$ac_link\"") >&5
+if { (eval echo "$as_me:8473: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:8409: \$? = $ac_status" >&5
+  echo "$as_me:8476: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:8412: \"$ac_try\"") >&5
+  { (eval echo "$as_me:8479: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:8415: \$? = $ac_status" >&5
+  echo "$as_me:8482: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_dlopen=yes
 else
@@ -8422,18 +8489,18 @@ ac_cv_func_dlopen=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:8425: result: $ac_cv_func_dlopen" >&5
+echo "$as_me:8492: result: $ac_cv_func_dlopen" >&5
 echo "${ECHO_T}$ac_cv_func_dlopen" >&6
 if test $ac_cv_func_dlopen = yes; then
   lt_cv_dlopen="dlopen"
 else
-  echo "$as_me:8430: checking for shl_load" >&5
+  echo "$as_me:8497: checking for shl_load" >&5
 echo $ECHO_N "checking for shl_load... $ECHO_C" >&6
 if test "${ac_cv_func_shl_load+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 8436 "configure"
+#line 8503 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char shl_load (); below.  */
@@ -8464,16 +8531,16 @@ f = shl_load;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:8467: \"$ac_link\"") >&5
+if { (eval echo "$as_me:8534: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:8470: \$? = $ac_status" >&5
+  echo "$as_me:8537: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:8473: \"$ac_try\"") >&5
+  { (eval echo "$as_me:8540: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:8476: \$? = $ac_status" >&5
+  echo "$as_me:8543: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_shl_load=yes
 else
@@ -8483,12 +8550,12 @@ ac_cv_func_shl_load=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:8486: result: $ac_cv_func_shl_load" >&5
+echo "$as_me:8553: result: $ac_cv_func_shl_load" >&5
 echo "${ECHO_T}$ac_cv_func_shl_load" >&6
 if test $ac_cv_func_shl_load = yes; then
   lt_cv_dlopen="shl_load"
 else
-  echo "$as_me:8491: checking for dlopen in -lsvld" >&5
+  echo "$as_me:8558: checking for dlopen in -lsvld" >&5
 echo $ECHO_N "checking for dlopen in -lsvld... $ECHO_C" >&6
 if test "${ac_cv_lib_svld_dlopen+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -8496,7 +8563,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-lsvld  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 8499 "configure"
+#line 8566 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -8515,16 +8582,16 @@ dlopen ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:8518: \"$ac_link\"") >&5
+if { (eval echo "$as_me:8585: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:8521: \$? = $ac_status" >&5
+  echo "$as_me:8588: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:8524: \"$ac_try\"") >&5
+  { (eval echo "$as_me:8591: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:8527: \$? = $ac_status" >&5
+  echo "$as_me:8594: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_svld_dlopen=yes
 else
@@ -8535,12 +8602,12 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:8538: result: $ac_cv_lib_svld_dlopen" >&5
+echo "$as_me:8605: result: $ac_cv_lib_svld_dlopen" >&5
 echo "${ECHO_T}$ac_cv_lib_svld_dlopen" >&6
 if test $ac_cv_lib_svld_dlopen = yes; then
   lt_cv_dlopen="dlopen" lt_cv_dlopen_libs="-lsvld"
 else
-  echo "$as_me:8543: checking for shl_load in -ldld" >&5
+  echo "$as_me:8610: checking for shl_load in -ldld" >&5
 echo $ECHO_N "checking for shl_load in -ldld... $ECHO_C" >&6
 if test "${ac_cv_lib_dld_shl_load+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -8548,7 +8615,7 @@ else
   ac_check_lib_save_LIBS=$LIBS
 LIBS="-ldld  $LIBS"
 cat >conftest.$ac_ext <<_ACEOF
-#line 8551 "configure"
+#line 8618 "configure"
 #include "confdefs.h"
 
 /* Override any gcc2 internal prototype to avoid an error.  */
@@ -8567,16 +8634,16 @@ shl_load ();
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:8570: \"$ac_link\"") >&5
+if { (eval echo "$as_me:8637: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:8573: \$? = $ac_status" >&5
+  echo "$as_me:8640: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:8576: \"$ac_try\"") >&5
+  { (eval echo "$as_me:8643: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:8579: \$? = $ac_status" >&5
+  echo "$as_me:8646: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_lib_dld_shl_load=yes
 else
@@ -8587,7 +8654,7 @@ fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 LIBS=$ac_check_lib_save_LIBS
 fi
-echo "$as_me:8590: result: $ac_cv_lib_dld_shl_load" >&5
+echo "$as_me:8657: result: $ac_cv_lib_dld_shl_load" >&5
 echo "${ECHO_T}$ac_cv_lib_dld_shl_load" >&6
 if test $ac_cv_lib_dld_shl_load = yes; then
   lt_cv_dlopen="dld_link" lt_cv_dlopen_libs="-dld"
@@ -8621,7 +8688,7 @@ fi
     save_LIBS="$LIBS"
     LIBS="$lt_cv_dlopen_libs $LIBS"
 
-    echo "$as_me:8624: checking whether a program can dlopen itself" >&5
+    echo "$as_me:8691: checking whether a program can dlopen itself" >&5
 echo $ECHO_N "checking whether a program can dlopen itself... $ECHO_C" >&6
 if test "${lt_cv_dlopen_self+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -8632,7 +8699,7 @@ else
     lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 8635 "configure"
+#line 8702 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -8693,10 +8760,10 @@ int main ()
     exit (status);
 }
 EOF
-  if { (eval echo "$as_me:8696: \"$ac_link\"") >&5
+  if { (eval echo "$as_me:8763: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:8699: \$? = $ac_status" >&5
+  echo "$as_me:8766: \$? = $ac_status" >&5
   (exit $ac_status); } && test -s conftest${ac_exeext} 2>/dev/null; then
     (./conftest; exit; ) 2>/dev/null
     lt_status=$?
@@ -8713,12 +8780,12 @@ fi
 rm -fr conftest*
 
 fi
-echo "$as_me:8716: result: $lt_cv_dlopen_self" >&5
+echo "$as_me:8783: result: $lt_cv_dlopen_self" >&5
 echo "${ECHO_T}$lt_cv_dlopen_self" >&6
 
     if test "x$lt_cv_dlopen_self" = xyes; then
       LDFLAGS="$LDFLAGS $link_static_flag"
-      echo "$as_me:8721: checking whether a statically linked program can dlopen itself" >&5
+      echo "$as_me:8788: checking whether a statically linked program can dlopen itself" >&5
 echo $ECHO_N "checking whether a statically linked program can dlopen itself... $ECHO_C" >&6
 if test "${lt_cv_dlopen_self_static+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -8729,7 +8796,7 @@ else
     lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 8732 "configure"
+#line 8799 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -8790,10 +8857,10 @@ int main ()
     exit (status);
 }
 EOF
-  if { (eval echo "$as_me:8793: \"$ac_link\"") >&5
+  if { (eval echo "$as_me:8860: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:8796: \$? = $ac_status" >&5
+  echo "$as_me:8863: \$? = $ac_status" >&5
   (exit $ac_status); } && test -s conftest${ac_exeext} 2>/dev/null; then
     (./conftest; exit; ) 2>/dev/null
     lt_status=$?
@@ -8810,7 +8877,7 @@ fi
 rm -fr conftest*
 
 fi
-echo "$as_me:8813: result: $lt_cv_dlopen_self_static" >&5
+echo "$as_me:8880: result: $lt_cv_dlopen_self_static" >&5
 echo "${ECHO_T}$lt_cv_dlopen_self_static" >&6
     fi
 
@@ -8842,7 +8909,7 @@ if test "$enable_shared" = yes && test "$GCC" = yes; then
     # Test whether the compiler implicitly links with -lc since on some
     # systems, -lgcc has to come before -lc. If gcc already passes -lc
     # to ld, don't add -lc before -lgcc.
-    echo "$as_me:8845: checking whether -lc should be explicitly linked in" >&5
+    echo "$as_me:8912: checking whether -lc should be explicitly linked in" >&5
 echo $ECHO_N "checking whether -lc should be explicitly linked in... $ECHO_C" >&6
     if test "${lt_cv_archive_cmds_need_lc+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -8850,10 +8917,10 @@ else
   $rm conftest*
     echo 'static int dummy;' > conftest.$ac_ext
 
-    if { (eval echo "$as_me:8853: \"$ac_compile\"") >&5
+    if { (eval echo "$as_me:8920: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:8856: \$? = $ac_status" >&5
+  echo "$as_me:8923: \$? = $ac_status" >&5
   (exit $ac_status); }; then
       soname=conftest
       lib=conftest
@@ -8867,10 +8934,10 @@ else
       libname=conftest
       save_allow_undefined_flag=$allow_undefined_flag
       allow_undefined_flag=
-      if { (eval echo "$as_me:8870: \"$archive_cmds 2\>\&1 \| grep \" -lc \" \>/dev/null 2\>\&1\"") >&5
+      if { (eval echo "$as_me:8937: \"$archive_cmds 2\>\&1 \| grep \" -lc \" \>/dev/null 2\>\&1\"") >&5
   (eval $archive_cmds 2\>\&1 \| grep \" -lc \" \>/dev/null 2\>\&1) 2>&5
   ac_status=$?
-  echo "$as_me:8873: \$? = $ac_status" >&5
+  echo "$as_me:8940: \$? = $ac_status" >&5
   (exit $ac_status); }
       then
 	lt_cv_archive_cmds_need_lc=no
@@ -8883,7 +8950,7 @@ else
     fi
 fi
 
-    echo "$as_me:8886: result: $lt_cv_archive_cmds_need_lc" >&5
+    echo "$as_me:8953: result: $lt_cv_archive_cmds_need_lc" >&5
 echo "${ECHO_T}$lt_cv_archive_cmds_need_lc" >&6
     ;;
   esac
@@ -9516,10 +9583,10 @@ esac
 # We do the IPv6 compilation checking after libtool so that we can put
 # the right suffix on the files.
 #
-echo "$as_me:9519: checking for IPv6 structures" >&5
+echo "$as_me:9586: checking for IPv6 structures" >&5
 echo $ECHO_N "checking for IPv6 structures... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 9522 "configure"
+#line 9589 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9534,24 +9601,24 @@ struct sockaddr_in6 sin6; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:9537: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:9604: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:9540: \$? = $ac_status" >&5
+  echo "$as_me:9607: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:9543: \"$ac_try\"") >&5
+  { (eval echo "$as_me:9610: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9546: \$? = $ac_status" >&5
+  echo "$as_me:9613: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9548: result: yes" >&5
+  echo "$as_me:9615: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	 found_ipv6=yes
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:9554: result: no" >&5
+echo "$as_me:9621: result: no" >&5
 echo "${ECHO_T}no" >&6
 	 found_ipv6=no
 fi
@@ -9561,7 +9628,7 @@ rm -f conftest.$ac_objext conftest.$ac_ext
 # See whether IPv6 support is provided via a Kame add-on.
 # This is done before other IPv6 linking tests to LIBS is properly set.
 #
-echo "$as_me:9564: checking for Kame IPv6 support" >&5
+echo "$as_me:9631: checking for Kame IPv6 support" >&5
 echo $ECHO_N "checking for Kame IPv6 support... $ECHO_C" >&6
 
 # Check whether --with-kame or --without-kame was given.
@@ -9585,16 +9652,16 @@ esac
 
 case "$use_kame" in
 	no)
-		echo "$as_me:9588: result: no" >&5
+		echo "$as_me:9655: result: no" >&5
 echo "${ECHO_T}no" >&6
 		;;
 	*)
 		if test -f $kame_path/lib/libinet6.a; then
-			echo "$as_me:9593: result: $kame_path/lib/libinet6.a" >&5
+			echo "$as_me:9660: result: $kame_path/lib/libinet6.a" >&5
 echo "${ECHO_T}$kame_path/lib/libinet6.a" >&6
 			LIBS="-L$kame_path/lib -linet6 $LIBS"
 		else
-			{ { echo "$as_me:9597: error: $kame_path/lib/libinet6.a not found.
+			{ { echo "$as_me:9664: error: $kame_path/lib/libinet6.a not found.
 
 Please choose the proper path with the following command:
 
@@ -9660,10 +9727,10 @@ case "$found_ipv6" in
 		ISC_PLATFORM_HAVEIPV6="#define ISC_PLATFORM_HAVEIPV6 1"
 		LWRES_PLATFORM_HAVEIPV6="#define LWRES_PLATFORM_HAVEIPV6 1"
 
-		echo "$as_me:9663: checking for in6_addr" >&5
+		echo "$as_me:9730: checking for in6_addr" >&5
 echo $ECHO_N "checking for in6_addr... $ECHO_C" >&6
 		cat >conftest.$ac_ext <<_ACEOF
-#line 9666 "configure"
+#line 9733 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9681,18 +9748,18 @@ struct in6_addr in6; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:9684: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:9751: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:9687: \$? = $ac_status" >&5
+  echo "$as_me:9754: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:9690: \"$ac_try\"") >&5
+  { (eval echo "$as_me:9757: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9693: \$? = $ac_status" >&5
+  echo "$as_me:9760: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9695: result: yes" >&5
+  echo "$as_me:9762: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 		 ISC_PLATFORM_HAVEINADDR6="#undef ISC_PLATFORM_HAVEINADDR6"
 		 LWRES_PLATFORM_HAVEINADDR6="#undef LWRES_PLATFORM_HAVEINADDR6"
@@ -9700,7 +9767,7 @@ echo "${ECHO_T}yes" >&6
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:9703: result: no" >&5
+echo "$as_me:9770: result: no" >&5
 echo "${ECHO_T}no" >&6
 		 ISC_PLATFORM_HAVEINADDR6="#define ISC_PLATFORM_HAVEINADDR6 1"
 		 LWRES_PLATFORM_HAVEINADDR6="#define LWRES_PLATFORM_HAVEINADDR6 1"
@@ -9708,10 +9775,10 @@ echo "${ECHO_T}no" >&6
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-		echo "$as_me:9711: checking for in6addr_any" >&5
+		echo "$as_me:9778: checking for in6addr_any" >&5
 echo $ECHO_N "checking for in6addr_any... $ECHO_C" >&6
 		cat >conftest.$ac_ext <<_ACEOF
-#line 9714 "configure"
+#line 9781 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9730,35 +9797,35 @@ struct in6_addr in6; in6 = in6addr_any; return (in6.s6_addr[0]);
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:9733: \"$ac_link\"") >&5
+if { (eval echo "$as_me:9800: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:9736: \$? = $ac_status" >&5
+  echo "$as_me:9803: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:9739: \"$ac_try\"") >&5
+  { (eval echo "$as_me:9806: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9742: \$? = $ac_status" >&5
+  echo "$as_me:9809: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9744: result: yes" >&5
+  echo "$as_me:9811: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 			 ISC_PLATFORM_NEEDIN6ADDRANY="#undef ISC_PLATFORM_NEEDIN6ADDRANY"
 			 LWRES_PLATFORM_NEEDIN6ADDRANY="#undef LWRES_PLATFORM_NEEDIN6ADDRANY"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:9751: result: no" >&5
+echo "$as_me:9818: result: no" >&5
 echo "${ECHO_T}no" >&6
 			 ISC_PLATFORM_NEEDIN6ADDRANY="#define ISC_PLATFORM_NEEDIN6ADDRANY 1"
 			 LWRES_PLATFORM_NEEDIN6ADDRANY="#define LWRES_PLATFORM_NEEDIN6ADDRANY 1"
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 
-		echo "$as_me:9758: checking for in6addr_loopback" >&5
+		echo "$as_me:9825: checking for in6addr_loopback" >&5
 echo $ECHO_N "checking for in6addr_loopback... $ECHO_C" >&6
 		cat >conftest.$ac_ext <<_ACEOF
-#line 9761 "configure"
+#line 9828 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9777,35 +9844,35 @@ struct in6_addr in6; in6 = in6addr_loopback; return (in6.s6_addr[0]);
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:9780: \"$ac_link\"") >&5
+if { (eval echo "$as_me:9847: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:9783: \$? = $ac_status" >&5
+  echo "$as_me:9850: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:9786: \"$ac_try\"") >&5
+  { (eval echo "$as_me:9853: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9789: \$? = $ac_status" >&5
+  echo "$as_me:9856: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9791: result: yes" >&5
+  echo "$as_me:9858: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 			 ISC_PLATFORM_NEEDIN6ADDRLOOPBACK="#undef ISC_PLATFORM_NEEDIN6ADDRLOOPBACK"
 			 LWRES_PLATFORM_NEEDIN6ADDRLOOPBACK="#undef LWRES_PLATFORM_NEEDIN6ADDRLOOPBACK"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:9798: result: no" >&5
+echo "$as_me:9865: result: no" >&5
 echo "${ECHO_T}no" >&6
 			 ISC_PLATFORM_NEEDIN6ADDRLOOPBACK="#define ISC_PLATFORM_NEEDIN6ADDRLOOPBACK 1"
 			 LWRES_PLATFORM_NEEDIN6ADDRLOOPBACK="#define LWRES_PLATFORM_NEEDIN6ADDRLOOPBACK 1"
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 
-		echo "$as_me:9805: checking for sin6_scope_id in struct sockaddr_in6" >&5
+		echo "$as_me:9872: checking for sin6_scope_id in struct sockaddr_in6" >&5
 echo $ECHO_N "checking for sin6_scope_id in struct sockaddr_in6... $ECHO_C" >&6
 		cat >conftest.$ac_ext <<_ACEOF
-#line 9808 "configure"
+#line 9875 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9823,34 +9890,34 @@ struct sockaddr_in6 xyzzy; xyzzy.sin6_scope_id = 0; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:9826: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:9893: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:9829: \$? = $ac_status" >&5
+  echo "$as_me:9896: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:9832: \"$ac_try\"") >&5
+  { (eval echo "$as_me:9899: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9835: \$? = $ac_status" >&5
+  echo "$as_me:9902: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9837: result: yes" >&5
+  echo "$as_me:9904: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 			 result="#define LWRES_HAVE_SIN6_SCOPE_ID 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:9843: result: no" >&5
+echo "$as_me:9910: result: no" >&5
 echo "${ECHO_T}no" >&6
 			 result="#undef LWRES_HAVE_SIN6_SCOPE_ID"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 		LWRES_HAVE_SIN6_SCOPE_ID="$result"
 
-		echo "$as_me:9850: checking for in6_pktinfo" >&5
+		echo "$as_me:9917: checking for in6_pktinfo" >&5
 echo $ECHO_N "checking for in6_pktinfo... $ECHO_C" >&6
 		cat >conftest.$ac_ext <<_ACEOF
-#line 9853 "configure"
+#line 9920 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9868,24 +9935,24 @@ struct in6_pktinfo xyzzy; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:9871: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:9938: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:9874: \$? = $ac_status" >&5
+  echo "$as_me:9941: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:9877: \"$ac_try\"") >&5
+  { (eval echo "$as_me:9944: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9880: \$? = $ac_status" >&5
+  echo "$as_me:9947: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9882: result: yes" >&5
+  echo "$as_me:9949: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 			 ISC_PLATFORM_HAVEIN6PKTINFO="#define ISC_PLATFORM_HAVEIN6PKTINFO 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:9888: result: no -- disabling runtime ipv6 support" >&5
+echo "$as_me:9955: result: no -- disabling runtime ipv6 support" >&5
 echo "${ECHO_T}no -- disabling runtime ipv6 support" >&6
 			 ISC_PLATFORM_HAVEIN6PKTINFO="#undef ISC_PLATFORM_HAVEIN6PKTINFO"
 fi
@@ -9912,15 +9979,15 @@ esac
 # which provides some (all?) of the desired functions.
 #
 
-echo "$as_me:9915: checking for inet_ntop with IPv6 support" >&5
+echo "$as_me:9982: checking for inet_ntop with IPv6 support" >&5
 echo $ECHO_N "checking for inet_ntop with IPv6 support... $ECHO_C" >&6
 if test "$cross_compiling" = yes; then
-  { { echo "$as_me:9918: error: cannot run test program while cross compiling" >&5
+  { { echo "$as_me:9985: error: cannot run test program while cross compiling" >&5
 echo "$as_me: error: cannot run test program while cross compiling" >&2;}
    { (exit 1); exit 1; }; }
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 9923 "configure"
+#line 9990 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9931,24 +9998,24 @@ main() {
 char a[16],b[64]; return(inet_ntop(AF_INET6, a, b, sizeof(b)) == (char*)0);}
 _ACEOF
 rm -f conftest$ac_exeext
-if { (eval echo "$as_me:9934: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10001: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:9937: \$? = $ac_status" >&5
+  echo "$as_me:10004: \$? = $ac_status" >&5
   (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:9939: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10006: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9942: \$? = $ac_status" >&5
+  echo "$as_me:10009: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9944: result: yes" >&5
+  echo "$as_me:10011: result: yes" >&5
 echo "${ECHO_T}yes" >&6
         ISC_PLATFORM_NEEDNTOP="#undef ISC_PLATFORM_NEEDNTOP"
 else
   echo "$as_me: program exited with status $ac_status" >&5
 echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:9951: result: no" >&5
+echo "$as_me:10018: result: no" >&5
 echo "${ECHO_T}no" >&6
         ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS inet_ntop.$O"
         ISC_EXTRA_SRCS="$ISC_EXTRA_SRCS inet_ntop.c"
@@ -9961,15 +10028,15 @@ fi
 # addresses with less than four octets, like "1.2.3".  Also leading
 # zeros should also be rejected.
 
-echo "$as_me:9964: checking for working inet_pton with IPv6 support" >&5
+echo "$as_me:10031: checking for working inet_pton with IPv6 support" >&5
 echo $ECHO_N "checking for working inet_pton with IPv6 support... $ECHO_C" >&6
 if test "$cross_compiling" = yes; then
-  echo "$as_me:9967: result: assuming target platform has working inet_pton" >&5
+  echo "$as_me:10034: result: assuming target platform has working inet_pton" >&5
 echo "${ECHO_T}assuming target platform has working inet_pton" >&6
 	ISC_PLATFORM_NEEDPTON="#undef ISC_PLATFORM_NEEDPTON"
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 9972 "configure"
+#line 10039 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -9981,24 +10048,24 @@ main() { char a[16]; return (inet_pton(AF_INET, "1.2.3", a) == 1 ? 1 :
 			     (inet_pton(AF_INET6, "::1.2.3.4", a) != 1)); }
 _ACEOF
 rm -f conftest$ac_exeext
-if { (eval echo "$as_me:9984: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10051: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:9987: \$? = $ac_status" >&5
+  echo "$as_me:10054: \$? = $ac_status" >&5
   (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:9989: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10056: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:9992: \$? = $ac_status" >&5
+  echo "$as_me:10059: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:9994: result: yes" >&5
+  echo "$as_me:10061: result: yes" >&5
 echo "${ECHO_T}yes" >&6
         ISC_PLATFORM_NEEDPTON="#undef ISC_PLATFORM_NEEDPTON"
 else
   echo "$as_me: program exited with status $ac_status" >&5
 echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10001: result: no" >&5
+echo "$as_me:10068: result: no" >&5
 echo "${ECHO_T}no" >&6
         ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS inet_pton.$O"
         ISC_EXTRA_SRCS="$ISC_EXTRA_SRCS inet_pton.c"
@@ -10007,10 +10074,10 @@ fi
 rm -f core core.* *.core conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
 fi
 
-echo "$as_me:10010: checking for inet_aton" >&5
+echo "$as_me:10077: checking for inet_aton" >&5
 echo $ECHO_N "checking for inet_aton... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10013 "configure"
+#line 10080 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -10025,24 +10092,24 @@ struct in_addr in; inet_aton(0, &in); return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10028: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10095: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10031: \$? = $ac_status" >&5
+  echo "$as_me:10098: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:10034: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10101: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10037: \$? = $ac_status" >&5
+  echo "$as_me:10104: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10039: result: yes" >&5
+  echo "$as_me:10106: result: yes" >&5
 echo "${ECHO_T}yes" >&6
         ISC_PLATFORM_NEEDATON="#undef ISC_PLATFORM_NEEDATON"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10045: result: no" >&5
+echo "$as_me:10112: result: no" >&5
 echo "${ECHO_T}no" >&6
         ISC_EXTRA_OBJS="$ISC_EXTRA_OBJS inet_aton.$O"
         ISC_EXTRA_SRCS="$ISC_EXTRA_SRCS inet_aton.c"
@@ -10063,10 +10130,10 @@ EOF
 		;;
 esac
 
-echo "$as_me:10066: checking for sa_len in struct sockaddr" >&5
+echo "$as_me:10133: checking for sa_len in struct sockaddr" >&5
 echo $ECHO_N "checking for sa_len in struct sockaddr... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10069 "configure"
+#line 10136 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -10080,25 +10147,25 @@ struct sockaddr sa; sa.sa_len = 0; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10083: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10150: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10086: \$? = $ac_status" >&5
+  echo "$as_me:10153: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10089: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10156: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10092: \$? = $ac_status" >&5
+  echo "$as_me:10159: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10094: result: yes" >&5
+  echo "$as_me:10161: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_PLATFORM_HAVESALEN="#define ISC_PLATFORM_HAVESALEN 1"
 	LWRES_PLATFORM_HAVESALEN="#define LWRES_PLATFORM_HAVESALEN 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10101: result: no" >&5
+echo "$as_me:10168: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_PLATFORM_HAVESALEN="#undef ISC_PLATFORM_HAVESALEN"
 	LWRES_PLATFORM_HAVESALEN="#undef LWRES_PLATFORM_HAVESALEN"
@@ -10108,10 +10175,10 @@ rm -f conftest.$ac_objext conftest.$ac_ext
 #
 # Look for a 4.4BSD or 4.3BSD struct msghdr
 #
-echo "$as_me:10111: checking for struct msghdr flavor" >&5
+echo "$as_me:10178: checking for struct msghdr flavor" >&5
 echo $ECHO_N "checking for struct msghdr flavor... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10114 "configure"
+#line 10181 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -10125,24 +10192,24 @@ struct msghdr msg; msg.msg_flags = 0; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10128: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10195: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10131: \$? = $ac_status" >&5
+  echo "$as_me:10198: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10134: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10201: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10137: \$? = $ac_status" >&5
+  echo "$as_me:10204: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10139: result: 4.4BSD" >&5
+  echo "$as_me:10206: result: 4.4BSD" >&5
 echo "${ECHO_T}4.4BSD" >&6
 	ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD44MSGHDR 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10145: result: 4.3BSD" >&5
+echo "$as_me:10212: result: 4.3BSD" >&5
 echo "${ECHO_T}4.3BSD" >&6
 	ISC_PLATFORM_MSGHDRFLAVOR="#define ISC_NET_BSD43MSGHDR 1"
 fi
@@ -10151,10 +10218,10 @@ rm -f conftest.$ac_objext conftest.$ac_ext
 #
 # Look for in_port_t.
 #
-echo "$as_me:10154: checking for type in_port_t" >&5
+echo "$as_me:10221: checking for type in_port_t" >&5
 echo $ECHO_N "checking for type in_port_t... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10157 "configure"
+#line 10224 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -10168,24 +10235,24 @@ in_port_t port = 25; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10171: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10238: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10174: \$? = $ac_status" >&5
+  echo "$as_me:10241: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10177: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10244: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10180: \$? = $ac_status" >&5
+  echo "$as_me:10247: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10182: result: yes" >&5
+  echo "$as_me:10249: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_PLATFORM_NEEDPORTT="#undef ISC_PLATFORM_NEEDPORTT"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10188: result: no" >&5
+echo "$as_me:10255: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_PLATFORM_NEEDPORTT="#define ISC_PLATFORM_NEEDPORTT 1"
 fi
@@ -10194,10 +10261,10 @@ rm -f conftest.$ac_objext conftest.$ac_ext
 #
 # Check for addrinfo
 #
-echo "$as_me:10197: checking for struct addrinfo" >&5
+echo "$as_me:10264: checking for struct addrinfo" >&5
 echo $ECHO_N "checking for struct addrinfo... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10200 "configure"
+#line 10267 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10210,18 +10277,18 @@ struct addrinfo a; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10213: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10280: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10216: \$? = $ac_status" >&5
+  echo "$as_me:10283: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10219: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10286: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10222: \$? = $ac_status" >&5
+  echo "$as_me:10289: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10224: result: yes" >&5
+  echo "$as_me:10291: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_NEEDADDRINFO="#undef ISC_LWRES_NEEDADDRINFO"
 	cat >>confdefs.h <<\EOF
@@ -10231,7 +10298,7 @@ EOF
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10234: result: no" >&5
+echo "$as_me:10301: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_NEEDADDRINFO="#define ISC_LWRES_NEEDADDRINFO 1"
 fi
@@ -10240,10 +10307,10 @@ rm -f conftest.$ac_objext conftest.$ac_ext
 #
 # Check for rrsetinfo
 #
-echo "$as_me:10243: checking for struct rrsetinfo" >&5
+echo "$as_me:10310: checking for struct rrsetinfo" >&5
 echo $ECHO_N "checking for struct rrsetinfo... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10246 "configure"
+#line 10313 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10256,33 +10323,33 @@ struct rrsetinfo r; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10259: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10326: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10262: \$? = $ac_status" >&5
+  echo "$as_me:10329: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10265: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10332: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10268: \$? = $ac_status" >&5
+  echo "$as_me:10335: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10270: result: yes" >&5
+  echo "$as_me:10337: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_NEEDRRSETINFO="#undef ISC_LWRES_NEEDRRSETINFO"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10276: result: no" >&5
+echo "$as_me:10343: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_NEEDRRSETINFO="#define ISC_LWRES_NEEDRRSETINFO 1"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10282: checking for int sethostent" >&5
+echo "$as_me:10349: checking for int sethostent" >&5
 echo $ECHO_N "checking for int sethostent... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10285 "configure"
+#line 10352 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10295,33 +10362,33 @@ int i = sethostent(0); return(0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10298: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10365: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10301: \$? = $ac_status" >&5
+  echo "$as_me:10368: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10304: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10371: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10307: \$? = $ac_status" >&5
+  echo "$as_me:10374: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10309: result: yes" >&5
+  echo "$as_me:10376: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_SETHOSTENTINT="#define ISC_LWRES_SETHOSTENTINT 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10315: result: no" >&5
+echo "$as_me:10382: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_SETHOSTENTINT="#undef ISC_LWRES_SETHOSTENTINT"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10321: checking for int endhostent" >&5
+echo "$as_me:10388: checking for int endhostent" >&5
 echo $ECHO_N "checking for int endhostent... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10324 "configure"
+#line 10391 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10334,33 +10401,33 @@ int i = endhostent(); return(0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10337: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10404: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10340: \$? = $ac_status" >&5
+  echo "$as_me:10407: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10343: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10410: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10346: \$? = $ac_status" >&5
+  echo "$as_me:10413: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10348: result: yes" >&5
+  echo "$as_me:10415: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_ENDHOSTENTINT="#define ISC_LWRES_ENDHOSTENTINT 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10354: result: no" >&5
+echo "$as_me:10421: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_ENDHOSTENTINT="#undef ISC_LWRES_ENDHOSTENTINT"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10360: checking for getnetbyaddr(in_addr_t, ...)" >&5
+echo "$as_me:10427: checking for getnetbyaddr(in_addr_t, ...)" >&5
 echo $ECHO_N "checking for getnetbyaddr(in_addr_t, ...)... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10363 "configure"
+#line 10430 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10374,33 +10441,33 @@ main ()
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10377: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10444: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10380: \$? = $ac_status" >&5
+  echo "$as_me:10447: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10383: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10450: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10386: \$? = $ac_status" >&5
+  echo "$as_me:10453: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10388: result: yes" >&5
+  echo "$as_me:10455: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_GETNETBYADDRINADDR="#define ISC_LWRES_GETNETBYADDRINADDR 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10394: result: no" >&5
+echo "$as_me:10461: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_GETNETBYADDRINADDR="#undef ISC_LWRES_GETNETBYADDRINADDR"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10400: checking for int setnetent" >&5
+echo "$as_me:10467: checking for int setnetent" >&5
 echo $ECHO_N "checking for int setnetent... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10403 "configure"
+#line 10470 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10413,33 +10480,33 @@ int i = setnetent(0); return(0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10416: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10483: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10419: \$? = $ac_status" >&5
+  echo "$as_me:10486: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10422: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10489: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10425: \$? = $ac_status" >&5
+  echo "$as_me:10492: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10427: result: yes" >&5
+  echo "$as_me:10494: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_SETNETENTINT="#define ISC_LWRES_SETNETENTINT 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10433: result: no" >&5
+echo "$as_me:10500: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_SETNETENTINT="#undef ISC_LWRES_SETNETENTINT"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10439: checking for int endnetent" >&5
+echo "$as_me:10506: checking for int endnetent" >&5
 echo $ECHO_N "checking for int endnetent... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10442 "configure"
+#line 10509 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10452,33 +10519,33 @@ int i = endnetent(); return(0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10455: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10522: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10458: \$? = $ac_status" >&5
+  echo "$as_me:10525: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10461: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10528: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10464: \$? = $ac_status" >&5
+  echo "$as_me:10531: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10466: result: yes" >&5
+  echo "$as_me:10533: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_ENDNETENTINT="#define ISC_LWRES_ENDNETENTINT 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10472: result: no" >&5
+echo "$as_me:10539: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_ENDNETENTINT="#undef ISC_LWRES_ENDNETENTINT"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10478: checking for gethostbyaddr(const void *, size_t, ...)" >&5
+echo "$as_me:10545: checking for gethostbyaddr(const void *, size_t, ...)" >&5
 echo $ECHO_N "checking for gethostbyaddr(const void *, size_t, ...)... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10481 "configure"
+#line 10548 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10492,33 +10559,33 @@ return(0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10495: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10562: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10498: \$? = $ac_status" >&5
+  echo "$as_me:10565: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10501: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10568: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10504: \$? = $ac_status" >&5
+  echo "$as_me:10571: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10506: result: yes" >&5
+  echo "$as_me:10573: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_GETHOSTBYADDRVOID="#define ISC_LWRES_GETHOSTBYADDRVOID 1"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10512: result: no" >&5
+echo "$as_me:10579: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_GETHOSTBYADDRVOID="#undef ISC_LWRES_GETHOSTBYADDRVOID"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10518: checking for h_errno in netdb.h" >&5
+echo "$as_me:10585: checking for h_errno in netdb.h" >&5
 echo $ECHO_N "checking for h_errno in netdb.h... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10521 "configure"
+#line 10588 "configure"
 #include "confdefs.h"
 
 #include <netdb.h>
@@ -10531,36 +10598,36 @@ h_errno = 1; return(0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:10534: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:10601: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:10537: \$? = $ac_status" >&5
+  echo "$as_me:10604: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:10540: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10607: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10543: \$? = $ac_status" >&5
+  echo "$as_me:10610: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10545: result: yes" >&5
+  echo "$as_me:10612: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	ISC_LWRES_NEEDHERRNO="#undef ISC_LWRES_NEEDHERRNO"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10551: result: no" >&5
+echo "$as_me:10618: result: no" >&5
 echo "${ECHO_T}no" >&6
 	ISC_LWRES_NEEDHERRNO="#define ISC_LWRES_NEEDHERRNO 1"
 fi
 rm -f conftest.$ac_objext conftest.$ac_ext
 
-echo "$as_me:10557: checking for getipnodebyname" >&5
+echo "$as_me:10624: checking for getipnodebyname" >&5
 echo $ECHO_N "checking for getipnodebyname... $ECHO_C" >&6
 if test "${ac_cv_func_getipnodebyname+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 10563 "configure"
+#line 10630 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char getipnodebyname (); below.  */
@@ -10591,16 +10658,16 @@ f = getipnodebyname;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10594: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10661: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10597: \$? = $ac_status" >&5
+  echo "$as_me:10664: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:10600: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10667: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10603: \$? = $ac_status" >&5
+  echo "$as_me:10670: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_getipnodebyname=yes
 else
@@ -10610,7 +10677,7 @@ ac_cv_func_getipnodebyname=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:10613: result: $ac_cv_func_getipnodebyname" >&5
+echo "$as_me:10680: result: $ac_cv_func_getipnodebyname" >&5
 echo "${ECHO_T}$ac_cv_func_getipnodebyname" >&6
 if test $ac_cv_func_getipnodebyname = yes; then
   ISC_LWRES_GETIPNODEPROTO="#undef ISC_LWRES_GETIPNODEPROTO"
@@ -10618,13 +10685,13 @@ else
   ISC_LWRES_GETIPNODEPROTO="#define ISC_LWRES_GETIPNODEPROTO 1"
 fi
 
-echo "$as_me:10621: checking for getnameinfo" >&5
+echo "$as_me:10688: checking for getnameinfo" >&5
 echo $ECHO_N "checking for getnameinfo... $ECHO_C" >&6
 if test "${ac_cv_func_getnameinfo+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 10627 "configure"
+#line 10694 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char getnameinfo (); below.  */
@@ -10655,16 +10722,16 @@ f = getnameinfo;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10658: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10725: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10661: \$? = $ac_status" >&5
+  echo "$as_me:10728: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:10664: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10731: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10667: \$? = $ac_status" >&5
+  echo "$as_me:10734: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_getnameinfo=yes
 else
@@ -10674,7 +10741,7 @@ ac_cv_func_getnameinfo=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:10677: result: $ac_cv_func_getnameinfo" >&5
+echo "$as_me:10744: result: $ac_cv_func_getnameinfo" >&5
 echo "${ECHO_T}$ac_cv_func_getnameinfo" >&6
 if test $ac_cv_func_getnameinfo = yes; then
   ISC_LWRES_GETNAMEINFOPROTO="#undef ISC_LWRES_GETNAMEINFOPROTO"
@@ -10682,13 +10749,13 @@ else
   ISC_LWRES_GETNAMEINFOPROTO="#define ISC_LWRES_GETNAMEINFOPROTO 1"
 fi
 
-echo "$as_me:10685: checking for getaddrinfo" >&5
+echo "$as_me:10752: checking for getaddrinfo" >&5
 echo $ECHO_N "checking for getaddrinfo... $ECHO_C" >&6
 if test "${ac_cv_func_getaddrinfo+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 10691 "configure"
+#line 10758 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char getaddrinfo (); below.  */
@@ -10719,16 +10786,16 @@ f = getaddrinfo;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10722: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10789: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10725: \$? = $ac_status" >&5
+  echo "$as_me:10792: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:10728: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10795: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10731: \$? = $ac_status" >&5
+  echo "$as_me:10798: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_getaddrinfo=yes
 else
@@ -10738,7 +10805,7 @@ ac_cv_func_getaddrinfo=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:10741: result: $ac_cv_func_getaddrinfo" >&5
+echo "$as_me:10808: result: $ac_cv_func_getaddrinfo" >&5
 echo "${ECHO_T}$ac_cv_func_getaddrinfo" >&6
 if test $ac_cv_func_getaddrinfo = yes; then
   ISC_LWRES_GETADDRINFOPROTO="#undef ISC_LWRES_GETADDRINFOPROTO"
@@ -10750,13 +10817,13 @@ else
   ISC_LWRES_GETADDRINFOPROTO="#define ISC_LWRES_GETADDRINFOPROTO 1"
 fi
 
-echo "$as_me:10753: checking for gai_strerror" >&5
+echo "$as_me:10820: checking for gai_strerror" >&5
 echo $ECHO_N "checking for gai_strerror... $ECHO_C" >&6
 if test "${ac_cv_func_gai_strerror+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 10759 "configure"
+#line 10826 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char gai_strerror (); below.  */
@@ -10787,16 +10854,16 @@ f = gai_strerror;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10790: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10857: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10793: \$? = $ac_status" >&5
+  echo "$as_me:10860: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:10796: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10863: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10799: \$? = $ac_status" >&5
+  echo "$as_me:10866: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_gai_strerror=yes
 else
@@ -10806,7 +10873,7 @@ ac_cv_func_gai_strerror=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:10809: result: $ac_cv_func_gai_strerror" >&5
+echo "$as_me:10876: result: $ac_cv_func_gai_strerror" >&5
 echo "${ECHO_T}$ac_cv_func_gai_strerror" >&6
 if test $ac_cv_func_gai_strerror = yes; then
   cat >>confdefs.h <<\EOF
@@ -10818,10 +10885,12 @@ fi
 #
 # Look for a sysctl call to get the list of network interfaces.
 #
-echo "$as_me:10821: checking for interface list sysctl" >&5
+case $ac_cv_header_sys_sysctl_h in
+yes)
+echo "$as_me:10890: checking for interface list sysctl" >&5
 echo $ECHO_N "checking for interface list sysctl... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10824 "configure"
+#line 10893 "configure"
 #include "confdefs.h"
 
 #include <sys/param.h>
@@ -10834,18 +10903,21 @@ found_rt_iflist
 _ACEOF
 if (eval "$ac_cpp conftest.$ac_ext") 2>&5 |
   egrep "found_rt_iflist" >/dev/null 2>&1; then
-  echo "$as_me:10837: result: yes" >&5
+  echo "$as_me:10906: result: yes" >&5
 echo "${ECHO_T}yes" >&6
 	 cat >>confdefs.h <<\EOF
 #define HAVE_IFLIST_SYSCTL 1
 EOF
 
 else
-  echo "$as_me:10844: result: no" >&5
+  echo "$as_me:10913: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 rm -f conftest*
 
+;;
+esac
+
 #
 # Check for some other useful functions that are not ever-present.
 #
@@ -10856,10 +10928,10 @@ rm -f conftest*
 # -D_LINUX_SOURCE_COMPAT is not defined [RT #2190], and
 # AC_CHECK_FUNC() incorrectly succeeds because it declares
 # the function itself.
-echo "$as_me:10859: checking for correctly declared strsep()" >&5
+echo "$as_me:10931: checking for correctly declared strsep()" >&5
 echo $ECHO_N "checking for correctly declared strsep()... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 10862 "configure"
+#line 10934 "configure"
 #include "confdefs.h"
 #include <string.h>
 int
@@ -10871,34 +10943,34 @@ char *sp; char *foo = strsep(&sp, ".");
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10874: \"$ac_link\"") >&5
+if { (eval echo "$as_me:10946: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10877: \$? = $ac_status" >&5
+  echo "$as_me:10949: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:10880: \"$ac_try\"") >&5
+  { (eval echo "$as_me:10952: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10883: \$? = $ac_status" >&5
+  echo "$as_me:10955: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:10885: result: yes" >&5
+  echo "$as_me:10957: result: yes" >&5
 echo "${ECHO_T}yes" >&6; ISC_PLATFORM_NEEDSTRSEP="#undef ISC_PLATFORM_NEEDSTRSEP"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:10890: result: no" >&5
+echo "$as_me:10962: result: no" >&5
 echo "${ECHO_T}no" >&6; ISC_PLATFORM_NEEDSTRSEP="#define ISC_PLATFORM_NEEDSTRSEP 1"
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 
-echo "$as_me:10895: checking for strlcpy" >&5
+echo "$as_me:10967: checking for strlcpy" >&5
 echo $ECHO_N "checking for strlcpy... $ECHO_C" >&6
 if test "${ac_cv_func_strlcpy+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 10901 "configure"
+#line 10973 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char strlcpy (); below.  */
@@ -10929,16 +11001,16 @@ f = strlcpy;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10932: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11004: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10935: \$? = $ac_status" >&5
+  echo "$as_me:11007: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:10938: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11010: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:10941: \$? = $ac_status" >&5
+  echo "$as_me:11013: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_strlcpy=yes
 else
@@ -10948,7 +11020,7 @@ ac_cv_func_strlcpy=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:10951: result: $ac_cv_func_strlcpy" >&5
+echo "$as_me:11023: result: $ac_cv_func_strlcpy" >&5
 echo "${ECHO_T}$ac_cv_func_strlcpy" >&6
 if test $ac_cv_func_strlcpy = yes; then
   ISC_PLATFORM_NEEDSTRLCPY="#undef ISC_PLATFORM_NEEDSTRLCPY"
@@ -10956,13 +11028,13 @@ else
   ISC_PLATFORM_NEEDSTRLCPY="#define ISC_PLATFORM_NEEDSTRLCPY 1"
 fi
 
-echo "$as_me:10959: checking for strlcat" >&5
+echo "$as_me:11031: checking for strlcat" >&5
 echo $ECHO_N "checking for strlcat... $ECHO_C" >&6
 if test "${ac_cv_func_strlcat+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 10965 "configure"
+#line 11037 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char strlcat (); below.  */
@@ -10993,16 +11065,16 @@ f = strlcat;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:10996: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11068: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:10999: \$? = $ac_status" >&5
+  echo "$as_me:11071: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:11002: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11074: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11005: \$? = $ac_status" >&5
+  echo "$as_me:11077: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_strlcat=yes
 else
@@ -11012,7 +11084,7 @@ ac_cv_func_strlcat=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:11015: result: $ac_cv_func_strlcat" >&5
+echo "$as_me:11087: result: $ac_cv_func_strlcat" >&5
 echo "${ECHO_T}$ac_cv_func_strlcat" >&6
 if test $ac_cv_func_strlcat = yes; then
   ISC_PLATFORM_NEEDSTRLCAT="#undef ISC_PLATFORM_NEEDSTRLCAT"
@@ -11020,13 +11092,13 @@ else
   ISC_PLATFORM_NEEDSTRLCAT="#define ISC_PLATFORM_NEEDSTRLCAT 1"
 fi
 
-echo "$as_me:11023: checking for vsnprintf" >&5
+echo "$as_me:11095: checking for vsnprintf" >&5
 echo $ECHO_N "checking for vsnprintf... $ECHO_C" >&6
 if test "${ac_cv_func_vsnprintf+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11029 "configure"
+#line 11101 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char vsnprintf (); below.  */
@@ -11057,16 +11129,16 @@ f = vsnprintf;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:11060: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11132: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11063: \$? = $ac_status" >&5
+  echo "$as_me:11135: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:11066: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11138: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11069: \$? = $ac_status" >&5
+  echo "$as_me:11141: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_vsnprintf=yes
 else
@@ -11076,7 +11148,7 @@ ac_cv_func_vsnprintf=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:11079: result: $ac_cv_func_vsnprintf" >&5
+echo "$as_me:11151: result: $ac_cv_func_vsnprintf" >&5
 echo "${ECHO_T}$ac_cv_func_vsnprintf" >&6
 if test $ac_cv_func_vsnprintf = yes; then
   ISC_PLATFORM_NEEDVSNPRINTF="#undef ISC_PLATFORM_NEEDVSNPRINTF"
@@ -11086,13 +11158,13 @@ else
 	 ISC_PLATFORM_NEEDVSNPRINTF="#define ISC_PLATFORM_NEEDVSNPRINTF 1"
 fi
 
-echo "$as_me:11089: checking for strerror" >&5
+echo "$as_me:11161: checking for strerror" >&5
 echo $ECHO_N "checking for strerror... $ECHO_C" >&6
 if test "${ac_cv_func_strerror+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11095 "configure"
+#line 11167 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char strerror (); below.  */
@@ -11123,16 +11195,16 @@ f = strerror;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:11126: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11198: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11129: \$? = $ac_status" >&5
+  echo "$as_me:11201: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:11132: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11204: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11135: \$? = $ac_status" >&5
+  echo "$as_me:11207: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_strerror=yes
 else
@@ -11142,7 +11214,7 @@ ac_cv_func_strerror=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:11145: result: $ac_cv_func_strerror" >&5
+echo "$as_me:11217: result: $ac_cv_func_strerror" >&5
 echo "${ECHO_T}$ac_cv_func_strerror" >&6
 if test $ac_cv_func_strerror = yes; then
   cat >>confdefs.h <<\EOF
@@ -11158,37 +11230,37 @@ fi
 # want "%ld" and everyone else can use "%lld".  Win32 uses "%I64d",
 # but that's defined elsewhere since we don't use configure on Win32.
 #
-echo "$as_me:11161: checking printf format modifier for 64-bit integers" >&5
+echo "$as_me:11233: checking printf format modifier for 64-bit integers" >&5
 echo $ECHO_N "checking printf format modifier for 64-bit integers... $ECHO_C" >&6
 if test "$cross_compiling" = yes; then
-  echo "$as_me:11164: result: assuming target platform uses ll" >&5
+  echo "$as_me:11236: result: assuming target platform uses ll" >&5
 echo "${ECHO_T}assuming target platform uses ll" >&6
 	ISC_PLATFORM_QUADFORMAT='#define ISC_PLATFORM_QUADFORMAT "ll"'
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11169 "configure"
+#line 11241 "configure"
 #include "confdefs.h"
 main() { exit(!(sizeof(long long int) == sizeof(long int))); }
 _ACEOF
 rm -f conftest$ac_exeext
-if { (eval echo "$as_me:11174: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11246: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11177: \$? = $ac_status" >&5
+  echo "$as_me:11249: \$? = $ac_status" >&5
   (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:11179: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11251: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11182: \$? = $ac_status" >&5
+  echo "$as_me:11254: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:11184: result: l" >&5
+  echo "$as_me:11256: result: l" >&5
 echo "${ECHO_T}l" >&6
 	ISC_PLATFORM_QUADFORMAT='#define ISC_PLATFORM_QUADFORMAT "l"'
 else
   echo "$as_me: program exited with status $ac_status" >&5
 echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:11191: result: ll" >&5
+echo "$as_me:11263: result: ll" >&5
 echo "${ECHO_T}ll" >&6
 	ISC_PLATFORM_QUADFORMAT='#define ISC_PLATFORM_QUADFORMAT "ll"'
 fi
@@ -11198,13 +11270,13 @@ fi
 #
 # Security Stuff
 #
-echo "$as_me:11201: checking for chroot" >&5
+echo "$as_me:11273: checking for chroot" >&5
 echo $ECHO_N "checking for chroot... $ECHO_C" >&6
 if test "${ac_cv_func_chroot+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11207 "configure"
+#line 11279 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char chroot (); below.  */
@@ -11235,16 +11307,16 @@ f = chroot;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:11238: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11310: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11241: \$? = $ac_status" >&5
+  echo "$as_me:11313: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:11244: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11316: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11247: \$? = $ac_status" >&5
+  echo "$as_me:11319: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_chroot=yes
 else
@@ -11254,7 +11326,7 @@ ac_cv_func_chroot=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:11257: result: $ac_cv_func_chroot" >&5
+echo "$as_me:11329: result: $ac_cv_func_chroot" >&5
 echo "${ECHO_T}$ac_cv_func_chroot" >&6
 if test $ac_cv_func_chroot = yes; then
   cat >>confdefs.h <<\EOF
@@ -11274,23 +11346,23 @@ case "$enable_linux_caps" in
 for ac_header in linux/capability.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
-echo "$as_me:11277: checking for $ac_header" >&5
+echo "$as_me:11349: checking for $ac_header" >&5
 echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
 if eval "test \"\${$as_ac_Header+set}\" = set"; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11283 "configure"
+#line 11355 "configure"
 #include "confdefs.h"
 #include <$ac_header>
 _ACEOF
-if { (eval echo "$as_me:11287: \"$ac_cpp conftest.$ac_ext\"") >&5
+if { (eval echo "$as_me:11359: \"$ac_cpp conftest.$ac_ext\"") >&5
   (eval $ac_cpp conftest.$ac_ext) 2>conftest.er1
   ac_status=$?
   egrep -v '^ *\+' conftest.er1 >conftest.err
   rm -f conftest.er1
   cat conftest.err >&5
-  echo "$as_me:11293: \$? = $ac_status" >&5
+  echo "$as_me:11365: \$? = $ac_status" >&5
   (exit $ac_status); } >/dev/null; then
   if test -s conftest.err; then
     ac_cpp_err=$ac_c_preproc_warn_flag
@@ -11309,7 +11381,7 @@ else
 fi
 rm -f conftest.err conftest.$ac_ext
 fi
-echo "$as_me:11312: result: `eval echo '${'$as_ac_Header'}'`" >&5
+echo "$as_me:11384: result: `eval echo '${'$as_ac_Header'}'`" >&5
 echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
 if test `eval echo '${'$as_ac_Header'}'` = yes; then
   cat >>confdefs.h <<EOF
@@ -11327,23 +11399,23 @@ esac
 for ac_header in sys/prctl.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
-echo "$as_me:11330: checking for $ac_header" >&5
+echo "$as_me:11402: checking for $ac_header" >&5
 echo $ECHO_N "checking for $ac_header... $ECHO_C" >&6
 if eval "test \"\${$as_ac_Header+set}\" = set"; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11336 "configure"
+#line 11408 "configure"
 #include "confdefs.h"
 #include <$ac_header>
 _ACEOF
-if { (eval echo "$as_me:11340: \"$ac_cpp conftest.$ac_ext\"") >&5
+if { (eval echo "$as_me:11412: \"$ac_cpp conftest.$ac_ext\"") >&5
   (eval $ac_cpp conftest.$ac_ext) 2>conftest.er1
   ac_status=$?
   egrep -v '^ *\+' conftest.er1 >conftest.err
   rm -f conftest.er1
   cat conftest.err >&5
-  echo "$as_me:11346: \$? = $ac_status" >&5
+  echo "$as_me:11418: \$? = $ac_status" >&5
   (exit $ac_status); } >/dev/null; then
   if test -s conftest.err; then
     ac_cpp_err=$ac_c_preproc_warn_flag
@@ -11362,7 +11434,7 @@ else
 fi
 rm -f conftest.err conftest.$ac_ext
 fi
-echo "$as_me:11365: result: `eval echo '${'$as_ac_Header'}'`" >&5
+echo "$as_me:11437: result: `eval echo '${'$as_ac_Header'}'`" >&5
 echo "${ECHO_T}`eval echo '${'$as_ac_Header'}'`" >&6
 if test `eval echo '${'$as_ac_Header'}'` = yes; then
   cat >>confdefs.h <<EOF
@@ -11375,13 +11447,13 @@ done
 #
 # Time Zone Stuff
 #
-echo "$as_me:11378: checking for tzset" >&5
+echo "$as_me:11450: checking for tzset" >&5
 echo $ECHO_N "checking for tzset... $ECHO_C" >&6
 if test "${ac_cv_func_tzset+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11384 "configure"
+#line 11456 "configure"
 #include "confdefs.h"
 /* System header to define __stub macros and hopefully few prototypes,
     which can conflict with char tzset (); below.  */
@@ -11412,16 +11484,16 @@ f = tzset;
 }
 _ACEOF
 rm -f conftest.$ac_objext conftest$ac_exeext
-if { (eval echo "$as_me:11415: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11487: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11418: \$? = $ac_status" >&5
+  echo "$as_me:11490: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest$ac_exeext'
-  { (eval echo "$as_me:11421: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11493: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11424: \$? = $ac_status" >&5
+  echo "$as_me:11496: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
   ac_cv_func_tzset=yes
 else
@@ -11431,7 +11503,7 @@ ac_cv_func_tzset=no
 fi
 rm -f conftest.$ac_objext conftest$ac_exeext conftest.$ac_ext
 fi
-echo "$as_me:11434: result: $ac_cv_func_tzset" >&5
+echo "$as_me:11506: result: $ac_cv_func_tzset" >&5
 echo "${ECHO_T}$ac_cv_func_tzset" >&6
 if test $ac_cv_func_tzset = yes; then
   cat >>confdefs.h <<\EOF
@@ -11443,10 +11515,10 @@ fi
 #
 # BSD/OS, and perhaps some others, don't define rlim_t.
 #
-echo "$as_me:11446: checking for type rlim_t" >&5
+echo "$as_me:11518: checking for type rlim_t" >&5
 echo $ECHO_N "checking for type rlim_t... $ECHO_C" >&6
 cat >conftest.$ac_ext <<_ACEOF
-#line 11449 "configure"
+#line 11521 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -11461,35 +11533,35 @@ rlim_t rl = 19671212; return (0);
 }
 _ACEOF
 rm -f conftest.$ac_objext
-if { (eval echo "$as_me:11464: \"$ac_compile\"") >&5
+if { (eval echo "$as_me:11536: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
-  echo "$as_me:11467: \$? = $ac_status" >&5
+  echo "$as_me:11539: \$? = $ac_status" >&5
   (exit $ac_status); } &&
          { ac_try='test -s conftest.$ac_objext'
-  { (eval echo "$as_me:11470: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11542: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11473: \$? = $ac_status" >&5
+  echo "$as_me:11545: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:11475: result: yes" >&5
+  echo "$as_me:11547: result: yes" >&5
 echo "${ECHO_T}yes" >&6
  ISC_PLATFORM_RLIMITTYPE="#define ISC_PLATFORM_RLIMITTYPE rlim_t"
 else
   echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-echo "$as_me:11481: result: no" >&5
+echo "$as_me:11553: result: no" >&5
 echo "${ECHO_T}no" >&6
 
-echo "$as_me:11484: checking type of rlim_cur" >&5
+echo "$as_me:11556: checking type of rlim_cur" >&5
 echo $ECHO_N "checking type of rlim_cur... $ECHO_C" >&6
 if test "$cross_compiling" = yes; then
-  { { echo "$as_me:11487: error: cannot determine type of rlim_cur when cross compiling - define rlim_t" >&5
+  { { echo "$as_me:11559: error: cannot determine type of rlim_cur when cross compiling - define rlim_t" >&5
 echo "$as_me: error: cannot determine type of rlim_cur when cross compiling - define rlim_t" >&2;}
    { (exit 1); exit 1; }; }
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11492 "configure"
+#line 11564 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -11498,17 +11570,17 @@ else
 main() { struct rlimit r; exit(!(sizeof(r.rlim_cur) == sizeof(int)));}
 _ACEOF
 rm -f conftest$ac_exeext
-if { (eval echo "$as_me:11501: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11573: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11504: \$? = $ac_status" >&5
+  echo "$as_me:11576: \$? = $ac_status" >&5
   (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:11506: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11578: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11509: \$? = $ac_status" >&5
+  echo "$as_me:11581: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:11511: result: int" >&5
+  echo "$as_me:11583: result: int" >&5
 echo "${ECHO_T}int" >&6
 ISC_PLATFORM_RLIMITTYPE="#define ISC_PLATFORM_RLIMITTYPE int"
 else
@@ -11517,12 +11589,12 @@ echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
 
 if test "$cross_compiling" = yes; then
-  { { echo "$as_me:11520: error: this cannot happen" >&5
+  { { echo "$as_me:11592: error: this cannot happen" >&5
 echo "$as_me: error: this cannot happen" >&2;}
    { (exit 1); exit 1; }; }
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11525 "configure"
+#line 11597 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -11531,17 +11603,17 @@ else
 main() { struct rlimit r; exit(!(sizeof(r.rlim_cur) == sizeof(long int)));}
 _ACEOF
 rm -f conftest$ac_exeext
-if { (eval echo "$as_me:11534: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11606: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11537: \$? = $ac_status" >&5
+  echo "$as_me:11609: \$? = $ac_status" >&5
   (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:11539: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11611: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11542: \$? = $ac_status" >&5
+  echo "$as_me:11614: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:11544: result: long int" >&5
+  echo "$as_me:11616: result: long int" >&5
 echo "${ECHO_T}long int" >&6
 ISC_PLATFORM_RLIMITTYPE="#define ISC_PLATFORM_RLIMITTYPE long int"
 else
@@ -11550,12 +11622,12 @@ echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
 
 if test "$cross_compiling" = yes; then
-  { { echo "$as_me:11553: error: this cannot happen" >&5
+  { { echo "$as_me:11625: error: this cannot happen" >&5
 echo "$as_me: error: this cannot happen" >&2;}
    { (exit 1); exit 1; }; }
 else
   cat >conftest.$ac_ext <<_ACEOF
-#line 11558 "configure"
+#line 11630 "configure"
 #include "confdefs.h"
 
 #include <sys/types.h>
@@ -11564,24 +11636,24 @@ else
 main() { struct rlimit r; exit((!sizeof(r.rlim_cur) == sizeof(long long int)));}
 _ACEOF
 rm -f conftest$ac_exeext
-if { (eval echo "$as_me:11567: \"$ac_link\"") >&5
+if { (eval echo "$as_me:11639: \"$ac_link\"") >&5
   (eval $ac_link) 2>&5
   ac_status=$?
-  echo "$as_me:11570: \$? = $ac_status" >&5
+  echo "$as_me:11642: \$? = $ac_status" >&5
   (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
-  { (eval echo "$as_me:11572: \"$ac_try\"") >&5
+  { (eval echo "$as_me:11644: \"$ac_try\"") >&5
   (eval $ac_try) 2>&5
   ac_status=$?
-  echo "$as_me:11575: \$? = $ac_status" >&5
+  echo "$as_me:11647: \$? = $ac_status" >&5
   (exit $ac_status); }; }; then
-  echo "$as_me:11577: result: long long int" >&5
+  echo "$as_me:11649: result: long long int" >&5
 echo "${ECHO_T}long long int" >&6
 ISC_PLATFORM_RLIMITTYPE="#define ISC_PLATFORM_RLIMITTYPE long long int"
 else
   echo "$as_me: program exited with status $ac_status" >&5
 echo "$as_me: failed program was:" >&5
 cat conftest.$ac_ext >&5
-{ { echo "$as_me:11584: error: unable to determine sizeof rlim_cur" >&5
+{ { echo "$as_me:11656: error: unable to determine sizeof rlim_cur" >&5
 echo "$as_me: error: unable to determine sizeof rlim_cur" >&2;}
    { (exit 1); exit 1; }; }
 
@@ -11694,7 +11766,7 @@ for ac_prog in openjade
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-echo "$as_me:11697: checking for $ac_word" >&5
+echo "$as_me:11769: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_path_OPENJADE+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -11711,7 +11783,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   if $as_executable_p "$ac_dir/$ac_word"; then
    ac_cv_path_OPENJADE="$ac_dir/$ac_word"
-   echo "$as_me:11714: found $ac_dir/$ac_word" >&5
+   echo "$as_me:11786: found $ac_dir/$ac_word" >&5
    break
 fi
 done
@@ -11722,10 +11794,10 @@ fi
 OPENJADE=$ac_cv_path_OPENJADE
 
 if test -n "$OPENJADE"; then
-  echo "$as_me:11725: result: $OPENJADE" >&5
+  echo "$as_me:11797: result: $OPENJADE" >&5
 echo "${ECHO_T}$OPENJADE" >&6
 else
-  echo "$as_me:11728: result: no" >&5
+  echo "$as_me:11800: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -11741,7 +11813,7 @@ for ac_prog in jadetex
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-echo "$as_me:11744: checking for $ac_word" >&5
+echo "$as_me:11816: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_path_JADETEX+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -11758,7 +11830,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   if $as_executable_p "$ac_dir/$ac_word"; then
    ac_cv_path_JADETEX="$ac_dir/$ac_word"
-   echo "$as_me:11761: found $ac_dir/$ac_word" >&5
+   echo "$as_me:11833: found $ac_dir/$ac_word" >&5
    break
 fi
 done
@@ -11769,10 +11841,10 @@ fi
 JADETEX=$ac_cv_path_JADETEX
 
 if test -n "$JADETEX"; then
-  echo "$as_me:11772: result: $JADETEX" >&5
+  echo "$as_me:11844: result: $JADETEX" >&5
 echo "${ECHO_T}$JADETEX" >&6
 else
-  echo "$as_me:11775: result: no" >&5
+  echo "$as_me:11847: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -11784,7 +11856,7 @@ for ac_prog in pdfjadetex
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
 set dummy $ac_prog; ac_word=$2
-echo "$as_me:11787: checking for $ac_word" >&5
+echo "$as_me:11859: checking for $ac_word" >&5
 echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6
 if test "${ac_cv_path_PDFJADETEX+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -11801,7 +11873,7 @@ for ac_dir in $ac_dummy; do
   test -z "$ac_dir" && ac_dir=.
   if $as_executable_p "$ac_dir/$ac_word"; then
    ac_cv_path_PDFJADETEX="$ac_dir/$ac_word"
-   echo "$as_me:11804: found $ac_dir/$ac_word" >&5
+   echo "$as_me:11876: found $ac_dir/$ac_word" >&5
    break
 fi
 done
@@ -11812,10 +11884,10 @@ fi
 PDFJADETEX=$ac_cv_path_PDFJADETEX
 
 if test -n "$PDFJADETEX"; then
-  echo "$as_me:11815: result: $PDFJADETEX" >&5
+  echo "$as_me:11887: result: $PDFJADETEX" >&5
 echo "${ECHO_T}$PDFJADETEX" >&6
 else
-  echo "$as_me:11818: result: no" >&5
+  echo "$as_me:11890: result: no" >&5
 echo "${ECHO_T}no" >&6
 fi
 
@@ -11837,7 +11909,7 @@ test -n "$PDFJADETEX" || PDFJADETEX="pdfjadetex"
 #
 
 SGMLCATALOG=""
-echo "$as_me:11840: checking for catalog" >&5
+echo "$as_me:11912: checking for catalog" >&5
 echo $ECHO_N "checking for catalog... $ECHO_C" >&6
 for d in $sgmltrees
 do
@@ -11845,14 +11917,14 @@ do
 	if test -f $f
 	then
 		SGMLCATALOG=$f
-		echo "$as_me:11848: result: $f" >&5
+		echo "$as_me:11920: result: $f" >&5
 echo "${ECHO_T}$f" >&6
 		break
 	fi
 done
 if test "X$SGMLCATALOG" = "X"
 then
-	echo "$as_me:11855: result: \"not found\"" >&5
+	echo "$as_me:11927: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6;
 	SGMLCATALOG=catalog
 fi
@@ -11879,7 +11951,7 @@ do
 done
 
 HTMLSTYLE=""
-echo "$as_me:11882: checking for html/docbook.dsl" >&5
+echo "$as_me:11954: checking for html/docbook.dsl" >&5
 echo $ECHO_N "checking for html/docbook.dsl... $ECHO_C" >&6
 for d in $stylepath
 do
@@ -11887,20 +11959,20 @@ do
 	if test -f $f
 	then
 		HTMLSTYLE=$f
-		echo "$as_me:11890: result: $f" >&5
+		echo "$as_me:11962: result: $f" >&5
 echo "${ECHO_T}$f" >&6
 		break
 	fi
 done
 if test "X$HTMLSTYLE" = "X"
 then
-	echo "$as_me:11897: result: \"not found\"" >&5
+	echo "$as_me:11969: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6;
 	HTMLSTYLE=html/docbook.dsl
 fi
 
 PRINTSTYLE=""
-echo "$as_me:11903: checking for print/docbook.dsl" >&5
+echo "$as_me:11975: checking for print/docbook.dsl" >&5
 echo $ECHO_N "checking for print/docbook.dsl... $ECHO_C" >&6
 for d in $stylepath
 do
@@ -11908,14 +11980,14 @@ do
 	if test -f $f
 	then
 		PRINTSTYLE=$f
-		echo "$as_me:11911: result: $f" >&5
+		echo "$as_me:11983: result: $f" >&5
 echo "${ECHO_T}$f" >&6
 		break
 	fi
 done
 if test "X$PRINTSTYLE" = "X"
 then
-	echo "$as_me:11918: result: \"not found\"" >&5
+	echo "$as_me:11990: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6;
 	PRINTSTYLE=print/docbook.dsl
 fi
@@ -11925,7 +11997,7 @@ fi
 #
 
 XMLDCL=""
-echo "$as_me:11928: checking for docbook/dsssl/modular/dtds/decls/xml.dcl" >&5
+echo "$as_me:12000: checking for docbook/dsssl/modular/dtds/decls/xml.dcl" >&5
 echo $ECHO_N "checking for docbook/dsssl/modular/dtds/decls/xml.dcl... $ECHO_C" >&6
 for d in $sgmltrees
 do
@@ -11933,14 +12005,14 @@ do
 	if test -f $f
 	then
 		XMLDCL=$f
-		echo "$as_me:11936: result: $f" >&5
+		echo "$as_me:12008: result: $f" >&5
 echo "${ECHO_T}$f" >&6
 		break
 	fi
 done
 if test "X$XMLDCL" = "X"
 then
-	echo "$as_me:11943: result: \"not found\"" >&5
+	echo "$as_me:12015: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6;
 	XMLDCL=docbook/dsssl/modular/dtds/decls/xml.dcl
 fi
@@ -11950,7 +12022,7 @@ fi
 #
 
 DOCBOOK2MANSPEC=""
-echo "$as_me:11953: checking for docbook2X/docbook2man-spec.pl" >&5
+echo "$as_me:12025: checking for docbook2X/docbook2man-spec.pl" >&5
 echo $ECHO_N "checking for docbook2X/docbook2man-spec.pl... $ECHO_C" >&6
 for d in $sgmltrees
 do
@@ -11958,14 +12030,14 @@ do
 	if test -f $f
 	then
 		DOCBOOK2MANSPEC=$f
-		echo "$as_me:11961: result: $f" >&5
+		echo "$as_me:12033: result: $f" >&5
 echo "${ECHO_T}$f" >&6
 		break
 	fi
 done
 if test "X$DOCBOOK2MANSPEC" = "X"
 then
-	echo "$as_me:11968: result: \"not found\"" >&5
+	echo "$as_me:12040: result: \"not found\"" >&5
 echo "${ECHO_T}\"not found\"" >&6;
 	DOCBOOK2MANSPEC=docbook2X/docbook2man-spec.pl
 fi
@@ -12087,7 +12159,7 @@ DEFS=-DHAVE_CONFIG_H
 : ${CONFIG_STATUS=./config.status}
 ac_clean_files_save=$ac_clean_files
 ac_clean_files="$ac_clean_files $CONFIG_STATUS"
-{ echo "$as_me:12090: creating $CONFIG_STATUS" >&5
+{ echo "$as_me:12162: creating $CONFIG_STATUS" >&5
 echo "$as_me: creating $CONFIG_STATUS" >&6;}
 cat >$CONFIG_STATUS <<_ACEOF
 #! $SHELL
@@ -12260,7 +12332,7 @@ cat >>$CONFIG_STATUS <<\EOF
     echo "$ac_cs_version"; exit 0 ;;
   --he | --h)
     # Conflict between --help and --header
-    { { echo "$as_me:12263: error: ambiguous option: $1
+    { { echo "$as_me:12335: error: ambiguous option: $1
 Try \`$0 --help' for more information." >&5
 echo "$as_me: error: ambiguous option: $1
 Try \`$0 --help' for more information." >&2;}
@@ -12279,7 +12351,7 @@ Try \`$0 --help' for more information." >&2;}
     ac_need_defaults=false;;
 
   # This is an error.
-  -*) { { echo "$as_me:12282: error: unrecognized option: $1
+  -*) { { echo "$as_me:12354: error: unrecognized option: $1
 Try \`$0 --help' for more information." >&5
 echo "$as_me: error: unrecognized option: $1
 Try \`$0 --help' for more information." >&2;}
@@ -12390,7 +12462,7 @@ do
   "docutil/docbook2man-wrapper.sh" ) CONFIG_FILES="$CONFIG_FILES docutil/docbook2man-wrapper.sh" ;;
   "isc-config.sh" ) CONFIG_FILES="$CONFIG_FILES isc-config.sh" ;;
   "config.h" ) CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;;
-  *) { { echo "$as_me:12393: error: invalid argument: $ac_config_target" >&5
+  *) { { echo "$as_me:12465: error: invalid argument: $ac_config_target" >&5
 echo "$as_me: error: invalid argument: $ac_config_target" >&2;}
    { (exit 1); exit 1; }; };;
   esac
@@ -12723,7 +12795,7 @@ done; }
   esac
 
   if test x"$ac_file" != x-; then
-    { echo "$as_me:12726: creating $ac_file" >&5
+    { echo "$as_me:12798: creating $ac_file" >&5
 echo "$as_me: creating $ac_file" >&6;}
     rm -f "$ac_file"
   fi
@@ -12741,7 +12813,7 @@ echo "$as_me: creating $ac_file" >&6;}
       -) echo $tmp/stdin ;;
       [\\/$]*)
          # Absolute (can't be DOS-style, as IFS=:)
-         test -f "$f" || { { echo "$as_me:12744: error: cannot find input file: $f" >&5
+         test -f "$f" || { { echo "$as_me:12816: error: cannot find input file: $f" >&5
 echo "$as_me: error: cannot find input file: $f" >&2;}
    { (exit 1); exit 1; }; }
          echo $f;;
@@ -12754,7 +12826,7 @@ echo "$as_me: error: cannot find input file: $f" >&2;}
            echo $srcdir/$f
          else
            # /dev/null tree
-           { { echo "$as_me:12757: error: cannot find input file: $f" >&5
+           { { echo "$as_me:12829: error: cannot find input file: $f" >&5
 echo "$as_me: error: cannot find input file: $f" >&2;}
    { (exit 1); exit 1; }; }
          fi;;
@@ -12815,7 +12887,7 @@ for ac_file in : $CONFIG_HEADERS; do test "x$ac_file" = x: && continue
   * )   ac_file_in=$ac_file.in ;;
   esac
 
-  test x"$ac_file" != x- && { echo "$as_me:12818: creating $ac_file" >&5
+  test x"$ac_file" != x- && { echo "$as_me:12890: creating $ac_file" >&5
 echo "$as_me: creating $ac_file" >&6;}
 
   # First look for the input files in the build tree, otherwise in the
@@ -12826,7 +12898,7 @@ echo "$as_me: creating $ac_file" >&6;}
       -) echo $tmp/stdin ;;
       [\\/$]*)
          # Absolute (can't be DOS-style, as IFS=:)
-         test -f "$f" || { { echo "$as_me:12829: error: cannot find input file: $f" >&5
+         test -f "$f" || { { echo "$as_me:12901: error: cannot find input file: $f" >&5
 echo "$as_me: error: cannot find input file: $f" >&2;}
    { (exit 1); exit 1; }; }
          echo $f;;
@@ -12839,7 +12911,7 @@ echo "$as_me: error: cannot find input file: $f" >&2;}
            echo $srcdir/$f
          else
            # /dev/null tree
-           { { echo "$as_me:12842: error: cannot find input file: $f" >&5
+           { { echo "$as_me:12914: error: cannot find input file: $f" >&5
 echo "$as_me: error: cannot find input file: $f" >&2;}
    { (exit 1); exit 1; }; }
          fi;;
@@ -12956,7 +13028,7 @@ cat >>$CONFIG_STATUS <<\EOF
   rm -f $tmp/in
   if test x"$ac_file" != x-; then
     if cmp -s $ac_file $tmp/config.h 2>/dev/null; then
-      { echo "$as_me:12959: $ac_file is unchanged" >&5
+      { echo "$as_me:13031: $ac_file is unchanged" >&5
 echo "$as_me: $ac_file is unchanged" >&6;}
     else
       ac_dir=`$as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
@@ -13060,7 +13132,7 @@ if test "$no_recursion" != yes; then
     # parts of a large source tree are present.
     test -d $srcdir/$ac_subdir || continue
 
-    { echo "$as_me:13063: configuring in $ac_subdir" >&5
+    { echo "$as_me:13135: configuring in $ac_subdir" >&5
 echo "$as_me: configuring in $ac_subdir" >&6;}
     case $srcdir in
     .) ;;
@@ -13082,7 +13154,7 @@ done; }
 
        if test -d ./$ac_subdir; then :;
        else
-         { { echo "$as_me:13085: error: cannot create \`pwd\`/$ac_subdir" >&5
+         { { echo "$as_me:13157: error: cannot create \`pwd\`/$ac_subdir" >&5
 echo "$as_me: error: cannot create \`pwd\`/$ac_subdir" >&2;}
    { (exit 1); exit 1; }; }
        fi
@@ -13113,7 +13185,7 @@ echo "$as_me: error: cannot create \`pwd\`/$ac_subdir" >&2;}
     elif test -f $ac_sub_srcdir/configure.in; then
       ac_sub_configure=$ac_configure
     else
-      { echo "$as_me:13116: WARNING: no configuration information is in $ac_subdir" >&5
+      { echo "$as_me:13188: WARNING: no configuration information is in $ac_subdir" >&5
 echo "$as_me: WARNING: no configuration information is in $ac_subdir" >&2;}
       ac_sub_configure=
     fi
@@ -13127,12 +13199,12 @@ echo "$as_me: WARNING: no configuration information is in $ac_subdir" >&2;}
         ac_sub_cache_file=$ac_dots$cache_file ;;
       esac
 
-      { echo "$as_me:13130: running $ac_sub_configure $ac_sub_configure_args --cache-file=$ac_sub_cache_file --srcdir=$ac_sub_srcdir" >&5
+      { echo "$as_me:13202: running $ac_sub_configure $ac_sub_configure_args --cache-file=$ac_sub_cache_file --srcdir=$ac_sub_srcdir" >&5
 echo "$as_me: running $ac_sub_configure $ac_sub_configure_args --cache-file=$ac_sub_cache_file --srcdir=$ac_sub_srcdir" >&6;}
       # The eval makes quoting arguments work.
       eval $ac_sub_configure $ac_sub_configure_args \
            --cache-file=$ac_sub_cache_file --srcdir=$ac_sub_srcdir ||
-        { { echo "$as_me:13135: error: $ac_sub_configure failed for $ac_subdir" >&5
+        { { echo "$as_me:13207: error: $ac_sub_configure failed for $ac_subdir" >&5
 echo "$as_me: error: $ac_sub_configure failed for $ac_subdir" >&2;}
    { (exit 1); exit 1; }; }
     fi
diff --git a/usr.sbin/bind/configure.in b/usr.sbin/bind/configure.in
index c95b48b5de2..943ef434fbb 100644
--- a/usr.sbin/bind/configure.in
+++ b/usr.sbin/bind/configure.in
@@ -13,7 +13,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-AC_REVISION($Revision: 1.6 $)
+AC_REVISION($Revision: 1.7 $)
 
 AC_INIT(lib/dns/name.c)
 AC_PREREQ(2.13)
@@ -455,7 +455,7 @@ case "$use_randomdev" in
 	unspec)
 		case "$host" in
 			*-openbsd*)
-				devrandom=/dev/srandom
+				devrandom=/dev/arandom
 				;;
 			*)
 				devrandom=/dev/random
@@ -525,9 +525,11 @@ case $host in
 	use_threads=false ;;
 *-freebsd*)
 	use_threads=false ;;
-*-bsdi*)
-	# Thread signals do not appear to work reliably on BSDI.
+*-bsdi[234]*)
+	# Thread signals do not work reliably on some versions of BSD/OS.
 	use_threads=false ;;
+*-bsdi5*)
+	use_threads=true ;;
 *-linux*)
    	# Threads are disabled on Linux by default because most
 	# Linux kernels produce unusable core dumps from multithreaded
@@ -636,6 +638,9 @@ then
 	AC_CHECK_FUNC(pthread_attr_getstacksize,
 		      AC_DEFINE(HAVE_PTHREAD_ATTR_GETSTACKSIZE),)
 
+	AC_CHECK_FUNC(pthread_attr_setstacksize,
+		      AC_DEFINE(HAVE_PTHREAD_ATTR_SETSTACKSIZE),)
+
 	#
 	# Additional OS-specific issues related to pthreads and sigwait.
 	#
@@ -1404,6 +1409,8 @@ AC_SUBST(ISC_LWRES_GETNAMEINFOPROTO)
 #
 # Look for a sysctl call to get the list of network interfaces.
 #
+case $ac_cv_header_sys_sysctl_h in
+yes)
 AC_MSG_CHECKING(for interface list sysctl)
 AC_EGREP_CPP(found_rt_iflist, [
 #include <sys/param.h>
@@ -1416,6 +1423,8 @@ found_rt_iflist
 	[AC_MSG_RESULT(yes)
 	 AC_DEFINE(HAVE_IFLIST_SYSCTL)],
 	[AC_MSG_RESULT(no)])
+;;
+esac
 
 #
 # Check for some other useful functions that are not ever-present.
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM-book.xml b/usr.sbin/bind/doc/arm/Bv9ARM-book.xml
index 6e1e13052fc..f328acdd3c1 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM-book.xml
+++ b/usr.sbin/bind/doc/arm/Bv9ARM-book.xml
@@ -2,7 +2,7 @@
 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
                "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd">
 
-<!-- File: $ISC: Bv9ARM-book.xml,v 1.155.2.22.4.1 2003/02/17 01:29:29 marka Exp $ -->
+<!-- File: $ISC: Bv9ARM-book.xml,v 1.155.2.32 2003/09/23 07:20:43 marka Exp $ -->
 
 <book>
 <title>BIND 9 Administrator Reference Manual</title>
@@ -1569,23 +1569,23 @@ statement, as described later in this document. </para>
   <sect1>
     <title>IPv6 Support in <acronym>BIND</acronym> 9</title>
 
-    <para><acronym>BIND</acronym> 9 fully supports all currently defined forms of IPv6
-    name to address and address to name lookups.  It will also use
-    IPv6 addresses to make queries when running on an IPv6 capable
-    system.</para>
+    <para><acronym>BIND</acronym> 9 fully supports all currently
+    defined forms of IPv6 name to address and address to name
+    lookups.  It will also use IPv6 addresses to make queries when
+    running on an IPv6 capable system.</para>
 
-    <para>For forward lookups, <acronym>BIND</acronym> 9 supports both A6 and AAAA
-    records.  The use of AAAA records is deprecated, but it is still
-    useful for hosts to have both AAAA and A6 records to maintain
-    backward compatibility with installations where AAAA records are
-    still used.  In fact, the stub resolvers currently shipped with
-    most operating system support only AAAA lookups, because following
-    A6 chains is much harder than doing A or AAAA lookups.</para>
+    <para>For forward lookups, <acronym>BIND</acronym> 9 supports
+    both A6 and AAAA records.  The use of A6 records has been moved
+    to experimental (RFC 3363) and should be treated as deprecated.</para>
 
-    <para>For IPv6 reverse lookups, <acronym>BIND</acronym> 9 supports the new
-    "bitstring" format used in the <emphasis>ip6.arpa</emphasis>
-    domain, as well as the older, deprecated "nibble" format used in
-    the <emphasis>ip6.int</emphasis> domain.</para>
+    <para>The use of "bitstring" labels for IPv6 has been moved to
+    experimental (RFC 3363) reverting to a nibble format.  The
+    suffix for the IPv6 reverse lookups has also changed from
+    <literal>IP6.INT</literal> to <literal>IP6.ARPA</literal> (RFC
+    3152).</para>
+
+    <para><acronym>BIND</acronym> 9 now defaults to nibble
+    <literal>IP6.ARPA</literal> format lookups.</para>
 
     <para><acronym>BIND</acronym> 9 includes a new lightweight resolver library and
     resolver daemon which new applications may choose to use to avoid
@@ -1607,174 +1607,22 @@ $ORIGIN example.com.
 host            3600    IN      AAAA    3ffe:8050:201:1860:42::1
 </programlisting>
 
-      <para>While their use is deprecated, they are useful to support
-      older IPv6 applications.  They should not be added where they
-      are not absolutely necessary.</para>
-
-    </sect2>
-    <sect2>
-      <title>Address Lookups Using A6 Records</title>
-
-      <para>The A6 record is more flexible than the AAAA record, and
-      is therefore more complicated.  The A6 record can be used to
-      form a chain of A6 records, each specifying part of the IPv6
-      address. It can also be used to specify the entire record as
-      well.  For example, this record supplies the same data as the
-      AAAA record in the previous example:</para>
-
-<programlisting>
-$ORIGIN example.com.
-host            3600    IN      A6      0 3ffe:8050:201:1860:42::1
-</programlisting>
-      <sect3>
-        <title>A6 Chains</title>
-
-        <para>A6 records are designed to allow network
-        renumbering. This works when an A6 record only specifies the
-        part of the address space the domain owner controls.  For
-        example, a host may be at a company named "company."  It has
-        two ISPs which provide IPv6 address space for it.  These two
-        ISPs fully specify the IPv6 prefix they supply.</para>
-
-        <para>In the company's address space:</para>
-
-<programlisting>
-$ORIGIN example.com.
-host            3600    IN      A6      64 0:0:0:0:42::1 company.example1.net.
-host            3600    IN      A6      64 0:0:0:0:42::1 company.example2.net.
-</programlisting>
-
-        <para>ISP1 will use:</para>
-
-<programlisting>
-$ORIGIN example1.net.
-company         3600    IN      A6      0 3ffe:8050:201:1860::
-</programlisting>
-
-<para>ISP2 will use:</para>
-
-<programlisting>
-$ORIGIN example2.net.
-company         3600    IN      A6      0 1234:5678:90ab:fffa::
-</programlisting>
-
-        <para>When <literal
-       >host.example.com</literal> is looked up,
-        the resolver (in the resolver daemon or caching name server)
-        will find two partial A6 records, and will use the additional
-        name to find the remainder of the data.</para>
-
-      </sect3>
-      <sect3>
-        <title>A6 Records for DNS Servers</title>
-
-        <para>When an A6 record specifies the address of a name
-        server, it should use the full address rather than specifying
-        a partial address.  For example:</para>
-
-<programlisting>
-$ORIGIN example.com.
-@               14400           IN      NS              ns0
-                14400           IN      NS              ns1
-ns0             14400           IN      A6              0 3ffe:8050:201:1860:42::1
-ns1             14400           IN      A               192.168.42.1
-</programlisting>
-
-        <para>It is recommended that IPv4-in-IPv6 mapped addresses not
-        be used.  If a host has an IPv4 address, use an A record, not
-        an A6, with <literal>::ffff:192.168.42.1</literal> as the
-        address.</para>
-
-      </sect3>
     </sect2>
     <sect2>
       <title>Address to Name Lookups Using Nibble Format</title>
 
-      <para>While the use of nibble format to look up names is
-      deprecated, it is supported for backwards compatibility with
-      existing IPv6 applications.</para>
-
       <para>When looking up an address in nibble format, the address
       components are simply reversed, just as in IPv4, and
-      <literal>ip6.int.</literal> is appended to the resulting name.
+      <literal>IP6.ARPA.</literal> is appended to the resulting name.
       For example, the following would provide reverse name lookup for
       a host with address
       <literal>3ffe:8050:201:1860:42::1</literal>.</para>
 
 <programlisting>
-$ORIGIN 0.6.8.1.1.0.2.0.0.5.0.8.e.f.f.3.ip6.int.
+$ORIGIN 0.6.8.1.1.0.2.0.0.5.0.8.e.f.f.3.IP6.ARPA.
 1.0.0.0.0.0.0.0.0.0.0.0.2.4.0.0   14400 IN      PTR     host.example.com.
 </programlisting>
     </sect2>
-    <sect2>
-      <title>Address to Name Lookups Using Bitstring Format</title>
-
-      <para>Bitstring labels can start and end on any bit boundary,
-      rather than on a multiple of 4 bits as in the nibble
-      format. They also use <emphasis>ip6.arpa</emphasis> rather than
-      <emphasis>ip6.int</emphasis>.</para>
-
-      <para>To replicate the previous example using bitstrings:</para>
-
-<programlisting>
-$ORIGIN \[x3ffe805002011860/64].ip6.arpa.
-\[x0042000000000001/64]         14400   IN      PTR     host.example.com.
-</programlisting>
-    </sect2>
-    <sect2>
-      <title>Using DNAME for Delegation of IPv6 Reverse Addresses</title>
-
-      <para>In IPV6, the same host may have many addresses from many
-      network providers.  Since the trailing portion of the address
-      usually remains constant, <command>DNAME</command> can help
-      reduce the number of zone files used for reverse mapping that
-      need to be maintained.</para>
-
-      <para>For example, consider a host which has two providers
-      (<literal>example.net</literal> and
-      <literal>example2.net</literal>) and
-      therefore two IPv6 addresses.  Since the host chooses its own 64
-      bit host address portion, the provider address is the only part
-      that changes:</para>
-
-<programlisting>
-$ORIGIN example.com.
-host                    IN      A6      64      ::1234:5678:1212:5675 cust1.example.net.
-                        IN      A6      64      ::1234:5678:1212:5675 subnet5.example2.net.
-$ORIGIN example.net.
-cust1                   IN      A6      48      0:0:0:dddd:: ipv6net.example.net.
-ipv6net                 IN      A6      0       aa:bb:cccc::
-$ORIGIN example2.net.
-subnet5                 IN      A6      48      0:0:0:1:: ipv6net2.example2.net.
-ipv6net2                IN      A6      0       6666:5555:4::
-</programlisting>
-
-<para>This sets up forward lookups.  To handle the reverse lookups,
-the provider <literal>example.net</literal>
-would have:</para>
-
-<programlisting>
-$ORIGIN \[x00aa00bbcccc/48].ip6.arpa.
-\[xdddd/16]             IN      DNAME           ipv6-rev.example.com.
-</programlisting>
-
-      <para>and <literal
-     >example2.net</literal> would have:</para>
-
-<programlisting>
-$ORIGIN \[x666655550004/48].ip6.arpa.
-\[x0001/16]             IN      DNAME           ipv6-rev.example.com.
-</programlisting>
-
-      <para><literal>example.com</literal>
-      needs only one zone file to handle both of these reverse
-      mappings:</para>
-
-<programlisting>
-$ORIGIN ipv6-rev.example.com.
-\[x1234567812125675/64] IN      PTR             host.example.com. 
-</programlisting>
-    </sect2>
   </sect1>
   </chapter>
 
@@ -2857,6 +2705,9 @@ statement in the <filename>named.conf</filename> file:</para>
     <optional> random-device <replaceable>path_name</replaceable> ; </optional>
     <optional> max-cache-size <replaceable>size_spec</replaceable> ; </optional>
     <optional> match-mapped-addresses <replaceable>yes_or_no</replaceable>; </optional>
+    <optional> root-delegation-only <optional> exclude { <replaceable>namelist
+</replaceable> } </optional> ; </optional>
+
 };
 </programlisting>
 </sect2>
@@ -2972,6 +2823,20 @@ the initial configuration load at server startup time and
 is ignored on subsequent reloads.</para>
 </listitem></varlistentry>
 
+<varlistentry><term><command>root-delegation-only</command></term>
+<listitem><para>
+Turn on enforcment of delegation-only in TLDs and root zones with an optional
+exclude list.
+</para>
+<para>
+Note some TLDs are NOT delegation only (e.g. "DE", "LV", "US" and "MUSEUM").
+</para>
+<programlisting>
+options {
+	root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
+};
+</programlisting>
+</listitem></varlistentry>
 </variablelist>
 
 
@@ -3860,9 +3725,9 @@ necessary.</simpara></note>
 
 <para>Many existing stub resolvers support IPv6 DNS lookups as defined in
 RFC1886, using AAAA records for forward lookups and "nibble labels" in
-the <literal>ip6.int</literal> domain for reverse lookups, but do not support
+the <literal>IP6.INT</literal> domain for reverse lookups, but do not support
 RFC2874-style lookups (using A6 records and binary labels in the
-<literal>ip6.arpa</literal> domain).</para>
+<literal>IP6.ARPA</literal> domain).</para>
 
 <para>For those who wish to continue to use such stub resolvers rather than
 switching to the BIND 9 lightweight resolver, BIND 9 provides a way
@@ -3878,9 +3743,9 @@ When it is enabled, recursive
 AAAA queries cause the server to first try an A6 lookup and if that
 fails, an AAAA lookups.  No matter which one succeeds, the results are
 returned as a set of synthetic AAAA records.  Similarly, recursive PTR
-queries in <literal>ip6.int</literal> will cause a
-lookup in <literal>ip6.arpa</literal> using binary
-labels, and if that fails, another lookup in <literal>ip6.int</literal>.
+queries in <literal>IP6.INT</literal> will cause a
+lookup in <literal>IP6.ARPA</literal> using binary
+labels, and if that fails, another lookup in <literal>IP6.INT</literal>.
 The results are returned as a synthetic PTR record in
 <literal>ip6.int</literal>.</para>
 
@@ -4019,6 +3884,17 @@ failure response other than those above.</para></entry>
 </tbody>
 </tgroup></informaltable>
 
+<para>
+Each query received by the server will cause exactly one of
+<command>success</command>,
+<command>referral</command>,
+<command>nxrrset</command>,
+<command>nxdomain</command>, or
+<command>failure</command>
+to be incremented, and may additionally cause the
+<command>recursion</command> counter to be incremented.
+</para>
+
 </sect3>
 
 </sect2>
@@ -4326,7 +4202,7 @@ configured.</para>
 <para>Stub zones can also be used as a way of forcing the resolution
 of a given domain to use a particular set of authoritative servers.
 For example, the caching name servers on a private network using
-RFC2157 addressing may be configured with stub zones for
+RFC1981 addressing may be configured with stub zones for
 <literal>10.in-addr.arpa</literal>
 to use a set of internal name servers as the authoritative
 servers for that domain.</para>
@@ -5219,12 +5095,12 @@ $GENERATE 1-2 0 NS SERVER$.EXAMPLE.
 $GENERATE 1-127 $ CNAME $.0</literal></programlisting>
 <para>is equivalent to</para>
 <programlisting><literal>0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE.
-0.0.0.192.IN-ADDR.ARPA NS SERVER2.EXAMPLE.
-1.0.0.192.IN-ADDR.ARPA CNAME 1.0.0.0.192.IN-ADDR.ARPA
-2.0.0.192.IN-ADDR.ARPA CNAME 2.0.0.0.192.IN-ADDR.ARPA
+0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
+1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
+2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
 ...
-127.0.0.192.IN-ADDR.ARPA CNAME 127.0.0.0.192.IN-ADDR.ARPA
-.</literal></programlisting>
+127.0.0.192.IN-ADDR.ARPA. CNAME 127.0.0.0.192.IN-ADDR.ARPA.
+</literal></programlisting>
       <informaltable colsep = "0" rowsep = "0">
         <tgroup cols = "2" colsep = "0" rowsep = "0" tgroupstyle = "3Level-table">
           <colspec colname = "1" colnum = "1" colsep = "0" colwidth = "0.875in"/>
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.ch03.html b/usr.sbin/bind/doc/arm/Bv9ARM.ch03.html
index 5f35c822eef..2b0b1b3e7ac 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.ch03.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.ch03.html
@@ -1558,4 +1558,4 @@ VALIGN="top"
 ></DIV
 ></BODY
 ></HTML
->
+>
\ No newline at end of file
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.ch04.html b/usr.sbin/bind/doc/arm/Bv9ARM.ch04.html
index 8a03f61b4af..2e00c1d7056 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.ch04.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.ch04.html
@@ -1435,41 +1435,38 @@ CLASS="acronym"
 ><SPAN
 CLASS="acronym"
 >BIND</SPAN
-> 9 fully supports all currently defined forms of IPv6
-    name to address and address to name lookups.  It will also use
-    IPv6 addresses to make queries when running on an IPv6 capable
-    system.</P
+> 9 fully supports all currently
+    defined forms of IPv6 name to address and address to name
+    lookups.  It will also use IPv6 addresses to make queries when
+    running on an IPv6 capable system.</P
 ><P
 >For forward lookups, <SPAN
 CLASS="acronym"
 >BIND</SPAN
-> 9 supports both A6 and AAAA
-    records.  The use of AAAA records is deprecated, but it is still
-    useful for hosts to have both AAAA and A6 records to maintain
-    backward compatibility with installations where AAAA records are
-    still used.  In fact, the stub resolvers currently shipped with
-    most operating system support only AAAA lookups, because following
-    A6 chains is much harder than doing A or AAAA lookups.</P
-><P
->For IPv6 reverse lookups, <SPAN
+> 9 supports
+    both A6 and AAAA records.  The use of A6 records has been moved
+    to experimental (RFC 3363) and should be treated as deprecated.</P
+><P
+>The use of "bitstring" labels for IPv6 has been moved to
+    experimental (RFC 3363) reverting to a nibble format.  The
+    suffix for the IPv6 reverse lookups has also changed from
+    <TT
+CLASS="literal"
+>IP6.INT</TT
+> to <TT
+CLASS="literal"
+>IP6.ARPA</TT
+> (RFC
+    3152).</P
+><P
+><SPAN
 CLASS="acronym"
 >BIND</SPAN
-> 9 supports the new
-    "bitstring" format used in the <SPAN
-CLASS="emphasis"
-><I
-CLASS="emphasis"
->ip6.arpa</I
-></SPAN
->
-    domain, as well as the older, deprecated "nibble" format used in
-    the <SPAN
-CLASS="emphasis"
-><I
-CLASS="emphasis"
->ip6.int</I
-></SPAN
-> domain.</P
+> 9 now defaults to nibble
+    <TT
+CLASS="literal"
+>IP6.ARPA</TT
+> format lookups.</P
 ><P
 ><SPAN
 CLASS="acronym"
@@ -1491,7 +1488,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1003"
+NAME="AEN1005"
 >4.8.1. Address Lookups Using AAAA Records</A
 ></H2
 ><P
@@ -1503,125 +1500,21 @@ CLASS="programlisting"
 >&#13;$ORIGIN example.com.
 host            3600    IN      AAAA    3ffe:8050:201:1860:42::1
 </PRE
-><P
->While their use is deprecated, they are useful to support
-      older IPv6 applications.  They should not be added where they
-      are not absolutely necessary.</P
 ></DIV
 ><DIV
 CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1008"
->4.8.2. Address Lookups Using A6 Records</A
+NAME="AEN1009"
+>4.8.2. Address to Name Lookups Using Nibble Format</A
 ></H2
 ><P
->The A6 record is more flexible than the AAAA record, and
-      is therefore more complicated.  The A6 record can be used to
-      form a chain of A6 records, each specifying part of the IPv6
-      address. It can also be used to specify the entire record as
-      well.  For example, this record supplies the same data as the
-      AAAA record in the previous example:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN example.com.
-host            3600    IN      A6      0 3ffe:8050:201:1860:42::1
-</PRE
-><DIV
-CLASS="sect3"
-><H3
-CLASS="sect3"
-><A
-NAME="AEN1012"
->4.8.2.1. A6 Chains</A
-></H3
-><P
->A6 records are designed to allow network
-        renumbering. This works when an A6 record only specifies the
-        part of the address space the domain owner controls.  For
-        example, a host may be at a company named "company."  It has
-        two ISPs which provide IPv6 address space for it.  These two
-        ISPs fully specify the IPv6 prefix they supply.</P
-><P
->In the company's address space:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN example.com.
-host            3600    IN      A6      64 0:0:0:0:42::1 company.example1.net.
-host            3600    IN      A6      64 0:0:0:0:42::1 company.example2.net.
-</PRE
-><P
->ISP1 will use:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN example1.net.
-company         3600    IN      A6      0 3ffe:8050:201:1860::
-</PRE
-><P
->ISP2 will use:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN example2.net.
-company         3600    IN      A6      0 1234:5678:90ab:fffa::
-</PRE
-><P
->When <TT
-CLASS="literal"
->host.example.com</TT
-> is looked up,
-        the resolver (in the resolver daemon or caching name server)
-        will find two partial A6 records, and will use the additional
-        name to find the remainder of the data.</P
-></DIV
-><DIV
-CLASS="sect3"
-><H3
-CLASS="sect3"
-><A
-NAME="AEN1023"
->4.8.2.2. A6 Records for DNS Servers</A
-></H3
-><P
->When an A6 record specifies the address of a name
-        server, it should use the full address rather than specifying
-        a partial address.  For example:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN example.com.
-@               14400           IN      NS              ns0
-                14400           IN      NS              ns1
-ns0             14400           IN      A6              0 3ffe:8050:201:1860:42::1
-ns1             14400           IN      A               192.168.42.1
-</PRE
-><P
->It is recommended that IPv4-in-IPv6 mapped addresses not
-        be used.  If a host has an IPv4 address, use an A record, not
-        an A6, with <TT
-CLASS="literal"
->::ffff:192.168.42.1</TT
-> as the
-        address.</P
-></DIV
-></DIV
-><DIV
-CLASS="sect2"
-><H2
-CLASS="sect2"
-><A
-NAME="AEN1029"
->4.8.3. Address to Name Lookups Using Nibble Format</A
-></H2
-><P
->While the use of nibble format to look up names is
-      deprecated, it is supported for backwards compatibility with
-      existing IPv6 applications.</P
-><P
 >When looking up an address in nibble format, the address
       components are simply reversed, just as in IPv4, and
       <TT
 CLASS="literal"
->ip6.int.</TT
+>IP6.ARPA.</TT
 > is appended to the resulting name.
       For example, the following would provide reverse name lookup for
       a host with address
@@ -1631,120 +1524,10 @@ CLASS="literal"
 >.</P
 ><PRE
 CLASS="programlisting"
->&#13;$ORIGIN 0.6.8.1.1.0.2.0.0.5.0.8.e.f.f.3.ip6.int.
+>&#13;$ORIGIN 0.6.8.1.1.0.2.0.0.5.0.8.e.f.f.3.IP6.ARPA.
 1.0.0.0.0.0.0.0.0.0.0.0.2.4.0.0   14400 IN      PTR     host.example.com.
 </PRE
 ></DIV
-><DIV
-CLASS="sect2"
-><H2
-CLASS="sect2"
-><A
-NAME="AEN1036"
->4.8.4. Address to Name Lookups Using Bitstring Format</A
-></H2
-><P
->Bitstring labels can start and end on any bit boundary,
-      rather than on a multiple of 4 bits as in the nibble
-      format. They also use <SPAN
-CLASS="emphasis"
-><I
-CLASS="emphasis"
->ip6.arpa</I
-></SPAN
-> rather than
-      <SPAN
-CLASS="emphasis"
-><I
-CLASS="emphasis"
->ip6.int</I
-></SPAN
->.</P
-><P
->To replicate the previous example using bitstrings:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN \[x3ffe805002011860/64].ip6.arpa.
-\[x0042000000000001/64]         14400   IN      PTR     host.example.com.
-</PRE
-></DIV
-><DIV
-CLASS="sect2"
-><H2
-CLASS="sect2"
-><A
-NAME="AEN1043"
->4.8.5. Using DNAME for Delegation of IPv6 Reverse Addresses</A
-></H2
-><P
->In IPV6, the same host may have many addresses from many
-      network providers.  Since the trailing portion of the address
-      usually remains constant, <B
-CLASS="command"
->DNAME</B
-> can help
-      reduce the number of zone files used for reverse mapping that
-      need to be maintained.</P
-><P
->For example, consider a host which has two providers
-      (<TT
-CLASS="literal"
->example.net</TT
-> and
-      <TT
-CLASS="literal"
->example2.net</TT
->) and
-      therefore two IPv6 addresses.  Since the host chooses its own 64
-      bit host address portion, the provider address is the only part
-      that changes:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN example.com.
-host                    IN      A6      64      ::1234:5678:1212:5675 cust1.example.net.
-                        IN      A6      64      ::1234:5678:1212:5675 subnet5.example2.net.
-$ORIGIN example.net.
-cust1                   IN      A6      48      0:0:0:dddd:: ipv6net.example.net.
-ipv6net                 IN      A6      0       aa:bb:cccc::
-$ORIGIN example2.net.
-subnet5                 IN      A6      48      0:0:0:1:: ipv6net2.example2.net.
-ipv6net2                IN      A6      0       6666:5555:4::
-</PRE
-><P
->This sets up forward lookups.  To handle the reverse lookups,
-the provider <TT
-CLASS="literal"
->example.net</TT
->
-would have:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN \[x00aa00bbcccc/48].ip6.arpa.
-\[xdddd/16]             IN      DNAME           ipv6-rev.example.com.
-</PRE
-><P
->and <TT
-CLASS="literal"
->example2.net</TT
-> would have:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN \[x666655550004/48].ip6.arpa.
-\[x0001/16]             IN      DNAME           ipv6-rev.example.com.
-</PRE
-><P
-><TT
-CLASS="literal"
->example.com</TT
->
-      needs only one zone file to handle both of these reverse
-      mappings:</P
-><PRE
-CLASS="programlisting"
->&#13;$ORIGIN ipv6-rev.example.com.
-\[x1234567812125675/64] IN      PTR             host.example.com. 
-</PRE
-></DIV
 ></DIV
 ></DIV
 ><DIV
@@ -1810,4 +1593,4 @@ CLASS="acronym"
 ></DIV
 ></BODY
 ></HTML
->
+>
\ No newline at end of file
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.ch05.html b/usr.sbin/bind/doc/arm/Bv9ARM.ch05.html
index 18c22934538..29bf4d59160 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.ch05.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.ch05.html
@@ -84,7 +84,7 @@ CLASS="TOC"
 ></DT
 ><DT
 >5.1. <A
-HREF="Bv9ARM.ch05.html#AEN1063"
+HREF="Bv9ARM.ch05.html#AEN1018"
 >The Lightweight Resolver Library</A
 ></DT
 ><DT
@@ -99,7 +99,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN1063"
+NAME="AEN1018"
 >5.1. The Lightweight Resolver Library</A
 ></H1
 ><P
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.ch06.html b/usr.sbin/bind/doc/arm/Bv9ARM.ch06.html
index 64140a3c3e0..cc5f97dbb25 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.ch06.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.ch06.html
@@ -94,7 +94,7 @@ HREF="Bv9ARM.ch06.html#Configuration_File_Grammar"
 ></DT
 ><DT
 >6.3. <A
-HREF="Bv9ARM.ch06.html#AEN3586"
+HREF="Bv9ARM.ch06.html#AEN3560"
 >Zone File</A
 ></DT
 ></DL
@@ -148,7 +148,7 @@ file documentation:</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN1105"
+NAME="AEN1060"
 ></A
 ><P
 ></P
@@ -738,7 +738,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN1267"
+NAME="AEN1222"
 >6.1.1.1. Syntax</A
 ></H3
 ><PRE
@@ -769,7 +769,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN1275"
+NAME="AEN1230"
 >6.1.1.2. Definition and Usage</A
 ></H3
 ><P
@@ -880,7 +880,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1304"
+NAME="AEN1259"
 >6.1.2. Comment Syntax</A
 ></H2
 ><P
@@ -899,7 +899,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN1309"
+NAME="AEN1264"
 >6.1.2.1. Syntax</A
 ></H3
 ><P
@@ -931,7 +931,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN1318"
+NAME="AEN1273"
 >6.1.2.2. Definition and Usage</A
 ></H3
 ><P
@@ -1041,7 +1041,7 @@ CLASS="acronym"
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN1342"
+NAME="AEN1297"
 ></A
 ><P
 ></P
@@ -1269,7 +1269,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1411"
+NAME="AEN1366"
 >6.2.1. <B
 CLASS="command"
 >acl</B
@@ -1316,7 +1316,7 @@ CLASS="command"
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN1424"
+NAME="AEN1379"
 ></A
 ><P
 ></P
@@ -1434,7 +1434,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1458"
+NAME="AEN1413"
 >6.2.3. <B
 CLASS="command"
 >controls</B
@@ -1737,7 +1737,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1531"
+NAME="AEN1486"
 >6.2.5. <B
 CLASS="command"
 >include</B
@@ -1757,7 +1757,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1536"
+NAME="AEN1491"
 >6.2.6. <B
 CLASS="command"
 >include</B
@@ -1786,7 +1786,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1543"
+NAME="AEN1498"
 >6.2.7. <B
 CLASS="command"
 >key</B
@@ -1820,7 +1820,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1550"
+NAME="AEN1505"
 >6.2.8. <B
 CLASS="command"
 >key</B
@@ -1898,7 +1898,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1568"
+NAME="AEN1523"
 >6.2.9. <B
 CLASS="command"
 >logging</B
@@ -2058,7 +2058,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1608"
+NAME="AEN1563"
 >6.2.10. <B
 CLASS="command"
 >logging</B
@@ -2121,7 +2121,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN1624"
+NAME="AEN1579"
 >6.2.10.1. The <B
 CLASS="command"
 >channel</B
@@ -2635,7 +2635,7 @@ CLASS="acronym"
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN1748"
+NAME="AEN1703"
 ></A
 ><P
 ></P
@@ -3015,8 +3015,7 @@ been forced to NXDOMAIN as the result of a delegation-only zone or
 a <B
 CLASS="command"
 >delegation-only</B
-> in a stub or forward
-zone declartation.
+> in a hint or stub zone declartation.
 </P
 ></TD
 ></TR
@@ -3032,7 +3031,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1866"
+NAME="AEN1821"
 >6.2.11. <B
 CLASS="command"
 >lwres</B
@@ -3129,7 +3128,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1890"
+NAME="AEN1845"
 >6.2.12. <B
 CLASS="command"
 >lwres</B
@@ -3203,7 +3202,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN1909"
+NAME="AEN1864"
 >6.2.13. <B
 CLASS="command"
 >options</B
@@ -4184,6 +4183,20 @@ CLASS="replaceable"
 ></TT
 >; </SPAN
 >]
+    [<SPAN
+CLASS="optional"
+> root-delegation-only [<SPAN
+CLASS="optional"
+> exclude { <TT
+CLASS="replaceable"
+><I
+>namelist
+</I
+></TT
+> } </SPAN
+>] ; </SPAN
+>]
+
 };
 </PRE
 ></DIV
@@ -4192,7 +4205,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN2134"
+NAME="AEN2092"
 >6.2.14. <B
 CLASS="command"
 >options</B
@@ -4465,6 +4478,26 @@ CLASS="command"
 the initial configuration load at server startup time and
 is ignored on subsequent reloads.</P
 ></DD
+><DT
+><B
+CLASS="command"
+>root-delegation-only</B
+></DT
+><DD
+><P
+>&#13;Turn on enforcment of delegation-only in TLDs and root zones with an optional
+exclude list.
+</P
+><P
+>&#13;Note some TLDs are NOT delegation only (e.g. "DE", "LV", "US" and "MUSEUM").
+</P
+><PRE
+CLASS="programlisting"
+>&#13;options {
+	root-delegation-only exclude { "de"; "lv"; "us"; "museum"; };
+};
+</PRE
+></DD
 ></DL
 ></DIV
 ><DIV
@@ -5187,7 +5220,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN2434"
+NAME="AEN2399"
 >6.2.14.2. Forwarding</A
 ></H3
 ><P
@@ -5391,7 +5424,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN2499"
+NAME="AEN2464"
 >6.2.14.4. Interfaces</A
 ></H3
 ><P
@@ -5486,7 +5519,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN2525"
+NAME="AEN2490"
 >6.2.14.5. Query Address</A
 ></H3
 ><P
@@ -5918,7 +5951,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN2664"
+NAME="AEN2629"
 >6.2.14.7. Operating System Resource Limits</A
 ></H3
 ><P
@@ -6038,7 +6071,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN2701"
+NAME="AEN2666"
 >6.2.14.8. Server  Resource Limits</A
 ></H3
 ><P
@@ -6122,7 +6155,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN2729"
+NAME="AEN2694"
 >6.2.14.9. Periodic Task Intervals</A
 ></H3
 ><P
@@ -6489,7 +6522,7 @@ CLASS="command"
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN2817"
+NAME="AEN2782"
 ></A
 ><P
 ></P
@@ -6620,12 +6653,12 @@ NAME="synthesis"
 RFC1886, using AAAA records for forward lookups and "nibble labels" in
 the <TT
 CLASS="literal"
->ip6.int</TT
+>IP6.INT</TT
 > domain for reverse lookups, but do not support
 RFC2874-style lookups (using A6 records and binary labels in the
 <TT
 CLASS="literal"
->ip6.arpa</TT
+>IP6.ARPA</TT
 > domain).</P
 ><P
 >For those who wish to continue to use such stub resolvers rather than
@@ -6658,15 +6691,15 @@ fails, an AAAA lookups.  No matter which one succeeds, the results are
 returned as a set of synthetic AAAA records.  Similarly, recursive PTR
 queries in <TT
 CLASS="literal"
->ip6.int</TT
+>IP6.INT</TT
 > will cause a
 lookup in <TT
 CLASS="literal"
->ip6.arpa</TT
+>IP6.ARPA</TT
 > using binary
 labels, and if that fails, another lookup in <TT
 CLASS="literal"
->ip6.int</TT
+>IP6.INT</TT
 >.
 The results are returned as a synthetic PTR record in
 <TT
@@ -6893,7 +6926,7 @@ number is identical to the number in the beginning line.</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN2932"
+NAME="AEN2897"
 ></A
 ><P
 ></P
@@ -7029,6 +7062,34 @@ failure response other than those above.</P
 ><P
 ></P
 ></DIV
+><P
+>&#13;Each query received by the server will cause exactly one of
+<B
+CLASS="command"
+>success</B
+>,
+<B
+CLASS="command"
+>referral</B
+>,
+<B
+CLASS="command"
+>nxrrset</B
+>,
+<B
+CLASS="command"
+>nxdomain</B
+>, or
+<B
+CLASS="command"
+>failure</B
+>
+to be incremented, and may additionally cause the
+<B
+CLASS="command"
+>recursion</B
+> counter to be incremented.
+</P
 ></DIV
 ></DIV
 ><DIV
@@ -7329,7 +7390,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN3047"
+NAME="AEN3019"
 >6.2.17. <B
 CLASS="command"
 >trusted-keys</B
@@ -7404,7 +7465,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN3063"
+NAME="AEN3035"
 >6.2.18. <B
 CLASS="command"
 >trusted-keys</B
@@ -7439,7 +7500,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN3071"
+NAME="AEN3043"
 >6.2.19. <B
 CLASS="command"
 >view</B
@@ -7514,7 +7575,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN3087"
+NAME="AEN3059"
 >6.2.20. <B
 CLASS="command"
 >view</B
@@ -7701,7 +7762,7 @@ CLASS="replaceable"
 >] [<SPAN
 CLASS="optional"
 >{ 
-    type ( master | slave | hint | stub | forward /| delegation-only ) ;
+    type ( master | slave | hint | stub | forward | delegation-only ) ;
     [<SPAN
 CLASS="optional"
 > allow-notify { <TT
@@ -8174,7 +8235,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN3240"
+NAME="AEN3212"
 >6.2.22. <B
 CLASS="command"
 >zone</B
@@ -8185,13 +8246,13 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN3243"
+NAME="AEN3215"
 >6.2.22.1. Zone Types</A
 ></H3
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3245"
+NAME="AEN3217"
 ></A
 ><P
 ></P
@@ -8329,7 +8390,7 @@ configured.</P
 >Stub zones can also be used as a way of forcing the resolution
 of a given domain to use a particular set of authoritative servers.
 For example, the caching name servers on a private network using
-RFC2157 addressing may be configured with stub zones for
+RFC1981 addressing may be configured with stub zones for
 <TT
 CLASS="literal"
 >10.in-addr.arpa</TT
@@ -8439,6 +8500,13 @@ status of infrastructure zones (e.g. COM, NET, ORG).  Any answer that
 is received without a explicit or implict delegation in the authority
 section will be treated as NXDOMAIN.  This does not apply to the zone
 apex.  This SHOULD NOT be applied to leaf zones.</P
+>
+<P
+><TT
+CLASS="varname"
+>delegation-only</TT
+> has no effect on answers received
+from forwarders.</P
 ></TD
 ></TR
 ></TBODY
@@ -8452,7 +8520,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN3306"
+NAME="AEN3280"
 >6.2.22.2. Class</A
 ></H3
 ><P
@@ -8490,7 +8558,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN3316"
+NAME="AEN3290"
 >6.2.22.3. Zone Options</A
 ></H3
 ><P
@@ -8717,7 +8785,7 @@ CLASS="command"
 ></DT
 ><DD
 ><P
->The flag only applies to forward and stub zones.  If set
+>The flag only applies to hint and stub zones.  If set
 to <TT
 CLASS="userinput"
 ><B
@@ -9148,7 +9216,7 @@ CLASS="varname"
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3556"
+NAME="AEN3530"
 ></A
 ><P
 ></P
@@ -9255,7 +9323,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN3586"
+NAME="AEN3560"
 >6.3. Zone File</A
 ></H1
 ><DIV
@@ -9276,7 +9344,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN3591"
+NAME="AEN3565"
 >6.3.1.1. Resource Records</A
 ></H3
 ><P
@@ -9299,7 +9367,7 @@ HREF="Bv9ARM.ch06.html#rrset_ordering"
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3597"
+NAME="AEN3571"
 ></A
 ><P
 ></P
@@ -9413,7 +9481,7 @@ or historical (h) and no longer in general use):</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3629"
+NAME="AEN3603"
 ></A
 ><P
 ></P
@@ -9907,7 +9975,7 @@ are currently valid in the DNS:</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3776"
+NAME="AEN3750"
 ></A
 ><P
 ></P
@@ -9962,7 +10030,7 @@ data that describes the resource:</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3792"
+NAME="AEN3766"
 ></A
 ><P
 ></P
@@ -10139,7 +10207,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN3840"
+NAME="AEN3814"
 >6.3.1.2. Textual expression of RRs</A
 ></H3
 ><P
@@ -10169,7 +10237,7 @@ knowledge of the typical representation for the data.</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3847"
+NAME="AEN3821"
 ></A
 ><P
 ></P
@@ -10378,7 +10446,7 @@ domain names.</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3913"
+NAME="AEN3887"
 ></A
 ><P
 ></P
@@ -10469,7 +10537,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN3941"
+NAME="AEN3915"
 >6.3.2. Discussion of MX Records</A
 ></H2
 ><P
@@ -10505,7 +10573,7 @@ pointed to by the CNAME.</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN3947"
+NAME="AEN3921"
 ></A
 ><P
 ></P
@@ -10801,7 +10869,7 @@ used in a zone file.</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN4039"
+NAME="AEN4013"
 ></A
 ><P
 ></P
@@ -10884,7 +10952,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4062"
+NAME="AEN4036"
 >6.3.4. Inverse Mapping in IPv4</A
 ></H2
 ><P
@@ -10911,7 +10979,7 @@ CLASS="optional"
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN4067"
+NAME="AEN4041"
 ></A
 ><P
 ></P
@@ -10991,7 +11059,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4089"
+NAME="AEN4063"
 >6.3.5. Other Zone File Directives</A
 ></H2
 ><P
@@ -11016,7 +11084,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN4096"
+NAME="AEN4070"
 >6.3.5.1. The <B
 CLASS="command"
 >$ORIGIN</B
@@ -11086,7 +11154,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN4116"
+NAME="AEN4090"
 >6.3.5.2. The <B
 CLASS="command"
 >$INCLUDE</B
@@ -11168,7 +11236,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN4136"
+NAME="AEN4110"
 >6.3.5.3. The <B
 CLASS="command"
 >$TTL</B
@@ -11208,7 +11276,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4147"
+NAME="AEN4121"
 >6.3.6. <SPAN
 CLASS="acronym"
 >BIND</SPAN
@@ -11277,17 +11345,17 @@ CLASS="programlisting"
 ><TT
 CLASS="literal"
 >0.0.0.192.IN-ADDR.ARPA NS SERVER1.EXAMPLE.
-0.0.0.192.IN-ADDR.ARPA NS SERVER2.EXAMPLE.
-1.0.0.192.IN-ADDR.ARPA CNAME 1.0.0.0.192.IN-ADDR.ARPA
-2.0.0.192.IN-ADDR.ARPA CNAME 2.0.0.0.192.IN-ADDR.ARPA
+0.0.0.192.IN-ADDR.ARPA. NS SERVER2.EXAMPLE.
+1.0.0.192.IN-ADDR.ARPA. CNAME 1.0.0.0.192.IN-ADDR.ARPA.
+2.0.0.192.IN-ADDR.ARPA. CNAME 2.0.0.0.192.IN-ADDR.ARPA.
 ...
-127.0.0.192.IN-ADDR.ARPA CNAME 127.0.0.0.192.IN-ADDR.ARPA
-.</TT
+127.0.0.192.IN-ADDR.ARPA. CNAME 127.0.0.0.192.IN-ADDR.ARPA.
+</TT
 ></PRE
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN4167"
+NAME="AEN4141"
 ></A
 ><P
 ></P
@@ -11537,4 +11605,4 @@ CLASS="acronym"
 ></DIV
 ></BODY
 ></HTML
->
+>
\ No newline at end of file
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.ch07.html b/usr.sbin/bind/doc/arm/Bv9ARM.ch07.html
index b1e4ba5ac88..8fa49daa4f8 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.ch07.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.ch07.html
@@ -89,7 +89,7 @@ HREF="Bv9ARM.ch07.html#Access_Control_Lists"
 ></DT
 ><DT
 >7.2. <A
-HREF="Bv9ARM.ch07.html#AEN4239"
+HREF="Bv9ARM.ch07.html#AEN4213"
 ><B
 CLASS="command"
 >chroot</B
@@ -197,7 +197,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN4239"
+NAME="AEN4213"
 >7.2. <B
 CLASS="command"
 >chroot</B
@@ -279,7 +279,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4262"
+NAME="AEN4236"
 >7.2.1. The <B
 CLASS="command"
 >chroot</B
@@ -355,7 +355,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4280"
+NAME="AEN4254"
 >7.2.2. Using the <B
 CLASS="command"
 >setuid</B
@@ -501,4 +501,4 @@ VALIGN="top"
 ></DIV
 ></BODY
 ></HTML
->
+>
\ No newline at end of file
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.ch08.html b/usr.sbin/bind/doc/arm/Bv9ARM.ch08.html
index 8dc8ade37f1..50b3e6b2898 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.ch08.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.ch08.html
@@ -81,17 +81,17 @@ CLASS="TOC"
 ></DT
 ><DT
 >8.1. <A
-HREF="Bv9ARM.ch08.html#AEN4301"
+HREF="Bv9ARM.ch08.html#AEN4275"
 >Common Problems</A
 ></DT
 ><DT
 >8.2. <A
-HREF="Bv9ARM.ch08.html#AEN4306"
+HREF="Bv9ARM.ch08.html#AEN4280"
 >Incrementing and Changing the Serial Number</A
 ></DT
 ><DT
 >8.3. <A
-HREF="Bv9ARM.ch08.html#AEN4311"
+HREF="Bv9ARM.ch08.html#AEN4285"
 >Where Can I Get Help?</A
 ></DT
 ></DL
@@ -101,7 +101,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN4301"
+NAME="AEN4275"
 >8.1. Common Problems</A
 ></H1
 ><DIV
@@ -109,7 +109,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4303"
+NAME="AEN4277"
 >8.1.1. It's not working; how can I figure out what's wrong?</A
 ></H2
 ><P
@@ -125,7 +125,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN4306"
+NAME="AEN4280"
 >8.2. Incrementing and Changing the Serial Number</A
 ></H1
 ><P
@@ -154,7 +154,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN4311"
+NAME="AEN4285"
 >8.3. Where Can I Get Help?</A
 ></H1
 ><P
@@ -269,4 +269,4 @@ VALIGN="top"
 ></DIV
 ></BODY
 ></HTML
->
+>
\ No newline at end of file
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.ch09.html b/usr.sbin/bind/doc/arm/Bv9ARM.ch09.html
index fde6cf57a67..387746bd5c3 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.ch09.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.ch09.html
@@ -74,7 +74,7 @@ CLASS="TOC"
 ></DT
 ><DT
 >A.1. <A
-HREF="Bv9ARM.ch09.html#AEN4327"
+HREF="Bv9ARM.ch09.html#AEN4301"
 >Acknowledgements</A
 ></DT
 ><DT
@@ -87,7 +87,7 @@ CLASS="acronym"
 ></DT
 ><DT
 >A.3. <A
-HREF="Bv9ARM.ch09.html#AEN4368"
+HREF="Bv9ARM.ch09.html#AEN4342"
 >General <SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -105,7 +105,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN4327"
+NAME="AEN4301"
 >A.1. Acknowledgements</A
 ></H1
 ><DIV
@@ -113,7 +113,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4329"
+NAME="AEN4303"
 >A.1.1. A Brief History of the <SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -248,7 +248,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN4359"
+NAME="AEN4333"
 >A.2.1.1. HS = hesiod</A
 ></H3
 ><P
@@ -269,7 +269,7 @@ CLASS="sect3"
 ><H3
 CLASS="sect3"
 ><A
-NAME="AEN4364"
+NAME="AEN4338"
 >A.2.1.2. CH = chaos</A
 ></H3
 ><P
@@ -287,7 +287,7 @@ CLASS="sect1"
 ><H1
 CLASS="sect1"
 ><A
-NAME="AEN4368"
+NAME="AEN4342"
 >A.3. General <SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -335,7 +335,7 @@ Unicast address scheme. For more information, see RFC 2374.</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN4379"
+NAME="AEN4353"
 ></A
 ><P
 ></P
@@ -554,7 +554,7 @@ VALIGN="MIDDLE"
 <DIV
 CLASS="informaltable"
 ><A
-NAME="AEN4448"
+NAME="AEN4422"
 ></A
 ><P
 ></P
@@ -749,7 +749,7 @@ unicast address consists of:</P
 ><DIV
 CLASS="informaltable"
 ><A
-NAME="AEN4503"
+NAME="AEN4477"
 ></A
 ><P
 ></P
@@ -909,19 +909,19 @@ TARGET="_top"
 </P
 ><H3
 ><A
-NAME="AEN4547"
+NAME="AEN4521"
 >Bibliography</A
 ></H3
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4548"
+NAME="AEN4522"
 >Standards</A
 ></H2
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4550"
+NAME="AEN4524"
 ></A
 ><P
 >[RFC974]&nbsp;<SPAN
@@ -938,7 +938,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4557"
+NAME="AEN4531"
 ></A
 ><P
 >[RFC1034]&nbsp;<SPAN
@@ -955,7 +955,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4564"
+NAME="AEN4538"
 ></A
 ><P
 >[RFC1035]&nbsp;<SPAN
@@ -979,7 +979,7 @@ NAME="proposed_standards"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4573"
+NAME="AEN4547"
 ></A
 ><P
 >[RFC2181]&nbsp;<SPAN
@@ -999,7 +999,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4581"
+NAME="AEN4555"
 ></A
 ><P
 >[RFC2308]&nbsp;<SPAN
@@ -1019,7 +1019,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4589"
+NAME="AEN4563"
 ></A
 ><P
 >[RFC1995]&nbsp;<SPAN
@@ -1039,7 +1039,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4597"
+NAME="AEN4571"
 ></A
 ><P
 >[RFC1996]&nbsp;<SPAN
@@ -1056,7 +1056,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4604"
+NAME="AEN4578"
 ></A
 ><P
 >[RFC2136]&nbsp;<SPAN
@@ -1082,7 +1082,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4621"
+NAME="AEN4595"
 ></A
 ><P
 >[RFC2845]&nbsp;<SPAN
@@ -1111,13 +1111,13 @@ STYLE="margin-left=0.5in"
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4640"
+NAME="AEN4614"
 >Proposed Standards Still Under Development</A
 ></H2
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4645"
+NAME="AEN4619"
 ></A
 ><P
 >[RFC1886]&nbsp;<SPAN
@@ -1140,7 +1140,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4657"
+NAME="AEN4631"
 ></A
 ><P
 >[RFC2065]&nbsp;<SPAN
@@ -1160,7 +1160,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4669"
+NAME="AEN4643"
 ></A
 ><P
 >[RFC2137]&nbsp;<SPAN
@@ -1177,7 +1177,7 @@ STYLE="margin-left=0.5in"
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4677"
+NAME="AEN4651"
 >Other Important RFCs About <SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -1186,7 +1186,7 @@ CLASS="acronym"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4680"
+NAME="AEN4654"
 ></A
 ><P
 >[RFC1535]&nbsp;<SPAN
@@ -1206,7 +1206,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4688"
+NAME="AEN4662"
 ></A
 ><P
 >[RFC1536]&nbsp;<SPAN
@@ -1238,7 +1238,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4709"
+NAME="AEN4683"
 ></A
 ><P
 >[RFC1982]&nbsp;<SPAN
@@ -1258,13 +1258,13 @@ STYLE="margin-left=0.5in"
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4720"
+NAME="AEN4694"
 >Resource Record Types</A
 ></H2
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4722"
+NAME="AEN4696"
 ></A
 ><P
 >[RFC1183]&nbsp;<SPAN
@@ -1293,7 +1293,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4740"
+NAME="AEN4714"
 ></A
 ><P
 >[RFC1706]&nbsp;<SPAN
@@ -1316,7 +1316,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4752"
+NAME="AEN4726"
 ></A
 ><P
 >[RFC2168]&nbsp;<SPAN
@@ -1337,7 +1337,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4763"
+NAME="AEN4737"
 ></A
 ><P
 >[RFC1876]&nbsp;<SPAN
@@ -1364,7 +1364,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4780"
+NAME="AEN4754"
 ></A
 ><P
 >[RFC2052]&nbsp;<SPAN
@@ -1388,7 +1388,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4792"
+NAME="AEN4766"
 ></A
 ><P
 >[RFC2163]&nbsp;<SPAN
@@ -1409,7 +1409,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4800"
+NAME="AEN4774"
 ></A
 ><P
 >[RFC2230]&nbsp;<SPAN
@@ -1429,7 +1429,7 @@ STYLE="margin-left=0.5in"
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4808"
+NAME="AEN4782"
 ><SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -1438,7 +1438,7 @@ CLASS="acronym"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4811"
+NAME="AEN4785"
 ></A
 ><P
 >[RFC1101]&nbsp;<SPAN
@@ -1458,7 +1458,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4819"
+NAME="AEN4793"
 ></A
 ><P
 >[RFC1123]&nbsp;<SPAN
@@ -1475,7 +1475,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4826"
+NAME="AEN4800"
 ></A
 ><P
 >[RFC1591]&nbsp;<SPAN
@@ -1492,7 +1492,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4833"
+NAME="AEN4807"
 ></A
 ><P
 >[RFC2317]&nbsp;<SPAN
@@ -1515,7 +1515,7 @@ STYLE="margin-left=0.5in"
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4847"
+NAME="AEN4821"
 ><SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -1524,7 +1524,7 @@ CLASS="acronym"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4850"
+NAME="AEN4824"
 ></A
 ><P
 >[RFC1537]&nbsp;<SPAN
@@ -1544,7 +1544,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4858"
+NAME="AEN4832"
 ></A
 ><P
 >[RFC1912]&nbsp;<SPAN
@@ -1564,7 +1564,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4866"
+NAME="AEN4840"
 ></A
 ><P
 >[RFC1912]&nbsp;<SPAN
@@ -1584,7 +1584,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4874"
+NAME="AEN4848"
 ></A
 ><P
 >[RFC2010]&nbsp;<SPAN
@@ -1604,7 +1604,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4885"
+NAME="AEN4859"
 ></A
 ><P
 >[RFC2219]&nbsp;<SPAN
@@ -1627,7 +1627,7 @@ STYLE="margin-left=0.5in"
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4897"
+NAME="AEN4871"
 >Other <SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -1636,7 +1636,7 @@ CLASS="acronym"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4903"
+NAME="AEN4877"
 ></A
 ><P
 >[RFC1464]&nbsp;<SPAN
@@ -1653,7 +1653,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4910"
+NAME="AEN4884"
 ></A
 ><P
 >[RFC1713]&nbsp;<SPAN
@@ -1673,7 +1673,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4918"
+NAME="AEN4892"
 ></A
 ><P
 >[RFC1794]&nbsp;<SPAN
@@ -1693,7 +1693,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4926"
+NAME="AEN4900"
 ></A
 ><P
 >[RFC2240]&nbsp;<SPAN
@@ -1710,7 +1710,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4933"
+NAME="AEN4907"
 ></A
 ><P
 >[RFC2345]&nbsp;<SPAN
@@ -1733,7 +1733,7 @@ STYLE="margin-left=0.5in"
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4947"
+NAME="AEN4921"
 ></A
 ><P
 >[RFC2352]&nbsp;<SPAN
@@ -1750,13 +1750,13 @@ STYLE="margin-left=0.5in"
 ><H2
 CLASS="bibliodiv"
 ><A
-NAME="AEN4954"
+NAME="AEN4928"
 >Obsolete and Unimplemented Experimental RRs</A
 ></H2
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4956"
+NAME="AEN4930"
 ></A
 ><P
 >[RFC1712]&nbsp;<SPAN
@@ -1807,7 +1807,7 @@ CLASS="sect2"
 ><H2
 CLASS="sect2"
 ><A
-NAME="AEN4977"
+NAME="AEN4951"
 >A.4.3. Other Documents About <SPAN
 CLASS="acronym"
 >BIND</SPAN
@@ -1817,13 +1817,13 @@ CLASS="acronym"
 ></P
 ><H3
 ><A
-NAME="AEN4981"
+NAME="AEN4955"
 >Bibliography</A
 ></H3
 ><DIV
 CLASS="biblioentry"
 ><A
-NAME="AEN4982"
+NAME="AEN4956"
 ></A
 ><P
 ><SPAN
@@ -1905,4 +1905,4 @@ VALIGN="top"
 ></DIV
 ></BODY
 ></HTML
->
+>
\ No newline at end of file
diff --git a/usr.sbin/bind/doc/arm/Bv9ARM.html b/usr.sbin/bind/doc/arm/Bv9ARM.html
index 8286e60087d..b72554ae7e5 100644
--- a/usr.sbin/bind/doc/arm/Bv9ARM.html
+++ b/usr.sbin/bind/doc/arm/Bv9ARM.html
@@ -326,29 +326,14 @@ CLASS="acronym"
 ><DL
 ><DT
 >4.8.1. <A
-HREF="Bv9ARM.ch04.html#AEN1003"
+HREF="Bv9ARM.ch04.html#AEN1005"
 >Address Lookups Using AAAA Records</A
 ></DT
 ><DT
 >4.8.2. <A
-HREF="Bv9ARM.ch04.html#AEN1008"
->Address Lookups Using A6 Records</A
-></DT
-><DT
->4.8.3. <A
-HREF="Bv9ARM.ch04.html#AEN1029"
+HREF="Bv9ARM.ch04.html#AEN1009"
 >Address to Name Lookups Using Nibble Format</A
 ></DT
-><DT
->4.8.4. <A
-HREF="Bv9ARM.ch04.html#AEN1036"
->Address to Name Lookups Using Bitstring Format</A
-></DT
-><DT
->4.8.5. <A
-HREF="Bv9ARM.ch04.html#AEN1043"
->Using DNAME for Delegation of IPv6 Reverse Addresses</A
-></DT
 ></DL
 ></DD
 ></DL
@@ -365,7 +350,7 @@ CLASS="acronym"
 ><DL
 ><DT
 >5.1. <A
-HREF="Bv9ARM.ch05.html#AEN1063"
+HREF="Bv9ARM.ch05.html#AEN1018"
 >The Lightweight Resolver Library</A
 ></DT
 ><DT
@@ -399,7 +384,7 @@ HREF="Bv9ARM.ch06.html#address_match_lists"
 ></DT
 ><DT
 >6.1.2. <A
-HREF="Bv9ARM.ch06.html#AEN1304"
+HREF="Bv9ARM.ch06.html#AEN1259"
 >Comment Syntax</A
 ></DT
 ></DL
@@ -413,7 +398,7 @@ HREF="Bv9ARM.ch06.html#Configuration_File_Grammar"
 ><DL
 ><DT
 >6.2.1. <A
-HREF="Bv9ARM.ch06.html#AEN1411"
+HREF="Bv9ARM.ch06.html#AEN1366"
 ><B
 CLASS="command"
 >acl</B
@@ -430,7 +415,7 @@ Usage</A
 ></DT
 ><DT
 >6.2.3. <A
-HREF="Bv9ARM.ch06.html#AEN1458"
+HREF="Bv9ARM.ch06.html#AEN1413"
 ><B
 CLASS="command"
 >controls</B
@@ -446,7 +431,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.5. <A
-HREF="Bv9ARM.ch06.html#AEN1531"
+HREF="Bv9ARM.ch06.html#AEN1486"
 ><B
 CLASS="command"
 >include</B
@@ -454,7 +439,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.6. <A
-HREF="Bv9ARM.ch06.html#AEN1536"
+HREF="Bv9ARM.ch06.html#AEN1491"
 ><B
 CLASS="command"
 >include</B
@@ -462,7 +447,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.7. <A
-HREF="Bv9ARM.ch06.html#AEN1543"
+HREF="Bv9ARM.ch06.html#AEN1498"
 ><B
 CLASS="command"
 >key</B
@@ -470,7 +455,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.8. <A
-HREF="Bv9ARM.ch06.html#AEN1550"
+HREF="Bv9ARM.ch06.html#AEN1505"
 ><B
 CLASS="command"
 >key</B
@@ -478,7 +463,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.9. <A
-HREF="Bv9ARM.ch06.html#AEN1568"
+HREF="Bv9ARM.ch06.html#AEN1523"
 ><B
 CLASS="command"
 >logging</B
@@ -486,7 +471,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.10. <A
-HREF="Bv9ARM.ch06.html#AEN1608"
+HREF="Bv9ARM.ch06.html#AEN1563"
 ><B
 CLASS="command"
 >logging</B
@@ -494,7 +479,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.11. <A
-HREF="Bv9ARM.ch06.html#AEN1866"
+HREF="Bv9ARM.ch06.html#AEN1821"
 ><B
 CLASS="command"
 >lwres</B
@@ -502,7 +487,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.12. <A
-HREF="Bv9ARM.ch06.html#AEN1890"
+HREF="Bv9ARM.ch06.html#AEN1845"
 ><B
 CLASS="command"
 >lwres</B
@@ -510,7 +495,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.13. <A
-HREF="Bv9ARM.ch06.html#AEN1909"
+HREF="Bv9ARM.ch06.html#AEN1864"
 ><B
 CLASS="command"
 >options</B
@@ -518,7 +503,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.14. <A
-HREF="Bv9ARM.ch06.html#AEN2134"
+HREF="Bv9ARM.ch06.html#AEN2092"
 ><B
 CLASS="command"
 >options</B
@@ -542,7 +527,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.17. <A
-HREF="Bv9ARM.ch06.html#AEN3047"
+HREF="Bv9ARM.ch06.html#AEN3019"
 ><B
 CLASS="command"
 >trusted-keys</B
@@ -550,7 +535,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.18. <A
-HREF="Bv9ARM.ch06.html#AEN3063"
+HREF="Bv9ARM.ch06.html#AEN3035"
 ><B
 CLASS="command"
 >trusted-keys</B
@@ -559,7 +544,7 @@ and Usage</A
 ></DT
 ><DT
 >6.2.19. <A
-HREF="Bv9ARM.ch06.html#AEN3071"
+HREF="Bv9ARM.ch06.html#AEN3043"
 ><B
 CLASS="command"
 >view</B
@@ -567,7 +552,7 @@ CLASS="command"
 ></DT
 ><DT
 >6.2.20. <A
-HREF="Bv9ARM.ch06.html#AEN3087"
+HREF="Bv9ARM.ch06.html#AEN3059"
 ><B
 CLASS="command"
 >view</B
@@ -584,7 +569,7 @@ Statement Grammar</A
 ></DT
 ><DT
 >6.2.22. <A
-HREF="Bv9ARM.ch06.html#AEN3240"
+HREF="Bv9ARM.ch06.html#AEN3212"
 ><B
 CLASS="command"
 >zone</B
@@ -594,7 +579,7 @@ CLASS="command"
 ></DD
 ><DT
 >6.3. <A
-HREF="Bv9ARM.ch06.html#AEN3586"
+HREF="Bv9ARM.ch06.html#AEN3560"
 >Zone File</A
 ></DT
 ><DD
@@ -606,7 +591,7 @@ HREF="Bv9ARM.ch06.html#types_of_resource_records_and_when_to_use_them"
 ></DT
 ><DT
 >6.3.2. <A
-HREF="Bv9ARM.ch06.html#AEN3941"
+HREF="Bv9ARM.ch06.html#AEN3915"
 >Discussion of MX Records</A
 ></DT
 ><DT
@@ -616,17 +601,17 @@ HREF="Bv9ARM.ch06.html#Setting_TTLs"
 ></DT
 ><DT
 >6.3.4. <A
-HREF="Bv9ARM.ch06.html#AEN4062"
+HREF="Bv9ARM.ch06.html#AEN4036"
 >Inverse Mapping in IPv4</A
 ></DT
 ><DT
 >6.3.5. <A
-HREF="Bv9ARM.ch06.html#AEN4089"
+HREF="Bv9ARM.ch06.html#AEN4063"
 >Other Zone File Directives</A
 ></DT
 ><DT
 >6.3.6. <A
-HREF="Bv9ARM.ch06.html#AEN4147"
+HREF="Bv9ARM.ch06.html#AEN4121"
 ><SPAN
 CLASS="acronym"
 >BIND</SPAN
@@ -656,7 +641,7 @@ HREF="Bv9ARM.ch07.html#Access_Control_Lists"
 ></DT
 ><DT
 >7.2. <A
-HREF="Bv9ARM.ch07.html#AEN4239"
+HREF="Bv9ARM.ch07.html#AEN4213"
 ><B
 CLASS="command"
 >chroot</B
@@ -670,7 +655,7 @@ UNIX servers)</A
 ><DL
 ><DT
 >7.2.1. <A
-HREF="Bv9ARM.ch07.html#AEN4262"
+HREF="Bv9ARM.ch07.html#AEN4236"
 >The <B
 CLASS="command"
 >chroot</B
@@ -678,7 +663,7 @@ CLASS="command"
 ></DT
 ><DT
 >7.2.2. <A
-HREF="Bv9ARM.ch07.html#AEN4280"
+HREF="Bv9ARM.ch07.html#AEN4254"
 >Using the <B
 CLASS="command"
 >setuid</B
@@ -702,26 +687,26 @@ HREF="Bv9ARM.ch08.html"
 ><DL
 ><DT
 >8.1. <A
-HREF="Bv9ARM.ch08.html#AEN4301"
+HREF="Bv9ARM.ch08.html#AEN4275"
 >Common Problems</A
 ></DT
 ><DD
 ><DL
 ><DT
 >8.1.1. <A
-HREF="Bv9ARM.ch08.html#AEN4303"
+HREF="Bv9ARM.ch08.html#AEN4277"
 >It's not working; how can I figure out what's wrong?</A
 ></DT
 ></DL
 ></DD
 ><DT
 >8.2. <A
-HREF="Bv9ARM.ch08.html#AEN4306"
+HREF="Bv9ARM.ch08.html#AEN4280"
 >Incrementing and Changing the Serial Number</A
 ></DT
 ><DT
 >8.3. <A
-HREF="Bv9ARM.ch08.html#AEN4311"
+HREF="Bv9ARM.ch08.html#AEN4285"
 >Where Can I Get Help?</A
 ></DT
 ></DL
@@ -735,14 +720,14 @@ HREF="Bv9ARM.ch09.html"
 ><DL
 ><DT
 >A.1. <A
-HREF="Bv9ARM.ch09.html#AEN4327"
+HREF="Bv9ARM.ch09.html#AEN4301"
 >Acknowledgements</A
 ></DT
 ><DD
 ><DL
 ><DT
 >A.1.1. <A
-HREF="Bv9ARM.ch09.html#AEN4329"
+HREF="Bv9ARM.ch09.html#AEN4303"
 >A Brief History of the <SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -772,7 +757,7 @@ HREF="Bv9ARM.ch09.html#classes_of_resource_records"
 ></DD
 ><DT
 >A.3. <A
-HREF="Bv9ARM.ch09.html#AEN4368"
+HREF="Bv9ARM.ch09.html#AEN4342"
 >General <SPAN
 CLASS="acronym"
 >DNS</SPAN
@@ -806,7 +791,7 @@ HREF="Bv9ARM.ch09.html#internet_drafts"
 ></DT
 ><DT
 >A.4.3. <A
-HREF="Bv9ARM.ch09.html#AEN4977"
+HREF="Bv9ARM.ch09.html#AEN4951"
 >Other Documents About <SPAN
 CLASS="acronym"
 >BIND</SPAN
@@ -871,4 +856,4 @@ VALIGN="top"
 ></DIV
 ></BODY
 ></HTML
->
+>
\ No newline at end of file
diff --git a/usr.sbin/bind/doc/misc/dnssec b/usr.sbin/bind/doc/misc/dnssec
index d05b7e5ed65..1800d027ea6 100644
--- a/usr.sbin/bind/doc/misc/dnssec
+++ b/usr.sbin/bind/doc/misc/dnssec
@@ -89,4 +89,4 @@ future as we consider them inferior to the use of TSIG or SIG(0) to
 ensure the integrity of zone transfers.
 
 
-$ISC: dnssec,v 1.14.2.3.4.2 2003/02/17 07:05:07 marka Exp $
+$ISC: dnssec,v 1.14.2.6 2003/03/06 04:38:20 marka Exp $
diff --git a/usr.sbin/bind/doc/misc/migration b/usr.sbin/bind/doc/misc/migration
index 916cde19b88..dfe991d599c 100644
--- a/usr.sbin/bind/doc/misc/migration
+++ b/usr.sbin/bind/doc/misc/migration
@@ -1,4 +1,4 @@
-Copyright (C) 2000, 2001  Internet Software Consortium.
+Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
 See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
 
                    BIND 8 to BIND 9 Migration Notes
@@ -38,7 +38,7 @@ do cause the zone not to load.
 1.3. Logging
 
 The set of logging categories in BIND 9 is different from that
-in BIND 8.  If you have customized your logging on a per-category
+in BIND 8.  If you have customised your logging on a per-category
 basis, you need to modify your logging statement to use the
 new categories.
 
@@ -50,7 +50,7 @@ server first starts up, regardless of the contents of the "logging"
 statement.  In BIND 8, the new logging configuration took effect
 immediately after the "logging" statement was read.
 
-1.4. Notify messages and Refesh queries
+1.4. Notify messages and Refresh queries
 
 The source address and port for these is now controlled by
 "notify-source" and "transfer-source", respectively, rather that
@@ -78,10 +78,10 @@ and use the value of the SOA MINTTL field as a default for missing TTL
 values.
 
 BIND 9.0 and 9.1 completely refused to load such files.  BIND 9.2
-emulates the nonstandard BIND 4/8 SOA MINTTL behavior and loads the
+emulates the nonstandard BIND 4/8 SOA MINTTL behaviour and loads the
 files anyway (provided the SOA is the first record in the file), but
 will issue the warning message "no TTL specified; using SOA MINTTL
-instad".
+instead".
 
 To avoid problems, we recommend that you use a $TTL directive in each
 zone file.
@@ -125,7 +125,7 @@ name is deprecated.  Use \$ instead.
 
 BIND 9 uses EDNS0 (RFC2671) to advertise its receive buffer size.  It
 also sets an EDNS flag bit in queries to indicate that it wishes to
-receive DNSSEC responses; this flag bit usage is not yet standardized,
+receive DNSSEC responses; this flag bit usage is not yet standardised,
 but we hope it will be.
 
 Most older servers that do not support EDNS0, including prior versions
@@ -154,13 +154,12 @@ You can work around this problem using the option "transfer-format
 one-answer;", but since these old versions all have known security
 problems, the correct fix is to upgrade the slave servers.
 
-Zone transfers to Windows 2000 DNS servers sometimes fail due to a bug
-in the Windows 2000 DNS server where DNS messages larger than 16K are
-not handled properly.  There will be a hot fix available from
-Microsoft to address this issue.  In the meantime, the problem can
-be worked around by setting "transfer-format one-answer;".
-[As of May 4 2001 the hotfix was still being prepared]
-
+Zone transfers to Windows 2000 DNS servers sometimes fail due to a
+bug in the Windows 2000 DNS server where DNS messages larger than
+16K are not handled properly.  Obtain the latest service pack for
+Windows 2000 from Microsoft to address this issue.  In the meantime,
+the problem can be worked around by setting "transfer-format one-answer;".
+http://support.microsoft.com/default.aspx?scid=kb;en-us;297936
 
 4. Unrestricted Character Set
 
@@ -219,11 +218,11 @@ records and would "leak" the child's NS records into the parent,
 effectively causing the parent zone to be silently modified: responses
 and zone transfers from the parent contained the child's NS records
 rather than the glue configured into the parent (if any).  In the case
-of children of type "stub", this behavior was documented as a feature,
+of children of type "stub", this behaviour was documented as a feature,
 allowing the glue NS records to be omitted from the parent
 configuration.
 
-Sites that were relying on this BIND 8 behavior need to add any
+Sites that were relying on this BIND 8 behaviour need to add any
 omitted glue NS records, and any necessary glue A records, to the
 parent zone.
 
@@ -243,4 +242,4 @@ necessary, the umask should be set explicitly in the script used to
 start the named process.
 
 
-$ISC: migration,v 1.37.2.1 2001/09/21 17:49:58 gson Exp $
+$ISC: migration,v 1.37.2.4 2003/09/02 02:20:15 marka Exp $
diff --git a/usr.sbin/bind/lib/dns/Makefile.in b/usr.sbin/bind/lib/dns/Makefile.in
index 125df367fd5..f3899929673 100644
--- a/usr.sbin/bind/lib/dns/Makefile.in
+++ b/usr.sbin/bind/lib/dns/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 1998-2001  Internet Software Consortium.
+# Copyright (C) 1998-2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: Makefile.in,v 1.126.2.1 2001/11/15 01:24:06 marka Exp $
+# $ISC: Makefile.in,v 1.126.2.4 2003/10/09 06:47:59 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -30,17 +30,21 @@ CINCLUDES =	-I. ${DNS_INCLUDES} ${ISC_INCLUDES}
 CDEFINES =
 CWARNINGS =
 
+ISCLIBS =	../../lib/isc/libisc.@A@
+
+ISCDEPLIBS =	../../lib/isc/libisc.@A@
+
 LIBS =		@LIBS@
 
 # Alphabetically
 
-DSTOBJS =	sec/dst/dst_api.@O@ \
-		sec/dst/dst_lib.@O@ sec/dst/dst_parse.@O@ \
-		sec/dst/dst_result.@O@ sec/dst/gssapi_link.@O@ \
-		sec/dst/gssapictx.@O@ sec/dst/hmac_link.@O@ \
-		sec/dst/key.@O@ sec/dst/openssl_link.@O@ \
-		sec/dst/openssldh_link.@O@ sec/dst/openssldsa_link.@O@ \
-		sec/dst/opensslrsa_link.@O@
+DSTOBJS =	sec/dst/dst_api.@O@ sec/dst/dst_lib.@O@ sec/dst/dst_parse.@O@ \
+		sec/dst/dst_result.@O@ sec/dst/hmac_link.@O@ sec/dst/key.@O@
+
+OPENSSLOBJS =	sec/dst/openssl_link.@O@ sec/dst/openssldh_link.@O@ \
+		sec/dst/openssldsa_link.@O@ sec/dst/opensslrsa_link.@O@
+
+GSSAPIOBJS =	sec/dst/gssapi_link.@O@ sec/dst/gssapictx.@O@
 
 # Alphabetically
 OBJS =		a6.@O@ acl.@O@ adb.@O@ byaddr.@O@ \
@@ -56,7 +60,7 @@ OBJS =		a6.@O@ acl.@O@ adb.@O@ byaddr.@O@ \
 		stats.@O@ tcpmsg.@O@ time.@O@ timer.@O@ tkey.@O@ \
 		tsig.@O@ ttl.@O@ validator.@O@ \
 		version.@O@ view.@O@ xfrin.@O@ zone.@O@ zonekey.@O@ zt.@O@ \
-		${OTHEROBJS} ${DSTOBJS}
+		${OTHEROBJS} ${DSTOBJS} ${OPENSSLOBJS} ${GSSAPIOBJS}
 
 # Alphabetically
 SRCS =		a6.c acl.c adb.c byaddr.c \
@@ -98,7 +102,27 @@ libdns.la: ${OBJS}
 	${LIBTOOL} --mode=link \
 		${CC} ${ALL_CFLAGS} -o libdns.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
-		${OBJS} ${LIBS}
+		${OBJS} ${LIBS} ${ISCLIBS}
+
+libdstcypto.@SA@: ${OPENSSLOBJS}
+	${AR} ${ARFLAGS} $@ ${OPENSSLOBJS}
+	${RANLIB} $@
+
+libdstcypto.la: ${OPENSSLOBJS}
+	${LIBTOOL} --mode=link \
+		${CC} ${ALL_CFLAGS} -o $@ -rpath ${libdir} \
+		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+		${OPENSSLOBJS} ${LIBS}
+
+libdstgssapi.@SA@: ${GSSAPIOBJS}
+	${AR} ${ARFLAGS} $@ ${GSSAPIOBJS}
+	${RANLIB} $@
+
+libdstgssapi.la: ${GSSAPIOBJS}
+	${LIBTOOL} --mode=link \
+		${CC} ${ALL_CFLAGS} -o $@ -rpath ${libdir} \
+		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
+		${GSSAPIOBJS} ${LIBS}
 
 timestamp: libdns.@A@
 	touch timestamp
diff --git a/usr.sbin/bind/lib/dns/adb.c b/usr.sbin/bind/lib/dns/adb.c
index 72f54871c67..fdf56543a0f 100644
--- a/usr.sbin/bind/lib/dns/adb.c
+++ b/usr.sbin/bind/lib/dns/adb.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: adb.c,v 1.181.2.4.4.2 2003/02/17 07:05:07 marka Exp $ */
+/* $ISC: adb.c,v 1.181.2.14 2003/10/10 00:30:14 marka Exp $ */
 
 /*
  * Implementation notes
@@ -87,6 +87,7 @@
  */
 #define ADB_CACHE_MINIMUM	10	/* seconds */
 #define ADB_CACHE_MAXIMUM	86400	/* seconds (86400 = 24 hours) */
+#define ADB_ENTRY_WINDOW	1800	/* seconds  */
 
 /*
  * Wake up every CLEAN_SECONDS and clean CLEAN_BUCKETS buckets, so that all
@@ -341,7 +342,7 @@ static isc_result_t dbfind_a6(dns_adbname_t *, isc_stdtime_t);
 #define NAME_IS_DEAD		0x40000000
 #define NAME_HINT_OK		DNS_ADBFIND_HINTOK
 #define NAME_GLUE_OK		DNS_ADBFIND_GLUEOK
-#define NAME_STARTATROOT	DNS_ADBFIND_STARTATROOT
+#define NAME_STARTATZONE	DNS_ADBFIND_STARTATZONE
 #define NAME_DEAD(n)		(((n)->flags & NAME_IS_DEAD) != 0)
 #define NAME_NEEDSPOKE(n)	(((n)->flags & NAME_NEEDS_POKE) != 0)
 #define NAME_GLUEOK(n)		(((n)->flags & NAME_GLUE_OK) != 0)
@@ -382,7 +383,7 @@ static isc_result_t dbfind_a6(dns_adbname_t *, isc_stdtime_t);
 #define FIND_WANTEMPTYEVENT(fn)	(((fn)->options & DNS_ADBFIND_EMPTYEVENT) != 0)
 #define FIND_AVOIDFETCHES(fn)	(((fn)->options & DNS_ADBFIND_AVOIDFETCHES) \
 				 != 0)
-#define FIND_STARTATROOT(fn)	(((fn)->options & DNS_ADBFIND_STARTATROOT) \
+#define FIND_STARTATZONE(fn)	(((fn)->options & DNS_ADBFIND_STARTATZONE) \
 				 != 0)
 #define FIND_HINTOK(fn)		(((fn)->options & DNS_ADBFIND_HINTOK) != 0)
 #define FIND_GLUEOK(fn)		(((fn)->options & DNS_ADBFIND_GLUEOK) != 0)
@@ -406,8 +407,8 @@ static isc_result_t dbfind_a6(dns_adbname_t *, isc_stdtime_t);
 #define GLUE_OK(nf, o) (!NAME_GLUEOK(nf) || (((o) & DNS_ADBFIND_GLUEOK) != 0))
 #define HINT_OK(nf, o) (!NAME_HINTOK(nf) || (((o) & DNS_ADBFIND_HINTOK) != 0))
 #define GLUEHINT_OK(nf, o) (GLUE_OK(nf, o) || HINT_OK(nf, o))
-#define STARTATROOT_MATCHES(nf, o) (((nf)->flags & NAME_STARTATROOT) == \
-				    ((o) & DNS_ADBFIND_STARTATROOT))
+#define STARTATZONE_MATCHES(nf, o) (((nf)->flags & NAME_STARTATZONE) == \
+				    ((o) & DNS_ADBFIND_STARTATZONE))
 
 #define ENTER_LEVEL		50
 #define EXIT_LEVEL		ENTER_LEVEL
@@ -496,6 +497,7 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	isc_result_t result;
 	dns_adb_t *adb;
 	dns_adbnamehook_t *nh;
+	dns_adbnamehook_t *anh;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	struct in_addr ina;
 	struct in6_addr in6a;
@@ -561,17 +563,26 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 
 			link_entry(adb, addr_bucket, entry);
 		} else {
-			foundentry->refcnt++;
-			nh->entry = foundentry;
+			for (anh = ISC_LIST_HEAD(adbname->v4);
+			     anh != NULL;
+			     anh = ISC_LIST_NEXT(anh, plink))
+				if (anh->entry == foundentry)
+					break;
+			if (anh == NULL) {
+				foundentry->refcnt++;
+				nh->entry = foundentry;
+			} else
+				free_adbnamehook(adb, &nh);
 		}
 
 		new_addresses_added = ISC_TRUE;
-		if (rdtype == dns_rdatatype_a)
-			ISC_LIST_APPEND(adbname->v4, nh, plink);
-		else
-			ISC_LIST_APPEND(adbname->v6, nh, plink);
+		if (nh != NULL) {
+			if (rdtype == dns_rdatatype_a)
+				ISC_LIST_APPEND(adbname->v4, nh, plink);
+			else
+				ISC_LIST_APPEND(adbname->v6, nh, plink);
+		}
 		nh = NULL;
-
 		result = dns_rdataset_next(rdataset);
 	}
 
@@ -582,7 +593,11 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 	if (addr_bucket != DNS_ADB_INVALIDBUCKET)
 		UNLOCK(&adb->entrylocks[addr_bucket]);
 
-	rdataset->ttl = ttlclamp(rdataset->ttl);
+	if (rdataset->trust == dns_trust_glue ||
+	    rdataset->trust == dns_trust_additional)
+		rdataset->ttl = ADB_CACHE_MINIMUM;
+	else
+		rdataset->ttl = ttlclamp(rdataset->ttl);
 
 	if (rdtype == dns_rdatatype_a) {
 		DP(NCACHE_LEVEL, "expire_v4 set to MIN(%u,%u) import_rdataset",
@@ -749,6 +764,7 @@ check_expire_namehooks(dns_adbname_t *name, isc_stdtime_t now) {
 			name->partial_result &= ~DNS_ADBFIND_INET;
 		}
 		name->expire_v4 = INT_MAX;
+		name->fetch_err = FIND_ERR_UNEXPECTED;
 	}
 
 	/*
@@ -761,6 +777,7 @@ check_expire_namehooks(dns_adbname_t *name, isc_stdtime_t now) {
 			name->partial_result &= ~DNS_ADBFIND_INET6;
 		}
 		name->expire_v6 = INT_MAX;
+		name->fetch6_err = FIND_ERR_UNEXPECTED;
 	}
 
 	/*
@@ -1775,7 +1792,7 @@ find_name_and_lock(dns_adb_t *adb, dns_name_t *name,
 	dns_adbname_t *adbname;
 	int bucket;
 
-	bucket = dns_name_hash(name, ISC_FALSE) % NBUCKETS;
+	bucket = dns_fullname_hash(name, ISC_FALSE) % NBUCKETS;
 
 	if (*bucketp == DNS_ADB_INVALIDBUCKET) {
 		LOCK(&adb->namelocks[bucket]);
@@ -1791,7 +1808,7 @@ find_name_and_lock(dns_adb_t *adb, dns_name_t *name,
 		if (!NAME_DEAD(adbname)) {
 			if (dns_name_equal(name, &adbname->name)
 			    && GLUEHINT_OK(adbname, options)
-			    && STARTATROOT_MATCHES(adbname, options))
+			    && STARTATZONE_MATCHES(adbname, options))
 				return (adbname);
 		}
 		adbname = ISC_LIST_NEXT(adbname, plink);
@@ -2107,10 +2124,10 @@ timer_cleanup(isc_task_t *task, isc_event_t *ev) {
 		/*
 		 * Call our cleanup routines.
 		 */
-		INSIST(cleanup_names(adb, adb->next_cleanbucket, now) ==
-			 ISC_FALSE);
-		INSIST(cleanup_entries(adb, adb->next_cleanbucket, now) ==
-			 ISC_FALSE);
+		RUNTIME_CHECK(cleanup_names(adb, adb->next_cleanbucket, now) ==
+			      ISC_FALSE);
+		RUNTIME_CHECK(cleanup_entries(adb, adb->next_cleanbucket, now)
+			      == ISC_FALSE);
 
 		/*
 		 * Set the next bucket to be cleaned.
@@ -2452,7 +2469,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	dns_adbfind_t *find;
 	dns_adbname_t *adbname;
 	int bucket;
-	isc_boolean_t want_event, start_at_root, alias, have_address;
+	isc_boolean_t want_event, start_at_zone, alias, have_address;
 	isc_result_t result;
 	unsigned int wanted_addresses;
 	unsigned int wanted_fetches;
@@ -2474,7 +2491,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	wanted_fetches = 0;
 	query_pending = 0;
 	want_event = ISC_FALSE;
-	start_at_root = ISC_FALSE;
+	start_at_zone = ISC_FALSE;
 	alias = ISC_FALSE;
 
 	if (now == 0)
@@ -2524,7 +2541,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	if (adb->name_sd[bucket]) {
 		DP(DEF_LEVEL,
 		   "dns_adb_createfind: returning ISC_R_SHUTTINGDOWN");
-		INSIST(free_adbfind(adb, &find) == ISC_FALSE);
+		RUNTIME_CHECK(free_adbfind(adb, &find) == ISC_FALSE);
 		result = ISC_R_SHUTTINGDOWN;
 		goto out;
 	}
@@ -2535,7 +2552,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	if (adbname == NULL) {
 		adbname = new_adbname(adb, name);
 		if (adbname == NULL) {
-			INSIST(free_adbfind(adb, &find) == ISC_FALSE);
+			RUNTIME_CHECK(free_adbfind(adb, &find) == ISC_FALSE);
 			result = ISC_R_NOMEMORY;
 			goto out;
 		}
@@ -2544,14 +2561,14 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 			adbname->flags |= NAME_HINT_OK;
 		if (FIND_GLUEOK(find))
 			adbname->flags |= NAME_GLUE_OK;
-		if (FIND_STARTATROOT(find))
-			adbname->flags |= NAME_STARTATROOT;
+		if (FIND_STARTATZONE(find))
+			adbname->flags |= NAME_STARTATZONE;
 	}
 
 	/*
 	 * Expire old entries, etc.
 	 */
-	INSIST(check_expire_namehooks(adbname, now) == ISC_FALSE);
+	RUNTIME_CHECK(check_expire_namehooks(adbname, now) == ISC_FALSE);
 
 	/*
 	 * Do we know that the name is an alias?
@@ -2572,8 +2589,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	 * start fetches.  First try looking for an A record
 	 * in the database.
 	 */
-	if (!NAME_HAS_V4(adbname) && !NAME_FETCH_V4(adbname)
-	    && EXPIRE_OK(adbname->expire_v4, now)
+	if (!NAME_HAS_V4(adbname) && EXPIRE_OK(adbname->expire_v4, now)
 	    && WANT_INET(wanted_addresses)) {
 		result = dbfind_name(adbname, now, dns_rdatatype_a);
 		if (result == ISC_R_SUCCESS) {
@@ -2608,12 +2624,12 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		else if (NXRRSET_RESULT(result))
 			goto v6;
 
-		wanted_fetches |= DNS_ADBFIND_INET;
+		if (!NAME_FETCH_V4(adbname))
+			wanted_fetches |= DNS_ADBFIND_INET;
 	}
 
  v6:
-	if (!NAME_HAS_V6(adbname) && !NAME_FETCH_V6(adbname)
-	    && EXPIRE_OK(adbname->expire_v6, now)
+	if (!NAME_HAS_V6(adbname) && EXPIRE_OK(adbname->expire_v6, now)
 	    && WANT_INET6(wanted_addresses)) {
 		result = dbfind_a6(adbname, now);
 		if (result == ISC_R_SUCCESS) {
@@ -2669,7 +2685,8 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		if (NCACHE_RESULT(result) || AUTH_NX(result))
 			goto fetch;
 
-		wanted_fetches |= DNS_ADBFIND_INET6;
+		if (!NAME_FETCH_V6(adbname))
+			wanted_fetches |= DNS_ADBFIND_INET6;
 	}
 
  fetch:
@@ -2687,14 +2704,14 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		 * be acceptable so we have to launch fetches.
 		 */
 
-		if (FIND_STARTATROOT(find))
-			start_at_root = ISC_TRUE;
+		if (FIND_STARTATZONE(find))
+			start_at_zone = ISC_TRUE;
 
 		/*
 		 * Start V4.
 		 */
 		if (WANT_INET(wanted_fetches) &&
-		    fetch_name_v4(adbname, start_at_root) == ISC_R_SUCCESS) {
+		    fetch_name_v4(adbname, start_at_zone) == ISC_R_SUCCESS) {
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: started A fetch for name %p",
 			   adbname);
@@ -2704,7 +2721,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		 * Start V6.
 		 */
 		if (WANT_INET6(wanted_fetches) &&
-		    fetch_name_a6(adbname, start_at_root) == ISC_R_SUCCESS) {
+		    fetch_name_a6(adbname, start_at_zone) == ISC_R_SUCCESS) {
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: started A6 fetch for name %p",
 			   adbname);
@@ -2834,7 +2851,8 @@ dns_adb_destroyfind(dns_adbfind_t **findp) {
 		entry = ai->entry;
 		ai->entry = NULL;
 		INSIST(DNS_ADBENTRY_VALID(entry));
-		INSIST(dec_entry_refcnt(adb, entry, ISC_TRUE) == ISC_FALSE);
+		RUNTIME_CHECK(dec_entry_refcnt(adb, entry, ISC_TRUE) ==
+			      ISC_FALSE);
 		free_adbaddrinfo(adb, &ai);
 		ai = ISC_LIST_HEAD(find->list);
 	}
@@ -3285,7 +3303,6 @@ dbfind_a6(dns_adbname_t *adbname, isc_stdtime_t now) {
 	INSIST(DNS_ADBNAME_VALID(adbname));
 	adb = adbname->adb;
 	INSIST(DNS_ADB_VALID(adb));
-	INSIST(!NAME_FETCH_V6(adbname));
 
 	result = ISC_R_UNEXPECTED;
 
@@ -3731,10 +3748,11 @@ fetch_callback_a6(isc_task_t *task, isc_event_t *ev) {
 }
 
 static isc_result_t
-fetch_name_v4(dns_adbname_t *adbname, isc_boolean_t start_at_root) {
+fetch_name_v4(dns_adbname_t *adbname, isc_boolean_t start_at_zone) {
 	isc_result_t result;
 	dns_adbfetch_t *fetch = NULL;
 	dns_adb_t *adb;
+	dns_fixedname_t fixed;
 	dns_name_t *name;
 	dns_rdataset_t rdataset;
 	dns_rdataset_t *nameservers;
@@ -3753,12 +3771,14 @@ fetch_name_v4(dns_adbname_t *adbname, isc_boolean_t start_at_root) {
 	dns_rdataset_init(&rdataset);
 
 	options = 0;
-	if (start_at_root) {
-		DP(50, "fetch_name_v4: starting at DNS root for name %p",
+	if (start_at_zone) {
+		DP(50, "fetch_name_v4: starting at zone for name %p",
 		   adbname);
-		name = dns_rootname;
-		result = dns_view_simplefind(adb->view, name, dns_rdatatype_ns,
-					     0, 0, ISC_TRUE, &rdataset, NULL);
+		dns_fixedname_init(&fixed);
+		name = dns_fixedname_name(&fixed);
+		result = dns_view_findzonecut2(adb->view, &adbname->name, name,
+					       0, 0, ISC_TRUE, ISC_FALSE,
+					       &rdataset, NULL);
 		if (result != ISC_R_SUCCESS && result != DNS_R_HINT)
 			goto cleanup;
 		nameservers = &rdataset;
@@ -3833,10 +3853,11 @@ fetch_name_aaaa(dns_adbname_t *adbname) {
 }
 
 static isc_result_t
-fetch_name_a6(dns_adbname_t *adbname, isc_boolean_t start_at_root) {
+fetch_name_a6(dns_adbname_t *adbname, isc_boolean_t start_at_zone) {
 	isc_result_t result;
 	dns_adbfetch6_t *fetch = NULL;
 	dns_adb_t *adb;
+	dns_fixedname_t fixed;
 	dns_name_t *name;
 	dns_rdataset_t rdataset;
 	dns_rdataset_t *nameservers;
@@ -3855,12 +3876,14 @@ fetch_name_a6(dns_adbname_t *adbname, isc_boolean_t start_at_root) {
 	dns_rdataset_init(&rdataset);
 
 	options = 0;
-	if (start_at_root) {
-		DP(50, "fetch_name_a6: starting at DNS root for name %p",
+	if (start_at_zone) {
+		DP(50, "fetch_name_a6: starting at zone for name %p",
 		   adbname);
-		name = dns_rootname;
-		result = dns_view_simplefind(adb->view, name, dns_rdatatype_ns,
-					     0, 0, ISC_TRUE, &rdataset, NULL);
+		dns_fixedname_init(&fixed);
+		name = dns_fixedname_name(&fixed);
+		result = dns_view_findzonecut2(adb->view, &adbname->name, name,
+					       0, 0, ISC_TRUE, ISC_FALSE,
+					       &rdataset, NULL);
 		if (result != ISC_R_SUCCESS && result != DNS_R_HINT)
 			goto cleanup;
 		nameservers = &rdataset;
@@ -3930,6 +3953,7 @@ dns_adb_adjustsrtt(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 {
 	int bucket;
 	unsigned int new_srtt;
+	isc_stdtime_t now;
 
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
@@ -3947,6 +3971,9 @@ dns_adb_adjustsrtt(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 	addr->entry->srtt = new_srtt;
 	addr->srtt = new_srtt;
 
+	isc_stdtime_get(&now);
+	addr->entry->expires = now + ADB_ENTRY_WINDOW;
+
 	UNLOCK(&adb->entrylocks[bucket]);
 }
 
@@ -4044,7 +4071,7 @@ dns_adb_freeaddrinfo(dns_adb_t *adb, dns_adbaddrinfo_t **addrp) {
 	bucket = addr->entry->lock_bucket;
 	LOCK(&adb->entrylocks[bucket]);
 
-	entry->expires = now + 1800;		/* XXXRTH */
+	entry->expires = now + ADB_ENTRY_WINDOW;
 
 	want_check_exit = dec_entry_refcnt(adb, entry, ISC_FALSE);
 
@@ -4072,8 +4099,8 @@ dns_adb_flush(dns_adb_t *adb) {
 		/*
 		 * Call our cleanup routines.
 		 */
-		INSIST(cleanup_names(adb, i, INT_MAX) == ISC_FALSE);
-		INSIST(cleanup_entries(adb, i, INT_MAX) == ISC_FALSE);
+		RUNTIME_CHECK(cleanup_names(adb, i, INT_MAX) == ISC_FALSE);
+		RUNTIME_CHECK(cleanup_entries(adb, i, INT_MAX) == ISC_FALSE);
 	}
 
 #ifdef DUMP_ADB_AFTER_CLEANING
diff --git a/usr.sbin/bind/lib/dns/api b/usr.sbin/bind/lib/dns/api
index 7bd467bdc97..d9681e57374 100644
--- a/usr.sbin/bind/lib/dns/api
+++ b/usr.sbin/bind/lib/dns/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 10
-LIBREVISION = 0
+LIBINTERFACE = 11
+LIBREVISION = 2
 LIBAGE = 0
diff --git a/usr.sbin/bind/lib/dns/byaddr.c b/usr.sbin/bind/lib/dns/byaddr.c
index b173f489a43..b0a5468d7e5 100644
--- a/usr.sbin/bind/lib/dns/byaddr.c
+++ b/usr.sbin/bind/lib/dns/byaddr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: byaddr.c,v 1.29 2001/06/04 19:32:57 tale Exp $ */
+/* $ISC: byaddr.c,v 1.29.2.2 2003/10/09 07:32:36 marka Exp $ */
 
 #include <config.h>
 
@@ -68,6 +68,18 @@ isc_result_t
 dns_byaddr_createptrname(isc_netaddr_t *address, isc_boolean_t nibble,
 			 dns_name_t *name)
 {
+	unsigned int options = DNS_BYADDROPT_IPV6INT;
+	
+	if (nibble)
+		options |= DNS_BYADDROPT_IPV6NIBBLE;
+
+	return (dns_byaddr_createptrname2(address, options, name));
+}
+
+isc_result_t
+dns_byaddr_createptrname2(isc_netaddr_t *address, unsigned int options,
+			  dns_name_t *name)
+{
 	char textname[128];
 	unsigned char *bytes;
 	int i;
@@ -92,7 +104,7 @@ dns_byaddr_createptrname(isc_netaddr_t *address, isc_boolean_t nibble,
 			       (bytes[1] & 0xff),
 			       (bytes[0] & 0xff));
 	} else if (address->family == AF_INET6) {
-		if (nibble) {
+		if ((options & DNS_BYADDROPT_IPV6NIBBLE) != 0) {
 			cp = textname;
 			for (i = 15; i >= 0; i--) {
 				*cp++ = hex_digits[bytes[i] & 0x0f];
@@ -100,7 +112,10 @@ dns_byaddr_createptrname(isc_netaddr_t *address, isc_boolean_t nibble,
 				*cp++ = hex_digits[(bytes[i] >> 4) & 0x0f];
 				*cp++ = '.';
 			}
-			strlcpy(cp, "ip6.int.", textname + sizeof(textname) - cp);
+			if ((options & DNS_BYADDROPT_IPV6INT) != 0)
+				strlcpy(cp, "ip6.int.", textname + sizeof(textname) - cp);
+			else
+				strlcpy(cp, "ip6.arpa.", textname + sizeof(textname) - cp);
 		} else {
 			cp = textname;
 			*cp++ = '\\';
@@ -242,9 +257,8 @@ dns_byaddr_create(isc_mem_t *mctx, isc_netaddr_t *address, dns_view_t *view,
 
 	dns_fixedname_init(&byaddr->name);
 
-	result = dns_byaddr_createptrname(address,
-			  ISC_TF(byaddr->options & DNS_BYADDROPT_IPV6NIBBLE),
-			  dns_fixedname_name(&byaddr->name));
+	result = dns_byaddr_createptrname2(address, byaddr->options,
+					   dns_fixedname_name(&byaddr->name));
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_lock;
 
diff --git a/usr.sbin/bind/lib/dns/cache.c b/usr.sbin/bind/lib/dns/cache.c
index be85a163ad1..e43c252e1ca 100644
--- a/usr.sbin/bind/lib/dns/cache.c
+++ b/usr.sbin/bind/lib/dns/cache.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: cache.c,v 1.45.2.4 2002/08/05 06:57:11 marka Exp $ */
+/* $ISC: cache.c,v 1.45.2.5 2003/10/16 06:07:12 marka Exp $ */
 
 #include <config.h>
 
@@ -245,7 +245,9 @@ dns_cache_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	for (i = 0; i < cache->db_argc; i++)
 		if (cache->db_argv[i] != NULL)
 			isc_mem_free(mctx, cache->db_argv[i]);
-	isc_mem_put(mctx, cache->db_argv, cache->db_argc * sizeof(char *));
+	if (cache->db_argv != NULL)
+		isc_mem_put(mctx, cache->db_argv,
+			    cache->db_argc * sizeof(char *));
  cleanup_dbtype:
 	isc_mem_free(mctx, cache->db_type);
  cleanup_filelock:
@@ -549,6 +551,8 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
 	return (ISC_R_SUCCESS);
 
  cleanup:
+	if (cleaner->overmem_event != NULL)
+		isc_event_free(&cleaner->overmem_event);
 	if (cleaner->resched_event != NULL)
 		isc_event_free(&cleaner->resched_event);
 	if (cleaner->cleaning_timer != NULL)
diff --git a/usr.sbin/bind/lib/dns/db.c b/usr.sbin/bind/lib/dns/db.c
index 357db1dd0a7..04757d72fd1 100644
--- a/usr.sbin/bind/lib/dns/db.c
+++ b/usr.sbin/bind/lib/dns/db.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: db.c,v 1.69.2.1 2001/09/04 23:09:33 gson Exp $ */
+/* $ISC: db.c,v 1.69.2.3 2003/10/09 07:32:36 marka Exp $ */
 
 /***
  *** Imports
@@ -428,7 +428,6 @@ dns_db_findnode(dns_db_t *db, dns_name_t *name,
 	 */
 
 	REQUIRE(DNS_DB_VALID(db));
-	REQUIRE(dns_name_issubdomain(name, &db->origin));
 	REQUIRE(nodep != NULL && *nodep == NULL);
 
 	return ((db->methods->findnode)(db, name, create, nodep));
diff --git a/usr.sbin/bind/lib/dns/dispatch.c b/usr.sbin/bind/lib/dns/dispatch.c
index 340dc107afc..31c59ffefb1 100644
--- a/usr.sbin/bind/lib/dns/dispatch.c
+++ b/usr.sbin/bind/lib/dns/dispatch.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dispatch.c,v 1.101.2.3 2002/05/08 06:38:14 marka Exp $ */
+/* $ISC: dispatch.c,v 1.101.2.6 2003/07/22 04:03:40 marka Exp $ */
 
 #include <config.h>
 
@@ -478,12 +478,7 @@ allocate_event(dns_dispatch_t *disp) {
  *
  * If I/O result == CANCELED or error, free the buffer.
  *
- * If query:
- *	if no listeners: free the buffer, restart.
- *	if listener: allocate event, fill in details.
- *		If cannot allocate, free buffer, restart.
- *	if rq event queue is not empty, queue.  else, send.
- *	restart.
+ * If query, free the buffer, restart.
  *
  * If response:
  *	Allocate event, fill in details.
@@ -521,7 +516,12 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		     "got packet: requests %d, buffers %d, recvs %d",
 		     disp->requests, disp->mgr->buffers, disp->recv_pending);
 
-	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) {
+	if (ev->ev_type == ISC_SOCKEVENT_RECVDONE) {
+		/*
+		 * Unless the receive event was imported from a listening
+		 * interface, in which case the event type is
+		 * DNS_EVENT_IMPORTRECVDONE, receive operation must be pending.
+		 */
 		INSIST(disp->recv_pending != 0);
 		disp->recv_pending = 0;
 	}
@@ -664,20 +664,15 @@ udp_recv(isc_task_t *task, isc_event_t *ev_in) {
 /*
  * General flow:
  *
- * If I/O result == CANCELED, EOF, or error, free the buffer
- * and notify everyone as the various queues drain.
+ * If I/O result == CANCELED, EOF, or error, notify everyone as the
+ * various queues drain.
  *
- * If query:
- *	if no listeners: free the buffer, restart.
- *	if listener: allocate event, fill in details.
- *		If cannot allocate, free buffer, restart.
- *	if rq event queue is not empty, queue.  else, send.
- *	restart.
+ * If query, restart.
  *
  * If response:
  *	Allocate event, fill in details.
- *		If cannot allocate, free buffer, restart.
- *	find target.  If not found, free buffer, restart.
+ *		If cannot allocate, restart.
+ *	find target.  If not found, restart.
  *	if event queue is not empty, queue.  else, send.
  *	restart.
  */
@@ -742,7 +737,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 		 * free the event *before* calling destroy_disp().
 		 */
 		isc_event_free(&ev_in);
-		
+
 		disp->shutting_down = 1;
 		disp->shutdown_why = tcpmsg->result;
 
@@ -1541,7 +1536,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		{
 			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
 			if (disp->recv_pending != 0)
-				isc_socket_cancel(disp->socket, NULL,
+				isc_socket_cancel(disp->socket, disp->task,
 						  ISC_SOCKCANCEL_RECV);
 		}
 
@@ -1679,7 +1674,7 @@ dns_dispatch_detach(dns_dispatch_t **dispp) {
 	killit = ISC_FALSE;
 	if (disp->refcount == 0) {
 		if (disp->recv_pending > 0)
-			isc_socket_cancel(disp->socket, NULL,
+			isc_socket_cancel(disp->socket, disp->task,
 					  ISC_SOCKCANCEL_RECV);
 		disp->shutting_down = 1;
 	}
@@ -1842,7 +1837,7 @@ dns_dispatch_removeresponse(dns_dispentry_t **resp,
 	killit = ISC_FALSE;
 	if (disp->refcount == 0) {
 		if (disp->recv_pending > 0)
-			isc_socket_cancel(disp->socket, NULL,
+			isc_socket_cancel(disp->socket, disp->task,
 					  ISC_SOCKCANCEL_RECV);
 		disp->shutting_down = 1;
 	}
@@ -2008,11 +2003,19 @@ dns_dispatch_changeattributes(dns_dispatch_t *disp,
 
 	LOCK(&disp->lock);
 
-	if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0 &&
-	    (attributes & DNS_DISPATCHATTR_NOLISTEN) == 0)
-	{
-		disp->attributes &= ~DNS_DISPATCHATTR_NOLISTEN;
-		startrecv(disp);
+	if ((mask & DNS_DISPATCHATTR_NOLISTEN) != 0) {
+		if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0 &&
+		    (attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) {
+			disp->attributes &= ~DNS_DISPATCHATTR_NOLISTEN;
+			startrecv(disp);
+		} else if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN)
+			   == 0 &&
+			   (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0) {
+			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
+			if (disp->recv_pending != 0)
+				isc_socket_cancel(disp->socket, disp->task,
+						  ISC_SOCKCANCEL_RECV);
+		}
 	}
 
 	disp->attributes &= ~mask;
@@ -2034,7 +2037,7 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) {
 	INSIST(sevent->n <= disp->mgr->buffersize);
 	newsevent = (isc_socketevent_t *)
 		    isc_event_allocate(disp->mgr->mctx, NULL,
-				      ISC_SOCKEVENT_RECVDONE, udp_recv,
+				      DNS_EVENT_IMPORTRECVDONE, udp_recv,
 				      disp, sizeof(isc_socketevent_t));
 	if (newsevent == NULL)
 		return;
diff --git a/usr.sbin/bind/lib/dns/dnssec.c b/usr.sbin/bind/lib/dns/dnssec.c
index 056199358ff..27a8887f85c 100644
--- a/usr.sbin/bind/lib/dns/dnssec.c
+++ b/usr.sbin/bind/lib/dns/dnssec.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  */
 
 /*
- * $ISC: dnssec.c,v 1.69.2.3 2002/08/02 05:08:49 marka Exp $
+ * $ISC: dnssec.c,v 1.69.2.5 2003/07/22 04:03:41 marka Exp $
  */
 
 
@@ -26,6 +26,7 @@
 
 #include <isc/buffer.h>
 #include <isc/mem.h>
+#include <isc/serial.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
@@ -360,15 +361,18 @@ dns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	if (ret != ISC_R_SUCCESS)
 		return (ret);
 
+	if (isc_serial_lt(sig.timesigned, sig.timeexpire))
+		return (DNS_R_SIGINVALID);
+
 	if (!ignoretime) {
 		isc_stdtime_get(&now);
 
 		/*
 		 * Is SIG temporally valid?
 		 */
-		if (sig.timesigned > now)
+		if (isc_serial_lt((isc_uint32_t)now, sig.timesigned))
 			return (DNS_R_SIGFUTURE);
-		else if (sig.timeexpire < now)
+		else if (isc_serial_lt(sig.timeexpire, (isc_uint32_t)now))
 			return (DNS_R_SIGEXPIRED);
 	}
 
@@ -723,13 +727,19 @@ dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 		goto failure;
 	}
 
+	if (isc_serial_lt(sig.timeexpire, sig.timesigned)) {
+		result = DNS_R_SIGINVALID;
+		msg->sig0status = dns_tsigerror_badtime;
+		goto failure;
+	}
+
 	isc_stdtime_get(&now);
-	if (sig.timesigned > now) {
+	if (isc_serial_lt((isc_uint32_t)now, sig.timesigned)) {
 		result = DNS_R_SIGFUTURE;
 		msg->sig0status = dns_tsigerror_badtime;
 		goto failure;
 	}
-	else if (sig.timeexpire < now) {
+	else if (isc_serial_lt(sig.timeexpire, (isc_uint32_t)now)) {
 		result = DNS_R_SIGEXPIRED;
 		msg->sig0status = dns_tsigerror_badtime;
 		goto failure;
diff --git a/usr.sbin/bind/lib/dns/gen.c b/usr.sbin/bind/lib/dns/gen.c
index a233ce558ae..9bd7df7ce55 100644
--- a/usr.sbin/bind/lib/dns/gen.c
+++ b/usr.sbin/bind/lib/dns/gen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: gen.c,v 1.65.2.2 2002/03/26 00:54:54 marka Exp $ */
+/* $ISC: gen.c,v 1.65.2.5 2003/07/23 06:57:48 marka Exp $ */
 
 #include <config.h>
 
@@ -110,6 +110,8 @@ const char copyright[] =
 " ***************/\n"
 "\n";
 
+#define TYPENAMES 256
+
 struct cc {
 	struct cc *next;
 	int rdclass;
@@ -130,7 +132,10 @@ struct ttnam {
 	char macroname[11];
 	char attr[256];
 	unsigned int sorted;
-} typenames[256];
+	int type;
+} typenames[TYPENAMES];
+
+int maxtype = -1;
 
 char *
 upper(char *);
@@ -274,26 +279,49 @@ dodecl(char *type, char *function, char *args) {
 				funname(tt->typename, buf1), args);
 }
 
+static struct ttnam *
+find_typename(int type) {
+	int i;
+
+	for (i = 0; i < TYPENAMES; i++) {
+		if (typenames[i].typename[0] != 0 &&
+		    typenames[i].type == type)
+			return (&typenames[i]);
+	}
+	return (NULL);
+}
+
 void
 insert_into_typenames(int type, const char *typename, const char *attr) {
-	struct ttnam *ttn;
-	int c;
+	struct ttnam *ttn = NULL;
+	int c, i;
 	char tmp[256];
 
-	ttn = &typenames[type];
-	if (ttn->typename[0] == 0) {
-		if (strlen(typename) > sizeof(ttn->typename) - 1) {
-			fprintf(stderr, "Error:  type name %s is too long\n",
-				typename);
+	for (i = 0; i < TYPENAMES; i++) {
+		if (typenames[i].typename[0] != 0 &&
+		    typenames[i].type == type &&
+		    strcmp(typename, typenames[i].typename) != 0) {
+			fprintf(stderr,
+				"Error:  type %d has two names: %s, %s\n",
+				type, typenames[i].typename, typename);
 			exit(1);
 		}
-		strlcpy(ttn->typename, typename, sizeof(ttn->typename));
-	} else if (strcmp(typename, ttn->typename) != 0) {
-		fprintf(stderr, "Error:  type %d has two names: %s, %s\n",
-			type, ttn->typename, typename);
+		if (typenames[i].typename[0] == 0 && ttn == NULL)
+			ttn = &typenames[i];
+	}
+	if (ttn == NULL) {
+		fprintf(stderr, "Error: typenames array too small\n");
 		exit(1);
 	}
 
+	if (strlen(typename) > sizeof(ttn->typename) - 1) {
+		fprintf(stderr, "Error:  type name %s is too long\n",
+			typename);
+		exit(1);
+	}
+	strlcpy(ttn->typename, typename, sizeof(ttn->typename));
+	ttn->type = type;
+
 	strlcpy(ttn->macroname, ttn->typename, sizeof(ttn->macroname));
 	c = strlen(ttn->macroname);
 	while (c > 0) {
@@ -320,6 +348,8 @@ insert_into_typenames(int type, const char *typename, const char *attr) {
 	}
 	strlcpy(ttn->attr, attr, sizeof(ttn->attr));
 	ttn->sorted = 0;
+	if (maxtype < type)
+		maxtype = type;
 }
 
 void
@@ -469,7 +499,7 @@ main(int argc, char **argv) {
 	char *file = NULL;
 	isc_dir_t dir;
 
-	for (i = 0 ; i <= 255 ; i++)
+	for (i = 0; i < TYPENAMES ; i++)
 		memset(&typenames[i], 0, sizeof(typenames[i]));
 
 	strlcpy(srcdir, "", sizeof(srcdir));
@@ -596,7 +626,7 @@ main(int argc, char **argv) {
 		 * attributes.
 		 */
 
-#define PRINT_COMMA(x) (x == 255 ? "" : ",")
+#define PRINT_COMMA(x) (x == maxtype ? "" : ",")
 
 #define METANOTQUESTION  "DNS_RDATATYPEATTR_META | " \
 			 "DNS_RDATATYPEATTR_NOTQUESTION"
@@ -626,9 +656,9 @@ main(int argc, char **argv) {
 		fprintf(stdout, "\tunsigned int flags;\n");
 		fprintf(stdout, "} typeattr_t;\n");
 		fprintf(stdout, "static typeattr_t typeattr[] = {\n");
-		for (i = 0 ; i <= 255 ; i++) {
-			ttn = &typenames[i];
-			if (ttn->typename[0] == 0) {
+		for (i = 0; i <= maxtype ; i++) {
+			ttn = find_typename(i);
+			if (ttn == NULL) {
 				const char *attrs;
 				if (i >= 128 && i < 255)
 					attrs = "DNS_RDATATYPEATTR_UNKNOWN | "
@@ -636,7 +666,7 @@ main(int argc, char **argv) {
 				else
 					attrs = "DNS_RDATATYPEATTR_UNKNOWN";
 				fprintf(stdout, "\t{ \"TYPE%d\", %s}%s\n",
-				       i, attrs, PRINT_COMMA(i));
+					i, attrs, PRINT_COMMA(i));
 			} else {
 				fprintf(stdout, "\t{ \"%s\", %s }%s\n",
 				       upper(ttn->typename),
@@ -647,16 +677,6 @@ main(int argc, char **argv) {
 		fprintf(stdout, "};\n");
 
 		/*
-		 * Run through the list of types and pre-mark the unused
-		 * ones as "sorted" so we simply ignore them below.
-		 */
-		for (i = 0 ; i <= 255 ; i++) {
-			ttn = &typenames[i];
-			if (ttn->typename[0] == 0)
-				ttn->sorted = 1;
-		}
-
-		/*
 		 * Spit out a quick and dirty hash function.  Here,
 		 * we walk through the list of type names, and calculate
 		 * a hash.  This isn't perfect, but it will generate "pretty
@@ -682,8 +702,10 @@ main(int argc, char **argv) {
 		fprintf(stdout, "#define RDATATYPE_FROMTEXT_SW(_hash,"
 				"_typename,_length,_typep) \\\n");
 		fprintf(stdout, "\tswitch (_hash) { \\\n");
-		for (i = 0 ; i <= 255 ; i++) {
-			ttn = &typenames[i];
+		for (i = 0; i <= maxtype ; i++) {
+			ttn = find_typename(i);
+			if (ttn == NULL)
+				continue;
 
 			/*
 			 * Skip entries we already processed.
@@ -698,15 +720,15 @@ main(int argc, char **argv) {
 			 * Find all other entries that happen to match
 			 * this hash.
 			 */
-			for (j = 0 ; j <= 255 ; j++) {
-				ttn2 = &typenames[j];
-				if (ttn2->sorted != 0)
+			for (j = 0; j <= maxtype ; j++) {
+				ttn2 = find_typename(j);
+				if (ttn2 == NULL)
 					continue;
 				if (hash == HASH(ttn2->typename)) {
 					fprintf(stdout, "\t\t\tRDATATYPE_COMPARE"
 					       "(\"%s\", %u, "
 					       "_typename, _length, _typep); \\\n",
-					       ttn2->typename, j);
+					       ttn2->typename, ttn2->type);
 					ttn2->sorted = 1;
 				}
 			}
@@ -750,7 +772,7 @@ main(int argc, char **argv) {
 					"#define dns_rdatatype_%s\t%s"
 					"((dns_rdatatype_t)dns_rdatatype_%s)"
 					"\n",
-					s, strlen(s) < 2 ? "\t" : "", s);
+					s, strlen(s) < 2U ? "\t" : "", s);
 				lasttype = tt->type;
 			}
 
diff --git a/usr.sbin/bind/lib/dns/include/dns/adb.h b/usr.sbin/bind/lib/dns/include/dns/adb.h
index da0628c6955..956596b3db4 100644
--- a/usr.sbin/bind/lib/dns/include/dns/adb.h
+++ b/usr.sbin/bind/lib/dns/include/dns/adb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: adb.h,v 1.66.2.3 2002/08/05 06:57:13 marka Exp $ */
+/* $ISC: adb.h,v 1.66.2.5 2003/07/22 04:03:45 marka Exp $ */
 
 #ifndef DNS_ADB_H
 #define DNS_ADB_H 1
@@ -147,9 +147,9 @@ struct dns_adbfind {
  *	If set, fetches will not be generated unless no addresses are
  *	available in any of the address families requested.
  *
- * _STARTATROOT:
- *	Fetches will start at the root nameservers, instead of the closest
- *	ancestor.  This is useful for reestablishing glue that has expired.
+ * _STARTATZONE:
+ *	Fetches will start using the closest zone data or use the root servers.
+ *	This is useful for reestablishing glue that has expired.
  *
  * _GLUEOK:
  * _HINTOK:
@@ -170,7 +170,7 @@ struct dns_adbfind {
 #define DNS_ADBFIND_EMPTYEVENT		0x00000004
 #define DNS_ADBFIND_WANTEVENT		0x00000008
 #define DNS_ADBFIND_AVOIDFETCHES	0x00000010
-#define DNS_ADBFIND_STARTATROOT		0x00000020
+#define DNS_ADBFIND_STARTATZONE		0x00000020
 #define DNS_ADBFIND_GLUEOK		0x00000040
 #define DNS_ADBFIND_HINTOK		0x00000080
 #define DNS_ADBFIND_RETURNLAME		0x00000100
diff --git a/usr.sbin/bind/lib/dns/include/dns/byaddr.h b/usr.sbin/bind/lib/dns/include/dns/byaddr.h
index c99afdcf380..f59f2e8fe49 100644
--- a/usr.sbin/bind/lib/dns/include/dns/byaddr.h
+++ b/usr.sbin/bind/lib/dns/include/dns/byaddr.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: byaddr.h,v 1.12 2001/01/09 21:52:18 bwelling Exp $ */
+/* $ISC: byaddr.h,v 1.12.2.2 2003/10/09 07:32:39 marka Exp $ */
 
 #ifndef DNS_BYADDR_H
 #define DNS_BYADDR_H 1
@@ -69,6 +69,7 @@ typedef struct dns_byaddrevent {
 } dns_byaddrevent_t;
 
 #define DNS_BYADDROPT_IPV6NIBBLE	0x0001
+#define DNS_BYADDROPT_IPV6INT		0x0002	/* Use IP6.INT nibble lookups */
 
 isc_result_t
 dns_byaddr_create(isc_mem_t *mctx, isc_netaddr_t *address, dns_view_t *view,
@@ -79,17 +80,13 @@ dns_byaddr_create(isc_mem_t *mctx, isc_netaddr_t *address, dns_view_t *view,
  *
  * Notes:
  *
- *	There are two reverse lookup formats for IPv6 addresses, 'bitstring'
- *	and 'nibble'.  The newer 'bitstring' format for the address fe80::1 is
- *
- *		\[xfe800000000000000000000000000001].ip6.int.
+ *	There is a reverse lookup format for IPv6 addresses, 'nibble'
  *
  *	The 'nibble' format for that address is
  *
- *   1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.int.
+ *   1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
  *
- *	The 'bitstring' format will be used unless the DNS_BYADDROPT_IPV6NIBBLE
- *	option has been set.
+ *	DNS_BYADDROPT_IPV6INT can be used to get nibble lookups under ip6.int.
  *
  * Requires:
  *
@@ -147,10 +144,15 @@ dns_byaddr_destroy(dns_byaddr_t **byaddrp);
 isc_result_t
 dns_byaddr_createptrname(isc_netaddr_t *address, isc_boolean_t nibble,
 			 dns_name_t *name);
+
+isc_result_t
+dns_byaddr_createptrname2(isc_netaddr_t *address, unsigned int options,
+			  dns_name_t *name);
 /*
  * Creates a name that would be used in a PTR query for this address.  The
  * nibble flag indicates that the 'nibble' format is to be used if an IPv6
- * address is provided, instead of the 'bitstring' format.
+ * address is provided, instead of the 'bitstring' format.  'options' are
+ * the same as for dns_byaddr_create().
  *
  * Requires:
  * 
diff --git a/usr.sbin/bind/lib/dns/include/dns/db.h b/usr.sbin/bind/lib/dns/include/dns/db.h
index 02e97bf3a98..2eb32304ee7 100644
--- a/usr.sbin/bind/lib/dns/include/dns/db.h
+++ b/usr.sbin/bind/lib/dns/include/dns/db.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: db.h,v 1.67 2001/08/28 03:58:13 marka Exp $ */
+/* $ISC: db.h,v 1.67.2.2 2003/10/09 07:32:39 marka Exp $ */
 
 #ifndef DNS_DB_H
 #define DNS_DB_H 1
@@ -598,8 +598,7 @@ dns_db_findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
  *
  *	'db' is a valid database.
  *
- *	'name' is a valid, non-empty, absolute name that is a subdomain of
- *	the database's origin.  (It need not be a proper subdomain.)
+ *	'name' is a valid, non-empty, absolute name.
  *
  *	nodep != NULL && *nodep == NULL
  *
diff --git a/usr.sbin/bind/lib/dns/include/dns/dispatch.h b/usr.sbin/bind/lib/dns/include/dns/dispatch.h
index cbe3ab9908d..643b2bbcd52 100644
--- a/usr.sbin/bind/lib/dns/include/dns/dispatch.h
+++ b/usr.sbin/bind/lib/dns/include/dns/dispatch.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dispatch.h,v 1.45.22.2 2003/02/17 07:05:10 marka Exp $ */
+/* $ISC: dispatch.h,v 1.45.2.2 2003/03/06 04:38:22 marka Exp $ */
 
 #ifndef DNS_DISPATCH_H
 #define DNS_DISPATCH_H 1
diff --git a/usr.sbin/bind/lib/dns/include/dns/events.h b/usr.sbin/bind/lib/dns/include/dns/events.h
index 913a571782a..d2ecbd14d0a 100644
--- a/usr.sbin/bind/lib/dns/include/dns/events.h
+++ b/usr.sbin/bind/lib/dns/include/dns/events.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: events.h,v 1.37 2001/02/13 02:49:07 gson Exp $ */
+/* $ISC: events.h,v 1.37.2.1 2002/09/04 02:47:08 jinmei Exp $ */
 
 #ifndef DNS_EVENTS_H
 #define DNS_EVENTS_H 1
@@ -60,6 +60,7 @@
 #define DNS_EVENT_QUERYABORTED			(ISC_EVENTCLASS_DNS + 31)
 #define DNS_EVENT_DISPATCHCONTROL		(ISC_EVENTCLASS_DNS + 32)
 #define DNS_EVENT_REQUESTCONTROL		(ISC_EVENTCLASS_DNS + 33)
+#define DNS_EVENT_IMPORTRECVDONE		(ISC_EVENTCLASS_DNS + 35)
 
 #define DNS_EVENT_FIRSTEVENT			(ISC_EVENTCLASS_DNS + 0)
 #define DNS_EVENT_LASTEVENT			(ISC_EVENTCLASS_DNS + 65535)
diff --git a/usr.sbin/bind/lib/dns/include/dns/log.h b/usr.sbin/bind/lib/dns/include/dns/log.h
index 38f1c3372b5..a52a62aa210 100644
--- a/usr.sbin/bind/lib/dns/include/dns/log.h
+++ b/usr.sbin/bind/lib/dns/include/dns/log.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: log.h,v 1.30.2.1 2001/10/11 02:03:23 marka Exp $ */
+/* $ISC: log.h,v 1.30.2.3 2003/10/09 07:32:39 marka Exp $ */
 
 /* Principal Authors: DCL */
 
diff --git a/usr.sbin/bind/lib/dns/include/dns/master.h b/usr.sbin/bind/lib/dns/include/dns/master.h
index 367cbcd68cc..54b1903d1d1 100644
--- a/usr.sbin/bind/lib/dns/include/dns/master.h
+++ b/usr.sbin/bind/lib/dns/include/dns/master.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: master.h,v 1.31.2.1 2001/09/04 22:51:41 gson Exp $ */
+/* $ISC: master.h,v 1.31.2.3 2003/07/22 04:03:45 marka Exp $ */
 
 #ifndef DNS_MASTER_H
 #define DNS_MASTER_H 1
@@ -37,6 +37,7 @@
 #define DNS_MASTER_MANYERRORS 	0x00000002	/* Continue processing on errors. */
 #define DNS_MASTER_NOINCLUDE 	0x00000004	/* Disallow $INCLUDE directives. */
 #define DNS_MASTER_ZONE 	0x00000008	/* Loading a zone master file. */
+#define DNS_MASTER_SLAVE	0x00000020	/* Loading a slave master file. */
 
 ISC_LANG_BEGINDECLS
 
diff --git a/usr.sbin/bind/lib/dns/include/dns/name.h b/usr.sbin/bind/lib/dns/include/dns/name.h
index 9f358b88af6..ab0750d158e 100644
--- a/usr.sbin/bind/lib/dns/include/dns/name.h
+++ b/usr.sbin/bind/lib/dns/include/dns/name.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: name.h,v 1.95.2.2 2002/04/23 02:28:51 marka Exp $ */
+/* $ISC: name.h,v 1.95.2.4 2003/10/09 07:32:39 marka Exp $ */
 
 #ifndef DNS_NAME_H
 #define DNS_NAME_H 1
@@ -390,6 +390,22 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive);
  *	A hash value
  */
 
+unsigned int
+dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive);
+/*
+ * Provide a hash value for 'name'.  Unlike dns_name_hash(), this function
+ * always takes into account of the entire name to calculate the hash value.
+ *
+ * Note: if 'case_sensitive' is ISC_FALSE, then names which differ only in
+ * case will have the same hash value.
+ *
+ * Requires:
+ *	'name' is a valid name
+ *
+ * Returns:
+ *	A hash value
+ */
+
 /***
  *** Comparisons
  ***/
diff --git a/usr.sbin/bind/lib/dns/include/dns/rdata.h b/usr.sbin/bind/lib/dns/include/dns/rdata.h
index 36f393a0125..0e482b97e9f 100644
--- a/usr.sbin/bind/lib/dns/include/dns/rdata.h
+++ b/usr.sbin/bind/lib/dns/include/dns/rdata.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rdata.h,v 1.51.2.2 2002/02/20 02:17:25 marka Exp $ */
+/* $ISC: rdata.h,v 1.51.2.4 2003/10/09 07:32:39 marka Exp $ */
 
 #ifndef DNS_RDATA_H
 #define DNS_RDATA_H 1
@@ -468,10 +468,6 @@ dns_rdatatype_ismeta(dns_rdatatype_t type);
 /*
  * Return true iff the rdata type 'type' is a meta-type
  * like ANY or AXFR.
- *
- * Requires:
- * 	'type' is a valid rdata type.
- *
  */
 
 isc_boolean_t
@@ -490,10 +486,6 @@ dns_rdataclass_ismeta(dns_rdataclass_t rdclass);
 /*
  * Return true iff the rdata class 'rdclass' is a meta-class
  * like ANY or NONE.
- *
- * Requires:
- * 	'rdclass' is a valid rdata class.
- *
  */
 
 isc_boolean_t
diff --git a/usr.sbin/bind/lib/dns/include/dns/rdataset.h b/usr.sbin/bind/lib/dns/include/dns/rdataset.h
index 47ddd524618..de0d5d43560 100644
--- a/usr.sbin/bind/lib/dns/include/dns/rdataset.h
+++ b/usr.sbin/bind/lib/dns/include/dns/rdataset.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rdataset.h,v 1.41.2.2 2002/04/23 02:28:52 marka Exp $ */
+/* $ISC: rdataset.h,v 1.41.2.5 2003/07/22 04:03:45 marka Exp $ */
 
 #ifndef DNS_RDATASET_H
 #define DNS_RDATASET_H 1
@@ -104,7 +104,7 @@ struct dns_rdataset {
 	void *				private1;
 	void *				private2;
 	void *				private3;
-	void *				private4;
+	unsigned int			privateuint4;
 	void *				private5;
 };
 
@@ -129,6 +129,7 @@ struct dns_rdataset {
 #define DNS_RDATASETATTR_FIXEDORDER	0x0400
 #define DNS_RDATASETATTR_RANDOMIZE	0x0800
 #define DNS_RDATASETATTR_CHASE		0x1000		/* Used by resolver. */
+#define DNS_RDATASETATTR_NXDOMAIN	0x2000
 
 void
 dns_rdataset_init(dns_rdataset_t *rdataset);
diff --git a/usr.sbin/bind/lib/dns/include/dns/rdataslab.h b/usr.sbin/bind/lib/dns/include/dns/rdataslab.h
index 317e32f95ce..4364d05a599 100644
--- a/usr.sbin/bind/lib/dns/include/dns/rdataslab.h
+++ b/usr.sbin/bind/lib/dns/include/dns/rdataslab.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rdataslab.h,v 1.20 2001/01/09 21:53:19 bwelling Exp $ */
+/* $ISC: rdataslab.h,v 1.20.2.2 2003/07/22 04:03:45 marka Exp $ */
 
 #ifndef DNS_RDATASLAB_H
 #define DNS_RDATASLAB_H 1
@@ -121,7 +121,8 @@ isc_boolean_t
 dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
 		    unsigned int reservelen);
 
-/* Compare two rdataslabs for equality.  This does _not_ do a full
+/*
+ * Compare two rdataslabs for equality.  This does _not_ do a full
  * DNSSEC comparison.
  *
  * Requires:
@@ -131,6 +132,20 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
  *	ISC_TRUE if the slabs are equal, ISC_FALSE otherwise.
  */
 
+isc_boolean_t
+dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
+		     unsigned int reservelen, dns_rdataclass_t rdclass, 
+		     dns_rdatatype_t type);
+/*
+ * Compare two rdataslabs for DNSSEC equality. 
+ *
+ * Requires:
+ *	'slab1' and 'slab2' point to slabs.
+ *
+ * Returns:
+ *	ISC_TRUE if the slabs are equal, ISC_FALSE otherwise.
+ */
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_RDATASLAB_H */
diff --git a/usr.sbin/bind/lib/dns/include/dns/result.h b/usr.sbin/bind/lib/dns/include/dns/result.h
index fae450fccab..bebf75ede29 100644
--- a/usr.sbin/bind/lib/dns/include/dns/result.h
+++ b/usr.sbin/bind/lib/dns/include/dns/result.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: result.h,v 1.81.2.3 2002/03/26 00:55:02 marka Exp $ */
+/* $ISC: result.h,v 1.81.2.7 2003/07/22 04:03:46 marka Exp $ */
 
 #ifndef DNS_RESULT_H
 #define DNS_RESULT_H 1
@@ -120,9 +120,11 @@
 #define DNS_R_FROZEN			(ISC_RESULTCLASS_DNS + 81)
 #define DNS_R_UNKNOWNFLAG		(ISC_RESULTCLASS_DNS + 82)
 #define DNS_R_EXPECTEDRESPONSE		(ISC_RESULTCLASS_DNS + 83)
+#define DNS_R_EMPTYNAME			(ISC_RESULTCLASS_DNS + 92)
+#define DNS_R_EMPTYWILD			(ISC_RESULTCLASS_DNS + 93)
+#define DNS_R_BADBITMAP			(ISC_RESULTCLASS_DNS + 94)
 
-
-#define DNS_R_NRESULTS			84	/* Number of results */
+#define DNS_R_NRESULTS			95	/* Number of results */
 
 /*
  * DNS wire format rcodes.
diff --git a/usr.sbin/bind/lib/dns/include/dns/view.h b/usr.sbin/bind/lib/dns/include/dns/view.h
index da264d8fcaa..dd465d09089 100644
--- a/usr.sbin/bind/lib/dns/include/dns/view.h
+++ b/usr.sbin/bind/lib/dns/include/dns/view.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: view.h,v 1.73.2.2 2002/08/05 06:57:13 marka Exp $ */
+/* $ISC: view.h,v 1.73.2.7 2003/09/19 14:10:31 marka Exp $ */
 
 #ifndef DNS_VIEW_H
 #define DNS_VIEW_H 1
@@ -119,6 +119,8 @@ struct dns_view {
 	dns_aclenv_t			aclenv;
 	isc_boolean_t			flush;
 	dns_namelist_t *		delonly;
+	isc_boolean_t			rootdelonly;
+	dns_namelist_t *		rootexclude;
 
 	/*
 	 * Configurable data for server use only,
@@ -513,6 +515,12 @@ dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 		     isc_stdtime_t now, unsigned int options,
 		     isc_boolean_t use_hints,
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
+
+isc_result_t
+dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
+		      isc_stdtime_t now, unsigned int options,
+		      isc_boolean_t use_hints, isc_boolean_t use_cache,
+		      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
 /*
  * Find the best known zonecut containing 'name'.
  *
@@ -526,6 +534,9 @@ dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
  *	If 'use_hints' is ISC_TRUE, and the view has a hints database, then
  *	it will be searched last.
  *
+ *	If 'use_cache' is ISC_TRUE, and the view has a cache, then it will be
+ *	searched.
+ *
  *	If 'sigrdataset' is not NULL, and there is a SIG rdataset which
  *	covers 'type', then 'sigrdataset' will be bound to it.
  *
@@ -696,6 +707,22 @@ isc_result_t
 dns_view_adddelegationonly(dns_view_t *view, dns_name_t *name);
 /*
  * Add the given name to the delegation only table.
+ * 
+ *
+ * Requires:
+ *	'view' is valid.
+ *	'name' is valid.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_NOMEMORY
+ */
+
+isc_result_t
+dns_view_excludedelegationonly(dns_view_t *view, dns_name_t *name);
+/*
+ * Add the given name to be excluded from the root-delegation-only.
+ * 
  *
  * Requires:
  *	'view' is valid.
@@ -709,7 +736,8 @@ dns_view_adddelegationonly(dns_view_t *view, dns_name_t *name);
 isc_boolean_t
 dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name);
 /*
- * Check if 'name' is in the delegation only table.
+ * Check if 'name' is in the delegation only table or if
+ * rootdelonly is set that name is not being excluded.
  *
  * Requires:
  *	'view' is valid.
@@ -720,7 +748,22 @@ dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name);
  *	ISC_FALSE othewise.
  */
 
+void
+dns_view_setrootdelonly(dns_view_t *view, isc_boolean_t value);
+/*
+ * Set the root delegation only flag.
+ *
+ * Requires:
+ *	'view' is valid.
+ */
 
-ISC_LANG_ENDDECLS
+isc_boolean_t
+dns_view_getrootdelonly(dns_view_t *view);
+/*
+ * Get the root delegation only flag.
+ *
+ * Requires:
+ *	'view' is valid.
+ */
 
 #endif /* DNS_VIEW_H */
diff --git a/usr.sbin/bind/lib/dns/include/dns/zone.h b/usr.sbin/bind/lib/dns/include/dns/zone.h
index 110155014bd..4808a476453 100644
--- a/usr.sbin/bind/lib/dns/include/dns/zone.h
+++ b/usr.sbin/bind/lib/dns/include/dns/zone.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: zone.h,v 1.106.2.5.4.2 2003/02/17 07:05:10 marka Exp $ */
+/* $ISC: zone.h,v 1.106.2.7 2003/03/06 04:38:22 marka Exp $ */
 
 #ifndef DNS_ZONE_H
 #define DNS_ZONE_H 1
diff --git a/usr.sbin/bind/lib/dns/log.c b/usr.sbin/bind/lib/dns/log.c
index c34cfc51eee..d2dcc08c4db 100644
--- a/usr.sbin/bind/lib/dns/log.c
+++ b/usr.sbin/bind/lib/dns/log.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: log.c,v 1.33.2.2 2001/10/11 23:07:00 gson Exp $ */
+/* $ISC: log.c,v 1.33.2.4 2003/10/09 07:32:37 marka Exp $ */
 
 /* Principal Authors: DCL */
 
diff --git a/usr.sbin/bind/lib/dns/master.c b/usr.sbin/bind/lib/dns/master.c
index 4e084bfe55b..10c46d57f25 100644
--- a/usr.sbin/bind/lib/dns/master.c
+++ b/usr.sbin/bind/lib/dns/master.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: master.c,v 1.122.2.5 2002/03/20 19:15:13 marka Exp $ */
+/* $ISC: master.c,v 1.122.2.8 2003/07/22 04:03:41 marka Exp $ */
 
 #include <config.h>
 
@@ -24,6 +24,7 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/print.h>
+#include <isc/serial.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
 #include <isc/task.h>
@@ -690,7 +691,10 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 		if (result != ISC_R_SUCCESS)
 			goto error_cleanup;
 
-		if (!dns_name_issubdomain(owner, lctx->top)) {
+		if ((lctx->options & DNS_MASTER_ZONE) != 0 &&
+		    (lctx->options & DNS_MASTER_SLAVE) == 0 &&
+		    !dns_name_issubdomain(owner, lctx->top))
+		{
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(owner, namebuf, sizeof(namebuf));
 			/*
@@ -1218,7 +1222,10 @@ load(dns_loadctx_t *lctx) {
 							target_size);
 				}
 			}
-			if (!dns_name_issubdomain(new_name, lctx->top)) {
+			if ((lctx->options & DNS_MASTER_ZONE) != 0 &&
+			    (lctx->options & DNS_MASTER_SLAVE) == 0 &&
+			    !dns_name_issubdomain(new_name, lctx->top))
+			{
 				char namebuf[DNS_NAME_FORMATSIZE];
 				dns_name_format(new_name, namebuf,
 						sizeof(namebuf));
@@ -1474,7 +1481,7 @@ load(dns_loadctx_t *lctx) {
 		if (type == dns_rdatatype_sig && lctx->warn_sigexpired) {
 			dns_rdata_sig_t sig;
 			(void)dns_rdata_tostruct(&rdata[rdcount], &sig, NULL);
-			if (now > sig.timeexpire) {
+			if (isc_serial_lt(sig.timeexpire, now)) {
 				(*callbacks->warn)(callbacks,
 						   "%s: %s:%lu: "
 						   "signature has expired",
diff --git a/usr.sbin/bind/lib/dns/masterdump.c b/usr.sbin/bind/lib/dns/masterdump.c
index 1cd5bf433b8..80b337b7e5f 100644
--- a/usr.sbin/bind/lib/dns/masterdump.c
+++ b/usr.sbin/bind/lib/dns/masterdump.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: masterdump.c,v 1.56.2.2 2001/10/30 01:53:24 marka Exp $ */
+/* $ISC: masterdump.c,v 1.56.2.5 2003/07/22 04:03:41 marka Exp $ */
 
 #include <config.h>
 
@@ -124,6 +124,7 @@ typedef struct dns_totext_ctx {
 	char *			linebreak;
 	char 			linebreak_buf[DNS_TOTEXT_LINEBREAK_MAXLEN];
 	dns_name_t *		origin;
+	dns_name_t *		neworigin;
 	dns_fixedname_t		origin_fixname;
 	isc_uint32_t 		current_ttl;
 	isc_boolean_t 		current_ttl_valid;
@@ -186,7 +187,7 @@ static char spaces[N_SPACES+1] = "          ";
 #define N_TABS 10
 static char tabs[N_TABS+1] = "\t\t\t\t\t\t\t\t\t\t";
 
-
+#define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
 
 /*
  * Output tabs and spaces to go from column '*current' to
@@ -306,6 +307,7 @@ totext_ctx_init(const dns_master_style_t *style, dns_totext_ctx_t *ctx) {
 	}
 
 	ctx->origin = NULL;
+	ctx->neworigin = NULL;
 	ctx->current_ttl = 0;
 	ctx->current_ttl_valid = ISC_FALSE;
 
@@ -458,7 +460,10 @@ rdataset_totext(dns_rdataset_t *rdataset,
 		 */
 		INDENT_TO(rdata_column);
 		if (rdataset->type == 0) {
-			RETERR(str_totext(";-$\n", target));
+			if (NXDOMAIN(rdataset))
+				RETERR(str_totext(";-$NXDOMAIN\n", target));
+			else
+				RETERR(str_totext(";-$NXRRSET\n", target));
 		} else {
 			dns_rdata_t rdata = DNS_RDATA_INIT;
 			isc_region_t r;
@@ -786,6 +791,7 @@ dump_rdatasets(isc_mem_t *mctx, dns_name_t *name, dns_rdatasetiter_t *rdsiter,
 	       isc_buffer_t *buffer, FILE *f)
 {
 	isc_result_t itresult, dumpresult;
+	isc_region_t r;
 	dns_rdataset_t rdatasets[MAXSORT];
 	dns_rdataset_t *sorted[MAXSORT];
 	int i, n;
@@ -793,6 +799,15 @@ dump_rdatasets(isc_mem_t *mctx, dns_name_t *name, dns_rdatasetiter_t *rdsiter,
 	itresult = dns_rdatasetiter_first(rdsiter);
 	dumpresult = ISC_R_SUCCESS;
 
+	if (itresult == ISC_R_SUCCESS && ctx->neworigin != NULL) {
+		isc_buffer_clear(buffer);
+		itresult = dns_name_totext(ctx->neworigin, ISC_FALSE, buffer);
+		RUNTIME_CHECK(itresult == ISC_R_SUCCESS);
+		isc_buffer_usedregion(buffer, &r);
+		fprintf(f, "$ORIGIN %.*s\n", (int) r.length, (char *) r.base);
+		ctx->neworigin = NULL;
+	}
+
  again:
 	for (i = 0;
 	     itresult == ISC_R_SUCCESS && i < MAXSORT;
@@ -929,14 +944,9 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db,
 				dns_fixedname_name(&ctx.origin_fixname);
 			result = dns_dbiterator_origin(dbiter, origin);
 			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			isc_buffer_clear(&buffer);
-			result = dns_name_totext(origin, ISC_FALSE, &buffer);
-			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			isc_buffer_usedregion(&buffer, &r);
-			fprintf(f, "$ORIGIN %.*s\n", (int) r.length,
-				(char *) r.base);
 			if ((ctx.style.flags & DNS_STYLEFLAG_REL_DATA) != 0)
 				ctx.origin = origin;
+			ctx.neworigin = origin;
 		}
 		result = dns_db_allrdatasets(db, node, version, now, &rdsiter);
 		if (result != ISC_R_SUCCESS) {
diff --git a/usr.sbin/bind/lib/dns/message.c b/usr.sbin/bind/lib/dns/message.c
index 5ce0157eba1..8801655297d 100644
--- a/usr.sbin/bind/lib/dns/message.c
+++ b/usr.sbin/bind/lib/dns/message.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: message.c,v 1.194.2.8 2002/02/28 05:17:49 marka Exp $ */
+/* $ISC: message.c,v 1.194.2.10 2003/07/22 04:03:41 marka Exp $ */
 
 /***
  *** Imports
@@ -2922,8 +2922,7 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 			ADD_STRING(target, ";; OPT PSEUDOSECTION:\n");
 		ADD_STRING(target, "; EDNS: version: ");
 		snprintf(buf, sizeof(buf), "%u",
-			 (unsigned int)((ps->ttl &
-					0x00ff0000 >> 16)));
+			 (unsigned int)((ps->ttl & 0x00ff0000) >> 16));
 		ADD_STRING(target, buf);
 		ADD_STRING(target, ", flags:");
 		if ((ps->ttl & DNS_MESSAGEEXTFLAG_DO) != 0)
diff --git a/usr.sbin/bind/lib/dns/name.c b/usr.sbin/bind/lib/dns/name.c
index f4937ca24f8..1eb688723e2 100644
--- a/usr.sbin/bind/lib/dns/name.c
+++ b/usr.sbin/bind/lib/dns/name.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,13 +15,14 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: name.c,v 1.127.2.5 2002/08/02 00:33:05 marka Exp $ */
+/* $ISC: name.c,v 1.127.2.8 2003/10/09 07:32:37 marka Exp $ */
 
 #include <config.h>
 
 #include <ctype.h>
 
 #include <isc/buffer.h>
+#include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/string.h>
@@ -461,6 +462,20 @@ dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
 	return (h);
 }
 
+unsigned int
+dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
+	/*
+	 * Provide a hash value for 'name'.
+	 */
+	REQUIRE(VALID_NAME(name));
+
+	if (name->labels == 0)
+		return (0);
+
+	return (isc_hash_calc((const unsigned char *)name->ndata,
+			      name->length, case_sensitive));
+}
+
 dns_namereln_t
 dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 		     int *orderp,
@@ -1807,7 +1822,7 @@ dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 				count = 256;
 			nlen--;
 			len = snprintf(num, sizeof(num), "%u", count);
-			INSIST(len <= 4);
+			INSIST(len <= 4U);
 			bytes = count / 8;
 			if (count % 8 != 0)
 				bytes++;
@@ -1960,7 +1975,7 @@ dns_name_tofilenametext(dns_name_t *name, isc_boolean_t omit_final_dot,
 				count = 256;
 			nlen--;
 			len = snprintf(num, sizeof(num), "%u", count);
-			INSIST(len <= 4);
+			INSIST(len <= 4U);
 			bytes = count / 8;
 			if (count % 8 != 0)
 				bytes++;
diff --git a/usr.sbin/bind/lib/dns/ncache.c b/usr.sbin/bind/lib/dns/ncache.c
index 8ec80415d65..8ae87e5920f 100644
--- a/usr.sbin/bind/lib/dns/ncache.c
+++ b/usr.sbin/bind/lib/dns/ncache.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: ncache.c,v 1.24.2.2 2002/02/08 03:57:29 marka Exp $ */
+/* $ISC: ncache.c,v 1.24.2.5 2003/09/17 05:20:01 marka Exp $ */
 
 #include <config.h>
 
@@ -249,6 +249,8 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	dns_rdataset_init(&ncrdataset);
 	dns_rdatalist_tordataset(&ncrdatalist, &ncrdataset);
 	ncrdataset.trust = trust;
+	if (message->rcode == dns_rcode_nxdomain)
+		ncrdataset.attributes |= DNS_RDATASETATTR_NXDOMAIN;
 
 	return (dns_db_addrdataset(cache, node, NULL, now, &ncrdataset,
 				   0, addedrdataset));
diff --git a/usr.sbin/bind/lib/dns/nxt.c b/usr.sbin/bind/lib/dns/nxt.c
index 4a531ddf286..00c67f291cd 100644
--- a/usr.sbin/bind/lib/dns/nxt.c
+++ b/usr.sbin/bind/lib/dns/nxt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: nxt.c,v 1.26 2001/01/09 21:51:09 bwelling Exp $ */
+/* $ISC: nxt.c,v 1.26.2.2 2003/10/09 07:32:37 marka Exp $ */
 
 #include <config.h>
 
@@ -119,7 +119,7 @@ dns_nxt_buildrdata(dns_db_t *db, dns_dbversion_t *version,
 	if (result != ISC_R_NOMORE)
 		return (result);
 
-	r.length += ((max_type + 7) / 8);
+	r.length += max_type / 8 + 1;
 	INSIST(r.length <= DNS_NXT_BUFFERSIZE);
 	dns_rdata_fromregion(rdata,
 			     dns_db_class(db),
diff --git a/usr.sbin/bind/lib/dns/rbt.c b/usr.sbin/bind/lib/dns/rbt.c
index 3dd6ce5fc34..25ec29ca270 100644
--- a/usr.sbin/bind/lib/dns/rbt.c
+++ b/usr.sbin/bind/lib/dns/rbt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rbt.c,v 1.115 2001/06/04 19:33:05 tale Exp $ */
+/* $ISC: rbt.c,v 1.115.2.2 2003/07/22 04:03:42 marka Exp $ */
 
 /* Principal Authors: DCL */
 
@@ -1526,8 +1526,7 @@ dns_rbt_formatnodename(dns_rbtnode_t *node, char *printname, unsigned int size)
 	if (result == ISC_R_SUCCESS)
 		dns_name_format(name, printname, size);
 	else
-		snprintf(printname, size,
-			 "<error building name: %s>",
+		snprintf(printname, size, "<error building name: %s>",
 			 dns_result_totext(result));
 
 	return (printname);
diff --git a/usr.sbin/bind/lib/dns/rbtdb.c b/usr.sbin/bind/lib/dns/rbtdb.c
index a54adfbc197..0dfa06c90e4 100644
--- a/usr.sbin/bind/lib/dns/rbtdb.c
+++ b/usr.sbin/bind/lib/dns/rbtdb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rbtdb.c,v 1.168.2.3 2002/08/05 06:57:11 marka Exp $ */
+/* $ISC: rbtdb.c,v 1.168.2.13 2003/10/17 05:39:44 marka Exp $ */
 
 /*
  * Principal Author: Bob Halley
@@ -84,7 +84,7 @@ typedef isc_uint32_t			rbtdb_rdatatype_t;
 		RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_cname)
 #define RBTDB_RDATATYPE_SIGDNAME \
 		RBTDB_RDATATYPE_VALUE(dns_rdatatype_sig, dns_rdatatype_dname)
-#define RBTDB_RDATATYPE_NXDOMAIN \
+#define RBTDB_RDATATYPE_NCACHEANY \
 		RBTDB_RDATATYPE_VALUE(0, dns_rdatatype_any)
 
 typedef struct rdatasetheader {
@@ -108,6 +108,7 @@ typedef struct rdatasetheader {
 #define RDATASET_ATTR_STALE		0x0002
 #define RDATASET_ATTR_IGNORE		0x0004
 #define RDATASET_ATTR_RETAIN		0x0008
+#define RDATASET_ATTR_NXDOMAIN		0x0010
 
 /*
  * XXX
@@ -127,6 +128,8 @@ typedef struct rdatasetheader {
 	(((header)->attributes & RDATASET_ATTR_IGNORE) != 0)
 #define RETAIN(header) \
 	(((header)->attributes & RDATASET_ATTR_RETAIN) != 0)
+#define NXDOMAIN(header) \
+	(((header)->attributes & RDATASET_ATTR_NXDOMAIN) != 0)
 
 #define DEFAULT_NODE_LOCK_COUNT		7		/* Should be prime. */
 
@@ -167,6 +170,7 @@ typedef struct {
 	rbtdb_nodelock_t *	       	node_locks;
 	dns_rbtnode_t *			origin_node;
 	/* Locked by lock. */
+	unsigned int			active;
 	isc_refcount_t			references;
 	unsigned int			attributes;
 	rbtdb_serial_t			current_serial;
@@ -369,9 +373,10 @@ free_rbtdb(dns_rbtdb_t *rbtdb) {
 }
 
 static inline void
-maybe_free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t set_exiting) {
-	isc_boolean_t want_free = ISC_TRUE;
+maybe_free_rbtdb(dns_rbtdb_t *rbtdb) {
+	isc_boolean_t want_free = ISC_FALSE;
 	unsigned int i;
+	unsigned int inactive = 0;
 
 	/* XXX check for open versions here */
 
@@ -381,15 +386,21 @@ maybe_free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t set_exiting) {
 	 */
 	for (i = 0; i < rbtdb->node_lock_count; i++) {
 		LOCK(&rbtdb->node_locks[i].lock);
-		if (set_exiting)
-			rbtdb->node_locks[i].exiting = ISC_TRUE;
-		if (rbtdb->node_locks[i].references != 0)
-			want_free = ISC_FALSE;
+		rbtdb->node_locks[i].exiting = ISC_TRUE;
+		if (rbtdb->node_locks[i].references == 0)
+			inactive++;
 		UNLOCK(&rbtdb->node_locks[i].lock);
 	}
 
-	if (want_free)
-		free_rbtdb(rbtdb);
+	if (inactive != 0) {
+		LOCK(&rbtdb->lock);
+		rbtdb->active -= inactive;
+		if (rbtdb->active == 0)
+			want_free = ISC_TRUE;
+		UNLOCK(&rbtdb->lock);
+		if (want_free)
+			free_rbtdb(rbtdb);
+	}
 }
 
 static void
@@ -402,7 +413,7 @@ detach(dns_db_t **dbp) {
 	isc_refcount_decrement(&rbtdb->references, &refs);
 
 	if (refs == 0)
-		maybe_free_rbtdb(rbtdb, ISC_TRUE);
+		maybe_free_rbtdb(rbtdb);
 
 	*dbp = NULL;
 }
@@ -792,10 +803,10 @@ no_references(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 		 * we only do a trylock.
 		 */
 		if (lock == isc_rwlocktype_read)
-			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
-
-		result = isc_rwlock_trylock(&rbtdb->tree_lock,
-					    isc_rwlocktype_write);
+			result = isc_rwlock_tryupgrade(&rbtdb->tree_lock);
+		else
+			result = isc_rwlock_trylock(&rbtdb->tree_lock,
+						    isc_rwlocktype_write);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS ||
 			      result == ISC_R_LOCKBUSY);
  
@@ -826,12 +837,13 @@ no_references(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	/*
 	 * Relock a read lock, or unlock the write lock if no lock was held.
 	 */
-	if (lock != isc_rwlocktype_write)
+	if (lock == isc_rwlocktype_none)
 		if (write_locked)
 			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
 
 	if (lock == isc_rwlocktype_read)
-		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
+		if (write_locked)
+			isc_rwlock_downgrade(&rbtdb->tree_lock);
 }
 
 static inline void
@@ -1064,6 +1076,34 @@ add_wildcard_magic(dns_rbtdb_t *rbtdb, dns_name_t *name) {
 }
 
 static isc_result_t
+add_empty_wildcards(dns_rbtdb_t *rbtdb, dns_name_t *name) {
+	isc_result_t result;
+	dns_name_t foundname;
+	dns_offsets_t offsets;
+	unsigned int n, l, i;
+
+	dns_name_init(&foundname, offsets);
+	n = dns_name_countlabels(name);
+	l = dns_name_countlabels(&rbtdb->common.origin);
+	i = l + 1;
+	while (i < n) {
+		dns_rbtnode_t *node = NULL;	/* dummy */
+		dns_name_getlabelsequence(name, n - i, i, &foundname);
+		if (dns_name_iswildcard(&foundname)) {
+			result = add_wildcard_magic(rbtdb, &foundname);
+			if (result != ISC_R_SUCCESS)
+				return (result);
+			result = dns_rbt_addnode(rbtdb->tree, &foundname,
+						 &node);
+			if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS)
+				return (result);
+		}
+		i++;
+	}
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
 findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
 	 dns_dbnode_t **nodep)
 {
@@ -1103,6 +1143,8 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
 			node->locknum = dns_name_hash(&nodename, ISC_TRUE) %
 				rbtdb->node_lock_count;
 #endif
+			add_empty_wildcards(rbtdb, name);
+
 			if (dns_name_iswildcard(name)) {
 				result = add_wildcard_magic(rbtdb, name);
 				if (result != ISC_R_SUCCESS) {
@@ -1287,6 +1329,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	rdataset->covers = RBTDB_RDATATYPE_EXT(header->type);
 	rdataset->ttl = header->ttl - now;
 	rdataset->trust = header->trust;
+	if (NXDOMAIN(header))
+		rdataset->attributes |= DNS_RDATASETATTR_NXDOMAIN;
 	rdataset->private1 = rbtdb;
 	rdataset->private2 = node;
 	raw = (unsigned char *)header + sizeof(*header);
@@ -1295,7 +1339,7 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	/*
 	 * Reset iterator state.
 	 */
-	rdataset->private4 = NULL;
+	rdataset->privateuint4 = 0;
 	rdataset->private5 = NULL;
 }
 
@@ -1411,8 +1455,171 @@ valid_glue(rbtdb_search_t *search, dns_name_t *name, rbtdb_rdatatype_t type,
 	return (valid);
 }
 
+static inline isc_boolean_t
+activeempty(rbtdb_search_t *search, dns_rbtnodechain_t *chain,
+	    dns_name_t *name)
+{
+	dns_fixedname_t fnext;
+	dns_fixedname_t forigin;
+	dns_name_t *next;
+	dns_name_t *origin;
+	dns_name_t prefix;
+	dns_rbtdb_t *rbtdb;
+	dns_rbtnode_t *node;
+	isc_result_t result;
+	isc_boolean_t answer = ISC_FALSE;
+	rdatasetheader_t *header;
+
+	rbtdb = search->rbtdb;
+
+	dns_name_init(&prefix, NULL);
+	dns_fixedname_init(&fnext);
+	next = dns_fixedname_name(&fnext);
+	dns_fixedname_init(&forigin);
+	origin = dns_fixedname_name(&forigin);
+
+	result = dns_rbtnodechain_next(chain, NULL, NULL);
+	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
+		node = NULL;
+		result = dns_rbtnodechain_current(chain, &prefix,
+						  origin, &node);
+		if (result != ISC_R_SUCCESS)
+			break;
+		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		for (header = node->data;
+		     header != NULL;
+		     header = header->next) {
+			if (header->serial <= search->serial &&
+			    !IGNORE(header) && EXISTS(header))
+				break;
+		}
+		UNLOCK(&(rbtdb->node_locks[node->locknum].lock));
+		if (header != NULL)
+			break;
+		result = dns_rbtnodechain_next(chain, NULL, NULL);
+	}
+	if (result == ISC_R_SUCCESS)
+		result = dns_name_concatenate(&prefix, origin, next, NULL);
+	if (result == ISC_R_SUCCESS && dns_name_issubdomain(next, name))
+		answer = ISC_TRUE;
+	return (answer);
+}
+
+static inline isc_boolean_t
+activeemtpynode(rbtdb_search_t *search, dns_name_t *qname, dns_name_t *wname) {
+	dns_fixedname_t fnext;
+	dns_fixedname_t forigin;
+	dns_fixedname_t fprev;
+	dns_name_t *next;
+	dns_name_t *origin;
+	dns_name_t *prev;
+	dns_name_t name;
+	dns_name_t rname;
+	dns_name_t tname;
+	dns_rbtdb_t *rbtdb;
+	dns_rbtnode_t *node;
+	dns_rbtnodechain_t chain;
+	isc_boolean_t check_next = ISC_TRUE;
+	isc_boolean_t check_prev = ISC_TRUE;
+	isc_boolean_t answer = ISC_FALSE;
+	isc_result_t result;
+	rdatasetheader_t *header;
+	unsigned int n;
+
+	rbtdb = search->rbtdb;
+
+	dns_name_init(&name, NULL);
+	dns_name_init(&tname, NULL);
+	dns_name_init(&rname, NULL);
+	dns_fixedname_init(&fnext);
+	next = dns_fixedname_name(&fnext);
+	dns_fixedname_init(&fprev);
+	prev = dns_fixedname_name(&fprev);
+	dns_fixedname_init(&forigin);
+	origin = dns_fixedname_name(&forigin);
+
+	/*
+	 * Find if qname is at or below a empty node.
+	 * Use our own copy of the chain.
+	 */
+
+	chain = search->chain;
+	do {
+		node = NULL;
+		result = dns_rbtnodechain_current(&chain, &name,
+						  origin, &node);
+		if (result != ISC_R_SUCCESS)
+			break;
+		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		for (header = node->data;
+		     header != NULL;
+		     header = header->next) {
+			if (header->serial <= search->serial &&
+			    !IGNORE(header) && EXISTS(header))
+				break;
+		}
+		UNLOCK(&(rbtdb->node_locks[node->locknum].lock));
+		if (header != NULL)
+			break;
+		result = dns_rbtnodechain_prev(&chain, NULL, NULL);
+	} while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN);
+	if (result == ISC_R_SUCCESS)
+		result = dns_name_concatenate(&name, origin, prev, NULL);
+	if (result != ISC_R_SUCCESS)
+		check_prev = ISC_FALSE;
+
+	result = dns_rbtnodechain_next(&chain, NULL, NULL);
+	while (result == ISC_R_SUCCESS || result == DNS_R_NEWORIGIN) {
+		node = NULL;
+		result = dns_rbtnodechain_current(&chain, &name,
+						  origin, &node);
+		if (result != ISC_R_SUCCESS)
+			break;
+		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		for (header = node->data;
+		     header != NULL;
+		     header = header->next) {
+			if (header->serial <= search->serial &&
+			    !IGNORE(header) && EXISTS(header))
+				break;
+		}
+		UNLOCK(&(rbtdb->node_locks[node->locknum].lock));
+		if (header != NULL)
+			break;
+		result = dns_rbtnodechain_next(&chain, NULL, NULL);
+	}
+	if (result == ISC_R_SUCCESS)
+		result = dns_name_concatenate(&name, origin, next, NULL);
+	if (result != ISC_R_SUCCESS)
+		check_next = ISC_FALSE;
+
+	dns_name_clone(qname, &rname);
+
+	/*
+	 * Remove the wildcard label to find the terminal name.
+	 */
+	n = dns_name_countlabels(wname);
+	dns_name_getlabelsequence(wname, 1, n - 1, &tname);
+
+	do {
+		if ((check_prev && dns_name_issubdomain(prev, &rname)) ||
+		    (check_next && dns_name_issubdomain(next, &rname))) {
+			answer = ISC_TRUE;
+			break;
+		}
+		/*
+		 * Remove the left hand label.
+		 */
+		n = dns_name_countlabels(&rname);
+		dns_name_getlabelsequence(&rname, 1, n - 1, &rname);
+	} while (!dns_name_equal(&rname, &tname));
+	return (answer);
+}
+
 static inline isc_result_t
-find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep) {
+find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep,
+	      dns_name_t *qname)
+{
 	unsigned int i, j;
 	dns_rbtnode_t *node, *level_node, *wnode;
 	rdatasetheader_t *header;
@@ -1422,6 +1629,7 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep) {
 	dns_fixedname_t fwname;
 	dns_rbtdb_t *rbtdb;
 	isc_boolean_t done, wild, active;
+	dns_rbtnodechain_t wchain;
 
 	/*
 	 * Caller must be holding the tree lock and MUST NOT be holding
@@ -1495,8 +1703,9 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep) {
 				break;
 
 			wnode = NULL;
+			dns_rbtnodechain_init(&wchain, NULL);
 			result = dns_rbt_findnode(rbtdb->tree, wname,
-						  NULL, &wnode, NULL,
+						  NULL, &wnode, &wchain,
 						  DNS_RBTFIND_EMPTYDATA,
 						  NULL, NULL);
 			if (result == ISC_R_SUCCESS) {
@@ -1514,7 +1723,10 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep) {
 					    break;
 			    }
 			    UNLOCK(&(rbtdb->node_locks[wnode->locknum].lock));
-			    if (header != NULL) {
+			    if (header != NULL ||
+				activeempty(search, &wchain, wname)) {
+				    if (activeemtpynode(search, qname, wname))
+						return (ISC_R_NOTFOUND);
 				    /*
 				     * The wildcard node is active!
 				     *
@@ -1704,6 +1916,9 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	rdatasetheader_t *header, *header_next, *found, *nxtheader;
 	rdatasetheader_t *foundsig, *cnamesig, *nxtsig;
 	rbtdb_rdatatype_t sigtype;
+	isc_boolean_t active;
+	dns_rbtnodechain_t chain;
+
 
 	search.rbtdb = (dns_rbtdb_t *)db;
 
@@ -1765,7 +1980,7 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 			 * we must see if there's a matching wildcard active
 			 * in the current version.
 			 */
-			result = find_wildcard(&search, &node);
+			result = find_wildcard(&search, &node, name);
 			if (result == ISC_R_SUCCESS) {
 				result = dns_name_copy(name, foundname, NULL);
 				if (result != ISC_R_SUCCESS)
@@ -1777,6 +1992,9 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 				goto tree_exit;
 		}
 
+		chain = search.chain;
+		active = activeempty(&search, &chain, name);
+
 		/*
 		 * If we're here, then the name does not exist, is not
 		 * beneath a zonecut, and there's no matching wildcard.
@@ -1785,9 +2003,10 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 			result = find_closest_nxt(&search, nodep, foundname,
 						  rdataset, sigrdataset);
 			if (result == ISC_R_SUCCESS)
-				result = DNS_R_NXDOMAIN;
+				result = active ? DNS_R_EMPTYNAME :
+						  DNS_R_NXDOMAIN;
 		} else
-			result = DNS_R_NXDOMAIN;
+			result = active ? DNS_R_EMPTYNAME : DNS_R_NXDOMAIN;
 		goto tree_exit;
 	} else if (result != ISC_R_SUCCESS)
 		goto tree_exit;
@@ -1970,14 +2189,11 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		 * active rdatasets in the desired version.  That means that
 		 * this node doesn't exist in the desired version, and that
 		 * we really have a partial match.
-		 *
-		 * If the node is the result of a wildcard match, then
-		 * it must be active in the desired version, and hence
-		 * empty_node should never be true.  We INSIST upon it.
 		 */
-		INSIST(!wild);
-		UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
-		goto partial_match;
+		if (!wild) {
+			UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+			goto partial_match;
+		}
 	}
 
 	/*
@@ -1995,30 +2211,37 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		    result = setup_delegation(&search, nodep, foundname,
 					      rdataset, sigrdataset);
 		    goto tree_exit;
-		} else {
+		}
+		/*
+		 * The desired type doesn't exist.
+		 */
+		result = DNS_R_NXRRSET;
+		if (search.rbtdb->secure &&
+		    (nxtheader == NULL || nxtsig == NULL)) {
 			/*
-			 * The desired type doesn't exist.
+			 * The zone is secure but there's no NXT,
+			 * or the NXT has no signature!
 			 */
-			result = DNS_R_NXRRSET;
-			if (search.rbtdb->secure &&
-			    (nxtheader == NULL || nxtsig == NULL)) {
-				/*
-				 * The zone is secure but there's no NXT,
-				 * or the NXT has no signature!
-				 */
+			if (!wild) {
 				result = DNS_R_BADDB;
 				goto node_exit;
 			}
-			if (nodep != NULL) {
-				new_reference(search.rbtdb, node);
-				*nodep = node;
-			}
-			if (search.rbtdb->secure) {
-				bind_rdataset(search.rbtdb, node, nxtheader,
-					      0, rdataset);
-				bind_rdataset(search.rbtdb, node, nxtsig,
-					      0, sigrdataset);
-			}
+			UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+			result = find_closest_nxt(&search, nodep, foundname,
+						  rdataset, sigrdataset);
+			if (result == ISC_R_SUCCESS)
+				result = DNS_R_EMPTYWILD;
+			goto tree_exit;
+		}
+		if (nodep != NULL) {
+			new_reference(search.rbtdb, node);
+			*nodep = node;
+		}
+		if (search.rbtdb->secure) {
+			bind_rdataset(search.rbtdb, node, nxtheader,
+				      0, rdataset);
+			bind_rdataset(search.rbtdb, node, nxtsig,
+				      0, sigrdataset);
 		}
 		goto node_exit;
 	}
@@ -2510,7 +2733,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 				 * target type.  Remember it.
 				 */
 				foundsig = header;
-			} else if (header->type == RBTDB_RDATATYPE_NXDOMAIN ||
+			} else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
 				   header->type == nxtype) {
 				/*
 				 * We've found a negative cache entry.
@@ -2598,7 +2821,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		/*
 		 * We found a negative cache entry.
 		 */
-		if (found->type == RBTDB_RDATATYPE_NXDOMAIN)
+		if (NXDOMAIN(found))
 			result = DNS_R_NCACHENXDOMAIN;
 		else
 			result = DNS_R_NCACHENXRRSET;
@@ -2618,7 +2841,8 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		result = ISC_R_SUCCESS;
 	}
 
-	if (type != dns_rdatatype_any || result == DNS_R_NCACHENXDOMAIN) {
+	if (type != dns_rdatatype_any || result == DNS_R_NCACHENXDOMAIN ||
+	    result == DNS_R_NCACHENXRRSET) {
 		bind_rdataset(search.rbtdb, node, found, search.now,
 			      rdataset);
 		if (foundsig != NULL)
@@ -2813,7 +3037,8 @@ static void
 detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 	dns_rbtnode_t *node;
-	isc_boolean_t maybe_free = ISC_FALSE;
+	isc_boolean_t want_free = ISC_FALSE;
+	isc_boolean_t inactive = ISC_FALSE;
 	unsigned int locknum;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
@@ -2830,15 +3055,22 @@ detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
 		no_references(rbtdb, node, 0, isc_rwlocktype_none);
 		if (rbtdb->node_locks[locknum].references == 0 &&
 		    rbtdb->node_locks[locknum].exiting)
-			maybe_free = ISC_TRUE;
+			inactive = ISC_TRUE;
 	}
 
 	UNLOCK(&rbtdb->node_locks[locknum].lock);
 
 	*targetp = NULL;
 
-	if (maybe_free)
-		maybe_free_rbtdb(rbtdb, ISC_FALSE);
+	if (inactive) {
+		LOCK(&rbtdb->lock);
+		rbtdb->active--;
+		if (rbtdb->active == 0)
+			want_free = ISC_TRUE;
+		UNLOCK(&rbtdb->lock);
+		if (want_free)
+			free_rbtdb(rbtdb);
+	}
 }
 
 static isc_result_t
@@ -3140,7 +3372,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			   0) {
 			if (header->type == matchtype)
 				found = header;
-			else if (header->type == RBTDB_RDATATYPE_NXDOMAIN ||
+			else if (header->type == RBTDB_RDATATYPE_NCACHEANY ||
 				 header->type == nxtype)
 				found = header;
 			else if (header->type == sigmatchtype)
@@ -3163,7 +3395,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		/*
 		 * We found a negative cache entry.
 		 */
-		if (found->type == RBTDB_RDATATYPE_NXDOMAIN)
+		if (NXDOMAIN(found))
 			result = DNS_R_NCACHENXDOMAIN;
 		else
 			result = DNS_R_NCACHENXRRSET;
@@ -3391,8 +3623,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			for (topheader = rbtnode->data;
 			     topheader != NULL;
 			     topheader = topheader->next) {
-				if (topheader->type ==
-				    RBTDB_RDATATYPE_NXDOMAIN)
+				if (NXDOMAIN(topheader))
 					break;
 			}
 			if (topheader != NULL && EXISTS(topheader) &&
@@ -3516,6 +3747,52 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 				return (result);
 			}
 		}
+		/*
+		 * Don't replace existing NS, A and AAAA RRsets
+		 * in the cache if they are already exist.  This
+		 * prevents named being locked to old servers.
+		 */
+		if (IS_CACHE(rbtdb) && header->ttl > now &&
+		    header->type == dns_rdatatype_ns &&
+		    !header_nx && !newheader_nx &&
+		    header->trust == newheader->trust &&
+		    dns_rdataslab_equalx((unsigned char *)header,
+					 (unsigned char *)newheader,
+				         (unsigned int)(sizeof(*newheader)),
+					 rbtdb->common.rdclass,
+				         (dns_rdatatype_t)header->type)) {
+			/*
+			 * Honour the new ttl if it is less than the
+			 * older one.
+			 */
+			if (header->ttl > newheader->ttl)
+				header->ttl = newheader->ttl;
+			free_rdataset(rbtdb->common.mctx, newheader);
+			if (addedrdataset != NULL)
+				bind_rdataset(rbtdb, rbtnode, header, now,
+					      addedrdataset);
+			return (ISC_R_SUCCESS);
+		}
+		if (IS_CACHE(rbtdb) && header->ttl > now &&
+		    (header->type == dns_rdatatype_a ||
+		     header->type == dns_rdatatype_aaaa) &&
+		    !header_nx && !newheader_nx &&
+		    header->trust == newheader->trust &&
+		    dns_rdataslab_equal((unsigned char *)header,
+					(unsigned char *)newheader,
+				        (unsigned int)(sizeof(*newheader)))) {
+			/*
+			 * Honour the new ttl if it is less than the
+			 * older one.
+			 */
+			if (header->ttl > newheader->ttl)
+				header->ttl = newheader->ttl;
+			free_rdataset(rbtdb->common.mctx, newheader);
+			if (addedrdataset != NULL)
+				bind_rdataset(rbtdb, rbtnode, header, now,
+					      addedrdataset);
+			return (ISC_R_SUCCESS);
+		}
 		INSIST(rbtversion == NULL ||
 		       rbtversion->serial >= topheader->serial);
 		if (topheader_prev != NULL)
@@ -3653,6 +3930,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	} else {
 		newheader->serial = 1;
 		newheader->trust = rdataset->trust;
+		if ((rdataset->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
+			newheader->attributes |= RDATASET_ATTR_NXDOMAIN;
 	}
 
 	/*
@@ -3881,6 +4160,8 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) {
 	    !IS_CACHE(rbtdb) && !dns_name_equal(name, &rbtdb->common.origin))
 		return (DNS_R_NOTZONETOP);
 
+	add_empty_wildcards(rbtdb, name);
+
 	if (dns_name_iswildcard(name)) {
 		/*
 		 * NS record owners cannot legally be wild cards.
@@ -4223,6 +4504,7 @@ dns_rbtdb_create
 		rbtdb->node_lock_count = DEFAULT_NODE_LOCK_COUNT;
 	rbtdb->node_locks = isc_mem_get(mctx, rbtdb->node_lock_count *
 					sizeof (rbtdb_nodelock_t));
+	rbtdb->active = rbtdb->node_lock_count;
 	for (i = 0; i < (int)(rbtdb->node_lock_count); i++) {
 		result = isc_mutex_init(&rbtdb->node_locks[i].lock);
 		if (result != ISC_R_SUCCESS) {
@@ -4365,12 +4647,12 @@ rdataset_first(dns_rdataset_t *rdataset) {
 	}
 	raw += 2;
 	/*
-	 * The private4 field is the number of rdata beyond the cursor
+	 * The privateuint4 field is the number of rdata beyond the cursor
 	 * position, so we decrement the total count by one before storing
 	 * it.
 	 */
 	count--;
-	rdataset->private4 = (void *)count;
+	rdataset->privateuint4 = count;
 	rdataset->private5 = raw;
 
 	return (ISC_R_SUCCESS);
@@ -4382,11 +4664,11 @@ rdataset_next(dns_rdataset_t *rdataset) {
 	unsigned int length;
 	unsigned char *raw;
 
-	count = (unsigned int)rdataset->private4;
+	count = rdataset->privateuint4;
 	if (count == 0)
 		return (ISC_R_NOMORE);
 	count--;
-	rdataset->private4 = (void *)count;
+	rdataset->privateuint4 = count;
 	raw = rdataset->private5;
 	length = raw[0] * 256 + raw[1];
 	raw += length + 2;
@@ -4420,7 +4702,7 @@ rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
 	/*
 	 * Reset iterator state.
 	 */
-	target->private4 = NULL;
+	target->privateuint4 = 0;
 	target->private5 = NULL;
 }
 
@@ -4702,6 +4984,7 @@ static void
 dbiterator_destroy(dns_dbiterator_t **iteratorp) {
 	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)(*iteratorp);
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
+	dns_db_t *db = NULL;
 
 	if (rbtdbiter->tree_locked == isc_rwlocktype_read) {
 		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_read);
@@ -4713,10 +4996,12 @@ dbiterator_destroy(dns_dbiterator_t **iteratorp) {
 
 	flush_deletions(rbtdbiter);
 
+	dns_db_attach(rbtdbiter->common.db, &db);
 	dns_db_detach(&rbtdbiter->common.db);
 
 	dns_rbtnodechain_reset(&rbtdbiter->chain);
-	isc_mem_put(rbtdb->common.mctx, rbtdbiter, sizeof *rbtdbiter);
+	isc_mem_put(db->mctx, rbtdbiter, sizeof(*rbtdbiter));
+	dns_db_detach(&db);
 
 	*iteratorp = NULL;
 }
diff --git a/usr.sbin/bind/lib/dns/rdata.c b/usr.sbin/bind/lib/dns/rdata.c
index 3fddd4ea445..0b8838d72bb 100644
--- a/usr.sbin/bind/lib/dns/rdata.c
+++ b/usr.sbin/bind/lib/dns/rdata.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rdata.c,v 1.147.2.7 2002/03/27 23:52:33 marka Exp $ */
+/* $ISC: rdata.c,v 1.147.2.11 2003/07/30 01:04:15 marka Exp $ */
 
 #include <config.h>
 #include <ctype.h>
@@ -620,7 +620,7 @@ unknown_fromtext(dns_rdataclass_t rdclass, dns_rdatatype_t type,
 
 	result = isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 					ISC_FALSE);
-	if (result == ISC_R_SUCCESS && token.value.as_ulong > 65535)
+	if (result == ISC_R_SUCCESS && token.value.as_ulong > 65535U)
 		return (ISC_R_RANGE);
 	result = isc_buffer_allocate(mctx, &buf, token.value.as_ulong);
 	if (result != ISC_R_SUCCESS)
@@ -759,7 +759,7 @@ rdata_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx,
 {
 	isc_result_t result = ISC_R_NOTIMPLEMENTED;
 	isc_boolean_t use_default = ISC_FALSE;
-	char buf[sizeof "65536"];
+	char buf[sizeof("65536")];
 	isc_region_t sr;
 
 	REQUIRE(rdata != NULL);
@@ -952,10 +952,9 @@ dns_rdata_digest(dns_rdata_t *rdata, dns_digestfunc_t digest, void *arg) {
 unsigned int
 dns_rdatatype_attributes(dns_rdatatype_t type)
 {
-	if (type > 255)
-		return (DNS_RDATATYPEATTR_UNKNOWN);
-
-	return (typeattr[type].flags);
+	if (type < (sizeof(typeattr)/sizeof(typeattr[0])))
+		return (typeattr[type].flags);
+	return (DNS_RDATATYPEATTR_UNKNOWN);
 }
 
 #define NUMBERSIZE sizeof("037777777777") /* 2^32-1 octal + NUL */
@@ -1083,7 +1082,7 @@ dns_rdataclass_fromtext(dns_rdataclass_t *classp, isc_textregion_t *source) {
 
 isc_result_t
 dns_rdataclass_totext(dns_rdataclass_t rdclass, isc_buffer_t *target) {
-	char buf[sizeof("CLASS65536")];
+	char buf[sizeof("CLASS65535")];
 
 	switch (rdclass) {
 	case dns_rdataclass_any:
@@ -1170,14 +1169,12 @@ dns_rdatatype_fromtext(dns_rdatatype_t *typep, isc_textregion_t *source) {
 
 isc_result_t
 dns_rdatatype_totext(dns_rdatatype_t type, isc_buffer_t *target) {
-	char buf[sizeof "TYPE65536"];
+	char buf[sizeof("TYPE65536")];
 
-	if (type > 255) {
-		snprintf(buf, sizeof buf, "TYPE%u", type);
-		return (str_totext(buf, target));
-	}
-
-	return (str_totext(typeattr[type].name, target));
+	if (type < (sizeof(typeattr)/sizeof(typeattr[0])))
+		return (str_totext(typeattr[type].name, target));
+	snprintf(buf, sizeof buf, "TYPE%u", type);
+	return (str_totext(buf, target));
 }
 
 void
@@ -1818,7 +1815,7 @@ atob_tobuffer(isc_lex_t *lexer, isc_buffer_t *target) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if ((token.value.as_ulong % 4) != 0)
+	if ((token.value.as_ulong % 4) != 0U)
 		isc_buffer_subtract(target,  4 - (token.value.as_ulong % 4));
 
 	/*
@@ -2053,7 +2050,6 @@ dns_rdatatype_questiononly(dns_rdatatype_t type) {
 
 isc_boolean_t
 dns_rdataclass_ismeta(dns_rdataclass_t rdclass) {
-	REQUIRE(rdclass < 65536);
 
 	if (rdclass == dns_rdataclass_reserved0
 	    || rdclass == dns_rdataclass_none
diff --git a/usr.sbin/bind/lib/dns/rdata/any_255/tsig_250.c b/usr.sbin/bind/lib/dns/rdata/any_255/tsig_250.c
index 063f7bec37e..890e2afe8ca 100644
--- a/usr.sbin/bind/lib/dns/rdata/any_255/tsig_250.c
+++ b/usr.sbin/bind/lib/dns/rdata/any_255/tsig_250.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: tsig_250.c,v 1.52 2001/07/16 03:05:58 marka Exp $ */
+/* $ISC: tsig_250.c,v 1.52.2.2 2003/10/09 07:32:41 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 13:39:43 PST 2000 by gson */
 
@@ -70,7 +70,7 @@ fromtext_any_tsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -79,7 +79,7 @@ fromtext_any_tsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -93,7 +93,7 @@ fromtext_any_tsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -119,7 +119,7 @@ fromtext_any_tsig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/afsdb_18.c b/usr.sbin/bind/lib/dns/rdata/generic/afsdb_18.c
index 71c0fe51cab..5071f12cccf 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/afsdb_18.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/afsdb_18.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: afsdb_18.c,v 1.39 2001/07/16 03:06:00 marka Exp $ */
+/* $ISC: afsdb_18.c,v 1.39.2.2 2003/10/09 07:32:42 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 14:59:00 PST 2000 by explorer */
 
@@ -43,7 +43,7 @@ fromtext_afsdb(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/cert_37.c b/usr.sbin/bind/lib/dns/rdata/generic/cert_37.c
index 2485a82d11a..5b5bafc78af 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/cert_37.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/cert_37.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: cert_37.c,v 1.40 2001/07/16 03:06:01 marka Exp $ */
+/* $ISC: cert_37.c,v 1.40.2.2 2003/10/09 07:32:42 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 21:14:32 EST 2000 by tale */
 
@@ -53,7 +53,7 @@ fromtext_cert(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/loc_29.c b/usr.sbin/bind/lib/dns/rdata/generic/loc_29.c
index 09c4036df72..1fffee76acd 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/loc_29.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/loc_29.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: loc_29.c,v 1.30.2.2 2002/08/05 06:57:14 marka Exp $ */
+/* $ISC: loc_29.c,v 1.30.2.4 2003/10/09 07:32:42 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 18:13:09 PST 2000 by explorer */
 
@@ -73,7 +73,7 @@ fromtext_loc(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 90)
+	if (token.value.as_ulong > 90U)
 		RETTOK(ISC_R_RANGE);
 	d1 = (int)token.value.as_ulong;
 	/*
@@ -142,7 +142,7 @@ fromtext_loc(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 180)
+	if (token.value.as_ulong > 180U)
 		RETTOK(ISC_R_RANGE);
 	d2 = (int)token.value.as_ulong;
 
@@ -511,7 +511,7 @@ totext_loc(ARGS_TOTEXT) {
 
 	altitude = uint32_fromregion(&sr);
 	isc_region_consume(&sr, 4);
-	if (altitude < 10000000) {
+	if (altitude < 10000000U) {
 		below = ISC_TRUE;
 		altitude = 10000000 - altitude;
 	} else {
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/mx_15.c b/usr.sbin/bind/lib/dns/rdata/generic/mx_15.c
index 8e2806868aa..cb39914efb9 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/mx_15.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/mx_15.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2001  Internet Software Consortium.
+ * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: mx_15.c,v 1.48 2001/07/16 03:06:19 marka Exp $ */
+/* $ISC: mx_15.c,v 1.48.2.2 2003/10/09 07:32:42 marka Exp $ */
 
 /* reviewed: Wed Mar 15 18:05:46 PST 2000 by brister */
 
@@ -38,7 +38,7 @@ fromtext_mx(ARGS_FROMTEXT) {
 
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/nxt_30.c b/usr.sbin/bind/lib/dns/rdata/generic/nxt_30.c
index 95854befba5..1da8d782a8a 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/nxt_30.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/nxt_30.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: nxt_30.c,v 1.49 2001/07/16 03:06:23 marka Exp $ */
+/* $ISC: nxt_30.c,v 1.49.2.2 2003/07/22 04:03:46 marka Exp $ */
 
 /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */
 
@@ -143,9 +143,9 @@ fromwire_nxt(ARGS_FROMWIRE) {
 	RETERR(dns_name_fromwire(&name, source, dctx, downcase, target));
 
 	isc_buffer_activeregion(source, &sr);
-	/* XXXRTH  Enforce RFC 2535 length rules if bit 0 is not set. */
-	if (sr.length > 8 * 1024)
-		return (DNS_R_EXTRADATA);
+	if (sr.length > 0 && (sr.base[0] & 0x80) == 0 &&
+	    ((sr.length > 16) || sr.base[sr.length - 1] == 0))
+		return (DNS_R_BADBITMAP);
 	RETERR(mem_tobuffer(target, sr.base, sr.length));
 	isc_buffer_forward(source, sr.length);
 	return (ISC_R_SUCCESS);
@@ -207,6 +207,10 @@ fromstruct_nxt(ARGS_FROMSTRUCT) {
 	REQUIRE(nxt->common.rdtype == type);
 	REQUIRE(nxt->common.rdclass == rdclass);
 	REQUIRE(nxt->typebits != NULL || nxt->len == 0);
+	if (nxt->typebits != NULL && (nxt->typebits[0] & 0x80) == 0) {
+		REQUIRE(nxt->len <= 16);
+		REQUIRE(nxt->typebits[nxt->len - 1] != 0);
+	}
 
 	UNUSED(type);
 	UNUSED(rdclass);
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/rt_21.c b/usr.sbin/bind/lib/dns/rdata/generic/rt_21.c
index a3c02d3b725..a8ed673582a 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/rt_21.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/rt_21.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rt_21.c,v 1.37 2001/07/16 03:06:28 marka Exp $ */
+/* $ISC: rt_21.c,v 1.37.2.2 2003/10/09 07:32:42 marka Exp $ */
 
 /* reviewed: Thu Mar 16 15:02:31 PST 2000 by brister */
 
@@ -40,7 +40,7 @@ fromtext_rt(ARGS_FROMTEXT) {
 
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/sig_24.c b/usr.sbin/bind/lib/dns/rdata/generic/sig_24.c
index 6c6ce9dad4d..e408d4826ab 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/sig_24.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/sig_24.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: sig_24.c,v 1.54 2001/07/16 03:06:29 marka Exp $ */
+/* $ISC: sig_24.c,v 1.54.2.2 2003/10/09 07:32:43 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
 
@@ -73,7 +73,7 @@ fromtext_sig(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xff)
+	if (token.value.as_ulong > 0xffU)
 		RETTOK(ISC_R_RANGE);
 	c = (unsigned char)token.value.as_ulong;
 	RETERR(mem_tobuffer(target, &c, 1));
diff --git a/usr.sbin/bind/lib/dns/rdata/generic/tkey_249.c b/usr.sbin/bind/lib/dns/rdata/generic/tkey_249.c
index 83efe2e9425..d323bb46f6a 100644
--- a/usr.sbin/bind/lib/dns/rdata/generic/tkey_249.c
+++ b/usr.sbin/bind/lib/dns/rdata/generic/tkey_249.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: tkey_249.c,v 1.48 2001/07/16 03:06:32 marka Exp $ */
+/* $ISC: tkey_249.c,v 1.48.2.2 2003/10/09 07:32:43 marka Exp $ */
 
 /*
  * Reviewed: Thu Mar 16 17:35:30 PST 2000 by halley.
@@ -73,7 +73,7 @@ fromtext_tkey(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -99,7 +99,7 @@ fromtext_tkey(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -113,7 +113,7 @@ fromtext_tkey(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -221,7 +221,7 @@ totext_tkey(ARGS_TOTEXT) {
 	 * Other Data.
 	 */
 	REQUIRE(n <= sr.length);
-	if (n != 0) {
+	if (n != 0U) {
 	    dr = sr;
 	    dr.length = n;
 	    if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
diff --git a/usr.sbin/bind/lib/dns/rdata/in_1/a6_38.c b/usr.sbin/bind/lib/dns/rdata/in_1/a6_38.c
index 959cae624fc..f3d2103962f 100644
--- a/usr.sbin/bind/lib/dns/rdata/in_1/a6_38.c
+++ b/usr.sbin/bind/lib/dns/rdata/in_1/a6_38.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: a6_38.c,v 1.46 2001/07/26 21:34:00 gson Exp $ */
+/* $ISC: a6_38.c,v 1.46.2.2 2003/10/09 07:32:44 marka Exp $ */
 
 /* RFC2874 */
 
@@ -48,7 +48,7 @@ fromtext_in_a6(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 128)
+	if (token.value.as_ulong > 128U)
 		RETTOK(ISC_R_RANGE);
 
 	prefixlen = (unsigned char)token.value.as_ulong;
diff --git a/usr.sbin/bind/lib/dns/rdata/in_1/kx_36.c b/usr.sbin/bind/lib/dns/rdata/in_1/kx_36.c
index 4280e7792cf..e4926fa5f96 100644
--- a/usr.sbin/bind/lib/dns/rdata/in_1/kx_36.c
+++ b/usr.sbin/bind/lib/dns/rdata/in_1/kx_36.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: kx_36.c,v 1.37 2001/07/16 03:06:43 marka Exp $ */
+/* $ISC: kx_36.c,v 1.37.2.2 2003/10/09 07:32:44 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 17:24:54 PST 2000 by explorer */
 
@@ -41,7 +41,7 @@ fromtext_in_kx(ARGS_FROMTEXT) {
 
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/in_1/naptr_35.c b/usr.sbin/bind/lib/dns/rdata/in_1/naptr_35.c
index 977faf28b40..b33ebb147e1 100644
--- a/usr.sbin/bind/lib/dns/rdata/in_1/naptr_35.c
+++ b/usr.sbin/bind/lib/dns/rdata/in_1/naptr_35.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: naptr_35.c,v 1.43 2001/07/16 03:06:44 marka Exp $ */
+/* $ISC: naptr_35.c,v 1.43.2.2 2003/10/09 07:32:44 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
@@ -44,7 +44,7 @@ fromtext_in_naptr(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -53,7 +53,7 @@ fromtext_in_naptr(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/in_1/px_26.c b/usr.sbin/bind/lib/dns/rdata/in_1/px_26.c
index d9f06b2fe6f..f21f93d241c 100644
--- a/usr.sbin/bind/lib/dns/rdata/in_1/px_26.c
+++ b/usr.sbin/bind/lib/dns/rdata/in_1/px_26.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: px_26.c,v 1.34 2001/07/16 03:06:48 marka Exp $ */
+/* $ISC: px_26.c,v 1.34.2.2 2003/10/09 07:32:45 marka Exp $ */
 
 /* Reviewed: Mon Mar 20 10:44:27 PST 2000 */
 
@@ -44,7 +44,7 @@ fromtext_in_px(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdata/in_1/srv_33.c b/usr.sbin/bind/lib/dns/rdata/in_1/srv_33.c
index 06f628838b5..a2ee550b344 100644
--- a/usr.sbin/bind/lib/dns/rdata/in_1/srv_33.c
+++ b/usr.sbin/bind/lib/dns/rdata/in_1/srv_33.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: srv_33.c,v 1.36 2001/07/16 03:06:49 marka Exp $ */
+/* $ISC: srv_33.c,v 1.36.2.2 2003/10/09 07:32:45 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 13:01:00 PST 2000 by bwelling */
 
@@ -44,7 +44,7 @@ fromtext_in_srv(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -53,7 +53,7 @@ fromtext_in_srv(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
@@ -62,7 +62,7 @@ fromtext_in_srv(ARGS_FROMTEXT) {
 	 */
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
 				      ISC_FALSE));
-	if (token.value.as_ulong > 0xffff)
+	if (token.value.as_ulong > 0xffffU)
 		RETTOK(ISC_R_RANGE);
 	RETERR(uint16_tobuffer(token.value.as_ulong, target));
 
diff --git a/usr.sbin/bind/lib/dns/rdatalist.c b/usr.sbin/bind/lib/dns/rdatalist.c
index 20aa3d1143d..c939281f5f9 100644
--- a/usr.sbin/bind/lib/dns/rdatalist.c
+++ b/usr.sbin/bind/lib/dns/rdatalist.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rdatalist.c,v 1.25 2001/01/09 21:51:21 bwelling Exp $ */
+/* $ISC: rdatalist.c,v 1.25.2.2 2003/07/22 04:03:43 marka Exp $ */
 
 #include <config.h>
 
@@ -74,7 +74,7 @@ dns_rdatalist_tordataset(dns_rdatalist_t *rdatalist,
 	rdataset->private1 = rdatalist;
 	rdataset->private2 = NULL;
 	rdataset->private3 = NULL;
-	rdataset->private4 = NULL;
+	rdataset->privateuint4 = 0;
 	rdataset->private5 = NULL;
 
 	return (ISC_R_SUCCESS);
diff --git a/usr.sbin/bind/lib/dns/rdataset.c b/usr.sbin/bind/lib/dns/rdataset.c
index 16c21f80a61..7a950ae1b10 100644
--- a/usr.sbin/bind/lib/dns/rdataset.c
+++ b/usr.sbin/bind/lib/dns/rdataset.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rdataset.c,v 1.58 2001/06/05 09:23:14 marka Exp $ */
+/* $ISC: rdataset.c,v 1.58.2.3 2003/08/05 00:42:55 marka Exp $ */
 
 #include <config.h>
 
@@ -52,7 +52,7 @@ dns_rdataset_init(dns_rdataset_t *rdataset) {
 	rdataset->private1 = NULL;
 	rdataset->private2 = NULL;
 	rdataset->private3 = NULL;
-	rdataset->private4 = NULL;
+	rdataset->privateuint4 = 0;
 	rdataset->private5 = NULL;
 }
 
@@ -77,7 +77,7 @@ dns_rdataset_invalidate(dns_rdataset_t *rdataset) {
 	rdataset->private1 = NULL;
 	rdataset->private2 = NULL;
 	rdataset->private3 = NULL;
-	rdataset->private4 = NULL;
+	rdataset->privateuint4 = 0;
 	rdataset->private5 = NULL;
 }
 
@@ -103,7 +103,7 @@ dns_rdataset_disassociate(dns_rdataset_t *rdataset) {
 	rdataset->private1 = NULL;
 	rdataset->private2 = NULL;
 	rdataset->private3 = NULL;
-	rdataset->private4 = NULL;
+	rdataset->privateuint4 = 0;
 	rdataset->private5 = NULL;
 }
 
diff --git a/usr.sbin/bind/lib/dns/rdataslab.c b/usr.sbin/bind/lib/dns/rdataslab.c
index 35fd7bab03d..d2673378f75 100644
--- a/usr.sbin/bind/lib/dns/rdataslab.c
+++ b/usr.sbin/bind/lib/dns/rdataslab.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rdataslab.c,v 1.29 2001/01/09 21:51:25 bwelling Exp $ */
+/* $ISC: rdataslab.c,v 1.29.2.2 2003/07/22 04:03:43 marka Exp $ */
 
 #include <config.h>
 
@@ -563,3 +563,35 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
 	}
 	return (ISC_TRUE);
 }
+
+isc_boolean_t
+dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
+		     unsigned int reservelen, dns_rdataclass_t rdclass,
+		     dns_rdatatype_t type)
+{
+	unsigned char *current1, *current2;
+	unsigned int count1, count2;
+	dns_rdata_t rdata1 = DNS_RDATA_INIT;
+	dns_rdata_t rdata2 = DNS_RDATA_INIT;
+
+	current1 = slab1 + reservelen;
+	count1 = *current1++ * 256;
+	count1 += *current1++;
+
+	current2 = slab2 + reservelen;
+	count2 = *current2++ * 256;
+	count2 += *current2++;
+
+	if (count1 != count2)
+		return (ISC_FALSE);
+
+	while (count1-- > 0) {
+		rdata_from_slab(&current1, rdclass, type, &rdata1);
+		rdata_from_slab(&current2, rdclass, type, &rdata2);
+		if (dns_rdata_compare(&rdata1, &rdata2) != 0)
+			return (ISC_FALSE);
+		dns_rdata_reset(&rdata1);
+		dns_rdata_reset(&rdata2);
+	}
+	return (ISC_TRUE);
+}
diff --git a/usr.sbin/bind/lib/dns/resolver.c b/usr.sbin/bind/lib/dns/resolver.c
index 76f6f85c748..052c81aff59 100644
--- a/usr.sbin/bind/lib/dns/resolver.c
+++ b/usr.sbin/bind/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: resolver.c,v 1.218.2.12.4.4 2003/02/18 03:32:01 marka Exp $ */
+/* $ISC: resolver.c,v 1.218.2.24 2003/09/22 00:32:39 marka Exp $ */
 
 #include <config.h>
 
@@ -278,6 +278,8 @@ struct dns_resolver {
 #define ISFORWARDER(a)			(((a)->flags & \
 					 FCTX_ADDRINFO_FORWARDER) != 0)
 
+#define NXDOMAIN(r) (((r)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0)
+
 static void destroy(dns_resolver_t *res);
 static void empty_bucket(dns_resolver_t *res);
 static isc_result_t resquery_send(resquery_t *query);
@@ -1579,20 +1581,13 @@ fctx_getaddresses(fetchctx_t *fctx) {
 		options = stdoptions;
 		/*
 		 * If this name is a subdomain of the query domain, tell
-		 * the ADB to start looking at "." if it doesn't know the
-		 * address.  This keeps us from getting stuck if the
-		 * nameserver is beneath the zone cut and we don't know its
-		 * address (e.g. because the A record has expired).
-		 * By restarting from ".", we ensure that any missing glue
-		 * will be reestablished.
-		 *
-		 * A further optimization would be to get the ADB to start
-		 * looking at the most enclosing zone cut above fctx->domain.
-		 * We don't expect this situation to happen very frequently,
-		 * so we've chosen the simple solution.
+		 * the ADB to start looking using zone/hint data. This keeps
+		 * us from getting stuck if the nameserver is beneath the
+		 * zone cut and we don't know its address (e.g. because the
+		 * A record has expired).
 		 */
 		if (dns_name_issubdomain(&ns.name, &fctx->domain))
-			options |= DNS_ADBFIND_STARTATROOT;
+			options |= DNS_ADBFIND_STARTATZONE;
 		options |= DNS_ADBFIND_GLUEOK;
 		options |= DNS_ADBFIND_HINTOK;
 
@@ -2309,7 +2304,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	/*
 	 * Compute an expiration time for the entire fetch.
 	 */
-	isc_interval_set(&interval, 90, 0);		/* XXXRTH constant */
+	isc_interval_set(&interval, 30, 0);		/* XXXRTH constant */
 	iresult = isc_time_nowplusinterval(&fctx->expires, &interval);
 	if (iresult != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -3014,7 +3009,10 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 					eresult = DNS_R_DNAME;
 				}
 			}
-			if (rdataset->trust == dns_trust_glue) {
+			if (rdataset->trust == dns_trust_glue &&
+			    (rdataset->type == dns_rdatatype_ns ||
+		             (rdataset->type == dns_rdatatype_sig &&
+			      rdataset->covers == dns_rdatatype_ns))) {
 				/*
 				 * If the trust level is 'dns_trust_glue'
 				 * then we are adding data from a referral
@@ -3043,8 +3041,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, isc_stdtime_t now) {
 					 * a negative cache entry, so we
 					 * must set eresult appropriately.
 					 */
-					 if (ardataset->covers ==
-					     dns_rdatatype_any)
+					 if (NXDOMAIN(ardataset))
 						 eresult =
 							 DNS_R_NCACHENXDOMAIN;
 					 else
@@ -3151,7 +3148,7 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 			 * The cache data is also a negative cache
 			 * entry.
 			 */
-			if (ardataset->covers == dns_rdatatype_any)
+			if (NXDOMAIN(ardataset))
 				*eresultp = DNS_R_NCACHENXDOMAIN;
 			else
 				*eresultp = DNS_R_NCACHENXRRSET;
@@ -3170,7 +3167,7 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 			result = ISC_R_SUCCESS;
 		}
 	} else if (result == ISC_R_SUCCESS) {
-		if (covers == dns_rdatatype_any)
+		if (NXDOMAIN(ardataset))
 			*eresultp = DNS_R_NCACHENXDOMAIN;
 		else
 			*eresultp = DNS_R_NCACHENXRRSET;
@@ -4589,15 +4586,19 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 		}
 
 		if (get_nameservers) {
+			dns_name_t *name;
 			dns_fixedname_init(&foundname);
 			fname = dns_fixedname_name(&foundname);
 			if (result != ISC_R_SUCCESS) {
 				fctx_done(fctx, DNS_R_SERVFAIL);
 				return;
 			}
+			if ((options & DNS_FETCHOPT_UNSHARED) == 0)
+				name = &fctx->name;
+			else
+				name = &fctx->domain;
 			result = dns_view_findzonecut(fctx->res->view,
-						      &fctx->domain,
-						      fname,
+						      name, fname,
 						      now, 0, ISC_TRUE,
 						      &fctx->nameservers,
 						      NULL);
diff --git a/usr.sbin/bind/lib/dns/result.c b/usr.sbin/bind/lib/dns/result.c
index b92aac2dec1..c98cee99e82 100644
--- a/usr.sbin/bind/lib/dns/result.c
+++ b/usr.sbin/bind/lib/dns/result.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: result.c,v 1.90.2.5 2002/03/26 00:55:00 marka Exp $ */
+/* $ISC: result.c,v 1.90.2.9 2003/07/22 04:03:44 marka Exp $ */
 
 #include <config.h>
 
@@ -125,7 +125,20 @@ static const char *text[DNS_R_NRESULTS] = {
 	"obsolete",			       /* 80 DNS_R_OBSOLETE	     */
 	"already frozen",		       /* 81 DNS_R_FROZEN	     */
 	"unknown flag",			       /* 82 DNS_R_UNKNOWNFLAG	     */
-	"expected a response"		       /* 83 DNS_R_EXPECTEDRESPONSE  */
+	"expected a response",		       /* 83 DNS_R_EXPECTEDRESPONSE  */
+	"<unused 84>",
+
+	"<unused 85>",
+	"<unused 86>",
+	"<unused 87>",
+	"<unused 88>",
+	"<unused 89>",
+
+	"<unused 90>",
+	"<unused 91>",
+	"empty name",				/* 92 DNS_R_EMPTYNAME	     */
+	"empty wild",				/* 93 DNS_R_EMPTYWILD	     */
+	"bad bitmap"				/* 94 DNS_R_BADBITMAP	     */
 };
 
 static const char *rcode_text[DNS_R_NRCODERESULTS] = {
diff --git a/usr.sbin/bind/lib/dns/rootns.c b/usr.sbin/bind/lib/dns/rootns.c
index 18be4a6ee67..f6a7e7294fb 100644
--- a/usr.sbin/bind/lib/dns/rootns.c
+++ b/usr.sbin/bind/lib/dns/rootns.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rootns.c,v 1.20.2.1 2001/10/03 22:30:17 gson Exp $ */
+/* $ISC: rootns.c,v 1.20.2.3 2003/07/22 04:03:44 marka Exp $ */
 
 #include <config.h>
 
@@ -65,7 +65,7 @@ static char root_ns[] =
 "G.ROOT-SERVERS.NET.     3600000 IN      A       192.112.36.4\n"
 "H.ROOT-SERVERS.NET.     3600000 IN      A       128.63.2.53\n"
 "I.ROOT-SERVERS.NET.     3600000 IN      A       192.36.148.17\n"
-"J.ROOT-SERVERS.NET.     3600000 IN      A       198.41.0.10\n"
+"J.ROOT-SERVERS.NET.     3600000 IN      A       192.58.128.30\n"
 "K.ROOT-SERVERS.NET.     3600000 IN      A       193.0.14.129\n"
 "L.ROOT-SERVERS.NET.     3600000 IN      A       198.32.64.12\n"
 "M.ROOT-SERVERS.NET.     3600000 IN      A       202.12.27.33\n";
diff --git a/usr.sbin/bind/lib/dns/sdb.c b/usr.sbin/bind/lib/dns/sdb.c
index e6a0ba7ee8e..5425668d9b1 100644
--- a/usr.sbin/bind/lib/dns/sdb.c
+++ b/usr.sbin/bind/lib/dns/sdb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: sdb.c,v 1.35 2001/06/28 21:34:54 gson Exp $ */
+/* $ISC: sdb.c,v 1.35.2.2 2003/10/09 07:32:38 marka Exp $ */
 
 #include <config.h>
 
@@ -763,8 +763,10 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	dns_fixedname_init(&fname);
 	xname = dns_fixedname_name(&fname);
 
-	if (rdataset == NULL)
+	if (rdataset == NULL) {
+		dns_rdataset_init(&xrdataset);
 		rdataset = &xrdataset;
+	}
 
 	result = DNS_R_NXDOMAIN;
 
diff --git a/usr.sbin/bind/lib/dns/sec/dst/dst_api.c b/usr.sbin/bind/lib/dns/sec/dst/dst_api.c
index 637414c3e07..ceaf9f624a8 100644
--- a/usr.sbin/bind/lib/dns/sec/dst/dst_api.c
+++ b/usr.sbin/bind/lib/dns/sec/dst/dst_api.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 1999-2001  Internet Software Consortium.
+ * Portions Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -19,7 +19,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $ISC: dst_api.c,v 1.88.2.2 2001/12/19 01:09:56 marka Exp $
+ * $ISC: dst_api.c,v 1.88.2.4 2003/10/09 07:32:46 marka Exp $
  */
 
 #include <config.h>
@@ -987,7 +987,7 @@ buildfilename(dns_name_t *name, dns_keytag_t id,
 		if (isc_buffer_availablelength(out) < strlen(directory))
 			return (ISC_R_NOSPACE);
 		isc_buffer_putstr(out, directory);
-		if (strlen(directory) > 0 &&
+		if (strlen(directory) > 0U &&
 		    directory[strlen(directory) - 1] != '/')
 			isc_buffer_putstr(out, "/");
 	}
@@ -1108,7 +1108,7 @@ dst__mem_realloc(void *ptr, size_t size) {
 
 	INSIST(dst_memory_pool != NULL);
 	p = NULL;
-	if (size > 0) {
+	if (size > 0U) {
 		p = dst__mem_alloc(size);
 		if (p != NULL && ptr != NULL)
 			memcpy(p, ptr, size);
diff --git a/usr.sbin/bind/lib/dns/sec/dst/openssl_link.c b/usr.sbin/bind/lib/dns/sec/dst/openssl_link.c
index 5b3f35da53a..bfc19886d9f 100644
--- a/usr.sbin/bind/lib/dns/sec/dst/openssl_link.c
+++ b/usr.sbin/bind/lib/dns/sec/dst/openssl_link.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 1999-2001  Internet Software Consortium.
+ * Portions Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -19,7 +19,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $ISC: openssl_link.c,v 1.46.8.1 2003/02/18 06:24:45 marka Exp $
+ * $ISC: openssl_link.c,v 1.46.2.2 2003/07/22 04:03:47 marka Exp $
  */
 #ifdef OPENSSL
 
diff --git a/usr.sbin/bind/lib/dns/sec/dst/opensslrsa_link.c b/usr.sbin/bind/lib/dns/sec/dst/opensslrsa_link.c
index ad2f8f9652b..6153e02463c 100644
--- a/usr.sbin/bind/lib/dns/sec/dst/opensslrsa_link.c
+++ b/usr.sbin/bind/lib/dns/sec/dst/opensslrsa_link.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $ISC: opensslrsa_link.c,v 1.12.2.3 2001/12/19 01:29:31 marka Exp $
+ * $ISC: opensslrsa_link.c,v 1.12.2.5 2003/10/09 07:32:46 marka Exp $
  */
 #ifdef OPENSSL
 
@@ -217,6 +217,7 @@ opensslrsa_generate(dst_key_t *key, int exp) {
 	}
 
 	rsa->flags &= ~(RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE);
+	rsa->flags |= RSA_FLAG_BLINDING;
 
 	key->opaque = rsa;
 
@@ -296,6 +297,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
 	if (rsa == NULL)
 		return (ISC_R_NOMEMORY);
 	rsa->flags &= ~(RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE);
+	rsa->flags |= RSA_FLAG_BLINDING;
 
 	if (r.length < 1) {
 		RSA_free(rsa);
@@ -434,6 +436,7 @@ opensslrsa_fromfile(dst_key_t *key, const char *filename) {
 	if (rsa == NULL)
 		DST_RET(ISC_R_NOMEMORY);
 	rsa->flags &= ~(RSA_FLAG_CACHE_PUBLIC | RSA_FLAG_CACHE_PRIVATE);
+	rsa->flags |= RSA_FLAG_BLINDING;
 	key->opaque = rsa;
 
 	for (i = 0; i < priv.nelements; i++) {
diff --git a/usr.sbin/bind/lib/dns/time.c b/usr.sbin/bind/lib/dns/time.c
index 4081e8e8a49..fcafbafed87 100644
--- a/usr.sbin/bind/lib/dns/time.c
+++ b/usr.sbin/bind/lib/dns/time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2001  Internet Software Consortium.
+ * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: time.c,v 1.18 2001/05/15 22:05:35 gson Exp $ */
+/* $ISC: time.c,v 1.18.2.4 2003/07/23 06:57:48 marka Exp $ */
 
 #include <config.h>
 
@@ -127,7 +127,7 @@ dns_time64_fromtext(char *source, isc_int64_t *target) {
 			return (ISC_R_RANGE); \
 	} while (0)
 
-	if (strlen(source) != 14)
+	if (strlen(source) != 14U)
 		return (DNS_R_SYNTAX);
 	if (sscanf(source, "%4d%2d%2d%2d%2d%2d",
 		   &year, &month, &day, &hour, &minute, &second) != 6)
@@ -161,15 +161,11 @@ dns_time64_fromtext(char *source, isc_int64_t *target) {
 isc_result_t
 dns_time32_fromtext(char *source, isc_uint32_t *target) {
 	isc_int64_t value64;
-	isc_int32_t value32;
 	isc_result_t result;
 	result = dns_time64_fromtext(source, &value64);
 	if (result != ISC_R_SUCCESS)
 		return (result);
-	value32 = (isc_uint32_t)value64;
-	if (value32 != value64)
-		return (ISC_R_RANGE);
-	*target = value32;
+	*target = (isc_uint32_t)value64;
 
 	return (ISC_R_SUCCESS);
 }
diff --git a/usr.sbin/bind/lib/dns/view.c b/usr.sbin/bind/lib/dns/view.c
index d07d78d6527..fe7df497c2d 100644
--- a/usr.sbin/bind/lib/dns/view.c
+++ b/usr.sbin/bind/lib/dns/view.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,10 +15,11 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: view.c,v 1.103.2.2 2002/08/05 06:57:12 marka Exp $ */
+/* $ISC: view.c,v 1.103.2.9 2003/09/19 13:24:03 marka Exp $ */
 
 #include <config.h>
 
+#include <isc/hash.h>
 #include <isc/task.h>
 #include <isc/string.h>		/* Required for HP/UX (and others?) */
 #include <isc/util.h>
@@ -162,6 +163,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->maxncachettl = 3 * 3600;
 	view->dstport = 53;
 	view->flush = ISC_FALSE;
+	view->delonly = NULL;
+	view->rootdelonly = ISC_FALSE;
+	view->rootexclude = NULL;
 
 	result = dns_peerlist_new(view->mctx, &view->peers);
 	if (result != ISC_R_SUCCESS)
@@ -275,6 +279,24 @@ destroy(dns_view_t *view) {
 			    DNS_VIEW_DELONLYHASH);
 		view->delonly = NULL;
 	}
+	if (view->rootexclude != NULL) {
+		dns_name_t *name;
+		int i;
+
+		for (i = 0; i < DNS_VIEW_DELONLYHASH; i++) {
+			name = ISC_LIST_HEAD(view->rootexclude[i]);
+			while (name != NULL) {
+				ISC_LIST_UNLINK(view->rootexclude[i],
+					 	name, link);
+				dns_name_free(name, view->mctx);
+				isc_mem_put(view->mctx, name, sizeof(*name));
+				name = ISC_LIST_HEAD(view->rootexclude[i]);
+			}
+		}
+		isc_mem_put(view->mctx, view->rootexclude,
+			    sizeof(dns_namelist_t) * DNS_VIEW_DELONLYHASH);
+		view->rootexclude = NULL;
+	}
 	dns_keytable_detach(&view->trustedkeys);
 	dns_keytable_detach(&view->secroots);
 	dns_fwdtable_destroy(&view->fwdtable);
@@ -871,9 +893,20 @@ dns_view_simplefind(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 isc_result_t
 dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 		     isc_stdtime_t now, unsigned int options,
-		     isc_boolean_t use_hints,
+		     isc_boolean_t use_hints, 
 		     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
 {
+	return(dns_view_findzonecut2(view, name, fname, now, options,
+				     use_hints, ISC_TRUE,
+				     rdataset, sigrdataset));
+}
+
+isc_result_t
+dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
+		      isc_stdtime_t now, unsigned int options,
+		      isc_boolean_t use_hints,  isc_boolean_t use_cache,
+		      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+{
 	isc_result_t result;
 	dns_db_t *db;
 	isc_boolean_t is_cache, use_zone, try_hints;
@@ -910,7 +943,7 @@ dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 		 * is it a subdomain of any zone for which we're
 		 * authoritative.
 		 */
-		if (view->cachedb != NULL) {
+		if (use_cache && view->cachedb != NULL) {
 			/*
 			 * We have a cache; try it.
 			 */
@@ -941,7 +974,7 @@ dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 			result = ISC_R_SUCCESS;
 		else if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		if (view->cachedb != NULL && db != view->hints) {
+		if (use_cache && view->cachedb != NULL && db != view->hints) {
 			/*
 			 * We found an answer, but the cache may be better.
 			 */
@@ -1191,6 +1224,41 @@ dns_view_adddelegationonly(dns_view_t *view, dns_name_t *name) {
 	return (result);
 }
 
+isc_result_t
+dns_view_excludedelegationonly(dns_view_t *view, dns_name_t *name) {
+	isc_result_t result;
+	dns_name_t *new;
+	isc_uint32_t hash;
+
+	REQUIRE(DNS_VIEW_VALID(view));
+
+	if (view->rootexclude == NULL) {
+		view->rootexclude = isc_mem_get(view->mctx,
+					    sizeof(dns_namelist_t) *
+					    DNS_VIEW_DELONLYHASH);
+		if (view->rootexclude == NULL)
+			return (ISC_R_NOMEMORY);
+		for (hash = 0; hash < DNS_VIEW_DELONLYHASH; hash++)
+			ISC_LIST_INIT(view->rootexclude[hash]);
+	}
+	hash = dns_name_hash(name, ISC_FALSE) % DNS_VIEW_DELONLYHASH;
+	new = ISC_LIST_HEAD(view->rootexclude[hash]);
+	while (new != NULL && !dns_name_equal(new, name))
+		new = ISC_LIST_NEXT(new, link);
+	if (new != NULL)
+		return (ISC_R_SUCCESS);
+	new = isc_mem_get(view->mctx, sizeof(*new));
+	if (new == NULL)
+		return (ISC_R_NOMEMORY);
+	dns_name_init(new, NULL);
+	result = dns_name_dup(name, view->mctx, new);
+	if (result == ISC_R_SUCCESS)
+		ISC_LIST_APPEND(view->rootexclude[hash], new, link);
+	else
+		isc_mem_put(view->mctx, new, sizeof(*new));
+	return (result);
+}
+
 isc_boolean_t
 dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name) {
 	dns_name_t *new;
@@ -1198,10 +1266,23 @@ dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name) {
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
-	if (view->delonly == NULL)
+	if (!view->rootdelonly && view->delonly == NULL)
 		return (ISC_FALSE);
 
 	hash = dns_name_hash(name, ISC_FALSE) % DNS_VIEW_DELONLYHASH;
+	if (view->rootdelonly && dns_name_countlabels(name) <= 2) {
+		if (view->rootexclude == NULL)
+			return (ISC_TRUE);
+		new = ISC_LIST_HEAD(view->rootexclude[hash]);
+		while (new != NULL && !dns_name_equal(new, name))
+			new = ISC_LIST_NEXT(new, link);
+		if (new == NULL)
+			return (ISC_TRUE);
+	}
+
+	if (view->delonly == NULL)
+		return (ISC_FALSE);
+
 	new = ISC_LIST_HEAD(view->delonly[hash]);
 	while (new != NULL && !dns_name_equal(new, name))
 		new = ISC_LIST_NEXT(new, link);
@@ -1209,3 +1290,15 @@ dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name) {
 		return (ISC_FALSE);
 	return (ISC_TRUE);
 }
+
+void 
+dns_view_setrootdelonly(dns_view_t *view, isc_boolean_t value) {
+	REQUIRE(DNS_VIEW_VALID(view));
+	view->rootdelonly = value;
+}
+
+isc_boolean_t
+dns_view_getrootdelonly(dns_view_t *view) {
+	REQUIRE(DNS_VIEW_VALID(view));
+	return (view->rootdelonly);
+}
diff --git a/usr.sbin/bind/lib/dns/xfrin.c b/usr.sbin/bind/lib/dns/xfrin.c
index 2ee488810fc..1b76a18b06b 100644
--- a/usr.sbin/bind/lib/dns/xfrin.c
+++ b/usr.sbin/bind/lib/dns/xfrin.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: xfrin.c,v 1.124.2.2 2001/09/12 20:44:04 gson Exp $ */
+/* $ISC: xfrin.c,v 1.124.2.4 2003/07/22 04:03:45 marka Exp $ */
 
 #include <config.h>
 
@@ -1166,11 +1166,6 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) {
 
 		name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
-		if (!dns_name_issubdomain(name, &xfr->name)) {
-			xfrin_log(xfr, ISC_LOG_WARNING,
-				  "ignoring out-of-zone data");
-			continue;
-		}
 		for (rds = ISC_LIST_HEAD(name->list);
 		     rds != NULL;
 		     rds = ISC_LIST_NEXT(rds, link))
diff --git a/usr.sbin/bind/lib/dns/zone.c b/usr.sbin/bind/lib/dns/zone.c
index ee3793dbe8e..8a3d4f992eb 100644
--- a/usr.sbin/bind/lib/dns/zone.c
+++ b/usr.sbin/bind/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: zone.c,v 1.333.2.13.4.2 2003/02/17 07:05:08 marka Exp $ */
+/* $ISC: zone.c,v 1.333.2.23 2003/07/28 07:03:15 marka Exp $ */
 
 #include <config.h>
 
@@ -409,7 +409,7 @@ static isc_result_t zone_dump(dns_zone_t *);
 static void got_transfer_quota(isc_task_t *task, isc_event_t *event);
 static isc_result_t zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr,
 					     dns_zone_t *zone);
-static void zmgr_resume_xfrs(dns_zonemgr_t *zmgr);
+static void zmgr_resume_xfrs(dns_zonemgr_t *zmgr, isc_boolean_t multi);
 static void zonemgr_free(dns_zonemgr_t *zmgr);
 static isc_result_t zonemgr_getio(dns_zonemgr_t *zmgr, isc_boolean_t high,
 				  isc_task_t *task, isc_taskaction_t action,
@@ -950,6 +950,24 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 				goto cleanup;
 			}
 		}
+	} 
+
+	INSIST(zone->db_argc >= 1);
+
+	if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub) &&
+	    (strcmp(zone->db_argv[0], "rbt") == 0 ||
+	     strcmp(zone->db_argv[0], "rbt64") == 0)) {
+		if (zone->masterfile == NULL ||
+		    !isc_file_exists(zone->masterfile)) {
+			if (zone->masterfile != NULL)
+				dns_zone_log(zone, ISC_LOG_DEBUG(1),
+					     "no master file");
+			zone->refreshtime = now;
+			if (zone->task != NULL)
+				zone_settimer(zone, &now);
+			result = ISC_R_SUCCESS;
+			goto cleanup;
+		}
 	}
 
 	dns_zone_log(zone, ISC_LOG_DEBUG(1), "starting load");
@@ -964,7 +982,6 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	INSIST(zone->db_argc >= 1);
 	result = dns_db_create(zone->mctx, zone->db_argv[0],
 			       &zone->origin, (zone->type == dns_zone_stub) ?
 			       dns_dbtype_stub : dns_dbtype_zone,
@@ -1024,6 +1041,7 @@ static void
 zone_gotreadhandle(isc_task_t *task, isc_event_t *event) {
 	dns_load_t *load = event->ev_arg;
 	isc_result_t result = ISC_R_SUCCESS;
+	unsigned int options;
 
 	REQUIRE(DNS_LOAD_VALID(load));
 
@@ -1033,11 +1051,14 @@ zone_gotreadhandle(isc_task_t *task, isc_event_t *event) {
 	if (result == ISC_R_CANCELED)
 		goto fail;
 
+	options = DNS_MASTER_ZONE;
+	if (load->zone->type == dns_zone_slave)
+		options |= DNS_MASTER_SLAVE;
 	result = dns_master_loadfileinc(load->zone->masterfile,
 					dns_db_origin(load->db),
 					dns_db_origin(load->db),
 					load->zone->rdclass,
-					DNS_MASTER_ZONE,
+					options,
 					&load->callbacks, task,
 					zone_loaddone, load,
 					&load->zone->lctx, load->zone->mctx);
@@ -1055,7 +1076,13 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 	dns_load_t *load;
 	isc_result_t result;
 	isc_result_t tresult;
+	unsigned int options;
 
+	options = DNS_MASTER_ZONE;
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS))
+		options |= DNS_MASTER_MANYERRORS;
+	if (zone->type == dns_zone_slave)
+		options |= DNS_MASTER_SLAVE;
 	if (zone->zmgr != NULL && zone->db != NULL && zone->task != NULL) {
 		load = isc_mem_get(zone->mctx, sizeof(*load));
 		if (load == NULL)
@@ -1088,14 +1115,12 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 			result = DNS_R_CONTINUE;
 	} else if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS)) {
 		dns_rdatacallbacks_t    callbacks;
-		unsigned int options;
 
 		dns_rdatacallbacks_init(&callbacks);
 		result = dns_db_beginload(db, &callbacks.add,
 					  &callbacks.add_private);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-		options = DNS_MASTER_MANYERRORS|DNS_MASTER_ZONE;
 		result = dns_master_loadfile(zone->masterfile, &zone->origin,
 					     &zone->origin, zone->rdclass,
 					     options, &callbacks, zone->mctx);
@@ -1318,6 +1343,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 
 		/* Mark the zone for immediate refresh. */
 		zone->refreshtime = now;
+		if (zone->task != NULL)
+			zone_settimer(zone, &now);
 		result = ISC_R_SUCCESS;
 	}
 	return (result);
@@ -3477,7 +3504,24 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 	zone->masteraddr = zone->masters[zone->curmaster];
 
 	isc_netaddr_fromsockaddr(&masterip, &zone->masteraddr);
-	(void)dns_view_getpeertsig(zone->view, &masterip, &key);
+	/*
+	 * First, look for a tsig key in the master statement, then
+	 * try for a server key.
+	 */
+	if ((zone->masterkeynames != NULL) &&
+	    (zone->masterkeynames[zone->curmaster] != NULL)) {
+		dns_view_t *view = dns_zone_getview(zone);
+		dns_name_t *keyname = zone->masterkeynames[zone->curmaster];
+		result = dns_view_gettsig(view, keyname, &key);
+		if (result != ISC_R_SUCCESS) {
+			char namebuf[DNS_NAME_FORMATSIZE];
+			dns_name_format(keyname, namebuf, sizeof(namebuf));
+			dns_zone_log(zone, ISC_LOG_ERROR,
+			             "unable to find key: %s", namebuf);
+		}
+	}
+	if (key == NULL)
+		(void)dns_view_getpeertsig(zone->view, &masterip, &key);
 
 	options = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_USEVC) ?
 		  DNS_REQUESTOPT_TCP : 0;
@@ -3618,7 +3662,24 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	zone->masteraddr = zone->masters[zone->curmaster];
 
 	isc_netaddr_fromsockaddr(&masterip, &zone->masteraddr);
-	(void)dns_view_getpeertsig(zone->view, &masterip, &key);	
+	/*
+	 * First, look for a tsig key in the master statement, then
+	 * try for a server key.
+	 */
+	if ((zone->masterkeynames != NULL) &&
+	    (zone->masterkeynames[zone->curmaster] != NULL)) {
+		dns_view_t *view = dns_zone_getview(zone);
+		dns_name_t *keyname = zone->masterkeynames[zone->curmaster];
+		result = dns_view_gettsig(view, keyname, &key);
+		if (result != ISC_R_SUCCESS) {
+			char namebuf[DNS_NAME_FORMATSIZE];
+			dns_name_format(keyname, namebuf, sizeof(namebuf));
+			dns_zone_log(zone, ISC_LOG_ERROR,
+			             "unable to find key: %s", namebuf);
+		}
+	}
+	if (key == NULL)
+		(void)dns_view_getpeertsig(zone->view, &masterip, &key);	
 
 	/*
 	 * Always use TCP so that we shouldn't truncate in additional section.
@@ -3667,6 +3728,8 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	if (message != NULL)
 		dns_message_destroy(&message);
   unlock:
+        if (key != NULL)
+		dns_tsigkey_detach(&key);
 	UNLOCK_ZONE(zone);
 	return;
 }
@@ -3678,7 +3741,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 static void
 zone_shutdown(isc_task_t *task, isc_event_t *event) {
 	dns_zone_t *zone = (dns_zone_t *) event->ev_arg;
-	isc_boolean_t free_needed;
+	isc_boolean_t free_needed, linked = ISC_FALSE;
 
 	UNUSED(task);
 	REQUIRE(DNS_ZONE_VALID(zone));
@@ -3704,6 +3767,7 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 		if (zone->statelist == &zone->zmgr->waiting_for_xfrin) {
 			ISC_LIST_UNLINK(zone->zmgr->waiting_for_xfrin, zone,
 					statelink);
+			linked = ISC_TRUE;
 			zone->statelist = NULL;
 		}
 		RWUNLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
@@ -3716,6 +3780,10 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
 		dns_xfrin_shutdown(zone->xfr);
 
 	LOCK_ZONE(zone);
+	if (linked) {
+		INSIST(zone->irefs > 0);
+		zone->irefs--;
+	}
 	if (zone->request != NULL) {
 		dns_request_cancel(zone->request);
 	}
@@ -4339,7 +4407,7 @@ zone_tostr(dns_zone_t *zone, char *buf, size_t length) {
 	isc_buffer_t buffer;
 
 	REQUIRE(buf != NULL);
-	REQUIRE(length > 1);
+	REQUIRE(length > 1U);
 
 	/*
 	 * Leave space for terminating '\0'.
@@ -4689,6 +4757,7 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	unsigned int nscount;
 	isc_uint32_t serial, refresh, retry, expire, minimum;
 	isc_result_t xfrresult = result;
+	isc_boolean_t free_needed;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
@@ -4820,8 +4889,7 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	RWLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
 	ISC_LIST_UNLINK(zone->zmgr->xfrin_in_progress, zone, statelink);
 	zone->statelist = NULL;
-	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING))
-		zmgr_resume_xfrs(zone->zmgr);
+	zmgr_resume_xfrs(zone->zmgr, ISC_FALSE);
 	RWUNLOCK(&zone->zmgr->rwlock, isc_rwlocktype_write);
 
 	/*
@@ -4829,7 +4897,13 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	 */
 	if (again && !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_EXITING))
 		queue_soa_query(zone);
+
+	INSIST(zone->irefs > 0);
+	zone->irefs--;
+	free_needed = exit_check(zone);
 	UNLOCK_ZONE(zone);
+	if (free_needed)
+		zone_free(zone);
 }
 
 static void
@@ -4913,6 +4987,9 @@ queue_xfrin(dns_zone_t *zone) {
 
 	RWLOCK(&zmgr->rwlock, isc_rwlocktype_write);
 	ISC_LIST_APPEND(zmgr->waiting_for_xfrin, zone, statelink);
+	LOCK_ZONE(zone);
+	zone->irefs++;
+	UNLOCK_ZONE(zone);
 	zone->statelist = &zmgr->waiting_for_xfrin;
 	result = zmgr_start_xfrin_ifquota(zmgr, zone);
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write);
@@ -5043,9 +5120,6 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 		dns_tsigkey_detach(&tsigkey);
 
 	isc_event_free(&event);
-
-	dns_zone_detach(&zone); /* XXXAG */
-	return;
 }
 
 /*
@@ -5494,6 +5568,7 @@ dns_zonemgr_forcemaint(dns_zonemgr_t *zmgr) {
 	{
 		dns_zone_maintenance(p);
 	}
+	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
 
 	/*
 	 * Recent configuration changes may have increased the
@@ -5501,9 +5576,9 @@ dns_zonemgr_forcemaint(dns_zonemgr_t *zmgr) {
 	 * transfers currently blocked on quota get started if
 	 * possible.
 	 */
-	zmgr_resume_xfrs(zmgr);
-
-	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
+	RWLOCK(&zmgr->rwlock, isc_rwlocktype_write);
+	zmgr_resume_xfrs(zmgr, ISC_TRUE);
+	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write);
 	return (ISC_R_SUCCESS);
 }
 
@@ -5573,16 +5648,20 @@ dns_zonemgr_getttransfersperns(dns_zonemgr_t *zmgr) {
  *	The zone manager is locked by the caller.
  */
 static void
-zmgr_resume_xfrs(dns_zonemgr_t *zmgr) {
+zmgr_resume_xfrs(dns_zonemgr_t *zmgr, isc_boolean_t multi) {
 	dns_zone_t *zone;
+	dns_zone_t *next;
 
 	for (zone = ISC_LIST_HEAD(zmgr->waiting_for_xfrin);
 	     zone != NULL;
-	     zone = ISC_LIST_NEXT(zone, statelink))
+	     zone = next)
 	{
 		isc_result_t result;
+		next = ISC_LIST_NEXT(zone, statelink);
 		result = zmgr_start_xfrin_ifquota(zmgr, zone);
 		if (result == ISC_R_SUCCESS) {
+			if (multi)
+				continue;
 			/*
 			 * We successfully filled the slot.  We're done.
 			 */
@@ -5590,7 +5669,7 @@ zmgr_resume_xfrs(dns_zonemgr_t *zmgr) {
 		} else if (result == ISC_R_QUOTA) {
 			/*
 			 * Not enough quota.  This is probably the per-server
-			 * quota, because we only get called when a unit of
+			 * quota, because we usually get called when a unit of
 			 * global quota has just been freed.  Try the next
 			 * zone, it may succeed if it uses another master.
 			 */
@@ -5686,14 +5765,6 @@ zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
 	ISC_LIST_UNLINK(zmgr->waiting_for_xfrin, zone, statelink);
 	ISC_LIST_APPEND(zmgr->xfrin_in_progress, zone, statelink);
 	zone->statelist = &zmgr->xfrin_in_progress;
-	/*
-	 * Make sure the zone does not go away before it has processed
-	 * the event; in effect, the event is attached to the zone.
-	 *
-	 * XXXAG This should be done as soon as the zone goes on the
-	 * queue, using irefs.
-	 */
-	isc_refcount_increment(&zone->erefs, NULL);
 	isc_task_send(zone->task, &e);
 	UNLOCK_ZONE(zone);
 
@@ -5895,7 +5966,7 @@ dns_zonemgr_setserialqueryrate(dns_zonemgr_t *zmgr, unsigned int value) {
 		s = 1;
 		ns = 0;
 		pertic = 1;		
-	} else if (value < 10) {
+	} else if (value <= 10) {
 		s = 0;
 		ns = 1000000000 / value;
 		pertic = 1;
diff --git a/usr.sbin/bind/lib/isc/Makefile.in b/usr.sbin/bind/lib/isc/Makefile.in
index e271abde47f..033827e6f61 100644
--- a/usr.sbin/bind/lib/isc/Makefile.in
+++ b/usr.sbin/bind/lib/isc/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 1998-2001  Internet Software Consortium.
+# Copyright (C) 1998-2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: Makefile.in,v 1.71.2.1 2001/10/22 23:28:13 gson Exp $
+# $ISC: Makefile.in,v 1.71.2.3 2003/10/09 07:32:47 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -52,7 +52,7 @@ WIN32OBJS = 	win32/condition.@O@ win32/dir.@O@ win32/file.@O@ \
 OBJS =		@ISC_EXTRA_OBJS@ \
 		assertions.@O@ base64.@O@ bitstring.@O@ buffer.@O@ \
 		bufferlist.@O@ commandline.@O@ error.@O@ event.@O@ \
-		heap.@O@ hex.@O@ hmacmd5.@O@ \
+		hash.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ \
 		lcg.@O@ lex.@O@ lfsr.@O@ lib.@O@ log.@O@ \
 		md5.@O@ mem.@O@ mutexblock.@O@ netaddr.@O@ ondestroy.@O@ \
 		quota.@O@ random.@O@ \
diff --git a/usr.sbin/bind/lib/isc/api b/usr.sbin/bind/lib/isc/api
index ca855cad96d..f32e146f9f0 100644
--- a/usr.sbin/bind/lib/isc/api
+++ b/usr.sbin/bind/lib/isc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 6
-LIBREVISION = 0
-LIBAGE = 2
+LIBINTERFACE = 7
+LIBREVISION = 1
+LIBAGE = 0
diff --git a/usr.sbin/bind/lib/isc/base64.c b/usr.sbin/bind/lib/isc/base64.c
index f12c4a2d7ef..c6ef07ef5c6 100644
--- a/usr.sbin/bind/lib/isc/base64.c
+++ b/usr.sbin/bind/lib/isc/base64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2001  Internet Software Consortium.
+ * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: base64.c,v 1.23 2001/03/22 00:07:04 bwelling Exp $ */
+/* $ISC: base64.c,v 1.23.2.2 2003/07/22 04:03:47 marka Exp $ */
 
 #include <config.h>
 
@@ -126,6 +126,17 @@ base64_decode_char(base64_decode_ctx_t *ctx, int c) {
 			return (ISC_R_BADBASE64);
 		if (ctx->val[2] == 64 && ctx->val[3] != 64)
 			return (ISC_R_BADBASE64);
+		/*
+		 * Check that bits that should be zero are.
+		 */
+		if (ctx->val[2] == 64 && (ctx->val[1] & 0xf) != 0)
+			return (ISC_R_BADBASE64);
+		/*
+		 * We don't need to test for ctx->val[2] != 64 as
+		 * the bottom two bits of 64 are zero.
+		 */
+		if (ctx->val[3] == 64 && (ctx->val[2] & 0x3) != 0)
+			return (ISC_R_BADBASE64);
 		n = (ctx->val[2] == 64) ? 1 :
 			(ctx->val[3] == 64) ? 2 : 3;
 		if (n != 3) {
diff --git a/usr.sbin/bind/lib/isc/entropy.c b/usr.sbin/bind/lib/isc/entropy.c
index de2e8628bb2..5eb991a4d96 100644
--- a/usr.sbin/bind/lib/isc/entropy.c
+++ b/usr.sbin/bind/lib/isc/entropy.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: entropy.c,v 1.3.2.1 2001/09/06 00:14:17 gson Exp $ */
+/* $ISC: entropy.c,v 1.3.2.3 2003/10/09 07:32:47 marka Exp $ */
 
 /*
  * This is the system independent part of the entropy module.  It is
@@ -303,7 +303,7 @@ entropypool_adddata(isc_entropy_t *ent, void *p, unsigned int len,
 	addr = (unsigned long)p;
 	buf = p;
 
-	if ((addr & 0x03) != 0) {
+	if ((addr & 0x03U) != 0U) {
 		val = 0;
 		switch (len) {
 		case 3:
diff --git a/usr.sbin/bind/lib/isc/include/isc/log.h b/usr.sbin/bind/lib/isc/include/isc/log.h
index 82b40cdd894..d870de6f457 100644
--- a/usr.sbin/bind/lib/isc/include/isc/log.h
+++ b/usr.sbin/bind/lib/isc/include/isc/log.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: log.h,v 1.39.2.2 2002/08/05 06:57:15 marka Exp $ */
+/* $ISC: log.h,v 1.39.2.4 2003/07/22 04:03:49 marka Exp $ */
 
 #ifndef ISC_LOG_H
 #define ISC_LOG_H 1
@@ -61,6 +61,7 @@
 #define ISC_LOG_PRINTTAG	0x0010
 #define ISC_LOG_PRINTALL	0x001F
 #define ISC_LOG_DEBUGONLY	0x1000
+#define ISC_LOG_OPENERR		0x8000		/* internal */
 
 /*
  * Other options.
diff --git a/usr.sbin/bind/lib/isc/include/isc/refcount.h b/usr.sbin/bind/lib/isc/include/isc/refcount.h
index 6ad94811847..a79a6a156c0 100644
--- a/usr.sbin/bind/lib/isc/include/isc/refcount.h
+++ b/usr.sbin/bind/lib/isc/include/isc/refcount.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001  Internet Software Consortium.
+ * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: refcount.h,v 1.3 2001/02/09 00:26:20 gson Exp $ */
+/* $ISC: refcount.h,v 1.3.2.3 2003/10/09 07:32:50 marka Exp $ */
 
 #ifndef ISC_REFCOUNT_H
 #define ISC_REFCOUNT_H 1
@@ -111,21 +111,23 @@ typedef struct isc_refcount {
 
 #define isc_refcount_increment(rp, tp)				\
 	do {							\
+		unsigned int *_tmp = (unsigned int *)(tp);	\
 		LOCK(&(rp)->lock);				\
 		REQUIRE((rp)->refs > 0);			\
 		++((rp)->refs);					\
-		if ((tp) != NULL)				\
-			*(unsigned int *)(tp) = ((rp)->refs);	\
+		if (_tmp != NULL)				\
+			*_tmp = ((rp)->refs);			\
 		UNLOCK(&(rp)->lock);				\
 	} while (0)
 
 #define isc_refcount_decrement(rp, tp)				\
 	do {							\
+		unsigned int *_tmp = (unsigned int *)(tp);	\
 		LOCK(&(rp)->lock);				\
 		REQUIRE((rp)->refs > 0);			\
 		--((rp)->refs);					\
-		if ((tp) != NULL)				\
-			*(unsigned int *)(tp) = ((rp)->refs);	\
+		if (_tmp != NULL)				\
+			*_tmp = ((rp)->refs);			\
 		UNLOCK(&(rp)->lock);				\
 	} while (0)
 
diff --git a/usr.sbin/bind/lib/isc/include/isc/rwlock.h b/usr.sbin/bind/lib/isc/include/isc/rwlock.h
index b8316a6d14c..a9bc8d17fb0 100644
--- a/usr.sbin/bind/lib/isc/include/isc/rwlock.h
+++ b/usr.sbin/bind/lib/isc/include/isc/rwlock.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2001  Internet Software Consortium.
+ * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rwlock.h,v 1.18 2001/03/08 00:55:15 tale Exp $ */
+/* $ISC: rwlock.h,v 1.18.2.3 2003/07/22 04:03:49 marka Exp $ */
 
 #ifndef ISC_RWLOCK_H
 #define ISC_RWLOCK_H 1
@@ -57,6 +57,7 @@ struct isc_rwlock {
 	unsigned int		writers_waiting;
 	unsigned int		read_quota;
 	unsigned int		write_quota;
+	isc_rwlocktype_t	original;
 };
 #else /* ISC_PLATFORM_USETHREADS */
 struct isc_rwlock {
@@ -80,6 +81,12 @@ isc_rwlock_trylock(isc_rwlock_t *rwl, isc_rwlocktype_t type);
 isc_result_t
 isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type);
 
+isc_result_t
+isc_rwlock_tryupgrade(isc_rwlock_t *rwl);
+
+void
+isc_rwlock_downgrade(isc_rwlock_t *rwl);
+
 void
 isc_rwlock_destroy(isc_rwlock_t *rwl);
 
diff --git a/usr.sbin/bind/lib/isc/include/isc/types.h b/usr.sbin/bind/lib/isc/include/isc/types.h
index 3b5dce31028..9a81248781a 100644
--- a/usr.sbin/bind/lib/isc/include/isc/types.h
+++ b/usr.sbin/bind/lib/isc/include/isc/types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: types.h,v 1.32.2.2 2002/08/06 06:09:07 marka Exp $ */
+/* $ISC: types.h,v 1.32.2.4 2003/10/09 07:32:50 marka Exp $ */
 
 #ifndef ISC_TYPES_H
 #define ISC_TYPES_H 1
@@ -52,6 +52,7 @@ typedef struct isc_event		isc_event_t;
 typedef ISC_LIST(isc_event_t)		isc_eventlist_t;
 typedef unsigned int			isc_eventtype_t;
 typedef isc_uint32_t			isc_fsaccess_t;
+typedef struct isc_hash			isc_hash_t;
 typedef struct isc_interface		isc_interface_t;
 typedef struct isc_interfaceiter	isc_interfaceiter_t;
 typedef struct isc_interval		isc_interval_t;
diff --git a/usr.sbin/bind/lib/isc/inet_pton.c b/usr.sbin/bind/lib/isc/inet_pton.c
index f938a01ce4b..ccaf2056fa8 100644
--- a/usr.sbin/bind/lib/isc/inet_pton.c
+++ b/usr.sbin/bind/lib/isc/inet_pton.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1996-2002  Internet Software Consortium.
+ * Copyright (C) 1996-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -17,7 +17,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static char rcsid[] =
-	"$ISC: inet_pton.c,v 1.10.2.2 2002/03/26 00:55:06 marka Exp $";
+	"$ISC: inet_pton.c,v 1.10.2.4 2003/07/22 04:03:47 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -196,6 +196,8 @@ inet_pton6(const char *src, unsigned char *dst) {
 		const int n = tp - colonp;
 		int i;
 
+		if (tp == endp)
+			return (0);
 		for (i = 1; i <= n; i++) {
 			endp[- i] = colonp[n - i];
 			colonp[n - i] = 0;
diff --git a/usr.sbin/bind/lib/isc/lex.c b/usr.sbin/bind/lib/isc/lex.c
index 8f87d1cef81..1e5d9183015 100644
--- a/usr.sbin/bind/lib/isc/lex.c
+++ b/usr.sbin/bind/lib/isc/lex.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: lex.c,v 1.66.2.5 2002/03/26 00:55:07 marka Exp $ */
+/* $ISC: lex.c,v 1.66.2.7 2003/10/09 07:32:48 marka Exp $ */
 
 #include <config.h>
 
@@ -92,7 +92,7 @@ isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp) {
 	 */
 
 	REQUIRE(lexp != NULL && *lexp == NULL);
-	REQUIRE(max_token > 0);
+	REQUIRE(max_token > 0U);
 
 	lex = isc_mem_get(mctx, sizeof *lex);
 	if (lex == NULL)
@@ -621,13 +621,13 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					state = lexstate_string;
 				}
 			}
-			if (remaining == 0) {
+			if (remaining == 0U) {
 				result = grow_data(lex, &remaining,
 						   &curr, &prev);
 				if (result != ISC_R_SUCCESS)
 					goto done;
 			}
-			INSIST(remaining > 0);
+			INSIST(remaining > 0U);
 			*curr++ = c;
 			*curr = '\0';
 			remaining--;
@@ -651,13 +651,13 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			if ((options & ISC_LEXOPT_ESCAPE) != 0)
 				escaped = (!escaped && c == '\\') ?
 						ISC_TRUE : ISC_FALSE;
-			if (remaining == 0) {
+			if (remaining == 0U) {
 				result = grow_data(lex, &remaining,
 						   &curr, &prev);
 				if (result != ISC_R_SUCCESS)
 					goto done;
 			}
-			INSIST(remaining > 0);
+			INSIST(remaining > 0U);
 			*curr++ = c;
 			*curr = '\0';
 			remaining--;
@@ -748,13 +748,13 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					escaped = ISC_TRUE;
 				else
 					escaped = ISC_FALSE;
-				if (remaining == 0) {
+				if (remaining == 0U) {
 					result = grow_data(lex, &remaining,
 							   &curr, &prev);
 					if (result != ISC_R_SUCCESS)
 						goto done;
 				}
-				INSIST(remaining > 0);
+				INSIST(remaining > 0U);
 				prev = curr;
 				*curr++ = c;
 				*curr = '\0';
diff --git a/usr.sbin/bind/lib/isc/lfsr.c b/usr.sbin/bind/lib/isc/lfsr.c
index f68c428d44b..697d7d26232 100644
--- a/usr.sbin/bind/lib/isc/lfsr.c
+++ b/usr.sbin/bind/lib/isc/lfsr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: lfsr.c,v 1.11 2001/01/09 21:56:11 bwelling Exp $ */
+/* $ISC: lfsr.c,v 1.11.2.2 2003/07/22 04:03:47 marka Exp $ */
 
 #include <config.h>
 
diff --git a/usr.sbin/bind/lib/isc/log.c b/usr.sbin/bind/lib/isc/log.c
index 6216cc40e2e..83c5a467832 100644
--- a/usr.sbin/bind/lib/isc/log.c
+++ b/usr.sbin/bind/lib/isc/log.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: log.c,v 1.70.2.5 2002/07/11 03:39:06 marka Exp $ */
+/* $ISC: log.c,v 1.70.2.9 2003/09/17 05:20:04 marka Exp $ */
 
 /* Principal Authors: DCL */
 
@@ -36,6 +36,7 @@
 #include <isc/mem.h>
 #include <isc/msgs.h>
 #include <isc/print.h>
+#include <isc/stat.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/time.h>
@@ -52,6 +53,10 @@
  */
 #define LOG_BUFFER_SIZE	(8 * 1024)
 
+#ifndef PATH_MAX
+#define PATH_MAX 1024	/* AIX and others don't define this. */
+#endif
+
 /*
  * This is the structure that holds each named channel.  A simple linked
  * list chains all of the channels together, so an individual channel is
@@ -1186,9 +1191,9 @@ greatest_version(isc_logchannel_t *channel, int *greatestp) {
 
 static isc_result_t
 roll_log(isc_logchannel_t *channel) {
-	int i, greatest, digits = 0;
-	char current[FILENAME_MAX + 1];
-	char new[FILENAME_MAX + 1];
+	int i, n, greatest;
+	char current[PATH_MAX + 1];
+	char new[PATH_MAX + 1];
 	const char *path;
 	isc_result_t result;
 
@@ -1232,37 +1237,58 @@ roll_log(isc_logchannel_t *channel) {
 		 * Remove any excess logs on the way to that value.
 		 */
 		while (--greatest >= FILE_VERSIONS(channel)) {
-			snprintf(current, sizeof current, "%s.%d", path, greatest);
-			(void)remove(current);
+			n = snprintf(current, sizeof(current), "%s.%d",
+				     path, greatest);
+			if (n >= (int)sizeof(current) || n < 0)
+				result = ISC_R_NOSPACE;
+			else
+				result = isc_file_remove(current);
+			if (result != ISC_R_SUCCESS &&
+			    result != ISC_R_FILENOTFOUND)
+				syslog(LOG_ERR,
+				       "unable to remove log file '%s.%d': %s",
+				       path, greatest,
+				       isc_result_totext(result));
 		}
 
-	for (i = greatest; i > 0; i /= 10)
-		digits++;
-
-	/*
-	 * Ensure the name fits in the filesystem.  Note that in this will not
-	 * trigger failure until there is going to be a log rolled into a name
-	 * that is too long, not when the maximum possible version name would
-	 * be too long.  Imagine a case where the name for logs 0-9 is exactly
-	 * as long as the maximum filename, but FILE_VERSIONS is configured as
-	 * 11.  log.10's name will be too long, but no error will be triggered
-	 * until log.9 exists and needs to be rolled.
-	 */
-	if (strlen(path) + 1 + digits > FILENAME_MAX)
-		return (ISC_R_INVALIDFILE);
-
 	for (i = greatest; i > 0; i--) {
-		snprintf(current, sizeof current, "%s.%d", path, i - 1);
-		snprintf(new, sizeof new, "%s.%d", path, i);
-		(void)isc_file_rename(current, new);
+		result = ISC_R_SUCCESS;
+		n = snprintf(current, sizeof(current), "%s.%d", path, i - 1);
+		if (n >= (int)sizeof(current) || n < 0)
+			result = ISC_R_NOSPACE;
+		if (result == ISC_R_SUCCESS) {
+			n = snprintf(new, sizeof(new), "%s.%d", path, i);
+			if (n >= (int)sizeof(new) || n < 0)
+				result = ISC_R_NOSPACE;
+		}
+		if (result == ISC_R_SUCCESS)
+			result = isc_file_rename(current, new);
+		if (result != ISC_R_SUCCESS &&
+		    result != ISC_R_FILENOTFOUND)
+			syslog(LOG_ERR,
+			       "unable to rename log file '%s.%d' to "
+			       "'%s.%d': %s", path, i - 1, path, i,
+			       isc_result_totext(result));
 	}
 
 	if (FILE_VERSIONS(channel) != 0) {
-		snprintf(new, sizeof new, "%s.0", path);
-		(void)isc_file_rename(path, new);
-
-	} else if (FILE_VERSIONS(channel) == 0)
-		(void)remove(path);
+		n = snprintf(new, sizeof(new), "%s.0", path);
+		if (n >= (int)sizeof(new) || n < 0)
+			result = ISC_R_NOSPACE;
+		else
+			result = isc_file_rename(path, new);
+		if (result != ISC_R_SUCCESS &&
+		    result != ISC_R_FILENOTFOUND)
+			syslog(LOG_ERR,
+			       "unable to rename log file '%s' to '%s.0': %s",
+			       path, path, isc_result_totext(result));
+	} else {
+		result = isc_file_remove(path);
+		if (result != ISC_R_SUCCESS &&
+		    result != ISC_R_FILENOTFOUND)
+			syslog(LOG_ERR, "unable to remove log file '%s': %s",
+			       path, isc_result_totext(result));
+	}
 
 	return (ISC_R_SUCCESS);
 }
@@ -1288,8 +1314,7 @@ isc_log_open(isc_logchannel_t *channel) {
 	 * and either has no size limit or has reached its size limit.
 	 */
 	if (stat(path, &statbuf) == 0) {
-		regular_file = (statbuf.st_mode & S_IFREG) ?
-							ISC_TRUE : ISC_FALSE;
+		regular_file = S_ISREG(statbuf.st_mode) ? ISC_TRUE : ISC_FALSE;
 		/* XXXDCL if not regular_file complain? */
 		roll = ISC_TF(regular_file &&
 			      statbuf.st_size >= FILE_MAXSIZE(channel));
@@ -1303,8 +1328,17 @@ isc_log_open(isc_logchannel_t *channel) {
 	 */
 	if (result == ISC_R_SUCCESS && roll) {
 		result = roll_log(channel);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
+			if ((channel->flags & ISC_LOG_OPENERR) == 0) {
+				syslog(LOG_ERR,
+				       "isc_log_open: roll_log '%s' "
+				       "failed: %s",
+				       FILE_NAME(channel),
+				       isc_result_totext(result));
+				channel->flags |= ISC_LOG_OPENERR;
+			}
 			return (result);
+		}
 	}
 
 	result = isc_stdio_open(path, "a", &FILE_STREAM(channel));
@@ -1640,12 +1674,17 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 
 			if (FILE_STREAM(channel) == NULL) {
 				result = isc_log_open(channel);
+				if (result != ISC_R_SUCCESS &&
+				    (channel->flags & ISC_LOG_OPENERR) == 0) {
+					syslog(LOG_ERR,
+					       "isc_log_open '%s' failed: %s",
+					       FILE_NAME(channel),
+					       isc_result_totext(result));
+					channel->flags |= ISC_LOG_OPENERR;
+				}
 				if (result != ISC_R_SUCCESS)
 					break;
-				/*
-				 * Probably something more meaningful should be
-				 * done with an error.
-				 */
+				channel->flags &= ~ISC_LOG_OPENERR;
 			}
 			/* FALLTHROUGH */
 
@@ -1693,8 +1732,9 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 				syslog_level = syslog_map[-level];
 
 			syslog(FACILITY(channel) | syslog_level,
-			       "%s%s%s%s%s%s%s%s%s",
+			       "%s%s%s%s%s%s%s%s%s%s",
 			       printtime     ? time_string	: "",
+			       printtime     ? " "		: "",
 			       printtag      ? lcfg->tag	: "",
 			       printtag      ? ": "		: "",
 			       printcategory ? category->name	: "",
diff --git a/usr.sbin/bind/lib/isc/mem.c b/usr.sbin/bind/lib/isc/mem.c
index 9cca07e2cd7..47c1557209f 100644
--- a/usr.sbin/bind/lib/isc/mem.c
+++ b/usr.sbin/bind/lib/isc/mem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1997-2002  Internet Software Consortium.
+ * Copyright (C) 1997-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: mem.c,v 1.98.2.6 2002/07/10 06:10:45 marka Exp $ */
+/* $ISC: mem.c,v 1.98.2.8 2003/10/09 07:32:48 marka Exp $ */
 
 #include <config.h>
 
@@ -647,10 +647,10 @@ mem_putstats(isc_mem_t *ctx, void *ptr, size_t size) {
 	ctx->inuse -= size;
 
 	if (size > ctx->max_size) {
-		INSIST(ctx->stats[ctx->max_size].gets > 0);
+		INSIST(ctx->stats[ctx->max_size].gets > 0U);
 		ctx->stats[ctx->max_size].gets--;
 	} else {
-		INSIST(ctx->stats[size].gets > 0);
+		INSIST(ctx->stats[size].gets > 0U);
 		ctx->stats[size].gets--;
 	}
 }
@@ -664,7 +664,7 @@ mem_putstats(isc_mem_t *ctx, void *ptr, size_t size) {
 static void *
 default_memalloc(void *arg, size_t size) {
 	UNUSED(arg);
-	if (size == 0)
+	if (size == 0U)
 		size = 1;
 	return (malloc(size));
 }
@@ -701,7 +701,7 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 	if (ctx == NULL)
 		return (ISC_R_NOMEMORY);
 
-	if (init_max_size == 0)
+	if (init_max_size == 0U)
 		ctx->max_size = DEF_MAX_SIZE;
 	else
 		ctx->max_size = init_max_size;
@@ -833,7 +833,7 @@ destroy(isc_mem_t *ctx) {
 			if (ctx->stats[i].gets != 0)
 				print_active(ctx, stderr);
 #endif
-			INSIST(ctx->stats[i].gets == 0);
+			INSIST(ctx->stats[i].gets == 0U);
 		}
 	}
 
@@ -992,14 +992,14 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) {
 #endif /* ISC_MEM_USE_INTERNAL_MALLOC */
 
 	ADD_TRACE(ctx, ptr, size, file, line);
-	if (ctx->hi_water != 0 && !ctx->hi_called &&
+	if (ctx->hi_water != 0U && !ctx->hi_called &&
 	    ctx->inuse > ctx->hi_water) {
 		ctx->hi_called = ISC_TRUE;
 		call_water = ISC_TRUE;
 	}
 	if (ctx->inuse > ctx->maxinuse) {
 		ctx->maxinuse = ctx->inuse;
-		if (ctx->hi_water != 0 && ctx->inuse > ctx->hi_water &&
+		if (ctx->hi_water != 0U && ctx->inuse > ctx->hi_water &&
 		    (isc_mem_debugging & ISC_MEM_DEBUGUSAGE) != 0)
 			fprintf(stderr, "maxinuse = %lu\n",
 				(unsigned long)ctx->inuse);
@@ -1038,7 +1038,7 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG)
 	 * isc_mem_setwater() called with 0 for hi_water and lo_water.
 	 */
 	if (ctx->hi_called && 
-	    (ctx->inuse < ctx->lo_water || ctx->lo_water == 0)) {
+	    (ctx->inuse < ctx->lo_water || ctx->lo_water == 0U)) {
 		ctx->hi_called = ISC_FALSE;
 
 		if (ctx->water != NULL)
@@ -1100,7 +1100,7 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) {
 	for (i = 0; i <= ctx->max_size; i++) {
 		s = &ctx->stats[i];
 
-		if (s->totalgets == 0 && s->gets == 0)
+		if (s->totalgets == 0U && s->gets == 0U)
 			continue;
 		fprintf(out, "%s%5lu: %11lu gets, %11lu rem",
 			(i == ctx->max_size) ? ">=" : "  ",
@@ -1340,7 +1340,7 @@ isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp) {
 	isc_mempool_t *mpctx;
 
 	REQUIRE(VALID_CONTEXT(mctx));
-	REQUIRE(size > 0);
+	REQUIRE(size > 0U);
 	REQUIRE(mpctxp != NULL && *mpctxp == NULL);
 
 	/*
diff --git a/usr.sbin/bind/lib/isc/print.c b/usr.sbin/bind/lib/isc/print.c
index c15eb6c0fc9..9b1deb60964 100644
--- a/usr.sbin/bind/lib/isc/print.c
+++ b/usr.sbin/bind/lib/isc/print.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: print.c,v 1.22 2001/05/16 00:52:55 gson Exp $ */
+/* $ISC: print.c,v 1.22.2.3 2003/07/22 04:03:47 marka Exp $ */
 
 #include <config.h>
 
@@ -166,7 +166,6 @@ isc_print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 				*str++ = *format;
 				size--;
 			}
-			format++;
 			count++;
 			break;
 		case 'q':
diff --git a/usr.sbin/bind/lib/isc/pthreads/thread.c b/usr.sbin/bind/lib/isc/pthreads/thread.c
index e2d766a3512..8908948cc9b 100644
--- a/usr.sbin/bind/lib/isc/pthreads/thread.c
+++ b/usr.sbin/bind/lib/isc/pthreads/thread.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: thread.c,v 1.9 2001/01/09 21:58:02 bwelling Exp $ */
+/* $ISC: thread.c,v 1.9.2.3 2003/10/09 07:32:51 marka Exp $ */
 
 #include <config.h>
 
@@ -23,7 +23,7 @@
 #include <isc/util.h>
 
 #ifndef THREAD_MINSTACKSIZE
-#define THREAD_MINSTACKSIZE		(64 * 1024)
+#define THREAD_MINSTACKSIZE		(64U * 1024)
 #endif
 
 isc_result_t
@@ -36,7 +36,8 @@ isc_thread_create(isc_threadfunc_t func, isc_threadarg_t arg,
 
 	pthread_attr_init(&attr);
 
-#ifdef HAVE_PTHREAD_ATTR_GETSTACKSIZE
+#if defined(HAVE_PTHREAD_ATTR_GETSTACKSIZE) && \
+    defined(HAVE_PTHREAD_ATTR_SETSTACKSIZE)
 	ret = pthread_attr_getstacksize(&attr, &stacksize);
 	if (ret != 0)
 		return (ISC_R_UNEXPECTED);
diff --git a/usr.sbin/bind/lib/isc/random.c b/usr.sbin/bind/lib/isc/random.c
index d74873aaa78..6d7ec5835e8 100644
--- a/usr.sbin/bind/lib/isc/random.c
+++ b/usr.sbin/bind/lib/isc/random.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,12 +15,18 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: random.c,v 1.15 2001/01/09 21:56:22 bwelling Exp $ */
+/* $ISC: random.c,v 1.15.2.4 2003/10/09 07:32:49 marka Exp $ */
 
 #include <config.h>
 
 #include <stdlib.h>
 #include <time.h>		/* Required for time(). */
+#ifdef HAVE_SYS_TYPES_H
+#include <sys/types.h>
+#endif
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
 
 #include <isc/mutex.h>
 #include <isc/once.h>
@@ -34,7 +40,15 @@ static void
 initialize_rand(void)
 {
 #ifndef HAVE_ARC4RANDOM
-	srand(time(NULL));
+	unsigned int pid = getpid();
+
+	/*
+	 * The low bits of pid generally change faster.
+	 * Xor them with the high bits of time which change slowly.
+	 */
+	pid = ((pid << 16) & 0xffff0000) | ((pid >> 16) & 0xffff);
+
+	srand(time(NULL) ^ pid);
 #endif
 }
 
@@ -64,7 +78,11 @@ isc_random_get(isc_uint32_t *val)
 	initialize();
 
 #ifndef HAVE_ARC4RANDOM
-	*val = rand();
+	/*
+	 * rand()'s lower bits are not random.
+	 * rand()'s upper bit is zero.
+	 */
+	*val = ((rand() >> 4) & 0xffff) | ((rand() << 12) & 0xffff0000) ;
 #else
 	*val = arc4random();
 #endif
diff --git a/usr.sbin/bind/lib/isc/rwlock.c b/usr.sbin/bind/lib/isc/rwlock.c
index 4a089d710fb..d7d842da408 100644
--- a/usr.sbin/bind/lib/isc/rwlock.c
+++ b/usr.sbin/bind/lib/isc/rwlock.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2001  Internet Software Consortium.
+ * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: rwlock.c,v 1.33 2001/04/17 14:36:45 tale Exp $ */
+/* $ISC: rwlock.c,v 1.33.2.4 2003/07/23 03:20:24 marka Exp $ */
 
 #include <config.h>
 
@@ -82,6 +82,7 @@ isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
 	rwl->magic = 0;
 
 	rwl->type = isc_rwlocktype_read;
+	rwl->original = isc_rwlocktype_none;
 	rwl->active = 0;
 	rwl->granted = 0;
 	rwl->readers_waiting = 0;
@@ -206,6 +207,50 @@ isc_rwlock_trylock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
 }
 
 isc_result_t
+isc_rwlock_tryupgrade(isc_rwlock_t *rwl) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	REQUIRE(VALID_RWLOCK(rwl));
+	LOCK(&rwl->lock);
+	REQUIRE(rwl->type == isc_rwlocktype_read);
+	REQUIRE(rwl->active != 0);
+
+	/* If we are the only reader then succeed. */
+	if (rwl->active == 1) {
+		rwl->original = (rwl->original == isc_rwlocktype_none) ?
+				isc_rwlocktype_read : isc_rwlocktype_none;
+		rwl->type = isc_rwlocktype_write;
+	} else
+		result = ISC_R_LOCKBUSY;
+
+	UNLOCK(&rwl->lock);
+	return (result);
+}
+
+void
+isc_rwlock_downgrade(isc_rwlock_t *rwl) {
+
+	REQUIRE(VALID_RWLOCK(rwl));
+	LOCK(&rwl->lock);
+	REQUIRE(rwl->type == isc_rwlocktype_write);
+	REQUIRE(rwl->active == 1);
+
+	rwl->type = isc_rwlocktype_read;
+	rwl->original = (rwl->original == isc_rwlocktype_none) ?
+			isc_rwlocktype_write : isc_rwlocktype_none;
+	/*
+	 * Resume processing any read request that were blocked when
+	 * we upgraded.
+	 */
+	if (rwl->original == isc_rwlocktype_none &&
+	    (rwl->writers_waiting == 0 || rwl->granted < rwl->read_quota) &&
+	    rwl->readers_waiting > 0)
+		BROADCAST(&rwl->readable);
+
+	UNLOCK(&rwl->lock);
+}
+
+isc_result_t
 isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
 
 	REQUIRE(VALID_RWLOCK(rwl));
@@ -222,6 +267,10 @@ isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
 	INSIST(rwl->active > 0);
 	rwl->active--;
 	if (rwl->active == 0) {
+		if (rwl->original != isc_rwlocktype_none) {
+			rwl->type = rwl->original;
+			rwl->original = isc_rwlocktype_none;
+		}
 		if (rwl->type == isc_rwlocktype_read) {
 			rwl->granted = 0;
 			if (rwl->writers_waiting > 0) {
@@ -249,6 +298,7 @@ isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
 			}
 		}
 	}
+	INSIST(rwl->original == isc_rwlocktype_none);
 
 #ifdef ISC_RWLOCK_TRACE
 	print_lock(isc_msgcat_get(isc_msgcat, ISC_MSGSET_RWLOCK,
@@ -319,6 +369,32 @@ isc_rwlock_trylock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
 }
 
 isc_result_t
+isc_rwlock_tryupgrade(isc_rwlock_t *rwl) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	REQUIRE(VALID_RWLOCK(rwl));
+	REQUIRE(rwl->type == isc_rwlocktype_read);
+	REQUIRE(rwl->active != 0);
+	
+	/* If we are the only reader then succeed. */
+	if (rwl->active == 1)
+		rwl->type = isc_rwlocktype_write;
+	else
+		result = ISC_R_LOCKBUSY;
+	return (result);
+}
+
+void
+isc_rwlock_downgrade(isc_rwlock_t *rwl) {
+
+	REQUIRE(VALID_RWLOCK(rwl));
+	REQUIRE(rwl->type == isc_rwlocktype_write);
+	REQUIRE(rwl->active == 1);
+
+	rwl->type = isc_rwlocktype_read;
+}
+
+isc_result_t
 isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
 	REQUIRE(VALID_RWLOCK(rwl));
 	REQUIRE(rwl->type == type);
diff --git a/usr.sbin/bind/lib/isc/sockaddr.c b/usr.sbin/bind/lib/isc/sockaddr.c
index b37b51e763b..72207862151 100644
--- a/usr.sbin/bind/lib/isc/sockaddr.c
+++ b/usr.sbin/bind/lib/isc/sockaddr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,13 +15,14 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: sockaddr.c,v 1.48 2001/01/09 21:56:29 bwelling Exp $ */
+/* $ISC: sockaddr.c,v 1.48.2.2 2003/10/09 07:32:49 marka Exp $ */
 
 #include <config.h>
 
 #include <stdio.h>
 
 #include <isc/buffer.h>
+#include <isc/hash.h>
 #include <isc/msgs.h>
 #include <isc/netaddr.h>
 #include <isc/print.h>
@@ -175,47 +176,50 @@ isc_sockaddr_format(isc_sockaddr_t *sa, char *array, unsigned int size) {
 
 unsigned int
 isc_sockaddr_hash(const isc_sockaddr_t *sockaddr, isc_boolean_t address_only) {
-	unsigned int length;
-	const unsigned char *s;
+	unsigned int length = 0;
+	const unsigned char *s = NULL;
 	unsigned int h = 0;
 	unsigned int g;
+	unsigned int p = 0;
+	const struct in6_addr *in6;
 
 	REQUIRE(sockaddr != NULL);
-
-	if (address_only) {
-		switch (sockaddr->type.sa.sa_family) {
-		case AF_INET:
-			return (ntohl(sockaddr->type.sin.sin_addr.s_addr));
-		case AF_INET6:
-			s = (const unsigned char *)&sockaddr->
-							   type.sin6.sin6_addr;
-			length = sizeof sockaddr->type.sin6.sin6_addr;
-			break;
-		default:
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 isc_msgcat_get(isc_msgcat,
-							ISC_MSGSET_SOCKADDR,
-							ISC_MSG_UNKNOWNFAMILY,
-							"unknown "
-							"address family: %d"),
-					 (int)sockaddr->type.sa.sa_family);
-			s = (const unsigned char *)&sockaddr->type;
-			length = sockaddr->length;
+	switch (sockaddr->type.sa.sa_family) {
+	case AF_INET:
+		s = (const unsigned char *)&sockaddr->type.sin.sin_addr;
+		p = ntohs(sockaddr->type.sin.sin_port);
+		length = sizeof(sockaddr->type.sin.sin_addr.s_addr);
+		break;
+	case AF_INET6:
+		in6 = &sockaddr->type.sin6.sin6_addr;
+		if (IN6_IS_ADDR_V4MAPPED(in6)) {
+			s = (const unsigned char *)&in6[12];
+			length = sizeof(sockaddr->type.sin.sin_addr.s_addr);
+		} else {
+			s = (const unsigned char *)in6;
+			length = sizeof(sockaddr->type.sin6.sin6_addr);
 		}
-	} else {
+		p = ntohs(sockaddr->type.sin6.sin6_port);
+		break;
+	default:
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 isc_msgcat_get(isc_msgcat,
+					        ISC_MSGSET_SOCKADDR,
+				       		ISC_MSG_UNKNOWNFAMILY,
+						"unknown address family: %d"),
+					     (int)sockaddr->type.sa.sa_family);
 		s = (const unsigned char *)&sockaddr->type;
 		length = sockaddr->length;
+		p = 0;
 	}
 
-	while (length > 0) {
-		h = ( h << 4 ) + *s;
-		if ((g = ( h & 0xf0000000 )) != 0) {
-			h = h ^ (g >> 24);
-			h = h ^ g;
-		}
-		s++;
-		length--;
+	h = isc_hash_calc(s, length, ISC_TRUE);
+	if (!address_only) {
+		g = isc_hash_calc((const unsigned char *)&p, sizeof(p),
+				  ISC_TRUE);
+		h = h ^ g; /* XXX: we should concatenate h and p first */
 	}
+
 	return (h);
 }
 
diff --git a/usr.sbin/bind/lib/isc/unix/dir.c b/usr.sbin/bind/lib/isc/unix/dir.c
index f40ab1ba653..0ad998d1968 100644
--- a/usr.sbin/bind/lib/isc/unix/dir.c
+++ b/usr.sbin/bind/lib/isc/unix/dir.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: dir.c,v 1.18 2001/06/08 23:50:31 tale Exp $ */
+/* $ISC: dir.c,v 1.18.2.2 2003/10/09 07:32:52 marka Exp $ */
 
 /* Principal Authors: DCL */
 
@@ -164,7 +164,7 @@ isc_dir_current(char *dirname, size_t length, isc_boolean_t end_sep) {
 	 * XXXDCL Could automatically allocate memory if dirname == NULL.
 	 */
 	REQUIRE(dirname != NULL);
-	REQUIRE(length > 0);
+	REQUIRE(length > 0U);
 
 	cwd = getcwd(dirname, length);
 
diff --git a/usr.sbin/bind/lib/isc/unix/ifiter_ioctl.c b/usr.sbin/bind/lib/isc/unix/ifiter_ioctl.c
index 47ff6f4ef1e..a389e280d0f 100644
--- a/usr.sbin/bind/lib/isc/unix/ifiter_ioctl.c
+++ b/usr.sbin/bind/lib/isc/unix/ifiter_ioctl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: ifiter_ioctl.c,v 1.19.2.2.4.1 2003/02/19 04:32:41 marka Exp $ */
+/* $ISC: ifiter_ioctl.c,v 1.19.2.5 2003/07/22 04:03:49 marka Exp $ */
 
 /*
  * Obtain the list of network interfaces using the SIOCGLIFCONF ioctl.
@@ -133,7 +133,7 @@ isc_interfaceiter_create(isc_mem_t *mctx, isc_interfaceiter_t **iterp) {
 			goto alloc_failure;
 		}
 
-		memset(&iter->ifc.lifc_len, 0, sizeof(iter->ifc.lifc_len));
+		memset(&iter->ifc, 0, sizeof(iter->ifc));
 #ifdef ISC_HAVE_LIFC_FAMILY
 		iter->ifc.lifc_family = AF_UNSPEC;
 #endif
diff --git a/usr.sbin/bind/lib/isc/unix/socket.c b/usr.sbin/bind/lib/isc/unix/socket.c
index 301f1520297..ec0bd2cd8f1 100644
--- a/usr.sbin/bind/lib/isc/unix/socket.c
+++ b/usr.sbin/bind/lib/isc/unix/socket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2002  Internet Software Consortium.
+ * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: socket.c,v 1.207.2.14.4.2 2003/02/18 07:28:41 marka Exp $ */
+/* $ISC: socket.c,v 1.207.2.19 2003/07/23 06:57:54 marka Exp $ */
 
 #include <config.h>
 
@@ -648,7 +648,7 @@ build_msghdr_send(isc_socket_t *sock, isc_socketevent_t *dev,
 		buffer = ISC_LIST_NEXT(buffer, link);
 	}
 
-	INSIST(skip_count == 0);
+	INSIST(skip_count == 0U);
 
  config:
 	msg->msg_iov = iov;
@@ -990,7 +990,7 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 	dev->n += cc;
 	actual_count = cc;
 	buffer = ISC_LIST_HEAD(dev->bufferlist);
-	while (buffer != NULL && actual_count > 0) {
+	while (buffer != NULL && actual_count > 0U) {
 		REQUIRE(ISC_BUFFER_VALID(buffer));
 		if (isc_buffer_availablelength(buffer) <= actual_count) {
 			actual_count -= isc_buffer_availablelength(buffer);
@@ -1003,7 +1003,7 @@ doio_recv(isc_socket_t *sock, isc_socketevent_t *dev) {
 		}
 		buffer = ISC_LIST_NEXT(buffer, link);
 		if (buffer == NULL) {
-			INSIST(actual_count == 0);
+			INSIST(actual_count == 0U);
 		}
 	}
 
@@ -1316,6 +1316,20 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 		break;
 	}
 
+#ifdef F_DUPFD
+        /*
+         * Leave a space for stdio to work in.
+         */
+        if (sock->fd >= 0 && sock->fd < 20) {
+                int new, tmp;
+                new = fcntl(sock->fd, F_DUPFD, 20);
+                tmp = errno;
+                (void)close(sock->fd);
+                errno = tmp;
+                sock->fd = new;
+        }
+#endif
+
 	if (sock->fd >= (int)FD_SETSIZE) {
 		(void)close(sock->fd);
 		isc_log_iwrite(isc_lctx, ISC_LOGCATEGORY_GENERAL,
@@ -1740,6 +1754,21 @@ internal_accept(isc_task_t *me, isc_event_t *ev) {
 	memset(&dev->newsocket->address.type.sa, 0, addrlen);
 	fd = accept(sock->fd, &dev->newsocket->address.type.sa,
 		    (void *)&addrlen);
+
+#ifdef F_DUPFD
+        /*
+         * Leave a space for stdio to work in.
+         */
+        if (fd >= 0 && fd < 20) {
+                int new, tmp;
+                new = fcntl(fd, F_DUPFD, 20);
+                tmp = errno;
+                (void)close(fd);
+                errno = tmp;
+                fd = new;
+        }
+#endif
+
 	if (fd < 0) {
 		if (SOFT_ERROR(errno))
 			goto soft_error;
diff --git a/usr.sbin/bind/lib/isc/unix/time.c b/usr.sbin/bind/lib/isc/unix/time.c
index 573860c60dc..6de20df0056 100644
--- a/usr.sbin/bind/lib/isc/unix/time.c
+++ b/usr.sbin/bind/lib/isc/unix/time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1998-2001  Internet Software Consortium.
+ * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: time.c,v 1.34.2.5 2001/10/22 23:28:26 gson Exp $ */
+/* $ISC: time.c,v 1.34.2.7 2003/10/09 07:32:52 marka Exp $ */
 
 #include <config.h>
 
@@ -173,7 +173,7 @@ isc_time_now(isc_time_t *t) {
 	 * Ensure the tv_sec value fits in t->seconds.
 	 */
 	if (sizeof(tv.tv_sec) > sizeof(t->seconds) &&
-	    ((tv.tv_sec | (unsigned int)-1) ^ (unsigned int)-1) != 0)
+	    ((tv.tv_sec | (unsigned int)-1) ^ (unsigned int)-1) != 0U)
 		return (ISC_R_RANGE);
 
 	t->seconds = tv.tv_sec;
@@ -366,7 +366,7 @@ isc_time_secondsastimet(isc_time_t *t, time_t *secondsp) {
 	    (time_t)0.5 != 0.5 &&	       /* Not a floating point type. */
 	    (i = (time_t)-1) != 4294967295u &&		       /* Is signed. */
 	    (seconds &
-	     (1U << (sizeof(time_t) * CHAR_BIT - 1))) != 0) {   /* Negative. */
+	     (1U << (sizeof(time_t) * CHAR_BIT - 1))) != 0U) {   /* Negative. */
 		/*
 		 * This UNUSED() is here to shut up the IRIX compiler:
 		 *	variable "i" was set but never used
diff --git a/usr.sbin/bind/lib/isccc/Makefile.in b/usr.sbin/bind/lib/isccc/Makefile.in
index b925e23d63b..2ccebefcdbd 100644
--- a/usr.sbin/bind/lib/isccc/Makefile.in
+++ b/usr.sbin/bind/lib/isccc/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2001  Internet Software Consortium.
+# Copyright (C) 2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: Makefile.in,v 1.2 2001/07/09 22:25:26 gson Exp $
+# $ISC: Makefile.in,v 1.2.2.2 2003/10/09 07:32:53 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -31,7 +31,7 @@ CDEFINES =
 CWARNINGS =
 
 ISCLIBS =	../../lib/isc/libisc.@A@
-ISCCCLIBS =	../../lib/cc/libisccc.@A@
+ISCCCLIBS =	../../lib/isccc/libisccc.@A@
 
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCCDEPLIBS =	libisccc.@A@
@@ -71,7 +71,7 @@ libisccc.la: ${OBJS}
 	${LIBTOOL} --mode=link \
 		${CC} ${ALL_CFLAGS} -o libisccc.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
-		${OBJS} ${LIBS}
+		${OBJS} ${LIBS} ${ISCLIBS}
 
 timestamp: libisccc.@A@
 	touch timestamp
diff --git a/usr.sbin/bind/lib/isccc/api b/usr.sbin/bind/lib/isccc/api
index 06977fcb711..13178156a49 100644
--- a/usr.sbin/bind/lib/isccc/api
+++ b/usr.sbin/bind/lib/isccc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 0
-LIBREVISION = 1
-LIBAGE = 0
+LIBINTERFACE = 1
+LIBREVISION = 0
+LIBAGE = 1
diff --git a/usr.sbin/bind/lib/isccc/cc.c b/usr.sbin/bind/lib/isccc/cc.c
index 342a8d5855d..df81f47e36c 100644
--- a/usr.sbin/bind/lib/isccc/cc.c
+++ b/usr.sbin/bind/lib/isccc/cc.c
@@ -1,6 +1,6 @@
 /*
- * Portions Copyright (C) 2001, 2002  Internet Software Consortium.
- * Portions Copyright (C) 2001, 2002  Nominum, Inc.
+ * Portions Copyright (C) 2001-2003  Internet Software Consortium.
+ * Portions Copyright (C) 2001-2003  Nominum, Inc.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: cc.c,v 1.4.2.2 2002/03/26 00:55:13 marka Exp $ */
+/* $ISC: cc.c,v 1.4.2.4 2003/10/09 07:32:53 marka Exp $ */
 
 #include <config.h>
 
@@ -105,7 +105,7 @@ value_towire(isccc_sexpr_t *elt, isccc_region_t *target)
 		 * the placeholder length too.  Adjust and
 		 * emit.
 		 */
-		INSIST(len >= 4);
+		INSIST(len >= 4U);
 		len -= 4;
 		PUT32(len, lenp);
 	} else if (isccc_sexpr_listp(elt)) {
@@ -128,7 +128,7 @@ value_towire(isccc_sexpr_t *elt, isccc_region_t *target)
 		 * 'len' is 4 bytes too big, since it counts
 		 * the placeholder length.  Adjust and emit.
 		 */
-		INSIST(len >= 4);
+		INSIST(len >= 4U);
 		len -= 4;
 		PUT32(len, lenp);
 	}
@@ -152,7 +152,7 @@ table_towire(isccc_sexpr_t *alist, isccc_region_t *target)
 		ks = isccc_sexpr_tostring(k);
 		v = ISCCC_SEXPR_CDR(kv);
 		len = strlen(ks);
-		INSIST(len <= 255);
+		INSIST(len <= 255U);
 		/*
 		 * Emit the key name.
 		 */
diff --git a/usr.sbin/bind/lib/isccc/include/isccc/result.h b/usr.sbin/bind/lib/isccc/include/isccc/result.h
index 4f1e573c463..fba41b8e5e7 100644
--- a/usr.sbin/bind/lib/isccc/include/isccc/result.h
+++ b/usr.sbin/bind/lib/isccc/include/isccc/result.h
@@ -1,6 +1,6 @@
 /*
- * Portions Copyright (C) 2001  Internet Software Consortium.
- * Portions Copyright (C) 2001  Nominum, Inc.
+ * Portions Copyright (C) 2001, 2003  Internet Software Consortium.
+ * Portions Copyright (C) 2001, 2003  Nominum, Inc.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: result.h,v 1.3 2001/03/28 23:11:41 bwelling Exp $ */
+/* $ISC: result.h,v 1.3.2.2 2003/07/22 04:03:53 marka Exp $ */
 
 #ifndef ISCCC_RESULT_H
 #define ISCCC_RESULT_H 1
@@ -30,8 +30,11 @@
 #define ISCCC_R_UNKNOWNVERSION		(ISC_RESULTCLASS_ISCCC + 0)
 #define ISCCC_R_SYNTAX			(ISC_RESULTCLASS_ISCCC + 1)
 #define ISCCC_R_BADAUTH			(ISC_RESULTCLASS_ISCCC + 2)
+#define ISCCC_R_EXPIRED			(ISC_RESULTCLASS_ISCCC + 3)
+#define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
+#define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
 
-#define ISCCC_R_NRESULTS 		3	/* Number of results */
+#define ISCCC_R_NRESULTS 		6	/* Number of results */
 
 ISC_LANG_BEGINDECLS
 
diff --git a/usr.sbin/bind/lib/isccc/result.c b/usr.sbin/bind/lib/isccc/result.c
index 9e86390428f..e0847eaa448 100644
--- a/usr.sbin/bind/lib/isccc/result.c
+++ b/usr.sbin/bind/lib/isccc/result.c
@@ -1,6 +1,6 @@
 /*
- * Portions Copyright (C) 2001  Internet Software Consortium.
- * Portions Copyright (C) 2001  Nominum, Inc.
+ * Portions Copyright (C) 2001, 2003  Internet Software Consortium.
+ * Portions Copyright (C) 2001, 2003  Nominum, Inc.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: result.c,v 1.3 2001/03/28 23:11:40 bwelling Exp $ */
+/* $ISC: result.c,v 1.3.2.2 2003/07/22 04:03:52 marka Exp $ */
 
 #include <config.h>
 
@@ -30,6 +30,9 @@ static const char *text[ISCCC_R_NRESULTS] = {
 	"unknown version",			/* 1 */
 	"syntax error",				/* 2 */
 	"bad auth",				/* 3 */
+	"expired",				/* 4 */
+	"clock skew",				/* 5 */
+	"duplicate"				/* 6 */
 };
 
 #define ISCCC_RESULT_RESULTSET			2
diff --git a/usr.sbin/bind/lib/isccfg/Makefile.in b/usr.sbin/bind/lib/isccfg/Makefile.in
index 0d90aaa2f92..368cf086a57 100644
--- a/usr.sbin/bind/lib/isccfg/Makefile.in
+++ b/usr.sbin/bind/lib/isccfg/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2001  Internet Software Consortium.
+# Copyright (C) 2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: Makefile.in,v 1.6 2001/07/09 22:25:27 gson Exp $
+# $ISC: Makefile.in,v 1.6.2.2 2003/10/09 07:32:54 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -31,6 +31,8 @@ CDEFINES =
 CWARNINGS =
 
 ISCLIBS =	../../lib/isc/libisc.@A@
+ISCCCLIBS =	../../lib/isccc/libisccc.@A@
+DNSLIBS =	../../lib/dns/libdns.@A@
 ISCCFGLIBS =	../../lib/cfg/libisccfg.@A@
 
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
@@ -66,7 +68,7 @@ libisccfg.la: ${OBJS}
 	${LIBTOOL} --mode=link \
 		${CC} ${ALL_CFLAGS} -o libisccfg.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
-		${OBJS} ${LIBS}
+		${OBJS} ${LIBS} ${DNSLIBS} ${ISCCCLIBS} ${ISCLIBS}
 
 timestamp: libisccfg.@A@
 	touch timestamp
diff --git a/usr.sbin/bind/lib/isccfg/api b/usr.sbin/bind/lib/isccfg/api
index 91fedd38857..0a12b5e852c 100644
--- a/usr.sbin/bind/lib/isccfg/api
+++ b/usr.sbin/bind/lib/isccfg/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 1
-LIBREVISION = 0
+LIBINTERFACE = 0
+LIBREVISION = 7
 LIBAGE = 0
diff --git a/usr.sbin/bind/lib/isccfg/check.c b/usr.sbin/bind/lib/isccfg/check.c
index f3e03260c12..6c035b9cda0 100644
--- a/usr.sbin/bind/lib/isccfg/check.c
+++ b/usr.sbin/bind/lib/isccfg/check.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2001, 2002  Internet Software Consortium.
+ * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: check.c,v 1.14.2.16 2002/04/23 02:00:03 marka Exp $ */
+/* $ISC: check.c,v 1.14.2.21 2003/09/19 13:41:36 marka Exp $ */
 
 #include <config.h>
 
@@ -61,6 +61,7 @@ static isc_result_t
 check_options(cfg_obj_t *options, isc_log_t *logctx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	unsigned int i;
+	cfg_obj_t *obj;
 
 	static intervaltable intervals[] = {
 	{ "cleaning-interval", 60 },
@@ -92,6 +93,40 @@ check_options(cfg_obj_t *options, isc_log_t *logctx) {
 			result = ISC_R_RANGE;
 		}
 	}
+
+	obj = NULL;
+	(void)cfg_map_get(options, "root-delegation-only", &obj);
+	if (obj != NULL) {
+		if (!cfg_obj_isvoid(obj)) {
+			cfg_listelt_t *element;
+			cfg_obj_t *exclude;
+			char *str;
+			dns_fixedname_t fixed;
+			dns_name_t *name;
+			isc_buffer_t b;
+			isc_result_t tresult;
+
+			dns_fixedname_init(&fixed);
+			name = dns_fixedname_name(&fixed);
+			for (element = cfg_list_first(obj);
+			     element != NULL;
+			     element = cfg_list_next(element)) {
+				exclude = cfg_listelt_value(element);
+				str = cfg_obj_asstring(exclude);
+				isc_buffer_init(&b, str, strlen(str));
+				isc_buffer_add(&b, strlen(str));
+				tresult = dns_name_fromtext(name, &b,
+							   dns_rootname,
+                                                           ISC_FALSE, NULL);
+				if (tresult != ISC_R_SUCCESS) {
+					cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+						    "bad domain name '%s'",
+						    str);
+					result = tresult;
+				}
+			}
+		}
+	}
 	return (result);
 }
 
@@ -247,11 +282,18 @@ check_zoneconf(cfg_obj_t *zconfig, isc_symtab_t *symtab, isc_log_t *logctx,
 		    cfg_map_get(zoptions, options[i].name, &obj) ==
 		    ISC_R_SUCCESS)
 		{
-			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
-				    "option '%s' is not allowed in '%s' "
-				    "zone '%s'",
-				    options[i].name, typestr, zname);
-			result = ISC_R_FAILURE;
+			if (strcmp(options[i].name, "allow-update") != 0 ||
+			    ztype != SLAVEZONE) {
+				cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+					    "option '%s' is not allowed "
+					    "in '%s' zone '%s'",
+					    options[i].name, typestr, zname);
+					result = ISC_R_FAILURE;
+			} else
+				cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+					    "option '%s' is not allowed "
+					    "in '%s' zone '%s'",
+					    options[i].name, typestr, zname);
 		}
 	}
 
diff --git a/usr.sbin/bind/lib/isccfg/parser.c b/usr.sbin/bind/lib/isccfg/parser.c
index 88acaaf6148..c93af6f7d44 100644
--- a/usr.sbin/bind/lib/isccfg/parser.c
+++ b/usr.sbin/bind/lib/isccfg/parser.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: parser.c,v 1.70.2.14.4.2 2003/02/17 07:05:10 marka Exp $ */
+/* $ISC: parser.c,v 1.70.2.22 2003/09/19 13:41:36 marka Exp $ */
 
 #include <config.h>
 
@@ -855,6 +855,17 @@ options_clauses[] = {
 	{ NULL, NULL, 0 }
 };
 
+
+static cfg_type_t cfg_type_namelist = {
+	"namelist", parse_bracketed_list, print_bracketed_list,
+	&cfg_rep_list, &cfg_type_qstring };
+
+static keyword_type_t exclude_kw = { "exclude", &cfg_type_namelist };
+
+static cfg_type_t cfg_type_optional_exclude = {
+	"optional_exclude", parse_optional_keyvalue, print_keyvalue,
+	&cfg_rep_list, &exclude_kw };
+
 /*
  * Clauses that can be found within the 'view' statement,
  * with defaults in the 'options' statement.
@@ -891,6 +902,7 @@ view_clauses[] = {
 	{ "check-names", &cfg_type_checknames,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NOTIMP },
 	{ "cache-file", &cfg_type_qstring, 0 },
+	{ "root-delegation-only",  &cfg_type_optional_exclude, 0 },
 	{ NULL, NULL, 0 }
 };
 
@@ -1201,7 +1213,8 @@ create_tuple(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (ISC_R_SUCCESS);
 
  cleanup:
-	CLEANUP_OBJ(obj);
+	if (obj != NULL)
+		isc_mem_put(pctx->mctx, obj, sizeof(*obj));
 	return (result);
 }
 
@@ -1667,6 +1680,10 @@ parse_sizeval(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	UNUSED(type);
 
 	CHECK(cfg_gettoken(pctx, 0));
+	if (pctx->token.type != isc_tokentype_string) {
+		result = ISC_R_UNEXPECTEDTOKEN;
+		goto cleanup;
+	}
 	CHECK(parse_unitstring(pctx->token.value.as_pointer, &val));
 
 	CHECK(create_cfgobj(pctx, &cfg_type_uint64, &obj));
@@ -1776,7 +1793,7 @@ create_string(cfg_parser_t *pctx, const char *contents, const cfg_type_t *type,
 	obj->value.string.length = len;
 	obj->value.string.base = isc_mem_get(pctx->mctx, len + 1);
 	if (obj->value.string.base == 0) {
-		CLEANUP_OBJ(obj);
+		isc_mem_put(pctx->mctx, obj, sizeof(*obj));
 		return (ISC_R_NOMEMORY);
 	}
 	memcpy(obj->value.string.base, contents, len);
@@ -2109,24 +2126,26 @@ parse_list(cfg_parser_t *pctx, const cfg_type_t *listtype, cfg_obj_t **ret)
 	cfg_obj_t *listobj = NULL;
 	const cfg_type_t *listof = listtype->of;
 	isc_result_t result;
+	cfg_listelt_t *elt = NULL;
 
 	CHECK(create_list(pctx, listtype, &listobj));
 
 	for (;;) {
-		cfg_listelt_t *elt = NULL;
-
 		CHECK(cfg_peektoken(pctx, 0));
 		if (pctx->token.type == isc_tokentype_special &&
-		    pctx->token.value.as_char == '}')
+		    pctx->token.value.as_char == /*{*/ '}')
 			break;
 		CHECK(parse_list_elt(pctx, listof, &elt));
 		CHECK(parse_semicolon(pctx));
 		ISC_LIST_APPEND(listobj->value.list, elt, link);
+		elt = NULL;
 	}
 	*ret = listobj;
 	return (ISC_R_SUCCESS);
 
  cleanup:
+	if (elt != NULL)
+		free_list_elt(pctx, elt);
 	CLEANUP_OBJ(listobj);
 	return (result);
 }
@@ -2429,7 +2448,6 @@ parse_symtab_elt(cfg_parser_t *pctx, const char *name,
 	CHECK(isc_symtab_define(symtab, name,
 				1, symval,
 				isc_symexists_reject));
-	obj = NULL;
 	return (ISC_R_SUCCESS);
 
  cleanup:
@@ -2768,7 +2786,7 @@ token_addr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na) {
 			}
 		}
 		if ((flags & V4PREFIXOK) != 0 &&
-		    strlen(s) <= 15) {
+		    strlen(s) <= 15U) {
 			char buf[64];
 			int i;
 
@@ -2827,7 +2845,7 @@ get_port(cfg_parser_t *pctx, unsigned int flags, in_port_t *port) {
 			     "expected port number or '*'");
 		return (ISC_R_UNEXPECTEDTOKEN);
 	}
-	if (pctx->token.value.as_ulong >= 65536) {
+	if (pctx->token.value.as_ulong >= 65536U) {
 		parser_error(pctx, LOG_NEAR,
 			     "port number out of range");
 		return (ISC_R_UNEXPECTEDTOKEN);
@@ -3761,7 +3779,8 @@ create_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (ISC_R_SUCCESS);
 
  cleanup:
-	CLEANUP_OBJ(obj);
+	if (obj != NULL)
+		isc_mem_put(pctx->mctx, obj, sizeof(*obj));
 	return (result);
 }
 
diff --git a/usr.sbin/bind/lib/lwres/context.c b/usr.sbin/bind/lib/lwres/context.c
index c84a8819bca..bab830e2a10 100644
--- a/usr.sbin/bind/lib/lwres/context.c
+++ b/usr.sbin/bind/lib/lwres/context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: context.c,v 1.41 2001/07/19 16:59:32 gson Exp $ */
+/* $ISC: context.c,v 1.41.2.2 2003/10/09 07:32:54 marka Exp $ */
 
 #include <config.h>
 
@@ -152,14 +152,14 @@ lwres_context_initserial(lwres_context_t *ctx, lwres_uint32_t serial) {
 void
 lwres_context_freemem(lwres_context_t *ctx, void *mem, size_t len) {
 	REQUIRE(mem != NULL);
-	REQUIRE(len != 0);
+	REQUIRE(len != 0U);
 
 	CTXFREE(mem, len);
 }
 
 void *
 lwres_context_allocmem(lwres_context_t *ctx, size_t len) {
-	REQUIRE(len != 0);
+	REQUIRE(len != 0U);
 
 	return (CTXMALLOC(len));
 }
@@ -349,7 +349,7 @@ lwres_context_sendrecv(lwres_context_t *ctx,
 	 * Type of tv_sec is long, so make sure the unsigned long timeout
 	 * does not overflow it.
 	 */
-	if (ctx->timeout <= LONG_MAX)
+	if (ctx->timeout <= (unsigned int)LONG_MAX)
 		timeout.tv_sec = (long)ctx->timeout;
 	else
 		timeout.tv_sec = LONG_MAX;
diff --git a/usr.sbin/bind/lib/lwres/getipnode.c b/usr.sbin/bind/lib/lwres/getipnode.c
index b6dbbf6b259..9f287517ca7 100644
--- a/usr.sbin/bind/lib/lwres/getipnode.c
+++ b/usr.sbin/bind/lib/lwres/getipnode.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2002  Internet Software Consortium.
+ * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: getipnode.c,v 1.30.2.3 2002/08/08 21:29:07 marka Exp $ */
+/* $ISC: getipnode.c,v 1.30.2.5 2003/10/09 07:32:55 marka Exp $ */
 
 #include <config.h>
 
@@ -242,13 +242,13 @@ lwres_getipnodebyaddr(const void *src, size_t len, int af, int *error_num) {
 
 	switch (af) {
 	case AF_INET:
-		if (len != INADDRSZ) {
+		if (len != (unsigned int)INADDRSZ) {
 			*error_num = NO_RECOVERY;
 			return (NULL);
 		}
 		break;
 	case AF_INET6:
-		if (len != IN6ADDRSZ) {
+		if (len != (unsigned int)IN6ADDRSZ) {
 			*error_num = NO_RECOVERY;
 			return (NULL);
 		}
diff --git a/usr.sbin/bind/lib/lwres/getnameinfo.c b/usr.sbin/bind/lib/lwres/getnameinfo.c
index 413f41f9e9b..61a42547b42 100644
--- a/usr.sbin/bind/lib/lwres/getnameinfo.c
+++ b/usr.sbin/bind/lib/lwres/getnameinfo.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 1999-2001  Internet Software Consortium.
+ * Portions Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: getnameinfo.c,v 1.30 2001/07/10 18:25:43 gson Exp $ */
+/* $ISC: getnameinfo.c,v 1.30.2.3 2003/07/23 06:57:56 marka Exp $ */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -162,7 +162,7 @@ lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 	}
 	proto = (flags & NI_DGRAM) ? "udp" : "tcp";
 
-	if (serv == NULL || servlen == 0) {
+	if (serv == NULL || servlen == 0U) {
 		/*
 		 * Caller does not want service.
 		 */
@@ -197,7 +197,7 @@ lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 	}
 #endif
 
-	if (host == NULL || hostlen == 0) {
+	if (host == NULL || hostlen == 0U) {
 		/*
 		 * What should we do?
 		 */
diff --git a/usr.sbin/bind/lib/lwres/getrrset.c b/usr.sbin/bind/lib/lwres/getrrset.c
index 085f435b583..e32cd0b360c 100644
--- a/usr.sbin/bind/lib/lwres/getrrset.c
+++ b/usr.sbin/bind/lib/lwres/getrrset.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000-2002  Internet Software Consortium.
+ * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: getrrset.c,v 1.11.2.2 2002/08/05 06:57:16 marka Exp $ */
+/* $ISC: getrrset.c,v 1.11.2.4 2003/10/09 07:32:55 marka Exp $ */
 
 #include <config.h>
 
@@ -48,7 +48,7 @@ lwresult_to_result(lwres_result_t lwresult) {
 
 static void *
 sane_malloc(size_t size) {
-	if (size == 0)
+	if (size == 0U)
 		size = 1;
 	return (malloc(size));
 }
diff --git a/usr.sbin/bind/lib/lwres/lwconfig.c b/usr.sbin/bind/lib/lwres/lwconfig.c
index 8e57396e803..30dbf689883 100644
--- a/usr.sbin/bind/lib/lwres/lwconfig.c
+++ b/usr.sbin/bind/lib/lwres/lwconfig.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2000, 2001  Internet Software Consortium.
+ * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: lwconfig.c,v 1.33 2001/07/10 18:25:45 gson Exp $ */
+/* $ISC: lwconfig.c,v 1.33.2.2 2003/10/09 07:32:55 marka Exp $ */
 
 /***
  *** Module for parsing resolv.conf files.
@@ -156,7 +156,7 @@ getword(FILE *fp, char *buffer, size_t size) {
 	char *p = buffer;
 
 	REQUIRE(buffer != NULL);
-	REQUIRE(size > 0);
+	REQUIRE(size > 0U);
 
 	*p = '\0';
 
@@ -195,7 +195,7 @@ lwres_strdup(lwres_context_t *ctx, const char *str) {
 	size_t len;
 
 	REQUIRE(str != NULL);
-	REQUIRE(strlen(str) > 0);
+	REQUIRE(strlen(str) > 0U);
 
 	len = strlen(str) + 1;
 	p = CTXMALLOC(len);
@@ -286,7 +286,7 @@ lwres_conf_parsenameserver(lwres_context_t *ctx,  FILE *fp) {
 		return (LWRES_R_SUCCESS);
 
 	res = getword(fp, word, sizeof(word));
-	if (strlen(word) == 0)
+	if (strlen(word) == 0U)
 		return (LWRES_R_FAILURE); /* Nothing on line. */
 	else if (res == ' ' || res == '\t')
 		res = eatwhite(fp);
@@ -314,7 +314,7 @@ lwres_conf_parselwserver(lwres_context_t *ctx,  FILE *fp) {
 		return (LWRES_R_SUCCESS);
 
 	res = getword(fp, word, sizeof(word));
-	if (strlen(word) == 0)
+	if (strlen(word) == 0U)
 		return (LWRES_R_FAILURE); /* Nothing on line. */
 	else if (res == ' ' || res == '\t')
 		res = eatwhite(fp);
@@ -339,7 +339,7 @@ lwres_conf_parsedomain(lwres_context_t *ctx,  FILE *fp) {
 	confdata = &ctx->confdata;
 
 	res = getword(fp, word, sizeof(word));
-	if (strlen(word) == 0)
+	if (strlen(word) == 0U)
 		return (LWRES_R_FAILURE); /* Nothing else on line. */
 	else if (res == ' ' || res == '\t')
 		res = eatwhite(fp);
@@ -401,11 +401,11 @@ lwres_conf_parsesearch(lwres_context_t *ctx,  FILE *fp) {
 	confdata->searchnxt = 0;
 
 	delim = getword(fp, word, sizeof(word));
-	if (strlen(word) == 0)
+	if (strlen(word) == 0U)
 		return (LWRES_R_FAILURE); /* Nothing else on line. */
 
 	idx = 0;
-	while (strlen(word) > 0) {
+	while (strlen(word) > 0U) {
 		if (confdata->searchnxt == LWRES_CONFMAXSEARCH)
 			goto ignore; /* Too many domains. */
 
@@ -462,10 +462,10 @@ lwres_conf_parsesortlist(lwres_context_t *ctx,  FILE *fp) {
 	confdata = &ctx->confdata;
 
 	delim = getword(fp, word, sizeof(word));
-	if (strlen(word) == 0)
+	if (strlen(word) == 0U)
 		return (LWRES_R_FAILURE); /* Empty line after keyword. */
 
-	while (strlen(word) > 0) {
+	while (strlen(word) > 0U) {
 		if (confdata->sortlistnxt == LWRES_CONFMAXSORTLIST)
 			return (LWRES_R_FAILURE); /* Too many values. */
 
@@ -518,10 +518,10 @@ lwres_conf_parseoption(lwres_context_t *ctx,  FILE *fp) {
 	confdata = &ctx->confdata;
 
 	delim = getword(fp, word, sizeof(word));
-	if (strlen(word) == 0)
+	if (strlen(word) == 0U)
 		return (LWRES_R_FAILURE); /* Empty line after keyword. */
 
-	while (strlen(word) > 0) {
+	while (strlen(word) > 0U) {
 		if (strcmp("debug", word) == 0) {
 			confdata->resdebug = 1;
 		} else if (strcmp("no_tld_query", word) == 0) {
@@ -556,7 +556,7 @@ lwres_conf_parse(lwres_context_t *ctx, const char *filename) {
 	confdata = &ctx->confdata;
 
 	REQUIRE(filename != NULL);
-	REQUIRE(strlen(filename) > 0);
+	REQUIRE(strlen(filename) > 0U);
 	REQUIRE(confdata != NULL);
 
 	errno = 0;
@@ -571,7 +571,7 @@ lwres_conf_parse(lwres_context_t *ctx, const char *filename) {
 			break;
 		}
 
-		if (strlen(word) == 0)
+		if (strlen(word) == 0U)
 			rval = LWRES_R_SUCCESS;
 		else if (strcmp(word, "nameserver") == 0)
 			rval = lwres_conf_parsenameserver(ctx, fp);
diff --git a/usr.sbin/bind/lib/lwres/lwinetaton.c b/usr.sbin/bind/lib/lwres/lwinetaton.c
index e6df47a49d0..e517fd1a22f 100644
--- a/usr.sbin/bind/lib/lwres/lwinetaton.c
+++ b/usr.sbin/bind/lib/lwres/lwinetaton.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 1996-2001  Internet Software Consortium.
+ * Portions Copyright (C) 1996-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -66,7 +66,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static char sccsid[] = "@(#)inet_addr.c	8.1 (Berkeley) 6/17/93";
-static char rcsid[] = "$ISC: lwinetaton.c,v 1.10 2001/01/09 21:59:25 bwelling Exp $";
+static char rcsid[] = "$ISC: lwinetaton.c,v 1.10.2.2 2003/10/09 07:32:55 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -148,7 +148,7 @@ lwres_net_aton(const char *cp, struct in_addr *addr) {
 			 *	a.b.c	(with c treated as 16 bits)
 			 *	a.b	(with b treated as 24 bits)
 			 */
-			if (pp >= parts + 3 || val > 0xff)
+			if (pp >= parts + 3 || val > 0xffU)
 				return (0);
 			*pp++ = (lwres_uint8_t)val;
 			c = *++cp;
@@ -175,19 +175,19 @@ lwres_net_aton(const char *cp, struct in_addr *addr) {
 		break;
 
 	case 2:				/* a.b -- 8.24 bits */
-		if (val > 0xffffff)
+		if (val > 0xffffffU)
 			return (0);
 		val |= parts[0] << 24;
 		break;
 
 	case 3:				/* a.b.c -- 8.8.16 bits */
-		if (val > 0xffff)
+		if (val > 0xffffU)
 			return (0);
 		val |= (parts[0] << 24) | (parts[1] << 16);
 		break;
 
 	case 4:				/* a.b.c.d -- 8.8.8.8 bits */
-		if (val > 0xff)
+		if (val > 0xffU)
 			return (0);
 		val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8);
 		break;
diff --git a/usr.sbin/bind/lib/lwres/man/lwres_context.3 b/usr.sbin/bind/lib/lwres/man/lwres_context.3
index 50183309bb3..85e60a07ffc 100644
--- a/usr.sbin/bind/lib/lwres/man/lwres_context.3
+++ b/usr.sbin/bind/lib/lwres/man/lwres_context.3
@@ -65,7 +65,7 @@ It holds a socket and other data needed for communicating
 with a resolver daemon.
 The new
 \fBlwres_context_t\fR
-is returned throught
+is returned through
 \fIcontextp\fR,
 a pointer to a
 \fBlwres_context_t\fR
diff --git a/usr.sbin/bind/lib/lwres/man/lwres_context.docbook b/usr.sbin/bind/lib/lwres/man/lwres_context.docbook
index 3a0b8499027..8434467abeb 100644
--- a/usr.sbin/bind/lib/lwres/man/lwres_context.docbook
+++ b/usr.sbin/bind/lib/lwres/man/lwres_context.docbook
@@ -1,6 +1,6 @@
 <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook V4.1//EN">
 <!--
- - Copyright (C) 2001  Internet Software Consortium.
+ - Copyright (C) 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: lwres_context.docbook,v 1.3 2001/06/18 22:56:16 gson Exp $ -->
+<!-- $ISC: lwres_context.docbook,v 1.3.2.2 2003/07/22 04:03:54 marka Exp $ -->
 
 <refentry>
 <refentryinfo>
@@ -109,7 +109,7 @@ It holds a socket and other data needed for communicating
 with a resolver daemon.
 The new
 <type>lwres_context_t</type>
-is returned throught
+is returned through
 <parameter>contextp</parameter>,
 
 a pointer to a
diff --git a/usr.sbin/bind/lib/lwres/man/lwres_context.html b/usr.sbin/bind/lib/lwres/man/lwres_context.html
index 90a969fd325..a3aeb4008f7 100644
--- a/usr.sbin/bind/lib/lwres/man/lwres_context.html
+++ b/usr.sbin/bind/lib/lwres/man/lwres_context.html
@@ -144,7 +144,7 @@ The new
 CLASS="TYPE"
 >lwres_context_t</SPAN
 >
-is returned throught
+is returned through
 <TT
 CLASS="PARAMETER"
 ><I
diff --git a/usr.sbin/bind/lib/lwres/man/lwres_getipnode.docbook b/usr.sbin/bind/lib/lwres/man/lwres_getipnode.docbook
index f867e026b58..b95c6b78e62 100644
--- a/usr.sbin/bind/lib/lwres/man/lwres_getipnode.docbook
+++ b/usr.sbin/bind/lib/lwres/man/lwres_getipnode.docbook
@@ -16,7 +16,7 @@
  - WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $ISC: lwres_getipnode.docbook,v 1.4.118.2 2003/02/17 07:05:11 marka Exp $ -->
+<!-- $ISC: lwres_getipnode.docbook,v 1.4.2.2 2003/03/06 04:38:26 marka Exp $ -->
 
 <refentry>
 
diff --git a/usr.sbin/bind/lib/tests/t_api.c b/usr.sbin/bind/lib/tests/t_api.c
index 460f3ee03ee..00913ec3f5b 100644
--- a/usr.sbin/bind/lib/tests/t_api.c
+++ b/usr.sbin/bind/lib/tests/t_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 1999-2001  Internet Software Consortium.
+ * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $ISC: t_api.c,v 1.48 2001/07/11 18:51:22 bwelling Exp $ */
+/* $ISC: t_api.c,v 1.48.2.2 2003/10/09 07:32:57 marka Exp $ */
 
 #include <config.h>
 
@@ -534,7 +534,7 @@ t_fgetbs(FILE *fp) {
 			}
 		}
 		*p = '\0';
-		return(((c == EOF) && (n == 0)) ? NULL : buf);
+		return(((c == EOF) && (n == 0U)) ? NULL : buf);
 	} else {
 		fprintf(stderr, "malloc failed %d", errno);
 		return(NULL);
@@ -569,7 +569,7 @@ t_getdate(char *buf, size_t buflen) {
 	t = time(NULL);
 	p = localtime(&t);
 	n = strftime(buf, buflen - 1, "%A %d %B %H:%M:%S %Y\n", p);
-	return(n != 0 ? buf : NULL);
+	return(n != 0U ? buf : NULL);
 }
 
 /*
diff --git a/usr.sbin/bind/libtool.m4 b/usr.sbin/bind/libtool.m4
index 2d9d1436c72..f96059b0807 100644
--- a/usr.sbin/bind/libtool.m4
+++ b/usr.sbin/bind/libtool.m4
@@ -1470,7 +1470,7 @@ else
         hardcode_libdir_flag_spec='${wl}-bnolibpath ${wl}-blibpath:$libdir:/usr/lib:/lib'
         # Warning - without using the other run time loading flags, -berok will
         #           link without error, but may produce a broken library.
-        allow_undefined_flag='${wl}-berok"
+        allow_undefined_flag='${wl}-berok'
         # This is a bit strange, but is similar to how AIX traditionally builds
         # it's shared libraries.
         archive_expsym_cmds="\$CC $shared_flag"' -o $output_objdir/$soname $libobjs $deplibs $compiler_flags ${allow_undefined_flag} '"\${wl}$no_entry_flag \${wl}$exp_sym_flag:\$export_symbols"' ~$AR -crlo $objdir/$libname$release.a $objdir/$soname'
@@ -1884,7 +1884,7 @@ beos*)
   shlibpath_var=LIBRARY_PATH
   ;;
 
-bsdi4*)
+bsdi[45]*)
   version_type=linux
   need_version=no
   library_names_spec='${libname}${release}.so$versuffix ${libname}${release}.so$major $libname.so'
diff --git a/usr.sbin/bind/ltmain.sh b/usr.sbin/bind/ltmain.sh
index 5959c479b0e..96c58359350 100644
--- a/usr.sbin/bind/ltmain.sh
+++ b/usr.sbin/bind/ltmain.sh
@@ -725,6 +725,9 @@ compiler."
       # that all symbols are satisfied, otherwise we get a static library.
       allow_undefined=yes
       ;;
+    *-*-aix*)
+      allow_undefined=no
+      ;;
     *)
       allow_undefined=yes
       ;;
@@ -940,6 +943,7 @@ compiler."
       -allow-undefined)
 	# FIXME: remove this flag sometime in the future.
 	$echo "$modename: \`-allow-undefined' is deprecated because it is the default" 1>&2
+	allow_undefined=yes
 	continue
 	;;
 
diff --git a/usr.sbin/bind/make/rules.in b/usr.sbin/bind/make/rules.in
index 388658c1ed9..7fc6b2416cf 100644
--- a/usr.sbin/bind/make/rules.in
+++ b/usr.sbin/bind/make/rules.in
@@ -13,7 +13,7 @@
 # NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
 # WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
-# $ISC: rules.in,v 1.40.2.3.4.2 2003/02/17 07:05:11 marka Exp $
+# $ISC: rules.in,v 1.40.2.5 2003/05/12 06:39:54 marka Exp $
 
 ###
 ### Common Makefile rules for BIND 9.
@@ -127,7 +127,7 @@ cleandir: distclean
 superclean: maintainer-clean
 
 clean distclean maintainer-clean::
-	rm -f *.@O@ *.lo *.la core *.core
+	rm -f *.@O@ *.lo *.la core *.core .depend
 	rm -rf .libs
 
 distclean maintainer-clean::
diff --git a/usr.sbin/bind/version b/usr.sbin/bind/version
index f30d285b7bf..11889821bca 100644
--- a/usr.sbin/bind/version
+++ b/usr.sbin/bind/version
@@ -1,10 +1,10 @@
-# $Id: version,v 1.3 2003/09/22 19:49:28 jakob Exp $
+# $ISC: version,v 1.26.2.22 2003/10/09 07:00:55 marka Exp $
 #
 # This file must follow /bin/sh rules.  It is imported directly via
 # configure.
 #
 MAJORVER=9
 MINORVER=2
-PATCHVER=2
-RELEASETYPE=-P
-RELEASEVER=3
+PATCHVER=3
+RELEASETYPE=
+RELEASEVER=