Import of ISC BIND 8.3.1-REL.

58 files changed, 3190 insertions, 2101 deletions

diff --git a/contrib/bind/bin/Makefile b/contrib/bind/bin/Makefile
index 5b56413..575470f 100644
--- a/contrib/bind/bin/Makefile
+++ b/contrib/bind/bin/Makefile
@@ -13,7 +13,7 @@
 ## ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 ## SOFTWARE.
 
-# $Id: Makefile,v 8.30 2000/12/23 08:02:48 vixie Exp $
+# $Id: Makefile,v 8.31 2001/08/14 05:57:57 marka Exp $
 
 DESTDIR=
 CC= cc
@@ -64,10 +64,10 @@ CPPFLAGS= -I${PORTINCL} -I${INCL}
 SUBDIRS = addr nslookup dig dnsquery host named named-xfer ndc nsupdate \
 	mkservdb irpd dnskeygen named-bootconf
 
-all: ${SUBDIRS}
-
-${SUBDIRS}: FRC
-	@(cd $@; pwd; ${MAKE} ${MARGS}) || exit 1
+all: 
+	@for x in ${SUBDIRS}; do \
+		(cd $$x; pwd; ${MAKE} ${MARGS} $@) || exit 1; \
+	done
 
 install depend tags clean distclean::
 	@for x in ${SUBDIRS}; do \
diff --git a/contrib/bind/bin/dig/dig.c b/contrib/bind/bin/dig/dig.c
index f8030fd..037a495 100644
--- a/contrib/bind/bin/dig/dig.c
+++ b/contrib/bind/bin/dig/dig.c
@@ -1,5 +1,5 @@
 #ifndef lint
-static const char rcsid[] = "$Id: dig.c,v 8.46 2001/04/01 17:35:01 vixie Exp $";
+static const char rcsid[] = "$Id: dig.c,v 8.51 2001/12/19 02:25:17 marka Exp $";
 #endif
 
 /*
@@ -188,9 +188,15 @@ static const char rcsid[] = "$Id: dig.c,v 8.46 2001/04/01 17:35:01 vixie Exp $";
 #define VERSION 83
 #define VSTRING "8.3"
 
-#define PRF_DEF		0x2ff9
-#define PRF_MIN		0xA930
-#define PRF_ZONE        0x24f9
+#define PRF_DEF		(RES_PRF_STATS | RES_PRF_CMD | RES_PRF_QUES | \
+			 RES_PRF_ANS | RES_PRF_AUTH | RES_PRF_ADD | \
+			 RES_PRF_HEAD1 | RES_PRF_HEAD2 | RES_PRF_TTLID | \
+			 RES_PRF_HEADX | RES_PRF_REPLY | RES_PRF_TRUNC)
+#define PRF_MIN		(RES_PRF_QUES | RES_PRF_ANS | RES_PRF_HEAD1 | \
+			 RES_PRF_HEADX | RES_PRF_REPLY | RES_PRF_TRUNC)
+#define PRF_ZONE        (RES_PRF_STATS | RES_PRF_CMD | RES_PRF_QUES | \
+			 RES_PRF_ANS | RES_PRF_AUTH | RES_PRF_ADD | \
+			 RES_PRF_TTLID | RES_PRF_REPLY | RES_PRF_TRUNC)
 
 #ifndef MAXHOSTNAMELEN
 #define MAXHOSTNAMELEN 256
@@ -219,7 +225,7 @@ int		queryType, queryClass;
 extern int	StringToClass(), StringToType();	/* subr.c */
 #if defined(BSD) && BSD >= 199006 && !defined(RISCOS_BSD)
 FILE		*yyin = NULL;
-void		yyrestart(FILE *f) { }
+void		yyrestart(FILE *f) { UNUSED(f); }
 #endif
 char		*pager = NULL;
 /* end of nslookup stuff */
@@ -448,13 +454,21 @@ main(int argc, char **argv) {
 						printf("; no arg for -t?\n");
 					else if ((tmp = atoi(*argv))
 					    || *argv[0]=='0') {
-						queryType = tmp;
-						qtypeSet++;
+						if (ns_t_xfr_p(tmp)) {
+							xfr = tmp;
+						} else {
+							queryType = tmp;
+							qtypeSet++;
+						}
 					} else if ((tmp = StringToType(*argv,
 								      0, NULL)
 						   ) != 0) {
-						queryType = tmp;
-						qtypeSet++;
+						if (ns_t_xfr_p(tmp)) {
+							xfr = tmp;
+						} else {
+							queryType = tmp;
+							qtypeSet++;
+						}
 					} else {
 						printf(
 						   "; invalid type specified\n"
@@ -832,6 +846,7 @@ main(int argc, char **argv) {
 		if (n < 0) {
 			fflush(stderr);
 			printf(";; res_nmkquery: buffer too small\n\n");
+			fflush(stdout);
 			continue;
 		}
 		if (queryType == T_IXFR) {
@@ -857,6 +872,13 @@ main(int argc, char **argv) {
 			bytes_out = n = cpp - packet;
 		};	
 
+#if defined(RES_USE_EDNS0) && defined(RES_USE_DNSSEC)
+		if (n > 0 &&
+		    (res.options & (RES_USE_EDNS0|RES_USE_DNSSEC)) != 0)
+			bytes_out = n = res_nopt(&res, n, packet,
+						 sizeof(packet), 4096);
+#endif
+
 		eecode = 0;
 		if (res.pfcode & RES_PRF_HEAD1)
 			fp_resstat(&res, stdout);
@@ -954,14 +976,15 @@ where:	server,\n\
 	d-opt	is of the form ``+keyword=value'' where keyword is one of:\n\
 		[no]debug [no]d2 [no]recurse retry=# time=# [no]ko [no]vc\n\
 		[no]defname [no]search domain=NAME [no]ignore [no]primary\n\
-		[no]aaonly [no]cmd [no]stats [no]Header [no]header\n\
+		[no]aaonly [no]cmd [no]stats [no]Header [no]header [no]trunc\n\
 		[no]ttlid [no]cl [no]qr [no]reply [no]ques [no]answer\n\
-		[no]author [no]addit pfdef pfmin pfset=# pfand=# pfor=#\n\
+		[no]author [no]addit [no]dnssec pfdef pfmin\n\
+		pfset=# pfand=# pfor=#\n\
 ", stderr);
 	fputs("\
 notes:	defname and search don't work; use fully-qualified names.\n\
 	this is DiG version " VSTRING "\n\
-	$Id: dig.c,v 8.46 2001/04/01 17:35:01 vixie Exp $\n\
+	$Id: dig.c,v 8.51 2001/12/19 02:25:17 marka Exp $\n\
 ", stderr);
 }
 
@@ -1000,6 +1023,10 @@ setopt(const char *string) {
 		res.options |= RES_DEFNAMES;
 	} else if (strncmp(option, "nodef", 5) == 0) {
 		res.options &= ~RES_DEFNAMES;
+	} else if (strncmp(option, "dn", 2) == 0) {	/* dnssec */
+		res.options |= RES_USE_DNSSEC;
+	} else if (strncmp(option, "nodn", 4) == 0) {
+		res.options &= ~RES_USE_DNSSEC;
 	} else if (strncmp(option, "sea", 3) == 0) {	/* search list */
 		res.options |= RES_DNSRCH;
 	} else if (strncmp(option, "nosea", 5) == 0) {
@@ -1075,6 +1102,10 @@ setopt(const char *string) {
 		res.pfcode |= RES_PRF_TTLID;
 	} else if (strncmp(option, "nott", 4) == 0) {  
 		res.pfcode &= ~RES_PRF_TTLID;
+	} else if (strncmp(option, "tr", 2) == 0) {  /* TTL & ID */
+		res.pfcode |= RES_PRF_TRUNC;
+	} else if (strncmp(option, "notr", 4) == 0) {  
+		res.pfcode &= ~RES_PRF_TRUNC;
 	} else if (strncmp(option, "he", 2) == 0) {  /* head flags stats */
 		res.pfcode |= RES_PRF_HEAD2;
 	} else if (strncmp(option, "nohe", 4) == 0) {  
@@ -1191,14 +1222,14 @@ printZone(ns_type xfr, const char *zone, const struct sockaddr_in *sin,
 	static int answerLen = 0;
 
 	querybuf buf;
-	int msglen, amtToRead, numRead, result = 0, sockFD, len;
+	int msglen, amtToRead, numRead, result, sockFD, len;
 	int count, type, class, rlen, done, n;
-	int numAnswers = 0, numRecords = 0, soacnt = 0;
+	int numAnswers, numRecords, soacnt;
 	u_char *cp, tmp[NS_INT16SZ];
 	char dname[2][NS_MAXDNAME];
 	enum { NO_ERRORS, ERR_READING_LEN, ERR_READING_MSG, ERR_PRINTING }
-		error = NO_ERRORS;
-	pid_t zpid;
+		error;
+	pid_t zpid = -1;
 	u_char *newmsg;
 	int newmsglen;
 	ns_tcp_tsig_state tsig_state;
@@ -1302,7 +1333,7 @@ printZone(ns_type xfr, const char *zone, const struct sockaddr_in *sin,
 		sockFD = -1;
 		return (e);
 	}
-	if (connect(sockFD, (struct sockaddr *)sin, sizeof *sin) < 0) {
+	if (connect(sockFD, (const struct sockaddr *)sin, sizeof *sin) < 0) {
 		int e = errno;
 
 		perror(";; connect");
@@ -1325,7 +1356,8 @@ printZone(ns_type xfr, const char *zone, const struct sockaddr_in *sin,
 		(void) close(sockFD);
 		sockFD = -1;
 		return (e);
-	}
+	} else if (key)
+		free (newmsg);
 
 	/*
 	 * If we're compressing, push a gzip into the pipeline.
@@ -1336,8 +1368,6 @@ printZone(ns_type xfr, const char *zone, const struct sockaddr_in *sin,
 
 		if (pipe(z) < 0) {
 			int e = errno;
-			if (key)
-				free (newmsg);
 
 			perror(";; pipe");
 			(void) close(sockFD);
@@ -1347,8 +1377,6 @@ printZone(ns_type xfr, const char *zone, const struct sockaddr_in *sin,
 		zpid = vfork();
 		if (zpid < 0) {
 			int e = errno;
-			if (key)
-				free (newmsg);
 
 			perror(";; fork");
 			(void) close(sockFD);
@@ -1370,6 +1398,11 @@ printZone(ns_type xfr, const char *zone, const struct sockaddr_in *sin,
 		(void) dup2(z[rd], sockFD);
 		(void) close(z[rd]);
 	}
+	result = 0;
+	numAnswers = 0;
+	numRecords = 0;
+	soacnt = 0;
+	error = NO_ERRORS;
 
 	dname[0][0] = '\0';
 	for (done = 0; !done; (void)NULL) {
@@ -1538,10 +1571,6 @@ printZone(ns_type xfr, const char *zone, const struct sockaddr_in *sin,
 		       WCOREDUMP(status) ? 't' : 'f');
 	}
 
-	/* XXX This should probably happen sooner than here */
-	if (key)
-		free (newmsg);
-
 	switch (error) {
 	case NO_ERRORS:
 		return (0);
@@ -1604,9 +1633,12 @@ print_axfr(FILE *file, const u_char *msg, size_t msglen) {
 			fprintf(file, "$ORIGIN %s.\n", origin);
 			if (strcmp(name, ".") == 0)
 				strcpy(origin, name);
-			strcpy(name_ctx, "@");
+			if (res.pfcode & RES_PRF_TRUNC)
+				strcpy(name_ctx, "@");
 		}
-		if (ns_sprintrr(&handle, &rr, name_ctx, origin,
+		if (ns_sprintrr(&handle, &rr,
+				(res.pfcode & RES_PRF_TRUNC) ? name_ctx : NULL,
+				(res.pfcode & RES_PRF_TRUNC) ? origin : NULL,
 				buf, sizeof buf) < 0) {
 			fprintf(file, ";; ns_sprintrr: %s\n", strerror(errno));
 			return (FORMERR);
diff --git a/contrib/bind/bin/dnskeygen/dnskeygen.c b/contrib/bind/bin/dnskeygen/dnskeygen.c
index 593fb00..06f09c4 100644
--- a/contrib/bind/bin/dnskeygen/dnskeygen.c
+++ b/contrib/bind/bin/dnskeygen/dnskeygen.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: dnskeygen.c,v 1.11.2.1 2001/04/26 02:56:06 marka Exp $";
+static const char rcsid[] = "$Id: dnskeygen.c,v 1.14 2001/09/25 04:50:14 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -37,7 +37,7 @@ static const char rcsid[] = "$Id: dnskeygen.c,v 1.11.2.1 2001/04/26 02:56:06 mar
 #define PATH_SEP '/'
 #endif
 
-static void usage(char *str, int full);
+static void usage(const char *str, int full);
 
 static short dsa_sizes[] = {512, 576, 640, 704, 768, 832, 896, 960, 1024, 0};
 static char *prog;
@@ -274,9 +274,10 @@ main(int argc, char **argv) {
 }
 
 static void
-usage(char *str, int flag){
+usage(const char *str, int flag) {
 	int i;
-	printf ("\nNo key generated\n");
+
+	printf("\nNo key generated\n");
 	if (*str != '\0')
 		printf("Usage:%s: %s\n",prog, str);
 	printf("Usage:%s -{DHR} <size> [-F] -{zhu} [-ac]  [-p <no>]"
@@ -316,7 +317,5 @@ usage(char *str, int flag){
 		printf("\n");
 	}
 
-	exit (-3);
+	exit (3);
 }
-
-
diff --git a/contrib/bind/bin/dnsquery/dnsquery.c b/contrib/bind/bin/dnsquery/dnsquery.c
index e8abd3e..c9fed3c 100644
--- a/contrib/bind/bin/dnsquery/dnsquery.c
+++ b/contrib/bind/bin/dnsquery/dnsquery.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: dnsquery.c,v 8.15 2000/12/23 08:14:32 vixie Exp $";
+static const char rcsid[] = "$Id: dnsquery.c,v 8.16 2001/09/25 04:50:15 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -66,7 +66,7 @@ main(int argc, char *argv[]) {
 	/* if no args, exit */
 	if (argc == 1) {
 		fprintf(stderr, "Usage:  %s [-h] host [-n ns] [-t type] [-c class] [-r retry] [-p period] [-s] [-v] [-d] [-a]\n", argv[0]);
-		exit(-1);
+		exit(1);
 	}
 
 	/* handle args */
@@ -82,7 +82,7 @@ main(int argc, char *argv[]) {
 		case 'h' :	if (strlen(optarg) >= sizeof(name)) {
 					fprintf(stderr,
 						"Domain name too long (%s)\n", optarg);
-					exit(-1);
+					exit(1);
 				} else
 					strcpy(name, optarg);
 				break;
@@ -96,7 +96,7 @@ main(int argc, char *argv[]) {
 					class = proto_class;
 				else {
 				    fprintf(stderr, "Bad class (%s)\n", optarg);
-					exit(-1);
+					exit(1);
 				}
 			    }
 				break;
@@ -110,7 +110,7 @@ main(int argc, char *argv[]) {
 					type = proto_type;
 				else {
 				    fprintf(stderr, "Bad type (%s)\n", optarg);
-					exit(-1);
+					exit(1);
 				}
 			    }
 				break;
@@ -135,7 +135,7 @@ main(int argc, char *argv[]) {
 						fprintf(stderr,
 							"res_ninit() failed\n"
 							);
-						exit(-1);
+						exit(1);
 				}
 				if (nameservers >= MAXNS) break;
 				(void) inet_aton(optarg,
@@ -146,7 +146,7 @@ main(int argc, char *argv[]) {
 						fprintf(stderr,
 						       "Bad nameserver (%s)\n",
 							optarg);
-						exit(-1);
+						exit(1);
 					}
 					memcpy(&q_nsaddr[nameservers],
 					       q_nsname->h_addr, INADDRSZ);
@@ -158,14 +158,14 @@ main(int argc, char *argv[]) {
 
 		default : 	fprintf(stderr, 
 				"\tUsage:  %s [-n ns] [-h host] [-t type] [-c class] [-r retry] [-p period] [-s] [-v] [-d] [-a]\n", argv[0]);
-				exit(-1);
+				exit(1);
 		}
 	}
 	if (optind < argc) {
 		if (strlen(argv[optind]) >= sizeof(name)) {
 			fprintf(stderr,
 				"Domain name too long (%s)\n", argv[optind]);
-			exit(-1);
+			exit(1);
 		} else {
 			strcpy(name, argv[optind]);
 		}
@@ -176,7 +176,7 @@ main(int argc, char *argv[]) {
 	if (!(res.options & RES_INIT))
 		if (res_ninit(&res) == -1) {
 			fprintf(stderr, "res_ninit() failed\n");
-			exit(-1);
+			exit(1);
 		}
 
 	/* 
@@ -208,13 +208,13 @@ main(int argc, char *argv[]) {
 		if (n < 0) {
 			fprintf(stderr, "Query failed (h_errno = %d) : %s\n", 
 				h_errno, h_errlist[h_errno]);
-			exit(-1);
+			exit(1);
 		}
 	} else if ((n = res_nsearch(&res, name, class, type,
 				    answer, len)) < 0) {
 		fprintf(stderr, "Query failed (h_errno = %d) : %s\n", 
 			h_errno, h_errlist[h_errno]);
-		exit(-1);
+		exit(1);
 	}
 	res_pquery(&res, answer, n, stdout);
 	exit(0);
diff --git a/contrib/bind/bin/host/host.c b/contrib/bind/bin/host/host.c
index 6ec63df..eb28564 100644
--- a/contrib/bind/bin/host/host.c
+++ b/contrib/bind/bin/host/host.c
@@ -1,5 +1,5 @@
 #ifndef lint
-static const char rcsid[] = "$Id: host.c,v 8.43.2.2 2001/08/09 14:04:45 marka Exp $";
+static const char rcsid[] = "$Id: host.c,v 8.49 2001/12/17 04:24:37 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -119,7 +119,7 @@ static const char copyright[] =
 #define PATH_SEP '/'
 #endif
 #define SIG_RDATA_BY_NAME	18
-#define NS_HEADERDATA_SIZE 10
+#define NS_HEADERDATA_SIZE 10	/* type + class + ttl + rdlen */
 
 #define NUMNS		8
 #define NUMNSADDR	16
@@ -354,7 +354,7 @@ main(int argc, char **argv) {
 					printf ("%s for %s not found, last verified key %s\n",
 						chase_step & SD_SIG ? "Key" : "Signature",
 						chase_step & SD_SIG ? chase_signer : chase_domain, 
-						chase_lastgoodkey ? chase_lastgoodkey : "None");
+						chase_lastgoodkey[0] ? chase_lastgoodkey : "None");
 				}
 			}
 			if (!getdomain[0] && cname) {
@@ -611,7 +611,8 @@ getinfo(const char *name, const char *domain, int type) {
 	int n;
 	char host[NS_MAXDNAME];
 
-	if (domain == NULL)
+	if (domain == NULL ||
+	    (domain[0] == '.' && domain[1] == '\0'))
 		sprintf(host, "%.*s", NS_MAXDNAME, name);
 	else
 		sprintf(host, "%.*s.%.*s",
@@ -647,7 +648,7 @@ printinfo(const querybuf *answer, const u_char *eom, int filter, int isls,
 	/*
 	 * Find first satisfactory answer.
 	 */
-	hp = (HEADER *) answer;
+	hp = (const HEADER *) answer;
 	ancount = ntohs(hp->ancount);
 	qdcount = ntohs(hp->qdcount);
 	nscount = ntohs(hp->nscount);
@@ -725,12 +726,12 @@ printinfo(const querybuf *answer, const u_char *eom, int filter, int isls,
 	if (nscount) {
 		printf("For authoritative answers, see:\n");
 		while (--nscount >= 0 && cp && cp < eom)
-			cp = (u_char *)pr_rr(cp, answer->qb2, stdout, filter);
+			cp = pr_rr(cp, answer->qb2, stdout, filter);
 	}
 	if (arcount) {
 		printf("Additional information:\n");
 		while (--arcount >= 0 && cp && cp < eom)
-			cp = (u_char *)pr_rr(cp, answer->qb2, stdout, filter);
+			cp = pr_rr(cp, answer->qb2, stdout, filter);
 	}
 
 	/* restore sigchase value */
@@ -740,7 +741,8 @@ printinfo(const querybuf *answer, const u_char *eom, int filter, int isls,
 	return (1);
 }
 
-void print_hex_field (u_int8_t field[], int length, int width, char *pref)
+static void print_hex_field (u_int8_t field[], int length, int width,
+			     const char *pref)
 {
 	/* Prints an arbitrary bit field, from one address for some number of
 		bytes.  Output is formatted via the width, and includes the raw
@@ -772,7 +774,7 @@ void print_hex_field (u_int8_t field[], int length, int width, char *pref)
 	} while (start < length);
 }
 
-void memswap (void *s1, void *s2, size_t n)
+static void memswap (void *s1, void *s2, size_t n)
 {
 	void *tmp;
 
@@ -789,23 +791,6 @@ void memswap (void *s1, void *s2, size_t n)
 	free (tmp);
 }
 
-void print_hex (u_int8_t field[], int length)
-{
-	/* Prints the hex values of a field...not as pretty as the print_hex_field.
-	*/
-	int		i, start, stop;
-
-	start=0;
-	do
-	{
-		stop=length;
- 		for (i = start; i < stop; i++)
-			printf ("%02x ", (u_char) field[i]);
-		start = stop;
-		if (start < length) printf ("\n");
-	} while (start < length);
-}
-
 /*
  * Print resource record fields in human readable form.
  */
@@ -826,7 +811,8 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 	u_char canonrr[MY_PACKETSZ];
 	size_t canonrr_len = 0;
 
-	if ((cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name))) == NULL)
+	cp = pr_cdname(cp, msg, name, sizeof(name));
+	if (cp == NULL)
 		return (NULL);			/* compression error */
 	strcpy(thisdomain, name);
 
@@ -895,7 +881,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 		const u_char *startrdata = cp;
 		u_char cdname[NS_MAXCDNAME];
 
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof name);
+		cp = pr_cdname(cp, msg, name, sizeof name);
 		if (doprint)
 			fprintf(file, "%c%s", punc, name);
 
@@ -944,7 +930,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 		const u_char *startname = cp;
 		u_char cdname[NS_MAXCDNAME];
 
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof name);
+		cp = pr_cdname(cp, msg, name, sizeof name);
 		if (doprint)
 			fprintf(file, "\t%s", name);
 
@@ -961,7 +947,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 		}
 
 		startname = cp;
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof name);
+		cp = pr_cdname(cp, msg, name, sizeof name);
 		if (doprint)
 			fprintf(file, " %s", name);
 
@@ -1020,7 +1006,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 				fprintf(file," ");
 		}
 		cp += sizeof(u_short);
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name));
+		cp = pr_cdname(cp, msg, name, sizeof(name));
 		if (doprint)
 			fprintf(file, "%s", name);
 
@@ -1056,7 +1042,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 		if (doprint)
 			fprintf(file," %d", ns_get16(cp));
 		cp += sizeof(u_short);
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name));
+		cp = pr_cdname(cp, msg, name, sizeof(name));
 		if (doprint)
 			fprintf(file, " %s", name);
 		break;
@@ -1098,14 +1084,14 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 		}
 		cp += n;
 		/* replacement  */
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name));
+		cp = pr_cdname(cp, msg, name, sizeof(name));
 		if (doprint)
 			fprintf(file, "%s", name);
 		break;
 
 	case ns_t_minfo:
 	case ns_t_rp:
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof name);
+		cp = pr_cdname(cp, msg, name, sizeof name);
 		if (doprint) {
 			if (type == ns_t_rp) {
 				char *p;
@@ -1116,7 +1102,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 			}
 			fprintf(file, "%c%s", punc, name);
 		}
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name));
+		cp = pr_cdname(cp, msg, name, sizeof(name));
 		if (doprint)
 			fprintf(file, " %s", name);
 		break;
@@ -1201,7 +1187,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 		u_char cdname[NS_MAXCDNAME];
 		size_t bitmaplen;
 
-		cp = (u_char *) pr_cdname(cp, msg, name, sizeof name);
+		cp = pr_cdname(cp, msg, name, sizeof name);
 		if (doprint)
 			fprintf(file, "%c%s", punc, name);
 		bitmaplen = dlen - (cp - startrdata);
@@ -1265,7 +1251,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 			fprintf(file, " %d", ns_get16(cp));
 		cp += sizeof(u_short);
 		/* signer's name */
-		cp = (u_char *)pr_cdname(cp, msg, name, sizeof(name));
+		cp = pr_cdname(cp, msg, name, sizeof(name));
 		if (doprint && verbose)
 			fprintf(file, " %s", name);
 		else if (doprint && !verbose)
@@ -1299,7 +1285,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 					       SIG_RDATA_BY_NAME);
 					memcpy(chase_sigrdata + SIG_RDATA_BY_NAME,
 					       cdname, n);
-					chase_sigrdata_len += SIG_RDATA_BY_NAME + n;
+					chase_sigrdata_len = SIG_RDATA_BY_NAME + n;
 					memcpy(chase_signature, cp, len);
 					chase_signature_len = len;
 
@@ -1376,10 +1362,14 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 			/* sort rr's (qsort() is too slow) */
 			
 			for (i = 0; i < NUMRR && chase_rr[i].len; i++)
-				for (j = i + 1; i < NUMRR && chase_rr[j].len; j++)
-					if (memcmp(chase_rr[i].data, chase_rr[j].data, MY_PACKETSZ) > 0)
-						memswap(&chase_rr[i], &chase_rr[j], sizeof(rrstruct));
-			
+				for (j = i + 1; j < NUMRR && chase_rr[j].len;
+				     j++)
+					if (memcmp(chase_rr[i].data,
+						   chase_rr[j].data,
+						   MY_PACKETSZ) < 0)
+						memswap(&chase_rr[i],
+						        &chase_rr[j],
+							sizeof(rrstruct));
 			/* append rr's to sigrdata */
 
 			for (i = 0; i < NUMRR && chase_rr[i].len; i++)
@@ -1392,6 +1382,7 @@ pr_rr(const u_char *cp, const u_char *msg, FILE *file, int filter) {
 			/* print rr-data and signature */
 
 			if (verbose) {
+				fprintf(file, "\n");
 				print_hex_field(chase_sigrdata,
 						chase_sigrdata_len,
 						21,"DATA: ");
diff --git a/contrib/bind/bin/irpd/irpd.c b/contrib/bind/bin/irpd/irpd.c
index e03276f..6dee58e 100644
--- a/contrib/bind/bin/irpd/irpd.c
+++ b/contrib/bind/bin/irpd/irpd.c
@@ -37,7 +37,7 @@ seem to be so for getnetbyaddr
 #endif
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irpd.c,v 1.10 2000/12/23 08:14:33 vixie Exp $";
+static const char rcsid[] = "$Id: irpd.c,v 1.13 2001/09/25 04:50:17 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -114,7 +114,7 @@ static const char rcsid[] = "$Id: irpd.c,v 1.10 2000/12/23 08:14:33 vixie Exp $"
 	do{ if ((nd)->field == 0) {					     \
 		(nd)->field = (*(nd)->irs->field ## _map)(nd->irs);	     \
 	        if ((nd)->field == 0) {					     \
-		    char *msg = "net_data " #field " initialization failed"; \
+		    const char *msg = "net_data " #field " initialization failed"; \
 		    ctl_response(sess, respcode, msg, CTL_EXIT, NULL,	     \
 			         NULL, NULL, NULL, 0);			     \
 		    return;						     \
@@ -149,103 +149,111 @@ static struct net_data *get_net_data(struct ctl_sess *sess);
 
 static void irpd_gethostbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			       const struct ctl_verb *verb, const char *rest,
-			       u_int respflags, void *respctx, void *uctx);
+			       u_int respflags, const void *respctx,
+			       void *uctx);
 static void irpd_gethostbyname2(struct ctl_sctx *ctx, struct ctl_sess *sess,
 				const struct ctl_verb *verb, const char *rest,
-				u_int respflags, void *respctx, void *uctx);
+				u_int respflags, const void *respctx,
+			        void *uctx);
+			
 static void irpd_gethostbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			       const struct ctl_verb *verb, const char *rest,
-			       u_int respflags, void *respctx, void *uctx);
+			       u_int respflags, const void *respctx,
+			       void *uctx);
 static void irpd_gethostent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			    const struct ctl_verb *verb, const char *rest,
-			    u_int respflags, void *respctx, void *uctx);
+			    u_int respflags, const void *respctx, void *uctx);
 static void irpd_sethostent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			    const struct ctl_verb *verb, const char *rest,
-			    u_int respflags, void *respctx, void *uctx);
+			    u_int respflags, const void *respctx, void *uctx);
 static void irpd_getpwnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_getpwuid(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_getpwent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_setpwent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_getnetbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			      const struct ctl_verb *verb, const char *rest,
-			      u_int respflags, void *respctx, void *uctx);
+			      u_int respflags, const void *respctx, void *uctx);
 static void irpd_getnetbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			      const struct ctl_verb *verb, const char *rest,
-			      u_int respflags, void *respctx, void *uctx);
+			      u_int respflags, const void *respctx, void *uctx);
 static void irpd_getnetent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			   const struct ctl_verb *verb, const char *rest,
-			   u_int respflags, void *respctx, void *uctx);
+			   u_int respflags, const void *respctx, void *uctx);
 static void irpd_setnetent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			   const struct ctl_verb *verb, const char *rest,
-			   u_int respflags, void *respctx, void *uctx);
+			   u_int respflags, const void *respctx, void *uctx);
 static void irpd_getgrnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_getgrgid(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_getgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_setgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  const struct ctl_verb *verb, const char *rest,
-			  u_int respflags, void *respctx, void *uctx);
+			  u_int respflags, const void *respctx, void *uctx);
 static void irpd_getservbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			       const struct ctl_verb *verb, const char *rest,
-			       u_int respflags, void *respctx, void *uctx);
+			       u_int respflags, const void *respctx,
+			       void *uctx);
 static void irpd_getservbyport(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			       const struct ctl_verb *verb, const char *rest,
-			       u_int respflags, void *respctx, void *uctx);
+			       u_int respflags, const void *respctx,
+			       void *uctx);
 static void irpd_getservent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			    const struct ctl_verb *verb, const char *rest,
-			    u_int respflags, void *respctx, void *uctx);
+			    u_int respflags, const void *respctx, void *uctx);
 static void irpd_setservent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			    const struct ctl_verb *verb, const char *rest,
-			    u_int respflags, void *respctx, void *uctx);
+			    u_int respflags, const void *respctx, void *uctx);
 static void irpd_getprotobyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 				const struct ctl_verb *verb, const char *rest,
-				u_int respflags, void *respctx, void *uctx);
+				u_int respflags, const void *respctx,
+			        void *uctx);
 static void irpd_getprotobynumber(struct ctl_sctx *ctx, struct ctl_sess *sess,
 				  const struct ctl_verb *verb, const char *rest,
-				  u_int respflags, void *respctx, void *uctx);
+				  u_int respflags, const void *respctx,
+				  void *uctx);
 static void irpd_getprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			     const struct ctl_verb *verb, const char *rest,
-			     u_int respflags, void *respctx, void *uctx);
+			     u_int respflags, const void *respctx, void *uctx);
 static void irpd_setprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			     const struct ctl_verb *verb, const char *rest,
-			     u_int respflags, void *respctx, void *uctx);
+			     u_int respflags, const void *respctx, void *uctx);
 static void irpd_getnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			     const struct ctl_verb *verb, const char *rest,
-			     u_int respflags, void *respctx, void *uctx);
+			     u_int respflags, const void *respctx, void *uctx);
 static void irpd_innetgr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			 const struct ctl_verb *verb, const char *rest,
-			 u_int respflags, void *respctx, void *uctx);
+			 u_int respflags, const void *respctx, void *uctx);
 static void irpd_setnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			     const struct ctl_verb *verb, const char *rest,
-			     u_int respflags, void *respctx, void *uctx);
+			     u_int respflags, const void *respctx, void *uctx);
 static void irpd_endnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			     const struct ctl_verb *verb, const char *rest,
-			     u_int respflags, void *respctx, void *uctx);
+			     u_int respflags, const void *respctx, void *uctx);
 static void irpd_quit(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		      const struct ctl_verb *verb, const char *rest,
-		      u_int respflags, void *respctx, void *uctx);
+		      u_int respflags, const void *respctx, void *uctx);
 static void irpd_help(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		      const struct ctl_verb *verb, const char *rest,
-		      u_int respflags, void *respctx, void *uctx);
+		      u_int respflags, const void *respctx, void *uctx);
 static void irpd_accept(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			const struct ctl_verb *verb, const char *rest,
-			u_int respflags, void *respctx, void *uctx);
+			u_int respflags, const void *respctx, void *uctx);
 static void irpd_abort(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		       const struct ctl_verb *verb, const char *rest,
-		       u_int respflags, void *respctx, void *uctx);
+		       u_int respflags, const void *respctx, void *uctx);
 
 static void response_done(struct ctl_sctx *ctx, struct ctl_sess *sess,
 			  void *uap);
@@ -266,59 +274,59 @@ static int main_needs_exit = 0;
 static evContext ev;
 
 struct ctl_verb verbs [] = {
-	{ "gethostbyname", irpd_gethostbyname },
-	{ "gethostbyname2", irpd_gethostbyname2 },
-	{ "gethostbyaddr", irpd_gethostbyaddr },
-	{ "gethostent", irpd_gethostent },
-	{ "sethostent", irpd_sethostent },
+	{ "gethostbyname", irpd_gethostbyname, NULL },
+	{ "gethostbyname2", irpd_gethostbyname2, NULL },
+	{ "gethostbyaddr", irpd_gethostbyaddr, NULL },
+	{ "gethostent", irpd_gethostent, NULL },
+	{ "sethostent", irpd_sethostent, NULL },
 #ifdef WANT_IRS_PW
-	{ "getpwnam", irpd_getpwnam },
-	{ "getpwuid", irpd_getpwuid },
-	{ "getpwent", irpd_getpwent },
-	{ "setpwent", irpd_setpwent },
+	{ "getpwnam", irpd_getpwnam, NULL },
+	{ "getpwuid", irpd_getpwuid, NULL },
+	{ "getpwent", irpd_getpwent, NULL },
+	{ "setpwent", irpd_setpwent, NULL },
 #endif
-	{ "getnetbyname", irpd_getnetbyname },
-	{ "getnetbyaddr", irpd_getnetbyaddr },
-	{ "getnetent", irpd_getnetent },
-	{ "setnetent", irpd_setnetent },
+	{ "getnetbyname", irpd_getnetbyname, NULL },
+	{ "getnetbyaddr", irpd_getnetbyaddr, NULL },
+	{ "getnetent", irpd_getnetent, NULL },
+	{ "setnetent", irpd_setnetent, NULL },
 #ifdef WANT_IRS_GR
-	{ "getgrnam", irpd_getgrnam },
-	{ "getgrgid", irpd_getgrgid },
-	{ "getgrent", irpd_getgrent },
-	{ "setgrent", irpd_setgrent },
+	{ "getgrnam", irpd_getgrnam, NULL },
+	{ "getgrgid", irpd_getgrgid, NULL },
+	{ "getgrent", irpd_getgrent, NULL },
+	{ "setgrent", irpd_setgrent, NULL },
 #endif
-	{ "getservbyname", irpd_getservbyname },
-	{ "getservbyport", irpd_getservbyport },
-	{ "getservent", irpd_getservent },
-	{ "setservent", irpd_setservent },
+	{ "getservbyname", irpd_getservbyname, NULL },
+	{ "getservbyport", irpd_getservbyport, NULL },
+	{ "getservent", irpd_getservent, NULL },
+	{ "setservent", irpd_setservent, NULL },
 
-	{ "getprotobyname", irpd_getprotobyname },
-	{ "getprotobynumber", irpd_getprotobynumber },
-	{ "getprotoent", irpd_getprotoent },
-	{ "setprotoent", irpd_setprotoent },
+	{ "getprotobyname", irpd_getprotobyname, NULL },
+	{ "getprotobynumber", irpd_getprotobynumber, NULL },
+	{ "getprotoent", irpd_getprotoent, NULL },
+	{ "setprotoent", irpd_setprotoent, NULL },
 
-	{ "getnetgrent", irpd_getnetgrent },
-	{ "innetgr", irpd_innetgr },
-	{ "setnetgrent", irpd_setnetgrent },
-	{ "endnetgrent", irpd_endnetgrent },
-	{ "quit", irpd_quit },
-	{ "help", irpd_help },
+	{ "getnetgrent", irpd_getnetgrent, NULL },
+	{ "innetgr", irpd_innetgr, NULL },
+	{ "setnetgrent", irpd_setnetgrent, NULL },
+	{ "endnetgrent", irpd_endnetgrent, NULL },
+	{ "quit", irpd_quit, NULL },
+	{ "help", irpd_help, NULL },
 
-	{ "", irpd_accept },	/* For connection setups. */
+	{ "", irpd_accept, NULL },	/* For connection setups. */
 
 	/* abort is a verb expected by the ctl library. Is called when the
 	 * client drops the connection unexpectedly.
 	 */
-	{ "abort", irpd_abort },
+	{ "abort", irpd_abort, NULL },
 
-	{ NULL, NULL }
+	{ NULL, NULL, NULL }
 };
 
 /*
  * An empty string causes the library to use the compiled in
  * defaults and to ignore any external files.
  */
-char *conffile = "";			
+const char *conffile = "";			
 
 /* Public. */
 
@@ -332,7 +340,7 @@ main(int argc, char **argv) {
 	struct sockaddr_in iaddr;
 	short port = IRPD_PORT;
 	char *prog = argv[0];
-	char *sockname = IRPD_PATH;
+	const char *sockname = IRPD_PATH;
 	char *p;
 	int ch;
 	size_t socksize;
@@ -420,11 +428,11 @@ main(int argc, char **argv) {
 
 /*
  * static void
- * simple_response(struct ctl_sess *sess, u_int code, char *msg);
+ * simple_response(struct ctl_sess *sess, u_int code, const char *msg);
  *	Send back a simple, one-line response to the client.
  */
 static void
-simple_response(struct ctl_sess *sess, u_int code, char *msg) {
+simple_response(struct ctl_sess *sess, u_int code, const char *msg) {
 	struct response_buff *b = newbuffer(strlen(msg) + 1);
 
 	if (b == 0)
@@ -485,18 +493,24 @@ do_gethostbyname2(struct ctl_sess *sess, struct net_data *nd,
  * static void
  * irpd_gethostbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		      const struct ctl_verb *verb, const char *rest,
- *		      u_int respflags, void *respctx, void *uctx);
+ *		      u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETHOSTBYNAME verb.
  */
 static void
 irpd_gethostbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		   const struct ctl_verb *verb, const char *rest,
-		   u_int respflags, void *respctx, void *uctx)
+		   u_int respflags, const void *respctx, void *uctx)
 {
 	char hname[MAXHOSTNAMELEN];
 	struct arg_s *args;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ho, sess, IRPD_GETHOST_ERROR);
@@ -523,19 +537,25 @@ irpd_gethostbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_gethostbyname2(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		       const struct ctl_verb *verb, const char *rest,
- *		       u_int respflags, void *respctx, void *uctx);
+ *		       u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETHOSTBYNAME2 verb.
  */
 static void
 irpd_gethostbyname2(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		    const struct ctl_verb *verb, const char *rest,
-		    u_int respflags, void *respctx, void *uctx)
+		    u_int respflags, const void *respctx, void *uctx)
 {
 	char hname[MAXHOSTNAMELEN];
 	struct arg_s *args;
 	int af;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ho, sess, IRPD_GETHOST_ERROR);
@@ -572,13 +592,13 @@ irpd_gethostbyname2(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_gethostbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		      const struct ctl_verb *verb, const char *rest,
- *		      u_int respflags, void *respctx, void *uctx);
+ *		      u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETHOSTBYADDR verb.
  */
 static void
 irpd_gethostbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		   const struct ctl_verb *verb, const char *rest,
-		   u_int respflags, void *respctx, void *uctx)
+		   u_int respflags, const void *respctx, void *uctx)
 {
 	struct hostent *ho;
 	char haddr[MAXHOSTNAMELEN];
@@ -588,6 +608,12 @@ irpd_gethostbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	int addrlen;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ho, sess, IRPD_GETHOST_ERROR);
@@ -640,17 +666,24 @@ irpd_gethostbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_gethostent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		   const struct ctl_verb *verb, const char *rest,
- *		   u_int respflags, void *respctx, void *uctx);
+ *		   u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETHOSTENT verb
  */
 static void
 irpd_gethostent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		const struct ctl_verb *verb, const char *rest,
-		u_int respflags, void *respctx, void *uctx)
+		u_int respflags, const void *respctx, void *uctx)
 {
 	struct hostent *ho;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ho, sess, IRPD_GETHOST_ERROR);
@@ -664,16 +697,23 @@ irpd_gethostent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_sethostent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		   const struct ctl_verb *verb, const char *rest,
- *		   u_int respflags, void *respctx, void *uctx);
+ *		   u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the SETHOSTENT verb
  */
 static void
 irpd_sethostent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		const struct ctl_verb *verb, const char *rest,
-		u_int respflags, void *respctx, void *uctx)
+		u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ho, sess, IRPD_GETHOST_ERROR);
@@ -716,19 +756,25 @@ send_pwent(struct ctl_sess *sess, struct passwd *pw) {
  * static void
  * irpd_getpwnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETPWNAM verb
  */
 static void
 irpd_getpwnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct passwd *pw;
 	char username[64];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pw, sess, IRPD_GETUSER_ERROR);
@@ -758,19 +804,25 @@ irpd_getpwnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getpwuid(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETPWUID verb.
  */
 static void
 irpd_getpwuid(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct passwd *pw;
 	char userid[64];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pw, sess, IRPD_GETUSER_ERROR);
@@ -819,17 +871,24 @@ irpd_getpwuid(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getpwent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implemtnation of the GETPWENT verb. 
  */
 static void
 irpd_getpwent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct passwd *pw;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pw, sess, IRPD_GETUSER_ERROR);
@@ -842,16 +901,23 @@ irpd_getpwent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_setpwent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implemtnation of the SETPWENT verb.
  */
 static void
 irpd_setpwent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pw, sess, IRPD_GETUSER_ERROR);
@@ -893,13 +959,13 @@ send_nwent(struct ctl_sess *sess, struct nwent *nw) {
  * static void
  * irpd_getnetbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		     const struct ctl_verb *verb, const char *rest,
- *		     u_int respflags, void *respctx, void *uctx);
+ *		     u_int respflags, const void *respctx, void *uctx);
  *	Implementation of GETNETBYNAME verb.
  */
 static void
 irpd_getnetbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		  const struct ctl_verb *verb, const char *rest,
-		  u_int respflags, void *respctx, void *uctx)
+		  u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct netent *ne;
@@ -907,6 +973,12 @@ irpd_getnetbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	char netname[MAXNETNAMELEN];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, nw, sess, IRPD_GETNET_ERROR);
@@ -947,12 +1019,12 @@ irpd_getnetbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getnetbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		     const struct ctl_verb *verb, const char *rest,
- *		     u_int respflags, void *respctx, void *uctx);
+ *		     u_int respflags, const void *respctx, void *uctx);
  */
 static void
 irpd_getnetbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		  const struct ctl_verb *verb, const char *rest,
-		  u_int respflags, void *respctx, void *uctx)
+		  u_int respflags, const void *respctx, void *uctx)
 {
 	struct netent *ne;
 	struct nwent *nw;
@@ -964,6 +1036,12 @@ irpd_getnetbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	int bits;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, nw, sess, IRPD_GETUSER_ERROR);
@@ -1038,18 +1116,25 @@ irpd_getnetbyaddr(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getnetent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		  const struct ctl_verb *verb, const char *rest,
- *		  u_int respflags, void *respctx, void *uctx);
+ *		  u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETNETENT verb.
  */
 static void
 irpd_getnetent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	       const struct ctl_verb *verb, const char *rest,
-	       u_int respflags, void *respctx, void *uctx)
+	       u_int respflags, const void *respctx, void *uctx)
 {
 	struct netent *ne;
 	struct nwent *nw;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, nw, sess, IRPD_GETNET_ERROR);
@@ -1068,16 +1153,23 @@ irpd_getnetent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_setnetent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		  const struct ctl_verb *verb, const char *rest,
- *		  u_int respflags, void *respctx, void *uctx);
+ *		  u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the SETNETENT verb.
  */
 static void
 irpd_setnetent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	       const struct ctl_verb *verb, const char *rest,
-	       u_int respflags, void *respctx, void *uctx)
+	       u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, nw, sess, IRPD_GETNET_ERROR);
@@ -1119,19 +1211,25 @@ send_grent(struct ctl_sess *sess, struct group *gr) {
  * static void
  * irpd_getgrnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETGRNAM verb.
  */
 static void
 irpd_getgrnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct group *gr;
 	char groupname[64];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, gr, sess, IRPD_GETGROUP_ERROR);
@@ -1161,19 +1259,25 @@ irpd_getgrnam(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getgrgid(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implentation of the GETGRGID verb.
  */
 static void
 irpd_getgrgid(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct group *gr;
 	char groupid[64];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, gr, sess, IRPD_GETGROUP_ERROR);
@@ -1222,17 +1326,24 @@ irpd_getgrgid(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the GETGRENT verb.
  */
 static void
 irpd_getgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct group *gr;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, gr, sess, IRPD_GETGROUP_ERROR);
@@ -1245,16 +1356,23 @@ irpd_getgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_setgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		 const struct ctl_verb *verb, const char *rest,
- *		 u_int respflags, void *respctx, void *uctx);
+ *		 u_int respflags, const void *respctx, void *uctx);
  *	Implementation of the SETGRENT verb.
  */
 static void
 irpd_setgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, gr, sess, IRPD_GETGROUP_ERROR);
@@ -1290,7 +1408,7 @@ send_servent(struct ctl_sess *sess, struct servent *serv) {
 static void
 irpd_getservbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		   const struct ctl_verb *verb, const char *rest,
-		   u_int respflags, void *respctx, void *uctx)
+		   u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct servent *serv;
@@ -1298,6 +1416,12 @@ irpd_getservbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	char protoname[10];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, sv, sess, IRPD_GETSERVICE_ERROR);
@@ -1335,13 +1459,13 @@ irpd_getservbyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getservbyport(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		      const struct ctl_verb *verb, const char *rest,
- *		      u_int respflags, void *respctx, void *uctx);
+ *		      u_int respflags, const void *respctx, void *uctx);
  *	Handle the GETSERVBYPORT verb.
  */
 static void
 irpd_getservbyport(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		   const struct ctl_verb *verb, const char *rest,
-		   u_int respflags, void *respctx, void *uctx)
+		   u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct servent *sv;
@@ -1349,6 +1473,12 @@ irpd_getservbyport(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	char protoname[10];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, sv, sess, IRPD_GETSERVICE_ERROR);
@@ -1405,17 +1535,24 @@ irpd_getservbyport(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getservent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		   const struct ctl_verb *verb, const char *rest,
- *		   u_int respflags, void *respctx, void *uctx);
+ *		   u_int respflags, const void *respctx, void *uctx);
  *	Handle the GETSERVENT verb.
  */
 static void
 irpd_getservent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	       const struct ctl_verb *verb, const char *rest,
-	       u_int respflags, void *respctx, void *uctx)
+	       u_int respflags, const void *respctx, void *uctx)
 {
 	struct servent *sv;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, sv, sess, IRPD_GETSERVICE_ERROR);
@@ -1428,16 +1565,23 @@ irpd_getservent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_setservent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		   const struct ctl_verb *verb, const char *rest,
- *		   u_int respflags, void *respctx, void *uctx);
+ *		   u_int respflags, const void *respctx, void *uctx);
  *	Handle the SETSERVENT verb.
  */
 static void
 irpd_setservent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	       const struct ctl_verb *verb, const char *rest,
-	       u_int respflags, void *respctx, void *uctx)
+	       u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, sv, sess, IRPD_GETSERVICE_ERROR);
@@ -1479,19 +1623,25 @@ send_prent(struct ctl_sess *sess, struct protoent *pr) {
  * static void
  * irpd_getprotobyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		       const struct ctl_verb *verb, const char *rest,
- *		       u_int respflags, void *respctx, void *uctx);
+ *		       u_int respflags, const void *respctx, void *uctx);
  *	Handle the GETPROTOBYNAME verb.
  */
 static void
 irpd_getprotobyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		    const struct ctl_verb *verb, const char *rest,
-		    u_int respflags, void *respctx, void *uctx)
+		    u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct protoent *pr;
 	char protoname[64];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pr, sess, IRPD_GETPROTO_ERROR);
@@ -1520,20 +1670,26 @@ irpd_getprotobyname(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getprotobynumber(struct ctl_sctx *ctx,
  *			 struct ctl_sess *sess, const struct ctl_verb *verb,
- *			 const char *rest, u_int respflags, void *respctx,
+ *			 const char *rest, u_int respflags, const void *respctx,
  *			 void *uctx);
  *	Handle the GETPROTOBYNUMBER verb.
  */
 static void
 irpd_getprotobynumber(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		      const struct ctl_verb *verb, const char *rest,
-		      u_int respflags, void *respctx, void *uctx)
+		      u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct protoent *pr;
 	char protonum[64];
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pr, sess, IRPD_GETPROTO_ERROR);
@@ -1582,17 +1738,24 @@ irpd_getprotobynumber(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_getprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		    const struct ctl_verb *verb, const char *rest,
- *		    u_int respflags, void *respctx, void *uctx);
+ *		    u_int respflags, const void *respctx, void *uctx);
  *	Handle the GETPROTOENT verb.
  */
 static void
 irpd_getprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		const struct ctl_verb *verb, const char *rest,
-		u_int respflags, void *respctx, void *uctx)
+		u_int respflags, const void *respctx, void *uctx)
 {
 	struct protoent *pr;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pr, sess, IRPD_GETPROTO_ERROR);
@@ -1605,16 +1768,23 @@ irpd_getprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_setprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		    const struct ctl_verb *verb, const char *rest,
- *		    u_int respflags, void *respctx, void *uctx);
+ *		    u_int respflags, const void *respctx, void *uctx);
  *	Handle the SETPROTOENT verb.
  */
 static void
 irpd_setprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		const struct ctl_verb *verb, const char *rest,
-		u_int respflags, void *respctx, void *uctx)
+		u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, pr, sess, IRPD_GETPROTO_ERROR);
@@ -1630,7 +1800,9 @@ irpd_setprotoent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *	user" response.
  */
 static void
-send_ngent(struct ctl_sess *sess, char *host, char *user, char *domain) {
+send_ngent(struct ctl_sess *sess, const char *host, const char *user,
+	   const char *domain)
+{
 	struct response_buff *b = newbuffer(0);
 
 	if (irp_marshall_ng(host, user, domain, &b->buff,
@@ -1651,16 +1823,22 @@ send_ngent(struct ctl_sess *sess, char *host, char *user, char *domain) {
  * static void
  * irpd_getnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		    const struct ctl_verb *verb, const char *rest,
- *		    u_int respflags, void *respctx, void *uctx);
+ *		    u_int respflags, const void *respctx, void *uctx);
  *	Handle the GETNETGRENT verb. 
  */
 static void
 irpd_getnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		 const struct ctl_verb *verb, const char *rest,
-		 u_int respflags, void *respctx, void *uctx)
+		 u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ng, sess, IRPD_GETNETGR_ERROR);
@@ -1669,7 +1847,7 @@ irpd_getnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		simple_response(sess, IRPD_GETNETGR_ERROR,
 				"GETNETGRENT");
 	} else {
-		char *host, *user, *domain;
+		const char *host, *user, *domain;
 		
 		if (getnetgrent_p(&host, &user, &domain, netdata) == 1) {
 			send_ngent(sess, host, user, domain);
@@ -1684,20 +1862,26 @@ irpd_getnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_innetgr(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		const struct ctl_verb *verb, const char *rest,
- *		u_int respflags, void *respctx, void *uctx);
+ *		u_int respflags, const void *respctx, void *uctx);
  *	Handle the INNETGR verb.
  */
 static void
 irpd_innetgr(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		 const struct ctl_verb *verb, const char *rest,
-		 u_int respflags, void *respctx, void *uctx)
+		 u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct net_data *netdata = get_net_data(sess);
-	char *host;
-	char *user;
-	char *domain;
+	const char *host;
+	const char *user;
+	const char *domain;
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ng, sess, IRPD_GETNETGR_ERROR);
@@ -1741,17 +1925,23 @@ irpd_innetgr(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_setnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		    const struct ctl_verb *verb, const char *rest,
- *		    u_int respflags, void *respctx, void *uctx);
+ *		    u_int respflags, const void *respctx, void *uctx);
  *	Handle the SETNETGRENT verb.
  */
 static void
 irpd_setnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		 const struct ctl_verb *verb, const char *rest,
-		 u_int respflags, void *respctx, void *uctx)
+		 u_int respflags, const void *respctx, void *uctx)
 {
 	struct arg_s *args;
 	struct net_data *netdata = get_net_data(sess);
 	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	INSIST(netdata != NULL);
 
 	ND_INIT(netdata, ng, sess, IRPD_GETNETGR_ERROR);
@@ -1773,15 +1963,21 @@ irpd_setnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_endnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *		    const struct ctl_verb *verb, const char *rest,
- *		    u_int respflags, void *respctx, void *uctx);
+ *		    u_int respflags, const void *respctx, void *uctx);
  *	Handle the ENDNETGRENT verb.
  */
 static void
 irpd_endnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
 		 const struct ctl_verb *verb, const char *rest,
-		 u_int respflags, void *respctx, void *uctx)
+		 u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
+
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
 	
 	INSIST(netdata != NULL);
 
@@ -1801,14 +1997,21 @@ irpd_endnetgrent(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_quit(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *	     const struct ctl_verb *verb, const char *rest,
- *	     u_int respflags, void *respctx, void *uctx);
+ *	     u_int respflags, const void *respctx, void *uctx);
  *	Handle the QUIT verb.
  */
 static void
 irpd_quit(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	ctl_response(sess, irpd_quit_ok, "See ya!", CTL_EXIT, NULL,
 		     0 , NULL, NULL, 0);
 }
@@ -1817,17 +2020,24 @@ irpd_quit(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_help(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *	     const struct ctl_verb *verb, const char *rest,
- *	     u_int respflags, void *respctx, void *uctx);
+ *	     u_int respflags, const void *respctx, void *uctx);
  *	Handle the HELP verb.
  */
 static void
 irpd_help(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
 	/* XXX	should make this do something better (like include required
 	 *	arguments.
 	 */
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	ctl_sendhelp(sess, 231);
 }
 
@@ -1835,27 +2045,33 @@ irpd_help(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_accept(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *	       const struct ctl_verb *verb, const char *rest,
- *	       u_int respflags, void *respctx, void *uctx);
+ *	       u_int respflags, const void *respctx, void *uctx);
  *	Handle a new connection.
  */
 static void
 irpd_accept(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
-	struct sockaddr *sa = respctx;
+	const struct sockaddr *sa = respctx;
 	char raddr[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
 	int reject = 1;
 	int response;
-	char *respmsg = NULL;
+	const char *respmsg = NULL;
+	
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(uctx);
 
 	if (sa->sa_family == AF_UNIX) {
 		syslog (LOG_INFO, "New AF_UNIX connection");
 		reject = 0;
 	} else if (sa->sa_family == AF_INET) {
-		struct sockaddr_in *sin = respctx;
-		static long localhost;
-		static long zero;
+		const struct sockaddr_in *sin = respctx;
+		static unsigned long localhost;
+		static unsigned long zero;
 
 		if (localhost == 0) {
 			/* yes, this could be done with simple arithmetic... */
@@ -1915,15 +2131,22 @@ irpd_accept(struct ctl_sctx *ctx, struct ctl_sess *sess,
  * static void
  * irpd_abort(struct ctl_sctx *ctx, struct ctl_sess *sess,
  *	      const struct ctl_verb *verb, const char *rest,
- *	      u_int respflags, void *respctx, void *uctx);
+ *	      u_int respflags, const void *respctx, void *uctx);
  *	Handle a dropped connection.
  */
 static void
 irpd_abort(struct ctl_sctx *ctx, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
 	struct net_data *netdata = get_net_data(sess);
+
+	UNUSED(ctx);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
 	
 	if (netdata != NULL)
 		net_data_destroy(netdata);
@@ -1937,6 +2160,8 @@ irpd_abort(struct ctl_sctx *ctx, struct ctl_sess *sess,
  */
 static void
 response_done(struct ctl_sctx *ctx, struct ctl_sess *sess, void *uap) {
+	UNUSED(ctx);
+	UNUSED(sess);
 	release_buffer(uap);
 }
 
@@ -1971,8 +2196,9 @@ logger(enum ctl_severity sev, const char *fmt, ...) {
 	fprintf(stderr, "irpd: ");
 	vfprintf(stderr, fmt, ap);
 #else
-	if (vsprintf(buffer, fmt, ap) > (sizeof (buffer) - 1)) {
+	if (vsprintf(buffer, fmt, ap) > (int)(sizeof (buffer) - 1)) {
 		syslog(LOG_CRIT, "Buffer overrun in logger");
+		va_end(ap);
 		abort();
 	}
 	syslog(level, "%s", buffer);
@@ -2080,7 +2306,7 @@ split_string(const char *string) {
 		if (*p == '\0')
 			break;
 
-		iovs[c].iov_base = (void *)p;
+		DE_CONST(p, iovs[c].iov_base);
 
 		while (*p && !isspace(*p)) {
 			p++;
diff --git a/contrib/bind/bin/mkservdb/mkservdb.c b/contrib/bind/bin/mkservdb/mkservdb.c
index b3b758c..a0a5933 100644
--- a/contrib/bind/bin/mkservdb/mkservdb.c
+++ b/contrib/bind/bin/mkservdb/mkservdb.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: mkservdb.c,v 1.9 2001/01/26 06:54:11 vixie Exp $";
+static const char rcsid[] = "$Id: mkservdb.c,v 1.10 2001/06/18 14:42:46 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -69,9 +69,9 @@ main(int argc, char **argv) {
 	DB *db;
 	DBT key;
 	DBT data;
-	char *filename = _PATH_SERVICES;
-	char *tmpdatabase = _PATH_SERVICES_DB_TMP;
-	char *database = _PATH_SERVICES_DB;
+	const char *filename = _PATH_SERVICES;
+	const char *tmpdatabase = _PATH_SERVICES_DB_TMP;
+	const char *database = _PATH_SERVICES_DB;
 	char dbuf[1024];
 	char kbuf[512];
 	u_short *ports;
@@ -152,7 +152,7 @@ main(int argc, char **argv) {
 		if (sv->s_aliases != NULL)
 			for (n = 0; sv->s_aliases[n] != NULL; n++)
 				if ((p + strlen(sv->s_aliases[n]) + 1) - dbuf
-				    <= sizeof dbuf) {
+				    <= (int)sizeof dbuf) {
 					strcpy(p, sv->s_aliases[n]);
 					p += strlen(p) + 1;
 				}
diff --git a/contrib/bind/bin/named-bootconf/named-bootconf.sh b/contrib/bind/bin/named-bootconf/named-bootconf.sh
index 3952b14..0a6e327 100644
--- a/contrib/bind/bin/named-bootconf/named-bootconf.sh
+++ b/contrib/bind/bin/named-bootconf/named-bootconf.sh
@@ -143,6 +143,11 @@ while read CMD ARGS; do
 			no-recursion )
 				echo "	recursion no;" >>$OPTIONFILE
 				;;
+			no-round-robin ) # HP extention
+				echo "	rrset-order {" >>$OPTIONFILE
+				echo "		class ANY type ANY name \"*\" order fixed;" >>$OPTIONFILE
+				echo "	};" >>$OPTIONFILE
+				;;
 			esac
 		done
 		rm -f $COMMENTFILE
diff --git a/contrib/bind/bin/named-bootconf/test.boot b/contrib/bind/bin/named-bootconf/test.boot
new file mode 100644
index 0000000..2b001e4
--- /dev/null
+++ b/contrib/bind/bin/named-bootconf/test.boot
@@ -0,0 +1,30 @@
+directory /var/named
+forwarders 1.2.3.4 1.2.3.5
+limit datasize 10000000
+limit files 1000
+limit transfers-in 100
+limit transfers-per-ns 20
+; no-round-robin in HP specific
+options no-round-robin fake-iquery forward-only no-fetch-glue no-recursion
+slave
+tcplist 10.0.0.1
+xfrnets 10.0.0.2
+cache .	rootservers
+primary example.net example.net.db
+secondary example.com 127.0.0.1 example.com.db
+stub example.org 127.0.0.1 example.org.db
+primary/IN example.net example.net.db
+secondary/IN example.com 127.0.0.1 example.com.db
+stub/IN example.org 127.0.0.1 example.org.db
+secondary/IN example.com 127.0.0.1
+stub/IN example.org 127.0.0.1
+primary/CHAOS example.net example.net.db
+secondary/CHAOS example.com 127.0.0.1 example.com.db
+stub/CHAOS example.org 127.0.0.1 example.org.db
+secondary/CHAOS example.com 127.0.0.1
+stub/CHAOS example.org 127.0.0.1
+primary/HS example.net example.net.db
+secondary/HS example.com 127.0.0.1 example.com.db
+stub/HS example.org 127.0.0.1 example.org.db
+secondary/HS example.com 127.0.0.1
+stub/HS example.org 127.0.0.1
diff --git a/contrib/bind/bin/named-xfer/named-xfer.c b/contrib/bind/bin/named-xfer/named-xfer.c
index 1a08f7b..b18b163 100644
--- a/contrib/bind/bin/named-xfer/named-xfer.c
+++ b/contrib/bind/bin/named-xfer/named-xfer.c
@@ -130,7 +130,7 @@ char copyright[] =
 
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)named-xfer.c	4.18 (Berkeley) 3/7/91";
-static const char rcsid[] = "$Id: named-xfer.c,v 8.105.2.1 2001/04/26 02:56:09 marka Exp $";
+static const char rcsid[] = "$Id: named-xfer.c,v 8.120 2002/01/29 06:54:52 marka Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -215,7 +215,7 @@ static	int		getzone(struct zoneinfo *, u_int32_t, int),
 			writemsg(int, const u_char *, int);
 static int		ixfr_log(const u_char *msg, int len, int *delete,
 				 FILE *file, struct sockaddr_in *sin,
-				 char *domain, u_int32_t *serial_no, int *);
+				 u_int32_t *serial_no, int *);
 static	SIG_FN		read_alarm(void);
 static	SIG_FN		term_handler(void);
 static	const char	*soa_zinfo(struct zoneinfo *, u_char *, u_char*),
@@ -288,7 +288,8 @@ init_xfer_logging() {
 	return (1);
 }
 
-void cleanup_for_exit(void) {
+static void
+cleanup_for_exit(void) {
 #ifdef DEBUG
 	if (!debug)
 #endif
@@ -322,7 +323,7 @@ main(int argc, char *argv[]) {
 	struct in_addr axfr_src;
  	char *dbfile = NULL, *tracefile = NULL, *tm = NULL, *tsigfile = NULL;
  	char *ixfrfile = NULL;
-	int dbfd, ddtd, result, c, ixfd;
+	int dbfd, ddtd, result, c, ixfd = -1;
 	u_int32_t serial_no = 0;
 	u_int port = htons(NAMESERVER_PORT);
 	struct stat statbuf;
@@ -495,12 +496,16 @@ main(int argc, char *argv[]) {
 		if (!quiet)
 			syslog(LOG_ERR, "can't [f]chmod tmpfile (%s): %s\n",
 			       tmpname, strerror(errno));
+		close(dbfd);
+		unlink(tmpname);
 		exit(XFER_FAIL);
 	}
 	if ((dbfp = fdopen(dbfd, "r+")) == NULL) {
 		perror(tmpname);
 		if (!quiet)
 			syslog(LOG_ERR, "can't fdopen tmpfile (%s)", tmpname);
+		close(dbfd);
+		unlink(tmpname);
 		exit(XFER_FAIL);
 	}
 	if (ixfrfile) {
@@ -547,9 +552,13 @@ main(int argc, char *argv[]) {
 #endif
 		{
 			perror(ddtfile);
+			close(ddtd);
+			unlink(ddtfile);
 			debug = 0;
 		} else if ((ddt = fdopen(ddtd, "w")) == NULL) {
 			perror(ddtfile);
+			close(ddtd);
+			unlink(ddtfile);
 			debug = 0;
 		} else
 			setvbuf(ddt, NULL, _IOLBF, 0);
@@ -751,7 +760,7 @@ main(int argc, char *argv[]) {
 	return (0);		/* Make gcc happy. */
 }
  
-static char *UsageText[] = {
+static const char *UsageText[] = {
 	"\t-z zone_to_transfer\n",
 	"\t-f db_file\n",
 	"\t[-i ixfr_file]\n",
@@ -770,11 +779,11 @@ static char *UsageText[] = {
 
 static void
 usage(const char *msg) {
-	char * const *line;
+	const char **line;
 
 	fprintf(stderr, "Usage error: %s\n", msg);
 	fprintf(stderr, "Usage: %s\n", ProgName);
-	for (line = UsageText;  *line;  line++)
+	for (line = UsageText; *line; line++)
 		fputs(*line, stderr);
 	exit(XFER_FAIL);
 }
@@ -853,6 +862,179 @@ char	prev_origin[MAXDNAME];	/* from most recent $ORIGIN line */
 char	prev_dname[MAXDNAME] = { DEF_DNAME }; /* from previous record */
 char	prev_ns_dname[MAXDNAME] = { DEF_DNAME }; /* from most recent NS record */
 
+/*
+ * TSIG state
+ */
+static int tsig_signed;
+static ns_tcp_tsig_state tsig_state;
+
+static int
+make_query(int fd, struct zoneinfo *zp, int type, u_int32_t serial_no,
+	   DST_KEY *tsig_key, u_char *buf, u_int bufsize)
+{
+	HEADER *hp;
+	u_char *cp;
+	int n, ret;
+	time_t timesigned = 0;
+
+	n = res_nmkquery(&res, QUERY, zp->z_origin, curclass,
+			 type, NULL, 0, NULL, buf, bufsize);
+	if (n < 0) {
+		if (!quiet)
+			syslog(LOG_INFO, "zone %s: res_nmkquery %s failed",
+			       p_type(query_type), zp->z_origin);
+		return (n);
+	}
+
+	if (type == T_IXFR) {
+		hp = (HEADER *) buf;
+		cp = buf;
+		dprintf(1, "len = %d\n", n);
+		hp->nscount = htons(1+ntohs(hp->nscount));
+		cp += n;
+		n = dn_comp(zp->z_origin, cp, bufsize - (cp - buf), NULL, NULL);
+		if (n < 0)
+			return (n);
+		cp += n;
+		if (cp + 3 * INT16SZ + 6 * INT32SZ + 2 > buf + bufsize)
+			return (-1);
+		PUTSHORT(T_SOA, cp); /* type */
+		PUTSHORT(C_IN, cp);  /* class */
+		PUTLONG(0, cp);      /* ttl */
+		PUTSHORT(22, cp);    /* dlen */
+		*cp++ = 0;           /* mname */
+		*cp++ = 0;           /* rname */
+		PUTLONG(serial_no, cp);
+		PUTLONG(0xDEAD, cp); /* Refresh */
+		PUTLONG(0xBEEF, cp); /* Retry */
+		PUTLONG(0xABCD, cp); /* Expire */
+		PUTLONG(0x1776, cp); /* Min TTL */
+		n = cp - buf;
+		dprintf(1, "len = %d\n", cp-buf);
+	}
+
+	tsig_signed = 0;
+	if (tsig_key != NULL) {
+		int siglen;
+		u_char sig[64];
+
+		siglen = sizeof(sig);
+		ret = ns_sign(buf, &n, bufsize, NOERROR, tsig_key,
+			      NULL, 0, sig, &siglen, timesigned);
+		if (ret == 0) {
+			tsig_signed = 1;
+			ns_verify_tcp_init(tsig_key, sig, siglen, &tsig_state);
+		} 
+	}
+
+	if (debug)
+		res_pquery(&res, buf, n, ddt);
+
+	if (writemsg(fd, buf, n) < 0) {
+		syslog(LOG_INFO, "writemsg: %m");
+		return (-1);
+	}
+
+	return (n);
+}
+
+static u_int
+readandverify(int fd, u_char **bufp, u_int *bufsizep,
+	      struct sockaddr_in *sin, char *z_origin, int sig_req)
+{
+	u_char *buf = *bufp;
+	u_char *newbuf;
+	u_int bufsize = *bufsizep;
+	u_int len;
+	
+	if (netread(fd, (char *)buf, INT16SZ, XFER_TIMER) < 0)
+		return (0);
+
+	if ((len = ns_get16(buf)) == 0)
+		return (0);
+
+	if (len > bufsize) {
+		newbuf = realloc(buf, len);
+		if (newbuf == NULL) {
+			syslog(LOG_INFO, "realloc(%u) failed\n", len);
+			return (0);
+		}
+		*bufp = buf = newbuf;
+		*bufsizep = bufsize = len;
+	}
+
+	if (netread(fd, (char *)buf, len, XFER_TIMER) < 0) 
+		return (0);
+
+#ifdef DEBUG
+	if (debug >= 3) {
+		(void)fprintf(ddt,"len = %d\n", len);
+		res_pquery(&res, buf, len, ddt);
+	}
+	if (fp)
+		res_pquery(&res, buf, len, fp);
+#endif
+
+	if (tsig_signed) {
+		int ret;
+
+		ret = ns_verify_tcp(buf, (int *)&len, &tsig_state, sig_req);
+		if (ret != 0) {
+			syslog(LOG_NOTICE, "%s [%s] %s %s: %s (%d)\n",
+	                       "TSIG verification from server",
+			       inet_ntoa(sin->sin_addr), "zone", z_origin,
+			       tsig_rcode(ret), ret);
+			return (0);
+		}
+	}
+
+	return (len);
+}
+
+static void
+print_comment(int s, struct sockaddr_in *sin, int check_serial,
+	      u_int32_t serial_no, DST_KEY *tsig_key)
+{
+	struct sockaddr_in local;
+	ISC_SOCKLEN_T locallen;
+	const char *l, *nl;
+
+	gettime(&tt);
+	locallen = sizeof local;
+	if (getsockname(s, (struct sockaddr *)&local, &locallen) < 0)
+		memset(&local, 0, sizeof local);
+
+	for (l = Version; l; l = nl) {
+		size_t len;
+		if ((nl = strchr(l, '\n')) != NULL) {
+			len = nl - l;
+			nl = nl + 1;
+		} else {
+			len = strlen(l);
+			nl = NULL;
+		}
+		while (isspace((unsigned char) *l))
+			l++;
+		if (*l)
+			fprintf(dbfp, "; BIND version %.*s\n", (int)len, l);
+	}
+
+	fprintf(dbfp, check_serial ?
+		"; zone '%s'   last serial %u\n" :
+		"; zone '%s'   first transfer\n",
+		domain, serial_no);
+	fprintf(dbfp, "; from %s:%d",
+	        inet_ntoa(sin->sin_addr), ntohs(sin->sin_port));
+	fprintf(dbfp, " (local %s) using %s at %s",
+		inet_ntoa(local.sin_addr), (methode == ISIXFR) ? "IXFR":"AXFR", 
+		ctimel(tt.tv_sec));
+	if (tsig_signed != 0)
+		fprintf(dbfp, "; TSIG verified: key %s.\n",
+			tsig_key->dk_key_name);
+	else
+		fprintf(dbfp, "; NOT TSIG verified\n");
+}
+
 static int
 getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 	HEADER *hp;
@@ -861,34 +1043,30 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 	int was_ixfr = 0;
 	u_int cnt;
  	u_char *cp, *nmp, *eom, *tmp ;
-	u_char *buf = NULL, *cpp = NULL;
+	u_char *buf = NULL;
 	u_char *bp;
 	u_int bufsize = 0;
 	u_char *buf2 = NULL;
 	u_int buf2size = 0;
 	char name2[MAXDNAME];
 	struct sockaddr_in sin;
-	struct sockaddr_in local;
-	int locallen;
 #ifdef POSIX_SIGNALS
 	struct sigaction sv, osv;
 #else
 	struct sigvec sv, osv;
 #endif
-	int qdcount, ancount, aucount, arcount, class, type;
+	int qdcount, ancount, aucount, arcount, class = 0, type = 0;
 	const char *badsoa_msg = "Nil";
 	struct sockaddr_in my_addr;
 	char my_addr_text[30];
-	int alen, ret, tsig_req;
+	ISC_SOCKLEN_T alen;
+	int tsig_req;
 	DST_KEY *tsig_key;
-	ns_tcp_tsig_state tsig_state;
-	int tsig_signed = 0;
-	u_char sig[64];
-	int siglen;
 	int ixfr_first = 1;
 	int loop_cnt = 0;
-	time_t timesigned;
 	u_int32_t query_serial = serial_no;
+	int first_soa_printed;
+	struct in_addr z_axfr_src;
 
 #ifdef DEBUG
 	if (debug) {
@@ -932,14 +1110,15 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 	if ((l = strlen(zone_top)) != 0 && zone_top[l - 1] == '.')
 		zone_top[l - 1] = '\0';
 	strcpy(prev_origin, zone_top);
+
 	for (cnt = 0; cnt < zp->z_addrcnt; cnt++) {
 		methode = servermethode[cnt];
 		sin.sin_addr = zp->z_addr[cnt];
 		dprintf(3, "address [%s] %s\n",
 			inet_ntoa(sin.sin_addr),
 			(methode == ISIXFR) ? "IXFR":"AXFR");
-
 	}
+
 	for (cnt = 0; cnt < zp->z_addrcnt; cnt++) {
 		methode = ISNOTIXFR;
 		curclass = zp->z_class;
@@ -950,6 +1129,8 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 		if (check_serial && tmpiname != NULL)
 			methode = servermethode[cnt];
 		error = 0;
+		tsig_signed = 0;
+		z_axfr_src = zp->z_axfr_src;
 		if (buf == NULL) {
 			if ((buf = (u_char *)malloc(2 * PACKETSZ)) == NULL) {
 				syslog(LOG_INFO, "malloc(%u) failed",
@@ -959,17 +1140,20 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 			}
 			bufsize = 2 * PACKETSZ;
 		}
+		tsig_key = tsig_key_from_addr(sin.sin_addr);
+
  try_again:
+		first_soa_printed = 0;
 		if ((s = socket(AF_INET, SOCK_STREAM, PF_UNSPEC)) < 0) {
 			syslog(LOG_INFO, "socket: %m");
 			error++;
 			break;
 		}	
-		if (zp->z_axfr_src.s_addr != 0) {
+		if (z_axfr_src.s_addr != 0) {
 			memset(&sin, 0, sizeof sin);
 			sin.sin_family = AF_INET;
 			sin.sin_port = 0;		/* "ANY" */
-			sin.sin_addr = zp->z_axfr_src;
+			sin.sin_addr = z_axfr_src;
 			dprintf(2, "binding to address [%s]\n",
 				inet_ntoa(sin.sin_addr));
 			if (bind(s, (struct sockaddr *)&sin, sizeof sin) < 0)
@@ -981,166 +1165,60 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 		sin.sin_port = port;
 		sin.sin_addr = zp->z_addr[cnt];
 		dprintf(2, "connecting to server #%d [%s].%d\n",
-			cnt+1, inet_ntoa(sin.sin_addr), ntohs(sin.sin_port));
+			cnt + 1, inet_ntoa(sin.sin_addr), ntohs(sin.sin_port));
 		if (connect(s, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
-			if (zp->z_axfr_src.s_addr != 0) {
+			if (z_axfr_src.s_addr != 0) {
 				dprintf(2, "connect failed, trying w/o -x");
-				zp->z_axfr_src.s_addr = 0;
+				z_axfr_src.s_addr = 0;
 				(void) my_close(s);
 				goto try_again;
 			}
 			if (!quiet)
 				syslog(LOG_INFO,
 				       "connect(%s) for zone %s failed: %s",
-				       inet_ntoa(sin.sin_addr), zp->z_origin, strerror(errno));
+				       inet_ntoa(sin.sin_addr), zp->z_origin,
+				       strerror(errno));
 			error++;
 			(void) my_close(s);
 			continue;
 		}	
-		if (methode == ISIXFR && was_ixfr == 0) {
-			hp = (HEADER *) buf;
-			cpp = buf;
-			n = res_nmkquery(&res, QUERY, zp->z_origin, curclass,
-				 T_IXFR, NULL, 0, NULL, buf, bufsize);
-			dprintf(1, "len = %d\n", n);
-			if (n < 0) {
-				if (!quiet)
-					syslog(LOG_INFO,
-					    "zone %s: dn_comp for ixfr failed",
-						zp->z_origin);
-					(void) my_close(s);
-#ifdef POSIX_SIGNALS
-					sigaction(SIGALRM,
-						  &osv,
-						 (struct sigaction*)0);
-#else
-					sigvec(SIGALRM,
-						       &osv,
-						   (struct sigvec *)0);
-#endif
-					return (XFER_FAIL);
-			}
-			hp->nscount = htons(1+ntohs(hp->nscount));
-			cpp += n;
-			n = dn_comp(zp->z_origin, cpp, bufsize-(cpp-buf),
-				    NULL, NULL);
-			if (n > 0)
-				cpp += n;
-			PUTSHORT(T_SOA, cpp); /* type */
-			PUTSHORT(C_IN, cpp);  /* class */
-			PUTLONG(0, cpp);      /* ttl */
-			PUTSHORT(22, cpp);    /* dlen */
-			*cpp++ = 0;           /* mname */
-			*cpp++ = 0;           /* rname */
-			PUTLONG(serial_no, cpp);
-			PUTLONG(0xDEAD, cpp); /* Refresh */
-			PUTLONG(0xBEEF, cpp); /* Retry */
-			PUTLONG(0xABCD, cpp); /* Expire */
-			PUTLONG(0x1776, cpp); /* Min TTL */
-			n = cpp-buf;
-			dprintf(1, "len = %d\n", cpp-buf);
-			if (debug)
-				res_pquery(&res, buf, n, ddt);
-		}
-		else {
-		n = res_nmkquery(&res, QUERY, zp->z_origin, curclass,
-				 T_SOA, NULL, 0, NULL, buf, bufsize);
+
+		query_type = (methode == ISIXFR && was_ixfr == 0) ?
+			      T_IXFR : T_SOA;
+
+		n = make_query(s, zp, query_type, serial_no, tsig_key,
+			       buf, bufsize);
+
 		if (n < 0) {
-			if (!quiet)
-				syslog(LOG_INFO,
-				       "zone %s: res_nmkquery T_SOA failed",
-				       zp->z_origin);
 			(void) my_close(s);
 #ifdef POSIX_SIGNALS
-			(void) sigaction(SIGALRM, &osv, (struct sigaction *)0);
+			(void) sigaction(SIGALRM, &osv,
+					 (struct sigaction *)0);
 #else
-			(void) sigvec(SIGALRM, &osv, (struct sigvec *)0);
+			(void) sigvec(SIGALRM, &osv,
+				      (struct sigvec *)0);
 #endif
 			return (XFER_FAIL);
 		}
-		}
-		/*
-		 * Append TSIG to SOA query if desired
-		 */
-		tsig_key = tsig_key_from_addr(sin.sin_addr);
-		if (tsig_key != NULL) {
-			siglen = sizeof(sig);
-			ret = ns_sign(buf, &n, bufsize, NOERROR, tsig_key,
-				      NULL, 0, sig, &siglen, timesigned);
-			if (ret == 0)
-				tsig_signed = 1;
-		}
 
 		/*
-		 * Send length & message for SOA query
+		 * Get out your butterfly net and catch the answer.
 		 */
-		if (writemsg(s, buf, n) < 0) {
-			syslog(LOG_INFO, "writemsg: %m");
-			error++;
-			(void) my_close(s);
-			continue;	
-		}
-		/*
-		 * Get out your butterfly net and catch the SOA
-		 */
-		
-		if (netread(s, (char *)buf, INT16SZ, 
-			(soa_cnt == 0) ?400 :XFER_TIMER) < 0) {
-			(void) my_close(s);
-			error++;
-			continue;
-		}
-		if ((len = ns_get16(buf)) == 0) {
-			(void) my_close(s);
-			continue;
-		}
-		if (len > bufsize) {
-			if ((buf = (u_char *)realloc(buf, len)) == NULL) {
-				syslog(LOG_INFO,
-		       "malloc(%u) failed for SOA from server [%s], zone %s\n",
-				       len,
-				       inet_ntoa(sin.sin_addr),
-				       zp->z_origin);
-				(void) my_close(s);
-				continue;
-			}
-			bufsize = len;
-		}
-		if (netread(s, (char *)buf, len, XFER_TIMER) < 0) {
+		len = readandverify(s, &buf, &bufsize, &sin, zp->z_origin, 1);
+		if (len == 0) {
+			my_close(s);
 			error++;
-			(void) my_close(s);
 			continue;
 		}
-		/*
-		 * Verify the TSIG if expected
-		 */
-		if (tsig_signed != 0) {
-			ret = ns_verify(buf, (int *)&len, tsig_key, sig, siglen,
-					NULL, NULL, &timesigned, 0);
-			if (ret != 0) {
-				syslog(LOG_NOTICE,
-		"SOA TSIG verification from server [%s], zone %s: %s (%d)\n",
-				       inet_ntoa(sin.sin_addr), zp->z_origin,
-				       tsig_rcode(ret), ret);
-				error++;
-				continue;
-			}
-		}
-		
-#ifdef DEBUG
-		if (debug >= 3) {
-			(void)fprintf(ddt,"len = %d\n", len);
-			res_pquery(&res, buf, len, ddt);
-		}
-#endif
-		if (((methode == ISIXFR) && (ixfp == NULL)) && was_ixfr == 0) {
+
+		if (query_type == T_IXFR && ixfp == NULL) {
 			delete_soa = 1;	
 			ixfr_soa = 0;
 			if ((ixfp = fopen(tmpiname, "w+")) == NULL) {
 				perror(tmpiname);
 				if (!quiet)
 					syslog(LOG_ERR,
-					       "can't fdopen ixfr log (%s)",
+					       "can't fopen ixfr log (%s)",
 					       tmpname);
 				exit(XFER_FAIL);
 			}
@@ -1158,16 +1236,18 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 		 *  3) not an answer to our question
 		 *  4) both the number of answers and authority count < 1)
 		 */
-		if (hp->rcode != NOERROR || !hp->aa || qdcount != 1 ||
+		if (hp->rcode != NOERROR ||
+		    (query_type == T_SOA && (!hp->aa || qdcount != 1)) ||
 		    (ancount < 1 && aucount < 1)) {
 #ifndef SYSLOG_42BSD
 			syslog(LOG_NOTICE,
-       "[%s] %s for %s, SOA query got rcode %d, aa %d, ancount %d, aucount %d",
+       "[%s] %s for %s, %s query got rcode %d, aa %d, ancount %d, aucount %d",
 			       inet_ntoa(sin.sin_addr),
 			       (hp->aa
 				? (qdcount==1 ?"no SOA found" :"bad response")
 				: "not authoritative"),
 			       zp->z_origin[0] != '\0' ? zp->z_origin : ".",
+			       p_type(query_type),
 			       hp->rcode, hp->aa, ancount, aucount);
 #endif
 			error++;
@@ -1179,9 +1259,9 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 			badsoa_msg = "too short";
  badsoa:
 			syslog(LOG_INFO,
-			       "malformed SOA from [%s], zone %s: %s",
-			       inet_ntoa(sin.sin_addr), zp->z_origin,
-			       badsoa_msg);
+			       "malformed %s from [%s], zone %s: %s",
+			       p_type(query_type), inet_ntoa(sin.sin_addr),
+			       zp->z_origin, badsoa_msg);
 			error++;
 			(void) my_close(s);
 			continue;
@@ -1211,7 +1291,7 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 		NS_GET16(type, tmp);
 		NS_GET16(class, tmp);
 		if (class != curclass || 
-			((type != T_SOA) && (type != T_IXFR) && (type != T_AXFR)) ||
+		    ((type != T_SOA) && (type != T_IXFR) && (type != T_AXFR)) ||
 		    ns_samename(zp->z_origin, name2) != 1) 
 		{
 			syslog(LOG_INFO,
@@ -1233,6 +1313,7 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 			u_char *cp4, *ocp = tmp;
 			u_short type, class, dlen, olen = len;
 			u_int32_t ttl;
+
 			n = dn_expand(buf, eom, tmp, name2, sizeof name2);
 			if (n < 0) {
 				badsoa_msg = "aname error";
@@ -1258,39 +1339,41 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 				goto badsoa;
 			}
 			if (type == T_SOA) {
-			  if (was_ixfr)  {
-				methode = ISNOTIXFR;
-				break;
-			  }
-			  if ((methode == ISIXFR) && (loop_cnt == 0)) {
-			  	soa_cnt++;
-				badsoa_msg = soa_zinfo(&zp_finish, tmp, eom);
-				if (badsoa_msg)
-					goto badsoa;
-				if (ixfp)
-					  if (ixfr_log(buf, len, &delete_soa, ixfp,
-						 &sin, domain, &serial_no,
-						 &ixfr_first) < 0) {
-						 error++;
-						 break;
-					  }
-			  } else { 
-				if (methode == ISIXFR) {
-					check_serial = 0;
-			 		soa_cnt++;
+				if (was_ixfr)  {
+					methode = ISNOTIXFR;
+					break;
+				}
+				if ((methode == ISIXFR) && (loop_cnt == 0)) {
+					soa_cnt++;
+					badsoa_msg = soa_zinfo(&zp_finish, tmp,
+							       eom);
+					if (badsoa_msg)
+						goto badsoa;
+					if (ixfp && ixfr_log(buf, len,
+							     &delete_soa,
+							     ixfp, &sin,
+							     &serial_no,
+							     &ixfr_first) < 0) {
+						error++;
+						break;
+					}
+				} else { 
+					if (methode == ISIXFR) {
+						check_serial = 0;
+						soa_cnt++;
+						break;
+					}
 					break;
 				}
-				break;
-			   }
 			}
 			if ((loop_cnt >= 1) && (soa_cnt < 2)) {
-					dprintf(1,
+				dprintf(1,
 				      	"server %s %d rejected IXFR and responded with AXFR\n",
-					       inet_ntoa(sin.sin_addr), soa_cnt);
-					methode = ISNOTIXFR;
-					check_serial = 0;
-					was_ixfr++;
-					tmp = bp;
+					inet_ntoa(sin.sin_addr), soa_cnt);
+				methode = ISNOTIXFR;
+				check_serial = 0;
+				was_ixfr++;
+				tmp = bp;
 				break;
 			}
 			/* Skip to next record, if any.  */
@@ -1298,153 +1381,129 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 				name2, p_type(type));
 			tmp = cp4 + dlen;
 			loop_cnt++;
-            if (ancount == 1 && loop_cnt == 1)
-            {
+			if (loop_cnt == 1) {
           
-		        badsoa_msg = soa_zinfo(&zp_start, bp, eom);
-		        if (badsoa_msg)
-			            goto badsoa;
-		        if (zp_start.z_serial == serial_no) {
-			        (void) my_close(s);
-			        dprintf(1, "zone up-to-date, serial %u\n", 
-							zp_start.z_serial);
-			        if (ixfp) {
-			        	(void) unlink (tmpiname);
-			        	(void) fclose(ixfp);
-			        	ixfp = NULL;
-			        }
-			        return (XFER_UPTODATE);
-			    }
-		        if (buf2 == NULL) {
-			        if ((buf2 = (u_char *)malloc(2 * PACKETSZ)) == NULL) {
-				        syslog(LOG_INFO, "malloc(%u) failed", 2 * PACKETSZ);
-				        error++;
-				        break;
-			        }
-			        buf2size = 2 * PACKETSZ;
-		        }
-          		if (netread(s, (char *)buf2, INT16SZ, XFER_TIMER) < 0) {
-          			(void) my_close(s);
-          			error++;
-				    tmp = bp;
-				    check_serial = 0;
-				    break;
-          		}
-          		if ((len = ns_get16(buf2)) == 0) {
-          			(void) my_close(s);
-				    tmp = bp;
-				    check_serial = 0;
-				    break;
-          		}
-          		if (len > buf2size) {
-          			if ((buf2 = (u_char *)realloc(buf2, len)) == NULL) {
-          				syslog(LOG_INFO,
-          		       "malloc(%u) failed for SOA from server [%s], zone %s\n",
-          				       len,
-          				       inet_ntoa(sin.sin_addr),
-          				       zp->z_origin);
-          				(void) my_close(s);
-				        tmp = bp;
-				        check_serial = 0;
-				        break;
-          			}
-          			buf2size = len;
-          		}
-          		if (netread(s, (char *)buf2, len, XFER_TIMER) < 0) {
-          			error++;
-          			(void) my_close(s);
-				    tmp = bp;
-				    check_serial = 0;
-				    break;
-          		}
-		        /*
-		         * Verify the TSIG if expected
-		         */
-		        if (tsig_signed != 0) {
-			        ret = ns_verify(buf, (int *)&len, tsig_key, sig, siglen,
-				        	NULL, NULL, &timesigned, 0);
-			        if (ret != 0) {
-				        syslog(LOG_NOTICE,
-		        "SOA TSIG verification from server [%s], zone %s: %s (%d)\n",
-			        	       inet_ntoa(sin.sin_addr), zp->z_origin,
-				               tsig_rcode(ret), ret);
-				        error++;
-          			    (void) my_close(s);
-				        tmp = bp;
-				        check_serial = 0;
-				        break;
-			        }
-		        }
-#ifdef DEBUG
-          		if (debug >= 3) {
-				(void)fprintf(ddt,"len = %d\n", len);
-				res_pquery(&res, buf2, len, ddt);
+				badsoa_msg = soa_zinfo(&zp_start, bp, eom);
+				if (badsoa_msg)
+					goto badsoa;
+				if (check_serial &&
+				    !SEQ_GT(zp_start.z_serial, query_serial)) {
+					(void) my_close(s);
+					dprintf(1,
+						"zone up-to-date, serial %u\n", 
+						zp_start.z_serial);
+					if (ixfp) {
+						(void) fclose(ixfp);
+						(void) unlink (tmpiname);
+						ixfp = NULL;
+					}
+					return (XFER_UPTODATE);
+				}
 			}
-#endif
-		        hp = (HEADER *) buf2;
-		        qdcount = ntohs(hp->qdcount);
-		        ancount = ntohs(hp->ancount);
-		        aucount = ntohs(hp->nscount);
-		        arcount = ntohs(hp->arcount);
+			if (ancount == 1 && loop_cnt == 1) {
+				if (buf2 == NULL) {
+					if ((buf2 = (u_char *)malloc(2 * PACKETSZ)) == NULL) {
+						syslog(LOG_INFO,
+						       "malloc(%u) failed",
+							2 * PACKETSZ);
+						error++;
+						break;
+					}
+					buf2size = 2 * PACKETSZ;
+				}
+				len = readandverify(s, &buf2, &buf2size, &sin,
+						    zp->z_origin, 0);
+				if (len == 0) {
+					error++;
+					tmp = bp;
+					check_serial = 0;
+					break;
+				}
+
+				hp = (HEADER *) buf2;
+				qdcount = ntohs(hp->qdcount);
+				ancount = ntohs(hp->ancount);
+				aucount = ntohs(hp->nscount);
+				arcount = ntohs(hp->arcount);
         
-        		tmp = buf2 + HFIXEDSZ;
-        		eom = buf2 + len;
-        		/* Query Section. */
-        		if (qdcount > 1) {
-        			badsoa_msg = "question error";
-        			goto badsoa;
-        		}
-        		n = dn_expand(buf2, eom, tmp, name2, sizeof name2);
-        		if (n < 0) {
-        			badsoa_msg = "qname error";
-        			goto badsoa;
-        		}
-        		tmp += n;
+				tmp = buf2 + HFIXEDSZ;
+				eom = buf2 + len;
+				/* Query Section. */
+				if (qdcount > 1) {
+					badsoa_msg = "question error";
+					goto badsoa;
+				} else if (qdcount == 1) {
+					n = dn_skipname(tmp, eom);
+					if (n < 0) {
+						badsoa_msg = "qname error";
+						goto badsoa;
+					}
+					tmp += n;
+					if (tmp + 2 * INT16SZ > eom) {
+						badsoa_msg = "query error";
+						goto badsoa;
+					}
+					tmp += 2 * INT16SZ; 
+				}
+				/* answer section */
+				if (ancount < 1) {
+					badsoa_msg = "empty answer";
+					goto badsoa;
+				}
+				n = dn_expand(buf2, eom, tmp, name2,
+					      sizeof name2);
+				if (n < 0) {
+					badsoa_msg = "qname error";
+					goto badsoa;
+				}
+				tmp += n;
 				bp = tmp;
-        		if (tmp + 2 * INT16SZ > eom) {
-        			badsoa_msg = "query error";
-        			goto badsoa;
-        		}
-        		NS_GET16(type, tmp);
-        		NS_GET16(class, tmp);
-        		if (class != curclass || 
-        		    ns_samename(zp->z_origin, name2) != 1) 
-        		{
-        			syslog(LOG_INFO,
+				if (tmp + 2 * INT16SZ > eom) {
+					badsoa_msg = "query error";
+					goto badsoa;
+				}
+				NS_GET16(type, tmp);
+				NS_GET16(class, tmp);
+				if (class != curclass || 
+				    ns_samename(zp->z_origin, name2) != 1) 
+				{
+					syslog(LOG_INFO,
         			"wrong query in resp from [%s], zone %s: [%s %s %s]\n",
-        			       inet_ntoa(sin.sin_addr), zp->z_origin,
-        			       name2, p_class(class), p_type(type));
-        			error++;
-        			(void) my_close(s);
-        			tmp = bp;
-                    check_serial = 0;
-                    break;
-        		}
+					       inet_ntoa(sin.sin_addr), zp->z_origin,
+					       name2, p_class(class), p_type(type));
+					error++;
+					tmp = bp;
+					check_serial = 0;
+					break;
+				}
 				if (type == T_SOA) {
-                    ixfr_single_answer_mode = 1;
-				    if (ixfp)
-				       if (ixfr_log(buf2, len, &delete_soa, ixfp,
-						 &sin, domain, &serial_no,
-						 &ixfr_first) < 0) {
-							error++;
-							break;
-				    }
-		            free(buf);
-                    buf = buf2;
-                    bufsize = buf2size;
+					ixfr_single_answer_mode = 1;
+					if (ixfp &&
+					    ixfr_log(buf2, len, &delete_soa, ixfp,
+						     &sin, &serial_no,
+						     &ixfr_first) < 0) {
+						error++;
+						break;
+					}
+					free(buf);
+					buf = buf2;
+					bufsize = buf2size;
+					buf2 = NULL;
 					break;
-                }
-				else {
-				    methode = ISNOTIXFR;
+				} else {
+					methode = ISNOTIXFR;
 					was_ixfr++;
-				    check_serial = 0;
-				    cp = buf + HFIXEDSZ;
+					check_serial = 0;
+					cp = buf + HFIXEDSZ;
 					n = print_output(zp, serial_no, buf, olen, ocp, 3);
+					first_soa_printed = 1;
+					free(buf);
 					buf = buf2;
-                    bufsize = buf2size;
+					buf2 = NULL;
+					bufsize = buf2size;
 					break;
-			    }
-            }
+				}
+			}
 			if (loop_cnt > 1) {
 				tmp = bp;
 				check_serial = 0;
@@ -1452,9 +1511,11 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 			}
 		} while (1);
 
-        if (error != 0) {
-			return (XFER_FAIL);
-        }
+		if (error != 0) {
+			(void) my_close(s);
+			continue;
+		}
+
 		if (ns_samename(zp->z_origin, name2) != 1) {
 			syslog(LOG_INFO,
 		       "wrong answer in resp from [%s], zone %s: [%s %s %s]\n",
@@ -1464,57 +1525,27 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 			(void) my_close(s);
 			continue;
 		}
-        if (loop_cnt < 1) {
-		badsoa_msg = soa_zinfo(&zp_start, tmp, eom);
-		if (badsoa_msg)
-			goto badsoa;
-        }
+		if (loop_cnt < 1) {
+			badsoa_msg = soa_zinfo(&zp_start, tmp, eom);
+			if (badsoa_msg)
+				goto badsoa;
+		}
 		if (methode == ISNOTIXFR) {
-		if (SEQ_GT(zp_start.z_serial, serial_no) || !check_serial) {
-			const char *l, *nl, *t;
-
-			if (soa_cnt)  {
-				goto axfr_response;
-			}
-			dprintf(1, "need update, serial %u\n",
-				zp_start.z_serial);
-			soa_cnt = 0;
-			hp = (HEADER *) buf;
-			ns_cnt = 0;
-			gettime(&tt);
-			locallen = sizeof local;
-			if (getsockname(s, (struct sockaddr *)&local,
-					&locallen) < 0) {
-				memset(&local, 0, sizeof local);
-			}
-			for (l = Version; l; l = nl) {
-				size_t len;
-				if ((nl = strchr(l, '\n')) != NULL) {
-					len = nl - l;
-					nl = nl + 1;
-				} else {
-					len = strlen(l);
-					nl = NULL;
+			if (SEQ_GT(zp_start.z_serial, serial_no) ||
+			    !check_serial) {
+				if (soa_cnt)  {
+					if (!first_soa_printed)
+						soa_cnt = 0;
+					goto axfr_response;
 				}
-				while (isspace((unsigned char) *l))
-					l++;
-				if (*l)
-					fprintf(dbfp, "; BIND version %.*s\n",
-						(int)len, l);
-			}
-			fprintf(dbfp, check_serial?
-				"; zone '%s'   last serial %u\n":
-				"; zone '%s'   first transfer\n",
-				domain, serial_no);
-			t = strdup(inet_ntoa(sin.sin_addr));
-			if (t == NULL)
-				return (XFER_FAIL);
-			fprintf(dbfp, "; from %s:%d (local %s) using %s at %s",
-				t, ntohs(sin.sin_port),
-				inet_ntoa(local.sin_addr),
-				(methode == ISIXFR) ? "IXFR":"AXFR", 
-				ctimel(tt.tv_sec));
-			free((void *)t);
+				dprintf(1, "need update, serial %u\n",
+					zp_start.z_serial);
+				soa_cnt = 0;
+				hp = (HEADER *) buf;
+				ns_cnt = 0;
+				print_comment(s, &sin, check_serial,
+					      serial_no, tsig_key);
+
 			for (;;) {
 				if ((soa_cnt == 0) || (zp->z_type == Z_STUB)) {
 					if (zp->z_type == Z_STUB) {
@@ -1527,33 +1558,24 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 						query_type = T_IXFR;
 					else
 						query_type = xfr_qtype;
-					n = res_nmkquery(&res, QUERY,
-							 zp->z_origin,
-							 curclass, query_type,
-							 NULL, 0,
-							 NULL, buf, bufsize);
+					n = make_query(s, zp, query_type,
+						       serial_no, tsig_key,
+						       buf, bufsize);
 					syslog(LOG_INFO,
 					       "send %s query %d to %s",
-				      (query_type == T_IXFR) ? "IXFR" :
-				      (query_type == T_AXFR) ? "AXFR" :
-				      (query_type == ns_t_zxfr) ? "ZXFR" :
-				      (query_type == T_SOA) ? "SOA" : "NS",
+						p_type(query_type),
 					       cnt, inet_ntoa(sin.sin_addr));
 					dprintf(1,
 					"send %s query to %s\n",
-					(query_type == T_IXFR) ? "IXFR" :
-					(query_type == T_AXFR) ? "AXFR" :
-					(query_type == ns_t_zxfr) ? "ZXFR" :
-					(query_type == T_SOA) ? "SOA" : "NS",
+						p_type(query_type),
 						inet_ntoa(sin.sin_addr));
 					dprintf(1,"bufsize = %d\n", bufsize);
 					if (n < 0) {
 						if (!quiet) {
 						    if (zp->z_type == Z_STUB)
 							syslog(LOG_INFO,
-						       (query_type == T_SOA)
-					? "zone %s: res_nmkquery T_SOA failed"
-					: "zone %s: res_nmkquery T_NS failed",
+					     "zone %s: res_nmkquery %s failed",
+							    p_type(query_type),
 							       zp->z_origin);
 						    else
 							syslog(LOG_INFO,
@@ -1571,93 +1593,21 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 #endif
 						return (XFER_FAIL);
 					}
-					cpp = buf + n;
-					/*
-					 * Append TSIG to AXFR query if desired
-					 */
-					if (tsig_signed != 0) {
-						siglen = sizeof(sig);
-						ns_sign(buf, &n, bufsize,
-							NOERROR, tsig_key,
-							NULL, 0, sig, &siglen,
-							timesigned);
-						cpp = buf + n;
-						ns_verify_tcp_init(tsig_key,
-								   sig, siglen,
-								   &tsig_state);
-					}
-					/*
-					 * Send length & msg for zone transfer
-					 */
-					if (writemsg(s, buf, cpp - buf) < 0) {
-						syslog(LOG_INFO,
-						       "writemsg: %m");
-						error++;
-						(void) my_close(s);
-						break;	
-					}
 				}
 /*XXX ZXFR*/
 receive:
 				/*
 				 * Receive length & response
 				 */
-				if (netread(s, (char *)buf, INT16SZ,
-					    (soa_cnt == 0) ?300 :XFER_TIMER)
-				    < 0) {
+				tsig_req = (soa_cnt == 0);
+				len = readandverify(s, &buf, &bufsize, &sin,
+						    zp->z_origin, tsig_req);
+				if (len == 0) {
 					error++;
 					break;
 				}
-				if ((len = ns_get16(buf)) == 0)
-					break;
-				if (len > bufsize) {
-					buf = (u_char *)realloc(buf, len);
-					if (buf == NULL) {
-						syslog(LOG_INFO,
-		   	 "malloc(%u) failed for packet from server [%s], zone %s\n",
-						       len,
-						       inet_ntoa(sin.sin_addr),
-						       zp->z_origin);
-						error++;
-						break;
-					}
-					bufsize = len;
-				}
 				hp = (HEADER *)buf;
 				eom = buf + len;
-				if (netread(s, (char *)buf, len, XFER_TIMER)
-				    < 0) {
-					error++;
-					break;
-				}
-#ifdef DEBUG
-				if (debug >= 3) {
-					(void)fprintf(ddt,"len = %d\n", len);
-					res_pquery(&res, buf, len, ddt);
-				}
-				if (fp)
-					res_pquery(&res, buf, len, fp);
-#endif
-				/*
-				 * Verify the TSIG if expected
-				 */
-				if (tsig_signed != 0) {
-					tsig_req = (soa_cnt == 0);
-					ret = ns_verify_tcp(buf, (int *)&len,
-							    &tsig_state,
-							    tsig_req);
-					eom = buf + len;
-
-					if (ret != 0) {
-						syslog(LOG_NOTICE,
-		"TSIG verification from server [%s], zone %s: %s (%d)\n",
-							inet_ntoa(sin.sin_addr),
-							zp->z_origin,
-							tsig_rcode(ret), ret);
-						error++;
-						break;
-					}
-				}
 				if (len < HFIXEDSZ) {
  badrec:
 					error++;
@@ -1673,8 +1623,8 @@ receive:
 								  sin_addr),
 							ntohs(my_addr.sin_port)
 							);
-					if ((hp->rcode == REFUSED) &&
-					    (len >= HFIXEDSZ)) {
+					if ((len >= HFIXEDSZ) &&
+					    (hp->rcode == REFUSED)) {
 						syslog(LOG_INFO,
 				  "[%s] transfer refused from [%s], zone %s\n",
 						       my_addr_text,
@@ -1692,7 +1642,7 @@ receive:
 axfr_response:
 				if (query_type == T_IXFR) 
 					if (hp->rcode != NOERROR) {
-					    dprintf(1,
+						dprintf(1,
 					    "server %s did not support IXFR\n",
 						    inet_ntoa(sin.sin_addr));
 						methode = ISNOTIXFR;
@@ -1700,11 +1650,12 @@ axfr_response:
 					};
 				cp = buf + HFIXEDSZ;
 				if (ntohs(hp->qdcount) == 1) {
-					if ((query_type == T_IXFR) && (methode == ISIXFR)) {
-							dprintf(1,
-				      "server %s rejected IXFR and responded with AXFR\n",
+					if ((query_type == T_IXFR) &&
+					     (methode == ISIXFR)) {
+						dprintf(1,
+				     "server %s rejected IXFR and responded with AXFR\n",
 						       inet_ntoa(sin.sin_addr));
-							methode = ISNOTIXFR;
+						methode = ISNOTIXFR;
 					}
 					n = dn_skipname(cp, eom);
 					if ((n  == -1) ||
@@ -1793,15 +1744,12 @@ axfr_response:
 				} else {
 					ancount = ntohs(hp->ancount);
 					if (query_type == T_IXFR &&
-					    methode == ISIXFR) {
-						if (ixfr_log(buf, len,
-							     &delete_soa, ixfp,
-							     &sin, domain,
-							     &serial_no,
-							     &ixfr_first) < 0){
-								error++;
-								break;
-							}
+					    methode == ISIXFR &&
+					    ixfr_log(buf, len, &delete_soa,
+						     ixfp, &sin, &serial_no,
+						     &ixfr_first) < 0 ){
+						error++;
+						break;
 					}
 					for (n = cnt = 0;
 					     cnt < (u_int)ancount;
@@ -1834,54 +1782,54 @@ axfr_response:
 					break;
 				if ((soa_cnt == -1) && (methode == ISIXFR))
 					break;
-			}
-			(void) my_close(s);
-			if (error == 0) {
+				}
+				(void) my_close(s);
+				if (error == 0) {
 #ifdef POSIX_SIGNALS
-				(void) sigaction(SIGALRM, &osv,
-						 (struct sigaction *)0);
+					(void) sigaction(SIGALRM, &osv,
+							 (struct sigaction *)0);
 #else
-				(void) sigvec(SIGALRM, &osv,
-					      (struct sigvec *)0);
+					(void) sigvec(SIGALRM, &osv,
+						      (struct sigvec *)0);
 #endif
+					if (ixfp) {
+						(void) fclose(ixfp);
+						ixfp = NULL;
+					}
+					return (XFER_SUCCESSAXFR);
+				}
 				if (ixfp) {
 					(void) fclose(ixfp);
 					ixfp = NULL;
 				}
-				return (XFER_SUCCESSAXFR);
-			}
-			if (ixfp) {
-				(void) fclose(ixfp);
-				ixfp = NULL;
-			}
-			dprintf(2, "error receiving zone transfer\n");
-		} else if (zp_start.z_serial == serial_no) {
-			(void) my_close(s);
-			dprintf(1, "zone up-to-date, serial %u\n",
-				zp_start.z_serial);
-			if (ixfp) {
-				(void) unlink (tmpiname);
-				(void) fclose(ixfp);
-				ixfp = NULL;
-			}
-			return (XFER_UPTODATE);
-		} else {
-			(void) my_close(s);
+				dprintf(2, "error receiving zone transfer\n");
+			} else if (zp_start.z_serial == serial_no) {
+				(void) my_close(s);
+				dprintf(1, "zone up-to-date, serial %u\n",
+					zp_start.z_serial);
+				if (ixfp) {
+					(void) fclose(ixfp);
+					(void) unlink (tmpiname);
+					ixfp = NULL;
+				}
+				return (XFER_UPTODATE);
+			} else {
+				(void) my_close(s);
 			if (!quiet)
 				syslog(LOG_NOTICE,
 		      "serial from [%s], zone %s: %u lower than current: %u\n",
 				       inet_ntoa(sin.sin_addr), zp->z_origin,
 				       zp_start.z_serial, serial_no);
-			return (XFER_FAIL);
-		}
+				return (XFER_FAIL);
+			}
 		} else {
 			if (zp_finish.z_serial == query_serial) {
 				(void) my_close(s);
 				dprintf(1, "zone up-to-date, serial %u\n",
 					zp_start.z_serial);
 				if (ixfp) {
-					(void) unlink (tmpiname);
 					(void) fclose(ixfp);
+					(void) unlink (tmpiname);
 					ixfp = NULL;
 				}
 				return (XFER_UPTODATE);
@@ -1898,21 +1846,15 @@ axfr_response:
 					zp_finish.z_serial, query_serial);
 				if (ixfp) {
 					(void) fclose(ixfp);
-					ixfp = NULL;
 					(void) unlink (tmpiname);
+					ixfp = NULL;
 				}
 				if (was_ixfr == 0) {
 					was_ixfr++;
-					n = res_nmkquery(&res, QUERY,
-							 zp->z_origin,
-							 curclass, T_AXFR,
-							 NULL, 0,
-							 NULL, buf, bufsize);
+					n = make_query(s, zp, T_AXFR,
+						       serial_no, tsig_key,
+						       buf, bufsize);
 					if (n < 0) {
-						if (!quiet)
-							syslog(LOG_INFO,
-		    		               "zone %s: res_nmkquery T_SOA failed",
-							       zp->z_origin);
 						(void) my_close(s);
 #ifdef POSIX_SIGNALS
 						(void) sigaction(SIGALRM, &osv,
@@ -1923,34 +1865,11 @@ axfr_response:
 #endif
 						return (XFER_FAIL);
 					}
-					/*
-					 * Append TSIG to SOA query if desired
-					 */
-					tsig_key = tsig_key_from_addr(sin.sin_addr);
-					if (tsig_key != NULL) {
-						siglen = sizeof(sig);
-						ret = ns_sign(buf, &n, bufsize,
-							      NOERROR,
-							      tsig_key, NULL,
-							      0, sig, &siglen,
-							      timesigned);
-						if (ret == 0)
-							tsig_signed = 1;
-					}
-
-				/*
-				 * Send length & message for AXFR query
-				 */
-					if (writemsg(s, buf, n) < 0)
-						syslog(LOG_INFO,
-						       "writemsg: %m");
-					else {
-						methode = ISNOTIXFR;
-						check_serial = 0;
-						soa_cnt = 0;
-						was_ixfr = 0;
-						goto receive;
-					}
+					methode = ISNOTIXFR;
+					check_serial = 0;
+					soa_cnt = 0;
+					was_ixfr = 0;
+					goto receive;
 				}
 				(void) my_close(s);
 				return (XFER_FAIL);
@@ -1959,70 +1878,23 @@ axfr_response:
 				methode = ISNOTIXFR;
 				check_serial = 0;
 				soa_cnt = 0;
-                goto axfr_response;
+				goto axfr_response;
 			}
 			dprintf(1, "We have an IXFR\n");
-            loop_cnt = 0;
+			loop_cnt = 0;
 			while (SEQ_GT(zp_finish.z_serial, serial_no)) {
 				/*
 				 * Receive length & response
 				 */
-				if (netread(s, (char *)buf, INT16SZ,
-					    (soa_cnt == 0) ?300 :XFER_TIMER)
-				    < 0) {
+				tsig_req = (soa_cnt == 0);
+				len = readandverify(s, &buf, &bufsize, &sin,
+						    zp->z_origin, 1);
+				if (len == 0) {
 					error++;
 					break;
 				}
-				if ((len = ns_get16(buf)) == 0)
-					break;
-				if (len > bufsize) {
-					buf = (u_char *)realloc(buf, len);
-					if (buf == NULL) {
-						syslog(LOG_INFO,
-		   	 "malloc(%u) failed for packet from server [%s], zone %s\n",
-						       len,
-						       inet_ntoa(sin.sin_addr),
-						       zp->z_origin);
-						error++;
-						break;
-					}
-					bufsize = len;
-				}
 				hp = (HEADER *)buf;
 				eom = buf + len;
-				if (netread(s, (char *)buf, len, XFER_TIMER)
-				    < 0) {
-					error++;
-					break;
-				}
-#ifdef DEBUG
-				if (debug >= 3) {
-					(void)fprintf(ddt,"len = %d\n", len);
-					res_pquery(&res, buf, len, ddt);
-				}
-				if (fp)
-					res_pquery(&res, buf, len, fp);
-#endif
-				/*
-				 * Verify the TSIG if expected
-				 */
-				if (tsig_signed != 0) {
-					tsig_req = (soa_cnt == 0);
-					ret = ns_verify_tcp(buf, (int *)&len,
-							    &tsig_state,
-							    tsig_req);
-					eom = buf + len;
-
-					if (ret != 0) {
-						syslog(LOG_NOTICE,
-		"TSIG verification from server [%s], zone %s: %s (%d)\n",
-							inet_ntoa(sin.sin_addr),
-							zp->z_origin,
-							tsig_rcode(ret), ret);
-						error++;
-						break;
-					}
-				}
 				if (len < HFIXEDSZ) {
 					error++;
 					alen = sizeof my_addr;
@@ -2049,20 +1921,19 @@ axfr_response:
 					}
 					break;
 				}
-				if (ixfp) {
-				  if (ixfr_log(buf, len, &delete_soa, ixfp,
-						 &sin, domain, &serial_no,
-						 &ixfr_first) < 0) {
-							error++;
-							break;
-				  }
-                }
+				if (ixfp &&
+				    ixfr_log(buf, len, &delete_soa, ixfp,
+				             &sin, &serial_no, &ixfr_first) < 0)
+				{
+					error++;
+					break;
+				}
 			}
 			(void) my_close(s);
 			if (!error) {
 				fprintf(ixfp, "update:\t{add} ");
 				if (soa_buf)
-				  fputs(soa_buf, ixfp);
+					fputs(soa_buf, ixfp);
 				fprintf(ixfp, "[END_DELTA]\n");
 				return (XFER_SUCCESSIXFR);
 			}
@@ -2074,9 +1945,9 @@ axfr_response:
 	(void) sigvec(SIGALRM, &osv, (struct sigvec *)0);
 #endif
 	if (ixfp) {
-			(void) unlink (tmpiname);
-			(void) my_fclose(ixfp);
-			ixfp = 0;
+		(void) my_fclose(ixfp);
+		(void) unlink (tmpiname);
+		ixfp = NULL;
 	}
 	if (!error)
 		return (XFER_TIMEOUT);
@@ -2103,7 +1974,8 @@ netread(int fd, char *buf, int len, int timeout) {
 	static const char setitimerStr[] = "setitimer: %m";
 	struct itimerval ival, zeroival;
 	struct sockaddr_in sa;
-	int n, salen;
+	int n;
+	ISC_SOCKLEN_T salen;
 #if defined(NETREAD_BROKEN)
 	int retries = 0;
 #endif
@@ -2112,7 +1984,7 @@ netread(int fd, char *buf, int len, int timeout) {
 	ival = zeroival;
 	ival.it_value.tv_sec = timeout;
 	while (len > 0) {
-#ifndef WINNT
+#ifndef _WIN32
 		if (setitimer(ITIMER_REAL, &ival, NULL) < 0) {
 			syslog(LOG_INFO, setitimerStr);
 			return (-1);
@@ -2153,8 +2025,13 @@ netread(int fd, char *buf, int len, int timeout) {
 		}
 		buf += n;
 		len -= n;
+#if defined(NETREAD_BROKEN)
+		/* Reset the retry counter if we are successfully reading. */
+		if(n > 0)
+			retries = 0;
+#endif
 	}
-#ifndef WINNT
+#ifndef _WIN32
 	if (setitimer(ITIMER_REAL, &zeroival, NULL) < 0) {
 		syslog(LOG_INFO, setitimerStr);
 		return (-1);
@@ -2175,7 +2052,7 @@ writemsg(int rfd, const u_char *msg, int msglen) {
 	__putshort(msglen, len);
 	iov[0].iov_base = (char *)len;
 	iov[0].iov_len = INT16SZ;
-	iov[1].iov_base = (char *)msg;
+	DE_CONST(msg, iov[1].iov_base);
 	iov[1].iov_len = msglen;
 	ret = writev(rfd, iov, 2);
 	if (ret != INT16SZ + msglen) {
@@ -2243,7 +2120,7 @@ print_output(struct zoneinfo *zp, u_int32_t serial_no, u_char *msg,
 	u_char *cp;
 	HEADER *hp = (HEADER *) msg;
 	u_int32_t ttl, tmpnum;
-	int i, j, tab, result, n1, n;
+	int i, j, longname, result, n1, n;
 	u_int class, type, dlen;
 	char data[MAXDATA];
 	u_char *cp1, *cp2, *temp_ptr, *eom, *rr_type_ptr;
@@ -2540,10 +2417,10 @@ print_output(struct zoneinfo *zp, u_int32_t serial_no, u_char *msg,
 		break;
 
 	default:
-		syslog(LOG_INFO, "\"%s %s %s\" - unknown type (%d)",
-		       dname, p_class(class), p_type(type), type);
-		hp->rcode = NOTIMP;
-		return (-1);
+		cp1 = cp;
+		n = dlen;
+		cp += n;
+		break;
 	}
 
 	if (n > MAXDATA) {
@@ -2689,7 +2566,7 @@ print_output(struct zoneinfo *zp, u_int32_t serial_no, u_char *msg,
 	}
 
 	if ((!soa_cnt || soa_cnt > 2) && methode == ISNOTIXFR) {
-		char *gripe;
+		const char *gripe;
 
 		if (!soa_cnt)
 			gripe = "got RR before first SOA";
@@ -2729,7 +2606,7 @@ print_output(struct zoneinfo *zp, u_int32_t serial_no, u_char *msg,
 		(void) fprintf(dbfp, "; Ignoring extra info about %s, invalid after NS delegation.\n",
 			dname);
 		ignore = "; ";
-	} else if (class != zp->z_class) {
+	} else if (class != (unsigned)zp->z_class) {
 		(void) fprintf(dbfp, "; Ignoring info about %s, not class %s\n",
 		dname, p_class(zp->z_class));
 		ignore = "; ";
@@ -2764,7 +2641,8 @@ print_output(struct zoneinfo *zp, u_int32_t serial_no, u_char *msg,
 		(void) strcpy(prev_origin, origin);
 		(void) fprintf(dbfp, "%s$ORIGIN %s.\n", ignore, origin);
 	}
-	tab = 0;
+
+	longname = 0;
 
 	if (ns_samename(prev_dname, dname) != 1) {
 		/*
@@ -2790,17 +2668,16 @@ print_output(struct zoneinfo *zp, u_int32_t serial_no, u_char *msg,
 				(void) fprintf(dbfp, "%s.%s.\t",
 					ignore, origin);	/* ??? */
 		} else {
-			char *backslash;
+			const char *backslash;
 			backslash = (*dname == '@' || *dname == '$') ?
 				"\\" : "";
 			(void) fprintf(dbfp, "%s%s%s\t", ignore,
 				       backslash, dname);
 		}
-		if (strlen(dname) < (size_t)8)
-			tab = 1;
+		if (strlen(dname) > (size_t)8)
+			longname = 1;
 	} else {
 		(void) fprintf(dbfp, "%s\t", ignore);
-		tab = 1;
 	}
 
 	(void) fprintf(dbfp, "%d\t", (int) ttl);
@@ -3116,10 +2993,15 @@ print_output(struct zoneinfo *zp, u_int32_t serial_no, u_char *msg,
 	}
 
 	default:
-		cp1 = cp + n;
-		while (cp < cp1)
-			fprintf(dbfp, "0x%02X ", *cp++ & 0xFF);
-		(void) fprintf(dbfp, "???\n");
+		fprintf (dbfp, "\\# %u", n);
+		if (n > 0) {
+			fputs(" ( ", dbfp);
+			isc_puthexstring(dbfp, cp1, n,
+					 (longname ? 28 : 40), 48,
+					 "\n\t\t\t\t");
+			fputs(" )\n", dbfp);
+		}
+
 	}
 	if (ferror(dbfp)) {
 		syslog(LOG_ERR, "%s: %m", tmpname);
@@ -3180,7 +3062,7 @@ do_section(ns_msg *handle, ns_sect section, int pflag, FILE *file, int *delete)
 	ns_rr rr;
 	const unsigned char *cp;
 	const unsigned char *eom;
-	u_int32_t serial;
+	u_int32_t serial = 0;
 	time_t now;
 
 	time(&now);
@@ -3203,7 +3085,7 @@ do_section(ns_msg *handle, ns_sect section, int pflag, FILE *file, int *delete)
 			} else if (rrnum > 0 && sflag != 0 &&
 				 (_res.pfcode & RES_PRF_HEAD1))
 				putc('\n', file);
-			return (serial);
+			break;
 		}
 		if (rrnum == 0 && sflag != 0 && (_res.pfcode & RES_PRF_HEAD1))
 			fprintf(file, ";; %s SECTION:\n",
@@ -3216,7 +3098,7 @@ do_section(ns_msg *handle, ns_sect section, int pflag, FILE *file, int *delete)
 		else {
 			int print_record = 1;
 			if (rr.type == ns_t_soa) {
-			print_record = 0;
+				print_record = 0;
 				*delete = !*delete;
 				cp = ns_rr_rdata(rr);
 				eom = cp + ns_rr_rdlen(rr);
@@ -3277,8 +3159,8 @@ do_section(ns_msg *handle, ns_sect section, int pflag, FILE *file, int *delete)
 					return(-1);
 				}
 				fputs(buf, file);
-					fputc('\n', file);
-					}
+				fputc('\n', file);
+				}
 			}
 
 		}
@@ -3289,8 +3171,7 @@ do_section(ns_msg *handle, ns_sect section, int pflag, FILE *file, int *delete)
 
 static int
 ixfr_log(const u_char *msg, int len, int  *delete, FILE *file,
-	 struct sockaddr_in *sin, char *domain, u_int32_t *serial_no,
-	 int *first_rr)
+	 struct sockaddr_in *sin, u_int32_t *serial_no, int *first_rr)
 {
 	ns_msg handle;
 	ns_type type;
@@ -3337,8 +3218,8 @@ ixfr_log(const u_char *msg, int len, int  *delete, FILE *file,
 		(*first_rr)++;
 	}
 	new_serial = do_section(&handle, ns_s_an, RES_PRF_ANS, file, delete);
-    if (type == T_SOA && SEQ_GT(new_serial, *serial_no) && (*delete))
-         *serial_no = new_serial;
+	if (type == T_SOA && SEQ_GT(new_serial, *serial_no) && (*delete))
+		*serial_no = new_serial;
 	return (1);
 }
 
@@ -3363,4 +3244,3 @@ tsig_rcode(int rcode) {
 	}
 	return ("FORMERR");
 }
-
diff --git a/contrib/bind/bin/named/db_defs.h b/contrib/bind/bin/named/db_defs.h
index f18acae..72aa19f 100644
--- a/contrib/bind/bin/named/db_defs.h
+++ b/contrib/bind/bin/named/db_defs.h
@@ -1,6 +1,6 @@
 /*
  *	from db.h	4.16 (Berkeley) 6/1/90
- *	$Id: db_defs.h,v 8.41 2001/02/08 02:05:50 marka Exp $
+ *	$Id: db_defs.h,v 8.46 2001/11/17 15:16:46 marka Exp $
  */
 
 /*
@@ -111,7 +111,14 @@
  * indicate what the union is being used for.  This should require less
  * memory than making d_addr a union of struct in6_addr and struct in_addr.
  */
+#ifdef CHECK_MAGIC
+#define DATABUF_MAGIC (('D'<<24)|('A'<<16)|('T'<<8)|'A')
+#endif
+
 struct databuf {
+#ifdef CHECK_MAGIC
+	u_int32_t	d_magic;	/* magic number */
+#endif
 	struct databuf	*d_next;	/* linked list */
 	struct in_addr	d_addr;		/* NS from whence this came */
 	u_int32_t	d_ttl;		/* time to live */
@@ -130,6 +137,7 @@ struct databuf {
 	unsigned	d_clev :6;
 	unsigned	d_rcode :4;	/* rcode for negative caching */
 	unsigned	d_mark :3;	/* place to mark data */
+	unsigned	d_noedns :1;	/* this server does not support edns */
 	int16_t		d_type;		/* type number */
 	int16_t		d_size;		/* size of data area */
 	u_int32_t	d_rcnt;
@@ -184,11 +192,14 @@ struct namebuf {
 	struct databuf	*n_data;	/* data records */
 	struct namebuf	*n_parent;	/* parent domain */
 	struct hashbuf	*n_hash;	/* hash table for children */
-	char		_n_name[sizeof(void*)];	/* Counted str (dynamic). */
+	union {
+		char		_n_name[sizeof(void*)];
+		unsigned char	_n_len[sizeof(void*)];
+	} _n;				/* Counted str (dynamic). */
 };
 #define	NAMESIZE(n)	(sizeof(struct namebuf) - sizeof(void*) + 1 + n + 1)
-#define	NAMELEN(nb)	(((u_char *)((nb)._n_name))[0])
-#define	NAME(nb)	((nb)._n_name + 1)
+#define	NAMELEN(nb)	((((nb)._n._n_len))[0])
+#define	NAME(nb)	((nb)._n._n_name + 1)
 
 struct hashbuf {
 	int		h_size;		/* size of hash table */
@@ -211,6 +222,7 @@ struct tsig_record {
 	u_int8_t	sig[TSIG_SIG_SIZE];
 	struct dst_key	*key;
 	int		siglen;
+	int		tsig_size;
 };
 
 struct sig_record {
@@ -227,7 +239,7 @@ struct dnode {
 	struct databuf	*dp;
 	struct dnode	*dn_next;
 	int		line;
-	char		*file;
+	const char	*file;
 };
 
 typedef struct dnode * dlist;
@@ -280,6 +292,7 @@ struct db_rrset {
 #endif
 #define CNAMEANDOTHER	(-12)
 #define DNSSECFAIL	(-13)	/* db_set_update */
+#define NONGLUE		(-14)
 
 /*
  * getnum() options
diff --git a/contrib/bind/bin/named/db_dump.c b/contrib/bind/bin/named/db_dump.c
index a350719..26daa6f 100644
--- a/contrib/bind/bin/named/db_dump.c
+++ b/contrib/bind/bin/named/db_dump.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_dump.c	4.33 (Berkeley) 3/3/91";
-static const char rcsid[] = "$Id: db_dump.c,v 8.49 2001/02/06 06:42:19 marka Exp $";
+static const char rcsid[] = "$Id: db_dump.c,v 8.51 2001/06/18 14:42:49 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -120,6 +120,7 @@ static const char rcsid[] = "$Id: db_dump.c,v 8.49 2001/02/06 06:42:19 marka Exp
 
 #include <isc/eventlib.h>
 #include <isc/logging.h>
+#include <isc/misc.h>
 
 #include "port_after.h"
 
@@ -177,7 +178,8 @@ zt_dump(FILE *fp) {
 
 	fprintf(fp, ";; ++zone table++\n");
 	for (zp = &zones[0]; zp < &zones[nzones]; zp++) {
-		char *pre, buf[64];
+		const char *pre;
+		char buf[64];
 		u_int cnt;
 
 		if (!zp->z_origin)
@@ -230,7 +232,7 @@ fwd_dump(FILE *fp) {
 }
 
 int
-db_dump(struct hashbuf *htp, FILE *fp, int zone, char *origin) {
+db_dump(struct hashbuf *htp, FILE *fp, int zone, const char *origin) {
 	struct databuf *dp = NULL;
 	struct namebuf *np;
 	struct namebuf **npp, **nppend;
@@ -621,9 +623,14 @@ db_dump(struct hashbuf *htp, FILE *fp, int zone, char *origin) {
 				break;
 
 			default:
-				fprintf(fp, "%s?d_type=%d?",
-					sep, dp->d_type);
-				sep = " ";
+				fprintf(fp, "\\# %u", dp->d_size);
+				if (dp->d_size != 0) {
+					fputs(" ( ", fp);
+					isc_puthexstring(fp, dp->d_data,
+							 dp->d_size, 40, 48,
+							 "\n\t\t\t\t");
+					fputs(" ) ", fp);
+				}
 			}
 			if (dp->d_cred < DB_C_ZONE) {
 				fprintf(fp, "%sCr=%s",
diff --git a/contrib/bind/bin/named/db_func.h b/contrib/bind/bin/named/db_func.h
index d01de88..7e7e05e 100644
--- a/contrib/bind/bin/named/db_func.h
+++ b/contrib/bind/bin/named/db_func.h
@@ -90,7 +90,7 @@
 
 /* db_proc.h - prototypes for functions in db_*.c
  *
- * $Id: db_func.h,v 8.44 2000/12/02 23:28:33 vixie Exp $
+ * $Id: db_func.h,v 8.46 2001/06/18 14:42:51 marka Exp $
  */
 
 /* ++from db_update.c++ */
@@ -113,7 +113,7 @@ struct hashbuf *	savehash(struct hashbuf *);
 /* --from db_save.c-- */
 
 /* ++from db_dump.c++ */
-int			db_dump(struct hashbuf *, FILE *, int, char *),
+int			db_dump(struct hashbuf *, FILE *, int, const char *),
 			zt_dump(FILE *);
 void			doadump(void);
 /* --from db_dump.c-- */
@@ -142,7 +142,7 @@ int			parse_sec_rdata(char *inp, int inp_len, int inp_full,
 					char *domain,  u_int32_t ttl, 
 					int type, enum context context,
 					enum transport transport,
-					char **errmsg);
+					const char **errmsg);
 /* --from db_load.c-- */
 
 /* ++from db_glue.c++ */
@@ -165,7 +165,7 @@ struct namebuf *	rm_name(struct namebuf *,
 				struct namebuf **,
 				struct namebuf *);
 void			rm_hash(struct hashbuf *);
-void			db_freedata(struct databuf *);
+void			db_detach(struct databuf **);
 void			db_lame_add(char *zone, char *server, time_t when);
 time_t			db_lame_find(char *zone, struct databuf *dp);
 void			db_lame_clean(void);
@@ -203,7 +203,7 @@ int			db_set_update(char *name, struct databuf *dp,
 /* --from db_sec.c-- */
 
 /* ++from db_tsig.c++ */
-char *			tsig_alg_name(int value);
+const char *		tsig_alg_name(int value);
 int			tsig_alg_value(char *name);
 struct dst_key *	tsig_key_from_addr(struct in_addr addr);
 struct tsig_record *	new_tsig(struct dst_key *key, u_char *sig, int siglen);
diff --git a/contrib/bind/bin/named/db_glue.c b/contrib/bind/bin/named/db_glue.c
index ba59802..e984db1 100644
--- a/contrib/bind/bin/named/db_glue.c
+++ b/contrib/bind/bin/named/db_glue.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_glue.c	4.4 (Berkeley) 6/1/90";
-static const char rcsid[] = "$Id: db_glue.c,v 8.42 2000/12/23 08:14:35 vixie Exp $";
+static const char rcsid[] = "$Id: db_glue.c,v 8.46 2001/11/25 23:52:19 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -145,8 +145,8 @@ destroyservicelist() {
 
 	for (slp = servicelist; slp != NULL; slp = slp_next) {
 		slp_next = slp->next;
-		freestr(slp->name);
-		freestr(slp->proto);
+		slp->name = freestr(slp->name);
+		slp->proto = freestr(slp->proto);
 		memput(slp, sizeof *slp);
 	}
 	servicelist = NULL;
@@ -183,7 +183,7 @@ destroyprotolist() {
 
 	for (plp = protolist; plp != NULL; plp = plp_next) {
 		plp_next = plp->next;
-		freestr(plp->name);
+		plp->name = freestr(plp->name);
 		memput(plp, sizeof *plp);
 	}
 	protolist = NULL;
@@ -354,31 +354,7 @@ rm_datum(struct databuf *dp, struct namebuf *np, struct databuf *pdp,
 	} else
 		dp->d_next = NULL;
 	dp->d_flags &= ~DB_F_ACTIVE;
-	DRCNTDEC(dp);
-	if (dp->d_rcnt) {
-#ifdef DEBUG
-		int32_t ii;
-#endif
-
-		switch(dp->d_type) {
-		case T_NS:
-			ns_debug(ns_log_db, 3, "rm_datum: %s rcnt = %d",
-				 dp->d_data, dp->d_rcnt);
-			break;
-#ifdef DEBUG
-		case T_A:
-			memcpy(&ii, dp->d_data, sizeof ii);
-			ns_debug(ns_log_db, 3,
-				 "rm_datum: %08.8X rcnt = %d",
-				 ii, dp->d_rcnt);
-			break;
-#endif
-		default:
-			ns_debug(ns_log_db, 3,
-				 "rm_datum: rcnt = %d", dp->d_rcnt);
-		}
-	} else
-		db_freedata(dp);
+	db_detach(&dp);
 	return (ndp);
 }
 
@@ -393,10 +369,10 @@ rm_name(struct namebuf *np, struct namebuf **pp, struct namebuf *pnp) {
 	const char *msg;
 
 	/* verify */
-	if ( (np->n_data && (msg = "data"))
-	  || (np->n_hash && (msg = "hash"))
+	if ( (np->n_data != NULL && (msg = "data") != NULL)
+	  || (np->n_hash != NULL && (msg = "hash") != NULL)
 	    ) {
-		ns_panic(ns_log_db, 1, "rm_name(%#x(%s)): non-nil %s pointer",
+		ns_panic(ns_log_db, 1, "rm_name(%p(%s)): non-nil %s pointer",
 			 np, NAME(*np), msg);
 	}
 
@@ -463,7 +439,7 @@ nhash(const char *name) {
 	return (hval);
 }
 
-void
+static void
 db_freedata(struct databuf *dp) {
 	int bytes = DATASIZE(dp->d_size);
 
@@ -476,9 +452,28 @@ db_freedata(struct databuf *dp) {
 	if (dp->d_next != NULL)
 		panic("db_free: d_next != NULL", NULL);
 	dp->d_flags |= DB_F_FREE;
+#ifdef CHECK_MAGIC
+	dp->d_magic = 0;
+#endif
 	memput(dp, bytes);
 }
 
+void
+db_detach(struct databuf **dpp) {
+	struct databuf *dp;
+
+	INSIST(dpp != NULL && *dpp != NULL);
+	dp = *dpp;
+#ifdef CHECK_MAGIC
+	INSIST(dp->d_magic == DATABUF_MAGIC);
+#endif
+
+	DRCNTDEC(dp);
+	if (dp->d_rcnt == 0)
+		db_freedata(dp);
+	*dpp = NULL;
+}
+
 struct lame_hash {
 	struct lame_hash	*next;
 	char			*zone;
@@ -550,9 +545,9 @@ db_lame_add(char *zone, char *server, time_t when) {
 	this->zone = savestr(zone, 0);
 	if (this->server == NULL || this->zone == NULL) {
 		if (this->server != NULL)
-			freestr(this->server);
+			this->server = freestr(this->server);
 		if (this->zone != NULL)
-			freestr(this->zone);
+			this->zone = freestr(this->zone);
 		memput(this, sizeof *this);
 		return;
 	}
@@ -602,8 +597,8 @@ db_lame_clean(void) {
 		this = lame_hash[i];
 		while (this != NULL) {
 			if (this->when < tt.tv_sec) {
-				freestr(this->zone);
-				freestr(this->server);
+				this->zone = freestr(this->zone);
+				this->server = freestr(this->server);
 				if (last != NULL) {
 					last->next = this->next;
 					memput(this, sizeof *this);
@@ -635,8 +630,8 @@ db_lame_destroy(void) {
 		while (this != NULL) {
 			last = this;
 			this = this->next;
-			freestr(last->zone);
-			freestr(last->server);
+			last->zone = freestr(last->zone);
+			last->server = freestr(last->server);
 			memput(last, sizeof *this);
 		}
 	}
diff --git a/contrib/bind/bin/named/db_ixfr.c b/contrib/bind/bin/named/db_ixfr.c
index e515075..231db12 100644
--- a/contrib/bind/bin/named/db_ixfr.c
+++ b/contrib/bind/bin/named/db_ixfr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static char     rcsid[] = "$Id: db_ixfr.c,v 8.23.2.2 2001/05/03 03:53:18 marka Exp $";
+static char     rcsid[] = "$Id: db_ixfr.c,v 8.31 2002/01/02 04:47:10 marka Exp $";
 #endif
 
 /*
@@ -52,6 +52,7 @@ static char     rcsid[] = "$Id: db_ixfr.c,v 8.23.2.2 2001/05/03 03:53:18 marka E
 #include <isc/eventlib.h>
 #include <isc/logging.h>
 #include <isc/memcluster.h>
+#include <isc/misc.h>
 
 #include "port_after.h"
 
@@ -108,25 +109,29 @@ ixfr_get_change_list(struct zoneinfo *zp,
 		case DBIXFR_ERROR:
 			ns_warning(ns_log_db, "Logical error in %s: unlinking", 
 				   zp->z_ixfr_base);
+			if (fp != NULL) {
+				(void) my_fclose(fp);
+				fp = NULL;
+			}
 			unlink(zp->z_ixfr_base);
 			goto cleanup;
 
 		case DBIXFR_FOUND_RR:
-				ns_debug(ns_log_default, 4, "ixfr_getdelta DBIXFR_FOUND_RR (%s)",
-					zp->z_origin);
+			ns_debug(ns_log_default, 4,
+				 "ixfr_getdelta DBIXFR_FOUND_RR (%s)",
+				 zp->z_origin);
 			if (EMPTY(*dlhead)) {
 				/* skip updates prior to the one we want */
 				uprec = HEAD(dl->d_changes);
 				INSIST(uprec != NULL);
-				if ((uprec->r_zone < from_serial) || 	
-					(uprec->r_zone > to_serial))  
+				if (SEQ_LT(uprec->r_zone, from_serial) || 	
+				    SEQ_GT(uprec->r_zone, to_serial))  
 				{
 					while ((uprec = HEAD(dl->d_changes)) != NULL) {
 						UNLINK(dl->d_changes, uprec, r_link);
 
 						if (uprec->r_dp != NULL)
-							db_freedata(uprec->r_dp);
-						uprec->r_dp = NULL;
+						      db_detach(&uprec->r_dp);
 						res_freeupdrec(uprec);
 					}
 					memput(dl, sizeof *dl);
@@ -174,7 +179,7 @@ ixfr_get_change_list(struct zoneinfo *zp,
 			UNLINK(dl->d_changes, uprec, r_link);
 
 			if (uprec->r_dp != NULL)
-				db_freedata(uprec->r_dp);
+				db_detach(&uprec->r_dp);
 			uprec->r_dp = NULL;
 			res_freeupdrec(uprec);
 		}
@@ -373,8 +378,9 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 	char            data[MAXDATA], dnbuf[MAXDNAME], sclass[3];
 	char           *dname, *cp, *cp1;
 	char            buf[MAXDATA];
-	u_int32_t       serial, ttl;
-	u_int32_t	current_serial;
+	long unsigned	lutmp;
+	u_int32_t       serial = 0, ttl;
+	u_int32_t	current_serial = 0;
 	int             nonempty_lineno = -1, prev_pktdone = 0, cont = 0,
 			inside_next = 0;
 	int             id;
@@ -384,7 +390,6 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 	enum transport  transport;
 	struct map     *mp;
 	int             zonelist[MAXDNAME];
-	struct databuf *dp;
 	struct in_addr  ina;
 	int             datasize;
 	ns_updrec *	rrecp;
@@ -395,7 +400,19 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 	err = 0;
 	transport = primary_trans;
 	lineno = 1;
+	zonenum = 0;
+
+	/*
+	 * Look for serial if "first" call othewise use new_serial to
+	 * for current_serial.
+	 */
+	if (*old_serial == *new_serial && *old_serial == 0)
+		current_serial = 0;
+	else
+		current_serial = *new_serial;
+
 	for (;;) {
+		dname = NULL;
 		if (!getword(buf, sizeof buf, fp, 0)) {
 			if (lineno == (nonempty_lineno + 1) && !(feof(fp))) {
 				/*
@@ -475,13 +492,15 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 		class = zp->z_class;
 		n = 0;
 		data[0] = '\0';
+		opcode = -1;
 		switch (section) {
 		case S_ZONE:
 			cp = fgets(buf, sizeof buf, fp);
 			if (!cp)
 				*buf = '\0';
 			n = sscanf(cp, "origin %s class %s serial %lu",
-				   origin, sclass, &serial);
+				   origin, sclass, &lutmp);
+			serial = lutmp;
 			if (current_serial == 0)
 				current_serial = serial;
 			else if (current_serial != serial) {
@@ -501,8 +520,7 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 
 				dname = origin;
 				type = T_SOA;
-				class = sym_ston(__p_class_syms, sclass,
-						 &success);
+				class = res_nametoclass(sclass, &success);
 				if (!success) {
 					err++;
 					break;
@@ -522,7 +540,6 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 				err++;
 				break;
 			}
-			opcode = -1;
 			if (buf[0] == '{') {
 				n = strlen(buf);
 				for (i = 0; (u_int32_t) i < n; i++)
@@ -567,8 +584,7 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 				int             success;
 				int             maybe_class;
 
-				maybe_class = sym_ston(__p_class_syms,
-						       buf, &success);
+				maybe_class = res_nametoclass(buf, &success);
 				if (success) {
 					class = maybe_class;
 					(void) getword(buf, sizeof buf, fp, 1);
@@ -579,8 +595,7 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 				int             success;
 				int             maybe_type;
 
-				maybe_type = sym_ston(__p_type_syms,
-						      buf, &success);
+				maybe_type = res_nametotype(buf, &success);
 
 				if (success) {
 					type = maybe_type;
@@ -817,7 +832,7 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 			case ns_t_nxt:
 			case ns_t_key:
 			case ns_t_cert:{
-				char *errmsg = NULL;
+				const char *errmsg = NULL;
 
 				n  = parse_sec_rdata(buf, sizeof(buf), 1,
 						     (u_char *) data,
@@ -833,7 +848,38 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 				break;
 			}
 			default:
-				err++;
+				if (strcmp(buf, "\\#") != 0) {
+					err++;
+					break;
+				}
+                                if (!getword(buf, sizeof buf, fp, 0) ||
+                                     !isdigit((unsigned char)buf[0])) {
+					err++;
+					break;
+				}
+                                n = strtoul(buf, &cp, 10);
+                                if (n > 0xffff || *cp != '\0') {
+					err++;
+					break;
+				}
+                                multiline = 0;
+                                i = isc_gethexstring((u_char *)data,
+						     sizeof(data), n, fp,
+						     &multiline);
+                                if (i == -1) {
+					err++;
+					break;
+				}
+                                if (multiline) {
+					c = getnonblank(fp, zp->z_updatelog, 1);
+					if (c != ')') {
+						ungetc(c, fp);
+						err++;
+						break;
+					}
+                                        multiline = 0;
+                                }
+				endline(fp);
 			}
 			if (section == S_PREREQ) {
 				ttl = 0;
@@ -880,6 +926,7 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 		}
 		rrecp = res_mkupdrec(section, dname, class, type, ttl);
 		if (section != S_ZONE) {
+			struct databuf *dp;
 			dp = savedata(class, type, ttl, (u_char *) data, n);
 			dp->d_zone = zonenum;
 			dp->d_cred = DB_C_ZONE;
@@ -904,13 +951,13 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 				      opcode == ADD) ||
 				     (opcode == DELETE &&
 				      arp->r_opcode == ADD)) &&
-				     arp->r_dp->d_type == dp->d_type &&
-				     arp->r_dp->d_class == dp->d_class &&
-				     arp->r_dp->d_ttl == dp->d_ttl &&
+				     arp->r_dp->d_type == rrecp->r_dp->d_type &&
+				     arp->r_dp->d_class == rrecp->r_dp->d_class &&
+				     arp->r_dp->d_ttl == rrecp->r_dp->d_ttl &&
 				     ns_samename(arp->r_dname, dname) == 1 &&
-				     db_cmp(arp->r_dp, dp) == 0) {
-					db_freedata(dp);
-					db_freedata(arp->r_dp);
+				     db_cmp(arp->r_dp, rrecp->r_dp) == 0) {
+					db_detach(&rrecp->r_dp);
+					db_detach(&arp->r_dp);
 					UNLINK(*listuprec, arp, r_link);
 					res_freeupdrec(arp);
 					res_freeupdrec(rrecp);
diff --git a/contrib/bind/bin/named/db_load.c b/contrib/bind/bin/named/db_load.c
index 87bdaed..12d0197 100644
--- a/contrib/bind/bin/named/db_load.c
+++ b/contrib/bind/bin/named/db_load.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_load.c	4.38 (Berkeley) 3/2/91";
-static const char rcsid[] = "$Id: db_load.c,v 8.113.2.1 2001/05/03 03:26:48 marka Exp $";
+static const char rcsid[] = "$Id: db_load.c,v 8.121 2001/11/12 21:22:22 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -130,6 +130,7 @@ static const char rcsid[] = "$Id: db_load.c,v 8.113.2.1 2001/05/03 03:26:48 mark
 #include <isc/eventlib.h>
 #include <isc/logging.h>
 #include <isc/memcluster.h>
+#include <isc/misc.h>
 
 #include "port_after.h"
 
@@ -149,15 +150,16 @@ static int		get_nxt_types(u_char *, FILE *, const char *);
 
 static int		parse_sig_rr(char *, int, u_char *, int, FILE *,  
 				     struct zoneinfo *, char *, u_int32_t ,
-				     enum context , enum transport , char **);
+				     enum context, enum transport,
+				     const char **);
 static int		parse_key_rr(char *, int, u_char *, int, FILE *, 
-				     struct zoneinfo *, char *, enum context, 
-				     enum transport, char **);
+				     const char **);
 
-static int		parse_cert_rr(char *, int, u_char *, int, FILE *, char **);
-static int		parse_nxt_rr(char *, int, u_char *, int, FILE *,
+static int		parse_cert_rr(char *, int, u_char *, int, FILE *,
+				      const char **);
+static int		parse_nxt_rr(char *, u_char *, int, FILE *,
 				     struct zoneinfo *, char *, enum context,
-				     enum transport, char **);
+				     enum transport, const char **);
 
 
 static int		wordtouint32_error = 0;
@@ -237,7 +239,7 @@ db_load(const char *filename, const char *in_origin,
 	char buf[MAXDATA];
 	char genlhs[MAXDNAME], genrhs[MAXDNAME];
 	u_char data[MAXDATA];
-	int data_size = sizeof(data);
+	unsigned int data_size = sizeof(data);
 	int c, someclass, class, type, dbflags, dataflags, multiline = 0;
 	int slineno, i, errs, didinclude, ininclude, escape, success;
 	u_int32_t ttl, n, serial;
@@ -404,7 +406,7 @@ db_load(const char *filename, const char *in_origin,
 				ERRTOZ("$GENERATE missing LHS");
 			if (!getword(buf, sizeof(buf), fp, 0))
 				ERRTOZ("GENERATE missing TYPE");
-			type = sym_ston(__p_type_syms, buf, &success);
+			type = res_nametotype(buf, &success);
 			if (success == 0 || type == ns_t_any) {
 				ns_info(ns_log_load,
 					"%s: Line %d: $GENERATE unknown type: %s.",
@@ -509,9 +511,10 @@ db_load(const char *filename, const char *in_origin,
 						  empty_from, &rrcount, lineno,
 						  filename);
 				if (c != OK) {
-					if (c == CNAMEANDOTHER)
+					if (c == CNAMEANDOTHER || c == NONGLUE)
 						errs++;
 				}
+				db_detach(&dp);
 			}
 			endline(fp);
 			continue;
@@ -578,7 +581,7 @@ db_load(const char *filename, const char *in_origin,
 			}
 
 			/* Parse class (IN, etc) */
-			someclass = sym_ston(__p_class_syms, buf, &success);
+			someclass = res_nametoclass(buf, &success);
 			if (success && someclass != zp->z_class) {
 				ns_info(ns_log_load,
 					"%s: Line %d: wrong class: %s.",
@@ -593,7 +596,7 @@ db_load(const char *filename, const char *in_origin,
 			}
 
 			/* Parse RR type (A, MX, etc) */
-			type = sym_ston(__p_type_syms, buf, &success);
+			type = res_nametotype(buf, &success);
 			if (success == 0 || type == ns_t_any) {
 				ns_info(ns_log_load,
 					"%s: Line %d: Unknown type: %s.",
@@ -635,8 +638,52 @@ db_load(const char *filename, const char *in_origin,
 			case ns_t_ptr:
 				escape = 1;
 				break;
-			default:
+			case ns_t_a:
+			case ns_t_md:
+			case ns_t_mf:
+			case ns_t_null:
+			case ns_t_hinfo:
+			case ns_t_mx:
+			case ns_t_txt:
+			case ns_t_afsdb:
+			case ns_t_x25:
+			case ns_t_isdn:
+			case ns_t_rt:
+			case ns_t_nsap:
+			case ns_t_nsap_ptr:
+			case ns_t_px:
+			case ns_t_gpos:
+			case ns_t_aaaa:
+			case ns_t_loc:
+			case ns_t_eid:
+			case ns_t_nimloc:
+			case ns_t_srv:
+			case ns_t_atma:
+			case ns_t_naptr:
+			case ns_t_kx:
+			case ns_t_dname:
+			case ns_t_sink:
+				escape = 0;
+				break;
+			case ns_t_opt:
+			case ns_t_tkey:
+			case ns_t_tsig:
+			case ns_t_ixfr:
+			case ns_t_axfr:
+			case ns_t_mailb:
+			case ns_t_maila:
+			case ns_t_any:
+			case ns_t_zxfr:
 				escape = 0;
+				ns_info(ns_log_load,
+					"%s: Line %d: meta type: %s.",
+					filename, lineno, p_type(type));
+				errs++;
+				break;
+			case ns_t_a6:	/* not implemented */
+			default:
+				escape = 1;
+				break;
 			}
 			if (!getword(buf, sizeof buf, fp, escape))
 				break;
@@ -710,7 +757,8 @@ db_load(const char *filename, const char *in_origin,
 					ns_notice(ns_log_load,
 			 "%s:%d: WARNING: new serial number < old (%lu < %lu)",
 						  filename , lineno,
-						  zp->z_serial, serial);
+						  (unsigned long)zp->z_serial,
+						  (unsigned long)serial);
 				}
 				if (getttl(fp, filename, lineno, &n,
 					   &multiline) <= 0) {
@@ -1004,7 +1052,7 @@ db_load(const char *filename, const char *in_origin,
 			case ns_t_key: 
 			case ns_t_cert:
 		        case ns_t_sig: {
-				char *errmsg = NULL;
+				const char *errmsg = NULL;
 				int ret;
 				if (ttl == USE_MINIMUM)	/* no ttl set */
 					ttl = 0;
@@ -1043,9 +1091,28 @@ db_load(const char *filename, const char *in_origin,
 				endline(fp);
 				break;
 
-
 			default:
-				goto err;
+				if (strcmp(buf, "\\#") != 0)
+					goto err;
+                                if (!getword(buf, sizeof buf, fp, 0) ||
+				     !isdigit((unsigned char)buf[0]))
+					ERRTO("opaque length");
+				n = strtoul(buf, &cp, 10);
+				if (n > 0xffff || *cp != '\0')
+					ERRTO("opaque length");
+				multiline = 0;
+				i = isc_gethexstring(data, sizeof(data), n, fp,
+						     &multiline);
+				if (i == -1)
+					ERRTO("opaque data read failed");
+				if (multiline) {
+					buf[0] = getnonblank(fp, filename, 1);
+					buf[1] = '\0';
+					if (buf[0] != ')')
+						ERRTO("\")\" expected");
+					multiline = 0;
+				}
+				endline(fp);
 			}
 			/*
 			 * Ignore data outside the zone.
@@ -1072,8 +1139,9 @@ db_load(const char *filename, const char *in_origin,
 					  &fcachetab : &hashtab, 
 					  empty_from, &rrcount, lineno,
 					  filename);
-			if (c == CNAMEANDOTHER)
+			if (c == CNAMEANDOTHER || c == NONGLUE)
 				errs++;
+			db_detach(&dp);
 			continue;
 
 		case ERRTOK:
@@ -1091,7 +1159,7 @@ db_load(const char *filename, const char *in_origin,
 			  (dataflags & DB_F_HINT) ? &fcachetab : &hashtab,
 			  empty_from, &rrcount, lineno, filename);
 	if (c != OK) {
-		if (c == CNAMEANDOTHER)
+		if (c == CNAMEANDOTHER || c == NONGLUE)
 			errs++;
 	}
 
@@ -1130,7 +1198,7 @@ db_load(const char *filename, const char *in_origin,
 		while (filenames) {
 			fn = filenames;
 			filenames = filenames->next;
-			freestr(fn->name);
+			fn->name = freestr(fn->name);
 			memput(fn, sizeof *fn);
 		}
 		if (errs != 0) {
@@ -1155,7 +1223,8 @@ db_load(const char *filename, const char *in_origin,
 		zp->z_ftime = 0;
 	}
 #ifdef BIND_NOTIFY
-	if (errs == 0 && (!ininclude) &&
+	if (errs == 0 && (!ininclude) && (initial_configuration == 0 ||
+	    !NS_OPTION_P(OPTION_SUPNOTIFY_INITIAL)) &&
 	    (zp->z_type == z_master || zp->z_type == z_slave))
 		ns_notify(zp->z_origin, zp->z_class, ns_t_soa);
 #endif
@@ -1332,6 +1401,7 @@ getword(char *buf, size_t size, FILE *fp, int preserve) {
 					if (preserve == 1)
 						break;
 				case '\\':
+				case '#':
 				case '.':
 				case '0':
 				case '1':
@@ -1994,7 +2064,7 @@ get_nxt_types(u_char *data, FILE *fp, const char *filename) {
 			continue;
 
 		/* Parse RR type (A, MX, etc) */
-		type = sym_ston(__p_type_syms, (char *)b, &success);
+		type = res_nametotype((char *)b, &success);
 		if ((!success) || type == ns_t_any) {
 			errs++;
 			ns_info(ns_log_db,
@@ -2064,7 +2134,8 @@ fixup_soa(const char *fn, struct zoneinfo *zp) {
 static int
 parse_sig_rr(char *buf, int buf_len, u_char *data, int data_size,
 	     FILE *fp, struct zoneinfo *zp, char *domain, u_int32_t ttl, 
-	     enum context domain_ctx, enum transport transport, char **errmsg)
+	     enum context domain_ctx, enum transport transport,
+	     const char **errmsg)
 {
 /* The SIG record looks like this in the db file:
    Name Cl SIG RRtype Algid [OTTL] Texp Tsig Kfoot Signer Sig
@@ -2097,7 +2168,7 @@ parse_sig_rr(char *buf, int buf_len, u_char *data, int data_size,
 	u_int32_t origTTL;
 	enum context context;
 	time_t now;
-	char *errtype = "SIG error";
+	const char *errtype = "SIG error";
 	int i, my_buf_size = MAXDATA, errs = 0;
 
 	
@@ -2122,7 +2193,7 @@ parse_sig_rr(char *buf, int buf_len, u_char *data, int data_size,
 	if (buf && buf_len == 0) 
 		if (!getmlword((char*)buf, my_buf_size, fp, 0))
 			ERRTO("SIG record doesn't specify type");
-	sig_type = sym_ston(__p_type_syms, buf, &success);
+	sig_type = res_nametotype(buf, &success);
 	if (!success || sig_type == ns_t_any) {
 		/*
 		 * We'll also accept a numeric RR type,
@@ -2324,9 +2395,9 @@ parse_sig_rr(char *buf, int buf_len, u_char *data, int data_size,
 }
 
 static int
-parse_nxt_rr(char *buf, int buf_len, u_char *data, int data_size,
-	     FILE *fp, struct zoneinfo *zp, char *domain, enum context context,
-	     enum transport transport, char **errmsg)
+parse_nxt_rr(char *buf, u_char *data, int data_size, FILE *fp,
+	     struct zoneinfo *zp, char *domain, enum context context,
+	     enum transport transport, const char **errmsg)
 {
 	
 	/* The NXT record looks like:
@@ -2364,7 +2435,7 @@ parse_nxt_rr(char *buf, int buf_len, u_char *data, int data_size,
 
 static int
 parse_cert_rr(char *buf, int buf_len, u_char *data, int data_size, 
-	      FILE *fp, char **errmsg)
+	      FILE *fp, const char **errmsg)
 {
 	/* Cert record looks like:
 	 *   Type Key_tag Alg Cert
@@ -2375,7 +2446,7 @@ parse_cert_rr(char *buf, int buf_len, u_char *data, int data_size,
 	 */
 	u_char *cp;
 	u_int32_t cert_type, key_tag, alg;
-	char *errtype = "CERT parse error";
+	const char *errtype = "CERT parse error";
 	int certlen, i, n, success;
 	
 	i = 0;
@@ -2386,6 +2457,8 @@ parse_cert_rr(char *buf, int buf_len, u_char *data, int data_size,
 		if (wordtouint32_error || cert_type > 0xFFFF)
 			ERRTO("CERT type out of range");
 	}
+	if (i + INT16SZ > data_size)
+		ERRTO("CERT no space");
 	PUTSHORT((u_int16_t)cert_type, cp);
 	i += INT16SZ;
 	
@@ -2396,6 +2469,8 @@ parse_cert_rr(char *buf, int buf_len, u_char *data, int data_size,
 	if (wordtouint32_error || key_tag > 0xFFFF)
 		ERRTO("CERT KEY tag out of range");
 	
+	if (i + INT16SZ > data_size)
+		ERRTO("CERT no space");
 	PUTSHORT((u_int16_t)key_tag, cp);
 	i += INT16SZ;
 	
@@ -2408,7 +2483,8 @@ parse_cert_rr(char *buf, int buf_len, u_char *data, int data_size,
 		if (wordtouint32_error || alg > 0xFF)
 			ERRTO("CERT KEY alg out of range");
 	}
-	
+	if (i + 1 > data_size)
+		ERRTO("CERT no space");
 	data[i++] = (u_char)alg;
 	
 	if (!getallwords(buf, buf_len, fp, 0)) {
@@ -2431,8 +2507,7 @@ parse_cert_rr(char *buf, int buf_len, u_char *data, int data_size,
 
 static int
 parse_key_rr(char *buf, int buf_len, u_char *data, int data_size,
-	     FILE *fp, struct zoneinfo *zp, char *domain, enum context context,
-	     enum transport transport, char **errmsg)
+	     FILE *fp, const char **errmsg)
 {
 	/* The KEY record looks like this in the db file:
 	 *	Name  Cl KEY Flags  Proto  Algid  PublicKeyData
@@ -2449,7 +2524,7 @@ parse_key_rr(char *buf, int buf_len, u_char *data, int data_size,
 	u_int32_t al, pr;
 	int nk, klen,i, n;
 	u_int32_t keyflags;
-	char *errtype = "KEY error";
+	const char *errtype = "KEY error";
 	u_char *cp, *expstart;
 	u_int expbytes, modbytes;
 
@@ -2636,7 +2711,7 @@ int
 parse_sec_rdata(char *buf, int buf_len, int buf_full, u_char *data,
 		int data_size, FILE *fp, struct zoneinfo *zp,
 		char *domain, u_int32_t ttl, int type, enum context context,
-		enum transport transport, char **errmsg)
+		enum transport transport, const char **errmsg)
 {
 	int ret = -1;
 
@@ -2653,11 +2728,10 @@ parse_sec_rdata(char *buf, int buf_len, int buf_full, u_char *data,
 				   domain, ttl, context, transport, errmsg);
 		break;
 	case ns_t_key:
-		ret = parse_key_rr(buf, buf_len, data, data_size, fp, zp,
-				   domain, context, transport, errmsg);
+		ret = parse_key_rr(buf, buf_len, data, data_size, fp, errmsg);
 		break;
 	case ns_t_nxt:
-		ret = parse_nxt_rr(buf, buf_len, data, data_size, fp, zp,
+		ret = parse_nxt_rr(buf, data, data_size, fp, zp,
 				   domain, context, transport, errmsg);
 		break;
 	case ns_t_cert:
@@ -2673,4 +2747,3 @@ parse_sec_rdata(char *buf, int buf_len, int buf_full, u_char *data,
 	endline(fp);
 	return (ret);
 }
-
diff --git a/contrib/bind/bin/named/db_lookup.c b/contrib/bind/bin/named/db_lookup.c
index 00b3d8d..77089da 100644
--- a/contrib/bind/bin/named/db_lookup.c
+++ b/contrib/bind/bin/named/db_lookup.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_lookup.c	4.18 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: db_lookup.c,v 8.26 2000/04/21 06:54:03 vixie Exp $";
+static const char rcsid[] = "$Id: db_lookup.c,v 8.27 2001/06/18 14:42:55 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -258,7 +258,7 @@ match(struct databuf *dp, int class, int type) {
 		return (0);
 	if (dp->d_type != type && dp->d_type != T_SIG && type != T_ANY)
 		return (0);
-	if (type != T_SIG && dp->d_type == T_SIG && SIG_COVERS(dp) != type)
+	if (type != T_SIG && dp->d_type == T_SIG && (int)SIG_COVERS(dp) != type)
 		return (0);
 	return (1);
 }
diff --git a/contrib/bind/bin/named/db_save.c b/contrib/bind/bin/named/db_save.c
index 2c8833c..2153e04 100644
--- a/contrib/bind/bin/named/db_save.c
+++ b/contrib/bind/bin/named/db_save.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_save.c	4.16 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: db_save.c,v 8.28 2000/11/29 06:55:48 marka Exp $";
+static const char rcsid[] = "$Id: db_save.c,v 8.29 2001/04/25 13:53:09 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -158,6 +158,10 @@ savedata(class, type, ttl, data, size)
 	dp->d_rcode = NOERROR;
 	dp->d_addr.s_addr = htonl(0);
 	dp->d_nstime = 0;
+	dp->d_rcnt = 1;
+#ifdef CHECK_MAGIC
+	dp->d_magic = DATABUF_MAGIC;
+#endif
 	memcpy(dp->d_data, data, dp->d_size);
 	return (dp);
 }
diff --git a/contrib/bind/bin/named/db_sec.c b/contrib/bind/bin/named/db_sec.c
index 9fb24fb..2d3425d 100644
--- a/contrib/bind/bin/named/db_sec.c
+++ b/contrib/bind/bin/named/db_sec.c
@@ -1,6 +1,6 @@
 
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: db_sec.c,v 8.32 2000/12/23 08:14:36 vixie Exp $";
+static const char rcsid[] = "$Id: db_sec.c,v 8.35 2001/06/18 14:42:57 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -139,7 +139,7 @@ static struct zpubkey *
 tree_srch_pubkey (const char *name) {
 	struct zpubkey tkey, *key;
 
-	tkey.zpk_name = (char *) name;
+	DE_CONST(name, tkey.zpk_name);
 	if (trusted_keys == NULL) {
 		tree_init(&trusted_keys);
 		return (NULL);
@@ -270,7 +270,7 @@ convert_databuf(struct databuf *dp, struct converted_databuf *cdp) {
 	    case ns_t_soa:
 	    case ns_t_minfo:
 	    case ns_t_rp:
-		if (eob - bp < strlen((char *)cp) + 1)
+		if (eob - bp < (int)strlen((char *)cp) + 1)
 			return (-1);
 		if (ns_name_pton((char *)cp, buf, sizeof buf) < 0)
 			return (-1);
@@ -280,7 +280,7 @@ convert_databuf(struct databuf *dp, struct converted_databuf *cdp) {
 		bp += len;
 		cp += strlen((char *)cp) + 1;
 
-		if (eob - bp < strlen((char *)cp) + 1)
+		if (eob - bp < (int)strlen((char *)cp) + 1)
 			return (-1);
 		if (ns_name_pton((char *)cp, buf, sizeof buf) < 0)
 			return (-1);
@@ -307,7 +307,7 @@ convert_databuf(struct databuf *dp, struct converted_databuf *cdp) {
 	    case ns_t_mr:
 	    case ns_t_ptr:
 	    case ns_t_nxt:
-		if (eob - bp < strlen((char *)cp) + 1)
+		if (eob - bp < (int)strlen((char *)cp) + 1)
 			return (-1);
 		if (ns_name_pton((char *)cp, buf, sizeof buf) < 0)
 			return (-1);
@@ -343,7 +343,7 @@ convert_databuf(struct databuf *dp, struct converted_databuf *cdp) {
 		bp += INT16SZ;
 		cp += INT16SZ;
 
-		if (eob - bp < strlen((char *)cp) + 1)
+		if (eob - bp < (int)strlen((char *)cp) + 1)
 			return (-1);
 		if (ns_name_pton((char *)cp, buf, sizeof buf) < 0)
 			return (-1);
@@ -354,7 +354,7 @@ convert_databuf(struct databuf *dp, struct converted_databuf *cdp) {
 		cp += strlen((char *)cp) + 1;
 
 		if (dp->d_type == ns_t_px) {
-			if (eob - bp < strlen((char *)cp) + 1)
+			if (eob - bp < (int)strlen((char *)cp) + 1)
 				return (-1);
 			if (ns_name_pton((char *)cp, buf, sizeof buf) < 0)
 				return (-1);
@@ -473,7 +473,7 @@ rrset_trim_sigs(struct db_rrset *rrset) {
 	}
 }
 
-int
+static int
 verify_set(struct db_rrset *rrset) {
 	DST_KEY *key = NULL;
 	struct sig_record *sigdata;
@@ -527,13 +527,13 @@ verify_set(struct db_rrset *rrset) {
 		 * Don't verify a set if the SIG inception time is in
 		 * the future.  This should be fixed before 2038 (BEW)
 		 */
-		if (ntohl(sigdata->sig_time_n) > now)
+		if ((time_t)ntohl(sigdata->sig_time_n) > now)
 			continue;
 
 		/* An expired set is dropped, but the data is not. */
-		if (ntohl(sigdata->sig_exp_n) < now) {
-			db_freedata(sigdp);
-			sigdn->dp = NULL;
+		if ((time_t)ntohl(sigdata->sig_exp_n) < now) {
+			db_detach(&sigdn->dp);
+			sigdp = NULL;
 			continue;
 		}
 
@@ -715,8 +715,8 @@ verify_set(struct db_rrset *rrset) {
 
 		if (ret < 0) {
 			dnssec_failed++;
-			db_freedata(sigdp);
-			sigdn->dp = NULL;
+			db_detach(&sigdn->dp);
+			sigdp = NULL;
 		}
 		else
 			dnssec_succeeded++;
@@ -746,40 +746,27 @@ end:
 }
 
 static void
-rrset_free_partial(struct db_rrset *rrset, int free_data, struct dnode *start) {
+rrset_free(struct db_rrset *rrset) {
 	struct dnode *dnp;
-	int found_start = 0;
 
 	ns_debug(ns_log_default, 5, "rrset_free(%s)", rrset->rr_name);
 
-	if (start == NULL)
-		found_start = 1;
-
 	while (rrset->rr_list) {
 		dnp = rrset->rr_list;
-		if (dnp == start)
-			found_start = 1;
 		rrset->rr_list = rrset->rr_list->dn_next;
-		if (dnp->dp != NULL && free_data == 1 && found_start == 1)
-			db_freedata(dnp->dp);
+		if (dnp->dp != NULL)
+			db_detach(&dnp->dp);
 		memput(dnp, sizeof(struct dnode));
 	}
 	while (rrset->rr_sigs) {
 		dnp = rrset->rr_sigs;
-		if (dnp == start)
-			found_start = 1;
 		rrset->rr_sigs = rrset->rr_sigs->dn_next;
-		if (dnp->dp != NULL && free_data == 1 && found_start == 1)
-			db_freedata(dnp->dp);
+		if (dnp->dp != NULL)
+			db_detach(&dnp->dp);
 		memput(dnp, sizeof(struct dnode));
 	}
 }
 
-static void
-rrset_free(struct db_rrset *rrset, int free_data) {
-	rrset_free_partial(rrset, free_data, NULL);
-}
-
 /*
  * This is called when we have an rrset with SIGs and no other data.
  * Returns 1 if we either found the necessary data or if the SIG can be added
@@ -838,7 +825,6 @@ rrset_db_update(struct db_rrset *rrset, int flags, struct hashbuf **htpp,
 		struct sockaddr_in from, int *rrcount)
 {
 	struct dnode *dnp;
-	struct databuf *dp;
 	int ret;
 
 	/* If we have any unattached SIG records that are DNSSEC signatures,
@@ -848,57 +834,51 @@ rrset_db_update(struct db_rrset *rrset, int flags, struct hashbuf **htpp,
 	 */ 
 	if (rrset->rr_list == NULL) {
 		if (attach_data(rrset) == 0) {
-			rrset_free(rrset, 1);
+			rrset_free(rrset);
 			return (OK);
 		}
 
 		if (rrset->rr_list != NULL &&
 		    verify_set(rrset) == DB_S_FAILED)
 		{
-			rrset_free(rrset, 1);
+			rrset_free(rrset);
 			return (OK);
 		}
 	}
 
 	for (dnp = rrset->rr_list; dnp != NULL; dnp = dnp->dn_next) {
-		dp = dnp->dp;
-		ret = db_update(rrset->rr_name, dp, dp, NULL,
+		ret = db_update(rrset->rr_name, dnp->dp, dnp->dp, NULL,
 				flags, (*htpp), from);
 		if (ret != OK) {
 			/* XXX Probably should do rollback.  */
-			db_err(ret, rrset->rr_name, dp->d_type,
+			db_err(ret, rrset->rr_name, dnp->dp->d_type,
 			       dnp->file, dnp->line);
 			if (ret != DATAEXISTS) {
-				rrset_free_partial(rrset, 1, dnp);
+				rrset_free(rrset);
 				return (ret);
 			}
-			db_freedata(dp);
 		}
 		if (rrcount != NULL)
 			(*rrcount)++;
-		dnp->dp = NULL;
 	}
 	for (dnp = rrset->rr_sigs; dnp != NULL; dnp = dnp->dn_next) {
-		dp = dnp->dp;
-		if (dp == NULL) /* verifyset() can remove sigs */
+		if (dnp->dp == NULL) /* verifyset() can remove sigs */
 			continue;
-		ret = db_update(rrset->rr_name, dp, dp, NULL,
+		ret = db_update(rrset->rr_name, dnp->dp, dnp->dp, NULL,
 				flags, (*htpp), from);
 		if (ret != OK) {
 			/* XXX Probably should do rollback.  */
-			db_err(ret, rrset->rr_name, dp->d_type,
+			db_err(ret, rrset->rr_name, dnp->dp->d_type,
 			       dnp->file, dnp->line);
 			if (ret != DATAEXISTS) {
-				rrset_free_partial(rrset, 1, dnp);
+				rrset_free(rrset);
 				return (ret);
 			}
-			db_freedata(dp);
 		}
 		if (rrcount != NULL)
 			(*rrcount)++;
-		dnp->dp = NULL;
 	}
-	rrset_free(rrset, 0);
+	rrset_free(rrset);
 	return (OK);
 }
 
@@ -927,7 +907,7 @@ add_to_rrset_list(struct db_rrset **rrsets, char *name, struct databuf *dp,
 	while (rrset != NULL) {
 		if (rrset->rr_type != ns_t_nxt || dp->d_type != ns_t_nxt) {
 			if (dp->d_type == ns_t_sig) {
-				if (SIG_COVERS(dp) == rrset->rr_type)
+				if ((int)SIG_COVERS(dp) == rrset->rr_type)
 					break;
 			} else {
 				if (dp->d_type == rrset->rr_type)
@@ -942,10 +922,7 @@ add_to_rrset_list(struct db_rrset **rrsets, char *name, struct databuf *dp,
 	if (rrset != NULL) {
 		if ((dp->d_type == ns_t_sig && rr_in_set(dp, rrset->rr_sigs)) ||
 		    (dp->d_type != ns_t_sig && rr_in_set(dp, rrset->rr_list)))
-		{
-			db_freedata(dp);
 			return (DATAEXISTS);
-		}
 	} else {
 		rrset = (struct db_rrset *) memget(sizeof(struct db_rrset));
 		if (rrset == NULL)
@@ -968,6 +945,7 @@ add_to_rrset_list(struct db_rrset **rrsets, char *name, struct databuf *dp,
 			 "add_to_rrset_list: memget failed(%s)", name);
 	memset(dnp, 0, sizeof(struct dnode));
 	dnp->dp = dp;
+	DRCNTINC(dnp->dp);
 	if (dp->d_type == ns_t_sig) {
 		if (rrset->rr_sigs != NULL) {
 			struct dnode *fdnp;
@@ -995,7 +973,7 @@ add_to_rrset_list(struct db_rrset **rrsets, char *name, struct databuf *dp,
 		} else
 			rrset->rr_list = dnp;
 	}
-	dnp->file = (char *) file;
+	dnp->file = file;
 	dnp->line = line;
 	return (0);
 }
@@ -1035,10 +1013,10 @@ update_rrset_list(struct db_rrset **rrsets, int flags, struct hashbuf **htpp,
 				result = tresult;
 		}
 		else {
-			rrset_free(rrset, 1);
+			rrset_free(rrset);
 			result = DNSSECFAIL;
 		}
-		freestr(rrset->rr_name);
+		rrset->rr_name = freestr(rrset->rr_name);
 		next = rrset->rr_next;
 		memput(rrset, sizeof(struct db_rrset));
 		rrset = next;
diff --git a/contrib/bind/bin/named/db_tsig.c b/contrib/bind/bin/named/db_tsig.c
index e8e81f9..5f7b670 100644
--- a/contrib/bind/bin/named/db_tsig.c
+++ b/contrib/bind/bin/named/db_tsig.c
@@ -1,6 +1,6 @@
 
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: db_tsig.c,v 8.6 2000/04/21 06:54:04 vixie Exp $";
+static const char rcsid[] = "$Id: db_tsig.c,v 8.7 2001/06/18 14:42:59 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -110,7 +110,7 @@ typedef struct {
 #define TSIG_ALG_MD5 "HMAC-MD5.SIG-ALG.REG.INT"
 #define TSIG_ALG_MD5_SHORT "hmac-md5"
 
-char *
+const char *
 tsig_alg_name(int value) {
 	if (value == KEY_HMAC_MD5)
 		return(TSIG_ALG_MD5);
diff --git a/contrib/bind/bin/named/db_update.c b/contrib/bind/bin/named/db_update.c
index d742fe9..494a0de 100644
--- a/contrib/bind/bin/named/db_update.c
+++ b/contrib/bind/bin/named/db_update.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_update.c	4.28 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: db_update.c,v 8.46 2001/02/08 02:05:51 marka Exp $";
+static const char rcsid[] = "$Id: db_update.c,v 8.50 2001/10/24 23:53:09 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -117,7 +117,7 @@ isRefByNS(const char *name, struct hashbuf *htp) {
 			     dp->d_class == C_HS) &&
 			    dp->d_type == T_NS &&
 			    !dp->d_rcode &&
-			    ns_samename(name, (char *)dp->d_data) == 1) {
+			    ns_samename(name, (const char *)dp->d_data) == 1) {
 				return (1);
 			}
 		}
@@ -227,7 +227,7 @@ db_update(const char *name,
 	struct databuf *tmpdp;
 #endif
 
-	ns_debug(ns_log_db, 3, "db_update(%s, %#x, %#x, %#x, 0%o, %#x)%s",
+	ns_debug(ns_log_db, 3, "db_update(%s, %p, %p, %p, 0%o, %p)%s",
 		 name, odp, newdp, savedpp, flags, htp,
 		 (odp && (odp->d_flags&DB_F_HINT)) ? " hint" : "");
 	np = nlookup(name, &htp, &fname, newdp != NULL);
@@ -267,9 +267,21 @@ db_update(const char *name,
 
 	if (newdp && zn && !(flags & DB_NOTAUTH)) {
 		if (nlabels(zones[zn].z_origin) > newdp->d_clev) {
-			ns_debug(ns_log_db, 5,
-				 "attempted update child zone %s, %s",
-				 zones[zn].z_origin, name);
+			if ((!ISVALIDGLUE(newdp) &&
+			    zones[newdp->d_zone].z_type == Z_PRIMARY) ||
+			    (newdp->d_type == T_NS &&
+			     !ns_samename(name, zones[zn].z_origin))) {
+				ns_info(ns_log_db,
+			  "domain %s %s record in zone %s should be in zone %s",
+				name, p_type(newdp->d_type),
+				zones[newdp->d_zone].z_origin,
+				zones[zn].z_origin);
+				return (NONGLUE);
+			} else
+				ns_debug(ns_log_db, 5,
+				       "attempted update child zone %s, %s %s",
+					 zones[zn].z_origin, name,
+					 p_type(newdp->d_type));
 			return (AUTH);
 		}
 	}
@@ -319,11 +331,10 @@ db_update(const char *name,
 			      dp, dp, NULL,
 			      (flags|DB_NOHINTS),
 			      fcachetab, from)
-		    != OK) {
+		    != OK)
 			ns_debug(ns_log_db, 3,
-				 "db_update: hint %#x freed", dp);
-			db_freedata(dp);
-		}
+				 "db_update: hint %p freed", dp);
+		db_detach(&dp);
         }
 
 	if (odp != NULL) {
@@ -749,7 +760,7 @@ db_update(const char *name,
 	 *	response source address here if flags&NOTAUTH.
 	 */
 	fixttl(newdp);
-	ns_debug(ns_log_db, 3, "db_update: adding%s %#x",
+	ns_debug(ns_log_db, 3, "db_update: adding%s %p",
 		 (newdp->d_flags&DB_F_HINT) ? " hint":"", newdp);
 
 	if (newdp->d_zone == DB_Z_CACHE &&
@@ -840,7 +851,8 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 	case T_MG:
 	case T_MR:
 		/* Only a domain name */
-		if (ns_samename((char *)dp1->d_data, (char *)dp2->d_data) == 1)
+		if (ns_samename((const char *)dp1->d_data,
+			        (const char *)dp2->d_data) == 1)
 			return (0);
 		else
 			return (1);
@@ -852,9 +864,9 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 		if (memcmp(dp1->d_data, dp2->d_data, NS_SIG_SIGNER))
 			return (1);
 		len = NS_SIG_SIGNER +
-			strlen((char *)dp1->d_data + NS_SIG_SIGNER);
-		if (ns_samename((char *)dp1->d_data + NS_SIG_SIGNER,
-				(char *)dp2->d_data + NS_SIG_SIGNER) != 1)
+			strlen((const char *)dp1->d_data + NS_SIG_SIGNER);
+		if (ns_samename((const char *)dp1->d_data + NS_SIG_SIGNER,
+				(const char *)dp2->d_data + NS_SIG_SIGNER) != 1)
 			return (1);
 		return (memcmp(dp1->d_data + len,
 			       dp2->d_data + len,
@@ -862,9 +874,10 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 
 	case T_NXT:
 		/* First a domain name, then binary data */
-		if (ns_samename((char *)dp1->d_data, (char *)dp2->d_data) != 1)
+		if (ns_samename((const char *)dp1->d_data,
+			        (const char *)dp2->d_data) != 1)
 			return (1);
-		len = strlen((char *)dp1->d_data)+1;
+		len = strlen((const char *)dp1->d_data)+1;
 		return (memcmp(dp1->d_data + len,
 			       dp2->d_data + len,
 			       dp1->d_size - len));
@@ -877,7 +890,7 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 		len2 = *cp2;
 		if (len != len2)
                       return (1);
-		if (strncasecmp((char *)++cp1, (char *)++cp2, len))
+		if (strncasecmp((const char *)++cp1, (const char *)++cp2, len))
 			return (1);
 		cp1 += len;
 		cp2 += len;
@@ -885,21 +898,23 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 		len2 = *cp2;
 		if (len != len2)
                       return (1);
-		return (strncasecmp((char *)++cp1, (char *)++cp2, len));
+		return (strncasecmp((const char *)++cp1, (const char *)++cp2,
+				    len));
 
 	case T_SOA:
 	case T_MINFO:
 	case T_RP:
-		if (ns_samename((char *)dp1->d_data, (char *)dp2->d_data) != 1)
+		if (ns_samename((const char *)dp1->d_data,
+			        (const char *)dp2->d_data) != 1)
 			return (1);
-		cp1 = dp1->d_data + strlen((char *)dp1->d_data) + 1;
-		cp2 = dp2->d_data + strlen((char *)dp2->d_data) + 1;
-		if (ns_samename((char *)cp1, (char *)cp2) != 1)
+		cp1 = dp1->d_data + strlen((const char *)dp1->d_data) + 1;
+		cp2 = dp2->d_data + strlen((const char *)dp2->d_data) + 1;
+		if (ns_samename((const char *)cp1, (const char *)cp2) != 1)
 			return (1);
 		if (dp1->d_type != T_SOA)
 			return (0);
-		cp1 += strlen((char *)cp1) + 1;
-		cp2 += strlen((char *)cp2) + 1;
+		cp1 += strlen((const char *)cp1) + 1;
+		cp2 += strlen((const char *)cp2) + 1;
 		return (memcmp(cp1, cp2, INT32SZ * 5));
 	
 	case T_NAPTR: {
@@ -937,7 +952,7 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 		cp1 += t1; cp2 += t2;
 
 		/* Replacement */
-		if (ns_samename((char *)cp1, (char *)cp2) != 1)
+		if (ns_samename((const char *)cp1, (const char *)cp2) != 1)
 			return (1);
 
 		/* they all checked out! */
@@ -958,7 +973,7 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 			if (*cp1++ != *cp2++ || *cp1++ != *cp2++) /* port */
 				return (1);
 		}
-		if (ns_samename((char *)cp1, (char *)cp2) != 1)
+		if (ns_samename((const char *)cp1, (const char *)cp2) != 1)
 			return (1);
 		return (0);
 
@@ -967,11 +982,11 @@ db_cmp(const struct databuf *dp1, const struct databuf *dp2) {
 		cp2 = dp2->d_data;
 		if (*cp1++ != *cp2++ || *cp1++ != *cp2++)       /* cmp prio */
 			return (1);
-		if (ns_samename((char *)cp1, (char *)cp2) != 1)
+		if (ns_samename((const char *)cp1, (const char *)cp2) != 1)
 			return (1);
-		cp1 += strlen((char *)cp1) + 1;
-		cp2 += strlen((char *)cp2) + 1;
-		if (ns_samename((char *)cp1, (char *)cp2) != 1)
+		cp1 += strlen((const char *)cp1) + 1;
+		cp2 += strlen((const char *)cp2) + 1;
+		if (ns_samename((const char *)cp1, (const char *)cp2) != 1)
 			return (1);
 		return (0);
 	
diff --git a/contrib/bind/bin/named/named.conf b/contrib/bind/bin/named/named.conf
index d423b34..08ef27d 100644
--- a/contrib/bind/bin/named/named.conf
+++ b/contrib/bind/bin/named/named.conf
@@ -14,6 +14,16 @@
 
 // watch out for ";" -- it's important!
 
+key sample_key {			// for TSIG
+	algorithm hmac-md5;		// hmac-md5 is the supported algorithm
+	secret "abcdefgh";		// base 64 encoded secret
+};
+
+key key2 {
+	algorithm hmac-md5;
+	secret "87654321";
+};
+
 options {
 	directory ".";			// use current directory
 	named-xfer "/usr/libexec/named-xfer";	// _PATH_XFER
@@ -42,7 +52,7 @@ options {
 					// notify on a zone-by-zone
 					// basis in the "zone" statement
 					// see (below)
-	max-serial-queries 4;		// number of parallel SOA queries
+	serial-queries 4;		// number of parallel SOA queries
 					// we can have outstanding for master
 					// zone change testing purposes
 	auth-nxdomain yes;		// always set AA on NXDOMAIN.
@@ -194,7 +204,7 @@ zone "slave.demo.zone" {
 	ixfr-base  "slave.demo.zone.ixfr";  // File name for IXFR transaction log file
 	masters {
 		1.2.3.4;		// where to zone transfer from
-		5.6.7.8;
+		5.6.7.8 key key2;
 	};
 	transfer-source 10.0.0.53;	// fixes multihoming problems
 	check-names warn;
@@ -250,16 +260,6 @@ zone "non-default-acl.demo.zone" {
 	};
 };
 
-key sample_key {			// for TSIG
-	algorithm hmac-md5;		// hmac-md5 is the supported algorithm
-	secret "abcdefgh";		// base 64 encoded secret
-};
-
-key key2 {
-	algorithm hmac-md5;
-	secret "87654321";
-};
-
 acl key_acl { key sample_key; };	// a request signed with sample_key
 
 server 1.2.3.4 {
diff --git a/contrib/bind/bin/named/named.h b/contrib/bind/bin/named/named.h
index 29a79fa..023767c 100644
--- a/contrib/bind/bin/named/named.h
+++ b/contrib/bind/bin/named/named.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: named.h,v 8.28 2001/02/12 05:56:15 marka Exp $
+ * $Id: named.h,v 8.31 2002/02/01 00:05:38 marka Exp $
  */
 
 /* Options. Change them at your peril. */
@@ -28,7 +28,7 @@
 #define TRACEROOT
 #define XFRNETS
 #define QRYLOG
-#define YPKLUDGE
+#undef YPKLUDGE
 #define	RENICE
 #define BIND_IXFR
 #define BIND_NOTIFY
@@ -45,6 +45,8 @@
 #define STRICT_RFC2308
 #undef BIND_ZXFR
 #undef LOG_TSIG_BUG
+#define NOADDITIONAL
+#undef FORWARD_ALLOWS	/* enable allow-query for forward zones. */
 
 #include <isc/assertions.h>
 #include <isc/list.h>
diff --git a/contrib/bind/bin/named/ns_config.c b/contrib/bind/bin/named/ns_config.c
index c4bca96..2d59a62 100644
--- a/contrib/bind/bin/named/ns_config.c
+++ b/contrib/bind/bin/named/ns_config.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_config.c,v 8.121 2001/02/08 02:05:53 marka Exp $";
+static const char rcsid[] = "$Id: ns_config.c,v 8.133 2002/02/01 00:05:39 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -89,7 +89,6 @@ static int default_logging_installed;
 static int options_installed = 0;
 static int logging_installed = 0;
 static int default_options_installed;
-static int initial_configuration = 1;
 
 static char **logging_categories;
 static char *current_pid_filename = NULL;
@@ -102,7 +101,7 @@ static symbol_table zone_symbol_table;
 void
 free_zone_timerinfo(struct zoneinfo *zp) {
 	if (zp->z_timerinfo != NULL) {
-		freestr(zp->z_timerinfo->name);
+		zp->z_timerinfo->name = freestr(zp->z_timerinfo->name);
 		memput(zp->z_timerinfo, sizeof *zp->z_timerinfo);
 		zp->z_timerinfo = NULL;
 	} else
@@ -125,17 +124,13 @@ free_zone_contents(struct zoneinfo *zp, int undefine_sym) {
 				 strerror(errno));
 	}
 	if (zp->z_origin != NULL)
-		freestr(zp->z_origin);
-	zp->z_origin = NULL;
+		zp->z_origin = freestr(zp->z_origin);
 	if (zp->z_source != NULL)
-		freestr(zp->z_source);
-	zp->z_source = NULL;
+		zp->z_source = freestr(zp->z_source);
 	if (zp->z_ixfr_base != NULL)
-		freestr(zp->z_ixfr_base);
-	zp->z_ixfr_base = NULL;
+		zp->z_ixfr_base = freestr(zp->z_ixfr_base);
 	if (zp->z_ixfr_tmp != NULL)
-		freestr(zp->z_ixfr_tmp);
-	zp->z_ixfr_tmp = NULL;
+		zp->z_ixfr_tmp = freestr(zp->z_ixfr_tmp);
 	if (zp->z_update_acl != NULL)
 		free_ip_match_list(zp->z_update_acl);
 	zp->z_update_acl = NULL;
@@ -147,8 +142,7 @@ free_zone_contents(struct zoneinfo *zp, int undefine_sym) {
 	zp->z_transfer_acl = NULL;
 #ifdef BIND_UPDATE
 	if (zp->z_updatelog != NULL)
-		freestr(zp->z_updatelog);
-	zp->z_updatelog = NULL;
+		zp->z_updatelog = freestr(zp->z_updatelog);
 #endif /* BIND_UPDATE */
 #ifdef BIND_NOTIFY
 	if (zp->z_also_notify != NULL)
@@ -156,6 +150,9 @@ free_zone_contents(struct zoneinfo *zp, int undefine_sym) {
 		       zp->z_notify_count * sizeof *zp->z_also_notify);
 	zp->z_also_notify = NULL;
 #endif
+	if (zp->z_fwdtab != NULL)
+		free_forwarders(zp->z_fwdtab);
+	zp->z_fwdtab = NULL;
 	block_signals();
 	if (LINKED(zp, z_reloadlink))
 		UNLINK(reloadingzones, zp, z_reloadlink);
@@ -189,7 +186,7 @@ find_zone(const char *name, int class) {
 }
 
 static struct zoneinfo *
-new_zone(int class, int type) {
+new_zone(void) {
 	struct zoneinfo *zp;
 
 	if (EMPTY(freezones))
@@ -303,9 +300,16 @@ validate_zone(struct zoneinfo *zp) {
 	if (zp->z_query_acl) {
 		if (zp->z_type != z_master &&
 		    zp->z_type != z_slave &&
+#ifdef FORWARD_ALLOWS
+		    zp->z_type != z_forward &&
+#endif
 		    zp->z_type != z_stub) {
 			ns_error(ns_log_config,
+#ifdef FORWARD_ALLOWS
+		  "'allow-query' option for hint zone '%s'",
+#else
 		  "'allow-query' option for non-{master,slave,stub} zone '%s'",
+#endif
 				 zp->z_origin);
 			return (0);
 		}
@@ -472,7 +476,7 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 	 * any data that was dynamically allocated.
 	 */
 	if (zp->z_origin != NULL)
-		freestr(zp->z_origin);
+		(void)freestr(zp->z_origin);
 	zp->z_origin = new_zp->z_origin;
 	new_zp->z_origin = NULL;
 	zp->z_maintain_ixfr_base = new_zp->z_maintain_ixfr_base;
@@ -480,8 +484,10 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 	zp->z_class = new_zp->z_class;
 	zp->z_type = new_zp->z_type;
 	zp->z_checknames = new_zp->z_checknames;
-	for (i = 0; i < new_zp->z_addrcnt; i++)
+	for (i = 0; i < new_zp->z_addrcnt; i++) {
 		zp->z_addr[i] = new_zp->z_addr[i];
+		zp->z_keys[i] = new_zp->z_keys[i];
+	}
 	zp->z_addrcnt = new_zp->z_addrcnt;
 	if (zp->z_update_acl)
 		free_ip_match_list(zp->z_update_acl);
@@ -529,7 +535,7 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 	zp->z_dumpintvl = new_zp->z_dumpintvl;
 	zp->z_deferupdcnt = new_zp->z_deferupdcnt;
 	if (zp->z_updatelog)
-		freestr(zp->z_updatelog);
+		(void)freestr(zp->z_updatelog);
 	zp->z_updatelog = new_zp->z_updatelog;
 	new_zp->z_updatelog = NULL;
 #endif /* BIND_UPDATE */
@@ -554,7 +560,7 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 
 		/* File has changed, or hasn't been loaded yet. */
 		if (zp->z_source) {
-			freestr(zp->z_source);
+			zp->z_source = freestr(zp->z_source);
 			ns_stopxfrs(zp);
 			purge_zone(zp->z_origin, fcachetab, zp->z_class);
 		}
@@ -562,12 +568,12 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 		new_zp->z_source = NULL;
 
 		if (zp->z_ixfr_base)
-			freestr(zp->z_ixfr_base);
+			(void)freestr(zp->z_ixfr_base);
 		zp->z_ixfr_base = new_zp->z_ixfr_base;
 		new_zp->z_ixfr_base = NULL;	
 
 		if (zp->z_ixfr_tmp)
-			freestr(zp->z_ixfr_tmp);
+			(void)freestr(zp->z_ixfr_tmp);
 		zp->z_ixfr_tmp = new_zp->z_ixfr_tmp;
 		new_zp->z_ixfr_tmp = NULL;	
 
@@ -597,17 +603,17 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 	primary_reload:
 #endif /* BIND_UPDATE */
 		if (zp->z_source != NULL)
-			freestr(zp->z_source);
+			(void)freestr(zp->z_source);
 		zp->z_source = new_zp->z_source;
 		new_zp->z_source = NULL;
 
 		if (zp->z_ixfr_base != NULL)
-			freestr(zp->z_ixfr_base);
+			(void)freestr(zp->z_ixfr_base);
 		zp->z_ixfr_base = new_zp->z_ixfr_base;
 		new_zp->z_ixfr_base = NULL;
 
 		if (zp->z_ixfr_tmp != NULL)
-			freestr(zp->z_ixfr_tmp);
+			(void)freestr(zp->z_ixfr_tmp);
 		zp->z_ixfr_tmp = new_zp->z_ixfr_tmp;
 		new_zp->z_ixfr_tmp = NULL;
 
@@ -649,8 +655,7 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 		     ((!reconfiging) && zonefile_changed_p(zp)))) {
 			ns_debug(ns_log_config, 1,
 				 "backup file changed or missing");
-			freestr(zp->z_source);
-			zp->z_source = NULL;
+			zp->z_source = freestr(zp->z_source);
 			zp->z_serial = 0;	/* force xfer */
 			ns_stopxfrs(zp);
 			/*
@@ -674,7 +679,7 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 		}
 
 		if (zp->z_ixfr_base != NULL)
-			freestr(zp->z_ixfr_base);
+			(void)freestr(zp->z_ixfr_base);
 		zp->z_ixfr_base = new_zp->z_ixfr_base;
 		new_zp->z_ixfr_base = NULL;
 
@@ -727,7 +732,7 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 void
 end_zone(zone_config zh, int should_install) {
 	struct zoneinfo *zp, *new_zp;
-	char *zname;
+	const char *zname;
 	symbol_value value;
 
 	new_zp = zh.opaque;
@@ -753,11 +758,11 @@ end_zone(zone_config zh, int should_install) {
 		zp = NULL;
 	}
 	if (zp == NULL) {
-		zp = new_zone(new_zp->z_class, new_zp->z_type);
+		zp = new_zone();
 		INSIST(zp != NULL);
 		value.integer = (zp - zones);
-		define_symbol(zone_symbol_table, savestr(new_zp->z_origin, 1),
-			      new_zp->z_class, value, SYMBOL_FREE_KEY);
+		define_symbol(zone_symbol_table, new_zp->z_origin,
+			      new_zp->z_class, value, 0);
 	}
 	ns_debug(ns_log_config, 5, "zone '%s', type = %d, class = %d", zname,
 		 new_zp->z_type, new_zp->z_class);
@@ -930,7 +935,7 @@ set_zone_query_acl(zone_config zh, ip_match_list iml) {
 	zp = zh.opaque;
 	INSIST(zp != NULL);
 
-	/* Fail if checknames already set for this zone */
+	/* Fail if allow-query acl already set for this zone */
 	if (zp->z_query_acl != NULL)
 		return (0);
 	zp->z_query_acl = iml;
@@ -960,7 +965,7 @@ set_zone_transfer_acl(zone_config zh, ip_match_list iml) {
 	zp = zh.opaque;
 	INSIST(zp != NULL);
 
-	/* Fail if checknames already set for this zone */
+	/* Fail if allow-transfer acl already set for this zone */
 	if (zp->z_transfer_acl != NULL)
 		return (0);
 	zp->z_transfer_acl = iml;
@@ -974,7 +979,7 @@ set_zone_transfer_time_in(zone_config zh, long max_time) {
 	zp = zh.opaque;
 	INSIST(zp != NULL);
 
-	/* Fail if checknames already set for this zone */
+	/* Fail if max-transfer-time-in already set for this zone */
 	if (zp->z_max_transfer_time_in)
 		return (0);
 	zp->z_max_transfer_time_in = max_time;
@@ -1013,13 +1018,14 @@ set_trusted_key(const char *name, const int flags, const int proto,
 }
 
 int
-add_zone_master(zone_config zh, struct in_addr address) {
+add_zone_master(zone_config zh, struct in_addr address, struct dst_key * key) {
 	struct zoneinfo *zp;
 
 	zp = zh.opaque;
 	INSIST(zp != NULL);
 
 	zp->z_addr[zp->z_addrcnt] = address;
+	zp->z_keys[zp->z_addrcnt] = key;
 	zp->z_addrcnt++;
 	if (zp->z_addrcnt >= NSMAX) {
 		ns_warning(ns_log_config, "NSMAX reached for zone '%s'",
@@ -1084,12 +1090,17 @@ add_zone_notify(zone_config zh, struct in_addr address) {
 options
 new_options() {
 	options op;
+	char hostname[256];
 
 	op = (options)memget(sizeof (struct options));
 	if (op == NULL)
 		panic("memget failed in new_options()", NULL);
 
 	op->version = savestr(ShortVersion, 1);
+	if (gethostname(hostname, sizeof(hostname)) == 0)
+		op->hostname = savestr(hostname, 1);
+	else
+		op->hostname = NULL;
 	op->directory = savestr(".", 1);
 	op->pid_filename = savestr(_PATH_PIDFILE, 1);
 	op->named_xfer = savestr(_PATH_XFER, 1);
@@ -1136,8 +1147,9 @@ new_options() {
 	op->max_host_stats = 0;
 	op->lame_ttl = NTTL;
 	op->heartbeat_interval = 3600;
-	op->max_log_size_ixfr = 20;
+	op->max_log_size_ixfr = 0;
 	op->minroots = MINROOTS;
+	op->preferred_glue = 0;
 	return (op);
 }
 
@@ -1145,20 +1157,22 @@ void
 free_options(options op) {
 	INSIST(op != NULL);
 
+	if (op->hostname)
+		op->hostname = freestr(op->hostname);
 	if (op->version)
-		freestr(op->version);
+		op->version = freestr(op->version);
 	if (op->directory)
-		freestr(op->directory);
+		op->directory = freestr(op->directory);
 	if (op->pid_filename)
-		freestr(op->pid_filename);
+		op->pid_filename = freestr(op->pid_filename);
 	if (op->named_xfer)
-		freestr(op->named_xfer);
+		op->named_xfer = freestr(op->named_xfer);
 	if (op->dump_filename)
-		freestr(op->dump_filename);
+		op->dump_filename = freestr(op->dump_filename);
 	if (op->stats_filename)
-		freestr(op->stats_filename);
+		op->stats_filename = freestr(op->stats_filename);
 	if (op->memstats_filename)
-		freestr(op->memstats_filename);
+		op->memstats_filename = freestr(op->memstats_filename);
 #ifdef BIND_NOTIFY
 	if (op->also_notify)
 		free_also_notify(op);
@@ -1197,6 +1211,7 @@ set_boolean_option(u_int *op_flags, int bool_opt, int value) {
 	case OPTION_FORWARD_ONLY:
 	case OPTION_FAKE_IQUERY:
 	case OPTION_NONOTIFY:
+	case OPTION_SUPNOTIFY_INITIAL:
 	case OPTION_NONAUTH_NXDOMAIN:
 	case OPTION_MULTIPLE_CNAMES:
 	case OPTION_USE_IXFR:
@@ -1290,7 +1305,7 @@ ns_rlimit(enum limit limit, u_long limit_value) {
 	struct rlimit limits, old_limits;
 	int rlimit = -1;
 	int fdlimit = evHighestFD(ev) + 1;
-	char *name;
+	const char *name;
 	rlimit_type value;
 
 	if (limit_value == ULONG_MAX) {
@@ -1337,7 +1352,7 @@ ns_rlimit(enum limit limit, u_long limit_value) {
 		name = "max number of open files";
 		if (value == 0)
 			limits = initial_num_files;
-		if (value > fdlimit)
+		if ((int)value > fdlimit)
 			limits.rlim_cur = limits.rlim_max = value = fdlimit;
 		break;
 	default:
@@ -1455,8 +1470,10 @@ write_open(char *filename) {
 		return (NULL);
 	(void) fchown(fd, user_id, group_id);
 	stream = fdopen(fd, "w");
-	if (stream == NULL)
+	if (stream == NULL) {
+		(void)unlink(filename);
 		(void)close(fd);
+	}
 	return (stream);
 }
 
@@ -1470,8 +1487,7 @@ update_pid_file() {
 	/* XXX */ ns_debug(ns_log_default, 1, "update_pid_file()");
 	if (current_pid_filename != NULL) {
 		(void)unlink(current_pid_filename);
-		freestr(current_pid_filename);
-		current_pid_filename = NULL;
+		current_pid_filename = freestr(current_pid_filename);
 	}
 	current_pid_filename = savestr(server_options->pid_filename, 0);
 	if (current_pid_filename == NULL) {
@@ -1521,6 +1537,11 @@ static void
 periodic_getnetconf(evContext ctx, void *uap, struct timespec due,
 		    struct timespec inter)
 {
+	UNUSED(ctx);
+	UNUSED(uap);
+	UNUSED(due);
+	UNUSED(inter);
+
 	getnetconf(1);
 }
 
@@ -1709,11 +1730,11 @@ use_default_options() {
  * rrset order types
  */
 static struct res_sym order_table [] = {
-	{ unknown_order, " unknown " }, /* can't match */
-	{ fixed_order, "fixed" },
-	{ cyclic_order, "cyclic" },
-	{ random_order, "random" },
-	{ unknown_order, NULL }
+	{ unknown_order, " unknown ", NULL }, /* can't match */
+	{ fixed_order, "fixed", NULL },
+	{ cyclic_order, "cyclic", NULL },
+	{ random_order, "random", NULL },
+	{ unknown_order, NULL, NULL }
 };
 
 /*
@@ -1759,7 +1780,7 @@ free_rrset_order_list(rrset_order_list rol) {
 
 	for (roe = rol->first; roe != NULL; roe = next_element) {
 		next_element = roe->next;
-		freestr(roe->name);
+		roe->name = freestr(roe->name);
 		memput(roe, sizeof (*roe));
 	}
 	memput(rol, sizeof (*rol));
@@ -1778,6 +1799,7 @@ add_to_rrset_order_list(rrset_order_list rol, rrset_order_element roe) {
 		rol->first = roe;
 }
 
+#ifdef notyet
 /* XXX this isn't being used yet, but it probably should be. Where? */
 void
 dprint_rrset_order_list(int category, rrset_order_list rol, int indent,
@@ -1799,7 +1821,7 @@ dprint_rrset_order_list(int category, rrset_order_list rol, int indent,
 			 roe->name, p_order(roe->order));
 	}
 }
-
+#endif
 
 rrset_order_element
 new_rrset_order_element(int class, int type, char *name, enum ordering order)
@@ -1986,7 +2008,7 @@ add_to_ip_match_list(ip_match_list iml, ip_match_element ime) {
 
 void
 dprint_ip_match_list(int category, ip_match_list iml, int indent,
-		     char *allow, char *deny) {
+		     const char *allow, const char *deny) {
 	ip_match_element ime;
 	char spaces[40+1];
 	char addr_text[sizeof "255.255.255.255"];
@@ -2083,6 +2105,7 @@ ip_match_addr_or_key(ip_match_list iml, struct in_addr address,
 					continue;
 			}
 		default:
+			indirect = 0;
 			panic("unexpected ime type in ip_match_addr_or_key()",
 			      NULL);
 		}
@@ -2278,7 +2301,6 @@ find_forwarder(struct in_addr address)
 {
 	struct fwddata *fdp;
 	struct fwddata **fdpp = NULL;
-	struct databuf *ns, *nsdata;
 	register int i;
 
 	for (i = 0; i < fwddata_count; i++) {
@@ -2299,28 +2321,19 @@ find_forwarder(struct in_addr address)
 	if (!fdp)
 		panic("memget failed in find_forwarder", NULL);
 
+	memset(&fdp->fwdaddr, 0, sizeof(fdp->fwdaddr));
 	fdp->fwdaddr.sin_family = AF_INET;
 	fdp->fwdaddr.sin_addr = address;
 	fdp->fwdaddr.sin_port = ns_port;
 
-	ns = fdp->ns = (struct databuf *)memget(sizeof(*ns));
-	if (!ns)
+	fdp->ns = savedata(C_IN, T_NS, 0, NULL, 0);
+	if (!fdp->ns)
 		panic("memget failed in find_forwarder", NULL);
-	memset(ns, 0, sizeof(*ns));
 
-	nsdata = fdp->nsdata = (struct databuf *)memget(sizeof(*nsdata));
-	if (!nsdata)
+	fdp->nsdata = savedata(C_IN, T_A, 0, NULL, 0);
+	if (!fdp->nsdata)
 		panic("memget failed in find_forwarder", NULL);
-	memset(nsdata, 0, sizeof(*nsdata));
-
-	ns->d_type = T_NS; 
-	ns->d_class = C_IN;
-	ns->d_rcnt = 1;
-
-	nsdata->d_type = T_A;
-	nsdata->d_class = C_IN;
-	nsdata->d_nstime = 1 + (int)(25.0*rand()/(RAND_MAX + 1.0));
-	nsdata->d_rcnt = 1;
+	fdp->nsdata->d_nstime = 1 + (int)(25.0*rand()/(RAND_MAX + 1.0));
 
 	fdp->ref_count = 1;
 
@@ -2480,7 +2493,7 @@ set_zone_forward(zone_config zh) {
 void
 add_zone_forwarder(zone_config zh, struct in_addr address) {
 	struct zoneinfo *zp;
-	char *zname;
+	const char *zname;
 
 	zp = zh.opaque;
 	INSIST(zp != NULL);
@@ -2507,9 +2520,8 @@ free_forwarders(struct fwdinfo *fwdtab) {
 					fwddata[i] = NULL;
 					break;
 				}
-			memput(ftp->fwddata->ns, sizeof *ftp->fwddata->ns);
-			memput(ftp->fwddata->nsdata,
-					sizeof *ftp->fwddata->nsdata);
+			db_detach(&ftp->fwddata->ns);
+			db_detach(&ftp->fwddata->nsdata);
 			memput(ftp->fwddata, sizeof *ftp->fwddata);
 		}
 		memput(ftp, sizeof *ftp);
@@ -2543,7 +2555,8 @@ new_server(struct in_addr address) {
 
 static void
 free_server(server_info si) {
-	/* Don't free key; it'll be done when the auth table is freed. */
+	if (si->key_list)
+		free_key_info_list(si->key_list);
 	memput(si, sizeof *si);
 }
 
@@ -2999,7 +3012,7 @@ use_default_logging() {
 static void
 init_default_log_channels() {
 	u_int flags;
-	char *name;
+	const char *name;
 	FILE *stream;
 
 	syslog_channel = log_new_syslog_channel(0, log_info, ISC_FACILITY);
@@ -3072,7 +3085,8 @@ shutdown_logging() {
 	log_free_context(log_ctx);
 
 	for (s = category_constants; s != NULL && s->name != NULL; s++)
-		freestr(logging_categories[s->number]);
+		logging_categories[s->number] =
+			freestr(logging_categories[s->number]);
 	size = ns_log_max_category * (sizeof (char *));
 	memput(logging_categories, size);
 	logging_categories = NULL;
@@ -3108,11 +3122,15 @@ shutdown_configuration() {
 		server_options = NULL;
 	}
 	if (current_pid_filename != NULL)
-		freestr(current_pid_filename);
+		current_pid_filename = freestr(current_pid_filename);
 	free_nameserver_info();
 	free_secretkey_info();
 	free_symbol_table(zone_symbol_table);
 	parser_shutdown();
+	if (fwddata != NULL)
+		memput(fwddata, fwddata_count * sizeof *fwddata);
+	fwddata = NULL;
+	fwddata_count = 0;
 	config_initialized = 0;
 }
 
diff --git a/contrib/bind/bin/named/ns_ctl.c b/contrib/bind/bin/named/ns_ctl.c
index 1950b07..ee77634 100644
--- a/contrib/bind/bin/named/ns_ctl.c
+++ b/contrib/bind/bin/named/ns_ctl.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_ctl.c,v 8.39 2000/12/19 23:31:38 marka Exp $";
+static const char rcsid[] = "$Id: ns_ctl.c,v 8.46 2001/12/19 11:53:48 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -91,55 +91,56 @@ static void		propagate_changes(const control, control);
 static void		install(control);
 static void		install_inet(control);
 static void		install_unix(control);
-static void		logger(enum ctl_severity, const char *fmt, ...);
+static void		logger(enum ctl_severity, const char *fmt, ...)
+			ISC_FORMAT_PRINTF(2,3);
 static void		verb_connect(struct ctl_sctx *, struct ctl_sess *,
 				     const struct ctl_verb *,
-				     const char *, u_int, void *, void *);
+				     const char *, u_int, const void *, void *);
 static void		verb_getpid(struct ctl_sctx *, struct ctl_sess *,
 				    const struct ctl_verb *,
-				    const char *, u_int, void *, void *);
+				    const char *, u_int, const void *, void *);
 static void		getpid_closure(struct ctl_sctx *, struct ctl_sess *,
 				       void *);
 static void		verb_status(struct ctl_sctx *, struct ctl_sess *,
 				    const struct ctl_verb *,
-				    const char *, u_int, void *, void *);
+				    const char *, u_int, const void *, void *);
 static void		status_closure(struct ctl_sctx *, struct ctl_sess *,
 				       void *);
 static void		verb_stop(struct ctl_sctx *, struct ctl_sess *,
 				  const struct ctl_verb *,
-				  const char *, u_int, void *, void *);
+				  const char *, u_int, const void *, void *);
 static void		verb_exec(struct ctl_sctx *, struct ctl_sess *,
 				  const struct ctl_verb *,
-				  const char *, u_int, void *, void *);
+				  const char *, u_int, const void *, void *);
 static void		verb_reload(struct ctl_sctx *, struct ctl_sess *,
 				    const struct ctl_verb *,
-				    const char *, u_int, void *, void *);
+				    const char *, u_int, const void *, void *);
 static void		verb_reconfig(struct ctl_sctx *, struct ctl_sess *,
 				      const struct ctl_verb *,
-				      const char *, u_int, void *, void *);
+				      const char *, u_int, const void *, void *);
 static void		verb_dumpdb(struct ctl_sctx *, struct ctl_sess *,
 				    const struct ctl_verb *,
-				    const char *, u_int, void *, void *);
+				    const char *, u_int, const void *, void *);
 static void		verb_stats(struct ctl_sctx *, struct ctl_sess *,
 				   const struct ctl_verb *,
-				   const char *, u_int, void *, void *);
+				   const char *, u_int, const void *, void *);
 static void		verb_trace(struct ctl_sctx *, struct ctl_sess *,
 				   const struct ctl_verb *,
-				   const char *, u_int, void *, void *);
+				   const char *, u_int, const void *, void *);
 static void		trace_closure(struct ctl_sctx *, struct ctl_sess *,
 				       void *);
 static void		verb_notrace(struct ctl_sctx *, struct ctl_sess *,
 				     const struct ctl_verb *,
-				     const char *, u_int, void *, void *);
+				     const char *, u_int, const void *, void *);
 static void		verb_querylog(struct ctl_sctx *, struct ctl_sess *,
 				      const struct ctl_verb *,
-				      const char *, u_int, void *, void *);
+				      const char *, u_int, const void *, void *);
 static void		verb_help(struct ctl_sctx *, struct ctl_sess *,
 				  const struct ctl_verb *,
-				  const char *, u_int, void *, void *);
+				  const char *, u_int, const void *, void *);
 static void		verb_quit(struct ctl_sctx *, struct ctl_sess *,
 				  const struct ctl_verb *,
-				  const char *, u_int, void *, void *);
+				  const char *, u_int, const void *, void *);
 
 /* Private data. */
 
@@ -226,7 +227,7 @@ ns_ctl_new_inet(struct in_addr saddr, u_int sport, ip_match_list allow) {
 
 #ifndef NO_SOCKADDR_UN
 control
-ns_ctl_new_unix(char *path, mode_t mode, uid_t owner, gid_t group) {
+ns_ctl_new_unix(const char *path, mode_t mode, uid_t owner, gid_t group) {
 	control new = new_control();
 
 	INIT_LINK(new, link);
@@ -525,11 +526,11 @@ install_unix(control ctl) {
 		if (slash != path)
 			*slash = '\0';
 		else {
-			freestr(path);
+			(void)freestr(path);
 			path = savestr("/", 1);
 		}
 	} else {
-		freestr(path);
+		(void)freestr(path);
 		path = savestr(".", 1);
 	}
 	if (mkdir(path, ctl->var.v_unix.mode) < 0) {
@@ -567,7 +568,7 @@ install_unix(control ctl) {
 		}
 	}
 #ifdef NEED_SECURE_DIRECTORY
-	freestr(path);
+	(void)freestr(path);
 #endif
 }
 #endif
@@ -581,7 +582,8 @@ logger(enum ctl_severity ctlsev, const char *format, ...) {
 	case ctl_debug:		logsev = log_debug(5);	break;
 	case ctl_warning:	logsev = log_warning;	break;
 	case ctl_error:		logsev = log_error;	break;
-	default:		panic("invalid ctlsev in logger", NULL);
+	default:		logsev = 0;
+				panic("invalid ctlsev in logger", NULL);
 	}
 	if (!log_ctx_valid)
 		return;
@@ -593,13 +595,18 @@ logger(enum ctl_severity ctlsev, const char *format, ...) {
 static void
 verb_connect(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	     const struct ctl_verb *verb, const char *rest,
-	     u_int respflags, void *respctx, void *uctx)
+	     u_int respflags, const void *respctx, void *uctx)
 {
-	const struct sockaddr *sa = (struct sockaddr *)respctx;
+	const struct sockaddr *sa = (const struct sockaddr *)respctx;
 	control nsctl = (control)uctx;
 
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+
 	if (sa->sa_family == AF_INET) {
-		const struct sockaddr_in *in = (struct sockaddr_in *)sa;
+		const struct sockaddr_in *in = (const struct sockaddr_in *)sa;
 		const ip_match_list acl = nsctl->var.v_inet.allow;
 
 		if (!ip_address_allowed(acl, in->sin_addr)) {
@@ -615,10 +622,17 @@ verb_connect(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_getpid(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	    const struct ctl_verb *verb, const char *rest,
-	    u_int respflags, void *respctx, void *uctx)
+	    u_int respflags, const void *respctx, void *uctx)
 {
 	char *msg = memget(MAX_STR_LEN);
 
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	if (msg == NULL) {
 		ctl_response(sess, 503, "(out of memory)", 0,
 			     NULL, NULL, NULL, NULL, 0);
@@ -632,6 +646,9 @@ static void
 getpid_closure(struct ctl_sctx *sctx, struct ctl_sess *sess, void *uap) {
 	char *msg = uap;
 
+	UNUSED(sctx);
+	UNUSED(sess);
+
 	memput(msg, MAX_STR_LEN);
 }
 
@@ -656,10 +673,17 @@ struct pvt_status {
 static void
 verb_status(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	    const struct ctl_verb *verb, const char *rest,
-	    u_int respflags, void *respctx, void *uctx)
+	    u_int respflags, const void *respctx, void *uctx)
 {
 	struct pvt_status *pvt = ctl_getcsctx(sess);
 
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	if (pvt == NULL) {
 		pvt = memget(sizeof *pvt);
 		if (pvt == NULL) {
@@ -717,6 +741,9 @@ static void
 status_closure(struct ctl_sctx *sctx, struct ctl_sess *sess, void *uap) {
 	struct pvt_status *pvt = ctl_getcsctx(sess);
 
+	UNUSED(sctx);
+	UNUSED(uap);
+
 	memput(pvt, sizeof *pvt);
 	ctl_setcsctx(sess, NULL);
 }
@@ -724,8 +751,15 @@ status_closure(struct ctl_sctx *sctx, struct ctl_sess *sess, void *uap) {
 static void
 verb_stop(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	ns_need(main_need_exit);
 	ctl_response(sess, 250, "Shutdown initiated.", 0, NULL, NULL, NULL,
 		     NULL, 0);
@@ -734,10 +768,16 @@ verb_stop(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_exec(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
 	struct stat sb;
 
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	if (rest != NULL && *rest != '\0') {
 		if (stat(rest, &sb) < 0) {
 			ctl_response(sess, 503, strerror(errno),
@@ -764,14 +804,21 @@ verb_exec(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_reload(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	    const struct ctl_verb *verb, const char *rest,
-	    u_int respflags, void *respctx, void *uctx)
+	    u_int respflags, const void *respctx, void *uctx)
 {
 	static const char spaces[] = " \t";
 	struct zoneinfo *zp;
 	char *tmp = NULL, *x;
+	const char *cl;
 	const char *msg;
 	int class, code, success;
 
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	/* If there are no args, this is a classic reload of the config. */
 	if (rest == NULL || *rest == '\0') {
 		ns_need(main_need_reload);
@@ -787,9 +834,8 @@ verb_reload(struct ctl_sctx *ctl, struct ctl_sess *sess,
 		*x++ = '\0';
 		x += strspn(x, spaces);
 	}
-	if (x == NULL || *x == '\0')
-		x = "in";
-	class = sym_ston(__p_class_syms, x, &success);
+	cl = (x == NULL || *x == '\0') ? "in" : x;
+	class = res_nametoclass(cl, &success);
 	if (!success) {
 		code = 507;
 		msg = "unrecognized class";
@@ -833,14 +879,20 @@ verb_reload(struct ctl_sctx *ctl, struct ctl_sess *sess,
  respond:
 	ctl_response(sess, code, msg, 0, NULL, NULL, NULL, NULL, 0);
 	if (tmp != NULL)
-		freestr(tmp);
+		(void)freestr(tmp);
 }
 
 static void
 verb_reconfig(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	if (strcmp(rest, "-noexpired") != 0)
 		ns_need(main_need_reconfig);
 	else
@@ -852,8 +904,15 @@ verb_reconfig(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_dumpdb(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	    const struct ctl_verb *verb, const char *rest,
-	    u_int respflags, void *respctx, void *uctx)
+	    u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	ns_need(main_need_dump);
 	ctl_response(sess, 250, "Database dump initiated.", 0, NULL,
 		     NULL, NULL, NULL, 0);
@@ -862,8 +921,14 @@ verb_dumpdb(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_stats(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	   const struct ctl_verb *verb, const char *rest,
-	   u_int respflags, void *respctx, void *uctx)
+	   u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	if (rest != NULL && strcmp(rest, "clear") == 0) {
 		ns_need(main_need_statsdumpandclear);
 		ctl_response(sess, 250, "Statistics dump and clear initiated.",
@@ -878,22 +943,31 @@ verb_stats(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_trace(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	   const struct ctl_verb *verb, const char *rest,
-	   u_int respflags, void *respctx, void *uctx)
+	   u_int respflags, const void *respctx, void *uctx)
 {
 	int i = atoi(rest);
 	char *msg = memget(MAX_STR_LEN);
 
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	if (msg == NULL) {
 		ctl_response(sess, 503, "(out of memory)", 0,
 			     NULL, NULL, NULL, NULL, 0);
 		return;
 	}
-	if (i > 0) 
+	if (isdigit(*(const unsigned char *)rest) && i >= 0) 
 		desired_debug = i;
 	else
 		desired_debug++;
 	ns_need(main_need_debug);
-	sprintf(msg, "Debug level: %d", desired_debug);
+	if (desired_debug == 0)
+		sprintf(msg, "Debugging turned off.");
+	else
+		sprintf(msg, "Debug level: %d", desired_debug);
 	ctl_response(sess, 250, msg, 0, NULL, trace_closure, msg, NULL, 0);
 }
 
@@ -901,14 +975,24 @@ static void
 trace_closure(struct ctl_sctx *sctx, struct ctl_sess *sess, void *uap) {
 	char *msg = uap;
 
+	UNUSED(sctx);
+	UNUSED(sess);
+
 	memput(msg, MAX_STR_LEN);
 }
 
 static void
 verb_notrace(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	     const struct ctl_verb *verb, const char *rest,
-	     u_int respflags, void *respctx, void *uctx)
+	     u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	desired_debug = 0;
 	ns_need(main_need_debug);
 	ctl_response(sess, 250, "Debugging turned off.",
@@ -918,11 +1002,18 @@ verb_notrace(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_querylog(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	      const struct ctl_verb *verb, const char *rest,
-	      u_int respflags, void *respctx, void *uctx)
+	      u_int respflags, const void *respctx, void *uctx)
 {
 	static const char	on[] = "Query logging is now on.",
 				off[] = "Query logging is now off.";
 
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	toggle_qrylog();
 	ctl_response(sess, 250, qrylog ? on : off,
 		     0, NULL, NULL, NULL, NULL, 0);
@@ -931,16 +1022,30 @@ verb_querylog(struct ctl_sctx *ctl, struct ctl_sess *sess,
 static void
 verb_help(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	ctl_sendhelp(sess, 214);
 }
 
 static void
 verb_quit(struct ctl_sctx *ctl, struct ctl_sess *sess,
 	  const struct ctl_verb *verb, const char *rest,
-	  u_int respflags, void *respctx, void *uctx)
+	  u_int respflags, const void *respctx, void *uctx)
 {
+	UNUSED(ctl);
+	UNUSED(verb);
+	UNUSED(rest);
+	UNUSED(respflags);
+	UNUSED(respctx);
+	UNUSED(uctx);
+
 	ctl_response(sess, 221, "End of control session.", CTL_EXIT, NULL,
 		     NULL, NULL, NULL, 0);
 }
diff --git a/contrib/bind/bin/named/ns_defs.h b/contrib/bind/bin/named/ns_defs.h
index 64aecce..86a81b6 100644
--- a/contrib/bind/bin/named/ns_defs.h
+++ b/contrib/bind/bin/named/ns_defs.h
@@ -1,6 +1,6 @@
 /*
  *	from ns.h	4.33 (Berkeley) 8/23/90
- *	$Id: ns_defs.h,v 8.105 2001/04/01 22:41:24 marka Exp $
+ *	$Id: ns_defs.h,v 8.115 2002/01/29 03:59:35 marka Exp $
  */
 
 /*
@@ -147,6 +147,7 @@
 #define	MAX_SYNCDELAY	3	/* Presumed timeout in use by our clients. */
 #define	MAX_SYNCDRAIN	100000	/* How long we'll spin in drain_all_rcvbuf. */
 #define	MAX_SYNCSTORE	500
+#define NS_MAX_DISTANCE 3	/* maximum nameserver chaining before failure */
 
 				  /* maximum time to cache negative answers */
 #define DEFAULT_MAX_NCACHE_TTL (3*60*60)
@@ -176,27 +177,30 @@ typedef enum need {
 } main_need;
 
 	/* What global options are set? */
-#define	OPTION_NORECURSE	0x0001	/* Don't recurse even if asked. */
-#define	OPTION_NOFETCHGLUE	0x0002	/* Don't fetch missing glue. */
-#define	OPTION_FORWARD_ONLY	0x0004	/* Don't use NS RR's, just forward. */
-#define	OPTION_FAKE_IQUERY	0x0008	/* Fake up bogus response to IQUERY. */
+#define	OPTION_NORECURSE	0x00000001 /* Don't recurse even if asked. */
+#define	OPTION_NOFETCHGLUE	0x00000002 /* Don't fetch missing glue. */
+#define	OPTION_FORWARD_ONLY	0x00000004 /* Don't use NS RR's, just forward. */
+#define	OPTION_FAKE_IQUERY	0x00000008 /* Fake up bogus response to IQUERY. */
 #ifdef BIND_NOTIFY
-#define	OPTION_NONOTIFY		0x0010	/* Turn off notify */
+#define	OPTION_NONOTIFY		0x00000010 /* Turn off notify */
+#define	OPTION_SUPNOTIFY_INITIAL 0x00000020 /* Supress initial notify */
 #endif
-#define	OPTION_NONAUTH_NXDOMAIN	0x0020	/* Generate non-auth NXDOMAINs? */
-#define	OPTION_MULTIPLE_CNAMES	0x0040	/* Allow a name to have multiple
-					 * CNAME RRs */
-#define OPTION_HOSTSTATS	0x0080	/* Maintain per-host statistics? */
-#define OPTION_DEALLOC_ON_EXIT	0x0100	/* Deallocate everything on exit? */
-#define OPTION_NODIALUP		0x0200	/* Turn off dialup support */
-#define OPTION_NORFC2308_TYPE1	0x0400	/* Prevent type1 respones (RFC 2308)
-					 * to cached negative respones */
-#define	OPTION_USE_ID_POOL	0x0800	/* Use the memory hogging query ID */
-#define	OPTION_TREAT_CR_AS_SPACE 0x1000 /* Treat CR in zone files as space */
-#define OPTION_USE_IXFR		0x2000	/* Use by delault ixfr in zone transfer */
-#define OPTION_MAINTAIN_IXFR_BASE 0x4000 /* Part of IXFR file name logic. */
-#define OPTION_HITCOUNT		0x8000	/* Keep track of each time an RR gets
-					 * hit in the database */
+#define	OPTION_NONAUTH_NXDOMAIN	0x00000040 /* Generate non-auth NXDOMAINs? */
+#define	OPTION_MULTIPLE_CNAMES	0x00000080 /* Allow a name to have multiple
+					    * CNAME RRs */
+#define OPTION_HOSTSTATS	0x00000100 /* Maintain per-host statistics? */
+#define OPTION_DEALLOC_ON_EXIT	0x00000200 /* Deallocate everything on exit? */
+#define OPTION_NODIALUP		0x00000400 /* Turn off dialup support */
+#define OPTION_NORFC2308_TYPE1	0x00000800 /* Prevent type1 respones (RFC 2308)
+					    * to cached negative respones */
+#define	OPTION_USE_ID_POOL	0x00001000 /* Use the memory hogging query ID */
+#define	OPTION_TREAT_CR_AS_SPACE 0x00002000 /* Treat CR in zone files as
+					     * space */
+#define OPTION_USE_IXFR		0x00004000 /* Use by default ixfr in zone
+					    * transfer */
+#define OPTION_MAINTAIN_IXFR_BASE 0x00008000 /* Part of IXFR file name logic. */
+#define OPTION_HITCOUNT		0x00010000 /* Keep track of each time an
+					    * RR gets hit in the database */
 
 #define	DEFAULT_OPTION_FLAGS	(OPTION_NODIALUP|OPTION_NONAUTH_NXDOMAIN|\
 				 OPTION_USE_ID_POOL|OPTION_NORFC2308_TYPE1)
@@ -236,6 +240,7 @@ typedef enum need {
 
 	/* Sequence space arithmetic. */
 #define SEQ_GT(a,b)	((int32_t)((a)-(b)) > 0)
+#define SEQ_LT(a,b)	((int32_t)((a)-(b)) < 0)
 
 #define	NS_OPTION_P(option) ((server_options == NULL) ? \
 		(panic(panic_msg_no_options, NULL), 0) : \
@@ -332,6 +337,7 @@ struct zoneinfo {
 	time_t		z_ftime;	/* modification time of source file */
 	struct in_addr	z_axfr_src;	/* bind() the axfr socket to this */
 	struct in_addr	z_addr[NSMAX];	/* list of master servers for zone */
+	struct dst_key * z_keys[NSMAX];	/* tsig key associated with master */
 	u_char		z_addrcnt;	/* number of entries in z_addr[] */
 	struct in_addr	z_xaddr[NSMAX];	/* list of master servers for xfer */
 	u_char		z_xaddrcnt;	/* number of entries in z_xaddr[] */
@@ -442,7 +448,8 @@ struct qserv {
 	struct databuf	*nsdata;	/* databuf for server address */
 	struct timeval	stime;		/* time first query started */
 	unsigned int	forwarder:1;	/* this entry is for a forwarder */
-	unsigned int	nretry:31;	/* # of times addr retried */
+	unsigned int	noedns:1;	/* don't try edns */
+	unsigned int	nretry:30;	/* # of times addr retried */
 	u_int32_t	serial;		/* valid if Q_ZSERIAL */
 };
 
@@ -461,6 +468,10 @@ struct qinfo {
 			q_cmsglen,	/* len of cname message */
 			q_cmsgsize;	/* allocated size of cname message */
 	int16_t		q_dfd;		/* UDP file descriptor */
+	int16_t		q_udpsize;	/* UDP message size */
+	int		q_distance;	/* distance this query is from the
+					 * original query that the server
+					 * received. */
 	time_t		q_time;		/* time to retry */
 	time_t		q_expire;	/* time to expire */
 	struct qinfo	*q_next;	/* rexmit list (sorted by time) */
@@ -470,6 +481,7 @@ struct qinfo {
 #ifdef notyet
 	struct nameser	*q_ns[NSMAX];	/* name servers */
 #endif
+	struct dst_key *q_keys[NSMAX];	/* keys to use with this address */
 	u_char		q_naddr;	/* number of addr's in q_addr */
 	u_char		q_curaddr;	/* last addr sent to */
 	u_char		q_nusedns;	/* number of elements in q_usedns[] */
@@ -497,6 +509,7 @@ struct qinfo {
 #define	Q_PRIMING	0x02		/* generated during priming phase */
 #define	Q_ZSERIAL	0x04		/* getting zone serial for xfer test */
 #define	Q_USEVC		0x08		/* forward using tcp not udp */
+#define	Q_EDNS		0x10		/* add edns opt record to answer */
 
 #define Q_NEXTADDR(qp,n) (&(qp)->q_addr[n].ns_addr)
 
@@ -731,7 +744,8 @@ typedef struct rrset_order_list {
 
 
 typedef struct options {
-	u_int flags;
+	u_int32_t flags;
+	char *hostname;
 	char *version;
 	char *directory;
 	char *dump_filename;
@@ -775,6 +789,7 @@ typedef struct options {
 	u_int max_host_stats;
 	u_int lame_ttl;
 	int minroots;
+	u_int16_t preferred_glue;
 } *options;
 
 typedef struct key_list_element {
@@ -832,8 +847,8 @@ typedef struct server_info {
  */
 
 struct ns_sym {
-	int	number;		/* Identifying number, like ns_log_default */
-	char *	name;		/* Its symbolic name, like "default" */
+	int		number;	/* Identifying number, like ns_log_default */
+	const char *	name;	/* Its symbolic name, like "default" */
 };
 
 /*
@@ -877,7 +892,7 @@ typedef struct log_config {
 } *log_config;
 
 struct map {
-	char *			token;
+	const char *		token;
 	int			val;
 };
 
@@ -908,3 +923,5 @@ enum req_action { Finish, Refuse, Return };
 #define INIT(x)
 #define DECL extern
 #endif
+
+#define EDNS_MESSAGE_SZ	4096
diff --git a/contrib/bind/bin/named/ns_forw.c b/contrib/bind/bin/named/ns_forw.c
index dac6525..f62ba20 100644
--- a/contrib/bind/bin/named/ns_forw.c
+++ b/contrib/bind/bin/named/ns_forw.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_forw.c	4.32 (Berkeley) 3/3/91";
-static const char rcsid[] = "$Id: ns_forw.c,v 8.78 2000/12/23 08:14:37 vixie Exp $";
+static const char rcsid[] = "$Id: ns_forw.c,v 8.89 2002/01/29 03:59:36 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -133,10 +133,10 @@ ns_forw(struct databuf *nsp[], u_char *msg, int msglen,
 	HEADER *hp;
 	u_int16_t id;
 	int sendto_errno = 0;
-	int n, has_tsig, oldqlen;
-	u_char *oldqbuf;
-	u_char *smsg;
-	int smsglen, smsgsize, siglen;
+	int n, has_tsig, oldqlen = 0;
+	u_char *oldqbuf = NULL;
+	u_char *smsg = NULL;
+	int smsglen, smsgsize = 0, siglen;
 	u_char sig[TSIG_SIG_SIZE];
 	DST_KEY *key;
 
@@ -225,39 +225,50 @@ ns_forw(struct databuf *nsp[], u_char *msg, int msglen,
 	if (debug >= 10)
 		res_pquery(&res, msg, msglen, log_get_stream(packet_channel));
 #endif
-	key = tsig_key_from_addr(nsa->sin_addr);
-	if (key != NULL) {
-		smsgsize = qp->q_msglen + TSIG_BUF_SIZE;
+        key = qp->q_keys[0];
+        if (key == NULL)
+                key = qp->q_keys[0] = tsig_key_from_addr(nsa->sin_addr);
+	if (key != NULL || !qp->q_addr[0].noedns) {
+		smsgsize = qp->q_msglen + TSIG_BUF_SIZE + 11;
 		smsg = memget(smsgsize);
 		if (smsg == NULL)
 			ns_panic(ns_log_default, 1, "ns_forw: memget failed");
 		smsglen = qp->q_msglen;
 		siglen = sizeof(sig);
 		memcpy(smsg, qp->q_msg, qp->q_msglen);
+	}
+
+	if (!qp->q_addr[0].noedns)
+		smsglen += ns_add_opt(smsg, smsg + smsglen, smsgsize, 0, 0,
+				      EDNS_MESSAGE_SZ, 0, NULL, 0);
+
+	if (key != NULL) {
 		n = ns_sign(smsg, &smsglen, smsgsize, NOERROR, key, NULL, 0,
 			    sig, &siglen, 0);
 		if (n == 0) {
-			oldqbuf = qp->q_msg;
-			oldqlen = qp->q_msglen;
-			qp->q_msglen = smsglen;
-			qp->q_msg = smsg;
-			hp = (HEADER *) qp->q_msg;
 			has_tsig = 1;
+			free_tsig(qp->q_nstsig);
 			qp->q_nstsig = new_tsig(key, sig, siglen);
-		}
-		else {
+		} else {
 			has_tsig = 0;
 			free_tsig(qp->q_nstsig);
 			qp->q_nstsig = NULL;
 			INSIST(0);
 		}
-	}
-	else {
+	} else {
 		has_tsig = 0;
 		free_tsig(qp->q_nstsig);
 		qp->q_nstsig = NULL;
 	}
 
+	if (smsg != NULL) {
+		oldqbuf = qp->q_msg;
+		oldqlen = qp->q_msglen;
+		qp->q_msglen = smsglen;
+		qp->q_msg = smsg;
+		hp = (HEADER *) qp->q_msg;
+	}
+
 	if (qp->q_flags & Q_USEVC) {
 		if (tcp_send(qp) != NOERROR) {
 			if (!haveComplained(ina_ulong(nsa->sin_addr),
@@ -269,15 +280,16 @@ ns_forw(struct databuf *nsp[], u_char *msg, int msglen,
 	} else if (sendto(ds, (char *)qp->q_msg, qp->q_msglen, 0,
 		   (struct sockaddr *)nsa,
 		   sizeof(struct sockaddr_in)) < 0) {
-		sendto_errno  = errno;
+		sendto_errno = errno;
 		if (!haveComplained(ina_ulong(nsa->sin_addr),
 				    (u_long)sendtoStr))
 			ns_info(ns_log_default, "ns_forw: sendto(%s): %s",
 				sin_ntoa(*nsa), strerror(errno));
 		nameserIncr(nsa->sin_addr, nssSendtoErr);
 	}
-	if (has_tsig == 1) {
-		memput(qp->q_msg, smsgsize);
+
+	if (smsgsize != 0) {
+		memput(smsg, smsgsize);
 		qp->q_msg = oldqbuf;
 		qp->q_msglen = oldqlen;
 		hp = (HEADER *) qp->q_msg;
@@ -456,8 +468,8 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
 	int oldn, naddr, class, found_arr, potential_ns, lame_ns;
 	time_t curtime;
 
-	ns_debug(ns_log_default, 3, "nslookup(nsp=%#x, qp=%#x, \"%s\")",
-		nsp, qp, syslogdname);
+	ns_debug(ns_log_default, 3, "nslookup(nsp=%p, qp=%p, \"%s\", d=%d)",
+		 nsp, qp, syslogdname, qp->q_distance);
 
 	lame_ns = potential_ns = 0;
 	naddr = n = qp->q_naddr;
@@ -494,7 +506,7 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
 		tmphtp = ((nsdp->d_flags & DB_F_HINT) ?fcachetab :hashtab);
 		np = nlookup(dname, &tmphtp, &fname, 0);
 		if (np == NULL) {
-			ns_debug(ns_log_default, 3, "%s: not found %s %#x",
+			ns_debug(ns_log_default, 3, "%s: not found %s %p",
 				 dname, fname, np);
 			found_arr = 0;
 			goto need_sysquery;
@@ -520,6 +532,8 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
 						complaint, dname, dp, nsdp);
 				goto skipserver;
 			}
+			if (dp->d_rcode == NXDOMAIN && dp->d_class == class)
+				goto skipserver;
 			if (dp->d_type != T_A || dp->d_class != class)
 				continue;
 			if (dp->d_rcode) {
@@ -587,9 +601,11 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
 			qs->ns_addr.sin_family = AF_INET;
 			qs->ns_addr.sin_port = ns_port;
 			qs->ns_addr.sin_addr = nsa;
+			qp->q_keys[n] = NULL;
 			qs->ns = nsdp;
 			qs->nsdata = dp;
 			qs->forwarder = 0;
+			qs->noedns = dp->d_noedns;
 			qs->nretry = 0;
 			/*
 			 * If this A RR has no RTT, initialize its RTT to a
@@ -615,7 +631,8 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
 			 * gdonl mar96
 			 */
 			if (aIsUs(nsa)) {
-			    static char *complaint = "contains our address";
+			    static const char *complaint =
+					 "contains our address";
 			    nslookupComplain(sysloginfo, syslogdname,
 					     complaint, dname, dp, nsdp);
 			    continue;
@@ -632,7 +649,7 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
 			if (memcmp(&qp->q_from, &qs->ns_addr,
 				   sizeof(qp->q_from)) == 0)
 			{
-			    static char *complaint = "forwarding loop";
+			    static const char *complaint = "forwarding loop";
 			    nslookupComplain(sysloginfo, syslogdname,
 					     complaint, dname, dp, nsdp);
 			    continue;
@@ -668,9 +685,10 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
  need_sysquery:
 		if (found_arr == 0) {
 			potential_ns++;
-			if (!(qp->q_flags & Q_SYSTEM))
-				(void) sysquery(dname, class, T_A, NULL, 0,
-						ns_port, QUERY);
+			if (qp->q_distance < NS_MAX_DISTANCE)
+				(void) sysquery(dname, class, T_A, NULL, NULL,
+						0, ns_port, QUERY,
+						qp->q_distance + 1);
 		}
  skipserver:
 		(void)NULL;
@@ -678,7 +696,7 @@ nslookup(struct databuf *nsp[], struct qinfo *qp,
 	ns_debug(ns_log_default, 3, "nslookup: %d ns addrs total", n);
 	qp->q_naddr = n;
 	if (n == 0 && potential_ns == 0 && !NS_ZFWDTAB(qp->q_fzone)) {
-		static char *complaint = "No possible A RRs";
+		static const char *complaint = "No possible A RRs";
 		if (lame_ns != 0)
 			complaint = "All possible A RR's lame";
 		if (sysloginfo && syslogdname &&
@@ -784,7 +802,7 @@ qcomp(struct qserv *qs1, struct qserv *qs2) {
 
 		strcpy(t, inet_ntoa(qs1->ns_addr.sin_addr));
 		ns_debug(ns_log_default, 10,
-			 "qcomp(%s, %s) %lu (%lu) - %lu (%lu) = %lu",
+			 "qcomp(%s, %s) %u (%u) - %u (%u) = %u",
 			 t, inet_ntoa(qs2->ns_addr.sin_addr),
 			 rtt1, rttr1, rtt2, rttr2, rtt1 - rtt2);
 	}
@@ -813,7 +831,7 @@ void
 schedretry(struct qinfo *qp, time_t t) {
 	struct qinfo *qp1, *qp2;
 
-	ns_debug(ns_log_default, 4, "schedretry(%#x, %ld sec)", qp, (long)t);
+	ns_debug(ns_log_default, 4, "schedretry(%p, %ld sec)", qp, (long)t);
 	if (qp->q_time)
 		ns_debug(ns_log_default, 4,
 			 "WARNING: schedretry(%#lx, %ld) q_time already %ld",
@@ -885,22 +903,28 @@ reset_retrytimer() {
 void
 retrytimer(evContext ctx, void *uap, struct timespec due,
 	   struct timespec ival) {
+
+	UNUSED(ctx);
+	UNUSED(uap);
+	UNUSED(due);
+	UNUSED(ival);
+
 	retry_timer_set = 0;
-	retry(retryqp);
+	retry(retryqp, 0);
 }
 
 /*
  * Retry is called to retransmit query 'qp'.
  */
 void
-retry(struct qinfo *qp) {
-	int n, has_tsig, oldqlen;
+retry(struct qinfo *qp, int samehost) {
+	int n, has_tsig, oldqlen = 0;
 	HEADER *hp;
 	struct sockaddr_in *nsa;
 	int sendto_errno = 0;
-	u_char *oldqbuf;
-	u_char *smsg;
-	int smsglen, smsgsize, siglen;
+	u_char *oldqbuf = NULL;
+	u_char *smsg = NULL;
+	int smsglen, smsgsize = 0, siglen;
 	u_char sig[TSIG_SIG_SIZE];
 	DST_KEY *key;
 
@@ -923,7 +947,15 @@ retry(struct qinfo *qp) {
 
 	/* Try next address. */
 	n = qp->q_curaddr;
+	if (samehost) {
+		qp->q_addr[n].nretry++;
+		if (qp->q_addr[n].nretry < MAXRETRY)
+			goto found;
+		qp->q_addr[n].nretry--;
+	}
+
 	if (qp->q_naddr > 0) {
+		qp->q_addr[n].noedns = 1;
 		++qp->q_addr[n].nretry;
 		do {
 			if (++n >= (int)qp->q_naddr)
@@ -970,7 +1002,7 @@ retry(struct qinfo *qp) {
 	}
 	ns_debug(ns_log_default, 5, "give up");
 	if ((qp->q_flags & Q_SYSTEM) == 0) {
-		n = ((HEADER *)qp->q_cmsg ? qp->q_cmsglen : qp->q_msglen);
+		n = (qp->q_cmsg ? qp->q_cmsglen : qp->q_msglen);
 		hp->id = qp->q_id;
 		hp->qr = 1;
 		hp->ra = (NS_OPTION_P(OPTION_NORECURSE) == 0);
@@ -1015,24 +1047,29 @@ retry(struct qinfo *qp) {
 		res_pquery(&res, qp->q_msg, qp->q_msglen,
 			    log_get_stream(packet_channel));
 #endif
-	key = tsig_key_from_addr(nsa->sin_addr);
-	if (key != NULL) {
-		smsgsize = qp->q_msglen + TSIG_BUF_SIZE;
+	key = qp->q_keys[n];
+        if (key == NULL)
+                key = qp->q_keys[n] = tsig_key_from_addr(nsa->sin_addr);
+	if (key != NULL || !qp->q_addr[n].noedns) {
+		smsgsize = qp->q_msglen + TSIG_BUF_SIZE + 11;
 		smsg = memget(smsgsize);
 		smsglen = qp->q_msglen;
 		siglen = sizeof(sig);
 		memcpy(smsg, qp->q_msg, qp->q_msglen);
+	}
+
+	if (!qp->q_addr[n].noedns)
+		smsglen += ns_add_opt(smsg, smsg + smsglen, smsgsize, 0, 0,
+				      EDNS_MESSAGE_SZ, 0, NULL, 0);
+
+	if (key != NULL) {
 		n = ns_sign(smsg, &smsglen, smsgsize, NOERROR, key, NULL, 0,
 			    sig, &siglen, 0);
 		if (n == 0) {
-			oldqbuf = qp->q_msg;
-			oldqlen = qp->q_msglen;
-			qp->q_msglen = smsglen;
-			qp->q_msg = smsg;
 			has_tsig = 1;
+			free_tsig(qp->q_nstsig);
 			qp->q_nstsig = new_tsig(key, sig, siglen);
-		}
-		else {
+		} else {
 			has_tsig = 0;
 			free_tsig(qp->q_nstsig);
 			qp->q_nstsig = NULL;
@@ -1044,6 +1081,13 @@ retry(struct qinfo *qp) {
 		qp->q_nstsig = NULL;
 	}
 
+	if (smsg != NULL) {
+		oldqbuf = qp->q_msg;
+		oldqlen = qp->q_msglen;
+		qp->q_msglen = smsglen;
+		qp->q_msg = smsg;
+	}
+
 	if (qp->q_flags & Q_USEVC) {
 		if (tcp_send(qp) != NOERROR)
 			ns_debug(ns_log_default, 3,
@@ -1057,8 +1101,8 @@ retry(struct qinfo *qp) {
 		ns_debug(ns_log_default, 3, "error resending msg: %s",
 			 strerror(errno));
 	}
-	if (has_tsig == 1) {
-		memput(qp->q_msg, smsgsize);
+	if (smsgsize != 0) {
+		memput(smsg, smsgsize);
 		qp->q_msg = oldqbuf;
 		qp->q_msglen = oldqlen;
 	}
@@ -1171,33 +1215,14 @@ qnew(const char *name, int class, int type, int forward) {
 }
 
 void
-ns_freeqns(struct qinfo *qp, char *where) {
-	static const char freed[] = "freed", busy[] = "busy";
-	const char *result;
-	struct databuf *dp;
-	int i;
-
-	for (i = 0 ; i < (int)qp->q_naddr ; i++) {
-		dp = qp->q_addr[i].ns;
-		if (dp) {
-			DRCNTDEC(dp);
-			result = (dp->d_rcnt) ? busy : freed;
-			ns_debug(ns_log_default, 3, "%s: ns %s rcnt %d (%s)",
-				 where, dp->d_data, dp->d_rcnt, result);
-			if (result == freed)
-				db_freedata(dp);
-		}
-		dp = qp->q_addr[i].nsdata;
-		if (dp) {
-			DRCNTDEC(dp);
-			result = (dp->d_rcnt) ? busy : freed;
-			ns_debug(ns_log_default, 3,
-				 "%s: nsdata %s rcnt %d (%s)",
-				 where, inet_ntoa(ina_get(dp->d_data)),
-				 dp->d_rcnt, result);
-			if (result == freed)
-				db_freedata(dp);
-		}
+ns_freeqns(struct qinfo *qp) {
+	unsigned int i;
+
+	for (i = 0 ; i < qp->q_naddr ; i++) {
+		if (qp->q_addr[i].ns != NULL)
+			db_detach(&qp->q_addr[i].ns);
+		if (qp->q_addr[i].nsdata != NULL)
+			db_detach(&qp->q_addr[i].nsdata);
 	}
 }
 
@@ -1214,14 +1239,14 @@ ns_freeqry(struct qinfo *qp) {
  	if (qp->q_cmsg != NULL)
 		memput(qp->q_cmsg, qp->q_cmsgsize);
 	if (qp->q_domain != NULL)
-		freestr(qp->q_domain);
+		qp->q_domain = freestr(qp->q_domain);
 	if (qp->q_name != NULL)
-		freestr(qp->q_name);
+		qp->q_name = freestr(qp->q_name);
 	if (qp->q_tsig != NULL)
 		memput(qp->q_tsig, sizeof(struct tsig_record));
 	if (qp->q_nstsig != NULL)
 		memput(qp->q_nstsig, sizeof(struct tsig_record));
-	ns_freeqns(qp, "ns_freeqry");
+	ns_freeqns(qp);
 	if (nsqhead == qp)
 		nsqhead = qp->q_link;
 	else {
@@ -1245,7 +1270,7 @@ nsfwdadd(struct qinfo *qp, struct fwdinfo *fwd) {
 	n = qp->q_naddr;
 	while (fwd != NULL && n < NSMAX) {
 		qs = qp->q_addr;
-		for (i = 0; i < (u_int)n; i++, qs++)
+		for (i = 0; i < n; i++, qs++)
 			if (ina_equal(qs->ns_addr.sin_addr,
 				      fwd->fwddata->fwdaddr.sin_addr))
 				goto nextfwd;
@@ -1253,6 +1278,7 @@ nsfwdadd(struct qinfo *qp, struct fwdinfo *fwd) {
 		qs->ns = fwd->fwddata->ns;
 		qs->nsdata = fwd->fwddata->nsdata;
 		qs->forwarder = 1;
+		qs->noedns = fwd->fwddata->nsdata->d_noedns;
 		qs->nretry = 0;
 		n++;
  nextfwd:
@@ -1260,7 +1286,7 @@ nsfwdadd(struct qinfo *qp, struct fwdinfo *fwd) {
 	}
 
 	/* Update the refcounts before the sort. */
-	for (i = qp->q_naddr; i < (u_int)n; i++) {
+	for (i = qp->q_naddr; i < n; i++) {
 		DRCNTINC(qp->q_addr[i].nsdata);
 		DRCNTINC(qp->q_addr[i].ns);
 	}
diff --git a/contrib/bind/bin/named/ns_func.h b/contrib/bind/bin/named/ns_func.h
index ef9780f..501aa01 100644
--- a/contrib/bind/bin/named/ns_func.h
+++ b/contrib/bind/bin/named/ns_func.h
@@ -90,43 +90,43 @@
 
 /* ns_func.h - declarations for ns_*.c's externally visible functions
  *
- * $Id: ns_func.h,v 8.105 2001/02/16 04:46:12 marka Exp $
+ * $Id: ns_func.h,v 8.115 2002/01/29 03:59:38 marka Exp $
  */
 
 /* ++from ns_glue.c++ */
 struct in_addr		ina_get(const u_char *data);
 const char *		sin_ntoa(struct sockaddr_in);
 int			ns_wouldlog(int category, int level);
-void			ns_debug(int, int, const char *, ...);
-void			ns_info(int, const char *, ...);
-void			ns_notice(int, const char *, ...);
-void			ns_warning(int, const char *, ...);
-void			ns_error(int, const char *, ...);
-void			ns_critical(int, const char *, ...);
-void			ns_panic(int, int, const char *, ...);
-void			ns_assertion_failed(char *file, int line,
-					    assertion_type type, char *cond,
-					    int print_errno);
+void			ns_debug(int, int, const char *, ...) ISC_FORMAT_PRINTF(3, 4);
+void			ns_info(int, const char *, ...) ISC_FORMAT_PRINTF(2, 3);
+void			ns_notice(int, const char *, ...) ISC_FORMAT_PRINTF(2, 3);
+void			ns_warning(int, const char *, ...) ISC_FORMAT_PRINTF(2, 3);
+void			ns_error(int, const char *, ...) ISC_FORMAT_PRINTF(2, 3);
+void			ns_critical(int, const char *, ...) ISC_FORMAT_PRINTF(2, 3);
+void			ns_panic(int, int, const char *, ...) ISC_FORMAT_PRINTF(3, 4);
+void			ns_assertion_failed(const char *file, int line,
+					    assertion_type type,
+					    const char *cond, int print_errno);
 void			panic(const char *, const void *);
 void			gettime(struct timeval *);
 int			nlabels(const char *);
 int			my_close(int);
 int			my_fclose(FILE *);
-void			__freestr(char *);
+void *			__freestr(char *);
 char *			__newstr(size_t, int);
 char *			__savestr(const char *, int);
-char *			checked_ctime(const time_t *t);
-char *			ctimel(long);
-void			__freestr_record(char *, char *, int);
-char *			__newstr_record(size_t, int, char *, int);
-char *			__savestr_record(const char *, int, char *, int);
+const char *		checked_ctime(const time_t *t);
+const char *		ctimel(long);
+void *			__freestr_record(char *, const char *, int);
+char *			__newstr_record(size_t, int, const char *, int);
+char *			__savestr_record(const char *, int, const char *, int);
 u_char *		ina_put(struct in_addr ina, u_char *data);
 u_char *		savebuf(const u_char *, size_t, int);
-void			dprintf(int level, const char *format, ...);
+void			dprintf(int level, const char *format, ...) ISC_FORMAT_PRINTF(2, 3);
 #ifdef DEBUG_STRINGS
 char *			debug_newstr(size_t, int, const char *, int);
 char *			debug_savestr(const char *, int, const char *, int);
-void			debug_freestr(char *, const char *, int);
+void *			debug_freestr(char *, const char *, int);
 #define newstr(l, n) debug_newstr((l), (n), __FILE__, __LINE__)
 #define savestr(s, n) debug_savestr((s), (n), __FILE__, __LINE__)
 #define freestr(s) debug_freestr((s), __FILE__, __LINE__)
@@ -159,7 +159,8 @@ void			prime_cache(void);
 void			delete_all(struct namebuf *, int, int);
 int			delete_stale(struct namebuf *);
 struct qinfo *		sysquery(const char *, int, int,
-				 struct in_addr *, int, u_int16_t, int);
+				 struct in_addr *, struct dst_key **keys,
+				 int, u_int16_t, int, int);
 int			doupdate(u_char *, u_char *, struct databuf **,
 				 int, int, int, u_int, struct sockaddr_in);
 int			send_msg(u_char *, int, struct qinfo *);
@@ -174,6 +175,14 @@ int			trunc_adjust(u_char *, int, int);
 /* --from ns_resp.c-- */
 
 /* ++from ns_req.c++ */
+int			ns_get_opt(u_char *msg, u_char *eom,
+				   u_int8_t *versionp, u_int16_t *rcodep,
+				   u_int16_t *flagp, u_int16_t *bufsizep,
+				   u_char **optionsp, size_t *optsizep);
+int			ns_add_opt(u_char *msg, u_char *cp, size_t buflen,
+				   u_int8_t version, u_int16_t rcode,
+				   u_int16_t size, u_int16_t flags,
+				   u_char *options, size_t optlen);
 void			ns_req(u_char *, int, int,
 			       struct qstream *,
 			       struct sockaddr_in,
@@ -192,6 +201,7 @@ int			doaddauth(HEADER *, u_char *, int,
 int			findZonePri(const struct zoneinfo *,
 				    const struct sockaddr_in);
 #endif
+int			drop_port(u_int16_t);
 /* --from ns_req.c-- */
 
 /* ++from ns_xfr.c++ */
@@ -212,8 +222,8 @@ void			ns_ctl_shutdown(void);
 void			ns_ctl_defaults(controls *);
 void			ns_ctl_add(controls *, control);
 control			ns_ctl_new_inet(struct in_addr, u_int, ip_match_list);
-#ifndef WINNT
-control			ns_ctl_new_unix(char *, mode_t, uid_t, gid_t);
+#ifndef NO_SOCKADDR_UN
+control			ns_ctl_new_unix(const char *, mode_t, uid_t, gid_t);
 #endif
 void			ns_ctl_install(controls *);
 /* --from ns_ctl.c-- */
@@ -249,10 +259,10 @@ void			unsched(struct qinfo *);
 void			reset_retrytimer(void);
 void			retrytimer(evContext ctx, void *uap,
 				   struct timespec due, struct timespec ival);
-void			retry(struct qinfo *);
+void			retry(struct qinfo *, int);
 void			qflush(void);
 void			qremove(struct qinfo *);
-void			ns_freeqns(struct qinfo *, char *);
+void			ns_freeqns(struct qinfo *);
 void			ns_freeqry(struct qinfo *);
 void			freeComplaints(void);
 void			nsfwdadd(struct qinfo *, struct fwdinfo *);
@@ -267,7 +277,7 @@ void			sq_remove(struct qstream *);
 void			sq_flushw(struct qstream *);
 void			sq_flush(struct qstream *allbut);
 void			dq_remove_gen(time_t gen);
-void			dq_remove_all();
+void			dq_remove_all(void);
 void			sq_done(struct qstream *);
 void			ns_setproctitle(char *, int);
 void			getnetconf(int);
@@ -386,8 +396,7 @@ int			merge_logs(struct zoneinfo *zp, char *logname);
 int			zonedump(struct zoneinfo *zp, int isixfr);
 void			dynamic_about_to_exit(void);
 enum req_action		req_update(HEADER *hp, u_char *cp, u_char *eom,
-				   u_char *msg, struct qstream *qsp,
-				   int dfd, struct sockaddr_in from,
+				   u_char *msg, struct sockaddr_in from,
 				   struct tsig_record *in_tsig);
 void			rdata_dump(struct databuf *dp, FILE *fp);
 /* --from ns_update.c-- */
@@ -422,7 +431,8 @@ int			set_zone_transfer_source(zone_config, struct in_addr);
 int			set_zone_pubkey(zone_config, const int, const int,
 					const int, const char *);
 int 			set_zone_transfer_time_in(zone_config, long);
-int			add_zone_master(zone_config, struct in_addr);
+int			add_zone_master(zone_config, struct in_addr,
+					struct dst_key *);
 #ifdef BIND_NOTIFY
 int			add_zone_notify(zone_config, struct in_addr);
 #endif
@@ -453,8 +463,8 @@ ip_match_element	new_ip_match_localhost(void);
 ip_match_element	new_ip_match_localnets(void);
 void			ip_match_negate(ip_match_element);
 void			add_to_ip_match_list(ip_match_list, ip_match_element);
-void			dprint_ip_match_list(int, ip_match_list, int, char *,
-					     char *);
+void			dprint_ip_match_list(int, ip_match_list, int,
+					     const char *, const char *);
 int			ip_match_address(ip_match_list, struct in_addr);
 int			ip_match_addr_or_key(ip_match_list, struct in_addr,
 					     struct dst_key *key);
@@ -503,10 +513,10 @@ time_t			load_configuration(const char *);
 /* --from ns_config.c-- */
 
 /* ++from parser.y++ */
-ip_match_list		lookup_acl(char *);
-void			define_acl(char *, ip_match_list);
+ip_match_list		lookup_acl(const char *);
+void			define_acl(const char *, ip_match_list);
 struct dst_key		*lookup_key(char *);
-void			define_key(char *, struct dst_key *);
+void			define_key(const char *, struct dst_key *);
 time_t			parse_configuration(const char *);
 void			parser_initialize(void);
 void			parser_shutdown(void);
diff --git a/contrib/bind/bin/named/ns_glob.h b/contrib/bind/bin/named/ns_glob.h
index 8f4628a..7f382d5 100644
--- a/contrib/bind/bin/named/ns_glob.h
+++ b/contrib/bind/bin/named/ns_glob.h
@@ -1,6 +1,6 @@
 /*
  *	from ns.h	4.33 (Berkeley) 8/23/90
- *	$Id: ns_glob.h,v 8.56 2000/12/02 18:39:25 vixie Exp $
+ *	$Id: ns_glob.h,v 8.57 2001/11/12 21:22:26 marka Exp $
  */
 
 /*
@@ -342,3 +342,4 @@ DECL	int			loading			INIT(0);
 DECL	int			xfers_running		INIT(0);
 DECL	int			xfers_deferred		INIT(0);
 DECL	int			qserials_running	INIT(0);
+DECL	int			initial_configuration	INIT(1);
diff --git a/contrib/bind/bin/named/ns_glue.c b/contrib/bind/bin/named/ns_glue.c
index a4bd0f1..3d73c18 100644
--- a/contrib/bind/bin/named/ns_glue.c
+++ b/contrib/bind/bin/named/ns_glue.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_glue.c,v 8.20 2001/02/16 04:46:14 marka Exp $";
+static const char rcsid[] = "$Id: ns_glue.c,v 8.24 2002/01/07 02:54:37 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -179,8 +179,8 @@ ns_panic(int category, int dump_core, const char *format, ...) {
 }
 
 void
-ns_assertion_failed(char *file, int line, assertion_type type, char *cond,
-		    int print_errno)
+ns_assertion_failed(const char *file, int line, assertion_type type,
+		    const char *cond, int print_errno)
 {
 	ns_panic(ns_log_insist, 1, "%s:%d: %s(%s)%s%s failed.",
 		file, line, assertion_type_to_text(type), cond,
@@ -277,7 +277,11 @@ my_close(int fd) {
 		s = close(fd);
 	} while (s < 0 && errno == EINTR);
 
-	if (s < 0 && errno != EBADF)
+	/*
+	 * Tru64 UNIX V5.1 can return a spurious EINVAL after connect()
+	 * failures.
+	 */
+	if (s < 0 && errno != EBADF && errno != EINVAL)
 		ns_info(ns_log_default, "close(%d) failed: %s", fd,
 		       strerror(errno));
 	else
@@ -328,9 +332,10 @@ __savestr(const char *str, int needpanic) {
 	return (__savestr_record(str, needpanic, __FILE__, __LINE__));
 }
 
-void
+void *
 __freestr(char *str) {
 	__freestr_record(str, __FILE__, __LINE__);
+	return (NULL);
 }
 
 #ifdef DEBUG_STRINGS
@@ -364,7 +369,7 @@ debug_freestr(char *str, const char *file, int line) {
 	len += 3;	/* 2 length bytes + NUL. */
 	printf("%s:%d: freestr %d %s\n", file, line, len, str);
 	__freestr_record(str, file, line);
-	return;
+	return (NULL);
 }
 #endif /* DEBUG_STRINGS */
 
@@ -372,7 +377,7 @@ debug_freestr(char *str, const char *file, int line) {
  * Return a counted string buffer big enough for a string of length 'len'.
  */
 char *
-__newstr_record(size_t len, int needpanic, char *file, int line) {
+__newstr_record(size_t len, int needpanic, const char *file, int line) {
 	u_char *buf, *bp;
 
 	REQUIRE(len <= 65536);
@@ -393,7 +398,7 @@ __newstr_record(size_t len, int needpanic, char *file, int line) {
  * Save a NUL terminated string and return a pointer to it.
  */
 char *
-__savestr_record(const char *str, int needpanic, char *file, int line) {
+__savestr_record(const char *str, int needpanic, const char *file, int line) {
 	char *buf;
 	size_t len;
 
@@ -410,8 +415,8 @@ __savestr_record(const char *str, int needpanic, char *file, int line) {
 	return (buf);
 }
 
-void
-__freestr_record(char *str, char *file, int line) {
+void *
+__freestr_record(char *str, const char *file, int line) {
 	u_char *buf, *bp;
 	size_t len;
 
@@ -419,11 +424,12 @@ __freestr_record(char *str, char *file, int line) {
 	bp = buf;
 	NS_GET16(len, bp);
 	__memput_record(buf, 2/*Len*/ + len + 1/*Nul*/, file, line);
+	return (NULL);
 }
 
-char *
+const char *
 checked_ctime(const time_t *t) {
-	char *ctime_result;
+	const char *ctime_result;
 
 	ctime_result = ctime(t);
 	if (ctime_result == NULL) {
@@ -438,7 +444,7 @@ checked_ctime(const time_t *t) {
  * Since the fields in a "struct timeval" are longs, and the argument to ctime
  * is a pointer to a time_t (which might not be a long), here's a bridge.
  */
-char *
+const char *
 ctimel(long l) {
 	time_t t = (time_t)l;
 
diff --git a/contrib/bind/bin/named/ns_init.c b/contrib/bind/bin/named/ns_init.c
index 553f047..773192b 100644
--- a/contrib/bind/bin/named/ns_init.c
+++ b/contrib/bind/bin/named/ns_init.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_init.c	4.38 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: ns_init.c,v 8.73 2001/04/20 00:21:40 vixie Exp $";
+static const char rcsid[] = "$Id: ns_init.c,v 8.76 2001/12/19 01:41:51 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -294,7 +294,10 @@ do_reload(const char *domain, int type, int class, int mark) {
 	 * Clean up any leftover data.
 	 */
 	ns_stopxfrs(zp);
-	purge_zone(domain, hashtab, class);
+	if (type == z_hint || (type == z_stub && *domain == 0))
+		purge_zone(domain, fcachetab, class);
+	else
+		purge_zone(domain, hashtab, class);
 
 	/*
 	 * Reload
@@ -534,9 +537,9 @@ ns_nameok(const struct qinfo *qry, const char *name, int class,
 		if (severity == warn)
 			ok = 1;
 		if (s != NULL)
-			freestr(s);
+			(void)freestr(s);
 		if (o != NULL)
-			freestr(o);
+			(void)freestr(o);
 	}
 	return (ok);
 }
diff --git a/contrib/bind/bin/named/ns_ixfr.c b/contrib/bind/bin/named/ns_ixfr.c
index c013717..f14019e 100644
--- a/contrib/bind/bin/named/ns_ixfr.c
+++ b/contrib/bind/bin/named/ns_ixfr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_ixfr.c,v 8.26.2.2 2001/08/10 03:00:08 marka Exp $";
+static const char rcsid[] = "$Id: ns_ixfr.c,v 8.31 2002/01/02 05:15:20 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -232,8 +232,7 @@ sx_send_ixfr(struct qstream *qsp) {
 					if (sx_addrr(qsp, rp->r_dname,
 						     rp->r_dp) < 0)
 						goto cleanup;
-					db_freedata(rp->r_dp);
-					rp->r_dp = NULL;
+					db_detach(&rp->r_dp);
 					foundsoa = 1;
 					break;
 				}
@@ -268,8 +267,7 @@ sx_send_ixfr(struct qstream *qsp) {
 					    sx_addrr(qsp, rp->r_dname,
 						     rp->r_dp) < 0)
 						goto cleanup;
-					db_freedata(rp->r_dp);
-					rp->r_dp = NULL;
+					db_detach(&rp->r_dp);
 				}
 				rp = NEXT(rp, r_link);
 			}
@@ -292,8 +290,7 @@ sx_send_ixfr(struct qstream *qsp) {
 					if (sx_addrr(qsp, rp->r_dname,
 						     rp->r_dp) < 0)
 						goto cleanup;
-					db_freedata(rp->r_dp);
-					rp->r_dp = NULL;
+					db_detach(&rp->r_dp);
 					foundsoa = 1;
 					break;
 				}
@@ -332,8 +329,7 @@ sx_send_ixfr(struct qstream *qsp) {
 						if (sx_addrr(qsp, rp->r_dname,
 							     rp->r_dp) < 0)
 							goto cleanup;
-						db_freedata(rp->r_dp);
-						rp->r_dp = NULL;
+						db_detach(&rp->r_dp);
 					}
 					rp = NEXT(rp, r_link);
 				}
@@ -344,10 +340,8 @@ sx_send_ixfr(struct qstream *qsp) {
 				/* clean up old update */
 				while ((rp = HEAD(dp->d_changes)) != NULL) {
 					UNLINK(dp->d_changes, rp, r_link);
-					if (rp->r_dp != NULL) {
-						db_freedata(rp->r_dp);
-						rp->r_dp = NULL;
-					}
+					if (rp->r_dp != NULL)
+						db_detach(&rp->r_dp);
 					res_freeupdrec(rp);
 				}
 				memput(dp, sizeof (*dp));
@@ -379,8 +373,7 @@ sx_send_ixfr(struct qstream *qsp) {
 				while ((rp = HEAD(dp->d_changes)) != NULL) {
 					UNLINK(dp->d_changes, rp, r_link);
 					if (rp->r_dp != NULL)
-						db_freedata(rp->r_dp);
-					rp->r_dp = NULL;
+						db_detach(&rp->r_dp);
 					res_freeupdrec(rp);
 				} 
 				memput(dp, sizeof *dp);
@@ -432,9 +425,8 @@ ixfr_log_maint(struct zoneinfo *zp) {
 		return (-1);
 	}
 	(void) my_fclose(db_fp);
-	ns_debug(ns_log_default, 3, "%s, size %d blk %d", 
-	     zp->z_source, db_sb.st_size, 
-	     db_sb.st_size);
+	ns_debug(ns_log_default, 3, "%s, size %ld", 
+		 zp->z_source, (long)db_sb.st_size);
 
 	/* open up the zone ixfr log */
 	if ((from_fp = fopen(zp->z_ixfr_base, "r")) == NULL) {
@@ -449,10 +441,8 @@ ixfr_log_maint(struct zoneinfo *zp) {
 		(void) my_fclose(from_fp);
 		return (-1);
 	}
-	ns_debug(ns_log_default, 3, "%s, size %d max %d\n", 
-	     zp->z_ixfr_base, 
-	     sb.st_size, 
-	     zp->z_max_log_size_ixfr);
+	ns_debug(ns_log_default, 3, "%s, size %ld max %ld\n", zp->z_ixfr_base, 
+		 (long)sb.st_size, (long)zp->z_max_log_size_ixfr);
 	if (zp->z_max_log_size_ixfr) {
 		if (sb.st_size > zp->z_max_log_size_ixfr)
 			seek = sb.st_size -
@@ -467,7 +457,7 @@ ixfr_log_maint(struct zoneinfo *zp) {
 		else 
 			 seek = 0;
 	}
-	ns_debug(ns_log_default, 3, "seek: %d", seek);
+	ns_debug(ns_log_default, 3, "seek: %ld", (long)seek);
 	if (seek < 1) {
 		ns_debug(ns_log_default, 3, "%s does not need to be reduced", 
 			zp->z_ixfr_base);
@@ -489,7 +479,7 @@ ixfr_log_maint(struct zoneinfo *zp) {
 
 	(void) strcat(tmpname, ".XXXXXX");
 	if ((fd = mkstemp(tmpname)) == -1) {
-		ns_warning(ns_log_db, "can't make tmpfile (%s): %s",
+		ns_warning(ns_log_db, "can't make tmpfile (%s): %s", 
 			   tmpname, strerror(errno));
 		memput(tmpname, len);
 		(void) my_fclose(from_fp);
@@ -536,7 +526,8 @@ ixfr_log_maint(struct zoneinfo *zp) {
 			break;
 	}
 	if (found) {
-		ns_debug(ns_log_default, 1, "ixfr_log_maint(): found [END_DELTA]");
+		ns_debug(ns_log_default, 1,
+			 "ixfr_log_maint(): found [END_DELTA]");
 	
 		fprintf(to_fp, "%s", LogSignature);
 
@@ -557,7 +548,8 @@ ixfr_log_maint(struct zoneinfo *zp) {
 	(void) my_fclose(from_fp);
 	if (error == 0) {
 		if (isc_movefile(tmpname, zp->z_ixfr_base) == -1) {
-			ns_warning(ns_log_default, "can not rename %s to %s :%s",
+			ns_warning(ns_log_default,
+				   "can not rename %s to %s :%s",
 				   tmpname, zp->z_ixfr_base, strerror(errno));
 		}
 		if ((from_fp = fopen(zp->z_ixfr_base, "r")) == NULL) {
@@ -576,25 +568,23 @@ ixfr_log_maint(struct zoneinfo *zp) {
 		if (sb.st_size <= 0)
 			(void) unlink(zp->z_ixfr_base);
 		else if (chmod(zp->z_ixfr_base, 0644) < 0)
-				ns_error(ns_log_update,
-					"chmod(%s,%o) failed, pressing on: %s",
-					 zp->z_source, sb.st_mode,
-					 strerror(errno));
+			ns_error(ns_log_update,
+				"chmod(%s,%o) failed, pressing on: %s",
+				 zp->z_source, sb.st_mode, strerror(errno));
 		(void) my_fclose(from_fp);
 	}
 	(void) unlink(tmpname);
 	memput(tmpname, len);
 
-	zp->z_serial_ixfr_start = 0; /* signal to read for lowest serial number */	
+	/* signal to read for lowest serial number */	
+	zp->z_serial_ixfr_start = 0;
 
-	ns_debug(ns_log_default, 3, "%s, size %d max %d\n", 
-	     zp->z_ixfr_base, 
-	     sb.st_size, 
-	     zp->z_max_log_size_ixfr);
+	ns_debug(ns_log_default, 3, "%s, size %ld max %ld\n", zp->z_ixfr_base,
+		 (long)sb.st_size, (long)zp->z_max_log_size_ixfr);
 
 	if (error)
 	 	return(-1);
 	else
-	    return (0);
+		return (0);
 }
 
diff --git a/contrib/bind/bin/named/ns_lexer.c b/contrib/bind/bin/named/ns_lexer.c
index bb2d11f..4a6f820 100644
--- a/contrib/bind/bin/named/ns_lexer.c
+++ b/contrib/bind/bin/named/ns_lexer.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_lexer.c,v 8.22 2000/11/29 06:55:58 marka Exp $";
+static const char rcsid[] = "$Id: ns_lexer.c,v 8.28 2001/12/28 04:07:47 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -142,6 +142,10 @@ static char message[20480];
 
 static void
 parser_complain(int is_warning, int print_last_token, const char *format,
+		va_list args) ISC_FORMAT_PRINTF(3, 0);
+
+static void
+parser_complain(int is_warning, int print_last_token, const char *format,
 		va_list args)
 {
 	LexerFileContext lf;
@@ -199,7 +203,7 @@ parser_error(int print_last_token, const char *format, ...) {
 
 void
 yyerror(const char *message) {
-	parser_error(1, message);
+	parser_error(1, "%s", message);
 }
 
 /*
@@ -207,7 +211,7 @@ yyerror(const char *message) {
  */
 
 struct keyword {
-        char *name;
+        const char *name;
 	int token;
 };
 
@@ -265,6 +269,7 @@ static struct keyword keywords[] = {
 #endif /* HITCOUNTS */
 	{"host-statistics", T_HOSTSTATS},
 	{"host-statistics-max", T_HOSTSTATSMAX},
+	{"hostname", T_HOSTNAME},
 	{"if-no-answer", T_IF_NO_ANSWER},
 	{"if-no-domain", T_IF_NO_DOMAIN},
 	{"ignore", T_IGNORE},
@@ -303,6 +308,7 @@ static struct keyword keywords[] = {
 	{"perm", T_PERM},
 	{"pid-file", T_PIDFILE},
 	{"port", T_PORT},
+	{"preferred-glue", T_PREFERRED_GLUE},
 	{"print-category", T_PRINT_CATEGORY},
 	{"print-severity", T_PRINT_SEVERITY},
 	{"print-time", T_PRINT_TIME},
@@ -324,6 +330,9 @@ static struct keyword keywords[] = {
 	{"statistics-interval", T_STATS_INTERVAL},
 	{"stub", T_STUB},
 	{"support-ixfr", T_SUPPORT_IXFR},
+#ifdef BIND_NOTIFY
+	{"suppress-initial-notify", T_NOTIFY_INITIAL},
+#endif
 	{"syslog", T_SYSLOG}, 
 	{"topology", T_TOPOLOGY},
 	{"transfer-format", T_TRANSFER_FORMAT}, 
@@ -474,7 +483,7 @@ scan_to_comment_end(int c_plus_plus_style) {
 	}
 }
 
-int
+static int
 get_next_char(int comment_ok) {
 	int c, nc;
 
@@ -518,7 +527,7 @@ get_next_char(int comment_ok) {
 	return (c);
 }
 
-void
+static void
 put_back_char(int c) {
 	if (c == EOF)
 		current_file->flags |= LEX_EOF;
diff --git a/contrib/bind/bin/named/ns_lexer.h b/contrib/bind/bin/named/ns_lexer.h
index 7a22b8e..394338c 100644
--- a/contrib/bind/bin/named/ns_lexer.h
+++ b/contrib/bind/bin/named/ns_lexer.h
@@ -30,8 +30,8 @@
 #define SYM_LOGGING	0x04
 #define SYM_SYSLOG	0x08
 
-int	parser_warning(int, const char *, ...);
-int	parser_error(int, const char *, ...);
+int	parser_warning(int, const char *, ...) ISC_FORMAT_PRINTF(2, 3);
+int	parser_error(int, const char *, ...) ISC_FORMAT_PRINTF(2, 3);
 void	yyerror(const char *);
 void	lexer_begin_file(const char *, FILE *);
 void	lexer_end_file(void);
diff --git a/contrib/bind/bin/named/ns_main.c b/contrib/bind/bin/named/ns_main.c
index 1d7bfe8..23cf249 100644
--- a/contrib/bind/bin/named/ns_main.c
+++ b/contrib/bind/bin/named/ns_main.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_main.c	4.55 (Berkeley) 7/1/91";
-static const char rcsid[] = "$Id: ns_main.c,v 8.145 2001/03/16 12:07:57 marka Exp $";
+static const char rcsid[] = "$Id: ns_main.c,v 8.155 2001/11/16 05:37:27 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -233,14 +233,14 @@ usage() {
 	exit(1);
 }
 
-static char bad_p_option[] =
+static const char bad_p_option[] =
 "-p remote/local obsolete; use 'listen-on' in config file to specify local";
 
-static char bad_directory[] = "chdir failed for directory '%s': %s";
+static const char bad_directory[] = "chdir failed for directory '%s': %s";
 
 /*ARGSUSED*/
 int
-main(int argc, char *argv[], char *envp[]) {
+main(int argc, char *argv[]) {
 	int n;
 	char *p;
 	int ch;
@@ -281,7 +281,7 @@ main(int argc, char *argv[], char *envp[]) {
 		case 'b':
 		case 'c':
 			if (conffile != NULL)
-				freestr(conffile);
+				(void)freestr(conffile);
 			conffile = savestr(optarg, 1);
 			break;
 
@@ -367,7 +367,7 @@ main(int argc, char *argv[], char *envp[]) {
 
 		case 'g':
 			if (group_name != NULL)
-				freestr(group_name);
+				(void)freestr(group_name);
 			group_name = savestr(optarg, 1);
 			if (only_digits(group_name))
 				group_id = atoi(group_name);
@@ -394,7 +394,7 @@ main(int argc, char *argv[], char *envp[]) {
 
 	if (argc) {
 		if (conffile != NULL)
-			freestr(conffile);
+			(void)freestr(conffile);
 		conffile = savestr(*argv, 1);
 		argc--, argv++;
 	}
@@ -431,8 +431,7 @@ main(int argc, char *argv[], char *envp[]) {
 		}
 #else
 		fprintf(stderr, "warning: chroot() not available\n");
-		freestr(chroot_dir);
-		chroot_dir = NULL;
+		chroot_dir = freestr(chroot_dir);
 #endif
 	}
 
@@ -608,13 +607,17 @@ stream_accept(evContext lev, void *uap, int rfd,
 	interface *ifp = uap;
 	struct qstream *sp;
 	struct iovec iov;
-	int len, n;
+	ISC_SOCKLEN_T len;
+	int n;
 	const int on = 1;
 #ifdef IP_OPTIONS	/* XXX */
 	u_char ip_opts[IP_OPT_BUF_SIZE];
 #endif
 	const struct sockaddr_in *la, *ra;
 
+	UNUSED(lalen);
+	UNUSED(ralen);
+
 	la = (const struct sockaddr_in *)lav;
 	ra = (const struct sockaddr_in *)rav;
 
@@ -714,7 +717,7 @@ stream_accept(evContext lev, void *uap, int rfd,
 
 #ifndef CANNOT_SET_SNDBUF
 	if (setsockopt(rfd, SOL_SOCKET, SO_SNDBUF,
-		      (char*)&sbufsize, sizeof sbufsize) < 0) {
+		       (const char*)&sbufsize, sizeof sbufsize) < 0) {
 		ns_info(ns_log_default, "setsockopt(rfd, SO_SNDBUF, %d): %s",
 			sbufsize, strerror(errno));
 		(void) close(rfd);
@@ -722,13 +725,21 @@ stream_accept(evContext lev, void *uap, int rfd,
 	}
 #endif
 	if (setsockopt(rfd, SOL_SOCKET, SO_KEEPALIVE,
-		       (char *)&on, sizeof on) < 0) {
+		       (const char *)&on, sizeof on) < 0) {
 		ns_info(ns_log_default, "setsockopt(rfd, KEEPALIVE): %s",
 			strerror(errno));
 		(void) close(rfd);
 		return;
 	}
 
+#ifdef USE_FIONBIO_IOCTL
+	if (ioctl(ifp->dfd, FIONBIO, (char *) &on) == -1) {
+		ns_info(ns_log_default, "ioctl(rfd, FIONBIO): %s",
+			strerror(errno));
+		(void) close(rfd);
+		return;
+	}
+#else
 	if ((n = fcntl(rfd, F_GETFL, 0)) == -1) {
 		ns_info(ns_log_default, "fcntl(rfd, F_GETFL): %s",
 			strerror(errno));
@@ -741,6 +752,7 @@ stream_accept(evContext lev, void *uap, int rfd,
 		(void) close(rfd);
 		return;
 	}
+#endif
 
 	/*
 	 * We don't like IP options.  Turn them off if the connection came in
@@ -830,6 +842,12 @@ tcp_send(struct qinfo *qp) {
 		sq_remove(sp);
 		return (SERVFAIL);
 	}
+#ifdef USE_FIONBIO_IOCTL
+	if (ioctl(sp->s_rfd, FIONBIO, (char *) &on) == -1) {
+		sq_remove(sp);
+		return (SERVFAIL);
+	}
+#else
 	if ((n = fcntl(sp->s_rfd, F_GETFL, 0)) == -1) {
 		sq_remove(sp);
 		return (SERVFAIL);
@@ -838,6 +856,7 @@ tcp_send(struct qinfo *qp) {
 		sq_remove(sp);
 		return (SERVFAIL);
 	}
+#endif
 	if (sq_openw(sp, qp->q_msglen + INT16SZ) == -1) {
 		sq_remove(sp);
 		return (SERVFAIL);
@@ -872,6 +891,12 @@ stream_send(evContext lev, void *uap, int fd, const void *la, int lalen,
 	    const void *ra, int ralen) {
 	struct qstream *sp = uap;
 
+	UNUSED(lev);
+	UNUSED(la);
+	UNUSED(lalen);
+	UNUSED(ra);
+	UNUSED(ralen);
+
 	ns_debug(ns_log_default, 1, "stream_send");
 
 	sp->flags &= ~STREAM_CONNECT_EV;
@@ -923,6 +948,8 @@ stream_getlen(evContext lev, void *uap, int fd, int bytes) {
 	struct qstream *sp = uap;
 	struct iovec iov;
 
+	UNUSED(fd);
+
 	sp->flags &= ~STREAM_READ_EV;
 	if (bytes != INT16SZ) {
 		/*
@@ -979,7 +1006,7 @@ stream_getlen(evContext lev, void *uap, int fd, int bytes) {
 	if (evRead(lev, sp->s_rfd, &iov, 1, stream_getmsg, sp, &sp->evID_r)
 	    == -1)
 		ns_panic(ns_log_default, 1, "evRead(fd %d): %s",
-			 (void *)sp->s_rfd, strerror(errno));
+			 sp->s_rfd, strerror(errno));
 	sp->flags |= STREAM_READ_EV;
 }
 
@@ -987,6 +1014,9 @@ static void
 stream_getmsg(evContext lev, void *uap, int fd, int bytes) {
 	struct qstream *sp = uap;
 
+	UNUSED(lev);
+	UNUSED(fd);
+
 	sp->flags &= ~STREAM_READ_EV;
 	if (bytes == -1) {
 		ns_info(ns_log_default, "stream_getmsg(%s): %s",
@@ -999,8 +1029,10 @@ stream_getmsg(evContext lev, void *uap, int fd, int bytes) {
 	sp->s_time = tt.tv_sec;
 
 	if (ns_wouldlog(ns_log_default,5)) {
-		ns_debug(ns_log_default, 5, "sp %#x rfd %d size %d time %d next %#x",
-			sp, sp->s_rfd, sp->s_size, sp->s_time, sp->s_next);
+		ns_debug(ns_log_default, 5,
+			 "sp %p rfd %d size %d time %ld next %p",
+			 sp, sp->s_rfd, sp->s_size, (long)sp->s_time,
+			 sp->s_next);
 		ns_debug(ns_log_default, 5, "\tbufsize %d bytes %d", sp->s_bufsize,
 			 bytes);
 	}
@@ -1034,13 +1066,16 @@ static void
 datagram_read(evContext lev, void *uap, int fd, int evmask) {
 	interface *ifp = uap;
 	struct sockaddr_in from;
-	int from_len = sizeof from;
+	ISC_SOCKLEN_T from_len = sizeof from;
 	int n, nudp;
 	union {
 		HEADER h;			/* Force alignment of 'buf'. */
-		u_char buf[PACKETSZ+1];
+		u_char buf[EDNS_MESSAGE_SZ+1];
 	} u;
 
+	UNUSED(lev);
+	UNUSED(evmask);
+
 	tt = evTimeVal(evNowTime());
 	nudp = 0;
 
@@ -1088,16 +1123,16 @@ datagram_read(evContext lev, void *uap, int fd, int evmask) {
 			 sin_ntoa(from), fd, n);
 	}
 
-	if (n > PACKETSZ) {
+	if (n > EDNS_MESSAGE_SZ) {
 		/*
 		 * The message is too big.  It's probably a response to
 		 * one of our questions, so we truncate it and press on.
 		 */
-		n = trunc_adjust(u.buf, PACKETSZ, PACKETSZ);
+		n = trunc_adjust(u.buf, EDNS_MESSAGE_SZ, EDNS_MESSAGE_SZ);
 		ns_debug(ns_log_default, 1, "truncated oversize UDP packet");
 	}
 
-	dispatch_message(u.buf, n, PACKETSZ, NULL, from, fd, ifp);
+	dispatch_message(u.buf, n, EDNS_MESSAGE_SZ, NULL, from, fd, ifp);
 	if (++nudp < nudptrans)
 		goto more;
 }
@@ -1106,8 +1141,11 @@ static void
 savedg_waitfunc(evContext ctx, void *uap, const void *tag) {
 	savedg *dg = (savedg *)uap;
 
+	UNUSED(ctx);
+	UNUSED(tag);
+
 	if (!EMPTY(iflist) && HEAD(iflist)->gen == dg->gen) {
-		u_char buf[PACKETSZ];
+		u_char buf[EDNS_MESSAGE_SZ];
 
 		memcpy(buf, dg->buf, dg->buflen);
 		dispatch_message(buf, dg->buflen, sizeof buf, NULL,
@@ -1222,8 +1260,7 @@ getnetconf(int periodic_scan) {
 	for (;;) {
 		buf = memget(bufsiz);
 		if (!buf)
-			ns_panic(ns_log_default, 1,
-				"memget(interface)", NULL);
+			ns_panic(ns_log_default, 1, "memget(interface)");
 		ifc.ifc_len = bufsiz;
 		ifc.ifc_buf = buf;
 #ifdef IRIX_EMUL_IOCTL_SIOCGIFCONF
@@ -1244,7 +1281,7 @@ getnetconf(int periodic_scan) {
 			 * buffer we will grow it just in case and
 			 * retry.
 			 */
-			if (ifc.ifc_len + 2 * sizeof(ifreq) < bufsiz)
+			if ((int)(ifc.ifc_len + 2 * sizeof(ifreq)) < bufsiz)
 				break;
 		}
 #endif
@@ -1345,7 +1382,7 @@ getnetconf(int periodic_scan) {
 				ifp = (interface *)memget(sizeof *ifp);
 				if (!ifp)
 					ns_panic(ns_log_default, 1,
-						 "memget(interface)", NULL);
+						 "memget(interface)");
 				memset(ifp, 0, sizeof *ifp);
 				INIT_LINK(ifp, link);
 				APPEND(iflist, ifp, link);
@@ -1491,8 +1528,8 @@ static int
 opensocket_d(interface *ifp) {
 	struct sockaddr_in nsa;
 	const int on = 1;
-	int m, n;
-	int fd;
+	ISC_SOCKLEN_T m;
+	int n;
 
 	memset(&nsa, 0, sizeof nsa);
 	nsa.sin_family = AF_INET;
@@ -1509,6 +1546,14 @@ opensocket_d(interface *ifp) {
 		close(ifp->dfd);
 		return (-1);
 	}
+#ifdef USE_FIONBIO_IOCTL
+	if (ioctl(ifp->dfd, FIONBIO, (char *) &on) == -1) {
+		ns_info(ns_log_default, "ioctl(ifp->dfd, FIONBIO): %s",
+			strerror(errno));
+		(void) close(ifp->dfd);
+		return (-1);
+	}
+#else
 	if ((n = fcntl(ifp->dfd, F_GETFL, 0)) == -1) {
 		ns_info(ns_log_default, "fcntl(ifp->dfd, F_GETFL): %s",
 			strerror(errno));
@@ -1521,6 +1566,7 @@ opensocket_d(interface *ifp) {
 		(void) close(ifp->dfd);
 		return (-1);
 	}
+#endif
 	if (fcntl(ifp->dfd, F_SETFD, 1) < 0) {
 		ns_error(ns_log_default, "F_SETFD: %s", strerror(errno));
 		close(ifp->dfd);
@@ -1529,7 +1575,7 @@ opensocket_d(interface *ifp) {
 	ns_debug(ns_log_default, 1, "ifp->addr %s d_dfd %d",
 		 sin_ntoa(nsa), ifp->dfd);
 	if (setsockopt(ifp->dfd, SOL_SOCKET, SO_REUSEADDR,
-	    (char *)&on, sizeof(on)) != 0) {
+		       (const char *)&on, sizeof(on)) != 0) {
 		ns_notice(ns_log_default, "setsockopt(REUSEADDR): %s",
 			  strerror(errno));
 		/* XXX press on regardless, this is not too serious. */
@@ -1540,12 +1586,12 @@ opensocket_d(interface *ifp) {
 	    && (m == sizeof n)
 	    && (n < drbufsize)) {
 		(void) setsockopt(ifp->dfd, SOL_SOCKET, SO_RCVBUF,
-				  (char *)&drbufsize, sizeof drbufsize);
+				  (const char *)&drbufsize, sizeof drbufsize);
 	}
 #endif /* SO_RCVBUF */
 #ifndef CANNOT_SET_SNDBUF
 	if (setsockopt(ifp->dfd, SOL_SOCKET, SO_SNDBUF,
-		      (char*)&dsbufsize, sizeof dsbufsize) < 0) {
+		       (const char*)&dsbufsize, sizeof dsbufsize) < 0) {
 		ns_info(ns_log_default,
 			"setsockopt(dfd=%d, SO_SNDBUF, %d): %s",
 			ifp->dfd, dsbufsize, strerror(errno));
@@ -1583,10 +1629,10 @@ drain_rcvbuf(evContext ctx, interface *ifp, int fd, int *mread, int *mstore) {
 	for (; *mread > 0; (*mread)--) {
 		union {
 			HEADER h;
-			u_char buf[PACKETSZ+1];
+			u_char buf[EDNS_MESSAGE_SZ+1];
 		} u;
 		struct sockaddr_in from;
-		int from_len = sizeof from;
+		ISC_SOCKLEN_T from_len = sizeof from;
 		savedg *dg;
 		int n;
 
@@ -1595,7 +1641,7 @@ drain_rcvbuf(evContext ctx, interface *ifp, int fd, int *mread, int *mstore) {
 		if (n <= 0)
 			break;		/* Socket buffer assumed empty. */
 		drop++;			/* Pessimistic assumption. */
-		if (n > PACKETSZ)
+		if (n > EDNS_MESSAGE_SZ)
 			continue;	/* Oversize message - EDNS0 needed. */
 		if (from.sin_family != AF_INET)
 			continue;	/* Not IPv4 - IPv6 needed. */
@@ -1655,7 +1701,6 @@ opensocket_s(interface *ifp) {
 	struct sockaddr_in nsa;
 	const int on = 1;
 	int n;
-	int fd;
 
 	memset(&nsa, 0, sizeof nsa);
 	nsa.sin_family = AF_INET;
@@ -1683,7 +1728,7 @@ opensocket_s(interface *ifp) {
 		return (-1);
 	}
 	if (setsockopt(ifp->sfd, SOL_SOCKET, SO_REUSEADDR,
-		       (char *)&on, sizeof on) != 0) {
+		       (const char *)&on, sizeof on) != 0) {
 		ns_notice(ns_log_default, "setsockopt(REUSEADDR): %s",
 			  strerror(errno));
 		/* Consider that your first warning of trouble to come. */
@@ -1728,7 +1773,8 @@ opensocket_f() {
 	static interface *prev_ifp;
 	struct sockaddr_in nsa;
 	const int on = 1;
-	int n, need_close;
+	ISC_SOCKLEN_T n;
+	int need_close;
 	interface *ifp;
 
 	need_close = 0;
@@ -1786,7 +1832,7 @@ opensocket_f() {
 	if (fcntl(ds, F_SETFD, 1) < 0)
 		ns_panic(ns_log_default, 1, "F_SETFD: %s", strerror(errno));
 	if (setsockopt(ds, SOL_SOCKET, SO_REUSEADDR,
-	    (char *)&on, sizeof on) != 0) {
+		       (const char *)&on, sizeof on) != 0) {
 		ns_notice(ns_log_default, "setsockopt(REUSEADDR): %s",
 			  strerror(errno));
 		/* XXX press on regardless, this is not too serious. */
@@ -1816,7 +1862,7 @@ opensocket_f() {
 
 	if (evSelectFD(ev, ds, EV_READ, datagram_read, NULL, &ds_evID) == -1)
 		ns_panic(ns_log_default, 1, "evSelectFD(fd %d): %s",
-			 (void *)ds, strerror(errno));
+			 ds, strerror(errno));
 	/* XXX: should probably use a different FileFunc that only accepts
 	 *	responses, since requests on this socket make no sense.
 	 */
@@ -1833,6 +1879,8 @@ setdebug(int new_debug) {
 	debug = new_debug;
 	log_option(log_ctx, LOG_OPTION_DEBUG, debug);
 	log_option(log_ctx, LOG_OPTION_LEVEL, debug);
+	if (old_debug && !debug)
+		log_close_debug_channels(log_ctx);
 	evSetDebug(ev, debug, log_get_stream(eventlib_channel));
 	if (debug) {
 		if (!old_debug)
@@ -2017,6 +2065,8 @@ static void
 sq_writable(evContext ctx, void *uap, int fd, int evmask) {
 	struct qstream *qs = uap;
 
+	UNUSED(ctx);
+
 	INSIST(evmask & EV_WRITE);
 	INSIST(fd == qs->s_rfd);
 	if (sq_dowrite(qs) < 0) {
@@ -2118,7 +2168,7 @@ sq_done(struct qstream *sp) {
 	if (evRead(ev, sp->s_rfd, &iov, 1, stream_getlen, sp, &sp->evID_r) ==
 	    -1)
 		ns_panic(ns_log_default, 1, "evRead(fd %d): %s",
-			 (void *)sp->s_rfd, strerror(errno));
+			 sp->s_rfd, strerror(errno));
 	sp->flags |= STREAM_READ_EV;
 }
 
@@ -2359,7 +2409,7 @@ nsid_hash(u_char *data, size_t len) {
 	 * fast.
 	 */
 	while (len-- > 0) {
-		HASHROTATE(nsid_hash_state);
+		nsid_hash_state = HASHROTATE(nsid_hash_state);
 		nsid_hash_state += *data++;
 	}
 }
@@ -2566,8 +2616,7 @@ nsid_init(void) {
 		nsid_vtable = memget(NSID_SHUFFLE_TABLE_SIZE *
 				     (sizeof(u_int16_t)) );
 		if (!nsid_vtable)
-			ns_panic(ns_log_default, 1, "memget(nsid_vtable)",
-				 NULL);
+			ns_panic(ns_log_default, 1, "memget(nsid_vtable)");
 		for (i = 0; i < NSID_SHUFFLE_TABLE_SIZE; i++) {
 			nsid_vtable[i] = nsid_state;
 			nsid_state = (((u_long) nsid_a1 * nsid_state) + nsid_c1)
@@ -2579,7 +2628,7 @@ nsid_init(void) {
 		nsid_algorithm = NSID_USE_POOL;
 		nsid_pool = memget(0x10000 * (sizeof(u_int16_t)));
 		if (!nsid_pool)
-			ns_panic(ns_log_default, 1, "memget(nsid_pool)", NULL);
+			ns_panic(ns_log_default, 1, "memget(nsid_pool)");
 		for (i = 0; ; i++) {
 			nsid_pool[i] = nsid_state;
 			nsid_state = (((u_long) nsid_a1 * nsid_state) + nsid_c1)                                     & 0xFFFF;
@@ -2632,8 +2681,10 @@ nsid_next() {
 			nsid_state = 0;
 		else
 			nsid_state++;
-	} else
-		ns_panic(ns_log_default, 1, "Unknown ID algorithm", NULL);
+	} else {
+		id = 0;	/* silence compiler */
+		ns_panic(ns_log_default, 1, "Unknown ID algorithm");
+	}
 
 	/* Now lets obfuscate ... */
 	id = (((u_long) nsid_a2 * id) + nsid_c2) & 0xFFFF;
@@ -2682,11 +2733,17 @@ deallocate_everything(void) {
 	if (nsid_pool != NULL)
 		memput(nsid_pool, 0x10000 * (sizeof(u_int16_t)));
 	nsid_pool = NULL;
+	if (nsid_vtable != NULL)
+		memput(nsid_vtable, NSID_SHUFFLE_TABLE_SIZE *
+				     (sizeof(u_int16_t)));
+	nsid_vtable = NULL;
 	irs_destroy();
 	if (f != NULL) {
 		memstats(f);
 		(void)fclose(f);
 	}
+	if (memactive())
+		abort();
 }
 	
 static void
@@ -2753,7 +2810,7 @@ toggle_qrylog(void) {
 
 static void
 wild(void) {
-	ns_panic(ns_log_default, 1, "wild need", NULL);
+	ns_panic(ns_log_default, 1, "wild need");
 }
 
 /*
@@ -2803,7 +2860,7 @@ handle_needs(void) {
 		INSIST_ERR(evDo(ev, (void *)handle_needs) != -1);
 		return;
 	}
-	ns_panic(ns_log_default, 1, "ns_handle_needs: queued == 0", NULL);
+	ns_panic(ns_log_default, 1, "ns_handle_needs: queued == 0");
 }
 
 static void
@@ -2812,6 +2869,8 @@ need_waitfunc(evContext ctx, void *uap, const void *tag) {
 	time_t begin;
 	long syncdelay;
 
+	UNUSED(tag);
+
 	begin = time(NULL);
 	(*hand)();
 	syncdelay = time(NULL) - begin;
diff --git a/contrib/bind/bin/named/ns_maint.c b/contrib/bind/bin/named/ns_maint.c
index 8220e51..0408936 100644
--- a/contrib/bind/bin/named/ns_maint.c
+++ b/contrib/bind/bin/named/ns_maint.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_maint.c	4.39 (Berkeley) 3/2/91";
-static const char rcsid[] = "$Id: ns_maint.c,v 8.122.2.4 2001/08/10 03:00:11 marka Exp $";
+static const char rcsid[] = "$Id: ns_maint.c,v 8.131 2001/11/12 04:49:32 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -267,11 +267,8 @@ zone_maint(struct zoneinfo *zp) {
 		break;
 	}
 
-	/*
-	 * It is essential that we never try to set a timer in the past
-	 * or for now because doing so could cause an infinite loop.
-	 */
-	INSIST(zp->z_time == 0 || zp->z_time > tt.tv_sec);
+	if (zp->z_time != 0 && zp->z_time < tt.tv_sec)
+		zp->z_time = tt.tv_sec;
 
 	sched_zone_maint(zp);
 }
@@ -282,6 +279,10 @@ do_zone_maint(evContext ctx, void *uap, struct timespec due,
 	ztimer_info zti = uap;
 	struct zoneinfo *zp;
 
+	UNUSED(ctx);
+	UNUSED(due);
+	UNUSED(inter);
+
 	INSIST(zti != NULL);
 	
 	ns_debug(ns_log_maint, 1, "do_zone_maint for zone %s (class %s)",
@@ -403,6 +404,10 @@ ns_cleancache(evContext ctx, void *uap,
 {
 	int deleted;
 
+	UNUSED(ctx);
+	UNUSED(due);
+	UNUSED(inter);
+
 	gettime(&tt);
 	INSIST(uap == NULL);
 	deleted = clean_cache(hashtab, 0);
@@ -416,6 +421,10 @@ ns_heartbeat(evContext ctx, void *uap, struct timespec due,
 {
 	struct zoneinfo *zp;
 
+	UNUSED(ctx);
+	UNUSED(due);
+	UNUSED(inter);
+
 	gettime(&tt);
 	INSIST(uap == NULL);
 
@@ -515,9 +524,9 @@ qserial_query(struct zoneinfo *zp) {
 	}
 
 	qp = sysquery(zp->z_origin, zp->z_class, T_SOA,
-		      zp->z_addr, zp->z_addrcnt,
+		      zp->z_addr, zp->z_keys, zp->z_addrcnt,
 		      ntohs(zp->z_port) ? zp->z_port : ns_port,
-		      QUERY);
+		      QUERY, 0);
 	if (qp == NULL) {
 		ns_debug(ns_log_default, 1,
 			 "qserial_query(%s): sysquery FAILED",
@@ -572,7 +581,7 @@ qserial_answer(struct qinfo *qp) {
 		qs = &qp->q_addr[n];
 		ns_debug(ns_log_default, 1, "qserial_answer(%s): [%s] -> %lu",
 			 zp->z_origin, inet_ntoa(qs->ns_addr.sin_addr),
-			 qs->serial);
+			 (unsigned long)qs->serial);
 		/* Don't consider serials which weren't set by a response. */
 		if (qs->serial == 0)
 			continue;
@@ -607,7 +616,7 @@ qserial_answer(struct qinfo *qp) {
 			ns_debug(ns_log_default, 1,
 				 "qserial_answer after sort: [%s] -> %lu",
 				 inet_ntoa(qs->ns_addr.sin_addr),
-				 qs->serial);
+				 (unsigned long)qs->serial);
 		}
 	}
 
@@ -647,18 +656,28 @@ qserial_answer(struct qinfo *qp) {
  *	 1:	Tsig info successfully written.
  */
 static int
-write_tsig_info(struct in_addr addr, char *name, int *fd) {
+write_tsig_info(struct zoneinfo *zp, struct in_addr addr, char *name, int *fd) {
 	server_info si;
-	DST_KEY *dst_key;
+	DST_KEY *dst_key = NULL;
 	int tsig_fd = *fd;
 	char tsig_str[1024], secret_buf64[172];
 	u_char secret_buf[128];
 	int secret_len, len;
+	int i;
 
-	si = find_server(addr);
-	if (si == NULL || si->key_list == NULL || si->key_list->first == NULL)
-		return(0);
-	dst_key = si->key_list->first->key;
+	for (i = 0; i < zp->z_addrcnt ; i++)
+		if (memcmp(&addr, &zp->z_addr[i], sizeof(addr)) == 0) {
+			dst_key = zp->z_keys[i];
+			break;
+		}
+
+	if (dst_key == NULL) {
+		si = find_server(addr);
+		if (si == NULL || si->key_list == NULL ||
+		    si->key_list->first == NULL)
+			return(0);
+		dst_key = si->key_list->first->key;
+	}
 	if (tsig_fd == -1) {
 		*fd = tsig_fd = mkstemp(name);
 		if (tsig_fd < 0) {
@@ -679,7 +698,7 @@ write_tsig_info(struct in_addr addr, char *name, int *fd) {
 	if (len == -1)
 		return (-1);
 	/* We need snprintf! */
-	if (strlen(dst_key->dk_key_name) + len + sizeof("XXX.XXX.XXX.XXX"),
+	if (strlen(dst_key->dk_key_name) + len + sizeof("XXX.XXX.XXX.XXX") +
 	    sizeof("123") + 5 > sizeof(tsig_str))
 		return (-1);
 	sprintf(tsig_str, "%s\n%s\n%d\n%s\n",
@@ -707,7 +726,7 @@ write_tsigs(struct zoneinfo *zp, char *tsig_name) {
 		if (aIsUs(a) && ns_port == zp->z_port)
 			continue;
 
-		tsig_ret = write_tsig_info(a, tsig_name, &tsig_fd);
+		tsig_ret = write_tsig_info(zp, a, tsig_name, &tsig_fd);
 		switch (tsig_ret) {
 		case -1:
 			goto error;
@@ -757,7 +776,8 @@ supports_ixfr(struct zoneinfo *zp) {
  */
 static void
 startxfer(struct zoneinfo *zp) {
-	char *argv[NSMAX*2 + 20], argv_ns[NSMAX][MAXDNAME];
+	char *argv[NSMAX*2 + 20];
+	char argv_ns[NSMAX][MAXDNAME];
 	int argc = 0, argc_ns = 0, i;
 	pid_t pid;
 	u_int cnt;
@@ -773,50 +793,50 @@ startxfer(struct zoneinfo *zp) {
 		 zp->z_origin[0] != '\0' ? zp->z_origin : ".");
 
 	argv[argc++] = server_options->named_xfer;
-	argv[argc++] = "-z";
-	argv[argc++] = zp->z_origin;
-	argv[argc++] = "-f";
+	DE_CONST("-z", argv[argc++]);
+	DE_CONST(*zp->z_origin ? zp->z_origin : ".", argv[argc++]);
+	DE_CONST("-f", argv[argc++]);
 	argv[argc++] = zp->z_source;
 #ifdef BIND_IXFR
 	if (supports_ixfr(zp) && zp->z_ixfr_tmp != NULL) {
-		argv[argc++] = "-i";
+		DE_CONST("-i", argv[argc++]);
 		argv[argc++] = zp->z_ixfr_tmp;
 	}
 #endif
 	if (zp->z_serial != 0) {
-		argv[argc++] = "-s";
+		DE_CONST("-s", argv[argc++]);
 		sprintf(serial_str, "%u", zp->z_serial);
 		argv[argc++] = serial_str;
 	}
 	if (zp->z_axfr_src.s_addr != 0 ||
 	    server_options->axfr_src.s_addr != 0) {
-		argv[argc++] = "-x";
+		DE_CONST("-x", argv[argc++]);
 		argv[argc++] = strcpy(src_str, inet_ntoa(
 			(zp->z_axfr_src.s_addr != 0) ? zp->z_axfr_src :
 			server_options->axfr_src));
 	}
-	argv[argc++] = "-C";
+	DE_CONST("-C", argv[argc++]);
 	sprintf(class_str, "%d", zp->z_class);
 	argv[argc++] = class_str;
  	if (zp->z_flags & Z_SYSLOGGED)
-		argv[argc++] = "-q";
-	argv[argc++] = "-P";
+		DE_CONST("-q", argv[argc++]);
+	DE_CONST("-P", argv[argc++]);
 	sprintf(port_str, "%d", ntohs(zp->z_port) != 0 ? zp->z_port : ns_port);
 	argv[argc++] = port_str;
 #ifdef STUBS
 	if (zp->z_type == Z_STUB)
-		argv[argc++] = "-S";
+		DE_CONST("-S", argv[argc++]);
 #endif
 #ifdef DEBUG
 	if (debug) {
-		argv[argc++] = "-d";
+		DE_CONST("-d", argv[argc++]);
 		sprintf(debug_str, "%d", debug);
 		argv[argc++] = debug_str;
-		argv[argc++] = "-l";
-		argv[argc++] = _PATH_XFERDDT;
+		DE_CONST("-l", argv[argc++]);
+		DE_CONST(_PATH_XFERDDT, argv[argc++]);
 		if (debug > 5) {
-			argv[argc++] = "-t";
-			argv[argc++] = _PATH_XFERTRACE;
+			DE_CONST("-t", argv[argc++]);
+			DE_CONST(_PATH_XFERTRACE, argv[argc++]);
 		}
 	}
 #endif
@@ -840,7 +860,7 @@ startxfer(struct zoneinfo *zp) {
 		return;
 	}
 	if (tsig_ret != 0) {
-		argv[argc++] = "-T";
+		DE_CONST("-T", argv[argc++]);
 		argv[argc++] = tsig_name;
 	}
 
@@ -867,9 +887,9 @@ startxfer(struct zoneinfo *zp) {
 
 			if (si != NULL &&
 			    (si->flags & SERVER_INFO_SUPPORT_IXFR) != 0)
-				argv[argc++] = "ixfr";
+				DE_CONST("ixfr", argv[argc++]);
 			else
-				argv[argc++] = "axfr";
+				DE_CONST("axfr", argv[argc++]);
 		}
 #endif
 	}
@@ -985,8 +1005,9 @@ printzoneinfo(int zonenum, int category, int level) {
 	if (zp->z_type == z_master && (zp->z_flags & Z_DYNAMIC) != 0) {
 		ns_debug(category, level,
 			 "\tdumpintvl %lu, soaincrintvl %lu deferupdcnt %lu",
-			 zp->z_dumpintvl, zp->z_soaincrintvl,
-			 zp->z_deferupdcnt);
+			 (unsigned long)zp->z_dumpintvl,
+			 (unsigned long)zp->z_soaincrintvl,
+			 (unsigned long)zp->z_deferupdcnt);
 		if (zp->z_soaincrtime)
 			ns_debug(category, level,
 				 "\tz_soaincrtime %lu (now %lu, left: %lu)",
@@ -1240,9 +1261,8 @@ valid_glue(struct databuf *dp, char *name, int belowcut) {
 	    ns_samedomain((char*)dp->d_data, zones[dp->d_zone].z_origin))
 		return (1);
 
-	/* NOKEY is in parent zone otherwise child zone */
-	if (dp->d_type == T_KEY && dp->d_size == 4 &&
-	    (dp->d_data[0] & 0xc3) == 0xc1)
+	/* KEY RRset may be in the parent */
+	if (dp->d_type == T_KEY)
 		return (1);
 
 	/* NXT & KEY records may be signed */
@@ -1593,10 +1613,11 @@ endxfer() {
 					zp->z_xferpid = XFER_ISAXFR;
 					if (exitstatus == XFER_SUCCESSAXFRIXFRFILE) {
 						zp->z_xferpid = XFER_ISAXFRIXFR;
+						if (zp->z_ixfr_tmp != NULL)
+							isc_movefile(
+								zp->z_ixfr_tmp,
+								zp->z_source);
 					} 
-					if (zp->z_ixfr_tmp != NULL)
-						isc_movefile(zp->z_ixfr_tmp,
-							     zp->z_source);
 					/* XXX should incorporate loadxfer() */
 					zp->z_flags |= Z_NEED_RELOAD;
 					zp->z_flags &= ~Z_SYSLOGGED;
diff --git a/contrib/bind/bin/named/ns_ncache.c b/contrib/bind/bin/named/ns_ncache.c
index 2b8bb6b..5667f36 100644
--- a/contrib/bind/bin/named/ns_ncache.c
+++ b/contrib/bind/bin/named/ns_ncache.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_ncache.c,v 8.27 2000/04/21 06:54:09 vixie Exp $";
+static const char rcsid[] = "$Id: ns_ncache.c,v 8.29 2001/06/18 14:43:16 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -121,7 +121,7 @@ cache_n_resp(u_char *msg, int msglen, struct sockaddr_in from,
 
 	while (ancount--) {
 		u_int32_t ttl;
-		u_int atype, aclass;
+		int atype, aclass;
 
 		n = dn_skipname(cp, eom);
 		if (n < 0) {
@@ -257,14 +257,14 @@ cache_n_resp(u_char *msg, int msglen, struct sockaddr_in from,
 		flags = DB_NOTAUTH|DB_NOHINTS;
 	}
 
-	if ((n = db_update(dname, dp, dp, NULL, flags, hashtab, from)) != OK) {
+	n = db_update(dname, dp, dp, NULL, flags, hashtab, from);
+	if (n != OK)
 		ns_debug(ns_log_ncache, 1,
 			 "db_update failed (%d), cache_n_resp()", n);
-		db_freedata(dp);
-		return;
-	}
-	ns_debug(ns_log_ncache, 4,
-		 "ncache succeeded: [%s %s %s] rcode:%d ttl:%ld",
-		    dname, p_type(type), p_class(class),
-		    dp->d_rcode, (long)(dp->d_ttl - tt.tv_sec));
+	else
+		ns_debug(ns_log_ncache, 4,
+			 "ncache succeeded: [%s %s %s] rcode:%d ttl:%ld",
+			 dname, p_type(type), p_class(class),
+			 dp->d_rcode, (long)(dp->d_ttl - tt.tv_sec));
+	db_detach(&dp);
 }
diff --git a/contrib/bind/bin/named/ns_notify.c b/contrib/bind/bin/named/ns_notify.c
index 20fd700..cde636a 100644
--- a/contrib/bind/bin/named/ns_notify.c
+++ b/contrib/bind/bin/named/ns_notify.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_notify.c,v 8.14 2001/04/01 18:38:36 vixie Exp $";
+static const char rcsid[] = "$Id: ns_notify.c,v 8.18 2001/11/12 04:49:33 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -146,7 +146,7 @@ ns_notify(const char *dname, ns_class class, ns_type type) {
 		       evConsTime(0, 0), &ni->timer) < 0) {
 		ns_error(ns_log_notify, "evSetTimer() failed: %s",
 			 strerror(errno));
-		freestr(ni->name);
+		ni->name = freestr(ni->name);
 		memput(ni, sizeof *ni);
 		return;
 	}
@@ -168,7 +168,7 @@ notify_afterload() {
 	while ((ni = HEAD(loading_notifies)) != NULL) {
 		UNLINK(loading_notifies, ni, link);
 		ns_notify(ni->name, ni->class, ni->type);
-		freestr(ni->name);
+		ni->name = freestr(ni->name);
 		memput(ni, sizeof *ni);
 	}
 }
@@ -262,8 +262,8 @@ sysnotify(const char *dname, ns_class class, ns_type type) {
 		for (i = 0; i < zp->z_notify_count; i++) {
 			ns_debug(ns_log_notify, 4, "notifying %s",
 				 inet_ntoa(*also_addr));
-			sysquery(dname, class, type, also_addr, 1, ns_port,
-				 NS_NOTIFY_OP);
+			sysquery(dname, class, type, also_addr, NULL, 1,
+				 ns_port, NS_NOTIFY_OP, 0);
 			also_addr++;
 		}
 		nns += zp->z_notify_count;
@@ -275,8 +275,8 @@ sysnotify(const char *dname, ns_class class, ns_type type) {
 		for (i = 0; i < server_options->notify_count; i++) {
 			ns_debug(ns_log_notify, 3, "notifying %s",
 				 inet_ntoa(*also_addr));
-			sysquery(dname, class, type, also_addr,
-				 1, ns_port, ns_o_notify);
+			sysquery(dname, class, type, also_addr, NULL, 1,
+				 ns_port, ns_o_notify, 0);
 			also_addr++;
 		}
 		nns += server_options->notify_count;
@@ -387,14 +387,14 @@ sysnotify_ns(const char *dname, const char *aname,
 		if (!is_us && !cname && !NS_OPTION_P(OPTION_NOFETCHGLUE)) {
 			struct qinfo *qp;
 
-			qp = sysquery(aname, class, ns_t_a, 0, 0, ns_port,
-				      ns_o_query);
+			qp = sysquery(aname, class, ns_t_a, NULL, NULL, 0,
+				      ns_port, ns_o_query, 0);
 			if (qp != NULL)
 				qp->q_notifyzone = zn;
 		}
 		return;
 	}
-	sysquery(dname, class, type, nss, nsc, ns_port, ns_o_notify);
+	sysquery(dname, class, type, nss, NULL, nsc, ns_port, ns_o_notify, 0);
 	(*nns)++;
 	*na += nsc;
 }
@@ -413,7 +413,7 @@ free_notify(struct notify *ni) {
 		evClearTimer(ev, ni->timer);
 		evInitID(&ni->timer);
 	}
-	freestr(ni->name);
+	ni->name = freestr(ni->name);
 	memput(ni, sizeof *ni);
 }
 
@@ -424,6 +424,10 @@ notify_timer(evContext ctx, void *uap,
 {
 	struct notify *ni = uap;
 
+	UNUSED(ctx);
+	UNUSED(due);
+	UNUSED(inter);
+
 	INSIST(evTestID(ni->timer));
 	evInitID(&ni->timer);
 	INSIST(LINKED(ni, link));
diff --git a/contrib/bind/bin/named/ns_parser.y b/contrib/bind/bin/named/ns_parser.y
index ed49549..0fe9dc7 100644
--- a/contrib/bind/bin/named/ns_parser.y
+++ b/contrib/bind/bin/named/ns_parser.y
@@ -1,6 +1,6 @@
 %{
 #if !defined(lint) && !defined(SABER)
-static char rcsid[] = "$Id: ns_parser.y,v 8.63.2.4 2001/04/30 08:03:02 marka Exp $";
+static char rcsid[] = "$Id: ns_parser.y,v 8.78 2001/12/28 04:07:48 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -65,6 +65,7 @@ static symbol_table symtab;
 
 #define AUTH_TABLE_SIZE 397		/* should always be prime */
 static symbol_table authtab = NULL;
+static symbol_table channeltab = NULL;
 
 static zone_config current_zone;
 static int should_install;
@@ -94,7 +95,7 @@ static int chan_versions;
 static u_long chan_max_size;
 
 static log_channel lookup_channel(char *);
-static void define_channel(char *, log_channel);
+static void define_channel(const char *, log_channel);
 static char *canonical_name(char *);
 
 int yyparse();
@@ -132,7 +133,7 @@ int yyparse();
 %token			T_DIRECTORY T_PIDFILE T_NAMED_XFER
 %token			T_DUMP_FILE T_STATS_FILE T_MEMSTATS_FILE
 %token			T_FAKE_IQUERY T_RECURSION T_FETCH_GLUE 
-%token			T_HITCOUNT
+%token			T_HITCOUNT T_PREFERRED_GLUE
 %token			T_QUERY_SOURCE T_LISTEN_ON T_PORT T_ADDRESS
 %token			T_RRSET_ORDER T_ORDER T_NAME T_CLASS
 %token			T_CONTROLS T_INET T_UNIX T_PERM T_OWNER T_GROUP T_ALLOW
@@ -143,14 +144,16 @@ int yyparse();
 %type	<ip_addr>	maybe_wild_addr
 %token			T_DATASIZE T_STACKSIZE T_CORESIZE
 %token			T_DEFAULT T_UNLIMITED
-%token			T_FILES T_VERSION
+%token			T_FILES T_VERSION T_HOSTNAME
 %token			T_HOSTSTATS T_HOSTSTATSMAX T_DEALLOC_ON_EXIT
 %token			T_TRANSFERS_IN T_TRANSFERS_OUT T_TRANSFERS_PER_NS
 %token			T_TRANSFER_FORMAT T_MAX_TRANSFER_TIME_IN
 %token			T_SERIAL_QUERIES T_ONE_ANSWER T_MANY_ANSWERS
 %type	<axfr_fmt>	transfer_format
-%token			T_NOTIFY T_AUTH_NXDOMAIN T_MULTIPLE_CNAMES T_USE_IXFR T_MAINTAIN_IXFR_BASE
-%token			T_CLEAN_INTERVAL T_INTERFACE_INTERVAL T_STATS_INTERVAL T_MAX_LOG_SIZE_IXFR
+%token			T_NOTIFY T_NOTIFY_INITIAL T_AUTH_NXDOMAIN
+%token			T_MULTIPLE_CNAMES T_USE_IXFR T_MAINTAIN_IXFR_BASE
+%token			T_CLEAN_INTERVAL T_INTERFACE_INTERVAL T_STATS_INTERVAL
+%token			T_MAX_LOG_SIZE_IXFR
 %token			T_HEARTBEAT T_USE_ID_POOL
 %token			T_MAX_NCACHE_TTL T_HAS_OLD_CLIENTS T_RFC2308_TYPE1
 %token			T_LAME_TTL T_MIN_ROOTS
@@ -268,7 +271,7 @@ statement: include_stmt
 include_stmt: T_INCLUDE L_QSTRING L_EOS
 	{
 		lexer_begin_file($2, NULL);
-		freestr($2);
+		(void)freestr($2);
 	}
 	;
 
@@ -298,48 +301,59 @@ options: option L_EOS
 	;
 
 option: /* Empty */
+	| T_HOSTNAME L_QSTRING
+	{
+		if (current_options->hostname != NULL)
+			(void)freestr(current_options->hostname);
+		current_options->hostname = $2;
+	}
 	| T_VERSION L_QSTRING
 	{
 		if (current_options->version != NULL)
-			freestr(current_options->version);
+			(void)freestr(current_options->version);
 		current_options->version = $2;
 	}
 	| T_DIRECTORY L_QSTRING
 	{
 		if (current_options->directory != NULL)
-			freestr(current_options->directory);
+			(void)freestr(current_options->directory);
 		current_options->directory = $2;
 	}
 	| T_NAMED_XFER L_QSTRING
 	{
 		if (current_options->named_xfer != NULL)
-			freestr(current_options->named_xfer);
+			(void)freestr(current_options->named_xfer);
 		current_options->named_xfer = $2;
 	}
 	| T_PIDFILE L_QSTRING
 	{
 		if (current_options->pid_filename != NULL)
-			freestr(current_options->pid_filename);
+			(void)freestr(current_options->pid_filename);
 		current_options->pid_filename = $2;
 	}
 	| T_STATS_FILE L_QSTRING
 	{
 		if (current_options->stats_filename != NULL)
-			freestr(current_options->stats_filename);
+			(void)freestr(current_options->stats_filename);
 		current_options->stats_filename = $2;
 	}
 	| T_MEMSTATS_FILE L_QSTRING
 	{
 		if (current_options->memstats_filename != NULL)
-			freestr(current_options->memstats_filename);
+			(void)freestr(current_options->memstats_filename);
 		current_options->memstats_filename = $2;
 	}
 	| T_DUMP_FILE L_QSTRING
 	{
 		if (current_options->dump_filename != NULL)
-			freestr(current_options->dump_filename);
+			(void)freestr(current_options->dump_filename);
 		current_options->dump_filename = $2;
 	}
+	| T_PREFERRED_GLUE L_STRING
+	{
+		current_options->preferred_glue =
+			strcasecmp($2, "aaaa") ? T_A : T_AAAA;
+	}
 	| T_FAKE_IQUERY yea_or_nay
 	{
 		set_global_boolean_option(current_options,
@@ -365,6 +379,14 @@ option: /* Empty */
 		set_global_boolean_option(current_options, 
 			OPTION_NONOTIFY, !$2);
 	}
+	| T_NOTIFY_INITIAL yea_or_nay
+	{
+		if (initial_configuration && $2)
+			ns_notice(ns_log_default,
+				  "suppressing initial notifies");
+		set_global_boolean_option(current_options, 
+			OPTION_SUPNOTIFY_INITIAL, $2);
+	}
 	| T_HOSTSTATS yea_or_nay
 	{
 		set_global_boolean_option(current_options,
@@ -428,8 +450,7 @@ option: /* Empty */
 		else {
 			add_listen_on(current_options, $2, $4);
 			value.pointer = NULL;
-			define_symbol(symtab, savestr(port_string, 1),
-				      SYM_PORT, value, SYMBOL_FREE_KEY);
+			define_symbol(symtab, port_string, SYM_PORT, value, 0);
 		}
 
 	}
@@ -600,6 +621,20 @@ control: /* Empty */
 	{
 		ns_ctl_add(&current_controls, ns_ctl_new_inet($2, $4, $7));
 	}
+	| T_INET maybe_wild_addr
+	  T_ALLOW '{' address_match_list '}'
+	  T_KEYS '{' dummy_key_list '}'
+	{
+		parser_warning(0, "Ignoring BIND 9 inet control clause");
+		free_ip_match_list($5);
+	}
+	| T_INET maybe_wild_addr T_PORT in_port
+	  T_ALLOW '{' address_match_list '}'
+	  T_KEYS '{' dummy_key_list '}'
+	{
+		parser_warning(0, "Ignoring BIND 9 inet control clause");
+		free_ip_match_list($7);
+	}
 	| T_UNIX L_QSTRING T_PERM L_NUMBER T_OWNER L_NUMBER T_GROUP L_NUMBER
 	{
 #ifndef NO_SOCKADDR_UN
@@ -644,7 +679,7 @@ ordering_class: /* nothing */
 			parser_error(0, "unknown class '%s'; using ANY", $2);
 			$$ = C_ANY;
 		}
-		freestr($2);
+		(void)freestr($2);
 	}
 	;
 
@@ -667,7 +702,7 @@ ordering_type: /* nothing */
 					     $2);
 			}
 		}
-		freestr($2);
+		(void)freestr($2);
 	}
 
 ordering_name: /* nothing */
@@ -678,7 +713,7 @@ ordering_name: /* nothing */
 	{
 		if (strcmp(".",$2) == 0 || strcmp("*.",$2) == 0) {
 			$$ = savestr("*", 1);
-			freestr($2);
+			(void)freestr($2);
 		} else {
 			$$ = $2 ;
 		}
@@ -702,7 +737,7 @@ rrset_ordering_element: ordering_class ordering_type ordering_name T_ORDER L_STR
 					     $5, p_order(o));
 			}
 			
-			freestr($5);
+			(void)freestr($5);
 			
 			$$ = new_rrset_order_element($1, $2, $3, o);
 		}
@@ -859,7 +894,7 @@ size_spec: any_string
 			/* 0 means "use default" */
 			$$ = 0;
 		}
-		freestr($1);
+		(void)freestr($1);
 	}
 	| L_NUMBER
 	{	
@@ -966,7 +1001,6 @@ logging_opt: T_CATEGORY category
 
 		if (lookup_channel($2) != NULL) {
 			parser_error(0, "can't redefine channel '%s'", $2);
-			freestr($2);
 		} else {
 			switch (chan_type) {
 			case log_file:
@@ -978,8 +1012,7 @@ logging_opt: T_CATEGORY category
 							     chan_max_size);
 				log_set_file_owner(current_channel,
 						   user_id, group_id);
-				freestr(chan_name);
-				chan_name = NULL;
+				chan_name = freestr(chan_name);
 				break;
 			case log_syslog:
 				current_channel =
@@ -1000,6 +1033,7 @@ logging_opt: T_CATEGORY category
 					 "couldn't create channel");
 			define_channel($2, current_channel);
 		}
+		(void)freestr($2);
 	}
 	;
 
@@ -1013,7 +1047,7 @@ channel_severity: any_string
 			parser_error(0, "unknown severity '%s'", $1);
 			chan_level = log_debug(99);
 		}
-		freestr($1);
+		(void)freestr($1);
 	}
 	| T_DEBUG
 	{
@@ -1087,7 +1121,7 @@ maybe_syslog_facility: /* nothing */ { $$ = LOG_DAEMON; }
 			parser_error(0, "unknown facility '%s'", $1);
 			$$ = LOG_DAEMON;
 		}
-		freestr($1);
+		(void)freestr($1);
 	}
 	;
 
@@ -1149,7 +1183,7 @@ channel: channel_name
 			} else
 				parser_error(0, "unknown channel '%s'", $1);
 		}
-		freestr($1);
+		(void)freestr($1);
 	}
 	;
 
@@ -1174,7 +1208,7 @@ category: category_name
 				     $1);
 			$$ = -1;
 		}
-		freestr($1);
+		(void)freestr($1);
 	}
 	;
 
@@ -1197,9 +1231,8 @@ server_stmt: T_SERVER L_IPADDR
 			parser_error(0, "cannot redefine server '%s'", 
 				     ip_printable);
 		else
-			define_symbol(symtab, savestr(ip_printable, 1),
-				      SYM_SERVER, value,
-				      SYMBOL_FREE_KEY);
+			define_symbol(symtab, ip_printable, SYM_SERVER, value,
+				      0);
 		current_server = begin_server($2);
 	}
 	'{' server_info_list '}'
@@ -1279,6 +1312,7 @@ address_match_element: address_match_simple
 		else
 			$$ = new_ip_match_key(dst_key);
 	        (void)freestr(key_name);
+		freestr($2);
 	}
 	;
 
@@ -1329,7 +1363,7 @@ address_match_simple: L_IPADDR
 		 * we give it a name and treat it like any other acl.
 		 */
 		sprintf(name, "__internal_%p", $2);
-		define_acl(savestr(name, 1), $2);
+		define_acl(name, $2);
   		$$ = new_ip_match_indirect($2);
 	}
 	;
@@ -1344,7 +1378,7 @@ address_name: any_string
 			$$ = NULL;
 		} else
 			$$ = new_ip_match_indirect(iml);
-		freestr($1);
+		(void)freestr($1);
 	}
 	;
 
@@ -1369,9 +1403,9 @@ key_ref: any_string
 				$$ = NULL;
 			} else
 				$$ = dst_key;
-			freestr(key_name);
+			key_name = freestr(key_name);
 		}
-		freestr($1);
+		(void)freestr($1);
 	}
 	;
 
@@ -1389,6 +1423,13 @@ key_list: key_list_element L_EOS
 	| error
 	;
 
+dummy_key_list_element: key_ref;
+
+dummy_key_list: dummy_key_list_element L_EOS
+	| dummy_key_list dummy_key_list_element L_EOS
+	| error
+	;
+
 key_stmt: T_SEC_KEY
 	{
 		current_algorithm = NULL;
@@ -1425,15 +1466,12 @@ key_stmt: T_SEC_KEY
 			}
 		}
 		if (key_name != NULL)
-			freestr(key_name);
-		key_name = NULL;
+			key_name = freestr(key_name);
 		if (current_algorithm != NULL)
-			freestr(current_algorithm);
-		current_algorithm = NULL;
+			current_algorithm = freestr(current_algorithm);
 		if (current_secret != NULL)
-			freestr(current_secret);
-		current_secret = NULL;
-		freestr($3);
+			current_secret = freestr(current_secret);
+		(void)freestr($3);
 	}
 	;
 	
@@ -1468,9 +1506,9 @@ acl_stmt: T_ACL any_string '{' address_match_list '}'
 	{
 		if (lookup_acl($2) != NULL) {
 			parser_error(0, "can't redefine ACL '%s'", $2);
-			freestr($2);
 		} else
 			define_acl($2, $4);
+		(void)freestr($2);
 	}
 	;
 
@@ -1506,12 +1544,11 @@ zone_stmt: T_ZONE L_QSTRING optional_class
 					     p_class($3));
 			} else {
 				should_install = 1;
-				define_symbol(symtab, savestr(zone_name, 1),
-					      sym_type, value,
-					      SYMBOL_FREE_KEY);
+				define_symbol(symtab, zone_name, sym_type,
+					      value, 0);
 			}
 		}
-		freestr($2);
+		(void)freestr($2);
 		current_zone = begin_zone(zone_name, $3); 
 	}
 	optional_zone_options_list
@@ -1538,7 +1575,7 @@ optional_class: /* Empty */
 			/* the zone validator will give the error */
 			$$ = C_NONE;
 		}
-		freestr($1);
+		(void)freestr($1);
 	}
 	;
 
@@ -1688,7 +1725,11 @@ master_in_addr_list: master_in_addr L_EOS
 
 master_in_addr: L_IPADDR
 	{
-	  	add_zone_master(current_zone, $1);
+	  	add_zone_master(current_zone, $1, NULL);
+	}
+	| L_IPADDR T_SEC_KEY key_ref
+	{
+		add_zone_master(current_zone, $1, $3);
 	}
 	;
 
@@ -1788,7 +1829,7 @@ in_port: L_NUMBER
 		if ($1 < 0 || $1 > 65535) {
 		  	parser_warning(0, 
 			  "invalid IP port number '%d'; setting port to 0",
-			               $1);
+			               (int)$1);
 			$1 = 0;
 		} else
 			$$ = htons($1);
@@ -1827,26 +1868,26 @@ init_acls() {
 	ime = new_ip_match_pattern(address, 0);
 	iml = new_ip_match_list();
 	add_to_ip_match_list(iml, ime);
-	define_acl(savestr("any", 1), iml);
+	define_acl("any", iml);
 
 	/* ACL "none" */
 	ime = new_ip_match_pattern(address, 0);
 	ip_match_negate(ime);
 	iml = new_ip_match_list();
 	add_to_ip_match_list(iml, ime);
-	define_acl(savestr("none", 1), iml);
+	define_acl("none", iml);
 
 	/* ACL "localhost" */
 	ime = new_ip_match_localhost();
 	iml = new_ip_match_list();
 	add_to_ip_match_list(iml, ime);
-	define_acl(savestr("localhost", 1), iml);
+	define_acl("localhost", iml);
 
 	/* ACL "localnets" */
 	ime = new_ip_match_localnets();
 	iml = new_ip_match_list();
 	add_to_ip_match_list(iml, ime);
-	define_acl(savestr("localnets", 1), iml);
+	define_acl("localnets", iml);
 }
 
 static void
@@ -1861,6 +1902,9 @@ free_sym_value(int type, void *value) {
 	case SYM_KEY:
 		free_key_info(value);
 		break;
+	case SYM_CHANNEL:
+		INSIST(log_free_channel(value) == 0);
+		break;
 	default:
 		ns_panic(ns_log_parser, 1,
 			 "unhandled case in free_sym_value()");
@@ -1873,25 +1917,26 @@ static log_channel
 lookup_channel(char *name) {
 	symbol_value value;
 
-	if (lookup_symbol(symtab, name, SYM_CHANNEL, &value))
+	if (lookup_symbol(channeltab, name, SYM_CHANNEL, &value))
 		return ((log_channel)(value.pointer));
 	return (NULL);
 }
 
 static void
-define_channel(char *name, log_channel channel) {
+define_channel(const char *name, log_channel channel) {
 	symbol_value value;
 
 	value.pointer = channel;  
-	define_symbol(symtab, name, SYM_CHANNEL, value, SYMBOL_FREE_KEY);
+	INSIST(log_inc_references(channel) == 0);
+	define_symbol(channeltab, name, SYM_CHANNEL, value, SYMBOL_FREE_VALUE);
 }
 
 static void
 define_builtin_channels() {
-	define_channel(savestr("default_syslog", 1), syslog_channel);
-	define_channel(savestr("default_debug", 1), debug_channel);
-	define_channel(savestr("default_stderr", 1), stderr_channel);
-	define_channel(savestr("null", 1), null_channel);
+	define_channel("default_syslog", syslog_channel);
+	define_channel("default_debug", debug_channel);
+	define_channel("default_stderr", stderr_channel);
+	define_channel("null", null_channel);
 }
 
 static void
@@ -1903,6 +1948,9 @@ parser_setup() {
 	if (authtab != NULL)
 		free_symbol_table(authtab);
 	authtab = new_symbol_table(AUTH_TABLE_SIZE, free_sym_value);
+	if (channeltab != NULL)
+		free_symbol_table(channeltab);
+	channeltab = new_symbol_table(AUTH_TABLE_SIZE, free_sym_value);
 	init_acls();
 	define_builtin_channels();
 	INIT_LIST(current_controls);
@@ -1924,7 +1972,7 @@ parser_cleanup() {
  */
 
 ip_match_list
-lookup_acl(char *name) {
+lookup_acl(const char *name) {
 	symbol_value value;
 
 	if (lookup_symbol(authtab, name, SYM_ACL, &value))
@@ -1933,15 +1981,14 @@ lookup_acl(char *name) {
 }
 
 void
-define_acl(char *name, ip_match_list iml) {
+define_acl(const char *name, ip_match_list iml) {
 	symbol_value value;
 
 	INSIST(name != NULL);
 	INSIST(iml != NULL);
 
 	value.pointer = iml;
-	define_symbol(authtab, name, SYM_ACL, value,
-		      SYMBOL_FREE_KEY|SYMBOL_FREE_VALUE);
+	define_symbol(authtab, name, SYM_ACL, value, SYMBOL_FREE_VALUE);
 	ns_debug(ns_log_parser, 7, "acl %s", name);
 	dprint_ip_match_list(ns_log_parser, iml, 2, "allow ", "deny ");
 }
@@ -1956,7 +2003,7 @@ lookup_key(char *name) {
 }
 
 void
-define_key(char *name, struct dst_key *dst_key) {
+define_key(const char *name, struct dst_key *dst_key) {
 	symbol_value value;
 
 	INSIST(name != NULL);
@@ -1996,5 +2043,7 @@ void
 parser_shutdown(void) {
 	if (authtab != NULL)
 		free_symbol_table(authtab);
+	if (channeltab != NULL)
+		free_symbol_table(channeltab);
 	lexer_shutdown();
 }
diff --git a/contrib/bind/bin/named/ns_parseutil.c b/contrib/bind/bin/named/ns_parseutil.c
index 4a26337..3619dc7 100644
--- a/contrib/bind/bin/named/ns_parseutil.c
+++ b/contrib/bind/bin/named/ns_parseutil.c
@@ -66,8 +66,7 @@ new_symbol_table(int size_guess, free_function free_value) {
 
 void
 free_symbol(symbol_table st, symbol_entry ste) {
-	if (ste->flags & SYMBOL_FREE_KEY)
-		freestr(ste->key);
+	ste->key = freestr(ste->key);
 	if (ste->flags & SYMBOL_FREE_VALUE)
 		(st->free_value)(ste->type, ste->value.pointer);
 }
@@ -147,7 +146,7 @@ lookup_symbol(symbol_table st, const char *key, int type,
 }
 
 void
-define_symbol(symbol_table st, char *key, int type, symbol_value value,
+define_symbol(symbol_table st, const char *key, int type, symbol_value value,
 	      unsigned int flags) {
 	int hash;
 	symbol_entry ste;
@@ -161,7 +160,7 @@ define_symbol(symbol_table st, char *key, int type, symbol_value value,
 		ste = (symbol_entry)memget(sizeof *ste);
 		if (ste == NULL)
 			panic("memget failed in define_symbol()", NULL);
-		ste->key = key;
+		ste->key = savestr(key, 1);
 		ste->type = type;
 		ste->value = value;
 		ste->flags = flags;
@@ -171,7 +170,7 @@ define_symbol(symbol_table st, char *key, int type, symbol_value value,
 		ns_debug(ns_log_parser, 7, "redefined symbol %s type %d",
 			 key, type);
 		free_symbol(st, ste);
-		ste->key = key;
+		ste->key = savestr(key, 1);
 		ste->value = value;
 		ste->flags = flags;
 	}
diff --git a/contrib/bind/bin/named/ns_parseutil.h b/contrib/bind/bin/named/ns_parseutil.h
index 77fc878..efb5c8f 100644
--- a/contrib/bind/bin/named/ns_parseutil.h
+++ b/contrib/bind/bin/named/ns_parseutil.h
@@ -22,7 +22,6 @@
  * Symbol Table
  */
 
-#define SYMBOL_FREE_KEY		0x01
 #define SYMBOL_FREE_VALUE	0x02
 
 typedef union symbol_value {
@@ -52,8 +51,8 @@ void			free_symbol_table(symbol_table);
 void			dprint_symbol_table(int, symbol_table);
 int			lookup_symbol(symbol_table, const char *, int,
 				      symbol_value *);
-void			define_symbol(symbol_table, char *, int, symbol_value,
-				      unsigned int);
+void			define_symbol(symbol_table, const char *, int,
+				      symbol_value, unsigned int);
 void			undefine_symbol(symbol_table, char *, int type);
 
 /*
diff --git a/contrib/bind/bin/named/ns_req.c b/contrib/bind/bin/named/ns_req.c
index 252ddbd..6695881 100644
--- a/contrib/bind/bin/named/ns_req.c
+++ b/contrib/bind/bin/named/ns_req.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_req.c	4.47 (Berkeley) 7/1/91";
-static const char rcsid[] = "$Id: ns_req.c,v 8.138.2.4 2001/08/10 03:00:14 marka Exp $";
+static const char rcsid[] = "$Id: ns_req.c,v 8.162 2002/02/01 00:05:36 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -153,11 +153,11 @@ static enum req_action	req_query(HEADER *hp, u_char **cpp, u_char *eom,
 				  int *buflenp, int *msglenp,
 				  u_char *msg, int dfd, int *ra,
 				  struct sockaddr_in from,
-				  struct tsig_record *in_tsig);
+				  struct tsig_record *in_tsig,
+				  u_int16_t udpsize);
 
 static enum req_action	req_iquery(HEADER *hp, u_char **cpp, u_char *eom,
-				   int *buflenp, u_char *msg,
-				   struct sockaddr_in from);
+				   int *buflenp, struct sockaddr_in from);
 
 #ifdef BIND_NOTIFY
 static enum req_action	req_notify(HEADER *hp, u_char **cpp, u_char *eom,
@@ -165,6 +165,132 @@ static enum req_action	req_notify(HEADER *hp, u_char **cpp, u_char *eom,
 #endif
 
 /*
+ * See if there is a OPT record at the end of the message.
+ *
+ * Results:
+ * -1	FORMERR
+ *  0	last RR is not a OPT record
+ * n>0	lenght of OPT record
+ */
+int
+ns_get_opt(u_char *msg, u_char *eom,
+	   u_int8_t *versionp, u_int16_t *rcodep, u_int16_t *flagp,
+	   u_int16_t *bufsizep, u_char **optionsp, size_t *optsizep)
+{
+	HEADER *hp = (HEADER *) msg;
+	u_char *start, *options, *cp;
+	u_int8_t version;
+	u_int16_t rdlen, type, bufsize, flags, optsize, rcode;
+	int i, n, root;
+
+	if (msg == NULL || eom == NULL || (msg + HFIXEDSZ) > eom)
+		return (-1);
+
+	if (ntohs(hp->arcount) == 0)
+		return (0);
+
+	cp = msg + HFIXEDSZ;
+	n = ns_skiprr(cp, eom, ns_s_qd, ntohs(hp->qdcount));
+	if (n < 0)
+		return (-1);
+	cp += n;
+	n = ns_skiprr(cp, eom, ns_s_an, ntohs(hp->ancount));
+	if (n < 0)
+		return (-1);
+	cp += n;
+	n = ns_skiprr(cp, eom, ns_s_ns, ntohs(hp->nscount));
+	if (n < 0)
+		return (-1);
+	cp += n;
+	i = ntohs(hp->arcount);
+	while (i-- > 0) {
+		start = cp;
+		if (cp >= eom)
+			return (-1);
+		root = (*cp == 0);
+		n = dn_skipname(cp, eom);
+		if (n < 0)
+			return (-1);
+		cp += n;
+		if (cp + (2 + 2 + 4 + 2) > eom)
+			return (-1);
+		GETSHORT(type, cp);
+		if (type != ns_t_opt) {
+			cp += INT16SZ + INT32SZ;	/* class, ttl */
+			GETSHORT(rdlen, cp);
+			if (cp + rdlen > eom)
+				return (-1);
+			cp += rdlen;
+			continue;
+		}
+		/* We have the OPT record.  Check it out in detail. */
+		if (!root)
+			return (-1);
+		GETSHORT(bufsize, cp);
+		rcode = (*cp++ <<4) + hp->rcode ;
+		version = *cp++;
+		GETSHORT(flags, cp);
+		GETSHORT(rdlen, cp);
+		/* ensure options are well formed */
+		options = cp;
+		optsize = rdlen;
+		while (rdlen != 0) {
+			u_int16_t code;
+			u_int16_t len;
+
+			if (rdlen < 4)
+				return (-1);
+			GETSHORT(code, cp);
+			GETSHORT(len, cp);
+			rdlen -= 4;
+			if (len > rdlen)
+				return (-1);
+			cp += len;
+			rdlen -= len;
+		}
+		/* Everything checks out. */
+		if (versionp != NULL)
+			*versionp = version;
+		if (rcodep != NULL)
+			*rcodep = rcode;
+		if (flagp != NULL)
+			*flagp = flags;
+		if (bufsizep != NULL)
+			*bufsizep = bufsize;
+		if (optionsp != NULL)
+			*optionsp = options;
+		if (optsizep != NULL)
+			*optsizep = optsize;
+		return (cp - start);
+	}
+	/* OPT not found */
+	return (0);
+}
+
+int
+ns_add_opt(u_char *msg, u_char *cp, size_t buflen, u_int8_t version,
+	   u_int16_t rcode, u_int16_t size, u_int16_t flags,
+	   u_char *options, size_t optlen)
+{
+	HEADER *hp = (HEADER *) msg;
+
+	if ((cp + 1 + 2 + 2 + 4 + 2 + optlen) > (msg + buflen))
+		return (-1);
+
+	*cp++ = 0;			/* "." */
+	PUTSHORT(ns_t_opt, cp);		/* type */
+	PUTSHORT(size, cp);		/* class (udp size) */
+	*cp++ = (rcode >> 4) & 0xff;	/* ttl (rcode + version + flags) */
+	hp->rcode = rcode & 0xf;
+	*cp++ = version;
+	PUTSHORT(flags, cp);
+	PUTSHORT(optlen, cp);		/* rdlen */
+	memcpy(cp, options, optlen);	/* options */
+	hp->arcount = htons(ntohs(hp->arcount) + 1);
+	return (1 + 2 + 2 + 4 + 2 + optlen);
+}
+
+/*
  * Process request using database; assemble and send response.
  */
 void
@@ -173,8 +299,8 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 {
 	HEADER *hp = (HEADER *) msg;
 	u_char *cp, *eom;
-	enum req_action action;
-	int n, ra, has_tsig, tsig_size, sig2len;
+	enum req_action action = Return;
+	int n, ra, has_tsig, tsig_size = 0, opt_size = 0, sig2len;
 	u_char *tsigstart;
 	u_char sig[TSIG_SIG_SIZE], sig2[TSIG_SIG_SIZE];
 	struct tsig_record *in_tsig = NULL;
@@ -182,8 +308,13 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	int msglen_orig = msglen;
 	int buflen_orig = buflen;
 	int siglen = sizeof sig;
-	DST_KEY *key;
+	DST_KEY *key = NULL;
 	time_t tsig_time;
+	int opt = 0;
+	u_int8_t version = 0;
+	u_int16_t rcode = ns_r_noerror;
+	u_int16_t udpsize = 0;
+	int drop;
 
 #ifdef DEBUG
 	if (debug > 3) {
@@ -192,6 +323,10 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	}
 #endif
 	
+	drop = drop_port(ntohs(from.sin_port));
+	if (qsp == NULL && drop == 1)
+		return;
+
 	tsigstart = ns_find_tsig(msg, msg + msglen);
 	if (tsigstart == NULL)
 		has_tsig = 0;
@@ -260,6 +395,7 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 		in_tsig->siglen = siglen;
 		memcpy(in_tsig->sig, sig, siglen);
 		tsig_size = msglen_orig - msglen;
+		in_tsig->tsig_size = tsig_size;
 	} else if (has_tsig) {
 		action = Finish;
 		in_tsig = memget(sizeof(struct tsig_record));
@@ -268,6 +404,7 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 		in_tsig->key = NULL;
 		in_tsig->siglen = 0;
 		tsig_size = msg + msglen - tsigstart;
+		in_tsig->tsig_size = tsig_size;
 		msglen = tsigstart - msg;
 	}
 
@@ -275,6 +412,30 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	nsid_hash((u_char *)&tt, sizeof(tt));
 	nsid_hash(msg, (msglen > 512) ? 512 : msglen);
 
+	if (error == NOERROR) {
+
+		opt = ns_get_opt(msg, msg + msglen, &version,
+				 NULL, NULL, &udpsize, NULL, NULL);
+		if (opt < 0) {
+			rcode = ns_r_formerr;
+			action = Finish;
+		} else if (opt == 0) {
+			if (qsp == NULL && buflen > PACKETSZ)
+				buflen_orig = buflen = PACKETSZ;
+		} else if (opt > 0) {
+			if (version != 0) {
+				rcode = ns_r_badvers;
+				action = Finish;
+			}
+			opt_size = 11;
+			if (udpsize < 512)
+				udpsize = 512;
+			if (qsp == NULL && buflen > udpsize)
+				buflen_orig = buflen = udpsize;
+		}
+	} else if (qsp == NULL && buflen > PACKETSZ)
+		buflen_orig = buflen = PACKETSZ;
+
 	/*
 	 * It's not a response so these bits have no business
 	 * being set. will later simplify work if we can
@@ -290,6 +451,8 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 
 	if (error == NOERROR)
 		hp->rcode = ns_r_noerror;
+	if (rcode == ns_r_noerror)
+		rcode = hp->rcode;
 	cp = msg + HFIXEDSZ;
 	eom = msg + msglen;
 	buflen -= HFIXEDSZ;
@@ -297,16 +460,17 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	free_addinfo();	/* sets addcount to zero */
 	dnptrs[0] = NULL;
 
-	if (error == NOERROR) {
+	if (error == NOERROR && rcode == ns_r_noerror) {
 		switch (hp->opcode) {
 		case ns_o_query:
 			action = req_query(hp, &cp, eom, qsp,
 					   &buflen, &msglen,
-					   msg, dfd, &ra, from, in_tsig);
+					   msg, dfd, &ra, from,
+					   in_tsig, udpsize);
 			break;
 
 		case ns_o_iquery:
-			action = req_iquery(hp, &cp, eom, &buflen, msg, from);
+			action = req_iquery(hp, &cp, eom, &buflen, from);
 			break;
 
 #ifdef BIND_NOTIFY
@@ -317,8 +481,7 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 
 #ifdef BIND_UPDATE
 		case ns_o_update:
-			action = req_update(hp, cp, eom, msg, qsp, dfd, from,
-					    in_tsig);
+			action = req_update(hp, cp, eom, msg, from, in_tsig);
 			break;
 #endif /* BIND_UPDATE */
 
@@ -334,6 +497,7 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 			hp->rcode = ns_r_notimpl;
 			action = Finish;
 		}
+		rcode = hp->rcode;
 	}
 
 	if (in_tsig != NULL) {
@@ -342,13 +506,20 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	}
 
 	/*
+	 * Loop advoidance.
+	 */
+	if (qsp == NULL && drop == 2 && 
+	    (hp->rcode == FORMERR || hp->rcode == NOTIMP))
+			action = Return;
+
+	/*
 	 * Vector via internal opcode.
 	 */
 	switch (action) {
 	case Return:
 		return;
 	case Refuse:
-		hp->rcode = ns_r_refused;
+		rcode = hp->rcode = ns_r_refused;
 		cp = eom;
 		/*FALLTHROUGH*/
 	case Finish:
@@ -365,13 +536,14 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	hp->qr = 1;		/* set Response flag */
 	hp->ra = ra;		/* init above, may be modified by req_query */
 
-	if (!hp->tc && has_tsig > 0 && buflen < tsig_size)
+	if (!hp->tc && (has_tsig > 0 || opt > 0) &&
+	    buflen < (tsig_size + opt_size))
 		hp->tc = 1;
 
 	/*
 	 * If there was a format error, then we don't know what the msg has.
 	 */
-	if (hp->rcode == ns_r_formerr) {
+	if (hp->rcode == ns_r_formerr || rcode == ns_r_badvers) {
 		hp->qdcount = htons(0);
 		hp->ancount = htons(0);
 		hp->nscount = htons(0);
@@ -380,44 +552,67 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	}
 
 	/*
-	 * If the query had a TSIG and the message is truncated or there was
-	 * a TSIG error, build a new message with no data and a TSIG.
+	 * If the query had a TSIG / OPT and the message is truncated or
+	 * there was a TSIG error, build a new message with no data and a
+	 * TSIG / OPT.
 	 */
-	if ((hp->tc || error != NOERROR) && has_tsig > 0) {
+	if ((hp->tc || error != NOERROR) && (has_tsig > 0 || opt > 0)) {
  sign_again:
 		hp->ancount = htons(0);
 		hp->nscount = htons(0);
 		hp->arcount = htons(0);
 		cp = msg + HFIXEDSZ;
 		cp += ns_skiprr(cp, msg + msglen, ns_s_qd, ntohs(hp->qdcount));
-		sig2len = sizeof sig2;
-		msglen = cp - msg;
-		buflen = buflen_orig - msglen;
-		n = ns_sign(msg, &msglen, msglen + buflen, error, key,
-			    sig, siglen, sig2, &sig2len, tsig_time);
-		if (n == NS_TSIG_ERROR_NO_SPACE && ntohs(hp->qdcount) != 0) {
-			hp->qdcount = htons(0);
-			goto sign_again;
+		if (opt > 0) {
+			n = ns_add_opt(msg, cp, buflen_orig, 0,
+				       rcode, EDNS_MESSAGE_SZ, 0, NULL, 0);
+			if (n < 0) {
+				hp->qdcount = htons(0);
+				goto sign_again;
+			}
+			cp += n;
+		}
+		if (has_tsig > 0) {
+			sig2len = sizeof sig2;
+			msglen = cp - msg;
+			buflen = buflen_orig - msglen;
+			n = ns_sign(msg, &msglen, msglen + buflen, error, key,
+				    sig, siglen, sig2, &sig2len, tsig_time);
+			if (n == NS_TSIG_ERROR_NO_SPACE &&
+				ntohs(hp->qdcount) != 0) {
+				hp->qdcount = htons(0);
+				goto sign_again;
+			}
+			if (n != 0)
+				ns_info(ns_log_default,
+					"ns_req: unable to sign response");
+			cp = msg + msglen;
 		}
-		if (n != 0)
-			ns_info(ns_log_default,
-				"ns_req: unable to sign response");
-		cp = msg + msglen;
 	}
-	/* Either the message is not truncated or there was no TSIG */
+	/* Either the message is not truncated or there was no TSIG & OPT */
 	else {
 		/*
 		 * Reserve space for tsig if required.
 		 */
-		if (has_tsig > 0)
-			buflen -= tsig_size;
+		if (has_tsig > 0 || opt_size != 0)
+			buflen -= tsig_size + opt_size;
+		INSIST(buflen >= 0);
+		msglen = cp - msg;
 		n = doaddinfo(hp, cp, buflen);
 		cp += n;
 		buflen -= n;
+		msglen += n;
+		if (opt > 0) {
+			buflen += opt_size;
+			n = ns_add_opt(msg, cp, msglen + buflen, 0,
+				       rcode, EDNS_MESSAGE_SZ, 0, NULL, 0);
+			INSIST(n > 0);
+			cp += n;
+			buflen -= n;
+		}
 		if (has_tsig > 0) {
 			buflen += tsig_size;
 			sig2len = sizeof sig2;
-			msglen = cp - msg;
 			n = ns_sign(msg, &msglen, msglen + buflen, error, key,
 				    sig, siglen, sig2, &sig2len, tsig_time);
 			if (n != 0) {
@@ -608,16 +803,42 @@ req_notify(HEADER *hp, u_char **cpp, u_char *eom, u_char *msg,
 }
 #endif /*BIND_NOTIFY*/
 
+static int
+add_bind(HEADER *hp, u_char **cpp, u_char *msg, int *msglenp,
+	 const char *label, const char *data)
+{
+	u_char *tp;
+
+	hp->ancount = htons(1);
+	hp->nscount = htons(0);
+	hp->arcount = htons(0);
+	hp->rcode = ns_r_noerror;
+	hp->aa = 1;
+	hp->ra = 0;
+	copyCharString(cpp, label);	/* Name */
+	copyCharString(cpp, "BIND");
+	*(*cpp)++ = 0x00;
+	PUTSHORT(T_TXT, *cpp);		/* Type */
+	PUTSHORT(C_CHAOS, *cpp);	/* Class */
+	PUTLONG(0, *cpp);		/* TTL */
+	tp = *cpp;			/* Temp RdLength */
+	PUTSHORT(0, *cpp);
+	copyCharString(cpp, data);
+	PUTSHORT((*cpp) - (tp + INT16SZ), tp);	/* Real RdLength */
+	*msglenp = *cpp - msg;		/* Total message length */
+	return (Finish);
+}
 
 static enum req_action
 req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 	  int *buflenp, int *msglenp, u_char *msg, int dfd, int *ra,
-	  struct sockaddr_in from, struct tsig_record *in_tsig)
+	  struct sockaddr_in from, struct tsig_record *in_tsig,
+	  u_int16_t udpsize)
 {
 	int n, class, type, count, zone, foundname, founddata, omsglen, cname;
 	int recursion_blocked_by_acl;
 	u_int16_t id;
-	u_int32_t serial_ixfr;
+	u_int32_t serial_ixfr = 0;
 	int ixfr_found;
 	int ixfr_error = 0;
 	char dnbuf2[MAXDNAME];
@@ -631,6 +852,8 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 	struct zoneinfo *zp;
 	struct databuf *dp;
 	DST_KEY *in_key = (in_tsig != NULL) ? in_tsig->key : NULL;
+	int access_class;
+	int adjustlen = 0;
 
 	nameserIncr(from.sin_addr, nssRcvdQ);
 
@@ -648,14 +871,19 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 
 	/* valid queries have one question and zero answers */
 	if ((ntohs(hp->qdcount) != 1)
-	    || ntohs(hp->ancount) != 0
-	    || ntohs(hp->arcount) != 0) {
+	    || ntohs(hp->ancount) != 0) {
 		ns_debug(ns_log_default, 1,
 			 "FORMERR Query header counts wrong");
 		hp->rcode = ns_r_formerr;
 		return (Finish);
 	}
 
+	if (ntohs(hp->arcount) != 0) {
+		ns_debug(ns_log_default, 1, "Ignoring addition section");
+		hp->arcount = htons(0);
+		adjustlen = 1;
+	}
+
 	/*
 	 * Get domain name, class, and type.
 	 */
@@ -680,8 +908,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 	GETSHORT(type, *cpp);
 	GETSHORT(class, *cpp);
 	if (*cpp < eom && type != ns_t_ixfr) {
-		ns_debug(ns_log_default, 6,
-			 "message length > received message");
+		if (!adjustlen)
+			ns_debug(ns_log_default, 6,
+				 "message length > received message");
 		*msglenp = *cpp - msg;
 	}
 
@@ -748,7 +977,7 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 		}
 		GETLONG(serial_ixfr, *cpp);
 		/* ignore other soa counters */
-		if ((*cpp + (4 * INT32SZ)) < eom)
+		if ((*cpp + (4 * INT32SZ)) < eom && !adjustlen)
 			ns_debug(ns_log_default, 6,
 				 "ixfr: message length > received message");
 		/* Reset msglenp to cover just the question. */
@@ -838,9 +1067,15 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 	/*
 	 * Begin Access Control Point
 	 */
-
 	zone = DB_Z_CACHE;
+
+	/*
+	 * Map class ANY to to class IN for the purpose of access control.
+	 */
+	access_class = (class == C_ANY && !ns_t_xfr_p(type)) ? C_IN : class;
+
 	if (np) {
+#ifndef FORWARD_ALLOWS
 		struct namebuf *access_np;
 
 		/*
@@ -855,13 +1090,35 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 		for (access_np = np; access_np != NULL;
 		     access_np = np_parent(access_np)) {
 			dp = access_np->n_data;
-			while (dp && dp->d_class != class)
+			while (dp && dp->d_class != access_class)
 				dp = dp->d_next;
 			if (dp != NULL) {
 				zone = dp->d_zone;
 				break;
 			}
 		}
+#else
+		/*
+		 * Try looking for forward zone.  It can be deeper than
+		 * any entry in the cache.
+		 */
+		if (zone == DB_Z_CACHE) {
+			char *s = dname;
+			int escape = 0;
+			while ((zp = find_zone(s, access_class)) == NULL) {
+				if (*s == '\0')
+					break;
+				while (*s != '\0' && (escape || *s != '.')) {
+					escape = escape ? 0 : (*s == '\\');
+					s++;
+				}   
+				if (*s == '.')
+					s++;
+			}
+			if (zp != NULL)
+				zone = zp - zones;
+		}
+#endif
 	}
 
 	zp = &zones[zone];
@@ -941,8 +1198,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 				for (access_np = np; access_np != NULL;
 				     access_np = np_parent(access_np)) {
 					dp = access_np->n_data;
-					while (dp && (dp->d_class != class ||
-					       dp->d_zone == DB_Z_CACHE))
+					while (dp &&
+					       (dp->d_class != access_class ||
+					        dp->d_zone == DB_Z_CACHE))
 						dp = dp->d_next;
 					if (dp != NULL) {
 						zone = dp->d_zone;
@@ -961,9 +1219,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 				}
 			}
 			ns_notice(ns_log_security,
-				  "denied query from %s for \"%s\" %s",
+				  "denied query from %s for \"%s\" %s/%s",
 				  sin_ntoa(from), *dname ? dname : ".",
-				  p_class(class));
+				  p_type(type), p_class(class));
 			nameserIncr(from.sin_addr, nssRcvdUQ);
 			return (Refuse);
 		}
@@ -1054,28 +1312,18 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 	 * Yow!
 	 */
 	if (class == ns_c_chaos && type == ns_t_txt &&
-	    ns_samename(dnbuf, "VERSION.BIND") == 1) {
-		u_char *tp;
+	    ns_samename(dnbuf, "VERSION.BIND") == 1 &&
+	    server_options->version != NULL &&
+	    server_options->version[0] != '\0')
+		return (add_bind(hp, cpp, msg, msglenp,
+			"VERSION", server_options->version));
 
-		hp->ancount = htons(1);
-		hp->nscount = htons(0);
-		hp->arcount = htons(0);
-		hp->rcode = ns_r_noerror;
-		hp->aa = 1;
-		hp->ra = 0;
-		copyCharString(cpp, "VERSION");	/* Name */
-		copyCharString(cpp, "BIND");
-		*(*cpp)++ = 0x00;
-		PUTSHORT(T_TXT, *cpp);		/* Type */
-		PUTSHORT(C_CHAOS, *cpp);	/* Class */
-		PUTLONG(0, *cpp);		/* TTL */
-		tp = *cpp;			/* Temp RdLength */
-		PUTSHORT(0, *cpp);
-		copyCharString(cpp, server_options->version);
-		PUTSHORT((*cpp) - (tp + INT16SZ), tp);	/* Real RdLength */
-		*msglenp = *cpp - msg;		/* Total message length */
-		return (Finish);
-	}
+	if (class == ns_c_chaos && type == ns_t_txt &&
+	    ns_samename(dnbuf, "HOSTNAME.BIND") == 1 &&
+	    server_options->hostname != NULL &&
+	    server_options->hostname[0] != '\0')
+		return (add_bind(hp, cpp, msg, msglenp,
+			"HOSTNAME", server_options->hostname));
 
 	/*
 	 * If we don't know anything about the requested name,
@@ -1365,8 +1613,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 		if (n < 0) {
 			ns_info(ns_log_default, "res_mkquery(%s) failed",
 				dname);
-			hp->rcode = ns_r_servfail;
+			memcpy(msg, omsg, omsglen);
 			memput(omsg, omsglen);
+			hp->rcode = ns_r_servfail;
 			free_nsp(nsp);
 			return (Finish);
 		}
@@ -1375,7 +1624,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 	n = ns_forw(nsp, msg, *msglenp, from, qsp, dfd, &qp,
 		    dname, class, type, np, 0, in_tsig);
 	if (n != FW_OK && cname) {
+		memcpy(msg, omsg, omsglen);
 		memput(omsg, omsglen);
+		*msglenp = omsglen;
 		omsg = NULL;
 	}
 	switch (n) {
@@ -1387,6 +1638,11 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 			qp->q_cmsgsize = omsglen;
 			qp->q_id = id;
 		}
+		if (udpsize != 0) {
+			qp->q_flags |= Q_EDNS;
+			qp->q_udpsize = udpsize;
+		} else
+			qp->q_udpsize = PACKETSZ;
 		break;
 	case FW_DUP:
 		break;		/* Duplicate request dropped */
@@ -1441,7 +1697,7 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 
 static enum req_action
 req_iquery(HEADER *hp, u_char **cpp, u_char *eom, int *buflenp,
-	   u_char *msg, struct sockaddr_in from)
+	   struct sockaddr_in from)
 {
 	u_int rdata_offset;
 	size_t alen;
@@ -1561,7 +1817,7 @@ req_iquery(HEADER *hp, u_char **cpp, u_char *eom, int *buflenp,
 	*buflenp -= INT16SZ;
 
 	hp->qdcount = htons(1);
-	if (alen > *buflenp) {
+	if ((int)alen > *buflenp) {
 		hp->tc = 1;
 		return (Finish);
 	}
@@ -1578,6 +1834,10 @@ int
 stale(struct databuf *dp) {
 	struct zoneinfo *zp = &zones[dp->d_zone];
 
+#ifdef CHECK_MAGIC
+	INSIST(dp->d_magic == DATABUF_MAGIC);
+#endif
+
 	switch (zp->z_type) {
 
 	case z_master:
@@ -1662,6 +1922,7 @@ make_rr(const char *name, struct databuf *dp, u_char *buf,
 	int32_t n;
 	int16_t type = dp->d_type;
 	u_int32_t ttl;
+	u_char naptr_flag;
 
 	ns_debug(ns_log_default, 5,
 		 "make_rr(%s, %lx, %lx, %d, %d) %d zone %d ttl %lu",
@@ -1801,6 +2062,7 @@ make_rr(const char *name, struct databuf *dp, u_char *buf,
 		buflen -= n + 1;
 		if (buflen < 0)
 			goto cleanup;
+		naptr_flag = (n == 1) ? *cp1 : 0;
 		*cp++ = n;
 		memcpy(cp, cp1, n);
 		cp += n;
@@ -1839,6 +2101,14 @@ make_rr(const char *name, struct databuf *dp, u_char *buf,
 		if (n < 0)
 			goto cleanup;
 		cp += n;
+		if (doadd && *cp1 != 0) {
+			if (naptr_flag == 's' || naptr_flag == 'S')
+				addname((char*)cp1, name, type, T_SRV,
+					dp->d_class);
+			if (naptr_flag == 'a' || naptr_flag == 'A')
+				addname((char*)cp1, name, type, T_A,
+					dp->d_class);
+		}
 
 		/* save data length */
 		n = (u_int16_t)((cp - sp) - INT16SZ);
@@ -2022,8 +2292,9 @@ doaddinfo(HEADER *hp, u_char *msg, int msglen) {
 	const char *fname;
 	register int n, count;
 	register int ns_logging;
-	int finishedA = 0;
-	int save_addcount = addcount;
+	int pass = 0;
+	int i, doadd;
+	
 
 	if (!addcount)
 		return (0);
@@ -2043,15 +2314,18 @@ doaddinfo(HEADER *hp, u_char *msg, int msglen) {
 	count = 0;
 	cp = msg;
 loop:
-	for (ap = addinfo; --addcount >= 0; ap++) {
+	for (ap = addinfo, i = 0; i < addcount; ap++, i++) {
 		int     foundany = 0,
 			foundcname = 0,
 			save_count = count,
 			save_msglen = msglen;
 		u_char	*save_cp = cp;
 
-		if ((finishedA == 1 && ap->a_type == T_A) ||
-		    (finishedA == 0 && ap->a_type == T_KEY))
+		if ((pass != 0 &&
+	             (pass != 1 || server_options->preferred_glue == 0) &&
+		     ap->a_type == T_A) ||
+		    (pass != 0 && ap->a_type == T_SRV) ||
+		    (pass != 2 && ap->a_type == T_KEY))
 			continue;
 		if (ns_logging)
 			ns_debug(ns_log_default, 3,
@@ -2066,35 +2340,52 @@ loop:
 		/* look for the data */
 		(void)delete_stale(np);
 		for (dp = np->n_data; dp != NULL; dp = dp->d_next) {
-			if (dp->d_rcode)
+			if (dp->d_rcode == NXDOMAIN) {
+				if (dp->d_class == ap->a_class)
+					foundany++;
 				continue;
+			}
 			if ((match(dp, (int)ap->a_class, T_CNAME) &&
-			     dp->d_type == T_CNAME) ||
-			    (match(dp, C_IN, T_CNAME) &&
 			     dp->d_type == T_CNAME)) {
 				foundcname++;
 				break;
 			}
+			if (pass == 0 && ap->a_type == T_A && 
+			    server_options->preferred_glue != 0 &&
+			    !match(dp, (int)ap->a_class,
+				   server_options->preferred_glue)) {
+				continue;
+			} 
+			if (pass != 0 && ap->a_type == T_A &&
+			    server_options->preferred_glue != 0 &&
+			    match(dp, (int)ap->a_class,
+				   server_options->preferred_glue)) {
+				continue;
+			} 
 			if (ap->a_type == T_A &&
 			    !match(dp, (int)ap->a_class, T_A) &&
-			    !match(dp, C_IN, T_A) &&
 			    !match(dp, (int)ap->a_class, T_AAAA) &&
-			    !match(dp, C_IN, T_AAAA) &&
-			    !match(dp, (int)ap->a_class, ns_t_a6) &&
-			    !match(dp, C_IN, ns_t_a6)) {
+			    !match(dp, (int)ap->a_class, ns_t_a6)) {
 				continue;
 			}
 			if (ap->a_type == T_KEY &&
-			    !match(dp, (int)ap->a_class, T_KEY) &&
-			    !match(dp, C_IN, T_KEY))
+			    !match(dp, (int)ap->a_class, T_KEY))
+				continue;
+			if (ap->a_type == T_SRV &&
+			    !match(dp, (int)ap->a_class, T_SRV))
 				continue;
 
 			foundany++;
+			if (dp->d_rcode)
+				continue;
 			/*
 			 *  Should be smart and eliminate duplicate
 			 *  data here.	XXX
 			 */
-			if ((n = make_rr(ap->a_dname, dp, cp, msglen, 0,
+			doadd = 0;
+			if (ap->a_type == T_SRV)
+				doadd = 1;
+			if ((n = make_rr(ap->a_dname, dp, cp, msglen, doadd,
 					 dnptrs, dnptrs_end, 0)) < 0) {
 				/* truncation in the additional-data section
 				 * is not all that serious.  we do not set TC,
@@ -2130,7 +2421,8 @@ loop:
 		    (ap->a_type == T_A || ap->a_type == T_AAAA)) {
 			/* ask a real server for this info */
 			(void) sysquery(ap->a_dname, (int)ap->a_class,
-					ap->a_type, NULL, 0, ns_port, QUERY);
+					ap->a_type, NULL, NULL, 0, ns_port,
+					QUERY, 0);
 		}
 		if (foundcname) {
 			if (!haveComplained(nhash(ap->a_dname),
@@ -2141,15 +2433,15 @@ loop:
 					p_type(ap->a_rtype), ap->a_dname);
 			}
 		}
-		freestr(ap->a_dname);
-		freestr(ap->a_rname);
 	}
-	if (finishedA == 0) {
-		finishedA = 1;
-		addcount = save_addcount;
+	if (pass++ < 2)
 		goto loop; /* now do the KEYs... */
-	}
 	hp->arcount = htons((u_int16_t)count);
+	for (ap = addinfo, i = 0; i < addcount; ap++, i++) {
+		ap->a_dname = freestr(ap->a_dname);
+		ap->a_rname = freestr(ap->a_rname);
+	}
+	addcount = 0;
 	return (cp - msg);
 }
 
@@ -2188,27 +2480,16 @@ free_addinfo() {
 	struct addinfo *ap;
 
 	for (ap = addinfo; --addcount >= 0; ap++) {
-		freestr(ap->a_dname);
-		freestr(ap->a_rname);
+		ap->a_dname = freestr(ap->a_dname);
+		ap->a_rname = freestr(ap->a_rname);
 	}
 	addcount = 0;
 }
 
 void
 free_nsp(struct databuf **nsp) {
-	while (*nsp) {
-		DRCNTDEC(*nsp);
-		if ((*nsp)->d_rcnt)
-			ns_debug(ns_log_default, 3, "free_nsp: %s rcnt %d",
-				 (*nsp)->d_data, (*nsp)->d_rcnt);
-		else {
-			ns_debug(ns_log_default, 3,
-				 "free_nsp: %s rcnt %d delayed",
-				 (*nsp)->d_data, (*nsp)->d_rcnt);
-			db_freedata(*nsp);	/* delayed free */
-		}
-		*nsp++ = NULL;
-	}
+	while (*nsp)
+		db_detach(nsp++);
 }
 
 static void
@@ -2218,3 +2499,20 @@ copyCharString(u_char **dst, const char *src) {
 	memcpy(*dst, src, len);
 	*dst += len;
 }
+
+/*
+ * Questionable source ports for queries / responses.
+ */
+int
+drop_port(u_int16_t port) {
+	switch (port) {
+	case 7: /* echo */
+	case 13: /* daytime */
+	case 19: /* chargen */
+	case 37: /* time */
+		return (1);
+	case 464: /* kpasswd */
+		return (2);
+	}
+	return (0);
+}
diff --git a/contrib/bind/bin/named/ns_resp.c b/contrib/bind/bin/named/ns_resp.c
index 31c233a..ea62674 100644
--- a/contrib/bind/bin/named/ns_resp.c
+++ b/contrib/bind/bin/named/ns_resp.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_resp.c	4.65 (Berkeley) 3/3/91";
-static const char rcsid[] = "$Id: ns_resp.c,v 8.152 2001/02/13 23:28:31 marka Exp $";
+static const char rcsid[] = "$Id: ns_resp.c,v 8.172 2002/01/31 00:06:41 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -182,7 +182,9 @@ static int		rrsetcmp(char *, struct db_list *, struct hashbuf *),
 				  struct sockaddr_in, char **);
 static void		mark_bad(struct qinfo *qp, struct sockaddr_in from);
 static void		mark_lame(struct qinfo *qp, struct sockaddr_in from);
-static void		fast_retry(struct qinfo *qp, struct sockaddr_in from);
+static int		mark_noedns(struct qinfo *qp, struct sockaddr_in from);
+static void		fast_retry(struct qinfo *qp, struct sockaddr_in from,
+				   int samehost);
 static void		add_related_additional(char *);
 static void		free_related_additional(void);
 static int		related_additional(char *);
@@ -198,11 +200,12 @@ static char *related[MAX_RELATED];
 static char *
 learntFrom(struct qinfo *qp, struct sockaddr_in *server) {
 	static char *buf = NULL;
-	char *a, *ns, *na;
+	const char *a, *ns, *na;
 	struct databuf *db;
 	int i;
 	char nsbuf[20];
 	char abuf[20];
+	static const char fmt[] = " '%s': learnt (A=%s,NS=%s)";
 	
 	a = ns = na = "<Not Available>";
 
@@ -243,23 +246,11 @@ learntFrom(struct qinfo *qp, struct sockaddr_in *server) {
 	if (*na == '\0')
 		na = "\".\"";
 
-	if (NS_OPTION_P(OPTION_HOSTSTATS)) {
-		static const char fmt[] = " '%s': learnt (A=%s,NS=%s)";
-
-		buf = newstr(sizeof fmt + strlen(na) + strlen(a) + strlen(ns),
-			     0);
-		if (buf == NULL)
-			return (NULL);
-		sprintf(buf, fmt, na, a, ns);
-	} else {
-		static const char fmt[] = " '%s'";
-
-		buf = newstr(sizeof fmt + strlen(na), 0);
-		if (buf == NULL)
-			return (NULL);
-		sprintf(buf, fmt, na);
-	}
 
+	buf = newstr(sizeof fmt + strlen(na) + strlen(a) + strlen(ns), 0);
+	if (buf == NULL)
+		return (NULL);
+	sprintf(buf, fmt, na, a, ns);
 	return (buf);
 }
 
@@ -289,7 +280,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 	char *dname, tmpdomain[MAXDNAME];
 	const char *fname;
 	const char *formerrmsg = "brain damage";
-	u_char newmsg[PACKETSZ];
+	u_char newmsg[EDNS_MESSAGE_SZ];
 	u_char **dpp, *tp;
 	time_t rtrip;
 	struct hashbuf *htp;
@@ -299,10 +290,10 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 	int forcecmsg = 0;
 	char *tname = NULL;
 	int sendto_errno = 0;
-	int has_tsig, oldqlen;
-	u_char *oldqbuf;
-	u_char *smsg;
-	int smsglen, smsgsize, siglen;
+	int has_tsig, oldqlen = 0;
+	u_char *oldqbuf = NULL;
+	u_char *smsg = NULL;
+	int smsglen, smsgsize = 0, siglen;
 	u_char sig[TSIG_SIG_SIZE];
 	time_t tsig_time;
 	DST_KEY *key;
@@ -419,25 +410,34 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 		&& hp->opcode != NS_NOTIFY_OP
 #endif
 		)) {
+		int noedns = 1;
 		ns_debug(ns_log_default, 2,
 			 "resp: error (ret %d, op %d), dropped",
 			 hp->rcode, hp->opcode);
 		switch (hp->rcode) {
 		case SERVFAIL:
 			nameserIncr(from.sin_addr, nssRcvdFail);
+			noedns = mark_noedns(qp, from);
 			break;
 		case FORMERR:
 			nameserIncr(from.sin_addr, nssRcvdFErr);
+			noedns = mark_noedns(qp, from);
+			break;
+		case NOTIMP:
+			nameserIncr(from.sin_addr, nssRcvdErr);
+			noedns = mark_noedns(qp, from);
 			break;
 		default:
 			nameserIncr(from.sin_addr, nssRcvdErr);
 			break;
 		}
 		if (ns_samename(qp->q_name, qp->q_domain) == 1 &&
-		    hp->rcode == SERVFAIL && hp->opcode == QUERY)
+		    hp->rcode == SERVFAIL && hp->opcode == QUERY &&
+		    noedns)
 			mark_lame(qp, from);
-		mark_bad(qp, from);
-		fast_retry(qp, from);
+		if (noedns)
+			mark_bad(qp, from);
+		fast_retry(qp, from, noedns ? 0 : 1);
 		return;
 	}
 
@@ -540,6 +540,8 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 				    (1 - ALPHA) * rtrip;
 			if (t > 65535)
 				t = 65535;
+			else if (t == 0)
+				t = 1;
 			ns->d_nstime = (u_int16_t)t;
 		}
 
@@ -580,15 +582,17 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 				continue;
 			if (qs->stime.tv_sec) {
 				if (ns2->d_nstime == 0)
-					t = (rtrip * BETA);
+					t = (rtrip * BETA) + 1;
 				else
 					t = ns2->d_nstime * BETA
 					        +
-					    (1 - ALPHA) * rtrip;
+					    (1 - ALPHA) * rtrip + 1;
 			} else
 				t = ns2->d_nstime * GAMMA;
 			if (t > 65535)
 				t = 65535;
+			else if (t == 0)
+				t = 1;
 			ns2->d_nstime = (u_int16_t)t;
 			if (ns_wouldlog(ns_log_default, 2)) {
 				ns_debug(ns_log_default, 2,
@@ -688,7 +692,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 			}
 			qs->serial = serial;
 		}
-		retry(qp);
+		retry(qp, 0);
 		return;
 	}
 
@@ -702,7 +706,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 #endif
 	    ) {
 		u_char *tp;
-		int type, class, dlen;
+		int type, class = 0, dlen;
 		int foundns, foundsoa;
 #ifdef DEBUG
 		if (debug > 0)
@@ -778,7 +782,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 					(learnt_from == NULL) ? "" :
 					learnt_from);
 				if (learnt_from != NULL)
-					freestr(learnt_from);
+					learnt_from = freestr(learnt_from);
 			} else if (fwd != NULL) {
 				if (!haveComplained(ina_ulong(from.sin_addr),
 					  (u_long)nonRecursiveForwarder))
@@ -787,7 +791,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 						   sin_ntoa(from));
 			}
 
-			fast_retry(qp, from);
+			fast_retry(qp, from, 0);
 			return;
 		}
 	}
@@ -833,7 +837,10 @@ tcp_retry:
 
 			nsa = Q_NEXTADDR(qp, 0);
 
-			key = tsig_key_from_addr(nsa->sin_addr);
+			key = qp->q_keys[0];
+			if (key != NULL)
+				key = qp->q_keys[0] =
+					 tsig_key_from_addr(nsa->sin_addr);
 			if (key != NULL) {
 				smsgsize = qp->q_msglen + TSIG_BUF_SIZE;
 				smsg = memget(smsgsize);
@@ -849,17 +856,16 @@ tcp_retry:
 					qp->q_msglen = smsglen;
 					qp->q_msg = smsg;
 					has_tsig = 1;
+					free_tsig(qp->q_nstsig);
 					qp->q_nstsig = new_tsig(key, sig,
 								siglen);
-				}
-				else {
+				} else {
 					has_tsig = 0;
 					free_tsig(qp->q_nstsig);
 					qp->q_nstsig = NULL;
 					INSIST(0);
 				}
-			}
-			else {
+			} else {
 				has_tsig = 0;
 				free_tsig(qp->q_nstsig);
 				qp->q_nstsig = NULL;
@@ -871,7 +877,7 @@ tcp_retry:
 				 * failed, but we'll try to press on because
 				 * there isn't anything else to do.
 				 */
-				retry(qp);
+				retry(qp, 0);
 
 			if (has_tsig == 1) {
 				memput(qp->q_msg, smsgsize);
@@ -892,14 +898,14 @@ tcp_retry:
 		/* mark this server as bad */
 		mark_bad(qp, from);
 		/* try another server, it may have a bigger write buffer */
-		retry(qp);
+		retry(qp, 0);
 		return;
 	}
 
 	tp = cp;
 
 	restart = 0;
-	validanswer = 0;
+	validanswer = -1;
 	nscount = 0;
 	soacount = 0;
 	cname = 0;
@@ -958,7 +964,8 @@ tcp_retry:
 					ns_debug(ns_log_resp_checks, 3,
 				 "ignoring answer '%s' after external cname",
 						 name);
-				db_freedata(dp);
+				db_detach(&dp);
+				validanswer = 0;
 				continue;
 			}
 			if (type == T_CNAME &&
@@ -969,7 +976,8 @@ tcp_retry:
 				cname++;
 				lastwascname = 1;
 			} else {
-				validanswer = 1;
+				if (validanswer)
+					validanswer = 1;
 				lastwascname = 0;
 			}
 
@@ -986,7 +994,8 @@ tcp_retry:
 			if (lastwascname) {
 				ns_debug(ns_log_resp_checks, 3,
 				 "last was cname, ignoring auth. and add.");
-				db_freedata(dp);
+				db_detach(&dp);
+				validanswer = 0;
 				break;
 			}
 			if (i < arfirst) {
@@ -1000,19 +1009,21 @@ tcp_retry:
 							aname[0] ? aname : ".",
 							name[0] ? name : ".",
 							sin_ntoa(from));
-						db_freedata(dp);
+						db_detach(&dp);
+						validanswer = 0;
 						continue;
-					} else if (fwd == NULL &&
-						   !ns_samedomain(name,
+					} else if (!ns_samedomain(name,
 							       qp->q_domain)) {
-						if (!externalcname)
+						if (fwd == NULL &&
+						    !externalcname)
 						    ns_info(ns_log_resp_checks,
 					    "bad referral (%s !< %s) from %s",
 							 name[0] ? name : ".",
 							 qp->q_domain[0] ?
 							 qp->q_domain : ".",
 							 sin_ntoa(from));
-						db_freedata(dp);
+						db_detach(&dp);
+						validanswer = 0;
 						continue;
 					}
 					if (type == T_NS) {
@@ -1036,7 +1047,8 @@ tcp_retry:
 	"invalid RR type '%s' in authority section (name = '%s') from %s",
 						p_type(type), name,
 						sin_ntoa(from));
-					db_freedata(dp);
+					db_detach(&dp);
+					validanswer = 0;
 					continue;
 				}
 				dp->d_cred = (hp->aa && (cname == 0)) ?
@@ -1048,12 +1060,14 @@ tcp_retry:
 				switch (type) {
 				case T_A:
 				case T_AAAA:
+				case T_SRV:
 					if (externalcname ||
 					    !ns_samedomain(name, qp->q_domain)) {
 						ns_debug(ns_log_resp_checks, 3,
 				       "ignoring additional info '%s' type %s",
 							 name, p_type(type));
-						db_freedata(dp);
+						db_detach(&dp);
+						validanswer = 0;
 						continue;
 					}
 					if (!related_additional(name)) {
@@ -1061,9 +1075,14 @@ tcp_retry:
 			     "unrelated additional info '%s' type %s from %s",
 							 name, p_type(type),
 							 sin_ntoa(from));
-						db_freedata(dp);
+						db_detach(&dp);
+						validanswer = 0;
 						continue;
 					}
+					if (type == T_SRV && tname != NULL) {
+						add_related_additional(tname);
+						tname = NULL;
+					}
 					break;
 				case T_KEY:
 					/* XXX  check? */
@@ -1076,12 +1095,20 @@ tcp_retry:
 					 * it might be a transaction signature.
 					 */
 					break;
+				case ns_t_opt:
+					/*
+					 * OPT does not get cached.
+					 */
+					db_detach(&dp);
+					validanswer = 0;
+					continue;
 				default:
 					ns_info(ns_log_resp_checks,
 	"invalid RR type '%s' in additional section (name = '%s') from %s",
 						p_type(type), name,
 						sin_ntoa(from));
-					db_freedata(dp);
+					db_detach(&dp);
+					validanswer = 0;
 					continue;
 				}
 				dp->d_cred = (qp->q_flags & Q_PRIMING)
@@ -1094,6 +1121,7 @@ tcp_retry:
 		++db_total_hits;
 #endif /* HITCOUNTS */
 		rrsetadd(flushset, name, dp);
+		db_detach(&dp);
 	}
 	free_related_additional();
 	freestr_maybe(&tname);
@@ -1121,7 +1149,7 @@ tcp_retry:
 		if ((qp->q_flags & Q_PRIMING) && !check_root()) {
 			/* mark server as bad */
 			mark_bad(qp, from);
-			fast_retry(qp, from);
+			fast_retry(qp, from, 0);
 			return;
 		}
 		ns_debug(ns_log_default, 3,
@@ -1138,7 +1166,7 @@ tcp_retry:
 		return;
 	}
 
-	if (ancount && count && !validanswer) {
+	if (ancount && count && validanswer != 1) {
 		/*
 		 * Everything passed validation but we didn't get the
 		 * final answer.  The response must have contained
@@ -1212,10 +1240,10 @@ tcp_retry:
 	 */
 	if (qp->q_cmsglen != 0) {
 		ns_debug(ns_log_default, 1, "Cname second pass");
-		newmsglen = MIN(PACKETSZ, qp->q_cmsglen);
+		newmsglen = MIN(EDNS_MESSAGE_SZ, qp->q_cmsglen);
 		memcpy(newmsg, qp->q_cmsg, newmsglen);
 	} else {
-		newmsglen = MIN(PACKETSZ, msglen);
+		newmsglen = MIN(EDNS_MESSAGE_SZ, msglen);
 		memcpy(newmsg, msg, newmsglen);
 	}
 	hp = (HEADER *) newmsg;
@@ -1398,13 +1426,13 @@ tcp_retry:
 
 	/* Reset the query control structure */
 
-	ns_freeqns(qp, "ns_resp");
+	ns_freeqns(qp);
 	qp->q_naddr = 0;
 	qp->q_curaddr = 0;
 	nsfwdadd(qp, NS_ZFWDTAB(qp->q_fzone));
 
 	if (qp->q_domain != NULL)
-		freestr(qp->q_domain);
+		(void)freestr(qp->q_domain);
 	getname(np, tmpdomain, sizeof tmpdomain);
 	qp->q_domain = savestr(tmpdomain, 1);
 
@@ -1471,7 +1499,7 @@ tcp_retry:
 			goto servfail;
 		}
 		if (qp->q_name != NULL)
-			freestr(qp->q_name);
+			(void)freestr(qp->q_name);
 		qp->q_name = savestr(dname, 1);
 		qp->q_msglen = n;
 		hp = (HEADER *) qp->q_msg;
@@ -1497,36 +1525,46 @@ tcp_retry:
 		res_pquery(&res, qp->q_msg, qp->q_msglen,
 			    log_get_stream(packet_channel));
 #endif
-	key = tsig_key_from_addr(nsa->sin_addr);
-	if (key != NULL) {
-		smsgsize = qp->q_msglen + TSIG_BUF_SIZE;
+	key = qp->q_keys[0];
+        if (key == NULL)
+                key = qp->q_keys[0] = tsig_key_from_addr(nsa->sin_addr);
+	if (key != NULL || !qp->q_addr[0].noedns) {
+		smsgsize = qp->q_msglen + TSIG_BUF_SIZE + 11;
 		smsg = memget(smsgsize);
 		smsglen = qp->q_msglen;
 		siglen = sizeof(sig);
 		memcpy(smsg, qp->q_msg, qp->q_msglen);
+	}
+
+	if (!qp->q_addr[0].noedns)
+                smsglen += ns_add_opt(smsg, smsg + smsglen, smsgsize, 0, 0,
+                                      EDNS_MESSAGE_SZ, 0, NULL, 0);
+	if (key != NULL) {
 		n = ns_sign(smsg, &smsglen, smsgsize, NOERROR, key, NULL, 0,
 			    sig, &siglen, 0);
 		if (n == 0) {
-			oldqbuf = qp->q_msg;
-			oldqlen = qp->q_msglen;
-			qp->q_msglen = smsglen;
-			qp->q_msg = smsg;
 			has_tsig = 1;
+			free_tsig(qp->q_nstsig);
 			qp->q_nstsig = new_tsig(key, sig, siglen);
-		}
-		else {
+		} else {
 			has_tsig = 0;
 			free_tsig(qp->q_nstsig);
 			qp->q_nstsig = NULL;
 			INSIST(0);
 		}
-	}
-	else {
+	} else {
 		has_tsig = 0;
 		free_tsig(qp->q_nstsig);
 		qp->q_nstsig = NULL;
 	}
 
+	if (smsg != NULL) {
+		oldqbuf = qp->q_msg;
+		oldqlen = qp->q_msglen;
+		qp->q_msglen = smsglen;
+		qp->q_msg = smsg;
+	}
+
 	if (qp->q_flags & Q_USEVC) {
 		if (tcp_send(qp) != NOERROR) {
 			if (!haveComplained(ina_ulong(nsa->sin_addr),
@@ -1546,8 +1584,9 @@ tcp_retry:
 				sin_ntoa(*nsa), strerror(errno));
 		nameserIncr(nsa->sin_addr, nssSendtoErr);
 	}
-	if (has_tsig == 1) {
-		memput(qp->q_msg, smsgsize);
+
+	if (smsgsize != 0) {
+		memput(smsg, smsgsize);
 		qp->q_msg = oldqbuf;
 		qp->q_msglen = oldqlen;
 	}
@@ -1570,7 +1609,7 @@ tcp_retry:
 	if (!haveComplained(ina_ulong(from.sin_addr), (u_long)formerrmsg))
 		ns_info(ns_log_resp_checks, "Malformed response from %s (%s)",
 			sin_ntoa(from), formerrmsg);
-	fast_retry(qp, from);
+	fast_retry(qp, from, 0);
 	free_nsp(nsp);
 	return;
 
@@ -1682,7 +1721,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 	BOUNDS_CHECK(cp, 2*INT16SZ + INT32SZ + INT16SZ);
 	GETSHORT(type, cp);
 	GETSHORT(class, cp);
-	if (class > CLASS_MAX) {
+	if (type != ns_t_opt && class > CLASS_MAX) {
 		ns_debug(ns_log_default, 3, "bad class in rrextract");
 		hp->rcode = FORMERR;
 		return (-1);
@@ -1867,6 +1906,9 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		}
 		cp += n;
 
+		if (tnamep != NULL && *cp1 != 0)
+			*tnamep = savestr((char *)cp1, 1);
+
 		/* compute end of data */
 		cp1 += strlen((char *)cp1) + 1;
 		/* compute size of data */
@@ -1959,7 +2001,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		break;
 
 	case T_SIG: {
-		u_long origTTL, exptime, signtime, timetilexp, now;
+		u_int32_t origTTL, exptime, signtime, timetilexp, now;
 		u_int8_t alg;
 
 		/* Check signature time, expiration, and adjust TTL.  */
@@ -1978,8 +2020,8 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		/* Don't let bogus name servers increase the signed TTL */
 		if (ttl > origTTL) {
 			ns_debug(ns_log_default, 3,
-				 "shrinking SIG TTL from %d to origTTL %d",
-				 ttl, origTTL);
+				 "shrinking SIG TTL from %lu to origTTL %lu",
+				 (unsigned long)ttl, (unsigned long)origTTL);
 			ttl = origTTL;
 		}
 
@@ -2020,7 +2062,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 
 		/* then the signer's name */
 		n = dn_expand(msg, eom, cp, (char *)cp1, (sizeof data) - 18);
-		if (n < 0 || n + NS_SIG_SIGNER > dlen) {
+		if (n < 0 || n + NS_SIG_SIGNER > (int)dlen) {
 			hp->rcode = FORMERR;
 			return (-1);
 		}
@@ -2031,7 +2073,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		   Its size is the total data length, minus what we copied. */
 		n = dlen - (NS_SIG_SIGNER + n);
 
-		if (n > (sizeof data) - (cp1 - (u_char *)data)) {
+		if (n > (int)(sizeof data) - (cp1 - (u_char *)data)) {
 			hp->rcode = FORMERR;
 			return (-1);  /* out of room! */
 		}
@@ -2072,7 +2114,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		 * because we always have to look at the 0 bit to see if
 		 * this is a "different format" NXT or not.
 		 */
-		if (n < 0 || n >= dlen) {
+		if (n < 0 || n >= (int)dlen) {
 			hp->rcode = FORMERR;
 			return (-1);
 		}
@@ -2109,7 +2151,7 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 				return (-1);
 			}
 		}
-		if (n2 > sizeof data - n1) {
+		if (n2 > (int)(sizeof data - n1)) {
 			hp->rcode = FORMERR;
 			return (-1);
 		}
@@ -2123,8 +2165,11 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 		break;
 	
 	default:
+		/* treat as opaque data */
 		ns_debug(ns_log_default, 3, "unknown type %d", type);
-		return ((cp - rrp) + dlen);
+		cp1 = cp;
+		n = dlen;
+		cp += n;
 	}
 
 	if (cp > eom) {
@@ -2147,6 +2192,8 @@ rrextract(u_char *msg, int msglen, u_char *rrp, struct databuf **dpp,
 	}
 
 	ttl += tt.tv_sec;
+	if (type == ns_t_opt)
+		class = 0;	/* Lie. */
 	*dpp = savedata(class, type, ttl, cp1, n);
 	return (cp - rrp);
 }
@@ -2155,14 +2202,23 @@ int
 send_msg(u_char *msg, int msglen, struct qinfo *qp) {
 	HEADER *hp = (HEADER *) msg;
 	u_char *oldmsg;
-	int oldlen;
+	int oldlen = 0;
 	int msgsize;
 	int ret;
+	int trunc;
+	int adjust = 0;
 
 	if (qp->q_flags & Q_SYSTEM)
 		return (1);
-	if (!qp->q_stream && (msglen > PACKETSZ))
-		msglen = trunc_adjust(msg, msglen, PACKETSZ);
+
+	trunc = (qp->q_stream != NULL) ? 65535 : qp->q_udpsize;
+	if (qp->q_tsig != NULL) 
+		adjust +=  qp->q_tsig->tsig_size;
+	if ((qp->q_flags & Q_EDNS) != 0)
+		adjust += 11;
+	if (msglen > trunc - adjust)
+		msglen = trunc_adjust(msg, msglen, trunc - adjust);
+
 	if (ns_wouldlog(ns_log_default, 1)) {
 		ns_debug(ns_log_default, 1, "send_msg -> %s (%s %d) id=%d",
 			 sin_ntoa(qp->q_from), 
@@ -2187,21 +2243,25 @@ send_msg(u_char *msg, int msglen, struct qinfo *qp) {
 				 (u_long)qp->q_next, (u_long)qp->q_link);
 		}
 	}
-	if (debug >= 6)
-		res_pquery(&res, msg, msglen, log_get_stream(packet_channel));
 #endif /* DEBUG */
 
-	if (qp->q_tsig != NULL) {
-		u_char sig[TSIG_SIG_SIZE];
-		int siglen = sizeof(sig);
-
+	if (adjust != 0) {
 		oldmsg = msg;
 		oldlen = msglen;
-
-		msgsize = msglen + TSIG_BUF_SIZE;
+		msgsize = msglen + adjust;
 		msg = memget(msgsize);
 		memcpy(msg, oldmsg, oldlen);
- 
+	} else
+		msgsize = msglen;	/* silence compiler */
+
+	if ((qp->q_flags & Q_EDNS) != 0)
+		msglen += ns_add_opt(msg, msg + msglen, msgsize, 0,
+				     hp->rcode, EDNS_MESSAGE_SZ, 0, NULL, 0);
+	
+	if (qp->q_tsig != NULL) {
+		u_char sig[TSIG_SIG_SIZE];
+		int siglen = sizeof(sig);
+
 		ret = ns_sign(msg, &msglen, msgsize, NOERROR, qp->q_tsig->key,
 			      qp->q_tsig->sig, qp->q_tsig->siglen,
 			      sig, &siglen, 0);
@@ -2210,22 +2270,19 @@ send_msg(u_char *msg, int msglen, struct qinfo *qp) {
 			INSIST(0);
 		}
 	}
+
+#ifdef DEBUG
+	if (debug >= 6)
+		res_pquery(&res, msg, msglen, log_get_stream(packet_channel));
+#endif /* DEBUG */
 	
 	if (qp->q_stream == NULL) {
 		/*
-		 * Don't send FORMERR to these well known ports
-		 * (loop avoidance).
+		 * Don't send FORMERR to certian well known ports.
 		 */
-		switch (ntohs(qp->q_from.sin_port)) {
-		case 7: /* echo */
-		case 13: /* daytime */
-		case 19: /* chargen */
-		case 37: /* time */
-			if (hp->rcode == FORMERR)
+		if (hp->rcode == FORMERR &&
+		    drop_port(ntohs(qp->q_from.sin_port)))
 				return (-1);
-		default:
-			break;
-		}
 		if (sendto(qp->q_dfd, (char*)msg, msglen, 0,
 			   (struct sockaddr *)&qp->q_from,
 			   sizeof(qp->q_from)) < 0) {
@@ -2244,8 +2301,8 @@ send_msg(u_char *msg, int msglen, struct qinfo *qp) {
 	} else
 		writestream(qp->q_stream, (u_char*)msg, msglen);
 
-	if (qp->q_tsig != NULL) 
-		memput(msg, oldlen + TSIG_BUF_SIZE);
+	if (adjust != 0)
+		memput(msg, oldlen + adjust);
 
 	return (0);
 }
@@ -2266,7 +2323,8 @@ prime_cache(void) {
 		 priming, root);
 	if (!priming && !root) {
 		struct qinfo *qp = sysquery("", ns_c_in, ns_t_ns,
-					    NULL, 0, ns_port, ns_o_query);
+					    NULL, NULL, 0, ns_port,
+					    ns_o_query, 0);
 
 		if (qp != NULL) {
 			qp->q_flags |= (Q_SYSTEM | Q_PRIMING);
@@ -2278,7 +2336,8 @@ prime_cache(void) {
 
 struct qinfo *
 sysquery(const char *dname, int class, int type,
-	 struct in_addr *nss, int nsc, u_int16_t port, int opcode)
+	 struct in_addr *nss, struct dst_key **keys, int nsc,
+	 u_int16_t port, int opcode, int distance)
 {
 	struct qinfo *qp, *oqp;
 	HEADER *hp;
@@ -2292,18 +2351,20 @@ sysquery(const char *dname, int class, int type,
 	const char *fname;
 	int n, count;
 	int sendto_errno = 0;
-	u_char *oldqbuf;
-	int oldqlen, has_tsig;
-	u_char *smsg;
-	int smsglen, smsgsize, siglen;
+	u_char *oldqbuf = NULL;
+	int oldqlen = 0, has_tsig;
+	u_char *smsg = NULL;
+	int smsglen, smsgsize = 0, siglen;
 	u_char sig[TSIG_SIG_SIZE];
 	DST_KEY *key;
 
 	nsp[0] = NULL;
-	ns_debug(ns_log_default, 3, "sysquery(%s, %d, %d, %#x, %d, %d)",
-		 dname, class, type, nss, nsc, ntohs(port));
+	ns_debug(ns_log_default, 3, "sysquery(%s, %d, %d, %p, %p, %d, %d)",
+		 dname, class, type, nss, keys, nsc, ntohs(port));
 	qp = qnew(dname, class, type, (nss != NULL && nsc != 0) ? 0 : 1);
 
+	qp->q_distance = distance;
+
 	if (nss != NULL && nsc != 0)
 		np = NULL;
 	else if (!NS_ZOPTION_P(qp->q_fzone, OPTION_FORWARD_ONLY)) {
@@ -2396,10 +2457,13 @@ sysquery(const char *dname, int class, int type,
 			qs->ns_addr.sin_family = AF_INET;
 			qs->ns_addr.sin_addr = nss[i];
 			qs->ns_addr.sin_port = port;
+			if  (keys != NULL)
+				qp->q_keys[i] = keys[i];
 			qs->ns = NULL;
 			qs->nsdata = NULL;
 			qs->stime = tt;
 			qs->forwarder = 0;
+			qs->noedns = 1;		/* XXXMPA */
 			qs->nretry = 0;
 		}
 		qp->q_naddr = nsc;
@@ -2451,7 +2515,7 @@ sysquery(const char *dname, int class, int type,
 				}
 				getname(np, tmpdomain, sizeof tmpdomain);
 				if (qp->q_domain != NULL)
-					freestr(qp->q_domain);
+					(void)freestr(qp->q_domain);
 				qp->q_domain = savestr(tmpdomain, 1);
 				goto fetch_a;
 			}
@@ -2476,37 +2540,47 @@ sysquery(const char *dname, int class, int type,
 			    log_get_stream(packet_channel));
 #endif
 
-	key = tsig_key_from_addr(nsa->sin_addr);
-	if (key != NULL) {
-		smsgsize = qp->q_msglen + TSIG_BUF_SIZE;
+	key = qp->q_keys[0];
+	if (key == NULL)
+		key = qp->q_keys[0] = tsig_key_from_addr(nsa->sin_addr);
+	if (key != NULL || !qp->q_addr[0].noedns) {
+		smsgsize = qp->q_msglen + TSIG_BUF_SIZE + 11;
 		smsg = memget(smsgsize);
 		smsglen = qp->q_msglen;
 		siglen = sizeof(sig);
 		memcpy(smsg, qp->q_msg, qp->q_msglen);
+	}
+	
+	if (!qp->q_addr[0].noedns)
+                smsglen += ns_add_opt(smsg, smsg + smsglen, smsgsize, 0, 0,
+                                      EDNS_MESSAGE_SZ, 0, NULL, 0);
+
+	if (key != NULL) {
 		n = ns_sign(smsg, &smsglen, smsgsize, NOERROR, key, NULL, 0,
 			    sig, &siglen, 0);
 		if (n == 0) {
-			oldqbuf = qp->q_msg;
-			oldqlen = qp->q_msglen;
-			qp->q_msglen = smsglen;
-			qp->q_msg = smsg;
 			has_tsig = 1;
-			qp->q_nstsig = new_tsig(key, sig, siglen); /* BEW? */
-
-		}
-		else {
+			free_tsig(qp->q_nstsig);
+			qp->q_nstsig = new_tsig(key, sig, siglen);
+		} else {
 			INSIST(0);
 			has_tsig = 0;
 			free_tsig(qp->q_nstsig);
 			qp->q_nstsig = NULL;
 		}
-	}
-	else {
+	} else {
 		has_tsig = 0;
 		free_tsig(qp->q_nstsig);
 		qp->q_nstsig = NULL;
 	}
 
+	if (smsgsize != 0) {
+		oldqbuf = qp->q_msg;
+		oldqlen = qp->q_msglen;
+		qp->q_msglen = smsglen;
+		qp->q_msg = smsg;
+	}
+
 	if (sendto(qp->q_dfd, (char*)qp->q_msg, qp->q_msglen, 0,
 		   (struct sockaddr *)nsa,
 		   sizeof(struct sockaddr_in)) < 0) {
@@ -2517,8 +2591,9 @@ sysquery(const char *dname, int class, int type,
 				sin_ntoa(*nsa), strerror(errno));
 		nameserIncr(nsa->sin_addr, nssSendtoErr);
 	}
-	if (has_tsig == 1) {
-		memput(qp->q_msg, smsgsize);
+
+	if (smsgsize != 0) {
+		memput(smsg, smsgsize);
 		qp->q_msg = oldqbuf;
 		qp->q_msglen = oldqlen;
 	}
@@ -2626,8 +2701,8 @@ check_ns() {
 				ns_debug(ns_log_default, 3,
 					 "check_ns: %s: not found %s %#lx",
 					 dname, fname, (u_long)tnp);
-				sysquery(dname, dp->d_class, T_A, NULL,
-					 0, ns_port, QUERY);
+				sysquery(dname, dp->d_class, T_A, NULL, NULL,
+					 0, ns_port, QUERY, 0);
 				continue;
 			}
 			/* look for name server addresses */
@@ -2660,8 +2735,8 @@ check_ns() {
 					"Root NS %s -> CNAME %s",
 					NAME(*np), NAME(*tnp));
 			else
-				sysquery(dname, dp->d_class, T_A, NULL,
-					 0, ns_port, QUERY);
+				sysquery(dname, dp->d_class, T_A, NULL, NULL,
+					 0, ns_port, QUERY, 0);
 	        }
 	}
 
@@ -2718,7 +2793,7 @@ findns(struct namebuf **npp, int class,
 				break;
 	}
 	while (np != NULL) {
-		ns_debug(ns_log_default, 5, "findns: np %#x '%s'", np,
+		ns_debug(ns_log_default, 5, "findns: np %p '%s'", np,
 			 NAME(*np));
 		/* Look first for SOA records. */
 #ifdef ADDAUTH
@@ -2776,10 +2851,8 @@ findns(struct namebuf **npp, int class,
 				 * them here as we just got them from the
 				 * cache.
 				 */
-				while (nspp > &nsp[0]) {
-					nspp--;
-					DRCNTDEC(*nspp);
-				}
+				while (nspp > &nsp[0])
+					db_detach(--nspp);
 				nsp[0] = NULL;
 				goto try_parent;
 			}
@@ -3232,7 +3305,7 @@ wanted(const struct databuf *dp, int class, int type) {
 #ifdef DEBUG
 	strcpy(pclass, p_class(class));
 	strcpy(ptype, p_type(type));
-	ns_debug(ns_log_default, 3, "wanted(%#x, %s %s) [%s %s]",
+	ns_debug(ns_log_default, 3, "wanted(%p, %s %s) [%s %s]",
 		 dp, pclass, ptype,
 		 p_class(dp->d_class), p_type(dp->d_type));
 #endif
@@ -3312,7 +3385,7 @@ wantedsig(const struct databuf *dp, int class, int type) {
 #ifdef DEBUG
 	strcpy(pclass, p_class(class));
 	strcpy(ptype, p_type(type));
-	ns_debug(ns_log_default, 3, "wantedtsig(%#x, %s %s) [%s %s]",
+	ns_debug(ns_log_default, 3, "wantedtsig(%p, %s %s) [%s %s]",
 		 dp, pclass, ptype,
 		 p_class(dp->d_class), p_type(dp->d_type));
 #endif
@@ -3400,6 +3473,7 @@ rrsetadd(struct flush_set *flushset, const char *name, struct databuf *dp) {
 		panic("rrsetadd: out of memory", NULL);
 	dbl->db_next = NULL;
 	dbl->db_dp = dp;
+	DRCNTINC(dbl->db_dp);
 	if (fs->fs_last == NULL)
 		fs->fs_list = dbl;
 	else
@@ -3664,6 +3738,7 @@ rrsetupdate(struct flush_set * flushset, int flags, struct sockaddr_in from,
 					 n);
 				odbp = dbp;
 				dbp = dbp->db_next;
+				db_detach(&odbp->db_dp);
 				memput(odbp, sizeof *odbp);
 			}    
 			ns_debug(ns_log_default, 3,
@@ -3674,7 +3749,7 @@ rrsetupdate(struct flush_set * flushset, int flags, struct sockaddr_in from,
 				(void)ttlcheck(fs->fs_name,fs->fs_list, 1);
 			dbp = fs->fs_list;
 			while (dbp) {
-				db_freedata(dbp->db_dp);
+				db_detach(&dbp->db_dp);
 				odbp = dbp;
 				dbp = dbp->db_next;
 				memput(odbp, sizeof *odbp);
@@ -3704,15 +3779,23 @@ flushrrset(struct flush_set * fs, struct sockaddr_in from) {
 			      from);
 		ns_debug(ns_log_default, 3, "flushrrset: %d", n);
 	} while (n == OK);
-	db_freedata(dp);
+	db_detach(&dp);
 }
 
 static void
 free_flushset(struct flush_set *flushset, int flushset_size) {
 	struct flush_set *fs;
+	struct db_list *dbl;
 
-	for (fs = flushset; fs->fs_name != NULL; fs++)
-		freestr(fs->fs_name);
+	for (fs = flushset; fs->fs_name != NULL; fs++) {
+		fs->fs_name = freestr(fs->fs_name);
+		while ((dbl = fs->fs_list) != NULL) {
+			fs->fs_list = dbl->db_next;
+			dbl->db_next = NULL;
+			db_detach(&dbl->db_dp);
+			memput(dbl, sizeof(*dbl));
+		}
+	}
 	memput(flushset, flushset_size);
 }
 
@@ -3727,7 +3810,7 @@ void
 delete_all(struct namebuf *np, int class, int type) {
 	struct databuf *dp, *pdp;
 
-	ns_debug(ns_log_default, 3, "delete_all(%#x:\"%s\" %s %s)",
+	ns_debug(ns_log_default, 3, "delete_all(%p:\"%s\" %s %s)",
 		 np, NAME(*np), p_class(class), p_type(type));
 	pdp = NULL;
 	dp = np->n_data;
@@ -3849,6 +3932,22 @@ trunc_adjust(u_char *msg, int msglen, int outlen) {
 /*
  * mark the server "from" bad in the qp structure so it won't be retried.
  */
+static int
+mark_noedns(struct qinfo *qp, struct sockaddr_in from) {
+	int i;
+
+	for (i = 0; i < (int)qp->q_naddr; i++)
+		if (ina_equal(qp->q_addr[i].ns_addr.sin_addr, from.sin_addr)) {
+			if (qp->q_addr[i].noedns)
+				return (1);
+			if (qp->q_addr[i].nsdata)
+				qp->q_addr[i].nsdata->d_noedns = 1;
+			qp->q_addr[i].noedns = 1;
+			break;
+		}
+	return (0);
+}
+
 static void
 mark_bad(struct qinfo *qp, struct sockaddr_in from) {
 	int i;
@@ -3878,10 +3977,10 @@ mark_lame(struct qinfo *qp, struct sockaddr_in from) {
  * wrong interface an a multihomed server.
  */
 static void
-fast_retry(struct qinfo *qp, struct sockaddr_in from) {
+fast_retry(struct qinfo *qp, struct sockaddr_in from, int samehost) {
         if (ina_equal(qp->q_addr[qp->q_curaddr].ns_addr.sin_addr,
                    from.sin_addr))
-                retry(qp);
+                retry(qp, samehost);
 }
 
 static void
@@ -3892,7 +3991,7 @@ add_related_additional(char *name) {
 		return;
 	for (i = 0; i < num_related; i++)
 		if (ns_samename(name, related[i]) == 1) {
-			freestr(name);
+			(void)freestr(name);
 			return;
 		}
 	related[num_related++] = name;
@@ -3903,7 +4002,7 @@ free_related_additional() {
 	int i;
 
 	for (i = 0; i < num_related; i++)
-		freestr(related[i]);
+		related[i] = freestr(related[i]);
 	num_related = 0;
 }
 
@@ -3921,8 +4020,7 @@ static void
 freestr_maybe(char **tname) {
 	if (tname == NULL || *tname == NULL)
 		return;
-	freestr(*tname);
-	*tname = NULL;
+	*tname = freestr(*tname);
 }
 
 /*
diff --git a/contrib/bind/bin/named/ns_signal.c b/contrib/bind/bin/named/ns_signal.c
index f5a6e24..0820bfa 100644
--- a/contrib/bind/bin/named/ns_signal.c
+++ b/contrib/bind/bin/named/ns_signal.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_main.c	4.55 (Berkeley) 7/1/91";
-static const char rcsid[] = "$Id: ns_signal.c,v 8.13 2000/07/11 07:10:12 vixie Exp $";
+static const char rcsid[] = "$Id: ns_signal.c,v 8.14 2001/06/18 14:43:25 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -162,28 +162,43 @@ static int blocked = 0;
 
 static SIG_FN
 onhup(int sig) {
+
+	UNUSED(sig);
+
 	ns_need_unsafe(main_need_reload);
 }
 
 static SIG_FN
 onintr(int sig) {
+
+	UNUSED(sig);
+
 	ns_need_unsafe(main_need_exit);
 }
 
 static SIG_FN
 setdumpflg(int sig) {
+
+	UNUSED(sig);
+
 	ns_need_unsafe(main_need_dump);
 }
 
 #ifdef DEBUG
 static SIG_FN
 setIncrDbgFlg(int sig) {
+
+	UNUSED(sig);
+
 	desired_debug++;
 	ns_need_unsafe(main_need_debug);
 }
 
 static SIG_FN
 setNoDbgFlg(int sig) {
+
+	UNUSED(sig);
+
 	desired_debug = 0;
 	ns_need_unsafe(main_need_debug);
 }
@@ -192,12 +207,18 @@ setNoDbgFlg(int sig) {
 #if defined(QRYLOG) && defined(SIGWINCH)
 static SIG_FN
 setQrylogFlg(int sig) {
+
+	UNUSED(sig);
+
 	ns_need_unsafe(main_need_qrylog);
 }
 #endif /*QRYLOG && SIGWINCH*/
 
 static SIG_FN
 setstatsflg(int sig) {
+
+	UNUSED(sig);
+
 	ns_need_unsafe(main_need_statsdump);
 }
 
@@ -207,6 +228,8 @@ discard_pipe(int sig) {
 	int saved_errno = errno;
 	struct sigaction sa;
 
+	UNUSED(sig);
+
 	memset(&sa, 0, sizeof sa);
 	sa.sa_mask = mask;
 	sa.sa_handler = discard_pipe;
@@ -214,11 +237,16 @@ discard_pipe(int sig) {
 		ns_error(ns_log_os, "sigaction failed in discard_pipe: %s",
 			 strerror(errno));
 	errno = saved_errno;
+#else
+	UNUSED(sig);
 #endif
 }
 
 static SIG_FN
 setreapflg(int sig) {
+
+	UNUSED(sig);
+
 	ns_need_unsafe(main_need_reap);
 }
 
@@ -226,7 +254,7 @@ setreapflg(int sig) {
 
 void
 init_signals(void) {
-	int sh;
+	size_t sh;
 
 	/* The mask of all our handlers will block all our other handlers. */
 	(void)sigemptyset(&mask);
diff --git a/contrib/bind/bin/named/ns_sort.c b/contrib/bind/bin/named/ns_sort.c
index 3b3f31e..6489c4d 100644
--- a/contrib/bind/bin/named/ns_sort.c
+++ b/contrib/bind/bin/named/ns_sort.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_sort.c	4.10 (Berkeley) 3/3/91";
-static const char rcsid[] = "$Id: ns_sort.c,v 8.6 2000/04/21 06:54:13 vixie Exp $";
+static const char rcsid[] = "$Id: ns_sort.c,v 8.8 2001/09/25 04:50:22 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -183,6 +183,7 @@ static const char rcsid[] = "$Id: ns_sort.c,v 8.6 2000/04/21 06:54:13 vixie Exp
 #include <stdio.h>
 #include <syslog.h>
 #include <resolv.h>
+#include <string.h>
 
 #include <isc/eventlib.h>
 #include <isc/logging.h>
@@ -240,6 +241,7 @@ sort_response(u_char *cp, u_char *eom, int ancount, struct sockaddr_in *from) {
 			indirect = 1;
 			break;
 		default:
+			indirect = 0;
 			panic("unexpected ime type in ip_match_address()",
 			      NULL);
 		}
@@ -282,6 +284,7 @@ sort_response(u_char *cp, u_char *eom, int ancount, struct sockaddr_in *from) {
 				iml = imematch->next->u.indirect.list;
 				break;
 			default:
+				iml = NULL;
 				panic("unexpected ime type in ip_match_address()",
 				      NULL);
 			}
@@ -303,9 +306,9 @@ sort_response(u_char *cp, u_char *eom, int ancount, struct sockaddr_in *from) {
 
 static int
 sort_rr(u_char *cp, u_char *eom, int ancount, ip_match_list iml) {
-	int type, class, dlen, n, c, distance, closest;
+	int type, class, dlen, n, c, distance, closest = 0;
 	struct in_addr inaddr;
-	u_char *rr1 = NULL, *rrbest, *cpstart;
+	u_char *rr1 = NULL, *rrbest = NULL, *cpstart;
 
 	rr1 = NULL;
 	cpstart = cp;
@@ -384,6 +387,7 @@ ip_match_address_elt(ip_match_list iml, struct in_addr address,
 			indirect = 1;
 			break;
 		default:
+			indirect = 0;
 			panic("unexpected ime type in ip_match_address()",
 			      NULL);
 		}
diff --git a/contrib/bind/bin/named/ns_stats.c b/contrib/bind/bin/named/ns_stats.c
index 0af3e2f..3c5abb1 100644
--- a/contrib/bind/bin/named/ns_stats.c
+++ b/contrib/bind/bin/named/ns_stats.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_stats.c	4.10 (Berkeley) 6/27/90";
-static const char rcsid[] = "$Id: ns_stats.c,v 8.32.2.1 2001/08/09 14:04:49 marka Exp $";
+static const char rcsid[] = "$Id: ns_stats.c,v 8.34 2001/08/09 13:17:21 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -381,6 +381,11 @@ ns_logstats(evContext ctx, void *uap, struct timespec due,
 #ifdef HAVE_GETRUSAGE
 # define tv_float(tv) ((tv).tv_sec + ((tv).tv_usec / 1000000.0))
 
+	UNUSED(ctx);
+	UNUSED(uap);
+	UNUSED(due);
+	UNUSED(inter);
+
 	getrusage(RUSAGE_SELF, &usage);
 	getrusage(RUSAGE_CHILDREN, &childu);
 
diff --git a/contrib/bind/bin/named/ns_update.c b/contrib/bind/bin/named/ns_update.c
index 4ad697b..774bd2c 100644
--- a/contrib/bind/bin/named/ns_update.c
+++ b/contrib/bind/bin/named/ns_update.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_update.c,v 8.91.2.2 2001/04/30 03:20:46 marka Exp $";
+static const char rcsid[] = "$Id: ns_update.c,v 8.103 2002/01/03 00:25:02 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -105,7 +105,7 @@ static struct map m_opcode[] = {
 #define M_CLASS_CNT m_class_cnt
 #define M_TYPE_CNT m_type_cnt
 
-static char *opcodes[] = {
+static const char *opcodes[] = {
 	"delete",
 	"add",
 	"",
@@ -734,53 +734,59 @@ prescan_nameok(ns_updrec *ur, int *rcodep, u_int16_t zclass,
 	u_int16_t type = ur->r_type;
 	char *cp = (char *)ur->r_dp->d_data;
 	enum context context;
+	enum transport transport;
 
 	/* We don't care about deletes */
 	if (ur->r_class != zclass)
 		return (1);
 
-	context = ns_ownercontext(type, primary_trans);
-	if (!ns_nameok(NULL, owner, class, zp, primary_trans, context, owner,
+	if (zp->z_type == Z_PRIMARY)
+		transport = primary_trans;
+	else
+		transport = secondary_trans;
+
+	context = ns_ownercontext(type, transport);
+	if (!ns_nameok(NULL, owner, class, zp, transport, context, owner,
 		       inaddr_any))
 		goto refused;
 
 	switch (type) {
 	case ns_t_soa:
 		context = hostname_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		cp += strlen(cp) + 1;
 		context = mailname_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
 	case ns_t_rp:
 		context = mailname_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		cp += strlen(cp) + 1;
 		context = domain_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
 	case ns_t_minfo:
 		context = mailname_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		cp += strlen(cp) + 1;
 		context = mailname_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
 	case ns_t_ns:
 		context = hostname_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
@@ -789,13 +795,13 @@ prescan_nameok(ns_updrec *ur, int *rcodep, u_int16_t zclass,
 	case ns_t_mg:
 	case ns_t_mr:
 		context = domain_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
 	case ns_t_ptr:
 		context = ns_ptrcontext(owner);
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
@@ -812,7 +818,7 @@ prescan_nameok(ns_updrec *ur, int *rcodep, u_int16_t zclass,
 		/* Pattern (txt) */
 		cp += (*cp&0xff) + 1;
 		context = domain_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans,
+		if (!ns_nameok(NULL, cp, class, zp, transport,
 			       context, owner, inaddr_any))
 			goto refused;
 		break;
@@ -825,18 +831,18 @@ prescan_nameok(ns_updrec *ur, int *rcodep, u_int16_t zclass,
 	case ns_t_kx:
 		cp += 2;
 		context = hostname_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
 	case ns_t_px:
 		cp += 2;
 		context = domain_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		cp += strlen(cp) + 1;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
@@ -852,13 +858,13 @@ prescan_nameok(ns_updrec *ur, int *rcodep, u_int16_t zclass,
 		 */
 		cp += 18;
 		context = domain_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
 	case ns_t_nxt:
 		context = domain_ctx;
-		if (!ns_nameok(NULL, cp, class, zp, primary_trans, context, owner,
+		if (!ns_nameok(NULL, cp, class, zp, transport, context, owner,
 			       inaddr_any))
 			goto refused;
 		break;
@@ -977,7 +983,7 @@ process_updates(const ns_updque *updlist, int *rcodep,
 
 		ns_debug(ns_log_update, 3,
 "process_update: record section=%s, dname=%s, \
-class=%s, type=%s, ttl=%d, dp=0x%0x",
+class=%s, type=%s, ttl=%d, dp=%p",
 			 p_section(section, ns_o_update), dname,
 			 p_class(class), p_type(type), ttl, rdp);
 
@@ -1048,7 +1054,7 @@ class=%s, type=%s, ttl=%d, dp=0x%0x",
 					 n);
 			} else {
 				ns_debug(ns_log_update, 3,
-				      "process_updates: added databuf 0x%0x",
+				      "process_updates: added databuf %p",
 					 dp);
 				dp->d_mark = D_MARK_ADDED;
 				numupdated++;
@@ -1135,8 +1141,8 @@ class=%s, type=%s, ttl=%d, dp=0x%0x",
 
 static enum req_action
 req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg, 
-		   struct qstream *qsp, int dfd, struct sockaddr_in from,
-		   struct tsig_record *in_tsig, ns_updque *curupd)
+		   struct sockaddr_in from, struct tsig_record *in_tsig,
+		   ns_updque *curupd)
 {
 	char dnbuf[MAXDNAME], *dname;
 	u_int zocount, prcount, upcount, adcount, class, type, dlen;
@@ -1340,7 +1346,6 @@ req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg,
 		dp->d_secure = DB_S_INSECURE; /* should be UNCHECKED */
 		dp->d_clev = nlabels(zp->z_origin);
 		/* XXX - also record in dp->d_ns, which host this came from */
-		DRCNTINC(dp);
 		rrecp->r_dp = dp;
 		/* Append the current record to the end of list of records. */
 		APPEND(*curupd, rrecp, r_link);
@@ -1380,7 +1385,8 @@ void
 free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 	ns_updrec *rrecp, *first_rrecp, *next_rrecp;
 	struct databuf *dp, *tmpdp;
-	char *dname, *msg;
+	char *dname;
+	const char *msg;
 
 	if (rcode == NOERROR) {
 		first_rrecp = HEAD(*updlist);
@@ -1389,7 +1395,7 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 		first_rrecp = TAIL(*updlist);
 		msg = "free_rrecp: update transaction aborted, rolling back";
 	}
-	ns_debug(ns_log_update, 1, msg);
+	ns_debug(ns_log_update, 1, "%s", msg);
 	for (rrecp = first_rrecp; rrecp != NULL; rrecp = next_rrecp) {
 		if (rcode == NOERROR)
 			next_rrecp = NEXT(rrecp, r_link);
@@ -1397,12 +1403,8 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 			next_rrecp = PREV(rrecp, r_link);
 		UNLINK(*updlist, rrecp, r_link);
 		if (rrecp->r_section != S_UPDATE) {
-			if (rrecp->r_dp) {
-				DRCNTDEC(rrecp->r_dp);
-				if (rrecp->r_dp->d_rcnt == 0)
-					db_freedata(rrecp->r_dp);
-				rrecp->r_dp = NULL;
-			}
+			if (rrecp->r_dp)
+				db_detach(&rrecp->r_dp);
 			INSIST(rrecp->r_deldp == NULL);
 			res_freeupdrec(rrecp);
 			continue;
@@ -1428,24 +1430,12 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 						 dname, p_type(dp->d_type));
 				} else {
 					ns_debug(ns_log_update, 3,
-				         "free_rrecp: deleted databuf 0x%0x",
+				         "free_rrecp: deleted databuf %p",
 						 dp);
-					/* 
-					 * XXXRTH 
-					 *
-					 * We used to db_freedata() here,
-					 * but I removed it because 'dp' was
-					 * part of a hashtab before we called
-					 * db_update(), and since our delete
-					 * has succeeded, it should have been
-					 * freed.
-					 */
 				}
 			}
 		}
-		DRCNTDEC(dp);
-		if (dp->d_rcnt == 0)
-			db_freedata(dp);
+		db_detach(&dp);
 
 		/* Process deleted databuf's. */
 		dp = rrecp->r_deldp;
@@ -1464,13 +1454,11 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 						 dname, p_type(tmpdp->d_type));
 				} else {
 					ns_debug(ns_log_update, 3,
-				      "free_rrecp: added back databuf 0x%0x",
+				      "free_rrecp: added back databuf %p",
 						 tmpdp);
 				}
 			}
-			DRCNTDEC(tmpdp);
-			if (tmpdp->d_rcnt == 0)
-				db_freedata(tmpdp);
+			db_detach(&tmpdp);
 		}
 		res_freeupdrec(rrecp);
 	}
@@ -1478,15 +1466,13 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 
 enum req_action
 req_update(HEADER *hp, u_char *cp, u_char *eom, u_char *msg, 
-	   struct qstream *qsp, int dfd, struct sockaddr_in from,
-	   struct tsig_record *in_tsig)
+	   struct sockaddr_in from, struct tsig_record *in_tsig)
 {
 	enum req_action ret;
 	ns_updque curupd;
 
 	INIT_LIST(curupd);
-	ret = req_update_private(hp, cp, eom, msg, qsp, dfd, from,
-				 in_tsig, &curupd);
+	ret = req_update_private(hp, cp, eom, msg, from, in_tsig, &curupd);
 	free_rrecp(&curupd, ret == Refuse ? ns_r_refused : hp->rcode, from);
 	if (ret == Finish) {
 		hp->qdcount = hp->ancount = hp->nscount = hp->arcount = 0;
@@ -1628,13 +1614,13 @@ rdata_expand(const u_char *msg, const u_char *eom, const u_char *cp,
 		cp += SIG_HDR_SIZE;
 		cp1 += SIG_HDR_SIZE;
 		n = dn_expand(msg, eom, cp, (char *)cp1, size);
-		if (n < 0 || n + SIG_HDR_SIZE > dlen)
+		if (n < 0 || n + SIG_HDR_SIZE > (int)dlen)
 			return (0);
 		cp += n;
 		n1 = dlen - n - SIG_HDR_SIZE;
 		n = strlen((char *)cp1) + 1;
 		cp1 += n;
-		if (size < n1)
+		if ((int)size < n1)
 			return (0);
 		memcpy(cp1, cp, n1);
 		cp1 += n1;
@@ -1665,14 +1651,16 @@ rdata_expand(const u_char *msg, const u_char *eom, const u_char *cp,
 			if (n1 < 4 || n1 > 16)
 				return (0);
 		}
-		if (n1 > size)
+		if (n1 > (int)size)
 			return (0);
 		memcpy(cp1, cp, n1);
 		cp1 += n1;
 		return (cp1 - cp1init);
 	default:
-		ns_debug(ns_log_update, 3, "unknown type %d", type);
-		return (0);
+		if (size < dlen)
+			return (0);
+		memcpy(cp1, cp, dlen);
+		return (dlen);
 	}
 }
 
@@ -1917,7 +1905,13 @@ rdata_dump(struct databuf *dp, FILE *fp) {
 		break;
 	}
 	default:
-		fprintf(fp, "\t;?d_type=%d?", dp->d_type);
+		fprintf(fp, "\\# %u", dp->d_size);
+		if (dp->d_size) {
+			fputs(" ( ", fp);
+			isc_puthexstring(fp, dp->d_data, dp->d_size,	
+					 28, 48, "\n\t\t\t\t");
+			fputs(" )", fp);
+		}
 	}
 }
 
@@ -1937,7 +1931,7 @@ findzone(const char *dname, int class, int depth, int *zonelist, int maxzones){
 	int escaped, found, done;
 
 	ns_debug(ns_log_update, 4, "findzone(dname=%s, class=%d, depth=%d, \
-zonelist=0x%x, maxzones=%d)",
+zonelist=%p, maxzones=%d)",
 		 dname, class, depth, zonelist, maxzones);
 #ifdef DEBUG
 	if (debug >= 5) {
@@ -2068,7 +2062,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 	u_int32_t serial, ttl, old_serial, new_serial;
 	char *dname, *cp, *cp1;
 	int type, class;
-	int i, c, section, opcode, matches, zonenum, err, multiline;
+	int i, c, section, opcode, matches, zonenum = 0, err, multiline;
 	int nonempty_lineno = -1, prev_pktdone = 0, cont = 0, inside_next = 0;
 	int id, rcode = NOERROR;
 	u_int32_t n;
@@ -2082,6 +2076,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 	int datasize;
 	unsigned long l;
 	ns_updque curupd;
+	unsigned long lutmp;
 
 	empty_from.sin_family = AF_INET;
 	empty_from.sin_addr.s_addr = htonl(INADDR_ANY);
@@ -2151,6 +2146,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 	INIT_LIST(curupd);
 	for (;;) {
 		err = 0;
+		dname = NULL;
 		if (!getword(buf, sizeof buf, fp, 0)) {
 			if (lineno == (nonempty_lineno + 1) && !(feof(fp))) {
 				/*
@@ -2223,6 +2219,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 			if (!EMPTY(curupd)) {
 				n = process_updates(&curupd, &rcode,
 						    empty_from);
+				free_rrecp(&curupd, rcode, empty_from);
 				if (n > 0)
 					ns_info(ns_log_update,
 			   "successfully merged update id %d from log file %s",
@@ -2234,7 +2231,6 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 					fclose(fp);
 					return(-1);
 				}
-				free_rrecp(&curupd, rcode, empty_from);
 			}
 			prev_pktdone = 0;
 			if (feof(fp))
@@ -2270,7 +2266,8 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 			if (!cp)
 				*buf = '\0';
 			n = sscanf(cp, "origin %s class %s serial %lu",
-				   origin, sclass, &serial);
+				   origin, sclass, &lutmp);
+			serial = lutmp;
 			if (n != 3 || ns_samename(origin, zp->z_origin) != 1)
 				err++;
 			if (cp)
@@ -2288,8 +2285,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 
 				dname = origin;
 				type = T_SOA;
-				class = sym_ston(__p_class_syms, sclass,
-						 &success);
+				class = res_nametoclass(sclass, &success);
 				if (!success) {
 				        err++;
 					break;
@@ -2355,9 +2351,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 				int success;
 				int maybe_class;
 				
-				maybe_class = sym_ston(__p_class_syms,
-						       buf,
-						       &success);
+				maybe_class = res_nametoclass(buf, &success);
 				if (success) {
 					class = maybe_class;
 					(void) getword(buf,
@@ -2370,9 +2364,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 				int success;
 				int maybe_type;
 
-				maybe_type = sym_ston(__p_type_syms,
-						      buf,
-						      &success);
+				maybe_type = res_nametotype(buf, &success);
 
 				if (success) {
 					type = maybe_type;
@@ -2618,7 +2610,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 				case ns_t_nxt:
 				case ns_t_cert:
 				    {
-					char * errmsg = NULL;
+					const char * errmsg = NULL;
 					int s;
 
 					s = parse_sec_rdata(buf, sizeof(buf),
@@ -2637,7 +2629,40 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 					break;
 				    }
 				default:
-					err++;
+					if (strcmp(buf, "\\#") != 0) {
+						err++;
+						break;
+					}
+					if (!getword(buf, sizeof buf, fp, 0) ||
+					    !isdigit((unsigned char)buf[0])) {
+						err++;
+						break;
+					}
+					n = strtoul(buf, &cp, 10);
+					if (n > 0xffff || *cp != '\0') {
+						err++;
+						break;
+					}
+					multiline = 0;
+					i = isc_gethexstring((u_char *)data,
+							     sizeof(data),
+							     n, fp, &multiline);
+					if (i == -1) {
+						err++;
+						break;
+					}
+					if (multiline) {
+						c = getnonblank(fp,
+								zp->z_updatelog,
+								1);
+						if (c != ')') {
+							ungetc(c, fp);
+							err++;
+							break;
+						}
+						multiline = 0;
+					}
+					endline(fp);
 				}
 			if (section == S_PREREQ) {
 				ttl = 0;
@@ -2687,12 +2712,12 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 			err++;
 		}
 		if (err) {
-			inside_next = 0;
 			ns_debug(ns_log_update, 1, 
 		      "merge of update id %d failed due to error at line %d",
 				 id, lineno);
 			free_rrecp(&curupd, FORMERR, empty_from);
-			continue;
+			fclose(fp);
+			return(-1);
 		}
 		rrecp = res_mkupdrec(section, dname, class, type, ttl);
 		if (section != S_ZONE) {
@@ -2701,7 +2726,6 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 			dp->d_cred = DB_C_ZONE;
 			dp->d_clev = nlabels(zp->z_origin);
 			dp->d_secure = DB_S_INSECURE; /* should be UNCHECKED */
-			DRCNTINC(dp);
 			rrecp->r_dp = dp;
 		} else {
 			rrecp->r_zone = zonenum;
diff --git a/contrib/bind/bin/named/ns_xfr.c b/contrib/bind/bin/named/ns_xfr.c
index 836195b..ab23b6b 100644
--- a/contrib/bind/bin/named/ns_xfr.c
+++ b/contrib/bind/bin/named/ns_xfr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_xfr.c,v 8.64 2001/02/15 00:18:46 marka Exp $";
+static const char rcsid[] = "$Id: ns_xfr.c,v 8.67 2001/07/10 05:06:50 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -107,7 +107,7 @@ ns_xfr(struct qstream *qsp, struct namebuf *znp,
 	 * write() data from us.
 	 */
 	(void) setsockopt(qsp->s_rfd, SOL_SOCKET, SO_SNDBUF,
-			  (char *)&sndbuf, sizeof sndbuf);
+			  (const char *)&sndbuf, sizeof sndbuf);
 #endif
 #ifdef SO_SNDLOWAT
 	/*
@@ -115,7 +115,7 @@ ns_xfr(struct qstream *qsp, struct namebuf *znp,
 	 * an XFER_BUFSIZE block of data.
 	 */
 	(void) setsockopt(qsp->s_rfd, SOL_SOCKET, SO_SNDLOWAT,
-			  (char *)&sndlowat, sizeof sndlowat);
+			  (const char *)&sndlowat, sizeof sndlowat);
 #endif
 	if (sq_openw(qsp, 64*1024) == -1) {
 		ns_error(ns_log_xfer_out, "ns_xfr: out of memory");
@@ -263,8 +263,7 @@ ns_freexfr(struct qstream *qsp) {
 			while ((rp = HEAD(dp->d_changes)) != NULL) {
 				UNLINK(dp->d_changes, rp, r_link);
 				if (rp->r_dp != NULL)
-					db_freedata(rp->r_dp);
-				rp->r_dp = NULL;
+					db_detach(&rp->r_dp);
 				res_freeupdrec(rp);
 			} 
 			memput(dp, sizeof *dp);
@@ -274,6 +273,10 @@ ns_freexfr(struct qstream *qsp) {
 	}
 	while (qsp->xfr.lev)
 		qsp->xfr.lev = sx_freelev(qsp->xfr.lev);
+	if (qsp->xfr.tsig_state != NULL) {
+		memput(qsp->xfr.tsig_state, sizeof(ns_tcp_tsig_state));
+		qsp->xfr.tsig_state = NULL;
+	}
 	zones[qsp->xfr.zone].z_numxfrs--;
 	qsp->flags &= ~(STREAM_AXFR | STREAM_AXFRIXFR);
 }
@@ -416,7 +419,7 @@ sx_addrr(struct qstream *qsp, const char *dname, struct databuf *dp) {
  * side effects:
  *	if progress was made, header and pointers will be advanced.
  */
-int
+static int
 sx_soarr(struct qstream *qsp) {
 	struct databuf *dp;
 	int added_soa = 0;
@@ -840,11 +843,8 @@ static struct qs_x_lev *
 sx_freelev(struct qs_x_lev *lev) {
 	struct qs_x_lev *next = lev->next;
 
-	if (lev->dp) {
-		DRCNTDEC(lev->dp);
-		if (lev->dp->d_rcnt == 0)
-			db_freedata(lev->dp);
-	}
+	if (lev->dp)
+		db_detach(&lev->dp);
 	memput(lev, sizeof *lev);
 	return (next);
 }
@@ -853,10 +853,7 @@ static struct databuf *
 db_next(struct databuf *dp) {
 	struct databuf *next = dp->d_next;
 
-	DRCNTDEC(dp);
-	if (dp->d_rcnt == 0)
-		db_freedata(dp);
-
+	db_detach(&dp);
 	if (next)
 		DRCNTINC(next);
 
diff --git a/contrib/bind/bin/ndc/ndc.c b/contrib/bind/bin/ndc/ndc.c
index 9daf69f..aa0e4a3 100644
--- a/contrib/bind/bin/ndc/ndc.c
+++ b/contrib/bind/bin/ndc/ndc.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ndc.c,v 1.16.2.1 2001/04/26 02:56:10 marka Exp $";
+static const char rcsid[] = "$Id: ndc.c,v 1.21 2001/12/19 23:16:23 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -60,7 +60,7 @@ typedef void (*closure)(void *, const char *, int);
 
 static const char *	program = "amnesia";
 static enum { e_channel, e_signals } mode = e_channel;
-static char *	channel = _PATH_NDCSOCK;
+static const char *	channel = _PATH_NDCSOCK;
 static const char	helpfmt[] = "\t%-16s\t%s\n";
 static const char *	pidfile = _PATH_PIDFILE;
 static sockaddr_t	client, server;
@@ -77,23 +77,23 @@ static int		builtincmd(void);
 static void		command(void);
 static int		running(int, pid_t *);
 static void		command_channel(void);
-static void		channel_loop(char *, int, closure, void *);
+static void		channel_loop(const char *, int, closure, void *);
 static void		getpid_closure(void *, const char *, int);
 static void		banner(struct ctl_cctx *, void *, const char *, u_int);
 static void		done(struct ctl_cctx *, void *, const char *, u_int);
-static void		logger(enum ctl_severity, const char *fmt, ...);
+static void		logger(enum ctl_severity, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);
 static void		command_signals(void);
 static void		stop_named(pid_t);
 static void		start_named(const char *, int);
 static int		fgetpid(const char *, pid_t *);
-static int		get_sockaddr(char *, sockaddr_t *);
+static int		get_sockaddr(const char *, sockaddr_t *);
 static size_t		impute_addrlen(const struct sockaddr *);
 static void		vtrace(const char *, va_list);
-static void		trace(const char *, ...);
-static void		result(const char *, ...);
-static void		fatal(const char *, ...);
-static void		verror(const char *, va_list);
-static void		error(const char *, ...);
+static void		trace(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
+static void		result(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
+static void		fatal(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
+static void		verror(const char *, va_list) ISC_FORMAT_PRINTF(1, 0);
+static void		error(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
 
 static void
 usage(const char *fmt, ...) {
@@ -114,7 +114,7 @@ usage(const char *fmt, ...) {
 /* Public. */
 
 int
-main(int argc, char *argv[], char *envp[]) {
+main(int argc, char *argv[]) {
 	char *p;
 	int ch;
 
@@ -402,7 +402,7 @@ struct args {
 };
 
 static void
-channel_loop(char *cmdtext, int show, closure cl, void *ua) {
+channel_loop(const char *cmdtext, int show, closure cl, void *ua) {
 	struct ctl_cctx *ctl;
 	struct sockaddr *client_addr;
 	struct args a;
@@ -457,6 +457,8 @@ static void
 done(struct ctl_cctx *ctl, void *uap, const char *msg, u_int flags) {
 	struct args *a = uap;
 
+	UNUSED(ctl);
+
 	if (msg == NULL) {
 		trace("EOF");
 		doneflag = 1;
@@ -488,6 +490,7 @@ logger(enum ctl_severity ctlsev, const char *format, ...) {
 			verror(format, args);
 		break;
 	default:
+		va_end(args);
 		abort();
 	}
 	va_end(args);
@@ -507,7 +510,7 @@ static struct cmdsig {
 	{ "querylog", SIGWINCH, "toggle query logging" },
 	{ "qrylog", SIGWINCH, "alias for querylog" },
 #endif
-	{ NULL, 0 }
+	{ NULL, 0, NULL }
 };
 
 static void
@@ -599,15 +602,15 @@ fgetpid(const char *f, pid_t *pid) {
 	long t;
 
 	for (try = 0; try < 5; try++) {
-		trace("pidfile is \"%s\" (try #%d)", pidfile, try + 1);
-		if ((fp = fopen(pidfile, "r")) == NULL)
+		trace("pidfile is \"%s\" (try #%d)", f, try + 1);
+		if ((fp = fopen(f, "r")) == NULL)
 			trace("pid file (%s) unavailable - %s",
-			      pidfile, strerror(errno));
+			      f, strerror(errno));
 		else if (fscanf(fp, "%ld\n", &t) != 1)
-			trace("pid file (%s) format is bad", pidfile);
+			trace("pid file (%s) format is bad", f);
 		else if (*pid = (pid_t)t, fclose(fp), kill(*pid, 0) < 0)
 			trace("pid file (%s) contains unusable pid (%d) - %s",
-			      pidfile, *pid, strerror(errno));
+			      f, *pid, strerror(errno));
 		else {
 			trace("pid is %ld", (long)*pid);
 			return (1);
@@ -619,7 +622,7 @@ fgetpid(const char *f, pid_t *pid) {
 }
 
 static int
-get_sockaddr(char *name, sockaddr_t *addr) {
+get_sockaddr(const char *name, sockaddr_t *addr) {
 	char *slash;
 
 #ifndef NO_SOCKADDR_UN
@@ -651,7 +654,7 @@ get_sockaddr(char *name, sockaddr_t *addr) {
 
 static size_t
 impute_addrlen(const struct sockaddr *sa) {
-	if (sa == 0)
+	if (sa == NULL)
 		return (0);
 	switch (sa->sa_family) {
 	case AF_INET:
@@ -663,6 +666,7 @@ impute_addrlen(const struct sockaddr *sa) {
 	default:
 		abort();
 	}
+	/*NOTREACHED*/
 }
 
 static void
diff --git a/contrib/bind/bin/nslookup/debug.c b/contrib/bind/bin/nslookup/debug.c
index 9b30977..5dcf927 100644
--- a/contrib/bind/bin/nslookup/debug.c
+++ b/contrib/bind/bin/nslookup/debug.c
@@ -53,7 +53,7 @@
 
 #ifndef lint
 static const char sccsid[] = "@(#)debug.c	5.26 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: debug.c,v 8.17 2000/11/08 06:47:31 marka Exp $";
+static const char rcsid[] = "$Id: debug.c,v 8.19 2001/09/25 04:50:26 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -80,6 +80,7 @@ static const char rcsid[] = "$Id: debug.c,v 8.17 2000/11/08 06:47:31 marka Exp $
 #include <netdb.h>
 #include <resolv.h>
 #include <stdio.h>
+#include <string.h>
 
 #include "port_after.h"
 
@@ -113,12 +114,12 @@ Fprint_query(const u_char *msg, const u_char *eom, int printHeader, FILE *file)
 	const u_char *cp;
 	const HEADER *hp;
 	int n;
-	u_int class, type;
+	u_int class, type = 0;
 
 	/*
 	 * Print header fields.
 	 */
-	hp = (HEADER *)msg;
+	hp = (const HEADER *)msg;
 	cp = msg + HFIXEDSZ;
 	if (printHeader || (res.options & RES_DEBUG2)) {
 		fprintf(file,"    HEADER:\n");
@@ -162,9 +163,9 @@ Fprint_query(const u_char *msg, const u_char *eom, int printHeader, FILE *file)
 			cp = Print_cdname(cp, msg, eom, file);
 			if (cp == NULL)
 				return;
-			type = ns_get16((u_char*)cp);
+			type = ns_get16((const u_char*)cp);
 			cp += INT16SZ;
-			class = ns_get16((u_char*)cp);
+			class = ns_get16((const u_char*)cp);
 			cp += INT16SZ;
 			fprintf(file,", type = %s", p_type(type));
 			fprintf(file,", class = %s\n", p_class(class));
@@ -217,7 +218,7 @@ Fprint_query(const u_char *msg, const u_char *eom, int printHeader, FILE *file)
 	fprintf(file,"\n------------\n");
 }
 
-const u_char *
+static const u_char *
 Print_cdname_sub(const u_char *cp, const u_char *msg, const u_char *eom,
 		 FILE *file, int format)
 {
@@ -323,16 +324,16 @@ Print_rr(const u_char *ocp, const u_char *msg, const u_char *eom, FILE *file) {
 
 	case T_MX:
 		BOUNDS_CHECK(cp, INT16SZ);
-		fprintf(file,"\tpreference = %u",ns_get16((u_char*)cp));
+		fprintf(file,"\tpreference = %u",ns_get16((const u_char*)cp));
 		cp += INT16SZ;
 		fprintf(file,", mail exchanger = ");
 		goto doname;
 
 	case T_NAPTR:
 		BOUNDS_CHECK(cp, 2 * INT16SZ);
-		fprintf(file, "\torder = %u",ns_get16((u_char*)cp));
+		fprintf(file, "\torder = %u",ns_get16((const u_char*)cp));
 		cp += INT16SZ;
-		fprintf(file,", preference = %u\n", ns_get16((u_char*)cp));
+		fprintf(file,", preference = %u\n", ns_get16((const u_char*)cp));
 		cp += INT16SZ;
 		/* Flags */
 		BOUNDS_CHECK(cp, 1);
@@ -364,11 +365,11 @@ Print_rr(const u_char *ocp, const u_char *msg, const u_char *eom, FILE *file) {
 
 	case T_SRV: 
 		BOUNDS_CHECK(cp, 3 * INT16SZ);
-		fprintf(file, "\tpriority = %u",ns_get16((u_char*)cp));
+		fprintf(file, "\tpriority = %u",ns_get16((const u_char*)cp));
 		cp += INT16SZ;
-		fprintf(file,", weight = %u", ns_get16((u_char*)cp));
+		fprintf(file,", weight = %u", ns_get16((const u_char*)cp));
 		cp += INT16SZ;
-		fprintf(file,", port= %u\n", ns_get16((u_char*)cp));
+		fprintf(file,", port= %u\n", ns_get16((const u_char*)cp));
 		cp += INT16SZ;
 
 		fprintf(file,"\thost = ");
@@ -376,7 +377,7 @@ Print_rr(const u_char *ocp, const u_char *msg, const u_char *eom, FILE *file) {
 
         case T_PX:
 		BOUNDS_CHECK(cp, INT16SZ);
-                fprintf(file,"\tpreference = %u",ns_get16((u_char*)cp));
+                fprintf(file,"\tpreference = %u",ns_get16((const u_char*)cp));
                 cp += INT16SZ;
                 fprintf(file,", RFC 822 = ");
                 cp = Print_cdname(cp, msg, eom, file);
@@ -395,14 +396,14 @@ Print_rr(const u_char *ocp, const u_char *msg, const u_char *eom, FILE *file) {
 
 	case T_RT:
 		BOUNDS_CHECK(cp, INT16SZ);
-		fprintf(file,"\tpreference = %u",ns_get16((u_char*)cp));
+		fprintf(file,"\tpreference = %u",ns_get16((const u_char*)cp));
 		cp += INT16SZ;
 		fprintf(file,", router = ");
 		goto doname;
 
 	case T_AFSDB:
 		BOUNDS_CHECK(cp, INT16SZ);
-		fprintf(file,"\tsubtype = %d",ns_get16((u_char*)cp));
+		fprintf(file,"\tsubtype = %d",ns_get16((const u_char*)cp));
 		cp += INT16SZ;
 		fprintf(file,", DCE/AFS server = ");
 		goto doname;
@@ -469,18 +470,18 @@ Print_rr(const u_char *ocp, const u_char *msg, const u_char *eom, FILE *file) {
 			return (NULL);			/* compression error */
 		}
 		BOUNDS_CHECK(cp, 5 * INT32SZ);
-		fprintf(file,"\n\tserial = %lu", ns_get32((u_char*)cp));
+		fprintf(file,"\n\tserial = %lu", ns_get32((const u_char*)cp));
 		cp += INT32SZ;
-		ttl = ns_get32((u_char*)cp);
+		ttl = ns_get32((const u_char*)cp);
 		fprintf(file,"\n\trefresh = %lu (%s)", ttl, p_time(ttl));
 		cp += INT32SZ;
-		ttl = ns_get32((u_char*)cp);
+		ttl = ns_get32((const u_char*)cp);
 		fprintf(file,"\n\tretry   = %lu (%s)", ttl, p_time(ttl));
 		cp += INT32SZ;
-		ttl = ns_get32((u_char*)cp);
+		ttl = ns_get32((const u_char*)cp);
 		fprintf(file,"\n\texpire  = %lu (%s)", ttl, p_time(ttl));
 		cp += INT32SZ;
-		ttl = ns_get32((u_char*)cp);
+		ttl = ns_get32((const u_char*)cp);
 		fprintf(file,
 		    "\n\tminimum ttl = %lu (%s)\n", ttl, p_time(ttl));
 		cp += INT32SZ;
diff --git a/contrib/bind/bin/nslookup/getinfo.c b/contrib/bind/bin/nslookup/getinfo.c
index 8b5cf38..68e3d75 100644
--- a/contrib/bind/bin/nslookup/getinfo.c
+++ b/contrib/bind/bin/nslookup/getinfo.c
@@ -53,7 +53,7 @@
 
 #ifndef lint
 static const char sccsid[] = "@(#)getinfo.c	5.26 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: getinfo.c,v 8.18 2001/02/27 06:03:40 vixie Exp $";
+static const char rcsid[] = "$Id: getinfo.c,v 8.20 2001/06/20 12:30:33 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -88,8 +88,6 @@ static const char rcsid[] = "$Id: getinfo.c,v 8.18 2001/02/27 06:03:40 vixie Exp
 
 #include "res.h"
 
-extern char *res_skip();
-
 static char *addr_list[MAXADDRS + 1];
 
 static char *host_aliases[MAXALIASES];
@@ -148,7 +146,7 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer)
     Boolean		isServer;
 {
     register HEADER	*headerPtr;
-    register u_char	*cp;
+    register const u_char	*cp;
     querybuf		answer;
     char		**aliasPtr;
     u_char		*eom, *bp;
@@ -157,7 +155,7 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer)
     char		*dnamePtr;
     int			type, class;
     int			qdcount, ancount, arcount, nscount, buflen;
-    int			origClass;
+    int			origClass = 0;
     int			numAliases = 0;
     int			numAddresses = 0;
     int			n, i, j;
@@ -238,8 +236,8 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer)
 
 	if (queryType != T_A && !(iquery && queryType == T_PTR)) {
 	    while (--ancount >= 0 && cp < eom) {
-		if ((cp = (u_char *)Print_rr(cp,
-		    (u_char *)&answer, eom, stdout)) == NULL) {
+		if ((cp = Print_rr(cp, (u_char *)&answer,
+				   eom, stdout)) == NULL) {
 		    return(ERROR);
 		}
 	    }
@@ -391,7 +389,7 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer)
 	printf("Authoritative answers can be found from:\n");
     }
 
-    cp = (u_char *)res_skip((char *) &answer, 2, eom);
+    cp = res_skip((u_char *)&answer, 2, eom);
 
     numServers = 0;
     if (queryType != T_A) {
@@ -399,8 +397,8 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer)
 	 * If we don't need to save the record, just print it.
 	 */
 	while (--nscount >= 0 && cp < eom) {
-	    if ((cp = (u_char *)Print_rr(cp,
-		(u_char *) &answer, eom, stdout)) == NULL) {
+	    if ((cp = Print_rr(cp, (u_char *) &answer, 
+			       eom, stdout)) == NULL) {
 		return(ERROR);
 	    }
 	}
@@ -476,15 +474,15 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer)
     /*
      * Additional resource records contain addresses of servers.
      */
-    cp = (u_char *)res_skip((char *) &answer, 3, eom);
+    cp = res_skip((u_char*)&answer, 3, eom);
 
     if (queryType != T_A) {
 	/*
 	 * If we don't need to save the record, just print it.
 	 */
 	while (--arcount >= 0 && cp < eom) {
-	    if ((cp = (u_char *)Print_rr(cp,
-		(u_char *) &answer, eom, stdout)) == NULL) {
+	    if ((cp = Print_rr(cp, (u_char *) &answer,
+			       eom, stdout)) == NULL) {
 		return(ERROR);
 	    }
 	}
@@ -592,7 +590,7 @@ GetHostInfoByName(nsAddrPtr, queryClass, queryType, name, hostPtr, isServer)
     struct in_addr	*nsAddrPtr;
     int			queryClass;
     int			queryType;
-    char		*name;
+    const char		*name;
     HostInfo		*hostPtr;
     Boolean		isServer;
 {
@@ -698,13 +696,14 @@ GetHostDomain(nsAddrPtr, queryClass, queryType, name, domain, hostPtr, isServer)
     struct in_addr	*nsAddrPtr;
     int			queryClass;
     int			queryType;
-    char		*name, *domain;
+    const char		*name;
+    char		*domain;
     HostInfo		*hostPtr;
     Boolean		isServer;
 {
     querybuf buf;
     char nbuf[2*MAXDNAME+2];
-    char *longname = nbuf;
+    const char *longname = nbuf;
     int n;
 
     if (domain == NULL) {
@@ -713,7 +712,7 @@ GetHostDomain(nsAddrPtr, queryClass, queryType, name, domain, hostPtr, isServer)
 	     * copy without '.' if present.
 	     */
 	    n = strlen(name) - 1;
-	    if (name[n] == '.' && n < sizeof(nbuf) - 1) {
+	    if (name[n] == '.' && n < (int)sizeof(nbuf) - 1) {
 		    memcpy(nbuf, name, n);
 		    nbuf[n] = '\0';
 	    } else
diff --git a/contrib/bind/bin/nslookup/list.c b/contrib/bind/bin/nslookup/list.c
index 863d433..c910230 100644
--- a/contrib/bind/bin/nslookup/list.c
+++ b/contrib/bind/bin/nslookup/list.c
@@ -53,7 +53,7 @@
 
 #ifndef lint
 static const char sccsid[] = "@(#)list.c	5.23 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: list.c,v 8.25 2000/12/23 08:14:46 vixie Exp $";
+static const char rcsid[] = "$Id: list.c,v 8.26 2001/06/18 14:43:38 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -434,7 +434,7 @@ ListSubr(int qtype, char *domain, char *cmd) {
 					strcpy(origin, name);
 				strcpy(name_ctx, "@");
 			}
-			if (qtype == T_ANY || ns_rr_type(rr) == qtype) {
+			if (qtype == T_ANY || (int)ns_rr_type(rr) == qtype) {
 				if (ns_sprintrr(&handle, &rr, name_ctx, origin,
 						buf, sizeof buf) < 0) {
 					perror("ns_sprintrr");
diff --git a/contrib/bind/bin/nslookup/main.c b/contrib/bind/bin/nslookup/main.c
index b27b418..6827c09 100644
--- a/contrib/bind/bin/nslookup/main.c
+++ b/contrib/bind/bin/nslookup/main.c
@@ -77,7 +77,7 @@ char copyright[] =
 
 #ifndef lint
 static const char sccsid[] = "@(#)main.c	5.42 (Berkeley) 3/3/91";
-static const char rcsid[] = "$Id: main.c,v 8.16 2000/12/23 08:14:47 vixie Exp $";
+static const char rcsid[] = "$Id: main.c,v 8.20 2001/06/20 12:40:06 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -168,7 +168,7 @@ int		queryClass = C_IN;
  * Stuff for Interrupt (control-C) signal handler.
  */
 
-extern SIG_FN	IntrHandler();
+extern SIG_FN	IntrHandler(int);
 FILE		*filePtr;
 jmp_buf		env;
 
@@ -176,10 +176,10 @@ jmp_buf		env;
 /*
  * Browser command for help.
  */
-char		*pager;
+const char		*pager;
 
-static void CvtAddrToPtr();
-static void ReadRC();
+static void CvtAddrToPtr(char *name);
+static void ReadRC(void);
 
 /*
  * Forward declarations.
@@ -188,6 +188,7 @@ static void LocalServer(HostInfo *defaultPtr);
 static void res_re_init(void);
 static void res_dnsrch(char *cp);
 static void Usage(void);
+static void ShowOptions(void);
 
 /*
  ******************************************************************************
@@ -381,7 +382,7 @@ main(int argc, char **argv) {
 }
 
 
-void
+static void
 LocalServer(defaultPtr)
     HostInfo *defaultPtr;
 {
@@ -436,10 +437,10 @@ Usage(void) {
 
 Boolean
 IsAddr(host, addrPtr)
-    char *host;
+    const char *host;
     struct in_addr *addrPtr;	/* If return TRUE, contains IP address */
 {
-    register char *cp;
+    register const char *cp;
 
     if (isdigit(host[0])) {
 	    /* Make sure it has only digits and dots. */
@@ -1028,7 +1029,7 @@ SetOption(option)
 /*
  * Fake a reinitialization when the domain is changed.
  */
-void
+static void
 res_re_init(void) {
     register char *cp, **pp;
     int n;
@@ -1050,7 +1051,7 @@ res_re_init(void) {
 
 #define SRCHLIST_SEP '/'
 
-void
+static void
 res_dnsrch(char *cp) {
     char **pp;
     int n;
@@ -1093,8 +1094,8 @@ res_dnsrch(char *cp) {
  ******************************************************************************
  */
 
-void
-ShowOptions()
+static void
+ShowOptions(void)
 {
     register char **cp;
 
@@ -1144,7 +1145,7 @@ ShowOptions()
  */
 
 void
-PrintHelp()
+PrintHelp(void)
 {
 	char cmd[PATH_MAX];
 
@@ -1193,7 +1194,7 @@ CvtAddrToPtr(name)
  */
 
 static void
-ReadRC()
+ReadRC(void)
 {
     register FILE *fp;
     register char *cp;
diff --git a/contrib/bind/bin/nslookup/res.h b/contrib/bind/bin/nslookup/res.h
index 2a07b17..79f8633 100644
--- a/contrib/bind/bin/nslookup/res.h
+++ b/contrib/bind/bin/nslookup/res.h
@@ -55,7 +55,7 @@
 
 /*
  *	@(#)res.h	5.10 (Berkeley) 6/1/90
- *	$Id: res.h,v 8.7 2000/12/23 08:14:47 vixie Exp $
+ *	$Id: res.h,v 8.9 2001/06/20 12:30:34 marka Exp $
  */
 
 /*
@@ -169,7 +169,6 @@ extern struct __res_state res;
  */
 
 /* XXX need prototypes */
-extern Boolean IsAddr();
 void Print_query(const u_char *msg, const u_char *eom, int printHeader);
 void Fprint_query(const u_char *msg, const u_char *eom, int printHeader,
 		  FILE *file);
@@ -186,14 +185,14 @@ extern char *Malloc();
 extern void NsError();
 extern void PrintServer();
 extern void PrintHostInfo();
-extern void ShowOptions();
 extern void FreeHostInfoPtr();
 extern FILE *OpenFile();
-extern char *res_skip();
 extern int pickString(const char *, char *, size_t);
-extern int GetHostInfoByName();
+extern int GetHostInfoByName(struct in_addr *, int, int, const char *,
+			     HostInfo *, Boolean);
 extern int GetHostInfoByAddr();
-extern int GetHostDomain();
+extern int GetHostDomain(struct in_addr *, int, int, const char *, char *,
+		         HostInfo *, Boolean);
 extern int matchString(const char *, const char *);
 extern int StringToType(char *, int, FILE *);
 extern int StringToClass(char *, int, FILE *);
@@ -208,3 +207,17 @@ void ListHost_close(void);
 int SetOption(char *);
 int LookupHost(char *, Boolean);
 int LookupHostWithServer(char *, Boolean);
+const char * DecodeType(int);
+const char * DecodeError(int);
+FILE * OpenFile(char *, char *, size_t);
+void  PrintHostInfo(FILE *, const char *, HostInfo *);
+char * Calloc(int, int);
+char * Malloc(int);
+SIG_FN IntrHandler(int);
+int ListSubr(int, char *, char *);
+void FreeHostInfoPtr(HostInfo *);
+unsigned char * res_skip(unsigned char *, int, unsigned char *);
+extern Boolean IsAddr(const char *, struct in_addr *);
+void PrintHelp(void);
+int GetHostInfoByAddr(struct in_addr *, struct in_addr *, HostInfo *);
+
diff --git a/contrib/bind/bin/nslookup/send.c b/contrib/bind/bin/nslookup/send.c
index 6af8873..ecbd75d 100644
--- a/contrib/bind/bin/nslookup/send.c
+++ b/contrib/bind/bin/nslookup/send.c
@@ -53,7 +53,7 @@
 
 #ifndef lint
 static const char sccsid[] = "@(#)send.c	5.18 (Berkeley) 3/2/91";
-static const char rcsid[] = "$Id: send.c,v 8.10 2000/12/23 08:14:47 vixie Exp $";
+static const char rcsid[] = "$Id: send.c,v 8.12 2001/07/03 06:27:12 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -123,14 +123,15 @@ int
 SendRequest(struct in_addr *nsAddrPtr, const u_char *buf, int buflen,
 	    u_char *answer, u_int anslen, int *trueLenPtr)
 {
-	int n, try, v_circuit, resplen, salen;
+	int n, try, v_circuit, resplen;
+	ISC_SOCKLEN_T salen;
 	int gotsomewhere = 0, connected = 0;
 	int connreset = 0;
 	u_short id, len;
 	u_char *cp;
 	fd_set dsmask;
 	struct timeval timeout;
-	const HEADER *hp = (HEADER *) buf;
+	const HEADER *hp = (const HEADER *) buf;
 	HEADER *anhp = (HEADER *) answer;
 	struct iovec iov[2];
 	int terrno = ETIMEDOUT;
@@ -183,7 +184,7 @@ SendRequest(struct in_addr *nsAddrPtr, const u_char *buf, int buflen,
 			__putshort(buflen, (u_char *)&len);
 			iov[0].iov_base = (caddr_t)&len;
 			iov[0].iov_len = INT16SZ;
-			iov[1].iov_base = (caddr_t)buf;
+			DE_CONST(buf, iov[1].iov_base);
 			iov[1].iov_len = buflen;
 			if (writev(s, iov, 2) != INT16SZ + buflen) {
 				terrno = errno;
@@ -224,7 +225,7 @@ SendRequest(struct in_addr *nsAddrPtr, const u_char *buf, int buflen,
 				continue;
 			}
 			cp = answer;
-			if ((resplen = ns_get16((u_char*)cp)) > anslen) {
+			if ((resplen = ns_get16((u_char*)cp)) > (int)anslen) {
 				if (res.options & RES_DEBUG)
 					fprintf(stderr, "response truncated\n");
 				len = anslen;
diff --git a/contrib/bind/bin/nslookup/skip.c b/contrib/bind/bin/nslookup/skip.c
index 5318ef6..4077523 100644
--- a/contrib/bind/bin/nslookup/skip.c
+++ b/contrib/bind/bin/nslookup/skip.c
@@ -53,7 +53,7 @@
 
 #ifndef lint
 static const char sccsid[] = "@(#)skip.c	5.12 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: skip.c,v 8.5 1999/10/13 16:39:20 vixie Exp $";
+static const char rcsid[] = "$Id: skip.c,v 8.7 2001/06/20 12:30:35 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -84,8 +84,9 @@ static const char rcsid[] = "$Id: skip.c,v 8.5 1999/10/13 16:39:20 vixie Exp $";
 #include <stdio.h>
 
 #include "port_after.h"
+#include "res.h"
 
-char *res_skip_rr();
+static unsigned char *res_skip_rr(unsigned char *cp, unsigned char *eom);
 
 
 /*
@@ -109,13 +110,13 @@ char *res_skip_rr();
  *******************************************************************************
  */
 
-char *
+unsigned char *
 res_skip(msg, numFieldsToSkip, eom)
-	char *msg;
+	unsigned char *msg;
 	int numFieldsToSkip;
-	char *eom;
+	unsigned char *eom;
 {
-	register char *cp;
+	register unsigned char *cp;
 	register HEADER *hp;
 	register int tmp;
 	register int n;
@@ -132,7 +133,7 @@ res_skip(msg, numFieldsToSkip, eom)
 	n = ntohs(hp->qdcount);
 	if (n > 0) {
 		while (--n >= 0 && cp < eom) {
-			tmp = dn_skipname((u_char *)cp, (u_char *)eom);
+			tmp = dn_skipname(cp, eom);
 			if (tmp == -1) return(NULL);
 			cp += tmp;
 			cp += INT16SZ;	/* type 	*/
@@ -193,15 +194,15 @@ res_skip(msg, numFieldsToSkip, eom)
  *******************************************************************************
  */
 
-char *
+static unsigned char *
 res_skip_rr(cp, eom)
-	char *cp;
-	char *eom;
+	unsigned char *cp;
+	unsigned char *eom;
 {
 	int tmp;
 	int dlen;
 
-	if ((tmp = dn_skipname((u_char *)cp, (u_char *)eom)) == -1)
+	if ((tmp = dn_skipname(cp, eom)) == -1)
 		return (NULL);			/* compression error */
 	cp += tmp;
 	if ((cp + RRFIXEDSZ) > eom)
@@ -209,7 +210,7 @@ res_skip_rr(cp, eom)
 	cp += INT16SZ;	/* 	type 	*/
 	cp += INT16SZ;	/* 	class 	*/
 	cp += INT32SZ;	/* 	ttl 	*/
-	dlen = ns_get16((u_char*)cp);
+	dlen = ns_get16(cp);
 	cp += INT16SZ;	/* 	dlen 	*/
 	cp += dlen;
 	if (cp > eom)
diff --git a/contrib/bind/bin/nslookup/subr.c b/contrib/bind/bin/nslookup/subr.c
index 44708b3..854e090 100644
--- a/contrib/bind/bin/nslookup/subr.c
+++ b/contrib/bind/bin/nslookup/subr.c
@@ -53,7 +53,7 @@
 
 #ifndef lint
 static const char sccsid[] = "@(#)subr.c	5.24 (Berkeley) 3/2/91";
-static const char rcsid[] = "$Id: subr.c,v 8.14 2000/12/23 08:14:48 vixie Exp $";
+static const char rcsid[] = "$Id: subr.c,v 8.15 2001/06/18 14:43:45 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -120,7 +120,7 @@ static const char rcsid[] = "$Id: subr.c,v 8.14 2000/12/23 08:14:48 vixie Exp $"
  */
 
 SIG_FN
-IntrHandler()
+IntrHandler(int sig)
 {
     extern jmp_buf env;
 #if defined(BSD) && BSD >= 199006 && !defined(RISCOS_BSD) && !defined(__osf__)
@@ -129,6 +129,8 @@ IntrHandler()
 #endif
     extern void ListHost_close(void);
 
+    UNUSED(sig);
+
     SendRequest_close();
     ListHost_close();
     if (filePtr != NULL && filePtr != stdout) {
@@ -233,7 +235,7 @@ Calloc(num, size)
 void
 PrintHostInfo(file, title, hp)
 	FILE	*file;
-	char	*title;
+	const char	*title;
 	register HostInfo *hp;
 {
 	register char		**cp;
@@ -387,21 +389,21 @@ OpenFile(string, file, size)
  */
 
 const struct res_sym error_syms[] = {
-	{ NOERROR,	"Success" },
-	{ FORMERR,	"Format error" },
-	{ SERVFAIL,	"Server failed" },
-	{ NXDOMAIN,	"Non-existent host/domain" },
-	{ NOTIMP,	"Not implemented" },
-	{ REFUSED,	"Query refused" },
+	{ NOERROR,	"Success", NULL },
+	{ FORMERR,	"Format error", NULL },
+	{ SERVFAIL,	"Server failed", NULL },
+	{ NXDOMAIN,	"Non-existent host/domain", NULL },
+	{ NOTIMP,	"Not implemented", NULL },
+	{ REFUSED,	"Query refused", NULL },
 #ifdef NOCHANGE
-	{ NOCHANGE,	"No change" },
+	{ NOCHANGE,	"No change", NULL },
 #endif
-	{ TIME_OUT,	"Timed out" },
-	{ NO_INFO,	"No information" },
-	{ ERROR,	"Unspecified error" },
-	{ NONAUTH,	"Non-authoritative answer" },
-	{ NO_RESPONSE,	"No response from server" },
-	{ 0,		NULL }
+	{ TIME_OUT,	"Timed out", NULL },
+	{ NO_INFO,	"No information", NULL },
+	{ ERROR,	"Unspecified error", NULL },
+	{ NONAUTH,	"Non-authoritative answer", NULL },
+	{ NO_RESPONSE,	"No response from server", NULL },
+	{ 0,		NULL, NULL }
 };
 
 const char *
diff --git a/contrib/bind/bin/nsupdate/nsupdate.c b/contrib/bind/bin/nsupdate/nsupdate.c
index 3363654..c8e8ce8 100644
--- a/contrib/bind/bin/nsupdate/nsupdate.c
+++ b/contrib/bind/bin/nsupdate/nsupdate.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: nsupdate.c,v 8.26 2000/12/23 08:14:48 vixie Exp $";
+static const char rcsid[] = "$Id: nsupdate.c,v 8.27 2001/06/18 14:43:46 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -390,7 +390,7 @@ main(int argc, char **argv) {
 		    exit (1);
 		}
 		r_dname = dnbuf;
-		r_ttl = (r_opcode == ADD) ? -1 : 0;
+		r_ttl = (r_opcode == ADD) ? (~0U) : 0;
 		r_type = -1;
 		r_class = C_IN; /* default to IN */
 		r_size = 0;
@@ -493,7 +493,7 @@ main(int argc, char **argv) {
 			r_size = endp - cp + 1;
 			break;
 		    case ADD:
-			if (r_ttl == -1) {
+			if (r_ttl == ~0U) {
 			    fprintf (stderr,
 		"ttl must be specified for record to be added: %s\n", buf);
 			    exit (1);