Vendor import of BIND 9.4.1

801 files changed, 39127 insertions, 18339 deletions

diff --git a/contrib/bind9/lib/Makefile.in b/contrib/bind9/lib/Makefile.in
index c72b3e7..e8be294 100644
--- a/contrib/bind9/lib/Makefile.in
+++ b/contrib/bind9/lib/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.15.2.2.8.4 2004/03/08 09:04:25 marka Exp $
+# $Id: Makefile.in,v 1.19 2004/03/05 05:05:00 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/bind/Makefile.in b/contrib/bind9/lib/bind/Makefile.in
index 61424e7..fd9a16f 100644
--- a/contrib/bind9/lib/bind/Makefile.in
+++ b/contrib/bind9/lib/bind/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.12.2.5.2.11 2006/06/24 00:25:38 marka Exp $
+# $Id: Makefile.in,v 1.22.18.7 2006/06/24 00:25:39 marka Exp $
 
 srcdir =        @srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/api b/contrib/bind9/lib/bind/api
index 8632b12..8701441 100644
--- a/contrib/bind9/lib/bind/api
+++ b/contrib/bind9/lib/bind/api
@@ -1,3 +1,3 @@
 LIBINTERFACE = 4
-LIBREVISION = 7
+LIBREVISION = 6
 LIBAGE = 0
diff --git a/contrib/bind9/lib/bind/bsd/Makefile.in b/contrib/bind9/lib/bind/bsd/Makefile.in
index dd7b616..cf70c10 100644
--- a/contrib/bind9/lib/bind/bsd/Makefile.in
+++ b/contrib/bind9/lib/bind/bsd/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6.206.1 2004/03/06 08:13:22 marka Exp $
+# $Id: Makefile.in,v 1.7 2004/03/05 05:05:07 marka Exp $
 
 srcdir=         @srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/bsd/daemon.c b/contrib/bind9/lib/bind/bsd/daemon.c
index a1472f9..a7d2ded 100644
--- a/contrib/bind9/lib/bind/bsd/daemon.c
+++ b/contrib/bind9/lib/bind/bsd/daemon.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)daemon.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: daemon.c,v 1.1 2001/03/29 06:30:31 marka Exp $";
+static const char rcsid[] = "$Id: daemon.c,v 1.1.352.1 2005/04/27 05:00:42 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -77,3 +77,5 @@ daemon(int nochdir, int noclose) {
 	return (0);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/ftruncate.c b/contrib/bind9/lib/bind/bsd/ftruncate.c
index 56ce8d3..b222c8b 100644
--- a/contrib/bind9/lib/bind/bsd/ftruncate.c
+++ b/contrib/bind9/lib/bind/bsd/ftruncate.c
@@ -1,8 +1,9 @@
 #ifndef LINT
-static const char rcsid[] = "$Id: ftruncate.c,v 1.1 2001/03/29 06:30:32 marka Exp $";
+static const char rcsid[] = "$Id: ftruncate.c,v 1.1.352.3 2005/06/22 22:05:45 marka Exp $";
 #endif
 
-/*
+/*! \file
+ * \brief
  * ftruncate - set file size, BSD Style
  *
  * shortens or enlarges the file as neeeded
diff --git a/contrib/bind9/lib/bind/bsd/gettimeofday.c b/contrib/bind9/lib/bind/bsd/gettimeofday.c
index ffde020..0c88e00 100644
--- a/contrib/bind9/lib/bind/bsd/gettimeofday.c
+++ b/contrib/bind9/lib/bind/bsd/gettimeofday.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Id: gettimeofday.c,v 1.1.2.2 2002/07/12 00:49:51 marka Exp $";
+static const char rcsid[] = "$Id: gettimeofday.c,v 1.3.332.1 2005/04/27 05:00:43 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -9,7 +9,7 @@ static const char rcsid[] = "$Id: gettimeofday.c,v 1.1.2.2 2002/07/12 00:49:51 m
 #include "port_after.h"
 
 #if !defined(NEED_GETTIMEOFDAY)
-/*
+/*%
  * gettimeofday() occasionally returns invalid tv_usec on some platforms.
  */
 #define MILLION 1000000
@@ -60,3 +60,5 @@ gettimeofday(struct timeval *tvp, struct _TIMEZONE *tzp) {
 	return (0);
 }
 #endif /*NEED_GETTIMEOFDAY*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/mktemp.c b/contrib/bind9/lib/bind/bsd/mktemp.c
index 9852a35..f201c2d 100644
--- a/contrib/bind9/lib/bind/bsd/mktemp.c
+++ b/contrib/bind9/lib/bind/bsd/mktemp.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)mktemp.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: mktemp.c,v 1.1 2001/03/29 06:30:33 marka Exp $";
+static const char rcsid[] = "$Id: mktemp.c,v 1.1.352.1 2005/04/27 05:00:43 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -96,7 +96,7 @@ gettemp(char *path, int *doopen) {
 	u_int pid;
 
 	pid = getpid();
-	for (trv = path; *trv; ++trv);		/* extra X's get set to 0's */
+	for (trv = path; *trv; ++trv);		/*%< extra X's get set to 0's */
 	while (*--trv == 'X') {
 		*trv = (pid % 10) + '0';
 		pid /= 10;
@@ -152,3 +152,5 @@ gettemp(char *path, int *doopen) {
 }
 
 #endif /*NEED_MKTEMP*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/putenv.c b/contrib/bind9/lib/bind/bsd/putenv.c
index abaa525..dca02c10 100644
--- a/contrib/bind9/lib/bind/bsd/putenv.c
+++ b/contrib/bind9/lib/bind/bsd/putenv.c
@@ -1,11 +1,11 @@
 #ifndef LINT
-static const char rcsid[] = "$Id: putenv.c,v 1.1 2001/03/29 06:30:33 marka Exp $";
+static const char rcsid[] = "$Id: putenv.c,v 1.1.352.1 2005/04/27 05:00:43 sra Exp $";
 #endif
 
 #include "port_before.h"
 #include "port_after.h"
 
-/*
+/*%
  * To give a little credit to Sun, SGI,
  * and many vendors in the SysV world.
  */
@@ -23,3 +23,5 @@ putenv(char *str) {
 	return (setenv(str, tmp, 1));
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/readv.c b/contrib/bind9/lib/bind/bsd/readv.c
index ccfcb5a..eb13bcc 100644
--- a/contrib/bind9/lib/bind/bsd/readv.c
+++ b/contrib/bind9/lib/bind/bsd/readv.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Id: readv.c,v 1.1 2001/03/29 06:30:35 marka Exp $";
+static const char rcsid[] = "$Id: readv.c,v 1.1.352.1 2005/04/27 05:00:43 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -36,3 +36,4 @@ __readv(fd, vp, vpcount)
 	return (count);
 }
 #endif /* NEED_READV */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/setenv.c b/contrib/bind9/lib/bind/bsd/setenv.c
index 6a11c9d..ce2f063 100644
--- a/contrib/bind9/lib/bind/bsd/setenv.c
+++ b/contrib/bind9/lib/bind/bsd/setenv.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)setenv.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: setenv.c,v 1.1 2001/03/29 06:30:35 marka Exp $";
+static const char rcsid[] = "$Id: setenv.c,v 1.1.352.1 2005/04/27 05:00:44 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -52,40 +52,40 @@ extern char **environ;
 
 static char *findenv(const char *name, int *offset);
 
-/*
+/*%
  * setenv --
  *	Set the value of the environmental variable "name" to be
  *	"value".  If rewrite is set, replace any current value.
  */
 setenv(const char *name, const char *value, int rewrite) {
 	extern char **environ;
-	static int alloced;			/* if allocated space before */
+	static int alloced;			/*%< if allocated space before */
 	char *c;
 	int l_value, offset;
 
-	if (*value == '=')			/* no `=' in value */
+	if (*value == '=')			/*%< no `=' in value */
 		++value;
 	l_value = strlen(value);
-	if ((c = findenv(name, &offset))) {	/* find if already exists */
+	if ((c = findenv(name, &offset))) {	/*%< find if already exists */
 		if (!rewrite)
 			return (0);
-		if (strlen(c) >= l_value) {	/* old larger; copy over */
+		if (strlen(c) >= l_value) {	/*%< old larger; copy over */
 			while (*c++ = *value++);
 			return (0);
 		}
-	} else {					/* create new slot */
+	} else {					/*%< create new slot */
 		int cnt;
 		char **p;
 
 		for (p = environ, cnt = 0; *p; ++p, ++cnt);
-		if (alloced) {			/* just increase size */
+		if (alloced) {			/*%< just increase size */
 			environ = (char **)realloc((char *)environ,
 			    (size_t)(sizeof(char *) * (cnt + 2)));
 			if (!environ)
 				return (-1);
 		}
-		else {				/* get new space */
-			alloced = 1;		/* copy old entries into it */
+		else {				/*%< get new space */
+			alloced = 1;		/*%< copy old entries into it */
 			p = malloc((size_t)(sizeof(char *) * (cnt + 2)));
 			if (!p)
 				return (-1);
@@ -95,8 +95,8 @@ setenv(const char *name, const char *value, int rewrite) {
 		environ[cnt + 1] = NULL;
 		offset = cnt;
 	}
-	for (c = (char *)name; *c && *c != '='; ++c);	/* no `=' in name */
-	if (!(environ[offset] =			/* name + `=' + value */
+	for (c = (char *)name; *c && *c != '='; ++c);	/*%< no `=' in name */
+	if (!(environ[offset] =			/*%< name + `=' + value */
 	    malloc((size_t)((int)(c - name) + l_value + 2))))
 		return (-1);
 	for (c = environ[offset]; (*c = *name++) && *c != '='; ++c);
@@ -104,7 +104,7 @@ setenv(const char *name, const char *value, int rewrite) {
 	return (0);
 }
 
-/*
+/*%
  * unsetenv(name) --
  *	Delete environmental variable "name".
  */
@@ -113,13 +113,13 @@ unsetenv(const char *name) {
 	char **p;
 	int offset;
 
-	while (findenv(name, &offset))	/* if set multiple times */
+	while (findenv(name, &offset))	/*%< if set multiple times */
 		for (p = &environ[offset];; ++p)
 			if (!(*p = *(p + 1)))
 				break;
 }
 
-/*
+/*%
  * findenv --
  *	Returns pointer to value associated with name, if any, else NULL.
  *	Sets offset to be the offset of the name/value combination in the
@@ -147,3 +147,5 @@ findenv(const char *name, int *offset) {
 	return (NULL);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/setitimer.c b/contrib/bind9/lib/bind/bsd/setitimer.c
index 791846a..2d5a4e4 100644
--- a/contrib/bind9/lib/bind/bsd/setitimer.c
+++ b/contrib/bind9/lib/bind/bsd/setitimer.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Id: setitimer.c,v 1.1 2001/03/29 06:30:35 marka Exp $";
+static const char rcsid[] = "$Id: setitimer.c,v 1.1.352.1 2005/04/27 05:00:44 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -8,7 +8,7 @@ static const char rcsid[] = "$Id: setitimer.c,v 1.1 2001/03/29 06:30:35 marka Ex
 
 #include "port_after.h"
 
-/*
+/*%
  * Setitimer emulation routine.
  */
 #ifndef NEED_SETITIMER
@@ -25,3 +25,5 @@ __setitimer(int which, const struct itimerval *value,
 		return (-1);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/strcasecmp.c b/contrib/bind9/lib/bind/bsd/strcasecmp.c
index c8c9d05..fd76837 100644
--- a/contrib/bind9/lib/bind/bsd/strcasecmp.c
+++ b/contrib/bind9/lib/bind/bsd/strcasecmp.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strcasecmp.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strcasecmp.c,v 1.1 2001/03/29 06:30:35 marka Exp $";
+static const char rcsid[] = "$Id: strcasecmp.c,v 1.1.352.1 2005/04/27 05:00:45 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -50,7 +50,7 @@ static const char rcsid[] = "$Id: strcasecmp.c,v 1.1 2001/03/29 06:30:35 marka E
 int __strcasecmp_unneeded__;
 #else
 
-/*
+/*%
  * This array is designed for mapping upper and lower case letter
  * together for a case independent comparison.  The mappings are
  * based upon ascii character sequences.
@@ -120,3 +120,5 @@ strncasecmp(const char *s1, const char *s2, size_t n) {
 }
 
 #endif /*NEED_STRCASECMP*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/strdup.c b/contrib/bind9/lib/bind/bsd/strdup.c
index 246bc1f..a8d31e9 100644
--- a/contrib/bind9/lib/bind/bsd/strdup.c
+++ b/contrib/bind9/lib/bind/bsd/strdup.c
@@ -16,3 +16,5 @@ strdup(const char *src) {
 	return (dst);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/strerror.c b/contrib/bind9/lib/bind/bsd/strerror.c
index d13adbb..5743398 100644
--- a/contrib/bind9/lib/bind/bsd/strerror.c
+++ b/contrib/bind9/lib/bind/bsd/strerror.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strerror.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strerror.c,v 1.3.2.1 2001/11/02 17:45:31 gson Exp $";
+static const char rcsid[] = "$Id: strerror.c,v 1.4.332.1 2005/04/27 05:00:46 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -57,19 +57,19 @@ extern char *sys_errlist[];
 const char *
 isc_strerror(int num) {
 #define	UPREFIX	"Unknown error: "
-	static char ebuf[40] = UPREFIX;		/* 64-bit number + slop */
+	static char ebuf[40] = UPREFIX;		/*%< 64-bit number + slop */
 	u_int errnum;
 	char *p, *t;
 	const char *ret;
 	char tmp[40];
 
-	errnum = num;				/* convert to unsigned */
+	errnum = num;				/*%< convert to unsigned */
 #ifdef USE_SYSERROR_LIST
 	if (errnum < sys_nerr)
 		return (sys_errlist[errnum]);
 #else
 #undef strerror
-	ret = strerror(num);			/* call strerror() in libc */
+	ret = strerror(num);			/*%< call strerror() in libc */
 	if (ret != NULL)
 		return(ret);
 #endif
@@ -88,3 +88,5 @@ isc_strerror(int num) {
 }
 
 #endif /*NEED_STRERROR*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/strpbrk.c b/contrib/bind9/lib/bind/bsd/strpbrk.c
index ff039e1..4502572 100644
--- a/contrib/bind9/lib/bind/bsd/strpbrk.c
+++ b/contrib/bind9/lib/bind/bsd/strpbrk.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strpbrk.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strpbrk.c,v 1.1 2001/03/29 06:30:36 marka Exp $";
+static const char rcsid[] = "$Id: strpbrk.c,v 1.1.352.1 2005/04/27 05:00:46 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -49,7 +49,7 @@ static const char rcsid[] = "$Id: strpbrk.c,v 1.1 2001/03/29 06:30:36 marka Exp
 int __strpbrk_unneeded__;
 #else
 
-/*
+/*%
  * Find the first occurrence in s1 of a character in s2 (excluding NUL).
  */
 char *
@@ -66,3 +66,5 @@ strpbrk(const char *s1, const char *s2) {
 }
 
 #endif /*NEED_STRPBRK*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/strsep.c b/contrib/bind9/lib/bind/bsd/strsep.c
index 3dcee4a..1214f80 100644
--- a/contrib/bind9/lib/bind/bsd/strsep.c
+++ b/contrib/bind9/lib/bind/bsd/strsep.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "strsep.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strsep.c,v 1.1 2001/03/29 06:30:36 marka Exp $";
+static const char rcsid[] = "$Id: strsep.c,v 1.1.352.1 2005/04/27 05:00:47 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -46,7 +46,7 @@ static const char rcsid[] = "$Id: strsep.c,v 1.1 2001/03/29 06:30:36 marka Exp $
 int __strsep_unneeded__;
 #else
 
-/*
+/*%
  * Get next token from string *stringp, where tokens are possibly-empty
  * strings separated by characters from delim.  
  *
@@ -84,3 +84,5 @@ strsep(char **stringp, const char *delim) {
 }
 
 #endif /*NEED_STRSEP*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/strtoul.c b/contrib/bind9/lib/bind/bsd/strtoul.c
index d110f30..f419227 100644
--- a/contrib/bind9/lib/bind/bsd/strtoul.c
+++ b/contrib/bind9/lib/bind/bsd/strtoul.c
@@ -1,6 +1,6 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)strtoul.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: strtoul.c,v 1.1.2.1 2003/06/27 03:51:35 marka Exp $";
+static const char rcsid[] = "$Id: strtoul.c,v 1.2.164.1 2005/04/27 05:00:47 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -52,7 +52,7 @@ static const char rcsid[] = "$Id: strtoul.c,v 1.1.2.1 2003/06/27 03:51:35 marka
 int __strtoul_unneeded__;
 #else
 
-/*
+/*%
  * Convert a string to an unsigned long integer.
  *
  * Ignores `locale' stuff.  Assumes that the upper and lower case
@@ -115,3 +115,5 @@ strtoul(const char *nptr, char **endptr, int base) {
 }
 
 #endif /*NEED_STRTOUL*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/utimes.c b/contrib/bind9/lib/bind/bsd/utimes.c
index 6a288f4..2f65cff 100644
--- a/contrib/bind9/lib/bind/bsd/utimes.c
+++ b/contrib/bind9/lib/bind/bsd/utimes.c
@@ -37,3 +37,4 @@ __utimes(char *filename, struct timeval *tvp) {
 }
 
 #endif /* NEED_UTIMES */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/bsd/writev.c b/contrib/bind9/lib/bind/bsd/writev.c
index fe204a9..0e81c26 100644
--- a/contrib/bind9/lib/bind/bsd/writev.c
+++ b/contrib/bind9/lib/bind/bsd/writev.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Id: writev.c,v 1.1.2.1 2003/06/27 03:51:35 marka Exp $";
+static const char rcsid[] = "$Id: writev.c,v 1.2.164.1 2005/04/27 05:00:47 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -85,3 +85,5 @@ __writev(fd, vp, vpcount)
 #endif /*_CRAY*/
 
 #endif /*NEED_WRITEV*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/configure b/contrib/bind9/lib/bind/configure
index 1fba616..d6171dc 100755
--- a/contrib/bind9/lib/bind/configure
+++ b/contrib/bind9/lib/bind/configure
@@ -1,5 +1,5 @@
 #! /bin/sh
-# From configure.in Revision: 1.83.2.5.2.31 .
+# From configure.in Revision: 1.90.18.29 .
 # Guess values for system-dependent variables and create Makefiles.
 # Generated by GNU Autoconf 2.59.
 #
diff --git a/contrib/bind9/lib/bind/configure.in b/contrib/bind9/lib/bind/configure.in
index 9c2877c..3431818 100644
--- a/contrib/bind9/lib/bind/configure.in
+++ b/contrib/bind9/lib/bind/configure.in
@@ -1,5 +1,5 @@
-# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
-# Copyright (C) 2001  Internet Software Consortium.
+# Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-AC_REVISION($Revision: 1.83.2.5.2.31 $)
+AC_REVISION($Revision: 1.90.18.31 $)
 
 AC_INIT(resolv/herror.c)
 AC_PREREQ(2.13)
diff --git a/contrib/bind9/lib/bind/dst/Makefile.in b/contrib/bind9/lib/bind/dst/Makefile.in
index 8b30659..c802840 100644
--- a/contrib/bind9/lib/bind/dst/Makefile.in
+++ b/contrib/bind9/lib/bind/dst/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.5.206.1 2004/03/06 08:13:22 marka Exp $
+# $Id: Makefile.in,v 1.6 2004/03/05 05:05:09 marka Exp $
  
 srcdir=		@srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/dst/dst_api.c b/contrib/bind9/lib/bind/dst/dst_api.c
index 417c31f..bc730dc 100644
--- a/contrib/bind9/lib/bind/dst/dst_api.c
+++ b/contrib/bind9/lib/bind/dst/dst_api.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.4.2.6.8.4 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/dst_api.c,v 1.10.332.5 2006/03/10 00:20:08 marka Exp $";
 #endif
 
 /*
@@ -78,7 +78,7 @@ static DST_KEY *dst_s_get_key_struct(const char *name, const int alg,
 				     const int flags, const int protocol,
 				     const int bits);
 
-/*
+/*%
  *  dst_init
  *	This function initializes the Digital Signature Toolkit.
  *	Right now, it just checks the DSTKEYPATH environment variable.
@@ -124,7 +124,7 @@ dst_init()
 	dst_hmac_md5_init();
 }
 
-/*
+/*%
  *  dst_check_algorithm
  *	This function determines if the crypto system for the specified
  *	algorithm is present.
@@ -143,7 +143,7 @@ dst_check_algorithm(const int alg)
 	return (dst_t_func[alg] != NULL);
 }
 
-/* 
+/*%
  * dst_s_get_key_struct 
  *	This function allocates key structure and fills in some of the 
  *	fields of the structure. 
@@ -163,7 +163,7 @@ dst_s_get_key_struct(const char *name, const int alg, const int flags,
 {
 	DST_KEY *new_key = NULL; 
 
-	if (dst_check_algorithm(alg)) /* make sure alg is available */
+	if (dst_check_algorithm(alg)) /*%< make sure alg is available */
 		new_key = (DST_KEY *) malloc(sizeof(*new_key));
 	if (new_key == NULL)
 		return (NULL);
@@ -183,7 +183,7 @@ dst_s_get_key_struct(const char *name, const int alg, const int flags,
 	return (new_key);
 }
 
-/*
+/*%
  *  dst_compare_keys
  *	Compares two keys for equality.
  *  Parameters
@@ -209,8 +209,7 @@ dst_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
 	return (key1->dk_func->compare(key1, key2));
 }
 
-
-/*
+/*%
  * dst_sign_data
  *	An incremental signing function.  Data is signed in steps.
  *	First the context must be initialized (SIG_MODE_INIT).
@@ -236,8 +235,8 @@ dst_compare_keys(const DST_KEY *key1, const DST_KEY *key2)
  *	sig_len Length of the signature field in bytes.
  * Return
  *	 0      Successfull INIT or Update operation
- *	>0      success FINAL (sign) operation
- *	<0      failure
+ *	&gt;0      success FINAL (sign) operation
+ *	&lt;0      failure
  */
 
 int
@@ -257,8 +256,7 @@ dst_sign_data(const int mode, DST_KEY *in_key, void **context,
 	return (UNKNOWN_KEYALG);
 }
 
-
-/*
+/*%
  *  dst_verify_data
  *	An incremental verify function.  Data is verified in steps.
  *	First the context must be initialized (SIG_MODE_INIT).
@@ -300,8 +298,7 @@ dst_verify_data(const int mode, DST_KEY *in_key, void **context,
 					signature, sig_len));
 }
 
-
-/*
+/*%
  *  dst_read_private_key
  *	Access a private key.  First the list of private keys that have
  *	already been read in is searched, then the key accessed on disk.
@@ -330,7 +327,7 @@ dst_read_key(const char *in_keyname, const u_int16_t in_id,
 	char keyname[PATH_MAX];
 	DST_KEY *dg_key = NULL, *pubkey = NULL;
 
-	if (!dst_check_algorithm(in_alg)) { /* make sure alg is available */
+	if (!dst_check_algorithm(in_alg)) { /*%< make sure alg is available */
 		EREPORT(("dst_read_private_key(): Algorithm %d not suppored\n",
 			 in_alg));
 		return (NULL);
@@ -373,7 +370,7 @@ dst_write_key(const DST_KEY *key, const int type)
 
 	if (key == NULL) 
 		return (0);
-	if (!dst_check_algorithm(key->dk_alg)) { /* make sure alg is available */
+	if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
 		EREPORT(("dst_write_key(): Algorithm %d not suppored\n", 
 			 key->dk_alg));
 		return (UNSUPPORTED_KEYALG);
@@ -390,19 +387,19 @@ dst_write_key(const DST_KEY *key, const int type)
 	return (priv+pub);
 }
 
-/*
+/*%
  *  dst_write_private_key
  *	Write a private key to disk.  The filename will be of the form:
- *	K<key->dk_name>+<key->dk_alg>+<key->dk_id>.<private key suffix>.
+ *	K&lt;key-&gt;dk_name&gt;+&lt;key-&gt;dk_alg+&gt;&lt;key-d&gt;k_id.&gt;&lt;private key suffix&gt;.
  *	If there is already a file with this name, an error is returned.
  *
  *  Parameters
  *	key     A DST managed key structure that contains
  *	      all information needed about a key.
  *  Return
- *	>= 0    Correct behavior.  Returns length of encoded key value
+ *	&gt;= 0    Correct behavior.  Returns length of encoded key value
  *		  written to disk.
- *	<  0    error.
+ *	&lt;  0    error.
  */
 
 static int
@@ -417,8 +414,7 @@ dst_s_write_private_key(const DST_KEY *key)
 	if (key == NULL)
 		return (-1);
 	if (key->dk_KEY_struct == NULL)
-		return (0);	/* null key has no private key */
-
+		return (0);	/*%< null key has no private key */
 	if (key->dk_func == NULL || key->dk_func->to_file_fmt == NULL) {
 		EREPORT(("dst_write_private_key(): Unsupported operation %d\n",
 			 key->dk_alg));
@@ -450,12 +446,12 @@ dst_s_write_private_key(const DST_KEY *key)
 	return (len);
 }
 
-/*
+/*%
 *
  *  dst_read_public_key
  *	Read a public key from disk and store in a DST key structure.
  *  Parameters
- *	in_name	 K<in_name><in_id>.<public key suffix> is the
+ *	in_name	 K&lt;in_name&gt;&lt;in_id&gt;.&lt;public key suffix&gt; is the
  *		      filename of the key file to be read.
  *  Returns
  *	NULL	    If the key does not exist or no name is supplied.
@@ -484,7 +480,7 @@ dst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
 	/*
 	 * Open the file and read it's formatted contents up to key
 	 * File format:
-	 *    domain.name [ttl] [IN] KEY  <flags> <protocol> <algorithm> <key>
+	 *    domain.name [ttl] [IN] KEY  &lt;flags&gt; &lt;protocol&gt; &lt;algorithm&gt; &lt;key&gt;
 	 * flags, proto, alg stored as decimal (or hex numbers FIXME).
 	 * (FIXME: handle parentheses for line continuation.)
 	 */
@@ -531,7 +527,7 @@ dst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
 	while ((c = getc(fp)) != EOF)
 		if (!isspace(c))
 			break;
-	ungetc(c, fp);		/* return the charcter to the input field */
+	ungetc(c, fp);		/*%< return the charcter to the input field */
 	/* Handle hex!! FIXME.  */
 
 	if (fscanf(fp, "%d %d %d", &flags, &proto, &alg) != 3) {
@@ -574,8 +570,7 @@ dst_s_read_public_key(const char *in_name, const u_int16_t in_id, int in_alg)
 	return dst_buffer_to_key(in_name, alg, flags, proto, deckey, dlen);
 }
 
-
-/*
+/*%
  *  dst_write_public_key
  *	Write a key to disk in DNS format.
  *  Parameters
@@ -629,8 +624,7 @@ dst_s_write_public_key(const DST_KEY *key)
 	return (1);
 }
 
-
-/*
+/*%
  *  dst_dnskey_to_public_key
  *	This function converts the contents of a DNS KEY RR into a DST
  *	key structure.
@@ -651,10 +645,10 @@ dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
 	int alg ;
 	int start = DST_KEY_START;
 
-	if (rdata == NULL || len <= DST_KEY_ALG) /* no data */
+	if (rdata == NULL || len <= DST_KEY_ALG) /*%< no data */
 		return (NULL);
 	alg = (u_int8_t) rdata[DST_KEY_ALG];
-	if (!dst_check_algorithm(alg)) { /* make sure alg is available */
+	if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
 		EREPORT(("dst_dnskey_to_key(): Algorithm %d not suppored\n",
 			 alg));
 		return (NULL);
@@ -691,8 +685,7 @@ dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
 	return (key_st);
 }
 
-
-/*
+/*%
  *  dst_public_key_to_dnskey
  *	Function to encode a public key into DNS KEY wire format 
  *  Parameters
@@ -714,7 +707,7 @@ dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
 	if (key == NULL)
 		return (-1);
 
-	if (!dst_check_algorithm(key->dk_alg)) { /* make sure alg is available */
+	if (!dst_check_algorithm(key->dk_alg)) { /*%< make sure alg is available */
 		EREPORT(("dst_key_to_dnskey(): Algorithm %d not suppored\n",
 			 key->dk_alg));
 		return (UNSUPPORTED_KEYALG);
@@ -727,7 +720,7 @@ dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
 	out_storage[loc++] = (u_char) key->dk_proto;
 	out_storage[loc++] = (u_char) key->dk_alg;
 
-	if (key->dk_flags > 0xffff) {	/* Extended flags */
+	if (key->dk_flags > 0xffff) {	/*%< Extended flags */
 		val = (u_int16_t)((key->dk_flags >> 16) & 0xffff);
 		dst_s_put_int16(&out_storage[loc], val);
 		loc += 2;
@@ -748,8 +741,7 @@ dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
 	return (-1);
 }
 
-
-/*
+/*%
  *  dst_buffer_to_key
  *	Function to encode a string of raw data into a DST key
  *  Parameters
@@ -761,19 +753,19 @@ dst_key_to_dnskey(const DST_KEY *key, u_char *out_storage,
  *	NON-NULL	the DST key
  */
 DST_KEY *
-dst_buffer_to_key(const char *key_name,		/* name of the key */
-		  const int alg,		/* algorithm */
-		  const int flags,		/* dns flags */
-		  const int protocol,		/* dns protocol */
-		  const u_char *key_buf,	/* key in dns wire fmt */
-		  const int key_len)		/* size of key */
+dst_buffer_to_key(const char *key_name,		/*!< name of the key  */
+		  const int alg,		/*!< algorithm  */
+		  const int flags,		/*!< dns flags  */
+		  const int protocol,		/*!< dns protocol  */
+		  const u_char *key_buf,	/*!< key in dns wire fmt  */
+		  const int key_len)		/*!< size of key  */
 {
 	
 	DST_KEY *dkey = NULL; 
 	int dnslen;
 	u_char dns[2048];
 
-	if (!dst_check_algorithm(alg)) { /* make sure alg is available */
+	if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
 		EREPORT(("dst_buffer_to_key(): Algorithm %d not suppored\n", alg));
 		return (NULL);
 	}
@@ -810,8 +802,7 @@ dst_key_to_buffer(DST_KEY *key, u_char *out_buff, int buf_len)
 	return (0);
 }
 
-
-/*
+/*%
  * dst_s_read_private_key_file
  *     Function reads in private key from a file.
  *     Fills out the KEY structure.
@@ -885,14 +876,14 @@ dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
 				"dst_s_read_private_key_file(): Keyfile %s version higher than mine %d.%d MAY FAIL\n",
 				name, file_major, file_minor));
 
-	while (*p++ != '\n') ;	/* skip to end of line */
+	while (*p++ != '\n') ;	/*%< skip to end of line */
 
 	if (!dst_s_verify_str((const char **) (void *)&p, "Algorithm: "))
 		goto fail;
 
 	if (sscanf((char *)p, "%d", &alg) != 1)
 		goto fail;
-	while (*p++ != '\n') ;	/* skip to end of line */
+	while (*p++ != '\n') ;	/*%< skip to end of line */
 
 	if (pk_key->dk_key_name && !strcmp(pk_key->dk_key_name, name))
 		SAFE_FREE2(pk_key->dk_key_name, strlen(pk_key->dk_key_name));
@@ -925,34 +916,34 @@ dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
 	return (0);
 }
 
-
-/*
- *  dst_generate_key
+/*%
  *	Generate and store a public/private keypair.
  *	Keys will be stored in formatted files.
+ *
  *  Parameters
- *	name    Name of the new key.  Used to create key files
- *		  K<name>+<alg>+<id>.public and K<name>+<alg>+<id>.private.
- *	bits    Size of the new key in bits.
- *	exp     What exponent to use:
- *		  0	   use exponent 3
- *		  non-zero    use Fermant4
- *	flags   The default value of the DNS Key flags.
- *		  The DNS Key RR Flag field is defined in RFC 2065,
+ &
+ *\par	name    Name of the new key.  Used to create key files
+ *\li		  K&lt;name&gt;+&lt;alg&gt;+&lt;id&gt;.public and K&lt;name&gt;+&lt;alg&gt;+&lt;id&gt;.private.
+ *\par	bits    Size of the new key in bits.
+ *\par	exp     What exponent to use:
+ *\li		  0	   use exponent 3
+ *\li		  non-zero    use Fermant4
+ *\par	flags   The default value of the DNS Key flags.
+ *\li		  The DNS Key RR Flag field is defined in RFC2065,
  *		  section 3.3.  The field has 16 bits.
- *	protocol
- *	      Default value of the DNS Key protocol field.
- *		  The DNS Key protocol field is defined in RFC 2065,
+ *\par	protocol
+ *\li	      Default value of the DNS Key protocol field.
+ *\li		  The DNS Key protocol field is defined in RFC2065,
  *		  section 3.4.  The field has 8 bits.
- *	alg     What algorithm to use.  Currently defined:
- *		  KEY_RSA       1
- *		  KEY_DSA       3
- *		  KEY_HMAC    157
- *	out_id The key tag is returned.
+ *\par	alg     What algorithm to use.  Currently defined:
+ *\li		  KEY_RSA       1
+ *\li		  KEY_DSA       3
+ *\li		  KEY_HMAC    157
+ *\par	out_id The key tag is returned.
  *
  *  Return
- *	NULL		Failure
- *	non-NULL 	the generated key pair
+ *\li	NULL		Failure
+ *\li	non-NULL 	the generated key pair
  *			Caller frees the result, and its dk_name pointer.
  */
 DST_KEY *
@@ -966,7 +957,7 @@ dst_generate_key(const char *name, const int bits, const int exp,
 	if (name == NULL)
 		return (NULL);
 
-	if (!dst_check_algorithm(alg)) { /* make sure alg is available */
+	if (!dst_check_algorithm(alg)) { /*%< make sure alg is available */
 		EREPORT(("dst_generate_key(): Algorithm %d not suppored\n", alg));
 		return (NULL);
 	}
@@ -974,7 +965,7 @@ dst_generate_key(const char *name, const int bits, const int exp,
 	new_key = dst_s_get_key_struct(name, alg, flags, protocol, bits);
 	if (new_key == NULL)
 		return (NULL);
-	if (bits == 0) /* null key we are done */
+	if (bits == 0) /*%< null key we are done */
 		return (new_key);
 	if (new_key->dk_func == NULL || new_key->dk_func->generate == NULL) {
 		EREPORT(("dst_generate_key_pair():Unsupported algorithm %d\n",
@@ -997,12 +988,11 @@ dst_generate_key(const char *name, const int bits, const int exp,
 	return (new_key);
 }
 
-
-/*
- *  dst_free_key
+/*%
  *	Release all data structures pointed to by a key structure.
+ *
  *  Parameters
- *	f_key   Key structure to be freed.
+ *\li	f_key   Key structure to be freed.
  */
 
 DST_KEY *
@@ -1028,13 +1018,14 @@ dst_free_key(DST_KEY *f_key)
 	return (NULL);
 }
 
-/*
- * dst_sig_size
+/*%
  *	Return the maximim size of signature from the key specified in bytes
+ *
  * Parameters
- *      key 
+ *\li      key 
+ *
  * Returns
- *     bytes
+ *  \li   bytes
  */
 int
 dst_sig_size(DST_KEY *key) {
@@ -1052,3 +1043,5 @@ dst_sig_size(DST_KEY *key) {
 		return -1;
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/dst/dst_internal.h b/contrib/bind9/lib/bind/dst/dst_internal.h
index 928650a..e9bc6fc 100644
--- a/contrib/bind9/lib/bind/dst/dst_internal.h
+++ b/contrib/bind9/lib/bind/dst/dst_internal.h
@@ -29,19 +29,19 @@
 # ifdef POSIX_PATH_MAX
 #  define PATH_MAX POSIX_PATH_MAX
 # else
-#  define PATH_MAX 255 /* this is the value of POSIX_PATH_MAX */
+#  define PATH_MAX 255 /*%< this is the value of POSIX_PATH_MAX */
 # endif
 #endif 
 
 typedef struct dst_key {
-	char	*dk_key_name;   /* name of the key */
-	int	dk_key_size;    /* this is the size of the key in bits */
-	int	dk_proto;       /* what protocols this key can be used for */
-	int	dk_alg;         /* algorithm number from key record */
-	u_int32_t dk_flags;     /* and the flags of the public key */
-	u_int16_t dk_id;        /* identifier of the key */
-	void	*dk_KEY_struct; /* pointer to key in crypto pkg fmt */
-	struct dst_func *dk_func; /* point to cryptto pgk specific function table */
+	char	*dk_key_name;   /*%< name of the key */
+	int	dk_key_size;    /*%< this is the size of the key in bits */
+	int	dk_proto;       /*%< what protocols this key can be used for */
+	int	dk_alg;         /*%< algorithm number from key record */
+	u_int32_t dk_flags;     /*%< and the flags of the public key */
+	u_int16_t dk_id;        /*%< identifier of the key */
+	void	*dk_KEY_struct; /*%< pointer to key in crypto pkg fmt */
+	struct dst_func *dk_func; /*%< point to cryptto pgk specific function table */
 } DST_KEY;
 #define HAS_DST_KEY 
 
@@ -103,7 +103,7 @@ extern const char *key_file_fmt_str;
 extern const char *dst_path;
 
 #ifndef DST_HASH_SIZE
-#define DST_HASH_SIZE 20	/* RIPEMD160 and SHA-1 are 20 bytes MD5 is 16 */
+#define DST_HASH_SIZE 20	/*%< RIPEMD160 and SHA-1 are 20 bytes MD5 is 16 */
 #endif
 
 int dst_bsafe_init(void);
@@ -129,7 +129,7 @@ int       dst_s_build_filename(  char *filename, const char *name,
 
 FILE      *dst_s_fopen (const char *filename, const char *mode, int perm);
 
-/* 
+/*%
  * read and write network byte order into u_int?_t  
  *  all of these should be retired
  */
@@ -152,3 +152,4 @@ dst_s_dump(const int mode, const u_char *data, const int size,
 
 
 #endif /* DST_INTERNAL_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/dst/hmac_link.c b/contrib/bind9/lib/bind/dst/hmac_link.c
index 028f02e..d4f0a2a 100644
--- a/contrib/bind9/lib/bind/dst/hmac_link.c
+++ b/contrib/bind9/lib/bind/dst/hmac_link.c
@@ -1,6 +1,6 @@
 #ifdef HMAC_MD5
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.2.2.1.4.2 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_link.c,v 1.3.164.3 2006/03/10 00:20:08 marka Exp $";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -19,7 +19,7 @@ static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_lin
  * WITH THE USE OR PERFORMANCE OF THE SOFTWARE.
  */
 
-/* 
+/*%
  * This file contains an implementation of the HMAC-MD5 algorithm.
  */
 #include "port_before.h"
@@ -46,7 +46,7 @@ static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/hmac_lin
 #  endif
 # endif
 # ifndef _MD5_H_
-#  define _MD5_H_ 1	/* make sure we do not include rsaref md5.h file */
+#  define _MD5_H_ 1	/*%< make sure we do not include rsaref md5.h file */
 # endif
 #endif
 
@@ -283,10 +283,9 @@ dst_hmac_md5_key_to_file_format(const DST_KEY *dkey, char *buff,
 	if (dkey == NULL || dkey->dk_KEY_struct == NULL) 
 		return (0);
 	if (buff == NULL || buff_len <= (int) strlen(key_file_fmt_str))
-		return (-1);	/* no OR not enough space in output area */
-
+		return (-1);	/*%< no OR not enough space in output area */
 	hkey = (HMAC_Key *) dkey->dk_KEY_struct;
-	memset(buff, 0, buff_len);	/* just in case */
+	memset(buff, 0, buff_len);	/*%< just in case */
 	/* write file header */
 	sprintf(buff, key_file_fmt_str, KEY_FILE_FORMAT, KEY_HMAC_MD5, "HMAC");
 
@@ -360,7 +359,7 @@ dst_hmac_md5_key_from_file_format(DST_KEY *dkey, const char *buff,
 		return (-5);
 	memcpy(tmp, p, len);
 	*(tmp + len) = 0x0;
-	key_len = b64_pton((char *)tmp, key, HMAC_LEN+1);	/* see above */
+	key_len = b64_pton((char *)tmp, key, HMAC_LEN+1);	/*%< see above */
 	SAFE_FREE2(tmp, len + 2);
 
 	if (dst_buffer_to_hmac_md5(dkey, key, key_len) < 0) {
@@ -369,7 +368,7 @@ dst_hmac_md5_key_from_file_format(DST_KEY *dkey, const char *buff,
 	return (0);
 }
 
-/*
+/*%
  * dst_hmac_md5_to_dns_key() 
  *         function to extract hmac key from DST_KEY structure 
  * intput: 
@@ -443,7 +442,7 @@ dst_hmac_md5_generate_key(DST_KEY *key, const int nothing)
 	return (-1);
 }
 
-/*
+/*%
  * dst_hmac_md5_init()  Function to answer set up function pointers for HMAC
  *	   related functions 
  */
@@ -480,3 +479,5 @@ dst_hmac_md5_init(){
 	return (0);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/dst/md5.h b/contrib/bind9/lib/bind/dst/md5.h
index 6525662..b1ed9e1 100644
--- a/contrib/bind9/lib/bind/dst/md5.h
+++ b/contrib/bind9/lib/bind/dst/md5.h
@@ -104,3 +104,5 @@ unsigned char *MD5();
 #else 
 #include <sys/md5.h>
 #endif /* HAVE_MD5 */
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/dst/md5_dgst.c b/contrib/bind9/lib/bind/dst/md5_dgst.c
index ba0a5a1..76b0505 100644
--- a/contrib/bind9/lib/bind/dst/md5_dgst.c
+++ b/contrib/bind9/lib/bind/dst/md5_dgst.c
@@ -56,7 +56,7 @@
  * [including the GNU Public Licence.]
  */
 
-#ifdef USE_MD5 /* Added by ogud@tis.com 1998/1/26 */
+#ifdef USE_MD5 /*%< Added by ogud@tis.com 1998/1/26 */
 #include <port_before.h>
 #ifndef HAVE_MD5
 #include <stdio.h>
@@ -65,7 +65,9 @@
 
 const char *MD5_version="MD5 part of SSLeay 0.8.1 19-Jul-1997";
 
-/* Implemented from RFC1321 The MD5 Message-Digest Algorithm
+/*! \file
+ * \brief
+ *  Implemented from RFC1321 The MD5 Message-Digest Algorithm
  */
 
 #define INIT_DATA_A (unsigned long)0x67452301L
@@ -105,7 +107,7 @@ unsigned long len;
 	l=(c->Nl+(len<<3))&0xffffffffL;
 	/* 95-05-24 eay Fixed a bug with the overflow handling, thanks to
 	 * Wei Dai <weidai@eskimo.com> for pointing it out. */
-	if (l < c->Nl) /* overflow */
+	if (l < c->Nl) /*%< overflow */
 		c->Nh++;
 	c->Nh+=(len>>29);
 	c->Nl=l;
@@ -137,7 +139,7 @@ unsigned long len;
 			int ew,ec;
 
 			c->num+=(int)len;
-			if ((sc+len) < 4U) /* ugly, add char's to a word */
+			if ((sc+len) < 4U) /*%< ugly, add char's to a word */
 				{
 				l= p[sw];
 				p_c2l_p(data,l,sc,len);
@@ -196,7 +198,7 @@ unsigned long len;
 	c->num=sc;
 	if (sc)
 		{
-		sw=sc>>2;	/* words to copy */
+		sw=sc>>2;	/*%< words to copy */
 #ifdef L_ENDIAN
 		p[sw]=0;
 		memcpy(p,data,sc);
diff --git a/contrib/bind9/lib/bind/dst/md5_locl.h b/contrib/bind9/lib/bind/dst/md5_locl.h
index ce4c765..657fe8c 100644
--- a/contrib/bind9/lib/bind/dst/md5_locl.h
+++ b/contrib/bind9/lib/bind/dst/md5_locl.h
@@ -147,7 +147,8 @@
 	(a)=ROTATE(l,16L); \
 	}
 #endif
-/*
+
+/*%
 #define	F(x,y,z)	(((x) & (y))  |  ((~(x)) & (z)))
 #define	G(x,y,z)	(((x) & (z))  |  ((y) & (~(z))))
 */
@@ -188,3 +189,5 @@
 	a+=((k)+(t)+I((b),(c),(d))); \
 	a=ROTATE(a,s); \
 	a+=b; };
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/dst/support.c b/contrib/bind9/lib/bind/dst/support.c
index 8fe3cdb..ec228d0 100644
--- a/contrib/bind9/lib/bind/dst/support.c
+++ b/contrib/bind9/lib/bind/dst/support.c
@@ -1,4 +1,4 @@
-static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/support.c,v 1.2.2.1.10.2 2005/10/11 00:48:14 marka Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/support.c,v 1.3.332.3 2005/10/11 00:25:09 marka Exp $";
 
 
 /*
@@ -34,7 +34,7 @@ static const char rcsid[] = "$Header: /proj/cvs/prod/bind9/lib/bind/dst/support.
 
 #include "port_after.h"
 
-/*
+/*%
  * dst_s_verify_str()
  *     Validate that the input string(*str) is at the head of the input
  *     buffer(**buf).  If so, move the buffer head pointer (*buf) to
@@ -52,20 +52,20 @@ int
 dst_s_verify_str(const char **buf, const char *str)
 {
 	int b, s;
-	if (*buf == NULL)	/* error checks */
+	if (*buf == NULL)	/*%< error checks */
 		return (0);
 	if (str == NULL || *str == '\0')
 		return (1);
 
-	b = strlen(*buf);	/* get length of strings */
+	b = strlen(*buf);	/*%< get length of strings */
 	s = strlen(str);
-	if (s > b || strncmp(*buf, str, s))	/* check if same */
-		return (0);	/* not a match */
-	(*buf) += s;		/* advance pointer */
+	if (s > b || strncmp(*buf, str, s))	/*%< check if same */
+		return (0);	/*%< not a match */
+	(*buf) += s;		/*%< advance pointer */
 	return (1);
 }
 
-/*
+/*%
  * dst_s_calculate_bits
  *     Given a binary number represented in a u_char[], determine
  *     the number of significant bits used.
@@ -89,8 +89,7 @@ dst_s_calculate_bits(const u_char *str, const int max_bits)
 	return (bits);
 }
 
-
-/*
+/*%
  * calculates a checksum used in dst for an id.
  * takes an array of bytes and a length.
  * returns a 16  bit checksum.
@@ -115,7 +114,7 @@ dst_s_id_calc(const u_char *key, const int keysize)
 	return (ac & 0xffff);
 }
 
-/* 
+/*%
  * dst_s_dns_key_id() Function to calculate DNSSEC footprint from KEY record
  *   rdata
  * Input:
@@ -131,7 +130,7 @@ dst_s_dns_key_id(const u_char *dns_key_rdata, const int rdata_len)
 		return 0;
 
 	/* compute id */
-	if (dns_key_rdata[3] == KEY_RSA)	/* Algorithm RSA */
+	if (dns_key_rdata[3] == KEY_RSA)	/*%< Algorithm RSA */
 		return dst_s_get_int16((const u_char *)
 				       &dns_key_rdata[rdata_len - 3]);
 	else if (dns_key_rdata[3] == KEY_HMAC_MD5)
@@ -142,7 +141,7 @@ dst_s_dns_key_id(const u_char *dns_key_rdata, const int rdata_len)
 		return dst_s_id_calc(dns_key_rdata, rdata_len);
 }
 
-/*
+/*%
  * dst_s_get_int16
  *     This routine extracts a 16 bit integer from a two byte character
  *     string.  The character string is assumed to be in network byte
@@ -161,8 +160,7 @@ dst_s_get_int16(const u_char *buf)
 	return (a);
 }
 
-
-/*
+/*%
  * dst_s_get_int32
  *     This routine extracts a 32 bit integer from a four byte character
  *     string.  The character string is assumed to be in network byte
@@ -182,8 +180,7 @@ dst_s_get_int32(const u_char *buf)
 	return (a);
 }
 
-
-/*
+/*%
  * dst_s_put_int16
  *     Take a 16 bit integer and store the value in a two byte
  *     character string.  The integer is assumed to be in network
@@ -201,8 +198,7 @@ dst_s_put_int16(u_int8_t *buf, const u_int16_t val)
 	buf[1] = (u_int8_t)(val);
 }
 
-
-/*
+/*%
  * dst_s_put_int32
  *     Take a 32 bit integer and store the value in a four byte
  *     character string.  The integer is assumed to be in network
@@ -222,13 +218,12 @@ dst_s_put_int32(u_int8_t *buf, const u_int32_t val)
 	buf[3] = (u_int8_t)(val);
 }
 
-
-/*
+/*%
  *  dst_s_filename_length
  *
  *	This function returns the number of bytes needed to hold the
  *	filename for a key file.  '/', '\' and ':' are not allowed.
- *	form:  K<keyname>+<alg>+<id>.<suffix>
+ *	form:  K&lt;keyname&gt;+&lt;alg&gt;+&lt;id&gt;.&lt;suffix&gt;
  *
  *	Returns 0 if the filename would contain either '\', '/' or ':'
  */
@@ -254,13 +249,12 @@ dst_s_filename_length(const char *name, const char *suffix)
 	return (1 + strlen(name) + 6 + strlen(suffix));
 }
 
-
-/*
+/*%
  *  dst_s_build_filename ()
  *	Builds a key filename from the key name, it's id, and a
  *	suffix.  '\', '/' and ':' are not allowed. fA filename is of the
- *	form:  K<keyname><id>.<suffix>
- *	form: K<keyname>+<alg>+<id>.<suffix>
+ *	form:  K&lt;keyname&gt;&lt;id&gt;.&lt;suffix&gt;
+ *	form: K&lt;keyname&gt;+&lt;alg&gt;+&lt;id&gt;.&lt;suffix&gt;
  *
  *	Returns -1 if the conversion fails:
  *	  if the filename would be too long for space allotted
@@ -294,7 +288,7 @@ dst_s_build_filename(char *filename, const char *name, u_int16_t id,
 	return (0);
 }
 
-/*
+/*%
  *  dst_s_fopen ()
  *     Open a file in the dst_path directory.  If perm is specified, the
  *     file is checked for existence first, and not opened if it exists.
@@ -344,3 +338,5 @@ dst_s_dump(const int mode, const u_char *data, const int size,
 #endif
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/Makefile.in b/contrib/bind9/lib/bind/include/Makefile.in
index a6e5553..d07ea7a 100644
--- a/contrib/bind9/lib/bind/include/Makefile.in
+++ b/contrib/bind9/lib/bind/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.3.206.1 2004/03/06 08:13:22 marka Exp $
+# $Id: Makefile.in,v 1.4 2004/03/05 05:05:11 marka Exp $
 
 srcdir =        @srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/include/arpa/inet.h b/contrib/bind9/lib/bind/include/arpa/inet.h
index 46caa49..d84987b 100644
--- a/contrib/bind9/lib/bind/include/arpa/inet.h
+++ b/contrib/bind9/lib/bind/include/arpa/inet.h
@@ -53,9 +53,9 @@
  * --Copyright--
  */
 
-/*
+/*%
  *	@(#)inet.h	8.1 (Berkeley) 6/2/93
- *	$Id: inet.h,v 1.1.206.1 2004/03/09 08:33:30 marka Exp $
+ *	$Id: inet.h,v 1.2.18.1 2005/04/27 05:00:50 sra Exp $
  */
 
 #ifndef _INET_H_
@@ -122,3 +122,5 @@ __END_DECLS
 #endif
 
 #endif /* !_INET_H_ */
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/arpa/nameser.h b/contrib/bind9/lib/bind/include/arpa/nameser.h
index 23db498..b3a7849 100644
--- a/contrib/bind9/lib/bind/include/arpa/nameser.h
+++ b/contrib/bind9/lib/bind/include/arpa/nameser.h
@@ -49,12 +49,14 @@
  */
 
 /*
- *	$Id: nameser.h,v 1.2.2.4.4.1 2004/03/09 08:33:30 marka Exp $
+ *	$Id: nameser.h,v 1.7.18.1 2005/04/27 05:00:50 sra Exp $
  */
 
 #ifndef _ARPA_NAMESER_H_
 #define _ARPA_NAMESER_H_
 
+/*! \file */
+
 #define BIND_4_COMPAT
 
 #include <sys/param.h>
@@ -65,7 +67,7 @@
 #endif
 #include <sys/cdefs.h>
 
-/*
+/*%
  * Revision information.  This is the release date in YYYYMMDD format.
  * It can change every day so the right thing to do with it is use it
  * in preprocessor commands such as "#if (__NAMESER > 19931104)".  Do not
@@ -73,43 +75,41 @@
  * contains a new enough lib/nameser/ to support the feature you need.
  */
 
-#define __NAMESER	19991006	/* New interface version stamp. */
-
+#define __NAMESER	19991006	/*%< New interface version stamp. */
 /*
- * Define constants based on RFC 883, RFC 1034, RFC 1035
+ * Define constants based on RFC0883, RFC1034, RFC 1035
  */
-#define NS_PACKETSZ	512	/* default UDP packet size */
-#define NS_MAXDNAME	1025	/* maximum domain name */
-#define NS_MAXMSG	65535	/* maximum message size */
-#define NS_MAXCDNAME	255	/* maximum compressed domain name */
-#define NS_MAXLABEL	63	/* maximum length of domain label */
-#define NS_HFIXEDSZ	12	/* #/bytes of fixed data in header */
-#define NS_QFIXEDSZ	4	/* #/bytes of fixed data in query */
-#define NS_RRFIXEDSZ	10	/* #/bytes of fixed data in r record */
-#define NS_INT32SZ	4	/* #/bytes of data in a u_int32_t */
-#define NS_INT16SZ	2	/* #/bytes of data in a u_int16_t */
-#define NS_INT8SZ	1	/* #/bytes of data in a u_int8_t */
-#define NS_INADDRSZ	4	/* IPv4 T_A */
-#define NS_IN6ADDRSZ	16	/* IPv6 T_AAAA */
-#define NS_CMPRSFLGS	0xc0	/* Flag bits indicating name compression. */
-#define NS_DEFAULTPORT	53	/* For both TCP and UDP. */
-
+#define NS_PACKETSZ	512	/*%< default UDP packet size */
+#define NS_MAXDNAME	1025	/*%< maximum domain name */
+#define NS_MAXMSG	65535	/*%< maximum message size */
+#define NS_MAXCDNAME	255	/*%< maximum compressed domain name */
+#define NS_MAXLABEL	63	/*%< maximum length of domain label */
+#define NS_HFIXEDSZ	12	/*%< #/bytes of fixed data in header */
+#define NS_QFIXEDSZ	4	/*%< #/bytes of fixed data in query */
+#define NS_RRFIXEDSZ	10	/*%< #/bytes of fixed data in r record */
+#define NS_INT32SZ	4	/*%< #/bytes of data in a u_int32_t */
+#define NS_INT16SZ	2	/*%< #/bytes of data in a u_int16_t */
+#define NS_INT8SZ	1	/*%< #/bytes of data in a u_int8_t */
+#define NS_INADDRSZ	4	/*%< IPv4 T_A */
+#define NS_IN6ADDRSZ	16	/*%< IPv6 T_AAAA */
+#define NS_CMPRSFLGS	0xc0	/*%< Flag bits indicating name compression. */
+#define NS_DEFAULTPORT	53	/*%< For both TCP and UDP. */
 /*
  * These can be expanded with synonyms, just keep ns_parse.c:ns_parserecord()
  * in synch with it.
  */
 typedef enum __ns_sect {
-	ns_s_qd = 0,		/* Query: Question. */
-	ns_s_zn = 0,		/* Update: Zone. */
-	ns_s_an = 1,		/* Query: Answer. */
-	ns_s_pr = 1,		/* Update: Prerequisites. */
-	ns_s_ns = 2,		/* Query: Name servers. */
-	ns_s_ud = 2,		/* Update: Update. */
-	ns_s_ar = 3,		/* Query|Update: Additional records. */
+	ns_s_qd = 0,		/*%< Query: Question. */
+	ns_s_zn = 0,		/*%< Update: Zone. */
+	ns_s_an = 1,		/*%< Query: Answer. */
+	ns_s_pr = 1,		/*%< Update: Prerequisites. */
+	ns_s_ns = 2,		/*%< Query: Name servers. */
+	ns_s_ud = 2,		/*%< Update: Update. */
+	ns_s_ar = 3,		/*%< Query|Update: Additional records. */
 	ns_s_max = 4
 } ns_sect;
 
-/*
+/*%
  * This is a message handle.  It is caller allocated and has no dynamic data.
  * This structure is intended to be opaque to all but ns_parse.c, thus the
  * leading _'s on the member names.  Use the accessor functions, not the _'s.
@@ -135,7 +135,7 @@ extern struct _ns_flagdata _ns_flagdata[];
 #define ns_msg_size(handle) ((handle)._eom - (handle)._msg)
 #define ns_msg_count(handle, section) ((handle)._counts[section] + 0)
 
-/*
+/*%
  * This is a parsed record.  It is caller allocated and has no dynamic data.
  */
 typedef	struct __ns_rr {
@@ -155,54 +155,54 @@ typedef	struct __ns_rr {
 #define ns_rr_rdlen(rr)	((rr).rdlength + 0)
 #define ns_rr_rdata(rr)	((rr).rdata + 0)
 
-/*
+/*%
  * These don't have to be in the same order as in the packet flags word,
  * and they can even overlap in some cases, but they will need to be kept
  * in synch with ns_parse.c:ns_flagdata[].
  */
 typedef enum __ns_flag {
-	ns_f_qr,		/* Question/Response. */
-	ns_f_opcode,		/* Operation code. */
-	ns_f_aa,		/* Authoritative Answer. */
-	ns_f_tc,		/* Truncation occurred. */
-	ns_f_rd,		/* Recursion Desired. */
-	ns_f_ra,		/* Recursion Available. */
-	ns_f_z,			/* MBZ. */
-	ns_f_ad,		/* Authentic Data (DNSSEC). */
-	ns_f_cd,		/* Checking Disabled (DNSSEC). */
-	ns_f_rcode,		/* Response code. */
+	ns_f_qr,		/*%< Question/Response. */
+	ns_f_opcode,		/*%< Operation code. */
+	ns_f_aa,		/*%< Authoritative Answer. */
+	ns_f_tc,		/*%< Truncation occurred. */
+	ns_f_rd,		/*%< Recursion Desired. */
+	ns_f_ra,		/*%< Recursion Available. */
+	ns_f_z,			/*%< MBZ. */
+	ns_f_ad,		/*%< Authentic Data (DNSSEC). */
+	ns_f_cd,		/*%< Checking Disabled (DNSSEC). */
+	ns_f_rcode,		/*%< Response code. */
 	ns_f_max
 } ns_flag;
 
-/*
+/*%
  * Currently defined opcodes.
  */
 typedef enum __ns_opcode {
-	ns_o_query = 0,		/* Standard query. */
-	ns_o_iquery = 1,	/* Inverse query (deprecated/unsupported). */
-	ns_o_status = 2,	/* Name server status query (unsupported). */
+	ns_o_query = 0,		/*%< Standard query. */
+	ns_o_iquery = 1,	/*%< Inverse query (deprecated/unsupported). */
+	ns_o_status = 2,	/*%< Name server status query (unsupported). */
 				/* Opcode 3 is undefined/reserved. */
-	ns_o_notify = 4,	/* Zone change notification. */
-	ns_o_update = 5,	/* Zone update message. */
+	ns_o_notify = 4,	/*%< Zone change notification. */
+	ns_o_update = 5,	/*%< Zone update message. */
 	ns_o_max = 6
 } ns_opcode;
 
-/*
+/*%
  * Currently defined response codes.
  */
 typedef	enum __ns_rcode {
-	ns_r_noerror = 0,	/* No error occurred. */
-	ns_r_formerr = 1,	/* Format error. */
-	ns_r_servfail = 2,	/* Server failure. */
-	ns_r_nxdomain = 3,	/* Name error. */
-	ns_r_notimpl = 4,	/* Unimplemented. */
-	ns_r_refused = 5,	/* Operation refused. */
+	ns_r_noerror = 0,	/*%< No error occurred. */
+	ns_r_formerr = 1,	/*%< Format error. */
+	ns_r_servfail = 2,	/*%< Server failure. */
+	ns_r_nxdomain = 3,	/*%< Name error. */
+	ns_r_notimpl = 4,	/*%< Unimplemented. */
+	ns_r_refused = 5,	/*%< Operation refused. */
 	/* these are for BIND_UPDATE */
-	ns_r_yxdomain = 6,	/* Name exists */
-	ns_r_yxrrset = 7,	/* RRset exists */
-	ns_r_nxrrset = 8,	/* RRset does not exist */
-	ns_r_notauth = 9,	/* Not authoritative for zone */
-	ns_r_notzone = 10,	/* Zone of record different from zone section */
+	ns_r_yxdomain = 6,	/*%< Name exists */
+	ns_r_yxrrset = 7,	/*%< RRset exists */
+	ns_r_nxrrset = 8,	/*%< RRset does not exist */
+	ns_r_notauth = 9,	/*%< Not authoritative for zone */
+	ns_r_notzone = 10,	/*%< Zone of record different from zone section */
 	ns_r_max = 11,
 	/* The following are EDNS extended rcodes */
 	ns_r_badvers = 16,
@@ -219,7 +219,7 @@ typedef enum __ns_update_operation {
 	ns_uop_max = 2
 } ns_update_operation;
 
-/*
+/*%
  * This structure is used for TSIG authenticated messages
  */
 struct ns_tsig_key {
@@ -229,7 +229,7 @@ struct ns_tsig_key {
 };
 typedef struct ns_tsig_key ns_tsig_key;
 
-/*
+/*%
  * This structure is used for TSIG authenticated TCP messages
  */
 struct ns_tcp_tsig_state {
@@ -249,61 +249,61 @@ typedef struct ns_tcp_tsig_state ns_tcp_tsig_state;
 #define NS_TSIG_ERROR_NO_SPACE -11
 #define NS_TSIG_ERROR_FORMERR -12
 
-/*
+/*%
  * Currently defined type values for resources and queries.
  */
 typedef enum __ns_type {
-	ns_t_invalid = 0,	/* Cookie. */
-	ns_t_a = 1,		/* Host address. */
-	ns_t_ns = 2,		/* Authoritative server. */
-	ns_t_md = 3,		/* Mail destination. */
-	ns_t_mf = 4,		/* Mail forwarder. */
-	ns_t_cname = 5,		/* Canonical name. */
-	ns_t_soa = 6,		/* Start of authority zone. */
-	ns_t_mb = 7,		/* Mailbox domain name. */
-	ns_t_mg = 8,		/* Mail group member. */
-	ns_t_mr = 9,		/* Mail rename name. */
-	ns_t_null = 10,		/* Null resource record. */
-	ns_t_wks = 11,		/* Well known service. */
-	ns_t_ptr = 12,		/* Domain name pointer. */
-	ns_t_hinfo = 13,	/* Host information. */
-	ns_t_minfo = 14,	/* Mailbox information. */
-	ns_t_mx = 15,		/* Mail routing information. */
-	ns_t_txt = 16,		/* Text strings. */
-	ns_t_rp = 17,		/* Responsible person. */
-	ns_t_afsdb = 18,	/* AFS cell database. */
-	ns_t_x25 = 19,		/* X_25 calling address. */
-	ns_t_isdn = 20,		/* ISDN calling address. */
-	ns_t_rt = 21,		/* Router. */
-	ns_t_nsap = 22,		/* NSAP address. */
-	ns_t_nsap_ptr = 23,	/* Reverse NSAP lookup (deprecated). */
-	ns_t_sig = 24,		/* Security signature. */
-	ns_t_key = 25,		/* Security key. */
-	ns_t_px = 26,		/* X.400 mail mapping. */
-	ns_t_gpos = 27,		/* Geographical position (withdrawn). */
-	ns_t_aaaa = 28,		/* Ip6 Address. */
-	ns_t_loc = 29,		/* Location Information. */
-	ns_t_nxt = 30,		/* Next domain (security). */
-	ns_t_eid = 31,		/* Endpoint identifier. */
-	ns_t_nimloc = 32,	/* Nimrod Locator. */
-	ns_t_srv = 33,		/* Server Selection. */
-	ns_t_atma = 34,		/* ATM Address */
-	ns_t_naptr = 35,	/* Naming Authority PoinTeR */
-	ns_t_kx = 36,		/* Key Exchange */
-	ns_t_cert = 37,		/* Certification record */
-	ns_t_a6 = 38,		/* IPv6 address (deprecates AAAA) */
-	ns_t_dname = 39,	/* Non-terminal DNAME (for IPv6) */
-	ns_t_sink = 40,		/* Kitchen sink (experimentatl) */
-	ns_t_opt = 41,		/* EDNS0 option (meta-RR) */
-	ns_t_apl = 42,		/* Address prefix list (RFC 3123) */
-	ns_t_tkey = 249,	/* Transaction key */
-	ns_t_tsig = 250,	/* Transaction signature. */
-	ns_t_ixfr = 251,	/* Incremental zone transfer. */
-	ns_t_axfr = 252,	/* Transfer zone of authority. */
-	ns_t_mailb = 253,	/* Transfer mailbox records. */
-	ns_t_maila = 254,	/* Transfer mail agent records. */
-	ns_t_any = 255,		/* Wildcard match. */
-	ns_t_zxfr = 256,	/* BIND-specific, nonstandard. */
+	ns_t_invalid = 0,	/*%< Cookie. */
+	ns_t_a = 1,		/*%< Host address. */
+	ns_t_ns = 2,		/*%< Authoritative server. */
+	ns_t_md = 3,		/*%< Mail destination. */
+	ns_t_mf = 4,		/*%< Mail forwarder. */
+	ns_t_cname = 5,		/*%< Canonical name. */
+	ns_t_soa = 6,		/*%< Start of authority zone. */
+	ns_t_mb = 7,		/*%< Mailbox domain name. */
+	ns_t_mg = 8,		/*%< Mail group member. */
+	ns_t_mr = 9,		/*%< Mail rename name. */
+	ns_t_null = 10,		/*%< Null resource record. */
+	ns_t_wks = 11,		/*%< Well known service. */
+	ns_t_ptr = 12,		/*%< Domain name pointer. */
+	ns_t_hinfo = 13,	/*%< Host information. */
+	ns_t_minfo = 14,	/*%< Mailbox information. */
+	ns_t_mx = 15,		/*%< Mail routing information. */
+	ns_t_txt = 16,		/*%< Text strings. */
+	ns_t_rp = 17,		/*%< Responsible person. */
+	ns_t_afsdb = 18,	/*%< AFS cell database. */
+	ns_t_x25 = 19,		/*%< X_25 calling address. */
+	ns_t_isdn = 20,		/*%< ISDN calling address. */
+	ns_t_rt = 21,		/*%< Router. */
+	ns_t_nsap = 22,		/*%< NSAP address. */
+	ns_t_nsap_ptr = 23,	/*%< Reverse NSAP lookup (deprecated). */
+	ns_t_sig = 24,		/*%< Security signature. */
+	ns_t_key = 25,		/*%< Security key. */
+	ns_t_px = 26,		/*%< X.400 mail mapping. */
+	ns_t_gpos = 27,		/*%< Geographical position (withdrawn). */
+	ns_t_aaaa = 28,		/*%< Ip6 Address. */
+	ns_t_loc = 29,		/*%< Location Information. */
+	ns_t_nxt = 30,		/*%< Next domain (security). */
+	ns_t_eid = 31,		/*%< Endpoint identifier. */
+	ns_t_nimloc = 32,	/*%< Nimrod Locator. */
+	ns_t_srv = 33,		/*%< Server Selection. */
+	ns_t_atma = 34,		/*%< ATM Address */
+	ns_t_naptr = 35,	/*%< Naming Authority PoinTeR */
+	ns_t_kx = 36,		/*%< Key Exchange */
+	ns_t_cert = 37,		/*%< Certification record */
+	ns_t_a6 = 38,		/*%< IPv6 address (deprecates AAAA) */
+	ns_t_dname = 39,	/*%< Non-terminal DNAME (for IPv6) */
+	ns_t_sink = 40,		/*%< Kitchen sink (experimentatl) */
+	ns_t_opt = 41,		/*%< EDNS0 option (meta-RR) */
+	ns_t_apl = 42,		/*%< Address prefix list (RFC3123) */
+	ns_t_tkey = 249,	/*%< Transaction key */
+	ns_t_tsig = 250,	/*%< Transaction signature. */
+	ns_t_ixfr = 251,	/*%< Incremental zone transfer. */
+	ns_t_axfr = 252,	/*%< Transfer zone of authority. */
+	ns_t_mailb = 253,	/*%< Transfer mailbox records. */
+	ns_t_maila = 254,	/*%< Transfer mail agent records. */
+	ns_t_any = 255,		/*%< Wildcard match. */
+	ns_t_zxfr = 256,	/*%< BIND-specific, nonstandard. */
 	ns_t_max = 65536
 } ns_type;
 
@@ -318,61 +318,61 @@ typedef enum __ns_type {
 #define ns_t_xfr_p(t) ((t) == ns_t_axfr || (t) == ns_t_ixfr || \
 		       (t) == ns_t_zxfr)
 
-/*
+/*%
  * Values for class field
  */
 typedef enum __ns_class {
-	ns_c_invalid = 0,	/* Cookie. */
-	ns_c_in = 1,		/* Internet. */
-	ns_c_2 = 2,		/* unallocated/unsupported. */
-	ns_c_chaos = 3,		/* MIT Chaos-net. */
-	ns_c_hs = 4,		/* MIT Hesiod. */
+	ns_c_invalid = 0,	/*%< Cookie. */
+	ns_c_in = 1,		/*%< Internet. */
+	ns_c_2 = 2,		/*%< unallocated/unsupported. */
+	ns_c_chaos = 3,		/*%< MIT Chaos-net. */
+	ns_c_hs = 4,		/*%< MIT Hesiod. */
 	/* Query class values which do not appear in resource records */
-	ns_c_none = 254,	/* for prereq. sections in update requests */
-	ns_c_any = 255,		/* Wildcard match. */
+	ns_c_none = 254,	/*%< for prereq. sections in update requests */
+	ns_c_any = 255,		/*%< Wildcard match. */
 	ns_c_max = 65536
 } ns_class;
 
 /* DNSSEC constants. */
 
 typedef enum __ns_key_types {
-	ns_kt_rsa = 1,		/* key type RSA/MD5 */
-	ns_kt_dh  = 2,		/* Diffie Hellman */
-	ns_kt_dsa = 3,		/* Digital Signature Standard (MANDATORY) */
-	ns_kt_private = 254	/* Private key type starts with OID */
+	ns_kt_rsa = 1,		/*%< key type RSA/MD5 */
+	ns_kt_dh  = 2,		/*%< Diffie Hellman */
+	ns_kt_dsa = 3,		/*%< Digital Signature Standard (MANDATORY) */
+	ns_kt_private = 254	/*%< Private key type starts with OID */
 } ns_key_types;
 
 typedef enum __ns_cert_types {
-	cert_t_pkix = 1,	/* PKIX (X.509v3) */
-	cert_t_spki = 2,	/* SPKI */
-	cert_t_pgp  = 3,	/* PGP */
-	cert_t_url  = 253,	/* URL private type */
-	cert_t_oid  = 254	/* OID private type */
+	cert_t_pkix = 1,	/*%< PKIX (X.509v3) */
+	cert_t_spki = 2,	/*%< SPKI */
+	cert_t_pgp  = 3,	/*%< PGP */
+	cert_t_url  = 253,	/*%< URL private type */
+	cert_t_oid  = 254	/*%< OID private type */
 } ns_cert_types;
 
 /* Flags field of the KEY RR rdata. */
-#define	NS_KEY_TYPEMASK		0xC000	/* Mask for "type" bits */
-#define	NS_KEY_TYPE_AUTH_CONF	0x0000	/* Key usable for both */
-#define	NS_KEY_TYPE_CONF_ONLY	0x8000	/* Key usable for confidentiality */
-#define	NS_KEY_TYPE_AUTH_ONLY	0x4000	/* Key usable for authentication */
-#define	NS_KEY_TYPE_NO_KEY	0xC000	/* No key usable for either; no key */
+#define	NS_KEY_TYPEMASK		0xC000	/*%< Mask for "type" bits */
+#define	NS_KEY_TYPE_AUTH_CONF	0x0000	/*%< Key usable for both */
+#define	NS_KEY_TYPE_CONF_ONLY	0x8000	/*%< Key usable for confidentiality */
+#define	NS_KEY_TYPE_AUTH_ONLY	0x4000	/*%< Key usable for authentication */
+#define	NS_KEY_TYPE_NO_KEY	0xC000	/*%< No key usable for either; no key */
 /* The type bits can also be interpreted independently, as single bits: */
-#define	NS_KEY_NO_AUTH		0x8000	/* Key unusable for authentication */
-#define	NS_KEY_NO_CONF		0x4000	/* Key unusable for confidentiality */
+#define	NS_KEY_NO_AUTH		0x8000	/*%< Key unusable for authentication */
+#define	NS_KEY_NO_CONF		0x4000	/*%< Key unusable for confidentiality */
 #define	NS_KEY_RESERVED2	0x2000	/* Security is *mandatory* if bit=0 */
-#define	NS_KEY_EXTENDED_FLAGS	0x1000	/* reserved - must be zero */
-#define	NS_KEY_RESERVED4	0x0800  /* reserved - must be zero */
-#define	NS_KEY_RESERVED5	0x0400  /* reserved - must be zero */
-#define	NS_KEY_NAME_TYPE	0x0300	/* these bits determine the type */
-#define	NS_KEY_NAME_USER	0x0000	/* key is assoc. with user */
-#define	NS_KEY_NAME_ENTITY	0x0200	/* key is assoc. with entity eg host */
-#define	NS_KEY_NAME_ZONE	0x0100	/* key is zone key */
-#define	NS_KEY_NAME_RESERVED	0x0300	/* reserved meaning */
-#define	NS_KEY_RESERVED8	0x0080  /* reserved - must be zero */
-#define	NS_KEY_RESERVED9	0x0040  /* reserved - must be zero */
-#define	NS_KEY_RESERVED10	0x0020  /* reserved - must be zero */
-#define	NS_KEY_RESERVED11	0x0010  /* reserved - must be zero */
-#define	NS_KEY_SIGNATORYMASK	0x000F	/* key can sign RR's of same name */
+#define	NS_KEY_EXTENDED_FLAGS	0x1000	/*%< reserved - must be zero */
+#define	NS_KEY_RESERVED4	0x0800  /*%< reserved - must be zero */
+#define	NS_KEY_RESERVED5	0x0400  /*%< reserved - must be zero */
+#define	NS_KEY_NAME_TYPE	0x0300	/*%< these bits determine the type */
+#define	NS_KEY_NAME_USER	0x0000	/*%< key is assoc. with user */
+#define	NS_KEY_NAME_ENTITY	0x0200	/*%< key is assoc. with entity eg host */
+#define	NS_KEY_NAME_ZONE	0x0100	/*%< key is zone key */
+#define	NS_KEY_NAME_RESERVED	0x0300	/*%< reserved meaning */
+#define	NS_KEY_RESERVED8	0x0080  /*%< reserved - must be zero */
+#define	NS_KEY_RESERVED9	0x0040  /*%< reserved - must be zero */
+#define	NS_KEY_RESERVED10	0x0020  /*%< reserved - must be zero */
+#define	NS_KEY_RESERVED11	0x0010  /*%< reserved - must be zero */
+#define	NS_KEY_SIGNATORYMASK	0x000F	/*%< key can sign RR's of same name */
 #define	NS_KEY_RESERVED_BITMASK ( NS_KEY_RESERVED2 | \
 				  NS_KEY_RESERVED4 | \
 				  NS_KEY_RESERVED5 | \
@@ -380,16 +380,14 @@ typedef enum __ns_cert_types {
 				  NS_KEY_RESERVED9 | \
 				  NS_KEY_RESERVED10 | \
 				  NS_KEY_RESERVED11 )
-#define NS_KEY_RESERVED_BITMASK2 0xFFFF /* no bits defined here */
-
+#define NS_KEY_RESERVED_BITMASK2 0xFFFF /*%< no bits defined here */
 /* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */
-#define	NS_ALG_MD5RSA		1	/* MD5 with RSA */
-#define	NS_ALG_DH               2	/* Diffie Hellman KEY */
-#define	NS_ALG_DSA              3	/* DSA KEY */
+#define	NS_ALG_MD5RSA		1	/*%< MD5 with RSA */
+#define	NS_ALG_DH               2	/*%< Diffie Hellman KEY */
+#define	NS_ALG_DSA              3	/*%< DSA KEY */
 #define	NS_ALG_DSS              NS_ALG_DSA
-#define	NS_ALG_EXPIRE_ONLY	253	/* No alg, no security */
-#define	NS_ALG_PRIVATE_OID	254	/* Key begins with OID giving alg */
-
+#define	NS_ALG_EXPIRE_ONLY	253	/*%< No alg, no security */
+#define	NS_ALG_PRIVATE_OID	254	/*%< Key begins with OID giving alg */
 /* Protocol values  */
 /* value 0 is reserved */
 #define NS_KEY_PROT_TLS         1
@@ -399,7 +397,7 @@ typedef enum __ns_cert_types {
 #define NS_KEY_PROT_ANY		255
 
 /* Signatures */
-#define	NS_MD5RSA_MIN_BITS	 512	/* Size of a mod or exp in bits */
+#define	NS_MD5RSA_MIN_BITS	 512	/*%< Size of a mod or exp in bits */
 #define	NS_MD5RSA_MAX_BITS	4096
 	/* Total of binary mod and exp */
 #define	NS_MD5RSA_MAX_BYTES	((NS_MD5RSA_MAX_BITS+7/8)*2+3)
@@ -413,15 +411,14 @@ typedef enum __ns_cert_types {
 #define NS_DSA_MAX_BYTES        405
 
 /* Offsets into SIG record rdata to find various values */
-#define	NS_SIG_TYPE	0	/* Type flags */
-#define	NS_SIG_ALG	2	/* Algorithm */
-#define	NS_SIG_LABELS	3	/* How many labels in name */
-#define	NS_SIG_OTTL	4	/* Original TTL */
-#define	NS_SIG_EXPIR	8	/* Expiration time */
-#define	NS_SIG_SIGNED	12	/* Signature time */
-#define	NS_SIG_FOOT	16	/* Key footprint */
-#define	NS_SIG_SIGNER	18	/* Domain name of who signed it */
-
+#define	NS_SIG_TYPE	0	/*%< Type flags */
+#define	NS_SIG_ALG	2	/*%< Algorithm */
+#define	NS_SIG_LABELS	3	/*%< How many labels in name */
+#define	NS_SIG_OTTL	4	/*%< Original TTL */
+#define	NS_SIG_EXPIR	8	/*%< Expiration time */
+#define	NS_SIG_SIGNED	12	/*%< Signature time */
+#define	NS_SIG_FOOT	16	/*%< Key footprint */
+#define	NS_SIG_SIGNER	18	/*%< Domain name of who signed it */
 /* How RR types are represented as bit-flags in NXT records */
 #define	NS_NXT_BITS 8
 #define	NS_NXT_BIT_SET(  n,p) (p[(n)/NS_NXT_BITS] |=  (0x80>>((n)%NS_NXT_BITS)))
@@ -429,12 +426,12 @@ typedef enum __ns_cert_types {
 #define	NS_NXT_BIT_ISSET(n,p) (p[(n)/NS_NXT_BITS] &   (0x80>>((n)%NS_NXT_BITS)))
 #define NS_NXT_MAX 127
 
-/*
+/*%
  * EDNS0 extended flags, host order.
  */
 #define NS_OPT_DNSSEC_OK	0x8000U
 
-/*
+/*%
  * Inline versions of get/put short/long.  Pointer is advanced.
  */
 #define NS_GET16(s, cp) do { \
@@ -473,7 +470,7 @@ typedef enum __ns_cert_types {
 	(cp) += NS_INT32SZ; \
 } while (0)
 
-/*
+/*%
  * ANSI C identifier hiding for bind's lib/nameser.
  */
 #define	ns_msg_getflag		__ns_msg_getflag
@@ -574,3 +571,4 @@ __END_DECLS
 #endif
 
 #endif /* !_ARPA_NAMESER_H_ */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/arpa/nameser_compat.h b/contrib/bind9/lib/bind/include/arpa/nameser_compat.h
index 4460261..3713293 100644
--- a/contrib/bind9/lib/bind/include/arpa/nameser_compat.h
+++ b/contrib/bind9/lib/bind/include/arpa/nameser_compat.h
@@ -30,16 +30,15 @@
  * SUCH DAMAGE.
  */
 
-/*
+/*%
  *      from nameser.h	8.1 (Berkeley) 6/2/93
- *	$Id: nameser_compat.h,v 1.1.2.3.4.3 2006/05/19 02:38:15 marka Exp $
+ *	$Id: nameser_compat.h,v 1.5.18.3 2006/05/19 02:36:00 marka Exp $
  */
 
 #ifndef _ARPA_NAMESER_COMPAT_
 #define	_ARPA_NAMESER_COMPAT_
 
-#define	__BIND		19950621	/* (DEAD) interface version stamp. */
-
+#define	__BIND		19950621	/*%< (DEAD) interface version stamp. */
 #ifndef BYTE_ORDER
 #if (BSD >= 199103)
 # include <machine/endian.h>
@@ -47,10 +46,9 @@
 #ifdef __linux
 # include <endian.h>
 #else
-#define	LITTLE_ENDIAN	1234	/* least-significant byte first (vax, pc) */
-#define	BIG_ENDIAN	4321	/* most-significant byte first (IBM, net) */
-#define	PDP_ENDIAN	3412	/* LSB first in word, MSW first in long (pdp)*/
-
+#define	LITTLE_ENDIAN	1234	/*%< least-significant byte first (vax, pc) */
+#define	BIG_ENDIAN	4321	/*%< most-significant byte first (IBM, net) */
+#define	PDP_ENDIAN	3412	/*%< LSB first in word, MSW first in long (pdp) */
 #if defined(vax) || defined(ns32000) || defined(sun386) || defined(i386) || \
     defined(__i386__) || defined(__i386) || defined(__amd64__) || \
     defined(__x86_64__) || defined(MIPSEL) || defined(_MIPSEL) || \
@@ -86,7 +84,7 @@
   error "Undefined or invalid BYTE_ORDER";
 #endif
 
-/*
+/*%
  * Structure for query header.  The order of the fields is machine- and
  * compiler-dependent, depending on the byte/bit order and the layout
  * of bit fields.  We use bit fields only in int variables, as this
@@ -94,40 +92,40 @@
  */
 
 typedef struct {
-	unsigned	id :16;		/* query identification number */
+	unsigned	id :16;		/*%< query identification number */
 #if BYTE_ORDER == BIG_ENDIAN
 			/* fields in third byte */
-	unsigned	qr: 1;		/* response flag */
-	unsigned	opcode: 4;	/* purpose of message */
-	unsigned	aa: 1;		/* authoritive answer */
-	unsigned	tc: 1;		/* truncated message */
-	unsigned	rd: 1;		/* recursion desired */
+	unsigned	qr: 1;		/*%< response flag */
+	unsigned	opcode: 4;	/*%< purpose of message */
+	unsigned	aa: 1;		/*%< authoritive answer */
+	unsigned	tc: 1;		/*%< truncated message */
+	unsigned	rd: 1;		/*%< recursion desired */
 			/* fields in fourth byte */
-	unsigned	ra: 1;		/* recursion available */
-	unsigned	unused :1;	/* unused bits (MBZ as of 4.9.3a3) */
-	unsigned	ad: 1;		/* authentic data from named */
-	unsigned	cd: 1;		/* checking disabled by resolver */
-	unsigned	rcode :4;	/* response code */
+	unsigned	ra: 1;		/*%< recursion available */
+	unsigned	unused :1;	/*%< unused bits (MBZ as of 4.9.3a3) */
+	unsigned	ad: 1;		/*%< authentic data from named */
+	unsigned	cd: 1;		/*%< checking disabled by resolver */
+	unsigned	rcode :4;	/*%< response code */
 #endif
 #if BYTE_ORDER == LITTLE_ENDIAN || BYTE_ORDER == PDP_ENDIAN
 			/* fields in third byte */
-	unsigned	rd :1;		/* recursion desired */
-	unsigned	tc :1;		/* truncated message */
-	unsigned	aa :1;		/* authoritive answer */
-	unsigned	opcode :4;	/* purpose of message */
-	unsigned	qr :1;		/* response flag */
+	unsigned	rd :1;		/*%< recursion desired */
+	unsigned	tc :1;		/*%< truncated message */
+	unsigned	aa :1;		/*%< authoritive answer */
+	unsigned	opcode :4;	/*%< purpose of message */
+	unsigned	qr :1;		/*%< response flag */
 			/* fields in fourth byte */
-	unsigned	rcode :4;	/* response code */
-	unsigned	cd: 1;		/* checking disabled by resolver */
-	unsigned	ad: 1;		/* authentic data from named */
-	unsigned	unused :1;	/* unused bits (MBZ as of 4.9.3a3) */
-	unsigned	ra :1;		/* recursion available */
+	unsigned	rcode :4;	/*%< response code */
+	unsigned	cd: 1;		/*%< checking disabled by resolver */
+	unsigned	ad: 1;		/*%< authentic data from named */
+	unsigned	unused :1;	/*%< unused bits (MBZ as of 4.9.3a3) */
+	unsigned	ra :1;		/*%< recursion available */
 #endif
 			/* remaining bytes */
-	unsigned	qdcount :16;	/* number of question entries */
-	unsigned	ancount :16;	/* number of answer entries */
-	unsigned	nscount :16;	/* number of authority entries */
-	unsigned	arcount :16;	/* number of resource entries */
+	unsigned	qdcount :16;	/*%< number of question entries */
+	unsigned	ancount :16;	/*%< number of answer entries */
+	unsigned	nscount :16;	/*%< number of authority entries */
+	unsigned	arcount :16;	/*%< number of resource entries */
 } HEADER;
 
 #define PACKETSZ	NS_PACKETSZ
@@ -231,3 +229,4 @@ typedef struct {
 #define	PUTLONG			NS_PUT32
 
 #endif /* _ARPA_NAMESER_COMPAT_ */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/fd_setsize.h b/contrib/bind9/lib/bind/include/fd_setsize.h
index 235b1ad..0e21049 100644
--- a/contrib/bind9/lib/bind/include/fd_setsize.h
+++ b/contrib/bind9/lib/bind/include/fd_setsize.h
@@ -1,9 +1,10 @@
 #ifndef _FD_SETSIZE_H
 #define _FD_SETSIZE_H
 
-/*
+/*%
  * If you need a bigger FD_SETSIZE, this is NOT the place to set it.
  * This file is a fallback for BIND ports which don't specify their own.
  */
 
 #endif /* _FD_SETSIZE_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/hesiod.h b/contrib/bind9/lib/bind/include/hesiod.h
index 7165d48..30c08d0 100644
--- a/contrib/bind9/lib/bind/include/hesiod.h
+++ b/contrib/bind9/lib/bind/include/hesiod.h
@@ -15,12 +15,13 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
+/*! \file 
+ * \brief
  * This file is primarily maintained by <tytso@mit.edu> and <ghudson@mit.edu>.
  */
 
 /*
- * $Id: hesiod.h,v 1.1.2.1.4.1 2004/03/09 08:33:29 marka Exp $
+ * $Id: hesiod.h,v 1.3.18.1 2005/04/27 05:00:49 sra Exp $
  */
 
 #ifndef _HESIOD_H_INCLUDED
diff --git a/contrib/bind9/lib/bind/include/irp.h b/contrib/bind9/lib/bind/include/irp.h
index 4462f20..21d8f48 100644
--- a/contrib/bind9/lib/bind/include/irp.h
+++ b/contrib/bind9/lib/bind/include/irp.h
@@ -16,16 +16,18 @@
  */
 
 /*
- * $Id: irp.h,v 1.1.2.1.4.1 2004/03/09 08:33:29 marka Exp $
+ * $Id: irp.h,v 1.3.18.1 2005/04/27 05:00:49 sra Exp $
  */
 
 #ifndef _IRP_H_INCLUDED
 #define _IRP_H_INCLUDED
 
-#define IRPD_TIMEOUT 30			/* seconds */
-#define IRPD_MAXSESS 50			/* number of simultaneous sessions. */
-#define IRPD_PORT 6660			/* 10 times the number of the beast. */
-#define IRPD_PATH "/var/run/irpd"	/* af_unix socket path */
+/*! \file */
+
+#define IRPD_TIMEOUT 30			/*%< seconds */
+#define IRPD_MAXSESS 50			/*%< number of simultaneous sessions. */
+#define IRPD_PORT 6660			/*%< 10 times the number of the beast. */
+#define IRPD_PATH "/var/run/irpd"	/*%< af_unix socket path */
 
 /* If sets the environment variable IRPDSERVER to an IP address
    (e.g. "192.5.5.1"), then that's the host the client expects irpd to be
@@ -101,3 +103,5 @@ int	irs_irp_get_full_response(struct irp_p *, int *, char *, size_t,
 int	irs_irp_read_line(struct irp_p *, char *, int);
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/irs.h b/contrib/bind9/lib/bind/include/irs.h
index a3b7903..582ba5b 100644
--- a/contrib/bind9/lib/bind/include/irs.h
+++ b/contrib/bind9/lib/bind/include/irs.h
@@ -16,12 +16,14 @@
  */
 
 /*
- * $Id: irs.h,v 1.2.2.1.4.1 2004/03/09 08:33:29 marka Exp $
+ * $Id: irs.h,v 1.4.18.1 2005/04/27 05:00:49 sra Exp $
  */
 
 #ifndef _IRS_H_INCLUDED
 #define _IRS_H_INCLUDED
 
+/*! \file */
+
 #include <sys/types.h>
 
 #include <arpa/nameser.h>
@@ -31,7 +33,7 @@
 #include <resolv.h>
 #include <pwd.h>
 
-/*
+/*%
  * This is the group map class.
  */
 struct irs_gr {
@@ -49,7 +51,7 @@ struct irs_gr {
 					void (*)(void *)));
 };
 
-/*
+/*%
  * This is the password map class.
  */
 struct irs_pw {
@@ -65,7 +67,7 @@ struct irs_pw {
 					void (*)(void *)));
 };
 
-/*
+/*%
  * This is the service map class.
  */
 struct irs_sv {
@@ -82,7 +84,7 @@ struct irs_sv {
 					void (*)(void *)));
 };
 
-/*
+/*%
  * This is the protocols map class.
  */
 struct irs_pr {
@@ -98,7 +100,7 @@ struct irs_pr {
 					void (*)(void *)));
 };
 
-/*
+/*%
  * This is the hosts map class.
  */
 struct irs_ho {
@@ -118,7 +120,7 @@ struct irs_ho {
 					  const struct addrinfo *));
 };
 
-/*
+/*%
  * This is the networks map class.
  */
 struct irs_nw {
@@ -134,7 +136,7 @@ struct irs_nw {
 					void (*)(void *)));
 };
 
-/*
+/*%
  * This is the netgroups map class.
  */
 struct irs_ng {
@@ -149,7 +151,7 @@ struct irs_ng {
 	void		(*minimize) __P((struct irs_ng *));
 };
 
-/*
+/*%
  * This is the generic map class, which copies the front of all others.
  */
 struct irs_map {
@@ -157,7 +159,7 @@ struct irs_map {
 	void		(*close) __P((void *));
 };
 
-/*
+/*%
  * This is the accessor class.  It contains pointers to all of the
  * initializers for the map classes for a particular accessor.
  */
@@ -176,21 +178,21 @@ struct irs_acc {
 					void (*)(void *)));
 };
 
-/*
+/*%
  * This is because the official definition of "struct netent" has no
  * concept of CIDR even though it allows variant address families (on
  * output but not input).  The compatibility stubs convert the structs
  * below into "struct netent"'s.
  */
 struct nwent {
-	char		*n_name;	/* official name of net */
-	char		**n_aliases;	/* alias list */
-	int		n_addrtype;	/* net address type */
-	void		*n_addr;	/* network address */
-	int		n_length;	/* address length, in bits */
+	char		*n_name;	/*%< official name of net */
+	char		**n_aliases;	/*%< alias list */
+	int		n_addrtype;	/*%< net address type */
+	void		*n_addr;	/*%< network address */
+	int		n_length;	/*%< address length, in bits */
 };
 
-/*
+/*%
  * Hide external function names from POSIX.
  */
 #define	irs_gen_acc	__irs_gen_acc
@@ -240,7 +242,7 @@ struct nwent {
 #define	net_data_destroy	__net_data_destroy
 #define	net_data_minimize	__net_data_minimize
 
-/*
+/*%
  * Externs.
  */
 extern struct irs_acc *	irs_gen_acc __P((const char *, const char *));
@@ -251,7 +253,7 @@ extern struct irs_acc *	irs_irp_acc __P((const char *));
 
 extern void		irs_destroy __P((void));
 
-/*
+/*%
  * These forward declarations are for the semi-private functions in
  * the get*.c files. Each of these funcs implements the real get*
  * functionality and the standard versions are just wrappers that
@@ -260,8 +262,7 @@ extern void		irs_destroy __P((void));
  * the /usr/include replacements.
  */
 
-struct net_data;			/* forward */
-
+struct net_data;			/*%< forward */
 /*
  * net_data_create gets a singleton net_data object.  net_data_init
  * creates as many net_data objects as times it is called.  Clients using
@@ -343,3 +344,5 @@ extern void		setservent_p __P((int, struct net_data *));
 extern void		endservent_p __P((struct net_data *));
 
 #endif /*_IRS_H_INCLUDED*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/assertions.h b/contrib/bind9/lib/bind/include/isc/assertions.h
index 9a9b9de..2ed768d 100644
--- a/contrib/bind9/lib/bind/include/isc/assertions.h
+++ b/contrib/bind9/lib/bind/include/isc/assertions.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: assertions.h,v 1.1.206.1 2004/03/09 08:33:30 marka Exp $
+ * $Id: assertions.h,v 1.2.18.1 2005/04/27 05:00:50 sra Exp $
  */
 
 #ifndef ASSERTIONS_H
@@ -118,5 +118,5 @@ const char *assertion_type_to_text(assertion_type type);
 #define INVARIANT(cond)		((void) (cond))
 #define INVARIANT_ERR(cond)	((void) (cond))
 #endif /* CHECK_INVARIANT */
-
 #endif /* ASSERTIONS_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/ctl.h b/contrib/bind9/lib/bind/include/isc/ctl.h
index 74957bc..0f6fe94 100644
--- a/contrib/bind9/lib/bind/include/isc/ctl.h
+++ b/contrib/bind9/lib/bind/include/isc/ctl.h
@@ -19,9 +19,11 @@
  */
 
 /*
- * $Id: ctl.h,v 1.1.2.2.4.1 2004/03/09 08:33:30 marka Exp $
+ * $Id: ctl.h,v 1.4.18.1 2005/04/27 05:00:51 sra Exp $
  */
 
+/*! \file */
+
 #include <sys/types.h>
 #include <sys/socket.h>
 
@@ -29,10 +31,9 @@
 
 /* Macros. */
 
-#define	CTL_MORE	0x0001	/* More will be / should be sent. */
-#define	CTL_EXIT	0x0002	/* Close connection after this. */
-#define	CTL_DATA	0x0004	/* Go into / this is DATA mode. */
-
+#define	CTL_MORE	0x0001	/*%< More will be / should be sent. */
+#define	CTL_EXIT	0x0002	/*%< Close connection after this. */
+#define	CTL_DATA	0x0004	/*%< Go into / this is DATA mode. */
 /* Types. */
 
 struct ctl_cctx;
@@ -107,3 +108,5 @@ void *			ctl_getcsctx(struct ctl_sess *);
 void *			ctl_setcsctx(struct ctl_sess *, void *);
 
 #endif /*ISC_CTL_H*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/dst.h b/contrib/bind9/lib/bind/include/isc/dst.h
index fe92297..90a9e67 100644
--- a/contrib/bind9/lib/bind/include/isc/dst.h
+++ b/contrib/bind9/lib/bind/include/isc/dst.h
@@ -3,15 +3,14 @@
 
 #ifndef HAS_DST_KEY
 typedef struct dst_key {
-	char	*dk_key_name;   /* name of the key */
-	int	dk_key_size;    /* this is the size of the key in bits */
-	int	dk_proto;       /* what protocols this key can be used for */
-	int	dk_alg;         /* algorithm number from key record */
-	u_int32_t dk_flags;     /* and the flags of the public key */
-	u_int16_t dk_id;        /* identifier of the key */
+	char	*dk_key_name;   /*%< name of the key */
+	int	dk_key_size;    /*%< this is the size of the key in bits */
+	int	dk_proto;       /*%< what protocols this key can be used for */
+	int	dk_alg;         /*%< algorithm number from key record */
+	u_int32_t dk_flags;     /*%< and the flags of the public key */
+	u_int16_t dk_id;        /*%< identifier of the key */
 } DST_KEY;
 #endif /* HAS_DST_KEY */
-
 /*
  * do not taint namespace
  */
@@ -59,58 +58,47 @@ typedef struct dst_key {
 void     dst_init(void);
 int      dst_check_algorithm(const int);
 
-int dst_sign_data(const int,	 	/* specifies INIT/UPDATE/FINAL/ALL */
-		  DST_KEY *,	 	/* the key to use */
-		  void **,	 	/* pointer to state structure */
-		  const u_char *,	/* data to be signed */
-		  const int,	 	/* length of input data */
-		  u_char *,	 	/* buffer to write signature to */
-		  const int);	 	/* size of output buffer */
-
-int dst_verify_data(const int,	 	/* specifies INIT/UPDATE/FINAL/ALL */
-		    DST_KEY *,	 	/* the key to use */
-		    void **,	 	/* pointer to state structure */
-		    const u_char *,	/* data to be verified */
-		    const int,	 	/* length of input data */
-		    const u_char *,	/* buffer containing signature */
-		    const int);	 	/* length of signature */
-
-
-DST_KEY *dst_read_key(const char *,	/* name of key */
-		      const u_int16_t,	/* key tag identifier */
-		      const int,	/* key algorithm */
-		      const int);	/* Private/PublicKey wanted*/
-
-int      dst_write_key(const DST_KEY *,	/* key to write out */
-		       const int); 	/* Public/Private */
-
-DST_KEY *dst_dnskey_to_key(const char *,	/* KEY record name */
-			   const u_char *,	/* KEY RDATA */
-			   const int);		/* size of input buffer*/
-
-
-int      dst_key_to_dnskey(const DST_KEY *,	/* key to translate */
-			   u_char *,		/* output buffer */
-			   const int);		/* size of out_storage*/
-
-
-DST_KEY *dst_buffer_to_key(const char *,  	/* name of the key */
-			   const int,	  	/* algorithm */
-			   const int,	  	/* dns flags */
-			   const int,	  	/* dns protocol */
-			   const u_char *, 	/* key in dns wire fmt */
-			   const int);	  	/* size of key */
-
 
+int dst_sign_data(const int,	 	/*!<   specifies INIT/UPDATE/FINAL/ALL  */
+		  DST_KEY *,	 	/*!<   the key to use  */
+		  void **,	 	/*!<   pointer to state structure  */
+		  const u_char *,	/*!<   data to be signed  */
+		  const int,	 	/*!<   length of input data  */
+		  u_char *,	 	/*!<   buffer to write signature to  */
+		  const int);	 	/*!<   size of output buffer  */
+int dst_verify_data(const int,	 	/*!<   specifies INIT/UPDATE/FINAL/ALL  */
+		    DST_KEY *,	 	/*!<   the key to use  */
+		    void **,	 	/*!<   pointer to state structure  */
+		    const u_char *,	/*!<   data to be verified  */
+		    const int,	 	/*!<   length of input data  */
+		    const u_char *,	/*!<   buffer containing signature  */
+		    const int);	 	/*!<   length of signature  */
+DST_KEY *dst_read_key(const char *,	/*!<   name of key  */
+		      const u_int16_t,	/*!<   key tag identifier  */
+		      const int,	/*!<   key algorithm  */
+		      const int);	/*!<   Private/PublicKey wanted */
+int      dst_write_key(const DST_KEY *,	/*!<   key to write out  */
+		       const int); 	/*!<   Public/Private  */
+DST_KEY *dst_dnskey_to_key(const char *,	/*!<   KEY record name  */
+			   const u_char *,	/*!<   KEY RDATA  */
+			   const int);		/*!<   size of input buffer */
+int      dst_key_to_dnskey(const DST_KEY *,	/*!<   key to translate  */
+			   u_char *,		/*!<   output buffer  */
+			   const int);		/*!<   size of out_storage */
+DST_KEY *dst_buffer_to_key(const char *,  	/*!<   name of the key  */
+			   const int,	  	/*!<   algorithm  */
+			   const int,	  	/*!<   dns flags  */
+			   const int,	  	/*!<   dns protocol  */
+			   const u_char *, 	/*!<   key in dns wire fmt  */
+			   const int);	  	/*!<   size of key  */
 int     dst_key_to_buffer(DST_KEY *, u_char *, int);
 
-DST_KEY *dst_generate_key(const char *,    	/* name of new key */
-			  const int,       	/* key algorithm to generate */
-			  const int,      	/* size of new key */
-			  const int,       	/* alg dependent parameter*/
-			  const int,     	/* key DNS flags */
-			  const int);		/* key DNS protocol */
-
+DST_KEY *dst_generate_key(const char *,    	/*!<   name of new key  */
+			  const int,       	/*!<   key algorithm to generate  */
+			  const int,      	/*!<   size of new key  */
+			  const int,       	/*!<   alg dependent parameter */
+			  const int,     	/*!<   key DNS flags  */
+			  const int);		/*!<   key DNS protocol  */
 DST_KEY *dst_free_key(DST_KEY *);
 int      dst_compare_keys(const DST_KEY *, const DST_KEY *);
 
@@ -122,13 +110,12 @@ u_int16_t dst_s_dns_key_id(const u_char *, const int);
 u_int16_t dst_s_id_calc(const u_char *, const int);
 
 /* Used by callers as well as by the library.  */
-#define RAW_KEY_SIZE    8192        /* large enough to store any key */
-
+#define RAW_KEY_SIZE    8192        /*%< large enough to store any key */
 /* DST_API control flags */
 /* These are used used in functions dst_sign_data and dst_verify_data */
-#define SIG_MODE_INIT		1  /* initialize digest */
-#define SIG_MODE_UPDATE		2  /* add data to digest */
-#define SIG_MODE_FINAL		4  /* generate/verify signature */
+#define SIG_MODE_INIT		1  /*%< initialize digest */
+#define SIG_MODE_UPDATE		2  /*%< add data to digest */
+#define SIG_MODE_FINAL		4  /*%< generate/verify signature */
 #define SIG_MODE_ALL		(SIG_MODE_INIT|SIG_MODE_UPDATE|SIG_MODE_FINAL)
 
 /* Flags for dst_read_private_key()  */
@@ -178,3 +165,4 @@ u_int16_t dst_s_id_calc(const u_char *, const int);
 #define UNSUPPORTED_KEYALG	(-31)
 
 #endif /* DST_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/eventlib.h b/contrib/bind9/lib/bind/include/isc/eventlib.h
index 033b312..598c71c 100644
--- a/contrib/bind9/lib/bind/include/isc/eventlib.h
+++ b/contrib/bind9/lib/bind/include/isc/eventlib.h
@@ -18,7 +18,7 @@
 /* eventlib.h - exported interfaces for eventlib
  * vix 09sep95 [initial]
  *
- * $Id: eventlib.h,v 1.1.2.1.4.2 2005/07/28 07:43:18 marka Exp $
+ * $Id: eventlib.h,v 1.3.18.2 2005/07/28 07:38:07 marka Exp $
  */
 
 #ifndef _EVENTLIB_H
@@ -200,3 +200,5 @@ int evDefer __P((evContext, evWaitFunc, void *));
 #endif
 
 #endif /*_EVENTLIB_H*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/heap.h b/contrib/bind9/lib/bind/include/isc/heap.h
index 691c821..384d507 100644
--- a/contrib/bind9/lib/bind/include/isc/heap.h
+++ b/contrib/bind9/lib/bind/include/isc/heap.h
@@ -45,3 +45,5 @@ int		heap_increased(heap_context, int);
 int		heap_decreased(heap_context, int);
 void *		heap_element(heap_context, int);
 int		heap_for_each(heap_context, heap_for_each_func, void *);
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/irpmarshall.h b/contrib/bind9/lib/bind/include/isc/irpmarshall.h
index e672f97..ef57701 100644
--- a/contrib/bind9/lib/bind/include/isc/irpmarshall.h
+++ b/contrib/bind9/lib/bind/include/isc/irpmarshall.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: irpmarshall.h,v 1.1.2.1.4.1 2004/03/09 08:33:31 marka Exp $
+ * $Id: irpmarshall.h,v 1.3.18.1 2005/04/27 05:00:51 sra Exp $
  */
 
 #ifndef _IRPMARSHALL_H_INCLUDED
@@ -63,7 +63,8 @@ int irp_unmarshall_nw(struct nwent *, char *);
 int irp_marshall_ne(struct netent *, char **, size_t *);
 int irp_unmarshall_ne(struct netent *, char *);
 
-/*
+/*! \file
+ * \brief
  * Functions to marshall and unmarshall various system data structures. We
  * use a printable ascii format that is as close to various system config
  * files as reasonable (e.g. /etc/passwd format).
@@ -79,9 +80,7 @@ int irp_unmarshall_ne(struct netent *, char *);
  *
  * The following description is true for all the marshalling functions:
  *
- */
-
-/* int irp_marshall_XX(struct yyyy *XX, char **buffer, size_t *len);
+ * int irp_marshall_XX(struct yyyy *XX, char **buffer, size_t *len);
  *
  * The argument XX (of type struct passwd for example) is marshalled in the
  * buffer pointed at by *BUFFER, which is of length *LEN. Returns 0
@@ -101,9 +100,7 @@ int irp_unmarshall_ne(struct netent *, char *);
  * to separate fields). Fields that have multiple subfields (like the
  * gr_mem field in struct group) have their subparts separated by
  * commas.
- */
-
-/*
+ *
  * int irp_unmarshall_XX(struct YYYYY *XX, char *buffer);
  *
  * The unmashalling functions break apart the buffer and store the
diff --git a/contrib/bind9/lib/bind/include/isc/list.h b/contrib/bind9/lib/bind/include/isc/list.h
index 4e27eb1..c85c667 100644
--- a/contrib/bind9/lib/bind/include/isc/list.h
+++ b/contrib/bind9/lib/bind/include/isc/list.h
@@ -114,3 +114,4 @@
 #define DEQUEUE(list, elt, link) UNLINK(list, elt, link)
 
 #endif /* LIST_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/logging.h b/contrib/bind9/lib/bind/include/isc/logging.h
index 574fd8a..c539443 100644
--- a/contrib/bind9/lib/bind/include/isc/logging.h
+++ b/contrib/bind9/lib/bind/include/isc/logging.h
@@ -110,3 +110,4 @@ int			log_free_channel(log_channel);
 void			log_close_debug_channels(log_context);
 
 #endif /* !LOGGING_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/memcluster.h b/contrib/bind9/lib/bind/include/isc/memcluster.h
index 11e1fa3..0923deb 100644
--- a/contrib/bind9/lib/bind/include/isc/memcluster.h
+++ b/contrib/bind9/lib/bind/include/isc/memcluster.h
@@ -47,3 +47,4 @@ void 	memstats(FILE *);
 int	memactive(void);
 
 #endif /* MEMCLUSTER_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/misc.h b/contrib/bind9/lib/bind/include/isc/misc.h
index b08b02d..d2e98ac 100644
--- a/contrib/bind9/lib/bind/include/isc/misc.h
+++ b/contrib/bind9/lib/bind/include/isc/misc.h
@@ -16,12 +16,14 @@
  */
 
 /*
- * $Id: misc.h,v 1.2.2.1.4.1 2004/03/09 08:33:31 marka Exp $
+ * $Id: misc.h,v 1.4.18.1 2005/04/27 05:00:52 sra Exp $
  */
 
 #ifndef _ISC_MISC_H
 #define _ISC_MISC_H
 
+/*! \file */
+
 #include <stdio.h>
 
 #define	bitncmp		__bitncmp
@@ -37,3 +39,5 @@ extern void		isc_puthexstring(FILE *, const unsigned char *, size_t,
 extern void		isc_tohex(const unsigned char *, size_t, char *);
 
 #endif /*_ISC_MISC_H*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/isc/tree.h b/contrib/bind9/lib/bind/include/isc/tree.h
index 0572c40..8096a8d 100644
--- a/contrib/bind9/lib/bind/include/isc/tree.h
+++ b/contrib/bind9/lib/bind/include/isc/tree.h
@@ -3,7 +3,7 @@
  * vix 22jan93 [revisited; uses RCS, ANSI, POSIX; has bug fixes]
  * vix 27jun86 [broken out of tree.c]
  *
- * $Id: tree.h,v 1.1.2.1 2003/06/27 03:51:39 marka Exp $
+ * $Id: tree.h,v 1.2.164.1 2005/04/27 05:00:52 sra Exp $
  */
 
 
@@ -19,7 +19,7 @@
 # endif
 #endif
 
-/*
+/*%
  * tree_t is our package-specific anonymous pointer.
  */
 #if defined(__STDC__) || defined(__GNUC__)
@@ -28,7 +28,7 @@ typedef	void *tree_t;
 typedef	char *tree_t;
 #endif
 
-/*
+/*%
  * Do not taint namespace
  */
 #define	tree_add	__tree_add
@@ -56,3 +56,4 @@ void	tree_mung	__P((tree **, void (*)()));
 
 
 #endif	/* _TREE_H_INCLUDED */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/netdb.h b/contrib/bind9/lib/bind/include/netdb.h
index 11ee8a5..66dd13d 100644
--- a/contrib/bind9/lib/bind/include/netdb.h
+++ b/contrib/bind9/lib/bind/include/netdb.h
@@ -86,7 +86,7 @@
 
 /*
  *      @(#)netdb.h	8.1 (Berkeley) 6/2/93
- *	$Id: netdb.h,v 1.12.2.1.4.9 2006/10/02 01:20:30 marka Exp $
+ *	$Id: netdb.h,v 1.15.18.6 2006/10/02 01:23:09 marka Exp $
  */
 
 #ifndef _NETDB_H_
@@ -131,99 +131,98 @@ __END_DECLS
 extern int h_errno;
 #endif
 
-/*
+/*%
  * Structures returned by network data base library.  All addresses are
  * supplied in host order, and returned in network order (suitable for
  * use in system calls).
  */
 struct	hostent {
-	char	*h_name;	/* official name of host */
-	char	**h_aliases;	/* alias list */
-	int	h_addrtype;	/* host address type */
-	int	h_length;	/* length of address */
-	char	**h_addr_list;	/* list of addresses from name server */
-#define	h_addr	h_addr_list[0]	/* address, for backward compatiblity */
+	char	*h_name;	/*%< official name of host */
+	char	**h_aliases;	/*%< alias list */
+	int	h_addrtype;	/*%< host address type */
+	int	h_length;	/*%< length of address */
+	char	**h_addr_list;	/*%< list of addresses from name server */
+#define	h_addr	h_addr_list[0]	/*%< address, for backward compatiblity */
 };
 
-/*
+/*%
  * Assumption here is that a network number
  * fits in an unsigned long -- probably a poor one.
  */
 struct	netent {
-	char		*n_name;	/* official name of net */
-	char		**n_aliases;	/* alias list */
-	int		n_addrtype;	/* net address type */
-	unsigned long	n_net;		/* network # */
+	char		*n_name;	/*%< official name of net */
+	char		**n_aliases;	/*%< alias list */
+	int		n_addrtype;	/*%< net address type */
+	unsigned long	n_net;		/*%< network # */
 };
 
 struct	servent {
-	char	*s_name;	/* official service name */
-	char	**s_aliases;	/* alias list */
-	int	s_port;		/* port # */
-	char	*s_proto;	/* protocol to use */
+	char	*s_name;	/*%< official service name */
+	char	**s_aliases;	/*%< alias list */
+	int	s_port;		/*%< port # */
+	char	*s_proto;	/*%< protocol to use */
 };
 
 struct	protoent {
-	char	*p_name;	/* official protocol name */
-	char	**p_aliases;	/* alias list */
-	int	p_proto;	/* protocol # */
+	char	*p_name;	/*%< official protocol name */
+	char	**p_aliases;	/*%< alias list */
+	int	p_proto;	/*%< protocol # */
 };
 
 struct	addrinfo {
-	int		ai_flags;	/* AI_PASSIVE, AI_CANONNAME */
-	int		ai_family;	/* PF_xxx */
-	int		ai_socktype;	/* SOCK_xxx */
-	int		ai_protocol;	/* 0 or IPPROTO_xxx for IPv4 and IPv6 */
+	int		ai_flags;	/*%< AI_PASSIVE, AI_CANONNAME */
+	int		ai_family;	/*%< PF_xxx */
+	int		ai_socktype;	/*%< SOCK_xxx */
+	int		ai_protocol;	/*%< 0 or IPPROTO_xxx for IPv4 and IPv6 */
 #if defined(sun) && defined(_SOCKLEN_T)
 #ifdef __sparcv9
 	int		_ai_pad;
 #endif
 	socklen_t	ai_addrlen;
 #else
-	size_t		ai_addrlen;	/* length of ai_addr */
+	size_t		ai_addrlen;	/*%< length of ai_addr */
 #endif
 #ifdef __linux
-	struct sockaddr	*ai_addr; 	/* binary address */
-	char		*ai_canonname;	/* canonical name for hostname */
+	struct sockaddr	*ai_addr; 	/*%< binary address */
+	char		*ai_canonname;	/*%< canonical name for hostname */
 #else
-	char		*ai_canonname;	/* canonical name for hostname */
-	struct sockaddr	*ai_addr; 	/* binary address */
+	char		*ai_canonname;	/*%< canonical name for hostname */
+	struct sockaddr	*ai_addr; 	/*%< binary address */
 #endif
-	struct addrinfo	*ai_next; 	/* next structure in linked list */
+	struct addrinfo	*ai_next; 	/*%< next structure in linked list */
 };
 
-/*
+/*%
  * Error return codes from gethostbyname() and gethostbyaddr()
  * (left in extern int h_errno).
  */
 
-#define	NETDB_INTERNAL	-1	/* see errno */
-#define	NETDB_SUCCESS	0	/* no problem */
-#define	HOST_NOT_FOUND	1 /* Authoritative Answer Host not found */
-#define	TRY_AGAIN	2 /* Non-Authoritive Host not found, or SERVERFAIL */
-#define	NO_RECOVERY	3 /* Non recoverable errors, FORMERR, REFUSED, NOTIMP */
-#define	NO_DATA		4 /* Valid name, no data record of requested type */
-#define	NO_ADDRESS	NO_DATA		/* no address, look for MX record */
-
+#define	NETDB_INTERNAL	-1	/*%< see errno */
+#define	NETDB_SUCCESS	0	/*%< no problem */
+#define	HOST_NOT_FOUND	1 /*%< Authoritative Answer Host not found */
+#define	TRY_AGAIN	2 /*%< Non-Authoritive Host not found, or SERVERFAIL */
+#define	NO_RECOVERY	3 /*%< Non recoverable errors, FORMERR, REFUSED, NOTIMP */
+#define	NO_DATA		4 /*%< Valid name, no data record of requested type */
+#define	NO_ADDRESS	NO_DATA		/*%< no address, look for MX record */
 /*
  * Error return codes from getaddrinfo()
  */
-#define	EAI_ADDRFAMILY	 1	/* address family for hostname not supported */
-#define	EAI_AGAIN	 2	/* temporary failure in name resolution */
-#define	EAI_BADFLAGS	 3	/* invalid value for ai_flags */
-#define	EAI_FAIL	 4	/* non-recoverable failure in name resolution */
-#define	EAI_FAMILY	 5	/* ai_family not supported */
-#define	EAI_MEMORY	 6	/* memory allocation failure */
-#define	EAI_NODATA	 7	/* no address associated with hostname */
-#define	EAI_NONAME	 8	/* hostname nor servname provided, or not known */
-#define	EAI_SERVICE	 9	/* servname not supported for ai_socktype */
-#define	EAI_SOCKTYPE	10	/* ai_socktype not supported */
-#define	EAI_SYSTEM	11	/* system error returned in errno */
+#define	EAI_ADDRFAMILY	 1	/*%< address family for hostname not supported */
+#define	EAI_AGAIN	 2	/*%< temporary failure in name resolution */
+#define	EAI_BADFLAGS	 3	/*%< invalid value for ai_flags */
+#define	EAI_FAIL	 4	/*%< non-recoverable failure in name resolution */
+#define	EAI_FAMILY	 5	/*%< ai_family not supported */
+#define	EAI_MEMORY	 6	/*%< memory allocation failure */
+#define	EAI_NODATA	 7	/*%< no address associated with hostname */
+#define	EAI_NONAME	 8	/*%< hostname nor servname provided, or not known */
+#define	EAI_SERVICE	 9	/*%< servname not supported for ai_socktype */
+#define	EAI_SOCKTYPE	10	/*%< ai_socktype not supported */
+#define	EAI_SYSTEM	11	/*%< system error returned in errno */
 #define EAI_BADHINTS	12
 #define EAI_PROTOCOL	13
 #define EAI_MAX		14
 
-/*
+/*%
  * Flag values for getaddrinfo()
  */
 #define	AI_PASSIVE	0x00000001
@@ -231,7 +230,7 @@ struct	addrinfo {
 #define AI_NUMERICHOST	0x00000004
 #define	AI_MASK		0x00000007
 
-/*
+/*%
  * Flag values for getipnodebyname()
  */
 #define AI_V4MAPPED	0x00000008
@@ -239,13 +238,13 @@ struct	addrinfo {
 #define AI_ADDRCONFIG	0x00000020
 #define AI_DEFAULT	(AI_V4MAPPED|AI_ADDRCONFIG)
 
-/*
+/*%
  * Constants for getnameinfo()
  */
 #define	NI_MAXHOST	1025
 #define	NI_MAXSERV	32
 
-/*
+/*%
  * Flag values for getnameinfo()
  */
 #define	NI_NOFQDN	0x00000001
@@ -256,7 +255,7 @@ struct	addrinfo {
 #define	NI_WITHSCOPEID	0x00000020
 #define NI_NUMERICSCOPE	0x00000040
 
-/*
+/*%
  * Scope delimit character
  */
 #define SCOPE_DELIMITER	'%'
@@ -572,12 +571,12 @@ __END_DECLS
 #include <rpc/netdb.h>
 #else
 struct rpcent {
-	char	*r_name;	/* name of server for this rpc program */
-	char	**r_aliases;	/* alias list */
-	int	r_number;	/* rpc program number */
+	char	*r_name;	/*%< name of server for this rpc program */
+	char	**r_aliases;	/*%< alias list */
+	int	r_number;	/*%< rpc program number */
 };
 struct rpcent	*getrpcbyname(), *getrpcbynumber(), *getrpcent();
 #endif /* __GNU_LIBRARY__ */
 #endif /* sun */
-
 #endif /* !_NETDB_H_ */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/netgroup.h b/contrib/bind9/lib/bind/include/netgroup.h
index 2296208..e4be459 100644
--- a/contrib/bind9/lib/bind/include/netgroup.h
+++ b/contrib/bind9/lib/bind/include/netgroup.h
@@ -22,3 +22,5 @@ int innetgr __P((const char *, const char *, const char *, const char *));
 #endif
 #endif
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/res_update.h b/contrib/bind9/lib/bind/include/res_update.h
index 07a37f3..2e6f171 100644
--- a/contrib/bind9/lib/bind/include/res_update.h
+++ b/contrib/bind9/lib/bind/include/res_update.h
@@ -16,34 +16,36 @@
  */
 
 /*
- *	$Id: res_update.h,v 1.1.206.1 2004/03/09 08:33:29 marka Exp $
+ *	$Id: res_update.h,v 1.2.18.1 2005/04/27 05:00:49 sra Exp $
  */
 
 #ifndef __RES_UPDATE_H
 #define __RES_UPDATE_H
 
+/*! \file */
+
 #include <sys/types.h>
 #include <arpa/nameser.h>
 #include <isc/list.h>
 #include <resolv.h>
 
-/*
+/*%
  * This RR-like structure is particular to UPDATE.
  */
 struct ns_updrec {
 	LINK(struct ns_updrec) r_link, r_glink;
-	ns_sect		r_section;	/* ZONE/PREREQUISITE/UPDATE */
-	char *		r_dname;	/* owner of the RR */
-	ns_class	r_class;	/* class number */
-	ns_type		r_type;		/* type number */
-	u_int32_t	r_ttl;		/* time to live */
-	u_char *	r_data;		/* rdata fields as text string */
-	u_int		r_size;		/* size of r_data field */
-	int		r_opcode;	/* type of operation */
+	ns_sect		r_section;	/*%< ZONE/PREREQUISITE/UPDATE */
+	char *		r_dname;	/*%< owner of the RR */
+	ns_class	r_class;	/*%< class number */
+	ns_type		r_type;		/*%< type number */
+	u_int32_t	r_ttl;		/*%< time to live */
+	u_char *	r_data;		/*%< rdata fields as text string */
+	u_int		r_size;		/*%< size of r_data field */
+	int		r_opcode;	/*%< type of operation */
 	/* following fields for private use by the resolver/server routines */
-	struct databuf *r_dp;		/* databuf to process */
-	struct databuf *r_deldp;	/* databuf's deleted/overwritten */
-	u_int		r_zone;		/* zone number on server */
+	struct databuf *r_dp;		/*%< databuf to process */
+	struct databuf *r_deldp;	/*%< databuf's deleted/overwritten */
+	u_int		r_zone;		/*%< zone number on server */
 };
 typedef struct ns_updrec ns_updrec;
 typedef	LIST(ns_updrec)	ns_updque;
@@ -63,3 +65,5 @@ int		res_nmkupdate __P((res_state, ns_updrec *, u_char *, int));
 int		res_nupdate __P((res_state, ns_updrec *, ns_tsig_key *));
 
 #endif /*__RES_UPDATE_H*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/include/resolv.h b/contrib/bind9/lib/bind/include/resolv.h
index 87a9520..66d84fc 100644
--- a/contrib/bind9/lib/bind/include/resolv.h
+++ b/contrib/bind9/lib/bind/include/resolv.h
@@ -48,9 +48,9 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
+/*%
  *	@(#)resolv.h	8.1 (Berkeley) 6/2/93
- *	$Id: resolv.h,v 1.7.2.11.4.3 2005/08/25 04:44:13 marka Exp $
+ *	$Id: resolv.h,v 1.19.18.3 2005/08/25 04:43:51 marka Exp $
  */
 
 #ifndef _RESOLV_H_
@@ -67,7 +67,7 @@
 #include <stdio.h>
 #include <arpa/nameser.h>
 
-/*
+/*%
  * Revision information.  This is the release date in YYYYMMDD format.
  * It can change every day so the right thing to do with it is use it
  * in preprocessor commands such as "#if (__RES > 19931104)".  Do not
@@ -77,7 +77,7 @@
 
 #define	__RES	20030124
 
-/*
+/*%
  * This used to be defined in res_query.c, now it's in herror.c.
  * [XXX no it's not.  It's in irs/irs_data.c]
  * It was
@@ -97,12 +97,12 @@
  */
 
 #define RES_SET_H_ERRNO(r,x) __h_errno_set(r,x)
-struct __res_state; /* forward */
+struct __res_state; /*%< forward */
 __BEGIN_DECLS
 void __h_errno_set(struct __res_state *res, int err);
 __END_DECLS
 
-/*
+/*%
  * Resolver configuration file.
  * Normally not present, but may contain the address of the
  * initial name server(s) to query and the domain search list.
@@ -132,70 +132,68 @@ typedef res_sendhookact (*res_send_rhook)__PMT((const struct sockaddr *,
 						int, int *));
 
 struct res_sym {
-	int		number;	   /* Identifying number, like T_MX */
-	const char *	name;	   /* Its symbolic name, like "MX" */
-	const char *	humanname; /* Its fun name, like "mail exchanger" */
+	int		number;	   /*%< Identifying number, like T_MX */
+	const char *	name;	   /*%< Its symbolic name, like "MX" */
+	const char *	humanname; /*%< Its fun name, like "mail exchanger" */
 };
 
-/*
+/*%
  * Global defines and variables for resolver stub.
  */
-#define	MAXNS			3	/* max # name servers we'll track */
-#define	MAXDFLSRCH		3	/* # default domain levels to try */
-#define	MAXDNSRCH		6	/* max # domains in search path */
-#define	LOCALDOMAINPARTS	2	/* min levels in name that is "local" */
-
-#define	RES_TIMEOUT		5	/* min. seconds between retries */
-#define	MAXRESOLVSORT		10	/* number of net to sort on */
-#define	RES_MAXNDOTS		15	/* should reflect bit field size */
-#define	RES_MAXRETRANS		30	/* only for resolv.conf/RES_OPTIONS */
-#define	RES_MAXRETRY		5	/* only for resolv.conf/RES_OPTIONS */
-#define	RES_DFLRETRY		2	/* Default #/tries. */
-#define	RES_MAXTIME		65535	/* Infinity, in milliseconds. */
-
+#define	MAXNS			3	/*%< max # name servers we'll track */
+#define	MAXDFLSRCH		3	/*%< # default domain levels to try */
+#define	MAXDNSRCH		6	/*%< max # domains in search path */
+#define	LOCALDOMAINPARTS	2	/*%< min levels in name that is "local" */
+#define	RES_TIMEOUT		5	/*%< min. seconds between retries */
+#define	MAXRESOLVSORT		10	/*%< number of net to sort on */
+#define	RES_MAXNDOTS		15	/*%< should reflect bit field size */
+#define	RES_MAXRETRANS		30	/*%< only for resolv.conf/RES_OPTIONS */
+#define	RES_MAXRETRY		5	/*%< only for resolv.conf/RES_OPTIONS */
+#define	RES_DFLRETRY		2	/*%< Default #/tries. */
+#define	RES_MAXTIME		65535	/*%< Infinity, in milliseconds. */
 struct __res_state_ext;
 
 struct __res_state {
-	int	retrans;	 	/* retransmission time interval */
-	int	retry;			/* number of times to retransmit */
+	int	retrans;	 	/*%< retransmission time interval */
+	int	retry;			/*%< number of times to retransmit */
 #ifdef sun
-	u_int	options;		/* option flags - see below. */
+	u_int	options;		/*%< option flags - see below. */
 #else
-	u_long	options;		/* option flags - see below. */
+	u_long	options;		/*%< option flags - see below. */
 #endif
-	int	nscount;		/* number of name servers */
+	int	nscount;		/*%< number of name servers */
 	struct sockaddr_in
-		nsaddr_list[MAXNS];	/* address of name server */
-#define	nsaddr	nsaddr_list[0]		/* for backward compatibility */
-	u_short	id;			/* current message id */
-	char	*dnsrch[MAXDNSRCH+1];	/* components of domain to search */
-	char	defdname[256];		/* default domain (deprecated) */
+		nsaddr_list[MAXNS];	/*%< address of name server */
+#define	nsaddr	nsaddr_list[0]		/*%< for backward compatibility */
+	u_short	id;			/*%< current message id */
+	char	*dnsrch[MAXDNSRCH+1];	/*%< components of domain to search */
+	char	defdname[256];		/*%< default domain (deprecated) */
 #ifdef sun
-	u_int	pfcode;			/* RES_PRF_ flags - see below. */
+	u_int	pfcode;			/*%< RES_PRF_ flags - see below. */
 #else
-	u_long	pfcode;			/* RES_PRF_ flags - see below. */
+	u_long	pfcode;			/*%< RES_PRF_ flags - see below. */
 #endif
-	unsigned ndots:4;		/* threshold for initial abs. query */
-	unsigned nsort:4;		/* number of elements in sort_list[] */
+	unsigned ndots:4;		/*%< threshold for initial abs. query */
+	unsigned nsort:4;		/*%< number of elements in sort_list[] */
 	char	unused[3];
 	struct {
 		struct in_addr	addr;
 		u_int32_t	mask;
 	} sort_list[MAXRESOLVSORT];
-	res_send_qhook qhook;		/* query hook */
-	res_send_rhook rhook;		/* response hook */
-	int	res_h_errno;		/* last one set for this context */
-	int	_vcsock;		/* PRIVATE: for res_send VC i/o */
-	u_int	_flags;			/* PRIVATE: see below */
-	u_int	_pad;			/* make _u 64 bit aligned */
+	res_send_qhook qhook;		/*%< query hook */
+	res_send_rhook rhook;		/*%< response hook */
+	int	res_h_errno;		/*%< last one set for this context */
+	int	_vcsock;		/*%< PRIVATE: for res_send VC i/o */
+	u_int	_flags;			/*%< PRIVATE: see below */
+	u_int	_pad;			/*%< make _u 64 bit aligned */
 	union {
 		/* On an 32-bit arch this means 512b total. */
 		char	pad[72 - 4*sizeof (int) - 2*sizeof (void *)];
 		struct {
 			u_int16_t		nscount;
-			u_int16_t		nstimes[MAXNS];	/* ms. */
+			u_int16_t		nstimes[MAXNS];	/*%< ms. */
 			int			nssocks[MAXNS];
-			struct __res_state_ext *ext;	/* extention for IPv6 */
+			struct __res_state_ext *ext;	/*%< extention for IPv6 */
 		} _ext;
 	} _u;
 };
@@ -208,62 +206,62 @@ union res_sockaddr_union {
 	struct sockaddr_in6	sin6;
 #endif
 #ifdef ISC_ALIGN64
-	int64_t			__align64;	/* 64bit alignment */
+	int64_t			__align64;	/*%< 64bit alignment */
 #else
-	int32_t			__align32;	/* 32bit alignment */
+	int32_t			__align32;	/*%< 32bit alignment */
 #endif
-	char			__space[128];   /* max size */
+	char			__space[128];   /*%< max size */
 };
 
-/*
+/*%
  * Resolver flags (used to be discrete per-module statics ints).
  */
-#define	RES_F_VC	0x00000001	/* socket is TCP */
-#define	RES_F_CONN	0x00000002	/* socket is connected */
-#define	RES_F_EDNS0ERR	0x00000004	/* EDNS0 caused errors */
-#define	RES_F__UNUSED	0x00000008	/* (unused) */
-#define	RES_F_LASTMASK	0x000000F0	/* ordinal server of last res_nsend */
-#define	RES_F_LASTSHIFT	4		/* bit position of LASTMASK "flag" */
+#define	RES_F_VC	0x00000001	/*%< socket is TCP */
+#define	RES_F_CONN	0x00000002	/*%< socket is connected */
+#define	RES_F_EDNS0ERR	0x00000004	/*%< EDNS0 caused errors */
+#define	RES_F__UNUSED	0x00000008	/*%< (unused) */
+#define	RES_F_LASTMASK	0x000000F0	/*%< ordinal server of last res_nsend */
+#define	RES_F_LASTSHIFT	4		/*%< bit position of LASTMASK "flag" */
 #define	RES_GETLAST(res) (((res)._flags & RES_F_LASTMASK) >> RES_F_LASTSHIFT)
 
 /* res_findzonecut2() options */
-#define	RES_EXHAUSTIVE	0x00000001	/* always do all queries */
-#define	RES_IPV4ONLY	0x00000002	/* IPv4 only */
-#define	RES_IPV6ONLY	0x00000004	/* IPv6 only */
+#define	RES_EXHAUSTIVE	0x00000001	/*%< always do all queries */
+#define	RES_IPV4ONLY	0x00000002	/*%< IPv4 only */
+#define	RES_IPV6ONLY	0x00000004	/*%< IPv6 only */
 
-/*
+/*%
  * Resolver options (keep these in synch with res_debug.c, please)
  */
-#define RES_INIT	0x00000001	/* address initialized */
-#define RES_DEBUG	0x00000002	/* print debug messages */
-#define RES_AAONLY	0x00000004	/* authoritative answers only (!IMPL)*/
-#define RES_USEVC	0x00000008	/* use virtual circuit */
-#define RES_PRIMARY	0x00000010	/* query primary server only (!IMPL) */
-#define RES_IGNTC	0x00000020	/* ignore trucation errors */
-#define RES_RECURSE	0x00000040	/* recursion desired */
-#define RES_DEFNAMES	0x00000080	/* use default domain name */
-#define RES_STAYOPEN	0x00000100	/* Keep TCP socket open */
-#define RES_DNSRCH	0x00000200	/* search up local domain tree */
-#define	RES_INSECURE1	0x00000400	/* type 1 security disabled */
-#define	RES_INSECURE2	0x00000800	/* type 2 security disabled */
-#define	RES_NOALIASES	0x00001000	/* shuts off HOSTALIASES feature */
-#define	RES_USE_INET6	0x00002000	/* use/map IPv6 in gethostbyname() */
-#define RES_ROTATE	0x00004000	/* rotate ns list after each query */
-#define	RES_NOCHECKNAME	0x00008000	/* do not check names for sanity. */
-#define	RES_KEEPTSIG	0x00010000	/* do not strip TSIG records */
-#define	RES_BLAST	0x00020000	/* blast all recursive servers */
-#define RES_NOTLDQUERY	0x00100000	/* don't unqualified name as a tld */
-#define RES_USE_DNSSEC	0x00200000	/* use DNSSEC using OK bit in OPT */
+#define RES_INIT	0x00000001	/*%< address initialized */
+#define RES_DEBUG	0x00000002	/*%< print debug messages */
+#define RES_AAONLY	0x00000004	/*%< authoritative answers only (!IMPL)*/
+#define RES_USEVC	0x00000008	/*%< use virtual circuit */
+#define RES_PRIMARY	0x00000010	/*%< query primary server only (!IMPL) */
+#define RES_IGNTC	0x00000020	/*%< ignore trucation errors */
+#define RES_RECURSE	0x00000040	/*%< recursion desired */
+#define RES_DEFNAMES	0x00000080	/*%< use default domain name */
+#define RES_STAYOPEN	0x00000100	/*%< Keep TCP socket open */
+#define RES_DNSRCH	0x00000200	/*%< search up local domain tree */
+#define	RES_INSECURE1	0x00000400	/*%< type 1 security disabled */
+#define	RES_INSECURE2	0x00000800	/*%< type 2 security disabled */
+#define	RES_NOALIASES	0x00001000	/*%< shuts off HOSTALIASES feature */
+#define	RES_USE_INET6	0x00002000	/*%< use/map IPv6 in gethostbyname() */
+#define RES_ROTATE	0x00004000	/*%< rotate ns list after each query */
+#define	RES_NOCHECKNAME	0x00008000	/*%< do not check names for sanity. */
+#define	RES_KEEPTSIG	0x00010000	/*%< do not strip TSIG records */
+#define	RES_BLAST	0x00020000	/*%< blast all recursive servers */
+#define RES_NOTLDQUERY	0x00100000	/*%< don't unqualified name as a tld */
+#define RES_USE_DNSSEC	0x00200000	/*%< use DNSSEC using OK bit in OPT */
 /* #define RES_DEBUG2	0x00400000 */	/* nslookup internal */
 /* KAME extensions: use higher bit to avoid conflict with ISC use */
-#define RES_USE_DNAME	0x10000000	/* use DNAME */
-#define RES_USE_EDNS0	0x40000000	/* use EDNS0 if configured */
-#define RES_NO_NIBBLE2	0x80000000	/* disable alternate nibble lookup */
+#define RES_USE_DNAME	0x10000000	/*%< use DNAME */
+#define RES_USE_EDNS0	0x40000000	/*%< use EDNS0 if configured */
+#define RES_NO_NIBBLE2	0x80000000	/*%< disable alternate nibble lookup */
 
 #define RES_DEFAULT	(RES_RECURSE | RES_DEFNAMES | \
 			 RES_DNSRCH | RES_NO_NIBBLE2)
 
-/*
+/*%
  * Resolver "pfcode" values.  Used by dig.
  */
 #define RES_PRF_STATS	0x00000001
@@ -504,3 +502,4 @@ int		res_getservers __P((res_state,
 __END_DECLS
 
 #endif /* !_RESOLV_H_ */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/Makefile.in b/contrib/bind9/lib/bind/inet/Makefile.in
index 96698fd..7eb297c 100644
--- a/contrib/bind9/lib/bind/inet/Makefile.in
+++ b/contrib/bind9/lib/bind/inet/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.206.1 2004/03/06 08:13:23 marka Exp $
+# $Id: Makefile.in,v 1.5 2004/03/05 05:05:13 marka Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/inet/inet_addr.c b/contrib/bind9/lib/bind/inet/inet_addr.c
index b967dc2..c95622d 100644
--- a/contrib/bind9/lib/bind/inet/inet_addr.c
+++ b/contrib/bind9/lib/bind/inet/inet_addr.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)inet_addr.c	8.1 (Berkeley) 6/17/93";
-static const char rcsid[] = "$Id: inet_addr.c,v 1.2.206.2 2004/03/17 00:29:45 marka Exp $";
+static const char rcsid[] = "$Id: inet_addr.c,v 1.4.18.1 2005/04/27 05:00:52 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -85,7 +85,7 @@ static const char rcsid[] = "$Id: inet_addr.c,v 1.2.206.2 2004/03/17 00:29:45 ma
 
 #include "port_after.h"
 
-/*
+/*%
  * Ascii internet address interpretation routine.
  * The value returned is in network order.
  */
@@ -98,7 +98,7 @@ inet_addr(const char *cp) {
 	return (INADDR_NONE);
 }
 
-/* 
+/*%
  * Check whether "cp" is a valid ascii representation
  * of an Internet address and convert to a binary address.
  * Returns 1 if the address is valid, 0 if not.
@@ -179,22 +179,22 @@ inet_aton(const char *cp, struct in_addr *addr) {
 	 */
 	n = pp - parts + 1;
 	switch (n) {
-	case 1:				/* a -- 32 bits */
+	case 1:				/*%< a -- 32 bits */
 		break;
 
-	case 2:				/* a.b -- 8.24 bits */
+	case 2:				/*%< a.b -- 8.24 bits */
 		if (val > 0xffffffU)
 			return (0);
 		val |= parts[0] << 24;
 		break;
 
-	case 3:				/* a.b.c -- 8.8.16 bits */
+	case 3:				/*%< a.b.c -- 8.8.16 bits */
 		if (val > 0xffffU)
 			return (0);
 		val |= (parts[0] << 24) | (parts[1] << 16);
 		break;
 
-	case 4:				/* a.b.c.d -- 8.8.8.8 bits */
+	case 4:				/*%< a.b.c.d -- 8.8.8.8 bits */
 		if (val > 0xffU)
 			return (0);
 		val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8);
@@ -204,3 +204,5 @@ inet_aton(const char *cp, struct in_addr *addr) {
 		addr->s_addr = htonl(val);
 	return (1);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_cidr_ntop.c b/contrib/bind9/lib/bind/inet/inet_cidr_ntop.c
index b25dc82..645b3cd 100644
--- a/contrib/bind9/lib/bind/inet/inet_cidr_ntop.c
+++ b/contrib/bind9/lib/bind/inet/inet_cidr_ntop.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_cidr_ntop.c,v 1.1.2.1.8.4 2006/10/11 02:32:50 marka Exp $";
+static const char rcsid[] = "$Id: inet_cidr_ntop.c,v 1.4.18.3 2006/10/11 02:32:47 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -45,7 +45,7 @@ inet_cidr_ntop_ipv4(const u_char *src, int bits, char *dst, size_t size);
 static char *
 inet_cidr_ntop_ipv6(const u_char *src, int bits, char *dst, size_t size);
 
-/*
+/*%
  * char *
  * inet_cidr_ntop(af, src, bits, dst, size)
  *	convert network address from network to presentation format.
@@ -92,7 +92,7 @@ decoct(const u_char *src, int bytes, char *dst, size_t size) {
 	return (dst - odst);
 }
 
-/*
+/*%
  * static char *
  * inet_cidr_ntop_ipv4(src, bits, dst, size)
  *	convert IPv4 network address from network to presentation format.
@@ -259,3 +259,5 @@ inet_cidr_ntop_ipv6(const u_char *src, int bits, char *dst, size_t size) {
 	strcpy(dst, tmp);
 	return (dst);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_cidr_pton.c b/contrib/bind9/lib/bind/inet/inet_cidr_pton.c
index 5bfef71..b55e3ea 100644
--- a/contrib/bind9/lib/bind/inet/inet_cidr_pton.c
+++ b/contrib/bind9/lib/bind/inet/inet_cidr_pton.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_cidr_pton.c,v 1.2.2.1.8.2 2004/03/17 00:29:46 marka Exp $";
+static const char rcsid[] = "$Id: inet_cidr_pton.c,v 1.5.18.1 2005/04/27 05:00:53 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -49,7 +49,7 @@ static int	inet_cidr_pton_ipv6 __P((const char *src, u_char *dst,
 
 static int	getbits(const char *, int ipv6);
 
-/*
+/*%
  * int
  * inet_cidr_pton(af, src, dst, *bits)
  *	convert network address from presentation to network format.
@@ -204,7 +204,7 @@ inet_cidr_pton_ipv6(const char *src, u_char *dst, int *pbits) {
 		    inet_cidr_pton_ipv4(curtok, tp, &bits, 1) == 0) {
 			tp += NS_INADDRSZ;
 			saw_xdigit = 0;
-			break;	/* '\0' was seen by inet_pton4(). */
+			break;	/*%< '\\0' was seen by inet_pton4(). */
 		}
 		if (ch == '/') {
 			bits = getbits(src, 1);
@@ -256,20 +256,22 @@ getbits(const char *src, int ipv6) {
 	int bits = 0;
 	char *cp, ch;
 	
-	if (*src == '\0')			/* syntax */
+	if (*src == '\0')			/*%< syntax */
 		return (-2);
 	do {
 		ch = *src++;
 		cp = strchr(digits, ch);
-		if (cp == NULL)			/* syntax */
+		if (cp == NULL)			/*%< syntax */
 			return (-2);
 		bits *= 10;
 		bits += cp - digits;
-		if (bits == 0 && *src != '\0')	/* no leading zeros */
+		if (bits == 0 && *src != '\0')	/*%< no leading zeros */
 			return (-2);
-		if (bits > (ipv6 ? 128 : 32))	/* range error */
+		if (bits > (ipv6 ? 128 : 32))	/*%< range error */
 			return (-2);
 	} while (*src != '\0');
 
 	return (bits);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_data.c b/contrib/bind9/lib/bind/inet/inet_data.c
index e586297..f3fa25b 100644
--- a/contrib/bind9/lib/bind/inet/inet_data.c
+++ b/contrib/bind9/lib/bind/inet/inet_data.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$Id: inet_data.c,v 1.2.206.1 2004/03/09 08:33:32 marka Exp $";
+static char rcsid[] = "$Id: inet_data.c,v 1.3.18.1 2005/04/27 05:00:53 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -42,3 +42,5 @@ static char rcsid[] = "$Id: inet_data.c,v 1.2.206.1 2004/03/09 08:33:32 marka Ex
 
 const struct in6_addr isc_in6addr_any = IN6ADDR_ANY_INIT;
 const struct in6_addr isc_in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_lnaof.c b/contrib/bind9/lib/bind/inet/inet_lnaof.c
index 97b80cf..70ac409 100644
--- a/contrib/bind9/lib/bind/inet/inet_lnaof.c
+++ b/contrib/bind9/lib/bind/inet/inet_lnaof.c
@@ -43,7 +43,7 @@ static const char sccsid[] = "@(#)inet_lnaof.c	8.1 (Berkeley) 6/4/93";
 
 #include "port_after.h"
 
-/*
+/*%
  * Return the local network address portion of an
  * internet address; handles class a/b/c network
  * number formats.
@@ -61,3 +61,5 @@ inet_lnaof(in)
 	else
 		return ((i)&IN_CLASSC_HOST);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_makeaddr.c b/contrib/bind9/lib/bind/inet/inet_makeaddr.c
index 6e4ecc3..c56cb3e 100644
--- a/contrib/bind9/lib/bind/inet/inet_makeaddr.c
+++ b/contrib/bind9/lib/bind/inet/inet_makeaddr.c
@@ -43,7 +43,7 @@ static const char sccsid[] = "@(#)inet_makeaddr.c	8.1 (Berkeley) 6/4/93";
 
 #include "port_after.h"
 
-/*
+/*%
  * Formulate an Internet address from network + host.  Used in
  * building addresses stored in the ifnet structure.
  */
@@ -64,3 +64,5 @@ inet_makeaddr(net, host)
 	a.s_addr = htonl(a.s_addr);
 	return (a);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_net_ntop.c b/contrib/bind9/lib/bind/inet/inet_net_ntop.c
index 47af6284e..a1ac243 100644
--- a/contrib/bind9/lib/bind/inet/inet_net_ntop.c
+++ b/contrib/bind9/lib/bind/inet/inet_net_ntop.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_net_ntop.c,v 1.1.2.1.8.2 2006/06/20 02:53:07 marka Exp $";
+static const char rcsid[] = "$Id: inet_net_ntop.c,v 1.3.18.2 2006/06/20 02:51:32 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -44,7 +44,7 @@ static char *	inet_net_ntop_ipv4 __P((const u_char *src, int bits,
 static char *	inet_net_ntop_ipv6 __P((const u_char *src, int bits,
 					char *dst, size_t size));
 
-/*
+/*%
  * char *
  * inet_net_ntop(af, src, bits, dst, size)
  *	convert network number from network to presentation format.
@@ -73,7 +73,7 @@ inet_net_ntop(af, src, bits, dst, size)
 	}
 }
 
-/*
+/*%
  * static char *
  * inet_net_ntop_ipv4(src, bits, dst, size)
  *	convert IPv4 network number from network to presentation format.
@@ -148,7 +148,7 @@ inet_net_ntop_ipv4(src, bits, dst, size)
 	return (NULL);
 }
 
-/*
+/*%
  * static char *
  * inet_net_ntop_ipv6(src, bits, fakebits, dst, size)
  *	convert IPv6 network number from network to presentation format.
@@ -275,3 +275,5 @@ emsgsize:
 	errno = EMSGSIZE;
 	return (NULL);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_net_pton.c b/contrib/bind9/lib/bind/inet/inet_net_pton.c
index abecfc7..d3de33b 100644
--- a/contrib/bind9/lib/bind/inet/inet_net_pton.c
+++ b/contrib/bind9/lib/bind/inet/inet_net_pton.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.2 2004/03/17 00:29:47 marka Exp $";
+static const char rcsid[] = "$Id: inet_net_pton.c,v 1.7.18.1 2005/04/27 05:00:53 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -42,7 +42,7 @@ static const char rcsid[] = "$Id: inet_net_pton.c,v 1.4.2.1.8.2 2004/03/17 00:29
 # define SPRINTF(x) ((size_t)sprintf x)
 #endif
 
-/*
+/*%
  * static int
  * inet_net_pton_ipv4(src, dst, size)
  *	convert IPv4 network number from presentation to network format.
@@ -73,7 +73,7 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
 		if (size <= 0U)
 			goto emsgsize;
 		dirty = 0;
-		src++;	/* skip x or X. */
+		src++;	/*%< skip x or X. */
 		while ((ch = *src++) != '\0' && isascii(ch) && isxdigit(ch)) {
 			if (isupper(ch))
 				ch = tolower(ch);
@@ -90,7 +90,7 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
 				dirty = 0;
 			}
 		}
-		if (dirty) {  /* Odd trailing nybble? */
+		if (dirty) {  /*%< Odd trailing nybble? */
 			if (size-- <= 0U)
 				goto emsgsize;
 			*dst++ = (u_char) (tmp << 4);
@@ -126,7 +126,7 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
 	if (ch == '/' && isascii((unsigned char)(src[0])) &&
 	    isdigit((unsigned char)(src[0])) && dst > odst) {
 		/* CIDR width specifier.  Nothing can follow it. */
-		ch = *src++;	/* Skip over the /. */
+		ch = *src++;	/*%< Skip over the /. */
 		bits = 0;
 		do {
 			n = strchr(digits, ch) - digits;
@@ -149,15 +149,15 @@ inet_net_pton_ipv4(const char *src, u_char *dst, size_t size) {
 		goto enoent;
 	/* If no CIDR spec was given, infer width from net class. */
 	if (bits == -1) {
-		if (*odst >= 240)	/* Class E */
+		if (*odst >= 240)	/*%< Class E */
 			bits = 32;
-		else if (*odst >= 224)	/* Class D */
+		else if (*odst >= 224)	/*%< Class D */
 			bits = 8;
-		else if (*odst >= 192)	/* Class C */
+		else if (*odst >= 192)	/*%< Class C */
 			bits = 24;
-		else if (*odst >= 128)	/* Class B */
+		else if (*odst >= 128)	/*%< Class B */
 			bits = 16;
-		else			/* Class A */
+		else			/*%< Class A */
 			bits = 8;
 		/* If imputed mask is narrower than specified octets, widen. */
 		if (bits < ((dst - odst) * 8))
@@ -200,11 +200,11 @@ getbits(const char *src, int *bitsp) {
 
 		pch = strchr(digits, ch);
 		if (pch != NULL) {
-			if (n++ != 0 && val == 0)	/* no leading zeros */
+			if (n++ != 0 && val == 0)	/*%< no leading zeros */
 				return (0);
 			val *= 10;
 			val += (pch - digits);
-			if (val > 128)			/* range */
+			if (val > 128)			/*%< range */
 				return (0);
 			continue;
 		}
@@ -231,16 +231,16 @@ getv4(const char *src, u_char *dst, int *bitsp) {
 
 		pch = strchr(digits, ch);
 		if (pch != NULL) {
-			if (n++ != 0 && val == 0)	/* no leading zeros */
+			if (n++ != 0 && val == 0)	/*%< no leading zeros */
 				return (0);
 			val *= 10;
 			val += (pch - digits);
-			if (val > 255)			/* range */
+			if (val > 255)			/*%< range */
 				return (0);
 			continue;
 		}
 		if (ch == '.' || ch == '/') {
-			if (dst - odst > 3)		/* too many octets? */
+			if (dst - odst > 3)		/*%< too many octets? */
 				return (0);
 			*dst++ = val;
 			if (ch == '/')
@@ -253,7 +253,7 @@ getv4(const char *src, u_char *dst, int *bitsp) {
 	}
 	if (n == 0)
 		return (0);
-	if (dst - odst > 3)		/* too many octets? */
+	if (dst - odst > 3)		/*%< too many octets? */
 		return (0);
 	*dst++ = val;
 	return (1);
@@ -322,7 +322,7 @@ inet_net_pton_ipv6(const char *src, u_char *dst, size_t size) {
 			tp += NS_INADDRSZ;
 			saw_xdigit = 0;
 			ipv4 = 1;
-			break;	/* '\0' was seen by inet_pton4(). */
+			break;	/*%< '\\0' was seen by inet_pton4(). */
 		}
 		if (ch == '/' && getbits(src, &bits) > 0)
 			break;
@@ -378,7 +378,7 @@ inet_net_pton_ipv6(const char *src, u_char *dst, size_t size) {
 	return (-1);
 }
 
-/*
+/*%
  * int
  * inet_net_pton(af, src, dst, size)
  *	convert network number from presentation to network format.
@@ -403,3 +403,5 @@ inet_net_pton(int af, const char *src, void *dst, size_t size) {
 		return (-1);
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_neta.c b/contrib/bind9/lib/bind/inet/inet_neta.c
index 325b7ce..bc3b601 100644
--- a/contrib/bind9/lib/bind/inet/inet_neta.c
+++ b/contrib/bind9/lib/bind/inet/inet_neta.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_neta.c,v 1.1.206.1 2004/03/09 08:33:33 marka Exp $";
+static const char rcsid[] = "$Id: inet_neta.c,v 1.2.18.1 2005/04/27 05:00:53 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -38,7 +38,7 @@ static const char rcsid[] = "$Id: inet_neta.c,v 1.1.206.1 2004/03/09 08:33:33 ma
 # define SPRINTF(x) ((size_t)sprintf x)
 #endif
 
-/*
+/*%
  * char *
  * inet_neta(src, dst, size)
  *	format a u_long network number into presentation format.
@@ -85,3 +85,5 @@ inet_neta(src, dst, size)
 	errno = EMSGSIZE;
 	return (NULL);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_netof.c b/contrib/bind9/lib/bind/inet/inet_netof.c
index e887530..c228e3d 100644
--- a/contrib/bind9/lib/bind/inet/inet_netof.c
+++ b/contrib/bind9/lib/bind/inet/inet_netof.c
@@ -43,7 +43,7 @@ static const char sccsid[] = "@(#)inet_netof.c	8.1 (Berkeley) 6/4/93";
 
 #include "port_after.h"
 
-/*
+/*%
  * Return the network number from an internet
  * address; handles class a/b/c network #'s.
  */
@@ -60,3 +60,5 @@ inet_netof(in)
 	else
 		return (((i)&IN_CLASSC_NET) >> IN_CLASSC_NSHIFT);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_network.c b/contrib/bind9/lib/bind/inet/inet_network.c
index aaa50c8..4758a00 100644
--- a/contrib/bind9/lib/bind/inet/inet_network.c
+++ b/contrib/bind9/lib/bind/inet/inet_network.c
@@ -44,7 +44,7 @@ static const char sccsid[] = "@(#)inet_network.c	8.1 (Berkeley) 6/4/93";
 
 #include "port_after.h"
 
-/*
+/*%
  * Internet network address interpretation routine.
  * The library routines call this routine to interpret
  * network numbers.
@@ -102,3 +102,5 @@ again:
 	}
 	return (val);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_ntoa.c b/contrib/bind9/lib/bind/inet/inet_ntoa.c
index 7fad4b8..1d566be 100644
--- a/contrib/bind9/lib/bind/inet/inet_ntoa.c
+++ b/contrib/bind9/lib/bind/inet/inet_ntoa.c
@@ -33,7 +33,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)inet_ntoa.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: inet_ntoa.c,v 1.1 2001/03/29 06:31:38 marka Exp $";
+static const char rcsid[] = "$Id: inet_ntoa.c,v 1.1.352.1 2005/04/27 05:00:54 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -48,7 +48,7 @@ static const char rcsid[] = "$Id: inet_ntoa.c,v 1.1 2001/03/29 06:31:38 marka Ex
 
 #include "port_after.h"
 
-/*
+/*%
  * Convert network-format internet address
  * to base 256 d.d.d.d representation.
  */
@@ -60,3 +60,5 @@ inet_ntoa(struct in_addr in) {
 	(void) inet_ntop(AF_INET, &in, ret, sizeof ret);
 	return (ret);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_ntop.c b/contrib/bind9/lib/bind/inet/inet_ntop.c
index cd502ab..9ab38bc 100644
--- a/contrib/bind9/lib/bind/inet/inet_ntop.c
+++ b/contrib/bind9/lib/bind/inet/inet_ntop.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_ntop.c,v 1.1.2.1.8.2 2005/11/03 23:08:40 marka Exp $";
+static const char rcsid[] = "$Id: inet_ntop.c,v 1.3.18.2 2005/11/03 23:02:22 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -41,7 +41,7 @@ static const char rcsid[] = "$Id: inet_ntop.c,v 1.1.2.1.8.2 2005/11/03 23:08:40
 # define SPRINTF(x) ((size_t)sprintf x)
 #endif
 
-/*
+/*%
  * WARNING: Don't even consider trying to compile this on a system where
  * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
  */
@@ -203,3 +203,5 @@ inet_ntop6(src, dst, size)
 	strcpy(dst, tmp);
 	return (dst);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/inet_pton.c b/contrib/bind9/lib/bind/inet/inet_pton.c
index f18a7b6..66b4c6a 100644
--- a/contrib/bind9/lib/bind/inet/inet_pton.c
+++ b/contrib/bind9/lib/bind/inet/inet_pton.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: inet_pton.c,v 1.2.206.2 2005/07/28 07:43:18 marka Exp $";
+static const char rcsid[] = "$Id: inet_pton.c,v 1.3.18.2 2005/07/28 07:38:07 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -30,7 +30,7 @@ static const char rcsid[] = "$Id: inet_pton.c,v 1.2.206.2 2005/07/28 07:43:18 ma
 #include <errno.h>
 #include "port_after.h"
 
-/*
+/*%
  * WARNING: Don't even consider trying to compile this on a system where
  * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
  */
@@ -188,7 +188,7 @@ inet_pton6(src, dst)
 		    inet_pton4(curtok, tp) > 0) {
 			tp += NS_INADDRSZ;
 			seen_xdigits = 0;
-			break;	/* '\0' was seen by inet_pton4(). */
+			break;	/*%< '\\0' was seen by inet_pton4(). */
 		}
 		return (0);
 	}
@@ -219,3 +219,5 @@ inet_pton6(src, dst)
 	memcpy(dst, tmp, NS_IN6ADDRSZ);
 	return (1);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/inet/nsap_addr.c b/contrib/bind9/lib/bind/inet/nsap_addr.c
index a4b98e7..d8fe87c 100644
--- a/contrib/bind9/lib/bind/inet/nsap_addr.c
+++ b/contrib/bind9/lib/bind/inet/nsap_addr.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nsap_addr.c,v 1.2.206.2 2005/07/28 07:43:18 marka Exp $";
+static const char rcsid[] = "$Id: nsap_addr.c,v 1.3.18.2 2005/07/28 07:38:08 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -107,3 +107,5 @@ inet_nsap_ntoa(int binlen, const u_char *binary, char *ascii) {
 	*ascii = '\0';
 	return (start);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/Makefile.in b/contrib/bind9/lib/bind/irs/Makefile.in
index 9695435..ce6f5f2 100644
--- a/contrib/bind9/lib/bind/irs/Makefile.in
+++ b/contrib/bind9/lib/bind/irs/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.7.206.3 2004/12/07 00:38:35 marka Exp $
+# $Id: Makefile.in,v 1.8.18.2 2004/12/07 00:53:48 marka Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/irs/dns.c b/contrib/bind9/lib/bind/irs/dns.c
index 27529b5..b78a1d6 100644
--- a/contrib/bind9/lib/bind/irs/dns.c
+++ b/contrib/bind9/lib/bind/irs/dns.c
@@ -16,10 +16,11 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns.c,v 1.1.206.3 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: dns.c,v 1.3.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif
 
-/*
+/*! \file
+ * \brief
  * dns.c --- this is the top-level accessor function for the dns
  */
 
diff --git a/contrib/bind9/lib/bind/irs/dns_gr.c b/contrib/bind9/lib/bind/irs/dns_gr.c
index a35b10c..358e5a7 100644
--- a/contrib/bind9/lib/bind/irs/dns_gr.c
+++ b/contrib/bind9/lib/bind/irs/dns_gr.c
@@ -16,10 +16,11 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_gr.c,v 1.1.2.1.4.1 2004/03/09 08:33:34 marka Exp $";
+static const char rcsid[] = "$Id: dns_gr.c,v 1.3.18.1 2005/04/27 05:00:54 sra Exp $";
 #endif
 
-/*
+/*! \file
+ * \brief
  * dns_gr.c --- this file contains the functions for accessing
  * 	group information from Hesiod.
  */
@@ -69,7 +70,7 @@ struct pvt {
 	 * we keep one buffer and resize it as needed.
 	 */
 	struct group	group;
-	size_t		nmemb;		/* Malloc'd max index of gr_mem[]. */
+	size_t		nmemb;		/*%< Malloc'd max index of gr_mem[]. */
 	char *		membuf;
 	size_t		membufsize;
 };
diff --git a/contrib/bind9/lib/bind/irs/dns_ho.c b/contrib/bind9/lib/bind/irs/dns_ho.c
index 192be04..d1d6f5a 100644
--- a/contrib/bind9/lib/bind/irs/dns_ho.c
+++ b/contrib/bind9/lib/bind/irs/dns_ho.c
@@ -52,7 +52,7 @@
 /* BIND Id: gethnamaddr.c,v 8.15 1996/05/22 04:56:30 vixie Exp $ */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_ho.c,v 1.5.2.7.4.8 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: dns_ho.c,v 1.14.18.7 2006/12/07 03:54:24 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -95,8 +95,7 @@ static const char rcsid[] = "$Id: dns_ho.c,v 1.5.2.7.4.8 2006/03/10 00:17:21 mar
 #define	MAXALIASES	35
 #define	MAXADDRS	35
 
-#define MAXPACKET (65535)	/* Maximum TCP message size */
-
+#define MAXPACKET (65535)	/*%< Maximum TCP message size */
 #define BOUNDS_CHECK(ptr, count) \
 	if ((ptr) + (count) > eom) { \
 		had_error++; \
@@ -110,14 +109,14 @@ typedef union {
 
 struct dns_res_target {
 	struct dns_res_target *next;
-	querybuf qbuf;		/* query buffer */
-	u_char *answer;		/* buffer to put answer */
-	int anslen;		/* size of answer buffer */
-	int qclass, qtype;	/* class and type of query */
-	int action;		/* condition whether query is really issued */
-	char qname[MAXDNAME +1]; /* domain name */
+	querybuf qbuf;		/*%< query buffer */
+	u_char *answer;		/*%< buffer to put answer */
+	int anslen;		/*%< size of answer buffer */
+	int qclass, qtype;	/*%< class and type of query */
+	int action;		/*%< condition whether query is really issued */
+	char qname[MAXDNAME +1]; /*%< domain name */
 #if 0
-	int n;			/* result length */
+	int n;			/*%< result length */
 #endif
 };
 enum {RESTGT_DOALWAYS, RESTGT_AFTERFAILURE, RESTGT_IGNORE};
@@ -128,7 +127,7 @@ struct pvt {
 	char *		h_addr_ptrs[MAXADDRS + 1];
 	char *		host_aliases[MAXALIASES];
 	char		hostbuf[8*1024];
-	u_char		host_addr[16];	/* IPv4 or IPv6 */
+	u_char		host_addr[16];	/*%< IPv4 or IPv6 */
 	struct __res_state  *res;
 	void		(*free_res)(void *);
 };
@@ -141,8 +140,7 @@ typedef union {
 static const u_char mapped[] = { 0,0, 0,0, 0,0, 0,0, 0,0, 0xff,0xff };
 static const u_char tunnelled[] = { 0,0, 0,0, 0,0, 0,0, 0,0, 0,0 };
 /* Note: the IPv6 loopback address is in the "tunnel" space */
-static const u_char v6local[] = { 0,0, 0,1 }; /* last 4 bytes of IPv6 addr */
-
+static const u_char v6local[] = { 0,0, 0,1 }; /*%< last 4 bytes of IPv6 addr */
 /* Forwards. */
 
 static void		ho_close(struct irs_ho *this);
@@ -317,8 +315,7 @@ ho_byname2(struct irs_ho *this, const char *name, int af)
 		if ((hp = gethostans(this, p->answer, n, name, p->qtype,
 				     af, size, NULL,
 				     (const struct addrinfo *)&ai)) != NULL)
-			goto cleanup;	/* no more loop is necessary */
-
+			goto cleanup;	/*%< no more loop is necessary */
 		querystate = RESQRY_FAIL;
 		continue;
 	}
@@ -495,10 +492,9 @@ ho_byaddr(struct irs_ho *this, const void *addr, int len, int af)
 		}
 
 		RES_SET_H_ERRNO(pvt->res, NETDB_SUCCESS);
-		goto cleanup;	/* no more loop is necessary. */
+		goto cleanup;	/*%< no more loop is necessary. */
 	}
-	hp = NULL; /* H_ERRNO was set by subroutines */
-
+	hp = NULL; /*%< H_ERRNO was set by subroutines */
  cleanup:
 	if (q != NULL)
 		memput(q, sizeof(*q));
@@ -610,7 +606,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 		q->action = RESTGT_DOALWAYS;
 		break;
 	default:
-		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /* better error? */
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /*%< better error? */
 		goto cleanup;
 	}
 
@@ -643,7 +639,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 			continue;
 		}
 		(void)gethostans(this, p->answer, n, name, p->qtype,
-				 pai->ai_family, /* XXX: meaningless */
+				 pai->ai_family, /*%< XXX: meaningless */
 				 0, &ai, pai);
 		if (ai) {
 			querystate = RESQRY_SUCCESS;
@@ -681,7 +677,7 @@ ho_res_set(struct irs_ho *this, struct __res_state *res,
 static struct hostent *
 gethostans(struct irs_ho *this,
 	   const u_char *ansbuf, int anslen, const char *qname, int qtype,
-	   int af, int size,	/* meaningless for addrinfo cases */
+	   int af, int size,	/*!< meaningless for addrinfo cases  */
 	   struct addrinfo **ret_aip, const struct addrinfo *pai)
 {
 	struct pvt *pvt = (struct pvt *)this->private;
@@ -709,7 +705,7 @@ gethostans(struct irs_ho *this,
 	switch (qtype) {
 	case T_A:
 	case T_AAAA:
-	case T_ANY:	/* use T_ANY only for T_A/T_AAAA lookup */
+	case T_ANY:	/*%< use T_ANY only for T_A/T_AAAA lookup */
 		name_ok = res_hnok;
 		break;
 	case T_PTR:
@@ -755,7 +751,7 @@ gethostans(struct irs_ho *this,
 		 * same as the one we sent; this just gets the expanded name
 		 * (i.e., with the succeeding search-domain tacked on).
 		 */
-		n = strlen(bp) + 1;		/* for the \0 */
+		n = strlen(bp) + 1;		/*%< for the \\0 */
 		if (n > MAXHOSTNAMELEN) {
 			RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
 			return (NULL);
@@ -780,14 +776,14 @@ gethostans(struct irs_ho *this,
 			had_error++;
 			continue;
 		}
-		cp += n;			/* name */
+		cp += n;			/*%< name */
 		BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ);
 		type = ns_get16(cp);
- 		cp += INT16SZ;			/* type */
+ 		cp += INT16SZ;			/*%< type */
 		class = ns_get16(cp);
- 		cp += INT16SZ + INT32SZ;	/* class, TTL */
+ 		cp += INT16SZ + INT32SZ;	/*%< class, TTL */
 		n = ns_get16(cp);
-		cp += INT16SZ;			/* len */
+		cp += INT16SZ;			/*%< len */
 		BOUNDS_CHECK(cp, n);
 		if (class != C_IN) {
 			cp += n;
@@ -815,10 +811,10 @@ gethostans(struct irs_ho *this,
 			if (ap >= &pvt->host_aliases[MAXALIASES-1])
 				continue;
 			*ap++ = bp;
-			n = strlen(bp) + 1;	/* for the \0 */
+			n = strlen(bp) + 1;	/*%< for the \\0 */
 			bp += n;
 			/* Get canonical name. */
-			n = strlen(tbuf) + 1;	/* for the \0 */
+			n = strlen(tbuf) + 1;	/*%< for the \\0 */
 			if (n > (ep - bp) || n > MAXHOSTNAMELEN) {
 				had_error++;
 				continue;
@@ -850,7 +846,7 @@ gethostans(struct irs_ho *this,
 					continue;
 			}
 			/* Get canonical name. */
-			n = strlen(tbuf) + 1;	/* for the \0 */
+			n = strlen(tbuf) + 1;	/*%< for the \\0 */
 			if (n > (ep - bp)) {
 				had_error++;
 				continue;
@@ -896,7 +892,7 @@ gethostans(struct irs_ho *this,
 			else
 				n = -1;
 			if (n != -1) {
-				n = strlen(bp) + 1;	/* for the \0 */
+				n = strlen(bp) + 1;	/*%< for the \\0 */
 				bp += n;
 			}
 			break;
@@ -927,7 +923,7 @@ gethostans(struct irs_ho *this,
 			if (!haveanswer) {
 				int nn;
 
-				nn = strlen(bp) + 1;	/* for the \0 */
+				nn = strlen(bp) + 1;	/*%< for the \\0 */
 				if (nn >= MAXHOSTNAMELEN) {
 					cp += n;
 					had_error++;
@@ -941,14 +937,14 @@ gethostans(struct irs_ho *this,
 			bp = (char *)(((u_long)bp + (sizeof(align) - 1)) &
 				      ~(sizeof(align) - 1));
 			/* Avoid overflows. */
-			if (bp + n >= &pvt->hostbuf[sizeof pvt->hostbuf]) {
+			if (bp + n > &pvt->hostbuf[sizeof(pvt->hostbuf) - 1]) {
 				had_error++;
 				continue;
 			}
-			if (ret_aip) { /* need addrinfo. keep it. */
+			if (ret_aip) { /*%< need addrinfo. keep it. */
 				while (cur->ai_next)
 					cur = cur->ai_next;
-			} else if (cur->ai_next) { /* need hostent */
+			} else if (cur->ai_next) { /*%< need hostent */
 				struct addrinfo *aip = cur->ai_next;
 
 				for (aip = cur->ai_next; aip;
@@ -988,7 +984,7 @@ gethostans(struct irs_ho *this,
 				addrsort(pvt->res, pvt->h_addr_ptrs,
 					 haveanswer);
 			if (pvt->host.h_name == NULL) {
-				n = strlen(qname) + 1;	/* for the \0 */
+				n = strlen(qname) + 1;	/*%< for the \\0 */
 				if (n > (ep - bp) || n >= MAXHOSTNAMELEN)
 					goto no_recovery;
 				strcpy(bp, qname);	/* (checked) */
@@ -1044,18 +1040,17 @@ add_hostent(struct pvt *pvt, char *bp, char **hap, struct addrinfo *ai)
 		addrp = (char *)&((struct sockaddr_in *)ai->ai_addr)->sin_addr;
 		break;
 	default:
-		return(-1);	/* abort? */
+		return(-1);	/*%< abort? */
 	}
 
 	/* Ensure alignment. */
 	bp = (char *)(((u_long)bp + (sizeof(align) - 1)) &
 		      ~(sizeof(align) - 1));
 	/* Avoid overflows. */
-	if (bp + addrlen >= &pvt->hostbuf[sizeof pvt->hostbuf])
+	if (bp + addrlen > &pvt->hostbuf[sizeof(pvt->hostbuf) - 1])
 		return(-1);
 	if (hap >= &pvt->h_addr_ptrs[MAXADDRS-1])
-		return(0); /* fail, but not treat it as an error. */
-
+		return(0); /*%< fail, but not treat it as an error. */
 	/* Suppress duplicates. */
 	for (tap = (const char **)pvt->h_addr_ptrs;
 	     *tap != NULL;
diff --git a/contrib/bind9/lib/bind/irs/dns_nw.c b/contrib/bind9/lib/bind/irs/dns_nw.c
index 8a5937d..1d03a52 100644
--- a/contrib/bind9/lib/bind/irs/dns_nw.c
+++ b/contrib/bind9/lib/bind/irs/dns_nw.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_nw.c,v 1.3.2.4.4.4 2004/09/16 00:57:34 marka Exp $";
+static const char rcsid[] = "$Id: dns_nw.c,v 1.9.18.3 2005/04/27 05:00:55 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -377,16 +377,16 @@ get1101answer(struct irs_nw *this,
 	while (--ancount >= 0 && cp < eom) {
 		int n = dn_expand(ansbuf, eom, cp, bp, ep - bp);
 
-		cp += n;		/* Owner */
+		cp += n;		/*%< Owner */
 		if (n < 0 || !maybe_dnok(pvt->res, bp) ||
 		    cp + 3 * INT16SZ + INT32SZ > eom) {
 			RES_SET_H_ERRNO(pvt->res, NO_RECOVERY);
 			return (NULL);
 		}
-		GETSHORT(type, cp);	/* Type */
-		GETSHORT(class, cp);	/* Class */
-		cp += INT32SZ;		/* TTL */
-		GETSHORT(n, cp);	/* RDLENGTH */
+		GETSHORT(type, cp);	/*%< Type */
+		GETSHORT(class, cp);	/*%< Class */
+		cp += INT32SZ;		/*%< TTL */
+		GETSHORT(n, cp);	/*%< RDLENGTH */
 		if (class == C_IN && type == T_PTR) {
 			int nn;
 
@@ -430,7 +430,7 @@ get1101answer(struct irs_nw *this,
 			    }
 			}
 		}
-		cp += n;		/* RDATA */
+		cp += n;		/*%< RDATA */
 	}
 	if (!haveanswer) {
 		RES_SET_H_ERRNO(pvt->res, TRY_AGAIN);
@@ -491,13 +491,13 @@ get1101mask(struct irs_nw *this, struct nwent *nwent) {
 
 		if (n < 0 || !maybe_dnok(pvt->res, owner))
 			break;
-		cp += n;		/* Owner */
+		cp += n;		/*%< Owner */
 		if (cp + 3 * INT16SZ + INT32SZ > eom)
 			break;
-		GETSHORT(type, cp);	/* Type */
-		GETSHORT(class, cp);	/* Class */
-		cp += INT32SZ;		/* TTL */
-		GETSHORT(n, cp);	/* RDLENGTH */
+		GETSHORT(type, cp);	/*%< Type */
+		GETSHORT(class, cp);	/*%< Class */
+		cp += INT32SZ;		/*%< TTL */
+		GETSHORT(n, cp);	/*%< RDLENGTH */
 		if (cp + n > eom)
 			break;
 		if (n == INADDRSZ && class == C_IN && type == T_A &&
@@ -513,7 +513,7 @@ get1101mask(struct irs_nw *this, struct nwent *nwent) {
 					else
 						break;
 		}
-		cp += n;		/* RDATA */
+		cp += n;		/*%< RDATA */
 	}
 	memput(ansbuf, MAXPACKET);
 	return (nwent);
@@ -587,3 +587,5 @@ init(struct irs_nw *this) {
 		return (-1);
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/dns_p.h b/contrib/bind9/lib/bind/irs/dns_p.h
index f984c1c..a19ff2d 100644
--- a/contrib/bind9/lib/bind/irs/dns_p.h
+++ b/contrib/bind9/lib/bind/irs/dns_p.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: dns_p.h,v 1.1.206.2 2004/03/17 00:29:48 marka Exp $
+ * $Id: dns_p.h,v 1.3.18.1 2005/04/27 05:00:55 sra Exp $
  */
 
 #ifndef _DNS_P_H_INCLUDED
@@ -27,7 +27,7 @@
 #define maybe_hnok(res, hn) maybe_ok((res), (hn), res_hnok)
 #define maybe_dnok(res, dn) maybe_ok((res), (dn), res_dnok)
 
-/*
+/*%
  * Object state.
  */
 struct dns_p {
@@ -48,3 +48,5 @@ extern struct irs_ho *	irs_dns_ho __P((struct irs_acc *));
 extern struct irs_nw *	irs_dns_nw __P((struct irs_acc *));
 
 #endif /*_DNS_P_H_INCLUDED*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/dns_pr.c b/contrib/bind9/lib/bind/irs/dns_pr.c
index ffcca15..7582f85 100644
--- a/contrib/bind9/lib/bind/irs/dns_pr.c
+++ b/contrib/bind9/lib/bind/irs/dns_pr.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_pr.c,v 1.3.206.1 2004/03/09 08:33:34 marka Exp $";
+static const char rcsid[] = "$Id: dns_pr.c,v 1.4.18.1 2005/04/27 05:00:55 sra Exp $";
 #endif
 
 /* Imports */
@@ -264,3 +264,5 @@ parse_hes_list(struct irs_pr *this, char **hes_list) {
 	}
 	return (NULL);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/dns_pw.c b/contrib/bind9/lib/bind/irs/dns_pw.c
index 41b3795..62c61d5 100644
--- a/contrib/bind9/lib/bind/irs/dns_pw.c
+++ b/contrib/bind9/lib/bind/irs/dns_pw.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_pw.c,v 1.1.206.1 2004/03/09 08:33:34 marka Exp $";
+static const char rcsid[] = "$Id: dns_pw.c,v 1.2.18.1 2005/04/27 05:00:55 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -229,3 +229,4 @@ getpwcommon(struct irs_pw *this, const char *arg, const char *type) {
 }
 
 #endif /* WANT_IRS_PW */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/dns_sv.c b/contrib/bind9/lib/bind/irs/dns_sv.c
index a2aafde..fcb25ac 100644
--- a/contrib/bind9/lib/bind/irs/dns_sv.c
+++ b/contrib/bind9/lib/bind/irs/dns_sv.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: dns_sv.c,v 1.3.206.1 2004/03/09 08:33:34 marka Exp $";
+static const char rcsid[] = "$Id: dns_sv.c,v 1.4.18.1 2005/04/27 05:00:55 sra Exp $";
 #endif
 
 /* Imports */
@@ -111,8 +111,8 @@ irs_dns_sv(struct irs_acc *this) {
 	sv->res_get = sv_res_get;
 	sv->res_set = sv_res_set;
 #else
-	sv->res_get = NULL; /* sv_res_get; */
-	sv->res_set = NULL; /* sv_res_set; */
+	sv->res_get = NULL; /*%< sv_res_get; */
+	sv->res_set = NULL; /*%< sv_res_set; */
 #endif
 	return (sv);
 }
@@ -296,3 +296,5 @@ sv_res_set(struct irs_sv *this, struct __res_state * res,
 	__hesiod_res_set(dns->hes_ctx, res, free_res);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gai_strerror.c b/contrib/bind9/lib/bind/irs/gai_strerror.c
index 0492f8f..29196a0 100644
--- a/contrib/bind9/lib/bind/irs/gai_strerror.c
+++ b/contrib/bind9/lib/bind/irs/gai_strerror.c
@@ -26,21 +26,20 @@
 
 static const char *gai_errlist[] = {
 	"no error",
-	"address family not supported for name",/* EAI_ADDRFAMILY */
-	"temporary failure",			/* EAI_AGAIN */
-	"invalid flags",			/* EAI_BADFLAGS */
-	"permanent failure",			/* EAI_FAIL */
-	"address family not supported",		/* EAI_FAMILY */
-	"memory failure",			/* EAI_MEMORY */
-	"no address",				/* EAI_NODATA */
-	"unknown name or service",		/* EAI_NONAME */
-	"service not supported for socktype",	/* EAI_SERVICE */
-	"socktype not supported",		/* EAI_SOCKTYPE */
-	"system failure",			/* EAI_SYSTEM */
-	"bad hints",				/* EAI_BADHINTS */
-	"bad protocol",				/* EAI_PROTOCOL */
-
-	"unknown error"				/* Must be last. */
+	"address family not supported for name",/*%< EAI_ADDRFAMILY */
+	"temporary failure",			/*%< EAI_AGAIN */
+	"invalid flags",			/*%< EAI_BADFLAGS */
+	"permanent failure",			/*%< EAI_FAIL */
+	"address family not supported",		/*%< EAI_FAMILY */
+	"memory failure",			/*%< EAI_MEMORY */
+	"no address",				/*%< EAI_NODATA */
+	"unknown name or service",		/*%< EAI_NONAME */
+	"service not supported for socktype",	/*%< EAI_SERVICE */
+	"socktype not supported",		/*%< EAI_SOCKTYPE */
+	"system failure",			/*%< EAI_SYSTEM */
+	"bad hints",				/*%< EAI_BADHINTS */
+	"bad protocol",				/*%< EAI_PROTOCOL */
+	"unknown error"				/*%< Must be last. */
 };
 
 static const int gai_nerr = (sizeof(gai_errlist)/sizeof(*gai_errlist));
@@ -100,3 +99,5 @@ gai_strerror(int ecode) {
 	return ("unknown error");
 #endif
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gen.c b/contrib/bind9/lib/bind/irs/gen.c
index e093db3..8e9146e 100644
--- a/contrib/bind9/lib/bind/irs/gen.c
+++ b/contrib/bind9/lib/bind/irs/gen.c
@@ -16,10 +16,11 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gen.c,v 1.3.206.3 2004/09/16 00:57:34 marka Exp $";
+static const char rcsid[] = "$Id: gen.c,v 1.5.18.2 2005/04/27 05:00:56 sra Exp $";
 #endif
 
-/*
+/*! \file
+ * \brief
  * this is the top level dispatcher
  *
  * The dispatcher is implemented as an accessor class; it is an
diff --git a/contrib/bind9/lib/bind/irs/gen_gr.c b/contrib/bind9/lib/bind/irs/gen_gr.c
index e0c6dba..0829ed8 100644
--- a/contrib/bind9/lib/bind/irs/gen_gr.c
+++ b/contrib/bind9/lib/bind/irs/gen_gr.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gen_gr.c,v 1.4.2.1.4.2 2004/05/17 07:48:56 marka Exp $";
+static const char rcsid[] = "$Id: gen_gr.c,v 1.6.18.2 2005/04/27 05:00:56 sra Exp $";
 #endif
 
 /* Imports */
@@ -61,7 +61,7 @@ struct pvt {
 	 * we keep one buffer and resize it as needed.
 	 */
 	struct group		group;
-	size_t			nmemb;    /* Malloc'd max index of gr_mem[]. */
+	size_t			nmemb;    /*%< Malloc'd max index of gr_mem[]. */
 	char *			membuf;
 	size_t			membufsize;
 	struct __res_state *	res;
@@ -490,3 +490,4 @@ newgid(int ngroups, gid_t *groups, gid_t group) {
 }
 
 #endif /* WANT_IRS_GR */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gen_ho.c b/contrib/bind9/lib/bind/irs/gen_ho.c
index f17aa22..c5e09da 100644
--- a/contrib/bind9/lib/bind/irs/gen_ho.c
+++ b/contrib/bind9/lib/bind/irs/gen_ho.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: gen_ho.c,v 1.1.206.3 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: gen_ho.c,v 1.3.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports */
@@ -348,7 +348,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 		ho = rule->inst->ho;
 		RES_SET_H_ERRNO(pvt->res, NETDB_INTERNAL);
 		errno = 0;
-		if (ho->addrinfo == NULL) /* for safety */
+		if (ho->addrinfo == NULL) /*%< for safety */
 			continue;
 		rval = (*ho->addrinfo)(ho, name, pai);
 		if (rval != NULL)
@@ -387,3 +387,5 @@ init(struct irs_ho *this) {
 
         return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gen_ng.c b/contrib/bind9/lib/bind/irs/gen_ng.c
index 9f3ecad..67f4edd 100644
--- a/contrib/bind9/lib/bind/irs/gen_ng.c
+++ b/contrib/bind9/lib/bind/irs/gen_ng.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gen_ng.c,v 1.1.206.1 2004/03/09 08:33:35 marka Exp $";
+static const char rcsid[] = "$Id: gen_ng.c,v 1.2.18.1 2005/04/27 05:00:56 sra Exp $";
 #endif
 
 /* Imports */
@@ -170,3 +170,5 @@ ng_minimize(struct irs_ng *this) {
 		(*ng->minimize)(ng);
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gen_nw.c b/contrib/bind9/lib/bind/irs/gen_nw.c
index cb41f5d..8452f3f 100644
--- a/contrib/bind9/lib/bind/irs/gen_nw.c
+++ b/contrib/bind9/lib/bind/irs/gen_nw.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gen_nw.c,v 1.1.206.2 2004/03/17 01:49:40 marka Exp $";
+static const char rcsid[] = "$Id: gen_nw.c,v 1.3.18.1 2005/04/27 05:00:56 sra Exp $";
 #endif
 
 /* Imports */
@@ -260,3 +260,5 @@ init(struct irs_nw *this) {
 		return (-1);
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gen_p.h b/contrib/bind9/lib/bind/irs/gen_p.h
index 0a7ea2b..a0a312d 100644
--- a/contrib/bind9/lib/bind/irs/gen_p.h
+++ b/contrib/bind9/lib/bind/irs/gen_p.h
@@ -16,10 +16,11 @@
  */
 
 /*
- * $Id: gen_p.h,v 1.1.206.1 2004/03/09 08:33:35 marka Exp $
+ * $Id: gen_p.h,v 1.2.18.1 2005/04/27 05:00:56 sra Exp $
  */
 
-/* Notes:
+/*! \file
+ *  Notes:
  *	We hope to create a complete set of thread-safe entry points someday,
  *	which will mean a set of getXbyY() functions that take as an argument
  *	a pointer to the map class, which will have a pointer to the private
@@ -36,32 +37,32 @@
 #ifndef _GEN_P_H_INCLUDED
 #define _GEN_P_H_INCLUDED
 
-/*
+/*%
  * These are the access methods.
  */
 enum irs_acc_id {
-	irs_lcl,	/* Local. */
-	irs_dns,	/* DNS or Hesiod. */
-	irs_nis,	/* Sun NIS ("YP"). */
-	irs_irp,	/* IR protocol.  */
+	irs_lcl,	/*%< Local. */
+	irs_dns,	/*%< DNS or Hesiod. */
+	irs_nis,	/*%< Sun NIS ("YP"). */
+	irs_irp,	/*%< IR protocol. */
 	irs_nacc
 };
 
-/*
+/*%
  * These are the map types.
  */
 enum irs_map_id {
-	irs_gr,		/* "group" */
-	irs_pw,		/* "passwd" */
-	irs_sv,		/* "services" */
-	irs_pr,		/* "protocols" */
-	irs_ho,		/* "hosts" */
-	irs_nw,		/* "networks" */
-	irs_ng,		/* "netgroup" */
+	irs_gr,		/*%< "group" */
+	irs_pw,		/*%< "passwd" */
+	irs_sv,		/*%< "services" */
+	irs_pr,		/*%< "protocols" */
+	irs_ho,		/*%< "hosts" */
+	irs_nw,		/*%< "networks" */
+	irs_ng,		/*%< "netgroup" */
 	irs_nmap
 };
 
-/*
+/*%
  * This is an accessor instance.
  */
 struct irs_inst {
@@ -75,7 +76,7 @@ struct irs_inst {
 	struct irs_ng *	ng;
 };
 
-/*
+/*%
  * This is a search rule for some map type.
  */
 struct irs_rule {
@@ -83,9 +84,8 @@ struct irs_rule {
 	struct irs_inst *	inst;
 	int			flags;
 };
-#define IRS_MERGE		0x0001	/* Don't stop if acc. has data? */
-#define	IRS_CONTINUE		0x0002	/* Don't stop if acc. has no data? */
-
+#define IRS_MERGE		0x0001	/*%< Don't stop if acc. has data? */
+#define	IRS_CONTINUE		0x0002	/*%< Don't stop if acc. has no data? */
 /*
  * This is the private data for a search access class.
  */
diff --git a/contrib/bind9/lib/bind/irs/gen_pr.c b/contrib/bind9/lib/bind/irs/gen_pr.c
index 465fee3..5c9d69c 100644
--- a/contrib/bind9/lib/bind/irs/gen_pr.c
+++ b/contrib/bind9/lib/bind/irs/gen_pr.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gen_pr.c,v 1.1.206.1 2004/03/09 08:33:35 marka Exp $";
+static const char rcsid[] = "$Id: gen_pr.c,v 1.2.18.1 2005/04/27 05:00:56 sra Exp $";
 #endif
 
 /* Imports */
@@ -224,3 +224,5 @@ pr_res_set(struct irs_pr *this, struct __res_state *res,
 			(*pr->res_set)(pr, pvt->res, NULL);
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gen_pw.c b/contrib/bind9/lib/bind/irs/gen_pw.c
index ca31302..80d9b5d 100644
--- a/contrib/bind9/lib/bind/irs/gen_pw.c
+++ b/contrib/bind9/lib/bind/irs/gen_pw.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gen_pw.c,v 1.1.206.1 2004/03/09 08:33:35 marka Exp $";
+static const char rcsid[] = "$Id: gen_pw.c,v 1.2.18.1 2005/04/27 05:00:57 sra Exp $";
 #endif
 
 /* Imports */
@@ -231,3 +231,4 @@ pw_res_set(struct irs_pw *this, struct __res_state *res,
 }
 
 #endif /* WANT_IRS_PW */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gen_sv.c b/contrib/bind9/lib/bind/irs/gen_sv.c
index e8f6114..66f0ab7 100644
--- a/contrib/bind9/lib/bind/irs/gen_sv.c
+++ b/contrib/bind9/lib/bind/irs/gen_sv.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gen_sv.c,v 1.1.206.1 2004/03/09 08:33:35 marka Exp $";
+static const char rcsid[] = "$Id: gen_sv.c,v 1.2.18.1 2005/04/27 05:00:57 sra Exp $";
 #endif
 
 /* Imports */
@@ -225,3 +225,5 @@ sv_res_set(struct irs_sv *this, struct __res_state *res,
 			(*sv->res_set)(sv, pvt->res, NULL);
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getaddrinfo.c b/contrib/bind9/lib/bind/irs/getaddrinfo.c
index c8d1ab3..1839ba4 100644
--- a/contrib/bind9/lib/bind/irs/getaddrinfo.c
+++ b/contrib/bind9/lib/bind/irs/getaddrinfo.c
@@ -29,48 +29,52 @@
  * SUCH DAMAGE.
  */
 
-/*
+/*! \file
  * Issues to be discussed:
- * - Thread safe-ness must be checked.
- * - Return values.  There are nonstandard return values defined and used
+ *\li  Thread safe-ness must be checked.
+ *\li  Return values.  There are nonstandard return values defined and used
  *   in the source code.  This is because RFC2553 is silent about which error
  *   code must be returned for which situation.
- * - IPv4 classful (shortened) form.  RFC2553 is silent about it.  XNET 5.2
+ *\li  IPv4 classful (shortened) form.  RFC2553 is silent about it.  XNET 5.2
  *   says to use inet_aton() to convert IPv4 numeric to binary (allows
  *   classful form as a result).
  *   current code - disallow classful form for IPv4 (due to use of inet_pton).
- * - freeaddrinfo(NULL).  RFC2553 is silent about it.  XNET 5.2 says it is
+ *\li  freeaddrinfo(NULL).  RFC2553 is silent about it.  XNET 5.2 says it is
  *   invalid.
  *   current code - SEGV on freeaddrinfo(NULL)
  * Note:
- * - We use getipnodebyname() just for thread-safeness.  There's no intent
+ *\li  We use getipnodebyname() just for thread-safeness.  There's no intent
  *   to let it do PF_UNSPEC (actually we never pass PF_UNSPEC to
  *   getipnodebyname().
- * - The code filters out AFs that are not supported by the kernel,
+ *\li  The code filters out AFs that are not supported by the kernel,
  *   when globbing NULL hostname (to loopback, or wildcard).  Is it the right
  *   thing to do?  What is the relationship with post-RFC2553 AI_ADDRCONFIG
  *   in ai_flags?
- * - (post-2553) semantics of AI_ADDRCONFIG itself is too vague.
+ *\li  (post-2553) semantics of AI_ADDRCONFIG itself is too vague.
  *   (1) what should we do against numeric hostname (2) what should we do
  *   against NULL hostname (3) what is AI_ADDRCONFIG itself.  AF not ready?
  *   non-loopback address configured?  global address configured?
- * - To avoid search order issue, we have a big amount of code duplicate
+ * \par Additional Issue:
+ *  To avoid search order issue, we have a big amount of code duplicate
  *   from gethnamaddr.c and some other places.  The issues that there's no
  *   lower layer function to lookup "IPv4 or IPv6" record.  Calling
  *   gethostbyname2 from getaddrinfo will end up in wrong search order, as
  *   follows:
- *	- The code makes use of following calls when asked to resolver with
+ *	\li The code makes use of following calls when asked to resolver with
  *	  ai_family  = PF_UNSPEC:
- *		getipnodebyname(host, AF_INET6);
+ *\code		getipnodebyname(host, AF_INET6);
  *		getipnodebyname(host, AF_INET);
- *	  This will result in the following queries if the node is configure to
+ *\endcode
+ *	\li  This will result in the following queries if the node is configure to
  *	  prefer /etc/hosts than DNS:
+ *\code
  *		lookup /etc/hosts for IPv6 address
  *		lookup DNS for IPv6 address
  *		lookup /etc/hosts for IPv4 address
  *		lookup DNS for IPv4 address
+ *\endcode
  *	  which may not meet people's requirement.
- *	  The right thing to happen is to have underlying layer which does
+ *	 \li The right thing to happen is to have underlying layer which does
  *	  PF_UNSPEC lookup (lookup both) and return chain of addrinfos.
  *	  This would result in a bit of code duplicate with _dns_ghbyname() and
  *	  friends.
@@ -199,20 +203,20 @@ struct addrinfo *addr2addrinfo __P((const struct addrinfo *,
 #if 0
 static const char *ai_errlist[] = {
 	"Success",
-	"Address family for hostname not supported",	/* EAI_ADDRFAMILY */
-	"Temporary failure in name resolution",		/* EAI_AGAIN      */
-	"Invalid value for ai_flags",		       	/* EAI_BADFLAGS   */
-	"Non-recoverable failure in name resolution", 	/* EAI_FAIL       */
-	"ai_family not supported",			/* EAI_FAMILY     */
-	"Memory allocation failure", 			/* EAI_MEMORY     */
-	"No address associated with hostname", 		/* EAI_NODATA     */
-	"hostname nor servname provided, or not known",	/* EAI_NONAME     */
-	"servname not supported for ai_socktype",	/* EAI_SERVICE    */
-	"ai_socktype not supported", 			/* EAI_SOCKTYPE   */
-	"System error returned in errno", 		/* EAI_SYSTEM     */
-	"Invalid value for hints",			/* EAI_BADHINTS	  */
-	"Resolved protocol is unknown",			/* EAI_PROTOCOL   */
-	"Unknown error", 				/* EAI_MAX        */
+	"Address family for hostname not supported",	/*%< EAI_ADDRFAMILY */
+	"Temporary failure in name resolution",		/*%< EAI_AGAIN */
+	"Invalid value for ai_flags",		       	/*%< EAI_BADFLAGS */
+	"Non-recoverable failure in name resolution", 	/*%< EAI_FAIL */
+	"ai_family not supported",			/*%< EAI_FAMILY */
+	"Memory allocation failure", 			/*%< EAI_MEMORY */
+	"No address associated with hostname", 		/*%< EAI_NODATA */
+	"hostname nor servname provided, or not known",	/*%< EAI_NONAME */
+	"servname not supported for ai_socktype",	/*%< EAI_SERVICE */
+	"ai_socktype not supported", 			/*%< EAI_SOCKTYPE */
+	"System error returned in errno", 		/*%< EAI_SYSTEM */
+	"Invalid value for hints",			/*%< EAI_BADHINTS */
+	"Resolved protocol is unknown",			/*%< EAI_PROTOCOL */
+	"Unknown error", 				/*%< EAI_MAX */
 };
 #endif
 
@@ -268,7 +272,7 @@ do { \
 #define MATCH(x, y, w) \
 	((x) == (y) || (/*CONSTCOND*/(w) && ((x) == ANY || (y) == ANY)))
 
-#if 0				/* bind8 has its own version */
+#if 0				/*%< bind8 has its own version */
 char *
 gai_strerror(ecode)
 	int ecode;
@@ -352,7 +356,7 @@ getaddrinfo(hostname, servname, hints, res)
 		/* error check for hints */
 		if (hints->ai_addrlen || hints->ai_canonname ||
 		    hints->ai_addr || hints->ai_next)
-			SETERROR(EAI_BADHINTS); /* xxx */
+			SETERROR(EAI_BADHINTS); /*%< xxx */
 		if (hints->ai_flags & ~AI_MASK)
 			SETERROR(EAI_BADFLAGS);
 		switch (hints->ai_family) {
@@ -517,7 +521,7 @@ getaddrinfo(hostname, servname, hints, res)
 		goto free;
 	}
 	if (afai == NULL) {
-		error = EAI_NONAME; /* we've had no errors. */
+		error = EAI_NONAME; /*%< we've had no errors. */
 		goto free;
 	}
 
@@ -574,7 +578,7 @@ getaddrinfo(hostname, servname, hints, res)
 			cur = cur->ai_next;
 	}
 
-	freeaddrinfo(afai);	/* afai must not be NULL at this point. */
+	freeaddrinfo(afai);	/*%< afai must not be NULL at this point. */
 
 	if (sentinel.ai_next) {
 good:
@@ -597,7 +601,7 @@ bad:
 	return(error);
 }
 
-/*
+/*%
  * FQDN hostname, DNS lookup
  */
 static int
@@ -625,7 +629,7 @@ explore_fqdn(pai, hostname, servname, res)
 
 	if (!net_data || !(ho = net_data->ho))
 		return(0);
-#if 0				/* XXX (notyet) */
+#if 0				/*%< XXX (notyet) */
 	if (net_data->ho_stayopen && net_data->ho_last &&
 	    net_data->ho_last->h_addrtype == af) {
 		if (ns_samename(name, net_data->ho_last->h_name) == 1)
@@ -661,7 +665,7 @@ explore_fqdn(pai, hostname, servname, res)
 			error = EAI_NONAME;
 			break;
 		default:
-		case NETDB_SUCCESS: /* should be impossible... */
+		case NETDB_SUCCESS: /*%< should be impossible... */
 			error = EAI_NONAME;
 			break;
 		}
@@ -669,7 +673,7 @@ explore_fqdn(pai, hostname, servname, res)
 	}
 
 	for (cur = result; cur; cur = cur->ai_next) {
-		GET_PORT(cur, servname); /* XXX: redundant lookups... */
+		GET_PORT(cur, servname); /*%< XXX: redundant lookups... */
 		/* canonname should already be filled. */
 	}
 
@@ -685,8 +689,8 @@ free:
 
 static int
 explore_copy(pai, src0, res)
-	const struct addrinfo *pai;	/* seed */
-	const struct addrinfo *src0;	/* source */
+	const struct addrinfo *pai;	/*%< seed */
+	const struct addrinfo *src0;	/*%< source */
 	struct addrinfo **res;
 {
 	int error;
@@ -720,7 +724,7 @@ fail:
 	return error;
 }
 
-/*
+/*%
  * hostname == NULL.
  * passive socket -> anyaddr (0.0.0.0 or ::)
  * non-passive socket -> localhost (127.0.0.1 or ::1)
@@ -768,7 +772,7 @@ free:
 	return error;
 }
 
-/*
+/*%
  * numeric hostname
  */
 static int
@@ -831,7 +835,7 @@ bad:
 	return error;
 }
 
-/*
+/*%
  * numeric hostname with scope
  */
 static int
@@ -882,7 +886,7 @@ explore_numeric_scope(pai, hostname, servname, res)
 			sin6 = (struct sockaddr_in6 *)(void *)cur->ai_addr;
 			if (!ip6_str2scopeid(scope, sin6, &scopeid)) {
 				free(hostname2);
-				return(EAI_NONAME); /* XXX: is return OK? */
+				return(EAI_NONAME); /*%< XXX: is return OK? */
 			}
 #ifdef HAVE_SIN6_SCOPE_ID
 			sin6->sin6_scope_id = scopeid;
@@ -1078,7 +1082,7 @@ find_afd(af)
 	return NULL;
 }
 
-/*
+/*%
  * post-2553: AI_ADDRCONFIG check.  if we use getipnodeby* as backend, backend
  * will take care of it.
  * the semantics of AI_ADDRCONFIG is not defined well.  we are not sure
@@ -1136,8 +1140,7 @@ ip6_str2scopeid(char *scope, struct sockaddr_in6 *sin6,
 	if (IN6_IS_ADDR_MC_ORGLOCAL(a6))
 		goto trynumeric;
 	else
-		goto trynumeric;	/* global */
-
+		goto trynumeric;	/*%< global */
 	/* try to convert to a numeric id as a last resort */
 trynumeric:
 	errno = 0;
@@ -1174,7 +1177,7 @@ hostent2addrinfo(hp, pai)
 	cur = &sentinel;
 
 	for (i = 0; (ap = aplist[i]) != NULL; i++) {
-#if 0				/* the trick seems too much */
+#if 0				/*%< the trick seems too much */
 		af = hp->h_addr_list;
 		if (af == AF_INET6 &&
 		    IN6_IS_ADDR_V4MAPPED((struct in6_addr *)ap)) {
@@ -1198,7 +1201,7 @@ hostent2addrinfo(hp, pai)
 			 */
 			GET_CANONNAME(cur->ai_next, hp->h_name);
 		}
-		while (cur->ai_next) /* no need to loop, actually. */
+		while (cur->ai_next) /*%< no need to loop, actually. */
 			cur = cur->ai_next;
 		continue;
 
diff --git a/contrib/bind9/lib/bind/irs/getgrent.c b/contrib/bind9/lib/bind/irs/getgrent.c
index 7c394f2..fe91ab3 100644
--- a/contrib/bind9/lib/bind/irs/getgrent.c
+++ b/contrib/bind9/lib/bind/irs/getgrent.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: getgrent.c,v 1.3.206.1 2004/03/09 08:33:35 marka Exp $";
+static const char rcsid[] = "$Id: getgrent.c,v 1.4.18.1 2005/04/27 05:00:57 sra Exp $";
 #endif
 
 /* Imports */
@@ -221,3 +221,4 @@ init() {
 }
 
 #endif /* WANT_IRS_GR */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getgrent_r.c b/contrib/bind9/lib/bind/irs/getgrent_r.c
index 1e8b1a6..1f7d94d 100644
--- a/contrib/bind9/lib/bind/irs/getgrent_r.c
+++ b/contrib/bind9/lib/bind/irs/getgrent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getgrent_r.c,v 1.5.206.1 2004/03/09 08:33:35 marka Exp $";
+static const char rcsid[] = "$Id: getgrent_r.c,v 1.6.18.1 2005/04/27 05:00:57 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -120,7 +120,7 @@ getgrgid_r(gid_t gid, struct group *gptr,
 }
 #endif
 
-/*
+/*%
  *	These assume a single context is in operation per thread.
  *	If this is not the case we will need to call irs directly
  *	rather than through the base functions.
@@ -180,7 +180,7 @@ copy_group(struct group *ge, struct group *gptr, char *buf, int buflen) {
 	int numptr, len;
 
 	/* Find out the amount of space required to store the answer. */
-	numptr = 1; /* NULL ptr */
+	numptr = 1; /*%< NULL ptr */
 	len = (char *)ALIGN(buf) - buf;
 	for (i = 0; ge->gr_mem[i]; i++, numptr++) {
 		len += strlen(ge->gr_mem[i]) + 1;
@@ -227,3 +227,4 @@ copy_group(struct group *ge, struct group *gptr, char *buf, int buflen) {
 	static int getgrent_r_unknown_system = 0;
 #endif /* GROUP_R_RETURN */
 #endif /* !def(_REENTRANT) || !def(DO_PTHREADS) || !def(WANT_IRS_PW) */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gethostent.c b/contrib/bind9/lib/bind/irs/gethostent.c
index cfea501..23aaa30 100644
--- a/contrib/bind9/lib/bind/irs/gethostent.c
+++ b/contrib/bind9/lib/bind/irs/gethostent.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gethostent.c,v 1.1.2.2.4.3 2006/01/10 05:09:16 marka Exp $";
+static const char rcsid[] = "$Id: gethostent.c,v 1.6.18.2 2006/01/10 05:09:08 marka Exp $";
 #endif
 
 /* Imports */
@@ -235,11 +235,11 @@ static const unsigned char in6addr_mapped[12] = {
 static int scan_interfaces(int *, int *);
 static struct hostent *copyandmerge(struct hostent *, struct hostent *, int, int *);
 
-/*
+/*%
  *	Public functions
  */
 
-/*
+/*%
  *	AI_V4MAPPED + AF_INET6
  *	If no IPv6 address then a query for IPv4 and map returned values.
  *
@@ -445,11 +445,11 @@ freehostent(struct hostent *he) {
 	memput(he, sizeof *he);
 }
 
-/*
+/*%
  * Private
  */
 
-/*
+/*%
  * Scan the interface table and set have_v4 and have_v6 depending
  * upon whether there are IPv4 and IPv6 interface addresses.
  *
@@ -505,7 +505,7 @@ scan_interfaces6(int *have_v4, int *have_v6) {
 		if (buf == NULL)
 			goto cleanup;
 #ifdef SETFAMILYFLAGS
-		lifc.lifc_family = AF_UNSPEC;	/* request all families */
+		lifc.lifc_family = AF_UNSPEC;	/*%< request all families */
 		lifc.lifc_flags = 0;
 #endif
 		lifc.lifc_len = bufsiz;
@@ -533,7 +533,7 @@ scan_interfaces6(int *have_v4, int *have_v6) {
 	}
 
 	/* Parse system's interface list. */
-	cplim = buf + lifc.lifc_len;    /* skip over if's with big ifr_addr's */
+	cplim = buf + lifc.lifc_len;    /*%< skip over if's with big ifr_addr's */
 	for (cp = buf;
 	     (*have_v4 == 0 || *have_v6 == 0) && cp < cplim;
 	     cp += cpsize) {
@@ -639,7 +639,7 @@ static int
 scan_interfaces(int *have_v4, int *have_v6) {
 	struct ifconf ifc;
 	union {
-		char _pad[256];		/* leave space for IPv6 addresses */
+		char _pad[256];		/*%< leave space for IPv6 addresses */
 		struct ifreq ifreq;
 	} u;
 	struct in_addr in4;
@@ -712,7 +712,7 @@ scan_interfaces(int *have_v4, int *have_v6) {
 	}
 
 	/* Parse system's interface list. */
-	cplim = buf + ifc.ifc_len;    /* skip over if's with big ifr_addr's */
+	cplim = buf + ifc.ifc_len;    /*%< skip over if's with big ifr_addr's */
 	for (cp = buf;
 	     (*have_v4 == 0 || *have_v6 == 0) && cp < cplim;
 	     cp += cpsize) {
@@ -792,8 +792,8 @@ scan_interfaces(int *have_v4, int *have_v6) {
 static struct hostent *
 copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num) {
 	struct hostent *he = NULL;
-	int addresses = 1;	/* NULL terminator */
-	int names = 1;		/* NULL terminator */
+	int addresses = 1;	/*%< NULL terminator */
+	int names = 1;		/*%< NULL terminator */
 	int len = 0;
 	char **cpp, **npp;
 
@@ -1034,7 +1034,7 @@ fakeaddr(const char *name, int af, struct net_data *net_data) {
 	return (&pvt->host);
 }
 
-#ifdef grot	/* for future use in gethostbyaddr(), for "SUNSECURITY" */
+#ifdef grot	/*%< for future use in gethostbyaddr(), for "SUNSECURITY" */
 	struct hostent *rhp;
 	char **haddr;
 	u_long old_options;
@@ -1065,5 +1065,6 @@ fakeaddr(const char *name, int af, struct net_data *net_data) {
 	    }
 	}
 #endif /* grot */
-
 #endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/gethostent_r.c b/contrib/bind9/lib/bind/irs/gethostent_r.c
index 8a7cff0..96d2a57 100644
--- a/contrib/bind9/lib/bind/irs/gethostent_r.c
+++ b/contrib/bind9/lib/bind/irs/gethostent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: gethostent_r.c,v 1.4.206.4 2005/09/03 12:47:38 marka Exp $";
+static const char rcsid[] = "$Id: gethostent_r.c,v 1.5.18.4 2005/09/03 12:45:14 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -90,7 +90,7 @@ gethostbyaddr_r(const char *addr, int len, int type,
 #endif
 }
 
-/*
+/*%
  *	These assume a single context is in operation per thread.
  *	If this is not the case we will need to call irs directly
  *	rather than through the base functions.
@@ -163,7 +163,7 @@ copy_hostent(struct hostent *he, struct hostent *hptr, HOST_R_COPY_ARGS) {
 	int nptr, len;
 
 	/* Find out the amount of space required to store the answer. */
-	nptr = 2; /* NULL ptrs */
+	nptr = 2; /*%< NULL ptrs */
 	len = (char *)ALIGN(buf) - buf;
 	for (i = 0; he->h_addr_list[i]; i++, nptr++) {
 		len += he->h_length;
@@ -272,3 +272,4 @@ copy_hostent(struct hostent *he, struct hostent *hptr, HOST_R_COPY_ARGS) {
 	static int gethostent_r_unknown_system = 0;
 #endif /* HOST_R_RETURN */
 #endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getnameinfo.c b/contrib/bind9/lib/bind/irs/getnameinfo.c
index d6d89f3..89c8230 100644
--- a/contrib/bind9/lib/bind/irs/getnameinfo.c
+++ b/contrib/bind9/lib/bind/irs/getnameinfo.c
@@ -63,7 +63,7 @@
 
 #include <port_after.h>
 
-/*
+/*%
  * Note that a_off will be dynamically adjusted so that to be consistent
  * with the definition of sockaddr_in{,6}.
  * The value presented below is just a guess.
@@ -139,7 +139,7 @@ getnameinfo(sa, salen, host, hostlen, serv, servlen, flags)
  found:
 	if (salen != afd->a_socklen) return EAI_FAIL;
 
-	port = ((const struct sockinet *)sa)->si_port; /* network byte order */
+	port = ((const struct sockinet *)sa)->si_port; /*%< network byte order */
 	addr = (const char *)sa + afd->a_off;
 
 	if (serv == NULL || servlen == 0U) {
@@ -251,13 +251,13 @@ ip6_parsenumeric(const struct sockaddr *sa, const char *addr, char *host,
 		return EAI_SYSTEM;
 
 	numaddrlen = strlen(numaddr);
-	if (numaddrlen + 1 > hostlen) /* don't forget terminator */
+	if (numaddrlen + 1 > hostlen) /*%< don't forget terminator */
 		return EAI_MEMORY;
 	strcpy(host, numaddr);
 
 #ifdef HAVE_SIN6_SCOPE_ID
 	if (((const struct sockaddr_in6 *)sa)->sin6_scope_id) {
-		char scopebuf[MAXHOSTNAMELEN]; /* XXX */
+		char scopebuf[MAXHOSTNAMELEN]; /*%< XXX */
 		int scopelen;
 
 		/* ip6_sa2str never fails */
@@ -330,3 +330,5 @@ ip6_sa2str(const struct sockaddr_in6 *sa6, char *buf,
 	return(strlen(tmp));
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getnetent.c b/contrib/bind9/lib/bind/irs/getnetent.c
index 4d1cd1e..5f7d233 100644
--- a/contrib/bind9/lib/bind/irs/getnetent.c
+++ b/contrib/bind9/lib/bind/irs/getnetent.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: getnetent.c,v 1.4.206.2 2004/03/17 01:49:40 marka Exp $";
+static const char rcsid[] = "$Id: getnetent.c,v 1.6.18.1 2005/04/27 05:00:58 sra Exp $";
 #endif
 
 /* Imports */
@@ -321,7 +321,7 @@ nw_to_net(struct nwent *nwent, struct net_data *net_data) {
 	pvt->netent.n_aliases = nwent->n_aliases;
 	pvt->netent.n_addrtype = nwent->n_addrtype;
 
-/*
+/*%
  * What this code does: Converts net addresses from network to host form.
  *
  * msbyte: the index of the most significant byte in the n_addr array.
@@ -341,3 +341,5 @@ nw_to_net(struct nwent *nwent, struct net_data *net_data) {
 }
 
 #endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getnetent_r.c b/contrib/bind9/lib/bind/irs/getnetent_r.c
index 1f8290d..7e56ddc 100644
--- a/contrib/bind9/lib/bind/irs/getnetent_r.c
+++ b/contrib/bind9/lib/bind/irs/getnetent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getnetent_r.c,v 1.3.206.2 2005/09/03 12:47:38 marka Exp $";
+static const char rcsid[] = "$Id: getnetent_r.c,v 1.4.18.2 2005/09/03 12:45:14 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -83,7 +83,7 @@ getnetbyaddr_r(GETNETBYADDR_ADDR_T addr, int type, struct netent *nptr, NET_R_AR
 #endif
 }
 
-/*
+/*%
  *	These assume a single context is in operation per thread.
  *	If this is not the case we will need to call irs directly
  *	rather than through the base functions.
@@ -151,7 +151,7 @@ copy_netent(struct netent *ne, struct netent *nptr, NET_R_COPY_ARGS) {
 	int numptr, len;
 
 	/* Find out the amount of space required to store the answer. */
-	numptr = 1; /* NULL ptr */
+	numptr = 1; /*%< NULL ptr */
 	len = (char *)ALIGN(buf) - buf;
 	for (i = 0; ne->n_aliases[i]; i++, numptr++) {
 		len += strlen(ne->n_aliases[i]) + 1;
@@ -231,3 +231,4 @@ copy_netent(struct netent *ne, struct netent *nptr, NET_R_COPY_ARGS) {
 	static int getnetent_r_unknown_system = 0;
 #endif /* NET_R_RETURN */
 #endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getnetgrent.c b/contrib/bind9/lib/bind/irs/getnetgrent.c
index b275153..a11fa08 100644
--- a/contrib/bind9/lib/bind/irs/getnetgrent.c
+++ b/contrib/bind9/lib/bind/irs/getnetgrent.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getnetgrent.c,v 1.1.2.1.4.1 2004/03/09 08:33:36 marka Exp $";
+static const char rcsid[] = "$Id: getnetgrent.c,v 1.3.18.1 2005/04/27 05:00:58 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports */
@@ -154,3 +154,5 @@ init(void) {
 }
 
 #endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getnetgrent_r.c b/contrib/bind9/lib/bind/irs/getnetgrent_r.c
index b5d9bb1..261d9b7 100644
--- a/contrib/bind9/lib/bind/irs/getnetgrent_r.c
+++ b/contrib/bind9/lib/bind/irs/getnetgrent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getnetgrent_r.c,v 1.5.2.1.4.4 2005/09/03 12:47:38 marka Exp $";
+static const char rcsid[] = "$Id: getnetgrent_r.c,v 1.7.18.4 2005/09/03 12:45:15 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -51,7 +51,7 @@ innetgr_r(const char *netgroup, const char *host, const char *user,
 	return (innetgr(ng, ho, us, dom));
 }
 
-/*
+/*%
  *	These assume a single context is in operation per thread.
  *	If this is not the case we will need to call irs directly
  *	rather than through the base functions.
@@ -175,3 +175,4 @@ copy_protoent(char **machinep, char **userp, char **domainp,
 	static int getnetgrent_r_unknown_system = 0;
 #endif /* NGR_R_RETURN */
 #endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getprotoent.c b/contrib/bind9/lib/bind/irs/getprotoent.c
index 145062f..9e3d775 100644
--- a/contrib/bind9/lib/bind/irs/getprotoent.c
+++ b/contrib/bind9/lib/bind/irs/getprotoent.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: getprotoent.c,v 1.2.206.1 2004/03/09 08:33:36 marka Exp $";
+static const char rcsid[] = "$Id: getprotoent.c,v 1.3.18.1 2005/04/27 05:00:58 sra Exp $";
 #endif
 
 /* Imports */
@@ -172,3 +172,5 @@ init() {
 }
 
 #endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getprotoent_r.c b/contrib/bind9/lib/bind/irs/getprotoent_r.c
index 58d0ec9..00b1572 100644
--- a/contrib/bind9/lib/bind/irs/getprotoent_r.c
+++ b/contrib/bind9/lib/bind/irs/getprotoent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getprotoent_r.c,v 1.3.206.2 2006/08/01 01:19:28 marka Exp $";
+static const char rcsid[] = "$Id: getprotoent_r.c,v 1.4.18.2 2006/08/01 01:19:12 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -76,7 +76,7 @@ getprotobynumber_r(int proto, struct protoent *pptr, PROTO_R_ARGS) {
 #endif
 }
 
-/*
+/*%
  *	These assume a single context is in operation per thread.
  *	If this is not the case we will need to call irs directly
  *	rather than through the base functions.
@@ -142,7 +142,7 @@ copy_protoent(struct protoent *pe, struct protoent *pptr, PROTO_R_COPY_ARGS) {
 	int numptr, len;
 
 	/* Find out the amount of space required to store the answer. */
-	numptr = 1; /* NULL ptr */
+	numptr = 1; /*%< NULL ptr */
 	len = (char *)ALIGN(buf) - buf;
 	for (i = 0; pe->p_aliases[i]; i++, numptr++) {
 		len += strlen(pe->p_aliases[i]) + 1;
@@ -220,3 +220,4 @@ copy_protoent(struct protoent *pe, struct protoent *pptr, PROTO_R_COPY_ARGS) {
 	static int getprotoent_r_unknown_system = 0;
 #endif /* PROTO_R_RETURN */
 #endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getpwent.c b/contrib/bind9/lib/bind/irs/getpwent.c
index 10c237e..86f1d03 100644
--- a/contrib/bind9/lib/bind/irs/getpwent.c
+++ b/contrib/bind9/lib/bind/irs/getpwent.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: getpwent.c,v 1.1.206.1 2004/03/09 08:33:36 marka Exp $";
+static const char rcsid[] = "$Id: getpwent.c,v 1.2.18.1 2005/04/27 05:00:59 sra Exp $";
 #endif
 
 /* Imports */
@@ -198,3 +198,4 @@ init() {
 }
 
 #endif /* WANT_IRS_PW */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getpwent_r.c b/contrib/bind9/lib/bind/irs/getpwent_r.c
index d28f184..212d016 100644
--- a/contrib/bind9/lib/bind/irs/getpwent_r.c
+++ b/contrib/bind9/lib/bind/irs/getpwent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getpwent_r.c,v 1.5.206.2 2004/09/17 13:32:37 marka Exp $";
+static const char rcsid[] = "$Id: getpwent_r.c,v 1.6.18.2 2005/04/27 05:00:59 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -121,7 +121,7 @@ getpwuid_r(uid_t uid,  struct passwd *pwptr, char *buf, int buflen) {
 }
 #endif
 
-/*
+/*%
  *	These assume a single context is in operation per thread.
  *	If this is not the case we will need to call irs directly
  *	rather than through the base functions.
@@ -273,3 +273,4 @@ copy_passwd(struct passwd *pw, struct passwd *pwptr, char *buf, int buflen) {
 	static int getpwent_r_unknown_system = 0;
 #endif /* PASS_R_RETURN */
 #endif /* !def(_REENTRANT) || !def(DO_PTHREADS) || !def(WANT_IRS_PW) */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getservent.c b/contrib/bind9/lib/bind/irs/getservent.c
index a13e36f..92ed18b 100644
--- a/contrib/bind9/lib/bind/irs/getservent.c
+++ b/contrib/bind9/lib/bind/irs/getservent.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: getservent.c,v 1.2.206.1 2004/03/09 08:33:36 marka Exp $";
+static const char rcsid[] = "$Id: getservent.c,v 1.3.18.1 2005/04/27 05:00:59 sra Exp $";
 #endif
 
 /* Imports */
@@ -175,3 +175,5 @@ init() {
 }
 
 #endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/getservent_r.c b/contrib/bind9/lib/bind/irs/getservent_r.c
index 6dd7034..12c2b9b 100644
--- a/contrib/bind9/lib/bind/irs/getservent_r.c
+++ b/contrib/bind9/lib/bind/irs/getservent_r.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: getservent_r.c,v 1.3.206.2 2006/08/01 01:19:28 marka Exp $";
+static const char rcsid[] = "$Id: getservent_r.c,v 1.4.18.2 2006/08/01 01:19:12 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <port_before.h>
@@ -79,7 +79,7 @@ getservbyport_r(int port, const char *proto,
 #endif
 }
 
-/*
+/*%
  *	These assume a single context is in operation per thread.
  *	If this is not the case we will need to call irs directly
  *	rather than through the base functions.
@@ -145,7 +145,7 @@ copy_servent(struct servent *se, struct servent *sptr, SERV_R_COPY_ARGS) {
 	int numptr, len;
 
 	/* Find out the amount of space required to store the answer. */
-	numptr = 1; /* NULL ptr */
+	numptr = 1; /*%< NULL ptr */
 	len = (char *)ALIGN(buf) - buf;
 	for (i = 0; se->s_aliases[i]; i++, numptr++) {
 		len += strlen(se->s_aliases[i]) + 1;
@@ -239,3 +239,4 @@ copy_servent(struct servent *se, struct servent *sptr, SERV_R_COPY_ARGS) {
 	static int getservent_r_unknown_system = 0;
 #endif /*SERV_R_RETURN */
 #endif /* !defined(_REENTRANT) || !defined(DO_PTHREADS) */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/hesiod.c b/contrib/bind9/lib/bind/irs/hesiod.c
index 618c592..5abb57c 100644
--- a/contrib/bind9/lib/bind/irs/hesiod.c
+++ b/contrib/bind9/lib/bind/irs/hesiod.c
@@ -1,5 +1,5 @@
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: hesiod.c,v 1.1.2.1.4.4 2005/07/28 07:43:19 marka Exp $";
+static const char rcsid[] = "$Id: hesiod.c,v 1.4.18.3 2005/07/28 07:38:08 marka Exp $";
 #endif
 
 /*
@@ -19,16 +19,16 @@ static const char rcsid[] = "$Id: hesiod.c,v 1.1.2.1.4.4 2005/07/28 07:43:19 mar
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
- * This file is primarily maintained by <tytso@mit.edu> and <ghudson@mit.edu>.
- */
 
-/*
+/*! \file
+ * \brief
  * hesiod.c --- the core portion of the hesiod resolver.
  *
  * This file is derived from the hesiod library from Project Athena;
  * It has been extensively rewritten by Theodore Ts'o to have a more
  * thread-safe interface.
+ * \author
+ * This file is primarily maintained by &lt;tytso@mit.edu&gt; and &lt;ghudson@mit.edu&gt;.
  */
 
 /* Imports */
@@ -69,7 +69,7 @@ static int	init(struct hesiod_p *ctx);
 
 /* Public */
 
-/*
+/*%
  * This function is called to initialize a hesiod_p.
  */
 int
@@ -145,7 +145,7 @@ hesiod_init(void **context) {
 	return (-1);
 }
 
-/*
+/*%
  * This function deallocates the hesiod_p
  */
 void
@@ -165,7 +165,7 @@ hesiod_end(void *context) {
 	errno = save_errno;
 }
 
-/*
+/*%
  * This function takes a hesiod (name, type) and returns a DNS
  * name which is to be resolved.
  */
@@ -224,7 +224,7 @@ hesiod_to_bind(void *context, const char *name, const char *type) {
 	return (bindname);
 }
 
-/*
+/*%
  * This is the core function.  Given a hesiod (name, type), it
  * returns an array of strings returned by the resolver.
  */
@@ -265,7 +265,7 @@ hesiod_free_list(void *context, char **list) {
 	free(list);
 }
 
-/*
+/*%
  * This function parses the /etc/hesiod.conf file
  */
 static int
@@ -335,17 +335,17 @@ parse_config_file(struct hesiod_p *ctx, const char *filename) {
 	return (-1);
 }
 
-/*
+/*%
  * Given a DNS class and a DNS name, do a lookup for TXT records, and
  * return a list of them.
  */
 static char **
 get_txt_records(struct hesiod_p *ctx, int class, const char *name) {
 	struct {
-		int type;		/* RR type */
-		int class;		/* RR class */
-		int dlen;		/* len of data section */
-		u_char *data;		/* pointer to data */
+		int type;		/*%< RR type */
+		int class;		/*%< RR class */
+		int dlen;		/*%< len of data section */
+		u_char *data;		/*%< pointer to data */
 	} rr;
 	HEADER *hp;
 	u_char qbuf[MAX_HESRESP], abuf[MAX_HESRESP];
@@ -412,7 +412,7 @@ get_txt_records(struct hesiod_p *ctx, int class, const char *name) {
 		rr.type = ns_get16(cp);
 		cp += INT16SZ;
 		rr.class = ns_get16(cp);
-		cp += INT16SZ + INT32SZ;	/* skip the ttl, too */
+		cp += INT16SZ + INT32SZ;	/*%< skip the ttl, too */
 		rr.dlen = ns_get16(cp);
 		cp += INT16SZ;
 		if (cp + rr.dlen > eom) {
diff --git a/contrib/bind9/lib/bind/irs/hesiod_p.h b/contrib/bind9/lib/bind/irs/hesiod_p.h
index 5af70a7..f42f84a 100644
--- a/contrib/bind9/lib/bind/irs/hesiod_p.h
+++ b/contrib/bind9/lib/bind/irs/hesiod_p.h
@@ -16,27 +16,27 @@
  */
 
 /*
- * This file is primarily maintained by <tytso@mit.edu> and <ghudson@mit.edu>.
- */
-
-/*
- * $Id: hesiod_p.h,v 1.1.206.1 2004/03/09 08:33:36 marka Exp $
- */
-
-/*
- * hesiod_p.h -- private definitions for the hesiod library
+ * $Id: hesiod_p.h,v 1.2.18.1 2005/04/27 05:00:59 sra Exp $
  */
 
 #ifndef _HESIOD_P_H_INCLUDED
 #define _HESIOD_P_H_INCLUDED
 
-#define DEF_RHS		".Athena.MIT.EDU"	/* Defaults if HESIOD_CONF */
-#define DEF_LHS		".ns"			/*    file is not */
-						/*    present. */
+/** \file
+ * \brief
+ * hesiod_p.h -- private definitions for the hesiod library.
+ *
+ * \author
+ * This file is primarily maintained by tytso@mit.edu and ghudson@mit.edu.
+ */
+
+#define DEF_RHS		".Athena.MIT.EDU"	/*%< Defaults if HESIOD_CONF */
+#define DEF_LHS		".ns"			/*%<    file is not */
+						/*%<    present. */
 struct hesiod_p {
-	char *		LHS;		/* normally ".ns" */
-	char *		RHS;		/* AKA the default hesiod domain */
-	struct __res_state * res;	/* resolver context */
+	char *		LHS;		/*%< normally ".ns" */
+	char *		RHS;		/*%< AKA the default hesiod domain */
+	struct __res_state * res;	/*%< resolver context */
 	void		(*free_res)(void *);
 	void		(*res_set)(struct hesiod_p *, struct __res_state *,
 				   void (*)(void *));
diff --git a/contrib/bind9/lib/bind/irs/irp.c b/contrib/bind9/lib/bind/irs/irp.c
index 649079c..85a053d 100644
--- a/contrib/bind9/lib/bind/irs/irp.c
+++ b/contrib/bind9/lib/bind/irs/irp.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: irp.c,v 1.3.2.1.10.4 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: irp.c,v 1.6.18.3 2006/03/10 00:20:08 marka Exp $";
 #endif
 
 /* Imports */
@@ -66,7 +66,7 @@ static void		irp_close(struct irs_acc *);
 /* send errors to syslog if true. */
 int irp_log_errors = 1;
 
-/*
+/*%
  * This module handles the irp module connection to irpd.
  *
  * The client expects a synchronous interface to functions like
@@ -74,7 +74,7 @@ int irp_log_errors = 1;
  * the wire (it's used in the server).
  */
 
-/*
+/*%
  * irs_acc *irs_irp_acc(const char *options);
  *
  *	Initialize the irp module.
@@ -137,8 +137,7 @@ irs_irp_connection_setup(struct irp_p *cxndata, int *warned) {
 	return (0);
 }
 
-
-/*
+/*%
  * int irs_irp_connect(void);
  *
  *	Sets up the connection to the remote irpd server.
@@ -245,9 +244,7 @@ irs_irp_connect(struct irp_p *pvt) {
 	return (0);
 }
 
-
-
-/*
+/*%
  * int	irs_irp_is_connected(struct irp_p *pvt);
  *
  * Returns:
@@ -261,9 +258,7 @@ irs_irp_is_connected(struct irp_p *pvt) {
 	return (pvt->fdCxn >= 0);
 }
 
-
-
-/*
+/*%
  * void
  * irs_irp_disconnect(struct irp_p *pvt);
  *
@@ -355,11 +350,7 @@ irs_irp_read_line(struct irp_p *pvt, char *buffer, int len) {
 	return (buffpos);
 }
 
-
-
-
-
-/*
+/*%
  * int irp_read_response(struct irp_p *pvt);
  *
  * Returns:
@@ -399,9 +390,7 @@ irs_irp_read_response(struct irp_p *pvt, char *text, size_t textlen) {
 	return (code);
 }
 
-
-
-/*
+/*%
  * char *irp_read_body(struct irp_p *pvt, size_t *size);
  *
  *	Read in the body of a response. Terminated by a line with
@@ -471,8 +460,7 @@ irs_irp_read_body(struct irp_p *pvt, size_t *size) {
 	return (NULL);
 }
 
-
-/*
+/*%
  * int irs_irp_get_full_response(struct irp_p *pvt, int *code,
  *			char **body, size_t *bodylen);
  *
@@ -515,8 +503,7 @@ irs_irp_get_full_response(struct irp_p *pvt, int *code, char *text,
 	return (0);
 }
 
-
-/*
+/*%
  * int irs_irp_send_command(struct irp_p *pvt, const char *fmt, ...);
  *
  *	Sends command to remote connected via the PVT
@@ -572,9 +559,7 @@ irs_irp_send_command(struct irp_p *pvt, const char *fmt, ...) {
 
 /* Methods */
 
-
-
-/*
+/*%
  * void irp_close(struct irs_acc *this)
  *
  */
@@ -593,3 +578,5 @@ irp_close(struct irs_acc *this) {
 
 
 
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_gr.c b/contrib/bind9/lib/bind/irs/irp_gr.c
index f7e3a2f..bdab3da 100644
--- a/contrib/bind9/lib/bind/irs/irp_gr.c
+++ b/contrib/bind9/lib/bind/irs/irp_gr.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irp_gr.c,v 1.2.206.1 2004/03/09 08:33:36 marka Exp $";
+static const char rcsid[] = "$Id: irp_gr.c,v 1.3.18.1 2005/04/27 05:01:00 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* extern */
@@ -54,16 +54,17 @@ static int __bind_irs_gr_unneeded;
 
 /* Types. */
 
-/*
+/*! \file 
+ * \brief
  * Module for the getnetgrent(3) family to use when connected to a
  * remote irp daemon.
- *
+ * \brief
  * See irpd.c for justification of caching done here.
  *
  */
 
 struct pvt {
-	struct irp_p   *girpdata;	/* global IRP data */
+	struct irp_p   *girpdata;	/*%< global IRP data */
 	int		warned;
 	struct group	group;
 };
@@ -83,21 +84,9 @@ static void		free_group(struct group *gr);
 
 /* Public. */
 
-
-
-
-
-/*
- * struct irs_gr * irs_irp_gr(struct irs_acc *this)
- *
- * Notes:
- *
+/*%
  *	Initialize the group sub-module.
  *
- * Notes:
- *
- *	Module data.
- *
  */
 
 struct irs_gr *
@@ -132,13 +121,7 @@ irs_irp_gr(struct irs_acc *this) {
 
 /* Methods. */
 
-
-
-/*
- * void gr_close(struct irs_gr *this)
- *
- * Notes:
- *
+/*%
  *	Close the sub-module.
  *
  */
@@ -153,14 +136,7 @@ gr_close(struct irs_gr *this) {
 	memput(this, sizeof *this);
 }
 
-
-
-
-/*
- * struct group * gr_next(struct irs_gr *this)
- *
- * Notes:
- *
+/*%
  *	Gets the next group out of the cached data and returns it.
  *
  */
@@ -207,15 +183,7 @@ gr_next(struct irs_gr *this) {
 	return (gr);
 }
 
-
-
-
-
-/*
- * struct group * gr_byname(struct irs_gr *this, const char *name)
- *
- * Notes:
- *
+/*%
  *	Gets a group by name from irpd and returns it.
  *
  */
@@ -263,15 +231,7 @@ gr_byname(struct irs_gr *this, const char *name) {
 	return (gr);
 }
 
-
-
-
-
-/*
- * struct group * gr_bygid(struct irs_gr *this, gid_t gid)
- *
- * Notes:
- *
+/*%
  *	Gets a group by gid from irpd and returns it.
  *
  */
@@ -318,10 +278,7 @@ gr_bygid(struct irs_gr *this, gid_t gid) {
 	return (gr);
 }
 
-
-
-
-/*
+/*%
  * void gr_rewind(struct irs_gr *this)
  *
  */
@@ -350,14 +307,7 @@ gr_rewind(struct irs_gr *this) {
 	return;
 }
 
-
-
-
-/*
- * void gr_minimize(struct irs_gr *this)
- *
- * Notes:
- *
+/*%
  *	Frees up cached data and disconnects(if necessary) from the remote.
  *
  */
@@ -372,9 +322,7 @@ gr_minimize(struct irs_gr *this) {
 
 /* Private. */
 
-
-
-/*
+/*%
  * static void free_group(struct group *gr);
  *
  *	Deallocate all the memory irp_unmarshall_gr allocated.
@@ -406,3 +354,4 @@ free_group(struct group *gr) {
 
 
 #endif /* WANT_IRS_GR */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_ho.c b/contrib/bind9/lib/bind/irs/irp_ho.c
index 9056612..d71285e 100644
--- a/contrib/bind9/lib/bind/irs/irp_ho.c
+++ b/contrib/bind9/lib/bind/irs/irp_ho.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irp_ho.c,v 1.1.206.1 2004/03/09 08:33:36 marka Exp $";
+static const char rcsid[] = "$Id: irp_ho.c,v 1.2.18.1 2005/04/27 05:01:00 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -84,9 +84,7 @@ static struct addrinfo * ho_addrinfo(struct irs_ho *this, const char *name,
 
 /* Public. */
 
-
-
-/*
+/*%
  * struct irs_ho * irs_irp_ho(struct irs_acc *this)
  *
  * Notes:
@@ -129,13 +127,7 @@ irs_irp_ho(struct irs_acc *this) {
 
 /* Methods. */
 
-
-
-/*
- * void ho_close(struct irs_ho *this)
- *
- * Notes:
- *
+/*%
  *	Closes down the module.
  *
  */
@@ -281,15 +273,7 @@ ho_byaddr(struct irs_ho *this, const void *addr, int len, int af) {
 	return (ho);
 }
 
-
-
-
-
-/*
- * struct hostent * ho_next(struct irs_ho *this)
- *
- * Notes:
- *
+/*%
  *	The implementation for gethostent(3). The first time it's
  *	called all the data is pulled from the remote(i.e. what
  *	the maximum number of gethostent(3) calls would return)
@@ -336,11 +320,7 @@ ho_next(struct irs_ho *this) {
 	return (ho);
 }
 
-
-
-
-
-/*
+/*%
  * void ho_rewind(struct irs_ho *this)
  *
  */
@@ -369,10 +349,7 @@ ho_rewind(struct irs_ho *this) {
 	return;
 }
 
-
-
-
-/*
+/*%
  * void ho_minimize(struct irs_ho *this)
  *
  */
@@ -386,10 +363,7 @@ ho_minimize(struct irs_ho *this) {
 	irs_irp_disconnect(pvt->girpdata);
 }
 
-
-
-
-/*
+/*%
  * void free_host(struct hostent *ho)
  *
  */
@@ -427,3 +401,5 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 	UNUSED(pai);
 	return(NULL);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_ng.c b/contrib/bind9/lib/bind/irs/irp_ng.c
index cf7bc7c..e0aa468 100644
--- a/contrib/bind9/lib/bind/irs/irp_ng.c
+++ b/contrib/bind9/lib/bind/irs/irp_ng.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: irp_ng.c,v 1.1.206.1 2004/03/09 08:33:37 marka Exp $";
+static const char rcsid[] = "$Id: irp_ng.c,v 1.2.18.2 2006/12/07 04:53:02 marka Exp $";
 #endif
 
 /* Imports */
@@ -62,13 +62,7 @@ static void		ng_minimize(struct irs_ng *);
 
 /* Public */
 
-
-
-/*
- * struct irs_ng * irs_irp_ng(struct irs_acc *this)
- *
- * Notes:
- *
+/*%
  *	Intialize the irp netgroup module.
  *
  */
@@ -155,15 +149,7 @@ ng_rewind(struct irs_ng *this, const char *group) {
 	return;
 }
 
-
-
-
 /*
- * int ng_next(struct irs_ng *this, const char **host, const char **user,
- *	       const char **domain)
- *
- * Notes:
- *
  *	Get the next netgroup item from the cache.
  *
  */
@@ -205,14 +191,7 @@ ng_next(struct irs_ng *this, const char **host, const char **user,
 	return (rval);
 }
 
-
-
 /*
- * int ng_test(struct irs_ng *this, const char *name, const char *host,
- *		const char *user, const char *domain)
- *
- * Notes:
- *
  *	Search for a match in a netgroup.
  *
  */
@@ -239,14 +218,14 @@ ng_test(struct irs_ng *this, const char *name,
 	}
 
 	if (irs_irp_send_command(pvt->girpdata, "innetgr %s", body) == 0) {
-		memput(body, bodylen);
-
 		code = irs_irp_read_response(pvt->girpdata, text, sizeof text);
 		if (code == IRPD_GETNETGR_MATCHES) {
 			rval = 1;
 		}
 	}
 
+	memput(body, bodylen);
+
 	return (rval);
 }
 
@@ -270,3 +249,5 @@ ng_minimize(struct irs_ng *this) {
 
 /* Private */
 
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_nw.c b/contrib/bind9/lib/bind/irs/irp_nw.c
index ea68612..b285120 100644
--- a/contrib/bind9/lib/bind/irs/irp_nw.c
+++ b/contrib/bind9/lib/bind/irs/irp_nw.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irp_nw.c,v 1.1.206.2 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: irp_nw.c,v 1.2.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #if 0
@@ -79,9 +79,7 @@ static void		free_nw(struct nwent *nw);
 
 /* Public */
 
-
-
-/*
+/*%
  * struct irs_nw * irs_irp_nw(struct irs_acc *this) 
  *
  */
@@ -117,9 +115,7 @@ irs_irp_nw(struct irs_acc *this) {
 
 /* Methods */
 
-
-
-/*
+/*%
  * void nw_close(struct irs_nw *this) 
  *
  */
@@ -136,10 +132,7 @@ nw_close(struct irs_nw *this) {
 	memput(this, sizeof *this);
 }
 
-
-
-
-/*
+/*%
  * struct nwent * nw_byaddr(struct irs_nw *this, void *net, 
  * 				int length, int type) 
  *
@@ -152,7 +145,7 @@ nw_byaddr(struct irs_nw *this, void *net, int length, int type) {
 	char *body = NULL;
 	size_t bodylen;
 	int code;
-	char paddr[24];			/* bigenough for ip4 w/ cidr spec. */
+	char paddr[24];			/*%< bigenough for ip4 w/ cidr spec. */
 	char text[256];
 
 	if (inet_net_ntop(type, net, length, paddr, sizeof paddr) == NULL) {
@@ -189,10 +182,7 @@ nw_byaddr(struct irs_nw *this, void *net, int length, int type) {
 	return (nw);
 }
 
-
-
-
-/*
+/*%
  * struct nwent * nw_byname(struct irs_nw *this, const char *name, int type) 
  *
  */
@@ -241,10 +231,7 @@ nw_byname(struct irs_nw *this, const char *name, int type) {
 	return (nw);
 }
 
-
-
-
-/*
+/*%
  * void nw_rewind(struct irs_nw *this) 
  *
  */
@@ -273,16 +260,7 @@ nw_rewind(struct irs_nw *this) {
 	return;
 }
 
-
-
-
-
-
-/*
- * struct nwent * nw_next(struct irs_nw *this) 
- *
- * Notes:
- * 	
+/*%
  * 	Prepares the cache if necessary and returns the first, or 
  * 	next item from it.
  */
@@ -324,12 +302,7 @@ nw_next(struct irs_nw *this) {
 	return (nw);
 }
 
-
-
-
-
-
-/*
+/*%
  * void nw_minimize(struct irs_nw *this) 
  *
  */
@@ -346,11 +319,7 @@ nw_minimize(struct irs_nw *this) {
 
 /* private. */
 
-
-
-/*
- * static void free_passwd(struct passwd *pw);
- *
+/*%
  *	deallocate all the memory irp_unmarshall_pw allocated.
  *
  */
@@ -375,3 +344,5 @@ free_nw(struct nwent *nw) {
 	if (nw->n_addr != NULL)
 		free(nw->n_addr);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_p.h b/contrib/bind9/lib/bind/irs/irp_p.h
index fa2858d..21d31cc 100644
--- a/contrib/bind9/lib/bind/irs/irp_p.h
+++ b/contrib/bind9/lib/bind/irs/irp_p.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: irp_p.h,v 1.1.2.2.4.1 2004/03/09 08:33:37 marka Exp $
+ * $Id: irp_p.h,v 1.4.18.1 2005/04/27 05:01:00 sra Exp $
  */
 
 #ifndef _IRP_P_H_INCLUDED
@@ -26,9 +26,8 @@
 
 struct irp_p {
 	char inbuffer[1024];
-	int inlast; /* index of one past the last char in buffer */
-	int incurr; /* index of the next char to be read from buffer */
-
+	int inlast; /*%< index of one past the last char in buffer */
+	int incurr; /*%< index of the next char to be read from buffer */
 	int fdCxn;
 };
 
@@ -57,3 +56,5 @@ int irs_irp_get_full_response(struct irp_p *pvt, int *code,
 extern int irp_log_errors;
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_pr.c b/contrib/bind9/lib/bind/irs/irp_pr.c
index 07d739d..00e69ab 100644
--- a/contrib/bind9/lib/bind/irs/irp_pr.c
+++ b/contrib/bind9/lib/bind/irs/irp_pr.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irp_pr.c,v 1.1.206.1 2004/03/09 08:33:37 marka Exp $";
+static const char rcsid[] = "$Id: irp_pr.c,v 1.2.18.1 2005/04/27 05:01:01 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* extern */
@@ -69,9 +69,7 @@ static void			free_proto(struct protoent *pr);
 
 /* Public */
 
-
-
-/*
+/*%
  * struct irs_pr * irs_irp_pr(struct irs_acc *this)
  *
  */
@@ -107,9 +105,7 @@ irs_irp_pr(struct irs_acc *this) {
 
 /* Methods */
 
-
-
-/*
+/*%
  * void pr_close(struct irs_pr *this)
  *
  */
@@ -126,9 +122,7 @@ pr_close(struct irs_pr *this) {
 	memput(this, sizeof *this);
 }
 
-
-
-/*
+/*%
  * struct protoent * pr_byname(struct irs_pr *this, const char *name)
  *
  */
@@ -177,9 +171,7 @@ pr_byname(struct irs_pr *this, const char *name) {
 	return (pr);
 }
 
-
-
-/*
+/*%
  * struct protoent * pr_bynumber(struct irs_pr *this, int proto)
  *
  */
@@ -228,10 +220,7 @@ pr_bynumber(struct irs_pr *this, int proto) {
 	return (pr);
 }
 
-
-
-
-/*
+/*%
  * void pr_rewind(struct irs_pr *this)
  *
  */
@@ -260,14 +249,7 @@ pr_rewind(struct irs_pr *this) {
 	return;
 }
 
-
-
-
-/*
- * struct protoent * pr_next(struct irs_pr *this)
- *
- * Notes:
- *
+/*%
  *	Prepares the cache if necessary and returns the next item in it.
  *
  */
@@ -311,10 +293,7 @@ pr_next(struct irs_pr *this) {
 	return (pr);
 }
 
-
-
-
-/*
+/*%
  * void pr_minimize(struct irs_pr *this)
  *
  */
@@ -326,14 +305,7 @@ pr_minimize(struct irs_pr *this) {
 	irs_irp_disconnect(pvt->girpdata);
 }
 
-
-
-
-
-
-/*
- * static void free_proto(struct protoent *pw);
- *
+/*%
  *	Deallocate all the memory irp_unmarshall_pr allocated.
  *
  */
@@ -351,3 +323,5 @@ free_proto(struct protoent *pr) {
 	for (p = pr->p_aliases ; p != NULL && *p != NULL ; p++)
 		free(*p);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_pw.c b/contrib/bind9/lib/bind/irs/irp_pw.c
index 069f588..a326375 100644
--- a/contrib/bind9/lib/bind/irs/irp_pw.c
+++ b/contrib/bind9/lib/bind/irs/irp_pw.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irp_pw.c,v 1.2.206.1 2004/03/09 08:33:37 marka Exp $";
+static const char rcsid[] = "$Id: irp_pw.c,v 1.3.18.1 2005/04/27 05:01:01 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Extern */
@@ -55,9 +55,9 @@ static int __bind_irs_pw_unneeded;
 /* Types */
 
 struct	pvt {
-	struct irp_p   *girpdata; /* global IRP data */
+	struct irp_p   *girpdata; /*%< global IRP data */
 	int		warned;
-	struct passwd	passwd;		/* password structure */
+	struct passwd	passwd;		/*%< password structure */
 };
 
 /* Forward */
@@ -104,9 +104,7 @@ irs_irp_pw(struct irs_acc *this) {
 
 /* Methods */
 
-
-
-/*
+/*%
  * void pw_close(struct irs_pw *this)
  *
  */
@@ -123,10 +121,7 @@ pw_close(struct irs_pw *this) {
 	memput(this, sizeof *this);
 }
 
-
-
-
-/*
+/*%
  * struct passwd * pw_next(struct irs_pw *this)
  *
  */
@@ -170,10 +165,7 @@ pw_next(struct irs_pw *this) {
 	return (pw);
 }
 
-
-
-
-/*
+/*%
  * struct passwd * pw_byname(struct irs_pw *this, const char *name)
  *
  */
@@ -221,10 +213,7 @@ pw_byname(struct irs_pw *this, const char *name) {
 	return (pw);
 }
 
-
-
-
-/*
+/*%
  * struct passwd * pw_byuid(struct irs_pw *this, uid_t uid)
  *
  */
@@ -272,10 +261,7 @@ pw_byuid(struct irs_pw *this, uid_t uid) {
 	return (pw);
 }
 
-
-
-
-/*
+/*%
  * void pw_rewind(struct irs_pw *this)
  *
  */
@@ -304,8 +290,7 @@ pw_rewind(struct irs_pw *this) {
 	return;
 }
 
-
-/*
+/*%
  * void pw_minimize(struct irs_pw *this)
  *
  */
@@ -320,11 +305,7 @@ pw_minimize(struct irs_pw *this) {
 
 /* Private. */
 
-
-
-/*
- * static void free_passwd(struct passwd *pw);
- *
+/*%
  *	Deallocate all the memory irp_unmarshall_pw allocated.
  *
  */
@@ -356,3 +337,4 @@ free_passwd(struct passwd *pw) {
 }
 
 #endif /* WANT_IRS_PW */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irp_sv.c b/contrib/bind9/lib/bind/irs/irp_sv.c
index 0c4d6a1..22ea980 100644
--- a/contrib/bind9/lib/bind/irs/irp_sv.c
+++ b/contrib/bind9/lib/bind/irs/irp_sv.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irp_sv.c,v 1.1.206.1 2004/03/09 08:33:37 marka Exp $";
+static const char rcsid[] = "$Id: irp_sv.c,v 1.2.18.1 2005/04/27 05:01:01 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* extern */
@@ -73,9 +73,7 @@ static void			free_service(struct servent *sv);
 
 /* Public */
 
-
-
-/*
+/*%
  * struct irs_sv * irs_irp_sv(struct irs_acc *this)
  *
  */
@@ -112,9 +110,7 @@ irs_irp_sv(struct irs_acc *this) {
 
 /* Methods */
 
-
-
-/*
+/*%
  * void sv_close(struct irs_sv *this)
  *
  */
@@ -131,14 +127,7 @@ sv_close(struct irs_sv *this) {
 	memput(this, sizeof *this);
 }
 
-
-
-
-/*
- * struct servent * sv_next(struct irs_sv *this)
- *
- * Notes:
- *
+/*%
  *	Fills the cache if necessary and returns the next item from it.
  *
  */
@@ -182,10 +171,7 @@ sv_next(struct irs_sv *this) {
 	return (sv);
 }
 
-
-
-
-/*
+/*%
  * struct servent * sv_byname(struct irs_sv *this, const char *name,
  *				const char *proto)
  *
@@ -236,10 +222,7 @@ sv_byname(struct irs_sv *this, const char *name, const char *proto) {
 	return (sv);
 }
 
-
-
-
-/*
+/*%
  * struct servent * sv_byport(struct irs_sv *this, int port,
  *				const char *proto)
  *
@@ -291,11 +274,7 @@ sv_byport(struct irs_sv *this, int port, const char *proto) {
 	return (sv);
 }
 
-
-
-
-
-/*
+/*%
  * void sv_rewind(struct irs_sv *this)
  *
  */
@@ -324,11 +303,7 @@ sv_rewind(struct irs_sv *this) {
 	return;
 }
 
-
-
-
-
-/*
+/*%
  * void sv_minimize(struct irs_sv *this)
  *
  */
@@ -367,3 +342,5 @@ free_service(struct servent *sv) {
 }
 
 
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irpmarshall.c b/contrib/bind9/lib/bind/irs/irpmarshall.c
index 198e349..8c34fa2 100644
--- a/contrib/bind9/lib/bind/irs/irpmarshall.c
+++ b/contrib/bind9/lib/bind/irs/irpmarshall.c
@@ -49,7 +49,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: irpmarshall.c,v 1.3.206.4 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: irpmarshall.c,v 1.5.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #if 0
@@ -118,15 +118,14 @@ static const char *COLONSTR = ":";
 #ifdef WANT_IRS_PW
 /* +++++++++++++++++++++++++ struct passwd +++++++++++++++++++++++++ */
 
-
-/*
+/*%
  * int irp_marshall_pw(const struct passwd *pw, char **buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
- *	See above
+ *	See irpmarshall.h
  *
- * return:
+ * return: \li
  *
  *	0 on sucess, -1 on failure.
  *
@@ -134,7 +133,7 @@ static const char *COLONSTR = ":";
 
 int
 irp_marshall_pw(const struct passwd *pw, char **buffer, size_t *len) {
-	size_t need = 1 ;		/* for null byte */
+	size_t need = 1 ;		/*%< for null byte */
 	char pwUid[24];
 	char pwGid[24];
 	char pwChange[24];
@@ -170,7 +169,7 @@ irp_marshall_pw(const struct passwd *pw, char **buffer, size_t *len) {
 	pwClass = "";
 #endif
 
-	need += strlen(pw->pw_name)	+ 1; /* one for fieldsep */
+	need += strlen(pw->pw_name)	+ 1; /*%< one for fieldsep */
 	need += strlen(pw->pw_passwd)	+ 1;
 	need += strlen(pwUid)		+ 1;
 	need += strlen(pwGid)		+ 1;
@@ -192,7 +191,7 @@ irp_marshall_pw(const struct passwd *pw, char **buffer, size_t *len) {
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -216,18 +215,14 @@ irp_marshall_pw(const struct passwd *pw, char **buffer, size_t *len) {
 	return (0);
 }
 
-
-
-
-
-/*
+/*%
  * int irp_unmarshall_pw(struct passwd *pw, char *buffer)
  *
- * notes:
+ * notes: \li
  *
- *	see above
+ *	See irpmarshall.h
  *
- * return:
+ * return: \li
  *
  *	0 on success, -1 on failure
  *
@@ -258,7 +253,7 @@ irp_unmarshall_pw(struct passwd *pw, char *buffer) {
 
 	/* pw_passwd field */
 	pass = NULL;
-	if (getfield(&pass, 0, &p, fieldsep) == NULL) { /* field can be empty */
+	if (getfield(&pass, 0, &p, fieldsep) == NULL) { /*%< field can be empty */
 		goto error;
 	}
 
@@ -271,10 +266,10 @@ irp_unmarshall_pw(struct passwd *pw, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	pwuid = (uid_t)t;
-	if ((long) pwuid != t) {	/* value must have been too big. */
+	if ((long) pwuid != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 
@@ -288,10 +283,10 @@ irp_unmarshall_pw(struct passwd *pw, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	pwgid = (gid_t)t;
-	if ((long)pwgid != t) {	/* value must have been too big. */
+	if ((long)pwgid != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 
@@ -313,10 +308,10 @@ irp_unmarshall_pw(struct passwd *pw, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	pwchange = (time_t)t;
-	if ((long)pwchange != t) {	/* value must have been too big. */
+	if ((long)pwchange != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 
@@ -330,10 +325,10 @@ irp_unmarshall_pw(struct passwd *pw, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	pwexpire = (time_t)t;
-	if ((long) pwexpire != t) {	/* value must have been too big. */
+	if ((long) pwexpire != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 
@@ -397,28 +392,23 @@ irp_unmarshall_pw(struct passwd *pw, char *buffer) {
 
 /* ------------------------- struct passwd ------------------------- */
 #endif /* WANT_IRS_PW */
-
-
-
 /* +++++++++++++++++++++++++ struct group +++++++++++++++++++++++++ */
 
-
-
-/*
+/*%
  * int irp_marshall_gr(const struct group *gr, char **buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
- *	see above.
+ *	See irpmarshall.h.
  *
- * return:
+ * return: \li
  *
  *	0 on success, -1 on failure
  */
 
 int
 irp_marshall_gr(const struct group *gr, char **buffer, size_t *len) {
-	size_t need = 1;	/* for null byte */
+	size_t need = 1;	/*%< for null byte */
 	char grGid[24];
 	const char *fieldsep = COLONSTR;
 
@@ -449,7 +439,7 @@ irp_marshall_gr(const struct group *gr, char **buffer, size_t *len) {
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -470,17 +460,14 @@ irp_marshall_gr(const struct group *gr, char **buffer, size_t *len) {
 	return (0);
 }
 
-
-
-
-/*
+/*%
  * int irp_unmarshall_gr(struct group *gr, char *buffer)
  *
- * notes:
+ * notes: \li
  *
- *	see above
+ *	See irpmarshall.h
  *
- * return:
+ * return: \li
  *
  *	0 on success and -1 on failure.
  *
@@ -528,10 +515,10 @@ irp_unmarshall_gr(struct group *gr, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	grgid = (gid_t)t;
-	if ((long) grgid != t) {	/* value must have been too big. */
+	if ((long) grgid != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 
@@ -575,16 +562,14 @@ irp_unmarshall_gr(struct group *gr, char *buffer) {
 
 /* +++++++++++++++++++++++++ struct servent +++++++++++++++++++++++++ */
 
-
-
-/*
+/*%
  * int irp_marshall_sv(const struct servent *sv, char **buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
- *	see above
+ *	See irpmarshall.h
  *
- * return:
+ * return: \li
  *
  *	0 on success, -1 on failure.
  *
@@ -592,7 +577,7 @@ irp_unmarshall_gr(struct group *gr, char *buffer) {
 
 int
 irp_marshall_sv(const struct servent *sv, char **buffer, size_t *len) {
-	size_t need = 1;	/* for null byte */
+	size_t need = 1;	/*%< for null byte */
 	char svPort[24];
 	const char *fieldsep = COLONSTR;
 	short realport;
@@ -623,7 +608,7 @@ irp_marshall_sv(const struct servent *sv, char **buffer, size_t *len) {
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -641,18 +626,14 @@ irp_marshall_sv(const struct servent *sv, char **buffer, size_t *len) {
 	return (0);
 }
 
-
-
-
-
-/*
+/*%
  * int irp_unmarshall_sv(struct servent *sv, char *buffer)
  *
- * notes:
+ * notes: \li
  *
- *	see above
+ *	See irpmarshall.h
  *
- * return:
+ * return: \li
  *
  *	0 on success, -1 on failure.
  *
@@ -705,10 +686,10 @@ irp_unmarshall_sv(struct servent *sv, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	svport = (short)t;
-	if ((long) svport != t) {	/* value must have been too big. */
+	if ((long) svport != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 	svport = htons(svport);
@@ -741,16 +722,14 @@ irp_unmarshall_sv(struct servent *sv, char *buffer) {
 
 /* +++++++++++++++++++++++++ struct protoent +++++++++++++++++++++++++ */
 
-
-
-/*
+/*%
  * int irp_marshall_pr(struct protoent *pr, char **buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
- *	see above
+ *	See irpmarshall.h
  *
- * return:
+ * return: \li
  *
  *	0 on success and -1 on failure.
  *
@@ -758,7 +737,7 @@ irp_unmarshall_sv(struct servent *sv, char *buffer) {
 
 int
 irp_marshall_pr(struct protoent *pr, char **buffer, size_t *len) {
-	size_t need = 1;	/* for null byte */
+	size_t need = 1;	/*%< for null byte */
 	char prProto[24];
 	const char *fieldsep = COLONSTR;
 
@@ -784,7 +763,7 @@ irp_marshall_pr(struct protoent *pr, char **buffer, size_t *len) {
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -802,16 +781,14 @@ irp_marshall_pr(struct protoent *pr, char **buffer, size_t *len) {
 
 }
 
-
-
-/*
+/*%
  * int irp_unmarshall_pr(struct protoent *pr, char *buffer)
  *
- * notes:
+ * notes: \li
  *
- *	See above
+ *	See irpmarshall.h
  *
- * return:
+ * return: \li
  *
  *	0 on success, -1 on failure
  *
@@ -863,10 +840,10 @@ int irp_unmarshall_pr(struct protoent *pr, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	prproto = (int)t;
-	if ((long) prproto != t) {	/* value must have been too big. */
+	if ((long) prproto != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 
@@ -891,15 +868,14 @@ int irp_unmarshall_pr(struct protoent *pr, char *buffer) {
 
 /* +++++++++++++++++++++++++ struct hostent +++++++++++++++++++++++++ */
 
-
-/*
+/*%
  * int irp_marshall_ho(struct hostent *ho, char **buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
- *	see above.
+ *	See irpmarshall.h.
  *
- * return:
+ * return: \li
  *
  *	0 on success, -1 on failure.
  *
@@ -907,7 +883,7 @@ int irp_unmarshall_pr(struct protoent *pr, char *buffer) {
 
 int
 irp_marshall_ho(struct hostent *ho, char **buffer, size_t *len) {
-	size_t need = 1;	/* for null byte */
+	size_t need = 1;	/*%< for null byte */
 	char hoaddrtype[24];
 	char holength[24];
 	char **av;
@@ -945,7 +921,7 @@ irp_marshall_ho(struct hostent *ho, char **buffer, size_t *len) {
 
 	/* we determine an upper bound on the string length needed, not an
 	   exact length. */
-	addrlen = (ho->h_addrtype == AF_INET ? 16 : 46) ; /* XX other AF's?? */
+	addrlen = (ho->h_addrtype == AF_INET ? 16 : 46) ; /*%< XX other AF's?? */
 	for (av = ho->h_addr_list; av != NULL && *av != NULL ; av++)
 		need += addrlen;
 
@@ -960,7 +936,7 @@ irp_marshall_ho(struct hostent *ho, char **buffer, size_t *len) {
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -999,16 +975,14 @@ irp_marshall_ho(struct hostent *ho, char **buffer, size_t *len) {
 	return (-1);
 }
 
-
-
-/*
+/*%
  * int irp_unmarshall_ho(struct hostent *ho, char *buffer)
  *
- * notes:
+ * notes: \li
  *
- *	See above.
+ *	See irpmarshall.h.
  *
- * return:
+ * return: \li
  *
  *	0 on success, -1 on failure.
  *
@@ -1080,10 +1054,10 @@ irp_unmarshall_ho(struct hostent *ho, char *buffer) {
 	}
 	t = strtol(tmpbuf, &tb, 10);
 	if (*tb) {
-		goto error;	/* junk in value */
+		goto error;	/*%< junk in value */
 	}
 	holength = (int)t;
-	if ((long) holength != t) {	/* value must have been too big. */
+	if ((long) holength != t) {	/*%< value must have been too big. */
 		goto error;
 	}
 
@@ -1155,16 +1129,15 @@ irp_unmarshall_ho(struct hostent *ho, char *buffer) {
 
 /* +++++++++++++++++++++++++ struct netgrp +++++++++++++++++++++++++ */
 
-
-/*
+/*%
  * int irp_marshall_ng(const char *host, const char *user,
  *		       const char *domain, char *buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
  *	See note for irp_marshall_ng_start
  *
- * return:
+ * return: \li
  *
  *	0 on success, 0 on failure.
  *
@@ -1173,7 +1146,7 @@ irp_unmarshall_ho(struct hostent *ho, char *buffer) {
 int
 irp_marshall_ng(const char *host, const char *user, const char *domain,
 		char **buffer, size_t *len) {
-	size_t need = 1; /* for nul byte */
+	size_t need = 1; /*%< for nul byte */
 	const char *fieldsep = ",";
 
 	if (len == NULL) {
@@ -1181,7 +1154,7 @@ irp_marshall_ng(const char *host, const char *user, const char *domain,
 		return (-1);
 	}
 
-	need += 4;		       /* two parens and two commas */
+	need += 4;		       /*%< two parens and two commas */
 	need += (host == NULL ? 0 : strlen(host));
 	need += (user == NULL ? 0 : strlen(user));
 	need += (domain == NULL ? 0 : strlen(domain));
@@ -1195,7 +1168,7 @@ irp_marshall_ng(const char *host, const char *user, const char *domain,
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -1227,18 +1200,17 @@ irp_marshall_ng(const char *host, const char *user, const char *domain,
 
 /* ---------- */
 
-
-/*
+/*%
  * int irp_unmarshall_ng(const char **host, const char **user,
  *			 const char **domain, char *buffer)
  *
- * notes:
+ * notes: \li
  *
  *	Unpacks the BUFFER into 3 character arrays it allocates and assigns
  *	to *HOST, *USER and *DOMAIN. If any field of the value is empty,
  *	then the corresponding paramater value will be set to NULL.
  *
- * return:
+ * return: \li
  *
  *	0 on success and -1 on failure.
  */
@@ -1325,15 +1297,14 @@ irp_unmarshall_ng(const char **hostp, const char **userp, const char **domainp,
 
 /* +++++++++++++++++++++++++ struct nwent +++++++++++++++++++++++++ */
 
-
-/*
+/*%
  * int irp_marshall_nw(struct nwent *ne, char **buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
  *	See at top.
  *
- * return:
+ * return: \li
  *
  *	0 on success and -1 on failure.
  *
@@ -1341,7 +1312,7 @@ irp_unmarshall_ng(const char **hostp, const char **userp, const char **domainp,
 
 int
 irp_marshall_nw(struct nwent *ne, char **buffer, size_t *len) {
-	size_t need = 1;	/* for null byte */
+	size_t need = 1;	/*%< for null byte */
 	char nAddrType[24];
 	char nNet[MAXPADDRSIZE];
 	const char *fieldsep = COLONSTR;
@@ -1374,7 +1345,7 @@ irp_marshall_nw(struct nwent *ne, char **buffer, size_t *len) {
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -1392,16 +1363,14 @@ irp_marshall_nw(struct nwent *ne, char **buffer, size_t *len) {
 	return (0);
 }
 
-
-
-/*
+/*%
  * int irp_unmarshall_nw(struct nwent *ne, char *buffer)
  *
- * notes:
+ * notes: \li
  *
  *	See note up top.
  *
- * return:
+ * return: \li
  *
  *	0 on success and -1 on failure.
  *
@@ -1502,15 +1471,14 @@ irp_unmarshall_nw(struct nwent *ne, char *buffer) {
 
 /* +++++++++++++++++++++++++ struct netent +++++++++++++++++++++++++ */
 
-
-/*
+/*%
  * int irp_marshall_ne(struct netent *ne, char **buffer, size_t *len)
  *
- * notes:
+ * notes: \li
  *
  *	See at top.
  *
- * return:
+ * return: \li
  *
  *	0 on success and -1 on failure.
  *
@@ -1518,7 +1486,7 @@ irp_unmarshall_nw(struct nwent *ne, char *buffer) {
 
 int
 irp_marshall_ne(struct netent *ne, char **buffer, size_t *len) {
-	size_t need = 1;	/* for null byte */
+	size_t need = 1;	/*%< for null byte */
 	char nAddrType[24];
 	char nNet[MAXPADDRSIZE];
 	const char *fieldsep = COLONSTR;
@@ -1551,7 +1519,7 @@ irp_marshall_ne(struct netent *ne, char **buffer, size_t *len) {
 	}
 
 	if (*buffer == NULL) {
-		need += 2;		/* for CRLF */
+		need += 2;		/*%< for CRLF */
 		*buffer = memget(need);
 		if (*buffer == NULL) {
 			errno = ENOMEM;
@@ -1569,16 +1537,14 @@ irp_marshall_ne(struct netent *ne, char **buffer, size_t *len) {
 	return (0);
 }
 
-
-
-/*
+/*%
  * int irp_unmarshall_ne(struct netent *ne, char *buffer)
  *
- * notes:
+ * notes: \li
  *
  *	See note up top.
  *
- * return:
+ * return: \li
  *
  *	0 on success and -1 on failure.
  *
@@ -1671,11 +1637,10 @@ irp_unmarshall_ne(struct netent *ne, char *buffer) {
 
 /* =========================================================================== */
 
-
-/*
+/*%
  * static char ** splitarray(const char *buffer, const char *buffend, char delim)
  *
- * notes:
+ * notes: \li
  *
  *	Split a delim separated astring. Not allowed
  *	to have two delims next to each other. BUFFER points to begining of
@@ -1683,7 +1648,7 @@ irp_unmarshall_ne(struct netent *ne, char *buffer) {
  *	(i.e. points at where the null byte would be if null
  *	terminated).
  *
- * return:
+ * return: \li
  *
  *	Returns a malloced array of pointers, each pointer pointing to a
  *	malloced string. If BUFEER is an empty string, then return values is
@@ -1719,7 +1684,7 @@ splitarray(const char *buffer, const char *buffend, char delim) {
 	}
 
 	if (count > 0) {
-		count++ ;		/* for NULL at end */
+		count++ ;		/*%< for NULL at end */
 		aptr = arr = malloc(count * sizeof (char *));
 		if (aptr == NULL) {
 			 errno = ENOMEM;
@@ -1749,13 +1714,10 @@ splitarray(const char *buffer, const char *buffend, char delim) {
 	return (arr);
 }
 
-
-
-
-/*
+/*%
  * static size_t joinlength(char * const *argv)
  *
- * return:
+ * return: \li
  *
  *	the number of bytes in all the arrays pointed at
  *	by argv, including their null bytes(which will usually be turned
@@ -1776,18 +1738,16 @@ joinlength(char * const *argv) {
 	return (len);
 }
 
-
-
-/*
+/*%
  * int joinarray(char * const *argv, char *buffer, char delim)
  *
- * notes:
+ * notes: \li
  *
  *	Copy all the ARGV strings into the end of BUFFER
  *	separating them with DELIM.  BUFFER is assumed to have
  *	enough space to hold everything and to be already null-terminated.
  *
- * return:
+ * return: \li
  *
  *	0 unless argv or buffer is NULL.
  *
@@ -1817,11 +1777,10 @@ joinarray(char * const *argv, char *buffer, char delim) {
 	return (0);
 }
 
-
-/*
+/*%
  * static char * getfield(char **res, size_t reslen, char **ptr, char delim)
  *
- * notes:
+ * notes: \li
  *
  *	Stores in *RES, which is a buffer of length RESLEN, a
  *	copy of the bytes from *PTR up to and including the first
@@ -1829,7 +1788,7 @@ joinarray(char * const *argv, char *buffer, char delim) {
  *	assigned a malloced buffer to hold the copy. *PTR is
  *	modified to point at the found delimiter.
  *
- * return:
+ * return: \li
  *
  *	If there was no delimiter, then NULL is returned,
  *	otherewise *RES is returned.
@@ -1854,7 +1813,7 @@ getfield(char **res, size_t reslen, char **ptr, char delim) {
 		if (*res == NULL) {
 			*res = strndup(*ptr, q - *ptr);
 		} else {
-			if ((size_t)(q - *ptr + 1) > reslen) { /* to big for res */
+			if ((size_t)(q - *ptr + 1) > reslen) { /*%< to big for res */
 				errno = EINVAL;
 				return (NULL);
 			} else {
@@ -1876,12 +1835,12 @@ getfield(char **res, size_t reslen, char **ptr, char delim) {
 /*
  * static char * strndup(const char *str, size_t len)
  *
- * notes:
+ * notes: \li
  *
  *	like strdup, except do len bytes instead of the whole string. Always
  *	null-terminates.
  *
- * return:
+ * return: \li
  *
  *	The newly malloced string.
  *
@@ -1901,14 +1860,14 @@ strndup(const char *str, size_t len) {
 
 #if WANT_MAIN
 
-/*
+/*%
  * static int strcmp_nws(const char *a, const char *b)
  *
- * notes:
+ * notes: \li
  *
  *	do a strcmp, except uneven lengths of whitespace compare the same
  *
- * return:
+ * return: \li
  *
  */
 
@@ -1942,14 +1901,10 @@ strcmp_nws(const char *a, const char *b) {
 
 #endif
 
-
-
-
-
-/*
+/*%
  * static void free_array(char **argv, size_t entries)
  *
- * notes:
+ * notes: \li
  *
  *	Free argv and each of the pointers inside it. The end of
  *	the array is when a NULL pointer is found inside. If
@@ -1984,7 +1939,7 @@ free_array(char **argv, size_t entries) {
 
 #if WANT_MAIN
 
-/* takes an option to indicate what sort of marshalling(read the code) and
+/*% takes an option to indicate what sort of marshalling(read the code) and
    an argument. If the argument looks like a marshalled buffer(has a ':'
    embedded) then it's unmarshalled and the remarshalled and the new string
    is compared to the old one.
@@ -2342,3 +2297,5 @@ main(int argc, char **argv) {
 }
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irs_data.c b/contrib/bind9/lib/bind/irs/irs_data.c
index 7904286..b71bc33 100644
--- a/contrib/bind9/lib/bind/irs/irs_data.c
+++ b/contrib/bind9/lib/bind/irs/irs_data.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: irs_data.c,v 1.3.2.2.4.4 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: irs_data.c,v 1.7.18.3 2006/03/10 00:20:08 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -113,7 +113,8 @@ net_data_destroy(void *p) {
 	memput(net_data, sizeof *net_data);
 }
 
-/* applications that need a specific config file other than
+/*%
+ *  applications that need a specific config file other than
  * _PATH_IRS_CONF should call net_data_init directly rather than letting
  *   the various wrapper functions make the first call. - brister
  */
@@ -239,3 +240,5 @@ __h_errno_set(struct __res_state *res, int err) {
 }
 
 #endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irs_data.h b/contrib/bind9/lib/bind/irs/irs_data.h
index 90eb78c..c1ee3dd 100644
--- a/contrib/bind9/lib/bind/irs/irs_data.h
+++ b/contrib/bind9/lib/bind/irs/irs_data.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: irs_data.h,v 1.1.206.1 2004/03/09 08:33:37 marka Exp $
+ * $Id: irs_data.h,v 1.2.18.1 2005/04/27 05:01:01 sra Exp $
  */
 
 #ifndef __BIND_NOSTATIC
@@ -38,7 +38,7 @@ struct net_data {
 	struct passwd *		pw_last;
 	struct servent *	sv_last;
 	struct protoent *	pr_last;
-	struct netent *		nw_last; /* should have been ne_last */
+	struct netent *		nw_last; /*%< should have been ne_last */
 	struct nwent *		nww_last;
 	struct hostent *	ho_last;
 
@@ -52,11 +52,12 @@ struct net_data {
 	void *			nw_data;
 	void *			ho_data;
 
-	struct __res_state *	res;	/* for gethostent.c */
-
+	struct __res_state *	res;	/*%< for gethostent.c */
 };
 
 extern struct net_data *	net_data_init(const char *conf_file);
 extern void			net_data_minimize(struct net_data *);
 
 #endif /*__BIND_NOSTATIC*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/irs_p.h b/contrib/bind9/lib/bind/irs/irs_p.h
index 6d340f2..bc1817b 100644
--- a/contrib/bind9/lib/bind/irs/irs_p.h
+++ b/contrib/bind9/lib/bind/irs/irs_p.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: irs_p.h,v 1.1.206.1 2004/03/09 08:33:37 marka Exp $
+ * $Id: irs_p.h,v 1.2.18.1 2005/04/27 05:01:01 sra Exp $
  */
 
 #ifndef _IRS_P_H_INCLUDED
@@ -47,3 +47,5 @@ extern struct irs_ng *	irs_nul_ng(struct irs_acc *);
 extern struct servent * irs_lclsv_fnxt(struct lcl_sv *);
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/lcl.c b/contrib/bind9/lib/bind/irs/lcl.c
index e02c90d..930c87e 100644
--- a/contrib/bind9/lib/bind/irs/lcl.c
+++ b/contrib/bind9/lib/bind/irs/lcl.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: lcl.c,v 1.1.206.2 2004/03/17 00:29:49 marka Exp $";
+static const char rcsid[] = "$Id: lcl.c,v 1.3.18.1 2005/04/27 05:01:02 sra Exp $";
 #endif
 
 /* Imports */
@@ -138,3 +138,5 @@ lcl_close(struct irs_acc *this) {
 	}
 	memput(this, sizeof *this);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/lcl_gr.c b/contrib/bind9/lib/bind/irs/lcl_gr.c
index ccf7b79..f17410c 100644
--- a/contrib/bind9/lib/bind/irs/lcl_gr.c
+++ b/contrib/bind9/lib/bind/irs/lcl_gr.c
@@ -49,7 +49,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: lcl_gr.c,v 1.1.206.1 2004/03/09 08:33:37 marka Exp $";
+static const char rcsid[] = "$Id: lcl_gr.c,v 1.2.18.1 2005/04/27 05:01:02 sra Exp $";
 /* from getgrent.c 8.2 (Berkeley) 3/21/94"; */
 /* from BSDI Id: getgrent.c,v 2.8 1996/05/28 18:15:14 bostic Exp $	*/
 #endif /* LIBC_SCCS and not lint */
@@ -90,7 +90,7 @@ static int __bind_irs_gr_unneeded;
 
 struct pvt {
 	FILE *		fp;
-	/*
+	/*%<
 	 * Need space to store the entries read from the group file.
 	 * The members list also needs space per member, and the
 	 * strings making up the user names must be allocated
@@ -98,7 +98,7 @@ struct pvt {
 	 * we keep one buffer and resize it as needed.
 	 */
 	struct group	group;
-	size_t		nmemb;		/* Malloc'd max index of gr_mem[]. */
+	size_t		nmemb;		/*%< Malloc'd max index of gr_mem[]. */
 	char *		membuf;
 	size_t		membufsize;
 };
@@ -227,9 +227,8 @@ grstart(struct pvt *pvt) {
 	return (1);
 }
 
-#define	INITIAL_NMEMB	30			/* about 120 bytes */
-#define	INITIAL_BUFSIZ	(INITIAL_NMEMB * 8)	/* about 240 bytes */
-
+#define	INITIAL_NMEMB	30			/*%< about 120 bytes */
+#define	INITIAL_BUFSIZ	(INITIAL_NMEMB * 8)	/*%< about 240 bytes */
 static char *
 grnext(struct pvt *pvt) {
 	char *w, *e;
@@ -352,3 +351,4 @@ grscan(struct irs_gr *this, int search, gid_t gid, const char *name) {
 }
 
 #endif /* WANT_IRS_GR */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/lcl_ho.c b/contrib/bind9/lib/bind/irs/lcl_ho.c
index b59a104..9534ee6 100644
--- a/contrib/bind9/lib/bind/irs/lcl_ho.c
+++ b/contrib/bind9/lib/bind/irs/lcl_ho.c
@@ -52,7 +52,7 @@
 /* BIND Id: gethnamaddr.c,v 8.15 1996/05/22 04:56:30 vixie Exp $ */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: lcl_ho.c,v 1.1.206.3 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: lcl_ho.c,v 1.3.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports. */
@@ -109,7 +109,7 @@ struct pvt {
 	char *		h_addr_ptrs[MAXADDRS + 1];
 	char *		host_aliases[MAXALIASES];
 	char		hostbuf[8*1024];
-	u_char		host_addr[16];	/* IPv4 or IPv6 */
+	u_char		host_addr[16];	/*%< IPv4 or IPv6 */
 	struct __res_state  *res;
 	void		(*free_res)(void *);
 };
@@ -508,7 +508,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 	cur = &sentinel;
 
 	switch(pai->ai_family) {
-	case AF_UNSPEC:		/* INET6 then INET4 */
+	case AF_UNSPEC:		/*%< INET6 then INET4 */
 		q.family = AF_INET6;
 		q.next = &q2;
 		q2.family = AF_INET;
@@ -520,7 +520,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 		q.family = AF_INET;
 		break;
 	default:
-		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /* ??? */
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /*%< ??? */
 		return(NULL);
 	}
 
@@ -574,3 +574,5 @@ init(struct irs_ho *this) {
 		return (-1);
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/lcl_ng.c b/contrib/bind9/lib/bind/irs/lcl_ng.c
index 3c678f2..3a9f3fa 100644
--- a/contrib/bind9/lib/bind/irs/lcl_ng.c
+++ b/contrib/bind9/lib/bind/irs/lcl_ng.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: lcl_ng.c,v 1.1.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: lcl_ng.c,v 1.2.18.1 2005/04/27 05:01:02 sra Exp $";
 #endif
 
 /* Imports */
@@ -43,11 +43,10 @@ static const char rcsid[] = "$Id: lcl_ng.c,v 1.1.206.1 2004/03/09 08:33:38 marka
 
 /* Definitions */
 
-#define NG_HOST         0       /* Host name */
-#define NG_USER         1       /* User name */
-#define NG_DOM          2       /* and Domain name */
-#define LINSIZ		1024    /* Length of netgroup file line */
-
+#define NG_HOST         0       /*%< Host name */
+#define NG_USER         1       /*%< User name */
+#define NG_DOM          2       /*%< and Domain name */
+#define LINSIZ		1024    /*%< Length of netgroup file line */
 /*
  * XXX Warning XXX
  * This code is a hack-and-slash special.  It realy needs to be
@@ -55,24 +54,25 @@ static const char rcsid[] = "$Id: lcl_ng.c,v 1.1.206.1 2004/03/09 08:33:38 marka
  * More reasonable data structures would not be a bad thing.
  */
 
-/*
+/*%
  * Static Variables and functions used by setnetgrent(), getnetgrent() and
  * endnetgrent().
+ *
  * There are two linked lists:
- * - linelist is just used by setnetgrent() to parse the net group file via.
+ * \li linelist is just used by setnetgrent() to parse the net group file via.
  *   parse_netgrp()
- * - netgrp is the list of entries for the current netgroup
+ * \li netgrp is the list of entries for the current netgroup
  */
 struct linelist {
-	struct linelist *l_next;	/* Chain ptr. */
-	int		l_parsed;	/* Flag for cycles */
-	char *		l_groupname;	/* Name of netgroup */
-	char *		l_line;		/* Netgroup entrie(s) to be parsed */
+	struct linelist *l_next;	/*%< Chain ptr. */
+	int		l_parsed;	/*%< Flag for cycles */
+	char *		l_groupname;	/*%< Name of netgroup */
+	char *		l_line;		/*%< Netgroup entrie(s) to be parsed */
 };
 
 struct ng_old_struct {
-	struct ng_old_struct *ng_next;	/* Chain ptr */
-	char *		ng_str[3];	/* Field pointers, see below */
+	struct ng_old_struct *ng_next;	/*%< Chain ptr */
+	char *		ng_str[3];	/*%< Field pointers, see below */
 };
 
 struct pvt {
@@ -142,7 +142,7 @@ ng_close(struct irs_ng *this) {
 	memput(this, sizeof *this);
 }
 	
-/*
+/*%
  * Parse the netgroup file looking for the netgroup and build the list
  * of netgrp structures. Let parse_netgrp() and read_for_group() do
  * most of the work.
@@ -174,7 +174,7 @@ ng_rewind(struct irs_ng *this, const char *group) {
 	pvt->nextgrp = pvt->grouphead.gr;
 }
 
-/*
+/*%
  * Get the next netgroup off the list.
  */
 static int
@@ -193,7 +193,7 @@ ng_next(struct irs_ng *this, const char **host, const char **user,
 	return (0);
 }
 
-/*
+/*%
  * Search for a match in a netgroup.
  */
 static int
@@ -229,7 +229,7 @@ ng_minimize(struct irs_ng *this) {
 
 /* Private */
 
-/*
+/*%
  * endnetgrent() - cleanup
  */
 static void
@@ -266,7 +266,7 @@ freelists(struct irs_ng *this) {
 	pvt->grouphead.gr = NULL;
 }
 
-/*
+/*%
  * Parse the netgroup file setting up the linked lists.
  */
 static int
@@ -349,7 +349,7 @@ parse_netgrp(struct irs_ng *this, const char *group) {
 	return (1);
 }
 
-/*
+/*%
  * Read the netgroup file and save lines until the line for the netgroup
  * is found. Return 1 if eof is encountered.
  */
@@ -442,3 +442,5 @@ read_for_group(struct irs_ng *this, const char *group) {
 	}
 	return (NULL);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/lcl_nw.c b/contrib/bind9/lib/bind/irs/lcl_nw.c
index 7d04672..2804946 100644
--- a/contrib/bind9/lib/bind/irs/lcl_nw.c
+++ b/contrib/bind9/lib/bind/irs/lcl_nw.c
@@ -49,7 +49,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: lcl_nw.c,v 1.1.206.2 2004/03/17 00:29:50 marka Exp $";
+static const char rcsid[] = "$Id: lcl_nw.c,v 1.3.18.1 2005/04/27 05:01:02 sra Exp $";
 /* from getgrent.c 8.2 (Berkeley) 3/21/94"; */
 /* from BSDI Id: getgrent.c,v 2.8 1996/05/28 18:15:14 bostic Exp $	*/
 #endif /* LIBC_SCCS and not lint */
@@ -369,3 +369,5 @@ init(struct irs_nw *this) {
 		return (-1);
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/lcl_p.h b/contrib/bind9/lib/bind/irs/lcl_p.h
index 44dd621..4e6bdc3 100644
--- a/contrib/bind9/lib/bind/irs/lcl_p.h
+++ b/contrib/bind9/lib/bind/irs/lcl_p.h
@@ -16,17 +16,18 @@
  */
 
 /*
- * $Id: lcl_p.h,v 1.1.206.1 2004/03/09 08:33:38 marka Exp $
+ * $Id: lcl_p.h,v 1.2.18.1 2005/04/27 05:01:02 sra Exp $
  */
 
-/*
+/*! \file
+ * \brief
  * lcl_p.h - private include file for the local accessor functions.
  */
 
 #ifndef _LCL_P_H_INCLUDED
 #define _LCL_P_H_INCLUDED
 
-/*
+/*%
  * Object state.
  */
 struct lcl_p {
diff --git a/contrib/bind9/lib/bind/irs/lcl_pr.c b/contrib/bind9/lib/bind/irs/lcl_pr.c
index ddc92c8..08c6da9 100644
--- a/contrib/bind9/lib/bind/irs/lcl_pr.c
+++ b/contrib/bind9/lib/bind/irs/lcl_pr.c
@@ -49,7 +49,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: lcl_pr.c,v 1.1.206.2 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: lcl_pr.c,v 1.2.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* extern */
@@ -290,3 +290,5 @@ pr_minimize(struct irs_pr *this) {
 		pvt->fp = NULL;
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/lcl_pw.c b/contrib/bind9/lib/bind/irs/lcl_pw.c
index dc31dd2..316057b 100644
--- a/contrib/bind9/lib/bind/irs/lcl_pw.c
+++ b/contrib/bind9/lib/bind/irs/lcl_pw.c
@@ -49,7 +49,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: lcl_pw.c,v 1.1.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: lcl_pw.c,v 1.2.18.1 2005/04/27 05:01:03 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Extern */
@@ -85,7 +85,8 @@ static int __bind_irs_pw_unneeded;
 #include "irs_p.h"
 #include "lcl_p.h"
 
-/*
+/*! \file
+ * \brief
  * The lookup techniques and data extraction code here must be kept
  * in sync with that in `pwd_mkdb'.
  */
@@ -94,9 +95,9 @@ static int __bind_irs_pw_unneeded;
 /* Types */
 
 struct  pvt {
-	struct passwd	passwd;		/* password structure */
-	DB 		*pw_db;		/* password database */
-	int		pw_keynum;	/* key counter */
+	struct passwd	passwd;		/*%< password structure */
+	DB 		*pw_db;		/*%< password database */
+	int		pw_keynum;	/*%< key counter */
 	int		warned;
 	u_int		max;
 	char *		line;
diff --git a/contrib/bind9/lib/bind/irs/lcl_sv.c b/contrib/bind9/lib/bind/irs/lcl_sv.c
index b407d7f..7675834 100644
--- a/contrib/bind9/lib/bind/irs/lcl_sv.c
+++ b/contrib/bind9/lib/bind/irs/lcl_sv.c
@@ -49,7 +49,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: lcl_sv.c,v 1.2.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: lcl_sv.c,v 1.3.18.1 2005/04/27 05:01:03 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* extern */
@@ -387,8 +387,7 @@ sv_db_rec(struct lcl_sv *sv, DBT *key, DBT *data) {
 	int n;
 
 	p = data->data;
-	p[data->size - 1] = '\0';	/* should be, but we depend on it */
-
+	p[data->size - 1] = '\0';	/*%< should be, but we depend on it */
 	if (((char *)key->data)[0] == '\0') {
 		if (key->size < sizeof(u_short)*2 || data->size < 2)
 			return (NULL);
@@ -429,3 +428,5 @@ sv_db_rec(struct lcl_sv *sv, DBT *key, DBT *data) {
 	return (&sv->serv);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis.c b/contrib/bind9/lib/bind/irs/nis.c
index 70eaaed..62cc267 100644
--- a/contrib/bind9/lib/bind/irs/nis.c
+++ b/contrib/bind9/lib/bind/irs/nis.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis.c,v 1.1.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis.c,v 1.2.18.1 2005/04/27 05:01:03 sra Exp $";
 #endif
 
 /* Imports */
@@ -152,3 +152,5 @@ nis_close(struct irs_acc *this) {
 }
 
 #endif /*WANT_IRS_NIS*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis_gr.c b/contrib/bind9/lib/bind/irs/nis_gr.c
index e06861f..9d4f15d 100644
--- a/contrib/bind9/lib/bind/irs/nis_gr.c
+++ b/contrib/bind9/lib/bind/irs/nis_gr.c
@@ -49,7 +49,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis_gr.c,v 1.1.2.1.4.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis_gr.c,v 1.3.18.1 2005/04/27 05:01:03 sra Exp $";
 /* from getgrent.c 8.2 (Berkeley) 3/21/94"; */
 /* from BSDI Id: getgrent.c,v 2.8 1996/05/28 18:15:14 bostic Exp $	*/
 #endif /* LIBC_SCCS and not lint */
@@ -99,7 +99,7 @@ struct pvt {
 	int		curkey_len;
 	char *		curval_data;
 	int		curval_len;
-	/*
+	/*%<
 	 * Need space to store the entries read from the group file.
 	 * The members list also needs space per member, and the
 	 * strings making up the user names must be allocated
@@ -107,7 +107,7 @@ struct pvt {
 	 * we keep one buffer and resize it as needed.
 	 */
 	struct group	group;
-	size_t		nmemb;		/* Malloc'd max index of gr_mem[]. */
+	size_t		nmemb;		/*%< Malloc'd max index of gr_mem[]. */
 	char *		membuf;
 	size_t		membufsize;
 };
@@ -351,3 +351,4 @@ nisfree(struct pvt *pvt, enum do_what do_what) {
 }
 
 #endif /* WANT_IRS_GR && WANT_IRS_NIS */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis_ho.c b/contrib/bind9/lib/bind/irs/nis_ho.c
index 7f0b125..7524279 100644
--- a/contrib/bind9/lib/bind/irs/nis_ho.c
+++ b/contrib/bind9/lib/bind/irs/nis_ho.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis_ho.c,v 1.2.2.1.4.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis_ho.c,v 1.4.18.1 2005/04/27 05:01:03 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports */
@@ -79,7 +79,7 @@ struct pvt {
 	char *		h_addr_ptrs[MAXADDRS + 1];
 	char *		host_aliases[MAXALIASES + 1];
 	char		hostbuf[8*1024];
-	u_char		host_addr[16];	/* IPv4 or IPv6 */
+	u_char		host_addr[16];	/*%< IPv4 or IPv6 */
 	struct __res_state  *res;
 	void		(*free_res)(void *);
 };
@@ -369,7 +369,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 	cur = &sentinel;
 
 	switch(pai->ai_family) {
-	case AF_UNSPEC:		/* INET6 then INET4 */
+	case AF_UNSPEC:		/*%< INET6 then INET4 */
 		q.family = AF_INET6;
 		q.next = &q2;
 		q2.family = AF_INET;
@@ -381,7 +381,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 		q.family = AF_INET;
 		break;
 	default:
-		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /* ??? */
+		RES_SET_H_ERRNO(pvt->res, NO_RECOVERY); /*%< ??? */
 		return(NULL);
 	}
 
@@ -414,7 +414,7 @@ ho_addrinfo(struct irs_ho *this, const char *name, const struct addrinfo *pai)
 
 /* Private */
 
-/*
+/*%
 ipnodes:
 ::1             localhost
 127.0.0.1       localhost
@@ -531,3 +531,5 @@ init(struct irs_ho *this) {
 	return (0);
 }
 #endif /*WANT_IRS_NIS*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis_ng.c b/contrib/bind9/lib/bind/irs/nis_ng.c
index 4ee700c..f2298b2 100644
--- a/contrib/bind9/lib/bind/irs/nis_ng.c
+++ b/contrib/bind9/lib/bind/irs/nis_ng.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis_ng.c,v 1.2.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis_ng.c,v 1.3.18.1 2005/04/27 05:01:03 sra Exp $";
 #endif
 
 /* Imports */
@@ -300,3 +300,5 @@ tmpfree(struct pvt *pvt) {
 }
 
 #endif /*WANT_IRS_NIS*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis_nw.c b/contrib/bind9/lib/bind/irs/nis_nw.c
index 669b29d..2fb50dc 100644
--- a/contrib/bind9/lib/bind/irs/nis_nw.c
+++ b/contrib/bind9/lib/bind/irs/nis_nw.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis_nw.c,v 1.2.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis_nw.c,v 1.3.18.1 2005/04/27 05:01:03 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports */
@@ -381,3 +381,5 @@ init(struct irs_nw *this) {
 }
 
 #endif /*WANT_IRS_NIS*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis_p.h b/contrib/bind9/lib/bind/irs/nis_p.h
index 95f5851..9e7f26c 100644
--- a/contrib/bind9/lib/bind/irs/nis_p.h
+++ b/contrib/bind9/lib/bind/irs/nis_p.h
@@ -16,14 +16,15 @@
  */
 
 /*
- * $Id: nis_p.h,v 1.1.206.1 2004/03/09 08:33:38 marka Exp $
+ * $Id: nis_p.h,v 1.2.18.1 2005/04/27 05:01:04 sra Exp $
  */
 
-/*
+/*! \file
+ * \brief
  * nis_p.h - private include file for the NIS functions.
  */
 
-/*
+/*%
  * Object state.
  */
 struct nis_p {
diff --git a/contrib/bind9/lib/bind/irs/nis_pr.c b/contrib/bind9/lib/bind/irs/nis_pr.c
index 8173f3e..58ff84d 100644
--- a/contrib/bind9/lib/bind/irs/nis_pr.c
+++ b/contrib/bind9/lib/bind/irs/nis_pr.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis_pr.c,v 1.2.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis_pr.c,v 1.3.18.1 2005/04/27 05:01:04 sra Exp $";
 #endif
 
 /* Imports */
@@ -298,3 +298,5 @@ nisfree(struct pvt *pvt, enum do_what do_what) {
 }
 
 #endif /*WANT_IRS_NIS*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis_pw.c b/contrib/bind9/lib/bind/irs/nis_pw.c
index 889d97f..02c6b42 100644
--- a/contrib/bind9/lib/bind/irs/nis_pw.c
+++ b/contrib/bind9/lib/bind/irs/nis_pw.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis_pw.c,v 1.2.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis_pw.c,v 1.3.18.1 2005/04/27 05:01:04 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports */
@@ -230,7 +230,7 @@ makepasswdent(struct irs_pw *this) {
 	if (!(cp = strchr(cp, ':')))
 		goto cleanup;
 #ifdef HAS_PW_CLASS
-	pvt->passwd.pw_class = cp;	/* Needs to point at a \0. */
+	pvt->passwd.pw_class = cp;	/*%< Needs to point at a \0. */
 #endif
 	*cp++ = '\0';
 
@@ -285,3 +285,4 @@ nisfree(struct pvt *pvt, enum do_what do_what) {
 }
 
 #endif /* WANT_IRS_PW && WANT_IRS_NIS */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nis_sv.c b/contrib/bind9/lib/bind/irs/nis_sv.c
index b8c1c6b..dd307f0 100644
--- a/contrib/bind9/lib/bind/irs/nis_sv.c
+++ b/contrib/bind9/lib/bind/irs/nis_sv.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nis_sv.c,v 1.2.206.1 2004/03/09 08:33:38 marka Exp $";
+static const char rcsid[] = "$Id: nis_sv.c,v 1.3.18.1 2005/04/27 05:01:04 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /* Imports */
@@ -306,3 +306,5 @@ nisfree(struct pvt *pvt, enum do_what do_what) {
 }
 
 #endif /*WANT_IRS_NIS*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/nul_ng.c b/contrib/bind9/lib/bind/irs/nul_ng.c
index 828bebe..fa9ec46 100644
--- a/contrib/bind9/lib/bind/irs/nul_ng.c
+++ b/contrib/bind9/lib/bind/irs/nul_ng.c
@@ -16,10 +16,11 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nul_ng.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $";
+static const char rcsid[] = "$Id: nul_ng.c,v 1.2.18.1 2005/04/27 05:01:04 sra Exp $";
 #endif
 
-/*
+/*! \file
+ * \brief
  * nul_ng.c - the netgroup accessor null map
  */
 
diff --git a/contrib/bind9/lib/bind/irs/pathnames.h b/contrib/bind9/lib/bind/irs/pathnames.h
index 412dc76..c775de2 100644
--- a/contrib/bind9/lib/bind/irs/pathnames.h
+++ b/contrib/bind9/lib/bind/irs/pathnames.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: pathnames.h,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $
+ * $Id: pathnames.h,v 1.2.18.1 2005/04/27 05:01:04 sra Exp $
  */
 
 #ifndef _PATH_IRS_CONF
@@ -48,3 +48,5 @@
 #ifndef _PATH_HESIOD_CONF
 #define _PATH_HESIOD_CONF "/etc/hesiod.conf"
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/irs/util.c b/contrib/bind9/lib/bind/irs/util.c
index 095e7ad..5c4cc28 100644
--- a/contrib/bind9/lib/bind/irs/util.c
+++ b/contrib/bind9/lib/bind/irs/util.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: util.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $";
+static const char rcsid[] = "$Id: util.c,v 1.2.18.1 2005/04/27 05:01:05 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -105,3 +105,5 @@ make_group_list(struct irs_gr *this, const char *name,
 	*ngroups = ng;
 	return (ret);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/Makefile.in b/contrib/bind9/lib/bind/isc/Makefile.in
index d8e8889..3cbb640 100644
--- a/contrib/bind9/lib/bind/isc/Makefile.in
+++ b/contrib/bind9/lib/bind/isc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6.206.1 2004/03/06 08:13:23 marka Exp $
+# $Id: Makefile.in,v 1.7 2004/03/05 05:05:38 marka Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/isc/assertions.c b/contrib/bind9/lib/bind/isc/assertions.c
index f1fb2ef..c03464d 100644
--- a/contrib/bind9/lib/bind/isc/assertions.c
+++ b/contrib/bind9/lib/bind/isc/assertions.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: assertions.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $";
+static const char rcsid[] = "$Id: assertions.c,v 1.2.18.1 2005/04/27 05:01:05 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -89,3 +89,5 @@ default_assertion_failed(const char *file, int line, assertion_type type,
 	abort();
 	/* NOTREACHED */
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/assertions.mdoc b/contrib/bind9/lib/bind/isc/assertions.mdoc
index c214453..4b77e56 100644
--- a/contrib/bind9/lib/bind/isc/assertions.mdoc
+++ b/contrib/bind9/lib/bind/isc/assertions.mdoc
@@ -1,4 +1,4 @@
-.\" $Id: assertions.mdoc,v 1.1.2.1.10.1 2004/03/09 08:33:39 marka Exp $
+.\" $Id: assertions.mdoc,v 1.3 2004/03/09 06:30:06 marka Exp $
 .\"
 .\" Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1997,1999 by Internet Software Consortium.
diff --git a/contrib/bind9/lib/bind/isc/base64.c b/contrib/bind9/lib/bind/isc/base64.c
index 51676f3..d4bc2ea 100644
--- a/contrib/bind9/lib/bind/isc/base64.c
+++ b/contrib/bind9/lib/bind/isc/base64.c
@@ -41,7 +41,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: base64.c,v 1.1.206.2 2004/03/17 00:29:50 marka Exp $";
+static const char rcsid[] = "$Id: base64.c,v 1.3.18.1 2005/04/27 05:01:05 sra Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -69,7 +69,7 @@ static const char Base64[] =
 static const char Pad64 = '=';
 
 /* (From RFC1521 and draft-ietf-dnssec-secext-03.txt)
-   The following encoding technique is taken from RFC 1521 by Borenstein
+   The following encoding technique is taken from RFC1521 by Borenstein
    and Freed.  It is reproduced here in a slightly edited form for
    convenience.
 
@@ -187,7 +187,7 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize) {
 	}
 	if (datalength >= targsize)
 		return (-1);
-	target[datalength] = '\0';	/* Returned value doesn't count \0. */
+	target[datalength] = '\0';	/*%< Returned value doesn't count \\0. */
 	return (datalength);
 }
 
@@ -210,14 +210,14 @@ b64_pton(src, target, targsize)
 	tarindex = 0;
 
 	while ((ch = *src++) != '\0') {
-		if (isspace(ch))	/* Skip whitespace anywhere. */
+		if (isspace(ch))	/*%< Skip whitespace anywhere. */
 			continue;
 
 		if (ch == Pad64)
 			break;
 
 		pos = strchr(Base64, ch);
-		if (pos == 0) 		/* A non-base64 character. */
+		if (pos == 0) 		/*%< A non-base64 character. */
 			return (-1);
 
 		switch (state) {
@@ -270,14 +270,14 @@ b64_pton(src, target, targsize)
 	 * on a byte boundary, and/or with erroneous trailing characters.
 	 */
 
-	if (ch == Pad64) {		/* We got a pad char. */
-		ch = *src++;		/* Skip it, get next. */
+	if (ch == Pad64) {		/*%< We got a pad char. */
+		ch = *src++;		/*%< Skip it, get next. */
 		switch (state) {
-		case 0:		/* Invalid = in first position */
-		case 1:		/* Invalid = in second position */
+		case 0:		/*%< Invalid = in first position */
+		case 1:		/*%< Invalid = in second position */
 			return (-1);
 
-		case 2:		/* Valid, means one byte of info */
+		case 2:		/*%< Valid, means one byte of info */
 			/* Skip any number of spaces. */
 			for ((void)NULL; ch != '\0'; ch = *src++)
 				if (!isspace(ch))
@@ -285,11 +285,11 @@ b64_pton(src, target, targsize)
 			/* Make sure there is another trailing = sign. */
 			if (ch != Pad64)
 				return (-1);
-			ch = *src++;		/* Skip the = */
+			ch = *src++;		/*%< Skip the = */
 			/* Fall through to "single trailing =" case. */
 			/* FALLTHROUGH */
 
-		case 3:		/* Valid, means two bytes of info */
+		case 3:		/*%< Valid, means two bytes of info */
 			/*
 			 * We know this char is an =.  Is there anything but
 			 * whitespace after it?
@@ -318,3 +318,5 @@ b64_pton(src, target, targsize)
 
 	return (tarindex);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/bitncmp.c b/contrib/bind9/lib/bind/isc/bitncmp.c
index fcff9f7..8764db1 100644
--- a/contrib/bind9/lib/bind/isc/bitncmp.c
+++ b/contrib/bind9/lib/bind/isc/bitncmp.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: bitncmp.c,v 1.1.206.1 2004/03/09 08:33:39 marka Exp $";
+static const char rcsid[] = "$Id: bitncmp.c,v 1.2.18.1 2005/04/27 05:01:05 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -29,7 +29,7 @@ static const char rcsid[] = "$Id: bitncmp.c,v 1.1.206.1 2004/03/09 08:33:39 mark
 
 #include <isc/misc.h>
 
-/*
+/*%
  * int
  * bitncmp(l, r, n)
  *	compare bit masks l and r, for n bits.
@@ -64,3 +64,5 @@ bitncmp(const void *l, const void *r, int n) {
 	}
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/bitncmp.mdoc b/contrib/bind9/lib/bind/isc/bitncmp.mdoc
index 5462c2f..7d4646c 100644
--- a/contrib/bind9/lib/bind/isc/bitncmp.mdoc
+++ b/contrib/bind9/lib/bind/isc/bitncmp.mdoc
@@ -1,4 +1,4 @@
-.\" $Id: bitncmp.mdoc,v 1.1.2.1.10.1 2004/03/09 08:33:39 marka Exp $
+.\" $Id: bitncmp.mdoc,v 1.3 2004/03/09 06:30:07 marka Exp $
 .\"
 .\" Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1996,1999 by Internet Software Consortium.
diff --git a/contrib/bind9/lib/bind/isc/ctl_clnt.c b/contrib/bind9/lib/bind/isc/ctl_clnt.c
index e1fa7e7..7dcf1be 100644
--- a/contrib/bind9/lib/bind/isc/ctl_clnt.c
+++ b/contrib/bind9/lib/bind/isc/ctl_clnt.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ctl_clnt.c,v 1.4.2.1.4.3 2004/03/17 01:13:35 marka Exp $";
+static const char rcsid[] = "$Id: ctl_clnt.c,v 1.7.18.1 2005/04/27 05:01:05 sra Exp $";
 #endif /* not lint */
 
 /*
@@ -122,7 +122,7 @@ static const char * const state_names[] = {
 
 /* Public. */
 
-/*
+/*%
  * void
  * ctl_client()
  *	create, condition, and connect to a listener on the control port.
@@ -198,7 +198,7 @@ ctl_client(evContext lev, const struct sockaddr *cap, size_t cap_len,
 	return (ctx);
 }
 
-/*
+/*%
  * void
  * ctl_endclient(ctx)
  *	close a client and release all of its resources.
@@ -210,7 +210,7 @@ ctl_endclient(struct ctl_cctx *ctx) {
 	memput(ctx, sizeof *ctx);
 }
 
-/*
+/*%
  * int
  * ctl_command(ctx, cmd, len, donefunc, uap)
  *	Queue a transaction, which will begin with sending cmd
@@ -600,3 +600,5 @@ timer(evContext ev, void *uap, struct timespec due, struct timespec itv) {
 		       ctx->timeout.tv_sec, state_names[ctx->state]);
 	error(ctx);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ctl_p.c b/contrib/bind9/lib/bind/isc/ctl_p.c
index bc45004..35c2398 100644
--- a/contrib/bind9/lib/bind/isc/ctl_p.c
+++ b/contrib/bind9/lib/bind/isc/ctl_p.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ctl_p.c,v 1.1.206.2 2004/03/17 00:29:51 marka Exp $";
+static const char rcsid[] = "$Id: ctl_p.c,v 1.3.18.1 2005/04/27 05:01:05 sra Exp $";
 #endif /* not lint */
 
 /*
@@ -56,7 +56,7 @@ const char * const ctl_sevnames[] = {
 
 /* Public. */
 
-/*
+/*%
  * ctl_logger()
  *	if ctl_startup()'s caller didn't specify a logger, this one
  *	is used.  this pollutes stderr with all kinds of trash so it will
@@ -184,3 +184,5 @@ ctl_sa_copy(const struct sockaddr *src, struct sockaddr *dst) {
 		break;
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ctl_p.h b/contrib/bind9/lib/bind/isc/ctl_p.h
index 42aade7..18a52ae 100644
--- a/contrib/bind9/lib/bind/isc/ctl_p.h
+++ b/contrib/bind9/lib/bind/isc/ctl_p.h
@@ -3,7 +3,7 @@ struct ctl_buf {
 	size_t			used;
 };
 
-#define	MAX_LINELEN		990	/* Like SMTP. */
+#define	MAX_LINELEN		990	/*%< Like SMTP. */
 #ifndef NO_SOCKADDR_UN
 #define MAX_NTOP			PATH_MAX
 #else
@@ -24,3 +24,5 @@ const char *		ctl_sa_ntop(const struct sockaddr *, char *, size_t,
 				    ctl_logfunc);
 void			ctl_sa_copy(const struct sockaddr *,
 				    struct sockaddr *);
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ctl_srvr.c b/contrib/bind9/lib/bind/isc/ctl_srvr.c
index 56c7684..52137c0 100644
--- a/contrib/bind9/lib/bind/isc/ctl_srvr.c
+++ b/contrib/bind9/lib/bind/isc/ctl_srvr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ctl_srvr.c,v 1.3.2.1.4.3 2004/03/17 01:13:35 marka Exp $";
+static const char rcsid[] = "$Id: ctl_srvr.c,v 1.6.18.2 2006/12/07 04:53:02 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -158,7 +158,7 @@ static const struct ctl_verb	fakehelpverb = {
 
 /* Public. */
 
-/*
+/*%
  * void
  * ctl_server()
  *	create, condition, and start a listener on the control port.
@@ -263,7 +263,7 @@ ctl_server(evContext lev, const struct sockaddr *sap, size_t sap_len,
 	return (ctx);
 }
 
-/*
+/*%
  * void
  * ctl_endserver(ctx)
  *	if the control listener is open, close it.  clean out all eventlib
@@ -291,7 +291,7 @@ ctl_endserver(struct ctl_sctx *ctx) {
 	memput(ctx, sizeof *ctx);
 }
 
-/*
+/*%
  * If body is non-NULL then it we add a "." line after it.
  * Caller must have  escaped lines with leading ".".
  */
@@ -564,7 +564,7 @@ static void
 ctl_readable(evContext lev, void *uap, int fd, int evmask) {
 	static const char me[] = "ctl_readable";
 	struct ctl_sess *sess = uap;
-	struct ctl_sctx *ctx = sess->ctx;
+	struct ctl_sctx *ctx;
 	char *eos, tmp[MAX_NTOP];
 	ssize_t n;
 
@@ -572,6 +572,8 @@ ctl_readable(evContext lev, void *uap, int fd, int evmask) {
 	REQUIRE(fd >= 0);
 	REQUIRE(evmask == EV_READ);
 	REQUIRE(sess->state == reading || sess->state == reading_data);
+
+	ctx = sess->ctx;
 	evTouchIdleTimer(lev, sess->rdtiID);
 	if (!allocated_p(sess->inbuf) &&
 	    ctl_bufget(&sess->inbuf, ctx->logger) < 0) {
@@ -778,3 +780,5 @@ ctl_signal_done(struct ctl_sctx *ctx, struct ctl_sess *sess) {
 		sess->donefunc = NULL;
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ev_connects.c b/contrib/bind9/lib/bind/isc/ev_connects.c
index b3873b7..64e918d 100644
--- a/contrib/bind9/lib/bind/isc/ev_connects.c
+++ b/contrib/bind9/lib/bind/isc/ev_connects.c
@@ -20,7 +20,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: ev_connects.c,v 1.4.206.3 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: ev_connects.c,v 1.5.18.3 2006/03/10 00:20:08 marka Exp $";
 #endif
 
 /* Import. */
@@ -69,7 +69,7 @@ evListen(evContext opaqueCtx, int fd, int maxconn,
 
 	OKNEW(new);
 	new->flags = EV_CONN_LISTEN;
-	OKFREE(mode = fcntl(fd, F_GETFL, NULL), new);	/* side effect: validate fd. */
+	OKFREE(mode = fcntl(fd, F_GETFL, NULL), new);	/*%< side effect: validate fd. */
 	/*
 	 * Remember the nonblocking status.  We assume that either evSelectFD
 	 * has not been done to this fd, or that if it has then the caller
@@ -359,9 +359,11 @@ connector(evContext opaqueCtx, void *uap, int fd, int evmask) {
 	    GETXXXNAME(getpeername, fd, ra.sa, ralen) < 0) {
 		int save = errno;
 
-		(void) close(fd);	/* XXX closing caller's fd */
+		(void) close(fd);	/*%< XXX closing caller's fd */
 		errno = save;
 		fd = -1;
 	}
 	(*conn_func)(opaqueCtx, conn_uap, fd, &la.sa, lalen, &ra.sa, ralen);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ev_files.c b/contrib/bind9/lib/bind/isc/ev_files.c
index 1f95ed0..71de091 100644
--- a/contrib/bind9/lib/bind/isc/ev_files.c
+++ b/contrib/bind9/lib/bind/isc/ev_files.c
@@ -20,7 +20,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: ev_files.c,v 1.3.2.1.4.3 2005/07/28 07:43:19 marka Exp $";
+static const char rcsid[] = "$Id: ev_files.c,v 1.5.18.3 2005/07/28 07:38:09 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -62,8 +62,7 @@ evSelectFD(evContext opaqueCtx,
 	if (fd > ctx->highestFD)
 		EV_ERR(EINVAL);
 #endif
-	OK(mode = fcntl(fd, F_GETFL, NULL));	/* side effect: validate fd. */
-
+	OK(mode = fcntl(fd, F_GETFL, NULL));	/*%< side effect: validate fd. */
 	/*
 	 * The first time we touch a file descriptor, we need to check to see
 	 * if the application already had it in O_NONBLOCK mode and if so, all
@@ -274,3 +273,5 @@ FindFD(const evContext_p *ctx, int fd, int eventmask) {
 			break;
 	return (id);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ev_streams.c b/contrib/bind9/lib/bind/isc/ev_streams.c
index 64e88b0..ab61246 100644
--- a/contrib/bind9/lib/bind/isc/ev_streams.c
+++ b/contrib/bind9/lib/bind/isc/ev_streams.c
@@ -20,7 +20,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: ev_streams.c,v 1.2.206.2 2004/03/17 00:29:51 marka Exp $";
+static const char rcsid[] = "$Id: ev_streams.c,v 1.4.18.1 2005/04/27 05:01:06 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -304,3 +304,5 @@ readable(evContext opaqueCtx, void *uap, int fd, int evmask) {
 	if (str->ioDone <= 0 || str->ioDone == str->ioTotal)
 		done(opaqueCtx, str);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ev_timers.c b/contrib/bind9/lib/bind/isc/ev_timers.c
index 11433fb..cead2aa 100644
--- a/contrib/bind9/lib/bind/isc/ev_timers.c
+++ b/contrib/bind9/lib/bind/isc/ev_timers.c
@@ -20,7 +20,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: ev_timers.c,v 1.2.2.1.4.5 2004/03/17 02:39:13 marka Exp $";
+static const char rcsid[] = "$Id: ev_timers.c,v 1.5.18.1 2005/04/27 05:01:06 sra Exp $";
 #endif
 
 /* Import. */
@@ -495,3 +495,5 @@ idle_timeout(evContext opaqueCtx,
 		this->timer->inter = evSubTime(this->max_idle, idle);
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/ev_waits.c b/contrib/bind9/lib/bind/isc/ev_waits.c
index f30280d..d33b061 100644
--- a/contrib/bind9/lib/bind/isc/ev_waits.c
+++ b/contrib/bind9/lib/bind/isc/ev_waits.c
@@ -20,7 +20,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: ev_waits.c,v 1.1.2.1.4.1 2004/03/09 08:33:43 marka Exp $";
+static const char rcsid[] = "$Id: ev_waits.c,v 1.3.18.1 2005/04/27 05:01:06 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -44,7 +44,7 @@ static evWaitList *	evGetWaitList(evContext_p *, const void *, int);
 
 /* Public. */
 
-/*
+/*%
  * Enter a new wait function on the queue.
  */
 int
@@ -72,7 +72,7 @@ evWaitFor(evContext opaqueCtx, const void *tag,
 	return (0);
 }
 
-/*
+/*%
  * Mark runnable all waiting functions having a certain tag.
  */
 int
@@ -99,7 +99,7 @@ evDo(evContext opaqueCtx, const void *tag) {
 	return (0);
 }
 
-/*
+/*%
  * Remove a waiting (or ready to run) function from the queue.
  */
 int
@@ -243,3 +243,5 @@ evGetWaitList(evContext_p *ctx, const void *tag, int should_create) {
 		this = evNewWaitList(ctx);
 	return (this);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/eventlib.c b/contrib/bind9/lib/bind/isc/eventlib.c
index 11120ec..20624d0 100644
--- a/contrib/bind9/lib/bind/isc/eventlib.c
+++ b/contrib/bind9/lib/bind/isc/eventlib.c
@@ -20,7 +20,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: eventlib.c,v 1.2.2.1.4.6 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: eventlib.c,v 1.5.18.5 2006/03/10 00:20:08 marka Exp $";
 #endif
 
 #include "port_before.h"
@@ -29,9 +29,9 @@ static const char rcsid[] = "$Id: eventlib.c,v 1.2.2.1.4.6 2006/03/10 00:17:21 m
 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/stat.h>
-#ifdef SOLARIS2
+#ifdef	SOLARIS2
 #include <limits.h>
-#endif /* SOLARIS2 */
+#endif	/* SOLARIS2 */
 
 #include <errno.h>
 #include <signal.h>
@@ -48,7 +48,7 @@ static const char rcsid[] = "$Id: eventlib.c,v 1.2.2.1.4.6 2006/03/10 00:17:21 m
 int      __evOptMonoTime;
 
 #ifdef USE_POLL
-#define pselect Pselect
+#define	pselect Pselect
 #endif /* USE_POLL */
 
 /* Forward. */
@@ -85,8 +85,9 @@ evCreate(evContext *opaqueCtx) {
 	INIT_LIST(ctx->accepts);
 
 	/* Files. */
+	ctx->files = NULL;
 #ifdef USE_POLL
-	ctx->pollfds = NULL;
+        ctx->pollfds = NULL;
 	ctx->maxnfds = 0;
 	ctx->firstfd = 0;
 	emulMaskInit(ctx, rdLast, EV_READ, 1);
@@ -97,21 +98,20 @@ evCreate(evContext *opaqueCtx) {
 	emulMaskInit(ctx, exNext, EV_EXCEPT, 0);
 	emulMaskInit(ctx, nonblockBefore, EV_WASNONBLOCKING, 0);
 #endif /* USE_POLL */
-	ctx->files = NULL;
 	FD_ZERO(&ctx->rdNext);
 	FD_ZERO(&ctx->wrNext);
 	FD_ZERO(&ctx->exNext);
 	FD_ZERO(&ctx->nonblockBefore);
 	ctx->fdMax = -1;
 	ctx->fdNext = NULL;
-	ctx->fdCount = 0;	/* Invalidate {rd,wr,ex}Last. */
+	ctx->fdCount = 0;	/*%< Invalidate {rd,wr,ex}Last. */
 #ifndef USE_POLL
 	ctx->highestFD = FD_SETSIZE - 1;
 	memset(ctx->fdTable, 0, sizeof ctx->fdTable);
-#else
+#else   
 	ctx->highestFD = INT_MAX / sizeof(struct pollfd);
 	ctx->fdTable = NULL;
-#endif
+#endif /* USE_POLL */
 #ifdef EVENTLIB_TIME_CHECKS
 	ctx->lastFdCount = 0;
 #endif
@@ -150,7 +150,7 @@ evSetDebug(evContext opaqueCtx, int level, FILE *output) {
 int
 evDestroy(evContext opaqueCtx) {
 	evContext_p *ctx = opaqueCtx.opaque;
-	int revs = 424242;	/* Doug Adams. */
+	int revs = 424242;	/*%< Doug Adams. */
 	evWaitList *this_wl, *next_wl;
 	evWait *this_wait, *next_wait;
 
@@ -266,8 +266,7 @@ evGetNext(evContext opaqueCtx, evEvent *opaqueEv, int options) {
 		nextTime = nextTimer->due;
 		timerPast = (evCmpTime(nextTime, ctx->lastEventTime) <= 0);
 	} else
-		timerPast = 0;	/* Make gcc happy. */
-
+		timerPast = 0;	/*%< Make gcc happy. */
 	evPrintf(ctx, 9, "evGetNext: fdCount %d\n", ctx->fdCount);
 	if (ctx->fdCount == 0) {
 		static const struct timespec NoTime = {0, 0L};
@@ -309,10 +308,10 @@ evGetNext(evContext opaqueCtx, evEvent *opaqueEv, int options) {
 #endif
 		do {
 #ifndef USE_POLL
-			/* XXX need to copy only the bits we are using. */
-			ctx->rdLast = ctx->rdNext;
-			ctx->wrLast = ctx->wrNext;
-			ctx->exLast = ctx->exNext;
+			 /* XXX need to copy only the bits we are using. */
+			 ctx->rdLast = ctx->rdNext;
+			 ctx->wrLast = ctx->wrNext;
+			 ctx->exLast = ctx->exNext;
 #else
 			/*
 			 * The pollfd structure uses separate fields for
@@ -742,10 +741,10 @@ pselect(int nfds, void *rfds, void *wfds, void *efds,
 	sigset_t sigs;
 	int n;
 #ifdef USE_POLL
-	int polltimeout = INFTIM;
-	evContext_p *ctx;
-	struct pollfd *fds;
-	nfds_t pnfds;
+	int	polltimeout = INFTIM;
+	evContext_p	*ctx;
+	struct pollfd	*fds;
+	nfds_t		pnfds;
 
 	UNUSED(nfds);
 #endif /* USE_POLL */
@@ -761,9 +760,9 @@ pselect(int nfds, void *rfds, void *wfds, void *efds,
 	if (sigmask)
 		sigprocmask(SIG_SETMASK, sigmask, &sigs);
 #ifndef USE_POLL
-	n = select(nfds, rfds, wfds, efds, tvp);
+	 n = select(nfds, rfds, wfds, efds, tvp);
 #else
-	/*
+        /*
 	 * rfds, wfds, and efds should all be from the same evContext_p,
 	 * so any of them will do. If they're all NULL, the caller is
 	 * presumably calling us to block.
@@ -797,7 +796,7 @@ pselect(int nfds, void *rfds, void *wfds, void *efds,
 				e++;
 			if (FD_ISSET(i, &ctx->exLast))
 				e++;
-			}
+		}
 		n = e;
 	}
 #endif /* USE_POLL */
diff --git a/contrib/bind9/lib/bind/isc/eventlib.mdoc b/contrib/bind9/lib/bind/isc/eventlib.mdoc
index 3bf6ffb..5e9cd85 100644
--- a/contrib/bind9/lib/bind/isc/eventlib.mdoc
+++ b/contrib/bind9/lib/bind/isc/eventlib.mdoc
@@ -1,4 +1,4 @@
-.\" $Id: eventlib.mdoc,v 1.1.2.1.10.1 2004/03/09 08:33:43 marka Exp $
+.\" $Id: eventlib.mdoc,v 1.3 2004/03/09 06:30:08 marka Exp $
 .\"
 .\" Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1995-1999 by Internet Software Consortium
diff --git a/contrib/bind9/lib/bind/isc/eventlib_p.h b/contrib/bind9/lib/bind/isc/eventlib_p.h
index 5c45ab8..5896553 100644
--- a/contrib/bind9/lib/bind/isc/eventlib_p.h
+++ b/contrib/bind9/lib/bind/isc/eventlib_p.h
@@ -15,10 +15,11 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* eventlib_p.h - private interfaces for eventlib
- * vix 09sep95 [initial]
+/*! \file 
+ * \brief private interfaces for eventlib
+ * \author vix 09sep95 [initial]
  *
- * $Id: eventlib_p.h,v 1.3.2.1.4.4 2006/03/10 00:17:21 marka Exp $
+ * $Id: eventlib_p.h,v 1.5.18.4 2006/03/10 00:20:08 marka Exp $
  */
 
 #ifndef _EVENTLIB_P_H
@@ -77,9 +78,9 @@ typedef struct evConn {
 	void *		uap;
 	int		fd;
 	int		flags;
-#define EV_CONN_LISTEN		0x0001		/* Connection is a listener. */
-#define EV_CONN_SELECTED	0x0002		/* evSelectFD(conn->file). */
-#define EV_CONN_BLOCK		0x0004		/* Listener fd was blocking. */
+#define EV_CONN_LISTEN		0x0001		/*%< Connection is a listener. */
+#define EV_CONN_SELECTED	0x0002		/*%< evSelectFD(conn->file). */
+#define EV_CONN_BLOCK		0x0004		/*%< Listener fd was blocking. */
 	evFileID	file;
 	struct evConn *	prev;
 	struct evConn *	next;
@@ -126,7 +127,7 @@ typedef struct evStream {
 	evFileID	file;
 	evTimerID	timer;
 	int		flags;
-#define EV_STR_TIMEROK	0x0001	/* IFF timer valid. */
+#define EV_STR_TIMEROK	0x0001	/*%< IFF timer valid. */
 	int		fd;
 	struct iovec *	iovOrig;
 	int		iovOrigCount;
diff --git a/contrib/bind9/lib/bind/isc/heap.c b/contrib/bind9/lib/bind/isc/heap.c
index 2faf6f5..bea7678 100644
--- a/contrib/bind9/lib/bind/isc/heap.c
+++ b/contrib/bind9/lib/bind/isc/heap.c
@@ -15,7 +15,7 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
+/*%
  * Heap implementation of priority queues adapted from the following:
  *
  *	_Introduction to Algorithms_, Cormen, Leiserson, and Rivest,
@@ -26,7 +26,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: heap.c,v 1.1.206.2 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: heap.c,v 1.2.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -39,7 +39,7 @@ static const char rcsid[] = "$Id: heap.c,v 1.1.206.2 2006/03/10 00:17:21 marka E
 
 #include <isc/heap.h>
 
-/*
+/*%
  * Note: to make heap_parent and heap_left easy to compute, the first
  * element of the heap array is not used; i.e. heap subscripts are 1-based,
  * not 0-based.
@@ -232,3 +232,5 @@ heap_for_each(heap_context ctx, heap_for_each_func action, void *uap) {
 		(action)(ctx->heap[i], uap);
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/heap.mdoc b/contrib/bind9/lib/bind/isc/heap.mdoc
index 95c9444..332a6ec 100644
--- a/contrib/bind9/lib/bind/isc/heap.mdoc
+++ b/contrib/bind9/lib/bind/isc/heap.mdoc
@@ -1,4 +1,4 @@
-.\" $Id: heap.mdoc,v 1.1.2.1.10.1 2004/03/09 08:33:43 marka Exp $
+.\" $Id: heap.mdoc,v 1.3 2004/03/09 06:30:08 marka Exp $
 .\"
 .\" Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1997,1999 by Internet Software Consortium.
diff --git a/contrib/bind9/lib/bind/isc/hex.c b/contrib/bind9/lib/bind/isc/hex.c
index 7031259..e43be4f 100644
--- a/contrib/bind9/lib/bind/isc/hex.c
+++ b/contrib/bind9/lib/bind/isc/hex.c
@@ -33,7 +33,7 @@ isc_gethexstring(unsigned char *buf, size_t len, int count, FILE *fp,
 	char *s;
 	int result = count;
 	
-	x = 0; /* silence compiler */
+	x = 0; /*%< silence compiler */
 	n = 0;
 	while (count > 0) {
 		c = fgetc(fp);
@@ -115,3 +115,5 @@ isc_tohex(const unsigned char *buf, size_t buflen, char *t) {
 	}
 	*t = '\0';
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/logging.c b/contrib/bind9/lib/bind/isc/logging.c
index d4c7be2..ca7049c 100644
--- a/contrib/bind9/lib/bind/isc/logging.c
+++ b/contrib/bind9/lib/bind/isc/logging.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: logging.c,v 1.3.2.1.4.2 2004/03/17 01:49:42 marka Exp $";
+static const char rcsid[] = "$Id: logging.c,v 1.6.18.1 2005/04/27 05:01:07 sra Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -258,7 +258,7 @@ log_check(log_context lc, int category, int level) {
 		return (0);
 
 	if (category < 0 || category > lc->num_categories)
-		category = 0;		/* use default */
+		category = 0;		/*%< use default */
 	lcl = lc->categories[category];
 	if (lcl == NULL) {
 		category = 0;
@@ -302,7 +302,7 @@ log_vwrite(log_context lc, int category, int level, const char *format,
 		return;
 
 	if (category < 0 || category > lc->num_categories)
-		category = 0;		/* use default */
+		category = 0;		/*%< use default */
 	original_category = category;
 	lcl = lc->categories[category];
 	if (lcl == NULL) {
@@ -441,7 +441,7 @@ log_write(log_context lc, int category, int level, const char *format, ...) {
 	va_end(args);
 }
 
-/*
+/*%
  * Functions to create, set, or destroy contexts
  */
 
@@ -718,3 +718,5 @@ log_free_channel(log_channel chan) {
 	}
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/logging.mdoc b/contrib/bind9/lib/bind/isc/logging.mdoc
index fc6351f..98b2aed 100644
--- a/contrib/bind9/lib/bind/isc/logging.mdoc
+++ b/contrib/bind9/lib/bind/isc/logging.mdoc
@@ -1,4 +1,4 @@
-.\" $Id: logging.mdoc,v 1.1.2.1.10.1 2004/03/09 08:33:43 marka Exp $
+.\" $Id: logging.mdoc,v 1.3 2004/03/09 06:30:08 marka Exp $
 .\"
 .\" Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1995-1999 by Internet Software Consortium
diff --git a/contrib/bind9/lib/bind/isc/logging_p.h b/contrib/bind9/lib/bind/isc/logging_p.h
index 99f6976..5e6314f 100644
--- a/contrib/bind9/lib/bind/isc/logging_p.h
+++ b/contrib/bind9/lib/bind/isc/logging_p.h
@@ -34,7 +34,7 @@ typedef union log_output {
 } log_output;
 
 struct log_channel {
-	int level;			/* don't log messages > level */
+	int level;			/*%< don't log messages > level */
 	log_channel_type type;
 	log_output out;
 	unsigned int flags;
@@ -58,3 +58,4 @@ struct log_context {
 };
 
 #endif /* !LOGGING_P_H */
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/memcluster.c b/contrib/bind9/lib/bind/isc/memcluster.c
index 886f516..a58a2fe 100644
--- a/contrib/bind9/lib/bind/isc/memcluster.c
+++ b/contrib/bind9/lib/bind/isc/memcluster.c
@@ -24,7 +24,7 @@
 
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: memcluster.c,v 1.3.206.8 2006/08/30 23:35:06 marka Exp $";
+static const char rcsid[] = "$Id: memcluster.c,v 1.5.18.6 2006/08/30 23:30:35 marka Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -355,7 +355,7 @@ __memget_record(size_t size, const char *file, int line) {
 #endif
 }
 
-/* 
+/*%
  * This is a call from an external caller, 
  * so we want to count this as a user "put". 
  */
@@ -410,7 +410,7 @@ __memput_record(void *mem, size_t size, const char *file, int line) {
 		prev = el;
 		el = el->next;
 	}
-	INSIST(el != NULL);	/* double free */
+	INSIST(el != NULL);	/*%< double free */
 	if (prev == NULL) {
 		if (size == max_size || new_size >= max_size)
 			activelists[max_size] = el->next;
@@ -437,8 +437,8 @@ __memput_record(void *mem, size_t size, const char *file, int line) {
 
 	/* The free list uses the "rounded-up" size "new_size": */
 #if defined(DEBUGGING_MEMCLUSTER)
-	memset(mem, 0xa5, new_size - sizeof *e); /* catch write after free */
-	e->size = 0;	/* catch double memput() */
+	memset(mem, 0xa5, new_size - sizeof *e); /*%< catch write after free */
+	e->size = 0;	/*%< catch double memput() */
 #ifdef MEMCLUSTER_RECORD
 	e->file = file;
 	e->line = line;
@@ -489,7 +489,7 @@ __memput_debug(void *ptr, size_t size, const char *file, int line) {
 	__memput_record(ptr, size, file, line);
 }
 
-/*
+/*%
  * Print the stats[] on the stream "out" with suitable formatting.
  */
 void
@@ -549,7 +549,7 @@ memactive(void) {
 
 /* Private. */
 
-/* 
+/*%
  * Round up size to a multiple of sizeof(void *).  This guarantees that a
  * block is at least sizeof void *, and that we won't violate alignment
  * restrictions, both of which are needed to make lists of blocks.
@@ -584,3 +584,5 @@ check(unsigned char *a, int value, size_t len) {
 		INSIST(a[i] == value);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/memcluster.mdoc b/contrib/bind9/lib/bind/isc/memcluster.mdoc
index cd4e6fb..20b39d0 100644
--- a/contrib/bind9/lib/bind/isc/memcluster.mdoc
+++ b/contrib/bind9/lib/bind/isc/memcluster.mdoc
@@ -1,4 +1,4 @@
-.\" $Id: memcluster.mdoc,v 1.1.2.1.10.1 2004/03/09 08:33:43 marka Exp $
+.\" $Id: memcluster.mdoc,v 1.3 2004/03/09 06:30:08 marka Exp $
 .\"
 .\" Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1995-1999 by Internet Software Consortium
diff --git a/contrib/bind9/lib/bind/isc/movefile.c b/contrib/bind9/lib/bind/isc/movefile.c
index 8582aa7..191c46e 100644
--- a/contrib/bind9/lib/bind/isc/movefile.c
+++ b/contrib/bind9/lib/bind/isc/movefile.c
@@ -33,3 +33,5 @@ isc_movefile(const char *oldname, const char *newname) {
 #else
 	static int os_port_has_isc_movefile = 1;
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/tree.c b/contrib/bind9/lib/bind/isc/tree.c
index 9bdf6d6..5553636 100644
--- a/contrib/bind9/lib/bind/isc/tree.c
+++ b/contrib/bind9/lib/bind/isc/tree.c
@@ -1,8 +1,8 @@
 #ifndef LINT
-static const char rcsid[] = "$Id: tree.c,v 1.2.206.1 2004/03/09 08:33:43 marka Exp $";
+static const char rcsid[] = "$Id: tree.c,v 1.3.18.1 2005/04/27 05:01:08 sra Exp $";
 #endif
 
-/*
+/*%
  * tree - balanced binary tree library
  *
  * vix 05apr94 [removed vixie.h dependencies; cleaned up formatting, names]
@@ -14,7 +14,7 @@ static const char rcsid[] = "$Id: tree.c,v 1.2.206.1 2004/03/09 08:33:43 marka E
  * vix 14dec85 [written]
  */
 
-/*
+/*%
  * This program text was created by Paul Vixie using examples from the book:
  * "Algorithms & Data Structures," Niklaus Wirth, Prentice-Hall, 1986, ISBN
  * 0-13-022005-1.  Any errors in the conversion from Modula-2 to C are Paul
@@ -215,7 +215,7 @@ sprout(tree **ppr, tree_t p_data, int *pi_balance,
 		MSG("LESS. sprouting left.")
 		sub = sprout(&(*ppr)->left, p_data, pi_balance,
 			     pfi_compare, pfv_delete);
-		if (sub && *pi_balance) {	/* left branch has grown */
+		if (sub && *pi_balance) {	/*%< left branch has grown */
 			MSG("LESS: left branch has grown")
 			switch ((*ppr)->bal) {
 			case 1:
@@ -233,13 +233,13 @@ sprout(tree **ppr, tree_t p_data, int *pi_balance,
 				/* left branch was already too long. rebal */
 				MSG("LESS: case -1: rebalancing")
 				p1 = (*ppr)->left;
-				if (p1->bal == -1) {		/* LL */
+				if (p1->bal == -1) {		/*%< LL */
 					MSG("LESS: single LL")
 					(*ppr)->left = p1->right;
 					p1->right = *ppr;
 					(*ppr)->bal = 0;
 					*ppr = p1;
-				} else {			/* double LR */
+				} else {			/*%< double LR */
 					MSG("LESS: double LR")
 
 					p2 = p1->right;
@@ -289,13 +289,13 @@ sprout(tree **ppr, tree_t p_data, int *pi_balance,
 			case 1:
 				MSG("MORE: balance was off, need to rebalance")
 				p1 = (*ppr)->right;
-				if (p1->bal == 1) {		/* RR */
+				if (p1->bal == 1) {		/*%< RR */
 					MSG("MORE: single RR")
 					(*ppr)->right = p1->left;
 					p1->left = *ppr;
 					(*ppr)->bal = 0;
 					*ppr = p1;
-				} else {			/* double RL */
+				} else {			/*%< double RL */
 					MSG("MORE: double RL")
 
 					p2 = p1->left;
@@ -530,3 +530,5 @@ bal_R(tree **ppr_p, int *pi_balance) {
 	}
 	RETV
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/isc/tree.mdoc b/contrib/bind9/lib/bind/isc/tree.mdoc
index c46fa7d..2c24e1f 100644
--- a/contrib/bind9/lib/bind/isc/tree.mdoc
+++ b/contrib/bind9/lib/bind/isc/tree.mdoc
@@ -1,4 +1,4 @@
-.\" $Id: tree.mdoc,v 1.1.2.1.10.1 2004/03/09 08:33:44 marka Exp $
+.\" $Id: tree.mdoc,v 1.3 2004/03/09 06:30:09 marka Exp $
 .\"
 .\" Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (c) 1995-1999 by Internet Software Consortium
diff --git a/contrib/bind9/lib/bind/make/includes.in b/contrib/bind9/lib/bind/make/includes.in
index f080202..d7e21cb 100644
--- a/contrib/bind9/lib/bind/make/includes.in
+++ b/contrib/bind9/lib/bind/make/includes.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: includes.in,v 1.1.206.1 2004/03/15 01:02:44 marka Exp $
+# $Id: includes.in,v 1.2 2004/03/16 05:22:19 marka Exp $
 
 # Search for machine-generated header files in the build tree,
 # and for normal headers in the source tree (${top_srcdir}).
diff --git a/contrib/bind9/lib/bind/make/rules.in b/contrib/bind9/lib/bind/make/rules.in
index 1a4e81d..888e6ad 100644
--- a/contrib/bind9/lib/bind/make/rules.in
+++ b/contrib/bind9/lib/bind/make/rules.in
@@ -1,5 +1,5 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
-# Copyright (C) 2001  Internet Software Consortium.
+# Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2001, 2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: rules.in,v 1.3.2.3.4.4 2004/10/20 00:14:47 marka Exp $
+# $Id: rules.in,v 1.9.18.3 2007/01/18 00:06:11 marka Exp $
 
 ###
 ### Common Makefile rules for BIND 9.
diff --git a/contrib/bind9/lib/bind/nameser/Makefile.in b/contrib/bind9/lib/bind/nameser/Makefile.in
index aa4bc6c..d033eee 100644
--- a/contrib/bind9/lib/bind/nameser/Makefile.in
+++ b/contrib/bind9/lib/bind/nameser/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.206.1 2004/03/15 01:02:45 marka Exp $
+# $Id: Makefile.in,v 1.5 2004/03/16 05:22:19 marka Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/nameser/ns_date.c b/contrib/bind9/lib/bind/nameser/ns_date.c
index d6b347a..af1455c 100644
--- a/contrib/bind9/lib/bind/nameser/ns_date.c
+++ b/contrib/bind9/lib/bind/nameser/ns_date.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_date.c,v 1.3.206.2 2004/03/16 12:34:16 marka Exp $";
+static const char rcsid[] = "$Id: ns_date.c,v 1.5.18.1 2005/04/27 05:01:08 sra Exp $";
 #endif
 
 /* Import. */
@@ -45,9 +45,11 @@ static int	datepart(const char *, int, int, int, int *);
 
 /* Public. */
 
-/* Convert a date in ASCII into the number of seconds since
-   1 January 1970 (GMT assumed).  Format is yyyymmddhhmmss, all
-   digits required, no spaces allowed.  */
+/*%
+ * Convert a date in ASCII into the number of seconds since
+ * 1 January 1970 (GMT assumed).  Format is yyyymmddhhmmss, all
+ * digits required, no spaces allowed.
+ */
 
 u_int32_t
 ns_datetosecs(const char *cp, int *errp) {
@@ -70,7 +72,7 @@ ns_datetosecs(const char *cp, int *errp) {
 	time.tm_hour  = datepart(cp +  8, 2,   00,   23, errp);
 	time.tm_min   = datepart(cp + 10, 2,   00,   59, errp);
 	time.tm_sec   = datepart(cp + 12, 2,   00,   59, errp);
-	if (*errp)		/* Any parse errors? */
+	if (*errp)		/*%< Any parse errors? */
 		return (0);
 
 	/* 
@@ -81,32 +83,29 @@ ns_datetosecs(const char *cp, int *errp) {
 #define SECS_PER_DAY    ((u_int32_t)24*60*60)
 #define isleap(y) ((((y) % 4) == 0 && ((y) % 100) != 0) || ((y) % 400) == 0)
 
-	result  = time.tm_sec;				/* Seconds */
-	result += time.tm_min * 60;			/* Minutes */
-	result += time.tm_hour * (60*60);		/* Hours */
-	result += (time.tm_mday - 1) * SECS_PER_DAY;	/* Days */
-
+	result  = time.tm_sec;				/*%< Seconds */
+	result += time.tm_min * 60;			/*%< Minutes */
+	result += time.tm_hour * (60*60);		/*%< Hours */
+	result += (time.tm_mday - 1) * SECS_PER_DAY;	/*%< Days */
 	/* Months are trickier.  Look without leaping, then leap */
 	mdays = 0;
 	for (i = 0; i < time.tm_mon; i++)
 		mdays += days_per_month[i];
-	result += mdays * SECS_PER_DAY;			/* Months */
+	result += mdays * SECS_PER_DAY;			/*%< Months */
 	if (time.tm_mon > 1 && isleap(1900+time.tm_year))
-		result += SECS_PER_DAY;		/* Add leapday for this year */
-
+		result += SECS_PER_DAY;		/*%< Add leapday for this year */
 	/* First figure years without leapdays, then add them in.  */
 	/* The loop is slow, FIXME, but simple and accurate.  */
-	result += (time.tm_year - 70) * (SECS_PER_DAY*365); /* Years */
+	result += (time.tm_year - 70) * (SECS_PER_DAY*365); /*%< Years */
 	for (i = 70; i < time.tm_year; i++)
 		if (isleap(1900+i))
-			result += SECS_PER_DAY; /* Add leapday for prev year */
-
+			result += SECS_PER_DAY; /*%< Add leapday for prev year */
 	return (result);
 }
 
 /* Private. */
 
-/*
+/*%
  * Parse part of a date.  Set error flag if any error.
  * Don't reset the flag if there is no error.
  */
@@ -126,3 +125,5 @@ datepart(const char *buf, int size, int min, int max, int *errp) {
 		*errp = 1;
 	return (result);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_name.c b/contrib/bind9/lib/bind/nameser/ns_name.c
index 5ac91e3..31dee36 100644
--- a/contrib/bind9/lib/bind/nameser/ns_name.c
+++ b/contrib/bind9/lib/bind/nameser/ns_name.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_name.c,v 1.3.2.4.4.2 2004/05/04 03:27:47 marka Exp $";
+static const char rcsid[] = "$Id: ns_name.c,v 1.8.18.2 2005/04/27 05:01:08 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -41,7 +41,7 @@ static const char rcsid[] = "$Id: ns_name.c,v 1.3.2.4.4.2 2004/05/04 03:27:47 ma
 # define SPRINTF(x) ((size_t)sprintf x)
 #endif
 
-#define NS_TYPE_ELT			0x40 /* EDNS0 extended label type */
+#define NS_TYPE_ELT			0x40 /*%< EDNS0 extended label type */
 #define DNS_LABELTYPE_BITSTRING		0x41
 
 /* Data. */
@@ -83,14 +83,15 @@ static int		decode_bitstring(const unsigned char **,
 
 /* Public. */
 
-/*
- * ns_name_ntop(src, dst, dstsiz)
+/*%
  *	Convert an encoded domain name to printable ascii as per RFC1035.
+
  * return:
- *	Number of bytes written to buffer, or -1 (with errno set)
+ *\li	Number of bytes written to buffer, or -1 (with errno set)
+ *
  * notes:
- *	The root is returned as "."
- *	All other domains are returned in non absolute form
+ *\li	The root is returned as "."
+ *\li	All other domains are returned in non absolute form
  */
 int
 ns_name_ntop(const u_char *src, char *dst, size_t dstsiz)
@@ -119,7 +120,7 @@ ns_name_ntop(const u_char *src, char *dst, size_t dstsiz)
 			*dn++ = '.';
 		}
 		if ((l = labellen(cp - 1)) < 0) {
-			errno = EMSGSIZE; /* XXX */
+			errno = EMSGSIZE; /*%< XXX */
 			return(-1);
 		}
 		if (dn + l >= eom) {
@@ -184,15 +185,17 @@ ns_name_ntop(const u_char *src, char *dst, size_t dstsiz)
 	return (dn - dst);
 }
 
-/*
- * ns_name_pton(src, dst, dstsiz)
+/*%
  *	Convert a ascii string into an encoded domain name as per RFC1035.
+ *
  * return:
- *	-1 if it fails
- *	1 if string was fully qualified
- *	0 is string was not fully qualified
+ *
+ *\li	-1 if it fails
+ *\li	1 if string was fully qualified
+ *\li	0 is string was not fully qualified
+ *
  * notes:
- *	Enforces label and domain length limits.
+ *\li	Enforces label and domain length limits.
  */
 
 int
@@ -209,9 +212,9 @@ ns_name_pton(const char *src, u_char *dst, size_t dstsiz)
 
 	while ((c = *src++) != 0) {
 		if (escaped) {
-			if (c == '[') { /* start a bit string label */
+			if (c == '[') { /*%< start a bit string label */
 				if ((cp = strchr(src, ']')) == NULL) {
-					errno = EINVAL; /* ??? */
+					errno = EINVAL; /*%< ??? */
 					return(-1);
 				}
 				if ((e = encode_bitsring(&src, cp + 2,
@@ -256,7 +259,7 @@ ns_name_pton(const char *src, u_char *dst, size_t dstsiz)
 			continue;
 		} else if (c == '.') {
 			c = (bp - label - 1);
-			if ((c & NS_CMPRSFLGS) != 0) {	/* Label too big. */
+			if ((c & NS_CMPRSFLGS) != 0) {	/*%< Label too big. */
 				errno = EMSGSIZE;
 				return (-1);
 			}
@@ -294,7 +297,7 @@ ns_name_pton(const char *src, u_char *dst, size_t dstsiz)
 		*bp++ = (u_char)c;
 	}
 	c = (bp - label - 1);
-	if ((c & NS_CMPRSFLGS) != 0) {		/* Label too big. */
+	if ((c & NS_CMPRSFLGS) != 0) {		/*%< Label too big. */
 		errno = EMSGSIZE;
 		return (-1);
 	}
@@ -311,20 +314,21 @@ ns_name_pton(const char *src, u_char *dst, size_t dstsiz)
 		}
 		*bp++ = 0;
 	}
-	if ((bp - dst) > MAXCDNAME) {	/* src too big */
+	if ((bp - dst) > MAXCDNAME) {	/*%< src too big */
 		errno = EMSGSIZE;
 		return (-1);
 	}
 	return (0);
 }
 
-/*
- * ns_name_ntol(src, dst, dstsiz)
+/*%
  *	Convert a network strings labels into all lowercase.
+ *
  * return:
- *	Number of bytes written to buffer, or -1 (with errno set)
+ *\li	Number of bytes written to buffer, or -1 (with errno set)
+ *
  * notes:
- *	Enforces label and domain length limits.
+ *\li	Enforces label and domain length limits.
  */
 
 int
@@ -371,11 +375,11 @@ ns_name_ntol(const u_char *src, u_char *dst, size_t dstsiz)
 	return (dn - dst);
 }
 
-/*
- * ns_name_unpack(msg, eom, src, dst, dstsiz)
+/*%
  *	Unpack a domain name from a message, source may be compressed.
+ *
  * return:
- *	-1 if it fails, or consumed octets if it succeeds.
+ *\li	-1 if it fails, or consumed octets if it succeeds.
  */
 int
 ns_name_unpack(const u_char *msg, const u_char *eom, const u_char *src,
@@ -424,7 +428,7 @@ ns_name_unpack(const u_char *msg, const u_char *eom, const u_char *src,
 			if (len < 0)
 				len = srcp - src + 1;
 			srcp = msg + (((n & 0x3f) << 8) | (*srcp & 0xff));
-			if (srcp < msg || srcp >= eom) {  /* Out of range. */
+			if (srcp < msg || srcp >= eom) {  /*%< Out of range. */
 				errno = EMSGSIZE;
 				return (-1);
 			}
@@ -442,7 +446,7 @@ ns_name_unpack(const u_char *msg, const u_char *eom, const u_char *src,
 
 		default:
 			errno = EMSGSIZE;
-			return (-1);			/* flag error */
+			return (-1);			/*%< flag error */
 		}
 	}
 	*dstp = '\0';
@@ -451,19 +455,21 @@ ns_name_unpack(const u_char *msg, const u_char *eom, const u_char *src,
 	return (len);
 }
 
-/*
- * ns_name_pack(src, dst, dstsiz, dnptrs, lastdnptr)
+/*%
  *	Pack domain name 'domain' into 'comp_dn'.
+ *
  * return:
- *	Size of the compressed name, or -1.
+ *\li	Size of the compressed name, or -1.
+ *
  * notes:
- *	'dnptrs' is an array of pointers to previous compressed names.
- *	dnptrs[0] is a pointer to the beginning of the message. The array
+ *\li	'dnptrs' is an array of pointers to previous compressed names.
+ *\li	dnptrs[0] is a pointer to the beginning of the message. The array
  *	ends with NULL.
- *	'lastdnptr' is a pointer to the end of the array pointed to
+ *\li	'lastdnptr' is a pointer to the end of the array pointed to
  *	by 'dnptrs'.
+ *
  * Side effects:
- *	The list of pointers in dnptrs is updated for labels inserted into
+ *\li	The list of pointers in dnptrs is updated for labels inserted into
  *	the message as we compress the name.  If 'dnptr' is NULL, we don't
  *	try to compress names. If 'lastdnptr' is NULL, we don't update the
  *	list.
@@ -485,7 +491,7 @@ ns_name_pack(const u_char *src, u_char *dst, int dstsiz,
 		if ((msg = *dnptrs++) != NULL) {
 			for (cpp = dnptrs; *cpp != NULL; cpp++)
 				(void)NULL;
-			lpp = cpp;	/* end of list to search */
+			lpp = cpp;	/*%< end of list to search */
 		}
 	} else
 		msg = NULL;
@@ -560,13 +566,14 @@ cleanup:
 	return (dstp - dst);
 }
 
-/*
- * ns_name_uncompress(msg, eom, src, dst, dstsiz)
+/*%
  *	Expand compressed domain name to presentation format.
+ *
  * return:
- *	Number of bytes read out of `src', or -1 (with errno set).
+ *\li	Number of bytes read out of `src', or -1 (with errno set).
+ *
  * note:
- *	Root domain returns as "." not "".
+ *\li	Root domain returns as "." not "".
  */
 int
 ns_name_uncompress(const u_char *msg, const u_char *eom, const u_char *src,
@@ -582,18 +589,19 @@ ns_name_uncompress(const u_char *msg, const u_char *eom, const u_char *src,
 	return (n);
 }
 
-/*
- * ns_name_compress(src, dst, dstsiz, dnptrs, lastdnptr)
+/*%
  *	Compress a domain name into wire format, using compression pointers.
+ *
  * return:
- *	Number of bytes consumed in `dst' or -1 (with errno set).
+ *\li	Number of bytes consumed in `dst' or -1 (with errno set).
+ *
  * notes:
- *	'dnptrs' is an array of pointers to previous compressed names.
- *	dnptrs[0] is a pointer to the beginning of the message.
- *	The list ends with NULL.  'lastdnptr' is a pointer to the end of the
+ *\li	'dnptrs' is an array of pointers to previous compressed names.
+ *\li	dnptrs[0] is a pointer to the beginning of the message.
+ *\li	The list ends with NULL.  'lastdnptr' is a pointer to the end of the
  *	array pointed to by 'dnptrs'. Side effect is to update the list of
  *	pointers for labels inserted into the message as we compress the name.
- *	If 'dnptr' is NULL, we don't try to compress names. If 'lastdnptr'
+ *\li	If 'dnptr' is NULL, we don't try to compress names. If 'lastdnptr'
  *	is NULL, we don't update the list.
  */
 int
@@ -607,7 +615,7 @@ ns_name_compress(const char *src, u_char *dst, size_t dstsiz,
 	return (ns_name_pack(tmp, dst, dstsiz, dnptrs, lastdnptr));
 }
 
-/*
+/*%
  * Reset dnptrs so that there are no active references to pointers at or
  * after src.
  */
@@ -624,11 +632,11 @@ ns_name_rollback(const u_char *src, const u_char **dnptrs,
 	}
 }
 
-/*
- * ns_name_skip(ptrptr, eom)
+/*%
  *	Advance *ptrptr to skip over the compressed name it points at.
+ *
  * return:
- *	0 on success, -1 (with errno set) on failure.
+ *\li	0 on success, -1 (with errno set) on failure.
  */
 int
 ns_name_skip(const u_char **ptrptr, const u_char *eom)
@@ -641,20 +649,20 @@ ns_name_skip(const u_char **ptrptr, const u_char *eom)
 	while (cp < eom && (n = *cp++) != 0) {
 		/* Check for indirection. */
 		switch (n & NS_CMPRSFLGS) {
-		case 0:			/* normal case, n == len */
+		case 0:			/*%< normal case, n == len */
 			cp += n;
 			continue;
-		case NS_TYPE_ELT: /* EDNS0 extended label */
+		case NS_TYPE_ELT: /*%< EDNS0 extended label */
 			if ((l = labellen(cp - 1)) < 0) {
-				errno = EMSGSIZE; /* XXX */
+				errno = EMSGSIZE; /*%< XXX */
 				return(-1);
 			}
 			cp += l;
 			continue;
-		case NS_CMPRSFLGS:	/* indirection */
+		case NS_CMPRSFLGS:	/*%< indirection */
 			cp++;
 			break;
-		default:		/* illegal type */
+		default:		/*%< illegal type */
 			errno = EMSGSIZE;
 			return (-1);
 		}
@@ -670,44 +678,44 @@ ns_name_skip(const u_char **ptrptr, const u_char *eom)
 
 /* Private. */
 
-/*
- * special(ch)
+/*%
  *	Thinking in noninternationalized USASCII (per the DNS spec),
  *	is this characted special ("in need of quoting") ?
+ *
  * return:
- *	boolean.
+ *\li	boolean.
  */
 static int
 special(int ch) {
 	switch (ch) {
-	case 0x22: /* '"' */
-	case 0x2E: /* '.' */
-	case 0x3B: /* ';' */
-	case 0x5C: /* '\\' */
-	case 0x28: /* '(' */
-	case 0x29: /* ')' */
+	case 0x22: /*%< '"' */
+	case 0x2E: /*%< '.' */
+	case 0x3B: /*%< ';' */
+	case 0x5C: /*%< '\\' */
+	case 0x28: /*%< '(' */
+	case 0x29: /*%< ')' */
 	/* Special modifiers in zone files. */
-	case 0x40: /* '@' */
-	case 0x24: /* '$' */
+	case 0x40: /*%< '@' */
+	case 0x24: /*%< '$' */
 		return (1);
 	default:
 		return (0);
 	}
 }
 
-/*
- * printable(ch)
+/*%
  *	Thinking in noninternationalized USASCII (per the DNS spec),
  *	is this character visible and not a space when printed ?
+ *
  * return:
- *	boolean.
+ *\li	boolean.
  */
 static int
 printable(int ch) {
 	return (ch > 0x20 && ch < 0x7f);
 }
 
-/*
+/*%
  *	Thinking in noninternationalized USASCII (per the DNS spec),
  *	convert this character to lower case if it's upper case.
  */
@@ -718,14 +726,15 @@ mklower(int ch) {
 	return (ch);
 }
 
-/*
- * dn_find(domain, msg, dnptrs, lastdnptr)
+/*%
  *	Search for the counted-label name in an array of compressed names.
+ *
  * return:
- *	offset from msg if found, or -1.
+ *\li	offset from msg if found, or -1.
+ *
  * notes:
- *	dnptrs is the pointer to the first name on the list,
- *	not the pointer to the start of the message.
+ *\li	dnptrs is the pointer to the first name on the list,
+ *\li	not the pointer to the start of the message.
  */
 static int
 dn_find(const u_char *domain, const u_char *msg,
@@ -753,9 +762,8 @@ dn_find(const u_char *domain, const u_char *msg,
 				 * check for indirection
 				 */
 				switch (n & NS_CMPRSFLGS) {
-				case 0:		/* normal case, n == len */
-					n = labellen(cp - 1); /* XXX */
-
+				case 0:		/*%< normal case, n == len */
+					n = labellen(cp - 1); /*%< XXX */
 					if (n != *dn++)
 						goto next;
 
@@ -769,11 +777,11 @@ dn_find(const u_char *domain, const u_char *msg,
 					if (*dn)
 						continue;
 					goto next;
-				case NS_CMPRSFLGS:	/* indirection */
+				case NS_CMPRSFLGS:	/*%< indirection */
 					cp = msg + (((n & 0x3f) << 8) | *cp);
 					break;
 
-				default:	/* illegal type */
+				default:	/*%< illegal type */
 					errno = EMSGSIZE;
 					return (-1);
 				}
@@ -855,12 +863,12 @@ encode_bitsring(const char **bp, const char *end, unsigned char **labelp,
 	/* XXX: currently, only hex strings are supported */
 	if (*cp++ != 'x')
 		return(EINVAL);
-	if (!isxdigit((*cp) & 0xff)) /* reject '\[x/BLEN]' */
+	if (!isxdigit((*cp) & 0xff)) /*%< reject '\[x/BLEN]' */
 		return(EINVAL);
 
 	for (tp = *dst + 1; cp < end && tp < eom; cp++) {
 		switch((c = *cp)) {
-		case ']':	/* end of the bitstring */
+		case ']':	/*%< end of the bitstring */
 			if (afterslash) {
 				if (beg_blen == NULL)
 					return(EINVAL);
@@ -870,7 +878,7 @@ encode_bitsring(const char **bp, const char *end, unsigned char **labelp,
 			}
 			if (count)
 				*tp++ = ((value << 4) & 0xff);
-			cp++;	/* skip ']' */
+			cp++;	/*%< skip ']' */
 			goto done;
 		case '/':
 			afterslash = 1;
@@ -914,14 +922,14 @@ encode_bitsring(const char **bp, const char *end, unsigned char **labelp,
 	 * MUST be just sufficient to contain the number of bits specified
 	 * by the <length>. If there are insignificant bits in a final
 	 * hexadecimal or octal digit, they MUST be zero.
-	 * RFC 2673, Section 3.2.
+	 * RFC2673, Section 3.2.
 	 */
 	if (blen > 0) {
 		int traillen;
 
 		if (((blen + 3) & ~3) != tbcount)
 			return(EINVAL);
-		traillen = tbcount - blen; /* between 0 and 3 */
+		traillen = tbcount - blen; /*%< between 0 and 3 */
 		if (((value << (8 - traillen)) & 0xff) != 0)
 			return(EINVAL);
 	}
@@ -957,7 +965,9 @@ labellen(const u_char *lp)
 				bitlen = 256;
 			return((bitlen + 7 ) / 8 + 1);
 		}
-		return(-1);	/* unknwon ELT */
+		return(-1);	/*%< unknwon ELT */
 	}
 	return(l);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_netint.c b/contrib/bind9/lib/bind/nameser/ns_netint.c
index 15fc93e..b08c58b 100644
--- a/contrib/bind9/lib/bind/nameser/ns_netint.c
+++ b/contrib/bind9/lib/bind/nameser/ns_netint.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_netint.c,v 1.1.206.1 2004/03/09 08:33:44 marka Exp $";
+static const char rcsid[] = "$Id: ns_netint.c,v 1.2.18.1 2005/04/27 05:01:08 sra Exp $";
 #endif
 
 /* Import. */
@@ -54,3 +54,5 @@ void
 ns_put32(u_long src, u_char *dst) {
 	NS_PUT32(src, dst);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_parse.c b/contrib/bind9/lib/bind/nameser/ns_parse.c
index 19a6f51..5e7998d 100644
--- a/contrib/bind9/lib/bind/nameser/ns_parse.c
+++ b/contrib/bind9/lib/bind/nameser/ns_parse.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_parse.c,v 1.3.2.1.4.3 2005/10/11 00:48:16 marka Exp $";
+static const char rcsid[] = "$Id: ns_parse.c,v 1.5.18.3 2005/10/11 00:25:10 marka Exp $";
 #endif
 
 /* Import. */
@@ -51,22 +51,22 @@ static void	setsection(ns_msg *msg, ns_sect sect);
 
 /* These need to be in the same order as the nres.h:ns_flag enum. */
 struct _ns_flagdata _ns_flagdata[16] = {
-	{ 0x8000, 15 },		/* qr. */
-	{ 0x7800, 11 },		/* opcode. */
-	{ 0x0400, 10 },		/* aa. */
-	{ 0x0200, 9 },		/* tc. */
-	{ 0x0100, 8 },		/* rd. */
-	{ 0x0080, 7 },		/* ra. */
-	{ 0x0040, 6 },		/* z. */
-	{ 0x0020, 5 },		/* ad. */
-	{ 0x0010, 4 },		/* cd. */
-	{ 0x000f, 0 },		/* rcode. */
-	{ 0x0000, 0 },		/* expansion (1/6). */
-	{ 0x0000, 0 },		/* expansion (2/6). */
-	{ 0x0000, 0 },		/* expansion (3/6). */
-	{ 0x0000, 0 },		/* expansion (4/6). */
-	{ 0x0000, 0 },		/* expansion (5/6). */
-	{ 0x0000, 0 },		/* expansion (6/6). */
+	{ 0x8000, 15 },		/*%< qr. */
+	{ 0x7800, 11 },		/*%< opcode. */
+	{ 0x0400, 10 },		/*%< aa. */
+	{ 0x0200, 9 },		/*%< tc. */
+	{ 0x0100, 8 },		/*%< rd. */
+	{ 0x0080, 7 },		/*%< ra. */
+	{ 0x0040, 6 },		/*%< z. */
+	{ 0x0020, 5 },		/*%< ad. */
+	{ 0x0010, 4 },		/*%< cd. */
+	{ 0x000f, 0 },		/*%< rcode. */
+	{ 0x0000, 0 },		/*%< expansion (1/6). */
+	{ 0x0000, 0 },		/*%< expansion (2/6). */
+	{ 0x0000, 0 },		/*%< expansion (3/6). */
+	{ 0x0000, 0 },		/*%< expansion (4/6). */
+	{ 0x0000, 0 },		/*%< expansion (5/6). */
+	{ 0x0000, 0 },		/*%< expansion (6/6). */
 };
 
 int ns_msg_getflag(ns_msg handle, int flag) {
@@ -207,3 +207,5 @@ setsection(ns_msg *msg, ns_sect sect) {
 		msg->_msg_ptr = msg->_sections[(int)sect];
 	}
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_print.c b/contrib/bind9/lib/bind/nameser/ns_print.c
index cb61cb1..0679ba4 100644
--- a/contrib/bind9/lib/bind/nameser/ns_print.c
+++ b/contrib/bind9/lib/bind/nameser/ns_print.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_print.c,v 1.3.2.1.4.7 2004/09/16 07:01:12 marka Exp $";
+static const char rcsid[] = "$Id: ns_print.c,v 1.6.18.4 2005/04/27 05:01:09 sra Exp $";
 #endif
 
 /* Import. */
@@ -69,12 +69,11 @@ static int	addtab(size_t len, size_t target, int spaced,
 
 /* Public. */
 
-/*
- * int
- * ns_sprintrr(handle, rr, name_ctx, origin, buf, buflen)
+/*%
  *	Convert an RR to presentation format.
+ *
  * return:
- *	Number of characters written to buf, or -1 (check errno).
+ *\li	Number of characters written to buf, or -1 (check errno).
  */
 int
 ns_sprintrr(const ns_msg *handle, const ns_rr *rr,
@@ -90,13 +89,11 @@ ns_sprintrr(const ns_msg *handle, const ns_rr *rr,
 	return (n);
 }
 
-/*
- * int
- * ns_sprintrrf(msg, msglen, name, class, type, ttl, rdata, rdlen,
- *	       name_ctx, origin, buf, buflen)
+/*%
  *	Convert the fields of an RR into presentation format.
+ *
  * return:
- *	Number of characters written to buf, or -1 (check errno).
+ *\li	Number of characters written to buf, or -1 (check errno).
  */
 int
 ns_sprintrrf(const u_char *msg, size_t msglen,
@@ -645,10 +642,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 
 		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
 		T(addstr(" ", 1, &buf, &buflen));
-		rdata += 8; /* time */
+		rdata += 8; /*%< time */
 		n = ns_get16(rdata); rdata += INT16SZ;
-		rdata += n; /* sig */
-		n = ns_get16(rdata); rdata += INT16SZ; /* original id */
+		rdata += n; /*%< sig */
+		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
 		sprintf(buf, "%d", ns_get16(rdata));
 		rdata += INT16SZ;
 		addlen(strlen(buf), &buf, &buflen);
@@ -735,7 +732,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 
 /* Private. */
 
-/*
+/*%
  * size_t
  * prune_origin(name, origin)
  *	Find out if the name is at or under the current origin.
@@ -768,7 +765,7 @@ prune_origin(const char *name, const char *origin) {
 	return (name - oname);
 }
 
-/*
+/*%
  * int
  * charstr(rdata, edata, buf, buflen)
  *	Format a <character-string> into the presentation buffer.
@@ -824,7 +821,7 @@ addname(const u_char *msg, size_t msglen,
 
 	n = dn_expand(msg, msg + msglen, *pp, *buf, *buflen);
 	if (n < 0)
-		goto enospc;	/* Guess. */
+		goto enospc;	/*%< Guess. */
 	newlen = prune_origin(*buf, origin);
 	if (**buf == '\0') {
 		goto root;
@@ -896,3 +893,5 @@ addtab(size_t len, size_t target, int spaced, char **buf, size_t *buflen) {
 	}
 	return (spaced);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_samedomain.c b/contrib/bind9/lib/bind/nameser/ns_samedomain.c
index d4ca550..a720f6a 100644
--- a/contrib/bind9/lib/bind/nameser/ns_samedomain.c
+++ b/contrib/bind9/lib/bind/nameser/ns_samedomain.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_samedomain.c,v 1.1.2.2.4.2 2004/03/16 12:34:17 marka Exp $";
+static const char rcsid[] = "$Id: ns_samedomain.c,v 1.5.18.1 2005/04/27 05:01:09 sra Exp $";
 #endif
 
 #include "port_before.h"
@@ -28,21 +28,22 @@ static const char rcsid[] = "$Id: ns_samedomain.c,v 1.1.2.2.4.2 2004/03/16 12:34
 
 #include "port_after.h"
 
-/*
- * int
- * ns_samedomain(a, b)
+/*%
  *	Check whether a name belongs to a domain.
+ *
  * Inputs:
- *	a - the domain whose ancestory is being verified
- *	b - the potential ancestor we're checking against
+ *\li	a - the domain whose ancestory is being verified
+ *\li	b - the potential ancestor we're checking against
+ *
  * Return:
- *	boolean - is a at or below b?
+ *\li	boolean - is a at or below b?
+ *
  * Notes:
- *	Trailing dots are first removed from name and domain.
+ *\li	Trailing dots are first removed from name and domain.
  *	Always compare complete subdomains, not only whether the
  *	domain name is the trailing string of the given name.
  *
- *	"host.foobar.top" lies in "foobar.top" and in "top" and in ""
+ *\li	"host.foobar.top" lies in "foobar.top" and in "top" and in ""
  *	but NOT in "bar.top"
  */
 
@@ -140,9 +141,7 @@ ns_samedomain(const char *a, const char *b) {
 	return (strncasecmp(cp, b, lb) == 0);
 }
 
-/*
- * int
- * ns_subdomain(a, b)
+/*%
  *	is "a" a subdomain of "b"?
  */
 int
@@ -150,30 +149,31 @@ ns_subdomain(const char *a, const char *b) {
 	return (ns_samename(a, b) != 1 && ns_samedomain(a, b));
 }
 
-/*
- * int
- * ns_makecanon(src, dst, dstsize)
+/*%
  *	make a canonical copy of domain name "src"
+ *
  * notes:
+ * \code
  *	foo -> foo.
  *	foo. -> foo.
  *	foo.. -> foo.
  *	foo\. -> foo\..
  *	foo\\. -> foo\\.
+ * \endcode
  */
 
 int
 ns_makecanon(const char *src, char *dst, size_t dstsize) {
 	size_t n = strlen(src);
 
-	if (n + sizeof "." > dstsize) {			/* Note: sizeof == 2 */
+	if (n + sizeof "." > dstsize) {			/*%< Note: sizeof == 2 */
 		errno = EMSGSIZE;
 		return (-1);
 	}
 	strcpy(dst, src);
-	while (n >= 1U && dst[n - 1] == '.')		/* Ends in "." */
-		if (n >= 2U && dst[n - 2] == '\\' &&	/* Ends in "\." */
-		    (n < 3U || dst[n - 3] != '\\'))	/* But not "\\." */
+	while (n >= 1U && dst[n - 1] == '.')		/*%< Ends in "." */
+		if (n >= 2U && dst[n - 2] == '\\' &&	/*%< Ends in "\." */
+		    (n < 3U || dst[n - 3] != '\\'))	/*%< But not "\\." */
 			break;
 		else
 			dst[--n] = '\0';
@@ -182,14 +182,13 @@ ns_makecanon(const char *src, char *dst, size_t dstsize) {
 	return (0);
 }
 
-/*
- * int
- * ns_samename(a, b)
+/*%
  *	determine whether domain name "a" is the same as domain name "b"
+ *
  * return:
- *	-1 on error
- *	0 if names differ
- *	1 if names are the same
+ *\li	-1 on error
+ *\li	0 if names differ
+ *\li	1 if names are the same
  */
 
 int
@@ -204,3 +203,5 @@ ns_samename(const char *a, const char *b) {
 	else
 		return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_sign.c b/contrib/bind9/lib/bind/nameser/ns_sign.c
index 7b742f1..ab4b0ef 100644
--- a/contrib/bind9/lib/bind/nameser/ns_sign.c
+++ b/contrib/bind9/lib/bind/nameser/ns_sign.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_sign.c,v 1.1.2.2.4.2 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: ns_sign.c,v 1.4.18.2 2006/03/10 00:20:08 marka Exp $";
 #endif
 
 /* Import. */
@@ -53,24 +53,26 @@ static const char rcsid[] = "$Id: ns_sign.c,v 1.1.2.2.4.2 2006/03/10 00:17:21 ma
 		} \
 	} while (0)
 
-/* ns_sign
+/*%
+ *  ns_sign
+ *
  * Parameters:
- *	msg		message to be sent
- *	msglen		input - length of message
+ *\li	msg		message to be sent
+ *\li	msglen		input - length of message
  *			output - length of signed message
- *	msgsize		length of buffer containing message
- *	error		value to put in the error field
- *	key		tsig key used for signing
- *	querysig	(response), the signature in the query
- *	querysiglen	(response), the length of the signature in the query
- *	sig		a buffer to hold the generated signature
- *	siglen		input - length of signature buffer
+ *\li	msgsize		length of buffer containing message
+ *\li	error		value to put in the error field
+ *\li	key		tsig key used for signing
+ *\li	querysig	(response), the signature in the query
+ *\li	querysiglen	(response), the length of the signature in the query
+ *\li	sig		a buffer to hold the generated signature
+ *\li	siglen		input - length of signature buffer
  *			output - length of signature
  *
  * Errors:
- *	- bad input data (-1)
- *	- bad key / sign failed (-BADKEY)
- *	- not enough space (NS_TSIG_ERROR_NO_SPACE)
+ *\li	- bad input data (-1)
+ *\li	- bad key / sign failed (-BADKEY)
+ *\li	- not enough space (NS_TSIG_ERROR_NO_SPACE)
  */
 int
 ns_sign(u_char *msg, int *msglen, int msgsize, int error, void *k,
@@ -124,7 +126,7 @@ ns_sign2(u_char *msg, int *msglen, int msgsize, int error, void *k,
 	BOUNDS_CHECK(cp, INT16SZ + INT16SZ + INT32SZ + INT16SZ);
 	PUTSHORT(ns_t_tsig, cp);
 	PUTSHORT(ns_c_any, cp);
-	PUTLONG(0, cp);		/* TTL */
+	PUTLONG(0, cp);		/*%< TTL */
 	lenp = cp;
 	cp += 2;
 
@@ -191,18 +193,18 @@ ns_sign2(u_char *msg, int *msglen, int msgsize, int error, void *k,
 
 		/* Digest the time signed, fudge, error, and other data */
 		cp2 = buf;
-		PUTSHORT(0, cp2);	/* Top 16 bits of time */
+		PUTSHORT(0, cp2);	/*%< Top 16 bits of time */
 		if (error != ns_r_badtime)
 			PUTLONG(timesigned, cp2);
 		else
 			PUTLONG(in_timesigned, cp2);
 		PUTSHORT(NS_TSIG_FUDGE, cp2);
-		PUTSHORT(error, cp2);	/* Error */
+		PUTSHORT(error, cp2);	/*%< Error */
 		if (error != ns_r_badtime)
-			PUTSHORT(0, cp2);	/* Other data length */
+			PUTSHORT(0, cp2);	/*%< Other data length */
 		else {
-			PUTSHORT(INT16SZ+INT32SZ, cp2);	/* Other data length */
-			PUTSHORT(0, cp2);	/* Top 16 bits of time */
+			PUTSHORT(INT16SZ+INT32SZ, cp2);	/*%< Other data length */
+			PUTSHORT(0, cp2);	/*%< Top 16 bits of time */
 			PUTLONG(timesigned, cp2);
 		}
 		dst_sign_data(SIG_MODE_UPDATE, key, &ctx, buf, cp2-buf,
@@ -224,17 +226,17 @@ ns_sign2(u_char *msg, int *msglen, int msgsize, int error, void *k,
 
 	/* The original message ID & error. */
 	BOUNDS_CHECK(cp, INT16SZ + INT16SZ);
-	PUTSHORT(ntohs(hp->id), cp);	/* already in network order */
+	PUTSHORT(ntohs(hp->id), cp);	/*%< already in network order */
 	PUTSHORT(error, cp);
 
 	/* Other data. */
 	BOUNDS_CHECK(cp, INT16SZ);
 	if (error != ns_r_badtime)
-		PUTSHORT(0, cp);	/* Other data length */
+		PUTSHORT(0, cp);	/*%< Other data length */
 	else {
-		PUTSHORT(INT16SZ+INT32SZ, cp);	/* Other data length */
+		PUTSHORT(INT16SZ+INT32SZ, cp);	/*%< Other data length */
 		BOUNDS_CHECK(cp, INT32SZ+INT16SZ);
-		PUTSHORT(0, cp);	/* Top 16 bits of time */
+		PUTSHORT(0, cp);	/*%< Top 16 bits of time */
 		PUTLONG(timesigned, cp);
 	}
 
@@ -323,7 +325,7 @@ ns_sign_tcp2(u_char *msg, int *msglen, int msgsize, int error,
 	BOUNDS_CHECK(cp, INT16SZ + INT16SZ + INT32SZ + INT16SZ);
 	PUTSHORT(ns_t_tsig, cp);
 	PUTSHORT(ns_c_any, cp);
-	PUTLONG(0, cp);		/* TTL */
+	PUTLONG(0, cp);		/*%< TTL */
 	lenp = cp;
 	cp += 2;
 
@@ -346,7 +348,7 @@ ns_sign_tcp2(u_char *msg, int *msglen, int msgsize, int error,
 
 	/* Digest the time signed and fudge. */
 	cp2 = buf;
-	PUTSHORT(0, cp2);	/* Top 16 bits of time */
+	PUTSHORT(0, cp2);	/*%< Top 16 bits of time */
 	PUTLONG(timesigned, cp2);
 	PUTSHORT(NS_TSIG_FUDGE, cp2);
 
@@ -367,7 +369,7 @@ ns_sign_tcp2(u_char *msg, int *msglen, int msgsize, int error,
 
 	/* The original message ID & error. */
 	BOUNDS_CHECK(cp, INT16SZ + INT16SZ);
-	PUTSHORT(ntohs(hp->id), cp);	/* already in network order */
+	PUTSHORT(ntohs(hp->id), cp);	/*%< already in network order */
 	PUTSHORT(error, cp);
 
 	/* Other data. */
@@ -381,3 +383,5 @@ ns_sign_tcp2(u_char *msg, int *msglen, int msgsize, int error,
 	*msglen = (cp - msg);
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_ttl.c b/contrib/bind9/lib/bind/nameser/ns_ttl.c
index 4d18d3f..627ddf1 100644
--- a/contrib/bind9/lib/bind/nameser/ns_ttl.c
+++ b/contrib/bind9/lib/bind/nameser/ns_ttl.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_ttl.c,v 1.1.206.2 2005/07/28 07:43:21 marka Exp $";
+static const char rcsid[] = "$Id: ns_ttl.c,v 1.2.18.2 2005/07/28 07:38:10 marka Exp $";
 #endif
 
 /* Import. */
@@ -158,3 +158,5 @@ fmt1(int t, char s, char **buf, size_t *buflen) {
 	*buflen -= len;
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/nameser/ns_verify.c b/contrib/bind9/lib/bind/nameser/ns_verify.c
index c74a0a3..b80b588 100644
--- a/contrib/bind9/lib/bind/nameser/ns_verify.c
+++ b/contrib/bind9/lib/bind/nameser/ns_verify.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_verify.c,v 1.1.206.3 2006/03/10 00:17:21 marka Exp $";
+static const char rcsid[] = "$Id: ns_verify.c,v 1.2.18.3 2006/03/10 00:20:08 marka Exp $";
 #endif
 
 /* Import. */
@@ -107,28 +107,29 @@ ns_find_tsig(u_char *msg, u_char *eom) {
 }
 
 /* ns_verify
+ *
  * Parameters:
- *	statp		res stuff
- *	msg		received message
- *	msglen		length of message
- *	key		tsig key used for verifying.
- *	querysig	(response), the signature in the query
- *	querysiglen	(response), the length of the signature in the query
- *	sig		(query), a buffer to hold the signature
- *	siglen		(query), input - length of signature buffer
+ *\li	statp		res stuff
+ *\li	msg		received message
+ *\li	msglen		length of message
+ *\li	key		tsig key used for verifying.
+ *\li	querysig	(response), the signature in the query
+ *\li	querysiglen	(response), the length of the signature in the query
+ *\li	sig		(query), a buffer to hold the signature
+ *\li	siglen		(query), input - length of signature buffer
  *				 output - length of signature
  *
  * Errors:
- *	- bad input (-1)
- *	- invalid dns message (NS_TSIG_ERROR_FORMERR)
- *	- TSIG is not present (NS_TSIG_ERROR_NO_TSIG)
- *	- key doesn't match (-ns_r_badkey)
- *	- TSIG verification fails with BADKEY (-ns_r_badkey)
- *	- TSIG verification fails with BADSIG (-ns_r_badsig)
- *	- TSIG verification fails with BADTIME (-ns_r_badtime)
- *	- TSIG verification succeeds, error set to BAKEY (ns_r_badkey)
- *	- TSIG verification succeeds, error set to BADSIG (ns_r_badsig)
- *	- TSIG verification succeeds, error set to BADTIME (ns_r_badtime)
+ *\li	- bad input (-1)
+ *\li	- invalid dns message (NS_TSIG_ERROR_FORMERR)
+ *\li	- TSIG is not present (NS_TSIG_ERROR_NO_TSIG)
+ *\li	- key doesn't match (-ns_r_badkey)
+ *\li	- TSIG verification fails with BADKEY (-ns_r_badkey)
+ *\li	- TSIG verification fails with BADSIG (-ns_r_badsig)
+ *\li	- TSIG verification fails with BADTIME (-ns_r_badtime)
+ *\li	- TSIG verification succeeds, error set to BAKEY (ns_r_badkey)
+ *\li	- TSIG verification succeeds, error set to BADSIG (ns_r_badsig)
+ *\li	- TSIG verification succeeds, error set to BADTIME (ns_r_badtime)
  */
 int
 ns_verify(u_char *msg, int *msglen, void *k,
@@ -450,7 +451,7 @@ ns_verify_tcp(u_char *msg, int *msglen, ns_tcp_tsig_state *state,
 
 	/* Digest the time signed and fudge. */
 	cp2 = buf;
-	PUTSHORT(0, cp2);       /* Top 16 bits of time. */
+	PUTSHORT(0, cp2);       /*%< Top 16 bits of time. */
 	PUTLONG(timesigned, cp2);
 	PUTSHORT(NS_TSIG_FUDGE, cp2);
 
@@ -479,3 +480,5 @@ ns_verify_tcp(u_char *msg, int *msglen, ns_tcp_tsig_state *state,
 
 	return (0);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/port/freebsd/include/Makefile.in b/contrib/bind9/lib/bind/port/freebsd/include/Makefile.in
index c18acf2..68bef09 100644
--- a/contrib/bind9/lib/bind/port/freebsd/include/Makefile.in
+++ b/contrib/bind9/lib/bind/port/freebsd/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.1.206.1 2004/03/15 01:02:47 marka Exp $
+# $Id: Makefile.in,v 1.2 2004/03/16 05:22:22 marka Exp $
 
 srcdir =        @srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/port_before.h.in b/contrib/bind9/lib/bind/port_before.h.in
index 320fff1..79cf277 100644
--- a/contrib/bind9/lib/bind/port_before.h.in
+++ b/contrib/bind9/lib/bind/port_before.h.in
@@ -148,3 +148,5 @@ struct timezone;        /* silence warning */
 #endif
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/Makefile.in b/contrib/bind9/lib/bind/resolv/Makefile.in
index a235fbc..cc661b6 100644
--- a/contrib/bind9/lib/bind/resolv/Makefile.in
+++ b/contrib/bind9/lib/bind/resolv/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.3.206.3 2005/07/29 00:13:09 marka Exp $
+# $Id: Makefile.in,v 1.4.18.2 2005/07/29 00:12:55 marka Exp $
 
 srcdir=		@srcdir@
 VPATH =         @srcdir@
diff --git a/contrib/bind9/lib/bind/resolv/herror.c b/contrib/bind9/lib/bind/resolv/herror.c
index 58807e9..9232426 100644
--- a/contrib/bind9/lib/bind/resolv/herror.c
+++ b/contrib/bind9/lib/bind/resolv/herror.c
@@ -50,7 +50,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)herror.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: herror.c,v 1.2.206.1 2004/03/09 08:33:54 marka Exp $";
+static const char rcsid[] = "$Id: herror.c,v 1.3.18.1 2005/04/27 05:01:09 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -72,10 +72,10 @@ static const char rcsid[] = "$Id: herror.c,v 1.2.206.1 2004/03/09 08:33:54 marka
 
 const char *h_errlist[] = {
 	"Resolver Error 0 (no error)",
-	"Unknown host",				/* 1 HOST_NOT_FOUND */
-	"Host name lookup failure",		/* 2 TRY_AGAIN */
-	"Unknown server error",			/* 3 NO_RECOVERY */
-	"No address associated with name",	/* 4 NO_ADDRESS */
+	"Unknown host",				/*%< 1 HOST_NOT_FOUND */
+	"Host name lookup failure",		/*%< 2 TRY_AGAIN */
+	"Unknown server error",			/*%< 3 NO_RECOVERY */
+	"No address associated with name",	/*%< 4 NO_ADDRESS */
 };
 int	h_nerr = { sizeof h_errlist / sizeof h_errlist[0] };
 
@@ -84,7 +84,7 @@ int	h_nerr = { sizeof h_errlist / sizeof h_errlist[0] };
 int	h_errno;
 #endif
 
-/*
+/*%
  * herror --
  *	print the error indicated by the h_errno value.
  */
@@ -113,7 +113,7 @@ herror(const char *s) {
 	writev(STDERR_FILENO, iov, (v - iov) + 1);
 }
 
-/*
+/*%
  * hstrerror --
  *	return the string associated with a given "host" errno value.
  */
@@ -125,3 +125,5 @@ hstrerror(int err) {
 		return (h_errlist[err]);
 	return ("Unknown resolver error");
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_comp.c b/contrib/bind9/lib/bind/resolv/res_comp.c
index 8cc99a7..4dc3c2a 100644
--- a/contrib/bind9/lib/bind/resolv/res_comp.c
+++ b/contrib/bind9/lib/bind/resolv/res_comp.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_comp.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_comp.c,v 1.1.2.1.4.2 2005/07/28 07:43:22 marka Exp $";
+static const char rcsid[] = "$Id: res_comp.c,v 1.3.18.2 2005/07/28 07:38:11 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -85,12 +85,13 @@ static const char rcsid[] = "$Id: res_comp.c,v 1.1.2.1.4.2 2005/07/28 07:43:22 m
 #include <unistd.h>
 #include "port_after.h"
 
-/*
+/*%
  * Expand compressed domain name 'src' to full domain name.
- * 'msg' is a pointer to the begining of the message,
- * 'eom' points to the first location after the message,
- * 'dst' is a pointer to a buffer of size 'dstsiz' for the result.
- * Return size of compressed name or -1 if there was an error.
+ *
+ * \li 'msg' is a pointer to the begining of the message,
+ * \li 'eom' points to the first location after the message,
+ * \li 'dst' is a pointer to a buffer of size 'dstsiz' for the result.
+ * \li Return size of compressed name or -1 if there was an error.
  */
 int
 dn_expand(const u_char *msg, const u_char *eom, const u_char *src,
@@ -103,10 +104,11 @@ dn_expand(const u_char *msg, const u_char *eom, const u_char *src,
 	return (n);
 }
 
-/*
+/*%
  * Pack domain name 'exp_dn' in presentation form into 'comp_dn'.
- * Return the size of the compressed name or -1.
- * 'length' is the size of the array pointed to by 'comp_dn'.
+ *
+ * \li Return the size of the compressed name or -1.
+ * \li 'length' is the size of the array pointed to by 'comp_dn'.
  */
 int
 dn_comp(const char *src, u_char *dst, int dstsiz,
@@ -117,7 +119,7 @@ dn_comp(const char *src, u_char *dst, int dstsiz,
 				 (const u_char **)lastdnptr));
 }
 
-/*
+/*%
  * Skip over a compressed domain name. Return the size or -1.
  */
 int
@@ -129,11 +131,9 @@ dn_skipname(const u_char *ptr, const u_char *eom) {
 	return (ptr - saveptr);
 }
 
-/*
+/*%
  * Verify that a domain name uses an acceptable character set.
- */
-
-/*
+ *
  * Note the conspicuous absence of ctype macros in these definitions.  On
  * non-ASCII hosts, we can't depend on string literals or ctype macros to
  * tell us anything about network-format data.  The rest of the BIND system
@@ -176,7 +176,7 @@ res_hnok(const char *dn) {
 	return (1);
 }
 
-/*
+/*%
  * hostname-like (A, MX, WKS) owners can have "*" as their first label
  * but must otherwise be as a host name.
  */
@@ -191,7 +191,7 @@ res_ownok(const char *dn) {
 	return (res_hnok(dn));
 }
 
-/*
+/*%
  * SOA RNAMEs and RP RNAMEs can have any printable character in their first
  * label, but the rest of the name has to look like a host name.
  */
@@ -219,8 +219,8 @@ res_mailok(const char *dn) {
 	return (0);
 }
 
-/*
- * This function is quite liberal, since RFC 1034's character sets are only
+/*%
+ * This function is quite liberal, since RFC1034's character sets are only
  * recommendations.
  */
 int
@@ -234,7 +234,7 @@ res_dnok(const char *dn) {
 }
 
 #ifdef BIND_4_COMPAT
-/*
+/*%
  * This module must export the following externally-visible symbols:
  *	___putlong
  *	___putshort
@@ -261,3 +261,5 @@ u_int32_t _getlong(const u_char *src) { return (ns_get32(src)); }
 u_int16_t _getshort(const u_char *src) { return (ns_get16(src)); }
 #endif /*__ultrix__*/
 #endif /*BIND_4_COMPAT*/
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_data.c b/contrib/bind9/lib/bind/resolv/res_data.c
index 204e03d..e3dcbf0 100644
--- a/contrib/bind9/lib/bind/resolv/res_data.c
+++ b/contrib/bind9/lib/bind/resolv/res_data.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: res_data.c,v 1.1.206.2 2004/03/16 12:34:18 marka Exp $";
+static const char rcsid[] = "$Id: res_data.c,v 1.3.18.1 2005/04/27 05:01:10 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -46,8 +46,8 @@ const char *_res_opcodes[] = {
 	"QUERY",
 	"IQUERY",
 	"CQUERYM",
-	"CQUERYU",	/* experimental */
-	"NOTIFY",	/* experimental */
+	"CQUERYU",	/*%< experimental */
+	"NOTIFY",	/*%< experimental */
 	"UPDATE",
 	"6",
 	"7",
@@ -73,7 +73,7 @@ const char *_res_sectioncodes[] = {
 #ifndef __BIND_NOSTATIC
 struct __res_state _res
 # if defined(__BIND_RES_TEXT)
-	= { RES_TIMEOUT, }	/* Motorola, et al. */
+	= { RES_TIMEOUT, }	/*%< Motorola, et al. */
 # endif
         ;
 
@@ -140,14 +140,14 @@ fp_nquery(const u_char *msg, int len, FILE *file) {
 }
 
 int
-res_mkquery(int op,			/* opcode of query */
-	    const char *dname,		/* domain name */
-	    int class, int type,	/* class and type of query */
-	    const u_char *data,		/* resource record data */
-	    int datalen,		/* length of data */
-	    const u_char *newrr_in,	/* new rr for modify or append */
-	    u_char *buf,		/* buffer to put query */
-	    int buflen)			/* size of buffer */
+res_mkquery(int op,			/*!< opcode of query  */
+	    const char *dname,		/*!< domain name  */
+	    int class, int type,	/*!< class and type of query  */
+	    const u_char *data,		/*!< resource record data  */
+	    int datalen,		/*!< length of data  */
+	    const u_char *newrr_in,	/*!< new rr for modify or append  */
+	    u_char *buf,		/*!< buffer to put query  */
+	    int buflen)			/*!< size of buffer  */
 {
 	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
 		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
@@ -169,10 +169,10 @@ res_mkupdate(ns_updrec *rrecp_in, u_char *buf, int buflen) {
 }
 
 int
-res_query(const char *name,	/* domain name */
-	  int class, int type,	/* class and type of query */
-	  u_char *answer,	/* buffer to put answer */
-	  int anslen)		/* size of answer buffer */
+res_query(const char *name,	/*!< domain name  */
+	  int class, int type,	/*!< class and type of query  */
+	  u_char *answer,	/*!< buffer to put answer  */
+	  int anslen)		/*!< size of answer buffer  */
 {
 	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
 		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
@@ -234,10 +234,10 @@ res_update(ns_updrec *rrecp_in) {
 }
 
 int
-res_search(const char *name,	/* domain name */
-	   int class, int type,	/* class and type of query */
-	   u_char *answer,	/* buffer to put answer */
-	   int anslen)		/* size of answer */
+res_search(const char *name,	/*!< domain name  */
+	   int class, int type,	/*!< class and type of query  */
+	   u_char *answer,	/*!< buffer to put answer  */
+	   int anslen)		/*!< size of answer  */
 {
 	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
 		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
@@ -250,9 +250,9 @@ res_search(const char *name,	/* domain name */
 int
 res_querydomain(const char *name,
 		const char *domain,
-		int class, int type,	/* class and type of query */
-		u_char *answer,		/* buffer to put answer */
-		int anslen)		/* size of answer */
+		int class, int type,	/*!< class and type of query  */
+		u_char *answer,		/*!< buffer to put answer  */
+		int anslen)		/*!< size of answer  */
 {
 	if ((_res.options & RES_INIT) == 0U && res_init() == -1) {
 		RES_SET_H_ERRNO(&_res, NETDB_INTERNAL);
@@ -289,3 +289,5 @@ local_hostname_length(const char *hostname) {
 #endif /*ultrix*/
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_debug.c b/contrib/bind9/lib/bind/resolv/res_debug.c
index 8dda12c..2ed234e 100644
--- a/contrib/bind9/lib/bind/resolv/res_debug.c
+++ b/contrib/bind9/lib/bind/resolv/res_debug.c
@@ -95,7 +95,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_debug.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_debug.c,v 1.3.2.5.4.6 2005/07/28 07:43:22 marka Exp $";
+static const char rcsid[] = "$Id: res_debug.c,v 1.10.18.5 2005/07/28 07:38:11 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -130,7 +130,7 @@ static const char rcsid[] = "$Id: res_debug.c,v 1.3.2.5.4.6 2005/07/28 07:43:22
 extern const char *_res_opcodes[];
 extern const char *_res_sectioncodes[];
 
-/*
+/*%
  * Print the current options.
  */
 void
@@ -223,7 +223,7 @@ do_section(const res_state statp,
 		free(buf);
 }
 
-/*
+/*%
  * Print the contents of a query.
  * This is intended to be primarily a debugging routine.
  */
@@ -318,7 +318,8 @@ p_cdname(const u_char *cp, const u_char *msg, FILE *file) {
 	return (p_cdnname(cp, msg, PACKETSZ, file));
 }
 
-/* Return a fully-qualified domain name from a compressed name (with
+/*%
+ * Return a fully-qualified domain name from a compressed name (with
    length supplied).  */
 
 const u_char *
@@ -334,7 +335,7 @@ p_fqnname(cp, msg, msglen, name, namelen)
 		return (NULL);
 	newlen = strlen(name);
 	if (newlen == 0 || name[newlen - 1] != '.') {
-		if (newlen + 1 >= namelen)	/* Lack space for final dot */
+		if (newlen + 1 >= namelen)	/*%< Lack space for final dot */
 			return (NULL);
 		else
 			strcpy(name + newlen, ".");
@@ -356,7 +357,7 @@ p_fqname(const u_char *cp, const u_char *msg, FILE *file) {
 	return (n);
 }
 
-/*
+/*%
  * Names of RR classes and qclasses.  Classes and qclasses are the same, except
  * that C_ANY is a qclass but not a class.  (You can ask for records of class
  * C_ANY, but you can't have any records of that class in the database.)
@@ -372,7 +373,7 @@ const struct res_sym __p_class_syms[] = {
 	{C_IN, 		(char *)0,	(char *)0}
 };
 
-/*
+/*%
  * Names of message sections.
  */
 const struct res_sym __p_default_section_syms[] = {
@@ -409,7 +410,7 @@ const struct res_sym __p_cert_syms[] = {
 	{0,		NULL,		NULL}
 };
 
-/*
+/*%
  * Names of RR types and qtypes.  Types and qtypes are the same, except
  * that T_ANY is a qtype but not a type.  (You can ask for records of type
  * T_ANY, but you can't have any records of that type in the database.)
@@ -467,7 +468,7 @@ const struct res_sym __p_type_syms[] = {
 	{0, 		NULL,		NULL}
 };
 
-/*
+/*%
  * Names of DNS rcodes.
  */
 const struct res_sym __p_rcode_syms[] = {
@@ -500,7 +501,7 @@ sym_ston(const struct res_sym *syms, const char *name, int *success) {
 	}
 	if (success)
 		*success = 0;
-	return (syms->number);		/* The default value. */
+	return (syms->number);		/*%< The default value. */
 }
 
 const char *
@@ -515,7 +516,7 @@ sym_ntos(const struct res_sym *syms, int number, int *success) {
 		}
 	}
 
-	sprintf(unname, "%d", number);		/* XXX nonreentrant */
+	sprintf(unname, "%d", number);		/*%< XXX nonreentrant */
 	if (success)
 		*success = 0;
 	return (unname);
@@ -532,13 +533,13 @@ sym_ntop(const struct res_sym *syms, int number, int *success) {
 			return (syms->humanname);
 		}
 	}
-	sprintf(unname, "%d", number);		/* XXX nonreentrant */
+	sprintf(unname, "%d", number);		/*%< XXX nonreentrant */
 	if (success)
 		*success = 0;
 	return (unname);
 }
 
-/*
+/*%
  * Return a string for the type.
  */
 const char *
@@ -556,7 +557,7 @@ p_type(int type) {
 	return (typebuf);
 }
 
-/*
+/*%
  * Return a string for the type.
  */
 const char *
@@ -574,7 +575,7 @@ p_section(int section, int opcode) {
 	return (sym_ntos(symbols, section, (int *)0));
 }
 
-/*
+/*%
  * Return a mnemonic for class.
  */
 const char *
@@ -592,7 +593,7 @@ p_class(int class) {
 	return (classbuf);
 }
 
-/*
+/*%
  * Return a mnemonic for an option
  */
 const char *
@@ -614,7 +615,7 @@ p_option(u_long option) {
 	case RES_INSECURE2:	return "insecure2";
 	case RES_NOALIASES:	return "noaliases";
 	case RES_USE_INET6:	return "inet6";
-#ifdef RES_USE_EDNS0	/* KAME extension */
+#ifdef RES_USE_EDNS0	/*%< KAME extension */
 	case RES_USE_EDNS0:	return "edns0";
 #endif
 #ifdef RES_USE_DNAME
@@ -635,7 +636,7 @@ p_option(u_long option) {
 	}
 }
 
-/*
+/*%
  * Return a mnemonic for a time to live.
  */
 const char *
@@ -647,7 +648,7 @@ p_time(u_int32_t value) {
 	return (nbuf);
 }
 
-/*
+/*%
  * Return a string for the rcode.
  */
 const char *
@@ -655,7 +656,7 @@ p_rcode(int rcode) {
 	return (sym_ntos(__p_rcode_syms, rcode, (int *)0));
 }
 
-/*
+/*%
  * Return a string for a res_sockaddr_union.
  */
 const char *
@@ -682,7 +683,7 @@ p_sockun(union res_sockaddr_union u, char *buf, size_t size) {
 	return (buf);
 }
 
-/*
+/*%
  * routines to convert between on-the-wire RR format and zone file format.
  * Does not contain conversion to/from decimal degrees; divide or multiply
  * by 60*60*1000 for that.
@@ -691,7 +692,7 @@ p_sockun(union res_sockaddr_union u, char *buf, size_t size) {
 static unsigned int poweroften[10] = {1, 10, 100, 1000, 10000, 100000,
 				      1000000,10000000,100000000,1000000000};
 
-/* takes an XeY precision/size value, returns a string representation. */
+/*% takes an XeY precision/size value, returns a string representation. */
 static const char *
 precsize_ntoa(prec)
 	u_int8_t prec;
@@ -709,7 +710,7 @@ precsize_ntoa(prec)
 	return (retbuf);
 }
 
-/* converts ascii size/precision X * 10**Y(cm) to 0xXY.  moves pointer. */
+/*% converts ascii size/precision X * 10**Y(cm) to 0xXY.  moves pointer.  */
 static u_int8_t
 precsize_aton(const char **strptr) {
 	unsigned int mval = 0, cmval = 0;
@@ -723,7 +724,7 @@ precsize_aton(const char **strptr) {
 	while (isdigit((unsigned char)*cp))
 		mval = mval * 10 + (*cp++ - '0');
 
-	if (*cp == '.') {		/* centimeters */
+	if (*cp == '.') {		/*%< centimeters */
 		cp++;
 		if (isdigit((unsigned char)*cp)) {
 			cmval = (*cp++ - '0') * 10;
@@ -749,7 +750,7 @@ precsize_aton(const char **strptr) {
 	return (retval);
 }
 
-/* converts ascii lat/lon to unsigned encoded 32-bit number.  moves pointer. */
+/*% converts ascii lat/lon to unsigned encoded 32-bit number.  moves pointer. */
 static u_int32_t
 latlon2ul(const char **latlonstrptr, int *which) {
 	const char *cp;
@@ -779,7 +780,7 @@ latlon2ul(const char **latlonstrptr, int *which) {
 	while (isdigit((unsigned char)*cp))
 		secs = secs * 10 + (*cp++ - '0');
 
-	if (*cp == '.') {		/* decimal seconds */
+	if (*cp == '.') {		/*%< decimal seconds */
 		cp++;
 		if (isdigit((unsigned char)*cp)) {
 			secsfrac = (*cp++ - '0') * 100;
@@ -792,7 +793,7 @@ latlon2ul(const char **latlonstrptr, int *which) {
 		}
 	}
 
-	while (!isspace((unsigned char)*cp))	/* if any trailing garbage */
+	while (!isspace((unsigned char)*cp))	/*%< if any trailing garbage */
 		cp++;
 
 	while (isspace((unsigned char)*cp))
@@ -813,30 +814,29 @@ latlon2ul(const char **latlonstrptr, int *which) {
 			- secsfrac;
 		break;
 	default:
-		retval = 0;	/* invalid value -- indicates error */
+		retval = 0;	/*%< invalid value -- indicates error */
 		break;
 	}
 
 	switch (*cp) {
 	case 'N': case 'n':
 	case 'S': case 's':
-		*which = 1;	/* latitude */
+		*which = 1;	/*%< latitude */
 		break;
 	case 'E': case 'e':
 	case 'W': case 'w':
-		*which = 2;	/* longitude */
+		*which = 2;	/*%< longitude */
 		break;
 	default:
-		*which = 0;	/* error */
+		*which = 0;	/*%< error */
 		break;
 	}
 
-	cp++;			/* skip the hemisphere */
-
-	while (!isspace((unsigned char)*cp))	/* if any trailing garbage */
+	cp++;			/*%< skip the hemisphere */
+	while (!isspace((unsigned char)*cp))	/*%< if any trailing garbage */
 		cp++;
 
-	while (isspace((unsigned char)*cp))	/* move to next field */
+	while (isspace((unsigned char)*cp))	/*%< move to next field */
 		cp++;
 
 	*latlonstrptr = cp;
@@ -844,7 +844,8 @@ latlon2ul(const char **latlonstrptr, int *which) {
 	return (retval);
 }
 
-/* converts a zone file representation in a string to an RDATA on-the-wire
+/*%
+ * converts a zone file representation in a string to an RDATA on-the-wire
  * representation. */
 int
 loc_aton(ascii, binary)
@@ -857,9 +858,9 @@ loc_aton(ascii, binary)
 	u_int32_t latit = 0, longit = 0, alt = 0;
 	u_int32_t lltemp1 = 0, lltemp2 = 0;
 	int altmeters = 0, altfrac = 0, altsign = 1;
-	u_int8_t hp = 0x16;	/* default = 1e6 cm = 10000.00m = 10km */
-	u_int8_t vp = 0x13;	/* default = 1e3 cm = 10.00m */
-	u_int8_t siz = 0x12;	/* default = 1e2 cm = 1.00m */
+	u_int8_t hp = 0x16;	/*%< default = 1e6 cm = 10000.00m = 10km */
+	u_int8_t vp = 0x13;	/*%< default = 1e3 cm = 10.00m */
+	u_int8_t siz = 0x12;	/*%< default = 1e2 cm = 1.00m */
 	int which1 = 0, which2 = 0;
 
 	cp = ascii;
@@ -870,18 +871,18 @@ loc_aton(ascii, binary)
 	lltemp2 = latlon2ul(&cp, &which2);
 
 	switch (which1 + which2) {
-	case 3:			/* 1 + 2, the only valid combination */
-		if ((which1 == 1) && (which2 == 2)) { /* normal case */
+	case 3:			/*%< 1 + 2, the only valid combination */
+		if ((which1 == 1) && (which2 == 2)) { /*%< normal case */
 			latit = lltemp1;
 			longit = lltemp2;
-		} else if ((which1 == 2) && (which2 == 1)) { /* reversed */
+		} else if ((which1 == 2) && (which2 == 1)) { /*%< reversed */
 			longit = lltemp1;
 			latit = lltemp2;
-		} else {	/* some kind of brokenness */
+		} else {	/*%< some kind of brokenness */
 			return (0);
 		}
 		break;
-	default:		/* we didn't get one of each */
+	default:		/*%< we didn't get one of each */
 		return (0);
 	}
 
@@ -897,7 +898,7 @@ loc_aton(ascii, binary)
 	while (isdigit((unsigned char)*cp))
 		altmeters = altmeters * 10 + (*cp++ - '0');
 
-	if (*cp == '.') {		/* decimal meters */
+	if (*cp == '.') {		/*%< decimal meters */
 		cp++;
 		if (isdigit((unsigned char)*cp)) {
 			altfrac = (*cp++ - '0') * 10;
@@ -909,7 +910,7 @@ loc_aton(ascii, binary)
 
 	alt = (10000000 + (altsign * (altmeters * 100 + altfrac)));
 
-	while (!isspace((unsigned char)*cp) && (cp < maxcp)) /* if trailing garbage or m */
+	while (!isspace((unsigned char)*cp) && (cp < maxcp)) /*%< if trailing garbage or m */
 		cp++;
 
 	while (isspace((unsigned char)*cp) && (cp < maxcp))
@@ -920,7 +921,7 @@ loc_aton(ascii, binary)
 
 	siz = precsize_aton(&cp);
 	
-	while (!isspace((unsigned char)*cp) && (cp < maxcp))	/* if trailing garbage or m */
+	while (!isspace((unsigned char)*cp) && (cp < maxcp))	/*%< if trailing garbage or m */
 		cp++;
 
 	while (isspace((unsigned char)*cp) && (cp < maxcp))
@@ -931,7 +932,7 @@ loc_aton(ascii, binary)
 
 	hp = precsize_aton(&cp);
 
-	while (!isspace((unsigned char)*cp) && (cp < maxcp))	/* if trailing garbage or m */
+	while (!isspace((unsigned char)*cp) && (cp < maxcp))	/*%< if trailing garbage or m */
 		cp++;
 
 	while (isspace((unsigned char)*cp) && (cp < maxcp))
@@ -945,7 +946,7 @@ loc_aton(ascii, binary)
  defaults:
 
 	bcp = binary;
-	*bcp++ = (u_int8_t) 0;	/* version byte */
+	*bcp++ = (u_int8_t) 0;	/*%< version byte */
 	*bcp++ = siz;
 	*bcp++ = hp;
 	*bcp++ = vp;
@@ -953,10 +954,10 @@ loc_aton(ascii, binary)
 	PUTLONG(longit,bcp);
 	PUTLONG(alt,bcp);
     
-	return (16);		/* size of RR in octets */
+	return (16);		/*%< size of RR in octets */
 }
 
-/* takes an on-the-wire LOC RR and formats it in a human readable format. */
+/*% takes an on-the-wire LOC RR and formats it in a human readable format. */
 const char *
 loc_ntoa(binary, ascii)
 	const u_char *binary;
@@ -1003,7 +1004,7 @@ loc_ntoa(binary, ascii)
 	longval = (templ - ((unsigned)1<<31));
 
 	GETLONG(templ, cp);
-	if (templ < referencealt) { /* below WGS 84 spheroid */
+	if (templ < referencealt) { /*%< below WGS 84 spheroid */
 		altval = referencealt - templ;
 		altsign = "-";
 	} else {
@@ -1066,7 +1067,7 @@ loc_ntoa(binary, ascii)
 }
 
 
-/* Return the number of DNS hierarchy levels in the name. */
+/*% Return the number of DNS hierarchy levels in the name. */
 int
 dn_count_labels(const char *name) {
 	int i, len, count;
@@ -1091,8 +1092,7 @@ dn_count_labels(const char *name) {
 	return (count);
 }
 
-
-/* 
+/*%
  * Make dates expressed in seconds-since-Jan-1-1970 easy to read.  
  * SIG records are required to be printed like this, by the Secure DNS RFC.
  */
@@ -1161,3 +1161,5 @@ res_nametotype(const char *buf, int *successp) {
 		*successp = success;
 	return (result);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_debug.h b/contrib/bind9/lib/bind/resolv/res_debug.h
index 2a9c0ae..c28171d 100644
--- a/contrib/bind9/lib/bind/resolv/res_debug.h
+++ b/contrib/bind9/lib/bind/resolv/res_debug.h
@@ -32,3 +32,4 @@
 #endif
 
 #endif /* _RES_DEBUG_H_ */ 
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_findzonecut.c b/contrib/bind9/lib/bind/resolv/res_findzonecut.c
index 804beb6..207d66c 100644
--- a/contrib/bind9/lib/bind/resolv/res_findzonecut.c
+++ b/contrib/bind9/lib/bind/resolv/res_findzonecut.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: res_findzonecut.c,v 1.2.2.3.4.4 2005/10/11 00:48:16 marka Exp $";
+static const char rcsid[] = "$Id: res_findzonecut.c,v 1.7.18.3 2005/10/11 00:25:11 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -96,55 +96,56 @@ static void	res_dprintf(const char *, ...) ISC_FORMAT_PRINTF(1, 2);
 
 /* Public. */
 
-/*
- * int
- * res_findzonecut(res, dname, class, zname, zsize, addrs, naddrs)
+/*%
  *	find enclosing zone for a <dname,class>, and some server addresses
+ *
  * parameters:
- *	res - resolver context to work within (is modified)
- *	dname - domain name whose enclosing zone is desired
- *	class - class of dname (and its enclosing zone)
- *	zname - found zone name
- *	zsize - allocated size of zname
- *	addrs - found server addresses
- *	naddrs - max number of addrs
+ *\li	res - resolver context to work within (is modified)
+ *\li	dname - domain name whose enclosing zone is desired
+ *\li	class - class of dname (and its enclosing zone)
+ *\li	zname - found zone name
+ *\li	zsize - allocated size of zname
+ *\li	addrs - found server addresses
+ *\li	naddrs - max number of addrs
+ *
  * return values:
- *	< 0 - an error occurred (check errno)
- *	= 0 - zname is now valid, but addrs[] wasn't changed
- *	> 0 - zname is now valid, and return value is number of addrs[] found
+ *\li	< 0 - an error occurred (check errno)
+ *\li	= 0 - zname is now valid, but addrs[] wasn't changed
+ *\li	> 0 - zname is now valid, and return value is number of addrs[] found
+ *
  * notes:
- *	this function calls res_nsend() which means it depends on correctly
+ *\li	this function calls res_nsend() which means it depends on correctly
  *	functioning recursive nameservers (usually defined in /etc/resolv.conf
  *	or its local equivilent).
  *
- *	we start by asking for an SOA<dname,class>.  if we get one as an
+ *\li	we start by asking for an SOA<dname,class>.  if we get one as an
  *	answer, that just means <dname,class> is a zone top, which is fine.
  *	more than likely we'll be told to go pound sand, in the form of a
  *	negative answer.
  *
- *	note that we are not prepared to deal with referrals since that would
+ *\li	note that we are not prepared to deal with referrals since that would
  *	only come from authority servers and our correctly functioning local
  *	recursive server would have followed the referral and got us something
  *	more definite.
  *
- *	if the authority section contains an SOA, this SOA should also be the
+ *\li	if the authority section contains an SOA, this SOA should also be the
  *	closest enclosing zone, since any intermediary zone cuts would've been
  *	returned as referrals and dealt with by our correctly functioning local
  *	recursive name server.  but an SOA in the authority section should NOT
  *	match our dname (since that would have been returned in the answer
  *	section).  an authority section SOA has to be "above" our dname.
  *
- *	however, since authority section SOA's were once optional, it's
+ *\li	however, since authority section SOA's were once optional, it's
  *	possible that we'll have to go hunting for the enclosing SOA by
  *	ripping labels off the front of our dname -- this is known as "doing
  *	it the hard way."
  *
- *	ultimately we want some server addresses, which are ideally the ones
+ *\li	ultimately we want some server addresses, which are ideally the ones
  *	pertaining to the SOA.MNAME, but only if there is a matching NS RR.
  *	so the second phase (after we find an SOA) is to go looking for the
  *	NS RRset for that SOA's zone.
  *
- *	no answer section processed by this code is allowed to contain CNAME
+ *\li	no answer section processed by this code is allowed to contain CNAME
  *	or DNAME RR's.  for the SOA query this means we strip a label and
  *	keep going.  for the NS and A queries this means we just give up.
  */
@@ -717,3 +718,5 @@ res_dprintf(const char *fmt, ...) {
 	fputc('\n', stderr);
 	va_end(ap);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_init.c b/contrib/bind9/lib/bind/resolv/res_init.c
index fd82e872..013a3ca 100644
--- a/contrib/bind9/lib/bind/resolv/res_init.c
+++ b/contrib/bind9/lib/bind/resolv/res_init.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_init.c	8.1 (Berkeley) 6/7/93";
-static const char rcsid[] = "$Id: res_init.c,v 1.9.2.5.4.6 2006/08/30 23:23:01 marka Exp $";
+static const char rcsid[] = "$Id: res_init.c,v 1.16.18.5 2006/08/30 23:23:13 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -98,7 +98,7 @@ static const char rcsid[] = "$Id: res_init.c,v 1.9.2.5.4.6 2006/08/30 23:23:01 m
 
 #include "res_private.h"
 
-/* Options.  Should all be left alone. */
+/*% Options.  Should all be left alone. */
 #define RESOLVSORT
 #define DEBUG
 
@@ -114,7 +114,7 @@ static const char sort_mask[] = "/&";
 static u_int32_t net_mask __P((struct in_addr));
 #endif
 
-#if !defined(isascii)	/* XXX - could be a function */
+#if !defined(isascii)	/*%< XXX - could be a function */
 # define isascii(c) (!(c & 0200))
 #endif
 
@@ -122,7 +122,7 @@ static u_int32_t net_mask __P((struct in_addr));
  * Resolver state default settings.
  */
 
-/*
+/*%
  * Set up default settings.  If the configuration file exist, the values
  * there will have precedence.  Otherwise, the server address is set to
  * INADDR_ANY and the default domain name comes from the gethostname().
@@ -150,14 +150,14 @@ res_ninit(res_state statp) {
 	return (__res_vinit(statp, 0));
 }
 
-/* This function has to be reachable by res_data.c but not publically. */
+/*% This function has to be reachable by res_data.c but not publically. */
 int
 __res_vinit(res_state statp, int preinit) {
 	register FILE *fp;
 	register char *cp, **pp;
 	register int n;
 	char buf[BUFSIZ];
-	int nserv = 0;    /* number of nameserver records read from file */
+	int nserv = 0;    /*%< number of nameserver records read from file */
 	int haveenv = 0;
 	int havesearch = 0;
 #ifdef RESOLVSORT
@@ -262,7 +262,7 @@ __res_vinit(res_state statp, int preinit) {
 		pp = statp->dnsrch;
 		*pp++ = cp;
 		for (n = 0; *cp && pp < statp->dnsrch + MAXDNSRCH; cp++) {
-			if (*cp == '\n')	/* silly backwards compat */
+			if (*cp == '\n')	/*%< silly backwards compat */
 				break;
 			else if (*cp == ' ' || *cp == '\t') {
 				*cp = 0;
@@ -294,7 +294,7 @@ __res_vinit(res_state statp, int preinit) {
 			continue;
 		/* read default domain name */
 		if (MATCH(buf, "domain")) {
-		    if (haveenv)	/* skip if have from environ */
+		    if (haveenv)	/*%< skip if have from environ */
 			    continue;
 		    cp = buf + sizeof("domain") - 1;
 		    while (*cp == ' ' || *cp == '\t')
@@ -310,7 +310,7 @@ __res_vinit(res_state statp, int preinit) {
 		}
 		/* set search list */
 		if (MATCH(buf, "search")) {
-		    if (haveenv)	/* skip if have from environ */
+		    if (haveenv)	/*%< skip if have from environ */
 			    continue;
 		    cp = buf + sizeof("search") - 1;
 		    while (*cp == ' ' || *cp == '\t')
@@ -464,7 +464,7 @@ __res_vinit(res_state statp, int preinit) {
 		while (pp < statp->dnsrch + MAXDFLSRCH) {
 			if (dots < LOCALDOMAINPARTS)
 				break;
-			cp = strchr(cp, '.') + 1;    /* we know there is one */
+			cp = strchr(cp, '.') + 1;    /*%< we know there is one */
 			*pp++ = cp;
 			dots--;
 		}
@@ -626,7 +626,7 @@ res_setoptions(res_state statp, const char *options, const char *source)
 #ifdef RESOLVSORT
 /* XXX - should really support CIDR which means explicit masks always. */
 static u_int32_t
-net_mask(in)		/* XXX - should really use system's version of this */
+net_mask(in)		/*!< XXX - should really use system's version of this  */
 	struct in_addr in;
 {
 	register u_int32_t i = ntohl(in.s_addr);
@@ -647,7 +647,7 @@ res_randomid(void) {
 	return (0xffff & (now.tv_sec ^ now.tv_usec ^ getpid()));
 }
 
-/*
+/*%
  * This routine is for closing the socket if a virtual circuit is used and
  * the program wants to close it.  This provides support for endhostent()
  * which expects to close the socket.
@@ -790,3 +790,5 @@ res_getservers(res_state statp, union res_sockaddr_union *set, int cnt) {
 	}
 	return (statp->nscount);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_mkquery.c b/contrib/bind9/lib/bind/resolv/res_mkquery.c
index 89000ed..50e4a9e 100644
--- a/contrib/bind9/lib/bind/resolv/res_mkquery.c
+++ b/contrib/bind9/lib/bind/resolv/res_mkquery.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_mkquery.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_mkquery.c,v 1.1.2.2.4.2 2004/03/16 12:34:18 marka Exp $";
+static const char rcsid[] = "$Id: res_mkquery.c,v 1.5.18.1 2005/04/27 05:01:11 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -89,20 +89,20 @@ static const char rcsid[] = "$Id: res_mkquery.c,v 1.1.2.2.4.2 2004/03/16 12:34:1
 
 extern const char *_res_opcodes[];
 
-/*
+/*%
  * Form all types of queries.
  * Returns the size of the result or -1.
  */
 int
 res_nmkquery(res_state statp,
-	     int op,			/* opcode of query */
-	     const char *dname,		/* domain name */
-	     int class, int type,	/* class and type of query */
-	     const u_char *data,	/* resource record data */
-	     int datalen,		/* length of data */
-	     const u_char *newrr_in,	/* new rr for modify or append */
-	     u_char *buf,		/* buffer to put query */
-	     int buflen)		/* size of buffer */
+	     int op,			/*!< opcode of query  */
+	     const char *dname,		/*!< domain name  */
+	     int class, int type,	/*!< class and type of query  */
+	     const u_char *data,	/*!< resource record data  */
+	     int datalen,		/*!< length of data  */
+	     const u_char *newrr_in,	/*!< new rr for modify or append  */
+	     u_char *buf,		/*!< buffer to put query  */
+	     int buflen)		/*!< size of buffer  */
 {
 	register HEADER *hp;
 	register u_char *cp, *ep;
@@ -179,7 +179,7 @@ res_nmkquery(res_state statp,
 		 */
 		if (ep - cp < 1 + RRFIXEDSZ + datalen)
 			return (-1);
-		*cp++ = '\0';	/* no domain name */
+		*cp++ = '\0';	/*%< no domain name */
 		ns_put16(type, cp);
 		cp += INT16SZ;
 		ns_put16(class, cp);
@@ -209,10 +209,10 @@ res_nmkquery(res_state statp,
 
 int
 res_nopt(res_state statp,
-	 int n0,		/* current offset in buffer */
-	 u_char *buf,		/* buffer to put query */
-	 int buflen,		/* size of buffer */
-	 int anslen)		/* UDP answer buffer size */
+	 int n0,		/*%< current offset in buffer */
+	 u_char *buf,		/*%< buffer to put query */
+	 int buflen,		/*%< size of buffer */
+	 int anslen)		/*%< UDP answer buffer size */
 {
 	register HEADER *hp;
 	register u_char *cp, *ep;
@@ -230,14 +230,13 @@ res_nopt(res_state statp,
 	if ((ep - cp) < 1 + RRFIXEDSZ)
 		return (-1);
 
-	*cp++ = 0;	/* "." */
-
-	ns_put16(T_OPT, cp);	/* TYPE */
+	*cp++ = 0;	/*%< "." */
+	ns_put16(T_OPT, cp);	/*%< TYPE */
 	cp += INT16SZ;
-	ns_put16(anslen & 0xffff, cp);	/* CLASS = UDP payload size */
+	ns_put16(anslen & 0xffff, cp);	/*%< CLASS = UDP payload size */
 	cp += INT16SZ;
-	*cp++ = NOERROR;	/* extended RCODE */
-	*cp++ = 0;		/* EDNS version */
+	*cp++ = NOERROR;	/*%< extended RCODE */
+	*cp++ = 0;		/*%< EDNS version */
 	if (statp->options & RES_USE_DNSSEC) {
 #ifdef DEBUG
 		if (statp->options & RES_DEBUG)
@@ -247,10 +246,12 @@ res_nopt(res_state statp,
 	}
 	ns_put16(flags, cp);
 	cp += INT16SZ;
-	ns_put16(0, cp);	/* RDLEN */
+	ns_put16(0, cp);	/*%< RDLEN */
 	cp += INT16SZ;
 	hp->arcount = htons(ntohs(hp->arcount) + 1);
 
 	return (cp - buf);
 }
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_mkupdate.c b/contrib/bind9/lib/bind/resolv/res_mkupdate.c
index 01078f1..4299275 100644
--- a/contrib/bind9/lib/bind/resolv/res_mkupdate.c
+++ b/contrib/bind9/lib/bind/resolv/res_mkupdate.c
@@ -15,13 +15,14 @@
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
+/*! \file
+ * \brief
  * Based on the Dynamic DNS reference implementation by Viraj Bais
- * <viraj_bais@ccm.fm.intel.com>
+ * &lt;viraj_bais@ccm.fm.intel.com>
  */
 
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: res_mkupdate.c,v 1.1.2.1.4.5 2005/10/14 05:43:47 marka Exp $";
+static const char rcsid[] = "$Id: res_mkupdate.c,v 1.4.18.4 2005/10/14 05:44:12 marka Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -62,17 +63,19 @@ static int getstr_str(char *, int, u_char **, u_char *);
 int res_protocolnumber(const char *);
 int res_servicenumber(const char *);
 
-/*
+/*%
  * Form update packets.
  * Returns the size of the resulting packet if no error
+ *
  * On error,
- *	returns -1 if error in reading a word/number in rdata
+ *	returns 
+ *\li              -1 if error in reading a word/number in rdata
  *		   portion for update packets
- *		-2 if length of buffer passed is insufficient
- *		-3 if zone section is not the first section in
+ *\li		-2 if length of buffer passed is insufficient
+ *\li		-3 if zone section is not the first section in
  *		   the linked list, or section order has a problem
- *		-4 on a number overflow
- *		-5 unknown operation or no records
+ *\li		-4 on a number overflow
+ *\li		-5 unknown operation or no records
  */
 int
 res_nmkupdate(res_state statp, ns_updrec *rrecp_in, u_char *buf, int buflen) {
@@ -189,7 +192,7 @@ res_nmkupdate(res_state statp, ns_updrec *rrecp_in, u_char *buf, int buflen) {
 		}
 		ShrinkBuffer(INT32SZ + INT16SZ);
 		PUTLONG(rttl, cp);
-		sp2 = cp;  /* save pointer to length byte */
+		sp2 = cp;  /*%< save pointer to length byte */
 		cp += INT16SZ;
 		if (rrecp->r_size == 0) {
 			if (section == S_UPDATE && rclass != C_ANY)
@@ -395,7 +398,7 @@ res_nmkupdate(res_state statp, ns_updrec *rrecp_in, u_char *buf, int buflen) {
 			}
 			break;
 		case T_X25:
-			/* RFC 1183 */
+			/* RFC1183 */
 			if ((n = getstr_str(buf2, sizeof buf2, &startp,
 					 endp)) < 0)
 				return (-1);
@@ -407,7 +410,7 @@ res_nmkupdate(res_state statp, ns_updrec *rrecp_in, u_char *buf, int buflen) {
 			cp += n;
 			break;
 		case T_ISDN:
-			/* RFC 1183 */
+			/* RFC1183 */
 			if ((n = getstr_str(buf2, sizeof buf2, &startp,
 					 endp)) < 0)
 				return (-1);
@@ -708,7 +711,7 @@ res_nmkupdate(res_state statp, ns_updrec *rrecp_in, u_char *buf, int buflen) {
 	return (cp - buf);
 }
 
-/*
+/*%
  * Get a whitespace delimited word from a string (not file)
  * into buf. modify the start pointer to point after the
  * word in the string.
@@ -721,9 +724,9 @@ getword_str(char *buf, int size, u_char **startpp, u_char *endp) {
         for (cp = buf; *startpp <= endp; ) {
                 c = **startpp;
                 if (isspace(c) || c == '\0') {
-                        if (cp != buf) /* trailing whitespace */
+                        if (cp != buf) /*%< trailing whitespace */
                                 break;
-                        else { /* leading whitespace */
+                        else { /*%< leading whitespace */
                                 (*startpp)++;
                                 continue;
                         }
@@ -737,9 +740,9 @@ getword_str(char *buf, int size, u_char **startpp, u_char *endp) {
         return (cp != buf);
 }
 
-/*
+/*%
  * get a white spae delimited string from memory.  Process quoted strings
- * and \DDD escapes.  Return length or -1 on error.  Returned string may
+ * and \\DDD escapes.  Return length or -1 on error.  Returned string may
  * contain nulls.
  */
 static char digits[] = "0123456789";
@@ -816,7 +819,8 @@ getstr_str(char *buf, int size, u_char **startpp, u_char *endp) {
 	*cp = '\0';
 	return ((cp == buf)?  (seen_quote? 0: -1): (cp - buf));
 }
-/*
+
+/*%
  * Get a whitespace delimited base 16 number from a string (not file) into buf
  * update the start pointer to point after the number in the string.
  */
@@ -832,9 +836,9 @@ gethexnum_str(u_char **startpp, u_char *endp) {
         for (n = 0; *startpp <= endp; ) {
                 c = **startpp;
                 if (isspace(c) || c == '\0') {
-                        if (seendigit) /* trailing whitespace */
+                        if (seendigit) /*%< trailing whitespace */
                                 break;
-                        else { /* leading whitespace */
+                        else { /*%< leading whitespace */
                                 (*startpp)++;
                                 continue;
                         }
@@ -864,7 +868,7 @@ gethexnum_str(u_char **startpp, u_char *endp) {
         return (n + m);
 }
 
-/*
+/*%
  * Get a whitespace delimited base 10 number from a string (not file) into buf
  * update the start pointer to point after the number in the string.
  */
@@ -877,9 +881,9 @@ getnum_str(u_char **startpp, u_char *endp) {
         for (n = 0; *startpp <= endp; ) {
                 c = **startpp;
                 if (isspace(c) || c == '\0') {
-                        if (seendigit) /* trailing whitespace */
+                        if (seendigit) /*%< trailing whitespace */
                                 break;
-                        else { /* leading whitespace */
+                        else { /*%< leading whitespace */
                                 (*startpp)++;
                                 continue;
                         }
@@ -906,7 +910,7 @@ getnum_str(u_char **startpp, u_char *endp) {
         return (n + m);
 }
 
-/*
+/*%
  * Allocate a resource record buffer & save rr info.
  */
 ns_updrec *
@@ -928,7 +932,7 @@ res_mkupdrec(int section, const char *dname,
 	return (rrecp);
 }
 
-/*
+/*%
  * Free a resource record buffer created by res_mkupdrec.
  */
 void
@@ -970,7 +974,7 @@ res_buildservicelist() {
 			free(slp);
 			break;
 		}
-		slp->port = ntohs((u_int16_t)sp->s_port);  /* host byt order */
+		slp->port = ntohs((u_int16_t)sp->s_port);  /*%< host byt order */
 		slp->next = servicelist;
 		slp->prev = NULL;
 		if (servicelist)
@@ -1012,7 +1016,7 @@ res_buildprotolist(void) {
 			free(slp);
 			break;
 		}
-		slp->port = pp->p_proto;	/* host byte order */
+		slp->port = pp->p_proto;	/*%< host byte order */
 		slp->next = protolist;
 		slp->prev = NULL;
 		if (protolist)
@@ -1049,14 +1053,14 @@ findservice(const char *s, struct valuelist **list) {
 				lp->next = *list;
 				*list = lp;
 			}
-			return (lp->port);	/* host byte order */
+			return (lp->port);	/*%< host byte order */
 		}
 	if (sscanf(s, "%d", &n) != 1 || n <= 0)
 		n = -1;
 	return (n);
 }
 
-/*
+/*%
  * Convert service name or (ascii) number to int.
  */
 int
@@ -1066,7 +1070,7 @@ res_servicenumber(const char *p) {
 	return (findservice(p, &servicelist));
 }
 
-/*
+/*%
  * Convert protocol name or (ascii) number to int.
  */
 int
@@ -1077,14 +1081,14 @@ res_protocolnumber(const char *p) {
 }
 
 static struct servent *
-cgetservbyport(u_int16_t port, const char *proto) {	/* Host byte order. */
+cgetservbyport(u_int16_t port, const char *proto) {	/*%< Host byte order. */
 	struct valuelist **list = &servicelist;
 	struct valuelist *lp = *list;
 	static struct servent serv;
 
 	port = ntohs(port);
 	for (; lp != NULL; lp = lp->next) {
-		if (port != (u_int16_t)lp->port)	/* Host byte order. */
+		if (port != (u_int16_t)lp->port)	/*%< Host byte order. */
 			continue;
 		if (strcasecmp(lp->proto, proto) == 0) {
 			if (lp != *list) {
@@ -1105,13 +1109,13 @@ cgetservbyport(u_int16_t port, const char *proto) {	/* Host byte order. */
 }
 
 static struct protoent *
-cgetprotobynumber(int proto) {				/* Host byte order. */
+cgetprotobynumber(int proto) {				/*%< Host byte order. */
 	struct valuelist **list = &protolist;
 	struct valuelist *lp = *list;
 	static struct protoent prot;
 
 	for (; lp != NULL; lp = lp->next)
-		if (lp->port == proto) {		/* Host byte order. */
+		if (lp->port == proto) {		/*%< Host byte order. */
 			if (lp != *list) {
 				lp->prev->next = lp->next;
 				if (lp->next)
@@ -1121,7 +1125,7 @@ cgetprotobynumber(int proto) {				/* Host byte order. */
 				*list = lp;
 			}
 			prot.p_name = lp->name;
-			prot.p_proto = lp->port;	/* Host byte order. */
+			prot.p_proto = lp->port;	/*%< Host byte order. */
 			return (&prot);
 		}
 	return (0);
@@ -1143,7 +1147,7 @@ res_protocolname(int num) {
 }
 
 const char *
-res_servicename(u_int16_t port, const char *proto) {	/* Host byte order. */
+res_servicename(u_int16_t port, const char *proto) {	/*%< Host byte order. */
 	static char number[8];
 	struct servent *ss;
 
diff --git a/contrib/bind9/lib/bind/resolv/res_mkupdate.h b/contrib/bind9/lib/bind/resolv/res_mkupdate.h
index a8f1e7c..96c452d 100644
--- a/contrib/bind9/lib/bind/resolv/res_mkupdate.h
+++ b/contrib/bind9/lib/bind/resolv/res_mkupdate.h
@@ -22,3 +22,4 @@ __BEGIN_DECLS
 __END_DECLS
 
 #endif /* _RES_MKUPDATE_H_ */ 
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_private.h b/contrib/bind9/lib/bind/resolv/res_private.h
index d7b66cd..4e98157 100644
--- a/contrib/bind9/lib/bind/resolv/res_private.h
+++ b/contrib/bind9/lib/bind/resolv/res_private.h
@@ -18,3 +18,5 @@ extern int
 res_ourserver_p(const res_state statp, const struct sockaddr *sa);
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_query.c b/contrib/bind9/lib/bind/resolv/res_query.c
index 5156ce8..c160e93 100644
--- a/contrib/bind9/lib/bind/resolv/res_query.c
+++ b/contrib/bind9/lib/bind/resolv/res_query.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_query.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_query.c,v 1.2.2.3.4.2 2004/03/16 12:34:19 marka Exp $";
+static const char rcsid[] = "$Id: res_query.c,v 1.7.18.1 2005/04/27 05:01:11 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -97,7 +97,7 @@ static const char rcsid[] = "$Id: res_query.c,v 1.2.2.3.4.2 2004/03/16 12:34:19
 #define MAXPACKET	1024
 #endif
 
-/*
+/*%
  * Formulate a normal query, send, and await answer.
  * Returned answer is placed in supplied buffer "answer".
  * Perform preliminary check of answer, returning success only
@@ -109,10 +109,10 @@ static const char rcsid[] = "$Id: res_query.c,v 1.2.2.3.4.2 2004/03/16 12:34:19
  */
 int
 res_nquery(res_state statp,
-	   const char *name,	/* domain name */
-	   int class, int type,	/* class and type of query */
-	   u_char *answer,	/* buffer to put answer */
-	   int anslen)		/* size of answer buffer */
+	   const char *name,	/*%< domain name */
+	   int class, int type,	/*%< class and type of query */
+	   u_char *answer,	/*%< buffer to put answer */
+	   int anslen)		/*%< size of answer buffer */
 {
 	u_char buf[MAXPACKET];
 	HEADER *hp = (HEADER *) answer;
@@ -122,8 +122,7 @@ res_nquery(res_state statp,
 	oflags = statp->_flags;
 
 again:
-	hp->rcode = NOERROR;	/* default */
-
+	hp->rcode = NOERROR;	/*%< default */
 #ifdef DEBUG
 	if (statp->options & RES_DEBUG)
 		printf(";; res_query(%s, %d, %d)\n", name, class, type);
@@ -195,7 +194,7 @@ again:
 	return (n);
 }
 
-/*
+/*%
  * Formulate a normal query, send, and retrieve answer in supplied buffer.
  * Return the size of the response on success, -1 on error.
  * If enabled, implement search rules until answer or unrecoverable failure
@@ -203,10 +202,10 @@ again:
  */
 int
 res_nsearch(res_state statp,
-	    const char *name,	/* domain name */
-	    int class, int type,	/* class and type of query */
-	    u_char *answer,	/* buffer to put answer */
-	    int anslen)		/* size of answer */
+	    const char *name,	/*%< domain name */
+	    int class, int type,	/*%< class and type of query */
+	    u_char *answer,	/*%< buffer to put answer */
+	    int anslen)		/*%< size of answer */
 {
 	const char *cp, * const *domain;
 	HEADER *hp = (HEADER *) answer;
@@ -218,8 +217,7 @@ res_nsearch(res_state statp,
 	int searched = 0;
 
 	errno = 0;
-	RES_SET_H_ERRNO(statp, HOST_NOT_FOUND);  /* True if we never query. */
-
+	RES_SET_H_ERRNO(statp, HOST_NOT_FOUND);  /*%< True if we never query. */
 	dots = 0;
 	for (cp = name; *cp != '\0'; cp++)
 		dots += (*cp == '.');
@@ -344,7 +342,7 @@ res_nsearch(res_state statp,
 	return (-1);
 }
 
-/*
+/*%
  * Perform a call on res_query on the concatenation of name and domain,
  * removing a trailing dot from name if domain is NULL.
  */
@@ -352,9 +350,9 @@ int
 res_nquerydomain(res_state statp,
 	    const char *name,
 	    const char *domain,
-	    int class, int type,	/* class and type of query */
-	    u_char *answer,		/* buffer to put answer */
-	    int anslen)		/* size of answer */
+	    int class, int type,	/*%< class and type of query */
+	    u_char *answer,		/*%< buffer to put answer */
+	    int anslen)		/*%< size of answer */
 {
 	char nbuf[MAXDNAME];
 	const char *longname = nbuf;
@@ -430,3 +428,5 @@ res_hostalias(const res_state statp, const char *name, char *dst, size_t siz) {
 	fclose(fp);
 	return (NULL);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_send.c b/contrib/bind9/lib/bind/resolv/res_send.c
index c47dd49..39dc998 100644
--- a/contrib/bind9/lib/bind/resolv/res_send.c
+++ b/contrib/bind9/lib/bind/resolv/res_send.c
@@ -70,10 +70,11 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_send.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_send.c,v 1.5.2.2.4.9 2006/10/16 23:00:50 marka Exp $";
+static const char rcsid[] = "$Id: res_send.c,v 1.9.18.8 2006/10/16 23:00:58 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
-/*
+/*! \file
+ * \brief
  * Send query to name server and wait for reply.
  */
 
@@ -147,14 +148,15 @@ static const int niflags = NI_NUMERICHOST | NI_NUMERICSERV;
 
 /* Public. */
 
-/* int
- * res_isourserver(ina)
+/*%
  *	looks up "ina" in _res.ns_addr_list[]
+ *
  * returns:
- *	0  : not found
- *	>0 : found
+ *\li	0  : not found
+ *\li	>0 : found
+ *
  * author:
- *	paul vixie, 29may94
+ *\li	paul vixie, 29may94
  */
 int
 res_ourserver_p(const res_state statp, const struct sockaddr *sa) {
@@ -197,17 +199,19 @@ res_ourserver_p(const res_state statp, const struct sockaddr *sa) {
 	return (0);
 }
 
-/* int
- * res_nameinquery(name, type, class, buf, eom)
+/*%
  *	look for (name,type,class) in the query section of packet (buf,eom)
+ *
  * requires:
- *	buf + HFIXEDSZ <= eom
+ *\li	buf + HFIXEDSZ <= eom
+ *
  * returns:
- *	-1 : format error
- *	0  : not found
- *	>0 : found
+ *\li	-1 : format error
+ *\li	0  : not found
+ *\li	>0 : found
+ *
  * author:
- *	paul vixie, 29may94
+ *\li	paul vixie, 29may94
  */
 int
 res_nameinquery(const char *name, int type, int class,
@@ -235,16 +239,17 @@ res_nameinquery(const char *name, int type, int class,
 	return (0);
 }
 
-/* int
- * res_queriesmatch(buf1, eom1, buf2, eom2)
+/*%
  *	is there a 1:1 mapping of (name,type,class)
  *	in (buf1,eom1) and (buf2,eom2)?
+ *
  * returns:
- *	-1 : format error
- *	0  : not a 1:1 mapping
- *	>0 : is a 1:1 mapping
+ *\li	-1 : format error
+ *\li	0  : not a 1:1 mapping
+ *\li	>0 : is a 1:1 mapping
+ *
  * author:
- *	paul vixie, 29may94
+ *\li	paul vixie, 29may94
  */
 int
 res_queriesmatch(const u_char *buf1, const u_char *eom1,
@@ -524,9 +529,9 @@ res_nsend(res_state statp,
 	res_nclose(statp);
 	if (!v_circuit) {
 		if (!gotsomewhere)
-			errno = ECONNREFUSED;	/* no nameservers found */
+			errno = ECONNREFUSED;	/*%< no nameservers found */
 		else
-			errno = ETIMEDOUT;	/* no answer obtained */
+			errno = ETIMEDOUT;	/*%< no answer obtained */
 	} else
 		errno = terrno;
 	return (-1);
@@ -553,10 +558,10 @@ get_salen(sa)
 	else if (sa->sa_family == AF_INET6)
 		return (sizeof(struct sockaddr_in6));
 	else
-		return (0);	/* unknown, die on connect */
+		return (0);	/*%< unknown, die on connect */
 }
 
-/*
+/*%
  * pick appropriate nsaddr_list for use.  see res_init() for initialization.
  */
 static struct sockaddr *
diff --git a/contrib/bind9/lib/bind/resolv/res_sendsigned.c b/contrib/bind9/lib/bind/resolv/res_sendsigned.c
index 93ad5c9..63ae07c 100644
--- a/contrib/bind9/lib/bind/resolv/res_sendsigned.c
+++ b/contrib/bind9/lib/bind/resolv/res_sendsigned.c
@@ -24,7 +24,7 @@
 #include "res_debug.h"
 
 
-/* res_nsendsigned */
+/*% res_nsendsigned */
 int
 res_nsendsigned(res_state statp, const u_char *msg, int msglen,
 		ns_tsig_key *key, u_char *answer, int anslen)
@@ -166,3 +166,5 @@ retry:
 	dst_free_key(dstkey);
 	return (len);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/bind/resolv/res_update.c b/contrib/bind9/lib/bind/resolv/res_update.c
index 8783d8a..483e19d 100644
--- a/contrib/bind9/lib/bind/resolv/res_update.c
+++ b/contrib/bind9/lib/bind/resolv/res_update.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: res_update.c,v 1.6.2.4.4.2 2004/03/16 12:34:20 marka Exp $";
+static const char rcsid[] = "$Id: res_update.c,v 1.12.18.1 2005/04/27 05:01:12 sra Exp $";
 #endif /* not lint */
 
 /*
@@ -19,9 +19,10 @@ static const char rcsid[] = "$Id: res_update.c,v 1.6.2.4.4.2 2004/03/16 12:34:20
  * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
+/*! \file
+ * \brief
  * Based on the Dynamic DNS reference implementation by Viraj Bais
- * <viraj_bais@ccm.fm.intel.com>
+ * &lt;viraj_bais@ccm.fm.intel.com>
  */
 
 #include "port_before.h"
@@ -49,7 +50,7 @@ static const char rcsid[] = "$Id: res_update.c,v 1.6.2.4.4.2 2004/03/16 12:34:20
 #include "port_after.h"
 #include "res_private.h"
 
-/*
+/*%
  * Separate a linked list of records into groups so that all records
  * in a group will belong to a single zone on the nameserver.
  * Create a dynamic update packet for each zone and send it to the
diff --git a/contrib/bind9/lib/bind9/Makefile.in b/contrib/bind9/lib/bind9/Makefile.in
index cd822f3..270e9ae 100644
--- a/contrib/bind9/lib/bind9/Makefile.in
+++ b/contrib/bind9/lib/bind9/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.2.200.10 2004/12/10 00:05:48 marka Exp $
+# $Id: Makefile.in,v 1.4.18.5 2004/12/10 00:11:50 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/bind9/api b/contrib/bind9/lib/bind9/api
index be7faa6..aba393a 100644
--- a/contrib/bind9/lib/bind9/api
+++ b/contrib/bind9/lib/bind9/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 0
-LIBREVISION = 8
+LIBINTERFACE = 30
+LIBREVISION = 3
 LIBAGE = 0
diff --git a/contrib/bind9/lib/bind9/check.c b/contrib/bind9/lib/bind9/check.c
index 2079a84..3144e65 100644
--- a/contrib/bind9/lib/bind9/check.c
+++ b/contrib/bind9/lib/bind9/check.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check.c,v 1.37.6.34 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: check.c,v 1.44.18.31 2006/08/21 00:09:52 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -33,11 +35,13 @@
 #include <isc/symtab.h>
 #include <isc/util.h>
 
+#include <dns/acl.h>
 #include <dns/fixedname.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatatype.h>
 #include <dns/secalg.h>
 
+#include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 
 #include <bind9/check.h>
@@ -117,10 +121,7 @@ check_orderent(const cfg_obj_t *ent, isc_log_t *logctx) {
 	    cfg_obj_log(ent, logctx, ISC_LOG_ERROR,
 			"rrset-order: missing ordering");
 		result = ISC_R_FAILURE;
-	} else if (strcasecmp(cfg_obj_asstring(obj), "fixed") == 0) {
-		cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
-			    "rrset-order: order 'fixed' not fully implemented");
-	} else if (/* strcasecmp(cfg_obj_asstring(obj), "fixed") != 0 && */
+	} else if (strcasecmp(cfg_obj_asstring(obj), "fixed") != 0 &&
 		   strcasecmp(cfg_obj_asstring(obj), "random") != 0 &&
 		   strcasecmp(cfg_obj_asstring(obj), "cyclic") != 0) {
 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
@@ -272,7 +273,8 @@ disabled_algorithms(const cfg_obj_t *disabled, isc_log_t *logctx) {
 		}
 		if (tresult != ISC_R_SUCCESS) {
 			cfg_obj_log(cfg_listelt_value(element), logctx,
-				    ISC_LOG_ERROR, "invalid algorithm");
+				    ISC_LOG_ERROR, "invalid algorithm '%s'",
+				    r.base);
 			result = tresult;
 		}
 	}
@@ -345,6 +347,56 @@ mustbesecure(const cfg_obj_t *secure, isc_symtab_t *symtab, isc_log_t *logctx,
 	return (result);
 }
 
+static isc_result_t
+checkacl(const char *aclname, cfg_aclconfctx_t *actx, const cfg_obj_t *zconfig,
+	 const cfg_obj_t *voptions, const cfg_obj_t *config,
+	 isc_log_t *logctx, isc_mem_t *mctx)
+{
+	isc_result_t result;
+	const cfg_obj_t *aclobj = NULL;
+	const cfg_obj_t *options;
+	dns_acl_t *acl = NULL;
+
+	if (zconfig != NULL) {
+		options = cfg_tuple_get(zconfig, "options");
+		cfg_map_get(options, aclname, &aclobj);
+	}
+	if (voptions != NULL && aclobj == NULL)
+		cfg_map_get(voptions, aclname, &aclobj);
+	if (config != NULL && aclobj == NULL) {
+		options = NULL;
+		cfg_map_get(config, "options", &options);
+		if (options != NULL)
+			cfg_map_get(options, aclname, &aclobj);
+	}
+	if (aclobj == NULL)
+		return (ISC_R_SUCCESS);
+	result = cfg_acl_fromconfig(aclobj, config, logctx, actx, mctx, &acl);
+	if (acl != NULL)
+		dns_acl_detach(&acl);
+	return (result);
+}
+
+static isc_result_t
+check_viewacls(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
+	       const cfg_obj_t *config, isc_log_t *logctx, isc_mem_t *mctx)
+{
+	isc_result_t result = ISC_R_SUCCESS, tresult;
+	int i = 0;
+	
+	static const char *acls[] = { "allow-query", "allow-query-cache",
+		"allow-recursion", "blackhole", "match-clients",
+		"match-destinations", "sortlist", NULL };
+
+	while (acls[i] != NULL) {
+		tresult = checkacl(acls[i++], actx, NULL, voptions, config,
+				   logctx, mctx);
+		if (tresult != ISC_R_SUCCESS)
+			result = tresult;  
+	}
+	return (result);
+}
+
 typedef struct {
 	const char *name;
 	unsigned int scale;
@@ -359,6 +411,10 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *element;
 	isc_symtab_t *symtab = NULL;
+	dns_fixedname_t fixed;
+	const char *str;
+	dns_name_t *name;
+	isc_buffer_t b;
 
 	static intervaltable intervals[] = {
 	{ "cleaning-interval", 60, 28 * 24 * 60 },	/* 28 days */
@@ -458,6 +514,9 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 		}
 	}
 
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
+
 	/*
 	 * Check the DLV zone name.
 	 */
@@ -472,16 +531,11 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 		     element != NULL;
 		     element = cfg_list_next(element))
 		{
-			dns_fixedname_t fixedname;
-			dns_name_t *name;
 			const char *dlv;
-			isc_buffer_t b;
 
 			obj = cfg_listelt_value(element);
 
 			dlv = cfg_obj_asstring(cfg_tuple_get(obj, "domain"));
-			dns_fixedname_init(&fixedname);
-			name = dns_fixedname_name(&fixedname);
 			isc_buffer_init(&b, dlv, strlen(dlv));
 			isc_buffer_add(&b, strlen(dlv));
 			tresult = dns_name_fromtext(name, &b, dns_rootname,
@@ -514,7 +568,6 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 			}
 			dlv = cfg_obj_asstring(cfg_tuple_get(obj,
 					       "trust-anchor"));
-			dns_fixedname_init(&fixedname);
 			isc_buffer_init(&b, dlv, strlen(dlv));
 			isc_buffer_add(&b, strlen(dlv));
 			tresult = dns_name_fromtext(name, &b, dns_rootname,
@@ -554,6 +607,59 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx) {
 			isc_symtab_destroy(&symtab);
 	}
 
+	/*
+	 * Check empty zone configuration.
+	 */
+	obj = NULL;
+	(void)cfg_map_get(options, "empty-server", &obj);
+	if (obj != NULL) {
+		str = cfg_obj_asstring(obj);
+		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_add(&b, strlen(str));
+		tresult = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
+					    dns_rootname, ISC_FALSE, NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "empty-server: invalid name '%s'", str);
+			result = ISC_R_FAILURE;
+		}
+	}
+
+	obj = NULL;
+	(void)cfg_map_get(options, "empty-contact", &obj);
+	if (obj != NULL) {
+		str = cfg_obj_asstring(obj);
+		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_add(&b, strlen(str));
+		tresult = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
+					    dns_rootname, ISC_FALSE, NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "empty-contact: invalid name '%s'", str);
+			result = ISC_R_FAILURE;
+		}
+	}
+
+	obj = NULL;
+	(void)cfg_map_get(options, "disable-empty-zone", &obj);
+	for (element = cfg_list_first(obj);
+	     element != NULL;
+	     element = cfg_list_next(element))
+	{
+		obj = cfg_listelt_value(element);
+		str = cfg_obj_asstring(obj);
+		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_add(&b, strlen(str));
+		tresult = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
+					    dns_rootname, ISC_FALSE, NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
+				    "disable-empty-zone: invalid name '%s'",
+				    str);
+			result = ISC_R_FAILURE;
+		}
+	}
+
 	return (result);
 }
 
@@ -679,12 +785,87 @@ validate_masters(const cfg_obj_t *obj, const cfg_obj_t *config,
 	return (result);
 }
 
+static isc_result_t
+check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_result_t tresult;
+	const cfg_listelt_t *element;
+	const cfg_listelt_t *element2;
+	dns_fixedname_t fixed;
+	const char *str;
+	isc_buffer_t b;
+
+	for (element = cfg_list_first(policy);
+	     element != NULL;
+	     element = cfg_list_next(element))
+	{
+		const cfg_obj_t *stmt = cfg_listelt_value(element);
+		const cfg_obj_t *identity = cfg_tuple_get(stmt, "identity");
+		const cfg_obj_t *matchtype = cfg_tuple_get(stmt, "matchtype");
+		const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
+		const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
+
+		dns_fixedname_init(&fixed);
+		str = cfg_obj_asstring(identity);
+		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_add(&b, strlen(str));
+		tresult = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
+                                            dns_rootname, ISC_FALSE, NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(identity, logctx, ISC_LOG_ERROR,
+				    "'%s' is not a valid name", str);
+			result = tresult;
+		}
+
+		dns_fixedname_init(&fixed);
+		str = cfg_obj_asstring(dname);
+		isc_buffer_init(&b, str, strlen(str));
+		isc_buffer_add(&b, strlen(str));
+		tresult = dns_name_fromtext(dns_fixedname_name(&fixed), &b,
+					    dns_rootname, ISC_FALSE, NULL);
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(dname, logctx, ISC_LOG_ERROR,
+				    "'%s' is not a valid name", str);
+			result = tresult;
+		}
+		if (tresult == ISC_R_SUCCESS &&
+		    strcasecmp(cfg_obj_asstring(matchtype), "wildcard") == 0 &&
+		    !dns_name_iswildcard(dns_fixedname_name(&fixed))) {
+			cfg_obj_log(identity, logctx, ISC_LOG_ERROR,
+				    "'%s' is not a wildcard", str);
+			result = ISC_R_FAILURE;
+		}
+
+		for (element2 = cfg_list_first(typelist);
+		     element2 != NULL;
+		     element2 = cfg_list_next(element2))
+		{
+			const cfg_obj_t *typeobj;
+			isc_textregion_t r;
+			dns_rdatatype_t type;
+			
+			typeobj = cfg_listelt_value(element2);
+			DE_CONST(cfg_obj_asstring(typeobj), r.base);
+			r.length = strlen(r.base);
+
+			tresult = dns_rdatatype_fromtext(&type, &r);
+			if (tresult != ISC_R_SUCCESS) {
+				cfg_obj_log(typeobj, logctx, ISC_LOG_ERROR,
+                                            "'%s' is not a valid type", r.base);
+				result = tresult;
+			}
+		}
+	}
+	return (result);
+}
+
 #define MASTERZONE	1
 #define SLAVEZONE	2
 #define STUBZONE	4
 #define HINTZONE	8
 #define FORWARDZONE	16
 #define DELEGATIONZONE	32
+#define CHECKACL	64
 
 typedef struct {
 	const char *name;
@@ -692,8 +873,9 @@ typedef struct {
 } optionstable;
 
 static isc_result_t
-check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
-	       isc_symtab_t *symtab, dns_rdataclass_t defclass,
+check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
+	       const cfg_obj_t *config, isc_symtab_t *symtab,
+	       dns_rdataclass_t defclass, cfg_aclconfctx_t *actx,
 	       isc_log_t *logctx, isc_mem_t *mctx)
 {
 	const char *zname;
@@ -709,9 +891,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 	isc_buffer_t b;
 
 	static optionstable options[] = {
-	{ "allow-query", MASTERZONE | SLAVEZONE | STUBZONE },
-	{ "allow-notify", SLAVEZONE },
-	{ "allow-transfer", MASTERZONE | SLAVEZONE },
+	{ "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | CHECKACL },
+	{ "allow-notify", SLAVEZONE | CHECKACL },
+	{ "allow-transfer", MASTERZONE | SLAVEZONE | CHECKACL },
 	{ "notify", MASTERZONE | SLAVEZONE },
 	{ "also-notify", MASTERZONE | SLAVEZONE },
 	{ "dialup", MASTERZONE | SLAVEZONE | STUBZONE },
@@ -734,9 +916,10 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 	{ "min-refresh-time", SLAVEZONE | STUBZONE },
 	{ "sig-validity-interval", MASTERZONE },
 	{ "zone-statistics", MASTERZONE | SLAVEZONE | STUBZONE },
-	{ "allow-update", MASTERZONE },
-	{ "allow-update-forwarding", SLAVEZONE },
+	{ "allow-update", MASTERZONE | CHECKACL },
+	{ "allow-update-forwarding", SLAVEZONE | CHECKACL },
 	{ "file", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE },
+	{ "journal", MASTERZONE | SLAVEZONE },
 	{ "ixfr-base", MASTERZONE | SLAVEZONE },
 	{ "ixfr-tmp-file", MASTERZONE | SLAVEZONE },
 	{ "masters", SLAVEZONE | STUBZONE },
@@ -744,6 +927,13 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 	{ "update-policy", MASTERZONE },
 	{ "database", MASTERZONE | SLAVEZONE | STUBZONE },
 	{ "key-directory", MASTERZONE },
+	{ "check-wildcard", MASTERZONE },
+	{ "check-mx", MASTERZONE },
+	{ "integrity-check", MASTERZONE },
+	{ "check-mx-cname", MASTERZONE },
+	{ "check-srv-cname", MASTERZONE },
+	{ "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE },
+	{ "update-check-ksk", MASTERZONE },
 	};
 
 	static optionstable dialups[] = {
@@ -835,6 +1025,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 
 	/*
 	 * Look for inappropriate options for the given zone type.
+	 * Check that ACLs expand correctly.
 	 */
 	for (i = 0; i < sizeof(options) / sizeof(options[0]); i++) {
 		obj = NULL;
@@ -855,6 +1046,16 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 					    "in '%s' zone '%s'",
 					    options[i].name, typestr, zname);
 		}
+		obj = NULL;
+		if ((options[i].allowed & ztype) != 0 &&
+		    (options[i].allowed & CHECKACL) != 0) {
+
+			tresult = checkacl(options[i].name, actx, zconfig,
+				           voptions, config, logctx, mctx);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+		}
+
 	}
 
 	/*
@@ -897,7 +1098,9 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 				    "when 'update-policy' is present",
 				    zname);
 			result = ISC_R_FAILURE;
-		}
+		} else if (res2 == ISC_R_SUCCESS &&
+			   check_update_policy(obj, logctx) != ISC_R_SUCCESS)
+			result = ISC_R_FAILURE;
 	}
 
 	/*
@@ -971,11 +1174,31 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *config,
 	return (result);
 }
 
+
+typedef struct keyalgorithms {
+	const char *name;
+	isc_uint16_t size;
+} algorithmtable;
+
 isc_result_t
 bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 	const cfg_obj_t *algobj = NULL;
 	const cfg_obj_t *secretobj = NULL;
 	const char *keyname = cfg_obj_asstring(cfg_map_getname(key));
+	const char *algorithm;
+	int i;
+	size_t len = 0;
+	static const algorithmtable algorithms[] = {
+		{ "hmac-md5", 128 },
+		{ "hmac-md5.sig-alg.reg.int", 0 },
+		{ "hmac-md5.sig-alg.reg.int.", 0 },
+		{ "hmac-sha1", 160 },
+		{ "hmac-sha224", 224 },
+		{ "hmac-sha256", 256 },
+		{ "hmac-sha384", 384 },
+		{ "hmac-sha512", 512 },
+		{  NULL, 0 }
+	};
 	
 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -986,6 +1209,56 @@ bind9_check_key(const cfg_obj_t *key, isc_log_t *logctx) {
 			    keyname);
 		return (ISC_R_FAILURE);
 	}
+
+	algorithm = cfg_obj_asstring(algobj);
+	for (i = 0; algorithms[i].name != NULL; i++) {
+		len = strlen(algorithms[i].name);
+		if (strncasecmp(algorithms[i].name, algorithm, len) == 0 &&
+		    (algorithm[len] == '\0' ||
+		     (algorithms[i].size != 0 && algorithm[len] == '-')))
+			break;
+	}
+	if (algorithms[i].name == NULL) {
+		cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
+			    "unknown algorithm '%s'", algorithm);
+		return (ISC_R_NOTFOUND);
+	}
+	if (algorithm[len] == '-') {
+		isc_uint16_t digestbits;
+		isc_result_t result;
+		result = isc_parse_uint16(&digestbits, algorithm + len + 1, 10);
+		if (result == ISC_R_SUCCESS || result == ISC_R_RANGE) {
+			if (result == ISC_R_RANGE ||
+			    digestbits > algorithms[i].size) {
+				cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
+					    "key '%s' digest-bits too large "
+					    "[%u..%u]", keyname,
+					    algorithms[i].size / 2,
+					    algorithms[i].size);
+				return (ISC_R_RANGE);
+			}
+			if ((digestbits % 8) != 0) {
+				cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
+					    "key '%s' digest-bits not multiple"
+					    " of 8", keyname);
+				return (ISC_R_RANGE);
+			}
+			/*
+			 * Recommended minima for hmac algorithms.
+			 */
+			if ((digestbits < (algorithms[i].size / 2U) ||
+			     (digestbits < 80U)))
+				cfg_obj_log(algobj, logctx, ISC_LOG_WARNING,
+					    "key '%s' digest-bits too small "
+					    "[<%u]", keyname, 
+					    algorithms[i].size/2);
+		} else {
+			cfg_obj_log(algobj, logctx, ISC_LOG_ERROR,
+				    "key '%s': unable to parse digest-bits",
+				    keyname);
+			return (result);
+		}
+	}
 	return (ISC_R_SUCCESS);
 }
 
@@ -1003,6 +1276,10 @@ check_keylist(const cfg_obj_t *keys, isc_symtab_t *symtab, isc_log_t *logctx) {
 		const char *keyname = cfg_obj_asstring(cfg_map_getname(key));
 		isc_symvalue_t symvalue;
 
+		tresult = bind9_check_key(key, logctx);
+		if (tresult != ISC_R_SUCCESS)
+			return (tresult);
+
 		symvalue.as_cpointer = key;
 		tresult = isc_symtab_define(symtab, keyname, 1,
 					    symvalue, isc_symexists_reject);
@@ -1024,69 +1301,80 @@ check_keylist(const cfg_obj_t *keys, isc_symtab_t *symtab, isc_log_t *logctx) {
 			result = tresult;
 		} else if (tresult != ISC_R_SUCCESS)
 			return (tresult);
-
-		tresult = bind9_check_key(key, logctx);
-		if (tresult != ISC_R_SUCCESS)
-			return (tresult);
 	}
 	return (result);
 }
 
+static struct {
+	const char *v4;
+	const char *v6;
+} sources[] = {
+	{ "transfer-source", "transfer-source-v6" },
+	{ "notify-source", "notify-source-v6" },
+	{ "query-source", "query-source-v6" },
+	{ NULL, NULL }
+};
+
 static isc_result_t
 check_servers(const cfg_obj_t *servers, isc_log_t *logctx) {
 	isc_result_t result = ISC_R_SUCCESS;
-	const cfg_listelt_t *e1;
-	const cfg_listelt_t *e2;
-	const cfg_obj_t *v1;
-	const cfg_obj_t *v2;
-	const isc_sockaddr_t *s1;
-	const isc_sockaddr_t *s2;
-	isc_netaddr_t na;
-	const cfg_obj_t *ts;
-	char buf[128];
+	isc_result_t tresult;
+	const cfg_listelt_t *e1, *e2;
+	const cfg_obj_t *v1, *v2;
+	isc_netaddr_t n1, n2;
+	unsigned int p1, p2;
+	const cfg_obj_t *obj;
+	char buf[ISC_NETADDR_FORMATSIZE];
 	const char *xfr;
-	isc_buffer_t target;
+	int source;
 
 	for (e1 = cfg_list_first(servers); e1 != NULL; e1 = cfg_list_next(e1)) {
 		v1 = cfg_listelt_value(e1);
-		s1 = cfg_obj_assockaddr(cfg_map_getname(v1));
-		ts = NULL;
-		if (isc_sockaddr_pf(s1) == AF_INET)
-			xfr = "transfer-source-v6";
-		else
-			xfr = "transfer-source";
-		(void)cfg_map_get(v1, xfr, &ts);
-		if (ts != NULL) {
-			isc_netaddr_fromsockaddr(&na, s1);
-			isc_buffer_init(&target, buf, sizeof(buf) - 1);
-			RUNTIME_CHECK(isc_netaddr_totext(&na, &target)
-				      == ISC_R_SUCCESS);
-			buf[isc_buffer_usedlength(&target)] = '\0';
+		cfg_obj_asnetprefix(cfg_map_getname(v1), &n1, &p1);
+		/*
+		 * Check that unused bits are zero.
+		 */
+		tresult = isc_netaddr_prefixok(&n1, p1);
+		if (tresult != ISC_R_SUCCESS) {
+			INSIST(tresult == ISC_R_FAILURE);
+			isc_netaddr_format(&n1, buf, sizeof(buf));
 			cfg_obj_log(v1, logctx, ISC_LOG_ERROR,
-				    "server '%s': %s not valid", buf, xfr);
-			result = ISC_R_FAILURE;
+				    "server '%s/%u': invalid prefix "
+				    "(extra bits specified)", buf, p1);
+			result = tresult;
 		}
+		source = 0;
+		do {
+			obj = NULL;
+			if (n1.family == AF_INET)
+				xfr = sources[source].v6;
+			else
+				xfr = sources[source].v4;
+			(void)cfg_map_get(v1, xfr, &obj);
+			if (obj != NULL) {
+				isc_netaddr_format(&n1, buf, sizeof(buf));
+				cfg_obj_log(v1, logctx, ISC_LOG_ERROR,
+					    "server '%s': %s not legal",
+					    buf, xfr);
+				result = ISC_R_FAILURE;
+			}
+		} while (sources[++source].v4 != NULL);
 		e2 = e1;
 		while ((e2 = cfg_list_next(e2)) != NULL) {
 			v2 = cfg_listelt_value(e2);
-			s2 = cfg_obj_assockaddr(cfg_map_getname(v2));
-			if (isc_sockaddr_eqaddr(s1, s2)) {
+			cfg_obj_asnetprefix(cfg_map_getname(v2), &n2, &p2);
+			if (p1 == p2 && isc_netaddr_equal(&n1, &n2)) {
 				const char *file = cfg_obj_file(v1);
 				unsigned int line = cfg_obj_line(v1);
 
 				if (file == NULL)
 					file = "<unknown file>";
 
-				isc_netaddr_fromsockaddr(&na, s2);
-				isc_buffer_init(&target, buf, sizeof(buf) - 1);
-				RUNTIME_CHECK(isc_netaddr_totext(&na, &target)
-					      == ISC_R_SUCCESS);
-				buf[isc_buffer_usedlength(&target)] = '\0';
-
+				isc_netaddr_format(&n2, buf, sizeof(buf));
 				cfg_obj_log(v2, logctx, ISC_LOG_ERROR,
-					    "server '%s': already exists "
+					    "server '%s/%u': already exists "
 					    "previous definition: %s:%u",
-					    buf, file, line);
+					    buf, p2, file, line);
 				result = ISC_R_FAILURE;
 			}
 		}
@@ -1095,7 +1383,7 @@ check_servers(const cfg_obj_t *servers, isc_log_t *logctx) {
 }
 		
 static isc_result_t
-check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
+check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	       dns_rdataclass_t vclass, isc_log_t *logctx, isc_mem_t *mctx)
 {
 	const cfg_obj_t *servers = NULL;
@@ -1105,6 +1393,9 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	isc_symtab_t *symtab = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult = ISC_R_SUCCESS;
+	cfg_aclconfctx_t actx;
+	const cfg_obj_t *obj;
+	isc_boolean_t enablednssec, enablevalidation;
 
 	/*
 	 * Check that all zone statements are syntactically correct and
@@ -1115,8 +1406,10 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (tresult != ISC_R_SUCCESS)
 		return (ISC_R_NOMEMORY);
 
-	if (vconfig != NULL)
-		(void)cfg_map_get(vconfig, "zone", &zones);
+	cfg_aclconfctx_init(&actx);
+
+	if (voptions != NULL)
+		(void)cfg_map_get(voptions, "zone", &zones);
 	else
 		(void)cfg_map_get(config, "zone", &zones);
 
@@ -1127,8 +1420,8 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		isc_result_t tresult;
 		const cfg_obj_t *zone = cfg_listelt_value(element);
 
-		tresult = check_zoneconf(zone, config, symtab, vclass,
-					 logctx, mctx);
+		tresult = check_zoneconf(zone, voptions, config, symtab,
+					 vclass, &actx, logctx, mctx);
 		if (tresult != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
@@ -1152,9 +1445,9 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		return (tresult);
 	}
 	
-	if (vconfig != NULL) {
+	if (voptions != NULL) {
 		keys = NULL;
-		(void)cfg_map_get(vconfig, "key", &keys);
+		(void)cfg_map_get(voptions, "key", &keys);
 		tresult = check_keylist(keys, symtab, logctx);
 		if (tresult == ISC_R_EXISTS)
 			result = ISC_R_FAILURE;
@@ -1169,55 +1462,349 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	/*
 	 * Check that forwarding is reasonable.
 	 */
-	if (vconfig == NULL) {
+	if (voptions == NULL) {
 		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL)
 			if (check_forward(options, logctx) != ISC_R_SUCCESS)
 				result = ISC_R_FAILURE;
 	} else {
-		if (check_forward(vconfig, logctx) != ISC_R_SUCCESS)
+		if (check_forward(voptions, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 	/*
 	 * Check that dual-stack-servers is reasonable.
 	 */
-	if (vconfig == NULL) {
+	if (voptions == NULL) {
 		const cfg_obj_t *options = NULL;
 		(void)cfg_map_get(config, "options", &options);
 		if (options != NULL)
 			if (check_dual_stack(options, logctx) != ISC_R_SUCCESS)
 				result = ISC_R_FAILURE;
 	} else {
-		if (check_dual_stack(vconfig, logctx) != ISC_R_SUCCESS)
+		if (check_dual_stack(voptions, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 
 	/*
 	 * Check that rrset-order is reasonable.
 	 */
-	if (vconfig != NULL) {
-		if (check_order(vconfig, logctx) != ISC_R_SUCCESS)
+	if (voptions != NULL) {
+		if (check_order(voptions, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 
-	if (vconfig != NULL) {
-		(void)cfg_map_get(vconfig, "server", &servers);
+	if (voptions != NULL) {
+		(void)cfg_map_get(voptions, "server", &servers);
 		if (servers != NULL &&
 		    check_servers(servers, logctx) != ISC_R_SUCCESS)
 			result = ISC_R_FAILURE;
 	}
 
-	if (vconfig != NULL)
-		tresult = check_options(vconfig, logctx, mctx);
+	/*
+	 * Check that dnssec-enable/dnssec-validation are sensible.
+	 */
+	obj = NULL;
+	if (voptions != NULL)
+		(void)cfg_map_get(voptions, "dnssec-enable", &obj);
+	if (obj == NULL)
+		(void)cfg_map_get(config, "dnssec-enable", &obj);
+	if (obj == NULL)
+		enablednssec = ISC_TRUE;
+	else
+		enablednssec = cfg_obj_asboolean(obj);
+
+	obj = NULL;
+	if (voptions != NULL)
+		(void)cfg_map_get(voptions, "dnssec-validation", &obj);
+	if (obj == NULL)
+		(void)cfg_map_get(config, "dnssec-validation", &obj);
+	if (obj == NULL)
+		enablevalidation = ISC_FALSE;	/* XXXMPA Change for 9.5. */
+	else
+		enablevalidation = cfg_obj_asboolean(obj);
+
+	if (enablevalidation && !enablednssec)
+		cfg_obj_log(obj, logctx, ISC_LOG_WARNING,
+			    "'dnssec-validation yes;' and 'dnssec-enable no;'");
+
+	if (voptions != NULL)
+		tresult = check_options(voptions, logctx, mctx);
 	else
 		tresult = check_options(config, logctx, mctx);
 	if (tresult != ISC_R_SUCCESS)
 		result = tresult;
 
+	tresult = check_viewacls(&actx, voptions, config, logctx, mctx);
+	if (tresult != ISC_R_SUCCESS)
+		result = tresult;
+
+	cfg_aclconfctx_destroy(&actx);
+
 	return (result);
 }
 
+static const char *
+default_channels[] = {
+	"default_syslog",
+	"default_stderr",
+	"default_debug",
+	"null",
+	NULL
+};
+
+static isc_result_t
+bind9_check_logging(const cfg_obj_t *config, isc_log_t *logctx,
+		    isc_mem_t *mctx)
+{
+	const cfg_obj_t *categories = NULL;
+	const cfg_obj_t *category;
+	const cfg_obj_t *channels = NULL;
+	const cfg_obj_t *channel;
+	const cfg_listelt_t *element;
+	const cfg_listelt_t *delement;
+	const char *channelname;
+	const char *catname;
+	const cfg_obj_t *fileobj = NULL;
+        const cfg_obj_t *syslogobj = NULL;
+        const cfg_obj_t *nullobj = NULL;
+        const cfg_obj_t *stderrobj = NULL;
+        const cfg_obj_t *logobj = NULL;
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_result_t tresult;
+	isc_symtab_t *symtab = NULL;
+	isc_symvalue_t symvalue;
+	int i;
+
+	(void)cfg_map_get(config, "logging", &logobj);
+	if (logobj == NULL)
+		return (ISC_R_SUCCESS);
+
+	result = isc_symtab_create(mctx, 100, NULL, NULL, ISC_FALSE, &symtab);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	symvalue.as_cpointer = NULL;
+	for (i = 0; default_channels[i] != NULL; i++) {
+		tresult = isc_symtab_define(symtab, default_channels[i], 1,
+					    symvalue, isc_symexists_replace);
+		if (tresult != ISC_R_SUCCESS)
+			result = tresult;
+	}
+
+	cfg_map_get(logobj, "channel", &channels);
+
+	for (element = cfg_list_first(channels);
+	     element != NULL;
+	     element = cfg_list_next(element))
+	{
+		channel = cfg_listelt_value(element);
+		channelname = cfg_obj_asstring(cfg_map_getname(channel));
+		fileobj = syslogobj = nullobj = stderrobj = NULL;
+		(void)cfg_map_get(channel, "file", &fileobj);
+		(void)cfg_map_get(channel, "syslog", &syslogobj);
+		(void)cfg_map_get(channel, "null", &nullobj);
+		(void)cfg_map_get(channel, "stderr", &stderrobj);
+		i = 0;
+		if (fileobj != NULL)
+			i++;
+		if (syslogobj != NULL)
+			i++;
+		if (nullobj != NULL)
+			i++;
+		if (stderrobj != NULL)
+			i++;
+		if (i != 1) {
+			cfg_obj_log(channel, logctx, ISC_LOG_ERROR,
+				    "channel '%s': exactly one of file, syslog, "
+				    "null, and stderr must be present",
+				     channelname);
+			result = ISC_R_FAILURE;
+		}
+		tresult = isc_symtab_define(symtab, channelname, 1,
+					    symvalue, isc_symexists_replace);
+		if (tresult != ISC_R_SUCCESS)
+			result = tresult;
+	}
+
+	cfg_map_get(logobj, "category", &categories);
+
+	for (element = cfg_list_first(categories);
+             element != NULL;
+             element = cfg_list_next(element))
+        {
+		category = cfg_listelt_value(element);
+		catname = cfg_obj_asstring(cfg_tuple_get(category, "name"));
+		if (isc_log_categorybyname(logctx, catname) == NULL) {
+			cfg_obj_log(category, logctx, ISC_LOG_ERROR,
+				    "undefined category: '%s'", catname);
+			result = ISC_R_FAILURE;
+		}
+		channels = cfg_tuple_get(category, "destinations");
+		for (delement = cfg_list_first(channels);
+		     delement != NULL;
+		     delement = cfg_list_next(delement))
+		{
+			channel = cfg_listelt_value(delement);
+			channelname = cfg_obj_asstring(channel);
+			tresult = isc_symtab_lookup(symtab, channelname, 1,
+                                          	    &symvalue);
+			if (tresult != ISC_R_SUCCESS) {
+				cfg_obj_log(channel, logctx, ISC_LOG_ERROR,
+					    "undefined channel: '%s'",
+					    channelname);
+				result = tresult;
+			}
+		}
+	}
+	isc_symtab_destroy(&symtab);
+	return (result);
+}
+
+static isc_result_t
+key_exists(const cfg_obj_t *keylist, const char *keyname) {
+	const cfg_listelt_t *element;
+	const char *str;
+	const cfg_obj_t *obj;
+	
+	if (keylist == NULL)
+		return (ISC_R_NOTFOUND);
+	for (element = cfg_list_first(keylist);
+	     element != NULL;   
+	     element = cfg_list_next(element)) 
+	{
+		obj = cfg_listelt_value(element);
+		str = cfg_obj_asstring(cfg_map_getname(obj));
+		if (strcasecmp(str, keyname) == 0)
+			return (ISC_R_SUCCESS);
+	}
+	return (ISC_R_NOTFOUND);
+}
+
+static isc_result_t
+bind9_check_controlskeys(const cfg_obj_t *control, const cfg_obj_t *keylist,
+			 isc_log_t *logctx)
+{
+	isc_result_t result = ISC_R_SUCCESS, tresult;
+	const cfg_obj_t *control_keylist;
+	const cfg_listelt_t *element;
+	const cfg_obj_t *key;
+	
+	control_keylist = cfg_tuple_get(control, "keys");
+	if (cfg_obj_isvoid(control_keylist))
+		return (ISC_R_SUCCESS);
+
+	for (element = cfg_list_first(control_keylist);
+	     element != NULL;
+	     element = cfg_list_next(element))
+	{
+		key = cfg_listelt_value(element);
+		tresult = key_exists(keylist, cfg_obj_asstring(key));
+		if (tresult != ISC_R_SUCCESS) {
+			cfg_obj_log(key, logctx, ISC_LOG_ERROR,
+				    "unknown key '%s'", cfg_obj_asstring(key));
+			result = tresult;
+		}
+	}
+	return (result);
+}
+
+static isc_result_t
+bind9_check_controls(const cfg_obj_t *config, isc_log_t *logctx,
+		     isc_mem_t *mctx)
+{
+	isc_result_t result = ISC_R_SUCCESS, tresult;
+	cfg_aclconfctx_t actx;
+	const cfg_listelt_t *element, *element2;
+	const cfg_obj_t *allow;
+	const cfg_obj_t *control;
+	const cfg_obj_t *controls;
+	const cfg_obj_t *controlslist = NULL;
+	const cfg_obj_t *inetcontrols;
+	const cfg_obj_t *unixcontrols;
+	const cfg_obj_t *keylist = NULL;
+	const char *path;
+	isc_uint32_t perm, mask;
+	dns_acl_t *acl = NULL;
+	isc_sockaddr_t addr;
+	int i;
+
+	(void)cfg_map_get(config, "controls", &controlslist);
+	if (controlslist == NULL)
+		return (ISC_R_SUCCESS);
+
+	(void)cfg_map_get(config, "key", &keylist);
+
+	cfg_aclconfctx_init(&actx);
+
+	/*
+	 * INET: Check allow clause.
+	 * UNIX: Check "perm" for sanity, check path length.
+	 */
+	for (element = cfg_list_first(controlslist);
+	     element != NULL;
+	     element = cfg_list_next(element)) {
+		controls = cfg_listelt_value(element);
+		unixcontrols = NULL;
+		inetcontrols = NULL;
+		(void)cfg_map_get(controls, "unix", &unixcontrols);
+		(void)cfg_map_get(controls, "inet", &inetcontrols);
+		for (element2 = cfg_list_first(inetcontrols);
+		     element2 != NULL;
+		     element2 = cfg_list_next(element2)) {
+			control = cfg_listelt_value(element2);
+			allow = cfg_tuple_get(control, "allow");
+			tresult = cfg_acl_fromconfig(allow, config, logctx,
+						     &actx, mctx, &acl);
+			if (acl != NULL)
+				dns_acl_detach(&acl);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			tresult = bind9_check_controlskeys(control, keylist,
+							   logctx);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+		}
+		for (element2 = cfg_list_first(unixcontrols);
+		     element2 != NULL;
+		     element2 = cfg_list_next(element2)) {
+			control = cfg_listelt_value(element2);
+			path = cfg_obj_asstring(cfg_tuple_get(control, "path"));
+			tresult = isc_sockaddr_frompath(&addr, path);
+			if (tresult == ISC_R_NOSPACE) {
+				cfg_obj_log(control, logctx, ISC_LOG_ERROR,
+					    "unix control '%s': path too long",
+					    path);
+				result = ISC_R_NOSPACE;
+			}
+			perm = cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
+			for (i = 0; i < 3; i++) {
+#ifdef NEED_SECURE_DIRECTORY
+				mask = (0x1 << (i*3));	/* SEARCH */
+#else
+				mask = (0x6 << (i*3)); 	/* READ + WRITE */
+#endif
+				if ((perm & mask) == mask)
+					break;
+			}
+			if (i == 0) {
+				cfg_obj_log(control, logctx, ISC_LOG_WARNING,
+					    "unix control '%s' allows access "
+					    "to everyone", path);
+			} else if (i == 3) {
+				cfg_obj_log(control, logctx, ISC_LOG_WARNING,
+					    "unix control '%s' allows access "
+					    "to nobody", path);
+			}
+			tresult = bind9_check_controlskeys(control, keylist,
+							   logctx);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+		}
+	}
+	cfg_aclconfctx_destroy(&actx);
+	return (result);
+}
 
 isc_result_t
 bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
@@ -1248,6 +1835,12 @@ bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 	    check_servers(servers, logctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
 
+	if (bind9_check_logging(config, logctx, mctx) != ISC_R_SUCCESS)
+		result = ISC_R_FAILURE;
+
+	if (bind9_check_controls(config, logctx, mctx) != ISC_R_SUCCESS)
+		result = ISC_R_FAILURE;
+
 	if (options != NULL && 
 	    check_order(options, logctx) != ISC_R_SUCCESS)
 		result = ISC_R_FAILURE;
diff --git a/contrib/bind9/lib/bind9/getaddresses.c b/contrib/bind9/lib/bind9/getaddresses.c
index 02d1104..b6edce0 100644
--- a/contrib/bind9/lib/bind9/getaddresses.c
+++ b/contrib/bind9/lib/bind9/getaddresses.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: getaddresses.c,v 1.13.126.8 2005/10/14 02:13:06 marka Exp $ */
+/* $Id: getaddresses.c,v 1.15.18.5 2005/10/14 01:28:24 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 #include <string.h>
diff --git a/contrib/bind9/lib/bind9/include/Makefile.in b/contrib/bind9/lib/bind9/include/Makefile.in
index 9081d9e..6c6611e 100644
--- a/contrib/bind9/lib/bind9/include/Makefile.in
+++ b/contrib/bind9/lib/bind9/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.1.200.3 2004/03/08 09:04:27 marka Exp $
+# $Id: Makefile.in,v 1.2 2004/03/05 05:09:08 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/bind9/include/bind9/Makefile.in b/contrib/bind9/lib/bind9/include/bind9/Makefile.in
index dec2982..8ef5c32 100644
--- a/contrib/bind9/lib/bind9/include/bind9/Makefile.in
+++ b/contrib/bind9/lib/bind9/include/bind9/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.5.200.4 2004/03/08 09:04:28 marka Exp $
+# $Id: Makefile.in,v 1.6 2004/03/05 05:09:10 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/bind9/include/bind9/check.h b/contrib/bind9/lib/bind9/include/bind9/check.h
index 09e8b2e..25a8e0c 100644
--- a/contrib/bind9/lib/bind9/include/bind9/check.h
+++ b/contrib/bind9/lib/bind9/include/bind9/check.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check.h,v 1.1.200.6 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: check.h,v 1.2.18.4 2006/03/02 00:37:21 marka Exp $ */
 
 #ifndef BIND9_CHECK_H
 #define BIND9_CHECK_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -30,24 +32,24 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 bind9_check_namedconf(const cfg_obj_t *config, isc_log_t *logctx,
 		      isc_mem_t *mctx);
-/*
+/*%<
  * Check the syntactic validity of a configuration parse tree generated from
  * a named.conf file.
  *
  * Requires:
- *	config is a valid parse tree
+ *\li	config is a valid parse tree
  *
- *	logctx is a valid logging context.
+ *\li	logctx is a valid logging context.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	ISC_R_FAILURE
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_FAILURE
  */
 
 isc_result_t
 bind9_check_key(const cfg_obj_t *config, isc_log_t *logctx);
-/*
- * As above, but for a single 'key' statement.
+/*%<
+ * Same as bind9_check_namedconf(), but for a single 'key' statement.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/bind9/include/bind9/getaddresses.h b/contrib/bind9/lib/bind9/include/bind9/getaddresses.h
index 4a3a546..e6d030d 100644
--- a/contrib/bind9/lib/bind9/include/bind9/getaddresses.h
+++ b/contrib/bind9/lib/bind9/include/bind9/getaddresses.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: getaddresses.h,v 1.2.200.3 2004/03/08 09:04:28 marka Exp $ */
+/* $Id: getaddresses.h,v 1.3.18.2 2005/04/29 00:15:48 marka Exp $ */
 
 #ifndef BIND9_GETADDRESSES_H
 #define BIND9_GETADDRESSES_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -30,7 +32,7 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 bind9_getaddresses(const char *hostname, in_port_t port,
 		   isc_sockaddr_t *addrs, int addrsize, int *addrcount);
-/*
+/*%<
  * Use the system resolver to get the addresses associated with a hostname.
  * If successful, the number of addresses found is returned in 'addrcount'.
  * If a hostname lookup is performed and addresses of an unknown family is
@@ -41,16 +43,16 @@ bind9_getaddresses(const char *hostname, in_port_t port,
  * framework, it should be surounded by isc_app_block()/isc_app_unblock().
  *
  *  Requires:
- *	'hostname' is not NULL.
- *	'addrs' is not NULL.
- *	'addrsize' > 0
- *	'addrcount' is not NULL.
+ *\li	'hostname' is not NULL.
+ *\li	'addrs' is not NULL.
+ *\li	'addrsize' > 0
+ *\li	'addrcount' is not NULL.
  *
  * 
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND
- *	ISC_R_NOFAMILYSUPPORT - 'hostname' is an IPv6 address, and IPv6 is
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOTFOUND
+ *\li	#ISC_R_NOFAMILYSUPPORT - 'hostname' is an IPv6 address, and IPv6 is
  *		not supported.
  */
 
diff --git a/contrib/bind9/lib/bind9/include/bind9/version.h b/contrib/bind9/lib/bind9/include/bind9/version.h
index a3b812e..154e240d 100644
--- a/contrib/bind9/lib/bind9/include/bind9/version.h
+++ b/contrib/bind9/lib/bind9/include/bind9/version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.h,v 1.2.208.3 2004/03/08 09:04:28 marka Exp $ */
+/* $Id: version.h,v 1.3.18.2 2005/04/29 00:15:48 marka Exp $ */
+
+/*! \file */
 
 #include <isc/platform.h>
 
diff --git a/contrib/bind9/lib/bind9/version.c b/contrib/bind9/lib/bind9/version.c
index 5fee2cf..2cc17da 100644
--- a/contrib/bind9/lib/bind9/version.c
+++ b/contrib/bind9/lib/bind9/version.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.c,v 1.3.200.4 2004/03/08 09:04:27 marka Exp $ */
+/* $Id: version.c,v 1.4.18.2 2005/04/29 00:15:47 marka Exp $ */
+
+/*! \file */
 
 #include <bind9/version.h>
 
diff --git a/contrib/bind9/lib/dns/Makefile.in b/contrib/bind9/lib/dns/Makefile.in
index 9c368d1..286a5f9 100644
--- a/contrib/bind9/lib/dns/Makefile.in
+++ b/contrib/bind9/lib/dns/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.126.2.3.2.19 2006/01/06 00:01:42 marka Exp $
+# $Id: Makefile.in,v 1.144.18.10 2006/01/06 00:01:43 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -49,17 +49,18 @@ DSTOBJS =	dst_api.@O@ dst_lib.@O@ dst_parse.@O@ dst_result.@O@ \
 		opensslrsa_link.@O@
 
 # Alphabetically
-DNSOBJS =	acl.@O@ adb.@O@ byaddr.@O@ \
+DNSOBJS =	acache.@O@ acl.@O@ adb.@O@ byaddr.@O@ \
 		cache.@O@ callbacks.@O@ compress.@O@ \
 		db.@O@ dbiterator.@O@ dbtable.@O@ diff.@O@ dispatch.@O@ \
-		dnssec.@O@ ds.@O@ forward.@O@ journal.@O@ keytable.@O@ \
+		dlz.@O@ dnssec.@O@ ds.@O@ forward.@O@ journal.@O@ keytable.@O@ \
 		lib.@O@ log.@O@ lookup.@O@ \
 		master.@O@ masterdump.@O@ message.@O@ \
 		name.@O@ ncache.@O@ nsec.@O@ order.@O@ peer.@O@ portlist.@O@ \
 		rbt.@O@ rbtdb.@O@ rbtdb64.@O@ rcode.@O@ rdata.@O@ \
 		rdatalist.@O@ \
 		rdataset.@O@ rdatasetiter.@O@ rdataslab.@O@ request.@O@ \
-		resolver.@O@ result.@O@ rootns.@O@ sdb.@O@ soa.@O@ ssu.@O@ \
+		resolver.@O@ result.@O@ rootns.@O@ sdb.@O@ sdlz.@O@ \
+		soa.@O@ ssu.@O@ \
 		stats.@O@ tcpmsg.@O@ time.@O@ timer.@O@ tkey.@O@ \
 		tsig.@O@ ttl.@O@ validator.@O@ \
 		version.@O@ view.@O@ xfrin.@O@ zone.@O@ zonekey.@O@ zt.@O@
@@ -73,17 +74,18 @@ DSTSRCS =	dst_api.c dst_lib.c dst_parse.c \
 		openssl_link.c openssldh_link.c \
 		openssldsa_link.c opensslrsa_link.c
 
-SRCS =		acl.c adb.c byaddr.c \
+DNSSRCS =	acache.c acl.c adb.c byaddr.c \
 		cache.c callbacks.c compress.c \
 		db.c dbiterator.c dbtable.c diff.c dispatch.c \
-		dnssec.c ds.c forward.c journal.c keytable.c \
+		dlz.c dnssec.c ds.c forward.c journal.c keytable.c \
 		lib.c log.c lookup.c \
 		master.c masterdump.c message.c \
 		name.c ncache.c nsec.c order.c peer.c portlist.c \
 		rbt.c rbtdb.c rbtdb64.c rcode.c rdata.c \
 		rdatalist.c \
 		rdataset.c rdatasetiter.c rdataslab.c request.c \
-		resolver.c result.c rootns.c sdb.c soa.c ssu.c \
+		resolver.c result.c rootns.c sdb.c sdlz.c \
+		soa.c ssu.c \
 		stats.c tcpmsg.c time.c timer.c tkey.c \
 		tsig.c ttl.c validator.c \
 		version.c view.c xfrin.c zone.c zonekey.c zt.c ${OTHERSRCS}
diff --git a/contrib/bind9/lib/dns/acache.c b/contrib/bind9/lib/dns/acache.c
new file mode 100644
index 0000000..5787a5a
--- /dev/null
+++ b/contrib/bind9/lib/dns/acache.c
@@ -0,0 +1,1778 @@
+/*
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: acache.c,v 1.3.2.16 2006/07/19 00:34:56 marka Exp $ */
+
+#include <config.h>
+
+#include <isc/atomic.h>
+#include <isc/event.h>
+#include <isc/hash.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/random.h>
+#include <isc/refcount.h>
+#include <isc/rwlock.h>
+#include <isc/task.h>
+#include <isc/time.h>
+#include <isc/timer.h>
+
+#include <dns/acache.h>
+#include <dns/db.h>
+#include <dns/events.h>
+#include <dns/log.h>
+#include <dns/message.h>
+#include <dns/name.h>
+#include <dns/rdataset.h>
+#include <dns/result.h>
+#include <dns/zone.h>
+
+#define ACACHE_MAGIC			ISC_MAGIC('A', 'C', 'H', 'E')
+#define DNS_ACACHE_VALID(acache)	ISC_MAGIC_VALID(acache, ACACHE_MAGIC)
+
+#define ACACHEENTRY_MAGIC		ISC_MAGIC('A', 'C', 'E', 'T')
+#define DNS_ACACHEENTRY_VALID(entry)	ISC_MAGIC_VALID(entry, ACACHEENTRY_MAGIC)
+
+#define DBBUCKETS	67
+
+#if 0
+#define ATRACE(m)       isc_log_write(dns_lctx, \
+				      DNS_LOGCATEGORY_DATABASE, \
+				      DNS_LOGMODULE_ACACHE, \
+				      ISC_LOG_DEBUG(3), \
+				      "acache %p: %s", acache, (m))
+#define AATRACE(a,m)    isc_log_write(dns_lctx, \
+				      DNS_LOGCATEGORY_DATABASE, \
+				      DNS_LOGMODULE_ACACHE, \
+				      ISC_LOG_DEBUG(3), \
+				      "acache %p: %s", (a), (m))
+#else
+#define ATRACE(m)
+#define AATRACE(a, m)
+#endif
+
+/*
+ * The following variables control incremental cleaning.
+ * MINSIZE is how many bytes is the floor for dns_acache_setcachesize().
+ * CLEANERINCREMENT is how many entries are examined in one pass.
+ * (XXX simply derived from definitions in cache.c  There may be better
+ *  constants here.)
+ */
+#define DNS_ACACHE_MINSIZE 		2097152	/* Bytes.  2097152 = 2 MB */
+#define DNS_ACACHE_CLEANERINCREMENT	1000	/* Number of entries. */
+
+#define DEFAULT_ACACHE_ENTRY_LOCK_COUNT	1009	/*%< Should be prime. */
+
+#if defined(ISC_RWLOCK_USEATOMIC) && defined(ISC_PLATFORM_HAVEATOMICSTORE)
+#define ACACHE_USE_RWLOCK 1
+#endif
+
+#ifdef ACACHE_USE_RWLOCK
+#define ACACHE_INITLOCK(l)	isc_rwlock_init((l), 0, 0)
+#define ACACHE_DESTROYLOCK(l)	isc_rwlock_destroy(l)
+#define ACACHE_LOCK(l, t)	RWLOCK((l), (t))
+#define ACACHE_UNLOCK(l, t)	RWUNLOCK((l), (t))
+
+#define acache_storetime(entry, t) \
+	(isc_atomic_store((isc_int32_t *)&(entry)->lastused, (t)))
+#else
+#define ACACHE_INITLOCK(l)	isc_mutex_init(l)
+#define ACACHE_DESTROYLOCK(l)	DESTROYLOCK(l)
+#define ACACHE_LOCK(l, t)	LOCK(l)
+#define ACACHE_UNLOCK(l, t)	UNLOCK(l)
+
+#define acache_storetime(entry, t) ((entry)->lastused = (t))
+#endif
+
+/* Locked by acache lock */
+typedef struct dbentry {
+	ISC_LINK(struct dbentry)	link;
+
+	dns_db_t			*db;
+	ISC_LIST(dns_acacheentry_t)	originlist;
+	ISC_LIST(dns_acacheentry_t)	referlist;
+} dbentry_t;
+
+typedef ISC_LIST(dbentry_t) dbentrylist_t;
+
+typedef struct acache_cleaner acache_cleaner_t;
+
+typedef enum {
+	cleaner_s_idle,	/* Waiting for cleaning-interval to expire. */
+	cleaner_s_busy,	/* Currently cleaning. */
+	cleaner_s_done  /* Freed enough memory after being overmem. */
+} cleaner_state_t;
+
+/*
+ * Convenience macros for comprehensive assertion checking.
+ */
+#define CLEANER_IDLE(c) ((c)->state == cleaner_s_idle && \
+			 (c)->resched_event != NULL)
+#define CLEANER_BUSY(c) ((c)->state == cleaner_s_busy && \
+			 (c)->resched_event == NULL)
+
+struct acache_cleaner {
+	isc_mutex_t		lock;
+	/*
+	 * Locks overmem_event, overmem.  (See cache.c)
+	 */
+
+	dns_acache_t		*acache;
+	unsigned int		cleaning_interval; /* The cleaning-interval
+						      from named.conf,
+						      in seconds. */
+
+	isc_stdtime_t		last_cleanup_time; /* The time when the last
+      						      cleanup task completed */
+
+	isc_timer_t 		*cleaning_timer;
+	isc_event_t		*resched_event;	/* Sent by cleaner task to
+						   itself to reschedule */
+	isc_event_t		*overmem_event;
+
+	dns_acacheentry_t	*current_entry;	/* The bookmark entry to
+						   restart the cleaning.
+						   Locked by acache lock. */
+	int 		 	increment;	/* Number of entries to
+						   clean in one increment */
+
+	unsigned long		ncleaned;	/* Number of entries cleaned
+						   up (for logging purposes) */
+	cleaner_state_t  	state;		/* Idle/Busy/Done. */
+	isc_boolean_t	 	overmem;	/* The acache is in an overmem
+						   state. */
+};
+
+struct dns_acachestats {
+	unsigned int			hits;
+	unsigned int			queries;
+	unsigned int			misses;
+	unsigned int			adds;
+	unsigned int			deleted;
+	unsigned int			cleaned;
+	unsigned int			cleaner_runs;
+	unsigned int			overmem;
+	unsigned int			overmem_nocreates;
+	unsigned int			nomem;
+};
+
+/*
+ * The actual acache object.
+ */
+
+struct dns_acache {
+	unsigned int			magic;
+
+	isc_mem_t			*mctx;
+	isc_refcount_t			refs;
+
+#ifdef ACACHE_USE_RWLOCK
+	isc_rwlock_t 			*entrylocks;
+#else
+	isc_mutex_t 			*entrylocks;
+#endif
+
+	isc_mutex_t			lock;
+
+	int				live_cleaners;
+	acache_cleaner_t		cleaner;
+	ISC_LIST(dns_acacheentry_t)	entries;
+	unsigned int			dbentries;
+	dbentrylist_t			dbbucket[DBBUCKETS];
+
+	isc_boolean_t			shutting_down;
+
+	isc_task_t 			*task;
+	isc_event_t			cevent;
+	isc_boolean_t			cevent_sent;
+
+	dns_acachestats_t		stats;
+};
+
+struct dns_acacheentry {
+	unsigned int 		magic;
+
+	unsigned int		locknum;
+	isc_refcount_t 		references;
+
+	dns_acache_t 		*acache;
+
+	/* Data for Management of cache entries */
+	ISC_LINK(dns_acacheentry_t) link;
+	ISC_LINK(dns_acacheentry_t) olink;
+	ISC_LINK(dns_acacheentry_t) rlink;
+
+	dns_db_t 		*origdb; /* reference to the DB
+					    holding this entry */
+
+	/* Cache data */
+	dns_zone_t 		*zone;		/* zone this entry
+						   belongs to */
+	dns_db_t		*db;   		/* DB this entry belongs to */
+	dns_dbversion_t		*version;	/* the version of the DB */
+	dns_dbnode_t 		*node;		/* node this entry
+						   belongs to */
+	dns_name_t 		*foundname;	/* corresponding DNS name
+						   and rdataset */
+
+	/* Callback function and its argument */
+	void 			(*callback)(dns_acacheentry_t *, void **);
+	void 			*cbarg;
+
+	/* Timestamp of the last time this entry is referred to */
+	isc_stdtime32_t		lastused;
+};
+
+/*
+ *	Internal functions (and prototypes).
+ */
+static inline isc_boolean_t check_noentry(dns_acache_t *acache);
+static void destroy(dns_acache_t *acache);
+static void shutdown_entries(dns_acache_t *acache);
+static void shutdown_buckets(dns_acache_t *acache);
+static void destroy_entry(dns_acacheentry_t *ent);
+static inline void unlink_dbentries(dns_acache_t *acache,
+				    dns_acacheentry_t *ent);
+static inline isc_result_t finddbent(dns_acache_t *acache,
+				     dns_db_t *db, dbentry_t **dbentryp);
+static inline void clear_entry(dns_acache_t *acache, dns_acacheentry_t *entry);
+static isc_result_t acache_cleaner_init(dns_acache_t *acache,
+					isc_timermgr_t *timermgr,
+					acache_cleaner_t *cleaner);
+static void acache_cleaning_timer_action(isc_task_t *task, isc_event_t *event);
+static void acache_incremental_cleaning_action(isc_task_t *task,
+					       isc_event_t *event);
+static void acache_overmem_cleaning_action(isc_task_t *task,
+					   isc_event_t *event);
+static void acache_cleaner_shutdown_action(isc_task_t *task,
+					   isc_event_t *event);
+
+/*
+ * acache should be locked.  If it is not, the stats can get out of whack,
+ * which is not a big deal for us since this is for debugging / stats
+ */
+static void
+reset_stats(dns_acache_t *acache) {
+	acache->stats.hits = 0;
+	acache->stats.queries = 0;
+	acache->stats.misses = 0;
+	acache->stats.adds = 0;
+	acache->stats.deleted = 0;
+	acache->stats.cleaned = 0;
+	acache->stats.overmem = 0;
+	acache->stats.overmem_nocreates = 0;
+	acache->stats.nomem = 0;
+}
+
+/*
+ * The acache must be locked before calling.
+ */
+static inline isc_boolean_t
+check_noentry(dns_acache_t *acache) {
+	if (ISC_LIST_EMPTY(acache->entries) && acache->dbentries == 0) {
+		return (ISC_TRUE);
+	}
+
+	return (ISC_FALSE);
+}
+
+/*
+ * The acache must be locked before calling.
+ */
+static void
+shutdown_entries(dns_acache_t *acache) {
+	dns_acacheentry_t *entry, *entry_next;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	INSIST(acache->shutting_down);
+
+	/*
+	 * Release the dependency of all entries, and detach them.
+	 */
+	for (entry = ISC_LIST_HEAD(acache->entries);
+	     entry != NULL;
+	     entry = entry_next) {
+		entry_next = ISC_LIST_NEXT(entry, link);
+
+		ACACHE_LOCK(&acache->entrylocks[entry->locknum],
+			    isc_rwlocktype_write);
+
+		/*
+		 * If the cleaner holds this entry, it will be unlinked and
+		 * freed in the cleaner later.
+		 */
+		if (acache->cleaner.current_entry != entry)
+			ISC_LIST_UNLINK(acache->entries, entry, link);
+		unlink_dbentries(acache, entry);
+		if (entry->callback != NULL) {
+			(entry->callback)(entry, &entry->cbarg);
+			entry->callback = NULL;
+		}
+
+		ACACHE_UNLOCK(&acache->entrylocks[entry->locknum],
+			      isc_rwlocktype_write);
+
+		if (acache->cleaner.current_entry != entry)
+			dns_acache_detachentry(&entry);
+	}
+}
+
+/*
+ * The acache must be locked before calling.
+ */
+static void
+shutdown_buckets(dns_acache_t *acache) {
+	int i;
+	dbentry_t *dbent;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	INSIST(acache->shutting_down);
+
+	for (i = 0; i < DBBUCKETS; i++) {
+		while ((dbent = ISC_LIST_HEAD(acache->dbbucket[i])) != NULL) {
+			INSIST(ISC_LIST_EMPTY(dbent->originlist) &&
+			       ISC_LIST_EMPTY(dbent->referlist));
+			ISC_LIST_UNLINK(acache->dbbucket[i], dbent, link);
+						
+			dns_db_detach(&dbent->db);
+
+			isc_mem_put(acache->mctx, dbent, sizeof(*dbent));
+				    
+			acache->dbentries--;
+		}
+	}
+
+	INSIST(acache->dbentries == 0);
+}
+
+static void
+shutdown_task(isc_task_t *task, isc_event_t *ev) {
+	dns_acache_t *acache;
+
+	UNUSED(task);
+
+	acache = ev->ev_arg;
+	INSIST(DNS_ACACHE_VALID(acache));
+
+	isc_event_free(&ev);
+
+	LOCK(&acache->lock);
+
+	shutdown_entries(acache);
+	shutdown_buckets(acache);
+
+	UNLOCK(&acache->lock);
+
+	dns_acache_detach(&acache);
+}
+
+/* The acache and the entry must be locked before calling. */
+static inline void
+unlink_dbentries(dns_acache_t *acache, dns_acacheentry_t *ent) {
+	isc_result_t result;
+	dbentry_t *dbent;
+
+	if (ISC_LINK_LINKED(ent, olink)) {
+		INSIST(ent->origdb != NULL);
+		dbent = NULL;
+		result = finddbent(acache, ent->origdb, &dbent);
+		INSIST(result == ISC_R_SUCCESS);
+
+		ISC_LIST_UNLINK(dbent->originlist, ent, olink);
+	}
+	if (ISC_LINK_LINKED(ent, rlink)) {
+		INSIST(ent->db != NULL);
+		dbent = NULL;
+		result = finddbent(acache, ent->db, &dbent);
+		INSIST(result == ISC_R_SUCCESS);
+
+		ISC_LIST_UNLINK(dbent->referlist, ent, rlink);
+	}
+}
+
+/* There must not be a reference to this entry. */
+static void
+destroy_entry(dns_acacheentry_t *entry) {
+	dns_acache_t *acache;
+
+	REQUIRE(DNS_ACACHEENTRY_VALID(entry));
+
+	acache = entry->acache;
+	REQUIRE(DNS_ACACHE_VALID(acache));
+
+	/*
+	 * Since there is no reference to this entry, it is safe to call
+	 * clear_entry() here.
+	 */
+	clear_entry(acache, entry);
+
+	isc_mem_put(acache->mctx, entry, sizeof(*entry));
+
+	dns_acache_detach(&acache);
+}
+
+static void
+destroy(dns_acache_t *acache) {
+	int i;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+
+	ATRACE("destroy");
+
+	isc_mem_setwater(acache->mctx, NULL, NULL, 0, 0);
+
+	if (acache->cleaner.overmem_event != NULL)
+		isc_event_free(&acache->cleaner.overmem_event);
+
+	if (acache->cleaner.resched_event != NULL)
+		isc_event_free(&acache->cleaner.resched_event);
+
+	if (acache->task != NULL)
+		isc_task_detach(&acache->task);
+
+	for (i = 0; i < DEFAULT_ACACHE_ENTRY_LOCK_COUNT; i++)
+		ACACHE_DESTROYLOCK(&acache->entrylocks[i]);
+	isc_mem_put(acache->mctx, acache->entrylocks,
+		    sizeof(*acache->entrylocks) *
+		    DEFAULT_ACACHE_ENTRY_LOCK_COUNT);
+
+	DESTROYLOCK(&acache->cleaner.lock);
+
+	DESTROYLOCK(&acache->lock);
+	acache->magic = 0;
+
+	isc_mem_putanddetach(&acache->mctx, acache, sizeof(*acache));
+}
+
+static inline isc_result_t
+finddbent(dns_acache_t *acache, dns_db_t *db, dbentry_t **dbentryp) {
+	int bucket;
+	dbentry_t *dbentry;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	REQUIRE(db != NULL);
+	REQUIRE(dbentryp != NULL && *dbentryp == NULL);
+
+	/*
+	 * The caller must be holding the acache lock.
+	 */
+
+	bucket = isc_hash_calc((const unsigned char *)&db,
+			       sizeof(db), ISC_TRUE) % DBBUCKETS;
+
+	for (dbentry = ISC_LIST_HEAD(acache->dbbucket[bucket]);
+	     dbentry != NULL;
+	     dbentry = ISC_LIST_NEXT(dbentry, link)) {
+		if (dbentry->db == db)
+			break;
+	}
+
+	*dbentryp = dbentry;
+
+	if (dbentry == NULL)
+		return (ISC_R_NOTFOUND);
+	else
+		return (ISC_R_SUCCESS);
+}
+
+static inline void
+clear_entry(dns_acache_t *acache, dns_acacheentry_t *entry) {
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	REQUIRE(DNS_ACACHEENTRY_VALID(entry));
+
+	/*
+	 * The caller must be holing the entry lock.
+	 */
+
+	if (entry->foundname) {
+		dns_rdataset_t *rdataset, *rdataset_next;
+
+		for (rdataset = ISC_LIST_HEAD(entry->foundname->list);
+		     rdataset != NULL;
+		     rdataset = rdataset_next) {
+			rdataset_next = ISC_LIST_NEXT(rdataset, link);
+			ISC_LIST_UNLINK(entry->foundname->list,
+					rdataset, link);
+			dns_rdataset_disassociate(rdataset);
+			isc_mem_put(acache->mctx, rdataset, sizeof(*rdataset));
+		}
+		if (dns_name_dynamic(entry->foundname))
+			dns_name_free(entry->foundname, acache->mctx);
+		isc_mem_put(acache->mctx, entry->foundname,
+			    sizeof(*entry->foundname)); 
+		entry->foundname = NULL;
+	}
+
+	if (entry->node != NULL) {
+		INSIST(entry->db != NULL);
+		dns_db_detachnode(entry->db, &entry->node);
+	}
+	if (entry->version != NULL) {
+		INSIST(entry->db != NULL);
+		dns_db_closeversion(entry->db, &entry->version, ISC_FALSE);
+	}
+	if (entry->db != NULL)
+		dns_db_detach(&entry->db);
+	if (entry->zone != NULL)
+		dns_zone_detach(&entry->zone);
+
+	if (entry->origdb != NULL)
+		dns_db_detach(&entry->origdb);
+}
+
+static isc_result_t
+acache_cleaner_init(dns_acache_t *acache, isc_timermgr_t *timermgr,
+		    acache_cleaner_t *cleaner)
+{
+	int result;
+
+	ATRACE("acache cleaner init");
+
+	result = isc_mutex_init(&cleaner->lock);
+	if (result != ISC_R_SUCCESS)
+		goto fail;
+
+	cleaner->increment = DNS_ACACHE_CLEANERINCREMENT;
+	cleaner->state = cleaner_s_idle;
+	cleaner->acache = acache;
+	cleaner->overmem = ISC_FALSE;
+
+	cleaner->cleaning_timer = NULL;
+	cleaner->resched_event = NULL;
+	cleaner->overmem_event = NULL;
+	cleaner->current_entry = NULL;
+
+	if (timermgr != NULL) {
+		cleaner->acache->live_cleaners++;
+		
+		result = isc_task_onshutdown(acache->task,
+					     acache_cleaner_shutdown_action,
+					     acache);
+		if (result != ISC_R_SUCCESS) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "acache cleaner: "
+					 "isc_task_onshutdown() failed: %s",
+					 dns_result_totext(result));
+			goto cleanup;
+		}
+
+		cleaner->cleaning_interval = 0; /* Initially turned off. */
+		isc_stdtime_get(&cleaner->last_cleanup_time);
+		result = isc_timer_create(timermgr, isc_timertype_inactive,
+					  NULL, NULL,
+					  acache->task,
+					  acache_cleaning_timer_action,
+					  cleaner, &cleaner->cleaning_timer);
+		if (result != ISC_R_SUCCESS) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "isc_timer_create() failed: %s",
+					 dns_result_totext(result));
+			result = ISC_R_UNEXPECTED;
+			goto cleanup;
+		}
+
+		cleaner->resched_event =
+			isc_event_allocate(acache->mctx, cleaner,
+					   DNS_EVENT_ACACHECLEAN,
+					   acache_incremental_cleaning_action,
+					   cleaner, sizeof(isc_event_t));
+		if (cleaner->resched_event == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto cleanup;
+		}
+
+		cleaner->overmem_event =
+			isc_event_allocate(acache->mctx, cleaner,
+					   DNS_EVENT_ACACHEOVERMEM,
+					   acache_overmem_cleaning_action,
+					   cleaner, sizeof(isc_event_t));
+		if (cleaner->overmem_event == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto cleanup;
+		}
+	}
+
+	return (ISC_R_SUCCESS);
+
+ cleanup:
+	if (cleaner->overmem_event != NULL)
+		isc_event_free(&cleaner->overmem_event);
+	if (cleaner->resched_event != NULL)
+		isc_event_free(&cleaner->resched_event);
+	if (cleaner->cleaning_timer != NULL)
+		isc_timer_detach(&cleaner->cleaning_timer);
+	cleaner->acache->live_cleaners--;
+	DESTROYLOCK(&cleaner->lock);
+ fail:
+	return (result);
+}
+
+static void
+begin_cleaning(acache_cleaner_t *cleaner) {
+	dns_acacheentry_t *head;
+	dns_acache_t *acache = cleaner->acache;
+
+	/*
+	 * This function does not have to lock the cleaner, since critical
+	 * parameters (except current_entry, which is locked by acache lock,)
+	 * are only used in a single task context.
+	 */
+
+	REQUIRE(CLEANER_IDLE(cleaner));
+	INSIST(DNS_ACACHE_VALID(acache));
+	INSIST(cleaner->current_entry == NULL);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_ACACHE, ISC_LOG_DEBUG(1),
+		      "begin acache cleaning, mem inuse %lu",
+		      (unsigned long)isc_mem_inuse(cleaner->acache->mctx));
+
+	LOCK(&acache->lock);
+
+	head = ISC_LIST_HEAD(acache->entries);
+	if (head != NULL)
+		dns_acache_attachentry(head, &cleaner->current_entry);
+
+	UNLOCK(&acache->lock);
+
+	if (cleaner->current_entry != NULL) {
+		cleaner->ncleaned = 0;
+		cleaner->state = cleaner_s_busy;
+		isc_task_send(acache->task, &cleaner->resched_event);
+	}
+
+	return;
+}
+
+static void
+end_cleaning(acache_cleaner_t *cleaner, isc_event_t *event) {
+	dns_acache_t *acache = cleaner->acache;
+
+	REQUIRE(CLEANER_BUSY(cleaner));
+	REQUIRE(event != NULL);
+	REQUIRE(DNS_ACACHEENTRY_VALID(cleaner->current_entry));
+
+	/* No need to lock the cleaner (see begin_cleaning()). */
+
+	LOCK(&acache->lock);
+
+	/*
+	 * Even if the cleaner has the last reference to the entry, which means
+	 * the entry has been unused, it may still be linked if unlinking the
+	 * entry has been delayed due to the reference.
+	 */
+	if (isc_refcount_current(&cleaner->current_entry->references) == 1) {
+		INSIST(cleaner->current_entry->callback == NULL);
+		
+		if (ISC_LINK_LINKED(cleaner->current_entry, link)) {
+			ISC_LIST_UNLINK(acache->entries,
+					cleaner->current_entry, link);
+		}
+	}
+	dns_acache_detachentry(&cleaner->current_entry);
+
+	if (cleaner->overmem)
+		acache->stats.overmem++;
+	acache->stats.cleaned += cleaner->ncleaned;
+	acache->stats.cleaner_runs++;
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_ACACHE,
+		      ISC_LOG_NOTICE,
+		      "acache %p stats: hits=%d misses=%d queries=%d "
+		      "adds=%d deleted=%d "
+		      "cleaned=%d cleaner_runs=%d overmem=%d "
+		      "overmem_nocreates=%d nomem=%d",
+		      acache,
+		      acache->stats.hits, acache->stats.misses,
+		      acache->stats.queries,
+		      acache->stats.adds, acache->stats.deleted,
+		      acache->stats.cleaned, acache->stats.cleaner_runs,
+		      acache->stats.overmem, acache->stats.overmem_nocreates, 
+		      acache->stats.nomem);
+	reset_stats(acache);
+
+	isc_stdtime_get(&cleaner->last_cleanup_time);
+
+	UNLOCK(&acache->lock);
+
+	dns_acache_setcleaninginterval(cleaner->acache,
+				       cleaner->cleaning_interval);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_ACACHE,
+		      ISC_LOG_DEBUG(1), "end acache cleaning, "
+		      "%lu entries cleaned, mem inuse %lu",
+		      cleaner->ncleaned,
+		      (unsigned long)isc_mem_inuse(cleaner->acache->mctx));
+
+	if (cleaner->overmem) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_ACACHE, ISC_LOG_NOTICE,
+			      "acache is still in overmem state "
+			      "after cleaning");
+	}
+
+	cleaner->ncleaned = 0;
+	cleaner->state = cleaner_s_idle;
+	cleaner->resched_event = event;
+}
+
+/*
+ * This is run once for every acache-cleaning-interval as defined
+ * in named.conf.
+ */
+static void
+acache_cleaning_timer_action(isc_task_t *task, isc_event_t *event) {
+	acache_cleaner_t *cleaner = event->ev_arg;
+
+	UNUSED(task);
+
+	INSIST(event->ev_type == ISC_TIMEREVENT_TICK);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_ACACHE,
+		      ISC_LOG_DEBUG(1), "acache cleaning timer fired, "
+		      "cleaner state = %d", cleaner->state);
+
+	if (cleaner->state == cleaner_s_idle)
+		begin_cleaning(cleaner);
+
+	isc_event_free(&event);
+}
+
+/* The caller must hold entry lock. */
+static inline isc_boolean_t
+entry_stale(acache_cleaner_t *cleaner, dns_acacheentry_t *entry,
+	    isc_stdtime32_t now32, unsigned int interval)
+{
+	/*
+	 * If the callback has been canceled, we definitely do not need the
+	 * entry.
+	 */
+	if (entry->callback == NULL)
+		return (ISC_TRUE);
+
+	if (interval > cleaner->cleaning_interval)
+		interval = cleaner->cleaning_interval;
+
+	if (entry->lastused + interval < now32)
+		return (ISC_TRUE);
+
+	/*
+	 * If the acache is in the overmem state, probabilistically decide if
+	 * the entry should be purged, based on the time passed from its last
+	 * use and the cleaning interval.
+	 */
+	if (cleaner->overmem) {
+		unsigned int passed =
+			now32 - entry->lastused; /* <= interval */
+		isc_uint32_t val;
+
+		if (passed > interval / 2)
+			return (ISC_TRUE);
+		isc_random_get(&val);
+		if (passed > interval / 4)
+			return (ISC_TF(val % 4 == 0));
+		return (ISC_TF(val % 8 == 0));
+	}
+
+	return (ISC_FALSE);
+}
+
+/*
+ * Do incremental cleaning.
+ */
+static void
+acache_incremental_cleaning_action(isc_task_t *task, isc_event_t *event) {
+	acache_cleaner_t *cleaner = event->ev_arg;
+	dns_acache_t *acache = cleaner->acache;
+	dns_acacheentry_t *entry, *next = NULL;
+	int n_entries;
+	isc_stdtime32_t now32, last32;
+	isc_stdtime_t now;
+	unsigned int interval;
+
+	INSIST(DNS_ACACHE_VALID(acache));
+	INSIST(task == acache->task);
+	INSIST(event->ev_type == DNS_EVENT_ACACHECLEAN);
+
+	if (cleaner->state == cleaner_s_done) {
+		cleaner->state = cleaner_s_busy;
+		end_cleaning(cleaner, event);
+		return;
+	}
+
+	INSIST(CLEANER_BUSY(cleaner));
+
+	n_entries = cleaner->increment;
+
+	isc_stdtime_get(&now);
+	isc_stdtime_convert32(now, &now32);
+
+	LOCK(&acache->lock);
+
+	entry = cleaner->current_entry;
+	isc_stdtime_convert32(cleaner->last_cleanup_time, &last32);
+	INSIST(now32 > last32);
+	interval = now32 - last32;
+
+	while (n_entries-- > 0) {
+		isc_boolean_t is_stale = ISC_FALSE;
+
+		INSIST(entry != NULL);
+
+		next = ISC_LIST_NEXT(entry, link);
+
+		ACACHE_LOCK(&acache->entrylocks[entry->locknum],
+			    isc_rwlocktype_write);
+
+		is_stale = entry_stale(cleaner, entry, now32, interval);
+		if (is_stale) {
+			ISC_LIST_UNLINK(acache->entries, entry, link);
+			unlink_dbentries(acache, entry);
+			if (entry->callback != NULL)
+				(entry->callback)(entry, &entry->cbarg);
+			entry->callback = NULL;
+
+			cleaner->ncleaned++;
+		}
+
+		ACACHE_UNLOCK(&acache->entrylocks[entry->locknum],
+			      isc_rwlocktype_write);
+
+		if (is_stale)
+			dns_acache_detachentry(&entry);
+
+		if (next == NULL) {
+			if (cleaner->overmem) {
+				entry = ISC_LIST_HEAD(acache->entries);
+				if (entry != NULL) {
+					/*
+					 * If we are still in the overmem
+					 * state, keep cleaning.
+					 */
+					isc_log_write(dns_lctx,
+						      DNS_LOGCATEGORY_DATABASE,
+						      DNS_LOGMODULE_ACACHE,
+						      ISC_LOG_DEBUG(1),
+						      "acache cleaner: "
+						      "still overmem, "
+						      "reset and try again");
+					continue;
+				}
+			}
+
+			UNLOCK(&acache->lock);
+			end_cleaning(cleaner, event);
+			return;
+		}
+
+		entry = next;
+	}
+
+	/*
+	 * We have successfully performed a cleaning increment but have
+	 * not gone through the entire cache.  Remember the entry that will
+	 * be the starting point in the next clean-up, and reschedule another
+	 * batch.  If it fails, just try to continue anyway.
+	 */
+	INSIST(next != NULL && next != cleaner->current_entry);
+	dns_acache_detachentry(&cleaner->current_entry);
+	dns_acache_attachentry(next, &cleaner->current_entry);
+
+	UNLOCK(&acache->lock);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_ACACHE,
+		      ISC_LOG_DEBUG(1), "acache cleaner: checked %d entries, "
+		      "mem inuse %lu, sleeping", cleaner->increment,
+		      (unsigned long)isc_mem_inuse(cleaner->acache->mctx));
+
+	isc_task_send(task, &event);
+	INSIST(CLEANER_BUSY(cleaner));
+
+	return;
+}
+
+/*
+ * This is called when the acache either surpasses its upper limit
+ * or shrinks beyond its lower limit.
+ */
+static void
+acache_overmem_cleaning_action(isc_task_t *task, isc_event_t *event) {
+	acache_cleaner_t *cleaner = event->ev_arg;
+	isc_boolean_t want_cleaning = ISC_FALSE;
+	
+	UNUSED(task);
+
+	INSIST(event->ev_type == DNS_EVENT_ACACHEOVERMEM);
+	INSIST(cleaner->overmem_event == NULL);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_ACACHE,
+		      ISC_LOG_DEBUG(1), "overmem_cleaning_action called, "
+		      "overmem = %d, state = %d", cleaner->overmem,
+		      cleaner->state);
+
+	LOCK(&cleaner->lock);
+
+	if (cleaner->overmem) {
+		if (cleaner->state == cleaner_s_idle)
+			want_cleaning = ISC_TRUE;
+	} else {
+		if (cleaner->state == cleaner_s_busy)
+			/*
+			 * end_cleaning() can't be called here because
+			 * then both cleaner->overmem_event and
+			 * cleaner->resched_event will point to this
+			 * event.  Set the state to done, and then
+			 * when the acache_incremental_cleaning_action() event
+			 * is posted, it will handle the end_cleaning.
+			 */
+			cleaner->state = cleaner_s_done;
+	}
+
+	cleaner->overmem_event = event;
+
+	UNLOCK(&cleaner->lock);
+
+	if (want_cleaning)
+		begin_cleaning(cleaner);
+}
+
+static void
+water(void *arg, int mark) {
+	dns_acache_t *acache = arg;
+	isc_boolean_t overmem = ISC_TF(mark == ISC_MEM_HIWATER);
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_ACACHE, ISC_LOG_DEBUG(1),
+		      "acache memory reaches %s watermark, mem inuse %lu",
+		      overmem ? "high" : "low",
+		      (unsigned long)isc_mem_inuse(acache->mctx));
+
+	LOCK(&acache->cleaner.lock);
+
+	acache->cleaner.overmem = overmem;
+
+	if (acache->cleaner.overmem_event != NULL)
+		isc_task_send(acache->task, &acache->cleaner.overmem_event);
+
+	UNLOCK(&acache->cleaner.lock);
+}
+
+/*
+ * The cleaner task is shutting down; do the necessary cleanup.
+ */
+static void
+acache_cleaner_shutdown_action(isc_task_t *task, isc_event_t *event) {
+	dns_acache_t *acache = event->ev_arg;
+	isc_boolean_t should_free = ISC_FALSE;
+
+	INSIST(task == acache->task);
+	INSIST(event->ev_type == ISC_TASKEVENT_SHUTDOWN);
+	INSIST(DNS_ACACHE_VALID(acache));
+
+	ATRACE("acache cleaner shutdown");
+
+	if (CLEANER_BUSY(&acache->cleaner))
+		end_cleaning(&acache->cleaner, event);
+	else
+		isc_event_free(&event);
+
+	LOCK(&acache->lock);
+
+	acache->live_cleaners--;
+	INSIST(acache->live_cleaners == 0);
+
+	if (isc_refcount_current(&acache->refs) == 0) {
+		INSIST(check_noentry(acache) == ISC_TRUE);
+		should_free = ISC_TRUE;
+	}
+
+	/*
+	 * By detaching the timer in the context of its task,
+	 * we are guaranteed that there will be no further timer
+	 * events.
+	 */
+	if (acache->cleaner.cleaning_timer != NULL)
+		isc_timer_detach(&acache->cleaner.cleaning_timer);
+
+	/* Make sure we don't reschedule anymore. */
+	(void)isc_task_purge(task, NULL, DNS_EVENT_ACACHECLEAN, NULL);
+
+	UNLOCK(&acache->lock);
+
+	if (should_free)
+		destroy(acache);
+}
+
+/*
+ *	Public functions.
+ */
+
+isc_result_t
+dns_acache_create(dns_acache_t **acachep, isc_mem_t *mctx,
+		  isc_taskmgr_t *taskmgr, isc_timermgr_t *timermgr)
+{
+	int i;
+	isc_result_t result;
+	dns_acache_t *acache;
+
+	REQUIRE(acachep != NULL && *acachep == NULL);
+	REQUIRE(mctx != NULL);
+	REQUIRE(taskmgr != NULL);
+
+	acache = isc_mem_get(mctx, sizeof(*acache));
+	if (acache == NULL)
+		return (ISC_R_NOMEMORY);
+
+	ATRACE("create");
+
+	result = isc_refcount_init(&acache->refs, 1);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, acache, sizeof(*acache));
+		return (result);
+	}
+
+	result = isc_mutex_init(&acache->lock);
+	if (result != ISC_R_SUCCESS) {
+		isc_refcount_decrement(&acache->refs, NULL);
+		isc_refcount_destroy(&acache->refs);
+		isc_mem_put(mctx, acache, sizeof(*acache));
+		return (result);
+	}
+
+	acache->mctx = NULL;
+	isc_mem_attach(mctx, &acache->mctx);
+	ISC_LIST_INIT(acache->entries);
+
+	acache->shutting_down = ISC_FALSE;
+
+	acache->task = NULL;
+	acache->entrylocks = NULL;
+
+	result = isc_task_create(taskmgr, 1, &acache->task);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_task_create() failed(): %s",
+				 dns_result_totext(result));
+		result = ISC_R_UNEXPECTED;
+		goto cleanup;
+	}
+	isc_task_setname(acache->task, "acachetask", acache);
+	ISC_EVENT_INIT(&acache->cevent, sizeof(acache->cevent), 0, NULL,
+		       DNS_EVENT_ACACHECONTROL, shutdown_task, NULL,
+		       NULL, NULL, NULL);
+	acache->cevent_sent = ISC_FALSE;
+
+	acache->dbentries = 0;
+	for (i = 0; i < DBBUCKETS; i++)
+		ISC_LIST_INIT(acache->dbbucket[i]);
+
+	acache->entrylocks = isc_mem_get(mctx, sizeof(*acache->entrylocks) *
+					 DEFAULT_ACACHE_ENTRY_LOCK_COUNT);
+	if (acache->entrylocks == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
+	for (i = 0; i < DEFAULT_ACACHE_ENTRY_LOCK_COUNT; i++) {
+		result = ACACHE_INITLOCK(&acache->entrylocks[i]);
+		if (result != ISC_R_SUCCESS) {
+			while (i-- > 0)
+				ACACHE_DESTROYLOCK(&acache->entrylocks[i]);
+			isc_mem_put(mctx, acache->entrylocks,
+				    sizeof(*acache->entrylocks) *
+				    DEFAULT_ACACHE_ENTRY_LOCK_COUNT);
+			acache->entrylocks = NULL;
+			goto cleanup;
+		}
+	}
+
+	acache->live_cleaners = 0;
+	result = acache_cleaner_init(acache, timermgr, &acache->cleaner); 
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	acache->stats.cleaner_runs = 0;
+	reset_stats(acache);
+
+	acache->magic = ACACHE_MAGIC;
+
+	*acachep = acache;
+	return (ISC_R_SUCCESS);
+
+ cleanup:
+	if (acache->task != NULL)
+		isc_task_detach(&acache->task);
+	DESTROYLOCK(&acache->lock);
+	isc_refcount_decrement(&acache->refs, NULL);
+	isc_refcount_destroy(&acache->refs);
+	if (acache->entrylocks != NULL) {
+		for (i = 0; i < DEFAULT_ACACHE_ENTRY_LOCK_COUNT; i++)
+			ACACHE_DESTROYLOCK(&acache->entrylocks[i]);
+		isc_mem_put(mctx, acache->entrylocks,
+			    sizeof(*acache->entrylocks) *
+			    DEFAULT_ACACHE_ENTRY_LOCK_COUNT);
+	}
+	isc_mem_put(mctx, acache, sizeof(*acache));
+	isc_mem_detach(&mctx);
+
+	return (result);
+}
+
+void
+dns_acache_attach(dns_acache_t *source, dns_acache_t **targetp) {
+	REQUIRE(DNS_ACACHE_VALID(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	AATRACE(source, "attach");
+
+	isc_refcount_increment(&source->refs, NULL);
+
+	*targetp = source;
+}
+
+void
+dns_acache_countquerymiss(dns_acache_t *acache) {
+	acache->stats.misses++; 	/* XXXSK danger: unlocked! */
+	acache->stats.queries++;	/* XXXSK danger: unlocked! */
+}
+
+void
+dns_acache_detach(dns_acache_t **acachep) {
+	dns_acache_t *acache;
+	unsigned int refs;
+	isc_boolean_t should_free = ISC_FALSE;
+
+	REQUIRE(acachep != NULL && DNS_ACACHE_VALID(*acachep));
+	acache = *acachep;
+
+	ATRACE("detach");
+
+	isc_refcount_decrement(&acache->refs, &refs);
+	if (refs == 0) {
+		INSIST(check_noentry(acache) == ISC_TRUE);
+		should_free = ISC_TRUE;
+	}
+
+	*acachep = NULL;
+
+	/*
+	 * If we're exiting and the cleaner task exists, let it free the cache.
+	 */
+	if (should_free && acache->live_cleaners > 0) {
+		isc_task_shutdown(acache->task);
+		should_free = ISC_FALSE;
+	}
+	
+	if (should_free)
+		destroy(acache);
+}
+
+void
+dns_acache_shutdown(dns_acache_t *acache) {
+	REQUIRE(DNS_ACACHE_VALID(acache));
+
+	LOCK(&acache->lock);
+
+	ATRACE("shutdown");
+
+	if (!acache->shutting_down) {
+		isc_event_t *event;
+		dns_acache_t *acache_evarg = NULL;
+
+		INSIST(!acache->cevent_sent);
+
+		acache->shutting_down = ISC_TRUE;
+
+		isc_mem_setwater(acache->mctx, NULL, NULL, 0, 0);
+
+		/*
+		 * Self attach the object in order to prevent it from being
+		 * destroyed while waiting for the event.
+		 */
+		dns_acache_attach(acache, &acache_evarg);
+		event = &acache->cevent;
+		event->ev_arg = acache_evarg;
+		isc_task_send(acache->task, &event);
+		acache->cevent_sent = ISC_TRUE;
+	}
+
+	UNLOCK(&acache->lock);
+}
+
+isc_result_t
+dns_acache_setdb(dns_acache_t *acache, dns_db_t *db) {
+	int bucket;
+	dbentry_t *dbentry;
+	isc_result_t result = ISC_R_SUCCESS;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	REQUIRE(db != NULL);
+
+	ATRACE("setdb");
+
+	LOCK(&acache->lock);
+
+	dbentry = NULL;
+	result = finddbent(acache, db, &dbentry);
+	if (result == ISC_R_SUCCESS) {
+		result = ISC_R_EXISTS;
+		goto end;
+	}
+	result = ISC_R_SUCCESS;
+
+	dbentry = isc_mem_get(acache->mctx, sizeof(*dbentry));
+	if (dbentry == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto end;
+	}
+
+	ISC_LINK_INIT(dbentry, link);
+	ISC_LIST_INIT(dbentry->originlist);
+	ISC_LIST_INIT(dbentry->referlist);
+
+	dbentry->db = NULL;
+	dns_db_attach(db, &dbentry->db);
+
+	bucket = isc_hash_calc((const unsigned char *)&db,
+			       sizeof(db), ISC_TRUE) % DBBUCKETS;
+
+	ISC_LIST_APPEND(acache->dbbucket[bucket], dbentry, link);
+
+	acache->dbentries++;
+
+ end:
+	UNLOCK(&acache->lock);
+
+	return (result);
+}
+
+isc_result_t
+dns_acache_putdb(dns_acache_t *acache, dns_db_t *db) {
+	int bucket;
+	isc_result_t result;
+	dbentry_t *dbentry;
+	dns_acacheentry_t *entry;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	REQUIRE(db != NULL);
+
+	ATRACE("putdb");
+
+	LOCK(&acache->lock);
+
+	dbentry = NULL;
+	result = finddbent(acache, db, &dbentry);
+	if (result != ISC_R_SUCCESS) {
+		/*
+		 * The entry may have not been created due to memory shortage.
+		 */
+		UNLOCK(&acache->lock);
+		return (ISC_R_NOTFOUND);
+	}
+
+	/*
+	 * Release corresponding cache entries: for each entry, release all
+	 * links the entry has, and then callback to the entry holder (if any).
+	 * If no other external references exist (this can happen if the
+	 * original holder has canceled callback,) destroy it here.
+	 */
+	while ((entry = ISC_LIST_HEAD(dbentry->originlist)) != NULL) {
+		ACACHE_LOCK(&acache->entrylocks[entry->locknum],
+			    isc_rwlocktype_write);
+
+		/*
+		 * Releasing olink first would avoid finddbent() in
+		 * unlink_dbentries().
+		 */
+		ISC_LIST_UNLINK(dbentry->originlist, entry, olink);
+		if (acache->cleaner.current_entry != entry)
+			ISC_LIST_UNLINK(acache->entries, entry, link);
+		unlink_dbentries(acache, entry);
+
+		if (entry->callback != NULL)
+			(entry->callback)(entry, &entry->cbarg);
+		entry->callback = NULL;
+
+		ACACHE_UNLOCK(&acache->entrylocks[entry->locknum],
+			      isc_rwlocktype_write);
+
+		if (acache->cleaner.current_entry != entry)
+			dns_acache_detachentry(&entry);
+	}
+	while ((entry = ISC_LIST_HEAD(dbentry->referlist)) != NULL) {
+		ACACHE_LOCK(&acache->entrylocks[entry->locknum],
+			    isc_rwlocktype_write);
+
+		ISC_LIST_UNLINK(dbentry->referlist, entry, rlink);
+		if (acache->cleaner.current_entry != entry)
+			ISC_LIST_UNLINK(acache->entries, entry, link);
+		unlink_dbentries(acache, entry);
+
+		if (entry->callback != NULL)
+			(entry->callback)(entry, &entry->cbarg);
+		entry->callback = NULL;
+
+		ACACHE_UNLOCK(&acache->entrylocks[entry->locknum],
+			      isc_rwlocktype_write);
+
+		if (acache->cleaner.current_entry != entry)
+			dns_acache_detachentry(&entry);
+	}
+
+	INSIST(ISC_LIST_EMPTY(dbentry->originlist) &&
+	       ISC_LIST_EMPTY(dbentry->referlist));
+
+	bucket = isc_hash_calc((const unsigned char *)&db,
+			       sizeof(db), ISC_TRUE) % DBBUCKETS;
+	ISC_LIST_UNLINK(acache->dbbucket[bucket], dbentry, link);
+	dns_db_detach(&dbentry->db);
+
+	isc_mem_put(acache->mctx, dbentry, sizeof(*dbentry));
+
+	acache->dbentries--;
+
+	acache->stats.deleted++;
+
+	UNLOCK(&acache->lock);
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_acache_createentry(dns_acache_t *acache, dns_db_t *origdb,
+		       void (*callback)(dns_acacheentry_t *, void **),
+		       void *cbarg, dns_acacheentry_t **entryp)
+{
+	dns_acacheentry_t *newentry;
+	isc_result_t result;
+	isc_uint32_t r;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	REQUIRE(entryp != NULL && *entryp == NULL);
+	REQUIRE(origdb != NULL);
+
+	/* 
+	 * Should we exceed our memory limit for some reason (for 
+	 * example, if the cleaner does not run aggressively enough), 
+	 * then we will not create additional entries.
+	 *
+	 * XXXSK: It might be better to lock the acache->cleaner->lock,
+	 * but locking may be an expensive bottleneck. If we misread 
+	 * the value, we will occasionally refuse to create a few 
+	 * cache entries, or create a few that we should not. I do not
+	 * expect this to happen often, and it will not have very bad
+	 * effects when it does. So no lock for now.
+	 */
+	if (acache->cleaner.overmem) {
+		acache->stats.overmem_nocreates++; /* XXXSK danger: unlocked! */
+		return (ISC_R_NORESOURCES);
+	}
+
+	newentry = isc_mem_get(acache->mctx, sizeof(*newentry));
+	if (newentry == NULL) {
+		acache->stats.nomem++;  /* XXXMLG danger: unlocked! */
+		return (ISC_R_NOMEMORY);
+	}
+
+	isc_random_get(&r);
+	newentry->locknum = r % DEFAULT_ACACHE_ENTRY_LOCK_COUNT;
+	
+	result = isc_refcount_init(&newentry->references, 1);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(acache->mctx, newentry, sizeof(*newentry));
+		return (result);
+	};
+
+	ISC_LINK_INIT(newentry, link);
+	ISC_LINK_INIT(newentry, olink);
+	ISC_LINK_INIT(newentry, rlink);
+
+	newentry->acache = NULL;
+	dns_acache_attach(acache, &newentry->acache);
+
+	newentry->zone = NULL;
+	newentry->db = NULL;
+	newentry->version = NULL;
+	newentry->node = NULL;
+	newentry->foundname = NULL;
+
+	newentry->callback = callback;
+	newentry->cbarg = cbarg;
+	newentry->origdb = NULL;
+	dns_db_attach(origdb, &newentry->origdb);
+
+	isc_stdtime_get(&newentry->lastused);
+
+	newentry->magic = ACACHEENTRY_MAGIC;
+
+	*entryp = newentry;
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_acache_getentry(dns_acacheentry_t *entry, dns_zone_t **zonep,
+		    dns_db_t **dbp, dns_dbversion_t **versionp,
+		    dns_dbnode_t **nodep, dns_name_t *fname,
+		    dns_message_t *msg, isc_stdtime_t now)
+{
+	isc_result_t result = ISC_R_SUCCESS;
+	dns_rdataset_t *erdataset;
+	isc_stdtime32_t	now32;
+	dns_acache_t *acache;
+	int locknum;
+
+	REQUIRE(DNS_ACACHEENTRY_VALID(entry));
+	REQUIRE(zonep == NULL || *zonep == NULL);
+	REQUIRE(dbp != NULL && *dbp == NULL);
+	REQUIRE(versionp != NULL && *versionp == NULL);
+	REQUIRE(nodep != NULL && *nodep == NULL);
+	REQUIRE(fname != NULL);
+	REQUIRE(msg != NULL);
+	acache = entry->acache;
+	REQUIRE(DNS_ACACHE_VALID(acache));
+
+	locknum = entry->locknum;
+	ACACHE_LOCK(&acache->entrylocks[locknum], isc_rwlocktype_read);
+
+	isc_stdtime_convert32(now, &now32);
+	acache_storetime(entry, now32);
+
+	if (entry->zone != NULL && zonep != NULL)
+		dns_zone_attach(entry->zone, zonep);
+
+	if (entry->db == NULL) {
+		*dbp = NULL;
+		*versionp = NULL;
+	} else {
+		dns_db_attach(entry->db, dbp);
+		dns_db_attachversion(entry->db, entry->version, versionp);
+	}
+	if (entry->node == NULL)
+		*nodep = NULL;
+	else {
+		dns_db_attachnode(entry->db, entry->node, nodep);
+
+		INSIST(entry->foundname != NULL);
+		dns_name_copy(entry->foundname, fname, NULL);
+		for (erdataset = ISC_LIST_HEAD(entry->foundname->list);
+		     erdataset != NULL;
+		     erdataset = ISC_LIST_NEXT(erdataset, link)) {
+			dns_rdataset_t *ardataset;
+
+			ardataset = NULL;
+			result = dns_message_gettemprdataset(msg, &ardataset);
+			if (result != ISC_R_SUCCESS) {
+				ACACHE_UNLOCK(&acache->entrylocks[locknum],
+					      isc_rwlocktype_read);
+				goto fail;
+			}
+
+			/*
+			 * XXXJT: if we simply clone the rdataset, we'll get
+			 * lost wrt cyclic ordering.  We'll need an additional
+			 * trick to get the latest counter from the original
+			 * header.
+			 */
+			dns_rdataset_init(ardataset);
+			dns_rdataset_clone(erdataset, ardataset);
+			ISC_LIST_APPEND(fname->list, ardataset, link);
+		}
+	}
+
+	entry->acache->stats.hits++; /* XXXMLG danger: unlocked! */
+	entry->acache->stats.queries++;
+
+	ACACHE_UNLOCK(&acache->entrylocks[locknum], isc_rwlocktype_read);
+
+	return (result);
+
+  fail:
+	while ((erdataset = ISC_LIST_HEAD(fname->list)) != NULL) {
+		ISC_LIST_UNLINK(fname->list, erdataset, link);
+		dns_rdataset_disassociate(erdataset);
+		dns_message_puttemprdataset(msg, &erdataset);
+	}
+	if (*nodep != NULL)
+		dns_db_detachnode(*dbp, nodep);
+	if (*versionp != NULL)
+		dns_db_closeversion(*dbp, versionp, ISC_FALSE);
+	if (*dbp != NULL)
+		dns_db_detach(dbp);
+	if (zonep != NULL && *zonep != NULL)
+		dns_zone_detach(zonep);
+
+	return (result);
+}
+
+isc_result_t
+dns_acache_setentry(dns_acache_t *acache, dns_acacheentry_t *entry,
+		    dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version,
+		    dns_dbnode_t *node, dns_name_t *fname)
+{
+	isc_result_t result;
+	dbentry_t *odbent;
+	dbentry_t *rdbent = NULL;
+	isc_boolean_t close_version = ISC_FALSE;
+	dns_acacheentry_t *dummy_entry = NULL;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+	REQUIRE(DNS_ACACHEENTRY_VALID(entry));
+
+	LOCK(&acache->lock);	/* XXX: need to lock it here for ordering */
+	ACACHE_LOCK(&acache->entrylocks[entry->locknum], isc_rwlocktype_write);
+
+	/* Set zone */
+	if (zone != NULL)
+		dns_zone_attach(zone, &entry->zone);
+	/* Set DB */
+	if (db != NULL)
+		dns_db_attach(db, &entry->db);
+	/*
+	 * Set DB version.  If the version is not given by the caller,
+	 * which is the case for glue or cache DBs, use the current version.
+	 */
+	if (version == NULL) {
+		if (db != NULL) {
+			dns_db_currentversion(db, &version);
+			close_version = ISC_TRUE;
+		}
+	}
+	if (version != NULL) {
+		INSIST(db != NULL);
+		dns_db_attachversion(db, version, &entry->version);
+	}
+	if (close_version)
+		dns_db_closeversion(db, &version, ISC_FALSE);
+	/* Set DB node. */
+	if (node != NULL) {
+		INSIST(db != NULL);
+		dns_db_attachnode(db, node, &entry->node);
+	}
+
+	/*
+	 * Set list of the corresponding rdatasets, if given.
+	 * To minimize the overhead and memory consumption, we'll do this for
+	 * positive cache only, in which case the DB node is non NULL.
+	 * We do not want to cache incomplete information, so give up the
+	 * entire entry when a memory shortage happen during the process.
+	 */
+	if (node != NULL) {
+		dns_rdataset_t *ardataset, *crdataset;
+
+		entry->foundname = isc_mem_get(acache->mctx,
+					       sizeof(*entry->foundname));
+
+		if (entry->foundname == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto fail;
+		}
+		dns_name_init(entry->foundname, NULL);
+		result = dns_name_dup(fname, acache->mctx,
+				      entry->foundname);
+		if (result != ISC_R_SUCCESS)
+			goto fail;
+
+		for (ardataset = ISC_LIST_HEAD(fname->list);
+		     ardataset != NULL;
+		     ardataset = ISC_LIST_NEXT(ardataset, link)) {
+			crdataset = isc_mem_get(acache->mctx,
+						sizeof(*crdataset));
+			if (crdataset == NULL) {
+				result = ISC_R_NOMEMORY;
+				goto fail;
+			}
+
+			dns_rdataset_init(crdataset);
+			dns_rdataset_clone(ardataset, crdataset);
+			ISC_LIST_APPEND(entry->foundname->list, crdataset,
+					link);
+		}
+	}
+
+	odbent = NULL;
+	result = finddbent(acache, entry->origdb, &odbent);
+	if (result != ISC_R_SUCCESS)
+		goto fail;
+	if (db != NULL) {
+		rdbent = NULL;
+		result = finddbent(acache, db, &rdbent);
+		if (result != ISC_R_SUCCESS)
+			goto fail;
+	}
+
+	ISC_LIST_APPEND(acache->entries, entry, link);
+	ISC_LIST_APPEND(odbent->originlist, entry, olink);
+	if (rdbent != NULL)
+		ISC_LIST_APPEND(rdbent->referlist, entry, rlink);
+
+	/*
+	 * The additional cache needs an implicit reference to entries in its
+	 * link.
+	 */
+	dns_acache_attachentry(entry, &dummy_entry);
+
+	ACACHE_UNLOCK(&acache->entrylocks[entry->locknum],
+		      isc_rwlocktype_write);
+
+	acache->stats.adds++;
+	UNLOCK(&acache->lock);
+
+	return (ISC_R_SUCCESS);
+
+ fail:
+	clear_entry(acache, entry);
+
+	ACACHE_UNLOCK(&acache->entrylocks[entry->locknum],
+		      isc_rwlocktype_write);
+	UNLOCK(&acache->lock);
+
+	return (result);
+}
+
+void
+dns_acache_cancelentry(dns_acacheentry_t *entry) {
+	dns_acache_t *acache = entry->acache;
+
+	REQUIRE(DNS_ACACHEENTRY_VALID(entry));
+	INSIST(DNS_ACACHE_VALID(acache));
+
+	LOCK(&acache->lock);
+	ACACHE_LOCK(&acache->entrylocks[entry->locknum], isc_rwlocktype_write);
+
+	/*
+	 * Release dependencies stored in this entry as much as possible.
+	 * The main link cannot be released, since the acache object has
+	 * a reference to this entry; the empty entry will be released in
+	 * the next cleaning action.
+	 */
+	unlink_dbentries(acache, entry);
+	clear_entry(entry->acache, entry);
+
+	entry->callback = NULL;
+	entry->cbarg = NULL;
+
+	ACACHE_UNLOCK(&acache->entrylocks[entry->locknum],
+		      isc_rwlocktype_write);
+	UNLOCK(&acache->lock);
+}
+
+void
+dns_acache_attachentry(dns_acacheentry_t *source,
+		       dns_acacheentry_t **targetp)
+{
+	REQUIRE(DNS_ACACHEENTRY_VALID(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	isc_refcount_increment(&source->references, NULL);
+
+	*targetp = source;
+}
+
+void
+dns_acache_detachentry(dns_acacheentry_t **entryp) {
+	dns_acacheentry_t *entry;
+	unsigned int refs;
+
+	REQUIRE(entryp != NULL && DNS_ACACHEENTRY_VALID(*entryp));
+	entry = *entryp;
+
+	isc_refcount_decrement(&entry->references, &refs);
+
+	/*
+	 * If there are no references to the entry, the entry must have been
+	 * unlinked and can be destroyed safely.
+	 */
+	if (refs == 0) {
+		INSIST(!ISC_LINK_LINKED(entry, link));
+		(*entryp)->acache->stats.deleted++;
+		destroy_entry(entry);
+	}
+
+	*entryp = NULL;
+}
+
+void
+dns_acache_setcleaninginterval(dns_acache_t *acache, unsigned int t) {
+	isc_interval_t interval;
+	isc_result_t result;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+
+	ATRACE("dns_acache_setcleaninginterval");
+
+	LOCK(&acache->lock);
+
+	/*
+	 * It may be the case that the acache has already shut down.
+	 * If so, it has no timer.  (Not sure if this can really happen.)
+	 */
+	if (acache->cleaner.cleaning_timer == NULL)
+		goto unlock;
+
+	acache->cleaner.cleaning_interval = t;
+
+	if (t == 0) {
+		result = isc_timer_reset(acache->cleaner.cleaning_timer,
+					 isc_timertype_inactive,
+					 NULL, NULL, ISC_TRUE);
+	} else {
+		isc_interval_set(&interval, acache->cleaner.cleaning_interval,
+				 0);
+		result = isc_timer_reset(acache->cleaner.cleaning_timer,
+					 isc_timertype_ticker,
+					 NULL, &interval, ISC_FALSE);
+	}
+	if (result != ISC_R_SUCCESS)	
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_ACACHE, ISC_LOG_WARNING,
+			      "could not set acache cleaning interval: %s",
+			      isc_result_totext(result));
+	else
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_ACACHE, ISC_LOG_NOTICE,
+			      "acache %p cleaning interval set to %d.",
+			      acache, t);
+
+ unlock:
+	UNLOCK(&acache->lock);
+}
+
+/*
+ * This function was derived from cache.c:dns_cache_setcachesize().  See the
+ * function for more details about the logic.
+ */
+void
+dns_acache_setcachesize(dns_acache_t *acache, isc_uint32_t size) {
+	isc_uint32_t lowater;
+	isc_uint32_t hiwater;
+
+	REQUIRE(DNS_ACACHE_VALID(acache));
+
+	if (size != 0 && size < DNS_ACACHE_MINSIZE)
+		size = DNS_ACACHE_MINSIZE;
+
+	hiwater = size - (size >> 3);
+	lowater = size - (size >> 2);
+
+	if (size == 0 || hiwater == 0 || lowater == 0)
+		isc_mem_setwater(acache->mctx, water, acache, 0, 0);
+	else
+		isc_mem_setwater(acache->mctx, water, acache,
+				 hiwater, lowater);
+}
diff --git a/contrib/bind9/lib/dns/acl.c b/contrib/bind9/lib/dns/acl.c
index e81d5ef..844c132 100644
--- a/contrib/bind9/lib/dns/acl.c
+++ b/contrib/bind9/lib/dns/acl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: acl.c,v 1.23.52.6 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: acl.c,v 1.25.18.5 2006/03/02 00:37:21 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -41,7 +43,11 @@ dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target) {
 		return (ISC_R_NOMEMORY);
 	acl->mctx = mctx;
 	acl->name = NULL;
-	isc_refcount_init(&acl->refcount, 1);
+	result = isc_refcount_init(&acl->refcount, 1);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, acl, sizeof(*acl));
+		return (result);
+	}
 	acl->elements = NULL;
 	acl->alloc = 0;
 	acl->length = 0;
diff --git a/contrib/bind9/lib/dns/adb.c b/contrib/bind9/lib/dns/adb.c
index 3fe436a..714df96 100644
--- a/contrib/bind9/lib/dns/adb.c
+++ b/contrib/bind9/lib/dns/adb.c
@@ -15,19 +15,18 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: adb.c,v 1.181.2.11.2.26 2006/01/04 23:50:20 marka Exp $ */
+/* $Id: adb.c,v 1.215.18.13 2006/08/30 23:49:57 marka Exp $ */
 
-/*
- * Implementation notes
- * --------------------
+/*! \file 
  *
+ * \note
  * In finds, if task == NULL, no events will be generated, and no events
  * have been sent.  If task != NULL but taskaction == NULL, an event has been
  * posted but not yet freed.  If neither are NULL, no event was posted.
  *
  */
 
-/*
+/*%
  * After we have cleaned all buckets, dump the database contents.
  */
 #if 0
@@ -53,6 +52,7 @@
 #include <dns/rdata.h>
 #include <dns/rdataset.h>
 #include <dns/rdatastruct.h>
+#include <dns/rdatatype.h>
 #include <dns/resolver.h>
 #include <dns/result.h>
 
@@ -62,8 +62,8 @@
 #define DNS_ADBNAME_VALID(x)	  ISC_MAGIC_VALID(x, DNS_ADBNAME_MAGIC)
 #define DNS_ADBNAMEHOOK_MAGIC	  ISC_MAGIC('a', 'd', 'N', 'H')
 #define DNS_ADBNAMEHOOK_VALID(x)  ISC_MAGIC_VALID(x, DNS_ADBNAMEHOOK_MAGIC)
-#define DNS_ADBZONEINFO_MAGIC	  ISC_MAGIC('a', 'd', 'b', 'Z')
-#define DNS_ADBZONEINFO_VALID(x)  ISC_MAGIC_VALID(x, DNS_ADBZONEINFO_MAGIC)
+#define DNS_ADBLAMEINFO_MAGIC	  ISC_MAGIC('a', 'd', 'b', 'Z')
+#define DNS_ADBLAMEINFO_VALID(x)  ISC_MAGIC_VALID(x, DNS_ADBLAMEINFO_MAGIC)
 #define DNS_ADBENTRY_MAGIC	  ISC_MAGIC('a', 'd', 'b', 'E')
 #define DNS_ADBENTRY_VALID(x)	  ISC_MAGIC_VALID(x, DNS_ADBENTRY_MAGIC)
 #define DNS_ADBFETCH_MAGIC	  ISC_MAGIC('a', 'd', 'F', '4')
@@ -71,51 +71,54 @@
 #define DNS_ADBFETCH6_MAGIC	  ISC_MAGIC('a', 'd', 'F', '6')
 #define DNS_ADBFETCH6_VALID(x)	  ISC_MAGIC_VALID(x, DNS_ADBFETCH6_MAGIC)
 
-/*
+/*! 
  * The number of buckets needs to be a prime (for good hashing).
  *
  * XXXRTH  How many buckets do we need?
  */
-#define NBUCKETS	       1009	/* how many buckets for names/addrs */
+#define NBUCKETS	       1009	/*%< how many buckets for names/addrs */
 
-/*
+/*!
  * For type 3 negative cache entries, we will remember that the address is
  * broken for this long.  XXXMLG This is also used for actual addresses, too.
  * The intent is to keep us from constantly asking about A/AAAA records
  * if the zone has extremely low TTLs.
  */
-#define ADB_CACHE_MINIMUM	10	/* seconds */
-#define ADB_CACHE_MAXIMUM	86400	/* seconds (86400 = 24 hours) */
-#define ADB_ENTRY_WINDOW	1800	/* seconds */
+#define ADB_CACHE_MINIMUM	10	/*%< seconds */
+#define ADB_CACHE_MAXIMUM	86400	/*%< seconds (86400 = 24 hours) */
+#define ADB_ENTRY_WINDOW	1800	/*%< seconds */
 
-/*
+/*%
  * Wake up every CLEAN_SECONDS and clean CLEAN_BUCKETS buckets, so that all
  * buckets are cleaned in CLEAN_PERIOD seconds.
  */
 #define CLEAN_PERIOD		3600
+/*% See #CLEAN_PERIOD */
 #define CLEAN_SECONDS		30
+/*% See #CLEAN_PERIOD */
 #define CLEAN_BUCKETS		((NBUCKETS * CLEAN_SECONDS) / CLEAN_PERIOD)
 
-#define FREE_ITEMS		64	/* free count for memory pools */
-#define FILL_COUNT		16	/* fill count for memory pools */
+#define FREE_ITEMS		64	/*%< free count for memory pools */
+#define FILL_COUNT		16	/*%< fill count for memory pools */
 
-#define DNS_ADB_INVALIDBUCKET (-1)	/* invalid bucket address */
+#define DNS_ADB_INVALIDBUCKET (-1)	/*%< invalid bucket address */
 
-#define DNS_ADB_MINADBSIZE	(1024*1024)	/* 1 Megabyte */
+#define DNS_ADB_MINADBSIZE	(1024*1024)	/*%< 1 Megabyte */
 
 typedef ISC_LIST(dns_adbname_t) dns_adbnamelist_t;
 typedef struct dns_adbnamehook dns_adbnamehook_t;
 typedef ISC_LIST(dns_adbnamehook_t) dns_adbnamehooklist_t;
-typedef struct dns_adbzoneinfo dns_adbzoneinfo_t;
+typedef struct dns_adblameinfo dns_adblameinfo_t;
 typedef ISC_LIST(dns_adbentry_t) dns_adbentrylist_t;
 typedef struct dns_adbfetch dns_adbfetch_t;
 typedef struct dns_adbfetch6 dns_adbfetch6_t;
 
+/*% dns adb structure */
 struct dns_adb {
 	unsigned int			magic;
 
 	isc_mutex_t			lock;
-	isc_mutex_t			reflock; /* Covers irefcnt, erefcnt */
+	isc_mutex_t			reflock; /*%< Covers irefcnt, erefcnt */
 	isc_mem_t		       *mctx;
 	dns_view_t		       *view;
 	isc_timermgr_t		       *timermgr;
@@ -131,32 +134,35 @@ struct dns_adb {
 	unsigned int			erefcnt;
 
 	isc_mutex_t			mplock;
-	isc_mempool_t		       *nmp;	/* dns_adbname_t */
-	isc_mempool_t		       *nhmp;	/* dns_adbnamehook_t */
-	isc_mempool_t		       *zimp;	/* dns_adbzoneinfo_t */
-	isc_mempool_t		       *emp;	/* dns_adbentry_t */
-	isc_mempool_t		       *ahmp;	/* dns_adbfind_t */
-	isc_mempool_t		       *aimp;	/* dns_adbaddrinfo_t */
-	isc_mempool_t		       *afmp;	/* dns_adbfetch_t */
-
-	/*
+	isc_mempool_t		       *nmp;	/*%< dns_adbname_t */
+	isc_mempool_t		       *nhmp;	/*%< dns_adbnamehook_t */
+	isc_mempool_t		       *limp;	/*%< dns_adblameinfo_t */
+	isc_mempool_t		       *emp;	/*%< dns_adbentry_t */
+	isc_mempool_t		       *ahmp;	/*%< dns_adbfind_t */
+	isc_mempool_t		       *aimp;	/*%< dns_adbaddrinfo_t */
+	isc_mempool_t		       *afmp;	/*%< dns_adbfetch_t */
+
+	/*!
 	 * Bucketized locks and lists for names.
 	 *
 	 * XXXRTH  Have a per-bucket structure that contains all of these?
 	 */
 	dns_adbnamelist_t		names[NBUCKETS];
+	/*% See dns_adbnamelist_t */
 	isc_mutex_t			namelocks[NBUCKETS];
+	/*% See dns_adbnamelist_t */
 	isc_boolean_t			name_sd[NBUCKETS];
+	/*% See dns_adbnamelist_t */
 	unsigned int			name_refcnt[NBUCKETS];
 
-	/*
+	/*!
 	 * Bucketized locks for entries.
 	 *
 	 * XXXRTH  Have a per-bucket structure that contains all of these?
 	 */
 	dns_adbentrylist_t		entries[NBUCKETS];
 	isc_mutex_t			entrylocks[NBUCKETS];
-	isc_boolean_t			entry_sd[NBUCKETS]; /* shutting down */
+	isc_boolean_t			entry_sd[NBUCKETS]; /*%< shutting down */
 	unsigned int			entry_refcnt[NBUCKETS];
 
 	isc_event_t			cevent;
@@ -169,6 +175,7 @@ struct dns_adb {
  * XXXMLG  Document these structures.
  */
 
+/*% dns_adbname structure */
 struct dns_adbname {
 	unsigned int			magic;
 	dns_name_t			name;
@@ -191,6 +198,7 @@ struct dns_adbname {
 	ISC_LINK(dns_adbname_t)		plink;
 };
 
+/*% The adbfetch structure */
 struct dns_adbfetch {
 	unsigned int			magic;
 	dns_adbnamehook_t	       *namehook;
@@ -199,9 +207,7 @@ struct dns_adbfetch {
 	dns_rdataset_t			rdataset;
 };
 
-/*
- * dns_adbnamehook_t
- *
+/*%
  * This is a small widget that dangles off a dns_adbname_t.  It contains a
  * pointer to the address information about this host, and a link to the next
  * namehook that will contain the next address this host has.
@@ -212,23 +218,22 @@ struct dns_adbnamehook {
 	ISC_LINK(dns_adbnamehook_t)	plink;
 };
 
-/*
- * dns_adbzoneinfo_t
- *
- * This is a small widget that holds zone-specific information about an
+/*%
+ * This is a small widget that holds qname-specific information about an
  * address.  Currently limited to lameness, but could just as easily be
  * extended to other types of information about zones.
  */
-struct dns_adbzoneinfo {
+struct dns_adblameinfo {
 	unsigned int			magic;
 
-	dns_name_t			zone;
+	dns_name_t			qname;
+	dns_rdatatype_t			qtype;
 	isc_stdtime_t			lame_timer;
 
-	ISC_LINK(dns_adbzoneinfo_t)	plink;
+	ISC_LINK(dns_adblameinfo_t)	plink;
 };
 
-/*
+/*%
  * An address entry.  It holds quite a bit of information about addresses,
  * including edns state (in "flags"), rtt, and of course the address of
  * the host.
@@ -244,7 +249,7 @@ struct dns_adbentry {
 	isc_sockaddr_t			sockaddr;
 
 	isc_stdtime_t			expires;
-	/*
+	/*%<
 	 * A nonzero 'expires' field indicates that the entry should
 	 * persist until that time.  This allows entries found
 	 * using dns_adb_findaddrinfo() to persist for a limited time
@@ -252,7 +257,7 @@ struct dns_adbentry {
 	 * name.
 	 */
 
-	ISC_LIST(dns_adbzoneinfo_t)	zoneinfo;
+	ISC_LIST(dns_adblameinfo_t)	lameinfo;
 	ISC_LINK(dns_adbentry_t)	plink;
 };
 
@@ -264,8 +269,9 @@ static inline void free_adbname(dns_adb_t *, dns_adbname_t **);
 static inline dns_adbnamehook_t *new_adbnamehook(dns_adb_t *,
 						 dns_adbentry_t *);
 static inline void free_adbnamehook(dns_adb_t *, dns_adbnamehook_t **);
-static inline dns_adbzoneinfo_t *new_adbzoneinfo(dns_adb_t *, dns_name_t *);
-static inline void free_adbzoneinfo(dns_adb_t *, dns_adbzoneinfo_t **);
+static inline dns_adblameinfo_t *new_adblameinfo(dns_adb_t *, dns_name_t *,
+						 dns_rdatatype_t);
+static inline void free_adblameinfo(dns_adb_t *, dns_adblameinfo_t **);
 static inline dns_adbentry_t *new_adbentry(dns_adb_t *);
 static inline void free_adbentry(dns_adb_t *, dns_adbentry_t **);
 static inline dns_adbfind_t *new_adbfind(dns_adb_t *);
@@ -1321,42 +1327,42 @@ free_adbnamehook(dns_adb_t *adb, dns_adbnamehook_t **namehook) {
 	isc_mempool_put(adb->nhmp, nh);
 }
 
-static inline dns_adbzoneinfo_t *
-new_adbzoneinfo(dns_adb_t *adb, dns_name_t *zone) {
-	dns_adbzoneinfo_t *zi;
+static inline dns_adblameinfo_t *
+new_adblameinfo(dns_adb_t *adb, dns_name_t *qname, dns_rdatatype_t qtype) {
+	dns_adblameinfo_t *li;
 
-	zi = isc_mempool_get(adb->zimp);
-	if (zi == NULL)
+	li = isc_mempool_get(adb->limp);
+	if (li == NULL)
 		return (NULL);
 
-	dns_name_init(&zi->zone, NULL);
-	if (dns_name_dup(zone, adb->mctx, &zi->zone) != ISC_R_SUCCESS) {
-		isc_mempool_put(adb->zimp, zi);
+	dns_name_init(&li->qname, NULL);
+	if (dns_name_dup(qname, adb->mctx, &li->qname) != ISC_R_SUCCESS) {
+		isc_mempool_put(adb->limp, li);
 		return (NULL);
 	}
+	li->magic = DNS_ADBLAMEINFO_MAGIC;
+	li->lame_timer = 0;
+	li->qtype = qtype;
+	ISC_LINK_INIT(li, plink);
 
-	zi->magic = DNS_ADBZONEINFO_MAGIC;
-	zi->lame_timer = 0;
-	ISC_LINK_INIT(zi, plink);
-
-	return (zi);
+	return (li);
 }
 
 static inline void
-free_adbzoneinfo(dns_adb_t *adb, dns_adbzoneinfo_t **zoneinfo) {
-	dns_adbzoneinfo_t *zi;
+free_adblameinfo(dns_adb_t *adb, dns_adblameinfo_t **lameinfo) {
+	dns_adblameinfo_t *li;
 
-	INSIST(zoneinfo != NULL && DNS_ADBZONEINFO_VALID(*zoneinfo));
-	zi = *zoneinfo;
-	*zoneinfo = NULL;
+	INSIST(lameinfo != NULL && DNS_ADBLAMEINFO_VALID(*lameinfo));
+	li = *lameinfo;
+	*lameinfo = NULL;
 
-	INSIST(!ISC_LINK_LINKED(zi, plink));
+	INSIST(!ISC_LINK_LINKED(li, plink));
 
-	dns_name_free(&zi->zone, adb->mctx);
+	dns_name_free(&li->qname, adb->mctx);
 
-	zi->magic = 0;
+	li->magic = 0;
 
-	isc_mempool_put(adb->zimp, zi);
+	isc_mempool_put(adb->limp, li);
 }
 
 static inline dns_adbentry_t *
@@ -1375,7 +1381,7 @@ new_adbentry(dns_adb_t *adb) {
 	isc_random_get(&r);
 	e->srtt = (r & 0x1f) + 1;
 	e->expires = 0;
-	ISC_LIST_INIT(e->zoneinfo);
+	ISC_LIST_INIT(e->lameinfo);
 	ISC_LINK_INIT(e, plink);
 
 	return (e);
@@ -1384,7 +1390,7 @@ new_adbentry(dns_adb_t *adb) {
 static inline void
 free_adbentry(dns_adb_t *adb, dns_adbentry_t **entry) {
 	dns_adbentry_t *e;
-	dns_adbzoneinfo_t *zi;
+	dns_adblameinfo_t *li;
 
 	INSIST(entry != NULL && DNS_ADBENTRY_VALID(*entry));
 	e = *entry;
@@ -1396,11 +1402,11 @@ free_adbentry(dns_adb_t *adb, dns_adbentry_t **entry) {
 
 	e->magic = 0;
 
-	zi = ISC_LIST_HEAD(e->zoneinfo);
-	while (zi != NULL) {
-		ISC_LIST_UNLINK(e->zoneinfo, zi, plink);
-		free_adbzoneinfo(adb, &zi);
-		zi = ISC_LIST_HEAD(e->zoneinfo);
+	li = ISC_LIST_HEAD(e->lameinfo);
+	while (li != NULL) {
+		ISC_LIST_UNLINK(e->lameinfo, li, plink);
+		free_adblameinfo(adb, &li);
+		li = ISC_LIST_HEAD(e->lameinfo);
 	}
 
 	isc_mempool_put(adb->emp, e);
@@ -1436,8 +1442,6 @@ new_adbfind(dns_adb_t *adb) {
 	 */
 	result = isc_mutex_init(&h->lock);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init failed in new_adbfind()");
 		isc_mempool_put(adb->ahmp, h);
 		return (NULL);
 	}
@@ -1647,45 +1651,48 @@ find_entry_and_lock(dns_adb_t *adb, isc_sockaddr_t *addr, int *bucketp) {
  * Entry bucket MUST be locked!
  */
 static isc_boolean_t
-entry_is_bad_for_zone(dns_adb_t *adb, dns_adbentry_t *entry, dns_name_t *zone,
-		      isc_stdtime_t now)
+entry_is_lame(dns_adb_t *adb, dns_adbentry_t *entry, dns_name_t *qname,
+	      dns_rdatatype_t qtype, isc_stdtime_t now)
 {
-	dns_adbzoneinfo_t *zi, *next_zi;
+	dns_adblameinfo_t *li, *next_li;
 	isc_boolean_t is_bad;
 
 	is_bad = ISC_FALSE;
 
-	zi = ISC_LIST_HEAD(entry->zoneinfo);
-	if (zi == NULL)
+	li = ISC_LIST_HEAD(entry->lameinfo);
+	if (li == NULL)
 		return (ISC_FALSE);
-	while (zi != NULL) {
-		next_zi = ISC_LIST_NEXT(zi, plink);
+	while (li != NULL) {
+		next_li = ISC_LIST_NEXT(li, plink);
 
 		/*
 		 * Has the entry expired?
 		 */
-		if (zi->lame_timer < now) {
-			ISC_LIST_UNLINK(entry->zoneinfo, zi, plink);
-			free_adbzoneinfo(adb, &zi);
+		if (li->lame_timer < now) {
+			ISC_LIST_UNLINK(entry->lameinfo, li, plink);
+			free_adblameinfo(adb, &li);
 		}
 
 		/*
 		 * Order tests from least to most expensive.
+		 *
+		 * We do not break out of the main loop here as
+		 * we use the loop for house keeping.
 		 */
-		if (zi != NULL && !is_bad) {
-			if (dns_name_equal(zone, &zi->zone))
-				is_bad = ISC_TRUE;
-		}
+		if (li != NULL && !is_bad && li->qtype == qtype &&
+		    dns_name_equal(qname, &li->qname))
+			is_bad = ISC_TRUE;
 
-		zi = next_zi;
+		li = next_li;
 	}
 
 	return (is_bad);
 }
 
 static void
-copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *zone,
-		    dns_adbname_t *name, isc_stdtime_t now)
+copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *qname,
+		    dns_rdatatype_t qtype, dns_adbname_t *name,
+		    isc_stdtime_t now)
 {
 	dns_adbnamehook_t *namehook;
 	dns_adbaddrinfo_t *addrinfo;
@@ -1702,7 +1709,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *zone,
 			LOCK(&adb->entrylocks[bucket]);
 
 			if (!FIND_RETURNLAME(find)
-			    && entry_is_bad_for_zone(adb, entry, zone, now)) {
+			    && entry_is_lame(adb, entry, qname, qtype, now)) {
 				find->options |= DNS_ADBFIND_LAMEPRUNED;
 				goto nextv4;
 			}
@@ -1731,7 +1738,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *zone,
 			bucket = entry->lock_bucket;
 			LOCK(&adb->entrylocks[bucket]);
 
-			if (entry_is_bad_for_zone(adb, entry, zone, now))
+			if (entry_is_lame(adb, entry, qname, qtype, now))
 				goto nextv6;
 			addrinfo = new_adbaddrinfo(adb, entry, find->port);
 			if (addrinfo == NULL) {
@@ -1971,7 +1978,7 @@ destroy(dns_adb_t *adb) {
 
 	isc_mempool_destroy(&adb->nmp);
 	isc_mempool_destroy(&adb->nhmp);
-	isc_mempool_destroy(&adb->zimp);
+	isc_mempool_destroy(&adb->limp);
 	isc_mempool_destroy(&adb->emp);
 	isc_mempool_destroy(&adb->ahmp);
 	isc_mempool_destroy(&adb->aimp);
@@ -2019,7 +2026,7 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
 	adb->irefcnt = 0;
 	adb->nmp = NULL;
 	adb->nhmp = NULL;
-	adb->zimp = NULL;
+	adb->limp = NULL;
 	adb->emp = NULL;
 	adb->ahmp = NULL;
 	adb->aimp = NULL;
@@ -2091,7 +2098,7 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
 
 	MPINIT(dns_adbname_t, adb->nmp, "adbname");
 	MPINIT(dns_adbnamehook_t, adb->nhmp, "adbnamehook");
-	MPINIT(dns_adbzoneinfo_t, adb->zimp, "adbzoneinfo");
+	MPINIT(dns_adblameinfo_t, adb->limp, "adblameinfo");
 	MPINIT(dns_adbentry_t, adb->emp, "adbentry");
 	MPINIT(dns_adbfind_t, adb->ahmp, "adbfind");
 	MPINIT(dns_adbaddrinfo_t, adb->aimp, "adbaddrinfo");
@@ -2144,8 +2151,8 @@ dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *timermgr,
 		isc_mempool_destroy(&adb->nmp);
 	if (adb->nhmp != NULL)
 		isc_mempool_destroy(&adb->nhmp);
-	if (adb->zimp != NULL)
-		isc_mempool_destroy(&adb->zimp);
+	if (adb->limp != NULL)
+		isc_mempool_destroy(&adb->limp);
 	if (adb->emp != NULL)
 		isc_mempool_destroy(&adb->emp);
 	if (adb->ahmp != NULL)
@@ -2265,8 +2272,9 @@ dns_adb_shutdown(dns_adb_t *adb) {
 
 isc_result_t
 dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
-		   void *arg, dns_name_t *name, dns_name_t *zone,
-		   unsigned int options, isc_stdtime_t now, dns_name_t *target,
+		   void *arg, dns_name_t *name, dns_name_t *qname,
+		   dns_rdatatype_t qtype, unsigned int options,
+		   isc_stdtime_t now, dns_name_t *target,
 		   in_port_t port, dns_adbfind_t **findp)
 {
 	dns_adbfind_t *find;
@@ -2283,7 +2291,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 		REQUIRE(action != NULL);
 	}
 	REQUIRE(name != NULL);
-	REQUIRE(zone != NULL);
+	REQUIRE(qname != NULL);
 	REQUIRE(findp != NULL && *findp == NULL);
 	REQUIRE(target == NULL || dns_name_hasbuffer(target));
 
@@ -2511,7 +2519,7 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
 	 * Run through the name and copy out the bits we are
 	 * interested in.
 	 */
-	copy_namehook_lists(adb, find, zone, adbname, now);
+	copy_namehook_lists(adb, find, qname, qtype, adbname, now);
 
  post_copy:
 	if (NAME_FETCH_V4(adbname))
@@ -2826,8 +2834,9 @@ dump_entry(FILE *f, dns_adbentry_t *entry, isc_boolean_t debug,
 	   isc_stdtime_t now)
 {
 	char addrbuf[ISC_NETADDR_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
 	isc_netaddr_t netaddr;
-	dns_adbzoneinfo_t *zi;
+	dns_adblameinfo_t *li;
 
 	isc_netaddr_fromsockaddr(&netaddr, &entry->sockaddr);
 	isc_netaddr_format(&netaddr, addrbuf, sizeof(addrbuf));
@@ -2840,12 +2849,14 @@ dump_entry(FILE *f, dns_adbentry_t *entry, isc_boolean_t debug,
 	if (entry->expires != 0)
 		fprintf(f, " [ttl %d]", entry->expires - now);
 	fprintf(f, "\n");
-	for (zi = ISC_LIST_HEAD(entry->zoneinfo);
-	     zi != NULL;
-	     zi = ISC_LIST_NEXT(zi, plink)) {
+	for (li = ISC_LIST_HEAD(entry->lameinfo);
+	     li != NULL;
+	     li = ISC_LIST_NEXT(li, plink)) {
 		fprintf(f, ";\t\t");
-		print_dns_name(f, &zi->zone);
-		fprintf(f, " [lame TTL %d]\n", zi->lame_timer - now);
+		print_dns_name(f, &li->qname);
+		dns_rdatatype_format(li->qtype, typebuf, sizeof(typebuf));
+		fprintf(f, " %s [lame TTL %d]\n", typebuf,
+			li->lame_timer - now);
 	}
 }
 
@@ -3332,36 +3343,37 @@ fetch_name(dns_adbname_t *adbname,
  * since these can be extracted from the find itself.
  */
 isc_result_t
-dns_adb_marklame(dns_adb_t *adb, dns_adbaddrinfo_t *addr, dns_name_t *zone,
-		 isc_stdtime_t expire_time)
+dns_adb_marklame(dns_adb_t *adb, dns_adbaddrinfo_t *addr, dns_name_t *qname,
+		 dns_rdatatype_t qtype, isc_stdtime_t expire_time)
 {
-	dns_adbzoneinfo_t *zi;
+	dns_adblameinfo_t *li;
 	int bucket;
 	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(DNS_ADBADDRINFO_VALID(addr));
-	REQUIRE(zone != NULL);
+	REQUIRE(qname != NULL);
 
 	bucket = addr->entry->lock_bucket;
 	LOCK(&adb->entrylocks[bucket]);
-	zi = ISC_LIST_HEAD(addr->entry->zoneinfo);
-	while (zi != NULL && !dns_name_equal(zone, &zi->zone))
-		zi = ISC_LIST_NEXT(zi, plink);
-	if (zi != NULL) {
-		if (expire_time > zi->lame_timer)
-			zi->lame_timer = expire_time;
+	li = ISC_LIST_HEAD(addr->entry->lameinfo);
+	while (li != NULL &&
+	       (li->qtype != qtype || !dns_name_equal(qname, &li->qname)))
+		li = ISC_LIST_NEXT(li, plink);
+	if (li != NULL) {
+		if (expire_time > li->lame_timer)
+			li->lame_timer = expire_time;
 		goto unlock;
 	}
-	zi = new_adbzoneinfo(adb, zone);
-	if (zi == NULL) {
+	li = new_adblameinfo(adb, qname, qtype);
+	if (li == NULL) {
 		result = ISC_R_NOMEMORY;
 		goto unlock;
 	}
 
-	zi->lame_timer = expire_time;
+	li->lame_timer = expire_time;
 
-	ISC_LIST_PREPEND(addr->entry->zoneinfo, zi, plink);
+	ISC_LIST_PREPEND(addr->entry->lameinfo, li, plink);
  unlock:
 	UNLOCK(&adb->entrylocks[bucket]);
 
diff --git a/contrib/bind9/lib/dns/api b/contrib/bind9/lib/dns/api
index 95b29be..5798ebc 100644
--- a/contrib/bind9/lib/dns/api
+++ b/contrib/bind9/lib/dns/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 23
-LIBREVISION = 0
+LIBINTERFACE = 33
+LIBREVISION = 1
 LIBAGE = 1
diff --git a/contrib/bind9/lib/dns/byaddr.c b/contrib/bind9/lib/dns/byaddr.c
index ace4fb0..38d6e8b 100644
--- a/contrib/bind9/lib/dns/byaddr.c
+++ b/contrib/bind9/lib/dns/byaddr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: byaddr.c,v 1.29.2.1.2.8 2004/08/28 06:25:18 marka Exp $ */
+/* $Id: byaddr.c,v 1.34.18.3 2005/04/29 00:15:49 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/cache.c b/contrib/bind9/lib/dns/cache.c
index f45af90..011dbf7 100644
--- a/contrib/bind9/lib/dns/cache.c
+++ b/contrib/bind9/lib/dns/cache.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cache.c,v 1.45.2.4.8.15 2006/08/01 01:07:05 marka Exp $ */
+/* $Id: cache.c,v 1.57.18.16 2006/08/01 01:06:48 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -29,6 +31,7 @@
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/events.h>
+#include <dns/lib.h>
 #include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/rdata.h>
@@ -39,13 +42,18 @@
 #define CACHE_MAGIC		ISC_MAGIC('$', '$', '$', '$')
 #define VALID_CACHE(cache)	ISC_MAGIC_VALID(cache, CACHE_MAGIC)
 
-/*
- * The following two variables control incremental cleaning.
- * MINSIZE is how many bytes is the floor for dns_cache_setcachesize().
+/*! 
+ * Control incremental cleaning.
+ * DNS_CACHE_MINSIZE is how many bytes is the floor for dns_cache_setcachesize().
+ * See also DNS_CACHE_CLEANERINCREMENT
+ */
+#define DNS_CACHE_MINSIZE 		2097152	/*%< Bytes.  2097152 = 2 MB */
+/*! 
+ * Control incremental cleaning.
  * CLEANERINCREMENT is how many nodes are examined in one pass.
+ * See also DNS_CACHE_MINSIZE 
  */
-#define DNS_CACHE_MINSIZE 		2097152	/* Bytes.  2097152 = 2 MB */
-#define DNS_CACHE_CLEANERINCREMENT	1000	/* Number of nodes. */
+#define DNS_CACHE_CLEANERINCREMENT	1000U	/*%< Number of nodes. */
 
 /***
  ***	Types
@@ -59,9 +67,9 @@
 typedef struct cache_cleaner cache_cleaner_t;
 
 typedef enum {
-	cleaner_s_idle,	/* Waiting for cleaning-interval to expire. */
-	cleaner_s_busy,	/* Currently cleaning. */
-	cleaner_s_done  /* Freed enough memory after being overmem. */
+	cleaner_s_idle,	/*%< Waiting for cleaning-interval to expire. */
+	cleaner_s_busy,	/*%< Currently cleaning. */
+	cleaner_s_done  /*%< Freed enough memory after being overmem. */
 } cleaner_state_t;
 
 /*
@@ -73,13 +81,13 @@ typedef enum {
 			 (c)->iterator != NULL && \
 			 (c)->resched_event == NULL)
 
-/*
+/*%
  * Accesses to a cache cleaner object are synchronized through
  * task/event serialization, or locked from the cache object.
  */
 struct cache_cleaner {
 	isc_mutex_t	lock;
-	/*
+	/*%<
 	 * Locks overmem_event, overmem.  Note: never allocate memory
 	 * while holding this lock - that could lead to deadlock since
 	 * the lock is take by water() which is called from the memory
@@ -88,22 +96,22 @@ struct cache_cleaner {
 
 	dns_cache_t	*cache;
 	isc_task_t 	*task;
-	unsigned int	cleaning_interval; /* The cleaning-interval from
+	unsigned int	cleaning_interval; /*% The cleaning-interval from
 					      named.conf, in seconds. */
 	isc_timer_t 	*cleaning_timer;
-	isc_event_t	*resched_event;	/* Sent by cleaner task to
+	isc_event_t	*resched_event;	/*% Sent by cleaner task to
 					   itself to reschedule */
 	isc_event_t	*overmem_event;
 
 	dns_dbiterator_t *iterator;
-	int 		 increment;	/* Number of names to
+	unsigned int 	 increment;	/*% Number of names to
 					   clean in one increment */
-	cleaner_state_t  state;		/* Idle/Busy. */
-	isc_boolean_t	 overmem;	/* The cache is in an overmem state. */
+	cleaner_state_t  state;		/*% Idle/Busy. */
+	isc_boolean_t	 overmem;	/*% The cache is in an overmem state. */
 	isc_boolean_t	 replaceiterator;
 };
 
-/*
+/*%
  * The actual cache object.
  */
 
@@ -149,6 +157,79 @@ cleaner_shutdown_action(isc_task_t *task, isc_event_t *event);
 static void
 overmem_cleaning_action(isc_task_t *task, isc_event_t *event);
 
+/*%
+ * Work out how many nodes can be cleaned in the time between two
+ * requests to the nameserver.  Smooth the resulting number and use
+ * it as a estimate for the number of nodes to be cleaned in the next
+ * iteration.
+ */
+static void
+adjust_increment(cache_cleaner_t *cleaner, unsigned int remaining,
+		 isc_time_t *start)
+{
+	isc_time_t end;
+	isc_uint64_t usecs;
+	isc_uint64_t new;
+	unsigned int pps = dns_pps;
+	unsigned int interval;
+	unsigned int names;
+	
+	/*
+	 * Tune for minumum of 100 packets per second (pps).
+	 */
+	if (pps < 100)
+		pps = 100;
+
+	isc_time_now(&end);
+
+	interval = 1000000 / pps; /* Interval between packets in usecs. */
+	if (interval == 0)
+		interval = 1;
+
+	INSIST(cleaner->increment >= remaining);
+	names = cleaner->increment - remaining;
+	usecs = isc_time_microdiff(&end, start);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
+		      ISC_LOG_DEBUG(1), "adjust_increment interval=%u "
+		      "names=%u usec=%" ISC_PLATFORM_QUADFORMAT "u",
+		      interval, names, usecs);
+	
+	if (usecs == 0) {
+		/*
+		 * If we cleaned all the nodes in unmeasurable time
+		 * double the number of nodes to be cleaned next time.
+		 */
+		if (names == cleaner->increment) {
+			cleaner->increment *= 2;
+			if (cleaner->increment > DNS_CACHE_CLEANERINCREMENT)
+				cleaner->increment = DNS_CACHE_CLEANERINCREMENT;
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+				      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
+				      "%p:new cleaner->increment = %u\n",
+				      cleaner, cleaner->increment);
+		}
+		return;
+	}
+
+	new = (names * interval);
+	new /= (usecs * 2);
+	if (new == 0)
+		new = 1;
+
+	/* Smooth */
+	new = (new + cleaner->increment * 7) / 8;
+
+	if (new > DNS_CACHE_CLEANERINCREMENT)
+		new = DNS_CACHE_CLEANERINCREMENT;
+
+	cleaner->increment = (unsigned int)new;
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
+		      ISC_LOG_DEBUG(1), "%p:new cleaner->increment = %u\n",
+		      cleaner, cleaner->increment);
+}
+
 static inline isc_result_t
 cache_create_db(dns_cache_t *cache, dns_db_t **db) {
 	return (dns_db_create(cache->mctx, cache->db_type, dns_rootname,
@@ -178,22 +259,12 @@ dns_cache_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	isc_mem_attach(mctx, &cache->mctx);
 
 	result = isc_mutex_init(&cache->lock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 dns_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_mem;
-	}
 
 	result = isc_mutex_init(&cache->filelock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 dns_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_lock;
-	}
 
 	cache->references = 1;
 	cache->live_tasks = 0;
@@ -488,13 +559,8 @@ cache_cleaner_init(dns_cache_t *cache, isc_taskmgr_t *taskmgr,
 	isc_result_t result;
 
 	result = isc_mutex_init(&cleaner->lock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 dns_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto fail;
-	}
 
 	cleaner->increment = DNS_CACHE_CLEANERINCREMENT;
 	cleaner->state = cleaner_s_idle;
@@ -740,7 +806,8 @@ static void
 incremental_cleaning_action(isc_task_t *task, isc_event_t *event) {
 	cache_cleaner_t *cleaner = event->ev_arg;
 	isc_result_t result;
-	int n_names;
+	unsigned int n_names;
+	isc_time_t start;
 
 	UNUSED(task);
 
@@ -770,6 +837,7 @@ incremental_cleaning_action(isc_task_t *task, isc_event_t *event) {
 
 	REQUIRE(DNS_DBITERATOR_VALID(cleaner->iterator));
 
+	isc_time_now(&start);
 	while (n_names-- > 0) {
 		dns_dbnode_t *node = NULL;
 
@@ -780,6 +848,7 @@ incremental_cleaning_action(isc_task_t *task, isc_event_t *event) {
 				 "cache cleaner: dns_dbiterator_current() "
 				 "failed: %s", dns_result_totext(result));
 
+			adjust_increment(cleaner, n_names, &start);
 			end_cleaning(cleaner, event);
 			return;
 		}
@@ -823,11 +892,14 @@ incremental_cleaning_action(isc_task_t *task, isc_event_t *event) {
 				}
 			}
 
+			adjust_increment(cleaner, n_names, &start);
 			end_cleaning(cleaner, event);
 			return;
 		}
 	}
 
+	adjust_increment(cleaner, 0U, &start);
+
 	/*
 	 * We have successfully performed a cleaning increment but have
 	 * not gone through the entire cache.  Free the iterator locks
@@ -838,7 +910,7 @@ incremental_cleaning_action(isc_task_t *task, isc_event_t *event) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
-		      ISC_LOG_DEBUG(1), "cache cleaner: checked %d nodes, "
+		      ISC_LOG_DEBUG(1), "cache cleaner: checked %u nodes, "
 		      "mem inuse %lu, sleeping", cleaner->increment,
 		      (unsigned long)isc_mem_inuse(cleaner->cache->mctx));
 
diff --git a/contrib/bind9/lib/dns/callbacks.c b/contrib/bind9/lib/dns/callbacks.c
index 431c7ef..a487ed0 100644
--- a/contrib/bind9/lib/dns/callbacks.c
+++ b/contrib/bind9/lib/dns/callbacks.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: callbacks.c,v 1.12.206.1 2004/03/06 08:13:36 marka Exp $ */
+/* $Id: callbacks.c,v 1.13.18.2 2005/04/29 00:15:49 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/compress.c b/contrib/bind9/lib/dns/compress.c
index 2122436..2103767 100644
--- a/contrib/bind9/lib/dns/compress.c
+++ b/contrib/bind9/lib/dns/compress.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: compress.c,v 1.50.206.4 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: compress.c,v 1.52.18.5 2006/03/02 00:37:21 marka Exp $ */
+
+/*! \file */
 
 #define DNS_NAME_USEINLINE 1
 
@@ -82,13 +84,31 @@ void
 dns_compress_setmethods(dns_compress_t *cctx, unsigned int allowed) {
 	REQUIRE(VALID_CCTX(cctx));
 
-	cctx->allowed = allowed;
+	cctx->allowed &= ~DNS_COMPRESS_ALL;
+	cctx->allowed |= (allowed & DNS_COMPRESS_ALL);
 }
 
 unsigned int
 dns_compress_getmethods(dns_compress_t *cctx) {
 	REQUIRE(VALID_CCTX(cctx));
-	return (cctx->allowed);
+	return (cctx->allowed & DNS_COMPRESS_ALL);
+}
+
+void
+dns_compress_setsensitive(dns_compress_t *cctx, isc_boolean_t sensitive) {
+	REQUIRE(VALID_CCTX(cctx));
+
+	if (sensitive)
+		cctx->allowed |= DNS_COMPRESS_CASESENSITIVE;
+	else
+		cctx->allowed &= ~DNS_COMPRESS_CASESENSITIVE;
+}
+
+isc_boolean_t
+dns_compress_getsensitive(dns_compress_t *cctx) {
+	REQUIRE(VALID_CCTX(cctx));
+
+	return (ISC_TF((cctx->allowed & DNS_COMPRESS_CASESENSITIVE) != 0));
 }
 
 int
@@ -138,8 +158,13 @@ dns_compress_findglobal(dns_compress_t *cctx, const dns_name_t *name,
 		for (node = cctx->table[hash]; node != NULL; node = node->next)
 		{
 			NODENAME(node, &nname);
-			if (dns_name_equal(&nname, &tname))
-				break;
+			if ((cctx->allowed & DNS_COMPRESS_CASESENSITIVE) != 0) {
+				if (dns_name_caseequal(&nname, &tname))
+					break;
+			} else {
+				if (dns_name_equal(&nname, &tname))
+					break;
+			}
 		}
 		if (node != NULL)
 			break;
diff --git a/contrib/bind9/lib/dns/db.c b/contrib/bind9/lib/dns/db.c
index 347ce1e..32ff6ae 100644
--- a/contrib/bind9/lib/dns/db.c
+++ b/contrib/bind9/lib/dns/db.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: db.c,v 1.69.2.1.10.4 2004/03/08 02:07:52 marka Exp $ */
+/* $Id: db.c,v 1.74.18.6 2005/10/13 02:12:24 marka Exp $ */
+
+/*! \file */
 
 /***
  *** Imports
@@ -301,6 +303,11 @@ dns_db_endload(dns_db_t *db, dns_dbload_t **dbloadp) {
 
 isc_result_t
 dns_db_load(dns_db_t *db, const char *filename) {
+	return (dns_db_load2(db, filename, dns_masterformat_text));
+}
+
+isc_result_t
+dns_db_load2(dns_db_t *db, const char *filename, dns_masterformat_t format) {
 	isc_result_t result, eresult;
 	dns_rdatacallbacks_t callbacks;
 	unsigned int options = 0;
@@ -319,9 +326,9 @@ dns_db_load(dns_db_t *db, const char *filename) {
 	result = dns_db_beginload(db, &callbacks.add, &callbacks.add_private);
 	if (result != ISC_R_SUCCESS)
 		return (result);
-	result = dns_master_loadfile(filename, &db->origin, &db->origin,
-				     db->rdclass, options,
-				     &callbacks, db->mctx);
+	result = dns_master_loadfile2(filename, &db->origin, &db->origin,
+				      db->rdclass, options,
+				      &callbacks, db->mctx, format);
 	eresult = dns_db_endload(db, &callbacks.add_private);
 	/*
 	 * We always call dns_db_endload(), but we only want to return its
@@ -337,13 +344,22 @@ dns_db_load(dns_db_t *db, const char *filename) {
 
 isc_result_t
 dns_db_dump(dns_db_t *db, dns_dbversion_t *version, const char *filename) {
+	return ((db->methods->dump)(db, version, filename,
+				    dns_masterformat_text));
+}
+
+isc_result_t
+dns_db_dump2(dns_db_t *db, dns_dbversion_t *version, const char *filename,
+	     dns_masterformat_t masterformat) {
 	/*
-	 * Dump 'db' into master file 'filename'.
+	 * Dump 'db' into master file 'filename' in the 'masterformat' format.
+	 * XXXJT: is it okay to modify the interface to the existing "dump"
+	 * method?
 	 */
 
 	REQUIRE(DNS_DB_VALID(db));
 
-	return ((db->methods->dump)(db, version, filename));
+	return ((db->methods->dump)(db, version, filename, masterformat));
 }
 
 /***
@@ -791,3 +807,15 @@ dns_db_unregister(dns_dbimplementation_t **dbimp) {
 	isc_mem_detach(&mctx);
 	RWUNLOCK(&implock, isc_rwlocktype_write);
 }
+
+isc_result_t
+dns_db_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
+	REQUIRE(DNS_DB_VALID(db));
+	REQUIRE(dns_db_iszone(db) == ISC_TRUE);
+	REQUIRE(nodep != NULL && *nodep == NULL);
+
+	if (db->methods->getoriginnode != NULL)
+		return ((db->methods->getoriginnode)(db, nodep));
+
+	return (ISC_R_NOTFOUND);
+}
diff --git a/contrib/bind9/lib/dns/dbiterator.c b/contrib/bind9/lib/dns/dbiterator.c
index 0bf354b..d462ad5 100644
--- a/contrib/bind9/lib/dns/dbiterator.c
+++ b/contrib/bind9/lib/dns/dbiterator.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dbiterator.c,v 1.13.206.1 2004/03/06 08:13:37 marka Exp $ */
+/* $Id: dbiterator.c,v 1.14.18.2 2005/04/29 00:15:50 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/dbtable.c b/contrib/bind9/lib/dns/dbtable.c
index d027fa3..b091e42 100644
--- a/contrib/bind9/lib/dns/dbtable.c
+++ b/contrib/bind9/lib/dns/dbtable.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -16,10 +16,11 @@
  */
 
 /*
- * $Id: dbtable.c,v 1.25.12.4 2004/03/09 05:21:08 marka Exp $
+ * $Id: dbtable.c,v 1.28.18.3 2005/07/12 01:22:19 marka Exp $
  */
 
-/*
+/*! \file
+ * \author
  * Principal Author: DCL
  */
 
@@ -86,7 +87,6 @@ dns_dbtable_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	result = isc_rwlock_init(&dbtable->tree_lock, 0, 0);
 	if (result != ISC_R_SUCCESS)
 		goto clean3;
-	
 
 	dbtable->default_db = NULL;
 	dbtable->mctx = mctx;
diff --git a/contrib/bind9/lib/dns/diff.c b/contrib/bind9/lib/dns/diff.c
index 8cd5643..22a3938 100644
--- a/contrib/bind9/lib/dns/diff.c
+++ b/contrib/bind9/lib/dns/diff.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: diff.c,v 1.4.2.1.8.4 2004/03/08 02:07:52 marka Exp $ */
+/* $Id: diff.c,v 1.9.18.3 2005/04/27 05:01:15 sra Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -30,8 +32,10 @@
 #include <dns/db.h>
 #include <dns/diff.h>
 #include <dns/log.h>
+#include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
+#include <dns/rdatatype.h>
 #include <dns/result.h>
 
 #define CHECK(op) \
@@ -195,6 +199,9 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
 	dns_difftuple_t *t;
 	dns_dbnode_t *node = NULL;
 	isc_result_t result;
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	char classbuf[DNS_RDATACLASS_FORMATSIZE];
 
 	REQUIRE(DNS_DIFF_VALID(diff));
 	REQUIRE(DNS_DB_VALID(db));
@@ -254,11 +261,19 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
 			       t->rdata.type == type &&
 			       rdata_covers(&t->rdata) == covers)
 			{
+				dns_name_format(name, namebuf, sizeof(namebuf));
+				dns_rdatatype_format(t->rdata.type, typebuf,
+						     sizeof(typebuf));
+				dns_rdataclass_format(t->rdata.rdclass,
+						      classbuf,
+						      sizeof(classbuf));
 				if (t->ttl != rdl.ttl && warn)
 					isc_log_write(DIFF_COMMON_LOGARGS,
 					      	ISC_LOG_WARNING,
-						"TTL differs in rdataset, "
-						"adjusting %lu -> %lu",
+						"'%s/%s/%s': TTL differs in "
+						"rdataset, adjusting "
+						"%lu -> %lu",
+						namebuf, typebuf, classbuf,
 						(unsigned long) t->ttl,
 						(unsigned long) rdl.ttl);
 				ISC_LIST_APPEND(rdl.rdata, &t->rdata, link);
diff --git a/contrib/bind9/lib/dns/dispatch.c b/contrib/bind9/lib/dns/dispatch.c
index 91ef2c5..02accdf 100644
--- a/contrib/bind9/lib/dns/dispatch.c
+++ b/contrib/bind9/lib/dns/dispatch.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.c,v 1.101.2.6.2.13 2006/07/19 00:44:04 marka Exp $ */
+/* $Id: dispatch.c,v 1.116.18.13 2007/02/07 23:57:58 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -43,12 +45,12 @@ typedef ISC_LIST(dns_dispentry_t)	dns_displist_t;
 
 typedef struct dns_qid {
 	unsigned int	magic;
-	unsigned int	qid_nbuckets;	/* hash table size */
-	unsigned int	qid_increment;	/* id increment on collision */
+	unsigned int	qid_nbuckets;	/*%< hash table size */
+	unsigned int	qid_increment;	/*%< id increment on collision */
 	isc_mutex_t	lock;
-	isc_lfsr_t	qid_lfsr1;	/* state generator info */
-	isc_lfsr_t	qid_lfsr2;	/* state generator info */
-	dns_displist_t	*qid_table;	/* the table itself */
+	isc_lfsr_t	qid_lfsr1;	/*%< state generator info */
+	isc_lfsr_t	qid_lfsr2;	/*%< state generator info */
+	dns_displist_t	*qid_table;	/*%< the table itself */
 } dns_qid_t;
 
 struct dns_dispatchmgr {
@@ -66,18 +68,18 @@ struct dns_dispatchmgr {
 	/* locked by buffer lock */
 	dns_qid_t			*qid;
 	isc_mutex_t			buffer_lock;
-	unsigned int			buffers;    /* allocated buffers */
-	unsigned int			buffersize; /* size of each buffer */
-	unsigned int			maxbuffers; /* max buffers */
+	unsigned int			buffers;    /*%< allocated buffers */
+	unsigned int			buffersize; /*%< size of each buffer */
+	unsigned int			maxbuffers; /*%< max buffers */
 
 	/* Locked internally. */
 	isc_mutex_t			pool_lock;
-	isc_mempool_t		       *epool;	/* memory pool for events */
-	isc_mempool_t		       *rpool;	/* memory pool for replies */
-	isc_mempool_t		       *dpool;  /* dispatch allocations */
-	isc_mempool_t		       *bpool;	/* memory pool for buffers */
+	isc_mempool_t		       *epool;	/*%< memory pool for events */
+	isc_mempool_t		       *rpool;	/*%< memory pool for replies */
+	isc_mempool_t		       *dpool;  /*%< dispatch allocations */
+	isc_mempool_t		       *bpool;	/*%< memory pool for buffers */
 
-	isc_entropy_t		       *entropy; /* entropy source */
+	isc_entropy_t		       *entropy; /*%< entropy source */
 };
 
 #define MGR_SHUTTINGDOWN		0x00000001U
@@ -103,32 +105,32 @@ struct dns_dispentry {
 
 struct dns_dispatch {
 	/* Unlocked. */
-	unsigned int		magic;		/* magic */
-	dns_dispatchmgr_t      *mgr;		/* dispatch manager */
-	isc_task_t	       *task;		/* internal task */
-	isc_socket_t	       *socket;		/* isc socket attached to */
-	isc_sockaddr_t		local;		/* local address */
-	unsigned int		maxrequests;	/* max requests */
+	unsigned int		magic;		/*%< magic */
+	dns_dispatchmgr_t      *mgr;		/*%< dispatch manager */
+	isc_task_t	       *task;		/*%< internal task */
+	isc_socket_t	       *socket;		/*%< isc socket attached to */
+	isc_sockaddr_t		local;		/*%< local address */
+	unsigned int		maxrequests;	/*%< max requests */
 	isc_event_t	       *ctlevent;
 
-	/* Locked by mgr->lock. */
+	/*% Locked by mgr->lock. */
 	ISC_LINK(dns_dispatch_t) link;
 
 	/* Locked by "lock". */
-	isc_mutex_t		lock;		/* locks all below */
+	isc_mutex_t		lock;		/*%< locks all below */
 	isc_sockettype_t	socktype;
 	unsigned int		attributes;
-	unsigned int		refcount;	/* number of users */
-	dns_dispatchevent_t    *failsafe_ev;	/* failsafe cancel event */
+	unsigned int		refcount;	/*%< number of users */
+	dns_dispatchevent_t    *failsafe_ev;	/*%< failsafe cancel event */
 	unsigned int		shutting_down : 1,
 				shutdown_out : 1,
 				connected : 1,
 				tcpmsg_valid : 1,
-				recv_pending : 1; /* is a recv() pending? */
+				recv_pending : 1; /*%< is a recv() pending? */
 	isc_result_t		shutdown_why;
-	unsigned int		requests;	/* how many requests we have */
-	unsigned int		tcpbuffers;	/* allocated buffers */
-	dns_tcpmsg_t		tcpmsg;		/* for tcp streams */
+	unsigned int		requests;	/*%< how many requests we have */
+	unsigned int		tcpbuffers;	/*%< allocated buffers */
+	dns_tcpmsg_t		tcpmsg;		/*%< for tcp streams */
 	dns_qid_t		*qid;
 };
 
@@ -970,6 +972,9 @@ startrecv(dns_dispatch_t *disp) {
 		INSIST(disp->recv_pending == 0);
 		disp->recv_pending = 1;
 		break;
+	default:
+		INSIST(0);
+		break;
 	}
 }
 
@@ -1239,6 +1244,7 @@ dns_dispatchmgr_setudp(dns_dispatchmgr_t *mgr,
 
 	if (isc_mempool_create(mgr->mctx, buffersize,
 			       &mgr->bpool) != ISC_R_SUCCESS) {
+		UNLOCK(&mgr->buffer_lock);
 		return (ISC_R_NOMEMORY);
 	}
 
@@ -1396,6 +1402,7 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
 {
 	dns_qid_t *qid;
 	unsigned int i;
+	isc_result_t result;
 
 	REQUIRE(VALID_DISPATCHMGR(mgr));
 	REQUIRE(buckets < 2097169);  /* next prime > 65536 * 32 */
@@ -1413,12 +1420,12 @@ qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
 		return (ISC_R_NOMEMORY);
 	}
 
-	if (isc_mutex_init(&qid->lock) != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_mutex_init failed");
+	result = isc_mutex_init(&qid->lock);
+	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mgr->mctx, qid->qid_table,
 			    buckets * sizeof(dns_displist_t));
 		isc_mem_put(mgr->mctx, qid, sizeof(*qid));
-		return (ISC_R_UNEXPECTED);
+		return (result);
 	}
 
 	for (i = 0; i < buckets; i++)
@@ -1471,7 +1478,7 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
 		  dns_dispatch_t **dispp)
 {
 	dns_dispatch_t *disp;
-	isc_result_t res;
+	isc_result_t result;
 
 	REQUIRE(VALID_DISPATCHMGR(mgr));
 	REQUIRE(dispp != NULL && *dispp == NULL);
@@ -1502,15 +1509,13 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
 	disp->tcpbuffers = 0;
 	disp->qid = NULL;
 
-	if (isc_mutex_init(&disp->lock) != ISC_R_SUCCESS) {
-		res = ISC_R_UNEXPECTED;
-		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_mutex_init failed");
+	result = isc_mutex_init(&disp->lock);
+	if (result != ISC_R_SUCCESS)
 		goto deallocate;
-	}
 
 	disp->failsafe_ev = allocate_event(disp);
 	if (disp->failsafe_ev == NULL) {
-		res = ISC_R_NOMEMORY;
+		result = ISC_R_NOMEMORY;
 		goto kill_lock;
 	}
 
@@ -1527,7 +1532,7 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, unsigned int maxrequests,
  deallocate:
 	isc_mempool_put(mgr->dpool, disp);
 
-	return (res);
+	return (result);
 }
 
 
diff --git a/contrib/bind9/lib/dns/dlz.c b/contrib/bind9/lib/dns/dlz.c
new file mode 100644
index 0000000..ee6c03b
--- /dev/null
+++ b/contrib/bind9/lib/dns/dlz.c
@@ -0,0 +1,510 @@
+/*
+ * Portions Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1999-2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dlz.c,v 1.2.2.2 2005/09/06 03:47:17 marka Exp $ */
+
+/*! \file */
+
+/***
+ *** Imports
+ ***/
+
+#include <config.h>
+
+#include <dns/fixedname.h>
+#include <dns/log.h>
+#include <dns/master.h>
+#include <dns/dlz.h>
+
+
+#include <isc/buffer.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/once.h>
+#include <isc/rwlock.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+/***
+ *** Supported DLZ DB Implementations Registry
+ ***/
+
+static ISC_LIST(dns_dlzimplementation_t) dlz_implementations;
+static isc_rwlock_t dlz_implock;
+static isc_once_t once = ISC_ONCE_INIT;
+
+static void
+dlz_initialize(void) {
+	RUNTIME_CHECK(isc_rwlock_init(&dlz_implock, 0, 0) == ISC_R_SUCCESS);
+	ISC_LIST_INIT(dlz_implementations);
+}
+
+/*%
+ * Searches the dlz_implementations list for a driver matching name.
+ */
+static inline dns_dlzimplementation_t *
+dlz_impfind(const char *name) {
+	dns_dlzimplementation_t *imp;
+
+	for (imp = ISC_LIST_HEAD(dlz_implementations);
+	     imp != NULL;
+	     imp = ISC_LIST_NEXT(imp, link))
+		if (strcasecmp(name, imp->name) == 0)
+			return (imp);
+	return (NULL);
+}
+
+/***
+ *** Basic DLZ Methods
+ ***/
+
+isc_result_t
+dns_dlzallowzonexfr(dns_view_t *view, dns_name_t *name,
+		    isc_sockaddr_t *clientaddr, dns_db_t **dbp)
+{
+	isc_result_t result;
+	dns_dlzallowzonexfr_t allowzonexfr;
+	dns_dlzdb_t *dlzdatabase;
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(DNS_DLZ_VALID(view->dlzdatabase));
+	REQUIRE(name != NULL);
+	REQUIRE(dbp != NULL && *dbp == NULL);
+
+	/* ask driver if the zone is supported */
+	dlzdatabase = view->dlzdatabase;
+	allowzonexfr = dlzdatabase->implementation->methods->allowzonexfr;
+	result = (*allowzonexfr)(dlzdatabase->implementation->driverarg,
+			         dlzdatabase->dbdata, dlzdatabase->mctx,
+				 view->rdclass, name, clientaddr, dbp);
+
+	if (result == ISC_R_NOTIMPLEMENTED)
+		return (ISC_R_NOTFOUND);
+	return (result);
+}
+
+isc_result_t
+dns_dlzcreate(isc_mem_t *mctx, const char *dlzname, const char *drivername,
+	      unsigned int argc, char *argv[], dns_dlzdb_t **dbp)
+{
+	dns_dlzimplementation_t *impinfo;
+	isc_result_t result;
+
+	/*
+	 * initialize the dlz_implementations list, this is guaranteed
+	 * to only really happen once.
+	 */
+	RUNTIME_CHECK(isc_once_do(&once, dlz_initialize) == ISC_R_SUCCESS);
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(dbp != NULL && *dbp == NULL);
+	REQUIRE(dlzname != NULL);
+	REQUIRE(drivername != NULL);
+	REQUIRE(mctx != NULL);
+
+	/* write log message */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_INFO,
+		      "Loading '%s' using driver %s", dlzname, drivername);
+
+	/* lock the dlz_implementations list so we can search it. */
+	RWLOCK(&dlz_implock, isc_rwlocktype_read);
+
+	/* search for the driver implementation	 */
+	impinfo = dlz_impfind(drivername);
+	if (impinfo == NULL) {
+		RWUNLOCK(&dlz_implock, isc_rwlocktype_read);
+
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
+			      "unsupported DLZ database driver '%s'."
+			      "  %s not loaded.",
+			      drivername, dlzname);
+
+		return (ISC_R_NOTFOUND);
+	}
+
+	/* Allocate memory to hold the DLZ database driver */
+	(*dbp) = isc_mem_get(mctx, sizeof(dns_dlzdb_t));
+	if ((*dbp) == NULL) {
+		RWUNLOCK(&dlz_implock, isc_rwlocktype_read);
+		return (ISC_R_NOMEMORY);
+	}
+
+	/* Make sure memory region is set to all 0's */
+	memset((*dbp), 0, sizeof(dns_dlzdb_t));
+
+	(*dbp)->implementation = impinfo;
+
+	/* Create a new database using implementation 'drivername'. */
+	result = ((impinfo->methods->create)(mctx, dlzname, argc, argv,
+					     impinfo->driverarg,
+					     &(*dbp)->dbdata));
+
+	/* mark the DLZ driver as valid */
+	if (result == ISC_R_SUCCESS) {
+		RWUNLOCK(&dlz_implock, isc_rwlocktype_read);
+		(*dbp)->magic = DNS_DLZ_MAGIC;
+		isc_mem_attach(mctx, &(*dbp)->mctx);
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+			      "DLZ driver loaded successfully.");
+		return (ISC_R_SUCCESS);
+	} else {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
+			      "DLZ driver failed to load.");
+	}
+
+	/* impinfo->methods->create failed. */
+	RWUNLOCK(&dlz_implock, isc_rwlocktype_read);
+	isc_mem_put(mctx, (*dbp), sizeof(dns_dlzdb_t));
+	return (result);
+}
+
+void
+dns_dlzdestroy(dns_dlzdb_t **dbp) {
+	isc_mem_t *mctx;
+	dns_dlzdestroy_t destroy;
+
+	/* Write debugging message to log */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+		      "Unloading DLZ driver.");
+
+	/*
+	 * Perform checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(dbp != NULL && DNS_DLZ_VALID(*dbp));
+
+	/* call the drivers destroy method */
+	if ((*dbp) != NULL) {
+		mctx = (*dbp)->mctx;
+		destroy = (*dbp)->implementation->methods->destroy;
+		(*destroy)((*dbp)->implementation->driverarg,(*dbp)->dbdata);
+		/* return memory */
+		isc_mem_put(mctx, (*dbp), sizeof(dns_dlzdb_t));
+		isc_mem_detach(&mctx);
+	}
+
+	*dbp = NULL;
+}
+
+
+isc_result_t
+dns_dlzfindzone(dns_view_t *view, dns_name_t *name, unsigned int minlabels,
+		dns_db_t **dbp)
+{
+	dns_fixedname_t fname;
+	dns_name_t *zonename;
+	unsigned int namelabels;
+	unsigned int i;
+	isc_result_t result;
+	dns_dlzfindzone_t findzone;
+	dns_dlzdb_t *dlzdatabase;
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(DNS_DLZ_VALID(view->dlzdatabase));
+	REQUIRE(name != NULL);
+	REQUIRE(dbp != NULL && *dbp == NULL);
+
+	/* setup a "fixed" dns name */
+	dns_fixedname_init(&fname);
+	zonename = dns_fixedname_name(&fname);
+
+	/* count the number of labels in the name */
+	namelabels = dns_name_countlabels(name);
+
+	/*
+	 * loop through starting with the longest domain name and
+	 * trying shorter names portions of the name until we find a
+	 * match, have an error, or are below the 'minlabels'
+	 * threshold.  minlabels is 0, if the standard database didn't
+	 * have a zone name match.  Otherwise minlables is the number
+	 * of labels in that name.  We need to beat that for a
+	 * "better" match for the DLZ database to be authoritative
+	 * instead of the standard database.
+	 */
+	for (i = namelabels; i > minlabels && i > 1; i--) {
+		if (i == namelabels) {
+			result = dns_name_copy(name, zonename, NULL);
+			if (result != ISC_R_SUCCESS)
+				return (result);
+		} else
+			dns_name_split(name, i, NULL, zonename);
+
+		/* ask SDLZ driver if the zone is supported */
+		dlzdatabase = view->dlzdatabase;
+		findzone = dlzdatabase->implementation->methods->findzone;
+		result = (*findzone)(dlzdatabase->implementation->driverarg,
+				     dlzdatabase->dbdata, dlzdatabase->mctx,
+				     view->rdclass, zonename, dbp);
+		if (result != ISC_R_NOTFOUND)
+			return (result);
+	}
+	return (ISC_R_NOTFOUND);
+}
+
+/*%
+ * Registers a DLZ driver.  This basically just adds the dlz
+ * driver to the list of available drivers in the dlz_implementations list.
+ */
+isc_result_t
+dns_dlzregister(const char *drivername, const dns_dlzmethods_t *methods,
+		void *driverarg, isc_mem_t *mctx,
+		dns_dlzimplementation_t **dlzimp)
+{
+
+	dns_dlzimplementation_t *dlz_imp;
+
+	/* Write debugging message to log */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+		      "Registering DLZ driver '%s'", drivername);
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(drivername != NULL);
+	REQUIRE(methods != NULL);
+	REQUIRE(methods->create != NULL);
+	REQUIRE(methods->destroy != NULL);
+	REQUIRE(methods->findzone != NULL);
+	REQUIRE(mctx != NULL);
+	REQUIRE(dlzimp != NULL && *dlzimp == NULL);
+
+	/*
+	 * initialize the dlz_implementations list, this is guaranteed
+	 * to only really happen once.
+	 */
+	RUNTIME_CHECK(isc_once_do(&once, dlz_initialize) == ISC_R_SUCCESS);
+
+	/* lock the dlz_implementations list so we can modify it. */
+	RWLOCK(&dlz_implock, isc_rwlocktype_write);
+
+	/*
+	 * check that another already registered driver isn't using
+	 * the same name
+	 */
+	dlz_imp = dlz_impfind(drivername);
+	if (dlz_imp != NULL) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+			      "DLZ Driver '%s' already registered",
+			      drivername);
+		RWUNLOCK(&dlz_implock, isc_rwlocktype_write);
+		return (ISC_R_EXISTS);
+	}
+
+	/*
+	 * Allocate memory for a dlz_implementation object.  Error if
+	 * we cannot.
+	 */
+	dlz_imp = isc_mem_get(mctx, sizeof(dns_dlzimplementation_t));
+	if (dlz_imp == NULL) {
+		RWUNLOCK(&dlz_implock, isc_rwlocktype_write);
+		return (ISC_R_NOMEMORY);
+	}
+
+	/* Make sure memory region is set to all 0's */
+	memset(dlz_imp, 0, sizeof(dns_dlzimplementation_t));
+
+	/* Store the data passed into this method */
+	dlz_imp->name = drivername;
+	dlz_imp->methods = methods;
+	dlz_imp->mctx = NULL;
+	dlz_imp->driverarg = driverarg;
+
+	/* attach the new dlz_implementation object to a memory context */
+	isc_mem_attach(mctx, &dlz_imp->mctx);
+
+	/*
+	 * prepare the dlz_implementation object to be put in a list,
+	 * and append it to the list
+	 */
+	ISC_LINK_INIT(dlz_imp, link);
+	ISC_LIST_APPEND(dlz_implementations, dlz_imp, link);
+
+	/* Unlock the dlz_implementations list.	 */
+	RWUNLOCK(&dlz_implock, isc_rwlocktype_write);
+
+	/* Pass back the dlz_implementation that we created. */
+	*dlzimp = dlz_imp;
+
+	return (ISC_R_SUCCESS);
+}
+
+/*%
+ * Helper function for dns_dlzstrtoargv().
+ * Pardon the gratuitous recursion.
+ */
+static isc_result_t
+dns_dlzstrtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp,
+		    char ***argvp, unsigned int n)
+{
+	isc_result_t result;
+
+ restart:
+	/* Discard leading whitespace. */
+	while (*s == ' ' || *s == '\t')
+		s++;
+
+	if (*s == '\0') {
+		/* We have reached the end of the string. */
+		*argcp = n;
+		*argvp = isc_mem_get(mctx, n * sizeof(char *));
+		if (*argvp == NULL)
+			return (ISC_R_NOMEMORY);
+	} else {
+		char *p = s;
+		while (*p != ' ' && *p != '\t' && *p != '\0' && *p != '{') {
+			if (*p == '\n') {
+				*p = ' ';
+				goto restart;
+			}
+			p++;
+		}
+
+		/* do "grouping", items between { and } are one arg */
+		if (*p == '{') {
+			char *t = p;
+			/*
+			 * shift all characters to left by 1 to get rid of '{'
+			 */
+			while (*t != '\0') {
+				t++;
+				*(t-1) = *t;
+			}
+			while (*p != '\0' && *p != '}') {
+				p++;
+			}
+			/* get rid of '}' character */
+			if (*p == '}') {
+				*p = '\0';
+				p++;
+			}
+			/* normal case, no "grouping" */
+		} else if (*p != '\0')
+			*p++ = '\0';
+
+		result = dns_dlzstrtoargvsub(mctx, p, argcp, argvp, n + 1);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		(*argvp)[n] = s;
+	}
+	return (ISC_R_SUCCESS);
+}
+
+/*%
+ * Tokenize the string "s" into whitespace-separated words,
+ * return the number of words in '*argcp' and an array
+ * of pointers to the words in '*argvp'.  The caller
+ * must free the array using isc_mem_put().  The string
+ * is modified in-place.
+ */
+isc_result_t
+dns_dlzstrtoargv(isc_mem_t *mctx, char *s,
+		 unsigned int *argcp, char ***argvp)
+{
+	return(dns_dlzstrtoargvsub(mctx, s, argcp, argvp, 0));
+}
+
+/*%
+ * Unregisters a DLZ driver.  This basically just removes the dlz
+ * driver from the list of available drivers in the dlz_implementations list.
+ */
+void
+dns_dlzunregister(dns_dlzimplementation_t **dlzimp) {
+	dns_dlzimplementation_t *dlz_imp;
+	isc_mem_t *mctx;
+
+	/* Write debugging message to log */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+		      "Unregistering DLZ driver.");
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(dlzimp != NULL && *dlzimp != NULL);
+
+	/*
+	 * initialize the dlz_implementations list, this is guaranteed
+	 * to only really happen once.
+	 */
+	RUNTIME_CHECK(isc_once_do(&once, dlz_initialize) == ISC_R_SUCCESS);
+
+	dlz_imp = *dlzimp;
+
+	/* lock the dlz_implementations list so we can modify it. */
+	RWLOCK(&dlz_implock, isc_rwlocktype_write);
+
+	/* remove the dlz_implementation object from the list */
+	ISC_LIST_UNLINK(dlz_implementations, dlz_imp, link);
+	mctx = dlz_imp->mctx;
+
+	/*
+	 * return the memory back to the available memory pool and
+	 * remove it from the memory context.
+	 */
+	isc_mem_put(mctx, dlz_imp, sizeof(dns_dlzimplementation_t));
+	isc_mem_detach(&mctx);
+
+	/* Unlock the dlz_implementations list. */
+	RWUNLOCK(&dlz_implock, isc_rwlocktype_write);
+}
diff --git a/contrib/bind9/lib/dns/dnssec.c b/contrib/bind9/lib/dns/dnssec.c
index 91f7a99..c0339a1 100644
--- a/contrib/bind9/lib/dns/dnssec.c
+++ b/contrib/bind9/lib/dns/dnssec.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -16,9 +16,10 @@
  */
 
 /*
- * $Id: dnssec.c,v 1.69.2.5.2.9 2006/01/04 23:50:20 marka Exp $
+ * $Id: dnssec.c,v 1.81.18.6 2006/03/07 00:34:53 marka Exp $
  */
 
+/*! \file */
 
 #include <config.h>
 
@@ -519,10 +520,10 @@ dns_dnssec_verify(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 
 isc_result_t
 dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
-			dns_dbnode_t *node, dns_name_t *name,
-			const char *directory, isc_mem_t *mctx,
-			unsigned int maxkeys, dst_key_t **keys,
-			unsigned int *nkeys)
+			 dns_dbnode_t *node, dns_name_t *name,
+			 const char *directory, isc_mem_t *mctx,
+			 unsigned int maxkeys, dst_key_t **keys,
+			 unsigned int *nkeys)
 {
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
diff --git a/contrib/bind9/lib/dns/ds.c b/contrib/bind9/lib/dns/ds.c
index b0ca523..7cd1609 100644
--- a/contrib/bind9/lib/dns/ds.c
+++ b/contrib/bind9/lib/dns/ds.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ds.c,v 1.4.2.1 2004/03/08 02:07:53 marka Exp $ */
+/* $Id: ds.c,v 1.4.20.5 2006/02/22 23:50:09 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -24,6 +26,7 @@
 #include <isc/buffer.h>
 #include <isc/region.h>
 #include <isc/sha1.h>
+#include <isc/sha2.h>
 #include <isc/util.h>
 
 #include <dns/ds.h>
@@ -40,10 +43,9 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
 		  unsigned int digest_type, unsigned char *buffer,
 		  dns_rdata_t *rdata)
 {
-	isc_sha1_t sha1;
 	dns_fixedname_t fname;
 	dns_name_t *name;
-	unsigned char digest[ISC_SHA1_DIGESTLENGTH];
+	unsigned char digest[ISC_SHA256_DIGESTLENGTH];
 	isc_region_t r;
 	isc_buffer_t b;
 	dns_rdata_ds_t ds;
@@ -51,7 +53,7 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
 	REQUIRE(key != NULL);
 	REQUIRE(key->type == dns_rdatatype_dnskey);
 
-	if (digest_type != DNS_DSDIGEST_SHA1)
+	if (!dns_ds_digest_supported(digest_type))
 		return (ISC_R_NOTIMPLEMENTED);
 
 	dns_fixedname_init(&fname);
@@ -61,23 +63,42 @@ dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
 	memset(buffer, 0, DNS_DS_BUFFERSIZE);
 	isc_buffer_init(&b, buffer, DNS_DS_BUFFERSIZE);
 
-	isc_sha1_init(&sha1);
-	dns_name_toregion(name, &r);
-	isc_sha1_update(&sha1, r.base, r.length);
-	dns_rdata_toregion(key, &r);
-	INSIST(r.length >= 4);
-	isc_sha1_update(&sha1, r.base, r.length);
-	isc_sha1_final(&sha1, digest);
+	if (digest_type == DNS_DSDIGEST_SHA1) {
+		isc_sha1_t sha1;
+		isc_sha1_init(&sha1);
+		dns_name_toregion(name, &r);
+		isc_sha1_update(&sha1, r.base, r.length);
+		dns_rdata_toregion(key, &r);
+		INSIST(r.length >= 4);
+		isc_sha1_update(&sha1, r.base, r.length);
+		isc_sha1_final(&sha1, digest);
+	} else {
+		isc_sha256_t sha256;
+		isc_sha256_init(&sha256);
+		dns_name_toregion(name, &r);
+		isc_sha256_update(&sha256, r.base, r.length);
+		dns_rdata_toregion(key, &r);
+		INSIST(r.length >= 4);
+		isc_sha256_update(&sha256, r.base, r.length);
+		isc_sha256_final(digest, &sha256);
+	}
 
 	ds.mctx = NULL;
 	ds.common.rdclass = key->rdclass;
 	ds.common.rdtype = dns_rdatatype_ds;
 	ds.algorithm = r.base[3];
 	ds.key_tag = dst_region_computeid(&r, ds.algorithm);
-	ds.digest_type = DNS_DSDIGEST_SHA1;
-	ds.length = ISC_SHA1_DIGESTLENGTH;
+	ds.digest_type = digest_type;
+	ds.length = (digest_type == DNS_DSDIGEST_SHA1) ?
+		    ISC_SHA1_DIGESTLENGTH : ISC_SHA256_DIGESTLENGTH;
 	ds.digest = digest;
 
 	return (dns_rdata_fromstruct(rdata, key->rdclass, dns_rdatatype_ds,
 				     &ds, &b));
 }
+
+isc_boolean_t
+dns_ds_digest_supported(unsigned int digest_type) {
+	return  (ISC_TF(digest_type == DNS_DSDIGEST_SHA1 ||
+			digest_type == DNS_DSDIGEST_SHA256));
+}
diff --git a/contrib/bind9/lib/dns/dst_api.c b/contrib/bind9/lib/dns/dst_api.c
index b7b03e6..7d98e10 100644
--- a/contrib/bind9/lib/dns/dst_api.c
+++ b/contrib/bind9/lib/dns/dst_api.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -18,9 +18,11 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.1.4.3 2006/01/04 23:50:20 marka Exp $
+ * $Id: dst_api.c,v 1.1.6.7 2006/01/27 23:57:44 marka Exp $
  */
 
+/*! \file */
+
 #include <config.h>
 
 #include <stdlib.h>
@@ -29,6 +31,7 @@
 #include <isc/dir.h>
 #include <isc/entropy.h>
 #include <isc/fsaccess.h>
+#include <isc/hmacsha.h>
 #include <isc/lex.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -69,10 +72,6 @@ static dst_key_t *	get_key_struct(dns_name_t *name,
 				       unsigned int bits,
 				       dns_rdataclass_t rdclass,
 				       isc_mem_t *mctx);
-static isc_result_t	read_public_key(const char *filename,
-					int type,
-					isc_mem_t *mctx,
-					dst_key_t **keyp);
 static isc_result_t	write_public_key(const dst_key_t *key, int type,
 					 const char *directory);
 static isc_result_t	buildfilename(dns_name_t *name,
@@ -111,6 +110,20 @@ static isc_result_t	addsuffix(char *filename, unsigned int len,
 			return (_r);		\
 	} while (0);				\
 
+static void *
+default_memalloc(void *arg, size_t size) {
+        UNUSED(arg);
+        if (size == 0U)
+                size = 1;
+        return (malloc(size));
+}
+
+static void
+default_memfree(void *arg, void *ptr) {
+        UNUSED(arg);
+        free(ptr);
+}
+
 isc_result_t
 dst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags) {
 	isc_result_t result;
@@ -126,9 +139,12 @@ dst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags) {
 	 * When using --with-openssl, there seems to be no good way of not
 	 * leaking memory due to the openssl error handling mechanism.
 	 * Avoid assertions by using a local memory context and not checking
-	 * for leaks on exit.
+	 * for leaks on exit.  Note: as there are leaks we cannot use
+	 * ISC_MEMFLAG_INTERNAL as it will free up memory still being used
+	 * by libcrypto.
 	 */
-	result = isc_mem_create(0, 0, &dst__memory_pool);
+	result = isc_mem_createx2(0, 0, default_memalloc, default_memfree,
+				  NULL, &dst__memory_pool, 0);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	isc_mem_setdestroycheck(dst__memory_pool, ISC_FALSE);
@@ -142,6 +158,11 @@ dst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags) {
 
 	memset(dst_t_func, 0, sizeof(dst_t_func));
 	RETERR(dst__hmacmd5_init(&dst_t_func[DST_ALG_HMACMD5]));
+	RETERR(dst__hmacsha1_init(&dst_t_func[DST_ALG_HMACSHA1]));
+	RETERR(dst__hmacsha224_init(&dst_t_func[DST_ALG_HMACSHA224]));
+	RETERR(dst__hmacsha256_init(&dst_t_func[DST_ALG_HMACSHA256]));
+	RETERR(dst__hmacsha384_init(&dst_t_func[DST_ALG_HMACSHA384]));
+	RETERR(dst__hmacsha512_init(&dst_t_func[DST_ALG_HMACSHA512]));
 #ifdef OPENSSL
 	RETERR(dst__openssl_init());
 	RETERR(dst__opensslrsa_init(&dst_t_func[DST_ALG_RSAMD5]));
@@ -392,7 +413,16 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx,
 	REQUIRE(mctx != NULL);
 	REQUIRE(keyp != NULL && *keyp == NULL);
 
-	result = read_public_key(filename, type, mctx, &pubkey);
+	newfilenamelen = strlen(filename) + 5;
+	newfilename = isc_mem_get(mctx, newfilenamelen);
+	if (newfilename == NULL)
+		return (ISC_R_NOMEMORY);
+	result = addsuffix(newfilename, newfilenamelen, filename, ".key");
+	INSIST(result == ISC_R_SUCCESS);
+
+	result = dst_key_read_public(newfilename, type, mctx, &pubkey);
+	isc_mem_put(mctx, newfilename, newfilenamelen);
+	newfilename = NULL;
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -482,7 +512,7 @@ dst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
 						    & 0xffff));
 	}
 
-	if (key->opaque == NULL) /* NULL KEY */
+	if (key->opaque == NULL) /*%< NULL KEY */
 		return (ISC_R_SUCCESS);
 
 	return (key->func->todns(key, target));
@@ -629,7 +659,7 @@ dst_key_generate(dns_name_t *name, unsigned int alg,
 	if (key == NULL)
 		return (ISC_R_NOMEMORY);
 
-	if (bits == 0) { /* NULL KEY */
+	if (bits == 0) { /*%< NULL KEY */
 		key->key_flags |= DNS_KEYTYPE_NOKEY;
 		*keyp = key;
 		return (ISC_R_SUCCESS);
@@ -753,8 +783,23 @@ dst_key_sigsize(const dst_key_t *key, unsigned int *n) {
 	case DST_ALG_HMACMD5:
 		*n = 16;
 		break;
+	case DST_ALG_HMACSHA1:
+		*n = ISC_SHA1_DIGESTLENGTH;
+		break;
+	case DST_ALG_HMACSHA224:
+		*n = ISC_SHA224_DIGESTLENGTH;
+		break;
+	case DST_ALG_HMACSHA256:
+		*n = ISC_SHA256_DIGESTLENGTH;
+		break;
+	case DST_ALG_HMACSHA384:
+		*n = ISC_SHA384_DIGESTLENGTH;
+		break;
+	case DST_ALG_HMACSHA512:
+		*n = ISC_SHA512_DIGESTLENGTH;
+		break;
 	case DST_ALG_GSSAPI:
-		*n = 128; /* XXX */
+		*n = 128; /*%< XXX */
 		break;
 	case DST_ALG_DH:
 	default:
@@ -780,7 +825,7 @@ dst_key_secretsize(const dst_key_t *key, unsigned int *n) {
  *** Static methods
  ***/
 
-/*
+/*%
  * Allocates a key structure and fills in some of the fields.
  */
 static dst_key_t *
@@ -822,12 +867,12 @@ get_key_struct(dns_name_t *name, unsigned int alg,
 	return (key);
 }
 
-/*
+/*%
  * Reads a public key from disk
  */
-static isc_result_t
-read_public_key(const char *filename, int type,
-		isc_mem_t *mctx, dst_key_t **keyp)
+isc_result_t
+dst_key_read_public(const char *filename, int type,
+		    isc_mem_t *mctx, dst_key_t **keyp)
 {
 	u_char rdatabuf[DST_KEY_MAXSIZE];
 	isc_buffer_t b;
@@ -837,25 +882,16 @@ read_public_key(const char *filename, int type,
 	isc_result_t ret;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned int opt = ISC_LEXOPT_DNSMULTILINE;
-	char *newfilename;
-	unsigned int newfilenamelen;
 	dns_rdataclass_t rdclass = dns_rdataclass_in;
 	isc_lexspecials_t specials;
 	isc_uint32_t ttl;
 	isc_result_t result;
 	dns_rdatatype_t keytype;
 
-	newfilenamelen = strlen(filename) + 5;
-	newfilename = isc_mem_get(mctx, newfilenamelen);
-	if (newfilename == NULL)
-		return (ISC_R_NOMEMORY);
-	ret = addsuffix(newfilename, newfilenamelen, filename, ".key");
-	INSIST(ret == ISC_R_SUCCESS);
-
 	/*
 	 * Open the file and read its formatted contents
 	 * File format:
-	 *    domain.name [ttl] [class] KEY <flags> <protocol> <algorithm> <key>
+	 *    domain.name [ttl] [class] [KEY|DNSKEY] <flags> <protocol> <algorithm> <key>
 	 */
 
 	/* 1500 should be large enough for any key */
@@ -870,7 +906,7 @@ read_public_key(const char *filename, int type,
 	isc_lex_setspecials(lex, specials);
 	isc_lex_setcomments(lex, ISC_LEXCOMMENT_DNSMASTERFILE);
 
-	ret = isc_lex_openfile(lex, newfilename);
+	ret = isc_lex_openfile(lex, filename);
 	if (ret != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -918,7 +954,7 @@ read_public_key(const char *filename, int type,
 	if (strcasecmp(DST_AS_STR(token), "DNSKEY") == 0)
 		keytype = dns_rdatatype_dnskey;
 	else if (strcasecmp(DST_AS_STR(token), "KEY") == 0)
-		keytype = dns_rdatatype_key; /* SIG(0), TKEY */
+		keytype = dns_rdatatype_key; /*%< SIG(0), TKEY */
 	else
 		BADTOKEN();
 
@@ -942,8 +978,6 @@ read_public_key(const char *filename, int type,
  cleanup:
 	if (lex != NULL)
 		isc_lex_destroy(&lex);
-	isc_mem_put(mctx, newfilename, newfilenamelen);
-
 	return (ret);
 }
 
@@ -967,7 +1001,7 @@ issymmetric(const dst_key_t *key) {
 	}
 }
 
-/*
+/*%
  * Writes a public key to disk in DNS format.
  */
 static isc_result_t
diff --git a/contrib/bind9/lib/dns/dst_internal.h b/contrib/bind9/lib/dns/dst_internal.h
index 982eb6d..f2deb72 100644
--- a/contrib/bind9/lib/dns/dst_internal.h
+++ b/contrib/bind9/lib/dns/dst_internal.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2000-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst_internal.h,v 1.1.4.1 2004/12/09 04:07:16 marka Exp $ */
+/* $Id: dst_internal.h,v 1.1.6.5 2006/01/27 23:57:44 marka Exp $ */
 
 #ifndef DST_DST_INTERNAL_H
 #define DST_DST_INTERNAL_H 1
@@ -46,18 +46,20 @@ extern isc_mem_t *dst__memory_pool;
 
 typedef struct dst_func dst_func_t;
 
+/*% DST Key Structure */
 struct dst_key {
 	unsigned int	magic;
-	dns_name_t *	key_name;	/* name of the key */
-	unsigned int	key_size;	/* size of the key in bits */
-	unsigned int	key_proto;	/* protocols this key is used for */
-	unsigned int	key_alg;	/* algorithm of the key */
-	isc_uint32_t	key_flags;	/* flags of the public key */
-	isc_uint16_t	key_id;		/* identifier of the key */
-	dns_rdataclass_t key_class;	/* class of the key record */
-	isc_mem_t	*mctx;		/* memory context */
-	void *		opaque;		/* pointer to key in crypto pkg fmt */
-	dst_func_t *	func;		/* crypto package specific functions */
+	dns_name_t *	key_name;	/*%< name of the key */
+	unsigned int	key_size;	/*%< size of the key in bits */
+	unsigned int	key_proto;	/*%< protocols this key is used for */
+	unsigned int	key_alg;	/*%< algorithm of the key */
+	isc_uint32_t	key_flags;	/*%< flags of the public key */
+	isc_uint16_t	key_id;		/*%< identifier of the key */
+	isc_uint16_t	key_bits;	/*%< hmac digest bits */
+	dns_rdataclass_t key_class;	/*%< class of the key record */
+	isc_mem_t	*mctx;		/*%< memory context */
+	void *		opaque;		/*%< pointer to key in crypto pkg fmt */
+	dst_func_t *	func;		/*%< crypto package specific functions */
 };
 
 struct dst_context {
@@ -100,30 +102,35 @@ struct dst_func {
 	void (*cleanup)(void);
 };
 
-/*
+/*%
  * Initializers
  */
 isc_result_t dst__openssl_init(void);
 
 isc_result_t dst__hmacmd5_init(struct dst_func **funcp);
+isc_result_t dst__hmacsha1_init(struct dst_func **funcp);
+isc_result_t dst__hmacsha224_init(struct dst_func **funcp);
+isc_result_t dst__hmacsha256_init(struct dst_func **funcp);
+isc_result_t dst__hmacsha384_init(struct dst_func **funcp);
+isc_result_t dst__hmacsha512_init(struct dst_func **funcp);
 isc_result_t dst__opensslrsa_init(struct dst_func **funcp);
 isc_result_t dst__openssldsa_init(struct dst_func **funcp);
 isc_result_t dst__openssldh_init(struct dst_func **funcp);
 isc_result_t dst__gssapi_init(struct dst_func **funcp);
 
-/*
+/*%
  * Destructors
  */
 void dst__openssl_destroy(void);
 
-/*
+/*%
  * Memory allocators using the DST memory pool.
  */
 void * dst__mem_alloc(size_t size);
 void   dst__mem_free(void *ptr);
 void * dst__mem_realloc(void *ptr, size_t size);
 
-/*
+/*%
  * Entropy retriever using the DST entropy pool.
  */
 isc_result_t dst__entropy_getdata(void *buf, unsigned int len,
@@ -132,3 +139,4 @@ isc_result_t dst__entropy_getdata(void *buf, unsigned int len,
 ISC_LANG_ENDDECLS
 
 #endif /* DST_DST_INTERNAL_H */
+/*! \file */
diff --git a/contrib/bind9/lib/dns/dst_lib.c b/contrib/bind9/lib/dns/dst_lib.c
index 8046110..305051c 100644
--- a/contrib/bind9/lib/dns/dst_lib.c
+++ b/contrib/bind9/lib/dns/dst_lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -17,9 +17,11 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_lib.c,v 1.1.4.1 2004/12/09 04:07:16 marka Exp $
+ * $Id: dst_lib.c,v 1.1.6.3 2005/04/29 00:15:51 marka Exp $
  */
 
+/*! \file */
+
 #include <config.h>
 
 #include <stddef.h>
diff --git a/contrib/bind9/lib/dns/dst_openssl.h b/contrib/bind9/lib/dns/dst_openssl.h
index 8dbc350..79e10b0 100644
--- a/contrib/bind9/lib/dns/dst_openssl.h
+++ b/contrib/bind9/lib/dns/dst_openssl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst_openssl.h,v 1.1.2.1 2004/12/09 04:07:17 marka Exp $ */
+/* $Id: dst_openssl.h,v 1.1.4.3 2005/04/29 00:15:52 marka Exp $ */
 
 #ifndef DST_OPENSSL_H
 #define DST_OPENSSL_H 1
@@ -31,3 +31,4 @@ dst__openssl_toresult(isc_result_t fallback);
 ISC_LANG_ENDDECLS
 
 #endif /* DST_OPENSSL_H */
+/*! \file */
diff --git a/contrib/bind9/lib/dns/dst_parse.c b/contrib/bind9/lib/dns/dst_parse.c
index d34aeca..aad7998 100644
--- a/contrib/bind9/lib/dns/dst_parse.c
+++ b/contrib/bind9/lib/dns/dst_parse.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -16,9 +16,9 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
+/*%
  * Principal Author: Brian Wellington
- * $Id: dst_parse.c,v 1.1.4.1 2004/12/09 04:07:17 marka Exp $
+ * $Id: dst_parse.c,v 1.1.6.7 2006/05/16 03:59:26 marka Exp $
  */
 
 #include <config.h>
@@ -67,6 +67,23 @@ static struct parse_map map[] = {
 	{TAG_DSA_PUBLIC, "Public_value(y):"},
 
 	{TAG_HMACMD5_KEY, "Key:"},
+	{TAG_HMACMD5_BITS, "Bits:"},
+
+	{TAG_HMACSHA1_KEY, "Key:"},
+	{TAG_HMACSHA1_BITS, "Bits:"},
+
+	{TAG_HMACSHA224_KEY, "Key:"},
+	{TAG_HMACSHA224_BITS, "Bits:"},
+
+	{TAG_HMACSHA256_KEY, "Key:"},
+	{TAG_HMACSHA256_BITS, "Bits:"},
+
+	{TAG_HMACSHA384_KEY, "Key:"},
+	{TAG_HMACSHA384_BITS, "Bits:"},
+
+	{TAG_HMACSHA512_KEY, "Key:"},
+	{TAG_HMACSHA512_BITS, "Bits:"},
+
 	{0, NULL}
 };
 
@@ -141,16 +158,53 @@ check_dsa(const dst_private_t *priv) {
 }
 
 static int
-check_hmac_md5(const dst_private_t *priv) {
-	if (priv->nelements != HMACMD5_NTAGS)
+check_hmac_md5(const dst_private_t *priv, isc_boolean_t old) {
+	int i, j;
+
+	if (priv->nelements != HMACMD5_NTAGS) {
+		/*
+		 * If this is a good old format and we are accepting
+		 * the old format return success.
+		 */
+		if (old && priv->nelements == OLD_HMACMD5_NTAGS &&
+		    priv->elements[0].tag == TAG_HMACMD5_KEY)
+			return (0);
 		return (-1);
-	if (priv->elements[0].tag != TAG_HMACMD5_KEY)
+	}
+	/*
+	 * We must be new format at this point.
+	 */
+	for (i = 0; i < HMACMD5_NTAGS; i++) {
+		for (j = 0; j < priv->nelements; j++)
+			if (priv->elements[j].tag == TAG(DST_ALG_HMACMD5, i))
+				break;
+		if (j == priv->nelements)
+			return (-1);
+	}
+	return (0);
+}
+
+static int
+check_hmac_sha(const dst_private_t *priv, unsigned int ntags,
+	       unsigned int alg)
+{
+	unsigned int i, j;
+	if (priv->nelements != ntags)
 		return (-1);
+	for (i = 0; i < ntags; i++) {
+		for (j = 0; j < priv->nelements; j++)
+			if (priv->elements[j].tag == TAG(alg, i))
+				break;
+		if (j == priv->nelements)
+			return (-1);
+	}
 	return (0);
 }
 
 static int
-check_data(const dst_private_t *priv, const unsigned int alg) {
+check_data(const dst_private_t *priv, const unsigned int alg,
+	   isc_boolean_t old)
+{
 	/* XXXVIX this switch statement is too sparse to gen a jump table. */
 	switch (alg) {
 	case DST_ALG_RSAMD5:
@@ -161,7 +215,17 @@ check_data(const dst_private_t *priv, const unsigned int alg) {
 	case DST_ALG_DSA:
 		return (check_dsa(priv));
 	case DST_ALG_HMACMD5:
-		return (check_hmac_md5(priv));
+		return (check_hmac_md5(priv, old));
+	case DST_ALG_HMACSHA1:
+		return (check_hmac_sha(priv, HMACSHA1_NTAGS, alg));
+	case DST_ALG_HMACSHA224:
+		return (check_hmac_sha(priv, HMACSHA224_NTAGS, alg));
+	case DST_ALG_HMACSHA256:
+		return (check_hmac_sha(priv, HMACSHA256_NTAGS, alg));
+	case DST_ALG_HMACSHA384:
+		return (check_hmac_sha(priv, HMACSHA384_NTAGS, alg));
+	case DST_ALG_HMACSHA512:
+		return (check_hmac_sha(priv, HMACSHA512_NTAGS, alg));
 	default:
 		return (DST_R_UNSUPPORTEDALG);
 	}
@@ -313,7 +377,7 @@ dst__privstruct_parse(dst_key_t *key, unsigned int alg, isc_lex_t *lex,
  done:
 	priv->nelements = n;
 
-	if (check_data(priv, alg) < 0)
+	if (check_data(priv, alg, ISC_TRUE) < 0)
 		goto fail;
 
 	return (ISC_R_SUCCESS);
@@ -341,7 +405,7 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 
 	REQUIRE(priv != NULL);
 
-	if (check_data(priv, dst_key_alg(key)) < 0)
+	if (check_data(priv, dst_key_alg(key), ISC_FALSE) < 0)
 		return (DST_R_INVALIDPRIVATEKEY);
 
 	isc_buffer_init(&b, filename, sizeof(filename));
@@ -380,6 +444,21 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	case DST_ALG_HMACMD5:
 		fprintf(fp, "(HMAC_MD5)\n");
 		break;
+	case DST_ALG_HMACSHA1:
+		fprintf(fp, "(HMAC_SHA1)\n");
+		break;
+	case DST_ALG_HMACSHA224:
+		fprintf(fp, "(HMAC_SHA224)\n");
+		break;
+	case DST_ALG_HMACSHA256:
+		fprintf(fp, "(HMAC_SHA256)\n");
+		break;
+	case DST_ALG_HMACSHA384:
+		fprintf(fp, "(HMAC_SHA384)\n");
+		break;
+	case DST_ALG_HMACSHA512:
+		fprintf(fp, "(HMAC_SHA512)\n");
+		break;
 	default:
 		fprintf(fp, "(?)\n");
 		break;
@@ -410,3 +489,5 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 	fclose(fp);
 	return (ISC_R_SUCCESS);
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/dns/dst_parse.h b/contrib/bind9/lib/dns/dst_parse.h
index 9ecef4f..8656f59 100644
--- a/contrib/bind9/lib/dns/dst_parse.h
+++ b/contrib/bind9/lib/dns/dst_parse.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2000-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -16,8 +16,9 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst_parse.h,v 1.1.4.1 2004/12/09 04:07:17 marka Exp $ */
+/* $Id: dst_parse.h,v 1.1.6.5 2006/01/27 23:57:44 marka Exp $ */
 
+/*! \file */
 #ifndef DST_DST_PARSE_H
 #define DST_DST_PARSE_H 1
 
@@ -59,8 +60,30 @@
 #define TAG_DSA_PRIVATE		((DST_ALG_DSA << TAG_SHIFT) + 3)
 #define TAG_DSA_PUBLIC		((DST_ALG_DSA << TAG_SHIFT) + 4)
 
-#define HMACMD5_NTAGS		1
+#define OLD_HMACMD5_NTAGS	1
+#define HMACMD5_NTAGS		2
 #define TAG_HMACMD5_KEY		((DST_ALG_HMACMD5 << TAG_SHIFT) + 0)
+#define TAG_HMACMD5_BITS	((DST_ALG_HMACMD5 << TAG_SHIFT) + 1)
+
+#define HMACSHA1_NTAGS		2
+#define TAG_HMACSHA1_KEY	((DST_ALG_HMACSHA1 << TAG_SHIFT) + 0)
+#define TAG_HMACSHA1_BITS	((DST_ALG_HMACSHA1 << TAG_SHIFT) + 1)
+
+#define HMACSHA224_NTAGS	2
+#define TAG_HMACSHA224_KEY	((DST_ALG_HMACSHA224 << TAG_SHIFT) + 0)
+#define TAG_HMACSHA224_BITS	((DST_ALG_HMACSHA224 << TAG_SHIFT) + 1)
+
+#define HMACSHA256_NTAGS	2
+#define TAG_HMACSHA256_KEY	((DST_ALG_HMACSHA256 << TAG_SHIFT) + 0)
+#define TAG_HMACSHA256_BITS	((DST_ALG_HMACSHA224 << TAG_SHIFT) + 1)
+
+#define HMACSHA384_NTAGS	2
+#define TAG_HMACSHA384_KEY	((DST_ALG_HMACSHA384 << TAG_SHIFT) + 0)
+#define TAG_HMACSHA384_BITS	((DST_ALG_HMACSHA384 << TAG_SHIFT) + 1)
+
+#define HMACSHA512_NTAGS	2
+#define TAG_HMACSHA512_KEY	((DST_ALG_HMACSHA512 << TAG_SHIFT) + 0)
+#define TAG_HMACSHA512_BITS	((DST_ALG_HMACSHA512 << TAG_SHIFT) + 1)
 
 struct dst_private_element {
 	unsigned short tag;
diff --git a/contrib/bind9/lib/dns/dst_result.c b/contrib/bind9/lib/dns/dst_result.c
index 9b1536c..c9bf073 100644
--- a/contrib/bind9/lib/dns/dst_result.c
+++ b/contrib/bind9/lib/dns/dst_result.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*
+/*%
  * Principal Author: Brian Wellington
- * $Id: dst_result.c,v 1.1.4.1 2004/12/09 04:07:17 marka Exp $
+ * $Id: dst_result.c,v 1.1.6.3 2005/04/29 00:15:52 marka Exp $
  */
 
 #include <config.h>
@@ -29,27 +29,27 @@
 #include <dst/lib.h>
 
 static const char *text[DST_R_NRESULTS] = {
-	"algorithm is unsupported",		/*  0 */
-	"openssl failure",			/*  1 */
-	"built with no crypto support",		/*  2 */
-	"illegal operation for a null key",	/*  3 */
-	"public key is invalid",		/*  4 */
-	"private key is invalid",		/*  5 */
-	"UNUSED6",				/*  6 */
-	"error occurred writing key to disk",	/*  7 */
-	"invalid algorithm specific parameter",	/*  8 */
-	"UNUSED9",				/*  9 */
-	"UNUSED10",				/* 10 */
-	"sign failure",				/* 11 */
-	"UNUSED12",				/* 12 */
-	"UNUSED13",				/* 13 */
-	"verify failure",			/* 14 */
-	"not a public key",			/* 15 */
-	"not a private key",			/* 16 */
-	"not a key that can compute a secret",	/* 17 */
-	"failure computing a shared secret",	/* 18 */
-	"no randomness available",		/* 19 */
-	"bad key type"				/* 20 */
+	"algorithm is unsupported",		/*%< 0 */
+	"openssl failure",			/*%< 1 */
+	"built with no crypto support",		/*%< 2 */
+	"illegal operation for a null key",	/*%< 3 */
+	"public key is invalid",		/*%< 4 */
+	"private key is invalid",		/*%< 5 */
+	"UNUSED6",				/*%< 6 */
+	"error occurred writing key to disk",	/*%< 7 */
+	"invalid algorithm specific parameter",	/*%< 8 */
+	"UNUSED9",				/*%< 9 */
+	"UNUSED10",				/*%< 10 */
+	"sign failure",				/*%< 11 */
+	"UNUSED12",				/*%< 12 */
+	"UNUSED13",				/*%< 13 */
+	"verify failure",			/*%< 14 */
+	"not a public key",			/*%< 15 */
+	"not a private key",			/*%< 16 */
+	"not a key that can compute a secret",	/*%< 17 */
+	"failure computing a shared secret",	/*%< 18 */
+	"no randomness available",		/*%< 19 */
+	"bad key type"				/*%< 20 */
 };
 
 #define DST_RESULT_RESULTSET			2
@@ -84,3 +84,5 @@ void
 dst_result_register(void) {
 	initialize();
 }
+
+/*! \file */
diff --git a/contrib/bind9/lib/dns/forward.c b/contrib/bind9/lib/dns/forward.c
index 1455fbad..e80a477 100644
--- a/contrib/bind9/lib/dns/forward.c
+++ b/contrib/bind9/lib/dns/forward.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: forward.c,v 1.5.206.3 2005/03/17 03:58:30 marka Exp $ */
+/* $Id: forward.c,v 1.6.18.4 2005/07/12 01:22:20 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -62,13 +64,8 @@ dns_fwdtable_create(isc_mem_t *mctx, dns_fwdtable_t **fwdtablep) {
 		goto cleanup_fwdtable;
 
 	result = isc_rwlock_init(&fwdtable->rwlock, 0, 0);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_rwlock_init() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_rbt;
-	}
 
 	fwdtable->mctx = NULL;
 	isc_mem_attach(mctx, &fwdtable->mctx);
diff --git a/contrib/bind9/lib/dns/gen-unix.h b/contrib/bind9/lib/dns/gen-unix.h
index bd007c4..fc2dbf2 100644
--- a/contrib/bind9/lib/dns/gen-unix.h
+++ b/contrib/bind9/lib/dns/gen-unix.h
@@ -15,9 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gen-unix.h,v 1.12.12.5 2005/06/09 23:54:29 marka Exp $ */
+/* $Id: gen-unix.h,v 1.14.18.3 2005/06/08 02:07:54 marka Exp $ */
 
-/*
+/*! \file
+ * \brief
  * This file is responsible for defining two operations that are not
  * directly portable between Unix-like systems and Windows NT, option
  * parsing and directory scanning.  It is here because it was decided
diff --git a/contrib/bind9/lib/dns/gen.c b/contrib/bind9/lib/dns/gen.c
index 1d83023..1e6212a 100644
--- a/contrib/bind9/lib/dns/gen.c
+++ b/contrib/bind9/lib/dns/gen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gen.c,v 1.65.2.5.2.9 2006/10/02 06:31:26 marka Exp $ */
+/* $Id: gen.c,v 1.73.18.6 2006/10/02 06:36:43 marka Exp $ */
+
+/*! \file */
 
 #ifdef WIN32
 /*
@@ -123,6 +125,8 @@ const char copyright[] =
 " ***************   DO NOT EDIT!\n"
 " ***************\n"
 " ***************/\n"
+"\n"
+"/*! \\file */\n"
 "\n";
 
 #define TYPENAMES 256
@@ -168,7 +172,7 @@ sd(int, const char *, const char *, char);
 void
 insert_into_typenames(int, const char *, const char *);
 
-/*
+/*%
  * If you use more than 10 of these in, say, a printf(), you'll have problems.
  */
 char *
@@ -832,13 +836,10 @@ main(int argc, char **argv) {
 	} while (0)
 
 		for (cc = classes; cc != NULL; cc = cc->next) {
-			if (cc->rdclass == 4) {
-				PRINTCLASS("ch", 3);
+			if (cc->rdclass == 3)
 				PRINTCLASS("chaos", 3);
-
-			} else if (cc->rdclass == 255) {
+			else if (cc->rdclass == 255)
 				PRINTCLASS("none", 254);
-			}
 			PRINTCLASS(cc->classname, cc->rdclass);
 		}
 
diff --git a/contrib/bind9/lib/dns/gssapi_link.c b/contrib/bind9/lib/dns/gssapi_link.c
index 0a2e848..a6a367a 100644
--- a/contrib/bind9/lib/dns/gssapi_link.c
+++ b/contrib/bind9/lib/dns/gssapi_link.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: gssapi_link.c,v 1.1.4.1 2004/12/09 04:07:17 marka Exp $
+ * $Id: gssapi_link.c,v 1.1.6.3 2005/04/29 00:15:53 marka Exp $
  */
 
 #ifdef GSSAPI
@@ -194,17 +194,17 @@ static dst_func_t gssapi_functions = {
 	gssapi_adddata,
 	gssapi_sign,
 	gssapi_verify,
-	NULL, /* computesecret */
+	NULL, /*%< computesecret */
 	gssapi_compare,
-	NULL, /* paramcompare */
+	NULL, /*%< paramcompare */
 	gssapi_generate,
 	gssapi_isprivate,
 	gssapi_destroy,
-	NULL, /* todns */
-	NULL, /* fromdns */
-	NULL, /* tofile */
-	NULL, /* parse */
-	NULL, /* cleanup */
+	NULL, /*%< todns */
+	NULL, /*%< fromdns */
+	NULL, /*%< tofile */
+	NULL, /*%< parse */
+	NULL, /*%< cleanup */
 };
 
 isc_result_t
@@ -218,3 +218,5 @@ dst__gssapi_init(dst_func_t **funcp) {
 #else
 int  gssapi_link_unneeded = 1;
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/dns/gssapictx.c b/contrib/bind9/lib/dns/gssapictx.c
index 2605a7a..ce5d6fa 100644
--- a/contrib/bind9/lib/dns/gssapictx.c
+++ b/contrib/bind9/lib/dns/gssapictx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gssapictx.c,v 1.1.4.1 2004/12/09 04:07:17 marka Exp $ */
+/* $Id: gssapictx.c,v 1.1.6.3 2005/04/29 00:15:54 marka Exp $ */
 
 #include <config.h>
 
@@ -260,3 +260,5 @@ dst_gssapi_acceptctx(dns_name_t *name, void *cred,
 }
 
 #endif
+
+/*! \file */
diff --git a/contrib/bind9/lib/dns/hmac_link.c b/contrib/bind9/lib/dns/hmac_link.c
index 762fcee..9655c89 100644
--- a/contrib/bind9/lib/dns/hmac_link.c
+++ b/contrib/bind9/lib/dns/hmac_link.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -18,14 +18,16 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: hmac_link.c,v 1.1.4.1 2004/12/09 04:07:17 marka Exp $
+ * $Id: hmac_link.c,v 1.1.6.5 2006/01/27 23:57:44 marka Exp $
  */
 
 #include <config.h>
 
 #include <isc/buffer.h>
 #include <isc/hmacmd5.h>
+#include <isc/hmacsha.h>
 #include <isc/md5.h>
+#include <isc/sha1.h>
 #include <isc/mem.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -46,6 +48,17 @@ typedef struct hmackey {
 } HMAC_Key;
 
 static isc_result_t
+getkeybits(dst_key_t *key, struct dst_private_element *element) {
+
+	if (element->length != 2)
+		return (DST_R_INVALIDPRIVATEKEY);
+
+	key->key_bits =	(element->data[0] << 8) + element->data[1];
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
 hmacmd5_createctx(dst_key_t *key, dst_context_t *dctx) {
 	isc_hmacmd5_t *hmacmd5ctx;
 	HMAC_Key *hkey = key->opaque;
@@ -95,10 +108,10 @@ static isc_result_t
 hmacmd5_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	isc_hmacmd5_t *hmacmd5ctx = dctx->opaque;
 
-	if (sig->length < ISC_MD5_DIGESTLENGTH)
+	if (sig->length > ISC_MD5_DIGESTLENGTH)
 		return (DST_R_VERIFYFAILURE);
 
-	if (isc_hmacmd5_verify(hmacmd5ctx, sig->base))
+	if (isc_hmacmd5_verify2(hmacmd5ctx, sig->base, sig->length))
 		return (ISC_R_SUCCESS);
 	else
 		return (DST_R_VERIFYFAILURE);
@@ -130,9 +143,9 @@ hmacmd5_generate(dst_key_t *key, int pseudorandom_ok) {
 	unsigned char data[HMAC_LEN];
 
 	bytes = (key->key_size + 7) / 8;
-	if (bytes > 64) {
-		bytes = 64;
-		key->key_size = 512;
+	if (bytes > HMAC_LEN) {
+		bytes = HMAC_LEN;
+		key->key_size = HMAC_LEN * 8;
 	}
 
 	memset(data, 0, HMAC_LEN);
@@ -220,6 +233,7 @@ hmacmd5_tofile(const dst_key_t *key, const char *directory) {
 	HMAC_Key *hkey;
 	dst_private_t priv;
 	int bytes = (key->key_size + 7) / 8;
+	unsigned char buf[2];
 
 	if (key->opaque == NULL)
 		return (DST_R_NULLKEY);
@@ -230,6 +244,12 @@ hmacmd5_tofile(const dst_key_t *key, const char *directory) {
 	priv.elements[cnt].length = bytes;
 	priv.elements[cnt++].data = hkey->key;
 
+	buf[0] = (key->key_bits >> 8) & 0xffU;
+	buf[1] = key->key_bits & 0xffU;
+	priv.elements[cnt].tag = TAG_HMACMD5_BITS;
+	priv.elements[cnt].data = buf;
+	priv.elements[cnt++].length = 2;
+
 	priv.nelements = cnt;
 	return (dst__privstruct_writefile(key, &priv, directory));
 }
@@ -237,21 +257,40 @@ hmacmd5_tofile(const dst_key_t *key, const char *directory) {
 static isc_result_t
 hmacmd5_parse(dst_key_t *key, isc_lex_t *lexer) {
 	dst_private_t priv;
-	isc_result_t ret;
+	isc_result_t result, tresult;
 	isc_buffer_t b;
 	isc_mem_t *mctx = key->mctx;
+	unsigned int i;
 
 	/* read private key file */
-	ret = dst__privstruct_parse(key, DST_ALG_HMACMD5, lexer, mctx, &priv);
-	if (ret != ISC_R_SUCCESS)
-		return (ret);
+	result = dst__privstruct_parse(key, DST_ALG_HMACMD5, lexer, mctx, &priv);
+	if (result != ISC_R_SUCCESS)
+		return (result);
 
-	isc_buffer_init(&b, priv.elements[0].data, priv.elements[0].length);
-	isc_buffer_add(&b, priv.elements[0].length);
-	ret = hmacmd5_fromdns(key, &b);
+	key->key_bits = 0;
+	for (i = 0; i < priv.nelements && result == ISC_R_SUCCESS; i++) {
+		switch (priv.elements[i].tag) {
+		case TAG_HMACMD5_KEY:
+			isc_buffer_init(&b, priv.elements[i].data,
+				        priv.elements[i].length);
+			isc_buffer_add(&b, priv.elements[i].length);
+			tresult = hmacmd5_fromdns(key, &b);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		case TAG_HMACMD5_BITS:
+			tresult = getkeybits(key, &priv.elements[i]);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		default:
+			result = DST_R_INVALIDPRIVATEKEY;
+			break;
+		}
+	}
 	dst__privstruct_free(&priv, mctx);
 	memset(&priv, 0, sizeof(priv));
-	return (ret);
+	return (result);
 }
 
 static dst_func_t hmacmd5_functions = {
@@ -260,9 +299,9 @@ static dst_func_t hmacmd5_functions = {
 	hmacmd5_adddata,
 	hmacmd5_sign,
 	hmacmd5_verify,
-	NULL, /* computesecret */
+	NULL, /*%< computesecret */
 	hmacmd5_compare,
-	NULL, /* paramcompare */
+	NULL, /*%< paramcompare */
 	hmacmd5_generate,
 	hmacmd5_isprivate,
 	hmacmd5_destroy,
@@ -270,7 +309,7 @@ static dst_func_t hmacmd5_functions = {
 	hmacmd5_fromdns,
 	hmacmd5_tofile,
 	hmacmd5_parse,
-	NULL, /* cleanup */
+	NULL, /*%< cleanup */
 };
 
 isc_result_t
@@ -280,3 +319,1350 @@ dst__hmacmd5_init(dst_func_t **funcp) {
 		*funcp = &hmacmd5_functions;
 	return (ISC_R_SUCCESS);
 }
+
+static isc_result_t hmacsha1_fromdns(dst_key_t *key, isc_buffer_t *data);
+
+typedef struct {
+	unsigned char key[ISC_SHA1_DIGESTLENGTH];
+} HMACSHA1_Key;
+
+static isc_result_t
+hmacsha1_createctx(dst_key_t *key, dst_context_t *dctx) {
+	isc_hmacsha1_t *hmacsha1ctx;
+	HMACSHA1_Key *hkey = key->opaque;
+
+	hmacsha1ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacsha1_t));
+	if (hmacsha1ctx == NULL)
+		return (ISC_R_NOMEMORY);
+	isc_hmacsha1_init(hmacsha1ctx, hkey->key, ISC_SHA1_DIGESTLENGTH);
+	dctx->opaque = hmacsha1ctx;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+hmacsha1_destroyctx(dst_context_t *dctx) {
+	isc_hmacsha1_t *hmacsha1ctx = dctx->opaque;
+
+	if (hmacsha1ctx != NULL) {
+		isc_hmacsha1_invalidate(hmacsha1ctx);
+		isc_mem_put(dctx->mctx, hmacsha1ctx, sizeof(isc_hmacsha1_t));
+		dctx->opaque = NULL;
+	}
+}
+
+static isc_result_t
+hmacsha1_adddata(dst_context_t *dctx, const isc_region_t *data) {
+	isc_hmacsha1_t *hmacsha1ctx = dctx->opaque;
+
+	isc_hmacsha1_update(hmacsha1ctx, data->base, data->length);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha1_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+	isc_hmacsha1_t *hmacsha1ctx = dctx->opaque;
+	unsigned char *digest;
+
+	if (isc_buffer_availablelength(sig) < ISC_SHA1_DIGESTLENGTH)
+		return (ISC_R_NOSPACE);
+	digest = isc_buffer_used(sig);
+	isc_hmacsha1_sign(hmacsha1ctx, digest, ISC_SHA1_DIGESTLENGTH);
+	isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha1_verify(dst_context_t *dctx, const isc_region_t *sig) {
+	isc_hmacsha1_t *hmacsha1ctx = dctx->opaque;
+
+	if (sig->length > ISC_SHA1_DIGESTLENGTH || sig->length == 0)
+		return (DST_R_VERIFYFAILURE);
+
+	if (isc_hmacsha1_verify(hmacsha1ctx, sig->base, sig->length))
+		return (ISC_R_SUCCESS);
+	else
+		return (DST_R_VERIFYFAILURE);
+}
+
+static isc_boolean_t
+hmacsha1_compare(const dst_key_t *key1, const dst_key_t *key2) {
+	HMACSHA1_Key *hkey1, *hkey2;
+
+	hkey1 = (HMACSHA1_Key *)key1->opaque;
+	hkey2 = (HMACSHA1_Key *)key2->opaque;
+
+	if (hkey1 == NULL && hkey2 == NULL)
+		return (ISC_TRUE);
+	else if (hkey1 == NULL || hkey2 == NULL)
+		return (ISC_FALSE);
+
+	if (memcmp(hkey1->key, hkey2->key, ISC_SHA1_DIGESTLENGTH) == 0)
+		return (ISC_TRUE);
+	else
+		return (ISC_FALSE);
+}
+
+static isc_result_t
+hmacsha1_generate(dst_key_t *key, int pseudorandom_ok) {
+	isc_buffer_t b;
+	isc_result_t ret;
+	int bytes;
+	unsigned char data[HMAC_LEN];
+
+	bytes = (key->key_size + 7) / 8;
+	if (bytes > HMAC_LEN) {
+		bytes = HMAC_LEN;
+		key->key_size = HMAC_LEN * 8;
+	}
+
+	memset(data, 0, HMAC_LEN);
+	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
+
+	if (ret != ISC_R_SUCCESS)
+		return (ret);
+
+	isc_buffer_init(&b, data, bytes);
+	isc_buffer_add(&b, bytes);
+	ret = hmacsha1_fromdns(key, &b);
+	memset(data, 0, ISC_SHA1_DIGESTLENGTH);
+
+	return (ret);
+}
+
+static isc_boolean_t
+hmacsha1_isprivate(const dst_key_t *key) {
+	UNUSED(key);
+	return (ISC_TRUE);
+}
+
+static void
+hmacsha1_destroy(dst_key_t *key) {
+	HMACSHA1_Key *hkey = key->opaque;
+	memset(hkey, 0, sizeof(HMACSHA1_Key));
+	isc_mem_put(key->mctx, hkey, sizeof(HMACSHA1_Key));
+	key->opaque = NULL;
+}
+
+static isc_result_t
+hmacsha1_todns(const dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA1_Key *hkey;
+	unsigned int bytes;
+
+	REQUIRE(key->opaque != NULL);
+
+	hkey = (HMACSHA1_Key *) key->opaque;
+
+	bytes = (key->key_size + 7) / 8;
+	if (isc_buffer_availablelength(data) < bytes)
+		return (ISC_R_NOSPACE);
+	isc_buffer_putmem(data, hkey->key, bytes);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha1_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA1_Key *hkey;
+	int keylen;
+	isc_region_t r;
+	isc_sha1_t sha1ctx;
+
+	isc_buffer_remainingregion(data, &r);
+	if (r.length == 0)
+		return (ISC_R_SUCCESS);
+
+	hkey = (HMACSHA1_Key *) isc_mem_get(key->mctx, sizeof(HMACSHA1_Key));
+	if (hkey == NULL)
+		return (ISC_R_NOMEMORY);
+
+	memset(hkey->key, 0, sizeof(hkey->key));
+
+	if (r.length > ISC_SHA1_DIGESTLENGTH) {
+		isc_sha1_init(&sha1ctx);
+		isc_sha1_update(&sha1ctx, r.base, r.length);
+		isc_sha1_final(&sha1ctx, hkey->key);
+		keylen = ISC_SHA1_DIGESTLENGTH;
+	}
+	else {
+		memcpy(hkey->key, r.base, r.length);
+		keylen = r.length;
+	}
+
+	key->key_size = keylen * 8;
+	key->opaque = hkey;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha1_tofile(const dst_key_t *key, const char *directory) {
+	int cnt = 0;
+	HMACSHA1_Key *hkey;
+	dst_private_t priv;
+	int bytes = (key->key_size + 7) / 8;
+	unsigned char buf[2];
+
+	if (key->opaque == NULL)
+		return (DST_R_NULLKEY);
+
+	hkey = (HMACSHA1_Key *) key->opaque;
+
+	priv.elements[cnt].tag = TAG_HMACSHA1_KEY;
+	priv.elements[cnt].length = bytes;
+	priv.elements[cnt++].data = hkey->key;
+
+	buf[0] = (key->key_bits >> 8) & 0xffU;
+	buf[1] = key->key_bits & 0xffU;
+	priv.elements[cnt].tag = TAG_HMACSHA1_BITS;
+	priv.elements[cnt].data = buf;
+	priv.elements[cnt++].length = 2;
+
+	priv.nelements = cnt;
+	return (dst__privstruct_writefile(key, &priv, directory));
+}
+
+static isc_result_t
+hmacsha1_parse(dst_key_t *key, isc_lex_t *lexer) {
+	dst_private_t priv;
+	isc_result_t result, tresult;
+	isc_buffer_t b;
+	isc_mem_t *mctx = key->mctx;
+	unsigned int i;
+
+	/* read private key file */
+	result = dst__privstruct_parse(key, DST_ALG_HMACSHA1, lexer, mctx,
+				       &priv);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	key->key_bits = 0;
+	for (i = 0; i < priv.nelements; i++) {
+		switch (priv.elements[i].tag) {
+		case TAG_HMACSHA1_KEY:
+			isc_buffer_init(&b, priv.elements[i].data,
+				        priv.elements[i].length);
+			isc_buffer_add(&b, priv.elements[i].length);
+			tresult = hmacsha1_fromdns(key, &b);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		case TAG_HMACSHA1_BITS:
+			tresult = getkeybits(key, &priv.elements[i]);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		default:
+			result = DST_R_INVALIDPRIVATEKEY;
+			break;
+		}
+	}
+	dst__privstruct_free(&priv, mctx);
+	memset(&priv, 0, sizeof(priv));
+	return (result);
+}
+
+static dst_func_t hmacsha1_functions = {
+	hmacsha1_createctx,
+	hmacsha1_destroyctx,
+	hmacsha1_adddata,
+	hmacsha1_sign,
+	hmacsha1_verify,
+	NULL, /* computesecret */
+	hmacsha1_compare,
+	NULL, /* paramcompare */
+	hmacsha1_generate,
+	hmacsha1_isprivate,
+	hmacsha1_destroy,
+	hmacsha1_todns,
+	hmacsha1_fromdns,
+	hmacsha1_tofile,
+	hmacsha1_parse,
+	NULL, /* cleanup */
+};
+
+isc_result_t
+dst__hmacsha1_init(dst_func_t **funcp) {
+	REQUIRE(funcp != NULL);
+	if (*funcp == NULL)
+		*funcp = &hmacsha1_functions;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t hmacsha224_fromdns(dst_key_t *key, isc_buffer_t *data);
+
+typedef struct {
+	unsigned char key[ISC_SHA224_DIGESTLENGTH];
+} HMACSHA224_Key;
+
+static isc_result_t
+hmacsha224_createctx(dst_key_t *key, dst_context_t *dctx) {
+	isc_hmacsha224_t *hmacsha224ctx;
+	HMACSHA224_Key *hkey = key->opaque;
+
+	hmacsha224ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacsha224_t));
+	if (hmacsha224ctx == NULL)
+		return (ISC_R_NOMEMORY);
+	isc_hmacsha224_init(hmacsha224ctx, hkey->key, ISC_SHA224_DIGESTLENGTH);
+	dctx->opaque = hmacsha224ctx;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+hmacsha224_destroyctx(dst_context_t *dctx) {
+	isc_hmacsha224_t *hmacsha224ctx = dctx->opaque;
+
+	if (hmacsha224ctx != NULL) {
+		isc_hmacsha224_invalidate(hmacsha224ctx);
+		isc_mem_put(dctx->mctx, hmacsha224ctx, sizeof(isc_hmacsha224_t));
+		dctx->opaque = NULL;
+	}
+}
+
+static isc_result_t
+hmacsha224_adddata(dst_context_t *dctx, const isc_region_t *data) {
+	isc_hmacsha224_t *hmacsha224ctx = dctx->opaque;
+
+	isc_hmacsha224_update(hmacsha224ctx, data->base, data->length);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha224_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+	isc_hmacsha224_t *hmacsha224ctx = dctx->opaque;
+	unsigned char *digest;
+
+	if (isc_buffer_availablelength(sig) < ISC_SHA224_DIGESTLENGTH)
+		return (ISC_R_NOSPACE);
+	digest = isc_buffer_used(sig);
+	isc_hmacsha224_sign(hmacsha224ctx, digest, ISC_SHA224_DIGESTLENGTH);
+	isc_buffer_add(sig, ISC_SHA224_DIGESTLENGTH);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha224_verify(dst_context_t *dctx, const isc_region_t *sig) {
+	isc_hmacsha224_t *hmacsha224ctx = dctx->opaque;
+
+	if (sig->length > ISC_SHA224_DIGESTLENGTH || sig->length == 0)
+		return (DST_R_VERIFYFAILURE);
+
+	if (isc_hmacsha224_verify(hmacsha224ctx, sig->base, sig->length))
+		return (ISC_R_SUCCESS);
+	else
+		return (DST_R_VERIFYFAILURE);
+}
+
+static isc_boolean_t
+hmacsha224_compare(const dst_key_t *key1, const dst_key_t *key2) {
+	HMACSHA224_Key *hkey1, *hkey2;
+
+	hkey1 = (HMACSHA224_Key *)key1->opaque;
+	hkey2 = (HMACSHA224_Key *)key2->opaque;
+
+	if (hkey1 == NULL && hkey2 == NULL)
+		return (ISC_TRUE);
+	else if (hkey1 == NULL || hkey2 == NULL)
+		return (ISC_FALSE);
+
+	if (memcmp(hkey1->key, hkey2->key, ISC_SHA224_DIGESTLENGTH) == 0)
+		return (ISC_TRUE);
+	else
+		return (ISC_FALSE);
+}
+
+static isc_result_t
+hmacsha224_generate(dst_key_t *key, int pseudorandom_ok) {
+	isc_buffer_t b;
+	isc_result_t ret;
+	int bytes;
+	unsigned char data[HMAC_LEN];
+
+	bytes = (key->key_size + 7) / 8;
+	if (bytes > HMAC_LEN) {
+		bytes = HMAC_LEN;
+		key->key_size = HMAC_LEN * 8;
+	}
+
+	memset(data, 0, HMAC_LEN);
+	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
+
+	if (ret != ISC_R_SUCCESS)
+		return (ret);
+
+	isc_buffer_init(&b, data, bytes);
+	isc_buffer_add(&b, bytes);
+	ret = hmacsha224_fromdns(key, &b);
+	memset(data, 0, ISC_SHA224_DIGESTLENGTH);
+
+	return (ret);
+}
+
+static isc_boolean_t
+hmacsha224_isprivate(const dst_key_t *key) {
+	UNUSED(key);
+	return (ISC_TRUE);
+}
+
+static void
+hmacsha224_destroy(dst_key_t *key) {
+	HMACSHA224_Key *hkey = key->opaque;
+	memset(hkey, 0, sizeof(HMACSHA224_Key));
+	isc_mem_put(key->mctx, hkey, sizeof(HMACSHA224_Key));
+	key->opaque = NULL;
+}
+
+static isc_result_t
+hmacsha224_todns(const dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA224_Key *hkey;
+	unsigned int bytes;
+
+	REQUIRE(key->opaque != NULL);
+
+	hkey = (HMACSHA224_Key *) key->opaque;
+
+	bytes = (key->key_size + 7) / 8;
+	if (isc_buffer_availablelength(data) < bytes)
+		return (ISC_R_NOSPACE);
+	isc_buffer_putmem(data, hkey->key, bytes);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha224_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA224_Key *hkey;
+	int keylen;
+	isc_region_t r;
+	isc_sha224_t sha224ctx;
+
+	isc_buffer_remainingregion(data, &r);
+	if (r.length == 0)
+		return (ISC_R_SUCCESS);
+
+	hkey = (HMACSHA224_Key *) isc_mem_get(key->mctx, sizeof(HMACSHA224_Key));
+	if (hkey == NULL)
+		return (ISC_R_NOMEMORY);
+
+	memset(hkey->key, 0, sizeof(hkey->key));
+
+	if (r.length > ISC_SHA224_DIGESTLENGTH) {
+		isc_sha224_init(&sha224ctx);
+		isc_sha224_update(&sha224ctx, r.base, r.length);
+		isc_sha224_final(hkey->key, &sha224ctx);
+		keylen = ISC_SHA224_DIGESTLENGTH;
+	}
+	else {
+		memcpy(hkey->key, r.base, r.length);
+		keylen = r.length;
+	}
+
+	key->key_size = keylen * 8;
+	key->opaque = hkey;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha224_tofile(const dst_key_t *key, const char *directory) {
+	int cnt = 0;
+	HMACSHA224_Key *hkey;
+	dst_private_t priv;
+	int bytes = (key->key_size + 7) / 8;
+	unsigned char buf[2];
+
+	if (key->opaque == NULL)
+		return (DST_R_NULLKEY);
+
+	hkey = (HMACSHA224_Key *) key->opaque;
+
+	priv.elements[cnt].tag = TAG_HMACSHA224_KEY;
+	priv.elements[cnt].length = bytes;
+	priv.elements[cnt++].data = hkey->key;
+
+	buf[0] = (key->key_bits >> 8) & 0xffU;
+	buf[1] = key->key_bits & 0xffU;
+	priv.elements[cnt].tag = TAG_HMACSHA224_BITS;
+	priv.elements[cnt].data = buf;
+	priv.elements[cnt++].length = 2;
+
+	priv.nelements = cnt;
+	return (dst__privstruct_writefile(key, &priv, directory));
+}
+
+static isc_result_t
+hmacsha224_parse(dst_key_t *key, isc_lex_t *lexer) {
+	dst_private_t priv;
+	isc_result_t result, tresult;
+	isc_buffer_t b;
+	isc_mem_t *mctx = key->mctx;
+	unsigned int i;
+
+	/* read private key file */
+	result = dst__privstruct_parse(key, DST_ALG_HMACSHA224, lexer, mctx,
+				       &priv);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	key->key_bits = 0;
+	for (i = 0; i < priv.nelements; i++) {
+		switch (priv.elements[i].tag) {
+		case TAG_HMACSHA224_KEY:
+			isc_buffer_init(&b, priv.elements[i].data,
+				        priv.elements[i].length);
+			isc_buffer_add(&b, priv.elements[i].length);
+			tresult = hmacsha224_fromdns(key, &b);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		case TAG_HMACSHA224_BITS:
+			tresult = getkeybits(key, &priv.elements[i]);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		default:
+			result = DST_R_INVALIDPRIVATEKEY;
+			break;
+		}
+	}
+	dst__privstruct_free(&priv, mctx);
+	memset(&priv, 0, sizeof(priv));
+	return (result);
+}
+
+static dst_func_t hmacsha224_functions = {
+	hmacsha224_createctx,
+	hmacsha224_destroyctx,
+	hmacsha224_adddata,
+	hmacsha224_sign,
+	hmacsha224_verify,
+	NULL, /* computesecret */
+	hmacsha224_compare,
+	NULL, /* paramcompare */
+	hmacsha224_generate,
+	hmacsha224_isprivate,
+	hmacsha224_destroy,
+	hmacsha224_todns,
+	hmacsha224_fromdns,
+	hmacsha224_tofile,
+	hmacsha224_parse,
+	NULL, /* cleanup */
+};
+
+isc_result_t
+dst__hmacsha224_init(dst_func_t **funcp) {
+	REQUIRE(funcp != NULL);
+	if (*funcp == NULL)
+		*funcp = &hmacsha224_functions;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t hmacsha256_fromdns(dst_key_t *key, isc_buffer_t *data);
+
+typedef struct {
+	unsigned char key[ISC_SHA256_DIGESTLENGTH];
+} HMACSHA256_Key;
+
+static isc_result_t
+hmacsha256_createctx(dst_key_t *key, dst_context_t *dctx) {
+	isc_hmacsha256_t *hmacsha256ctx;
+	HMACSHA256_Key *hkey = key->opaque;
+
+	hmacsha256ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacsha256_t));
+	if (hmacsha256ctx == NULL)
+		return (ISC_R_NOMEMORY);
+	isc_hmacsha256_init(hmacsha256ctx, hkey->key, ISC_SHA256_DIGESTLENGTH);
+	dctx->opaque = hmacsha256ctx;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+hmacsha256_destroyctx(dst_context_t *dctx) {
+	isc_hmacsha256_t *hmacsha256ctx = dctx->opaque;
+
+	if (hmacsha256ctx != NULL) {
+		isc_hmacsha256_invalidate(hmacsha256ctx);
+		isc_mem_put(dctx->mctx, hmacsha256ctx, sizeof(isc_hmacsha256_t));
+		dctx->opaque = NULL;
+	}
+}
+
+static isc_result_t
+hmacsha256_adddata(dst_context_t *dctx, const isc_region_t *data) {
+	isc_hmacsha256_t *hmacsha256ctx = dctx->opaque;
+
+	isc_hmacsha256_update(hmacsha256ctx, data->base, data->length);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha256_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+	isc_hmacsha256_t *hmacsha256ctx = dctx->opaque;
+	unsigned char *digest;
+
+	if (isc_buffer_availablelength(sig) < ISC_SHA256_DIGESTLENGTH)
+		return (ISC_R_NOSPACE);
+	digest = isc_buffer_used(sig);
+	isc_hmacsha256_sign(hmacsha256ctx, digest, ISC_SHA256_DIGESTLENGTH);
+	isc_buffer_add(sig, ISC_SHA256_DIGESTLENGTH);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha256_verify(dst_context_t *dctx, const isc_region_t *sig) {
+	isc_hmacsha256_t *hmacsha256ctx = dctx->opaque;
+
+	if (sig->length > ISC_SHA256_DIGESTLENGTH || sig->length == 0)
+		return (DST_R_VERIFYFAILURE);
+
+	if (isc_hmacsha256_verify(hmacsha256ctx, sig->base, sig->length))
+		return (ISC_R_SUCCESS);
+	else
+		return (DST_R_VERIFYFAILURE);
+}
+
+static isc_boolean_t
+hmacsha256_compare(const dst_key_t *key1, const dst_key_t *key2) {
+	HMACSHA256_Key *hkey1, *hkey2;
+
+	hkey1 = (HMACSHA256_Key *)key1->opaque;
+	hkey2 = (HMACSHA256_Key *)key2->opaque;
+
+	if (hkey1 == NULL && hkey2 == NULL)
+		return (ISC_TRUE);
+	else if (hkey1 == NULL || hkey2 == NULL)
+		return (ISC_FALSE);
+
+	if (memcmp(hkey1->key, hkey2->key, ISC_SHA256_DIGESTLENGTH) == 0)
+		return (ISC_TRUE);
+	else
+		return (ISC_FALSE);
+}
+
+static isc_result_t
+hmacsha256_generate(dst_key_t *key, int pseudorandom_ok) {
+	isc_buffer_t b;
+	isc_result_t ret;
+	int bytes;
+	unsigned char data[HMAC_LEN];
+
+	bytes = (key->key_size + 7) / 8;
+	if (bytes > HMAC_LEN) {
+		bytes = HMAC_LEN;
+		key->key_size = HMAC_LEN * 8;
+	}
+
+	memset(data, 0, HMAC_LEN);
+	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
+
+	if (ret != ISC_R_SUCCESS)
+		return (ret);
+
+	isc_buffer_init(&b, data, bytes);
+	isc_buffer_add(&b, bytes);
+	ret = hmacsha256_fromdns(key, &b);
+	memset(data, 0, ISC_SHA256_DIGESTLENGTH);
+
+	return (ret);
+}
+
+static isc_boolean_t
+hmacsha256_isprivate(const dst_key_t *key) {
+	UNUSED(key);
+	return (ISC_TRUE);
+}
+
+static void
+hmacsha256_destroy(dst_key_t *key) {
+	HMACSHA256_Key *hkey = key->opaque;
+	memset(hkey, 0, sizeof(HMACSHA256_Key));
+	isc_mem_put(key->mctx, hkey, sizeof(HMACSHA256_Key));
+	key->opaque = NULL;
+}
+
+static isc_result_t
+hmacsha256_todns(const dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA256_Key *hkey;
+	unsigned int bytes;
+
+	REQUIRE(key->opaque != NULL);
+
+	hkey = (HMACSHA256_Key *) key->opaque;
+
+	bytes = (key->key_size + 7) / 8;
+	if (isc_buffer_availablelength(data) < bytes)
+		return (ISC_R_NOSPACE);
+	isc_buffer_putmem(data, hkey->key, bytes);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha256_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA256_Key *hkey;
+	int keylen;
+	isc_region_t r;
+	isc_sha256_t sha256ctx;
+
+	isc_buffer_remainingregion(data, &r);
+	if (r.length == 0)
+		return (ISC_R_SUCCESS);
+
+	hkey = (HMACSHA256_Key *) isc_mem_get(key->mctx, sizeof(HMACSHA256_Key));
+	if (hkey == NULL)
+		return (ISC_R_NOMEMORY);
+
+	memset(hkey->key, 0, sizeof(hkey->key));
+
+	if (r.length > ISC_SHA256_DIGESTLENGTH) {
+		isc_sha256_init(&sha256ctx);
+		isc_sha256_update(&sha256ctx, r.base, r.length);
+		isc_sha256_final(hkey->key, &sha256ctx);
+		keylen = ISC_SHA256_DIGESTLENGTH;
+	}
+	else {
+		memcpy(hkey->key, r.base, r.length);
+		keylen = r.length;
+	}
+
+	key->key_size = keylen * 8;
+	key->opaque = hkey;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha256_tofile(const dst_key_t *key, const char *directory) {
+	int cnt = 0;
+	HMACSHA256_Key *hkey;
+	dst_private_t priv;
+	int bytes = (key->key_size + 7) / 8;
+	unsigned char buf[2];
+
+	if (key->opaque == NULL)
+		return (DST_R_NULLKEY);
+
+	hkey = (HMACSHA256_Key *) key->opaque;
+
+	priv.elements[cnt].tag = TAG_HMACSHA256_KEY;
+	priv.elements[cnt].length = bytes;
+	priv.elements[cnt++].data = hkey->key;
+
+	buf[0] = (key->key_bits >> 8) & 0xffU;
+	buf[1] = key->key_bits & 0xffU;
+	priv.elements[cnt].tag = TAG_HMACSHA256_BITS;
+	priv.elements[cnt].data = buf;
+	priv.elements[cnt++].length = 2;
+
+	priv.nelements = cnt;
+	return (dst__privstruct_writefile(key, &priv, directory));
+}
+
+static isc_result_t
+hmacsha256_parse(dst_key_t *key, isc_lex_t *lexer) {
+	dst_private_t priv;
+	isc_result_t result, tresult;
+	isc_buffer_t b;
+	isc_mem_t *mctx = key->mctx;
+	unsigned int i;
+
+	/* read private key file */
+	result = dst__privstruct_parse(key, DST_ALG_HMACSHA256, lexer, mctx,
+				       &priv);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	key->key_bits = 0;
+	for (i = 0; i < priv.nelements; i++) {
+		switch (priv.elements[i].tag) {
+		case TAG_HMACSHA256_KEY:
+			isc_buffer_init(&b, priv.elements[i].data,
+				        priv.elements[i].length);
+			isc_buffer_add(&b, priv.elements[i].length);
+			tresult = hmacsha256_fromdns(key, &b);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		case TAG_HMACSHA256_BITS:
+			tresult = getkeybits(key, &priv.elements[i]);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		default:
+			result = DST_R_INVALIDPRIVATEKEY;
+			break;
+		}
+	}
+	dst__privstruct_free(&priv, mctx);
+	memset(&priv, 0, sizeof(priv));
+	return (result);
+}
+
+static dst_func_t hmacsha256_functions = {
+	hmacsha256_createctx,
+	hmacsha256_destroyctx,
+	hmacsha256_adddata,
+	hmacsha256_sign,
+	hmacsha256_verify,
+	NULL, /* computesecret */
+	hmacsha256_compare,
+	NULL, /* paramcompare */
+	hmacsha256_generate,
+	hmacsha256_isprivate,
+	hmacsha256_destroy,
+	hmacsha256_todns,
+	hmacsha256_fromdns,
+	hmacsha256_tofile,
+	hmacsha256_parse,
+	NULL, /* cleanup */
+};
+
+isc_result_t
+dst__hmacsha256_init(dst_func_t **funcp) {
+	REQUIRE(funcp != NULL);
+	if (*funcp == NULL)
+		*funcp = &hmacsha256_functions;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t hmacsha384_fromdns(dst_key_t *key, isc_buffer_t *data);
+
+typedef struct {
+	unsigned char key[ISC_SHA384_DIGESTLENGTH];
+} HMACSHA384_Key;
+
+static isc_result_t
+hmacsha384_createctx(dst_key_t *key, dst_context_t *dctx) {
+	isc_hmacsha384_t *hmacsha384ctx;
+	HMACSHA384_Key *hkey = key->opaque;
+
+	hmacsha384ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacsha384_t));
+	if (hmacsha384ctx == NULL)
+		return (ISC_R_NOMEMORY);
+	isc_hmacsha384_init(hmacsha384ctx, hkey->key, ISC_SHA384_DIGESTLENGTH);
+	dctx->opaque = hmacsha384ctx;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+hmacsha384_destroyctx(dst_context_t *dctx) {
+	isc_hmacsha384_t *hmacsha384ctx = dctx->opaque;
+
+	if (hmacsha384ctx != NULL) {
+		isc_hmacsha384_invalidate(hmacsha384ctx);
+		isc_mem_put(dctx->mctx, hmacsha384ctx, sizeof(isc_hmacsha384_t));
+		dctx->opaque = NULL;
+	}
+}
+
+static isc_result_t
+hmacsha384_adddata(dst_context_t *dctx, const isc_region_t *data) {
+	isc_hmacsha384_t *hmacsha384ctx = dctx->opaque;
+
+	isc_hmacsha384_update(hmacsha384ctx, data->base, data->length);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha384_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+	isc_hmacsha384_t *hmacsha384ctx = dctx->opaque;
+	unsigned char *digest;
+
+	if (isc_buffer_availablelength(sig) < ISC_SHA384_DIGESTLENGTH)
+		return (ISC_R_NOSPACE);
+	digest = isc_buffer_used(sig);
+	isc_hmacsha384_sign(hmacsha384ctx, digest, ISC_SHA384_DIGESTLENGTH);
+	isc_buffer_add(sig, ISC_SHA384_DIGESTLENGTH);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha384_verify(dst_context_t *dctx, const isc_region_t *sig) {
+	isc_hmacsha384_t *hmacsha384ctx = dctx->opaque;
+
+	if (sig->length > ISC_SHA384_DIGESTLENGTH || sig->length == 0)
+		return (DST_R_VERIFYFAILURE);
+
+	if (isc_hmacsha384_verify(hmacsha384ctx, sig->base, sig->length))
+		return (ISC_R_SUCCESS);
+	else
+		return (DST_R_VERIFYFAILURE);
+}
+
+static isc_boolean_t
+hmacsha384_compare(const dst_key_t *key1, const dst_key_t *key2) {
+	HMACSHA384_Key *hkey1, *hkey2;
+
+	hkey1 = (HMACSHA384_Key *)key1->opaque;
+	hkey2 = (HMACSHA384_Key *)key2->opaque;
+
+	if (hkey1 == NULL && hkey2 == NULL)
+		return (ISC_TRUE);
+	else if (hkey1 == NULL || hkey2 == NULL)
+		return (ISC_FALSE);
+
+	if (memcmp(hkey1->key, hkey2->key, ISC_SHA384_DIGESTLENGTH) == 0)
+		return (ISC_TRUE);
+	else
+		return (ISC_FALSE);
+}
+
+static isc_result_t
+hmacsha384_generate(dst_key_t *key, int pseudorandom_ok) {
+	isc_buffer_t b;
+	isc_result_t ret;
+	int bytes;
+	unsigned char data[HMAC_LEN];
+
+	bytes = (key->key_size + 7) / 8;
+	if (bytes > HMAC_LEN) {
+		bytes = HMAC_LEN;
+		key->key_size = HMAC_LEN * 8;
+	}
+
+	memset(data, 0, HMAC_LEN);
+	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
+
+	if (ret != ISC_R_SUCCESS)
+		return (ret);
+
+	isc_buffer_init(&b, data, bytes);
+	isc_buffer_add(&b, bytes);
+	ret = hmacsha384_fromdns(key, &b);
+	memset(data, 0, ISC_SHA384_DIGESTLENGTH);
+
+	return (ret);
+}
+
+static isc_boolean_t
+hmacsha384_isprivate(const dst_key_t *key) {
+	UNUSED(key);
+	return (ISC_TRUE);
+}
+
+static void
+hmacsha384_destroy(dst_key_t *key) {
+	HMACSHA384_Key *hkey = key->opaque;
+	memset(hkey, 0, sizeof(HMACSHA384_Key));
+	isc_mem_put(key->mctx, hkey, sizeof(HMACSHA384_Key));
+	key->opaque = NULL;
+}
+
+static isc_result_t
+hmacsha384_todns(const dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA384_Key *hkey;
+	unsigned int bytes;
+
+	REQUIRE(key->opaque != NULL);
+
+	hkey = (HMACSHA384_Key *) key->opaque;
+
+	bytes = (key->key_size + 7) / 8;
+	if (isc_buffer_availablelength(data) < bytes)
+		return (ISC_R_NOSPACE);
+	isc_buffer_putmem(data, hkey->key, bytes);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha384_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA384_Key *hkey;
+	int keylen;
+	isc_region_t r;
+	isc_sha384_t sha384ctx;
+
+	isc_buffer_remainingregion(data, &r);
+	if (r.length == 0)
+		return (ISC_R_SUCCESS);
+
+	hkey = (HMACSHA384_Key *) isc_mem_get(key->mctx, sizeof(HMACSHA384_Key));
+	if (hkey == NULL)
+		return (ISC_R_NOMEMORY);
+
+	memset(hkey->key, 0, sizeof(hkey->key));
+
+	if (r.length > ISC_SHA384_DIGESTLENGTH) {
+		isc_sha384_init(&sha384ctx);
+		isc_sha384_update(&sha384ctx, r.base, r.length);
+		isc_sha384_final(hkey->key, &sha384ctx);
+		keylen = ISC_SHA384_DIGESTLENGTH;
+	}
+	else {
+		memcpy(hkey->key, r.base, r.length);
+		keylen = r.length;
+	}
+
+	key->key_size = keylen * 8;
+	key->opaque = hkey;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha384_tofile(const dst_key_t *key, const char *directory) {
+	int cnt = 0;
+	HMACSHA384_Key *hkey;
+	dst_private_t priv;
+	int bytes = (key->key_size + 7) / 8;
+	unsigned char buf[2];
+
+	if (key->opaque == NULL)
+		return (DST_R_NULLKEY);
+
+	hkey = (HMACSHA384_Key *) key->opaque;
+
+	priv.elements[cnt].tag = TAG_HMACSHA384_KEY;
+	priv.elements[cnt].length = bytes;
+	priv.elements[cnt++].data = hkey->key;
+
+	buf[0] = (key->key_bits >> 8) & 0xffU;
+	buf[1] = key->key_bits & 0xffU;
+	priv.elements[cnt].tag = TAG_HMACSHA384_BITS;
+	priv.elements[cnt].data = buf;
+	priv.elements[cnt++].length = 2;
+
+	priv.nelements = cnt;
+	return (dst__privstruct_writefile(key, &priv, directory));
+}
+
+static isc_result_t
+hmacsha384_parse(dst_key_t *key, isc_lex_t *lexer) {
+	dst_private_t priv;
+	isc_result_t result, tresult;
+	isc_buffer_t b;
+	isc_mem_t *mctx = key->mctx;
+	unsigned int i;
+
+	/* read private key file */
+	result = dst__privstruct_parse(key, DST_ALG_HMACSHA384, lexer, mctx,
+				       &priv);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	key->key_bits = 0;
+	for (i = 0; i < priv.nelements; i++) {
+		switch (priv.elements[i].tag) {
+		case TAG_HMACSHA384_KEY:
+			isc_buffer_init(&b, priv.elements[i].data,
+				        priv.elements[i].length);
+			isc_buffer_add(&b, priv.elements[i].length);
+			tresult = hmacsha384_fromdns(key, &b);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		case TAG_HMACSHA384_BITS:
+			tresult = getkeybits(key, &priv.elements[i]);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		default:
+			result = DST_R_INVALIDPRIVATEKEY;
+			break;
+		}
+	}
+	dst__privstruct_free(&priv, mctx);
+	memset(&priv, 0, sizeof(priv));
+	return (result);
+}
+
+static dst_func_t hmacsha384_functions = {
+	hmacsha384_createctx,
+	hmacsha384_destroyctx,
+	hmacsha384_adddata,
+	hmacsha384_sign,
+	hmacsha384_verify,
+	NULL, /* computesecret */
+	hmacsha384_compare,
+	NULL, /* paramcompare */
+	hmacsha384_generate,
+	hmacsha384_isprivate,
+	hmacsha384_destroy,
+	hmacsha384_todns,
+	hmacsha384_fromdns,
+	hmacsha384_tofile,
+	hmacsha384_parse,
+	NULL, /* cleanup */
+};
+
+isc_result_t
+dst__hmacsha384_init(dst_func_t **funcp) {
+	REQUIRE(funcp != NULL);
+	if (*funcp == NULL)
+		*funcp = &hmacsha384_functions;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t hmacsha512_fromdns(dst_key_t *key, isc_buffer_t *data);
+
+typedef struct {
+	unsigned char key[ISC_SHA512_DIGESTLENGTH];
+} HMACSHA512_Key;
+
+static isc_result_t
+hmacsha512_createctx(dst_key_t *key, dst_context_t *dctx) {
+	isc_hmacsha512_t *hmacsha512ctx;
+	HMACSHA512_Key *hkey = key->opaque;
+
+	hmacsha512ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacsha512_t));
+	if (hmacsha512ctx == NULL)
+		return (ISC_R_NOMEMORY);
+	isc_hmacsha512_init(hmacsha512ctx, hkey->key, ISC_SHA512_DIGESTLENGTH);
+	dctx->opaque = hmacsha512ctx;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+hmacsha512_destroyctx(dst_context_t *dctx) {
+	isc_hmacsha512_t *hmacsha512ctx = dctx->opaque;
+
+	if (hmacsha512ctx != NULL) {
+		isc_hmacsha512_invalidate(hmacsha512ctx);
+		isc_mem_put(dctx->mctx, hmacsha512ctx, sizeof(isc_hmacsha512_t));
+		dctx->opaque = NULL;
+	}
+}
+
+static isc_result_t
+hmacsha512_adddata(dst_context_t *dctx, const isc_region_t *data) {
+	isc_hmacsha512_t *hmacsha512ctx = dctx->opaque;
+
+	isc_hmacsha512_update(hmacsha512ctx, data->base, data->length);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha512_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+	isc_hmacsha512_t *hmacsha512ctx = dctx->opaque;
+	unsigned char *digest;
+
+	if (isc_buffer_availablelength(sig) < ISC_SHA512_DIGESTLENGTH)
+		return (ISC_R_NOSPACE);
+	digest = isc_buffer_used(sig);
+	isc_hmacsha512_sign(hmacsha512ctx, digest, ISC_SHA512_DIGESTLENGTH);
+	isc_buffer_add(sig, ISC_SHA512_DIGESTLENGTH);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha512_verify(dst_context_t *dctx, const isc_region_t *sig) {
+	isc_hmacsha512_t *hmacsha512ctx = dctx->opaque;
+
+	if (sig->length > ISC_SHA512_DIGESTLENGTH || sig->length == 0)
+		return (DST_R_VERIFYFAILURE);
+
+	if (isc_hmacsha512_verify(hmacsha512ctx, sig->base, sig->length))
+		return (ISC_R_SUCCESS);
+	else
+		return (DST_R_VERIFYFAILURE);
+}
+
+static isc_boolean_t
+hmacsha512_compare(const dst_key_t *key1, const dst_key_t *key2) {
+	HMACSHA512_Key *hkey1, *hkey2;
+
+	hkey1 = (HMACSHA512_Key *)key1->opaque;
+	hkey2 = (HMACSHA512_Key *)key2->opaque;
+
+	if (hkey1 == NULL && hkey2 == NULL)
+		return (ISC_TRUE);
+	else if (hkey1 == NULL || hkey2 == NULL)
+		return (ISC_FALSE);
+
+	if (memcmp(hkey1->key, hkey2->key, ISC_SHA512_DIGESTLENGTH) == 0)
+		return (ISC_TRUE);
+	else
+		return (ISC_FALSE);
+}
+
+static isc_result_t
+hmacsha512_generate(dst_key_t *key, int pseudorandom_ok) {
+	isc_buffer_t b;
+	isc_result_t ret;
+	int bytes;
+	unsigned char data[HMAC_LEN];
+
+	bytes = (key->key_size + 7) / 8;
+	if (bytes > HMAC_LEN) {
+		bytes = HMAC_LEN;
+		key->key_size = HMAC_LEN * 8;
+	}
+
+	memset(data, 0, HMAC_LEN);
+	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
+
+	if (ret != ISC_R_SUCCESS)
+		return (ret);
+
+	isc_buffer_init(&b, data, bytes);
+	isc_buffer_add(&b, bytes);
+	ret = hmacsha512_fromdns(key, &b);
+	memset(data, 0, ISC_SHA512_DIGESTLENGTH);
+
+	return (ret);
+}
+
+static isc_boolean_t
+hmacsha512_isprivate(const dst_key_t *key) {
+	UNUSED(key);
+	return (ISC_TRUE);
+}
+
+static void
+hmacsha512_destroy(dst_key_t *key) {
+	HMACSHA512_Key *hkey = key->opaque;
+	memset(hkey, 0, sizeof(HMACSHA512_Key));
+	isc_mem_put(key->mctx, hkey, sizeof(HMACSHA512_Key));
+	key->opaque = NULL;
+}
+
+static isc_result_t
+hmacsha512_todns(const dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA512_Key *hkey;
+	unsigned int bytes;
+
+	REQUIRE(key->opaque != NULL);
+
+	hkey = (HMACSHA512_Key *) key->opaque;
+
+	bytes = (key->key_size + 7) / 8;
+	if (isc_buffer_availablelength(data) < bytes)
+		return (ISC_R_NOSPACE);
+	isc_buffer_putmem(data, hkey->key, bytes);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha512_fromdns(dst_key_t *key, isc_buffer_t *data) {
+	HMACSHA512_Key *hkey;
+	int keylen;
+	isc_region_t r;
+	isc_sha512_t sha512ctx;
+
+	isc_buffer_remainingregion(data, &r);
+	if (r.length == 0)
+		return (ISC_R_SUCCESS);
+
+	hkey = (HMACSHA512_Key *) isc_mem_get(key->mctx, sizeof(HMACSHA512_Key));
+	if (hkey == NULL)
+		return (ISC_R_NOMEMORY);
+
+	memset(hkey->key, 0, sizeof(hkey->key));
+
+	if (r.length > ISC_SHA512_DIGESTLENGTH) {
+		isc_sha512_init(&sha512ctx);
+		isc_sha512_update(&sha512ctx, r.base, r.length);
+		isc_sha512_final(hkey->key, &sha512ctx);
+		keylen = ISC_SHA512_DIGESTLENGTH;
+	}
+	else {
+		memcpy(hkey->key, r.base, r.length);
+		keylen = r.length;
+	}
+
+	key->key_size = keylen * 8;
+	key->opaque = hkey;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+hmacsha512_tofile(const dst_key_t *key, const char *directory) {
+	int cnt = 0;
+	HMACSHA512_Key *hkey;
+	dst_private_t priv;
+	int bytes = (key->key_size + 7) / 8;
+	unsigned char buf[2];
+
+	if (key->opaque == NULL)
+		return (DST_R_NULLKEY);
+
+	hkey = (HMACSHA512_Key *) key->opaque;
+
+	priv.elements[cnt].tag = TAG_HMACSHA512_KEY;
+	priv.elements[cnt].length = bytes;
+	priv.elements[cnt++].data = hkey->key;
+
+	buf[0] = (key->key_bits >> 8) & 0xffU;
+	buf[1] = key->key_bits & 0xffU;
+	priv.elements[cnt].tag = TAG_HMACSHA512_BITS;
+	priv.elements[cnt].data = buf;
+	priv.elements[cnt++].length = 2;
+
+	priv.nelements = cnt;
+	return (dst__privstruct_writefile(key, &priv, directory));
+}
+
+static isc_result_t
+hmacsha512_parse(dst_key_t *key, isc_lex_t *lexer) {
+	dst_private_t priv;
+	isc_result_t result, tresult;
+	isc_buffer_t b;
+	isc_mem_t *mctx = key->mctx;
+	unsigned int i;
+
+	/* read private key file */
+	result = dst__privstruct_parse(key, DST_ALG_HMACSHA512, lexer, mctx,
+				       &priv);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	key->key_bits = 0;
+	for (i = 0; i < priv.nelements; i++) {
+		switch (priv.elements[i].tag) {
+		case TAG_HMACSHA512_KEY:
+			isc_buffer_init(&b, priv.elements[i].data,
+				        priv.elements[i].length);
+			isc_buffer_add(&b, priv.elements[i].length);
+			tresult = hmacsha512_fromdns(key, &b);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		case TAG_HMACSHA512_BITS:
+			tresult = getkeybits(key, &priv.elements[i]);
+			if (tresult != ISC_R_SUCCESS)
+				result = tresult;
+			break;
+		default:
+			result = DST_R_INVALIDPRIVATEKEY;
+			break;
+		}
+	}
+	dst__privstruct_free(&priv, mctx);
+	memset(&priv, 0, sizeof(priv));
+	return (result);
+}
+
+static dst_func_t hmacsha512_functions = {
+	hmacsha512_createctx,
+	hmacsha512_destroyctx,
+	hmacsha512_adddata,
+	hmacsha512_sign,
+	hmacsha512_verify,
+	NULL, /* computesecret */
+	hmacsha512_compare,
+	NULL, /* paramcompare */
+	hmacsha512_generate,
+	hmacsha512_isprivate,
+	hmacsha512_destroy,
+	hmacsha512_todns,
+	hmacsha512_fromdns,
+	hmacsha512_tofile,
+	hmacsha512_parse,
+	NULL, /* cleanup */
+};
+
+isc_result_t
+dst__hmacsha512_init(dst_func_t **funcp) {
+	REQUIRE(funcp != NULL);
+	if (*funcp == NULL)
+		*funcp = &hmacsha512_functions;
+	return (ISC_R_SUCCESS);
+}
+
+/*! \file */
diff --git a/contrib/bind9/lib/dns/include/Makefile.in b/contrib/bind9/lib/dns/include/Makefile.in
index 92dfb3b..593ad5a 100644
--- a/contrib/bind9/lib/dns/include/Makefile.in
+++ b/contrib/bind9/lib/dns/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.11.206.2 2004/12/09 04:07:19 marka Exp $
+# $Id: Makefile.in,v 1.12.18.1 2004/12/09 04:41:46 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/dns/include/dns/Makefile.in b/contrib/bind9/lib/dns/include/dns/Makefile.in
index 267bc8d..3f367bc 100644
--- a/contrib/bind9/lib/dns/include/dns/Makefile.in
+++ b/contrib/bind9/lib/dns/include/dns/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.43.2.1.10.6 2004/03/08 09:04:34 marka Exp $
+# $Id: Makefile.in,v 1.50 2004/03/05 05:09:40 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/dns/include/dns/acache.h b/contrib/bind9/lib/dns/include/dns/acache.h
new file mode 100644
index 0000000..50d7fc1
--- /dev/null
+++ b/contrib/bind9/lib/dns/include/dns/acache.h
@@ -0,0 +1,445 @@
+/*
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: acache.h,v 1.3.2.4 2006/05/03 00:07:49 marka Exp $ */
+
+#ifndef DNS_ACACHE_H
+#define DNS_ACACHE_H 1
+
+/*****
+ ***** Module Info
+ *****/
+
+/*
+ * Acache
+ * 
+ * The Additional Cache Object
+ *
+ *	This module manages internal caching entries that correspond to
+ *	the additional section data of a DNS DB node (an RRset header, more
+ *	accurately).  An additional cache entry is expected to be (somehow)
+ *	attached to a particular RR in a particular DB node, and contains a set
+ *	of information of an additional data for the DB node.
+ *
+ *	An additional cache object is intended to be created as a per-view
+ *	object, and manages all cache entries within the view.
+ *
+ *	The intended usage of the additional caching is to provide a short cut
+ *	to additional glue RRs of an NS RR.  For each NS RR, it is often
+ *	necessary to look for glue RRs to make a proper response.  Once the
+ *	glue RRs are known, the additional caching allows the client to
+ *	associate the information to the original NS RR so that further
+ *	expensive lookups can be avoided for the NS RR.
+ *
+ *	Each additional cache entry contains information to identify a
+ *	particular DB node and (optionally) an associated RRset.  The
+ *	information consists of its zone, database, the version of the
+ *	database, database node, and RRset.
+ *
+ *	A "negative" information can also be cached.  For example, if a glue
+ *	RR does not exist as an authoritative data in the same zone as that
+ *	of the NS RR, this fact can be cached by specifying a NULL pointer
+ *	for the database, version, and node.  (See the description for
+ *	dns_acache_getentry() below for more details.)
+ *
+ *	Since each member stored in an additional cache entry holds a reference
+ *	to a corresponding object, a stale cache entry may cause unnecessary
+ *	memory consumption.  For instance, when a zone is reloaded, additional
+ *	cache entries that have a reference to the zone (and its DB and/or
+ *	DB nodes) can delay the cleanup of the referred objects.  In order to
+ *	minimize such a bad effect, this module provides several cleanup
+ *	mechanisms.
+ *
+ *	The first one is a shutdown procedure called when the associated view
+ *	is shut down.  In this case, dns_acache_shutdown() will be called and
+ *	all cache entries will be purged.  This mechanism will help the
+ *	situation when the configuration is reloaded or the main server is
+ *	stopped.
+ *
+ *	Per-DB cleanup mechanism is also provided.  Each additional cache entry
+ *	is associated with related DB, which is expected to have been
+ *	registered when the DB was created by dns_acache_setdb().  If a
+ *	particular DB is going to be destroyed, the primary holder of the DB,
+ *	a typical example of which is a zone, will call dns_acache_putdb().
+ *	Then this module will clean-up all cache entries associated with the
+ *	DB.  This mechanism is effective when a secondary zone DB is going to
+ *	be stale after a zone transfer.
+ *
+ *	Finally, this module supports for periodic clean-up of stale entries.
+ *	Each cache entry has a timestamp field, which is updated every time
+ *	the entry is referred.  A periodically invoked cleaner checks the
+ *	timestamp of each entry, and purge entries that have not been referred
+ *	for a certain period.  The cleaner interval can be specified by
+ *	dns_acache_setcleaninginterval().  If the periodic clean-up is not
+ *	enough, it is also possible to specify the upper limit of entries
+ *	in terms of the memory consumption.  If the maximum value is
+ *	specified, the cleaner is invoked when the memory consumption reaches
+ *	the high watermark inferred from the maximum value.  In this case,
+ *	the cleaner will use more aggressive algorithm to decide the "victim"
+ *	entries.  The maximum value can be specified by
+ *	dns_acache_setcachesize().
+ *
+ *	When a cache entry is going to be purged within this module, the
+ *	callback function specified at the creation time will be called.
+ *	The callback function is expected to release all internal resources
+ *	related to the entry, which will typically be specific to DB
+ *	implementation, and to call dns_acache_detachentry().  The callback
+ *	mechanism is very important, since the holder of an additional cache
+ *	entry may not be able to initiate the clean-up of the entry, due to
+ *	the reference ordering.  For example, as long as an additional cache
+ *	entry has a reference to a DB object, the DB cannot be freed, in which
+ *	a DB node may have a reference to the cache entry.
+ *
+ *	Credits:
+ *	The basic idea of this kind of short-cut for frequently used
+ *	information is similar to the "pre-compiled answer" approach adopted
+ *	in nsd by NLnet LABS with RIPE NCC.  Our work here is an independent
+ *	effort, but the success of nsd encouraged us to pursue this path.
+ *
+ *	The design and implementation of the periodic memory management and
+ *	the upper limitation of memory consumption was derived from the cache
+ *	DB implementation of BIND9.
+ *
+ * MP:
+ *	There are two main locks in this module.  One is for each entry, and
+ *	the other is for the additional cache object.
+ *
+ * Reliability:
+ *	The callback function for a cache entry is called with holding the
+ *	entry lock.  Thus, it implicitly assumes the callback function does not
+ *	call a function that can require the lock.  Typically, the only
+ *	function that can be called from the callback function safely is
+ *	dns_acache_detachentry().  The breakage of this implicit assumption
+ *	may cause a deadlock.
+ *
+ * Resources:
+ *	In a 32-bit architecture (such as i386), the following additional
+ *	memory is required comparing to the case that disables this module.
+ *	- 76 bytes for each additional cache entry
+ *	- if the entry has a DNS name and associated RRset,
+ *	  * 44 bytes + size of the name (1-255 bytes)
+ *	  * 52 bytes x number_of_RRs 
+ *	- 28 bytes for each DB related to this module
+ *
+ *	Using the additional cache also requires extra memory consumption in
+ *	the DB implementation.  In the current implementation for rbtdb, we
+ *	need:
+ *	- two additional pointers for each DB node (8 bytes for a 32-bit
+ *	  architecture
+ *	- for each RR associated to an RR in a DB node, we also need
+ *	  a pointer and management objects to support the additional cache
+ *	  function.  These are allocated on-demand.  The total size is
+ *	  32 bytes for a 32-bit architecture.
+ *
+ * Security:
+ *	Since this module does not handle any low-level data directly,
+ *	no security issue specific to this module is anticipated.
+ *
+ * Standards:
+ *	None.
+ */
+
+/***
+ *** Imports
+ ***/
+
+#include <isc/mutex.h>
+#include <isc/lang.h>
+#include <isc/refcount.h>
+#include <isc/stdtime.h>
+
+#include <dns/types.h>
+
+/***
+ *** Functions
+ ***/
+ISC_LANG_BEGINDECLS
+
+isc_result_t
+dns_acache_create(dns_acache_t **acachep, isc_mem_t *mctx,
+		  isc_taskmgr_t *taskmgr, isc_timermgr_t *timermgr);
+/*
+ * Create a new DNS additional cache object.
+ *
+ * Requires:
+ *
+ *	'mctx' is a valid memory context
+ *
+ *	'taskmgr' is a valid task manager
+ *
+ *	'timermgr' is a valid timer or NULL.  If NULL, no periodic cleaning of
+ *	the cache will take place.
+ *
+ *	'acachep' is a valid pointer, and *acachep == NULL
+ *
+ * Ensures:
+ *
+ *	'*acachep' is attached to the newly created cache
+ *
+ * Returns:
+ *
+ *	ISC_R_SUCCESS
+ *	ISC_R_NOMEMORY
+ *	ISC_R_UNEXPECTED
+ */
+
+void
+dns_acache_attach(dns_acache_t *source, dns_acache_t **targetp);
+/*
+ * Attach *targetp to cache.
+ *
+ * Requires:
+ *
+ *	'acache' is a valid additional cache.
+ *
+ *	'targetp' points to a NULL dns_acache_t *.
+ *
+ * Ensures:
+ *
+ *	*targetp is attached to the 'source' additional cache.
+ */
+
+void
+dns_acache_detach(dns_acache_t **acachep);
+/*
+ * Detach *acachep from its cache.
+ *
+ * Requires:
+ *
+ *	'*acachep' points to a valid additional cache.
+ *
+ * Ensures:
+ *
+ *	*acachep is NULL.
+ *
+ *	If '*acachep' is the last reference to the cache and the additional
+ *	cache does not have an outstanding task, all resources used by the
+ *	cache will be freed.
+ */
+
+void
+dns_acache_setcleaninginterval(dns_acache_t *acache, unsigned int t);
+/*
+ * Set the periodic cleaning interval of an additional cache to 'interval'
+ * seconds.
+ */
+
+void
+dns_acache_setcachesize(dns_acache_t *acache, isc_uint32_t size);
+/*
+ * Set the maximum additional cache size.  0 means unlimited.
+ */
+
+isc_result_t
+dns_acache_setdb(dns_acache_t *acache, dns_db_t *db);
+/*
+ * Set 'db' in 'acache' when the db can be referred from acache, in order
+ * to provide a hint for resolving the back reference.
+ *
+ * Requires:
+ *	'acache' is a valid acache pointer.
+ *	'db' is a valid DNS DB pointer.
+ *
+ * Ensures:
+ *	'acache' will have a reference to 'db'.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_EXISTS	(which means the specified 'db' is already set)
+ *	ISC_R_NOMEMORY
+ */
+
+isc_result_t
+dns_acache_putdb(dns_acache_t *acache, dns_db_t *db);
+/*
+ * Release 'db' from 'acache' if it has been set by dns_acache_setdb().
+ *
+ * Requires:
+ *	'acache' is a valid acache pointer.
+ *	'db' is a valid DNS DB pointer.
+ *
+ * Ensures:
+ *	'acache' will release the reference to 'db'.  Additionally, the content
+ *	of each cache entry that is related to the 'db' will be released via
+ *	the callback function.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_NOTFOUND	(which means the specified 'db' is not set in 'acache')
+ *	ISC_R_NOMEMORY
+ */
+
+void
+dns_acache_shutdown(dns_acache_t *acache);
+/*
+ * Shutdown 'acache'.
+ *
+ * Requires:
+ *
+ * 	'*acache' is a valid additional cache.
+ */
+
+isc_result_t
+dns_acache_createentry(dns_acache_t *acache, dns_db_t *origdb,
+		       void (*callback)(dns_acacheentry_t *, void **),
+		       void *cbarg, dns_acacheentry_t **entryp);
+/*
+ * Create an additional cache entry.  A new entry is created and attached to
+ * the given additional cache object.  A callback function is also associated
+ * with the created entry, which will be called when the cache entry is purged
+ * for some reason.
+ *
+ * Requires:
+ *
+ * 	'acache' is a valid additional cache.
+ *	'entryp' is a valid pointer, and *entryp == NULL
+ *	'origdb' is a valid DNS DB pointer.
+ *	'callback' and 'cbarg' can be NULL.  In this case, however, the entry
+ *	is meaningless (and will be cleaned-up in the next periodical
+ *	cleaning).
+ *
+ * Ensures:
+ *	'*entryp' will point to a new additional cache entry.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_NOMEMORY
+ */
+
+isc_result_t
+dns_acache_getentry(dns_acacheentry_t *entry, dns_zone_t **zonep,
+		    dns_db_t **dbp, dns_dbversion_t **versionp,
+		    dns_dbnode_t **nodep, dns_name_t *fname,
+		    dns_message_t *msg, isc_stdtime_t now);
+/*
+ * Get content from a particular additional cache entry.
+ *
+ * Requires:
+ *
+ * 	'entry' is a valid additional cache entry.
+ *	'zonep' is a NULL pointer or '*zonep' == NULL (this is the only
+ *	optional parameter.)
+ *	'dbp' is a valid pointer, and '*dbp' == NULL
+ *	'versionp' is a valid pointer, and '*versionp' == NULL
+ *	'nodep' is a valid pointer, and '*nodep' == NULL
+ *	'fname' is a valid DNS name.
+ *	'msg' is a valid DNS message.
+ *
+ * Ensures:
+ *	Several possible cases can happen according to the content.
+ *	1. For a positive cache entry,
+ *	'*zonep' will point to the corresponding zone (if zonep is a valid
+ *	pointer),
+ *	'*dbp' will point to a DB for the zone,
+ *	'*versionp' will point to its version, and
+ *	'*nodep' will point to the corresponding DB node.
+ *	'fname' will have the DNS name of the DB node and contain a list of
+ *	rdataset for the node (which can be an empty list).
+ *
+ * 	2. For a negative cache entry that means no corresponding zone exists,
+ *	'*zonep' == NULL (if zonep is a valid pointer)
+ *	'*dbp', '*versionp', and '*nodep' will be NULL.
+ *
+ *	3. For a negative cache entry that means no corresponding DB node
+ *	exists, '*zonep' will point to the corresponding zone (if zonep is a
+ *	valid pointer),
+ *	'*dbp' will point to a corresponding DB for zone,
+ *	'*versionp' will point to its version.
+ *	'*nodep' will be kept as NULL.
+ *	'fname' will not change.
+ *
+ *	On failure, no new references will be created.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_NOMEMORY
+ */
+
+isc_result_t
+dns_acache_setentry(dns_acache_t *acache, dns_acacheentry_t *entry,
+		    dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version,
+		    dns_dbnode_t *node, dns_name_t *fname);
+/*
+ * Set content to a particular additional cache entry.
+ *
+ * Requires:
+ *	'acache' is a valid additional cache.
+ *	'entry' is a valid additional cache entry.
+ *	All the others pointers are NULL or a valid pointer of the
+ *	corresponding type.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_NOMEMORY
+ *	ISC_R_NOTFOUND
+ */
+
+void
+dns_acache_cancelentry(dns_acacheentry_t *entry);
+/*
+ * Cancel the use of the cache entry 'entry'.  This function is supposed to
+ * be called when the node that holds the entry finds the content is not
+ * correct any more.  This function will try to release as much dependency as
+ * possible, and will be ready to be cleaned-up.  The registered callback
+ * function will be canceled and will never called.
+ *
+ * Requires:
+ *	'entry' is a valid additional cache entry.
+ */
+
+void
+dns_acache_attachentry(dns_acacheentry_t *source, dns_acacheentry_t **targetp);
+/*
+ * Attach *targetp to the cache entry 'source'.
+ *
+ * Requires:
+ *
+ *	'source' is a valid additional cache entry.
+ *
+ *	'targetp' points to a NULL dns_acacheentry_t *.
+ *
+ * Ensures:
+ *
+ *	*targetp is attached to 'source'.
+ */
+		       
+void
+dns_acache_detachentry(dns_acacheentry_t **entryp);
+/*
+ * Detach *entryp from its cache.
+ *
+ * Requires:
+ *
+ *	'*entryp' points to a valid additional cache entry.
+ *
+ * Ensures:
+ *
+ *	*entryp is NULL.
+ *
+ *	If '*entryp' is the last reference to the entry, 
+ *	cache does not have an outstanding task, all resources used by the
+ *	entry (including the entry object itself) will be freed.
+ */
+
+void
+dns_acache_countquerymiss(dns_acache_t *acache);
+/*
+ * Count up a missed acache query.  XXXMLG need more docs.
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif /* DNS_ACACHE_H */
diff --git a/contrib/bind9/lib/dns/include/dns/acl.h b/contrib/bind9/lib/dns/include/dns/acl.h
index ce4c8b6..34e394f 100644
--- a/contrib/bind9/lib/dns/include/dns/acl.h
+++ b/contrib/bind9/lib/dns/include/dns/acl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: acl.h,v 1.20.52.5 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: acl.h,v 1.22.18.4 2006/03/02 00:37:21 marka Exp $ */
 
 #ifndef DNS_ACL_H
 #define DNS_ACL_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * Address match list handling.
  */
 
@@ -75,10 +76,10 @@ struct dns_acl {
 	isc_mem_t		*mctx;
 	isc_refcount_t		refcount;
 	dns_aclelement_t	*elements;
-	unsigned int 		alloc;		/* Elements allocated */
-	unsigned int 		length;		/* Elements initialized */
-	char 			*name;		/* Temporary use only */
-	ISC_LINK(dns_acl_t) 	nextincache;	/* Ditto */
+	unsigned int 		alloc;		/*%< Elements allocated */
+	unsigned int 		length;		/*%< Elements initialized */
+	char 			*name;		/*%< Temporary use only */
+	ISC_LINK(dns_acl_t) 	nextincache;	/*%< Ditto */
 };
 
 struct dns_aclenv {
@@ -98,26 +99,26 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target);
-/*
+/*%<
  * Create a new ACL with room for 'n' elements.
  * The elements are uninitialized and the length is 0.
  */
 
 isc_result_t
 dns_acl_appendelement(dns_acl_t *acl, const dns_aclelement_t *elt);
-/*
+/*%<
  * Append an element to an existing ACL.
  */
 
 isc_result_t
 dns_acl_any(isc_mem_t *mctx, dns_acl_t **target);
-/*
+/*%<
  * Create a new ACL that matches everything.
  */
 
 isc_result_t
 dns_acl_none(isc_mem_t *mctx, dns_acl_t **target);
-/*
+/*%<
  * Create a new ACL that matches nothing.
  */
 
@@ -135,13 +136,13 @@ dns_acl_equal(const dns_acl_t *a, const dns_acl_t *b);
 
 isc_boolean_t
 dns_acl_isinsecure(const dns_acl_t *a);
-/*
- * Return ISC_TRUE iff the acl 'a' is considered insecure, that is,
+/*%<
+ * Return #ISC_TRUE iff the acl 'a' is considered insecure, that is,
  * if it contains IP addresses other than those of the local host.
  * This is intended for applications such as printing warning 
  * messages for suspect ACLs; it is not intended for making access
  * control decisions.  We make no guarantee that an ACL for which
- * this function returns ISC_FALSE is safe.
+ * this function returns #ISC_FALSE is safe.
  */
 
 isc_result_t
@@ -160,7 +161,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
 	      const dns_aclenv_t *env,
 	      int *match,
 	      const dns_aclelement_t **matchelt);
-/*
+/*%<
  * General, low-level ACL matching.  This is expected to
  * be useful even for weird stuff like the topology and sortlist statements.
  *
@@ -181,7 +182,7 @@ dns_acl_match(const isc_netaddr_t *reqaddr,
  * If there is no match, *match will be set to zero.
  *
  * Returns:
- *	ISC_R_SUCCESS		Always succeeds.
+ *\li	#ISC_R_SUCCESS		Always succeeds.
  */
 
 isc_boolean_t
@@ -190,7 +191,7 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr,
 		     const dns_aclelement_t *e,
 		     const dns_aclenv_t *env,		     
 		     const dns_aclelement_t **matchelt);
-/*
+/*%<
  * Like dns_acl_match, but matches against the single ACL element 'e'
  * rather than a complete list and returns ISC_TRUE iff it matched.
  * To determine whether the match was prositive or negative, the 
@@ -203,7 +204,7 @@ isc_result_t
 dns_acl_elementmatch(const dns_acl_t *acl,
 		     const dns_aclelement_t *elt,
 		     const dns_aclelement_t **matchelt);
-/*
+/*%<
  * Search for an ACL element in 'acl' which is exactly the same as 'elt'.
  * If there is one, and 'matchelt' is non NULL, then '*matchelt' will point
  * to the entry.
@@ -212,8 +213,8 @@ dns_acl_elementmatch(const dns_acl_t *acl,
  * before adding an entry.
  *
  * Returns:
- *	ISC_R_SUCCESS		Match succeeds.
- *	ISC_R_NOTFOUND		Match fails.
+ *\li	#ISC_R_SUCCESS		Match succeeds.
+ *\li	#ISC_R_NOTFOUND		Match fails.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/adb.h b/contrib/bind9/lib/dns/include/dns/adb.h
index 7a17eff..1e3cd61 100644
--- a/contrib/bind9/lib/dns/include/dns/adb.h
+++ b/contrib/bind9/lib/dns/include/dns/adb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: adb.h,v 1.66.2.5.2.4 2004/03/06 08:13:50 marka Exp $ */
+/* $Id: adb.h,v 1.76.18.3 2005/06/23 04:23:16 marka Exp $ */
 
 #ifndef DNS_ADB_H
 #define DNS_ADB_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ *\brief
  * DNS Address Database
  *
  * This module implements an address database (ADB) for mapping a name
@@ -49,21 +50,21 @@
  * Records are stored internally until a timer expires. The timer is the
  * smaller of the TTL or signature validity period.
  *
- * Lameness is stored per-zone, and this data hangs off each address field.
- * When an address is marked lame for a given zone the address will not
- * be returned to a caller.
+ * Lameness is stored per <qname,qtype> tuple, and this data hangs off each
+ * address field.  When an address is marked lame for a given tuple the address
+ * will not be returned to a caller.
  *
  *
  * MP:
  *
- *	The ADB takes care of all necessary locking.
+ *\li	The ADB takes care of all necessary locking.
  *
- *	Only the task which initiated the name lookup can cancel the lookup.
+ *\li	Only the task which initiated the name lookup can cancel the lookup.
  *
  *
  * Security:
  *
- *	None, since all data stored is required to be pre-filtered.
+ *\li	None, since all data stored is required to be pre-filtered.
  *	(Cache needs to be sane, fetches return bounds-checked and sanity-
  *       checked data, caller passes a good dns_name_t for the zone, etc)
  */
@@ -98,8 +99,8 @@ ISC_LANG_BEGINDECLS
 
 typedef struct dns_adbname		dns_adbname_t;
 
-/* dns_adbfind_t
- *
+/*! 
+ *\brief
  * Represents a lookup for a single name.
  *
  * On return, the client can safely use "list", and can reorder the list.
@@ -108,14 +109,14 @@ typedef struct dns_adbname		dns_adbname_t;
  */
 struct dns_adbfind {
 	/* Public */
-	unsigned int			magic;		/* RO: magic */
-	dns_adbaddrinfolist_t		list;		/* RO: list of addrs */
-	unsigned int			query_pending;	/* RO: partial list */
-	unsigned int			partial_result;	/* RO: addrs missing */
-	unsigned int			options;	/* RO: options */
-	isc_result_t			result_v4;	/* RO: v4 result */
-	isc_result_t			result_v6;	/* RO: v6 result */
-	ISC_LINK(dns_adbfind_t)		publink;	/* RW: client use */
+	unsigned int			magic;		/*%< RO: magic */
+	dns_adbaddrinfolist_t		list;		/*%< RO: list of addrs */
+	unsigned int			query_pending;	/*%< RO: partial list */
+	unsigned int			partial_result;	/*%< RO: addrs missing */
+	unsigned int			options;	/*%< RO: options */
+	isc_result_t			result_v4;	/*%< RO: v4 result */
+	isc_result_t			result_v6;	/*%< RO: v6 result */
+	ISC_LINK(dns_adbfind_t)		publink;	/*%< RW: client use */
 
 	/* Private */
 	isc_mutex_t			lock;		/* locks all below */
@@ -161,34 +162,65 @@ struct dns_adbfind {
  *	At least one address was omitted from the list because it was lame.
  *	This bit will NEVER be set if _RETURNLAME is set in the createfind().
  */
+/*% Return addresses of type INET. */
 #define DNS_ADBFIND_INET		0x00000001
+/*% Return addresses of type INET6. */
 #define DNS_ADBFIND_INET6		0x00000002
 #define DNS_ADBFIND_ADDRESSMASK		0x00000003
-
+/*%
+ *      Only schedule an event if no addresses are known.
+ *      Must set _WANTEVENT for this to be meaningful.
+ */
 #define DNS_ADBFIND_EMPTYEVENT		0x00000004
+/*%
+ *	An event is desired.  Check this bit in the returned find to see
+ *	if one will actually be generated.
+ */
 #define DNS_ADBFIND_WANTEVENT		0x00000008
+/*%
+ *	If set, fetches will not be generated unless no addresses are
+ *	available in any of the address families requested.
+ */
 #define DNS_ADBFIND_AVOIDFETCHES	0x00000010
+/*%
+ *	Fetches will start using the closest zone data or use the root servers.
+ *	This is useful for reestablishing glue that has expired.
+ */
 #define DNS_ADBFIND_STARTATZONE		0x00000020
+/*%
+ *	Glue or hints are ok.  These are used when matching names already
+ *	in the adb, and when dns databases are searched.
+ */
 #define DNS_ADBFIND_GLUEOK		0x00000040
+/*%
+ *	Glue or hints are ok.  These are used when matching names already
+ *	in the adb, and when dns databases are searched.
+ */
 #define DNS_ADBFIND_HINTOK		0x00000080
+/*%
+ *	Return lame servers in a find, so that all addresses are returned.
+ */
 #define DNS_ADBFIND_RETURNLAME		0x00000100
+/*%
+ *      Only schedule an event if no addresses are known.
+ *      Must set _WANTEVENT for this to be meaningful.
+ */
 #define DNS_ADBFIND_LAMEPRUNED		0x00000200
 
-/* dns_adbaddrinfo_t
- *
+/*%
  * The answers to queries come back as a list of these.
  */
 struct dns_adbaddrinfo {
-	unsigned int			magic;		/* private */
+	unsigned int			magic;		/*%< private */
 
-	isc_sockaddr_t			sockaddr;	/* [rw] */
-	unsigned int			srtt;		/* [rw] microseconds */
-	unsigned int			flags;		/* [rw] */
-	dns_adbentry_t		       *entry;		/* private */
+	isc_sockaddr_t			sockaddr;	/*%< [rw] */
+	unsigned int			srtt;		/*%< [rw] microseconds */
+	unsigned int			flags;		/*%< [rw] */
+	dns_adbentry_t		       *entry;		/*%< private */
 	ISC_LINK(dns_adbaddrinfo_t)	publink;
 };
 
-/*
+/*!< 
  * The event sent to the caller task is just a plain old isc_event_t.  It
  * contains no data other than a simple status, passed in the "type" field
  * to indicate that another address resolved, or all partially resolved
@@ -198,13 +230,13 @@ struct dns_adbaddrinfo {
  *
  * This is simply a standard event, with the "type" set to:
  *
- *	DNS_EVENT_ADBMOREADDRESSES   -- another address resolved.
- *	DNS_EVENT_ADBNOMOREADDRESSES -- all pending addresses failed,
+ *\li	#DNS_EVENT_ADBMOREADDRESSES   -- another address resolved.
+ *\li	#DNS_EVENT_ADBNOMOREADDRESSES -- all pending addresses failed,
  *					were canceled, or otherwise will
  *					not be usable.
- *	DNS_EVENT_ADBCANCELED	     -- The request was canceled by a
+ *\li	#DNS_EVENT_ADBCANCELED	     -- The request was canceled by a
  *					3rd party.
- *	DNS_EVENT_ADBNAMEDELETED     -- The name was deleted, so this request
+ *\li	#DNS_EVENT_ADBNAMEDELETED     -- The name was deleted, so this request
  *					was canceled.
  *
  * In each of these cases, the addresses returned by the initial call
@@ -219,89 +251,90 @@ struct dns_adbaddrinfo {
 isc_result_t
 dns_adb_create(isc_mem_t *mem, dns_view_t *view, isc_timermgr_t *tmgr,
 	       isc_taskmgr_t *taskmgr, dns_adb_t **newadb);
-/*
+/*%<
  * Create a new ADB.
  *
  * Notes:
  *
- *	Generally, applications should not create an ADB directly, but
+ *\li	Generally, applications should not create an ADB directly, but
  *	should instead call dns_view_createresolver().
  *
  * Requires:
  *
- *	'mem' must be a valid memory context.
+ *\li	'mem' must be a valid memory context.
  *
- *	'view' be a pointer to a valid view.
+ *\li	'view' be a pointer to a valid view.
  *
- *	'tmgr' be a pointer to a valid timer manager.
+ *\li	'tmgr' be a pointer to a valid timer manager.
  *
- *	'taskmgr' be a pointer to a valid task manager.
+ *\li	'taskmgr' be a pointer to a valid task manager.
  *
- *	'newadb' != NULL && '*newadb' == NULL.
+ *\li	'newadb' != NULL && '*newadb' == NULL.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS	after happiness.
- *	ISC_R_NOMEMORY	after resource allocation failure.
+ *\li	#ISC_R_SUCCESS	after happiness.
+ *\li	#ISC_R_NOMEMORY	after resource allocation failure.
  */
 
 void
 dns_adb_attach(dns_adb_t *adb, dns_adb_t **adbp);
-/*
+/*%
  * Attach to an 'adb' to 'adbp'.
  *
  * Requires:
- *	'adb' to be a valid dns_adb_t, created via dns_adb_create().
- *	'adbp' to be a valid pointer to a *dns_adb_t which is initialized
+ *\li	'adb' to be a valid dns_adb_t, created via dns_adb_create().
+ *\li	'adbp' to be a valid pointer to a *dns_adb_t which is initialized
  *	to NULL.
  */
 
 void
 dns_adb_detach(dns_adb_t **adb);
-/*
+/*%
  * Delete the ADB. Sets *ADB to NULL. Cancels any outstanding requests.
  *
  * Requires:
  *
- *	'adb' be non-NULL and '*adb' be a valid dns_adb_t, created via
+ *\li	'adb' be non-NULL and '*adb' be a valid dns_adb_t, created via
  *	dns_adb_create().
  */
 
 void
 dns_adb_whenshutdown(dns_adb_t *adb, isc_task_t *task, isc_event_t **eventp);
-/*
+/*%
  * Send '*eventp' to 'task' when 'adb' has shutdown.
  *
  * Requires:
  *
- *	'*adb' is a valid dns_adb_t.
+ *\li	'*adb' is a valid dns_adb_t.
  *
- *	eventp != NULL && *eventp is a valid event.
+ *\li	eventp != NULL && *eventp is a valid event.
  *
  * Ensures:
  *
- *	*eventp == NULL
+ *\li	*eventp == NULL
  *
- *	The event's sender field is set to the value of adb when the event
+ *\li	The event's sender field is set to the value of adb when the event
  *	is sent.
  */
 
 void
 dns_adb_shutdown(dns_adb_t *adb);
-/*
+/*%<
  * Shutdown 'adb'.
  *
  * Requires:
  *
- * 	'*adb' is a valid dns_adb_t.
+ * \li	'*adb' is a valid dns_adb_t.
  */
 
 isc_result_t
 dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
-		   void *arg, dns_name_t *name, dns_name_t *zone,
-		   unsigned int options, isc_stdtime_t now, dns_name_t *target,
+		   void *arg, dns_name_t *name, dns_name_t *qname,
+		   dns_rdatatype_t qtype, unsigned int options,
+		   isc_stdtime_t now, dns_name_t *target,
 		   in_port_t port, dns_adbfind_t **find);
-/*
+/*%<
  * Main interface for clients. The adb will look up the name given in
  * "name" and will build up a list of found addresses, and perhaps start
  * internal fetches to resolve names that are unknown currently.
@@ -311,9 +344,9 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
  * set to a pointer to the dns_adbfind_t returned by this function.
  *
  * If no events will be generated, the *find->result_v4 and/or result_v6
- * members may be examined for address lookup status.  The usual ISC_R_SUCCESS,
- * ISC_R_FAILURE, and DNS_R_NX{DOMAIN,RRSET} are returned, along with
- * ISC_R_NOTFOUND meaning the ADB has not _yet_ found the values.  In this
+ * members may be examined for address lookup status.  The usual #ISC_R_SUCCESS,
+ * #ISC_R_FAILURE, and #DNS_R_NX{DOMAIN,RRSET} are returned, along with
+ * #ISC_R_NOTFOUND meaning the ADB has not _yet_ found the values.  In this
  * latter case, retrying may produce more addresses.
  *
  * If events will be returned, the result_v[46] members are only valid
@@ -346,42 +379,42 @@ dns_adb_createfind(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
  *
  * Requires:
  *
- *	*adb be a valid isc_adb_t object.
+ *\li	*adb be a valid isc_adb_t object.
  *
- *	If events are to be sent, *task be a valid task,
+ *\li	If events are to be sent, *task be a valid task,
  *	and isc_taskaction_t != NULL.
  *
- *	*name is a valid dns_name_t.
+ *\li	*name is a valid dns_name_t.
  *
- *	zone != NULL and *zone be a valid dns_name_t.
+ *\li	qname != NULL and *qname be a valid dns_name_t.
  *
- *	target == NULL or target is a valid name with a buffer.
+ *\li	target == NULL or target is a valid name with a buffer.
  *
- *	find != NULL && *find == NULL.
+ *\li	find != NULL && *find == NULL.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS	Addresses might have been returned, and events will be
+ *\li	#ISC_R_SUCCESS	Addresses might have been returned, and events will be
  *			delivered for unresolved addresses.
- *	ISC_R_NOMORE	Addresses might have been returned, but no events
+ *\li	#ISC_R_NOMORE	Addresses might have been returned, but no events
  *			will ever be posted for this context.  This is only
  *			returned if task != NULL.
- *	ISC_R_NOMEMORY	insufficient resources
- *	DNS_R_ALIAS	'name' is an alias for another name.
+ *\li	#ISC_R_NOMEMORY	insufficient resources
+ *\li	#DNS_R_ALIAS	'name' is an alias for another name.
  *
  * Calls, and returns error codes from:
  *
- *	isc_stdtime_get()
+ *\li	isc_stdtime_get()
  *
  * Notes:
  *
- *	No internal reference to "name" exists after this function
+ *\li	No internal reference to "name" exists after this function
  *	returns.
  */
 
 void
 dns_adb_cancelfind(dns_adbfind_t *find);
-/*
+/*%<
  * Cancels the find, and sends the event off to the caller.
  *
  * It is an error to call dns_adb_cancelfind() on a find where
@@ -389,7 +422,7 @@ dns_adb_cancelfind(dns_adbfind_t *find);
  *
  * Note:
  *
- *	It is possible that the real completion event was posted just
+ *\li	It is possible that the real completion event was posted just
  *	before the dns_adb_cancelfind() call was made.  In this case,
  *	dns_adb_cancelfind() will do nothing.  The event callback needs
  *	to be prepared to find this situation (i.e. result is valid but
@@ -397,101 +430,105 @@ dns_adb_cancelfind(dns_adbfind_t *find);
  *
  * Requires:
  *
- *	'find' be a valid dns_adbfind_t pointer.
+ *\li	'find' be a valid dns_adbfind_t pointer.
  *
- *	events would have been posted to the task.  This can be checked
+ *\li	events would have been posted to the task.  This can be checked
  *	with (find->options & DNS_ADBFIND_WANTEVENT).
  *
  * Ensures:
  *
- *	The event was posted to the task.
+ *\li	The event was posted to the task.
  */
 
 void
 dns_adb_destroyfind(dns_adbfind_t **find);
-/*
+/*%<
  * Destroys the find reference.
  *
  * Note:
  *
- *	This can only be called after the event was delivered for a
+ *\li	This can only be called after the event was delivered for a
  *	find.  Additionally, the event MUST have been freed via
  *	isc_event_free() BEFORE this function is called.
  *
  * Requires:
  *
- *	'find' != NULL and *find be valid dns_adbfind_t pointer.
+ *\li	'find' != NULL and *find be valid dns_adbfind_t pointer.
  *
  * Ensures:
  *
- *	No "address found" events will be posted to the originating task
+ *\li	No "address found" events will be posted to the originating task
  *	after this function returns.
  */
 
 void
 dns_adb_dump(dns_adb_t *adb, FILE *f);
-/*
+/*%<
  * This function is only used for debugging.  It will dump as much of the
  * state of the running system as possible.
  *
  * Requires:
  *
- *	adb be valid.
+ *\li	adb be valid.
  *
- *	f != NULL, and is a file open for writing.
+ *\li	f != NULL, and is a file open for writing.
  */
 
 void
 dns_adb_dumpfind(dns_adbfind_t *find, FILE *f);
-/*
+/*%<
  * This function is only used for debugging.  Dump the data associated
  * with a find.
  *
  * Requires:
  *
- *	find is valid.
+ *\li	find is valid.
  *
- * 	f != NULL, and is a file open for writing.
+ * \li	f != NULL, and is a file open for writing.
  */
 
 isc_result_t
-dns_adb_marklame(dns_adb_t *adb, dns_adbaddrinfo_t *addr, dns_name_t *zone,
-		 isc_stdtime_t expire_time);
-/*
- * Mark the given address as lame for the zone "zone".  expire_time should
+dns_adb_marklame(dns_adb_t *adb, dns_adbaddrinfo_t *addr, dns_name_t *qname,
+		 dns_rdatatype_t type, isc_stdtime_t expire_time);
+/*%<
+ * Mark the given address as lame for the <qname,qtype>.  expire_time should
  * be set to the time when the entry should expire.  That is, if it is to
  * expire 10 minutes in the future, it should set it to (now + 10 * 60).
  *
  * Requires:
  *
- *	adb be valid.
+ *\li	adb be valid.
  *
- *	addr be valid.
+ *\li	addr be valid.
  *
- *	zone be the zone used in the dns_adb_createfind() call.
+ *\li	qname be the qname used in the dns_adb_createfind() call.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- all is well.
- *	ISC_R_NOMEMORY		-- could not mark address as lame.
+ *\li	#ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_NOMEMORY		-- could not mark address as lame.
  */
 
 /*
  * A reasonable default for RTT adjustments
  */
-#define DNS_ADB_RTTADJDEFAULT		7	/* default scale */
-#define DNS_ADB_RTTADJREPLACE		0	/* replace with our rtt */
-#define DNS_ADB_RTTADJAGE		10	/* age this rtt */
+#define DNS_ADB_RTTADJDEFAULT		7	/*%< default scale */
+#define DNS_ADB_RTTADJREPLACE		0	/*%< replace with our rtt */
+#define DNS_ADB_RTTADJAGE		10	/*%< age this rtt */
 
 void
 dns_adb_adjustsrtt(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 		   unsigned int rtt, unsigned int factor);
-/*
- * Mix the round trip time into the existing smoothed rtt.  The formula used
+/*%<
+ * Mix the round trip time into the existing smoothed rtt.  
+
+ * The formula used
  * (where srtt is the existing rtt value, and rtt and factor are arguments to
  * this function):
  *
+ *\code
  *	new_srtt = (old_srtt / 10 * factor) + (rtt / 10 * (10 - factor));
+ *\endcode
  *
  * XXXRTH  Do we want to publish the formula?  What if we want to change how
  *         this works later on?  Recommend/require that the units are
@@ -499,77 +536,79 @@ dns_adb_adjustsrtt(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
  *
  * Requires:
  *
- *	adb be valid.
+ *\li	adb be valid.
  *
- *	addr be valid.
+ *\li	addr be valid.
  *
- *	0 <= factor <= 10
+ *\li	0 <= factor <= 10
  *
  * Note:
  *
- *	The srtt in addr will be updated to reflect the new global
+ *\li	The srtt in addr will be updated to reflect the new global
  *	srtt value.  This may include changes made by others.
  */
 
 void
 dns_adb_changeflags(dns_adb_t *adb, dns_adbaddrinfo_t *addr,
 		    unsigned int bits, unsigned int mask);
-/*
+/*%
+ * Change Flags.
+ *
  * Set the flags as given by:
  *
- *	newflags = (oldflags & ~mask) | (bits & mask);
+ *\li	newflags = (oldflags & ~mask) | (bits & mask);
  *
  * Requires:
  *
- *	adb be valid.
+ *\li	adb be valid.
  *
- *	addr be valid.
+ *\li	addr be valid.
  */
 
 isc_result_t
 dns_adb_findaddrinfo(dns_adb_t *adb, isc_sockaddr_t *sa,
 		     dns_adbaddrinfo_t **addrp, isc_stdtime_t now);
-/*
+/*%<
  * Return a dns_adbaddrinfo_t that is associated with address 'sa'.
  *
  * Requires:
  *
- *	adb is valid.
+ *\li	adb is valid.
  *
- *	sa is valid.
+ *\li	sa is valid.
  *
- *	addrp != NULL && *addrp == NULL
+ *\li	addrp != NULL && *addrp == NULL
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_SHUTTINGDOWN
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_SHUTTINGDOWN
  */
 
 void
 dns_adb_freeaddrinfo(dns_adb_t *adb, dns_adbaddrinfo_t **addrp);
-/*
+/*%<
  * Free a dns_adbaddrinfo_t allocated by dns_adb_findaddrinfo().
  *
  * Requires:
  *
- *	adb is valid.
+ *\li	adb is valid.
  *
- *	*addrp is a valid dns_adbaddrinfo_t *.
+ *\li	*addrp is a valid dns_adbaddrinfo_t *.
  */
 
 void
 dns_adb_flush(dns_adb_t *adb);
-/*
+/*%<
  * Flushes all cached data from the adb.
  *
  * Requires:
- * 	adb is valid.
+ *\li 	adb is valid.
  */
 
 void
 dns_adb_setadbsize(dns_adb_t *adb, isc_uint32_t size);
-/*
+/*%<
  * Set a target memory size.  If memory usage exceeds the target
  * size entries will be removed before they would have expired on
  * a random basis.
@@ -577,17 +616,17 @@ dns_adb_setadbsize(dns_adb_t *adb, isc_uint32_t size);
  * If 'size' is 0 then memory usage is unlimited.
  *
  * Requires:
- *	'adb' is valid.
+ *\li	'adb' is valid.
  */
 
 void
 dns_adb_flushname(dns_adb_t *adb, dns_name_t *name);
-/*
+/*%<
  * Flush 'name' from the adb cache.
  * 
  * Requires:
- *	'adb' is valid.
- *	'name' is valid.
+ *\li	'adb' is valid.
+ *\li	'name' is valid.
  */
 
 
diff --git a/contrib/bind9/lib/dns/include/dns/bit.h b/contrib/bind9/lib/dns/include/dns/bit.h
index e4a7d20..770f294 100644
--- a/contrib/bind9/lib/dns/include/dns/bit.h
+++ b/contrib/bind9/lib/dns/include/dns/bit.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: bit.h,v 1.7.206.1 2004/03/06 08:13:51 marka Exp $ */
+/* $Id: bit.h,v 1.8.18.2 2005/04/29 00:16:09 marka Exp $ */
 
 #ifndef DNS_BIT_H
 #define DNS_BIT_H 1
 
+/*! \file */
+
 #include <isc/int.h>
 #include <isc/boolean.h>
 
diff --git a/contrib/bind9/lib/dns/include/dns/byaddr.h b/contrib/bind9/lib/dns/include/dns/byaddr.h
index 8f69cd9..1f1e88c 100644
--- a/contrib/bind9/lib/dns/include/dns/byaddr.h
+++ b/contrib/bind9/lib/dns/include/dns/byaddr.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: byaddr.h,v 1.12.2.1.2.4 2004/03/08 09:04:34 marka Exp $ */
+/* $Id: byaddr.h,v 1.16.18.2 2005/04/29 00:16:09 marka Exp $ */
 
 #ifndef DNS_BYADDR_H
 #define DNS_BYADDR_H 1
@@ -24,28 +24,27 @@
  ***** Module Info
  *****/
 
-/*
- * DNS ByAddr
- *
+/*! \file
+ * \brief
  * The byaddr module provides reverse lookup services for IPv4 and IPv6
  * addresses.
  *
  * MP:
- *	The module ensures appropriate synchronization of data structures it
+ *\li	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	RFCs:	1034, 1035, 2181, <TBS>
- *	Drafts:	<TBS>
+ *\li	RFCs:	1034, 1035, 2181, TBS
+ *\li	Drafts:	TBS
  */
 
 #include <isc/lang.h>
@@ -55,7 +54,7 @@
 
 ISC_LANG_BEGINDECLS
 
-/*
+/*%
  * A 'dns_byaddrevent_t' is returned when a byaddr completes.
  * The sender field will be set to the byaddr that completed.  If 'result'
  * is ISC_R_SUCCESS, then 'names' will contain a list of names associated
@@ -72,76 +71,79 @@ typedef struct dns_byaddrevent {
  * This option is deprecated since we now only consider nibbles.
 #define DNS_BYADDROPT_IPV6NIBBLE	0x0001
  */
+/*% Note DNS_BYADDROPT_IPV6NIBBLE is now deprecated. */
 #define DNS_BYADDROPT_IPV6INT		0x0002
 
 isc_result_t
 dns_byaddr_create(isc_mem_t *mctx, isc_netaddr_t *address, dns_view_t *view,
 		  unsigned int options, isc_task_t *task,
 		  isc_taskaction_t action, void *arg, dns_byaddr_t **byaddrp);
-/*
+/*%<
  * Find the domain name of 'address'.
  *
  * Notes:
  *
- *	There is a reverse lookup format for IPv6 addresses, 'nibble'
+ *\li	There is a reverse lookup format for IPv6 addresses, 'nibble'
  *
- *	The 'nibble' format for that address is
+ *\li	The 'nibble' format for that address is
  *
+ * \code
  *   1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
+ * \endcode
  *
- *	DNS_BYADDROPT_IPV6INT can be used to get nibble lookups under ip6.int.
+ *\li	#DNS_BYADDROPT_IPV6INT can be used to get nibble lookups under ip6.int.
  *
  * Requires:
  *
- *	'mctx' is a valid mctx.
+ *\li	'mctx' is a valid mctx.
  *
- *	'address' is a valid IPv4 or IPv6 address.
+ *\li	'address' is a valid IPv4 or IPv6 address.
  *
- *	'view' is a valid view which has a resolver.
+ *\li	'view' is a valid view which has a resolver.
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	byaddrp != NULL && *byaddrp == NULL
+ *\li	byaddrp != NULL && *byaddrp == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  *
- *	Any resolver-related error (e.g. ISC_R_SHUTTINGDOWN) may also be
+ *\li	Any resolver-related error (e.g. #ISC_R_SHUTTINGDOWN) may also be
  *	returned.
  */
 
 void
 dns_byaddr_cancel(dns_byaddr_t *byaddr);
-/*
+/*%<
  * Cancel 'byaddr'.
  *
  * Notes:
  *
- *	If 'byaddr' has not completed, post its BYADDRDONE event with a
- *	result code of ISC_R_CANCELED.
+ *\li	If 'byaddr' has not completed, post its #BYADDRDONE event with a
+ *	result code of #ISC_R_CANCELED.
  *
  * Requires:
  *
- *	'byaddr' is a valid byaddr.
+ *\li	'byaddr' is a valid byaddr.
  */
 
 void
 dns_byaddr_destroy(dns_byaddr_t **byaddrp);
-/*
+/*%<
  * Destroy 'byaddr'.
  *
  * Requires:
  *
- *	'*byaddrp' is a valid byaddr.
+ *\li	'*byaddrp' is a valid byaddr.
  *
- *	The caller has received the BYADDRDONE event (either because the
+ *\li	The caller has received the BYADDRDONE event (either because the
  *	byaddr completed or because dns_byaddr_cancel() was called).
  *
  * Ensures:
  *
- *	*byaddrp == NULL.
+ *\li	*byaddrp == NULL.
  */
 
 isc_result_t
@@ -151,7 +153,7 @@ dns_byaddr_createptrname(isc_netaddr_t *address, isc_boolean_t nibble,
 isc_result_t
 dns_byaddr_createptrname2(isc_netaddr_t *address, unsigned int options,
 			  dns_name_t *name);
-/*
+/*%<
  * Creates a name that would be used in a PTR query for this address.  The
  * nibble flag indicates that the 'nibble' format is to be used if an IPv6
  * address is provided, instead of the 'bitstring' format.  Since we dropped
@@ -160,8 +162,8 @@ dns_byaddr_createptrname2(isc_netaddr_t *address, unsigned int options,
  *
  * Requires:
  * 
- * 	'address' is a valid address.
- * 	'name' is a valid name with a dedicated buffer.
+ * \li	'address' is a valid address.
+ * \li	'name' is a valid name with a dedicated buffer.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/cache.h b/contrib/bind9/lib/dns/include/dns/cache.h
index 4b775c9..fc4f78e 100644
--- a/contrib/bind9/lib/dns/include/dns/cache.h
+++ b/contrib/bind9/lib/dns/include/dns/cache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cache.h,v 1.17.12.5 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: cache.h,v 1.19.18.3 2005/08/23 02:31:38 marka Exp $ */
 
 #ifndef DNS_CACHE_H
 #define DNS_CACHE_H 1
@@ -24,18 +24,17 @@
  ***** Module Info
  *****/
 
-/*
- * cache
- *
+/*! \file
+ * \brief
  * Defines dns_cache_t, the cache object.
  *
  * Notes:
- * 	A cache object contains DNS data of a single class.
+ *\li 	A cache object contains DNS data of a single class.
  *	Multiple classes will be handled by creating multiple
  *	views, each with a different class and its own cache.
  *
  * MP:
- *	See notes at the individual functions.
+ *\li	See notes at the individual functions.
  *
  * Reliability:
  *
@@ -66,71 +65,70 @@ dns_cache_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 		 isc_timermgr_t *timermgr, dns_rdataclass_t rdclass,
 		 const char *db_type, unsigned int db_argc, char **db_argv,
 		 dns_cache_t **cachep);
-/*
+/*%<
  * Create a new DNS cache.
  *
  * Requires:
  *
- *	'mctx' is a valid memory context
+ *\li	'mctx' is a valid memory context
  *
- *	'taskmgr' is a valid task manager and 'timermgr' is a valid timer
+ *\li	'taskmgr' is a valid task manager and 'timermgr' is a valid timer
  * 	manager, or both are NULL.  If NULL, no periodic cleaning of the
  * 	cache will take place.
  *
- *	'cachep' is a valid pointer, and *cachep == NULL
+ *\li	'cachep' is a valid pointer, and *cachep == NULL
  *
  * Ensures:
  *
- *	'*cachep' is attached to the newly created cache
+ *\li	'*cachep' is attached to the newly created cache
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 void
 dns_cache_attach(dns_cache_t *cache, dns_cache_t **targetp);
-/*
+/*%<
  * Attach *targetp to cache.
  *
  * Requires:
  *
- *	'cache' is a valid cache.
+ *\li	'cache' is a valid cache.
  *
- *	'targetp' points to a NULL dns_cache_t *.
+ *\li	'targetp' points to a NULL dns_cache_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to cache.
+ *\li	*targetp is attached to cache.
  */
 
 void
 dns_cache_detach(dns_cache_t **cachep);
-/*
+/*%<
  * Detach *cachep from its cache.
  *
  * Requires:
  *
- *	'cachep' points to a valid cache.
+ *\li	'cachep' points to a valid cache.
  *
  * Ensures:
  *
- *	*cachep is NULL.
- *
- *	If '*cachep' is the last reference to the cache,
+ *\li	*cachep is NULL.
  *
- *		All resources used by the cache will be freed
+ *\li	If '*cachep' is the last reference to the cache,
+ *		all resources used by the cache will be freed
  */
 
 void
 dns_cache_attachdb(dns_cache_t *cache, dns_db_t **dbp);
-/*
+/*%<
  * Attach *dbp to the cache's database.
  *
  * Notes:
  *
- *	This may be used to get a reference to the database for
+ *\li	This may be used to get a reference to the database for
  *	the purpose of cache lookups (XXX currently it is also
  * 	the way to add data to the cache, but having a
  * 	separate dns_cache_add() interface instead would allow
@@ -140,39 +138,39 @@ dns_cache_attachdb(dns_cache_t *cache, dns_db_t **dbp);
  *
  * Requires:
  *
- *	'cache' is a valid cache.
+ *\li	'cache' is a valid cache.
  *
- *	'dbp' points to a NULL dns_db *.
+ *\li	'dbp' points to a NULL dns_db *.
  *
  * Ensures:
  *
- *	*dbp is attached to the database.
+ *\li	*dbp is attached to the database.
  */
 
 
 isc_result_t
-dns_cache_setfilename(dns_cache_t *cahce, const char *filename);
-/*
+dns_cache_setfilename(dns_cache_t *cache, const char *filename);
+/*%<
  * If 'filename' is non-NULL, make the cache persistent.
  * The cache's data will be stored in the given file.
  * If 'filename' is NULL, make the cache non-persistent.
  * Files that are no longer used are not unlinked automatically.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	Various file-related failures
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	Various file-related failures
  */
 
 isc_result_t
 dns_cache_load(dns_cache_t *cache);
-/*
+/*%<
  * If the cache has a file name, load the cache contents from the file.
  * Previous cache contents are not discarded.
  * If no file name has been set, do nothing and return success.
  *
  * MT:
- *	Multiple simultaneous attempts to load or dump the cache
+ *\li	Multiple simultaneous attempts to load or dump the cache
  * 	will be serialized with respect to one another, but
  *	the cache may be read and updated while the dump is
  *	in progress.  Updates performed during loading
@@ -181,19 +179,19 @@ dns_cache_load(dns_cache_t *cache);
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *      Various failures depending on the database implementation type
+ *\li	#ISC_R_SUCCESS
+ *  \li    Various failures depending on the database implementation type
  */
 
 isc_result_t
 dns_cache_dump(dns_cache_t *cache);
-/*
+/*%<
  * If the cache has a file name, write the cache contents to disk,
  * overwriting any preexisting file.  If no file name has been set,
  * do nothing and return success.
  *
  * MT:
- *	Multiple simultaneous attempts to load or dump the cache
+ *\li	Multiple simultaneous attempts to load or dump the cache
  * 	will be serialized with respect to one another, but
  *	the cache may be read and updated while the dump is
  *	in progress.  Updates performed during the dump may
@@ -201,13 +199,13 @@ dns_cache_dump(dns_cache_t *cache);
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *      Various failures depending on the database implementation type
+ *\li	#ISC_R_SUCCESS
+ *  \li    Various failures depending on the database implementation type
  */
 
 isc_result_t
 dns_cache_clean(dns_cache_t *cache, isc_stdtime_t now);
-/*
+/*%<
  * Force immediate cleaning of the cache, freeing all rdatasets
  * whose TTL has expired as of 'now' and that have no pending
  * references.
@@ -215,24 +213,24 @@ dns_cache_clean(dns_cache_t *cache, isc_stdtime_t now);
 
 void
 dns_cache_setcleaninginterval(dns_cache_t *cache, unsigned int interval);
-/*
+/*%<
  * Set the periodic cache cleaning interval to 'interval' seconds.
  */
 
 void
 dns_cache_setcachesize(dns_cache_t *cache, isc_uint32_t size);
-/*
+/*%<
  * Set the maximum cache size.  0 means unlimited.
  */
 
 isc_result_t
 dns_cache_flush(dns_cache_t *cache);
-/*
+/*%<
  * Flushes all data from the cache.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
@@ -241,13 +239,13 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name);
  * Flushes a given name from the cache.
  *
  * Requires:
- *	'cache' to be valid.
- *	'name' to be valid.
+ *\li	'cache' to be valid.
+ *\li	'name' to be valid.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	other error returns.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	other error returns.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/callbacks.h b/contrib/bind9/lib/dns/include/dns/callbacks.h
index 9c2710a..6aee70b 100644
--- a/contrib/bind9/lib/dns/include/dns/callbacks.h
+++ b/contrib/bind9/lib/dns/include/dns/callbacks.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: callbacks.h,v 1.15.2.2.8.1 2004/03/06 08:13:51 marka Exp $ */
+/* $Id: callbacks.h,v 1.18.18.2 2005/04/29 00:16:10 marka Exp $ */
 
 #ifndef DNS_CALLBACKS_H
 #define DNS_CALLBACKS_H 1
 
+/*! \file */
+
 /***
  ***	Imports
  ***/
@@ -35,19 +37,19 @@ ISC_LANG_BEGINDECLS
  ***/
 
 struct dns_rdatacallbacks {
-	/*
+	/*%
 	 * dns_load_master calls this when it has rdatasets to commit.
 	 */
 	dns_addrdatasetfunc_t add;
-	/*
+	/*%
 	 * dns_load_master / dns_rdata_fromtext call this to issue a error.
 	 */
 	void	(*error)(struct dns_rdatacallbacks *, const char *, ...);
-	/*
+	/*%
 	 * dns_load_master / dns_rdata_fromtext call this to issue a warning.
 	 */
 	void	(*warn)(struct dns_rdatacallbacks *, const char *, ...);
-	/*
+	/*%
 	 * Private data handles for use by the above callback functions.
 	 */
 	void	*add_private;
@@ -61,20 +63,22 @@ struct dns_rdatacallbacks {
 
 void
 dns_rdatacallbacks_init(dns_rdatacallbacks_t *callbacks);
-/*
+/*%<
  * Initialize 'callbacks'.
- * 	'error' and 'warn' are set to default callbacks that print the
+ *
+ *
+ * \li	'error' and 'warn' are set to default callbacks that print the
  *	error message through the DNS library log context.
  *
- *	All other elements are initialized to NULL.
+ *\li	All other elements are initialized to NULL.
  *
  * Requires:
- *      'callbacks' is a valid dns_rdatacallbacks_t,
+ *  \li    'callbacks' is a valid dns_rdatacallbacks_t,
  */
 
 void
 dns_rdatacallbacks_init_stdio(dns_rdatacallbacks_t *callbacks);
-/*
+/*%<
  * Like dns_rdatacallbacks_init, but logs to stdio.
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/cert.h b/contrib/bind9/lib/dns/include/dns/cert.h
index 28a3d4c..4de1aec 100644
--- a/contrib/bind9/lib/dns/include/dns/cert.h
+++ b/contrib/bind9/lib/dns/include/dns/cert.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cert.h,v 1.12.206.1 2004/03/06 08:13:51 marka Exp $ */
+/* $Id: cert.h,v 1.13.18.2 2005/04/29 00:16:10 marka Exp $ */
 
 #ifndef DNS_CERT_H
 #define DNS_CERT_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -28,38 +30,38 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_cert_fromtext(dns_cert_t *certp, isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a certificate type.
  * The text may contain either a mnemonic type name or a decimal type number.
  *
  * Requires:
- *	'certp' is a valid pointer.
+ *\li	'certp' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_RANGE			numeric type is out of range
- *	DNS_R_UNKNOWN			mnemonic type is unknown
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#ISC_R_RANGE			numeric type is out of range
+ *\li	#DNS_R_UNKNOWN			mnemonic type is unknown
  */
 
 isc_result_t
 dns_cert_totext(dns_cert_t cert, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of certificate type 'cert' into 'target'.
  *
  * Requires:
- *	'cert' is a valid cert.
+ *\li	'cert' is a valid cert.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
  * Ensures:
- *	If the result is success:
+ *\li	If the result is success:
  *		The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#ISC_R_NOSPACE			target buffer is too small
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/compress.h b/contrib/bind9/lib/dns/include/dns/compress.h
index 042a4ea..4d9c011 100644
--- a/contrib/bind9/lib/dns/include/dns/compress.h
+++ b/contrib/bind9/lib/dns/include/dns/compress.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: compress.h,v 1.29.2.2.8.3 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: compress.h,v 1.32.18.6 2006/03/02 00:37:21 marka Exp $ */
 
 #ifndef DNS_COMPRESS_H
 #define DNS_COMPRESS_H 1
@@ -27,11 +27,12 @@
 
 ISC_LANG_BEGINDECLS
 
-#define DNS_COMPRESS_NONE		0x00	/* no compression */
-#define DNS_COMPRESS_GLOBAL14		0x01	/* "normal" compression. */
-#define DNS_COMPRESS_ALL		0x01	/* all compression. */
+#define DNS_COMPRESS_NONE		0x00	/*%< no compression */
+#define DNS_COMPRESS_GLOBAL14		0x01	/*%< "normal" compression. */
+#define DNS_COMPRESS_ALL		0x01	/*%< all compression. */
+#define DNS_COMPRESS_CASESENSITIVE	0x02	/*%< case sensitive compression. */
 
-/*
+/*! \file
  *	Direct manipulation of the structures is strongly discouraged.
  */
 
@@ -49,198 +50,218 @@ struct dns_compressnode {
 };
 
 struct dns_compress {
-	unsigned int		magic;		/* Magic number. */
-	unsigned int		allowed;	/* Allowed methods. */
-	int			edns;		/* Edns version or -1. */
-	/* Global compression table. */
+	unsigned int		magic;		/*%< Magic number. */
+	unsigned int		allowed;	/*%< Allowed methods. */
+	int			edns;		/*%< Edns version or -1. */
+	/*% Global compression table. */
 	dns_compressnode_t	*table[DNS_COMPRESS_TABLESIZE];
-	/* Preallocated nodes for the table. */
+	/*% Preallocated nodes for the table. */
 	dns_compressnode_t	initialnodes[DNS_COMPRESS_INITIALNODES];
-	isc_uint16_t		count;		/* Number of nodes. */
-	isc_mem_t		*mctx;		/* Memory context. */
+	isc_uint16_t		count;		/*%< Number of nodes. */
+	isc_mem_t		*mctx;		/*%< Memory context. */
 };
 
 typedef enum {
-	DNS_DECOMPRESS_ANY,			/* Any compression */
-	DNS_DECOMPRESS_STRICT,			/* Allowed compression */
-	DNS_DECOMPRESS_NONE			/* No compression */
+	DNS_DECOMPRESS_ANY,			/*%< Any compression */
+	DNS_DECOMPRESS_STRICT,			/*%< Allowed compression */
+	DNS_DECOMPRESS_NONE			/*%< No compression */
 } dns_decompresstype_t;
 
 struct dns_decompress {
-	unsigned int		magic;		/* Magic number. */
-	unsigned int		allowed;	/* Allowed methods. */
-	int			edns;		/* Edns version or -1. */
-	dns_decompresstype_t	type;		/* Strict checking */
+	unsigned int		magic;		/*%< Magic number. */
+	unsigned int		allowed;	/*%< Allowed methods. */
+	int			edns;		/*%< Edns version or -1. */
+	dns_decompresstype_t	type;		/*%< Strict checking */
 };
 
 isc_result_t
 dns_compress_init(dns_compress_t *cctx, int edns, isc_mem_t *mctx);
-/*
+/*%<
  *	Inialise the compression context structure pointed to by 'cctx'.
  *
  *	Requires:
- *		'cctx' is a valid dns_compress_t structure.
- *		'mctx' is an initialized memory context.
+ *	\li	'cctx' is a valid dns_compress_t structure.
+ *	\li	'mctx' is an initialized memory context.
  *	Ensures:
- *		cctx->global is initialized.
+ *	\li	cctx->global is initialized.
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		failures from dns_rbt_create()
+ *	\li	#ISC_R_SUCCESS
+ *	\li	failures from dns_rbt_create()
  */
 
 void
 dns_compress_invalidate(dns_compress_t *cctx);
 
-/*
+/*%<
  *	Invalidate the compression structure pointed to by cctx.
  *
  *	Requires:
- *		'cctx' to be initialized.
+ *\li		'cctx' to be initialized.
  */
 
 void
 dns_compress_setmethods(dns_compress_t *cctx, unsigned int allowed);
 
-/*
+/*%<
  *	Sets allowed compression methods.
  *
  *	Requires:
- *		'cctx' to be initialized.
+ *\li		'cctx' to be initialized.
  */
 
 unsigned int
 dns_compress_getmethods(dns_compress_t *cctx);
 
-/*
+/*%<
  *	Gets allowed compression methods.
  *
  *	Requires:
- *		'cctx' to be initialized.
+ *\li		'cctx' to be initialized.
  *
  *	Returns:
- *		allowed compression bitmap.
+ *\li		allowed compression bitmap.
+ */
+
+void
+dns_compress_setsensitive(dns_compress_t *cctx, isc_boolean_t sensitive);
+
+/*
+ *	Preserve the case of compressed domain names.
+ *
+ *	Requires:
+ *		'cctx' to be initialized.
+ */
+
+isc_boolean_t
+dns_compress_getsensitive(dns_compress_t *cctx);
+/*
+ *	Return whether case is to be preservered when compressing
+ *	domain names.
+ *
+ *	Requires:
+ *		'cctx' to be initialized.
  */
 
 int
 dns_compress_getedns(dns_compress_t *cctx);
 
-/*
+/*%<
  *	Gets edns value.
  *
  *	Requires:
- *		'cctx' to be initialized.
+ *\li		'cctx' to be initialized.
  *
  *	Returns:
- *		-1 .. 255
+ *\li		-1 .. 255
  */
 
 isc_boolean_t
 dns_compress_findglobal(dns_compress_t *cctx, const dns_name_t *name,
 			dns_name_t *prefix, isc_uint16_t *offset);
-/*
+/*%<
  *	Finds longest possible match of 'name' in the global compression table.
  *
  *	Requires:
- *		'cctx' to be initialized.
- *		'name' to be a absolute name.
- *		'prefix' to be initialized.
- *		'offset' to point to an isc_uint16_t.
+ *\li		'cctx' to be initialized.
+ *\li		'name' to be a absolute name.
+ *\li		'prefix' to be initialized.
+ *\li		'offset' to point to an isc_uint16_t.
  *
  *	Ensures:
- *		'prefix' and 'offset' are valid if ISC_TRUE is 	returned.
+ *\li		'prefix' and 'offset' are valid if ISC_TRUE is 	returned.
  *
  *	Returns:
- *		ISC_TRUE / ISC_FALSE
+ *\li		#ISC_TRUE / #ISC_FALSE
  */
 
 void
 dns_compress_add(dns_compress_t *cctx, const dns_name_t *name,
 		 const dns_name_t *prefix, isc_uint16_t offset);
-/*
+/*%<
  *	Add compression pointers for 'name' to the compression table,
  *	not replacing existing pointers.
  *
  *	Requires:
- *		'cctx' initialized
+ *\li		'cctx' initialized
  *
- *		'name' must be initialized and absolute, and must remain
+ *\li		'name' must be initialized and absolute, and must remain
  *		valid until the message compression is complete.
  *
- *		'prefix' must be a prefix returned by
+ *\li		'prefix' must be a prefix returned by
  *		dns_compress_findglobal(), or the same as 'name'.
  */
 
 void
 dns_compress_rollback(dns_compress_t *cctx, isc_uint16_t offset);
 
-/*
+/*%<
  *	Remove any compression pointers from global table >= offset.
  *
  *	Requires:
- *		'cctx' is initialized.
+ *\li		'cctx' is initialized.
  */
 
 void
 dns_decompress_init(dns_decompress_t *dctx, int edns,
 		    dns_decompresstype_t type);
 
-/*
+/*%<
  *	Initializes 'dctx'.
  *	Records 'edns' and 'type' into the structure.
  *
  *	Requires:
- *		'dctx' to be a valid pointer.
+ *\li		'dctx' to be a valid pointer.
  */
 
 void
 dns_decompress_invalidate(dns_decompress_t *dctx);
 
-/*
+/*%<
  *	Invalidates 'dctx'.
  *
  *	Requires:
- *		'dctx' to be initialized
+ *\li		'dctx' to be initialized
  */
 
 void
 dns_decompress_setmethods(dns_decompress_t *dctx, unsigned int allowed);
 
-/*
+/*%<
  *	Sets 'dctx->allowed' to 'allowed'.
  *
  *	Requires:
- *		'dctx' to be initialized
+ *\li		'dctx' to be initialized
  */
 
 unsigned int
 dns_decompress_getmethods(dns_decompress_t *dctx);
 
-/*
+/*%<
  *	Returns 'dctx->allowed'
  *
  *	Requires:
- *		'dctx' to be initialized
+ *\li		'dctx' to be initialized
  */
 
 int
 dns_decompress_edns(dns_decompress_t *dctx);
 
-/*
+/*%<
  *	Returns 'dctx->edns'
  *
  *	Requires:
- *		'dctx' to be initialized
+ *\li		'dctx' to be initialized
  */
 
 dns_decompresstype_t
 dns_decompress_type(dns_decompress_t *dctx);
 
-/*
+/*%<
  *	Returns 'dctx->type'
  *
  *	Requires:
- *		'dctx' to be initialized
+ *\li		'dctx' to be initialized
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/db.h b/contrib/bind9/lib/dns/include/dns/db.h
index 8e08882..a791a2e 100644
--- a/contrib/bind9/lib/dns/include/dns/db.h
+++ b/contrib/bind9/lib/dns/include/dns/db.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: db.h,v 1.67.12.8 2004/05/14 05:06:41 marka Exp $ */
+/* $Id: db.h,v 1.76.18.7 2005/10/13 02:12:25 marka Exp $ */
 
 #ifndef DNS_DB_H
 #define DNS_DB_H 1
@@ -24,31 +24,30 @@
  ***** Module Info
  *****/
 
-/*
- * DNS DB
- *
+/*! \file
+ * \brief
  * The DNS DB interface allows named rdatasets to be stored and retrieved.
  *
  * The dns_db_t type is like a "virtual class".  To actually use
  * DBs, an implementation of the class is required.
  *
- * XXX <more> XXX
+ * XXX more XXX
  *
  * MP:
- *	The module ensures appropriate synchronization of data structures it
+ * \li	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
  *
  * Reliability:
- *	No anticipated impact.
+ * \li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ * \li	TBS
  *
  * Security:
- *	No anticipated impact.
+ * \li	No anticipated impact.
  *
  * Standards:
- *	None.
+ * \li	None.
  */
 
 /*****
@@ -76,7 +75,8 @@ typedef struct dns_dbmethods {
 				     dns_dbload_t **dbloadp);
 	isc_result_t	(*endload)(dns_db_t *db, dns_dbload_t **dbloadp);
 	isc_result_t	(*dump)(dns_db_t *db, dns_dbversion_t *version,
-				const char *filename);
+				const char *filename,
+				dns_masterformat_t masterformat);
 	void		(*currentversion)(dns_db_t *db,
 					  dns_dbversion_t **versionp);
 	isc_result_t	(*newversion)(dns_db_t *db,
@@ -145,6 +145,7 @@ typedef struct dns_dbmethods {
 	isc_boolean_t	(*ispersistent)(dns_db_t *db);
 	void		(*overmem)(dns_db_t *db, isc_boolean_t overmem);
 	void		(*settask)(dns_db_t *db, isc_task_t *);
+	isc_result_t	(*getoriginnode)(dns_db_t *db, dns_dbnode_t **nodep);
 } dns_dbmethods_t;
 
 typedef isc_result_t
@@ -156,10 +157,10 @@ typedef isc_result_t
 #define DNS_DB_MAGIC		ISC_MAGIC('D','N','S','D')
 #define DNS_DB_VALID(db)	ISC_MAGIC_VALID(db, DNS_DB_MAGIC)
 
-/*
+/*%
  * This structure is actually just the common prefix of a DNS db
  * implementation's version of a dns_db_t.
- *
+ * \brief
  * Direct use of this structure by clients is forbidden.  DB implementations
  * may change the structure.  'magic' must be DNS_DB_MAGIC for any of the
  * dns_db_ routines to work.  DB implementations must maintain all DB
@@ -179,7 +180,8 @@ struct dns_db {
 #define DNS_DBATTR_CACHE		0x01
 #define DNS_DBATTR_STUB			0x02
 
-/*
+/*@{*/
+/*%
  * Options that can be specified for dns_db_find().
  */
 #define DNS_DBFIND_GLUEOK		0x01
@@ -189,16 +191,19 @@ struct dns_db {
 #define DNS_DBFIND_NOEXACT		0x10
 #define DNS_DBFIND_FORCENSEC		0x20
 #define DNS_DBFIND_COVERINGNSEC		0x40
+/*@}*/
 
-/*
+/*@{*/
+/*%
  * Options that can be specified for dns_db_addrdataset().
  */
 #define DNS_DBADD_MERGE			0x01
 #define DNS_DBADD_FORCE			0x02
 #define DNS_DBADD_EXACT			0x04
 #define DNS_DBADD_EXACTTTL		0x08
+/*@}*/
 
-/*
+/*%
  * Options that can be specified for dns_db_subtractrdataset().
  */
 #define DNS_DBSUB_EXACT			0x01
@@ -215,78 +220,77 @@ isc_result_t
 dns_db_create(isc_mem_t *mctx, const char *db_type, dns_name_t *origin,
 	      dns_dbtype_t type, dns_rdataclass_t rdclass,
 	      unsigned int argc, char *argv[], dns_db_t **dbp);
-/*
+/*%<
  * Create a new database using implementation 'db_type'.
  *
  * Notes:
- *	All names in the database must be subdomains of 'origin' and in class
+ * \li	All names in the database must be subdomains of 'origin' and in class
  *	'rdclass'.  The database makes its own copy of the origin, so the
  *	caller may do whatever they like with 'origin' and its storage once the
  *	call returns.
  *
- *	DB implementation-specific parameters are passed using argc and argv.
+ * \li	DB implementation-specific parameters are passed using argc and argv.
  *
  * Requires:
  *
- *	dbp != NULL and *dbp == NULL
+ * \li	dbp != NULL and *dbp == NULL
  *
- *	'origin' is a valid absolute domain name.
+ * \li	'origin' is a valid absolute domain name.
  *
- *	mctx is a valid memory context
+ * \li	mctx is a valid memory context
  *
  * Ensures:
  *
- *	A copy of 'origin' has been made for the databases use, and the
+ * \li	A copy of 'origin' has been made for the databases use, and the
  *	caller is free to do whatever they want with the name and storage
  *	associated with 'origin'.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_NOTFOUND				db_type not found
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
+ * \li	#ISC_R_NOTFOUND				db_type not found
  *
- *	Many other errors are possible, depending on what db_type was
+ * \li	Many other errors are possible, depending on what db_type was
  *	specified.
  */
 
 void
 dns_db_attach(dns_db_t *source, dns_db_t **targetp);
-/*
+/*%<
  * Attach *targetp to source.
  *
  * Requires:
  *
- *	'source' is a valid database.
+ * \li	'source' is a valid database.
  *
- *	'targetp' points to a NULL dns_db_t *.
+ * \li	'targetp' points to a NULL dns_db_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to source.
+ * \li	*targetp is attached to source.
  */
 
 void
 dns_db_detach(dns_db_t **dbp);
-/*
+/*%<
  * Detach *dbp from its database.
  *
  * Requires:
  *
- *	'dbp' points to a valid database.
+ * \li	'dbp' points to a valid database.
  *
  * Ensures:
  *
- *	*dbp is NULL.
- *
- *	If '*dbp' is the last reference to the database,
+ * \li	*dbp is NULL.
  *
- *		All resources used by the database will be freed
+ * \li	If '*dbp' is the last reference to the database,
+ *		all resources used by the database will be freed
  */
 
 isc_result_t
 dns_db_ondestroy(dns_db_t *db, isc_task_t *task, isc_event_t **eventp);
-/*
+/*%<
  * Causes 'eventp' to be sent to be sent to 'task' when the database is
  * destroyed.
  *
@@ -297,189 +301,198 @@ dns_db_ondestroy(dns_db_t *db, isc_task_t *task, isc_event_t **eventp);
 
 isc_boolean_t
 dns_db_iscache(dns_db_t *db);
-/*
+/*%<
  * Does 'db' have cache semantics?
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
  * Returns:
- *	ISC_TRUE	'db' has cache semantics
- *	ISC_FALSE	otherwise
+ * \li	#ISC_TRUE	'db' has cache semantics
+ * \li	#ISC_FALSE	otherwise
  */
 
 isc_boolean_t
 dns_db_iszone(dns_db_t *db);
-/*
+/*%<
  * Does 'db' have zone semantics?
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
  * Returns:
- *	ISC_TRUE	'db' has zone semantics
- *	ISC_FALSE	otherwise
+ * \li	#ISC_TRUE	'db' has zone semantics
+ * \li	#ISC_FALSE	otherwise
  */
 
 isc_boolean_t
 dns_db_isstub(dns_db_t *db);
-/*
+/*%<
  * Does 'db' have stub semantics?
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
  * Returns:
- *	ISC_TRUE	'db' has zone semantics
- *	ISC_FALSE	otherwise
+ * \li	#ISC_TRUE	'db' has zone semantics
+ * \li	#ISC_FALSE	otherwise
  */
 
 isc_boolean_t
 dns_db_issecure(dns_db_t *db);
-/*
+/*%<
  * Is 'db' secure?
  *
  * Requires:
  *
- *	'db' is a valid database with zone semantics.
+ * \li	'db' is a valid database with zone semantics.
  *
  * Returns:
- *	ISC_TRUE	'db' is secure.
- *	ISC_FALSE	'db' is not secure.
+ * \li	#ISC_TRUE	'db' is secure.
+ * \li	#ISC_FALSE	'db' is not secure.
  */
 
 dns_name_t *
 dns_db_origin(dns_db_t *db);
-/*
+/*%<
  * The origin of the database.
  *
  * Note: caller must not try to change this name.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
  * Returns:
  *
- *	The origin of the database.
+ * \li	The origin of the database.
  */
 
 dns_rdataclass_t
 dns_db_class(dns_db_t *db);
-/*
+/*%<
  * The class of the database.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
  * Returns:
  *
- *	The class of the database.
+ * \li	The class of the database.
  */
 
 isc_result_t
 dns_db_beginload(dns_db_t *db, dns_addrdatasetfunc_t *addp,
 		 dns_dbload_t **dbloadp);
-/*
+/*%<
  * Begin loading 'db'.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	This is the first attempt to load 'db'.
+ * \li	This is the first attempt to load 'db'.
  *
- *	addp != NULL && *addp == NULL
+ * \li	addp != NULL && *addp == NULL
  *
- *	dbloadp != NULL && *dbloadp == NULL
+ * \li	dbloadp != NULL && *dbloadp == NULL
  *
  * Ensures:
  *
- *	On success, *addp will be a valid dns_addrdatasetfunc_t suitable
+ * \li	On success, *addp will be a valid dns_addrdatasetfunc_t suitable
  *	for loading 'db'.  *dbloadp will be a valid DB load context which
  *	should be used as 'arg' when *addp is called.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used, syntax errors in the master file, etc.
  */
 
 isc_result_t
 dns_db_endload(dns_db_t *db, dns_dbload_t **dbloadp);
-/*
+/*%<
  * Finish loading 'db'.
  *
  * Requires:
  *
- *	'db' is a valid database that is being loaded.
+ * \li	'db' is a valid database that is being loaded.
  *
- *	dbloadp != NULL and *dbloadp is a valid database load context.
+ * \li	dbloadp != NULL and *dbloadp is a valid database load context.
  *
  * Ensures:
  *
- *	*dbloadp == NULL
+ * \li	*dbloadp == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used, syntax errors in the master file, etc.
  */
 
 isc_result_t
 dns_db_load(dns_db_t *db, const char *filename);
-/*
+
+isc_result_t
+dns_db_load2(dns_db_t *db, const char *filename, dns_masterformat_t format);
+/*%<
  * Load master file 'filename' into 'db'.
  *
  * Notes:
- *	This routine is equivalent to calling
+ * \li	This routine is equivalent to calling
  *
+ *\code
  *		dns_db_beginload();
  *		dns_master_loadfile();
  *		dns_db_endload();
+ *\endcode
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	This is the first attempt to load 'db'.
+ * \li	This is the first attempt to load 'db'.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used, syntax errors in the master file, etc.
  */
 
 isc_result_t
 dns_db_dump(dns_db_t *db, dns_dbversion_t *version, const char *filename);
-/*
+
+isc_result_t
+dns_db_dump2(dns_db_t *db, dns_dbversion_t *version, const char *filename,
+	     dns_masterformat_t masterformat);
+/*%<
  * Dump version 'version' of 'db' to master file 'filename'.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'version' is a valid version.
+ * \li	'version' is a valid version.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used, OS file errors, etc.
  */
 
@@ -489,68 +502,68 @@ dns_db_dump(dns_db_t *db, dns_dbversion_t *version, const char *filename);
 
 void
 dns_db_currentversion(dns_db_t *db, dns_dbversion_t **versionp);
-/*
+/*%<
  * Open the current version for reading.
  *
  * Requires:
  *
- *	'db' is a valid database with zone semantics.
+ * \li	'db' is a valid database with zone semantics.
  *
- *	versionp != NULL && *verisonp == NULL
+ * \li	versionp != NULL && *verisonp == NULL
  *
  * Ensures:
  *
- *	On success, '*versionp' is attached to the current version.
+ * \li	On success, '*versionp' is attached to the current version.
  *
  */
 
 isc_result_t
 dns_db_newversion(dns_db_t *db, dns_dbversion_t **versionp);
-/*
+/*%<
  * Open a new version for reading and writing.
  *
  * Requires:
  *
- *	'db' is a valid database with zone semantics.
+ * \li	'db' is a valid database with zone semantics.
  *
- *	versionp != NULL && *verisonp == NULL
+ * \li	versionp != NULL && *verisonp == NULL
  *
  * Ensures:
  *
- *	On success, '*versionp' is attached to the current version.
+ * \li	On success, '*versionp' is attached to the current version.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used.
  */
 
 void
 dns_db_attachversion(dns_db_t *db, dns_dbversion_t *source,
 		     dns_dbversion_t **targetp);
-/*
+/*%<
  * Attach '*targetp' to 'source'.
  *
  * Requires:
  *
- *	'db' is a valid database with zone semantics.
+ * \li	'db' is a valid database with zone semantics.
  *
- *	source is a valid open version
+ * \li	source is a valid open version
  *
- *	targetp != NULL && *targetp == NULL
+ * \li	targetp != NULL && *targetp == NULL
  *
  * Ensures:
  *
- *	'*targetp' is attached to source.
+ * \li	'*targetp' is attached to source.
  */
 
 void
 dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 		    isc_boolean_t commit);
-/*
+/*%<
  * Close version '*versionp'.
  *
  * Note: if '*versionp' is a read-write version and 'commit' is ISC_TRUE,
@@ -560,19 +573,19 @@ dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp,
  *
  * Requires:
  *
- *	'db' is a valid database with zone semantics.
+ * \li	'db' is a valid database with zone semantics.
  *
- *	'*versionp' refers to a valid version.
+ * \li	'*versionp' refers to a valid version.
  *
- *	If committing a writable version, then there must be no other
+ * \li	If committing a writable version, then there must be no other
  *	outstanding references to the version (e.g. an active rdataset
  *	iterator).
  *
  * Ensures:
  *
- *	*versionp == NULL
+ * \li	*versionp == NULL
  *
- *	If *versionp is a read-write version, and commit is ISC_TRUE, then
+ * \li	If *versionp is a read-write version, and commit is ISC_TRUE, then
  *	the version will become the current version.  If !commit, then all
  *	changes made in the version will be undone, and the version will
  *	not become the current version.
@@ -585,37 +598,37 @@ dns_db_closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 isc_result_t
 dns_db_findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
 		dns_dbnode_t **nodep);
-/*
+/*%<
  * Find the node with name 'name'.
  *
  * Notes:
- *	If 'create' is ISC_TRUE and no node with name 'name' exists, then
+ * \li	If 'create' is ISC_TRUE and no node with name 'name' exists, then
  *	such a node will be created.
  *
- *	This routine is for finding or creating a node with the specified
+ * \li	This routine is for finding or creating a node with the specified
  *	name.  There are no partial matches.  It is not suitable for use
  *	in building responses to ordinary DNS queries; clients which wish
  *	to do that should use dns_db_find() instead.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'name' is a valid, non-empty, absolute name.
+ * \li	'name' is a valid, non-empty, absolute name.
  *
- *	nodep != NULL && *nodep == NULL
+ * \li	nodep != NULL && *nodep == NULL
  *
  * Ensures:
  *
- *	On success, *nodep is attached to the node with name 'name'.
+ * \li	On success, *nodep is attached to the node with name 'name'.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND			If !create and name not found.
- *	ISC_R_NOMEMORY		        Can only happen if create is ISC_TRUE.
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND			If !create and name not found.
+ * \li	#ISC_R_NOMEMORY		        Can only happen if create is ISC_TRUE.
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used.
  */
 
@@ -624,44 +637,44 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	    dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
 	    dns_dbnode_t **nodep, dns_name_t *foundname,
 	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
-/*
+/*%<
  * Find the best match for 'name' and 'type' in version 'version' of 'db'.
  *
  * Notes:
  *
- *	If type == dns_rdataset_any, then rdataset will not be bound.
+ * \li	If type == dns_rdataset_any, then rdataset will not be bound.
  *
- *	If 'options' does not have DNS_DBFIND_GLUEOK set, then no glue will
- *	be returned.  For zone databases, glue is as defined in RFC 2181.
+ * \li	If 'options' does not have #DNS_DBFIND_GLUEOK set, then no glue will
+ *	be returned.  For zone databases, glue is as defined in RFC2181.
  *	For cache databases, glue is any rdataset with a trust of
  *	dns_trust_glue.
  *
- *	If 'options' does not have DNS_DBFIND_PENDINGOK set, then no
+ * \li	If 'options' does not have #DNS_DBFIND_PENDINGOK set, then no
  *	pending data will be returned.  This option is only meaningful for
  *	cache databases.
  *
- *	If the DNS_DBFIND_NOWILD option is set, then wildcard matching will
+ * \li	If the #DNS_DBFIND_NOWILD option is set, then wildcard matching will
  *	be disabled.  This option is only meaningful for zone databases.
  *
- *	If the DNS_DBFIND_FORCENSEC option is set, the database is assumed to
+ * \li	If the #DNS_DBFIND_FORCENSEC option is set, the database is assumed to
  *	have NSEC records, and these will be returned when appropriate.  This
  *	is only necessary when querying a database that was not secure
  *	when created.
  *
- *	If the DNS_DBFIND_COVERINGNSEC option is set, then look for a
+ * \li	If the DNS_DBFIND_COVERINGNSEC option is set, then look for a
  *	NSEC record that potentially covers 'name' if a answer cannot
  *	be found.  Note the returned NSEC needs to be checked to ensure
  *	that it is correct.  This only affects answers returned from the
  *	cache.
  *
- *	To respond to a query for SIG records, the caller should create a
+ * \li	To respond to a query for SIG records, the caller should create a
  *	rdataset iterator and extract the signatures from each rdataset.
  *
- *	Making queries of type ANY with DNS_DBFIND_GLUEOK is not recommended,
+ * \li	Making queries of type ANY with #DNS_DBFIND_GLUEOK is not recommended,
  *	because the burden of determining whether a given rdataset is valid
  *	glue or not falls upon the caller.
  *
- *	The 'now' field is ignored if 'db' is a zone database.  If 'db' is a
+ * \li	The 'now' field is ignored if 'db' is a zone database.  If 'db' is a
  *	cache database, an rdataset will not be found unless it expires after
  *	'now'.  Any ANY query will not match unless at least one rdataset at
  *	the node expires after 'now'.  If 'now' is zero, then the current time
@@ -669,43 +682,41 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'type' is not SIG, or a meta-RR type other than 'ANY' (e.g. 'OPT').
+ * \li	'type' is not SIG, or a meta-RR type other than 'ANY' (e.g. 'OPT').
  *
- *	'nodep' is NULL, or nodep is a valid pointer and *nodep == NULL.
+ * \li	'nodep' is NULL, or nodep is a valid pointer and *nodep == NULL.
  *
- *	'foundname' is a valid name with a dedicated buffer.
+ * \li	'foundname' is a valid name with a dedicated buffer.
  *
- *	'rdataset' is NULL, or is a valid unassociated rdataset.
+ * \li	'rdataset' is NULL, or is a valid unassociated rdataset.
  *
- * Ensures:
- *	On a non-error completion:
+ * Ensures,
+ *	on a non-error completion:
  *
- *		If nodep != NULL, then it is bound to the found node.
+ *	\li	If nodep != NULL, then it is bound to the found node.
  *
- *		If foundname != NULL, then it contains the full name of the
+ *	\li	If foundname != NULL, then it contains the full name of the
  *		found node.
  *
- *		If rdataset != NULL and type != dns_rdatatype_any, then
+ *	\li	If rdataset != NULL and type != dns_rdatatype_any, then
  *		rdataset is bound to the found rdataset.
  *
- * Returns:
- *
  *	Non-error results are:
  *
- *		ISC_R_SUCCESS			The desired node and type were
+ *	\li	#ISC_R_SUCCESS			The desired node and type were
  *						found.
  *
- *		DNS_R_WILDCARD			The desired node and type were
+ *	\li	#DNS_R_WILDCARD			The desired node and type were
  *						found after performing
  *						wildcard matching.  This is
  *						only returned if the
- *						DNS_DBFIND_INDICATEWILD
+ *						#DNS_DBFIND_INDICATEWILD
  *						option is set; otherwise
- *						ISC_R_SUCCESS is returned.
+ *						#ISC_R_SUCCESS is returned.
  *
- *		DNS_R_GLUE			The desired node and type were
+ *	\li	#DNS_R_GLUE			The desired node and type were
  *						found, but are glue.  This
  *						result can only occur if
  *						the DNS_DBFIND_GLUEOK option
@@ -720,7 +731,7 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  *						take care not to return invalid
  *						glue to a client.
  *
- *		DNS_R_DELEGATION		The data requested is beneath
+ *	\li	#DNS_R_DELEGATION		The data requested is beneath
  *						a zone cut.  node, foundname,
  *						and rdataset reference the
  *						NS RRset of the zone cut.
@@ -728,7 +739,7 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  *						then this is the deepest known
  *						delegation.
  *
- *		DNS_R_ZONECUT			type == dns_rdatatype_any, and
+ *	\li	#DNS_R_ZONECUT			type == dns_rdatatype_any, and
  *						the desired node is a zonecut.
  *						The caller must take care not
  *						to return inappropriate glue
@@ -737,24 +748,24 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  *						database and DNS_DBFIND_GLUEOK
  *						is set.
  *
- *		DNS_R_DNAME			The data requested is beneath
+ *	\li	#DNS_R_DNAME			The data requested is beneath
  *						a DNAME.  node, foundname,
  *						and rdataset reference the
  *						DNAME RRset.
  *
- *		DNS_R_CNAME			The rdataset requested was not
+ *	\li	#DNS_R_CNAME			The rdataset requested was not
  *						found, but there is a CNAME
  *						at the desired name.  node,
  *						foundname, and rdataset
  *						reference the CNAME RRset.
  *
- *		DNS_R_NXDOMAIN			The desired name does not
+ *	\li	#DNS_R_NXDOMAIN			The desired name does not
  *						exist.
  *
- *		DNS_R_NXRRSET			The desired name exists, but
+ *	\li	#DNS_R_NXRRSET			The desired name exists, but
  *						the desired type does not.
  *
- *		ISC_R_NOTFOUND			The desired name does not
+ *	\li	#ISC_R_NOTFOUND			The desired name does not
  *						exist, and no delegation could
  *						be found.  This result can only
  *						occur if 'db' is a cache
@@ -762,34 +773,34 @@ dns_db_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
  *						use its nameserver(s) of last
  *						resort (e.g. root hints).
  *
- *		DNS_R_NCACHENXDOMAIN		The desired name does not
+ *	\li	#DNS_R_NCACHENXDOMAIN		The desired name does not
  *						exist.  'node' is bound to the
  *						cache node with the desired
  *						name, and 'rdataset' contains
  *						the negative caching proof.
  *
- *		DNS_R_NCACHENXRRSET		The desired type does not
+ *	\li	#DNS_R_NCACHENXRRSET		The desired type does not
  *						exist.  'node' is bound to the
  *						cache node with the desired
  *						name, and 'rdataset' contains
  *						the negative caching proof.
  *
- *		DNS_R_EMPTYNAME			The name exists but there is
+ *	\li	#DNS_R_EMPTYNAME			The name exists but there is
  *						no data at the name. 
  *
- *		DNS_R_COVERINGNSEC		The returned data is a NSEC
+ *	\li	#DNS_R_COVERINGNSEC		The returned data is a NSEC
  *						that potentially covers 'name'.
  *
  *	Error results:
  *
- *		ISC_R_NOMEMORY
+ *	\li	#ISC_R_NOMEMORY
  *
- *		DNS_R_BADDB			Data that is required to be
+ *	\li	#DNS_R_BADDB			Data that is required to be
  *						present in the DB, e.g. an NSEC
  *						record in a secure zone, is not
  *						present.
  *
- *		Other results are possible, and should all be treated as
+ *	\li	Other results are possible, and should all be treated as
  *		errors.
  */
 
@@ -798,100 +809,97 @@ dns_db_findzonecut(dns_db_t *db, dns_name_t *name,
 		   unsigned int options, isc_stdtime_t now,
 		   dns_dbnode_t **nodep, dns_name_t *foundname,
 		   dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
-/*
+/*%<
  * Find the deepest known zonecut which encloses 'name' in 'db'.
  *
  * Notes:
  *
- *	If the DNS_DBFIND_NOEXACT option is set, then the zonecut returned
+ * \li	If the #DNS_DBFIND_NOEXACT option is set, then the zonecut returned
  *	(if any) will be the deepest known ancestor of 'name'.
  *
- *	If 'now' is zero, then the current time will be used.
+ * \li	If 'now' is zero, then the current time will be used.
  *
  * Requires:
  *
- *	'db' is a valid database with cache semantics.
+ * \li	'db' is a valid database with cache semantics.
  *
- *	'nodep' is NULL, or nodep is a valid pointer and *nodep == NULL.
+ * \li	'nodep' is NULL, or nodep is a valid pointer and *nodep == NULL.
  *
- *	'foundname' is a valid name with a dedicated buffer.
+ * \li	'foundname' is a valid name with a dedicated buffer.
  *
- *	'rdataset' is NULL, or is a valid unassociated rdataset.
+ * \li	'rdataset' is NULL, or is a valid unassociated rdataset.
  *
- * Ensures:
- *	On a non-error completion:
+ * Ensures, on a non-error completion:
  *
- *		If nodep != NULL, then it is bound to the found node.
+ * \li	If nodep != NULL, then it is bound to the found node.
  *
- *		If foundname != NULL, then it contains the full name of the
- *		found node.
+ * \li	If foundname != NULL, then it contains the full name of the
+ *	found node.
  *
- *		If rdataset != NULL and type != dns_rdatatype_any, then
- *		rdataset is bound to the found rdataset.
+ * \li	If rdataset != NULL and type != dns_rdatatype_any, then
+ *	rdataset is bound to the found rdataset.
  *
- * Returns:
+ * Non-error results are:
  *
- *	Non-error results are:
- *
- *		ISC_R_SUCCESS
+ * \li	#ISC_R_SUCCESS
  *
- *		ISC_R_NOTFOUND
+ * \li	#ISC_R_NOTFOUND
  *
- *		Other results are possible, and should all be treated as
- *		errors.
+ * \li	Other results are possible, and should all be treated as
+ *	errors.
  */
 
 void
 dns_db_attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp);
-/*
+/*%<
  * Attach *targetp to source.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'source' is a valid node.
+ * \li	'source' is a valid node.
  *
- *	'targetp' points to a NULL dns_node_t *.
+ * \li	'targetp' points to a NULL dns_node_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to source.
+ * \li	*targetp is attached to source.
  */
 
 void
 dns_db_detachnode(dns_db_t *db, dns_dbnode_t **nodep);
-/*
+/*%<
  * Detach *nodep from its node.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'nodep' points to a valid node.
+ * \li	'nodep' points to a valid node.
  *
  * Ensures:
  *
- *	*nodep is NULL.
+ * \li	*nodep is NULL.
  */
 
 isc_result_t
 dns_db_expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now);
-/*
+/*%<
  * Mark as stale all records at 'node' which expire at or before 'now'.
  *
  * Note: if 'now' is zero, then the current time will be used.
  *
  * Requires:
  *
- *	'db' is a valid cache database.
+ * \li	'db' is a valid cache database.
  *
- *	'node' is a valid node.
+ * \li	'node' is a valid node.
  */
 
 void
 dns_db_printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out);
-/*
+/*%<
  * Print a textual representation of the contents of the node to
  * 'out'.
  *
@@ -899,9 +907,9 @@ dns_db_printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out);
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'node' is a valid node.
+ * \li	'node' is a valid node.
  */
 
 /***
@@ -911,29 +919,29 @@ dns_db_printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out);
 isc_result_t
 dns_db_createiterator(dns_db_t *db, isc_boolean_t relative_names,
 		      dns_dbiterator_t **iteratorp);
-/*
+/*%<
  * Create an iterator for version 'version' of 'db'.
  *
  * Notes:
  *
- *	If 'relative_names' is ISC_TRUE, then node names returned by the
+ * \li	If 'relative_names' is ISC_TRUE, then node names returned by the
  *	iterator will be relative to the iterator's current origin.  If
- *	ISC_FALSE, then the node names will be absolute.
+ *	#ISC_FALSE, then the node names will be absolute.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	iteratorp != NULL && *iteratorp == NULL
+ * \li	iteratorp != NULL && *iteratorp == NULL
  *
  * Ensures:
  *
- *	On success, *iteratorp will be a valid database iterator.
+ * \li	On success, *iteratorp will be a valid database iterator.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  */
 
 /***
@@ -949,62 +957,62 @@ dns_db_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		    dns_rdatatype_t type, dns_rdatatype_t covers,
 		    isc_stdtime_t now, dns_rdataset_t *rdataset,
 		    dns_rdataset_t *sigrdataset);
-/*
+/*%<
  * Search for an rdataset of type 'type' at 'node' that are in version
  * 'version' of 'db'.  If found, make 'rdataset' refer to it.
  *
  * Notes:
  *
- *	If 'version' is NULL, then the current version will be used.
+ * \li	If 'version' is NULL, then the current version will be used.
  *
- *	Care must be used when using this routine to build a DNS response:
+ * \li	Care must be used when using this routine to build a DNS response:
  *	'node' should have been found with dns_db_find(), not
  *	dns_db_findnode().  No glue checking is done.  No checking for
  *	pending data is done.
  *
- *	The 'now' field is ignored if 'db' is a zone database.  If 'db' is a
+ * \li	The 'now' field is ignored if 'db' is a zone database.  If 'db' is a
  *	cache database, an rdataset will not be found unless it expires after
  *	'now'.  If 'now' is zero, then the current time will be used.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'node' is a valid node.
+ * \li	'node' is a valid node.
  *
- *	'rdataset' is a valid, disassociated rdataset.
+ * \li	'rdataset' is a valid, disassociated rdataset.
  *
- *	'sigrdataset' is a valid, disassociated rdataset, or it is NULL.
+ * \li	'sigrdataset' is a valid, disassociated rdataset, or it is NULL.
  *
- *	If 'covers' != 0, 'type' must be SIG.
+ * \li	If 'covers' != 0, 'type' must be SIG.
  *
- *	'type' is not a meta-RR type such as 'ANY' or 'OPT'.
+ * \li	'type' is not a meta-RR type such as 'ANY' or 'OPT'.
  *
  * Ensures:
  *
- *	On success, 'rdataset' is associated with the found rdataset.
+ * \li	On success, 'rdataset' is associated with the found rdataset.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used.
  */
 
 isc_result_t
 dns_db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		    isc_stdtime_t now, dns_rdatasetiter_t **iteratorp);
-/*
+/*%<
  * Make '*iteratorp' an rdataset iteratator for all rdatasets at 'node' in
  * version 'version' of 'db'.
  *
  * Notes:
  *
- *	If 'version' is NULL, then the current version will be used.
+ * \li	If 'version' is NULL, then the current version will be used.
  *
- *	The 'now' field is ignored if 'db' is a zone database.  If 'db' is a
+ * \li	The 'now' field is ignored if 'db' is a zone database.  If 'db' is a
  *	cache database, an rdataset will not be found unless it expires after
  *	'now'.  Any ANY query will not match unless at least one rdataset at
  *	the node expires after 'now'.  If 'now' is zero, then the current time
@@ -1012,22 +1020,22 @@ dns_db_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'node' is a valid node.
+ * \li	'node' is a valid node.
  *
- *	iteratorp != NULL && *iteratorp == NULL
+ * \li	iteratorp != NULL && *iteratorp == NULL
  *
  * Ensures:
  *
- *	On success, '*iteratorp' is a valid rdataset iterator.
+ * \li	On success, '*iteratorp' is a valid rdataset iterator.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used.
  */
 
@@ -1035,58 +1043,58 @@ isc_result_t
 dns_db_addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		   isc_stdtime_t now, dns_rdataset_t *rdataset,
 		   unsigned int options, dns_rdataset_t *addedrdataset);
-/*
+/*%<
  * Add 'rdataset' to 'node' in version 'version' of 'db'.
  *
  * Notes:
  *
- *	If the database has zone semantics, the DNS_DBADD_MERGE option is set,
+ * \li	If the database has zone semantics, the #DNS_DBADD_MERGE option is set,
  *	and an rdataset of the same type as 'rdataset' already exists at
  *	'node' then the contents of 'rdataset' will be merged with the existing
  *	rdataset.  If the option is not set, then rdataset will replace any
  *	existing rdataset of the same type.  If not merging and the
- *	DNS_DBADD_FORCE option is set, then the data will update the database
+ *	#DNS_DBADD_FORCE option is set, then the data will update the database
  *	without regard to trust levels.  If not forcing the data, then the
  *	rdataset will only be added if its trust level is >= the trust level of
  *	any existing rdataset.  Forcing is only meaningful for cache databases.
- *	If DNS_DBADD_EXACT is set then there must be no rdata in common between
- *	the old and new rdata sets.  If DNS_DBADD_EXACTTTL is set then both
+ *	If #DNS_DBADD_EXACT is set then there must be no rdata in common between
+ *	the old and new rdata sets.  If #DNS_DBADD_EXACTTTL is set then both
  *	the old and new rdata sets must have the same ttl.
  *
- *	The 'now' field is ignored if 'db' is a zone database.  If 'db' is
+ * \li	The 'now' field is ignored if 'db' is a zone database.  If 'db' is
  *	a cache database, then the added rdataset will expire no later than
  *	now + rdataset->ttl.
  *
- *	If 'addedrdataset' is not NULL, then it will be attached to the
+ * \li	If 'addedrdataset' is not NULL, then it will be attached to the
  *	resulting new rdataset in the database, or to the existing data if
  *	the existing data was better.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'node' is a valid node.
+ * \li	'node' is a valid node.
  *
- *	'rdataset' is a valid, associated rdataset with the same class
+ * \li	'rdataset' is a valid, associated rdataset with the same class
  *	as 'db'.
  *
- *	'addedrdataset' is NULL, or a valid, unassociated rdataset.
+ * \li	'addedrdataset' is NULL, or a valid, unassociated rdataset.
  *
- *	The database has zone semantics and 'version' is a valid
+ * \li	The database has zone semantics and 'version' is a valid
  *	read-write version, or the database has cache semantics
  *	and version is NULL.
  *
- *	If the database has cache semantics, the DNS_DBADD_MERGE option must
+ * \li	If the database has cache semantics, the #DNS_DBADD_MERGE option must
  *	not be set.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	DNS_R_UNCHANGED			The operation did not change anything.
- *	ISC_R_NOMEMORY
- *	DNS_R_NOTEXACT
+ * \li	#ISC_R_SUCCESS
+ * \li	#DNS_R_UNCHANGED			The operation did not change anything.
+ * \li	#ISC_R_NOMEMORY
+ * \li	#DNS_R_NOTEXACT
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used.
  */
 
@@ -1094,41 +1102,41 @@ isc_result_t
 dns_db_subtractrdataset(dns_db_t *db, dns_dbnode_t *node,
 			dns_dbversion_t *version, dns_rdataset_t *rdataset,
 			unsigned int options, dns_rdataset_t *newrdataset);
-/*
+/*%<
  * Remove any rdata in 'rdataset' from 'node' in version 'version' of
  * 'db'.
  *
  * Notes:
  *
- *	If 'newrdataset' is not NULL, then it will be attached to the
+ * \li	If 'newrdataset' is not NULL, then it will be attached to the
  *	resulting new rdataset in the database, unless the rdataset has
  *	become nonexistent.  If DNS_DBSUB_EXACT is set then all elements
  *	of 'rdataset' must exist at 'node'.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'node' is a valid node.
+ * \li	'node' is a valid node.
  *
- *	'rdataset' is a valid, associated rdataset with the same class
+ * \li	'rdataset' is a valid, associated rdataset with the same class
  *	as 'db'.
  *
- *	'newrdataset' is NULL, or a valid, unassociated rdataset.
+ * \li	'newrdataset' is NULL, or a valid, unassociated rdataset.
  *
- *	The database has zone semantics and 'version' is a valid
+ * \li	The database has zone semantics and 'version' is a valid
  *	read-write version.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	DNS_R_UNCHANGED			The operation did not change anything.
- *	DNS_R_NXRRSET			All rdata of the same type as those
+ * \li	#ISC_R_SUCCESS
+ * \li	#DNS_R_UNCHANGED			The operation did not change anything.
+ * \li	#DNS_R_NXRRSET			All rdata of the same type as those
  *					in 'rdataset' have been deleted.
- *	DNS_R_NOTEXACT			Some part of 'rdataset' did not
+ * \li	#DNS_R_NOTEXACT			Some part of 'rdataset' did not
  *					exist and DNS_DBSUB_EXACT was set.
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used.
  */
 
@@ -1136,134 +1144,154 @@ isc_result_t
 dns_db_deleterdataset(dns_db_t *db, dns_dbnode_t *node,
 		      dns_dbversion_t *version, dns_rdatatype_t type,
 		      dns_rdatatype_t covers);
-/*
+/*%<
  * Make it so that no rdataset of type 'type' exists at 'node' in version
  * version 'version' of 'db'.
  *
  * Notes:
  *
- *	If 'type' is dns_rdatatype_any, then no rdatasets will exist in
+ * \li	If 'type' is dns_rdatatype_any, then no rdatasets will exist in
  *	'version' (provided that the dns_db_deleterdataset() isn't followed
  *	by one or more dns_db_addrdataset() calls).
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
- *	'node' is a valid node.
+ * \li	'node' is a valid node.
  *
- *	The database has zone semantics and 'version' is a valid
+ * \li	The database has zone semantics and 'version' is a valid
  *	read-write version, or the database has cache semantics
  *	and version is NULL.
  *
- *	'type' is not a meta-RR type, except for dns_rdatatype_any, which is
+ * \li	'type' is not a meta-RR type, except for dns_rdatatype_any, which is
  *	allowed.
  *
- *	If 'covers' != 0, 'type' must be SIG.
+ * \li	If 'covers' != 0, 'type' must be SIG.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	DNS_R_UNCHANGED			No rdatasets of 'type' existed before
+ * \li	#ISC_R_SUCCESS
+ * \li	#DNS_R_UNCHANGED			No rdatasets of 'type' existed before
  *					the operation was attempted.
  *
- *	Other results are possible, depending upon the database
+ * \li	Other results are possible, depending upon the database
  *	implementation used.
  */
 
 isc_result_t
 dns_db_getsoaserial(dns_db_t *db, dns_dbversion_t *ver, isc_uint32_t *serialp);
-/*
+/*%<
  * Get the current SOA serial number from a zone database.
  *
  * Requires:
- *      'db' is a valid database with zone semantics.
- *      'ver' is a valid version.
+ * \li	'db' is a valid database with zone semantics.
+ * \li	'ver' is a valid version.
  */
 
 void
 dns_db_overmem(dns_db_t *db, isc_boolean_t overmem);
-/*
+/*%<
  * Enable / disable agressive cache cleaning.
  */
 
 unsigned int
 dns_db_nodecount(dns_db_t *db);
-/*
+/*%<
  * Count the number of nodes in 'db'.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
  * Returns:
- * 	The number of nodes in the database
+ * \li	The number of nodes in the database
  */
 
 void
 dns_db_settask(dns_db_t *db, isc_task_t *task);
-/*
+/*%<
  * If task is set then the final detach maybe performed asynchronously.
  *
  * Requires:
- *	'db' is a valid database.
- *	'task' to be valid or NULL.
+ * \li	'db' is a valid database.
+ * \li	'task' to be valid or NULL.
  */
 
 isc_boolean_t
 dns_db_ispersistent(dns_db_t *db);
-/*
+/*%<
  * Is 'db' persistent?  A persistent database does not need to be loaded
  * from disk or written to disk.
  *
  * Requires:
  *
- *	'db' is a valid database.
+ * \li	'db' is a valid database.
  *
  * Returns:
- *	ISC_TRUE	'db' is persistent.
- *	ISC_FALSE	'db' is not persistent.
+ * \li	#ISC_TRUE	'db' is persistent.
+ * \li	#ISC_FALSE	'db' is not persistent.
  */
 
 isc_result_t
 dns_db_register(const char *name, dns_dbcreatefunc_t create, void *driverarg,
 		isc_mem_t *mctx, dns_dbimplementation_t **dbimp);
 
-/*
+/*%<
  * Register a new database implementation and add it to the list of
  * supported implementations.
  *
  * Requires:
  *
- * 	'name' is not NULL
- * 	'order' is a valid function pointer
- * 	'mctx' is a valid memory context
- * 	dbimp != NULL && *dbimp == NULL
+ * \li 	'name' is not NULL
+ * \li	'order' is a valid function pointer
+ * \li	'mctx' is a valid memory context
+ * \li	dbimp != NULL && *dbimp == NULL
  *
  * Returns:
- * 	ISC_R_SUCCESS	The registration succeeded
- * 	ISC_R_NOMEMORY	Out of memory
- * 	ISC_R_EXISTS	A database implementation with the same name exists
+ * \li	#ISC_R_SUCCESS	The registration succeeded
+ * \li	#ISC_R_NOMEMORY	Out of memory
+ * \li	#ISC_R_EXISTS	A database implementation with the same name exists
  *
  * Ensures:
  *
- *	*dbimp points to an opaque structure which must be passed to
+ * \li	*dbimp points to an opaque structure which must be passed to
  *	dns_db_unregister().
  */
 
 void
 dns_db_unregister(dns_dbimplementation_t **dbimp);
-/*
+/*%<
  * Remove a database implementation from the the list of supported
  * implementations.  No databases of this type can be active when this
  * is called.
  *
  * Requires:
- * 	dbimp != NULL && *dbimp == NULL
+ * \li 	dbimp != NULL && *dbimp == NULL
  *
  * Ensures:
  *
- * 	Any memory allocated in *dbimp will be freed.
+ * \li	Any memory allocated in *dbimp will be freed.
+ */
+
+isc_result_t
+dns_db_getoriginnode(dns_db_t *db, dns_dbnode_t **nodep);
+/*%<
+ * Get the origin DB node corresponding to the DB's zone.  This function
+ * should typically succeed unless the underlying DB implementation doesn't
+ * support the feature.
+ *
+ * Requires:
+ *
+ * \li	'db' is a valid zone database.
+ * \li	'nodep' != NULL && '*nodep' == NULL
+ *
+ * Ensures:
+ * \li	On success, '*nodep' will point to the DB node of the zone's origin.
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND - the DB implementation does not support this feature.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/dbiterator.h b/contrib/bind9/lib/dns/include/dns/dbiterator.h
index 8b8cb1b..47ce082 100644
--- a/contrib/bind9/lib/dns/include/dns/dbiterator.h
+++ b/contrib/bind9/lib/dns/include/dns/dbiterator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dbiterator.h,v 1.18.206.1 2004/03/06 08:13:54 marka Exp $ */
+/* $Id: dbiterator.h,v 1.19.18.2 2005/04/29 00:16:11 marka Exp $ */
 
 #ifndef DNS_DBITERATOR_H
 #define DNS_DBITERATOR_H 1
@@ -24,9 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * DNS DB Iterator
- *
+/*! \file
+ * \brief
  * The DNS DB Iterator interface allows iteration of all of the nodes in a
  * database.
  *
@@ -37,25 +36,25 @@
  * It is the client's responsibility to call dns_db_detachnode() on all
  * nodes returned.
  *
- * XXX <more> XXX
+ * XXX &lt;more&gt; XXX
  *
  * MP:
- *	The iterator itself is not locked.  The caller must ensure
+ *\li	The iterator itself is not locked.  The caller must ensure
  *	synchronization.
  *
- *	The iterator methods ensure appropriate database locking.
+ *\li	The iterator methods ensure appropriate database locking.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 /*****
@@ -89,7 +88,7 @@ typedef struct dns_dbiteratormethods {
 
 #define DNS_DBITERATOR_MAGIC	     ISC_MAGIC('D','N','S','I')
 #define DNS_DBITERATOR_VALID(dbi)    ISC_MAGIC_VALID(dbi, DNS_DBITERATOR_MAGIC)
-/*
+/*%
  * This structure is actually just the common prefix of a DNS db
  * implementation's version of a dns_dbiterator_t.
  *
@@ -110,136 +109,136 @@ struct dns_dbiterator {
 
 void
 dns_dbiterator_destroy(dns_dbiterator_t **iteratorp);
-/*
+/*%<
  * Destroy '*iteratorp'.
  *
  * Requires:
  *
- *	'*iteratorp' is a valid iterator.
+ *\li	'*iteratorp' is a valid iterator.
  *
  * Ensures:
  *
- *	All resources used by the iterator are freed.
+ *\li	All resources used by the iterator are freed.
  *
- *	*iteratorp == NULL.
+ *\li	*iteratorp == NULL.
  */
 
 isc_result_t
 dns_dbiterator_first(dns_dbiterator_t *iterator);
-/*
+/*%<
  * Move the node cursor to the first node in the database (if any).
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no nodes in the database.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE			There are no nodes in the database.
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_dbiterator_last(dns_dbiterator_t *iterator);
-/*
+/*%<
  * Move the node cursor to the last node in the database (if any).
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no nodes in the database.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE			There are no nodes in the database.
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name);
-/*
+/*%<
  * Move the node cursor to the node with name 'name'.
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOTFOUND
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_dbiterator_prev(dns_dbiterator_t *iterator);
-/*
+/*%<
  * Move the node cursor to the previous node in the database (if any).
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no more nodes in the
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE			There are no more nodes in the
  *					database.
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_dbiterator_next(dns_dbiterator_t *iterator);
-/*
+/*%<
  * Move the node cursor to the next node in the database (if any).
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no more nodes in the
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE			There are no more nodes in the
  *					database.
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
 		       dns_name_t *name);
-/*
+/*%<
  * Return the current node.
  *
  * Notes:
- *	If 'name' is not NULL, it will be set to the name of the node.
+ *\li	If 'name' is not NULL, it will be set to the name of the node.
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
- *	nodep != NULL && *nodep == NULL
+ *\li	nodep != NULL && *nodep == NULL
  *
- *	The node cursor of 'iterator' is at a valid location (i.e. the
+ *\li	The node cursor of 'iterator' is at a valid location (i.e. the
  *	result of last call to a cursor movement command was ISC_R_SUCCESS).
  *
- *	'name' is NULL, or is a valid name with a dedicated buffer.
+ *\li	'name' is NULL, or is a valid name with a dedicated buffer.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	DNS_R_NEWORIGIN			If this iterator was created with
+ *\li	#ISC_R_SUCCESS
+ *\li	#DNS_R_NEWORIGIN			If this iterator was created with
  *					'relative_names' set to ISC_TRUE,
- *					then DNS_R_NEWORIGIN will be returned
+ *					then #DNS_R_NEWORIGIN will be returned
  *					when the origin the names are
  *					relative to changes.  This result
  *					can occur only when 'name' is not
  *					NULL.  This is also a successful
  *					result.
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_dbiterator_pause(dns_dbiterator_t *iterator);
-/*
+/*%<
  * Pause iteration.
  *
  * Calling a cursor movement method or dns_dbiterator_current() may cause
@@ -250,47 +249,47 @@ dns_dbiterator_pause(dns_dbiterator_t *iterator);
  * iterator method in the immediate future.
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
  * Ensures:
- *	Any database locks being held for efficiency of iterator access are
+ *\li	Any database locks being held for efficiency of iterator access are
  *	released.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name);
-/*
+/*%<
  * Return the origin to which returned node names are relative.
  *
  * Requires:
  *
- *	'iterator' is a valid relative_names iterator.
+ *\li	'iterator' is a valid relative_names iterator.
  *
- *	'name' is a valid name with a dedicated buffer.
+ *\li	'name' is a valid name with a dedicated buffer.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 void
 dns_dbiterator_setcleanmode(dns_dbiterator_t *iterator, isc_boolean_t mode);
-/*
+/*%<
  * Indicate that the given iterator is/is not cleaning the DB.
  *
  * Notes:
- *	When 'mode' is ISC_TRUE, 
+ *\li	When 'mode' is ISC_TRUE, 
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/dbtable.h b/contrib/bind9/lib/dns/include/dns/dbtable.h
index 3874b46..18d3e50 100644
--- a/contrib/bind9/lib/dns/include/dns/dbtable.h
+++ b/contrib/bind9/lib/dns/include/dns/dbtable.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dbtable.h,v 1.16.206.1 2004/03/06 08:13:55 marka Exp $ */
+/* $Id: dbtable.h,v 1.17.18.2 2005/04/29 00:16:11 marka Exp $ */
 
 #ifndef DNS_DBTABLE_H
 #define DNS_DBTABLE_H 1
@@ -24,26 +24,27 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * DNS DB Tables
  *
- * XXX <TBS> XXX
+ * XXX TBS XXX
  *
  * MP:
- *	The module ensures appropriate synchronization of data structures it
+ *\li	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	None.
+ *\li	None.
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 #include <isc/lang.h>
@@ -57,106 +58,106 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 dns_dbtable_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 		   dns_dbtable_t **dbtablep);
-/*
+/*%<
  * Make a new dbtable of class 'rdclass'
  *
  * Requires:
- *	mctx != NULL
- * 	dbtablep != NULL && *dptablep == NULL
- *	'rdclass' is a valid class
+ *\li	mctx != NULL
+ * \li	dbtablep != NULL && *dptablep == NULL
+ *\li	'rdclass' is a valid class
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
  */
 
 void
 dns_dbtable_attach(dns_dbtable_t *source, dns_dbtable_t **targetp);
-/*
+/*%<
  * Attach '*targetp' to 'source'.
  *
  * Requires:
  *
- *	'source' is a valid dbtable.
+ *\li	'source' is a valid dbtable.
  *
- *	'targetp' points to a NULL dns_dbtable_t *.
+ *\li	'targetp' points to a NULL dns_dbtable_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to source.
+ *\li	*targetp is attached to source.
  */
 
 void
 dns_dbtable_detach(dns_dbtable_t **dbtablep);
-/*
+/*%<
  * Detach *dbtablep from its dbtable.
  *
  * Requires:
  *
- *	'*dbtablep' points to a valid dbtable.
+ *\li	'*dbtablep' points to a valid dbtable.
  *
  * Ensures:
  *
- *	*dbtablep is NULL.
- *
- *	If '*dbtablep' is the last reference to the dbtable,
+ *\li	*dbtablep is NULL.
  *
- *		All resources used by the dbtable will be freed
+ *\li	If '*dbtablep' is the last reference to the dbtable,
+ *		all resources used by the dbtable will be freed
  */
 
 isc_result_t
 dns_dbtable_add(dns_dbtable_t *dbtable, dns_db_t *db);
-/*
+/*%<
  * Add 'db' to 'dbtable'.
  *
  * Requires:
- *	'dbtable' is a valid dbtable.
+ *\li	'dbtable' is a valid dbtable.
  *
- *	'db' is a valid database with the same class as 'dbtable'
+ *\li	'db' is a valid database with the same class as 'dbtable'
  */
 
 void
 dns_dbtable_remove(dns_dbtable_t *dbtable, dns_db_t *db);
-/*
+/*%<
  * Remove 'db' from 'dbtable'.
  *
  * Requires:
- *	'db' was previously added to 'dbtable'.
+ *\li	'db' was previously added to 'dbtable'.
  */
 
 void
 dns_dbtable_adddefault(dns_dbtable_t *dbtable, dns_db_t *db);
-/*
+/*%<
  * Use 'db' as the result of a dns_dbtable_find() if no better match is
  * available.
  */
 
 void
 dns_dbtable_getdefault(dns_dbtable_t *dbtable, dns_db_t **db);
-/*
+/*%<
  * Get the 'db' used as the result of a dns_dbtable_find()
  * if no better match is available.
  */
 
 void
 dns_dbtable_removedefault(dns_dbtable_t *dbtable);
-/*
+/*%<
  * Remove the default db from 'dbtable'.
  */
 
 isc_result_t
 dns_dbtable_find(dns_dbtable_t *dbtable, dns_name_t *name,
 		 unsigned int options, dns_db_t **dbp);
-/*
+/*%<
  * Find the deepest match to 'name' in the dbtable, and return it
  *
  * Notes:
- *	If the DNS_DBTABLEFIND_NOEXACT option is set, the best partial
+ *\li	If the DNS_DBTABLEFIND_NOEXACT option is set, the best partial
  *	match (if any) to 'name' will be returned.
  *
- * Returns:  ISC_R_SUCCESS		on success
- *	     <something else>		no default and match
+ * Returns:  
+ * \li #ISC_R_SUCCESS		on success
+ *\li	     something else:		no default and match
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/diff.h b/contrib/bind9/lib/dns/include/dns/diff.h
index 604f702..cd96a0b 100644
--- a/contrib/bind9/lib/dns/include/dns/diff.h
+++ b/contrib/bind9/lib/dns/include/dns/diff.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: diff.h,v 1.4.12.3 2004/03/08 09:04:35 marka Exp $ */
+/* $Id: diff.h,v 1.6.18.2 2005/04/29 00:16:12 marka Exp $ */
 
 #ifndef DNS_DIFF_H
 #define DNS_DIFF_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * A diff is a convenience type representing a list of changes to be
  * made to a database.
  */
@@ -44,7 +45,7 @@
  *** Types
  ***/
 
-/*
+/*%
  * A dns_difftuple_t represents a single RR being added or deleted.
  * The RR type and class are in the 'rdata' member; the class is always
  * the real one, not a DynDNS meta-class, so that the rdatas can be
@@ -61,9 +62,9 @@
  */
 
 typedef enum {
-	DNS_DIFFOP_ADD,	        /* Add an RR. */
-	DNS_DIFFOP_DEL,		/* Delete an RR. */
-	DNS_DIFFOP_EXISTS	/* Assert RR existence. */
+	DNS_DIFFOP_ADD,	        /*%< Add an RR. */
+	DNS_DIFFOP_DEL,		/*%< Delete an RR. */
+	DNS_DIFFOP_EXISTS	/*%< Assert RR existence. */
 } dns_diffop_t;
 
 typedef struct dns_difftuple dns_difftuple_t;
@@ -82,7 +83,7 @@ struct dns_difftuple {
 	/* Variable-size name data and rdata follows. */
 };
 
-/*
+/*%
  * A dns_diff_t represents a set of changes being applied to
  * a zone.  Diffs are also used to represent "RRset exists
  * (value dependent)" prerequisites.
@@ -116,106 +117,106 @@ isc_result_t
 dns_difftuple_create(isc_mem_t *mctx,
 		     dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl,
 		     dns_rdata_t *rdata, dns_difftuple_t **tp);
-/*
+/*%<
  * Create a tuple.  Deep copies are made of the name and rdata, so
  * they need not remain valid after the call.
  *
  * Requires:
- *	*tp != NULL && *tp == NULL.
+ *\li	*tp != NULL && *tp == NULL.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *      ISC_R_NOMEMORY
+ *\li	ISC_R_SUCCESS
+ *  \li    ISC_R_NOMEMORY
  */
 
 void
 dns_difftuple_free(dns_difftuple_t **tp);
-/*
+/*%<
  * Free a tuple.
  *
  * Requires:
- *       **tp is a valid tuple.
+ *    \li   **tp is a valid tuple.
  *
  * Ensures:
- *       *tp == NULL
- *       All memory used by the tuple is freed.
+ *     \li  *tp == NULL
+ *      \li All memory used by the tuple is freed.
  */
 
 isc_result_t
 dns_difftuple_copy(dns_difftuple_t *orig, dns_difftuple_t **copyp);
-/*
+/*%<
  * Copy a tuple.
  *
  * Requires:
- * 	'orig' points to a valid tuple
- *	copyp != NULL && *copyp == NULL
+ * \li	'orig' points to a valid tuple
+ *\li	copyp != NULL && *copyp == NULL
  */
 
 void
 dns_diff_init(isc_mem_t *mctx, dns_diff_t *diff);
-/*
+/*%<
  * Initialize a diff.
  *
  * Requires:
- *    'diff' points to an uninitialized dns_diff_t
- *    allocated by the caller.
+ * \li   'diff' points to an uninitialized dns_diff_t
+ *  \li  allocated by the caller.
  *
  * Ensures:
- *    '*diff' is a valid, empty diff.
+ * \li   '*diff' is a valid, empty diff.
  */
 
 void
 dns_diff_clear(dns_diff_t *diff);
-/*
+/*%<
  * Clear a diff, destroying all its tuples.
  *
  * Requires:
- *    'diff' points to a valid dns_diff_t.
+ * \li   'diff' points to a valid dns_diff_t.
  *
  * Ensures:
- *     Any tuples in the diff are destroyed.
+ * \li    Any tuples in the diff are destroyed.
  *     The diff now empty, but it is still valid
  *     and may be reused without calling dns_diff_init
  *     again.  The only memory used is that of the
  *     dns_diff_t structure itself.
  *
  * Notes:
- *     Managing the memory of the dns_diff_t structure itself
+ * \li    Managing the memory of the dns_diff_t structure itself
  *     is the caller's responsibility.
  */
 
 void
 dns_diff_append(dns_diff_t *diff, dns_difftuple_t **tuple);
-/*
+/*%<
  * Append a single tuple to a diff.
  *
- *	'diff' is a valid diff.
- * 	'*tuple' is a valid tuple.
+ *\li	'diff' is a valid diff.
+ * \li	'*tuple' is a valid tuple.
  *
  * Ensures:
- *	*tuple is NULL.
- *	The tuple has been freed, or will be freed when the diff is cleared.
+ *\li	*tuple is NULL.
+ *\li	The tuple has been freed, or will be freed when the diff is cleared.
  */
 
 void
 dns_diff_appendminimal(dns_diff_t *diff, dns_difftuple_t **tuple);
-/*
+/*%<
  * Append 'tuple' to 'diff', removing any duplicate
  * or conflicting updates as needed to create a minimal diff.
  *
  * Requires:
- *	'diff' is a minimal diff.
+ *\li	'diff' is a minimal diff.
  *
  * Ensures:
- *	'diff' is still a minimal diff.
- *   	*tuple is NULL.
- *   	The tuple has been freed, or will be freed when the diff is cleared.
+ *\li	'diff' is still a minimal diff.
+ *  \li 	*tuple is NULL.
+ *   \li	The tuple has been freed, or will be freed when the diff is cleared.
  *
  */
 
 isc_result_t
 dns_diff_sort(dns_diff_t *diff, dns_diff_compare_func *compare);
-/*
+/*%<
  * Sort 'diff' in-place according to the comparison function 'compare'.
  */
 
@@ -223,7 +224,7 @@ isc_result_t
 dns_diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver);
 isc_result_t
 dns_diff_applysilently(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver);
-/*
+/*%<
  * Apply 'diff' to the database 'db'.
  *
  * dns_diff_apply() logs warnings about updates with no effect or
@@ -234,44 +235,44 @@ dns_diff_applysilently(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver);
  * but less efficient.
  *
  * Requires:
- *	*diff is a valid diff (possibly empty), containing
- *   	tuples of type DNS_DIFFOP_ADD and/or
- *   	For DNS_DIFFOP_DEL tuples, the TTL is ignored.
+ *\li	*diff is a valid diff (possibly empty), containing
+ *   	tuples of type #DNS_DIFFOP_ADD and/or
+ *  	For #DNS_DIFFOP_DEL tuples, the TTL is ignored.
  *
  */
 
 isc_result_t
 dns_diff_load(dns_diff_t *diff, dns_addrdatasetfunc_t addfunc,
 	      void *add_private);
-/*
+/*%<
  * Like dns_diff_apply, but for use when loading a new database
  * instead of modifying an existing one.  This bypasses the
  * database transaction mechanisms.
  *
  * Requires:
- * 	'addfunc' is a valid dns_addradatasetfunc_t obtained from
+ *\li 	'addfunc' is a valid dns_addradatasetfunc_t obtained from
  * 	dns_db_beginload()
  *
- *	'add_private' points to a corresponding dns_dbload_t *
+ *\li	'add_private' points to a corresponding dns_dbload_t *
  *      (XXX why is it a void pointer, then?)
  */
 
 isc_result_t
 dns_diff_print(dns_diff_t *diff, FILE *file);
 
-/*
+/*%<
  * Print the differences to 'file' or if 'file' is NULL via the
  * logging system.
  *
  * Require:
- *	'diff' to be valid.
- *	'file' to refer to a open file or NULL.
+ *\li	'diff' to be valid.
+ *\li	'file' to refer to a open file or NULL.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
- *	any error from dns_rdataset_totext()
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
+ *\li	any error from dns_rdataset_totext()
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/dispatch.h b/contrib/bind9/lib/dns/include/dns/dispatch.h
index 201a65a..47f6b20 100644
--- a/contrib/bind9/lib/dns/include/dns/dispatch.h
+++ b/contrib/bind9/lib/dns/include/dns/dispatch.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.h,v 1.45.2.2.4.2 2004/03/06 08:13:55 marka Exp $ */
+/* $Id: dispatch.h,v 1.48.18.2 2005/04/29 00:16:12 marka Exp $ */
 
 #ifndef DNS_DISPATCH_H
 #define DNS_DISPATCH_H 1
@@ -24,14 +24,14 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * DNS Dispatch Management
- *
  * 	Shared UDP and single-use TCP dispatches for queries and responses.
  *
  * MP:
  *
- *     	All locking is performed internally to each dispatch.
+ *\li     	All locking is performed internally to each dispatch.
  * 	Restrictions apply to dns_dispatch_removeresponse().
  *
  * Reliability:
@@ -40,12 +40,12 @@
  *
  * Security:
  *
- *	Depends on the isc_socket_t and dns_message_t for prevention of
+ *\li	Depends on the isc_socket_t and dns_message_t for prevention of
  *	buffer overruns.
  *
  * Standards:
  *
- *	None.
+ *\li	None.
  */
 
 /***
@@ -61,7 +61,7 @@
 
 ISC_LANG_BEGINDECLS
 
-/*
+/*%
  * This event is sent to a task when a response comes in.
  * No part of this structure should ever be modified by the caller,
  * other than parts of the buffer.  The holy parts of the buffer are
@@ -79,16 +79,17 @@ ISC_LANG_BEGINDECLS
  */
 
 struct dns_dispatchevent {
-	ISC_EVENT_COMMON(dns_dispatchevent_t);	/* standard event common */
-	isc_result_t		result;		/* result code */
-	isc_int32_t		id;		/* message id */
-	isc_sockaddr_t		addr;		/* address recv'd from */
-	struct in6_pktinfo	pktinfo;	/* reply info for v6 */
-	isc_buffer_t	        buffer;		/* data buffer */
-	isc_uint32_t		attributes;	/* mirrored from socket.h */
+	ISC_EVENT_COMMON(dns_dispatchevent_t);	/*%< standard event common */
+	isc_result_t		result;		/*%< result code */
+	isc_int32_t		id;		/*%< message id */
+	isc_sockaddr_t		addr;		/*%< address recv'd from */
+	struct in6_pktinfo	pktinfo;	/*%< reply info for v6 */
+	isc_buffer_t	        buffer;		/*%< data buffer */
+	isc_uint32_t		attributes;	/*%< mirrored from socket.h */
 };
 
-/*
+/*@{*/
+/*%
  * Attributes for added dispatchers.
  *
  * Values with the mask 0xffff0000 are application defined.
@@ -121,83 +122,84 @@ struct dns_dispatchevent {
 #define DNS_DISPATCHATTR_NOLISTEN	0x00000020U
 #define DNS_DISPATCHATTR_MAKEQUERY	0x00000040U
 #define DNS_DISPATCHATTR_CONNECTED	0x00000080U
+/*@}*/
 
 isc_result_t
 dns_dispatchmgr_create(isc_mem_t *mctx, isc_entropy_t *entropy,
 		       dns_dispatchmgr_t **mgrp);
-/*
+/*%<
  * Creates a new dispatchmgr object.
  *
  * Requires:
- *	"mctx" be a valid memory context.
+ *\li	"mctx" be a valid memory context.
  *
- *	mgrp != NULL && *mgrp == NULL
+ *\li	mgrp != NULL && *mgrp == NULL
  *
- *	"entropy" may be NULL, in which case an insecure random generator
+ *\li	"entropy" may be NULL, in which case an insecure random generator
  *	will be used.  If it is non-NULL, it must be a valid entropy
  *	source.
  *
  * Returns:
- *	ISC_R_SUCCESS	-- all ok
+ *\li	ISC_R_SUCCESS	-- all ok
  *
- *	anything else	-- failure
+ *\li	anything else	-- failure
  */
 
 
 void
 dns_dispatchmgr_destroy(dns_dispatchmgr_t **mgrp);
-/*
+/*%<
  * Destroys the dispatchmgr when it becomes empty.  This could be
  * immediately.
  *
  * Requires:
- *	mgrp != NULL && *mgrp is a valid dispatchmgr.
+ *\li	mgrp != NULL && *mgrp is a valid dispatchmgr.
  */
 
 
 void
 dns_dispatchmgr_setblackhole(dns_dispatchmgr_t *mgr, dns_acl_t *blackhole);
-/*
+/*%<
  * Sets the dispatcher's "blackhole list," a list of addresses that will
  * be ignored by all dispatchers created by the dispatchmgr.
  *
  * Requires:
- * 	mgrp is a valid dispatchmgr
- * 	blackhole is a valid acl
+ * \li	mgrp is a valid dispatchmgr
+ * \li	blackhole is a valid acl
  */
 
 
 dns_acl_t *
 dns_dispatchmgr_getblackhole(dns_dispatchmgr_t *mgr);
-/*
+/*%<
  * Gets a pointer to the dispatcher's current blackhole list,
  * without incrementing its reference count.
  *
  * Requires:
- * 	mgr is a valid dispatchmgr
+ *\li 	mgr is a valid dispatchmgr
  * Returns:
- *	A pointer to the current blackhole list, or NULL.
+ *\li	A pointer to the current blackhole list, or NULL.
  */
 
 void
 dns_dispatchmgr_setblackportlist(dns_dispatchmgr_t *mgr,
                                  dns_portlist_t *portlist);
-/*
+/*%<
  * Sets a list of UDP ports that won't be used when creating a udp
  * dispatch with a wildcard port.
  *
  * Requires:
- *	mgr is a valid dispatchmgr
- *	portlist to be NULL or a valid port list.
+ *\li	mgr is a valid dispatchmgr
+ *\li	portlist to be NULL or a valid port list.
  */
 
 dns_portlist_t *
 dns_dispatchmgr_getblackportlist(dns_dispatchmgr_t *mgr);
-/*
+/*%<
  * Return the current port list.
  *
  * Requires:
- *	mgr is a valid dispatchmgr
+ *\li	mgr is a valid dispatchmgr
  */
 
 
@@ -210,29 +212,29 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		    unsigned int buckets, unsigned int increment,
 		    unsigned int attributes, unsigned int mask,
 		    dns_dispatch_t **dispp);
-/*
+/*%<
  * Attach to existing dns_dispatch_t if one is found with dns_dispatchmgr_find,
  * otherwise create a new UDP dispatch.
  *
  * Requires:
- *	All pointer parameters be valid for their respective types.
+ *\li	All pointer parameters be valid for their respective types.
  *
- *	dispp != NULL && *disp == NULL
+ *\li	dispp != NULL && *disp == NULL
  *
- *	512 <= buffersize <= 64k
+ *\li	512 <= buffersize <= 64k
  *
- *	maxbuffers > 0
+ *\li	maxbuffers > 0
  *
- *	buckets < 2097169
+ *\li	buckets < 2097169
  *
- *	increment > buckets
+ *\li	increment > buckets
  *
- *	(attributes & DNS_DISPATCHATTR_TCP) == 0
+ *\li	(attributes & DNS_DISPATCHATTR_TCP) == 0
  *
  * Returns:
- *	ISC_R_SUCCESS	-- success.
+ *\li	ISC_R_SUCCESS	-- success.
  *
- *	Anything else	-- failure.
+ *\li	Anything else	-- failure.
  */
 
 isc_result_t
@@ -241,7 +243,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 		       unsigned int maxbuffers, unsigned int maxrequests,
 		       unsigned int buckets, unsigned int increment,
 		       unsigned int attributes, dns_dispatch_t **dispp);
-/*
+/*%<
  * Create a new dns_dispatch and attach it to the provided isc_socket_t.
  *
  * For all dispatches, "buffersize" is the maximum packet size we will
@@ -258,65 +260,65 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
  *
  * Requires:
  *
- *	mgr is a valid dispatch manager.
+ *\li	mgr is a valid dispatch manager.
  *
- *	sock is a valid.
+ *\li	sock is a valid.
  *
- *	task is a valid task that can be used internally to this dispatcher.
+ *\li	task is a valid task that can be used internally to this dispatcher.
  *
- * 	512 <= buffersize <= 64k
+ * \li	512 <= buffersize <= 64k
  *
- *	maxbuffers > 0.
+ *\li	maxbuffers > 0.
  *
- *	maxrequests <= maxbuffers.
+ *\li	maxrequests <= maxbuffers.
  *
- *	buckets < 2097169 (the next prime after 65536 * 32)
+ *\li	buckets < 2097169 (the next prime after 65536 * 32)
  *
- *	increment > buckets (and prime).
+ *\li	increment > buckets (and prime).
  *
- *	attributes includes DNS_DISPATCHATTR_TCP and does not include
- *	DNS_DISPATCHATTR_UDP.
+ *\li	attributes includes #DNS_DISPATCHATTR_TCP and does not include
+ *	#DNS_DISPATCHATTR_UDP.
  *
  * Returns:
- *	ISC_R_SUCCESS	-- success.
+ *\li	ISC_R_SUCCESS	-- success.
  *
- *	Anything else	-- failure.
+ *\li	Anything else	-- failure.
  */
 
 void
 dns_dispatch_attach(dns_dispatch_t *disp, dns_dispatch_t **dispp);
-/*
+/*%<
  * Attach to a dispatch handle.
  *
  * Requires:
- *	disp is valid.
+ *\li	disp is valid.
  *
- *	dispp != NULL && *dispp == NULL
+ *\li	dispp != NULL && *dispp == NULL
  */
 
 void
 dns_dispatch_detach(dns_dispatch_t **dispp);
-/*
+/*%<
  * Detaches from the dispatch.
  *
  * Requires:
- *	dispp != NULL and *dispp be a valid dispatch.
+ *\li	dispp != NULL and *dispp be a valid dispatch.
  */
 
 void
 dns_dispatch_starttcp(dns_dispatch_t *disp);
-/*
+/*%<
  * Start processing of a TCP dispatch once the socket connects.
  *
  * Requires:
- *	'disp' is valid.
+ *\li	'disp' is valid.
  */
 
 isc_result_t
 dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 			 isc_task_t *task, isc_taskaction_t action, void *arg,
 			 isc_uint16_t *idp, dns_dispentry_t **resp);
-/*
+/*%<
  * Add a response entry for this dispatch.
  *
  * "*idp" is filled in with the assigned message ID, and *resp is filled in
@@ -327,24 +329,24 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
  * or through dns_dispatch_removeresponse() for another to be delivered.
  *
  * Requires:
- *	"idp" be non-NULL.
+ *\li	"idp" be non-NULL.
  *
- *	"task" "action" and "arg" be set as appropriate.
+ *\li	"task" "action" and "arg" be set as appropriate.
  *
- *	"dest" be non-NULL and valid.
+ *\li	"dest" be non-NULL and valid.
  *
- *	"resp" be non-NULL and *resp be NULL
+ *\li	"resp" be non-NULL and *resp be NULL
  *
  * Ensures:
  *
- *	<id, dest> is a unique tuple.  That means incoming messages
+ *\li	&lt;id, dest> is a unique tuple.  That means incoming messages
  *	are identifiable.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- all is well.
- *	ISC_R_NOMEMORY		-- memory could not be allocated.
- *	ISC_R_NOMORE		-- no more message ids can be allocated
+ *\li	ISC_R_SUCCESS		-- all is well.
+ *\li	ISC_R_NOMEMORY		-- memory could not be allocated.
+ *\li	ISC_R_NOMORE		-- no more message ids can be allocated
  *				   for this destination.
  */
 
@@ -352,88 +354,90 @@ dns_dispatch_addresponse(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 void
 dns_dispatch_removeresponse(dns_dispentry_t **resp,
 			    dns_dispatchevent_t **sockevent);
-/*
+/*%<
  * Stops the flow of responses for the provided id and destination.
  * If "sockevent" is non-NULL, the dispatch event and associated buffer is
  * also returned to the system.
  *
  * Requires:
- *	"resp" != NULL and "*resp" contain a value previously allocated
+ *\li	"resp" != NULL and "*resp" contain a value previously allocated
  *	by dns_dispatch_addresponse();
  *
- *	May only be called from within the task given as the 'task' 
+ *\li	May only be called from within the task given as the 'task' 
  * 	argument to dns_dispatch_addresponse() when allocating '*resp'.
  */
 
 
 isc_socket_t *
 dns_dispatch_getsocket(dns_dispatch_t *disp);
-/*
+/*%<
  * Return the socket associated with this dispatcher.
  *
  * Requires:
- *	disp is valid.
+ *\li	disp is valid.
  *
  * Returns:
- *	The socket the dispatcher is using.
+ *\li	The socket the dispatcher is using.
  */
 
 isc_result_t 
 dns_dispatch_getlocaladdress(dns_dispatch_t *disp, isc_sockaddr_t *addrp);
-/*
+/*%<
  * Return the local address for this dispatch.
  * This currently only works for dispatches using UDP sockets.
  *
  * Requires:
- *	disp is valid.
- *	addrp to be non null.
+ *\li	disp is valid.
+ *\li	addrp to be non null.
  *
  * Returns:
- *	ISC_R_SUCCESS	
- *	ISC_R_NOTIMPLEMENTED
+ *\li	ISC_R_SUCCESS	
+ *\li	ISC_R_NOTIMPLEMENTED
  */
 
 void
 dns_dispatch_cancel(dns_dispatch_t *disp);
-/*
+/*%<
  * cancel outstanding clients
  *
  * Requires:
- *	disp is valid.
+ *\li	disp is valid.
  */
 
 void
 dns_dispatch_changeattributes(dns_dispatch_t *disp,
 			      unsigned int attributes, unsigned int mask);
-/*
+/*%<
  * Set the bits described by "mask" to the corresponding values in
  * "attributes".
  *
  * That is:
  *
+ * \code
  *	new = (old & ~mask) | (attributes & mask)
+ * \endcode
  *
- * This function has a side effect when DNS_DISPATCHATTR_NOLISTEN changes. 
+ * This function has a side effect when #DNS_DISPATCHATTR_NOLISTEN changes. 
  * When the flag becomes off, the dispatch will start receiving on the
  * corresponding socket.  When the flag becomes on, receive events on the
  * corresponding socket will be canceled.
  *
  * Requires:
- *	disp is valid.
+ *\li	disp is valid.
  *
- *	attributes are reasonable for the dispatch.  That is, setting the UDP
+ *\li	attributes are reasonable for the dispatch.  That is, setting the UDP
  *	attribute on a TCP socket isn't reasonable.
  */
 
 void
 dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event);
-/*
+/*%<
  * Inform the dispatcher of a socket receive.  This is used for sockets
  * shared between dispatchers and clients.  If the dispatcher fails to copy
  * or send the event, nothing happens.
  *
  * Requires:
- * 	disp is valid, and the attribute DNS_DISPATCHATTR_NOLISTEN is set.
+ *\li 	disp is valid, and the attribute DNS_DISPATCHATTR_NOLISTEN is set.
  * 	event != NULL
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/dlz.h b/contrib/bind9/lib/dns/include/dns/dlz.h
new file mode 100644
index 0000000..4c61c91
--- /dev/null
+++ b/contrib/bind9/lib/dns/include/dns/dlz.h
@@ -0,0 +1,290 @@
+/*
+ * Portions Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1999-2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dlz.h,v 1.2.2.2 2005/09/06 03:47:18 marka Exp $ */
+
+/*! \file */
+
+#ifndef DLZ_H
+#define DLZ_H 1
+
+/*****
+ ***** Module Info
+ *****/
+
+/*
+ * DLZ Interface
+ *
+ * The DLZ interface allows zones to be looked up using a driver instead of
+ * Bind's default in memory zone table.
+ *
+ *
+ * Reliability:
+ *	No anticipated impact.
+ *
+ * Resources:
+ *
+ * Security:
+ *	No anticipated impact.
+ *
+ * Standards:
+ *	None.
+ */
+
+/*****
+ ***** Imports
+ *****/
+
+#include <dns/name.h>
+#include <dns/types.h>
+#include <dns/view.h>
+
+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
+/***
+ *** Types
+ ***/
+
+#define DNS_DLZ_MAGIC		ISC_MAGIC('D','L','Z','D')
+#define DNS_DLZ_VALID(dlz)	ISC_MAGIC_VALID(dlz, DNS_DLZ_MAGIC)
+
+typedef isc_result_t
+(*dns_dlzallowzonexfr_t)(void *driverarg, void *dbdata, isc_mem_t *mctx,
+			 dns_rdataclass_t rdclass, dns_name_t *name,
+			 isc_sockaddr_t *clientaddr,
+			 dns_db_t **dbp);
+
+/*%<
+ * Method prototype.  Drivers implementing the DLZ interface MUST
+ * supply an allow zone transfer method.  This method is called when
+ * the DNS server is performing a zone transfer query.  The driver's
+ * method should return ISC_R_SUCCESS and a database pointer to the
+ * name server if the zone is supported by the database, and zone
+ * transfer is allowed.  Otherwise it will return ISC_R_NOTFOUND if
+ * the zone is not supported by the database, or ISC_R_NOPERM if zone
+ * transfers are not allowed.  If an error occurs it should return a
+ * result code indicating the type of error.
+ */
+
+typedef isc_result_t
+(*dns_dlzcreate_t)(isc_mem_t *mctx, const char *dlzname, unsigned int argc,
+		   char *argv[], void *driverarg, void **dbdata);
+
+/*%<
+ * Method prototype.  Drivers implementing the DLZ interface MUST
+ * supply a create method.  This method is called when the DNS server
+ * is starting up and creating drivers for use later.
+ */
+
+typedef void
+(*dns_dlzdestroy_t)(void *driverarg, void **dbdata);
+
+/*%<
+ * Method prototype.  Drivers implementing the DLZ interface MUST
+ * supply a destroy method.  This method is called when the DNS server
+ * is shuting down and no longer needs the driver.
+ */
+
+typedef isc_result_t
+(*dns_dlzfindzone_t)(void *driverarg, void *dbdata, isc_mem_t *mctx,
+		     dns_rdataclass_t rdclass, dns_name_t *name,
+		     dns_db_t **dbp);
+
+/*%<
+
+ * Method prototype.  Drivers implementing the DLZ interface MUST
+ * supply a find zone method.  This method is called when the DNS
+ * server is performing a query.  The find zone method will be called
+ * with the longest possible name first, and continue to be called
+ * with successively shorter domain names, until any of the following
+ * occur:
+ *
+ * \li	1) a match is found, and the function returns (ISC_R_SUCCESS)
+ *
+ * \li	2) a problem occurs, and the functions returns anything other
+ *	   than (ISC_R_NOTFOUND)
+ * \li	3) we run out of domain name labels. I.E. we have tried the
+ *	   shortest domain name
+ * \li	4) the number of labels in the domain name is less than
+ *	   min_lables for dns_dlzfindzone
+ *
+ * The driver's find zone method should return ISC_R_SUCCESS and a
+ * database pointer to the name server if the zone is supported by the
+ * database.  Otherwise it will return ISC_R_NOTFOUND, and a null
+ * pointer if the zone is not supported.  If an error occurs it should
+ * return a result code indicating the type of error.
+ */
+
+/*% the methods supplied by a DLZ driver */
+typedef struct dns_dlzmethods {
+	dns_dlzcreate_t		create;
+	dns_dlzdestroy_t	destroy;
+	dns_dlzfindzone_t	findzone;
+	dns_dlzallowzonexfr_t	allowzonexfr;
+} dns_dlzmethods_t;
+
+/*% information about a DLZ driver */
+struct dns_dlzimplementation {
+	const char				*name;
+	const dns_dlzmethods_t			*methods;
+	isc_mem_t				*mctx;
+	void					*driverarg;
+	ISC_LINK(dns_dlzimplementation_t)	link;
+};
+
+/*% an instance of a DLZ driver */
+struct dns_dlzdb {
+	unsigned int		magic;
+	isc_mem_t		*mctx;
+	dns_dlzimplementation_t	*implementation;
+	void			*dbdata;
+};
+
+
+/***
+ *** Method declarations
+ ***/
+
+isc_result_t
+dns_dlzallowzonexfr(dns_view_t *view, dns_name_t *name,
+		    isc_sockaddr_t *clientaddr, dns_db_t **dbp);
+
+/*%<
+ * This method is called when the DNS server is performing a zone
+ * transfer query.  It will call the DLZ driver's allow zone tranfer
+ * method.
+ */
+
+isc_result_t
+dns_dlzcreate(isc_mem_t *mctx, const char *dlzname,
+	      const char *drivername, unsigned int argc,
+	      char *argv[], dns_dlzdb_t **dbp);
+
+/*%<
+ * This method is called when the DNS server is starting up and
+ * creating drivers for use later.  It will search the DLZ driver list
+ * for 'drivername' and return a DLZ driver via dbp if a match is
+ * found.  If the DLZ driver supplies a create method, this function
+ * will call it.
+ */
+
+void
+dns_dlzdestroy(dns_dlzdb_t **dbp);
+
+/*%<
+ * This method is called when the DNS server is shuting down and no
+ * longer needs the driver.  If the DLZ driver supplies a destroy
+ * methods, this function will call it.
+ */
+
+isc_result_t
+dns_dlzfindzone(dns_view_t *view, dns_name_t *name,
+		unsigned int minlabels, dns_db_t **dbp);
+
+/*%<
+ * This method is called when the DNS server is performing a query.
+ * It will call the DLZ driver's find zone method.
+ */
+
+isc_result_t
+dns_dlzregister(const char *drivername, const dns_dlzmethods_t *methods,
+		 void *driverarg, isc_mem_t *mctx,
+		dns_dlzimplementation_t **dlzimp);
+
+/*%<
+ * Register a dynamically loadable zones (DLZ) driver for the database
+ * type 'drivername', implemented by the functions in '*methods'.
+ *
+ * dlzimp must point to a NULL dlz_implementation_t pointer.  That is,
+ * dlzimp != NULL && *dlzimp == NULL.  It will be assigned a value that
+ * will later be used to identify the driver when deregistering it.
+ */
+
+isc_result_t
+dns_dlzstrtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp);
+
+/*%<
+ * This method is called when the name server is starting up to parse
+ * the DLZ driver command line from named.conf.  Basically it splits
+ * up a string into and argc / argv.  The primary difference of this
+ * method is items between braces { } are considered only 1 word.  for
+ * example the command line "this is { one grouped phrase } and this
+ * isn't" would be parsed into:
+ *
+ * \li	argv[0]: "this"
+ * \li	argv[1]: "is"
+ * \li	argv{2]: " one grouped phrase "
+ * \li	argv[3]: "and"
+ * \li	argv[4]: "this"
+ * \li	argv{5}: "isn't"
+ *
+ * braces should NOT be nested, more than one grouping in the command
+ * line is allowed.  Notice, argv[2] has an extra space at the
+ * beginning and end.  Extra spaces are not stripped between a
+ * grouping.  You can do so in your driver if needed, or be sure not
+ * to put extra spaces before / after the braces.
+ */
+
+void
+dns_dlzunregister(dns_dlzimplementation_t **dlzimp);
+
+/*%<
+ * Removes the dlz driver from the list of registered dlz drivers.
+ * There must be no active dlz drivers of this type when this function
+ * is called.
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif /* DLZ_H */
diff --git a/contrib/bind9/lib/dns/include/dns/dnssec.h b/contrib/bind9/lib/dns/include/dns/dnssec.h
index 5f86178..2804e03 100644
--- a/contrib/bind9/lib/dns/include/dns/dnssec.h
+++ b/contrib/bind9/lib/dns/include/dns/dnssec.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec.h,v 1.21.12.5 2004/03/08 09:04:35 marka Exp $ */
+/* $Id: dnssec.h,v 1.26.18.2 2005/04/29 00:16:12 marka Exp $ */
 
 #ifndef DNS_DNSSEC_H
 #define DNS_DNSSEC_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/stdtime.h>
 
@@ -32,51 +34,51 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 dns_dnssec_keyfromrdata(dns_name_t *name, dns_rdata_t *rdata, isc_mem_t *mctx,
 			dst_key_t **key);
-/*
+/*%<
  *	Creates a DST key from a DNS record.  Basically a wrapper around
  *	dst_key_fromdns().
  *
  *	Requires:
- *		'name' is not NULL
- *		'rdata' is not NULL
- *		'mctx' is not NULL
- *		'key' is not NULL
- *		'*key' is NULL
+ *\li		'name' is not NULL
+ *\li		'rdata' is not NULL
+ *\li		'mctx' is not NULL
+ *\li		'key' is not NULL
+ *\li		'*key' is NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		DST_R_INVALIDPUBLICKEY
- *		various errors from dns_name_totext
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		DST_R_INVALIDPUBLICKEY
+ *\li		various errors from dns_name_totext
  */
 
 isc_result_t
 dns_dnssec_sign(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		isc_stdtime_t *inception, isc_stdtime_t *expire,
 		isc_mem_t *mctx, isc_buffer_t *buffer, dns_rdata_t *sigrdata);
-/*
+/*%<
  *	Generates a SIG record covering this rdataset.  This has no effect
  *	on existing SIG records.
  *
  *	Requires:
- *		'name' (the owner name of the record) is a valid name
- *		'set' is a valid rdataset
- *		'key' is a valid key
- *		'inception' is not NULL
- *		'expire' is not NULL
- *		'mctx' is not NULL
- *		'buffer' is not NULL
- *		'sigrdata' is not NULL
+ *\li		'name' (the owner name of the record) is a valid name
+ *\li		'set' is a valid rdataset
+ *\li		'key' is a valid key
+ *\li		'inception' is not NULL
+ *\li		'expire' is not NULL
+ *\li		'mctx' is not NULL
+ *\li		'buffer' is not NULL
+ *\li		'sigrdata' is not NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		ISC_R_NOSPACE
- *		DNS_R_INVALIDTIME - the expiration is before the inception
- *		DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		#ISC_R_NOSPACE
+ *\li		#DNS_R_INVALIDTIME - the expiration is before the inception
+ *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
  *			it is not a zone key or its flags prevent
  *			authentication)
- *		DST_R_*
+ *\li		DST_R_*
  */
 
 isc_result_t
@@ -88,35 +90,36 @@ isc_result_t
 dns_dnssec_verify2(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		   isc_boolean_t ignoretime, isc_mem_t *mctx,
 		   dns_rdata_t *sigrdata, dns_name_t *wild);
-/*
+/*%<
  *	Verifies the SIG record covering this rdataset signed by a specific
  *	key.  This does not determine if the key's owner is authorized to
  *	sign this record, as this requires a resolver or database.
  *	If 'ignoretime' is ISC_TRUE, temporal validity will not be checked.
  *
  *	Requires:
- *		'name' (the owner name of the record) is a valid name
- *		'set' is a valid rdataset
- *		'key' is a valid key
- *		'mctx' is not NULL
- *		'sigrdata' is a valid rdata containing a SIG record
- *		'wild' if non-NULL then is a valid and has a buffer.
+ *\li		'name' (the owner name of the record) is a valid name
+ *\li		'set' is a valid rdataset
+ *\li		'key' is a valid key
+ *\li		'mctx' is not NULL
+ *\li		'sigrdata' is a valid rdata containing a SIG record
+ *\li		'wild' if non-NULL then is a valid and has a buffer.
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		DNS_R_FROMWILDCARD - the signature is valid and is from
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		#DNS_R_FROMWILDCARD - the signature is valid and is from
  *			a wildcard expansion.  dns_dnssec_verify2() only.
  *			'wild' contains the name of the wildcard if non-NULL.
- *		DNS_R_SIGINVALID - the signature fails to verify
- *		DNS_R_SIGEXPIRED - the signature has expired
- *		DNS_R_SIGFUTURE - the signature's validity period has not begun
- *		DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
+ *\li		#DNS_R_SIGINVALID - the signature fails to verify
+ *\li		#DNS_R_SIGEXPIRED - the signature has expired
+ *\li		#DNS_R_SIGFUTURE - the signature's validity period has not begun
+ *\li		#DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either
  *			it is not a zone key or its flags prevent
  *			authentication)
- *		DST_R_*
+ *\li		DST_R_*
  */
 
+/*@{*/
 isc_result_t
 dns_dnssec_findzonekeys(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
 			dns_name_t *name, isc_mem_t *mctx,
@@ -128,50 +131,51 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
 			 const char *directory, isc_mem_t *mctx,
 			 unsigned int maxkeys, dst_key_t **keys,
 			 unsigned int *nkeys);
-/*
+/*%<
  * 	Finds a set of zone keys.
  * 	XXX temporary - this should be handled in dns_zone_t.
  */
+/*@}*/
 
 isc_result_t
 dns_dnssec_signmessage(dns_message_t *msg, dst_key_t *key);
-/*
+/*%<
  *	Signs a message with a SIG(0) record.  This is implicitly called by
  *	dns_message_renderend() if msg->sig0key is not NULL.
  *
  *	Requires:
- *		'msg' is a valid message
- *		'key' is a valid key that can be used for signing
+ *\li		'msg' is a valid message
+ *\li		'key' is a valid key that can be used for signing
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		DST_R_*
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		DST_R_*
  */
 
 isc_result_t
 dns_dnssec_verifymessage(isc_buffer_t *source, dns_message_t *msg,
 			 dst_key_t *key);
-/*
+/*%<
  *	Verifies a message signed by a SIG(0) record.  This is not
  *	called implicitly by dns_message_parse().  If dns_message_signer()
  *	is called before dns_dnssec_verifymessage(), it will return
- *	DNS_R_NOTVERIFIEDYET.  dns_dnssec_verifymessage() will set
+ *	#DNS_R_NOTVERIFIEDYET.  dns_dnssec_verifymessage() will set
  *	the verified_sig0 flag in msg if the verify succeeds, and
  *	the sig0status field otherwise.
  *
  *	Requires:
- *		'source' is a valid buffer containing the unparsed message
- *		'msg' is a valid message
- *		'key' is a valid key
+ *\li		'source' is a valid buffer containing the unparsed message
+ *\li		'msg' is a valid message
+ *\li		'key' is a valid key
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		ISC_R_NOTFOUND - no SIG(0) was found
- *		DNS_R_SIGINVALID - the SIG record is not well-formed or
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		#ISC_R_NOTFOUND - no SIG(0) was found
+ *\li		#DNS_R_SIGINVALID - the SIG record is not well-formed or
  *				   was not generated by the key.
- *		DST_R_*
+ *\li		DST_R_*
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/ds.h b/contrib/bind9/lib/dns/include/dns/ds.h
index 979ac9f..5e4cc40 100644
--- a/contrib/bind9/lib/dns/include/dns/ds.h
+++ b/contrib/bind9/lib/dns/include/dns/ds.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ds.h,v 1.3.2.1 2004/03/08 02:08:00 marka Exp $ */
+/* $Id: ds.h,v 1.3.20.5 2006/02/22 23:50:09 marka Exp $ */
 
 #ifndef DNS_DS_H
 #define DNS_DS_H 1
@@ -25,11 +25,12 @@
 #include <dns/types.h>
 
 #define DNS_DSDIGEST_SHA1 (1)
+#define DNS_DSDIGEST_SHA256 (2)
 
 /*
- * Assuming SHA-1 digest type.
+ * Assuming SHA-256 digest type.
  */
-#define DNS_DS_BUFFERSIZE (24)
+#define DNS_DS_BUFFERSIZE (36)
 
 ISC_LANG_BEGINDECLS
 
@@ -37,20 +38,26 @@ isc_result_t
 dns_ds_buildrdata(dns_name_t *owner, dns_rdata_t *key,
 		  unsigned int digest_type, unsigned char *buffer,
 		  dns_rdata_t *rdata);
-/*
+/*%<
  * Build the rdata of a DS record.
  *
  * Requires:
- *	key	Points to a valid DNS KEY record.
- *	buffer	Points to a temporary buffer of at least
- * 		DNS_DS_BUFFERSIZE bytes.
- *	rdata	Points to an initialized dns_rdata_t.
+ *\li	key	Points to a valid DNS KEY record.
+ *\li	buffer	Points to a temporary buffer of at least
+ * 		#DNS_DS_BUFFERSIZE bytes.
+ *\li	rdata	Points to an initialized dns_rdata_t.
  *
  * Ensures:
- *      *rdata	Contains a valid DS rdata.  The 'data' member refers
+ *  \li    *rdata	Contains a valid DS rdata.  The 'data' member refers
  *		to 'buffer'.
  */
 
+isc_boolean_t
+dns_ds_digest_supported(unsigned int digest_type);
+/*%<
+ * Is this digest algorithm supported by dns_ds_buildrdata()?
+ */
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_DS_H */
diff --git a/contrib/bind9/lib/dns/include/dns/events.h b/contrib/bind9/lib/dns/include/dns/events.h
index 1e66139..d1ebef3 100644
--- a/contrib/bind9/lib/dns/include/dns/events.h
+++ b/contrib/bind9/lib/dns/include/dns/events.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,14 +15,15 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: events.h,v 1.37.2.1.4.4 2004/03/08 09:04:36 marka Exp $ */
+/* $Id: events.h,v 1.42.18.3 2005/04/29 00:16:13 marka Exp $ */
 
 #ifndef DNS_EVENTS_H
 #define DNS_EVENTS_H 1
 
 #include <isc/eventclass.h>
 
-/*
+/*! \file 
+ * \brief
  * Registry of DNS event numbers.
  */
 
@@ -63,6 +64,10 @@
 #define DNS_EVENT_DUMPQUANTUM			(ISC_EVENTCLASS_DNS + 34)
 #define DNS_EVENT_IMPORTRECVDONE		(ISC_EVENTCLASS_DNS + 35)
 #define DNS_EVENT_FREESTORAGE			(ISC_EVENTCLASS_DNS + 36)
+#define DNS_EVENT_VIEWACACHESHUTDOWN		(ISC_EVENTCLASS_DNS + 37)
+#define DNS_EVENT_ACACHECONTROL			(ISC_EVENTCLASS_DNS + 38)
+#define DNS_EVENT_ACACHECLEAN			(ISC_EVENTCLASS_DNS + 39)
+#define DNS_EVENT_ACACHEOVERMEM			(ISC_EVENTCLASS_DNS + 40)
 
 #define DNS_EVENT_FIRSTEVENT			(ISC_EVENTCLASS_DNS + 0)
 #define DNS_EVENT_LASTEVENT			(ISC_EVENTCLASS_DNS + 65535)
diff --git a/contrib/bind9/lib/dns/include/dns/fixedname.h b/contrib/bind9/lib/dns/include/dns/fixedname.h
index 3ee306f..8380de6 100644
--- a/contrib/bind9/lib/dns/include/dns/fixedname.h
+++ b/contrib/bind9/lib/dns/include/dns/fixedname.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: fixedname.h,v 1.12.206.1 2004/03/06 08:13:55 marka Exp $ */
+/* $Id: fixedname.h,v 1.13.18.2 2005/04/29 00:16:13 marka Exp $ */
 
 #ifndef DNS_FIXEDNAME_H
 #define DNS_FIXEDNAME_H 1
@@ -24,28 +24,31 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * Fixed-size Names
  *
  * dns_fixedname_t is a convenience type containing a name, an offsets table,
  * and a dedicated buffer big enough for the longest possible name.
  *
  * MP:
- *	The caller must ensure any required synchronization.
+ *\li	The caller must ensure any required synchronization.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	Per dns_fixedname_t:
+ *\li	Per dns_fixedname_t:
+ *\code
  *		sizeof(dns_name_t) + sizeof(dns_offsets_t) +
  *		sizeof(isc_buffer_t) + 255 bytes + structure padding
+ *\endcode
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 /*****
diff --git a/contrib/bind9/lib/dns/include/dns/forward.h b/contrib/bind9/lib/dns/include/dns/forward.h
index 1eb62d2..ddf6d7f 100644
--- a/contrib/bind9/lib/dns/include/dns/forward.h
+++ b/contrib/bind9/lib/dns/include/dns/forward.h
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: forward.h,v 1.2.206.3 2005/03/17 03:58:31 marka Exp $ */
+/* $Id: forward.h,v 1.3.18.3 2005/04/27 05:01:33 sra Exp $ */
 
 #ifndef DNS_FORWARD_H
 #define DNS_FORWARD_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/result.h>
 
@@ -34,68 +36,81 @@ struct dns_forwarders {
 
 isc_result_t
 dns_fwdtable_create(isc_mem_t *mctx, dns_fwdtable_t **fwdtablep);
-/*
+/*%<
  * Creates a new forwarding table.
  *
  * Requires:
- * 	mctx is a valid memory context.
- * 	fwdtablep != NULL && *fwdtablep == NULL
+ * \li 	mctx is a valid memory context.
+ * \li	fwdtablep != NULL && *fwdtablep == NULL
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_fwdtable_add(dns_fwdtable_t *fwdtable, dns_name_t *name,
 		 isc_sockaddrlist_t *addrs, dns_fwdpolicy_t policy);
-/*
+/*%<
  * Adds an entry to the forwarding table.  The entry associates
  * a domain with a list of forwarders and a forwarding policy.  The
  * addrs list is copied if not empty, so the caller should free its copy.
  *
  * Requires:
- * 	fwdtable is a valid forwarding table.
- * 	name is a valid name
- * 	addrs is a valid list of sockaddrs, which may be empty.
+ * \li	fwdtable is a valid forwarding table.
+ * \li	name is a valid name
+ * \li	addrs is a valid list of sockaddrs, which may be empty.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_fwdtable_find(dns_fwdtable_t *fwdtable, dns_name_t *name,
 		  dns_forwarders_t **forwardersp);
+/*%<
+ * Finds a domain in the forwarding table.  The closest matching parent
+ * domain is returned.
+ *
+ * Requires:
+ * \li	fwdtable is a valid forwarding table.
+ * \li	name is a valid name
+ * \li	forwardersp != NULL && *forwardersp == NULL
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND
+ */
 
 isc_result_t
 dns_fwdtable_find2(dns_fwdtable_t *fwdtable, dns_name_t *name,
 		   dns_name_t *foundname, dns_forwarders_t **forwardersp);
-/*
+/*%<
  * Finds a domain in the forwarding table.  The closest matching parent
  * domain is returned.
  *
  * Requires:
- * 	fwdtable is a valid forwarding table.
- * 	name is a valid name
- * 	forwardersp != NULL && *forwardersp == NULL
- *	foundname to be NULL or a valid name with buffer.
+ * \li	fwdtable is a valid forwarding table.
+ * \li	name is a valid name
+ * \li	forwardersp != NULL && *forwardersp == NULL
+ * \li	foundname to be NULL or a valid name with buffer.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	ISC_R_NOTFOUND
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND
  */
 
 void
 dns_fwdtable_destroy(dns_fwdtable_t **fwdtablep);
-/*
+/*%<
  * Destroys a forwarding table.
  *
  * Requires:
- * 	fwtablep != NULL && *fwtablep != NULL
+ * \li	fwtablep != NULL && *fwtablep != NULL
  *
  * Ensures:
- * 	all memory associated with the forwarding table is freed.
+ * \li	all memory associated with the forwarding table is freed.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/journal.h b/contrib/bind9/lib/dns/include/dns/journal.h
index fdf6094..b776a30 100644
--- a/contrib/bind9/lib/dns/include/dns/journal.h
+++ b/contrib/bind9/lib/dns/include/dns/journal.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: journal.h,v 1.23.12.3 2004/03/08 09:04:36 marka Exp $ */
+/* $Id: journal.h,v 1.25.18.2 2005/04/29 00:16:13 marka Exp $ */
 
 #ifndef DNS_JOURNAL_H
 #define DNS_JOURNAL_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * Database journalling.
  */
 
@@ -44,7 +45,7 @@
  *** Types
  ***/
 
-/*
+/*%
  * A dns_journal_t represents an open journal file.  This is an opaque type.
  *
  * A particular dns_journal_t object may be opened for writing, in which case
@@ -67,19 +68,21 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 		   dns_diffop_t op, dns_difftuple_t **tp);
-/*
+/*!< brief
  * Create a diff tuple for the current database SOA.
  * XXX this probably belongs somewhere else.
  */
 
 
+/*@{*/
 #define DNS_SERIAL_GT(a, b) ((int)(((a) - (b)) & 0xFFFFFFFF) > 0)
 #define DNS_SERIAL_GE(a, b) ((int)(((a) - (b)) & 0xFFFFFFFF) >= 0)
-/*
+/*!< brief
  * Compare SOA serial numbers.  DNS_SERIAL_GT(a, b) returns true iff
  * a is "greater than" b where "greater than" is as defined in RFC1982.
  * DNS_SERIAL_GE(a, b) returns true iff a is "greater than or equal to" b.
  */
+/*@}*/
 
 /**************************************************************************/
 /*
@@ -89,7 +92,7 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 isc_result_t
 dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write,
 		 dns_journal_t **journalp);
-/*
+/*%<
  * Open the journal file 'filename' and create a dns_journal_t object for it.
  *
  * If 'write' is ISC_TRUE, the journal is open for writing.  If it does
@@ -101,7 +104,7 @@ dns_journal_open(isc_mem_t *mctx, const char *filename, isc_boolean_t write,
 
 void
 dns_journal_destroy(dns_journal_t **journalp);
-/*
+/*%<
  * Destroy a dns_journal_t, closing any open files and freeing its memory.
  */
 
@@ -112,52 +115,52 @@ dns_journal_destroy(dns_journal_t **journalp);
 
 isc_result_t
 dns_journal_begin_transaction(dns_journal_t *j);
-/*
+/*%<
  * Prepare to write a new transaction to the open journal file 'j'.
  *
  * Requires:
- *      'j' is open for writing.
+ *     \li 'j' is open for writing.
  */
 
 isc_result_t
 dns_journal_writediff(dns_journal_t *j, dns_diff_t *diff);
-/*
+/*%<
  * Write 'diff' to the current transaction of journal file 'j'.
  *
  * Requires:
- *      'j' is open for writing and dns_journal_begin_transaction()
+ * \li     'j' is open for writing and dns_journal_begin_transaction()
  * 	has been called.
  *
- * 	'diff' is a full or partial, correctly ordered IXFR
+ *\li 	'diff' is a full or partial, correctly ordered IXFR
  *      difference sequence.
  */
 
 isc_result_t
 dns_journal_commit(dns_journal_t *j);
-/*
+/*%<
  * Commit the current transaction of journal file 'j'.
  *
  * Requires:
- *      'j' is open for writing and dns_journal_begin_transaction()
+ * \li     'j' is open for writing and dns_journal_begin_transaction()
  * 	has been called.
  *
- *      dns_journal_writediff() has been called one or more times
+ *   \li   dns_journal_writediff() has been called one or more times
  * 	to form a complete, correctly ordered IXFR difference
  *      sequence.
  */
 
 isc_result_t
 dns_journal_write_transaction(dns_journal_t *j, dns_diff_t *diff);
-/*
+/*%
  * Write a complete transaction at once to a journal file,
  * sorting it if necessary, and commit it.  Equivalent to calling
  * dns_diff_sort(), dns_journal_begin_transaction(),
  * dns_journal_writediff(), and dns_journal_commit().
  *
  * Requires:
- *      'j' is open for writing.
+ *\li      'j' is open for writing.
  *
- * 	'diff' contains exactly one SOA deletion, one SOA addition
+ * \li	'diff' contains exactly one SOA deletion, one SOA addition
  *       with a greater serial number, and possibly other changes,
  *       in arbitrary order.
  */
@@ -171,46 +174,48 @@ isc_uint32_t
 dns_journal_first_serial(dns_journal_t *j);
 isc_uint32_t
 dns_journal_last_serial(dns_journal_t *j);
-/*
+/*%<
  * Get the first and last addressable serial number in the journal.
  */
 
 isc_result_t
 dns_journal_iter_init(dns_journal_t *j,
 		      isc_uint32_t begin_serial, isc_uint32_t end_serial);
-/*
+/*%<
  * Prepare to iterate over the transactions that will bring the database
  * from SOA serial number 'begin_serial' to 'end_serial'.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_RANGE	begin_serial is outside the addressable range.
- *	ISC_R_NOTFOUND	begin_serial is within the range of adressable
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_RANGE	begin_serial is outside the addressable range.
+ *\li	ISC_R_NOTFOUND	begin_serial is within the range of adressable
  *			serial numbers covered by the journal, but
  *			this particular serial number does not exist.
  */
 
+/*@{*/
 isc_result_t
 dns_journal_first_rr(dns_journal_t *j);
 isc_result_t
 dns_journal_next_rr(dns_journal_t *j);
-/*
+/*%<
  * Position the iterator at the first/next RR in a journal
  * transaction sequence established using dns_journal_iter_init().
  *
  * Requires:
- *      dns_journal_iter_init() has been called.
+ *    \li  dns_journal_iter_init() has been called.
  *
  */
+/*@}*/
 
 void
 dns_journal_current_rr(dns_journal_t *j, dns_name_t **name, isc_uint32_t *ttl,
 		       dns_rdata_t **rdata);
-/*
+/*%<
  * Get the name, ttl, and rdata of the current journal RR.
  *
  * Requires:
- *      The last call to dns_journal_first_rr() or dns_journal_next_rr()
+ * \li     The last call to dns_journal_first_rr() or dns_journal_next_rr()
  *      returned ISC_R_SUCCESS.
  */
 
@@ -221,22 +226,22 @@ dns_journal_current_rr(dns_journal_t *j, dns_name_t **name, isc_uint32_t *ttl,
 
 isc_result_t
 dns_journal_rollforward(isc_mem_t *mctx, dns_db_t *db, const char *filename);
-/*
+/*%<
  * Roll forward (play back) the journal file "filename" into the
  * database "db".  This should be called when the server starts
  * after a shutdown or crash.
  *
  * Requires:
- *      'mctx' is a valid memory context.
- *	'db' is a valid database which does not have a version
+ *\li      'mctx' is a valid memory context.
+ *\li	'db' is a valid database which does not have a version
  *           open for writing.
- *      'filename' is the name of the journal file belonging to 'db'.
+ *  \li    'filename' is the name of the journal file belonging to 'db'.
  *
  * Returns:
- *	DNS_R_NOJOURNAL when journal does not exist.
- *	ISC_R_NOTFOUND when current serial in not in journal.
- *	ISC_R_RANGE when current serial in not in journals range.
- *	ISC_R_SUCCESS journal has been applied successfully to database.
+ *\li	DNS_R_NOJOURNAL when journal does not exist.
+ *\li	ISC_R_NOTFOUND when current serial in not in journal.
+ *\li	ISC_R_RANGE when current serial in not in journals range.
+ *\li	ISC_R_SUCCESS journal has been applied successfully to database.
  *	others
  */
 
@@ -249,7 +254,7 @@ dns_db_diff(isc_mem_t *mctx,
 	    dns_db_t *dba, dns_dbversion_t *dbvera,
 	    dns_db_t *dbb, dns_dbversion_t *dbverb,
 	    const char *journal_filename);
-/*
+/*%<
  * Compare the databases 'dba' and 'dbb' and generate a journal
  * entry containing the changes to make 'dba' from 'dbb' (note
  * the order).  This journal entry will consist of a single,
@@ -260,7 +265,7 @@ dns_db_diff(isc_mem_t *mctx,
 isc_result_t
 dns_journal_compact(isc_mem_t *mctx, char *filename, isc_uint32_t serial,
                     isc_uint32_t target_size);
-/*
+/*%<
  * Attempt to compact the journal if it is greater that 'target_size'.
  * Changes from 'serial' onwards will be preserved.  If the journal
  * exists and is non-empty 'serial' must exist in the journal.
diff --git a/contrib/bind9/lib/dns/include/dns/keyflags.h b/contrib/bind9/lib/dns/include/dns/keyflags.h
index 025b137..665b517 100644
--- a/contrib/bind9/lib/dns/include/dns/keyflags.h
+++ b/contrib/bind9/lib/dns/include/dns/keyflags.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keyflags.h,v 1.9.206.1 2004/03/06 08:13:56 marka Exp $ */
+/* $Id: keyflags.h,v 1.10.18.2 2005/04/29 00:16:13 marka Exp $ */
 
 #ifndef DNS_KEYFLAGS_H
 #define DNS_KEYFLAGS_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -28,7 +30,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_keyflags_fromtext(dns_keyflags_t *flagsp, isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a DNSSEC KEY flags value.
  * The text may contain either a set of flag mnemonics separated by
  * vertical bars or a decimal flags value.  For compatibility with
@@ -37,14 +39,14 @@ dns_keyflags_fromtext(dns_keyflags_t *flagsp, isc_textregion_t *source);
  * are also accepted.
  *
  * Requires:
- *	'flagsp' is a valid pointer.
+ *\li	'flagsp' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_RANGE			numeric flag value is out of range
- *	DNS_R_UNKNOWN			mnemonic flag is unknown
+ *\li	ISC_R_SUCCESS			on success
+ *\li	ISC_R_RANGE			numeric flag value is out of range
+ *\li	DNS_R_UNKNOWN			mnemonic flag is unknown
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/keytable.h b/contrib/bind9/lib/dns/include/dns/keytable.h
index f3a21a6..b8bfcc1 100644
--- a/contrib/bind9/lib/dns/include/dns/keytable.h
+++ b/contrib/bind9/lib/dns/include/dns/keytable.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keytable.h,v 1.10.206.3 2006/01/06 00:01:42 marka Exp $ */
+/* $Id: keytable.h,v 1.11.18.3 2005/12/05 00:00:03 marka Exp $ */
 
 #ifndef DNS_KEYTABLE_H
 #define DNS_KEYTABLE_H 1
@@ -24,22 +24,21 @@
  ***** Module Info
  *****/
 
-/*
- * Key Tables
- *
+/*! \file
+ * \brief
  * The keytable module provides services for storing and retrieving DNSSEC
  * trusted keys, as well as the ability to find the deepest matching key
  * for a given domain name.
  *
  * MP:
- *	The module ensures appropriate synchronization of data structures it
+ *\li	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  */
 
 #include <isc/lang.h>
@@ -52,203 +51,202 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep);
-/*
+/*%<
  * Create a keytable.
  *
  * Requires:
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
- *	keytablep != NULL && *keytablep == NULL
+ *\li	keytablep != NULL && *keytablep == NULL
  *
  * Ensures:
  *
- *	On success, *keytablep is a valid, empty key table.
+ *\li	On success, *keytablep is a valid, empty key table.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	ISC_R_SUCCESS
  *
- *	Any other result indicates failure.
+ *\li	Any other result indicates failure.
  */
 
 
 void
 dns_keytable_attach(dns_keytable_t *source, dns_keytable_t **targetp);
-/*
+/*%<
  * Attach *targetp to source.
  *
  * Requires:
  *
- *	'source' is a valid keytable.
+ *\li	'source' is a valid keytable.
  *
- *	'targetp' points to a NULL dns_keytable_t *.
+ *\li	'targetp' points to a NULL dns_keytable_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to source.
+ *\li	*targetp is attached to source.
  */
 
 void
 dns_keytable_detach(dns_keytable_t **keytablep);
-/*
+/*%<
  * Detach *keytablep from its keytable.
  *
  * Requires:
  *
- *	'keytablep' points to a valid keytable.
+ *\li	'keytablep' points to a valid keytable.
  *
  * Ensures:
  *
- *	*keytablep is NULL.
- *
- *	If '*keytablep' is the last reference to the keytable,
+ *\li	*keytablep is NULL.
  *
- *		All resources used by the keytable will be freed
+ *\li	If '*keytablep' is the last reference to the keytable,
+ *		all resources used by the keytable will be freed
  */
 
 isc_result_t
 dns_keytable_add(dns_keytable_t *keytable, dst_key_t **keyp);
-/*
+/*%<
  * Add '*keyp' to 'keytable'.
  *
  * Notes:
  *
- *	Ownership of *keyp is transferred to the keytable.
+ *\li	Ownership of *keyp is transferred to the keytable.
  *
  * Requires:
  *
- *	keyp != NULL && *keyp is a valid dst_key_t *.
+ *\li	keyp != NULL && *keyp is a valid dst_key_t *.
  *
  * Ensures:
  *
- *	On success, *keyp == NULL
+ *\li	On success, *keyp == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	ISC_R_SUCCESS
  *
- *	Any other result indicates failure.
+ *\li	Any other result indicates failure.
  */
 
 isc_result_t
 dns_keytable_findkeynode(dns_keytable_t *keytable, dns_name_t *name,
 			 dns_secalg_t algorithm, dns_keytag_t tag,
 			 dns_keynode_t **keynodep);
-/*
+/*%<
  * Search for a key named 'name', matching 'algorithm' and 'tag' in
  * 'keytable'.  This finds the first instance which matches.  Use
  * dns_keytable_findnextkeynode() to find other instances.
  *
  * Requires:
  *
- *	'keytable' is a valid keytable.
+ *\li	'keytable' is a valid keytable.
  *
- *	'name' is a valid absolute name.
+ *\li	'name' is a valid absolute name.
  *
- *	keynodep != NULL && *keynodep == NULL
+ *\li	keynodep != NULL && *keynodep == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	DNS_R_PARTIALMATCH	the name existed in the keytable.
- *	ISC_R_NOTFOUND
+ *\li	ISC_R_SUCCESS
+ *\li	DNS_R_PARTIALMATCH	the name existed in the keytable.
+ *\li	ISC_R_NOTFOUND
  *
- *	Any other result indicates an error.
+ *\li	Any other result indicates an error.
  */
 
 isc_result_t
 dns_keytable_findnextkeynode(dns_keytable_t *keytable, dns_keynode_t *keynode,
 		                             dns_keynode_t **nextnodep);
-/*
+/*%<
  * Search for the next key with the same properties as 'keynode' in
  * 'keytable' as found by dns_keytable_findkeynode().
  *
  * Requires:
  *
- *	'keytable' is a valid keytable.
+ *\li	'keytable' is a valid keytable.
  *
- *	'keynode' is a valid keynode.
+ *\li	'keynode' is a valid keynode.
  *
- *	nextnodep != NULL && *nextnodep == NULL
+ *\li	nextnodep != NULL && *nextnodep == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOTFOUND
  *
- *	Any other result indicates an error.
+ *\li	Any other result indicates an error.
  */
 
 isc_result_t
 dns_keytable_finddeepestmatch(dns_keytable_t *keytable, dns_name_t *name,
 			      dns_name_t *foundname);
-/*
+/*%<
  * Search for the deepest match of 'name' in 'keytable'.
  *
  * Requires:
  *
- *	'keytable' is a valid keytable.
+ *\li	'keytable' is a valid keytable.
  *
- *	'name' is a valid absolute name.
+ *\li	'name' is a valid absolute name.
  *
- *	'foundname' is a name with a dedicated buffer.
+ *\li	'foundname' is a name with a dedicated buffer.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOTFOUND
  *
- *	Any other result indicates an error.
+ *\li	Any other result indicates an error.
  */
 
 void
 dns_keytable_detachkeynode(dns_keytable_t *keytable,
 			   dns_keynode_t **keynodep);
-/*
+/*%<
  * Give back a keynode found via dns_keytable_findkeynode().
  *
  * Requires:
  *
- *	'keytable' is a valid keytable.
+ *\li	'keytable' is a valid keytable.
  *
- *	*keynodep is a valid keynode returned by a call to
+ *\li	*keynodep is a valid keynode returned by a call to
  *	dns_keytable_findkeynode().
  *
  * Ensures:
  *
- *	*keynodep == NULL
+ *\li	*keynodep == NULL
  */
 
 isc_result_t
 dns_keytable_issecuredomain(dns_keytable_t *keytable, dns_name_t *name,
 			    isc_boolean_t *wantdnssecp);
-/*
+/*%<
  * Is 'name' at or beneath a trusted key?
  *
  * Requires:
  *
- *	'keytable' is a valid keytable.
+ *\li	'keytable' is a valid keytable.
  *
- *	'name' is a valid absolute name.
+ *\li	'name' is a valid absolute name.
  *
- *	'*wantsdnssecp' is a valid isc_boolean_t.
+ *\li	'*wantsdnssecp' is a valid isc_boolean_t.
  *
  * Ensures:
  *
- *	On success, *wantsdnssecp will be ISC_TRUE if and only if 'name'
+ *\li	On success, *wantsdnssecp will be ISC_TRUE if and only if 'name'
  *	is at or beneath a trusted key.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	ISC_R_SUCCESS
  *
- *	Any other result is an error.
+ *\li	Any other result is an error.
  */
 
 dst_key_t *
 dns_keynode_key(dns_keynode_t *keynode);
-/*
+/*%<
  * Get the DST key associated with keynode.
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/keyvalues.h b/contrib/bind9/lib/dns/include/dns/keyvalues.h
index ef9e821..df17ace 100644
--- a/contrib/bind9/lib/dns/include/dns/keyvalues.h
+++ b/contrib/bind9/lib/dns/include/dns/keyvalues.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,36 +15,38 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keyvalues.h,v 1.11.12.3 2004/03/06 08:13:56 marka Exp $ */
+/* $Id: keyvalues.h,v 1.15.18.2 2005/04/29 00:16:14 marka Exp $ */
 
 #ifndef DNS_KEYVALUES_H
 #define DNS_KEYVALUES_H 1
 
+/*! \file */
+
 /*
  * Flags field of the KEY RR rdata
  */
-#define DNS_KEYFLAG_TYPEMASK	0xC000	/* Mask for "type" bits */
-#define DNS_KEYTYPE_AUTHCONF	0x0000	/* Key usable for both */
-#define DNS_KEYTYPE_CONFONLY	0x8000	/* Key usable for confidentiality */
-#define DNS_KEYTYPE_AUTHONLY	0x4000	/* Key usable for authentication */
-#define DNS_KEYTYPE_NOKEY	0xC000	/* No key usable for either; no key */
+#define DNS_KEYFLAG_TYPEMASK	0xC000	/*%< Mask for "type" bits */
+#define DNS_KEYTYPE_AUTHCONF	0x0000	/*%< Key usable for both */
+#define DNS_KEYTYPE_CONFONLY	0x8000	/*%< Key usable for confidentiality */
+#define DNS_KEYTYPE_AUTHONLY	0x4000	/*%< Key usable for authentication */
+#define DNS_KEYTYPE_NOKEY	0xC000	/*%< No key usable for either; no key */
 #define DNS_KEYTYPE_NOAUTH	DNS_KEYTYPE_CONFONLY
 #define DNS_KEYTYPE_NOCONF	DNS_KEYTYPE_AUTHONLY
 
-#define DNS_KEYFLAG_RESERVED2	0x2000	/* reserved - must be zero */
-#define DNS_KEYFLAG_EXTENDED	0x1000	/* key has extended flags */
-#define DNS_KEYFLAG_RESERVED4	0x0800	/* reserved - must be zero */
-#define DNS_KEYFLAG_RESERVED5	0x0400	/* reserved - must be zero */
-#define DNS_KEYFLAG_OWNERMASK	0x0300	/* these bits determine the type */
-#define DNS_KEYOWNER_USER	0x0000	/* key is assoc. with user */
-#define DNS_KEYOWNER_ENTITY	0x0200	/* key is assoc. with entity eg host */
-#define DNS_KEYOWNER_ZONE	0x0100	/* key is zone key */
-#define DNS_KEYOWNER_RESERVED	0x0300	/* reserved meaning */
-#define DNS_KEYFLAG_RESERVED8	0x0080	/* reserved - must be zero */
-#define DNS_KEYFLAG_RESERVED9	0x0040	/* reserved - must be zero */
-#define DNS_KEYFLAG_RESERVED10	0x0020	/* reserved - must be zero */
-#define DNS_KEYFLAG_RESERVED11	0x0010	/* reserved - must be zero */
-#define DNS_KEYFLAG_SIGNATORYMASK 0x000F /* key can sign RR's of same name */
+#define DNS_KEYFLAG_RESERVED2	0x2000	/*%< reserved - must be zero */
+#define DNS_KEYFLAG_EXTENDED	0x1000	/*%< key has extended flags */
+#define DNS_KEYFLAG_RESERVED4	0x0800	/*%< reserved - must be zero */
+#define DNS_KEYFLAG_RESERVED5	0x0400	/*%< reserved - must be zero */
+#define DNS_KEYFLAG_OWNERMASK	0x0300	/*%< these bits determine the type */
+#define DNS_KEYOWNER_USER	0x0000	/*%< key is assoc. with user */
+#define DNS_KEYOWNER_ENTITY	0x0200	/*%< key is assoc. with entity eg host */
+#define DNS_KEYOWNER_ZONE	0x0100	/*%< key is zone key */
+#define DNS_KEYOWNER_RESERVED	0x0300	/*%< reserved meaning */
+#define DNS_KEYFLAG_RESERVED8	0x0080	/*%< reserved - must be zero */
+#define DNS_KEYFLAG_RESERVED9	0x0040	/*%< reserved - must be zero */
+#define DNS_KEYFLAG_RESERVED10	0x0020	/*%< reserved - must be zero */
+#define DNS_KEYFLAG_RESERVED11	0x0010	/*%< reserved - must be zero */
+#define DNS_KEYFLAG_SIGNATORYMASK 0x000F /*%< key can sign RR's of same name */
 
 #define DNS_KEYFLAG_RESERVEDMASK (DNS_KEYFLAG_RESERVED2 | \
 				  DNS_KEYFLAG_RESERVED4 | \
@@ -53,21 +55,21 @@
 				  DNS_KEYFLAG_RESERVED9 | \
 				  DNS_KEYFLAG_RESERVED10 | \
 				  DNS_KEYFLAG_RESERVED11 )
-#define DNS_KEYFLAG_KSK		0x0001	/* key signing key */
+#define DNS_KEYFLAG_KSK		0x0001	/*%< key signing key */
 
-#define DNS_KEYFLAG_RESERVEDMASK2 0xFFFF	/* no bits defined here */
+#define DNS_KEYFLAG_RESERVEDMASK2 0xFFFF	/*%< no bits defined here */
 
 /* The Algorithm field of the KEY and SIG RR's is an integer, {1..254} */
-#define DNS_KEYALG_RSAMD5	1       /* RSA with MD5 */
+#define DNS_KEYALG_RSAMD5	1       /*%< RSA with MD5 */
 #define DNS_KEYALG_RSA		DNS_KEYALG_RSAMD5
-#define DNS_KEYALG_DH		2       /* Diffie Hellman KEY */
-#define DNS_KEYALG_DSA		3       /* DSA KEY */
+#define DNS_KEYALG_DH		2       /*%< Diffie Hellman KEY */
+#define DNS_KEYALG_DSA		3       /*%< DSA KEY */
 #define DNS_KEYALG_DSS		NS_ALG_DSA
 #define DNS_KEYALG_ECC		4
 #define DNS_KEYALG_RSASHA1	5
 #define DNS_KEYALG_INDIRECT	252
 #define DNS_KEYALG_PRIVATEDNS	253
-#define DNS_KEYALG_PRIVATEOID	254     /* Key begins with OID giving alg */
+#define DNS_KEYALG_PRIVATEOID	254     /*%< Key begins with OID giving alg */
 
 /* Protocol values  */
 #define	DNS_KEYPROTO_RESERVED	0
@@ -78,11 +80,11 @@
 #define DNS_KEYPROTO_ANY	255
 
 /* Signatures */
-#define DNS_SIG_RSAMINBITS	512	/* Size of a mod or exp in bits */
+#define DNS_SIG_RSAMINBITS	512	/*%< Size of a mod or exp in bits */
 #define DNS_SIG_RSAMAXBITS	2552
 	/* Total of binary mod and exp */
 #define DNS_SIG_RSAMAXBYTES	((DNS_SIG_RSAMAXBITS+7/8)*2+3)
-	/* Max length of text sig block */
+	/*%< Max length of text sig block */
 #define DNS_SIG_RSAMAXBASE64	(((DNS_SIG_RSAMAXBYTES+2)/3)*4)
 #define DNS_SIG_RSAMINSIZE	((DNS_SIG_RSAMINBITS+7)/8)
 #define DNS_SIG_RSAMAXSIZE	((DNS_SIG_RSAMAXBITS+7)/8)
diff --git a/contrib/bind9/lib/dns/include/dns/lib.h b/contrib/bind9/lib/dns/include/dns/lib.h
index e53dd2b..d59dde3 100644
--- a/contrib/bind9/lib/dns/include/dns/lib.h
+++ b/contrib/bind9/lib/dns/include/dns/lib.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,21 +15,27 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lib.h,v 1.6.12.3 2004/03/08 09:04:36 marka Exp $ */
+/* $Id: lib.h,v 1.8.18.4 2005/09/20 04:33:48 marka Exp $ */
 
 #ifndef DNS_LIB_H
 #define DNS_LIB_H 1
 
+/*! \file */
+
 #include <isc/types.h>
 #include <isc/lang.h>
 
 ISC_LANG_BEGINDECLS
 
+/*%
+ * Tuning: external query load in packets per seconds.
+ */
+LIBDNS_EXTERNAL_DATA extern unsigned int dns_pps;
 LIBDNS_EXTERNAL_DATA extern isc_msgcat_t *dns_msgcat;
 
 void
 dns_lib_initmsgcat(void);
-/*
+/*%<
  * Initialize the DNS library's message catalog, dns_msgcat, if it
  * has not already been initialized.
  */
diff --git a/contrib/bind9/lib/dns/include/dns/log.h b/contrib/bind9/lib/dns/include/dns/log.h
index 9901fc9..7bee174 100644
--- a/contrib/bind9/lib/dns/include/dns/log.h
+++ b/contrib/bind9/lib/dns/include/dns/log.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.h,v 1.30.2.1.10.2 2004/03/06 08:13:57 marka Exp $ */
+/* $Id: log.h,v 1.33.18.4 2005/09/05 00:18:27 marka Exp $ */
 
-/* Principal Authors: DCL */
+/*! \file
+ * \author  Principal Authors: DCL */
 
 #ifndef DNS_LOG_H
 #define DNS_LOG_H 1
@@ -69,33 +70,35 @@ LIBDNS_EXTERNAL_DATA extern isc_logmodule_t dns_modules[];
 #define DNS_LOGMODULE_SDB		(&dns_modules[22])
 #define DNS_LOGMODULE_DIFF		(&dns_modules[23])
 #define DNS_LOGMODULE_HINTS		(&dns_modules[24])
+#define DNS_LOGMODULE_ACACHE		(&dns_modules[25])
+#define DNS_LOGMODULE_DLZ		(&dns_modules[26])
 
 ISC_LANG_BEGINDECLS
 
 void
 dns_log_init(isc_log_t *lctx);
-/*
+/*%
  * Make the libdns categories and modules available for use with the
  * ISC logging library.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  *
- *	dns_log_init() is called only once.
+ *\li	dns_log_init() is called only once.
  *
  * Ensures:
- * 	The catgories and modules defined above are available for
+ * \li	The catgories and modules defined above are available for
  * 	use by isc_log_usechannnel() and isc_log_write().
  */
 
 void
 dns_log_setcontext(isc_log_t *lctx);
-/*
+/*%
  * Make the libdns library use the provided context for logging internal
  * messages.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/lookup.h b/contrib/bind9/lib/dns/include/dns/lookup.h
index 2be254c..aea6f84 100644
--- a/contrib/bind9/lib/dns/include/dns/lookup.h
+++ b/contrib/bind9/lib/dns/include/dns/lookup.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lookup.h,v 1.5.206.1 2004/03/06 08:13:57 marka Exp $ */
+/* $Id: lookup.h,v 1.6.18.2 2005/04/29 00:16:15 marka Exp $ */
 
 #ifndef DNS_LOOKUP_H
 #define DNS_LOOKUP_H 1
@@ -24,29 +24,28 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Lookup
- *
+/*! \file
+ * \brief
  * The lookup module performs simple DNS lookups.  It implements
  * the full resolver algorithm, both looking for local data and 
  * resoving external names as necessary.
  *
  * MP:
- *	The module ensures appropriate synchronization of data structures it
+ *\li	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	RFCs:	1034, 1035, 2181, <TBS>
- *	Drafts:	<TBS>
+ *\li	RFCs:	1034, 1035, 2181, TBS
+ *\li	Drafts:	TBS
  */
 
 #include <isc/lang.h>
@@ -56,7 +55,7 @@
 
 ISC_LANG_BEGINDECLS
 
-/*
+/*%
  * A 'dns_lookupevent_t' is returned when a lookup completes.
  * The sender field will be set to the lookup that completed.  If 'result'
  * is ISC_R_SUCCESS, then 'names' will contain a list of names associated
@@ -77,60 +76,60 @@ isc_result_t
 dns_lookup_create(isc_mem_t *mctx, dns_name_t *name, dns_rdatatype_t type,
 		  dns_view_t *view, unsigned int options, isc_task_t *task,
 		  isc_taskaction_t action, void *arg, dns_lookup_t **lookupp);
-/*
+/*%<
  * Finds the rrsets matching 'name' and 'type'.
  *
  * Requires:
  *
- *	'mctx' is a valid mctx.
+ *\li	'mctx' is a valid mctx.
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
- *	'view' is a valid view which has a resolver.
+ *\li	'view' is a valid view which has a resolver.
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	lookupp != NULL && *lookupp == NULL
+ *\li	lookupp != NULL && *lookupp == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOMEMORY
  *
- *	Any resolver-related error (e.g. ISC_R_SHUTTINGDOWN) may also be
+ *\li	Any resolver-related error (e.g. ISC_R_SHUTTINGDOWN) may also be
  *	returned.
  */
 
 void
 dns_lookup_cancel(dns_lookup_t *lookup);
-/*
+/*%<
  * Cancel 'lookup'.
  *
  * Notes:
  *
- *	If 'lookup' has not completed, post its LOOKUPDONE event with a
+ *\li	If 'lookup' has not completed, post its LOOKUPDONE event with a
  *	result code of ISC_R_CANCELED.
  *
  * Requires:
  *
- *	'lookup' is a valid lookup.
+ *\li	'lookup' is a valid lookup.
  */
 
 void
 dns_lookup_destroy(dns_lookup_t **lookupp);
-/*
+/*%<
  * Destroy 'lookup'.
  *
  * Requires:
  *
- *	'*lookupp' is a valid lookup.
+ *\li	'*lookupp' is a valid lookup.
  *
- *	The caller has received the LOOKUPDONE event (either because the
+ *\li	The caller has received the LOOKUPDONE event (either because the
  *	lookup completed or because dns_lookup_cancel() was called).
  *
  * Ensures:
  *
- *	*lookupp == NULL.
+ *\li	*lookupp == NULL.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/master.h b/contrib/bind9/lib/dns/include/dns/master.h
index 0b861c6..1f94c8c 100644
--- a/contrib/bind9/lib/dns/include/dns/master.h
+++ b/contrib/bind9/lib/dns/include/dns/master.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: master.h,v 1.31.2.3.2.7 2004/03/08 09:04:36 marka Exp $ */
+/* $Id: master.h,v 1.38.18.6 2005/06/20 01:19:43 marka Exp $ */
 
 #ifndef DNS_MASTER_H
 #define DNS_MASTER_H 1
 
+/*! \file */
+
 /***
  ***	Imports
  ***/
@@ -33,21 +35,60 @@
 /*
  * Flags to be passed in the 'options' argument in the functions below.
  */
-#define	DNS_MASTER_AGETTL 	0x00000001	/* Age the ttl based on $DATE. */
-#define DNS_MASTER_MANYERRORS 	0x00000002	/* Continue processing on errors. */
-#define DNS_MASTER_NOINCLUDE 	0x00000004	/* Disallow $INCLUDE directives. */
-#define DNS_MASTER_ZONE 	0x00000008	/* Loading a zone master file. */
-#define DNS_MASTER_HINT 	0x00000010	/* Loading a hint master file. */
-#define DNS_MASTER_SLAVE 	0x00000020	/* Loading a slave master file. */
-#define DNS_MASTER_CHECKNS 	0x00000040	/* Check NS records to see if
-						 * they are an address */
-#define DNS_MASTER_FATALNS 	0x00000080	/* Treat DNS_MASTER_CHECKNS
-						 * matches as fatal */
+#define	DNS_MASTER_AGETTL 	0x00000001	/*%< Age the ttl based on $DATE. */
+#define DNS_MASTER_MANYERRORS 	0x00000002	/*%< Continue processing on errors. */
+#define DNS_MASTER_NOINCLUDE 	0x00000004	/*%< Disallow $INCLUDE directives. */
+#define DNS_MASTER_ZONE 	0x00000008	/*%< Loading a zone master file. */
+#define DNS_MASTER_HINT 	0x00000010	/*%< Loading a hint master file. */
+#define DNS_MASTER_SLAVE 	0x00000020	/*%< Loading a slave master file. */
+#define DNS_MASTER_CHECKNS 	0x00000040	/*%<
+						 * Check NS records to see 
+						 * if they are an address
+						 */
+#define DNS_MASTER_FATALNS 	0x00000080	/*%<
+						 * Treat DNS_MASTER_CHECKNS
+						 * matches as fatal
+						 */
 #define DNS_MASTER_CHECKNAMES   0x00000100
 #define DNS_MASTER_CHECKNAMESFAIL 0x00000200
+#define DNS_MASTER_CHECKWILDCARD 0x00000400	/* Check for internal wildcards. */
+#define DNS_MASTER_CHECKMX	0x00000800
+#define DNS_MASTER_CHECKMXFAIL	0x00001000
 
 ISC_LANG_BEGINDECLS
 
+/*
+ * Structures that implement the "raw" format for master dump.
+ * These are provided for a reference purpose only; in the actual
+ * encoding, we directly read/write each field so that the encoded data
+ * is always "packed", regardless of the hardware architecture.
+ */
+#define DNS_RAWFORMAT_VERSION 0
+
+/* Common header */
+typedef struct {
+	isc_uint32_t		format;		/* must be
+						 * dns_masterformat_raw */
+	isc_uint32_t		version;	/* compatibility for future
+						 * extensions */
+	isc_uint32_t		dumptime;	/* timestamp on creation
+						 * (currently unused)
+						 */
+} dns_masterrawheader_t;
+
+/* The structure for each RRset */
+typedef struct {
+	isc_uint32_t		totallen;	/* length of the data for this
+						 * RRset, including the
+						 * "header" part */
+	dns_rdataclass_t	rdclass;	/* 16-bit class */
+	dns_rdatatype_t		type;		/* 16-bit type */
+	dns_rdatatype_t		covers;		/* same as type */
+	dns_ttl_t		ttl;		/* 32-bit TTL */
+	isc_uint32_t		nrdata;		/* number of RRs in this set */
+	/* followed by encoded owner name, and then rdata */
+} dns_masterrawrdataset_t;
+
 /***
  ***	Function
  ***/
@@ -62,6 +103,16 @@ dns_master_loadfile(const char *master_file,
 		    isc_mem_t *mctx);
 
 isc_result_t
+dns_master_loadfile2(const char *master_file,
+		     dns_name_t *top,
+		     dns_name_t *origin,
+		     dns_rdataclass_t zclass,
+		     unsigned int options,
+		     dns_rdatacallbacks_t *callbacks,
+		     isc_mem_t *mctx,
+		     dns_masterformat_t format);
+
+isc_result_t
 dns_master_loadstream(FILE *stream,
 		      dns_name_t *top,
 		      dns_name_t *origin,
@@ -100,6 +151,18 @@ dns_master_loadfileinc(const char *master_file,
 		       dns_loadctx_t **ctxp, isc_mem_t *mctx);
 
 isc_result_t
+dns_master_loadfileinc2(const char *master_file,
+			dns_name_t *top,
+			dns_name_t *origin,
+			dns_rdataclass_t zclass,
+			unsigned int options,
+			dns_rdatacallbacks_t *callbacks,
+			isc_task_t *task,
+			dns_loaddonefunc_t done, void *done_arg,
+			dns_loadctx_t **ctxp, isc_mem_t *mctx,
+			dns_masterformat_t format);
+
+isc_result_t
 dns_master_loadstreaminc(FILE *stream,
 			 dns_name_t *top,
 			 dns_name_t *origin,
@@ -132,8 +195,8 @@ dns_master_loadlexerinc(isc_lex_t *lex,
 			dns_loaddonefunc_t done, void *done_arg,
 			dns_loadctx_t **ctxp, isc_mem_t *mctx);
 
-/*
- * Loads a RFC 1305 master file from a file, stream, buffer, or existing
+/*%<
+ * Loads a RFC1305 master file from a file, stream, buffer, or existing
  * lexer into rdatasets and then calls 'callbacks->commit' to commit the
  * rdatasets.  Rdata memory belongs to dns_master_load and will be
  * reused / released when the callback completes.  dns_load_master will
@@ -150,63 +213,63 @@ dns_master_loadlexerinc(isc_lex_t *lex,
  * not called.
  *
  * Requires:
- *	'master_file' points to a valid string.
- *	'lexer' points to a valid lexer.
- *	'top' points to a valid name.
- *	'origin' points to a valid name.
- *	'callbacks->commit' points to a valid function.
- *	'callbacks->error' points to a valid function.
- *	'callbacks->warn' points to a valid function.
- *	'mctx' points to a valid memory context.
- *	'task' and 'done' to be valid.
- *	'lmgr' to be valid.
- *	'ctxp != NULL && ctxp == NULL'.
+ *\li	'master_file' points to a valid string.
+ *\li	'lexer' points to a valid lexer.
+ *\li	'top' points to a valid name.
+ *\li	'origin' points to a valid name.
+ *\li	'callbacks->commit' points to a valid function.
+ *\li	'callbacks->error' points to a valid function.
+ *\li	'callbacks->warn' points to a valid function.
+ *\li	'mctx' points to a valid memory context.
+ *\li	'task' and 'done' to be valid.
+ *\li	'lmgr' to be valid.
+ *\li	'ctxp != NULL && ctxp == NULL'.
  *
  * Returns:
- *	ISC_R_SUCCESS upon successfully loading the master file.
- *	ISC_R_SEENINCLUDE upon successfully loading the master file with
+ *\li	ISC_R_SUCCESS upon successfully loading the master file.
+ *\li	ISC_R_SEENINCLUDE upon successfully loading the master file with
  *		a $INCLUDE statement.
- *	ISC_R_NOMEMORY out of memory.
- *	ISC_R_UNEXPECTEDEND expected to be able to read a input token and
+ *\li	ISC_R_NOMEMORY out of memory.
+ *\li	ISC_R_UNEXPECTEDEND expected to be able to read a input token and
  *		there was not one.
- *	ISC_R_UNEXPECTED
- *	DNS_R_NOOWNER failed to specify a ownername.
- *	DNS_R_NOTTL failed to specify a ttl.
- *	DNS_R_BADCLASS record class did not match zone class.
- *	DNS_R_CONTINUE load still in progress (dns_master_load*inc() only).
- *	Any dns_rdata_fromtext() error code.
- *	Any error code from callbacks->commit().
+ *\li	ISC_R_UNEXPECTED
+ *\li	DNS_R_NOOWNER failed to specify a ownername.
+ *\li	DNS_R_NOTTL failed to specify a ttl.
+ *\li	DNS_R_BADCLASS record class did not match zone class.
+ *\li	DNS_R_CONTINUE load still in progress (dns_master_load*inc() only).
+ *\li	Any dns_rdata_fromtext() error code.
+ *\li	Any error code from callbacks->commit().
  */
 
 void
 dns_loadctx_detach(dns_loadctx_t **ctxp);
-/*
+/*%<
  * Detach from the load context.
  *
  * Requires:
- *	'*ctxp' to be valid.
+ *\li	'*ctxp' to be valid.
  *
  * Ensures:
- *	'*ctxp == NULL'
+ *\li	'*ctxp == NULL'
  */
 
 void
 dns_loadctx_attach(dns_loadctx_t *source, dns_loadctx_t **target);
-/*
+/*%<
  * Attach to the load context.
  *
  * Requires:
- *	'source' to be valid.
- *	'target != NULL && *target == NULL'.
+ *\li	'source' to be valid.
+ *\li	'target != NULL && *target == NULL'.
  */
 
 void
 dns_loadctx_cancel(dns_loadctx_t *ctx);
-/*
+/*%<
  * Cancel loading the zone file associated with this load context.
  *
  * Requires:
- *	'ctx' to be valid
+ *\li	'ctx' to be valid
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/masterdump.h b/contrib/bind9/lib/dns/include/dns/masterdump.h
index 888c588..8cf5c13 100644
--- a/contrib/bind9/lib/dns/include/dns/masterdump.h
+++ b/contrib/bind9/lib/dns/include/dns/masterdump.h
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: masterdump.h,v 1.22.12.10 2005/09/06 02:12:41 marka Exp $ */
+/* $Id: masterdump.h,v 1.31.14.4 2005/09/01 03:04:28 marka Exp $ */
 
 #ifndef DNS_MASTERDUMP_H
 #define DNS_MASTERDUMP_H 1
 
+/*! \file */
+
 /***
  ***	Imports
  ***/
@@ -46,10 +48,10 @@ typedef struct dns_master_style dns_master_style_t;
  * rdata.h.
  */
 
-/* Omit the owner name when possible. */
+/*% Omit the owner name when possible. */
 #define	DNS_STYLEFLAG_OMIT_OWNER        0x00010000U
 
-/*
+/*%
  * Omit the TTL when possible.  If DNS_STYLEFLAG_TTL is
  * also set, this means no TTLs are ever printed
  * because $TTL directives are generated before every
@@ -67,32 +69,32 @@ typedef struct dns_master_style dns_master_style_t;
  */
 #define	DNS_STYLEFLAG_OMIT_TTL		0x00020000U
 
-/* Omit the class when possible. */
+/*% Omit the class when possible. */
 #define	DNS_STYLEFLAG_OMIT_CLASS	0x00040000U
 
-/* Output $TTL directives. */
+/*% Output $TTL directives. */
 #define	DNS_STYLEFLAG_TTL		0x00080000U
 
-/*
+/*%
  * Output $ORIGIN directives and print owner names relative to
  * the origin when possible.
  */
 #define	DNS_STYLEFLAG_REL_OWNER		0x00100000U
 
-/* Print domain names in RR data in relative form when possible.
+/*% Print domain names in RR data in relative form when possible.
    For this to take effect, DNS_STYLEFLAG_REL_OWNER must also be set. */
 #define	DNS_STYLEFLAG_REL_DATA		0x00200000U
 
-/* Print the trust level of each rdataset. */
+/*% Print the trust level of each rdataset. */
 #define	DNS_STYLEFLAG_TRUST		0x00400000U
 
-/* Print negative caching entries. */
+/*% Print negative caching entries. */
 #define	DNS_STYLEFLAG_NCACHE		0x00800000U
 
-/* Never print the TTL */
+/*% Never print the TTL */
 #define	DNS_STYLEFLAG_NO_TTL		0x01000000U
                     
-/* Never print the CLASS */
+/*% Never print the CLASS */
 #define	DNS_STYLEFLAG_NO_CLASS		0x02000000U 
 
 ISC_LANG_BEGINDECLS
@@ -101,7 +103,7 @@ ISC_LANG_BEGINDECLS
  ***	Constants
  ***/
 
-/*
+/*%
  * The default master file style.
  *
  * This uses $TTL directives to avoid the need to dedicate a
@@ -110,13 +112,13 @@ ISC_LANG_BEGINDECLS
  */
 LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_default;
 
-/*
+/*%
  * A master file style that dumps zones to a very generic format easily
  * imported/checked with external tools.
  */
 LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_full;
 
-/*
+/*%
  * A master file style that prints explicit TTL values on each 
  * record line, never using $TTL statements.  The TTL has a tab 
  * stop of its own, but the class and type share one.
@@ -124,13 +126,13 @@ LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_full;
 LIBDNS_EXTERNAL_DATA extern const dns_master_style_t
 					dns_master_style_explicitttl;
 
-/*
+/*%
  * A master style format designed for cache files.  It prints explicit TTL
  * values on each record line and never uses $ORIGIN or relative names.
  */
 LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_cache;
 
-/*
+/*%
  * A master style that prints name, ttl, class, type, and value on 
  * every line.  Similar to explicitttl above, but more verbose.  
  * Intended for generating master files which can be easily parsed 
@@ -138,7 +140,7 @@ LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_cache;
  */
 LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_simple;
 
-/*
+/*%
  * The style used for debugging, "dig" output, etc.
  */
 LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_debug;
@@ -149,54 +151,55 @@ LIBDNS_EXTERNAL_DATA extern const dns_master_style_t dns_master_style_debug;
 
 void
 dns_dumpctx_attach(dns_dumpctx_t *source, dns_dumpctx_t **target);
-/*
+/*%<
  * Attach to a dump context.
  *
  * Require:
- *	'source' to be valid.
- *	'target' to be non NULL and '*target' to be NULL.
+ *\li	'source' to be valid.
+ *\li	'target' to be non NULL and '*target' to be NULL.
  */
 
 void
 dns_dumpctx_detach(dns_dumpctx_t **dctxp);
-/*
+/*%<
  * Detach from a dump context.
  *
  * Require:
- *	'dctxp' to point to a valid dump context.
+ *\li	'dctxp' to point to a valid dump context.
  *
  * Ensures:
- *	'*dctxp' is NULL.
+ *\li	'*dctxp' is NULL.
  */
 
 void
 dns_dumpctx_cancel(dns_dumpctx_t *dctx);
-/*
+/*%<
  * Cancel a in progress dump.
  *
  * Require:
- *	'dctx' to be valid.
+ *\li	'dctx' to be valid.
  */
 
 dns_dbversion_t *
 dns_dumpctx_version(dns_dumpctx_t *dctx);
-/*
+/*%<
  * Return the version handle (if any) of the database being dumped.
  *
  * Require:
- *	'dctx' to be valid.
+ *\li	'dctx' to be valid.
  */
 
 dns_db_t *
 dns_dumpctx_db(dns_dumpctx_t *dctx);
-/*
+/*%<
  * Return the database being dumped.
  *
  * Require:
- *	'dctx' to be valid.
+ *\li	'dctx' to be valid.
  */
 
 
+/*@{*/
 isc_result_t
 dns_master_dumptostreaminc(isc_mem_t *mctx, dns_db_t *db,
 			   dns_dbversion_t *version,
@@ -208,26 +211,37 @@ isc_result_t
 dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db,
 			dns_dbversion_t *version,
 			const dns_master_style_t *style, FILE *f);
-/*
- * Dump the database 'db' to the steam 'f' in RFC1035 master
- * file format, in the style defined by 'style'
- * (e.g., &dns_default_master_style_default)
+
+isc_result_t
+dns_master_dumptostream2(isc_mem_t *mctx, dns_db_t *db,
+			 dns_dbversion_t *version,
+			 const dns_master_style_t *style,
+			 dns_masterformat_t format, FILE *f);
+/*%<
+ * Dump the database 'db' to the steam 'f' in the specified format by
+ * 'format'.  If the format is dns_masterformat_text (the RFC1035 format),
+ * 'style' specifies the file style (e.g., &dns_master_style_default).
+ *
+ * dns_master_dumptostream() is an old form of dns_master_dumptostream2(),
+ * which always specifies the dns_masterformat_text format.
  *
  * Temporary dynamic memory may be allocated from 'mctx'.
  *
  * Require:
- *	'task' to be valid.
- *	'done' to be non NULL.
- *	'dctxp' to be non NULL && '*dctxp' to be NULL.
+ *\li	'task' to be valid.
+ *\li	'done' to be non NULL.
+ *\li	'dctxp' to be non NULL && '*dctxp' to be NULL.
  * 
  * Returns:
- *	ISC_R_SUCCESS
- *	DNS_R_CONTINUE	dns_master_dumptostreaminc() only.
- *	ISC_R_NOMEMORY
- * 	Any database or rrset iterator error.
- *	Any dns_rdata_totext() error code.
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_CONTINUE	dns_master_dumptostreaminc() only.
+ *\li	ISC_R_NOMEMORY
+ *\li	Any database or rrset iterator error.
+ *\li	Any dns_rdata_totext() error code.
  */
+/*@}*/
 
+/*@{*/
 isc_result_t
 dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		   const dns_master_style_t *style, const char *filename,
@@ -235,39 +249,56 @@ dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		   dns_dumpctx_t **dctxp);
 
 isc_result_t
+dns_master_dumpinc2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
+		    const dns_master_style_t *style, const char *filename,
+		    isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,			    dns_dumpctx_t **dctxp, dns_masterformat_t format);
+
+isc_result_t
 dns_master_dump(isc_mem_t *mctx, dns_db_t *db,
 		dns_dbversion_t *version,
 		const dns_master_style_t *style, const char *filename);
-/*
- * Dump the database 'db' to the file 'filename' in RFC1035 master
- * file format, in the style defined by 'style'
- * (e.g., &dns_default_master_style_default)
+
+isc_result_t
+dns_master_dump2(isc_mem_t *mctx, dns_db_t *db,
+		 dns_dbversion_t *version,
+		 const dns_master_style_t *style, const char *filename,
+		 dns_masterformat_t format);
+
+/*%<
+ * Dump the database 'db' to the file 'filename' in the specified format by
+ * 'format'.  If the format is dns_masterformat_text (the RFC1035 format),
+ * 'style' specifies the file style (e.g., &dns_master_style_default).
+ *
+ * dns_master_dumpinc() and dns_master_dump() are old forms of _dumpinc2()
+ * and _dump2(), respectively, which always specify the dns_masterformat_text
+ * format.
  *
  * Temporary dynamic memory may be allocated from 'mctx'.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	DNS_R_CONTINUE	dns_master_dumpinc() only.
- *	ISC_R_NOMEMORY
- * 	Any database or rrset iterator error.
- *	Any dns_rdata_totext() error code.
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_CONTINUE	dns_master_dumpinc() only.
+ *\li	ISC_R_NOMEMORY
+ *\li	Any database or rrset iterator error.
+ *\li	Any dns_rdata_totext() error code.
  */
+/*@}*/
 
 isc_result_t
 dns_master_rdatasettotext(dns_name_t *owner_name,
 			  dns_rdataset_t *rdataset,
 			  const dns_master_style_t *style,
 			  isc_buffer_t *target);
-/*
+/*%<
  * Convert 'rdataset' to text format, storing the result in 'target'.
  *
  * Notes:
- *	The rdata cursor position will be changed.
+ *\li	The rdata cursor position will be changed.
  *
  * Requires:
- *	'rdataset' is a valid non-question rdataset.
+ *\li	'rdataset' is a valid non-question rdataset.
  *
- *	'rdataset' is not empty.
+ *\li	'rdataset' is not empty.
  */
 
 isc_result_t
diff --git a/contrib/bind9/lib/dns/include/dns/message.h b/contrib/bind9/lib/dns/include/dns/message.h
index 960c11a..9002b83 100644
--- a/contrib/bind9/lib/dns/include/dns/message.h
+++ b/contrib/bind9/lib/dns/include/dns/message.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.h,v 1.100.2.3.8.10 2006/02/28 06:32:54 marka Exp $ */
+/* $Id: message.h,v 1.114.18.6 2006/03/02 23:19:20 marka Exp $ */
 
 #ifndef DNS_MESSAGE_H
 #define DNS_MESSAGE_H 1
@@ -33,7 +33,9 @@
 
 #include <dst/dst.h>
 
-/*
+/*! \file 
+ * \brief Message Handling Module
+ *
  * How this beast works:
  *
  * When a dns message is received in a buffer, dns_message_fromwire() is called
@@ -54,9 +56,9 @@
  * one of two ways.  Assume a name was allocated via
  * dns_message_gettempname():
  *
- *	(1) insert it into a section, using dns_message_addname().
+ *\li	(1) insert it into a section, using dns_message_addname().
  *
- *	(2) return it to the message using dns_message_puttempname().
+ *\li	(2) return it to the message using dns_message_puttempname().
  *
  * The same applies to rdatasets.
  *
@@ -74,6 +76,7 @@
  * Since the buffer itself exists until the message is destroyed, this sort
  * of code can be written:
  *
+ * \code
  *	buffer = isc_buffer_allocate(mctx, 512);
  *	name = NULL;
  *	name = dns_message_gettempname(message, &name);
@@ -81,6 +84,7 @@
  *	result = dns_name_fromtext(name, &source, dns_rootname, ISC_FALSE,
  *				   buffer);
  *	dns_message_takebuffer(message, &buffer);
+ * \endcode
  *
  *
  * TODO:
@@ -102,7 +106,7 @@
 #define DNS_MESSAGE_REPLYPRESERVE	(DNS_MESSAGEFLAG_RD|DNS_MESSAGEFLAG_CD)
 #define DNS_MESSAGEEXTFLAG_REPLYPRESERVE (DNS_MESSAGEEXTFLAG_DO)
 
-#define DNS_MESSAGE_HEADERLEN		12 /* 6 isc_uint16_t's */
+#define DNS_MESSAGE_HEADERLEN		12 /*%< 6 isc_uint16_t's */
 
 #define DNS_MESSAGE_MAGIC		ISC_MAGIC('M','S','G','@')
 #define DNS_MESSAGE_VALID(msg)		ISC_MAGIC_VALID(msg, DNS_MESSAGE_MAGIC)
@@ -140,32 +144,32 @@ typedef int dns_messagetextflag_t;
 /*
  * These tell the message library how the created dns_message_t will be used.
  */
-#define DNS_MESSAGE_INTENTUNKNOWN	0 /* internal use only */
-#define DNS_MESSAGE_INTENTPARSE		1 /* parsing messages */
-#define DNS_MESSAGE_INTENTRENDER	2 /* rendering */
+#define DNS_MESSAGE_INTENTUNKNOWN	0 /*%< internal use only */
+#define DNS_MESSAGE_INTENTPARSE		1 /*%< parsing messages */
+#define DNS_MESSAGE_INTENTRENDER	2 /*%< rendering */
 
 /*
  * Control behavior of parsing
  */
-#define DNS_MESSAGEPARSE_PRESERVEORDER	0x0001	/* preserve rdata order */
-#define DNS_MESSAGEPARSE_BESTEFFORT	0x0002	/* return a message if a
+#define DNS_MESSAGEPARSE_PRESERVEORDER	0x0001	/*%< preserve rdata order */
+#define DNS_MESSAGEPARSE_BESTEFFORT	0x0002	/*%< return a message if a
 						   recoverable parse error
 						   occurs */
-#define DNS_MESSAGEPARSE_CLONEBUFFER	0x0004	/* save a copy of the
+#define DNS_MESSAGEPARSE_CLONEBUFFER	0x0004	/*%< save a copy of the
 						   source buffer */
-#define DNS_MESSAGEPARSE_IGNORETRUNCATION 0x0008 /* trucation errors are
+#define DNS_MESSAGEPARSE_IGNORETRUNCATION 0x0008 /*%< trucation errors are
 						  * not fatal. */
 
 /*
  * Control behavior of rendering
  */
-#define DNS_MESSAGERENDER_ORDERED	0x0001	/* don't change order */
-#define DNS_MESSAGERENDER_PARTIAL	0x0002	/* allow a partial rdataset */
-#define DNS_MESSAGERENDER_OMITDNSSEC	0x0004	/* omit DNSSEC records */
-#define DNS_MESSAGERENDER_PREFER_A	0x0008	/* prefer A records in
-						 * additional section. */
-#define DNS_MESSAGERENDER_PREFER_AAAA	0x0010	/* prefer AAAA records in
-						 * additional section. */
+#define DNS_MESSAGERENDER_ORDERED	0x0001	/*%< don't change order */
+#define DNS_MESSAGERENDER_PARTIAL	0x0002	/*%< allow a partial rdataset */
+#define DNS_MESSAGERENDER_OMITDNSSEC	0x0004	/*%< omit DNSSEC records */
+#define DNS_MESSAGERENDER_PREFER_A	0x0008	/*%< prefer A records in
+						      additional section. */
+#define DNS_MESSAGERENDER_PREFER_AAAA	0x0010	/*%< prefer AAAA records in
+						  additional section. */
 
 typedef struct dns_msgblock dns_msgblock_t;
 
@@ -248,32 +252,32 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 dns_message_create(isc_mem_t *mctx, unsigned int intent, dns_message_t **msgp);
 
-/*
+/*%<
  * Create msg structure.
  *
  * This function will allocate some internal blocks of memory that are
  * expected to be needed for parsing or rendering nearly any type of message.
  *
  * Requires:
- *	'mctx' be a valid memory context.
+ *\li	'mctx' be a valid memory context.
  *
- *	'msgp' be non-null and '*msg' be NULL.
+ *\li	'msgp' be non-null and '*msg' be NULL.
  *
- *	'intent' must be one of DNS_MESSAGE_INTENTPARSE or
- *	DNS_MESSAGE_INTENTRENDER.
+ *\li	'intent' must be one of DNS_MESSAGE_INTENTPARSE or
+ *	#DNS_MESSAGE_INTENTRENDER.
  *
  * Ensures:
- *	The data in "*msg" is set to indicate an unused and empty msg
+ *\li	The data in "*msg" is set to indicate an unused and empty msg
  *	structure.
  *
  * Returns:
- *	ISC_R_NOMEMORY		-- out of memory
- *	ISC_R_SUCCESS		-- success
+ *\li	#ISC_R_NOMEMORY		-- out of memory
+ *\li	#ISC_R_SUCCESS		-- success
  */
 
 void
 dns_message_reset(dns_message_t *msg, unsigned int intent);
-/*
+/*%<
  * Reset a message structure to default state.  All internal lists are freed
  * or reset to a default state as well.  This is simply a more efficient
  * way to call dns_message_destroy() followed by dns_message_allocate(),
@@ -286,22 +290,22 @@ dns_message_reset(dns_message_t *msg, unsigned int intent);
  *
  * Requires:
  *
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	'intent' is DNS_MESSAGE_INTENTPARSE or DNS_MESSAGE_INTENTRENDER
+ *\li	'intent' is DNS_MESSAGE_INTENTPARSE or DNS_MESSAGE_INTENTRENDER
  */
 
 void
 dns_message_destroy(dns_message_t **msgp);
-/*
+/*%<
  * Destroy all state in the message.
  *
  * Requires:
  *
- *	'msgp' be valid.
+ *\li	'msgp' be valid.
  *
  * Ensures:
- *	'*msgp' == NULL
+ *\li	'*msgp' == NULL
  */
 
 isc_result_t
@@ -316,85 +320,83 @@ dns_message_pseudosectiontotext(dns_message_t *msg,
 				const dns_master_style_t *style,
 				dns_messagetextflag_t flags,
 				isc_buffer_t *target);
-/*
+/*%<
  * Convert section 'section' or 'pseudosection' of message 'msg' to
  * a cleartext representation
  *
  * Notes:
- *      See dns_message_totext for meanings of flags.
+ *     \li See dns_message_totext for meanings of flags.
  *
  * Requires:
  *
- *	'msg' is a valid message.
+ *\li	'msg' is a valid message.
  *
- *	'style' is a valid master dump style.
+ *\li	'style' is a valid master dump style.
  *
- *	'target' is a valid buffer.
+ *\li	'target' is a valid buffer.
  *
- *	'section' is a valid section label.
+ *\li	'section' is a valid section label.
  *
  * Ensures:
  *
- *	If the result is success:
- *
+ *\li	If the result is success:
  *		The used space in 'target' is updated.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
- *	ISC_R_NOMORE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
+ *\li	#ISC_R_NOMORE
  *
- *	Note: On error return, *target may be partially filled with data.
+ *\li	Note: On error return, *target may be partially filled with data.
 */
 
 isc_result_t
 dns_message_totext(dns_message_t *msg, const dns_master_style_t *style,
 		   dns_messagetextflag_t flags, isc_buffer_t *target);
-/*
+/*%<
  * Convert all sections of message 'msg' to a cleartext representation
  *
  * Notes:
- *      In flags, If DNS_MESSAGETEXTFLAG_OMITDOT is set, then the
+ * \li     In flags, If #DNS_MESSAGETEXTFLAG_OMITDOT is set, then the
  *      final '.' in absolute names will not be emitted.  If
- *      DNS_MESSAGETEXTFLAG_NOCOMMENTS is cleared, lines beginning
+ *      #DNS_MESSAGETEXTFLAG_NOCOMMENTS is cleared, lines beginning
  *      with ";;" will be emitted indicating section name.  If
- *      DNS_MESSAGETEXTFLAG_NOHEADERS is cleared, header lines will
+ *      #DNS_MESSAGETEXTFLAG_NOHEADERS is cleared, header lines will
  *      be emitted.
  *
  * Requires:
  *
- *	'msg' is a valid message.
+ *\li	'msg' is a valid message.
  *
- *	'style' is a valid master dump style.
+ *\li	'style' is a valid master dump style.
  *
- *	'target' is a valid buffer.
+ *\li	'target' is a valid buffer.
  *
  * Ensures:
  *
- *	If the result is success:
- *
+ *\li	If the result is success:
  *		The used space in 'target' is updated.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
- *	ISC_R_NOMORE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
+ *\li	#ISC_R_NOMORE
  *
- *	Note: On error return, *target may be partially filled with data.
+ *\li	Note: On error return, *target may be partially filled with data.
  */
 
 isc_result_t
 dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 		  unsigned int options);
-/*
+/*%<
  * Parse raw wire data in 'source' as a DNS message.
  *
  * OPT records are detected and stored in the pseudo-section "opt".
  * TSIGs are detected and stored in the pseudo-section "tsig".
  *
- * If DNS_MESSAGEPARSE_PRESERVEORDER is set, or if the opcode of the message
+ * If #DNS_MESSAGEPARSE_PRESERVEORDER is set, or if the opcode of the message
  * is UPDATE, a separate dns_name_t object will be created for each RR in the
  * message.  Each such dns_name_t will have a single rdataset containing the
  * single RR, and the order of the RRs in the message is preserved.
@@ -403,39 +405,39 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
  * of rdatasets.  To access the names and their data, use
  * dns_message_firstname() and dns_message_nextname().
  *
- * If DNS_MESSAGEPARSE_BESTEFFORT is set, errors in message content will
+ * If #DNS_MESSAGEPARSE_BESTEFFORT is set, errors in message content will
  * not be considered FORMERRs.  If the entire message can be parsed, it
  * will be returned and DNS_R_RECOVERABLE will be returned.
  *
- * If DNS_MESSAGEPARSE_IGNORETRUNCATION is set then return as many complete
+ * If #DNS_MESSAGEPARSE_IGNORETRUNCATION is set then return as many complete
  * RR's as possible, DNS_R_RECOVERABLE will be returned.
  *
  * OPT and TSIG records are always handled specially, regardless of the
  * 'preserve_order' setting.
  *
  * Requires:
- *	"msg" be valid.
+ *\li	"msg" be valid.
  *
- *	"buffer" be a wire format buffer.
+ *\li	"buffer" be a wire format buffer.
  *
  * Ensures:
- *	The buffer's data format is correct.
+ *\li	The buffer's data format is correct.
  *
- *	The buffer's contents verify as correct regarding header bits, buffer
+ *\li	The buffer's contents verify as correct regarding header bits, buffer
  * 	and rdata sizes, etc.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- all is well
- *	ISC_R_NOMEMORY		-- no memory
- *	DNS_R_RECOVERABLE	-- the message parsed properly, but contained
+ *\li	#ISC_R_SUCCESS		-- all is well
+ *\li	#ISC_R_NOMEMORY		-- no memory
+ *\li	#DNS_R_RECOVERABLE	-- the message parsed properly, but contained
  *				   errors.
- *	Many other errors possible XXXMLG
+ *\li	Many other errors possible XXXMLG
  */
 
 isc_result_t
 dns_message_renderbegin(dns_message_t *msg, dns_compress_t *cctx,
 			isc_buffer_t *buffer);
-/*
+/*%<
  * Begin rendering on a message.  Only one call can be made to this function
  * per message.
  *
@@ -447,24 +449,24 @@ dns_message_renderbegin(dns_message_t *msg, dns_compress_t *cctx,
  *
  * Requires:
  *
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	'cctx' be valid.
+ *\li	'cctx' be valid.
  *
- *	'buffer' is a valid buffer.
+ *\li	'buffer' is a valid buffer.
  *
  * Side Effects:
  *
- *	The buffer is cleared before it is used.
+ *\li	The buffer is cleared before it is used.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- all is well
- *	ISC_R_NOSPACE		-- output buffer is too small
+ *\li	#ISC_R_SUCCESS		-- all is well
+ *\li	#ISC_R_NOSPACE		-- output buffer is too small
  */
 
 isc_result_t
 dns_message_renderchangebuffer(dns_message_t *msg, isc_buffer_t *buffer);
-/*
+/*%<
  * Reset the buffer.  This can be used after growing the old buffer
  * on a ISC_R_NOSPACE return from most of the render functions.
  *
@@ -474,20 +476,20 @@ dns_message_renderchangebuffer(dns_message_t *msg, isc_buffer_t *buffer);
  *
  * Requires:
  *
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	dns_message_renderbegin() was called.
+ *\li	dns_message_renderbegin() was called.
  *
- *	buffer != NULL.
+ *\li	buffer != NULL.
  *
  * Returns:
- *	ISC_R_NOSPACE		-- new buffer is too small
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_NOSPACE		-- new buffer is too small
+ *\li	#ISC_R_SUCCESS		-- all is well.
  */
 
 isc_result_t
 dns_message_renderreserve(dns_message_t *msg, unsigned int space);
-/*
+/*%<
  * XXXMLG should use size_t rather than unsigned int once the buffer
  * API is cleaned up
  *
@@ -495,18 +497,18 @@ dns_message_renderreserve(dns_message_t *msg, unsigned int space);
  *
  * Requires:
  *
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	dns_message_renderbegin() was called.
+ *\li	dns_message_renderbegin() was called.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- all is well.
- *	ISC_R_NOSPACE		-- not enough free space in the buffer.
+ *\li	#ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_NOSPACE		-- not enough free space in the buffer.
  */
 
 void
 dns_message_renderrelease(dns_message_t *msg, unsigned int space);
-/*
+/*%<
  * XXXMLG should use size_t rather than unsigned int once the buffer
  * API is cleaned up
  *
@@ -514,87 +516,87 @@ dns_message_renderrelease(dns_message_t *msg, unsigned int space);
  *
  * Requires:
  *
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	'space' is less than or equal to the total amount of space reserved
+ *\li	'space' is less than or equal to the total amount of space reserved
  *	via prior calls to dns_message_renderreserve().
  *
- *	dns_message_renderbegin() was called.
+ *\li	dns_message_renderbegin() was called.
  */
 
 isc_result_t
 dns_message_rendersection(dns_message_t *msg, dns_section_t section,
 			  unsigned int options);
-/*
+/*%<
  * Render all names, rdatalists, etc from the given section at the
  * specified priority or higher.
  *
  * Requires:
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	'section' be a valid section.
+ *\li	'section' be a valid section.
  *
- *	dns_message_renderbegin() was called.
+ *\li	dns_message_renderbegin() was called.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- all records were written, and there are
+ *\li	#ISC_R_SUCCESS		-- all records were written, and there are
  *				   no more records for this section.
- *	ISC_R_NOSPACE		-- Not enough room in the buffer to write
+ *\li	#ISC_R_NOSPACE		-- Not enough room in the buffer to write
  *				   all records requested.
- *	DNS_R_MOREDATA		-- All requested records written, and there
+ *\li	#DNS_R_MOREDATA		-- All requested records written, and there
  *				   are records remaining for this section.
  */
 
 void
 dns_message_renderheader(dns_message_t *msg, isc_buffer_t *target);
-/*
+/*%<
  * Render the message header.  This is implicitly called by
  * dns_message_renderend().
  *
  * Requires:
  *
- *	'msg' be a valid message.
+ *\li	'msg' be a valid message.
  *
- *	dns_message_renderbegin() was called.
+ *\li	dns_message_renderbegin() was called.
  *
- *	'target' is a valid buffer with enough space to hold a message header
+ *\li	'target' is a valid buffer with enough space to hold a message header
  */
 
 isc_result_t
 dns_message_renderend(dns_message_t *msg);
-/*
+/*%<
  * Finish rendering to the buffer.  Note that more data can be in the
  * 'msg' structure.  Destroying the structure will free this, or in a multi-
  * part EDNS1 message this data can be rendered to another buffer later.
  *
  * Requires:
  *
- *	'msg' be a valid message.
+ *\li	'msg' be a valid message.
  *
- *	dns_message_renderbegin() was called.
+ *\li	dns_message_renderbegin() was called.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_SUCCESS		-- all is well.
  */
 
 void
 dns_message_renderreset(dns_message_t *msg);
-/*
+/*%<
  * Reset the message so that it may be rendered again.
  *
  * Notes:
  *
- *	If dns_message_renderbegin() has been called, dns_message_renderend()
+ *\li	If dns_message_renderbegin() has been called, dns_message_renderend()
  *	must be called before calling this function.
  *
  * Requires:
  *
- *	'msg' be a valid message with rendering intent.
+ *\li	'msg' be a valid message with rendering intent.
  */
 
 isc_result_t
 dns_message_firstname(dns_message_t *msg, dns_section_t section);
-/*
+/*%<
  * Set internal per-section name pointer to the beginning of the section.
  *
  * The functions dns_message_firstname() and dns_message_nextname() may
@@ -602,39 +604,39 @@ dns_message_firstname(dns_message_t *msg, dns_section_t section);
  *
  * Requires:
  *
- *   	'msg' be valid.
+ *\li   	'msg' be valid.
  *
- *	'section' be a valid section.
+ *\li	'section' be a valid section.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- All is well.
- *	ISC_R_NOMORE		-- No names on given section.
+ *\li	#ISC_R_SUCCESS		-- All is well.
+ *\li	#ISC_R_NOMORE		-- No names on given section.
  */
 
 isc_result_t
 dns_message_nextname(dns_message_t *msg, dns_section_t section);
-/*
+/*%<
  * Sets the internal per-section name pointer to point to the next name
  * in that section.
  *
  * Requires:
  *
- *   	'msg' be valid.
+ * \li  	'msg' be valid.
  *
- *	'section' be a valid section.
+ *\li	'section' be a valid section.
  *
- *	dns_message_firstname() must have been called on this section,
+ *\li	dns_message_firstname() must have been called on this section,
  *	and the result was ISC_R_SUCCESS.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- All is well.
- *	ISC_R_NOMORE		-- No more names in given section.
+ *\li	#ISC_R_SUCCESS		-- All is well.
+ *\li	#ISC_R_NOMORE		-- No more names in given section.
  */
 
 void
 dns_message_currentname(dns_message_t *msg, dns_section_t section,
 			dns_name_t **name);
-/*
+/*%<
  * Sets 'name' to point to the name where the per-section internal name
  * pointer is currently set.
  *
@@ -643,15 +645,15 @@ dns_message_currentname(dns_message_t *msg, dns_section_t section,
  *
  * Requires:
  *
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	'name' be non-NULL, and *name be NULL.
+ *\li	'name' be non-NULL, and *name be NULL.
  *
- *	'section' be a valid section.
+ *\li	'section' be a valid section.
  *
- *	dns_message_firstname() must have been called on this section,
+ *\li	dns_message_firstname() must have been called on this section,
  *	and the result of it and any dns_message_nextname() calls was
- *	ISC_R_SUCCESS.
+ *	#ISC_R_SUCCESS.
  */
 
 isc_result_t
@@ -659,55 +661,55 @@ dns_message_findname(dns_message_t *msg, dns_section_t section,
 		     dns_name_t *target, dns_rdatatype_t type,
 		     dns_rdatatype_t covers, dns_name_t **foundname,
 		     dns_rdataset_t **rdataset);
-/*
+/*%<
  * Search for a name in the specified section.  If it is found, *name is
  * set to point to the name, and *rdataset is set to point to the found
  * rdataset (if type is specified as other than dns_rdatatype_any).
  *
  * Requires:
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	'section' be a valid section.
+ *\li	'section' be a valid section.
  *
- *	If a pointer to the name is desired, 'foundname' should be non-NULL.
+ *\li	If a pointer to the name is desired, 'foundname' should be non-NULL.
  *	If it is non-NULL, '*foundname' MUST be NULL.
  *
- *	If a type other than dns_datatype_any is searched for, 'rdataset'
+ *\li	If a type other than dns_datatype_any is searched for, 'rdataset'
  *	may be non-NULL, '*rdataset' be NULL, and will point at the found
  *	rdataset.  If the type is dns_datatype_any, 'rdataset' must be NULL.
  *
- *	'target' be a valid name.
+ *\li	'target' be a valid name.
  *
- *	'type' be a valid type.
+ *\li	'type' be a valid type.
  *
- *	If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type.
+ *\li	If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type.
  *	Otherwise it should be 0.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- all is well.
- *	DNS_R_NXDOMAIN		-- name does not exist in that section.
- *	DNS_R_NXRRSET		-- The name does exist, but the desired
+ *\li	#ISC_R_SUCCESS		-- all is well.
+ *\li	#DNS_R_NXDOMAIN		-- name does not exist in that section.
+ *\li	#DNS_R_NXRRSET		-- The name does exist, but the desired
  *				   type does not.
  */
 
 isc_result_t
 dns_message_findtype(dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdatatype_t covers, dns_rdataset_t **rdataset);
-/*
+/*%<
  * Search the name for the specified type.  If it is found, *rdataset is
  * filled in with a pointer to that rdataset.
  *
  * Requires:
- *	if '**rdataset' is non-NULL, *rdataset needs to be NULL.
+ *\li	if '**rdataset' is non-NULL, *rdataset needs to be NULL.
  *
- *	'type' be a valid type, and NOT dns_rdatatype_any.
+ *\li	'type' be a valid type, and NOT dns_rdatatype_any.
  *
- *	If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type.
+ *\li	If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type.
  *	Otherwise it should be 0.
  *
  * Returns:
- *	ISC_R_SUCCESS		-- all is well.
- *	ISC_R_NOTFOUND		-- the desired type does not exist.
+ *\li	#ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_NOTFOUND		-- the desired type does not exist.
  */
 
 isc_result_t
@@ -735,24 +737,24 @@ void
 dns_message_movename(dns_message_t *msg, dns_name_t *name,
 		     dns_section_t fromsection,
 		     dns_section_t tosection);
-/*
+/*%<
  * Move a name from one section to another.
  *
  * Requires:
  *
- *	'msg' be valid.
+ *\li	'msg' be valid.
  *
- *	'name' must be a name already in 'fromsection'.
+ *\li	'name' must be a name already in 'fromsection'.
  *
- *	'fromsection' must be a valid section.
+ *\li	'fromsection' must be a valid section.
  *
- *	'tosection' must be a valid section.
+ *\li	'tosection' must be a valid section.
  */
 
 void
 dns_message_addname(dns_message_t *msg, dns_name_t *name,
 		    dns_section_t section);
-/*
+/*%<
  * Adds the name to the given section.
  *
  * It is the caller's responsibility to enforce any unique name requirements
@@ -760,13 +762,32 @@ dns_message_addname(dns_message_t *msg, dns_name_t *name,
  *
  * Requires:
  *
- *	'msg' be valid, and be a renderable message.
+ *\li	'msg' be valid, and be a renderable message.
+ *
+ *\li	'name' be a valid absolute name.
+ *
+ *\li	'section' be a named section.
+ */
+
+void
+dns_message_removename(dns_message_t *msg, dns_name_t *name,
+                       dns_section_t section);
+/*%<
+ * Remove a existing name from a given section.
+ *
+ * It is the caller's responsibility to ensure the name is part of the
+ * given section.
+ *
+ * Requires:
+ *
+ *\li	'msg' be valid, and be a renderable message.
  *
- *	'name' be a valid absolute name.
+ *\li	'name' be a valid absolute name.
  *
- *	'section' be a named section.
+ *\li	'section' be a named section.
  */
 
+
 /*
  * LOANOUT FUNCTIONS
  *
@@ -777,7 +798,7 @@ dns_message_addname(dns_message_t *msg, dns_name_t *name,
 
 isc_result_t
 dns_message_gettempname(dns_message_t *msg, dns_name_t **item);
-/*
+/*%<
  * Return a name that can be used for any temporary purpose, including
  * inserting into the message's linked lists.  The name must be returned
  * to the message code using dns_message_puttempname() or inserted into
@@ -786,180 +807,180 @@ dns_message_gettempname(dns_message_t *msg, dns_name_t **item);
  * It is the caller's responsibility to initialize this name.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item == NULL
+ *\li	item != NULL && *item == NULL
  *
  * Returns:
- *	ISC_R_SUCCESS		-- All is well.
- *	ISC_R_NOMEMORY		-- No item can be allocated.
+ *\li	#ISC_R_SUCCESS		-- All is well.
+ *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
 isc_result_t
 dns_message_gettempoffsets(dns_message_t *msg, dns_offsets_t **item);
-/*
+/*%<
  * Return an offsets array that can be used for any temporary purpose,
  * such as attaching to a temporary name.  The offsets will be freed
  * when the message is destroyed or reset.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item == NULL
+ *\li	item != NULL && *item == NULL
  *
  * Returns:
- *	ISC_R_SUCCESS		-- All is well.
- *	ISC_R_NOMEMORY		-- No item can be allocated.
+ *\li	#ISC_R_SUCCESS		-- All is well.
+ *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
 isc_result_t
 dns_message_gettemprdata(dns_message_t *msg, dns_rdata_t **item);
-/*
+/*%<
  * Return a rdata that can be used for any temporary purpose, including
  * inserting into the message's linked lists.  The rdata will be freed
  * when the message is destroyed or reset.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item == NULL
+ *\li	item != NULL && *item == NULL
  *
  * Returns:
- *	ISC_R_SUCCESS		-- All is well.
- *	ISC_R_NOMEMORY		-- No item can be allocated.
+ *\li	#ISC_R_SUCCESS		-- All is well.
+ *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
 isc_result_t
 dns_message_gettemprdataset(dns_message_t *msg, dns_rdataset_t **item);
-/*
+/*%<
  * Return a rdataset that can be used for any temporary purpose, including
  * inserting into the message's linked lists. The name must be returned
  * to the message code using dns_message_puttempname() or inserted into
  * one of the message's sections before the message is destroyed.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item == NULL
+ *\li	item != NULL && *item == NULL
  *
  * Returns:
- *	ISC_R_SUCCESS		-- All is well.
- *	ISC_R_NOMEMORY		-- No item can be allocated.
+ *\li	#ISC_R_SUCCESS		-- All is well.
+ *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
 isc_result_t
 dns_message_gettemprdatalist(dns_message_t *msg, dns_rdatalist_t **item);
-/*
+/*%<
  * Return a rdatalist that can be used for any temporary purpose, including
  * inserting into the message's linked lists.  The rdatalist will be
  * destroyed when the message is destroyed or reset.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item == NULL
+ *\li	item != NULL && *item == NULL
  *
  * Returns:
- *	ISC_R_SUCCESS		-- All is well.
- *	ISC_R_NOMEMORY		-- No item can be allocated.
+ *\li	#ISC_R_SUCCESS		-- All is well.
+ *\li	#ISC_R_NOMEMORY		-- No item can be allocated.
  */
 
 void
 dns_message_puttempname(dns_message_t *msg, dns_name_t **item);
-/*
+/*%<
  * Return a borrowed name to the message's name free list.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item point to a name returned by
+ *\li	item != NULL && *item point to a name returned by
  *	dns_message_gettempname()
  *
  * Ensures:
- *	*item == NULL
+ *\li	*item == NULL
  */
 
 void
 dns_message_puttemprdata(dns_message_t *msg, dns_rdata_t **item);
-/*
+/*%<
  * Return a borrowed rdata to the message's rdata free list.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item point to a rdata returned by
+ *\li	item != NULL && *item point to a rdata returned by
  *	dns_message_gettemprdata()
  *
  * Ensures:
- *	*item == NULL
+ *\li	*item == NULL
  */
 
 void
 dns_message_puttemprdataset(dns_message_t *msg, dns_rdataset_t **item);
-/*
+/*%<
  * Return a borrowed rdataset to the message's rdataset free list.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item point to a rdataset returned by
+ *\li	item != NULL && *item point to a rdataset returned by
  *	dns_message_gettemprdataset()
  *
  * Ensures:
- *	*item == NULL
+ *\li	*item == NULL
  */
 
 void
 dns_message_puttemprdatalist(dns_message_t *msg, dns_rdatalist_t **item);
-/*
+/*%<
  * Return a borrowed rdatalist to the message's rdatalist free list.
  *
  * Requires:
- *	msg be a valid message
+ *\li	msg be a valid message
  *
- *	item != NULL && *item point to a rdatalist returned by
+ *\li	item != NULL && *item point to a rdatalist returned by
  *	dns_message_gettemprdatalist()
  *
  * Ensures:
- *	*item == NULL
+ *\li	*item == NULL
  */
 
 isc_result_t
 dns_message_peekheader(isc_buffer_t *source, dns_messageid_t *idp,
 		       unsigned int *flagsp);
-/*
+/*%<
  * Assume the remaining region of "source" is a DNS message.  Peek into
  * it and fill in "*idp" with the message id, and "*flagsp" with the flags.
  *
  * Requires:
  *
- *	source != NULL
+ *\li	source != NULL
  *
  * Ensures:
  *
- *	if (idp != NULL) *idp == message id.
+ *\li	if (idp != NULL) *idp == message id.
  *
- *	if (flagsp != NULL) *flagsp == message flags.
+ *\li	if (flagsp != NULL) *flagsp == message flags.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_SUCCESS		-- all is well.
  *
- *	ISC_R_UNEXPECTEDEND	-- buffer doesn't contain enough for a header.
+ *\li	#ISC_R_UNEXPECTEDEND	-- buffer doesn't contain enough for a header.
  */
 
 isc_result_t
 dns_message_reply(dns_message_t *msg, isc_boolean_t want_question_section);
-/*
+/*%<
  * Start formatting a reply to the query in 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message with parsing intent, and contains a query.
+ *\li	'msg' is a valid message with parsing intent, and contains a query.
  *
  * Ensures:
  *
- *	The message will have a rendering intent.  If 'want_question_section'
+ *\li	The message will have a rendering intent.  If 'want_question_section'
  *	is true, the message opcode is query or notify, and the question
  *	section is present and properly formatted, then the question section
  *	will be included in the reply.  All other sections will be cleared.
@@ -968,9 +989,9 @@ dns_message_reply(dns_message_t *msg, isc_boolean_t want_question_section);
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_SUCCESS		-- all is well.
  *
- *	DNS_R_FORMERR		-- the header or question section of the
+ *\li	#DNS_R_FORMERR		-- the header or question section of the
  *				   message is invalid, replying is impossible.
  *				   If DNS_R_FORMERR is returned when
  *				   want_question_section is ISC_FALSE, then
@@ -981,308 +1002,308 @@ dns_message_reply(dns_message_t *msg, isc_boolean_t want_question_section);
 
 dns_rdataset_t *
 dns_message_getopt(dns_message_t *msg);
-/*
+/*%<
  * Get the OPT record for 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message.
+ *\li	'msg' is a valid message.
  *
  * Returns:
  *
- *	The OPT rdataset of 'msg', or NULL if there isn't one.
+ *\li	The OPT rdataset of 'msg', or NULL if there isn't one.
  */
 
 isc_result_t
 dns_message_setopt(dns_message_t *msg, dns_rdataset_t *opt);
-/*
+/*%<
  * Set the OPT record for 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message with rendering intent
+ *\li	'msg' is a valid message with rendering intent
  *	and no sections have been rendered.
  *
- *	'opt' is a valid OPT record.
+ *\li	'opt' is a valid OPT record.
  *
  * Ensures:
  *
- *	The OPT record has either been freed or ownership of it has
+ *\li	The OPT record has either been freed or ownership of it has
  *	been transferred to the message.
  *
- *	If ISC_R_SUCCESS was returned, the OPT record will be rendered 
+ *\li	If ISC_R_SUCCESS was returned, the OPT record will be rendered 
  *	when dns_message_renderend() is called.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_SUCCESS		-- all is well.
  *
- *	ISC_R_NOSPACE		-- there is no space for the OPT record.
+ *\li	#ISC_R_NOSPACE		-- there is no space for the OPT record.
  */
 
 dns_rdataset_t *
 dns_message_gettsig(dns_message_t *msg, dns_name_t **owner);
-/*
+/*%<
  * Get the TSIG record and owner for 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message.
- *	'owner' is NULL or *owner is NULL.
+ *\li	'msg' is a valid message.
+ *\li	'owner' is NULL or *owner is NULL.
  *
  * Returns:
  *
- *	The TSIG rdataset of 'msg', or NULL if there isn't one.
+ *\li	The TSIG rdataset of 'msg', or NULL if there isn't one.
  *
  * Ensures:
  *
- * 	If 'owner' is not NULL, it will point to the owner name.
+ * \li	If 'owner' is not NULL, it will point to the owner name.
  */
 
 isc_result_t
 dns_message_settsigkey(dns_message_t *msg, dns_tsigkey_t *key);
-/*
+/*%<
  * Set the tsig key for 'msg'.  This is only necessary for when rendering a
  * query or parsing a response.  The key (if non-NULL) is attached to, and
  * will be detached when the message is destroyed.
  *
  * Requires:
  *
- *	'msg' is a valid message with rendering intent,
+ *\li	'msg' is a valid message with rendering intent,
  *	dns_message_renderbegin() has been called, and no sections have been
  *	rendered.
- *	'key' is a valid tsig key or NULL.
+ *\li	'key' is a valid tsig key or NULL.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_SUCCESS		-- all is well.
  *
- *	ISC_R_NOSPACE		-- there is no space for the TSIG record.
+ *\li	#ISC_R_NOSPACE		-- there is no space for the TSIG record.
  */
 
 dns_tsigkey_t *
 dns_message_gettsigkey(dns_message_t *msg);
-/*
+/*%<
  * Gets the tsig key for 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message
+ *\li	'msg' is a valid message
  */
 
 isc_result_t
 dns_message_setquerytsig(dns_message_t *msg, isc_buffer_t *querytsig);
-/*
+/*%<
  * Indicates that 'querytsig' is the TSIG from the signed query for which
  * 'msg' is the response.  This is also used for chained TSIGs in TCP
  * responses.
  *
  * Requires:
  *
- *	'querytsig' is a valid buffer as returned by dns_message_getquerytsig()
+ *\li	'querytsig' is a valid buffer as returned by dns_message_getquerytsig()
  *	or NULL
  *
- *	'msg' is a valid message
+ *\li	'msg' is a valid message
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_message_getquerytsig(dns_message_t *msg, isc_mem_t *mctx,
 			 isc_buffer_t **querytsig);
-/*
+/*%<
  * Gets the tsig from the TSIG from the signed query 'msg'.  This is also used
  * for chained TSIGs in TCP responses.  Unlike dns_message_gettsig, this makes
  * a copy of the data, so can be used if the message is destroyed.
  *
  * Requires:
  *
- *	'msg' is a valid signed message
- *	'mctx' is a valid memory context
- *	querytsig != NULL && *querytsig == NULL
+ *\li	'msg' is a valid signed message
+ *\li	'mctx' is a valid memory context
+ *\li	querytsig != NULL && *querytsig == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  *
  * Ensures:
- * 	'tsig' points to NULL or an allocated buffer which must be freed
+ *\li 	'tsig' points to NULL or an allocated buffer which must be freed
  * 	by the caller.
  */
 
 dns_rdataset_t *
 dns_message_getsig0(dns_message_t *msg, dns_name_t **owner);
-/*
+/*%<
  * Get the SIG(0) record and owner for 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message.
- *	'owner' is NULL or *owner is NULL.
+ *\li	'msg' is a valid message.
+ *\li	'owner' is NULL or *owner is NULL.
  *
  * Returns:
  *
- *	The SIG(0) rdataset of 'msg', or NULL if there isn't one.
+ *\li	The SIG(0) rdataset of 'msg', or NULL if there isn't one.
  *
  * Ensures:
  *
- * 	If 'owner' is not NULL, it will point to the owner name.
+ * \li	If 'owner' is not NULL, it will point to the owner name.
  */
 
 isc_result_t
 dns_message_setsig0key(dns_message_t *msg, dst_key_t *key);
-/*
+/*%<
  * Set the SIG(0) key for 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message with rendering intent,
+ *\li	'msg' is a valid message with rendering intent,
  *	dns_message_renderbegin() has been called, and no sections have been
  *	rendered.
- *	'key' is a valid sig key or NULL.
+ *\li	'key' is a valid sig key or NULL.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_SUCCESS		-- all is well.
  *
- *	ISC_R_NOSPACE		-- there is no space for the SIG(0) record.
+ *\li	#ISC_R_NOSPACE		-- there is no space for the SIG(0) record.
  */
 
 dst_key_t *
 dns_message_getsig0key(dns_message_t *msg);
-/*
+/*%<
  * Gets the SIG(0) key for 'msg'.
  *
  * Requires:
  *
- *	'msg' is a valid message
+ *\li	'msg' is a valid message
  */
 
 void
 dns_message_takebuffer(dns_message_t *msg, isc_buffer_t **buffer);
-/*
+/*%<
  * Give the *buffer to the message code to clean up when it is no
  * longer needed.  This is usually when the message is reset or
  * destroyed.
  *
  * Requires:
  *
- *	msg be a valid message.
+ *\li	msg be a valid message.
  *
- *	buffer != NULL && *buffer is a valid isc_buffer_t, which was
+ *\li	buffer != NULL && *buffer is a valid isc_buffer_t, which was
  *	dynamincally allocated via isc_buffer_allocate().
  */
 
 isc_result_t
 dns_message_signer(dns_message_t *msg, dns_name_t *signer);
-/*
+/*%<
  * If this message was signed, return the identity of the signer.
  * Unless ISC_R_NOTFOUND is returned, signer will reflect the name of the
  * key that signed the message.
  *
  * Requires:
  *
- *	msg is a valid parsed message.
- *	signer is a valid name
+ *\li	msg is a valid parsed message.
+ *\li	signer is a valid name
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		- the message was signed, and *signer
+ *\li	#ISC_R_SUCCESS		- the message was signed, and *signer
  *				  contains the signing identity
  *
- *	ISC_R_NOTFOUND		- no TSIG or SIG(0) record is present in the
+ *\li	#ISC_R_NOTFOUND		- no TSIG or SIG(0) record is present in the
  *				  message
  *
- *	DNS_R_TSIGVERIFYFAILURE	- the message was signed by a TSIG, but the
+ *\li	#DNS_R_TSIGVERIFYFAILURE	- the message was signed by a TSIG, but the
  *				  signature failed to verify
  *
- *	DNS_R_TSIGERRORSET	- the message was signed by a TSIG and
+ *\li	#DNS_R_TSIGERRORSET	- the message was signed by a TSIG and
  *				  verified, but the query was rejected by
  *				  the server
  *
- *	DNS_R_NOIDENTITY	- the message was signed by a TSIG and
+ *\li	#DNS_R_NOIDENTITY	- the message was signed by a TSIG and
  *				  verified, but the key has no identity since
  *				  it was generated by an unsigned TKEY process
  *
- *	DNS_R_SIGINVALID	- the message was signed by a SIG(0), but
+ *\li	#DNS_R_SIGINVALID	- the message was signed by a SIG(0), but
  *				  the signature failed to verify
  *
- *	DNS_R_NOTVERIFIEDYET	- the message was signed by a TSIG or SIG(0),
+ *\li	#DNS_R_NOTVERIFIEDYET	- the message was signed by a TSIG or SIG(0),
  *				  but the signature has not been verified yet
  */
 
 isc_result_t
 dns_message_checksig(dns_message_t *msg, dns_view_t *view);
-/*
+/*%<
  * If this message was signed, verify the signature.
  *
  * Requires:
  *
- *	msg is a valid parsed message.
- *	view is a valid view or NULL
+ *\li	msg is a valid parsed message.
+ *\li	view is a valid view or NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		- the message was unsigned, or the message
+ *\li	#ISC_R_SUCCESS		- the message was unsigned, or the message
  *				  was signed correctly.
  *
- *	DNS_R_EXPECTEDTSIG	- A TSIG was expected, but not seen
- *	DNS_R_UNEXPECTEDTSIG	- A TSIG was seen but not expected
- *	DNS_R_TSIGVERIFYFAILURE - The TSIG failed to verify
+ *\li	#DNS_R_EXPECTEDTSIG	- A TSIG was expected, but not seen
+ *\li	#DNS_R_UNEXPECTEDTSIG	- A TSIG was seen but not expected
+ *\li	#DNS_R_TSIGVERIFYFAILURE - The TSIG failed to verify
  */
 
 isc_result_t
 dns_message_rechecksig(dns_message_t *msg, dns_view_t *view);
-/*
+/*%<
  * Reset the signature state and then if the message was signed,
  * verify the message.
  *
  * Requires:
  *
- *	msg is a valid parsed message.
- *	view is a valid view or NULL
+ *\li	msg is a valid parsed message.
+ *\li	view is a valid view or NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		- the message was unsigned, or the message
+ *\li	#ISC_R_SUCCESS		- the message was unsigned, or the message
  *				  was signed correctly.
  *
- *	DNS_R_EXPECTEDTSIG	- A TSIG was expected, but not seen
- *	DNS_R_UNEXPECTEDTSIG	- A TSIG was seen but not expected
- *	DNS_R_TSIGVERIFYFAILURE - The TSIG failed to verify
+ *\li	#DNS_R_EXPECTEDTSIG	- A TSIG was expected, but not seen
+ *\li	#DNS_R_UNEXPECTEDTSIG	- A TSIG was seen but not expected
+ *\li	#DNS_R_TSIGVERIFYFAILURE - The TSIG failed to verify
  */
 
 void
 dns_message_resetsig(dns_message_t *msg);
-/*
+/*%<
  * Reset the signature state.
  *
  * Requires:
- *	'msg' is a valid parsed message.
+ *\li	'msg' is a valid parsed message.
  */
 
 isc_region_t *
 dns_message_getrawmessage(dns_message_t *msg);
-/*
+/*%<
  * Retrieve the raw message in compressed wire format.  The message must
  * have been successfully parsed for it to have been saved.
  *
  * Requires:
- *	msg is a valid parsed message.
+ *\li	msg is a valid parsed message.
  *
  * Returns:
- *	NULL	if there is no saved message.
+ *\li	NULL	if there is no saved message.
  *	a pointer to a region which refers the dns message.
  */
 
 void
 dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
 			 const void *order_arg);
-/*
+/*%<
  * Define the order in which RR sets get rendered by
  * dns_message_rendersection() to be the ascending order
  * defined by the integer value returned by 'order' when
@@ -1290,27 +1311,27 @@ dns_message_setsortorder(dns_message_t *msg, dns_rdatasetorderfunc_t order,
  * 'order_arg' are NULL, a default order is used.
  *
  * Requires:
- *	msg be a valid message.
- *	order_arg is NULL if and only if order is NULL.
+ *\li	msg be a valid message.
+ *\li	order_arg is NULL if and only if order is NULL.
  */
 
 void 
 dns_message_settimeadjust(dns_message_t *msg, int timeadjust);
-/*
+/*%<
  * Adjust the time used to sign/verify a message by timeadjust.
  * Currently only TSIG.
  *
  * Requires:
- *	msg be a valid message.
+ *\li	msg be a valid message.
  */
 
 int 
 dns_message_gettimeadjust(dns_message_t *msg);
-/*
+/*%<
  * Return the current time adjustment.
  *
  * Requires:
- *	msg be a valid message.
+ *\li	msg be a valid message.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/name.h b/contrib/bind9/lib/dns/include/dns/name.h
index ce9e1f1..038ae05 100644
--- a/contrib/bind9/lib/dns/include/dns/name.h
+++ b/contrib/bind9/lib/dns/include/dns/name.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: name.h,v 1.95.2.3.2.14 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: name.h,v 1.107.18.15 2006/03/02 00:37:21 marka Exp $ */
 
 #ifndef DNS_NAME_H
 #define DNS_NAME_H 1
@@ -24,9 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Names and Labels
- *
+/*! \file
+ * \brief
  * Provides facilities for manipulating DNS names and labels, including
  * conversions to and from wire format and text format.
  *
@@ -45,26 +44,26 @@
  * handles.
  *
  * MP:
- *	Clients of this module must impose any required synchronization.
+ *\li	Clients of this module must impose any required synchronization.
  *
  * Reliability:
- *	This module deals with low-level byte streams.  Errors in any of
+ *\li	This module deals with low-level byte streams.  Errors in any of
  *	the functions are likely to crash the server or corrupt memory.
  *
  * Resources:
- *	None.
+ *\li	None.
  *
  * Security:
  *
- *	*** WARNING ***
+ *\li	*** WARNING ***
  *
- *	dns_name_fromwire() deals with raw network data.  An error in
+ *\li	dns_name_fromwire() deals with raw network data.  An error in
  *	this routine could result in the failure or hijacking of the server.
  *
  * Standards:
- *	RFC 1035
- *	Draft EDNS0 (0)
- *	Draft Binary Labels (2)
+ *\li	RFC1035
+ *\li	Draft EDNS0 (0)
+ *\li	Draft Binary Labels (2)
  *
  */
 
@@ -109,7 +108,7 @@ ISC_LANG_BEGINDECLS
  *** Types
  ***/
 
-/*
+/*%
  * Clients are strongly discouraged from using this type directly,  with
  * the exception of the 'link' and 'list' fields which may be used directly
  * for whatever purpose the client desires.
@@ -135,89 +134,100 @@ struct dns_name {
 /*
  * Attributes below 0x0100 reserved for name.c usage.
  */
-#define DNS_NAMEATTR_CACHE		0x0100		/* Used by resolver. */
-#define DNS_NAMEATTR_ANSWER		0x0200		/* Used by resolver. */
-#define DNS_NAMEATTR_NCACHE		0x0400		/* Used by resolver. */
-#define DNS_NAMEATTR_CHAINING		0x0800		/* Used by resolver. */
-#define DNS_NAMEATTR_CHASE		0x1000		/* Used by resolver. */
-#define DNS_NAMEATTR_WILDCARD		0x2000		/* Used by server. */
+#define DNS_NAMEATTR_CACHE		0x0100		/*%< Used by resolver. */
+#define DNS_NAMEATTR_ANSWER		0x0200		/*%< Used by resolver. */
+#define DNS_NAMEATTR_NCACHE		0x0400		/*%< Used by resolver. */
+#define DNS_NAMEATTR_CHAINING		0x0800		/*%< Used by resolver. */
+#define DNS_NAMEATTR_CHASE		0x1000		/*%< Used by resolver. */
+#define DNS_NAMEATTR_WILDCARD		0x2000		/*%< Used by server. */
 
 #define DNS_NAME_DOWNCASE		0x0001
-#define DNS_NAME_CHECKNAMES		0x0002		/* Used by rdata. */
-#define DNS_NAME_CHECKNAMESFAIL		0x0004		/* Used by rdata. */
-#define DNS_NAME_CHECKREVERSE		0x0008		/* Used by rdata. */
+#define DNS_NAME_CHECKNAMES		0x0002		/*%< Used by rdata. */
+#define DNS_NAME_CHECKNAMESFAIL		0x0004		/*%< Used by rdata. */
+#define DNS_NAME_CHECKREVERSE		0x0008		/*%< Used by rdata. */
+#define DNS_NAME_CHECKMX		0x0010		/*%< Used by rdata. */
+#define DNS_NAME_CHECKMXFAIL		0x0020		/*%< Used by rdata. */
 
 LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_rootname;
 LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_wildcardname;
 
-/*
+/*%
  * Standard size of a wire format name
  */
 #define DNS_NAME_MAXWIRE 255
 
+/*
+ * Text output filter procedure.
+ * 'target' is the buffer to be converted.  The region to be converted
+ * is from 'buffer'->base + 'used_org' to the end of the used region.
+ */
+typedef isc_result_t (*dns_name_totextfilter_t)(isc_buffer_t *target,
+						unsigned int used_org,
+						isc_boolean_t absolute);
+
 /***
  *** Initialization
  ***/
 
 void
 dns_name_init(dns_name_t *name, unsigned char *offsets);
-/*
+/*%<
  * Initialize 'name'.
  *
  * Notes:
- *	'offsets' is never required to be non-NULL, but specifying a
+ * \li	'offsets' is never required to be non-NULL, but specifying a
  *	dns_offsets_t for 'offsets' will improve the performance of most
  *	name operations if the name is used more than once.
  *
  * Requires:
- *	'name' is not NULL and points to a struct dns_name.
+ * \li	'name' is not NULL and points to a struct dns_name.
  *
- *	offsets == NULL or offsets is a dns_offsets_t.
+ * \li	offsets == NULL or offsets is a dns_offsets_t.
  *
  * Ensures:
- *	'name' is a valid name.
- *	dns_name_countlabels(name) == 0
- *	dns_name_isabsolute(name) == ISC_FALSE
+ * \li	'name' is a valid name.
+ * \li	dns_name_countlabels(name) == 0
+ * \li	dns_name_isabsolute(name) == ISC_FALSE
  */
 
 void
 dns_name_reset(dns_name_t *name);
-/*
+/*%<
  * Reinitialize 'name'.
  *
  * Notes:
- *	This function distinguishes itself from dns_name_init() in two
+ * \li	This function distinguishes itself from dns_name_init() in two
  *	key ways:
  *
- *	+ If any buffer is associated with 'name' (via dns_name_setbuffer()
+ * \li	+ If any buffer is associated with 'name' (via dns_name_setbuffer()
  *	  or by being part of a dns_fixedname_t) the link to the buffer
  *	  is retained but the buffer itself is cleared.
  *
- *	+ Of the attributes associated with 'name', all are retained except
+ * \li	+ Of the attributes associated with 'name', all are retained except
  *	  DNS_NAMEATTR_ABSOLUTE.
  *
  * Requires:
- *	'name' is a valid name.
+ * \li	'name' is a valid name.
  *
  * Ensures:
- *	'name' is a valid name.
- *	dns_name_countlabels(name) == 0
- *	dns_name_isabsolute(name) == ISC_FALSE
+ * \li	'name' is a valid name.
+ * \li	dns_name_countlabels(name) == 0
+ * \li	dns_name_isabsolute(name) == ISC_FALSE
  */
 
 void
 dns_name_invalidate(dns_name_t *name);
-/*
+/*%<
  * Make 'name' invalid.
  *
  * Requires:
- *	'name' is a valid name.
+ * \li	'name' is a valid name.
  *
  * Ensures:
- *	If assertion checking is enabled, future attempts to use 'name'
+ * \li	If assertion checking is enabled, future attempts to use 'name'
  *	without initializing it will cause an assertion failure.
  *
- *	If the name had a dedicated buffer, that association is ended.
+ * \li	If the name had a dedicated buffer, that association is ended.
  */
 
 
@@ -227,93 +237,92 @@ dns_name_invalidate(dns_name_t *name);
 
 void
 dns_name_setbuffer(dns_name_t *name, isc_buffer_t *buffer);
-/*
+/*%<
  * Dedicate a buffer for use with 'name'.
  *
  * Notes:
- *	Specification of a target buffer in dns_name_fromwire(),
+ * \li	Specification of a target buffer in dns_name_fromwire(),
  *	dns_name_fromtext(), and dns_name_concatentate() is optional if
  *	'name' has a dedicated buffer.
  *
- *	The caller must not write to buffer until the name has been
+ * \li	The caller must not write to buffer until the name has been
  *	invalidated or is otherwise known not to be in use.
  *
- *	If buffer is NULL and the name previously had a dedicated buffer,
+ * \li	If buffer is NULL and the name previously had a dedicated buffer,
  *	than that buffer is no longer dedicated to use with this name.
  *	The caller is responsible for ensuring that the storage used by
  *	the name remains valid.
  *
  * Requires:
- *	'name' is a valid name.
+ * \li	'name' is a valid name.
  *
- *	'buffer' is a valid binary buffer and 'name' doesn't have a
+ * \li	'buffer' is a valid binary buffer and 'name' doesn't have a
  *	dedicated buffer already, or 'buffer' is NULL.
  */
 
 isc_boolean_t
 dns_name_hasbuffer(const dns_name_t *name);
-/*
+/*%<
  * Does 'name' have a dedicated buffer?
  *
  * Requires:
- *	'name' is a valid name.
+ * \li	'name' is a valid name.
  *
  * Returns:
- *	ISC_TRUE	'name' has a dedicated buffer.
- *	ISC_FALSE	'name' does not have a dedicated buffer.
+ * \li	ISC_TRUE	'name' has a dedicated buffer.
+ * \li	ISC_FALSE	'name' does not have a dedicated buffer.
  */
 
-
 /***
  *** Properties
  ***/
 
 isc_boolean_t
 dns_name_isabsolute(const dns_name_t *name);
-/*
+/*%<
  * Does 'name' end in the root label?
  *
  * Requires:
- *	'name' is a valid name
+ * \li	'name' is a valid name
  *
  * Returns:
- *	TRUE		The last label in 'name' is the root label.
- *	FALSE		The last label in 'name' is not the root label.
+ * \li	TRUE		The last label in 'name' is the root label.
+ * \li	FALSE		The last label in 'name' is not the root label.
  */
 
 isc_boolean_t
 dns_name_iswildcard(const dns_name_t *name);
-/*
+/*%<
  * Is 'name' a wildcard name?
  *
  * Requires:
- *	'name' is a valid name
+ * \li	'name' is a valid name
  *
- *	dns_name_countlabels(name) > 0
+ * \li	dns_name_countlabels(name) > 0
  *
  * Returns:
- *	TRUE		The least significant label of 'name' is '*'.
- *	FALSE		The least significant label of 'name' is not '*'.
+ * \li	TRUE		The least significant label of 'name' is '*'.
+ * \li	FALSE		The least significant label of 'name' is not '*'.
  */
 
 unsigned int
 dns_name_hash(dns_name_t *name, isc_boolean_t case_sensitive);
-/*
+/*%<
  * Provide a hash value for 'name'.
  *
  * Note: if 'case_sensitive' is ISC_FALSE, then names which differ only in
  * case will have the same hash value.
  *
  * Requires:
- *	'name' is a valid name
+ * \li	'name' is a valid name
  *
  * Returns:
- *	A hash value
+ * \li	A hash value
  */
 
 unsigned int
 dns_name_fullhash(dns_name_t *name, isc_boolean_t case_sensitive);
-/*
+/*%<
  * Provide a hash value for 'name'.  Unlike dns_name_hash(), this function
  * always takes into account of the entire name to calculate the hash value.
  *
@@ -321,15 +330,15 @@ dns_name_fullhash(dns_name_t *name, isc_boolean_t case_sensitive);
  * case will have the same hash value.
  *
  * Requires:
- *	'name' is a valid name
+ *\li	'name' is a valid name
  *
  * Returns:
- *	A hash value
+ *\li	A hash value
  */
 
 unsigned int
 dns_name_hashbylabel(dns_name_t *name, isc_boolean_t case_sensitive);
-/*
+/*%<
  * Provide a hash value for 'name', where the hash value is the sum
  * of the hash values of each label.
  *
@@ -337,20 +346,20 @@ dns_name_hashbylabel(dns_name_t *name, isc_boolean_t case_sensitive);
  * case will have the same hash value.
  *
  * Requires:
- *	'name' is a valid name
+ *\li	'name' is a valid name
  *
  * Returns:
- *	A hash value
+ *\li	A hash value
  */
 
-/***
+/*
  *** Comparisons
  ***/
 
 dns_namereln_t
 dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 		     int *orderp, unsigned int *nlabelsp);
-/*
+/*%<
  * Determine the relative ordering under the DNSSEC order relation of
  * 'name1' and 'name2', and also determine the hierarchical
  * relationship of the names.
@@ -361,39 +370,39 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
  * same domain.
  *
  * Requires:
- *	'name1' is a valid name
+ *\li	'name1' is a valid name
  *
- *	dns_name_countlabels(name1) > 0
+ *\li	dns_name_countlabels(name1) > 0
  *
- *	'name2' is a valid name
+ *\li	'name2' is a valid name
  *
- *	dns_name_countlabels(name2) > 0
+ *\li	dns_name_countlabels(name2) > 0
  *
- *	orderp and nlabelsp are valid pointers.
+ *\li	orderp and nlabelsp are valid pointers.
  *
- *	Either name1 is absolute and name2 is absolute, or neither is.
+ *\li	Either name1 is absolute and name2 is absolute, or neither is.
  *
  * Ensures:
  *
- *	*orderp is < 0 if name1 < name2, 0 if name1 = name2, > 0 if
+ *\li	*orderp is < 0 if name1 < name2, 0 if name1 = name2, > 0 if
  *	name1 > name2.
  *
- *	*nlabelsp is the number of common significant labels.
+ *\li	*nlabelsp is the number of common significant labels.
  *
  * Returns:
- *	dns_namereln_none		There's no hierarchical relationship
+ *\li	dns_namereln_none		There's no hierarchical relationship
  *					between name1 and name2.
- *	dns_namereln_contains		name1 properly contains name2; i.e.
+ *\li	dns_namereln_contains		name1 properly contains name2; i.e.
  *					name2 is a proper subdomain of name1.
- *	dns_namereln_subdomain		name1 is a proper subdomain of name2.
- *	dns_namereln_equal		name1 and name2 are equal.
- *	dns_namereln_commonancestor	name1 and name2 share a common
+ *\li	dns_namereln_subdomain		name1 is a proper subdomain of name2.
+ *\li	dns_namereln_equal		name1 and name2 are equal.
+ *\li	dns_namereln_commonancestor	name1 and name2 share a common
  *					ancestor.
  */
 
 int
 dns_name_compare(const dns_name_t *name1, const dns_name_t *name2);
-/*
+/*%<
  * Determine the relative ordering under the DNSSEC order relation of
  * 'name1' and 'name2'.
  *
@@ -403,124 +412,130 @@ dns_name_compare(const dns_name_t *name1, const dns_name_t *name2);
  * same domain.
  *
  * Requires:
- *	'name1' is a valid name
+ * \li	'name1' is a valid name
  *
- *	'name2' is a valid name
+ * \li	'name2' is a valid name
  *
- *	Either name1 is absolute and name2 is absolute, or neither is.
+ * \li	Either name1 is absolute and name2 is absolute, or neither is.
  *
  * Returns:
- *	< 0		'name1' is less than 'name2'
- *	0		'name1' is equal to 'name2'
- *	> 0		'name1' is greater than 'name2'
+ * \li	< 0		'name1' is less than 'name2'
+ * \li	0		'name1' is equal to 'name2'
+ * \li	> 0		'name1' is greater than 'name2'
  */
 
 isc_boolean_t
 dns_name_equal(const dns_name_t *name1, const dns_name_t *name2);
-/*
+/*%<
  * Are 'name1' and 'name2' equal?
  *
  * Notes:
- *	Because it only needs to test for equality, dns_name_equal() can be
+ * \li	Because it only needs to test for equality, dns_name_equal() can be
  *	significantly faster than dns_name_fullcompare() or dns_name_compare().
  *
- *	Offsets tables are not used in the comparision.
+ * \li	Offsets tables are not used in the comparision.
  *
- * 	It makes no sense for one of the names to be relative and the
+ * \li	It makes no sense for one of the names to be relative and the
  *	other absolute.  If both names are relative, then to be meaningfully
  * 	compared the caller must ensure that they are both relative to the
  * 	same domain.
  *
  * Requires:
- *	'name1' is a valid name
+ * \li	'name1' is a valid name
  *
- *	'name2' is a valid name
+ * \li	'name2' is a valid name
  *
- *	Either name1 is absolute and name2 is absolute, or neither is.
+ * \li	Either name1 is absolute and name2 is absolute, or neither is.
  *
  * Returns:
- *	ISC_TRUE	'name1' and 'name2' are equal
- *	ISC_FALSE	'name1' and 'name2' are not equal
+ * \li	ISC_TRUE	'name1' and 'name2' are equal
+ * \li	ISC_FALSE	'name1' and 'name2' are not equal
+ */
+
+isc_boolean_t
+dns_name_caseequal(const dns_name_t *name1, const dns_name_t *name2);
+/*%<
+ * Case sensitive version of dns_name_equal().
  */
 
 int
 dns_name_rdatacompare(const dns_name_t *name1, const dns_name_t *name2);
-/*
+/*%<
  * Compare two names as if they are part of rdata in DNSSEC canonical
  * form.
  *
  * Requires:
- *	'name1' is a valid absolute name
+ * \li	'name1' is a valid absolute name
  *
- *	dns_name_countlabels(name1) > 0
+ * \li	dns_name_countlabels(name1) > 0
  *
- *	'name2' is a valid absolute name
+ * \li	'name2' is a valid absolute name
  *
- *	dns_name_countlabels(name2) > 0
+ * \li	dns_name_countlabels(name2) > 0
  *
  * Returns:
- *	< 0		'name1' is less than 'name2'
- *	0		'name1' is equal to 'name2'
- *	> 0		'name1' is greater than 'name2'
+ * \li	< 0		'name1' is less than 'name2'
+ * \li	0		'name1' is equal to 'name2'
+ * \li	> 0		'name1' is greater than 'name2'
  */
 
 isc_boolean_t
 dns_name_issubdomain(const dns_name_t *name1, const dns_name_t *name2);
-/*
+/*%<
  * Is 'name1' a subdomain of 'name2'?
  *
  * Notes:
- *	name1 is a subdomain of name2 if name1 is contained in name2, or
+ * \li	name1 is a subdomain of name2 if name1 is contained in name2, or
  *	name1 equals name2.
  *
- *	It makes no sense for one of the names to be relative and the
+ * \li	It makes no sense for one of the names to be relative and the
  *	other absolute.  If both names are relative, then to be meaningfully
  *	compared the caller must ensure that they are both relative to the
  *	same domain.
  *
  * Requires:
- *	'name1' is a valid name
+ * \li	'name1' is a valid name
  *
- *	'name2' is a valid name
+ * \li	'name2' is a valid name
  *
- *	Either name1 is absolute and name2 is absolute, or neither is.
+ * \li	Either name1 is absolute and name2 is absolute, or neither is.
  *
  * Returns:
- *	TRUE		'name1' is a subdomain of 'name2'
- *	FALSE		'name1' is not a subdomain of 'name2'
+ * \li	TRUE		'name1' is a subdomain of 'name2'
+ * \li	FALSE		'name1' is not a subdomain of 'name2'
  */
 
 isc_boolean_t
 dns_name_matcheswildcard(const dns_name_t *name, const dns_name_t *wname);
-/*
+/*%<
  * Does 'name' match the wildcard specified in 'wname'?
  *
  * Notes:
- *	name matches the wildcard specified in wname if all labels
+ * \li	name matches the wildcard specified in wname if all labels
  *	following the wildcard in wname are identical to the same number
  *	of labels at the end of name.
  *
- *	It makes no sense for one of the names to be relative and the
+ * \li	It makes no sense for one of the names to be relative and the
  *	other absolute.  If both names are relative, then to be meaningfully
  *	compared the caller must ensure that they are both relative to the
  *	same domain.
  *
  * Requires:
- *	'name' is a valid name
+ * \li	'name' is a valid name
  *
- *	dns_name_countlabels(name) > 0
+ * \li	dns_name_countlabels(name) > 0
  *
- *	'wname' is a valid name
+ * \li	'wname' is a valid name
  *
- *	dns_name_countlabels(wname) > 0
+ * \li	dns_name_countlabels(wname) > 0
  *
- *	dns_name_iswildcard(wname) is true
+ * \li	dns_name_iswildcard(wname) is true
  *
- *	Either name is absolute and wname is absolute, or neither is.
+ * \li	Either name is absolute and wname is absolute, or neither is.
  *
  * Returns:
- *	TRUE		'name' matches the wildcard specified in 'wname'
- *	FALSE		'name' does not match the wildcard specified in 'wname'
+ * \li	TRUE		'name' matches the wildcard specified in 'wname'
+ * \li	FALSE		'name' does not match the wildcard specified in 'wname'
  */
 
 /***
@@ -529,89 +544,91 @@ dns_name_matcheswildcard(const dns_name_t *name, const dns_name_t *wname);
 
 unsigned int
 dns_name_countlabels(const dns_name_t *name);
-/*
+/*%<
  * How many labels does 'name' have?
  *
  * Notes:
- *	In this case, as in other places, a 'label' is an ordinary label.
+ * \li	In this case, as in other places, a 'label' is an ordinary label.
  *
  * Requires:
- *	'name' is a valid name
+ * \li	'name' is a valid name
  *
  * Ensures:
- *	The result is <= 128.
+ * \li	The result is <= 128.
  *
  * Returns:
- *	The number of labels in 'name'.
+ * \li	The number of labels in 'name'.
  */
 
 void
 dns_name_getlabel(const dns_name_t *name, unsigned int n, dns_label_t *label);
-/*
+/*%<
  * Make 'label' refer to the 'n'th least significant label of 'name'.
  *
  * Notes:
- *	Numbering starts at 0.
+ * \li	Numbering starts at 0.
  *
- *	Given "rc.vix.com.", the label 0 is "rc", and label 3 is the
+ * \li	Given "rc.vix.com.", the label 0 is "rc", and label 3 is the
  *	root label.
  *
- *	'label' refers to the same memory as 'name', so 'name' must not
+ * \li	'label' refers to the same memory as 'name', so 'name' must not
  *	be changed while 'label' is still in use.
  *
  * Requires:
- *	n < dns_name_countlabels(name)
+ * \li	n < dns_name_countlabels(name)
  */
 
 void
 dns_name_getlabelsequence(const dns_name_t *source, unsigned int first,
 			  unsigned int n, dns_name_t *target);
-/*
+/*%<
  * Make 'target' refer to the 'n' labels including and following 'first'
  * in 'source'.
  *
  * Notes:
- *	Numbering starts at 0.
+ * \li	Numbering starts at 0.
  *
- *	Given "rc.vix.com.", the label 0 is "rc", and label 3 is the
+ * \li	Given "rc.vix.com.", the label 0 is "rc", and label 3 is the
  *	root label.
  *
- *	'target' refers to the same memory as 'source', so 'source'
+ * \li	'target' refers to the same memory as 'source', so 'source'
  *	must not be changed while 'target' is still in use.
  *
  * Requires:
- *	'source' and 'target' are valid names.
+ * \li	'source' and 'target' are valid names.
  *
- *	first < dns_name_countlabels(name)
+ * \li	first < dns_name_countlabels(name)
  *
- *	first + n <= dns_name_countlabels(name)
+ * \li	first + n <= dns_name_countlabels(name)
  */
 
 
 void
 dns_name_clone(const dns_name_t *source, dns_name_t *target);
-/*
+/*%<
  * Make 'target' refer to the same name as 'source'.
  *
  * Notes:
  *
- *	'target' refers to the same memory as 'source', so 'source'
+ * \li	'target' refers to the same memory as 'source', so 'source'
  *	must not be changed while 'target' is still in use.
  *
- *	This call is functionally equivalent to:
+ * \li	This call is functionally equivalent to:
  *
+ * \code
  *		dns_name_getlabelsequence(source, 0,
  *					  dns_name_countlabels(source),
  *					  target);
+ * \endcode
  *
  *	but is more efficient.  Also, dns_name_clone() works even if 'source'
  *	is empty.
  *
  * Requires:
  *
- *	'source' is a valid name.
+ * \li	'source' is a valid name.
  *
- *	'target' is a valid name that is not read-only.
+ * \li	'target' is a valid name that is not read-only.
  */
 
 /***
@@ -620,206 +637,205 @@ dns_name_clone(const dns_name_t *source, dns_name_t *target);
 
 void
 dns_name_fromregion(dns_name_t *name, const isc_region_t *r);
-/*
+/*%<
  * Make 'name' refer to region 'r'.
  *
  * Note:
- *	If the conversion encounters a root label before the end of the
+ * \li	If the conversion encounters a root label before the end of the
  *	region the conversion stops and the length is set to the length
  *	so far converted.  A maximum of 255 bytes is converted.
  *
  * Requires:
- *	The data in 'r' is a sequence of one or more type 00 or type 01000001
+ * \li	The data in 'r' is a sequence of one or more type 00 or type 01000001
  *	labels.
  */
 
 void
 dns_name_toregion(dns_name_t *name, isc_region_t *r);
-/*
+/*%<
  * Make 'r' refer to 'name'.
  *
  * Requires:
  *
- *	'name' is a valid name.
+ * \li	'name' is a valid name.
  *
- *	'r' is a valid region.
+ * \li	'r' is a valid region.
  */
 
 isc_result_t
 dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 		  dns_decompress_t *dctx, unsigned int options,
 		  isc_buffer_t *target);
-/*
+/*%<
  * Copy the possibly-compressed name at source (active region) into target,
  * decompressing it.
  *
  * Notes:
- *	Decompression policy is controlled by 'dctx'.
+ * \li	Decompression policy is controlled by 'dctx'.
  *
- *	If DNS_NAME_DOWNCASE is set, any uppercase letters in 'source' will be
+ * \li	If DNS_NAME_DOWNCASE is set, any uppercase letters in 'source' will be
  *	downcased when they are copied into 'target'.
  *
  * Security:
  *
- *	*** WARNING ***
+ * \li	*** WARNING ***
  *
- *	This routine will often be used when 'source' contains raw network
+ * \li	This routine will often be used when 'source' contains raw network
  *	data.  A programming error in this routine could result in a denial
  *	of service, or in the hijacking of the server.
  *
  * Requires:
  *
- *	'name' is a valid name.
+ * \li	'name' is a valid name.
  *
- *	'source' is a valid buffer and the first byte of the active
+ * \li	'source' is a valid buffer and the first byte of the active
  *	region should be the first byte of a DNS wire format domain name.
  *
- *	'target' is a valid buffer or 'target' is NULL and 'name' has
+ * \li	'target' is a valid buffer or 'target' is NULL and 'name' has
  *	a dedicated buffer.
  *
- *	'dctx' is a valid decompression context.
+ * \li	'dctx' is a valid decompression context.
  *
  * Ensures:
  *
  *	If result is success:
- *	 	If 'target' is not NULL, 'name' is attached to it.
+ * \li	 	If 'target' is not NULL, 'name' is attached to it.
  *
- *		Uppercase letters are downcased in the copy iff
+ * \li		Uppercase letters are downcased in the copy iff
  *		DNS_NAME_DOWNCASE is set in options.
  *
- *		The current location in source is advanced, and the used space
+ * \li		The current location in source is advanced, and the used space
  *		in target is updated.
  *
  * Result:
- *	Success
- *	Bad Form: Label Length
- *	Bad Form: Unknown Label Type
- *	Bad Form: Name Length
- *	Bad Form: Compression type not allowed
- *	Bad Form: Bad compression pointer
- *	Bad Form: Input too short
- *	Resource Limit: Too many compression pointers
- *	Resource Limit: Not enough space in buffer
+ * \li	Success
+ * \li	Bad Form: Label Length
+ * \li	Bad Form: Unknown Label Type
+ * \li	Bad Form: Name Length
+ * \li	Bad Form: Compression type not allowed
+ * \li	Bad Form: Bad compression pointer
+ * \li	Bad Form: Input too short
+ * \li	Resource Limit: Too many compression pointers
+ * \li	Resource Limit: Not enough space in buffer
  */
 
 isc_result_t
 dns_name_towire(const dns_name_t *name, dns_compress_t *cctx,
-		isc_buffer_t *target);
-/*
+	        isc_buffer_t *target);
+/*%<
  * Convert 'name' into wire format, compressing it as specified by the
  * compression context 'cctx', and storing the result in 'target'.
  *
  * Notes:
- *	If the compression context allows global compression, then the
+ * \li	If the compression context allows global compression, then the
  *	global compression table may be updated.
  *
  * Requires:
- *	'name' is a valid name
+ * \li	'name' is a valid name
  *
- *	dns_name_countlabels(name) > 0
+ * \li	dns_name_countlabels(name) > 0
  *
- *	dns_name_isabsolute(name) == TRUE
+ * \li	dns_name_isabsolute(name) == TRUE
  *
- *	target is a valid buffer.
+ * \li	target is a valid buffer.
  *
- *	Any offsets specified in a global compression table are valid
+ * \li	Any offsets specified in a global compression table are valid
  *	for buffer.
  *
  * Ensures:
  *
  *	If the result is success:
  *
- *		The used space in target is updated.
+ * \li		The used space in target is updated.
  *
  * Returns:
- *	Success
- *	Resource Limit: Not enough space in buffer
+ * \li	Success
+ * \li	Resource Limit: Not enough space in buffer
  */
 
 isc_result_t
 dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 		  dns_name_t *origin, unsigned int options,
 		  isc_buffer_t *target);
-/*
+/*%<
  * Convert the textual representation of a DNS name at source
  * into uncompressed wire form stored in target.
  *
  * Notes:
- *	Relative domain names will have 'origin' appended to them
+ * \li	Relative domain names will have 'origin' appended to them
  *	unless 'origin' is NULL, in which case relative domain names
  *	will remain relative.
  *
- *	If DNS_NAME_DOWNCASE is set in 'options', any uppercase letters
+ * \li	If DNS_NAME_DOWNCASE is set in 'options', any uppercase letters
  *	in 'source' will be downcased when they are copied into 'target'.
  *
  * Requires:
  *
- *	'name' is a valid name.
+ * \li	'name' is a valid name.
  *
- *	'source' is a valid buffer.
+ * \li	'source' is a valid buffer.
  *
- *	'target' is a valid buffer or 'target' is NULL and 'name' has
+ * \li	'target' is a valid buffer or 'target' is NULL and 'name' has
  *	a dedicated buffer.
  *
  * Ensures:
  *
  *	If result is success:
- *	 	If 'target' is not NULL, 'name' is attached to it.
+ * \li	 	If 'target' is not NULL, 'name' is attached to it.
  *
- *		Uppercase letters are downcased in the copy iff
+ * \li		Uppercase letters are downcased in the copy iff
  *		DNS_NAME_DOWNCASE is set in 'options'.
  *
- *		The current location in source is advanced, and the used space
+ * \li		The current location in source is advanced, and the used space
  *		in target is updated.
  *
  * Result:
- *	ISC_R_SUCCESS
- *	DNS_R_EMPTYLABEL
- *	DNS_R_LABELTOOLONG
- *	DNS_R_BADESCAPE
- *	(DNS_R_BADBITSTRING: should not be returned)
- *	(DNS_R_BITSTRINGTOOLONG: should not be returned)
- *	DNS_R_BADDOTTEDQUAD
- *	ISC_R_NOSPACE
- *	ISC_R_UNEXPECTEDEND
+ *\li	#ISC_R_SUCCESS
+ *\li	#DNS_R_EMPTYLABEL
+ *\li	#DNS_R_LABELTOOLONG
+ *\li	#DNS_R_BADESCAPE
+ *\li	(#DNS_R_BADBITSTRING: should not be returned)
+ *\li	(#DNS_R_BITSTRINGTOOLONG: should not be returned)
+ *\li	#DNS_R_BADDOTTEDQUAD
+ *\li	#ISC_R_NOSPACE
+ *\li	#ISC_R_UNEXPECTEDEND
  */
 
 isc_result_t
 dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 		isc_buffer_t *target);
-/*
+/*%<
  * Convert 'name' into text format, storing the result in 'target'.
  *
  * Notes:
- *	If 'omit_final_dot' is true, then the final '.' in absolute
+ *\li	If 'omit_final_dot' is true, then the final '.' in absolute
  *	names other than the root name will be omitted.
  *
- *	If dns_name_countlabels == 0, the name will be "@", representing the
- *	current origin as described by RFC 1035.
+ *\li	If dns_name_countlabels == 0, the name will be "@", representing the
+ *	current origin as described by RFC1035.
  *
- *	The name is not NUL terminated.
+ *\li	The name is not NUL terminated.
  *
  * Requires:
  *
- *	'name' is a valid name
+ *\li	'name' is a valid name
  *
- *	'target' is a valid buffer.
+ *\li	'target' is a valid buffer.
  *
- *	if dns_name_isabsolute == FALSE, then omit_final_dot == FALSE
+ *\li	if dns_name_isabsolute == FALSE, then omit_final_dot == FALSE
  *
  * Ensures:
  *
- *	If the result is success:
- *
- *		The used space in target is updated.
+ *\li	If the result is success:
+ *		the used space in target is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
  */
 
 #define DNS_NAME_MAXTEXT 1023
-/*
+/*%<
  * The maximum length of the text representation of a domain
  * name as generated by dns_name_totext().  This does not
  * include space for a terminating NULL.
@@ -844,56 +860,53 @@ dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 isc_result_t
 dns_name_tofilenametext(dns_name_t *name, isc_boolean_t omit_final_dot,
 			isc_buffer_t *target);
-/*
+/*%<
  * Convert 'name' into an alternate text format appropriate for filenames,
  * storing the result in 'target'.  The name data is downcased, guaranteeing
  * that the filename does not depend on the case of the converted name.
  *
  * Notes:
- *	If 'omit_final_dot' is true, then the final '.' in absolute
+ *\li	If 'omit_final_dot' is true, then the final '.' in absolute
  *	names other than the root name will be omitted.
  *
- *	The name is not NUL terminated.
+ *\li	The name is not NUL terminated.
  *
  * Requires:
  *
- *	'name' is a valid absolute name
+ *\li	'name' is a valid absolute name
  *
- *	'target' is a valid buffer.
+ *\li	'target' is a valid buffer.
  *
  * Ensures:
  *
- *	If the result is success:
- *
- *		The used space in target is updated.
+ *\li	If the result is success:
+ *		the used space in target is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
  */
 
 isc_result_t
 dns_name_downcase(dns_name_t *source, dns_name_t *name,
 		  isc_buffer_t *target);
-/*
+/*%<
  * Downcase 'source'.
  *
  * Requires:
  *
- *	'source' and 'name' are valid names.
- *
- *	If source == name, then
+ *\li	'source' and 'name' are valid names.
  *
+ *\li	If source == name, then
  *		'source' must not be read-only
  *
- *	Otherwise,
- *
+ *\li	Otherwise,
  *		'target' is a valid buffer or 'target' is NULL and
  *		'name' has a dedicated buffer.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
  *
  * Note: if source == name, then the result will always be ISC_R_SUCCESS.
  */
@@ -901,199 +914,198 @@ dns_name_downcase(dns_name_t *source, dns_name_t *name,
 isc_result_t
 dns_name_concatenate(dns_name_t *prefix, dns_name_t *suffix,
 		     dns_name_t *name, isc_buffer_t *target);
-/*
+/*%<
  *	Concatenate 'prefix' and 'suffix'.
  *
  * Requires:
  *
- *	'prefix' is a valid name or NULL.
+ *\li	'prefix' is a valid name or NULL.
  *
- *	'suffix' is a valid name or NULL.
+ *\li	'suffix' is a valid name or NULL.
  *
- *	'name' is a valid name or NULL.
+ *\li	'name' is a valid name or NULL.
  *
- *	'target' is a valid buffer or 'target' is NULL and 'name' has
+ *\li	'target' is a valid buffer or 'target' is NULL and 'name' has
  *	a dedicated buffer.
  *
- *	If 'prefix' is absolute, 'suffix' must be NULL or the empty name.
+ *\li	If 'prefix' is absolute, 'suffix' must be NULL or the empty name.
  *
  * Ensures:
  *
- *	On success,
+ *\li	On success,
  *	 	If 'target' is not NULL and 'name' is not NULL, then 'name'
  *		is attached to it.
- *
  *		The used space in target is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
- *	DNS_R_NAMETOOLONG
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
+ *\li	#DNS_R_NAMETOOLONG
  */
 
 void
 dns_name_split(dns_name_t *name, unsigned int suffixlabels,
 	       dns_name_t *prefix, dns_name_t *suffix);
-/*
+/*%<
  *
  * Split 'name' into two pieces on a label boundary.
  *
  * Notes:
- *      'name' is split such that 'suffix' holds the most significant
+ * \li     'name' is split such that 'suffix' holds the most significant
  *      'suffixlabels' labels.  All other labels are stored in 'prefix'. 
  *
- *	Copying name data is avoided as much as possible, so 'prefix'
+ *\li	Copying name data is avoided as much as possible, so 'prefix'
  *	and 'suffix' will end up pointing at the data for 'name'.
  *
- *	It is legitimate to pass a 'prefix' or 'suffix' that has
+ *\li	It is legitimate to pass a 'prefix' or 'suffix' that has
  *	its name data stored someplace other than the dedicated buffer.
  *	This is useful to avoid name copying in the calling function.
  *
- *	It is also legitimate to pass a 'prefix' or 'suffix' that is
+ *\li	It is also legitimate to pass a 'prefix' or 'suffix' that is
  *	the same dns_name_t as 'name'.
  *
  * Requires:
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
- * 	'suffixlabels' cannot exceed the number of labels in 'name'.
+ *\li	'suffixlabels' cannot exceed the number of labels in 'name'.
  *
- *	'prefix' is a valid name or NULL, and cannot be read-only.
+ * \li	'prefix' is a valid name or NULL, and cannot be read-only.
  *
- *	'suffix' is a valid name or NULL, and cannot be read-only.
+ *\li	'suffix' is a valid name or NULL, and cannot be read-only.
  *
- *	If non-NULL, 'prefix' and 'suffix' must have dedicated buffers.
+ *\li	If non-NULL, 'prefix' and 'suffix' must have dedicated buffers.
  *
- *	'prefix' and 'suffix' cannot point to the same buffer.
+ *\li	'prefix' and 'suffix' cannot point to the same buffer.
  *
  * Ensures:
  *
- *	On success:
+ *\li	On success:
  *		If 'prefix' is not NULL it will contain the least significant
  *		labels.
- *
  *		If 'suffix' is not NULL it will contain the most significant
  *		labels.  dns_name_countlabels(suffix) will be equal to
  *		suffixlabels.
  *
- *	On failure:
+ *\li	On failure:
  *		Either 'prefix' or 'suffix' is invalidated (depending
  *		on which one the problem was encountered with).
  *
  * Returns:
- *	ISC_R_SUCCESS	No worries.  (This function should always success).
+ *\li	#ISC_R_SUCCESS	No worries.  (This function should always success).
  */
 
 isc_result_t
-dns_name_dup(const dns_name_t *source, isc_mem_t *mctx, dns_name_t *target);
-/*
+dns_name_dup(const dns_name_t *source, isc_mem_t *mctx,
+	     dns_name_t *target);
+/*%<
  * Make 'target' a dynamically allocated copy of 'source'.
  *
  * Requires:
  *
- *	'source' is a valid non-empty name.
+ *\li	'source' is a valid non-empty name.
  *
- *	'target' is a valid name that is not read-only.
+ *\li	'target' is a valid name that is not read-only.
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  */
 
 isc_result_t
 dns_name_dupwithoffsets(dns_name_t *source, isc_mem_t *mctx,
 			dns_name_t *target);
-/*
+/*%<
  * Make 'target' a read-only dynamically allocated copy of 'source'.
  * 'target' will also have a dynamically allocated offsets table.
  *
  * Requires:
  *
- *	'source' is a valid non-empty name.
+ *\li	'source' is a valid non-empty name.
  *
- *	'target' is a valid name that is not read-only.
+ *\li	'target' is a valid name that is not read-only.
  *
- *	'target' has no offsets table.
+ *\li	'target' has no offsets table.
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  */
 
 void
 dns_name_free(dns_name_t *name, isc_mem_t *mctx);
-/*
+/*%<
  * Free 'name'.
  *
  * Requires:
  *
- *	'name' is a valid name created previously in 'mctx' by dns_name_dup().
+ *\li	'name' is a valid name created previously in 'mctx' by dns_name_dup().
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
  * Ensures:
  *
- *	All dynamic resources used by 'name' are freed and the name is
+ *\li	All dynamic resources used by 'name' are freed and the name is
  *	invalidated.
  */
 
 isc_result_t
 dns_name_digest(dns_name_t *name, dns_digestfunc_t digest, void *arg);
-/*
+/*%<
  * Send 'name' in DNSSEC canonical form to 'digest'.
  *
  * Requires:
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
- *	'digest' is a valid dns_digestfunc_t.
+ *\li	'digest' is a valid dns_digestfunc_t.
  *
  * Ensures:
  *
- *	If successful, the DNSSEC canonical form of 'name' will have been
+ *\li	If successful, the DNSSEC canonical form of 'name' will have been
  *	sent to 'digest'.
  *
- *	If digest() returns something other than ISC_R_SUCCESS, that result
+ *\li	If digest() returns something other than ISC_R_SUCCESS, that result
  *	will be returned as the result of dns_name_digest().
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *
- *	Many other results are possible if not successful.
+ *\li	Many other results are possible if not successful.
  *
  */
 
 isc_boolean_t
 dns_name_dynamic(dns_name_t *name);
-/*
+/*%<
  * Returns whether there is dynamic memory associated with this name.
  *
  * Requires:
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
  * Returns:
  *
- *	'ISC_TRUE' if the name is dynamic othewise 'ISC_FALSE'.
+ *\li	'ISC_TRUE' if the name is dynamic othewise 'ISC_FALSE'.
  */
 
 isc_result_t
 dns_name_print(dns_name_t *name, FILE *stream);
-/*
+/*%<
  * Print 'name' on 'stream'.
  *
  * Requires:
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
- *	'stream' is a valid stream.
+ *\li	'stream' is a valid stream.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *
- *	Any error that dns_name_totext() can return.
+ *\li	Any error that dns_name_totext() can return.
  */
 
 void
 dns_name_format(dns_name_t *name, char *cp, unsigned int size);
-/*
+/*%<
  * Format 'name' as text appropriate for use in log messages.
  *
  * Store the formatted name at 'cp', writing no more than
@@ -1108,47 +1120,63 @@ dns_name_format(dns_name_t *name, char *cp, unsigned int size);
  *
  * Requires:
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
- *	'cp' points a valid character array of size 'size'.
+ *\li	'cp' points a valid character array of size 'size'.
  *
- *	'size' > 0.
+ *\li	'size' > 0.
  *
  */
 
+isc_result_t
+dns_name_settotextfilter(dns_name_totextfilter_t proc);
+/*%<
+ * Set / clear a thread specific function 'proc' to be called at the
+ * end of dns_name_totext().
+ *
+ * Note: Under Windows you need to call "dns_name_settotextfilter(NULL);"
+ * prior to exiting the thread otherwise memory will be leaked.
+ * For other platforms, which are pthreads based, this is still a good
+ * idea but not required.
+ *
+ * Returns
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_UNEXPECTED
+ */
+
 #define DNS_NAME_FORMATSIZE (DNS_NAME_MAXTEXT + 1)
-/*
+/*%<
  * Suggested size of buffer passed to dns_name_format().
  * Includes space for the terminating NULL.
  */
 
 isc_result_t
 dns_name_copy(dns_name_t *source, dns_name_t *dest, isc_buffer_t *target);
-/*
+/*%<
  * Makes 'dest' refer to a copy of the name in 'source'.  The data are
  * either copied to 'target' or the dedicated buffer in 'dest'.
  *
  * Requires:
- * 	'source' is a valid name.
+ * \li	'source' is a valid name.
  *
- * 	'dest' is an initialized name with a dedicated buffer.
+ * \li	'dest' is an initialized name with a dedicated buffer.
  *
- * 	'target' is NULL or an initialized buffer.
+ * \li	'target' is NULL or an initialized buffer.
  *
- * 	Either dest has a dedicated buffer or target != NULL.
+ * \li	Either dest has a dedicated buffer or target != NULL.
  *
  * Ensures:
  *
- *	On success, the used space in target is updated.
+ *\li	On success, the used space in target is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
  */
 
 isc_boolean_t
 dns_name_ishostname(const dns_name_t *name, isc_boolean_t wildcard);
-/*
+/*%<
  * Return if 'name' is a valid hostname.  RFC 952 / RFC 1123.
  * If 'wildcard' is ISC_TRUE then allow the first label of name to
  * be a wildcard.
@@ -1161,16 +1189,37 @@ dns_name_ishostname(const dns_name_t *name, isc_boolean_t wildcard);
 
 isc_boolean_t
 dns_name_ismailbox(const dns_name_t *name);
-/*
+/*%<
  * Return if 'name' is a valid mailbox.  RFC 821.
  *
  * Requires:
- *	'name' to be valid.
+ * \li	'name' to be valid.
+ */
+
+isc_boolean_t
+dns_name_internalwildcard(const dns_name_t *name);
+/*%<
+ * Return if 'name' contains a internal wildcard name.
+ *
+ * Requires:
+ * \li	'name' to be valid.
+ */
+
+void
+dns_name_destroy(void);
+/*%<
+ * Cleanup dns_name_settotextfilter() / dns_name_totext() state.
+ *
+ * This should be called as part of the final cleanup process.
+ *
+ * Note: dns_name_settotextfilter(NULL); should be called for all
+ * threads which have called dns_name_settotextfilter() with a
+ * non-NULL argument prior to calling dns_name_destroy();
  */
 
 ISC_LANG_ENDDECLS
 
-/***
+/*
  *** High Peformance Macros
  ***/
 
diff --git a/contrib/bind9/lib/dns/include/dns/ncache.h b/contrib/bind9/lib/dns/include/dns/ncache.h
index 6bf6003..459effb 100644
--- a/contrib/bind9/lib/dns/include/dns/ncache.h
+++ b/contrib/bind9/lib/dns/include/dns/ncache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ncache.h,v 1.12.12.5 2004/03/08 09:04:37 marka Exp $ */
+/* $Id: ncache.h,v 1.17.18.2 2005/04/29 00:16:16 marka Exp $ */
 
 #ifndef DNS_NCACHE_H
 #define DNS_NCACHE_H 1
@@ -24,25 +24,26 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ *\brief
  * DNS Ncache
  *
- * XXX <TBS> XXX
+ * XXX TBS XXX
  *
  * MP:
- *	The caller must ensure any required synchronization.
+ *\li	The caller must ensure any required synchronization.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	RFC 2308
+ *\li	RFC2308
  */
 
 #include <isc/lang.h>
@@ -52,7 +53,7 @@
 
 ISC_LANG_BEGINDECLS
 
-/*
+/*%
  * _OMITDNSSEC:
  *      Omit DNSSEC records when rendering.
  */
@@ -62,7 +63,7 @@ isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
 	       dns_rdataset_t *addedrdataset);
-/*
+/*%<
  * Convert the authority data from 'message' into a negative cache
  * rdataset, and store it in 'cache' at 'node' with a TTL limited to
  * 'maxttl'.
@@ -71,21 +72,21 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
  * or dns_rdatatype_any when caching a NXDOMAIN response.
  *
  * Note:
- *	If 'addedrdataset' is not NULL, then it will be attached to the added
+ *\li	If 'addedrdataset' is not NULL, then it will be attached to the added
  *	rdataset.  See dns_db_addrdataset() for more details.
  *
  * Requires:
- *	'message' is a valid message with a properly formatting negative cache
+ *\li	'message' is a valid message with a properly formatting negative cache
  *	authority section.
  *
- *	The requirements of dns_db_addrdataset() apply to 'cache', 'node',
+ *\li	The requirements of dns_db_addrdataset() apply to 'cache', 'node',
  *	'now', and 'addedrdataset'.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE
  *
- *	Any result code of dns_db_addrdataset() is a possible result code
+ *\li	Any result code of dns_db_addrdataset() is a possible result code
  *	of dns_ncache_add().
  */
 
@@ -93,63 +94,63 @@ isc_result_t
 dns_ncache_towire(dns_rdataset_t *rdataset, dns_compress_t *cctx,
 		  isc_buffer_t *target, unsigned int options,
 		  unsigned int *countp);
-/*
+/*%<
  * Convert the negative caching rdataset 'rdataset' to wire format,
  * compressing names as specified in 'cctx', and storing the result in
  * 'target'.  If 'omit_dnssec' is set, DNSSEC records will not
  * be added to 'target'.
  *
  * Notes:
- *	The number of RRs added to target will be added to *countp.
+ *\li	The number of RRs added to target will be added to *countp.
  *
  * Requires:
- *	'rdataset' is a valid negative caching rdataset.
+ *\li	'rdataset' is a valid negative caching rdataset.
  *
- *	'rdataset' is not empty.
+ *\li	'rdataset' is not empty.
  *
- *	'countp' is a valid pointer.
+ *\li	'countp' is a valid pointer.
  *
  * Ensures:
- *	On a return of ISC_R_SUCCESS, 'target' contains a wire format
+ *\li	On a return of ISC_R_SUCCESS, 'target' contains a wire format
  *	for the data contained in 'rdataset'.  Any error return leaves
  *	the buffer unchanged.
  *
- *	*countp has been incremented by the number of RRs added to
+ *\li	*countp has been incremented by the number of RRs added to
  *	target.
  *
  * Returns:
- *	ISC_R_SUCCESS		- all ok
- *	ISC_R_NOSPACE		- 'target' doesn't have enough room
+ *\li	#ISC_R_SUCCESS		- all ok
+ *\li	#ISC_R_NOSPACE		- 'target' doesn't have enough room
  *
- *	Any error returned by dns_rdata_towire(), dns_rdataset_next(),
+ *\li	Any error returned by dns_rdata_towire(), dns_rdataset_next(),
  *	dns_name_towire().
  */
 
 isc_result_t
 dns_ncache_getrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
 		       dns_rdatatype_t type, dns_rdataset_t *rdataset);
-/*
+/*%<
  * Search the negative caching rdataset for an rdataset with the
  * specified name and type.
  *
  * Requires:
- *	'ncacherdataset' is a valid negative caching rdataset.
+ *\li	'ncacherdataset' is a valid negative caching rdataset.
  *
- *	'ncacherdataset' is not empty.
+ *\li	'ncacherdataset' is not empty.
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
- *	'type' is not SIG, or a meta-RR type.
+ *\li	'type' is not SIG, or a meta-RR type.
  *
- *	'rdataset' is a valid disassociated rdataset.
+ *\li	'rdataset' is a valid disassociated rdataset.
  *
  * Ensures:
- *	On a return of ISC_R_SUCCESS, 'rdataset' is bound to the found
+ *\li	On a return of ISC_R_SUCCESS, 'rdataset' is bound to the found
  *	rdataset.
  *
  * Returns:
- *	ISC_R_SUCCESS		- the rdataset was found.
- *	ISC_R_NOTFOUND		- the rdataset was not found.
+ *\li	#ISC_R_SUCCESS		- the rdataset was found.
+ *\li	#ISC_R_NOTFOUND		- the rdataset was not found.
  *
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/nsec.h b/contrib/bind9/lib/dns/include/dns/nsec.h
index 68a5833..46b75fa 100644
--- a/contrib/bind9/lib/dns/include/dns/nsec.h
+++ b/contrib/bind9/lib/dns/include/dns/nsec.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec.h,v 1.4.2.1 2004/03/08 02:08:00 marka Exp $ */
+/* $Id: nsec.h,v 1.4.20.2 2005/04/29 00:16:16 marka Exp $ */
 
 #ifndef DNS_NSEC_H
 #define DNS_NSEC_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -33,33 +35,33 @@ isc_result_t
 dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version,
 		    dns_dbnode_t *node, dns_name_t *target,
 		    unsigned char *buffer, dns_rdata_t *rdata);
-/*
+/*%<
  * Build the rdata of a NSEC record.
  *
  * Requires:
- *	buffer	Points to a temporary buffer of at least
+ *\li	buffer	Points to a temporary buffer of at least
  * 		DNS_NSEC_BUFFERSIZE bytes.
- *	rdata	Points to an initialized dns_rdata_t.
+ *\li	rdata	Points to an initialized dns_rdata_t.
  *
  * Ensures:
- *      *rdata	Contains a valid NSEC rdata.  The 'data' member refers
+ *  \li    *rdata	Contains a valid NSEC rdata.  The 'data' member refers
  *		to 'buffer'.
  */
 
 isc_result_t
 dns_nsec_build(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node,
 	       dns_name_t *target, dns_ttl_t ttl);
-/*
+/*%<
  * Build a NSEC record and add it to a database.
  */
 
 isc_boolean_t
 dns_nsec_typepresent(dns_rdata_t *nsec, dns_rdatatype_t type);
-/*
+/*%<
  * Determine if a type is marked as present in an NSEC record.
  *
  * Requires:
- *	'nsec' points to a valid rdataset of type NSEC
+ *\li	'nsec' points to a valid rdataset of type NSEC
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/opcode.h b/contrib/bind9/lib/dns/include/dns/opcode.h
index 4d656b8..4796dba 100644
--- a/contrib/bind9/lib/dns/include/dns/opcode.h
+++ b/contrib/bind9/lib/dns/include/dns/opcode.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: opcode.h,v 1.1.200.3 2004/03/08 09:04:37 marka Exp $ */
+/* $Id: opcode.h,v 1.2.18.2 2005/04/29 00:16:16 marka Exp $ */
 
 #ifndef DNS_OPCODE_H
 #define DNS_OPCODE_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -27,21 +29,21 @@
 ISC_LANG_BEGINDECLS
 
 isc_result_t dns_opcode_totext(dns_opcode_t opcode, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of error 'opcode' into 'target'.
  *
  * Requires:
- *	'opcode' is a valid opcode.
+ *\li	'opcode' is a valid opcode.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
  * Ensures:
- *	If the result is success:
+ *\li	If the result is success:
  *		The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#ISC_R_NOSPACE			target buffer is too small
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/order.h b/contrib/bind9/lib/dns/include/dns/order.h
index e28e3ca..6458db0 100644
--- a/contrib/bind9/lib/dns/include/dns/order.h
+++ b/contrib/bind9/lib/dns/include/dns/order.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: order.h,v 1.2.202.3 2004/03/08 09:04:37 marka Exp $ */
+/* $Id: order.h,v 1.3.18.2 2005/04/29 00:16:17 marka Exp $ */
 
 #ifndef DNS_ORDER_H
 #define DNS_ORDER_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -29,67 +31,67 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_order_create(isc_mem_t *mctx, dns_order_t **orderp);
-/*
+/*%<
  * Create a order object.
  *
  * Requires:
- * 	'orderp' to be non NULL and '*orderp == NULL'.
- *	'mctx' to be valid.
+ * \li	'orderp' to be non NULL and '*orderp == NULL'.
+ *\li	'mctx' to be valid.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_order_add(dns_order_t *order, dns_name_t *name,
 	      dns_rdatatype_t rdtype, dns_rdataclass_t rdclass,
 	      unsigned int mode);
-/*
+/*%<
  * Add a entry to the end of the order list.
  *
  * Requires:
- * 	'order' to be valid.
- *	'name' to be valid.
- *	'mode' to be one of DNS_RDATASERATTR_RANDOMIZE,
- *		DNS_RDATASERATTR_RANDOMIZE or zero (DNS_RDATASERATTR_CYCLIC).
+ * \li	'order' to be valid.
+ *\li	'name' to be valid.
+ *\li	'mode' to be one of #DNS_RDATASERATTR_RANDOMIZE,
+ *		#DNS_RDATASERATTR_RANDOMIZE or zero (#DNS_RDATASERATTR_CYCLIC).
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 unsigned int
 dns_order_find(dns_order_t *order, dns_name_t *name,
 	       dns_rdatatype_t rdtype, dns_rdataclass_t rdclass);
-/*
+/*%<
  * Find the first matching entry on the list.
  *
  * Requires:
- *	'order' to be valid.
- *	'name' to be valid.
+ *\li	'order' to be valid.
+ *\li	'name' to be valid.
  *
  * Returns the mode set by dns_order_add() or zero.
  */
 
 void
 dns_order_attach(dns_order_t *source, dns_order_t **target);
-/*
+/*%<
  * Attach to the 'source' object.
  *
  * Requires:
- * 	'source' to be valid.
- *	'target' to be non NULL and '*target == NULL'.
+ * \li	'source' to be valid.
+ *\li	'target' to be non NULL and '*target == NULL'.
  */
 
 void
 dns_order_detach(dns_order_t **orderp);
-/*
+/*%<
  * Detach from the object.  Clean up if last this was the last
  * reference.
  *
  * Requires:
- *	'*orderp' to be valid.
+ *\li	'*orderp' to be valid.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/peer.h b/contrib/bind9/lib/dns/include/dns/peer.h
index 9032964..be5a8c3 100644
--- a/contrib/bind9/lib/dns/include/dns/peer.h
+++ b/contrib/bind9/lib/dns/include/dns/peer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: peer.h,v 1.16.2.1.10.5 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: peer.h,v 1.20.18.8 2006/02/28 03:10:48 marka Exp $ */
 
 #ifndef DNS_PEER_H
 #define DNS_PEER_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * Data structures for peers (e.g. a 'server' config file statement)
  */
 
@@ -64,6 +65,7 @@ struct dns_peer {
 	isc_mem_t	       *mem;
 
 	isc_netaddr_t		address;
+	unsigned int		prefixlen;
 	isc_boolean_t		bogus;
 	dns_transfer_format_t	transfer_format;
 	isc_uint32_t		transfers;
@@ -73,6 +75,10 @@ struct dns_peer {
 	isc_boolean_t		support_edns;
 	dns_name_t	       *key;
 	isc_sockaddr_t	       *transfer_source;
+	isc_sockaddr_t	       *notify_source;  
+	isc_sockaddr_t	       *query_source;  
+	isc_uint16_t		udpsize;		/* recieve size */
+	isc_uint16_t		maxudp;			/* transmit size */
 
 	isc_uint32_t		bitflags;
 
@@ -115,6 +121,10 @@ dns_peerlist_currpeer(dns_peerlist_t *peers, dns_peer_t **retval);
 isc_result_t
 dns_peer_new(isc_mem_t *mem, isc_netaddr_t *ipaddr, dns_peer_t **peer);
 
+isc_result_t
+dns_peer_newprefix(isc_mem_t *mem, isc_netaddr_t *ipaddr,
+		   unsigned int prefixlen, dns_peer_t **peer);
+
 void
 dns_peer_attach(dns_peer_t *source, dns_peer_t **target);
 
@@ -173,6 +183,30 @@ dns_peer_settransfersource(dns_peer_t *peer,
 isc_result_t
 dns_peer_gettransfersource(dns_peer_t *peer, isc_sockaddr_t *transfer_source);
 
+isc_result_t
+dns_peer_setudpsize(dns_peer_t *peer, isc_uint16_t udpsize);
+
+isc_result_t
+dns_peer_getudpsize(dns_peer_t *peer, isc_uint16_t *udpsize);
+
+isc_result_t
+dns_peer_setmaxudp(dns_peer_t *peer, isc_uint16_t maxudp);
+
+isc_result_t
+dns_peer_getmaxudp(dns_peer_t *peer, isc_uint16_t *maxudp);
+
+isc_result_t
+dns_peer_setnotifysource(dns_peer_t *peer, const isc_sockaddr_t *notify_source);
+
+isc_result_t
+dns_peer_getnotifysource(dns_peer_t *peer, isc_sockaddr_t *notify_source);
+
+isc_result_t
+dns_peer_setquerysource(dns_peer_t *peer, const isc_sockaddr_t *query_source);
+
+isc_result_t
+dns_peer_getquerysource(dns_peer_t *peer, isc_sockaddr_t *query_source);
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_PEER_H */
diff --git a/contrib/bind9/lib/dns/include/dns/portlist.h b/contrib/bind9/lib/dns/include/dns/portlist.h
index ea672a9..2d400d4 100644
--- a/contrib/bind9/lib/dns/include/dns/portlist.h
+++ b/contrib/bind9/lib/dns/include/dns/portlist.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: portlist.h,v 1.2.84.2 2004/03/06 08:13:58 marka Exp $ */
+/* $Id: portlist.h,v 1.3.18.2 2005/04/29 00:16:17 marka Exp $ */
+
+/*! \file */
 
 #include <isc/lang.h>
 #include <isc/net.h>
@@ -27,73 +29,73 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_portlist_create(isc_mem_t *mctx, dns_portlist_t **portlistp);
-/*
+/*%<
  * Create a port list.
  * 
  * Requires:
- *	'mctx' to be valid.
- *	'portlistp' to be non NULL and '*portlistp' to be NULL;
+ *\li	'mctx' to be valid.
+ *\li	'portlistp' to be non NULL and '*portlistp' to be NULL;
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
  */
 
 isc_result_t
 dns_portlist_add(dns_portlist_t *portlist, int af, in_port_t port);
-/*
+/*%<
  * Add the given <port,af> tuple to the portlist.
  *
  * Requires:
- *	'portlist' to be valid.
- *	'af' to be AF_INET or AF_INET6
+ *\li	'portlist' to be valid.
+ *\li	'af' to be AF_INET or AF_INET6
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 void
 dns_portlist_remove(dns_portlist_t *portlist, int af, in_port_t port);
-/*
+/*%<
  * Remove the given <port,af> tuple to the portlist.
  *
  * Requires:
- *	'portlist' to be valid.
- *	'af' to be AF_INET or AF_INET6
+ *\li	'portlist' to be valid.
+ *\li	'af' to be AF_INET or AF_INET6
  */
 
 isc_boolean_t
 dns_portlist_match(dns_portlist_t *portlist, int af, in_port_t port);
-/*
+/*%<
  * Find the given <port,af> tuple to the portlist.
  *
  * Requires:
- *	'portlist' to be valid.
- *	'af' to be AF_INET or AF_INET6
+ *\li	'portlist' to be valid.
+ *\li	'af' to be AF_INET or AF_INET6
  *
  * Returns
- * 	ISC_TRUE if the tuple is found, ISC_FALSE otherwise.
+ * \li	#ISC_TRUE if the tuple is found, ISC_FALSE otherwise.
  */
 
 void
 dns_portlist_attach(dns_portlist_t *portlist, dns_portlist_t **portlistp);
-/*
+/*%<
  * Attach to a port list.
  *
  * Requires:
- *	'portlist' to be valid.
- *	'portlistp' to be non NULL and '*portlistp' to be NULL;
+ *\li	'portlist' to be valid.
+ *\li	'portlistp' to be non NULL and '*portlistp' to be NULL;
  */
 
 void
 dns_portlist_detach(dns_portlist_t **portlistp);
-/*
+/*%<
  * Detach from a port list.
  *
  * Requires:
- *	'*portlistp' to be valid.
+ *\li	'*portlistp' to be valid.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/rbt.h b/contrib/bind9/lib/dns/include/dns/rbt.h
index 6f99a7d..a1edf0c 100644
--- a/contrib/bind9/lib/dns/include/dns/rbt.h
+++ b/contrib/bind9/lib/dns/include/dns/rbt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,13 +15,16 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbt.h,v 1.55.12.6 2004/10/11 05:55:51 marka Exp $ */
+/* $Id: rbt.h,v 1.59.18.5 2005/10/13 01:26:07 marka Exp $ */
 
 #ifndef DNS_RBT_H
 #define DNS_RBT_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/magic.h>
+#include <isc/refcount.h>
 
 #include <dns/types.h>
 
@@ -29,7 +32,8 @@ ISC_LANG_BEGINDECLS
 
 #define DNS_RBT_USEHASH 1
 
-/*
+/*@{*/
+/*%
  * Option values for dns_rbt_findnode() and dns_rbt_findname().
  * These are used to form a bitmask.
  */
@@ -37,6 +41,13 @@ ISC_LANG_BEGINDECLS
 #define DNS_RBTFIND_EMPTYDATA			0x01
 #define DNS_RBTFIND_NOEXACT			0x02
 #define DNS_RBTFIND_NOPREDECESSOR		0x04
+/*@}*/
+
+#ifndef DNS_RBT_USEISCREFCOUNT
+#ifdef ISC_REFCOUNT_HAVEATOMIC
+#define DNS_RBT_USEISCREFCOUNT 1
+#endif
+#endif
 
 /*
  * These should add up to 30.
@@ -51,7 +62,7 @@ ISC_LANG_BEGINDECLS
 #define DNS_RBTNODE_VALID(n)		ISC_TRUE
 #endif
 
-/*
+/*%
  * This is the structure that is used for each node in the red/black
  * tree of trees.  NOTE WELL:  the implementation manages this as a variable
  * length structure, with the actual wire-format name and other data
@@ -69,7 +80,8 @@ typedef struct dns_rbtnode {
 #ifdef DNS_RBT_USEHASH
 	struct dns_rbtnode *hashnext;
 #endif
-	/*
+	/*@{*/
+	/*!
 	 * The following bitfields add up to a total bitwidth of 32.
 	 * The range of values necessary for each item is indicated,
 	 * but in the case of "attributes" the field is wider to accomodate
@@ -81,19 +93,21 @@ typedef struct dns_rbtnode {
 	 * In each case below the "range" indicated is what's _necessary_ for
 	 * the bitfield to hold, not what it actually _can_ hold.
 	 */
-	unsigned int is_root : 1;	/* range is 0..1 */
-	unsigned int color : 1;		/* range is 0..1 */
-	unsigned int find_callback : 1;	/* range is 0..1 */
-	unsigned int attributes : 4;	/* range is 0..2 */
-	unsigned int namelen : 8;	/* range is 1..255 */
-	unsigned int offsetlen : 8;	/* range is 1..128 */
-	unsigned int padbytes : 9;	/* range is 0..380 */
+	unsigned int is_root : 1;	/*%< range is 0..1 */
+	unsigned int color : 1;		/*%< range is 0..1 */
+	unsigned int find_callback : 1;	/*%< range is 0..1 */
+	unsigned int attributes : 4;	/*%< range is 0..2 */
+	unsigned int namelen : 8;	/*%< range is 1..255 */
+	unsigned int offsetlen : 8;	/*%< range is 1..128 */
+	unsigned int padbytes : 9;	/*%< range is 0..380 */
+	/*@}*/
 
 #ifdef DNS_RBT_USEHASH
 	unsigned int hashval;
 #endif
 
-	/*
+	/*@{*/
+	/*!
 	 * These values are used in the RBT DB implementation.  The appropriate
 	 * node lock must be held before accessing them.
 	 */
@@ -101,7 +115,12 @@ typedef struct dns_rbtnode {
 	unsigned int dirty:1;
 	unsigned int wild:1;
 	unsigned int locknum:DNS_RBT_LOCKLENGTH;
+#ifndef DNS_RBT_USEISCREFCOUNT
 	unsigned int references:DNS_RBT_REFLENGTH;
+#else
+	isc_refcount_t references; /* note that this is not in the bitfield */
+#endif
+	/*@}*/
 } dns_rbtnode_t;
 
 typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t *node,
@@ -112,7 +131,7 @@ typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t *node,
  *****	Chain Info
  *****/
 
-/*
+/*!
  * A chain is used to keep track of the sequence of nodes to reach any given
  * node from the root of the tree.  Originally nodes did not have parent
  * pointers in them (for memory usage reasons) so there was no way to find
@@ -151,7 +170,7 @@ typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t *node,
  * functions but additionally can provide the node to which the chain points.
  */
 
-/*
+/*%
  * The number of level blocks to allocate at a time.  Currently the maximum
  * number of levels is allocated directly in the structure, but future
  * revisions of this code might have a static initial block with dynamic
@@ -165,14 +184,14 @@ typedef isc_result_t (*dns_rbtfindcallback_t)(dns_rbtnode_t *node,
 typedef struct dns_rbtnodechain {
 	unsigned int		magic;
 	isc_mem_t *		mctx;
-	/*
+	/*%
 	 * The terminal node of the chain.  It is not in levels[].
 	 * This is ostensibly private ... but in a pinch it could be
 	 * used tell that the chain points nowhere without needing to
 	 * call dns_rbtnodechain_current().
 	 */
 	dns_rbtnode_t *		end;
-	/*
+	/*%
 	 * The maximum number of labels in a name is 128; bitstrings mean
 	 * a conceptually very large number (which I have not bothered to
 	 * compute) of logical levels because splitting can potentially occur
@@ -181,7 +200,7 @@ typedef struct dns_rbtnodechain {
 	 * in the worst case.
 	 */
 	dns_rbtnode_t *		levels[DNS_RBT_LEVELBLOCK];
-	/*
+	/*%
 	 * level_count indicates how deep the chain points into the
 	 * tree of trees, and is the index into the levels[] array.
 	 * Thus, levels[level_count - 1] is the last level node stored.
@@ -190,7 +209,7 @@ typedef struct dns_rbtnodechain {
 	 * so on.
 	 */
 	unsigned int		level_count;
-	/*
+	/*%
 	 * level_matches tells how many levels matched above the node
 	 * returned by dns_rbt_findnode().  A match (partial or exact) found
 	 * in the first level thus results in level_matches being set to 1.
@@ -203,44 +222,43 @@ typedef struct dns_rbtnodechain {
 /*****
  ***** Public interfaces.
  *****/
-
 isc_result_t
 dns_rbt_create(isc_mem_t *mctx, void (*deleter)(void *, void *),
 	       void *deleter_arg, dns_rbt_t **rbtp);
-/*
+/*%<
  * Initialize a red-black tree of trees.
  *
  * Notes:
- *	The deleter argument, if non-null, points to a function that is
+ *\li	The deleter argument, if non-null, points to a function that is
  *	responsible for cleaning up any memory associated with the data
  *	pointer of a node when the node is deleted.  It is passed the
  *	deleted node's data pointer as its first argument and deleter_arg
  *	as its second argument.
  *
  * Requires:
- * 	mctx is a pointer to a valid memory context.
- *	rbtp != NULL && *rbtp == NULL
- *	arg == NULL iff deleter == NULL
+ * \li	mctx is a pointer to a valid memory context.
+ *\li	rbtp != NULL && *rbtp == NULL
+ *\li	arg == NULL iff deleter == NULL
  *
  * Ensures:
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is ISC_R_SUCCESS:
  *		*rbtp points to a valid red-black tree manager
  *
- *	If result is failure:
+ *\li	If result is failure:
  *		*rbtp does not point to a valid red-black tree manager.
  *
  * Returns:
- *	ISC_R_SUCCESS	Success
- *	ISC_R_NOMEMORY	Resource limit: Out of Memory
+ *\li	#ISC_R_SUCCESS	Success
+ *\li	#ISC_R_NOMEMORY	Resource limit: Out of Memory
  */
 
 isc_result_t
 dns_rbt_addname(dns_rbt_t *rbt, dns_name_t *name, void *data);
-/*
+/*%<
  * Add 'name' to the tree of trees, associated with 'data'.
  *
  * Notes:
- *	'data' is never required to be non-NULL, but specifying it
+ *\li	'data' is never required to be non-NULL, but specifying it
  *	when the name is added is faster than searching for 'name'
  *	again and then setting the data pointer.  The lack of a data pointer
  *	for a node also has other ramifications regarding whether
@@ -248,106 +266,103 @@ dns_rbt_addname(dns_rbt_t *rbt, dns_name_t *name, void *data);
  *	joins nodes.
  *
  * Requires:
- *	rbt is a valid rbt manager.
- *	dns_name_isabsolute(name) == TRUE
+ *\li	rbt is a valid rbt manager.
+ *\li	dns_name_isabsolute(name) == TRUE
  *
  * Ensures:
- *	'name' is not altered in any way.
+ *\li	'name' is not altered in any way.
  *
- *	Any external references to nodes in the tree are unaffected by
+ *\li	Any external references to nodes in the tree are unaffected by
  *	node splits that are necessary to insert the new name.
  *
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is #ISC_R_SUCCESS:
  *		'name' is findable in the red/black tree of trees in O(log N).
- *
  *		The data pointer of the node for 'name' is set to 'data'.
  *
- *	If result is ISC_R_EXISTS or ISC_R_NOSPACE:
+ *\li	If result is #ISC_R_EXISTS or #ISC_R_NOSPACE:
  *		The tree of trees is unaltered.
  *
- *	If result is ISC_R_NOMEMORY:
+ *\li	If result is #ISC_R_NOMEMORY:
  *		No guarantees.
  *
  * Returns:
- *	ISC_R_SUCCESS	Success
- *	ISC_R_EXISTS	The name already exists with associated data.
- *	ISC_R_NOSPACE 	The name had more logical labels than are allowed.
- *	ISC_R_NOMEMORY	Resource Limit: Out of Memory
+ *\li	#ISC_R_SUCCESS	Success
+ *\li	#ISC_R_EXISTS	The name already exists with associated data.
+ *\li	#ISC_R_NOSPACE 	The name had more logical labels than are allowed.
+ *\li	#ISC_R_NOMEMORY	Resource Limit: Out of Memory
  */
 
 isc_result_t
 dns_rbt_addnode(dns_rbt_t *rbt, dns_name_t *name, dns_rbtnode_t **nodep);
 
-/*
+/*%<
  * Just like dns_rbt_addname, but returns the address of the node.
  *
  * Requires:
- *	rbt is a valid rbt structure.
- *	dns_name_isabsolute(name) == TRUE
- *	nodep != NULL && *nodep == NULL
+ *\li	rbt is a valid rbt structure.
+ *\li	dns_name_isabsolute(name) == TRUE
+ *\li	nodep != NULL && *nodep == NULL
  *
  * Ensures:
- *	'name' is not altered in any way.
+ *\li	'name' is not altered in any way.
  *
- *	Any external references to nodes in the tree are unaffected by
+ *\li	Any external references to nodes in the tree are unaffected by
  *	node splits that are necessary to insert the new name.
  *
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is ISC_R_SUCCESS:
  *		'name' is findable in the red/black tree of trees in O(log N).
- *
  *		*nodep is the node that was added for 'name'.
  *
- *	If result is ISC_R_EXISTS:
+ *\li	If result is ISC_R_EXISTS:
  *		The tree of trees is unaltered.
- *
  *		*nodep is the existing node for 'name'.
  *
- *	If result is ISC_R_NOMEMORY:
+ *\li	If result is ISC_R_NOMEMORY:
  *		No guarantees.
  *
  * Returns:
- *	ISC_R_SUCCESS	Success
- *	ISC_R_EXISTS	The name already exists, possibly without data.
- *	ISC_R_NOMEMORY	Resource Limit: Out of Memory
+ *\li	#ISC_R_SUCCESS	Success
+ *\li	#ISC_R_EXISTS	The name already exists, possibly without data.
+ *\li	#ISC_R_NOMEMORY	Resource Limit: Out of Memory
  */
 
 isc_result_t
 dns_rbt_findname(dns_rbt_t *rbt, dns_name_t *name, unsigned int options,
 		 dns_name_t *foundname, void **data);
-/*
+/*%<
  * Get the data pointer associated with 'name'.
  *
  * Notes:
- *	When DNS_RBTFIND_NOEXACT is set, the closest matching superdomain is
- *      returned (also subject to DNS_RBTFIND_EMPTYDATA), even when there is
+ *\li	When #DNS_RBTFIND_NOEXACT is set, the closest matching superdomain is
+ *      returned (also subject to #DNS_RBTFIND_EMPTYDATA), even when there is
  *	an exact match in the tree.
  *
- *      A node that has no data is considered not to exist for this function,
- *      unless the DNS_RBTFIND_EMPTYDATA option is set.
+ *\li   A node that has no data is considered not to exist for this function,
+ *      unless the #DNS_RBTFIND_EMPTYDATA option is set.
  *
  * Requires:
- *	rbt is a valid rbt manager.
- *	dns_name_isabsolute(name) == TRUE
- *	data != NULL && *data == NULL
+ *\li	rbt is a valid rbt manager.
+ *\li	dns_name_isabsolute(name) == TRUE
+ *\li	data != NULL && *data == NULL
  *
  * Ensures:
- *	'name' and the tree are not altered in any way.
+ *\li	'name' and the tree are not altered in any way.
  *
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is ISC_R_SUCCESS:
  *		*data is the data associated with 'name'.
  *
- *	If result is DNS_R_PARTIALMATCH:
+ *\li	If result is DNS_R_PARTIALMATCH:
  *		*data is the data associated with the deepest superdomain
  * 		of 'name' which has data.
  *
- *	If result is ISC_R_NOTFOUND:
+ *\li	If result is ISC_R_NOTFOUND:
  *		Neither the name nor a superdomain was found with data.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success
- *	DNS_R_PARTIALMATCH	Superdomain found with data
- *	ISC_R_NOTFOUND		No match
- *	ISC_R_NOSPACE		Concatenating nodes to form foundname failed
+ *\li	#ISC_R_SUCCESS		Success
+ *\li	#DNS_R_PARTIALMATCH	Superdomain found with data
+ *\li	#ISC_R_NOTFOUND		No match
+ *\li	#ISC_R_NOSPACE		Concatenating nodes to form foundname failed
  */
 
 isc_result_t
@@ -355,20 +370,20 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
 		 dns_rbtnode_t **node, dns_rbtnodechain_t *chain,
 		 unsigned int options, dns_rbtfindcallback_t callback,
 		 void *callback_arg);
-/*
+/*%<
  * Find the node for 'name'.
  *
  * Notes:
- *	A node that has no data is considered not to exist for this function,
+ *\li	A node that has no data is considered not to exist for this function,
  *	unless the DNS_RBTFIND_EMPTYDATA option is set.  This applies to both
  *	exact matches and partial matches.
  *
- *	If the chain parameter is non-NULL, then the path through the tree
+ *\li	If the chain parameter is non-NULL, then the path through the tree
  *	to the DNSSEC predecessor of the searched for name is maintained,
  *	unless the DNS_RBTFIND_NOPREDECESSOR or DNS_RBTFIND_NOEXACT option
  *	is used. (For more details on those options, see below.)
  *
- *	If there is no predecessor, then the chain will point to nowhere, as
+ *\li	If there is no predecessor, then the chain will point to nowhere, as
  *	indicated by chain->end being NULL or dns_rbtnodechain_current
  *	returning ISC_R_NOTFOUND.  Note that in a normal Internet DNS RBT
  *	there will always be a predecessor for all names except the root
@@ -376,23 +391,23 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
  *	everything.  But you can certainly construct a trivial tree and a
  *	search for it that has no predecessor.
  *
- *	Within the chain structure, the 'levels' member of the structure holds
+ *\li	Within the chain structure, the 'levels' member of the structure holds
  *	the root node of each level except the first.
  *
- *	The 'level_count' of the chain indicates how deep the chain to the
+ *\li	The 'level_count' of the chain indicates how deep the chain to the
  *	predecessor name is, as an index into the 'levels[]' array.  It does
  *	not count name elements, per se, but only levels of the tree of trees,
  *	the distinction arrising because multiple labels from a name can be
  *	stored on only one level.  It is also does not include the level
  *	that has the node, since that level is not stored in levels[].
  *
- *	The chain's 'level_matches' is not directly related to the predecessor.
+ *\li	The chain's 'level_matches' is not directly related to the predecessor.
  *	It is the number of levels above the level of the found 'node',
  *	regardless of whether it was a partial match or exact match.  When
  *	the node is found in the top level tree, or no node is found at all,
  *	level_matches is 0.
  *
- *	When DNS_RBTFIND_NOEXACT is set, the closest matching superdomain is
+ *\li	When DNS_RBTFIND_NOEXACT is set, the closest matching superdomain is
  *      returned (also subject to DNS_RBTFIND_EMPTYDATA), even when
  *      there is an exact match in the tree.  In this case, the chain
  *	will not point to the DNSSEC predecessor, but will instead point
@@ -407,26 +422,29 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
  *	where you want the chain pointed, so this can be made more firm.
  *
  * Requires:
- *	rbt is a valid rbt manager.
- *	dns_name_isabsolute(name) == TRUE.
- *	node != NULL && *node == NULL.
- *	DNS_RBTFIND_NOEXACT and DNS_RBTFIND_NOPREDECESSOR are mutally
+ *\li	rbt is a valid rbt manager.
+ *\li	dns_name_isabsolute(name) == TRUE.
+ *\li	node != NULL && *node == NULL.
+ *\li	#DNS_RBTFIND_NOEXACT and DNS_RBTFIND_NOPREDECESSOR are mutally
  *		exclusive.
  *
  * Ensures:
- *	'name' and the tree are not altered in any way.
+ *\li	'name' and the tree are not altered in any way.
  *
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is ISC_R_SUCCESS:
+ *\verbatim
  *		*node is the terminal node for 'name'.
- *
+
  *		'foundname' and 'name' represent the same name (though not
  *		the same memory).
- *
+
  *		'chain' points to the DNSSEC predecessor, if any, of 'name'.
  *
  *		chain->level_matches and chain->level_count are equal.
+ *\endverbatim
  *
  * 	If result is DNS_R_PARTIALMATCH:
+ *\verbatim
  *		*node is the data associated with the deepest superdomain
  * 		of 'name' which has data.
  *
@@ -434,59 +452,62 @@ dns_rbt_findnode(dns_rbt_t *rbt, dns_name_t *name, dns_name_t *foundname,
  *		data, unless the DNS_RBTFIND_EMPTYDATA option is set).
  *
  *		'chain' points to the DNSSEC predecessor, if any, of 'name'.
+ *\endverbatim
  *
- *	If result is ISC_R_NOTFOUND:
+ *\li	If result is ISC_R_NOTFOUND:
+ *\verbatim
  *		Neither the name nor a superdomain was found.  *node is NULL.
  *
  *		'chain' points to the DNSSEC predecessor, if any, of 'name'.
  *
  *		chain->level_matches is 0.
+ *\endverbatim
  *
  * Returns:
- *	ISC_R_SUCCESS		Success
- *	DNS_R_PARTIALMATCH	Superdomain found with data
- *	ISC_R_NOTFOUND		No match, or superdomain with no data
- *	ISC_R_NOSPACE Concatenating nodes to form foundname failed
+ *\li	#ISC_R_SUCCESS		Success
+ *\li	#DNS_R_PARTIALMATCH	Superdomain found with data
+ *\li	#ISC_R_NOTFOUND		No match, or superdomain with no data
+ *\li	#ISC_R_NOSPACE Concatenating nodes to form foundname failed
  */
 
 isc_result_t
 dns_rbt_deletename(dns_rbt_t *rbt, dns_name_t *name, isc_boolean_t recurse);
-/*
+/*%<
  * Delete 'name' from the tree of trees.
  *
  * Notes:
- *	When 'name' is removed, if recurse is ISC_TRUE then all of its
+ *\li	When 'name' is removed, if recurse is ISC_TRUE then all of its
  *      subnames are removed too.
  *
  * Requires:
- *	rbt is a valid rbt manager.
- *	dns_name_isabsolute(name) == TRUE
+ *\li	rbt is a valid rbt manager.
+ *\li	dns_name_isabsolute(name) == TRUE
  *
  * Ensures:
- *	'name' is not altered in any way.
+ *\li	'name' is not altered in any way.
  *
- *	Does NOT ensure that any external references to nodes in the tree
+ *\li	Does NOT ensure that any external references to nodes in the tree
  *	are unaffected by node joins.
  *
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is ISC_R_SUCCESS:
  *		'name' does not appear in the tree with data; however,
  *		the node for the name might still exist which can be
  *		found with dns_rbt_findnode (but not dns_rbt_findname).
  *
- *	If result is ISC_R_NOTFOUND:
+ *\li	If result is ISC_R_NOTFOUND:
  *		'name' does not appear in the tree with data, because
  *		it did not appear in the tree before the function was called.
  *
- *	If result is something else:
+ *\li	If result is something else:
  *		See result codes for dns_rbt_findnode (if it fails, the
  *		node is not deleted) or dns_rbt_deletenode (if it fails,
  *		the node is deleted, but the tree is not optimized when
  *		it could have been).
  *
  * Returns:
- *	ISC_R_SUCCESS	Success
- *	ISC_R_NOTFOUND	No match
- *	something_else	Any return code from dns_rbt_findnode except
+ *\li	#ISC_R_SUCCESS	Success
+ *\li	#ISC_R_NOTFOUND	No match
+ *\li	something_else	Any return code from dns_rbt_findnode except
  *			DNS_R_PARTIALMATCH (which causes ISC_R_NOTFOUND
  *			to be returned instead), and any code from
  *			dns_rbt_deletenode.
@@ -494,115 +515,115 @@ dns_rbt_deletename(dns_rbt_t *rbt, dns_name_t *name, isc_boolean_t recurse);
 
 isc_result_t
 dns_rbt_deletenode(dns_rbt_t *rbt, dns_rbtnode_t *node, isc_boolean_t recurse);
-/*
+/*%<
  * Delete 'node' from the tree of trees.
  *
  * Notes:
- *	When 'node' is removed, if recurse is ISC_TRUE then all nodes
+ *\li	When 'node' is removed, if recurse is ISC_TRUE then all nodes
  *	in levels down from it are removed too.
  *
  * Requires:
- *	rbt is a valid rbt manager.
- *	node != NULL.
+ *\li	rbt is a valid rbt manager.
+ *\li	node != NULL.
  *
  * Ensures:
- *	Does NOT ensure that any external references to nodes in the tree
+ *\li	Does NOT ensure that any external references to nodes in the tree
  *	are unaffected by node joins.
  *
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is ISC_R_SUCCESS:
  *		'node' does not appear in the tree with data; however,
  *		the node might still exist if it serves as a pointer to
  *		a lower tree level as long as 'recurse' was false, hence
  *		the node could can be found with dns_rbt_findnode whem
  *		that function's empty_data_ok parameter is true.
  *
- *	If result is ISC_R_NOMEMORY or ISC_R_NOSPACE:
+ *\li	If result is ISC_R_NOMEMORY or ISC_R_NOSPACE:
  *		The node was deleted, but the tree structure was not
  *		optimized.
  *
  * Returns:
- *	ISC_R_SUCCESS	Success
- *	ISC_R_NOMEMORY	Resource Limit: Out of Memory when joining nodes.
- *	ISC_R_NOSPACE	dns_name_concatenate failed when joining nodes.
+ *\li	#ISC_R_SUCCESS	Success
+ *\li	#ISC_R_NOMEMORY	Resource Limit: Out of Memory when joining nodes.
+ *\li	#ISC_R_NOSPACE	dns_name_concatenate failed when joining nodes.
  */
 
 void
 dns_rbt_namefromnode(dns_rbtnode_t *node, dns_name_t *name);
-/*
+/*%<
  * Convert the sequence of labels stored at 'node' into a 'name'.
  *
  * Notes:
- *	This function does not return the full name, from the root, but
+ *\li	This function does not return the full name, from the root, but
  *	just the labels at the indicated node.
  *
- *	The name data pointed to by 'name' is the information stored
+ *\li	The name data pointed to by 'name' is the information stored
  *	in the node, not a copy.  Altering the data at this pointer
  *	will likely cause grief.
  *
  * Requires:
- *	name->offsets == NULL
+ * \li	name->offsets == NULL
  *
  * Ensures:
- *	'name' is DNS_NAMEATTR_READONLY.
+ * \li	'name' is DNS_NAMEATTR_READONLY.
  *
- *	'name' will point directly to the labels stored after the
+ * \li	'name' will point directly to the labels stored after the
  *	dns_rbtnode_t struct.
  *
- *	'name' will have offsets that also point to the information stored
+ * \li	'name' will have offsets that also point to the information stored
  *	as part of the node.
  */
 
 isc_result_t
 dns_rbt_fullnamefromnode(dns_rbtnode_t *node, dns_name_t *name);
-/*
+/*%<
  * Like dns_rbt_namefromnode, but returns the full name from the root.
  *
  * Notes:
- *	Unlike dns_rbt_namefromnode, the name will not point directly
+ * \li	Unlike dns_rbt_namefromnode, the name will not point directly
  *	to node data.  Rather, dns_name_concatenate will be used to copy
  *	the name data from each node into the 'name' argument.
  *
  * Requires:
- *	name != NULL
- *	name has a dedicated buffer.
+ * \li	name != NULL
+ * \li	name has a dedicated buffer.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE		(possible via dns_name_concatenate)
- *	DNS_R_NAMETOOLONG	(possible via dns_name_concatenate)
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOSPACE		(possible via dns_name_concatenate)
+ * \li	DNS_R_NAMETOOLONG	(possible via dns_name_concatenate)
  */
 
 char *
 dns_rbt_formatnodename(dns_rbtnode_t *node, char *printname,
 		       unsigned int size);
-/*
+/*%<
  * Format the full name of a node for printing, using dns_name_format().
  *
  * Notes:
- *	'size' is the length of the printname buffer.  This should be
+ * \li	'size' is the length of the printname buffer.  This should be
  *	DNS_NAME_FORMATSIZE or larger.
  *
  * Requires:
- *	node and printname are not NULL.
+ * \li	node and printname are not NULL.
  *
  * Returns:
- *	The 'printname' pointer.
+ * \li	The 'printname' pointer.
  */
 
 unsigned int
 dns_rbt_nodecount(dns_rbt_t *rbt);
-/*
+/*%<
  * Obtain the number of nodes in the tree of trees.
  *
  * Requires:
- *	rbt is a valid rbt manager.
+ * \li	rbt is a valid rbt manager.
  */
 
 void
 dns_rbt_destroy(dns_rbt_t **rbtp);
 isc_result_t
 dns_rbt_destroy2(dns_rbt_t **rbtp, unsigned int quantum);
-/*
+/*%<
  * Stop working with a red-black tree of trees. 
  * If 'quantum' is zero then the entire tree will be destroyed.
  * If 'quantum' is non zero then up to 'quantum' nodes will be destroyed
@@ -612,26 +633,26 @@ dns_rbt_destroy2(dns_rbt_t **rbtp, unsigned int quantum);
  * performed on the tree of trees.
  * 
  * Requires:
- * 	*rbt is a valid rbt manager.
+ * \li	*rbt is a valid rbt manager.
  *
  * Ensures on ISC_R_SUCCESS:
- *	All space allocated by the RBT library has been returned.
+ * \li	All space allocated by the RBT library has been returned.
  *
- *	*rbt is invalidated as an rbt manager.
+ * \li	*rbt is invalidated as an rbt manager.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_QUOTA if 'quantum' nodes have been destroyed.
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_QUOTA if 'quantum' nodes have been destroyed.
  */
 
 void
 dns_rbt_printall(dns_rbt_t *rbt);
-/*
+/*%<
  * Print an ASCII representation of the internal structure of the red-black
  * tree of trees.
  *
  * Notes:
- *	The name stored at each node, along with the node's color, is printed.
+ * \li	The name stored at each node, along with the node's color, is printed.
  *	Then the down pointer, left and right pointers are displayed
  *	recursively in turn.  NULL down pointers are silently omitted;
  *	NULL left and right pointers are printed.
@@ -643,70 +664,70 @@ dns_rbt_printall(dns_rbt_t *rbt);
 
 void
 dns_rbtnodechain_init(dns_rbtnodechain_t *chain, isc_mem_t *mctx);
-/*
+/*%<
  * Initialize 'chain'.
  *
  * Requires:
- *	'chain' is a valid pointer.
+ *\li	'chain' is a valid pointer.
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
  * Ensures:
- *	'chain' is suitable for use.
+ *\li	'chain' is suitable for use.
  */
 
 void
 dns_rbtnodechain_reset(dns_rbtnodechain_t *chain);
-/*
+/*%<
  * Free any dynamic storage associated with 'chain', and then reinitialize
  * 'chain'.
  *
  * Requires:
- *	'chain' is a valid pointer.
+ *\li	'chain' is a valid pointer.
  *
  * Ensures:
- *	'chain' is suitable for use, and uses no dynamic storage.
+ *\li	'chain' is suitable for use, and uses no dynamic storage.
  */
 
 void
 dns_rbtnodechain_invalidate(dns_rbtnodechain_t *chain);
-/*
+/*%<
  * Free any dynamic storage associated with 'chain', and then invalidates it.
  *
  * Notes:
- * 	Future calls to any dns_rbtnodechain_ function will need to call
+ *\li 	Future calls to any dns_rbtnodechain_ function will need to call
  * 	dns_rbtnodechain_init on the chain first (except, of course,
  *	dns_rbtnodechain_init itself).
  *
  * Requires:
- *	'chain' is a valid chain.
+ *\li	'chain' is a valid chain.
  *
  * Ensures:
- *	'chain' is no longer suitable for use, and uses no dynamic storage.
+ *\li	'chain' is no longer suitable for use, and uses no dynamic storage.
  */
 
 isc_result_t
 dns_rbtnodechain_current(dns_rbtnodechain_t *chain, dns_name_t *name,
 			 dns_name_t *origin, dns_rbtnode_t **node);
-/*
+/*%<
  * Provide the name, origin and node to which the chain is currently pointed.
  *
  * Notes:
- *	The tree need not have be locked against additions for the chain
+ *\li	The tree need not have be locked against additions for the chain
  *	to remain valid, however there are no guarantees if any deletion
  *	has been made since the chain was established.
  *
  * Requires:
- *	'chain' is a valid chain.
+ *\li	'chain' is a valid chain.
  *
  * Ensures:
- *	'node', if non-NULL, is the node to which the chain was pointed
+ *\li	'node', if non-NULL, is the node to which the chain was pointed
  *	by dns_rbt_findnode, dns_rbtnodechain_first or dns_rbtnodechain_last.
  *	If none were called for the chain since it was initialized or reset,
  *	or if the was no predecessor to the name searched for with
  *	dns_rbt_findnode, then '*node' is NULL and ISC_R_NOTFOUND is returned.
  *
- *	'name', if non-NULL, is the name stored at the terminal level of
+ *\li	'name', if non-NULL, is the name stored at the terminal level of
  *	the chain.  This is typically a single label, like the "www" of
  *	"www.isc.org", but need not be so.  At the root of the tree of trees,
  *	if the node is "." then 'name' is ".", otherwise it is relative to ".".
@@ -714,124 +735,181 @@ dns_rbtnodechain_current(dns_rbtnodechain_t *chain, dns_name_t *name,
  *	"isc.org." then the root node's stored name is "isc.org." but 'name'
  *	will be "isc.org".)
  *
- *	'origin', if non-NULL, is the sequence of labels in the levels
+ *\li	'origin', if non-NULL, is the sequence of labels in the levels
  *	above the terminal level, such as "isc.org." in the above example.
  *	'origin' is always "." for the root node.
  *
  *
  * Returns:
- *	ISC_R_SUCCESS		name, origin & node were successfully set.
- *	ISC_R_NOTFOUND		The chain does not point to any node.
- *	<something_else>	Any error return from dns_name_concatenate.
+ *\li	#ISC_R_SUCCESS		name, origin & node were successfully set.
+ *\li	#ISC_R_NOTFOUND		The chain does not point to any node.
+ *\li	&lt;something_else>	Any error return from dns_name_concatenate.
  */
 
 isc_result_t
 dns_rbtnodechain_first(dns_rbtnodechain_t *chain, dns_rbt_t *rbt,
 		       dns_name_t *name, dns_name_t *origin);
-/*
+/*%<
  * Set the chain to the lexically first node in the tree of trees.
  *
  * Notes:
- *	By the definition of ordering for DNS names, the root of the tree of
+ *\li	By the definition of ordering for DNS names, the root of the tree of
  *	trees is the very first node, since everything else in the megatree
  *	uses it as a common suffix.
  *
  * Requires:
- *	'chain' is a valid chain.
- *	'rbt' is a valid rbt manager.
+ *\li	'chain' is a valid chain.
+ *\li	'rbt' is a valid rbt manager.
  *
  * Ensures:
- *	The chain points to the very first node of the tree.
+ *\li	The chain points to the very first node of the tree.
  *
- *	'name' and 'origin', if non-NULL, are set as described for
+ *\li	'name' and 'origin', if non-NULL, are set as described for
  *	dns_rbtnodechain_current.  Thus 'origin' will always be ".".
  *
  * Returns:
- *	DNS_R_NEWORIGIN		The name & origin were successfully set.
- *	<something_else>	Any error result from dns_rbtnodechain_current.
+ *\li	#DNS_R_NEWORIGIN		The name & origin were successfully set.
+ *\li	&lt;something_else>	Any error result from dns_rbtnodechain_current.
  */
 
 isc_result_t
 dns_rbtnodechain_last(dns_rbtnodechain_t *chain, dns_rbt_t *rbt,
 		       dns_name_t *name, dns_name_t *origin);
-/*
+/*%<
  * Set the chain to the lexically last node in the tree of trees.
  *
  * Requires:
- *	'chain' is a valid chain.
- *	'rbt' is a valid rbt manager.
+ *\li	'chain' is a valid chain.
+ *\li	'rbt' is a valid rbt manager.
  *
  * Ensures:
- *	The chain points to the very last node of the tree.
+ *\li	The chain points to the very last node of the tree.
  *
- *	'name' and 'origin', if non-NULL, are set as described for
+ *\li	'name' and 'origin', if non-NULL, are set as described for
  *	dns_rbtnodechain_current.
  *
  * Returns:
- *	DNS_R_NEWORIGIN		The name & origin were successfully set.
- *	ISC_R_NOMEMORY		Resource Limit: Out of Memory building chain.
- *	<something_else>	Any error result from dns_name_concatenate.
+ *\li	#DNS_R_NEWORIGIN		The name & origin were successfully set.
+ *\li	#ISC_R_NOMEMORY		Resource Limit: Out of Memory building chain.
+ *\li	&lt;something_else>	Any error result from dns_name_concatenate.
  */
 
 isc_result_t
 dns_rbtnodechain_prev(dns_rbtnodechain_t *chain, dns_name_t *name,
 		      dns_name_t *origin);
-/*
+/*%<
  * Adjusts chain to point the DNSSEC predecessor of the name to which it
  * is currently pointed.
  *
  * Requires:
- *	'chain' is a valid chain.
- *	'chain' has been pointed somewhere in the tree with dns_rbt_findnode,
+ *\li	'chain' is a valid chain.
+ *\li	'chain' has been pointed somewhere in the tree with dns_rbt_findnode,
  *	dns_rbtnodechain_first or dns_rbtnodechain_last -- and remember that
  *	dns_rbt_findnode is not guaranteed to point the chain somewhere,
  *	since there may have been no predecessor to the searched for name.
  *
  * Ensures:
- *	The chain is pointed to the predecessor of its current target.
+ *\li	The chain is pointed to the predecessor of its current target.
  *
- *	'name' and 'origin', if non-NULL, are set as described for
+ *\li	'name' and 'origin', if non-NULL, are set as described for
  *	dns_rbtnodechain_current.
  *
- *	'origin' is only if a new origin was found.
+ *\li	'origin' is only if a new origin was found.
  *
  * Returns:
- *	ISC_R_SUCCESS		The predecessor was found and 'name' was set.
- *	DNS_R_NEWORIGIN		The predecessor was found with a different
+ *\li	#ISC_R_SUCCESS		The predecessor was found and 'name' was set.
+ *\li	#DNS_R_NEWORIGIN		The predecessor was found with a different
  *				origin and 'name' and 'origin' were set.
- *	ISC_R_NOMORE		There was no predecessor.
- *	<something_else>	Any error result from dns_rbtnodechain_current.
+ *\li	#ISC_R_NOMORE		There was no predecessor.
+ *\li	&lt;something_else>	Any error result from dns_rbtnodechain_current.
  */
 
 isc_result_t
 dns_rbtnodechain_next(dns_rbtnodechain_t *chain, dns_name_t *name,
 		      dns_name_t *origin);
-/*
+/*%<
  * Adjusts chain to point the DNSSEC successor of the name to which it
  * is currently pointed.
  *
  * Requires:
- *	'chain' is a valid chain.
- *	'chain' has been pointed somewhere in the tree with dns_rbt_findnode,
+ *\li	'chain' is a valid chain.
+ *\li	'chain' has been pointed somewhere in the tree with dns_rbt_findnode,
  *	dns_rbtnodechain_first or dns_rbtnodechain_last -- and remember that
  *	dns_rbt_findnode is not guaranteed to point the chain somewhere,
  *	since there may have been no predecessor to the searched for name.
  *
  * Ensures:
- *	The chain is pointed to the successor of its current target.
+ *\li	The chain is pointed to the successor of its current target.
  *
- *	'name' and 'origin', if non-NULL, are set as described for
+ *\li	'name' and 'origin', if non-NULL, are set as described for
  *	dns_rbtnodechain_current.
  *
- *	'origin' is only if a new origin was found.
+ *\li	'origin' is only if a new origin was found.
  *
  * Returns:
- *	ISC_R_SUCCESS		The successor was found and 'name' was set.
- *	DNS_R_NEWORIGIN		The successor was found with a different
+ *\li	#ISC_R_SUCCESS		The successor was found and 'name' was set.
+ *\li	#DNS_R_NEWORIGIN		The successor was found with a different
  *				origin and 'name' and 'origin' were set.
- *	ISC_R_NOMORE		There was no successor.
- *	<something_else>	Any error result from dns_name_concatenate.
+ *\li	#ISC_R_NOMORE		There was no successor.
+ *\li	&lt;something_else>	Any error result from dns_name_concatenate.
+ */
+
+/*
+ * Wrapper macros for manipulating the rbtnode reference counter:
+ *   Since we selectively use isc_refcount_t for the reference counter of
+ *   a rbtnode, operations on the counter depend on the actual type of it.
+ *   The following macros provide a common interface to these operations,
+ *   hiding the back-end.  The usage is the same as that of isc_refcount_xxx().
  */
+#ifdef DNS_RBT_USEISCREFCOUNT
+#define dns_rbtnode_refinit(node, n)				\
+	do {							\
+ 		isc_refcount_init(&(node)->references, (n));	\
+	} while (0) 
+#define dns_rbtnode_refdestroy(node)				\
+	do {							\
+		isc_refcount_destroy(&(node)->references);	\
+	} while (0) 
+#define dns_rbtnode_refcurrent(node)				\
+	isc_refcount_current(&(node)->references)
+#define dns_rbtnode_refincrement0(node, refs)			\
+	do {							\
+		isc_refcount_increment0(&(node)->references, (refs)); \
+	} while (0) 
+#define dns_rbtnode_refincrement(node, refs)			\
+	do {							\
+		isc_refcount_increment(&(node)->references, (refs)); \
+	} while (0) 
+#define dns_rbtnode_refdecrement(node, refs)			\
+	do {							\
+		isc_refcount_decrement(&(node)->references, (refs)); \
+	} while (0) 
+#else  /* DNS_RBT_USEISCREFCOUNT */
+#define dns_rbtnode_refinit(node, n)	((node)->references = (n))
+#define dns_rbtnode_refdestroy(node)	(REQUIRE((node)->references == 0))
+#define dns_rbtnode_refcurrent(node)	((node)->references)
+#define dns_rbtnode_refincrement0(node, refs)			\
+	do {							\
+		unsigned int *_tmp = (unsigned int *)(refs);	\
+		(node)->references++;				\
+		if ((_tmp) != NULL)				\
+			(*_tmp) = (node)->references;		\
+	} while (0) 
+#define dns_rbtnode_refincrement(node, refs)			\
+	do {							\
+		REQUIRE((node)->references > 0);		\
+		(node)->references++;				\
+		if ((refs) != NULL)				\
+			(*refs) = (node)->references;		\
+	} while (0) 
+#define dns_rbtnode_refdecrement(node, refs)			\
+	do {							\
+		REQUIRE((node)->references > 0);		\
+		(node)->references--;				\
+		if ((refs) != NULL)				\
+			(*refs) = (node)->references;		\
+	} while (0) 
+#endif /* DNS_RBT_USEISCREFCOUNT */
 
 ISC_LANG_ENDDECLS
 
diff --git a/contrib/bind9/lib/dns/include/dns/rcode.h b/contrib/bind9/lib/dns/include/dns/rcode.h
index b2494f7..03c145b 100644
--- a/contrib/bind9/lib/dns/include/dns/rcode.h
+++ b/contrib/bind9/lib/dns/include/dns/rcode.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rcode.h,v 1.12.206.1 2004/03/06 08:13:59 marka Exp $ */
+/* $Id: rcode.h,v 1.13.18.2 2005/04/29 00:16:18 marka Exp $ */
 
 #ifndef DNS_RCODE_H
 #define DNS_RCODE_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -27,68 +29,68 @@
 ISC_LANG_BEGINDECLS
 
 isc_result_t dns_rcode_fromtext(dns_rcode_t *rcodep, isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a DNS error value.
  *
  * Requires:
- *	'rcodep' is a valid pointer.
+ *\li	'rcodep' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	DNS_R_UNKNOWN			type is unknown
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#DNS_R_UNKNOWN			type is unknown
  */
 
 isc_result_t dns_rcode_totext(dns_rcode_t rcode, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of error 'rcode' into 'target'.
  *
  * Requires:
- *	'rcode' is a valid rcode.
+ *\li	'rcode' is a valid rcode.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
  * Ensures:
- *	If the result is success:
+ *\li	If the result is success:
  *		The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#ISC_R_NOSPACE			target buffer is too small
  */
 
 isc_result_t dns_tsigrcode_fromtext(dns_rcode_t *rcodep,
 				    isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a TSIG/TKEY error value.
  *
  * Requires:
- *	'rcodep' is a valid pointer.
+ *\li	'rcodep' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	DNS_R_UNKNOWN			type is unknown
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#DNS_R_UNKNOWN			type is unknown
  */
 
 isc_result_t dns_tsigrcode_totext(dns_rcode_t rcode, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of TSIG/TKEY error 'rcode' into 'target'.
  *
  * Requires:
- *	'rcode' is a valid TSIG/TKEY error code.
+ *\li	'rcode' is a valid TSIG/TKEY error code.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
  * Ensures:
- *	If the result is success:
+ *\li	If the result is success:
  *		The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#ISC_R_NOSPACE			target buffer is too small
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/rdata.h b/contrib/bind9/lib/dns/include/dns/rdata.h
index b006b17..a14bde7 100644
--- a/contrib/bind9/lib/dns/include/dns/rdata.h
+++ b/contrib/bind9/lib/dns/include/dns/rdata.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata.h,v 1.51.2.3.2.4 2004/03/08 02:08:01 marka Exp $ */
+/* $Id: rdata.h,v 1.60.18.3 2005/05/19 04:59:56 marka Exp $ */
 
 #ifndef DNS_RDATA_H
 #define DNS_RDATA_H 1
@@ -24,9 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Rdata
- *
+/*! \file
+ * \brief
  * Provides facilities for manipulating DNS rdata, including conversions to
  * and from wire format and text format.
  *
@@ -46,7 +45,7 @@
  *
  * Implementation Notes:
  *
- *	The routines in this module are expected to be synthesized by the
+ *\li	The routines in this module are expected to be synthesized by the
  *	build process from a set of source files, one per rdata type.  For
  *	portability, it's probably best that the building be done by a C
  *	program.  Adding a new rdata type will be a simple matter of adding
@@ -54,38 +53,37 @@
  *	the format of a particular rdata type is in this file.
  *
  * MP:
- *	Clients of this module must impose any required synchronization.
+ *\li	Clients of this module must impose any required synchronization.
  *
  * Reliability:
- *	This module deals with low-level byte streams.  Errors in any of
+ *\li	This module deals with low-level byte streams.  Errors in any of
  *	the functions are likely to crash the server or corrupt memory.
  *
- *	Rdata is typed, and the caller must know what type of rdata it has.
+ *\li	Rdata is typed, and the caller must know what type of rdata it has.
  *	A caller that gets this wrong could crash the server.
  *
- *	The fromstruct() and tostruct() routines use a void * pointer to
+ *\li	The fromstruct() and tostruct() routines use a void * pointer to
  *	represent the structure.  The caller must ensure that it passes a
  *	pointer to the appropriate type, or the server could crash or memory
  *	could be corrupted.
  *
  * Resources:
- *	None.
+ *\li	None.
  *
  * Security:
  *
- *	*** WARNING ***
- *
+ *\li	*** WARNING ***
  *	dns_rdata_fromwire() deals with raw network data.  An error in
  *	this routine could result in the failure or hijacking of the server.
  *
  * Standards:
- *	RFC 1035
- *	Draft EDNS0 (0)
- *	Draft EDNS1 (0)
- *	Draft Binary Labels (2)
- *	Draft Local Compression (1)
- *	<Various RFCs for particular types; these will be documented in the
- *	 sources files of the types.>
+ *\li	RFC1035
+ *\li	Draft EDNS0 (0)
+ *\li	Draft EDNS1 (0)
+ *\li	Draft Binary Labels (2)
+ *\li	Draft Local Compression (1)
+ *\li	Various RFCs for particular types; these will be documented in the
+ *	 sources files of the types.
  *
  */
 
@@ -100,19 +98,17 @@
 
 ISC_LANG_BEGINDECLS
 
-/*****
- ***** RData
- *****
- ***** An 'rdata' is a handle to a binary region.  The handle has an RR
- ***** class and type, and the data in the binary region is in the format
- ***** of the given class and type.
- *****/
 
 /***
  *** Types
  ***/
 
-/*
+/*%
+ ***** An 'rdata' is a handle to a binary region.  The handle has an RR
+ ***** class and type, and the data in the binary region is in the format
+ ***** of the given class and type.
+ *****/
+/*%
  * Clients are strongly discouraged from using this type directly, with
  * the exception of the 'link' field which may be used directly for whatever
  * purpose the client desires.
@@ -128,7 +124,7 @@ struct dns_rdata {
 
 #define DNS_RDATA_INIT { NULL, 0, 0, 0, 0, {(void*)(-1), (void *)(-1)}}
 
-#define DNS_RDATA_UPDATE	0x0001		/* update pseudo record */
+#define DNS_RDATA_UPDATE	0x0001		/*%< update pseudo record */
 
 /*
  * Flags affecting rdata formatting style.  Flags 0xFFFF0000
@@ -136,17 +132,19 @@ struct dns_rdata {
  * See additional comments at dns_rdata_tofmttext().
  */
 
-/* Split the rdata into multiple lines to try to keep it
+/*% Split the rdata into multiple lines to try to keep it
  within the "width". */
 #define DNS_STYLEFLAG_MULTILINE		0x00000001U
 
-/* Output explanatory comments. */
+/*% Output explanatory comments. */
 #define DNS_STYLEFLAG_COMMENT		0x00000002U
 
 #define DNS_RDATA_DOWNCASE		DNS_NAME_DOWNCASE
 #define DNS_RDATA_CHECKNAMES		DNS_NAME_CHECKNAMES
 #define DNS_RDATA_CHECKNAMESFAIL	DNS_NAME_CHECKNAMESFAIL
 #define DNS_RDATA_CHECKREVERSE		DNS_NAME_CHECKREVERSE
+#define DNS_RDATA_CHECKMX		DNS_NAME_CHECKMX
+#define DNS_RDATA_CHECKMXFAIL		DNS_NAME_CHECKMXFAIL
 
 /***
  *** Initialization
@@ -154,7 +152,7 @@ struct dns_rdata {
 
 void
 dns_rdata_init(dns_rdata_t *rdata);
-/*
+/*%<
  * Make 'rdata' empty.
  *
  * Requires:
@@ -163,21 +161,21 @@ dns_rdata_init(dns_rdata_t *rdata);
 
 void
 dns_rdata_reset(dns_rdata_t *rdata);
-/*
+/*%<
  * Make 'rdata' empty.
  *
  * Requires:
- *	'rdata' is a previously initialized rdata and is not linked.
+ *\li	'rdata' is a previously initialized rdata and is not linked.
  */
 
 void
 dns_rdata_clone(const dns_rdata_t *src, dns_rdata_t *target);
-/*
+/*%<
  * Clone 'target' from 'src'.
  *
  * Requires:
- *	'src' to be initialized.
- *	'target' to be initialized.
+ *\li	'src' to be initialized.
+ *\li	'target' to be initialized.
  */
 
 /***
@@ -186,20 +184,20 @@ dns_rdata_clone(const dns_rdata_t *src, dns_rdata_t *target);
 
 int
 dns_rdata_compare(const dns_rdata_t *rdata1, const dns_rdata_t *rdata2);
-/*
+/*%<
  * Determine the relative ordering under the DNSSEC order relation of
  * 'rdata1' and 'rdata2'.
  *
  * Requires:
  *
- *	'rdata1' is a valid, non-empty rdata
+ *\li	'rdata1' is a valid, non-empty rdata
  *
- *	'rdata2' is a valid, non-empty rdata
+ *\li	'rdata2' is a valid, non-empty rdata
  *
  * Returns:
- *	< 0		'rdata1' is less than 'rdata2'
- *	0		'rdata1' is equal to 'rdata2'
- *	> 0		'rdata1' is greater than 'rdata2'
+ *\li	< 0		'rdata1' is less than 'rdata2'
+ *\li	0		'rdata1' is equal to 'rdata2'
+ *\li	> 0		'rdata1' is greater than 'rdata2'
  */
 
 /***
@@ -209,17 +207,17 @@ dns_rdata_compare(const dns_rdata_t *rdata1, const dns_rdata_t *rdata2);
 void
 dns_rdata_fromregion(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 		     dns_rdatatype_t type, isc_region_t *r);
-/*
+/*%<
  * Make 'rdata' refer to region 'r'.
  *
  * Requires:
  *
- *	The data in 'r' is properly formatted for whatever type it is.
+ *\li	The data in 'r' is properly formatted for whatever type it is.
  */
 
 void
 dns_rdata_toregion(const dns_rdata_t *rdata, isc_region_t *r);
-/*
+/*%<
  * Make 'r' refer to 'rdata'.
  */
 
@@ -228,73 +226,70 @@ dns_rdata_fromwire(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 		   dns_rdatatype_t type, isc_buffer_t *source,
 		   dns_decompress_t *dctx, unsigned int options,
 		   isc_buffer_t *target);
-/*
+/*%<
  * Copy the possibly-compressed rdata at source into the target region.
  *
  * Notes:
- *	Name decompression policy is controlled by 'dctx'.
+ *\li	Name decompression policy is controlled by 'dctx'.
  *
  *	'options'
- *	DNS_RDATA_DOWNCASE	downcase domain names when they are copied
+ *\li	DNS_RDATA_DOWNCASE	downcase domain names when they are copied
  *				into target.
  *
  * Requires:
  *
- *	'rdclass' and 'type' are valid.
+ *\li	'rdclass' and 'type' are valid.
  *
- *	'source' is a valid buffer, and the active region of 'source'
+ *\li	'source' is a valid buffer, and the active region of 'source'
  *	references the rdata to be processed.
  *
- *	'target' is a valid buffer.
+ *\li	'target' is a valid buffer.
  *
- *	'dctx' is a valid decompression context.
+ *\li	'dctx' is a valid decompression context.
  *
- * Ensures:
- *
- *	If result is success:
- *	 	If 'rdata' is not NULL, it is attached to the target.
- *
- *		The conditions dns_name_fromwire() ensures for names hold
+ * Ensures,
+ *	if result is success:
+ *	\li 	If 'rdata' is not NULL, it is attached to the target.
+ *	\li	The conditions dns_name_fromwire() ensures for names hold
  *		for all names in the rdata.
- *
- *		The current location in source is advanced, and the used space
+ *	\li	The current location in source is advanced, and the used space
  *		in target is updated.
  *
  * Result:
- *	Success
- *	<Any non-success status from dns_name_fromwire()>
- *	<Various 'Bad Form' class failures depending on class and type>
- *	Bad Form: Input too short
- *	Resource Limit: Not enough space
+ *\li	Success
+ *\li	Any non-success status from dns_name_fromwire()
+ *\li	Various 'Bad Form' class failures depending on class and type
+ *\li	Bad Form: Input too short
+ *\li	Resource Limit: Not enough space
  */
 
 isc_result_t
 dns_rdata_towire(dns_rdata_t *rdata, dns_compress_t *cctx,
 		 isc_buffer_t *target);
-/*
+/*%<
  * Convert 'rdata' into wire format, compressing it as specified by the
  * compression context 'cctx', and storing the result in 'target'.
  *
  * Notes:
- *	If the compression context allows global compression, then the
+ *\li	If the compression context allows global compression, then the
  *	global compression table may be updated.
  *
  * Requires:
- *	'rdata' is a valid, non-empty rdata
+ *\li	'rdata' is a valid, non-empty rdata
  *
- *	target is a valid buffer
+ *\li	target is a valid buffer
  *
- *	Any offsets specified in a global compression table are valid
+ *\li	Any offsets specified in a global compression table are valid
  *	for target.
  *
- * Ensures:
- *	If the result is success:
- *		The used space in target is updated.
+ * Ensures,
+ *	if the result is success:
+ *	\li	The used space in target is updated.
  *
  * Returns:
- *	Success
- *	<Any non-success status from dns_name_towire()>
- *	Resource Limit: Not enough space
+ *\li	Success
+ *\li	Any non-success status from dns_name_towire()
+ *\li	Resource Limit: Not enough space
  */
 
 isc_result_t
@@ -302,100 +297,100 @@ dns_rdata_fromtext(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 		   dns_rdatatype_t type, isc_lex_t *lexer, dns_name_t *origin,
 		   unsigned int options, isc_mem_t *mctx,
 		   isc_buffer_t *target, dns_rdatacallbacks_t *callbacks);
-/*
+/*%<
  * Convert the textual representation of a DNS rdata into uncompressed wire
  * form stored in the target region.  Tokens constituting the text of the rdata
  * are taken from 'lexer'.
  *
  * Notes:
- *	Relative domain names in the rdata will have 'origin' appended to them.
+ *\li	Relative domain names in the rdata will have 'origin' appended to them.
  *	A NULL origin implies "origin == dns_rootname".
  *
  *
  *	'options'
- *	DNS_RDATA_DOWNCASE	downcase domain names when they are copied
+ *\li	DNS_RDATA_DOWNCASE	downcase domain names when they are copied
  *				into target.
- *	DNS_RDATA_CHECKNAMES 	perform checknames checks.
- *	DNS_RDATA_CHECKNAMESFAIL fail if the checknames check fail.  If
+ *\li	DNS_RDATA_CHECKNAMES 	perform checknames checks.
+ *\li	DNS_RDATA_CHECKNAMESFAIL fail if the checknames check fail.  If
  *				not set a warning will be issued.
- *	DNS_RDATA_CHECKREVERSE  this should set if the owner name ends
+ *\li	DNS_RDATA_CHECKREVERSE  this should set if the owner name ends
  *				in IP6.ARPA, IP6.INT or IN-ADDR.ARPA.
  *
  * Requires:
  *
- *	'rdclass' and 'type' are valid.
+ *\li	'rdclass' and 'type' are valid.
  *
- *	'lexer' is a valid isc_lex_t.
+ *\li	'lexer' is a valid isc_lex_t.
  *
- *	'mctx' is a valid isc_mem_t.
+ *\li	'mctx' is a valid isc_mem_t.
  *
- *	'target' is a valid region.
+ *\li	'target' is a valid region.
  *
- *	'origin' if non NULL it must be absolute.
+ *\li	'origin' if non NULL it must be absolute.
  *	
- *	'callbacks' to be NULL or callbacks->warn and callbacks->error be
+ *\li	'callbacks' to be NULL or callbacks->warn and callbacks->error be
  *	initialized.
  *
- * Ensures:
- *	If result is success:
- *	 	If 'rdata' is not NULL, it is attached to the target.
- *
- *		The conditions dns_name_fromtext() ensures for names hold
+ * Ensures, 
+ *	if result is success:
+ *\li	 	If 'rdata' is not NULL, it is attached to the target.
+
+ *\li		The conditions dns_name_fromtext() ensures for names hold
  *		for all names in the rdata.
- *
- *		The used space in target is updated.
+
+ *\li		The used space in target is updated.
  *
  * Result:
- *	Success
- *	<Translated result codes from isc_lex_gettoken>
- *	<Various 'Bad Form' class failures depending on class and type>
- *	Bad Form: Input too short
- *	Resource Limit: Not enough space
- *	Resource Limit: Not enough memory
+ *\li	Success
+ *\li	Translated result codes from isc_lex_gettoken
+ *\li	Various 'Bad Form' class failures depending on class and type
+ *\li	Bad Form: Input too short
+ *\li	Resource Limit: Not enough space
+ *\li	Resource Limit: Not enough memory
  */
 
 isc_result_t
 dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target);
-/*
+/*%<
  * Convert 'rdata' into text format, storing the result in 'target'.
  * The text will consist of a single line, with fields separated by
  * single spaces.
  *
  * Notes:
- *	If 'origin' is not NULL, then any names in the rdata that are
+ *\li	If 'origin' is not NULL, then any names in the rdata that are
  *	subdomains of 'origin' will be made relative it.
  *
- *	XXX Do we *really* want to support 'origin'?  I'm inclined towards "no"
+ *\li	XXX Do we *really* want to support 'origin'?  I'm inclined towards "no"
  *	at the moment.
  *
  * Requires:
  *
- *	'rdata' is a valid, non-empty rdata
+ *\li	'rdata' is a valid, non-empty rdata
  *
- *	'origin' is NULL, or is a valid name
+ *\li	'origin' is NULL, or is a valid name
  *
- *	'target' is a valid text buffer
+ *\li	'target' is a valid text buffer
  *
- * Ensures:
- *	If the result is success:
+ * Ensures,
+ *	if the result is success:
  *
- *		The used space in target is updated.
+ *	\li	The used space in target is updated.
  *
  * Returns:
- *	Success
- *	<Any non-success status from dns_name_totext()>
- *	Resource Limit: Not enough space
+ *\li	Success
+ *\li	Any non-success status from dns_name_totext()
+ *\li	Resource Limit: Not enough space
  */
 
 isc_result_t
 dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags,
 		    unsigned int width, char *linebreak, isc_buffer_t *target);
-/*
+/*%<
  * Like dns_rdata_totext, but do formatted output suitable for
  * database dumps.  This is intended for use by dns_db_dump();
  * library users are discouraged from calling it directly.
  *
- * If (flags & DNS_STYLEFLAG_MULTILINE) != 0, attempt to stay
+ * If (flags & #DNS_STYLEFLAG_MULTILINE) != 0, attempt to stay
  * within 'width' by breaking the text into multiple lines.
  * The string 'linebreak' is inserted between lines, and parentheses
  * are added when necessary.  Because RRs contain unbreakable elements
@@ -403,11 +398,11 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags,
  * potentially large, there is no guarantee that the lines will
  * not exceed 'width' anyway.
  *
- * If (flags & DNS_STYLEFLAG_MULTILINE) == 0, the rdata is always
+ * If (flags & #DNS_STYLEFLAG_MULTILINE) == 0, the rdata is always
  * printed as a single line, and no parentheses are used.
  * The 'width' and 'linebreak' arguments are ignored.
  *
- * If (flags & DNS_STYLEFLAG_COMMENT) != 0, output explanatory
+ * If (flags & #DNS_STYLEFLAG_COMMENT) != 0, output explanatory
  * comments next to things like the SOA timer fields.  Some
  * comments (e.g., the SOA ones) are only printed when multiline
  * output is selected.
@@ -416,7 +411,7 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags,
 isc_result_t
 dns_rdata_fromstruct(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
 		     dns_rdatatype_t type, void *source, isc_buffer_t *target);
-/*
+/*%<
  * Convert the C structure representation of an rdata into uncompressed wire
  * format in 'target'.
  *
@@ -424,30 +419,30 @@ dns_rdata_fromstruct(dns_rdata_t *rdata, dns_rdataclass_t rdclass,
  *
  * Requires:
  *
- *	'rdclass' and 'type' are valid.
+ *\li	'rdclass' and 'type' are valid.
  *
- *	'source' points to a valid C struct for the class and type.
+ *\li	'source' points to a valid C struct for the class and type.
  *
- *	'target' is a valid buffer.
+ *\li	'target' is a valid buffer.
  *
- *	All structure pointers to memory blocks should be NULL if their
+ *\li	All structure pointers to memory blocks should be NULL if their
  *	corresponding length values are zero.
  *
- * Ensures:
- *	If result is success:
- *	 	If 'rdata' is not NULL, it is attached to the target.
+ * Ensures,
+ *	if result is success:
+ *	\li 	If 'rdata' is not NULL, it is attached to the target.
  *
- *		The used space in 'target' is updated.
+ *	\li	The used space in 'target' is updated.
  *
  * Result:
- *	Success
- *	<Various 'Bad Form' class failures depending on class and type>
- *	Resource Limit: Not enough space
+ *\li	Success
+ *\li	Various 'Bad Form' class failures depending on class and type
+ *\li	Resource Limit: Not enough space
  */
 
 isc_result_t
 dns_rdata_tostruct(dns_rdata_t *rdata, void *target, isc_mem_t *mctx);
-/*
+/*%<
  * Convert an rdata into its C structure representation.
  *
  * If 'mctx' is NULL then 'rdata' must persist while 'target' is being used.
@@ -456,80 +451,80 @@ dns_rdata_tostruct(dns_rdata_t *rdata, void *target, isc_mem_t *mctx);
  *
  * Requires:
  *
- *	'rdata' is a valid, non-empty rdata.
+ *\li	'rdata' is a valid, non-empty rdata.
  *
- *	'target' to point to a valid pointer for the type and class.
+ *\li	'target' to point to a valid pointer for the type and class.
  *
  * Result:
- *	Success
- *	Resource Limit: Not enough memory
+ *\li	Success
+ *\li	Resource Limit: Not enough memory
  */
 
 void
 dns_rdata_freestruct(void *source);
-/*
+/*%<
  * Free dynamic memory attached to 'source' (if any).
  *
  * Requires:
  *
- *	'source' to point to the structure previously filled in by
+ *\li	'source' to point to the structure previously filled in by
  *	dns_rdata_tostruct().
  */
 
 isc_boolean_t
 dns_rdatatype_ismeta(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff the rdata type 'type' is a meta-type
  * like ANY or AXFR.
  */
 
 isc_boolean_t
 dns_rdatatype_issingleton(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff the rdata type 'type' is a singleton type,
  * like CNAME or SOA.
  *
  * Requires:
- * 	'type' is a valid rdata type.
+ * \li	'type' is a valid rdata type.
  *
  */
 
 isc_boolean_t
 dns_rdataclass_ismeta(dns_rdataclass_t rdclass);
-/*
+/*%<
  * Return true iff the rdata class 'rdclass' is a meta-class
  * like ANY or NONE.
  */
 
 isc_boolean_t
 dns_rdatatype_isdnssec(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff 'type' is one of the DNSSEC
  * rdata types that may exist alongside a CNAME record.
  *
  * Requires:
- * 	'type' is a valid rdata type.
+ * \li	'type' is a valid rdata type.
  */
 
 isc_boolean_t
 dns_rdatatype_iszonecutauth(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff rdata of type 'type' is considered authoritative
  * data (not glue) in the NSEC chain when it occurs in the parent zone
  * at a zone cut.
  *
  * Requires:
- * 	'type' is a valid rdata type.
+ * \li	'type' is a valid rdata type.
  *
  */
 
 isc_boolean_t
 dns_rdatatype_isknown(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff the rdata type 'type' is known.
  *
  * Requires:
- * 	'type' is a valid rdata type.
+ * \li	'type' is a valid rdata type.
  *
  */
 
@@ -537,140 +532,140 @@ dns_rdatatype_isknown(dns_rdatatype_t type);
 isc_result_t
 dns_rdata_additionaldata(dns_rdata_t *rdata, dns_additionaldatafunc_t add,
 			 void *arg);
-/*
+/*%<
  * Call 'add' for each name and type from 'rdata' which is subject to
  * additional section processing.
  *
  * Requires:
  *
- *	'rdata' is a valid, non-empty rdata.
+ *\li	'rdata' is a valid, non-empty rdata.
  *
- *	'add' is a valid dns_additionalfunc_t.
+ *\li	'add' is a valid dns_additionalfunc_t.
  *
  * Ensures:
  *
- *	If successful, then add() will have been called for each name
+ *\li	If successful, then add() will have been called for each name
  *	and type subject to additional section processing.
  *
- *	If add() returns something other than ISC_R_SUCCESS, that result
+ *\li	If add() returns something other than #ISC_R_SUCCESS, that result
  *	will be returned as the result of dns_rdata_additionaldata().
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	ISC_R_SUCCESS
  *
- *	Many other results are possible if not successful.
+ *\li	Many other results are possible if not successful.
  */
 
 isc_result_t
 dns_rdata_digest(dns_rdata_t *rdata, dns_digestfunc_t digest, void *arg);
-/*
+/*%<
  * Send 'rdata' in DNSSEC canonical form to 'digest'.
  *
  * Note:
- *	'digest' may be called more than once by dns_rdata_digest().  The
+ *\li	'digest' may be called more than once by dns_rdata_digest().  The
  *	concatenation of all the regions, in the order they were given
  *	to 'digest', will be the DNSSEC canonical form of 'rdata'.
  *
  * Requires:
  *
- *	'rdata' is a valid, non-empty rdata.
+ *\li	'rdata' is a valid, non-empty rdata.
  *
- *	'digest' is a valid dns_digestfunc_t.
+ *\li	'digest' is a valid dns_digestfunc_t.
  *
  * Ensures:
  *
- *	If successful, then all of the rdata's data has been sent, in
+ *\li	If successful, then all of the rdata's data has been sent, in
  *	DNSSEC canonical form, to 'digest'.
  *
- *	If digest() returns something other than ISC_R_SUCCESS, that result
+ *\li	If digest() returns something other than ISC_R_SUCCESS, that result
  *	will be returned as the result of dns_rdata_digest().
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	ISC_R_SUCCESS
  *
- *	Many other results are possible if not successful.
+ *\li	Many other results are possible if not successful.
  */
 
 isc_boolean_t
 dns_rdatatype_questiononly(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff rdata of type 'type' can only appear in the question
  * section of a properly formatted message.
  *
  * Requires:
- * 	'type' is a valid rdata type.
+ * \li	'type' is a valid rdata type.
  *
  */
 
 isc_boolean_t
 dns_rdatatype_notquestion(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff rdata of type 'type' can not appear in the question
  * section of a properly formatted message.
  *
  * Requires:
- * 	'type' is a valid rdata type.
+ * \li	'type' is a valid rdata type.
  *
  */
 
 isc_boolean_t
 dns_rdatatype_atparent(dns_rdatatype_t type);
-/*
+/*%<
  * Return true iff rdata of type 'type' should appear at the parent of
  * a zone cut.
  *
  * Requires:
- * 	'type' is a valid rdata type.
+ * \li	'type' is a valid rdata type.
  *
  */
 
 unsigned int
 dns_rdatatype_attributes(dns_rdatatype_t rdtype);
-/*
+/*%<
  * Return attributes for the given type.
  *
  * Requires:
- *	'rdtype' are known.
+ *\li	'rdtype' are known.
  *
  * Returns:
- *	a bitmask consisting of the following flags.
+ *\li	a bitmask consisting of the following flags.
  */
 
-/* only one may exist for a name */
+/*% only one may exist for a name */
 #define DNS_RDATATYPEATTR_SINGLETON		0x00000001U
-/* requires no other data be present */
+/*% requires no other data be present */
 #define DNS_RDATATYPEATTR_EXCLUSIVE		0x00000002U
-/* Is a meta type */
+/*% Is a meta type */
 #define DNS_RDATATYPEATTR_META			0x00000004U
-/* Is a DNSSEC type, like RRSIG or NSEC */
+/*% Is a DNSSEC type, like RRSIG or NSEC */
 #define DNS_RDATATYPEATTR_DNSSEC		0x00000008U
-/* Is a zone cut authority type */
+/*% Is a zone cut authority type */
 #define DNS_RDATATYPEATTR_ZONECUTAUTH		0x00000010U
-/* Is reserved (unusable) */
+/*% Is reserved (unusable) */
 #define DNS_RDATATYPEATTR_RESERVED		0x00000020U
-/* Is an unknown type */
+/*% Is an unknown type */
 #define DNS_RDATATYPEATTR_UNKNOWN		0x00000040U
-/* Is META, and can only be in a question section */
+/*% Is META, and can only be in a question section */
 #define DNS_RDATATYPEATTR_QUESTIONONLY		0x00000080U
-/* is META, and can NOT be in a question section */
+/*% is META, and can NOT be in a question section */
 #define DNS_RDATATYPEATTR_NOTQUESTION		0x00000100U
-/* Is present at zone cuts in the parent, not the child */
+/*% Is present at zone cuts in the parent, not the child */
 #define DNS_RDATATYPEATTR_ATPARENT		0x00000200U
 
 dns_rdatatype_t
 dns_rdata_covers(dns_rdata_t *rdata);
-/*
+/*%<
  * Return the rdatatype that this type covers.
  *
  * Requires:
- *	'rdata' is a valid, non-empty rdata.
+ *\li	'rdata' is a valid, non-empty rdata.
  *
- *	'rdata' is a type that covers other rdata types.
+ *\li	'rdata' is a type that covers other rdata types.
  *
  * Returns:
- *	The type covered.
+ *\li	The type covered.
  */
 
 isc_boolean_t
diff --git a/contrib/bind9/lib/dns/include/dns/rdataclass.h b/contrib/bind9/lib/dns/include/dns/rdataclass.h
index 359a2be..fc622bf 100644
--- a/contrib/bind9/lib/dns/include/dns/rdataclass.h
+++ b/contrib/bind9/lib/dns/include/dns/rdataclass.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataclass.h,v 1.17.206.1 2004/03/06 08:13:59 marka Exp $ */
+/* $Id: rdataclass.h,v 1.18.18.2 2005/04/29 00:16:18 marka Exp $ */
 
 #ifndef DNS_RDATACLASS_H
 #define DNS_RDATACLASS_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -28,49 +30,49 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_rdataclass_fromtext(dns_rdataclass_t *classp, isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a DNS class.
  *
  * Requires:
- *	'classp' is a valid pointer.
+ *\li	'classp' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	DNS_R_UNKNOWN			class is unknown
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#DNS_R_UNKNOWN			class is unknown
  */
 
 isc_result_t
 dns_rdataclass_totext(dns_rdataclass_t rdclass, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of class 'rdclass' into 'target'.
  *
  * Requires:
- *	'rdclass' is a valid class.
+ *\li	'rdclass' is a valid class.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
- * Ensures:
- *	If the result is success:
- *		The used space in 'target' is updated.
+ * Ensures,
+ *	if the result is success:
+ *\li		The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#ISC_R_NOSPACE			target buffer is too small
  */
 
 void
 dns_rdataclass_format(dns_rdataclass_t rdclass,
 		      char *array, unsigned int size);
-/*
+/*%<
  * Format a human-readable representation of the class 'rdclass'
  * into the character array 'array', which is of size 'size'.
  * The resulting string is guaranteed to be null-terminated.
  */
 
 #define DNS_RDATACLASS_FORMATSIZE sizeof("CLASS65535")
-/*
+/*%<
  * Minimum size of array to pass to dns_rdataclass_format().
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/rdatalist.h b/contrib/bind9/lib/dns/include/dns/rdatalist.h
index a846c89..697386f 100644
--- a/contrib/bind9/lib/dns/include/dns/rdatalist.h
+++ b/contrib/bind9/lib/dns/include/dns/rdatalist.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatalist.h,v 1.13.206.1 2004/03/06 08:13:59 marka Exp $ */
+/* $Id: rdatalist.h,v 1.14.18.2 2005/04/29 00:16:19 marka Exp $ */
 
 #ifndef DNS_RDATALIST_H
 #define DNS_RDATALIST_H 1
@@ -24,32 +24,31 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Rdatalist
- *
+/*! \file
+ * \brief
  * A DNS rdatalist is a list of rdata of a common type and class.
  *
  * MP:
- *	Clients of this module must impose any required synchronization.
+ *\li	Clients of this module must impose any required synchronization.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 #include <isc/lang.h>
 
 #include <dns/types.h>
 
-/*
+/*%
  * Clients may use this type directly.
  */
 struct dns_rdatalist {
@@ -65,38 +64,38 @@ ISC_LANG_BEGINDECLS
 
 void
 dns_rdatalist_init(dns_rdatalist_t *rdatalist);
-/*
+/*%<
  * Initialize rdatalist.
  *
  * Ensures:
- *	All fields of rdatalist have been initialized to their default
+ *\li	All fields of rdatalist have been initialized to their default
  *	values.
  */
 
 isc_result_t
 dns_rdatalist_tordataset(dns_rdatalist_t *rdatalist,
 			 dns_rdataset_t *rdataset);
-/*
+/*%<
  * Make 'rdataset' refer to the rdata in 'rdatalist'.
  *
  * Note:
- *	The caller must ensure that 'rdatalist' remains valid and unchanged
+ *\li	The caller must ensure that 'rdatalist' remains valid and unchanged
  *	while 'rdataset' is associated with it.
  *
  * Requires:
  *
- *	'rdatalist' is a valid rdatalist.
+ *\li	'rdatalist' is a valid rdatalist.
  *
- *	'rdataset' is a valid rdataset that is not currently associated with
+ *\li	'rdataset' is a valid rdataset that is not currently associated with
  *	any rdata.
  *
- * Ensures:
- *	On success,
+ * Ensures,
+ *	on success,
  *
- *		'rdataset' is associated with the rdata in rdatalist.
+ *\li		'rdataset' is associated with the rdata in rdatalist.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/rdataset.h b/contrib/bind9/lib/dns/include/dns/rdataset.h
index 12cfbde..5597591 100644
--- a/contrib/bind9/lib/dns/include/dns/rdataset.h
+++ b/contrib/bind9/lib/dns/include/dns/rdataset.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataset.h,v 1.41.2.5.2.10 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: rdataset.h,v 1.51.18.7 2006/03/03 00:56:53 marka Exp $ */
 
 #ifndef DNS_RDATASET_H
 #define DNS_RDATASET_H 1
@@ -24,9 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Rdataset
- *
+/*! \file
+ * \brief
  * A DNS rdataset is a handle that can be associated with a collection of
  * rdata all having a common owner name, class, and type.
  *
@@ -34,31 +33,38 @@
  * rdatasets, an implementation of the method suite (e.g. "slabbed rdata") is
  * required.
  *
- * XXX <more> XXX
+ * XXX &lt;more&gt; XXX
  *
  * MP:
- *	Clients of this module must impose any required synchronization.
+ *\li	Clients of this module must impose any required synchronization.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 #include <isc/lang.h>
 #include <isc/magic.h>
+#include <isc/stdtime.h>
 
 #include <dns/types.h>
 
 ISC_LANG_BEGINDECLS
 
+typedef enum {
+	dns_rdatasetadditional_fromauth,
+	dns_rdatasetadditional_fromcache,
+	dns_rdatasetadditional_fromglue
+} dns_rdatasetadditional_t;
+
 typedef struct dns_rdatasetmethods {
 	void			(*disassociate)(dns_rdataset_t *rdataset);
 	isc_result_t		(*first)(dns_rdataset_t *rdataset);
@@ -74,12 +80,36 @@ typedef struct dns_rdatasetmethods {
 					      dns_name_t *name,
 					      dns_rdataset_t *nsec,
 					      dns_rdataset_t *nsecsig);
+	isc_result_t		(*getadditional)(dns_rdataset_t *rdataset,
+						 dns_rdatasetadditional_t type,
+						 dns_rdatatype_t qtype,
+						 dns_acache_t *acache,
+						 dns_zone_t **zonep,
+						 dns_db_t **dbp,
+						 dns_dbversion_t **versionp,
+						 dns_dbnode_t **nodep,
+						 dns_name_t *fname,
+						 dns_message_t *msg,
+						 isc_stdtime_t now);
+	isc_result_t		(*setadditional)(dns_rdataset_t *rdataset,
+						 dns_rdatasetadditional_t type,
+						 dns_rdatatype_t qtype,
+						 dns_acache_t *acache,
+						 dns_zone_t *zone,
+						 dns_db_t *db,
+						 dns_dbversion_t *version,
+						 dns_dbnode_t *node,
+						 dns_name_t *fname);
+	isc_result_t		(*putadditional)(dns_acache_t *acache,
+						 dns_rdataset_t *rdataset,
+						 dns_rdatasetadditional_t type,
+						 dns_rdatatype_t qtype);
 } dns_rdatasetmethods_t;
 
 #define DNS_RDATASET_MAGIC	       ISC_MAGIC('D','N','S','R')
 #define DNS_RDATASET_VALID(set)	       ISC_MAGIC_VALID(set, DNS_RDATASET_MAGIC)
 
-/*
+/*%
  * Direct use of this structure by clients is strongly discouraged, except
  * for the 'link' field which may be used however the client wishes.  The
  * 'private', 'current', and 'index' fields MUST NOT be changed by clients.
@@ -103,14 +133,15 @@ struct dns_rdataset {
 	 * attributes
 	 */
 	unsigned int			attributes;
-	/*
+	/*%
 	 * the counter provides the starting point in the "cyclic" order.
 	 * The value ISC_UINT32_MAX has a special meaning of "picking up a
 	 * random value." in order to take care of databases that do not
 	 * increment the counter.
 	 */
 	isc_uint32_t			count;
-	/*
+	/*@{*/
+	/*%
 	 * These are for use by the rdataset implementation, and MUST NOT
 	 * be changed by clients.
 	 */
@@ -120,35 +151,41 @@ struct dns_rdataset {
 	unsigned int			privateuint4;
 	void *				private5;
 	void *				private6;
+	/*@}*/
 };
 
-/*
- * _RENDERED:
+/*!
+ * \def DNS_RDATASETATTR_RENDERED
  *	Used by message.c to indicate that the rdataset was rendered.
  *
- * _TTLADJUSTED:
+ * \def DNS_RDATASETATTR_TTLADJUSTED
  *	Used by message.c to indicate that the rdataset's rdata had differing
  *	TTL values, and the rdataset->ttl holds the smallest.
+ *
+ * \def DNS_RDATASETATTR_LOADORDER
+ *	Output the RRset in load order.
  */
+
 #define DNS_RDATASETATTR_QUESTION	0x00000001
-#define DNS_RDATASETATTR_RENDERED	0x00000002	/* Used by message.c */
-#define DNS_RDATASETATTR_ANSWERED	0x00000004	/* Used by server. */
-#define DNS_RDATASETATTR_CACHE		0x00000008	/* Used by resolver. */
-#define DNS_RDATASETATTR_ANSWER		0x00000010	/* Used by resolver. */
-#define DNS_RDATASETATTR_ANSWERSIG	0x00000020	/* Used by resolver. */
-#define DNS_RDATASETATTR_EXTERNAL	0x00000040	/* Used by resolver. */
-#define DNS_RDATASETATTR_NCACHE		0x00000080	/* Used by resolver. */
-#define DNS_RDATASETATTR_CHAINING	0x00000100	/* Used by resolver. */
-#define DNS_RDATASETATTR_TTLADJUSTED	0x00000200	/* Used by message.c */
+#define DNS_RDATASETATTR_RENDERED	0x00000002	/*%< Used by message.c */
+#define DNS_RDATASETATTR_ANSWERED	0x00000004	/*%< Used by server. */
+#define DNS_RDATASETATTR_CACHE		0x00000008	/*%< Used by resolver. */
+#define DNS_RDATASETATTR_ANSWER		0x00000010	/*%< Used by resolver. */
+#define DNS_RDATASETATTR_ANSWERSIG	0x00000020	/*%< Used by resolver. */
+#define DNS_RDATASETATTR_EXTERNAL	0x00000040	/*%< Used by resolver. */
+#define DNS_RDATASETATTR_NCACHE		0x00000080	/*%< Used by resolver. */
+#define DNS_RDATASETATTR_CHAINING	0x00000100	/*%< Used by resolver. */
+#define DNS_RDATASETATTR_TTLADJUSTED	0x00000200	/*%< Used by message.c */
 #define DNS_RDATASETATTR_FIXEDORDER	0x00000400
 #define DNS_RDATASETATTR_RANDOMIZE	0x00000800
-#define DNS_RDATASETATTR_CHASE		0x00001000	/* Used by resolver. */
+#define DNS_RDATASETATTR_CHASE		0x00001000	/*%< Used by resolver. */
 #define DNS_RDATASETATTR_NXDOMAIN	0x00002000
 #define DNS_RDATASETATTR_NOQNAME	0x00004000
-#define DNS_RDATASETATTR_CHECKNAMES	0x00008000	/* Used by resolver. */
+#define DNS_RDATASETATTR_CHECKNAMES	0x00008000	/*%< Used by resolver. */
 #define DNS_RDATASETATTR_REQUIREDGLUE	0x00010000
+#define DNS_RDATASETATTR_LOADORDER	0x00020000
 
-/*
+/*%
  * _OMITDNSSEC:
  * 	Omit DNSSEC records when rendering ncache records.
  */
@@ -156,147 +193,147 @@ struct dns_rdataset {
 
 void
 dns_rdataset_init(dns_rdataset_t *rdataset);
-/*
+/*%<
  * Make 'rdataset' a valid, disassociated rdataset.
  *
  * Requires:
- *	'rdataset' is not NULL.
+ *\li	'rdataset' is not NULL.
  *
  * Ensures:
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  */
 
 void
 dns_rdataset_invalidate(dns_rdataset_t *rdataset);
-/*
+/*%<
  * Invalidate 'rdataset'.
  *
  * Requires:
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  *
  * Ensures:
- *	If assertion checking is enabled, future attempts to use 'rdataset'
+ *\li	If assertion checking is enabled, future attempts to use 'rdataset'
  *	without initializing it will cause an assertion failure.
  */
 
 void
 dns_rdataset_disassociate(dns_rdataset_t *rdataset);
-/*
+/*%<
  * Disassociate 'rdataset' from its rdata, allowing it to be reused.
  *
  * Notes:
- *	The client must ensure it has no references to rdata in the rdataset
+ *\li	The client must ensure it has no references to rdata in the rdataset
  *	before disassociating.
  *
  * Requires:
- *	'rdataset' is a valid, associated rdataset.
+ *\li	'rdataset' is a valid, associated rdataset.
  *
  * Ensures:
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  */
 
 isc_boolean_t
 dns_rdataset_isassociated(dns_rdataset_t *rdataset);
-/*
+/*%<
  * Is 'rdataset' associated?
  *
  * Requires:
- *	'rdataset' is a valid rdataset.
+ *\li	'rdataset' is a valid rdataset.
  *
  * Returns:
- *	ISC_TRUE			'rdataset' is associated.
- *	ISC_FALSE			'rdataset' is not associated.
+ *\li	#ISC_TRUE			'rdataset' is associated.
+ *\li	#ISC_FALSE			'rdataset' is not associated.
  */
 
 void
 dns_rdataset_makequestion(dns_rdataset_t *rdataset, dns_rdataclass_t rdclass,
 			  dns_rdatatype_t type);
-/*
+/*%<
  * Make 'rdataset' a valid, associated, question rdataset, with a
  * question class of 'rdclass' and type 'type'.
  *
  * Notes:
- *	Question rdatasets have a class and type, but no rdata.
+ *\li	Question rdatasets have a class and type, but no rdata.
  *
  * Requires:
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  *
  * Ensures:
- *	'rdataset' is a valid, associated, question rdataset.
+ *\li	'rdataset' is a valid, associated, question rdataset.
  */
 
 void
 dns_rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target);
-/*
+/*%<
  * Make 'target' refer to the same rdataset as 'source'.
  *
  * Requires:
- *	'source' is a valid, associated rdataset.
+ *\li	'source' is a valid, associated rdataset.
  *
- *	'target' is a valid, dissociated rdataset.
+ *\li	'target' is a valid, dissociated rdataset.
  *
  * Ensures:
- *	'target' references the same rdataset as 'source'.
+ *\li	'target' references the same rdataset as 'source'.
  */
 
 unsigned int
 dns_rdataset_count(dns_rdataset_t *rdataset);
-/*
+/*%<
  * Return the number of records in 'rdataset'.
  *
  * Requires:
- *	'rdataset' is a valid, associated rdataset.
+ *\li	'rdataset' is a valid, associated rdataset.
  *
  * Returns:
- *	The number of records in 'rdataset'.
+ *\li	The number of records in 'rdataset'.
  */
 
 isc_result_t
 dns_rdataset_first(dns_rdataset_t *rdataset);
-/*
+/*%<
  * Move the rdata cursor to the first rdata in the rdataset (if any).
  *
  * Requires:
- *	'rdataset' is a valid, associated rdataset.
+ *\li	'rdataset' is a valid, associated rdataset.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no rdata in the set.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE			There are no rdata in the set.
  */
 
 isc_result_t
 dns_rdataset_next(dns_rdataset_t *rdataset);
-/*
+/*%<
  * Move the rdata cursor to the next rdata in the rdataset (if any).
  *
  * Requires:
- *	'rdataset' is a valid, associated rdataset.
+ *\li	'rdataset' is a valid, associated rdataset.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no more rdata in the set.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE			There are no more rdata in the set.
  */
 
 void
 dns_rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata);
-/*
+/*%<
  * Make 'rdata' refer to the current rdata.
  *
  * Notes:
  *
- *	The data returned in 'rdata' is valid for the life of the
+ *\li	The data returned in 'rdata' is valid for the life of the
  *	rdataset; in particular, subsequent changes in the cursor position
  *	do not invalidate 'rdata'.
  *
  * Requires:
- *	'rdataset' is a valid, associated rdataset.
+ *\li	'rdataset' is a valid, associated rdataset.
  *
- *	The rdata cursor of 'rdataset' is at a valid location (i.e. the
+ *\li	The rdata cursor of 'rdataset' is at a valid location (i.e. the
  *	result of last call to a cursor movement command was ISC_R_SUCCESS).
  *
  * Ensures:
- *	'rdata' refers to the rdata at the rdata cursor location of
- *	'rdataset'.
+ *\li	'rdata' refers to the rdata at the rdata cursor location of
+ *\li	'rdataset'.
  */
 
 isc_result_t
@@ -305,23 +342,23 @@ dns_rdataset_totext(dns_rdataset_t *rdataset,
 		    isc_boolean_t omit_final_dot,
 		    isc_boolean_t question,
 		    isc_buffer_t *target);
-/*
+/*%<
  * Convert 'rdataset' to text format, storing the result in 'target'.
  *
  * Notes:
- *	The rdata cursor position will be changed.
+ *\li	The rdata cursor position will be changed.
  *
- *	The 'question' flag should normally be ISC_FALSE.  If it is 
- *	ISC_TRUE, the TTL and rdata fields are not printed.  This is 
+ *\li	The 'question' flag should normally be #ISC_FALSE.  If it is 
+ *	#ISC_TRUE, the TTL and rdata fields are not printed.  This is 
  *	for use when printing an rdata representing a question section.
  *
- *	This interface is deprecated; use dns_master_rdatasettottext()
+ *\li	This interface is deprecated; use dns_master_rdatasettottext()
  * 	and/or dns_master_questiontotext() instead.
  *
  * Requires:
- *	'rdataset' is a valid rdataset.
+ *\li	'rdataset' is a valid rdataset.
  *
- *	'rdataset' is not empty.
+ *\li	'rdataset' is not empty.
  */
 
 isc_result_t
@@ -331,35 +368,35 @@ dns_rdataset_towire(dns_rdataset_t *rdataset,
 		    isc_buffer_t *target,
 		    unsigned int options,
 		    unsigned int *countp);
-/*
+/*%<
  * Convert 'rdataset' to wire format, compressing names as specified
  * in 'cctx', and storing the result in 'target'.
  *
  * Notes:
- *	The rdata cursor position will be changed.
+ *\li	The rdata cursor position will be changed.
  *
- *	The number of RRs added to target will be added to *countp.
+ *\li	The number of RRs added to target will be added to *countp.
  *
  * Requires:
- *	'rdataset' is a valid rdataset.
+ *\li	'rdataset' is a valid rdataset.
  *
- *	'rdataset' is not empty.
+ *\li	'rdataset' is not empty.
  *
- *	'countp' is a valid pointer.
+ *\li	'countp' is a valid pointer.
  *
  * Ensures:
- *	On a return of ISC_R_SUCCESS, 'target' contains a wire format
+ *\li	On a return of ISC_R_SUCCESS, 'target' contains a wire format
  *	for the data contained in 'rdataset'.  Any error return leaves
  *	the buffer unchanged.
  *
- *	*countp has been incremented by the number of RRs added to
+ *\li	*countp has been incremented by the number of RRs added to
  *	target.
  *
  * Returns:
- *	ISC_R_SUCCESS		- all ok
- *	ISC_R_NOSPACE		- 'target' doesn't have enough room
+ *\li	#ISC_R_SUCCESS		- all ok
+ *\li	#ISC_R_NOSPACE		- 'target' doesn't have enough room
  *
- *	Any error returned by dns_rdata_towire(), dns_rdataset_next(),
+ *\li	Any error returned by dns_rdata_towire(), dns_rdataset_next(),
  *	dns_name_towire().
  */
 
@@ -372,13 +409,13 @@ dns_rdataset_towiresorted(dns_rdataset_t *rdataset,
 			  const void *order_arg,
 			  unsigned int options,
 			  unsigned int *countp);
-/*
+/*%<
  * Like dns_rdataset_towire(), but sorting the rdatasets according to
  * the integer value returned by 'order' when called witih the rdataset
  * and 'order_arg' as arguments.
  *
  * Requires:
- *	All the requirements of dns_rdataset_towire(), and
+ *\li	All the requirements of dns_rdataset_towire(), and
  *	that order_arg is NULL if and only if order is NULL.
  */
 
@@ -392,76 +429,167 @@ dns_rdataset_towirepartial(dns_rdataset_t *rdataset,
 			   unsigned int options,
 			   unsigned int *countp,
 			   void **state);
-/*
+/*%<
  * Like dns_rdataset_towiresorted() except that a partial rdataset
  * may be written.
  *
  * Requires:
- *	All the requirements of dns_rdataset_towiresorted().
+ *\li	All the requirements of dns_rdataset_towiresorted().
  *	If 'state' is non NULL then the current position in the
  *	rdataset will be remembered if the rdataset in not
  *	completely written and should be passed on on subsequent
  *	calls (NOT CURRENTLY IMPLEMENTED).
  *
  * Returns:
- *	ISC_R_SUCCESS if all of the records were written.
- *	ISC_R_NOSPACE if unable to fit in all of the records. *countp
+ *\li	#ISC_R_SUCCESS if all of the records were written.
+ *\li	#ISC_R_NOSPACE if unable to fit in all of the records. *countp
  *		      will be updated to reflect the number of records
  *		      written.
  */
 
-
 isc_result_t
 dns_rdataset_additionaldata(dns_rdataset_t *rdataset,
 			    dns_additionaldatafunc_t add, void *arg);
-/*
+/*%<
  * For each rdata in rdataset, call 'add' for each name and type in the
  * rdata which is subject to additional section processing.
  *
  * Requires:
  *
- *	'rdataset' is a valid, non-question rdataset.
+ *\li	'rdataset' is a valid, non-question rdataset.
  *
- *	'add' is a valid dns_additionaldatafunc_t
+ *\li	'add' is a valid dns_additionaldatafunc_t
  *
  * Ensures:
  *
- *	If successful, dns_rdata_additionaldata() will have been called for
+ *\li	If successful, dns_rdata_additionaldata() will have been called for
  *	each rdata in 'rdataset'.
  *
- *	If a call to dns_rdata_additionaldata() is not successful, the
+ *\li	If a call to dns_rdata_additionaldata() is not successful, the
  *	result returned will be the result of dns_rdataset_additionaldata().
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *
- *	Any error that dns_rdata_additionaldata() can return.
+ *\li	Any error that dns_rdata_additionaldata() can return.
  */
 
 isc_result_t
 dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 			dns_rdataset_t *nsec, dns_rdataset_t *nsecsig);
-/*
+/*%<
  * Return the noqname proof for this record.
  *
  * Requires:
- *	'rdataset' to be valid and DNS_RDATASETATTR_NOQNAME to be set.
- *	'name' to be valid.
- *	'nsec' and 'nsecsig' to be valid and not associated.
+ *\li	'rdataset' to be valid and #DNS_RDATASETATTR_NOQNAME to be set.
+ *\li	'name' to be valid.
+ *\li	'nsec' and 'nsecsig' to be valid and not associated.
  */
 
 isc_result_t
 dns_rdataset_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name);
-/*
+/*%<
  * Associate a noqname proof with this record.
- * Sets DNS_RDATASETATTR_NOQNAME if successful.
+ * Sets #DNS_RDATASETATTR_NOQNAME if successful.
  * Adjusts the 'rdataset->ttl' to minimum of the 'rdataset->ttl' and
  * the 'nsec' and 'rrsig(nsec)' ttl.
  *
  * Requires:
- *	'rdataset' to be valid and DNS_RDATASETATTR_NOQNAME to be set.
- *	'name' to be valid and have NSEC and RRSIG(NSEC) rdatasets.
+ *\li	'rdataset' to be valid and #DNS_RDATASETATTR_NOQNAME to be set.
+ *\li	'name' to be valid and have NSEC and RRSIG(NSEC) rdatasets.
+ */
+
+isc_result_t
+dns_rdataset_getadditional(dns_rdataset_t *rdataset,
+			   dns_rdatasetadditional_t type,
+			   dns_rdatatype_t qtype,
+			   dns_acache_t *acache,
+			   dns_zone_t **zonep,
+			   dns_db_t **dbp,
+			   dns_dbversion_t **versionp,
+			   dns_dbnode_t **nodep,
+			   dns_name_t *fname,
+			   dns_message_t *msg,
+			   isc_stdtime_t now);
+/*%<
+ * Get cached additional information from the DB node for a particular
+ * 'rdataset.'  'type' is one of dns_rdatasetadditional_fromauth,
+ * dns_rdatasetadditional_fromcache, and dns_rdatasetadditional_fromglue,
+ * which specifies the origin of the information.  'qtype' is intended to
+ * be used for specifying a particular rdata type in the cached information.
+ *
+ * Requires:
+ * \li	'rdataset' is a valid rdataset.
+ * \li	'acache' can be NULL, in which case this function will simply return
+ * 	ISC_R_FAILURE.
+ * \li	For the other pointers, see dns_acache_getentry().
+ *
+ * Ensures:
+ * \li	See dns_acache_getentry().
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_FAILURE	- additional information caching is not supported.
+ * \li	#ISC_R_NOTFOUND	- the corresponding DB node has not cached additional
+ *			  information for 'rdataset.'
+ * \li	Any error that dns_acache_getentry() can return.
+ */
+
+isc_result_t
+dns_rdataset_setadditional(dns_rdataset_t *rdataset,
+			   dns_rdatasetadditional_t type,
+			   dns_rdatatype_t qtype,
+			   dns_acache_t *acache,
+			   dns_zone_t *zone,
+			   dns_db_t *db,
+			   dns_dbversion_t *version,
+			   dns_dbnode_t *node,
+			   dns_name_t *fname);
+/*%<
+ * Set cached additional information to the DB node for a particular
+ * 'rdataset.'  See dns_rdataset_getadditional for the semantics of 'type'
+ * and 'qtype'.
+ *
+ * Requires:
+ * \li	'rdataset' is a valid rdataset.
+ * \li	'acache' can be NULL, in which case this function will simply return
+ *	ISC_R_FAILURE.
+ * \li	For the other pointers, see dns_acache_setentry().
+ *
+ * Ensures:
+ * \li	See dns_acache_setentry().
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_FAILURE	- additional information caching is not supported.
+ * \li	#ISC_R_NOMEMORY
+ * \li	Any error that dns_acache_setentry() can return.
+ */
+
+isc_result_t
+dns_rdataset_putadditional(dns_acache_t *acache,
+			   dns_rdataset_t *rdataset,
+			   dns_rdatasetadditional_t type,
+			   dns_rdatatype_t qtype);
+/*%<
+ * Discard cached additional information stored in the DB node for a particular
+ * 'rdataset.'  See dns_rdataset_getadditional for the semantics of 'type'
+ * and 'qtype'.
+ *
+ * Requires:
+ * \li	'rdataset' is a valid rdataset.
+ * \li	'acache' can be NULL, in which case this function will simply return
+ *	ISC_R_FAILURE.
+ *
+ * Ensures:
+ * \li	See dns_acache_cancelentry().
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_FAILURE	- additional information caching is not supported.
+ * \li	#ISC_R_NOTFOUND	- the corresponding DB node has not cached additional
+ *			  information for 'rdataset.'
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/rdatasetiter.h b/contrib/bind9/lib/dns/include/dns/rdatasetiter.h
index 198aebb..b2e13f8 100644
--- a/contrib/bind9/lib/dns/include/dns/rdatasetiter.h
+++ b/contrib/bind9/lib/dns/include/dns/rdatasetiter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatasetiter.h,v 1.14.206.1 2004/03/06 08:13:59 marka Exp $ */
+/* $Id: rdatasetiter.h,v 1.15.18.2 2005/04/29 00:16:19 marka Exp $ */
 
 #ifndef DNS_RDATASETITER_H
 #define DNS_RDATASETITER_H 1
@@ -24,9 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Rdataset Iterator
- *
+/*! \file
+ * \brief
  * The DNS Rdataset Iterator interface allows iteration of all of the
  * rdatasets at a node.
  *
@@ -37,25 +36,25 @@
  * It is the client's responsibility to call dns_rdataset_disassociate()
  * on all rdatasets returned.
  *
- * XXX <more> XXX
+ * XXX more XXX
  *
  * MP:
- *	The iterator itself is not locked.  The caller must ensure
+ *\li	The iterator itself is not locked.  The caller must ensure
  *	synchronization.
  *
- *	The iterator methods ensure appropriate database locking.
+ *\li	The iterator methods ensure appropriate database locking.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 /*****
@@ -85,12 +84,12 @@ typedef struct dns_rdatasetitermethods {
 #define DNS_RDATASETITER_MAGIC	     ISC_MAGIC('D','N','S','i')
 #define DNS_RDATASETITER_VALID(i)    ISC_MAGIC_VALID(i, DNS_RDATASETITER_MAGIC)
 
-/*
+/*%
  * This structure is actually just the common prefix of a DNS db
  * implementation's version of a dns_rdatasetiter_t.
- *
+ * \brief
  * Direct use of this structure by clients is forbidden.  DB implementations
- * may change the structure.  'magic' must be DNS_RDATASETITER_MAGIC for
+ * may change the structure.  'magic' must be #DNS_RDATASETITER_MAGIC for
  * any of the dns_rdatasetiter routines to work.  DB implementations must
  * maintain all DB rdataset iterator invariants.
  */
@@ -106,64 +105,64 @@ struct dns_rdatasetiter {
 
 void
 dns_rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp);
-/*
+/*%<
  * Destroy '*iteratorp'.
  *
  * Requires:
  *
- *	'*iteratorp' is a valid iterator.
+ *\li	'*iteratorp' is a valid iterator.
  *
  * Ensures:
  *
- *	All resources used by the iterator are freed.
+ *\li	All resources used by the iterator are freed.
  *
- *	*iteratorp == NULL.
+ *\li	*iteratorp == NULL.
  */
 
 isc_result_t
 dns_rdatasetiter_first(dns_rdatasetiter_t *iterator);
-/*
+/*%<
  * Move the rdataset cursor to the first rdataset at the node (if any).
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no rdatasets at the node.
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOMORE			There are no rdatasets at the node.
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 isc_result_t
 dns_rdatasetiter_next(dns_rdatasetiter_t *iterator);
-/*
+/*%<
  * Move the rdataset cursor to the next rdataset at the node (if any).
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			There are no more rdatasets at the
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOMORE			There are no more rdatasets at the
  *					node.
  *
- *	Other results are possible, depending on the DB implementation.
+ *\li	Other results are possible, depending on the DB implementation.
  */
 
 void
 dns_rdatasetiter_current(dns_rdatasetiter_t *iterator,
 			 dns_rdataset_t *rdataset);
-/*
+/*%<
  * Return the current rdataset.
  *
  * Requires:
- *	'iterator' is a valid iterator.
+ *\li	'iterator' is a valid iterator.
  *
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  *
- *	The rdataset cursor of 'iterator' is at a valid location (i.e. the
- *	result of last call to a cursor movement command was ISC_R_SUCCESS).
+ *\li	The rdataset cursor of 'iterator' is at a valid location (i.e. the
+ *	result of last call to a cursor movement command was #ISC_R_SUCCESS).
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/rdataslab.h b/contrib/bind9/lib/dns/include/dns/rdataslab.h
index a0912db..b693a71 100644
--- a/contrib/bind9/lib/dns/include/dns/rdataslab.h
+++ b/contrib/bind9/lib/dns/include/dns/rdataslab.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,34 +15,33 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataslab.h,v 1.20.2.2.2.4 2004/03/08 09:04:39 marka Exp $ */
+/* $Id: rdataslab.h,v 1.25.18.2 2005/04/29 00:16:19 marka Exp $ */
 
 #ifndef DNS_RDATASLAB_H
 #define DNS_RDATASLAB_H 1
 
-/*
- * DNS Rdata Slab
- *
+/*! \file
+ * \brief
  * Implements storage of rdatasets into slabs of memory.
  *
  * MP:
- *	Clients of this module must impose any required synchronization.
+ *\li	Clients of this module must impose any required synchronization.
  *
  * Reliability:
- *	This module deals with low-level byte streams.  Errors in any of
+ *\li	This module deals with low-level byte streams.  Errors in any of
  *	the functions are likely to crash the server or corrupt memory.
  *
- *	If the caller passes invalid memory references, these functions are
+ *\li	If the caller passes invalid memory references, these functions are
  *	likely to crash the server or corrupt memory.
  *
  * Resources:
- *	None.
+ *\li	None.
  *
  * Security:
- *	None.
+ *\li	None.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 /***
@@ -65,22 +64,22 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen);
-/*
+/*%<
  * Slabify a rdataset.  The slab area will be allocated and returned
  * in 'region'.
  *
  * Requires:
- *	'rdataset' is valid.
+ *\li	'rdataset' is valid.
  *
  * Ensures:
- *	'region' will have base pointing to the start of allocated memory,
+ *\li	'region' will have base pointing to the start of allocated memory,
  *	with the slabified region beginning at region->base + reservelen.
  *	region->length contains the total length allocated.
  *
  * Returns:
- *	ISC_R_SUCCESS		- successful completion
- *	ISC_R_NOMEMORY		- no memory.
- *	<XXX others>
+ *\li	ISC_R_SUCCESS		- successful completion
+ *\li	ISC_R_NOMEMORY		- no memory.
+ *\li	XXX others
  */
 
 void
@@ -88,27 +87,26 @@ dns_rdataslab_tordataset(unsigned char *slab, unsigned int reservelen,
 			 dns_rdataclass_t rdclass, dns_rdatatype_t rdtype,
 			 dns_rdatatype_t covers, dns_ttl_t ttl,
 			 dns_rdataset_t *rdataset);
-/*
+/*%<
  * Construct an rdataset from a slab.
  *
  * Requires:
- *	'slab' points to a slab.
- *	'rdataset' is disassociated.
+ *\li	'slab' points to a slab.
+ *\li	'rdataset' is disassociated.
  *
  * Ensures:
- *	'rdataset' is associated and points to a valid rdataest.
+ *\li	'rdataset' is associated and points to a valid rdataest.
  */
-
 unsigned int
 dns_rdataslab_size(unsigned char *slab, unsigned int reservelen);
-/*
+/*%<
  * Return the total size of an rdataslab.
  *
  * Requires:
- *	'slab' points to a slab.
+ *\li	'slab' points to a slab.
  *
  * Returns:
- *	The number of bytes in the slab, including the reservelen.
+ *\li	The number of bytes in the slab, including the reservelen.
  */
 
 isc_result_t
@@ -116,7 +114,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 		    unsigned int reservelen, isc_mem_t *mctx,
 		    dns_rdataclass_t rdclass, dns_rdatatype_t type,
 		    unsigned int flags, unsigned char **tslabp);
-/*
+/*%<
  * Merge 'oslab' and 'nslab'.
  */
 
@@ -125,7 +123,7 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		       unsigned int reservelen, isc_mem_t *mctx,
 		       dns_rdataclass_t rdclass, dns_rdatatype_t type,
 		       unsigned int flags, unsigned char **tslabp);
-/*
+/*%<
  * Subtract 'sslab' from 'mslab'.  If 'exact' is true then all elements
  * of 'sslab' must exist in 'mslab'.
  *
@@ -136,30 +134,28 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 isc_boolean_t
 dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
 		    unsigned int reservelen);
-
-/*
+/*%<
  * Compare two rdataslabs for equality.  This does _not_ do a full
  * DNSSEC comparison.
  *
  * Requires:
- *	'slab1' and 'slab2' point to slabs.
+ *\li	'slab1' and 'slab2' point to slabs.
  *
  * Returns:
- *	ISC_TRUE if the slabs are equal, ISC_FALSE otherwise.
+ *\li	ISC_TRUE if the slabs are equal, ISC_FALSE otherwise.
  */
-
 isc_boolean_t
 dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
 		     unsigned int reservelen, dns_rdataclass_t rdclass, 
 		     dns_rdatatype_t type);
-/*
+/*%<
  * Compare two rdataslabs for DNSSEC equality. 
  *
  * Requires:
- *	'slab1' and 'slab2' point to slabs.
+ *\li	'slab1' and 'slab2' point to slabs.
  *
  * Returns:
- *	ISC_TRUE if the slabs are equal, ISC_FALSE otherwise.
+ *\li	ISC_TRUE if the slabs are equal, #ISC_FALSE otherwise.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/rdatatype.h b/contrib/bind9/lib/dns/include/dns/rdatatype.h
index 0fa865d..40a884d 100644
--- a/contrib/bind9/lib/dns/include/dns/rdatatype.h
+++ b/contrib/bind9/lib/dns/include/dns/rdatatype.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatatype.h,v 1.17.206.1 2004/03/06 08:13:59 marka Exp $ */
+/* $Id: rdatatype.h,v 1.18.18.2 2005/04/29 00:16:20 marka Exp $ */
 
 #ifndef DNS_RDATATYPE_H
 #define DNS_RDATATYPE_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -28,49 +30,49 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_rdatatype_fromtext(dns_rdatatype_t *typep, isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a DNS rdata type.
  *
  * Requires:
- *	'typep' is a valid pointer.
+ *\li	'typep' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	DNS_R_UNKNOWN			type is unknown
+ *\li	ISC_R_SUCCESS			on success
+ *\li	DNS_R_UNKNOWN			type is unknown
  */
 
 isc_result_t
 dns_rdatatype_totext(dns_rdatatype_t type, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of type 'type' into 'target'.
  *
  * Requires:
- *	'type' is a valid type.
+ *\li	'type' is a valid type.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
- * Ensures:
- *	If the result is success:
- *		The used space in 'target' is updated.
+ * Ensures,
+ *	if the result is success:
+ *\li		The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	#ISC_R_SUCCESS			on success
+ *\li	#ISC_R_NOSPACE			target buffer is too small
  */
 
 void
 dns_rdatatype_format(dns_rdatatype_t rdtype,
 		     char *array, unsigned int size);
-/*
+/*%<
  * Format a human-readable representation of the type 'rdtype'
  * into the character array 'array', which is of size 'size'.
  * The resulting string is guaranteed to be null-terminated.
  */
 
 #define DNS_RDATATYPE_FORMATSIZE sizeof("TYPE65535")
-/*
+/*%<
  * Minimum size of array to pass to dns_rdatatype_format().
  * May need to be adjusted if a new RR type with a very long
  * name is defined.
diff --git a/contrib/bind9/lib/dns/include/dns/request.h b/contrib/bind9/lib/dns/include/dns/request.h
index b3e7bcd..b858a9e 100644
--- a/contrib/bind9/lib/dns/include/dns/request.h
+++ b/contrib/bind9/lib/dns/include/dns/request.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: request.h,v 1.17.12.5 2004/03/08 09:04:39 marka Exp $ */
+/* $Id: request.h,v 1.21.18.2 2005/04/29 00:16:20 marka Exp $ */
 
 #ifndef DNS_REQUEST_H
 #define DNS_REQUEST_H 1
@@ -24,21 +24,21 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Request
+/*! \file
  *
+ * \brief
  * The request module provides simple request/response services useful for
  * sending SOA queries, DNS Notify messages, and dynamic update requests.
  *
  * MP:
- *	The module ensures appropriate synchronization of data structures it
+ *\li	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  */
 
 #include <isc/lang.h>
@@ -62,102 +62,101 @@ dns_requestmgr_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
 		      dns_dispatchmgr_t *dispatchmgr,
 		      dns_dispatch_t *dispatchv4, dns_dispatch_t *dispatchv6,
 		      dns_requestmgr_t **requestmgrp);
-/*
+/*%<
  * Create a request manager.
  *
  * Requires:
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
- *	'timermgr' is a valid timer manager.
+ *\li	'timermgr' is a valid timer manager.
  *
- *	'socketmgr' is a valid socket manager.
+ *\li	'socketmgr' is a valid socket manager.
  *
- *	'taskmgr' is a valid task manager.
+ *\li	'taskmgr' is a valid task manager.
  *
- *	'dispatchv4' is a valid dispatcher with an IPv4 UDP socket, or is NULL.
+ *\li	'dispatchv4' is a valid dispatcher with an IPv4 UDP socket, or is NULL.
  *
- *	'dispatchv6' is a valid dispatcher with an IPv6 UDP socket, or is NULL.
+ *\li	'dispatchv6' is a valid dispatcher with an IPv6 UDP socket, or is NULL.
  *
- *	requestmgrp != NULL && *requestmgrp == NULL
+ *\li	requestmgrp != NULL && *requestmgrp == NULL
  *
  * Ensures:
  *
- *	On success, *requestmgrp is a valid request manager.
+ *\li	On success, *requestmgrp is a valid request manager.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	ISC_R_SUCCESS
  *
- *	Any other result indicates failure.
+ *\li	Any other result indicates failure.
  */
 
 void
 dns_requestmgr_whenshutdown(dns_requestmgr_t *requestmgr, isc_task_t *task,
 			    isc_event_t **eventp);
-/*
+/*%<
  * Send '*eventp' to 'task' when 'requestmgr' has completed shutdown.
  *
  * Notes:
  *
- *	It is not safe to detach the last reference to 'requestmgr' until
+ *\li	It is not safe to detach the last reference to 'requestmgr' until
  *	shutdown is complete.
  *
  * Requires:
  *
- *	'requestmgr' is a valid request manager.
+ *\li	'requestmgr' is a valid request manager.
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	*eventp is a valid event.
+ *\li	*eventp is a valid event.
  *
  * Ensures:
  *
- *	*eventp == NULL.
+ *\li	*eventp == NULL.
  */
 
 void
 dns_requestmgr_shutdown(dns_requestmgr_t *requestmgr);
-/*
+/*%<
  * Start the shutdown process for 'requestmgr'.
  *
  * Notes:
  *
- *	This call has no effect if the request manager is already shutting
+ *\li	This call has no effect if the request manager is already shutting
  *	down.
  *
  * Requires:
  *
- *	'requestmgr' is a valid requestmgr.
+ *\li	'requestmgr' is a valid requestmgr.
  */
 
 void
 dns_requestmgr_attach(dns_requestmgr_t *source, dns_requestmgr_t **targetp);
-/*
+/*%<
  *	Attach to the request manager.  dns_requestmgr_shutdown() must not
  *	have been called on 'source' prior to calling dns_requestmgr_attach().
  *
  * Requires:
  *
- *	'source' is a valid requestmgr.
+ *\li	'source' is a valid requestmgr.
  *
- *	'targetp' to be non NULL and '*targetp' to be NULL.
+ *\li	'targetp' to be non NULL and '*targetp' to be NULL.
  */
 
 void
 dns_requestmgr_detach(dns_requestmgr_t **requestmgrp);
-/*
- *
+/*%<
  *	Detach from the given requestmgr.  If this is the final detach
  *	requestmgr will be destroyed.  dns_requestmgr_shutdown() must
  *	be called before the final detach.
  *
  * Requires:
  *
- *	'*requestmgrp' is a valid requestmgr.
+ *\li	'*requestmgrp' is a valid requestmgr.
  *
  * Ensures:
- *	'*requestmgrp' is NULL.
+ *\li	'*requestmgrp' is NULL.
  */
 
 isc_result_t
@@ -167,31 +166,32 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		   unsigned int timeout, isc_task_t *task,
 		   isc_taskaction_t action, void *arg,
 		   dns_request_t **requestp);
-/*
+/*%<
  * Create and send a request.
  *
  * Notes:
  *
- *	'message' will be rendered and sent to 'address'.  If the
- *	DNS_REQUESTOPT_TCP option is set, TCP will be used.  The request
+ *\li	'message' will be rendered and sent to 'address'.  If the
+ *	#DNS_REQUESTOPT_TCP option is set, TCP will be used.  The request
  *	will timeout after 'timeout' seconds.
  *
- *	When the request completes, successfully, due to a timeout, or
+ *\li	When the request completes, successfully, due to a timeout, or
  *	because it was canceled, a completion event will be sent to 'task'.
  *
  * Requires:
  *
- *	'message' is a valid DNS message.
+ *\li	'message' is a valid DNS message.
  *
- *	'address' is a valid sockaddr.
+ *\li	'address' is a valid sockaddr.
  *
- *	'timeout' > 0
+ *\li	'timeout' > 0
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	requestp != NULL && *requestp == NULL
+ *\li	requestp != NULL && *requestp == NULL
  */
 
+/*% See dns_request_createvia3() */
 isc_result_t
 dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		      isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
@@ -200,6 +200,7 @@ dns_request_createvia(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		      isc_taskaction_t action, void *arg,
 		      dns_request_t **requestp);
 
+/*% See dns_request_createvia3() */
 isc_result_t
 dns_request_createvia2(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		       isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
@@ -216,36 +217,37 @@ dns_request_createvia3(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		       unsigned int udpretries, isc_task_t *task,
 		       isc_taskaction_t action, void *arg,
 		       dns_request_t **requestp);
-/*
+/*%< 
  * Create and send a request.
  *
  * Notes:
  *
- *	'message' will be rendered and sent to 'address'.  If the
- *	DNS_REQUESTOPT_TCP option is set, TCP will be used.  The request
+ *\li	'message' will be rendered and sent to 'address'.  If the
+ *	#DNS_REQUESTOPT_TCP option is set, TCP will be used.  The request
  *	will timeout after 'timeout' seconds.  UDP requests will be resent
  *	at 'udptimeout' intervals if non-zero or 'udpretries' is non-zero.
  *
- *	When the request completes, successfully, due to a timeout, or
+ *\li	When the request completes, successfully, due to a timeout, or
  *	because it was canceled, a completion event will be sent to 'task'.
  *
  * Requires:
  *
- *	'message' is a valid DNS message.
+ *\li	'message' is a valid DNS message.
  *
- *	'dstaddr' is a valid sockaddr.
+ *\li	'dstaddr' is a valid sockaddr.
  *
- *	'srcaddr' is a valid sockaddr or NULL.
+ *\li	'srcaddr' is a valid sockaddr or NULL.
  *
- *	'srcaddr' and 'dstaddr' are the same protocol family.
+ *\li	'srcaddr' and 'dstaddr' are the same protocol family.
  *
- *	'timeout' > 0
+ *\li	'timeout' > 0
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	requestp != NULL && *requestp == NULL
+ *\li	requestp != NULL && *requestp == NULL
  */
 
+/*% See dns_request_createraw3() */
 isc_result_t
 dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		      isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
@@ -253,6 +255,7 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		      isc_task_t *task, isc_taskaction_t action, void *arg,
 		      dns_request_t **requestp);
 
+/*% See dns_request_createraw3() */
 isc_result_t
 dns_request_createraw2(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		       isc_sockaddr_t *srcaddr, isc_sockaddr_t *destaddr,
@@ -268,55 +271,55 @@ dns_request_createraw3(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf,
 		       unsigned int udptimeout, unsigned int udpretries,
 		       isc_task_t *task, isc_taskaction_t action, void *arg,
 		       dns_request_t **requestp);
-/*
- * Create and send a request.
+/*!< 
+ * \brief Create and send a request.
  *
  * Notes:
  *
- *	'msgbuf' will be sent to 'destaddr' after setting the id.  If the
- *	DNS_REQUESTOPT_TCP option is set, TCP will be used.  The request
+ *\li	'msgbuf' will be sent to 'destaddr' after setting the id.  If the
+ *	#DNS_REQUESTOPT_TCP option is set, TCP will be used.  The request
  *	will timeout after 'timeout' seconds.   UDP requests will be resent
  *	at 'udptimeout' intervals if non-zero or if 'udpretries' is not zero.
  *	
- *	When the request completes, successfully, due to a timeout, or
+ *\li	When the request completes, successfully, due to a timeout, or
  *	because it was canceled, a completion event will be sent to 'task'.
  *
  * Requires:
  *
- *	'msgbuf' is a valid DNS message in compressed wire format.
+ *\li	'msgbuf' is a valid DNS message in compressed wire format.
  *
- *	'destaddr' is a valid sockaddr.
+ *\li	'destaddr' is a valid sockaddr.
  *
- *	'srcaddr' is a valid sockaddr or NULL.
+ *\li	'srcaddr' is a valid sockaddr or NULL.
  *
- *	'srcaddr' and 'dstaddr' are the same protocol family.
+ *\li	'srcaddr' and 'dstaddr' are the same protocol family.
  *
- *	'timeout' > 0
+ *\li	'timeout' > 0
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	requestp != NULL && *requestp == NULL
+ *\li	requestp != NULL && *requestp == NULL
  */
 
 void
 dns_request_cancel(dns_request_t *request);
-/*
+/*%<
  * Cancel 'request'.
  *
  * Requires:
  *
- *	'request' is a valid request.
+ *\li	'request' is a valid request.
  *
  * Ensures:
  *
- *	If the completion event for 'request' has not yet been sent, it
+ *\li	If the completion event for 'request' has not yet been sent, it
  *	will be sent, and the result code will be ISC_R_CANCELED.
  */
 
 isc_result_t
 dns_request_getresponse(dns_request_t *request, dns_message_t *message,
 			unsigned int options);
-/*
+/*%<
  * Get the response to 'request' by filling in 'message'.
  *
  * 'options' is passed to dns_message_parse().  See dns_message_parse()
@@ -324,46 +327,46 @@ dns_request_getresponse(dns_request_t *request, dns_message_t *message,
  *
  * Requires:
  *
- *	'request' is a valid request for which the caller has received the
+ *\li	'request' is a valid request for which the caller has received the
  *	completion event.
  *
- *	The result code of the completion event was ISC_R_SUCCESS.
+ *\li	The result code of the completion event was #ISC_R_SUCCESS.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
+ *\li	ISC_R_SUCCESS
  *
- *	Any result that dns_message_parse() can return.
+ *\li	Any result that dns_message_parse() can return.
  */
 
 isc_boolean_t
 dns_request_usedtcp(dns_request_t *request);
-/*
- * Return whether this query used TCP or not.  Setting DNS_REQUESTOPT_TCP
+/*%<
+ * Return whether this query used TCP or not.  Setting #DNS_REQUESTOPT_TCP
  * in the call to dns_request_create() will cause the function to return
- * ISC_TRUE, othewise the result is based on the query message size.
+ * #ISC_TRUE, othewise the result is based on the query message size.
  *
  * Requires:
- *	'request' is a valid request.
+ *\li	'request' is a valid request.
  *
  * Returns:
- *	ISC_TRUE	if TCP was used.
- *	ISC_FALSE	if UDP was used.
+ *\li	ISC_TRUE	if TCP was used.
+ *\li	ISC_FALSE	if UDP was used.
  */
 
 void
 dns_request_destroy(dns_request_t **requestp);
-/*
+/*%<
  * Destroy 'request'.
  *
  * Requires:
  *
- *	'request' is a valid request for which the caller has received the
+ *\li	'request' is a valid request for which the caller has received the
  *	completion event.
  *
  * Ensures:
  *
- *	*requestp == NULL
+ *\li	*requestp == NULL
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/resolver.h b/contrib/bind9/lib/dns/include/dns/resolver.h
index 8e3e632..4e0e6a0 100644
--- a/contrib/bind9/lib/dns/include/dns/resolver.h
+++ b/contrib/bind9/lib/dns/include/dns/resolver.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.h,v 1.34.12.9 2006/02/01 23:48:51 marka Exp $ */
+/* $Id: resolver.h,v 1.40.18.11 2006/02/01 22:39:17 marka Exp $ */
 
 #ifndef DNS_RESOLVER_H
 #define DNS_RESOLVER_H 1
@@ -24,9 +24,9 @@
  ***** Module Info
  *****/
 
-/*
- * DNS Resolver
+/*! \file
  *
+ * \brief
  * This is the BIND 9 resolver, the module responsible for resolving DNS
  * requests by iteratively querying authoritative servers and following
  * referrals.  This is a "full resolver", not to be confused with
@@ -35,21 +35,21 @@
  * daemon the stub resolver talks to.
  *
  * MP:
- *	The module ensures appropriate synchronization of data structures it
+ *\li	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	RFCs:	1034, 1035, 2181, <TBS>
- *	Drafts:	<TBS>
+ *\li	RFCs:	1034, 1035, 2181, TBS
+ *\li	Drafts:	TBS
  */
 
 #include <isc/lang.h>
@@ -60,14 +60,14 @@
 
 ISC_LANG_BEGINDECLS
 
-/*
+/*%
  * A dns_fetchevent_t is sent when a 'fetch' completes.  Any of 'db',
  * 'node', 'rdataset', and 'sigrdataset' may be bound.  It is the
  * receiver's responsibility to detach before freeing the event.
- *
- * 'rdataset' and 'sigrdataset' are the values that were supplied when
- * dns_resolver_createfetch() was called.  They are returned to the
- * caller so that they may be freed.
+ * \brief
+ * 'rdataset', 'sigrdataset', 'client' and 'id' are the values that were
+ * supplied when dns_resolver_createfetch() was called.  They are returned
+ *  to the caller so that they may be freed.
  */
 typedef struct dns_fetchevent {
 	ISC_EVENT_COMMON(struct dns_fetchevent);
@@ -79,17 +79,25 @@ typedef struct dns_fetchevent {
 	dns_rdataset_t *		rdataset;
 	dns_rdataset_t *		sigrdataset;
 	dns_fixedname_t			foundname;
+	isc_sockaddr_t *		client;
+	dns_messageid_t			id;
 } dns_fetchevent_t;
 
 /*
  * Options that modify how a 'fetch' is done.
  */
-#define DNS_FETCHOPT_TCP		0x01	     /* Use TCP. */
-#define DNS_FETCHOPT_UNSHARED		0x02	     /* See below. */
-#define DNS_FETCHOPT_RECURSIVE		0x04	     /* Set RD? */
-#define DNS_FETCHOPT_NOEDNS0		0x08	     /* Do not use EDNS. */
-#define DNS_FETCHOPT_FORWARDONLY	0x10	     /* Only use forwarders. */
-#define DNS_FETCHOPT_NOVALIDATE		0x20	     /* Disable validation. */
+#define DNS_FETCHOPT_TCP		0x01	     /*%< Use TCP. */
+#define DNS_FETCHOPT_UNSHARED		0x02	     /*%< See below. */
+#define DNS_FETCHOPT_RECURSIVE		0x04	     /*%< Set RD? */
+#define DNS_FETCHOPT_NOEDNS0		0x08	     /*%< Do not use EDNS. */
+#define DNS_FETCHOPT_FORWARDONLY	0x10	     /*%< Only use forwarders. */
+#define DNS_FETCHOPT_NOVALIDATE		0x20	     /*%< Disable validation. */
+#define DNS_FETCHOPT_EDNS512		0x40	     /*%< Advertise a 512 byte
+						          UDP buffer. */
+
+#define	DNS_FETCHOPT_EDNSVERSIONSET	0x00800000
+#define	DNS_FETCHOPT_EDNSVERSIONMASK	0xff000000
+#define	DNS_FETCHOPT_EDNSVERSIONSHIFT	24
 
 /*
  * XXXRTH  Should this API be made semi-private?  (I.e.
@@ -110,114 +118,114 @@ dns_resolver_create(dns_view_t *view,
 		    dns_dispatch_t *dispatchv6,
 		    dns_resolver_t **resp);
 
-/*
+/*%<
  * Create a resolver.
  *
  * Notes:
  *
- *	Generally, applications should not create a resolver directly, but
+ *\li	Generally, applications should not create a resolver directly, but
  *	should instead call dns_view_createresolver().
  *
- *	No options are currently defined.
+ *\li	No options are currently defined.
  *
  * Requires:
  *
- *	'view' is a valid view.
+ *\li	'view' is a valid view.
  *
- *	'taskmgr' is a valid task manager.
+ *\li	'taskmgr' is a valid task manager.
  *
- *	'ntasks' > 0.
+ *\li	'ntasks' > 0.
  *
- *	'socketmgr' is a valid socket manager.
+ *\li	'socketmgr' is a valid socket manager.
  *
- *	'timermgr' is a valid timer manager.
+ *\li	'timermgr' is a valid timer manager.
  *
- *	'dispatchv4' is a valid dispatcher with an IPv4 UDP socket, or is NULL.
+ *\li	'dispatchv4' is a valid dispatcher with an IPv4 UDP socket, or is NULL.
  *
- *	'dispatchv6' is a valid dispatcher with an IPv6 UDP socket, or is NULL.
+ *\li	'dispatchv6' is a valid dispatcher with an IPv6 UDP socket, or is NULL.
  *
- *	resp != NULL && *resp == NULL.
+ *\li	resp != NULL && *resp == NULL.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS				On success.
+ *\li	#ISC_R_SUCCESS				On success.
  *
- *	Anything else				Failure.
+ *\li	Anything else				Failure.
  */
 
 void
 dns_resolver_freeze(dns_resolver_t *res);
-/*
+/*%<
  * Freeze resolver.
  *
  * Notes:
  *
- *	Certain configuration changes cannot be made after the resolver
+ *\li	Certain configuration changes cannot be made after the resolver
  *	is frozen.  Fetches cannot be created until the resolver is frozen.
  *
  * Requires:
  *
- *	'res' is a valid, unfrozen resolver.
+ *\li	'res' is a valid, unfrozen resolver.
  *
  * Ensures:
  *
- *	'res' is frozen.
+ *\li	'res' is frozen.
  */
 
 void
 dns_resolver_prime(dns_resolver_t *res);
-/*
+/*%<
  * Prime resolver.
  *
  * Notes:
  *
- *	Resolvers which have a forwarding policy other than dns_fwdpolicy_only
+ *\li	Resolvers which have a forwarding policy other than dns_fwdpolicy_only
  *	need to be primed with the root nameservers, otherwise the root
  *	nameserver hints data may be used indefinitely.  This function requests
  *	that the resolver start a priming fetch, if it isn't already priming.
  *
  * Requires:
  *
- *	'res' is a valid, frozen resolver.
+ *\li	'res' is a valid, frozen resolver.
  */
 
 
 void
 dns_resolver_whenshutdown(dns_resolver_t *res, isc_task_t *task,
 			  isc_event_t **eventp);
-/*
+/*%<
  * Send '*eventp' to 'task' when 'res' has completed shutdown.
  *
  * Notes:
  *
- *	It is not safe to detach the last reference to 'res' until
+ *\li	It is not safe to detach the last reference to 'res' until
  *	shutdown is complete.
  *
  * Requires:
  *
- *	'res' is a valid resolver.
+ *\li	'res' is a valid resolver.
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	*eventp is a valid event.
+ *\li	*eventp is a valid event.
  *
  * Ensures:
  *
- *	*eventp == NULL.
+ *\li	*eventp == NULL.
  */
 
 void
 dns_resolver_shutdown(dns_resolver_t *res);
-/*
+/*%<
  * Start the shutdown process for 'res'.
  *
  * Notes:
  *
- *	This call has no effect if the resolver is already shutting down.
+ *\li	This call has no effect if the resolver is already shutting down.
  *
  * Requires:
  *
- *	'res' is a valid resolver.
+ *\li	'res' is a valid resolver.
  */
 
 void
@@ -236,88 +244,108 @@ dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name,
 			 dns_rdataset_t *rdataset,
 			 dns_rdataset_t *sigrdataset,
 			 dns_fetch_t **fetchp);
-/*
+
+isc_result_t
+dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
+			  dns_rdatatype_t type,
+			  dns_name_t *domain, dns_rdataset_t *nameservers,
+			  dns_forwarders_t *forwarders,
+			  isc_sockaddr_t *client, isc_uint16_t id,
+			  unsigned int options, isc_task_t *task,
+			  isc_taskaction_t action, void *arg,
+			  dns_rdataset_t *rdataset,
+			  dns_rdataset_t *sigrdataset,
+			  dns_fetch_t **fetchp);
+/*%<
  * Recurse to answer a question.
  *
  * Notes:
  *
- *	This call starts a query for 'name', type 'type'.
+ *\li	This call starts a query for 'name', type 'type'.
  *
- *	The 'domain' is a parent domain of 'name' for which
+ *\li	The 'domain' is a parent domain of 'name' for which
  *	a set of name servers 'nameservers' is known.  If no
  *	such name server information is available, set
  * 	'domain' and 'nameservers' to NULL.
  *
- *	'forwarders' is unimplemented, and subject to change when
+ *\li	'forwarders' is unimplemented, and subject to change when
  *	we figure out how selective forwarding will work.
  *
- *	When the fetch completes (successfully or otherwise), a
- *	DNS_EVENT_FETCHDONE event with action 'action' and arg 'arg' will be
+ *\li	When the fetch completes (successfully or otherwise), a
+ *	#DNS_EVENT_FETCHDONE event with action 'action' and arg 'arg' will be
  *	posted to 'task'.
  *
- *	The values of 'rdataset' and 'sigrdataset' will be returned in
+ *\li	The values of 'rdataset' and 'sigrdataset' will be returned in
  *	the FETCHDONE event.
  *
+ *\li	'client' and 'id' are used for duplicate query detection.  '*client'
+ *	must remain stable until after 'action' has been called or
+ *	dns_resolver_cancelfetch() is called.
+ *
  * Requires:
  *
- *	'res' is a valid resolver that has been frozen.
+ *\li	'res' is a valid resolver that has been frozen.
  *
- *	'name' is a valid name.
+ *\li	'name' is a valid name.
  *
- *	'type' is not a meta type other than ANY.
+ *\li	'type' is not a meta type other than ANY.
  *
- *	'domain' is a valid name or NULL.
+ *\li	'domain' is a valid name or NULL.
  *
- *	'nameservers' is a valid NS rdataset (whose owner name is 'domain')
+ *\li	'nameservers' is a valid NS rdataset (whose owner name is 'domain')
  *	iff. 'domain' is not NULL.
  *
- *	'forwarders' is NULL.
+ *\li	'forwarders' is NULL.
+ *
+ *\li	'client' is a valid sockaddr or NULL.
  *
- *	'options' contains valid options.
+ *\li	'options' contains valid options.
  *
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  *
- *	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
+ *\li	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
  *
- *	fetchp != NULL && *fetchp == NULL.
+ *\li	fetchp != NULL && *fetchp == NULL.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS					Success
+ *\li	#ISC_R_SUCCESS					Success
+ *\li	#DNS_R_DUPLICATE
+ *\li	#DNS_R_DROP
  *
- *	Many other values are possible, all of which indicate failure.
+ *\li	Many other values are possible, all of which indicate failure.
  */
 
 void
 dns_resolver_cancelfetch(dns_fetch_t *fetch);
-/*
+/*%<
  * Cancel 'fetch'.
  *
  * Notes:
  *
- *	If 'fetch' has not completed, post its FETCHDONE event with a
- *	result code of ISC_R_CANCELED.
+ *\li	If 'fetch' has not completed, post its FETCHDONE event with a
+ *	result code of #ISC_R_CANCELED.
  *
  * Requires:
  *
- *	'fetch' is a valid fetch.
+ *\li	'fetch' is a valid fetch.
  */
 
 void
 dns_resolver_destroyfetch(dns_fetch_t **fetchp);
-/*
+/*%<
  * Destroy 'fetch'.
  *
  * Requires:
  *
- *	'*fetchp' is a valid fetch.
+ *\li	'*fetchp' is a valid fetch.
  *
- *	The caller has received the FETCHDONE event (either because the
+ *\li	The caller has received the FETCHDONE event (either because the
  *	fetch completed or because dns_resolver_cancelfetch() was called).
  *
  * Ensures:
  *
- *	*fetchp == NULL.
+ *\li	*fetchp == NULL.
  */
 
 dns_dispatchmgr_t *
@@ -337,25 +365,25 @@ dns_resolver_taskmgr(dns_resolver_t *resolver);
 
 isc_uint32_t
 dns_resolver_getlamettl(dns_resolver_t *resolver);
-/*
+/*%<
  * Get the resolver's lame-ttl.  zero => no lame processing.
  *
  * Requires:
- *	'resolver' to be valid.
+ *\li	'resolver' to be valid.
  */
 
 void
 dns_resolver_setlamettl(dns_resolver_t *resolver, isc_uint32_t lame_ttl);
-/*
+/*%<
  * Set the resolver's lame-ttl.  zero => no lame processing.
  *
  * Requires:
- *	'resolver' to be valid.
+ *\li	'resolver' to be valid.
  */
 
 unsigned int
 dns_resolver_nrunning(dns_resolver_t *resolver);
-/*
+/*%<
  * Return the number of currently running resolutions in this
  * resolver.  This is may be less than the number of outstanding
  * fetches due to multiple identical fetches, or more than the
@@ -366,56 +394,62 @@ dns_resolver_nrunning(dns_resolver_t *resolver);
 isc_result_t
 dns_resolver_addalternate(dns_resolver_t *resolver, isc_sockaddr_t *alt,
 			  dns_name_t *name, in_port_t port);
-/*
+/*%<
  * Add alternate addresses to be tried in the event that the nameservers
  * for a zone are not available in the address families supported by the
  * operating system.
  *
  * Require:
- * 	only one of 'name' or 'alt' to be valid.
+ * \li	only one of 'name' or 'alt' to be valid.
  */
 
 void
 dns_resolver_setudpsize(dns_resolver_t *resolver, isc_uint16_t udpsize);
-/*
+/*%<
  * Set the EDNS UDP buffer size advertised by the server.
  */
 
 isc_uint16_t
 dns_resolver_getudpsize(dns_resolver_t *resolver);
-/*
+/*%<
  * Get the current EDNS UDP buffer size.
  */
 
 void
 dns_resolver_reset_algorithms(dns_resolver_t *resolver);
-/*
+/*%<
  * Clear the disabled DNSSEC algorithms.
  */
 
 isc_result_t
 dns_resolver_disable_algorithm(dns_resolver_t *resolver, dns_name_t *name,
 			       unsigned int alg);
-/*
+/*%<
  * Mark the give DNSSEC algorithm as disabled and below 'name'.
  * Valid algorithms are less than 256.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_RANGE
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_RANGE
+ *\li	#ISC_R_NOMEMORY
  */
 
 isc_boolean_t
 dns_resolver_algorithm_supported(dns_resolver_t *resolver, dns_name_t *name,
 				 unsigned int alg);
-/*
+/*%<
  * Check if the given algorithm is supported by this resolver.
  * This checks if the algorithm has been disabled via
  * dns_resolver_disable_algorithm() then the underlying
  * crypto libraries if not specifically disabled.
  */
 
+isc_boolean_t
+dns_resolver_digest_supported(dns_resolver_t *resolver, unsigned int digest_type);
+/*%<
+ * Is this digest type supported.
+ */
+
 void
 dns_resolver_resetmustbesecure(dns_resolver_t *resolver);
 
@@ -426,6 +460,20 @@ dns_resolver_setmustbesecure(dns_resolver_t *resolver, dns_name_t *name,
 isc_boolean_t
 dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name);
 
+void
+dns_resolver_setclientsperquery(dns_resolver_t *resolver,
+				isc_uint32_t min, isc_uint32_t max);
+
+void
+dns_resolver_getclientsperquery(dns_resolver_t *resolver, isc_uint32_t *cur,
+				isc_uint32_t *min, isc_uint32_t *max);
+
+isc_boolean_t
+dns_resolver_getzeronosoattl(dns_resolver_t *resolver);
+ 
+void
+dns_resolver_setzeronosoattl(dns_resolver_t *resolver, isc_boolean_t state);
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_RESOLVER_H */
diff --git a/contrib/bind9/lib/dns/include/dns/result.h b/contrib/bind9/lib/dns/include/dns/result.h
index f1a71d9..db5481b 100644
--- a/contrib/bind9/lib/dns/include/dns/result.h
+++ b/contrib/bind9/lib/dns/include/dns/result.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.h,v 1.81.2.7.2.13 2004/05/14 05:06:41 marka Exp $ */
+/* $Id: result.h,v 1.104.10.6 2005/06/17 02:04:32 marka Exp $ */
 
 #ifndef DNS_RESULT_H
 #define DNS_RESULT_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/resultclass.h>
 
@@ -143,8 +145,10 @@
 #define DNS_R_UNKNOWNCOMMAND		(ISC_RESULTCLASS_DNS + 99)
 #define DNS_R_MUSTBESECURE		(ISC_RESULTCLASS_DNS + 100)
 #define DNS_R_COVERINGNSEC		(ISC_RESULTCLASS_DNS + 101)
+#define DNS_R_MXISADDRESS		(ISC_RESULTCLASS_DNS + 102)
+#define DNS_R_DUPLICATE			(ISC_RESULTCLASS_DNS + 103)
 
-#define DNS_R_NRESULTS			102	/* Number of results */
+#define DNS_R_NRESULTS			104	/*%< Number of results */
 
 /*
  * DNS wire format rcodes.
@@ -165,7 +169,7 @@
 #define DNS_R_NOTZONE			(ISC_RESULTCLASS_DNSRCODE + 10)
 #define DNS_R_BADVERS			(ISC_RESULTCLASS_DNSRCODE + 16)
 
-#define DNS_R_NRCODERESULTS		17	/* Number of rcode results */
+#define DNS_R_NRCODERESULTS		17	/*%< Number of rcode results */
 
 #define DNS_RESULT_ISRCODE(result) \
 	(ISC_RESULTCLASS_INCLASS(ISC_RESULTCLASS_DNSRCODE, (result)))
diff --git a/contrib/bind9/lib/dns/include/dns/rootns.h b/contrib/bind9/lib/dns/include/dns/rootns.h
index 02da556..a3ddc48 100644
--- a/contrib/bind9/lib/dns/include/dns/rootns.h
+++ b/contrib/bind9/lib/dns/include/dns/rootns.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rootns.h,v 1.8.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: rootns.h,v 1.9.18.3 2005/04/27 05:01:38 sra Exp $ */
 
 #ifndef DNS_ROOTNS_H
 #define DNS_ROOTNS_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -30,6 +32,14 @@ isc_result_t
 dns_rootns_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
                   const char *filename, dns_db_t **target);
 
+void
+dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db);
+/*
+ * Reports differences between hints and the real roots.
+ *
+ * Requires view, hints and (cache) db to be valid.
+ */
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_ROOTNS_H */
diff --git a/contrib/bind9/lib/dns/include/dns/sdb.h b/contrib/bind9/lib/dns/include/dns/sdb.h
index 5fdeace..de849f9 100644
--- a/contrib/bind9/lib/dns/include/dns/sdb.h
+++ b/contrib/bind9/lib/dns/include/dns/sdb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sdb.h,v 1.12.12.3 2004/03/08 09:04:39 marka Exp $ */
+/* $Id: sdb.h,v 1.15.18.2 2005/04/29 00:16:21 marka Exp $ */
 
 #ifndef DNS_SDB_H
 #define DNS_SDB_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * Simple database API.
  */
 
@@ -40,17 +41,17 @@
  *** Types
  ***/
 
-/*
+/*%
  * A simple database.  This is an opaque type.
  */
 typedef struct dns_sdb dns_sdb_t;
 
-/*
+/*%
  * A simple database lookup in progress.  This is an opaque type.
  */
 typedef struct dns_sdblookup dns_sdblookup_t;
 
-/*
+/*%
  * A simple database traversal in progress.  This is an opaque type.
  */
 typedef struct dns_sdballnodes dns_sdballnodes_t;
@@ -96,7 +97,7 @@ isc_result_t
 dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
 		 void *driverdata, unsigned int flags, isc_mem_t *mctx,
 		 dns_sdbimplementation_t **sdbimp);
-/*
+/*%<
  * Register a simple database driver for the database type 'drivername',
  * implemented by the functions in '*methods'.
  *
@@ -126,7 +127,7 @@ dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
  * The allnodes function, if non-NULL, fills in an opaque structure to be
  * used by a database iterator.  This allows the zone to be transferred.
  * This may use a considerable amount of memory for large zones, and the
- * zone transfer may not be fully RFC 1035 compliant if the zone is 
+ * zone transfer may not be fully RFC1035 compliant if the zone is 
  * frequently changed.
  *
  * The create function will be called for each zone configured
@@ -156,19 +157,20 @@ dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
 
 void
 dns_sdb_unregister(dns_sdbimplementation_t **sdbimp);
-/*
+/*%<
  * Removes the simple database driver from the list of registered database
  * types.  There must be no active databases of this type when this function
  * is called.
  */
 
+/*% See dns_sdb_putradata() */
 isc_result_t
 dns_sdb_putrr(dns_sdblookup_t *lookup, const char *type, dns_ttl_t ttl,
 	      const char *data);
 isc_result_t
 dns_sdb_putrdata(dns_sdblookup_t *lookup, dns_rdatatype_t type, dns_ttl_t ttl,
 		 const unsigned char *rdata, unsigned int rdlen);
-/*
+/*%<
  * Add a single resource record to the lookup structure to be
  * returned in the query response.  dns_sdb_putrr() takes the
  * resource record in master file text format as a null-terminated
@@ -176,6 +178,7 @@ dns_sdb_putrdata(dns_sdblookup_t *lookup, dns_rdatatype_t type, dns_ttl_t ttl,
  * uncompressed wire format.
  */
 
+/*% See dns_sdb_putnamerdata() */
 isc_result_t
 dns_sdb_putnamedrr(dns_sdballnodes_t *allnodes, const char *name,
 		   const char *type, dns_ttl_t ttl, const char *data);
@@ -183,7 +186,7 @@ isc_result_t
 dns_sdb_putnamedrdata(dns_sdballnodes_t *allnodes, const char *name,
 		      dns_rdatatype_t type, dns_ttl_t ttl,
 		      const void *rdata, unsigned int rdlen);
-/*
+/*%<
  * Add a single resource record to the allnodes structure to be
  * included in a zone transfer response, in text or wire
  * format as above.
@@ -192,7 +195,7 @@ dns_sdb_putnamedrdata(dns_sdballnodes_t *allnodes, const char *name,
 isc_result_t
 dns_sdb_putsoa(dns_sdblookup_t *lookup, const char *mname, const char *rname,
 	       isc_uint32_t serial);
-/*
+/*%<
  * This function may optionally be called from the 'authority' callback
  * to simplify construction of the SOA record for 'zone'.  It will
  * provide a SOA listing 'mname' as as the master server and 'rname' as
diff --git a/contrib/bind9/lib/dns/include/dns/sdlz.h b/contrib/bind9/lib/dns/include/dns/sdlz.h
new file mode 100644
index 0000000..13ba14a
--- /dev/null
+++ b/contrib/bind9/lib/dns/include/dns/sdlz.h
@@ -0,0 +1,266 @@
+/*
+ * Portions Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1999-2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: sdlz.h,v 1.2.2.2 2005/09/06 03:47:19 marka Exp $ */
+
+/*! \file */
+
+#ifndef SDLZ_H
+#define SDLZ_H 1
+
+#include <dns/dlz.h>
+
+ISC_LANG_BEGINDECLS
+
+#define DNS_SDLZFLAG_THREADSAFE		0x00000001U
+#define DNS_SDLZFLAG_RELATIVEOWNER	0x00000002U
+#define DNS_SDLZFLAG_RELATIVERDATA	0x00000004U
+
+ /* A simple DLZ database. */
+typedef struct dns_sdlz_db dns_sdlz_db_t;
+
+ /* A simple DLZ database lookup in progress. */
+typedef struct dns_sdlzlookup dns_sdlzlookup_t;
+
+ /* A simple DLZ database traversal in progress. */
+typedef struct dns_sdlzallnodes dns_sdlzallnodes_t;
+
+
+typedef isc_result_t
+(*dns_sdlzallnodesfunc_t)(const char *zone, void *driverarg, void *dbdata,
+			  dns_sdlzallnodes_t *allnodes);
+
+/*%<
+ * Method prototype.  Drivers implementing the SDLZ interface may
+ * supply an all nodes method.  This method is called when the DNS
+ * server is performing a zone transfer query, after the allow zone
+ * transfer method has been called.  This method is only called if the
+ * allow zone transfer method returned ISC_R_SUCCESS.  This method and
+ * the allow zone transfer method are both required for zone transfers
+ * to be supported.  If the driver generates data dynamically (instead
+ * of searching in a database for it) it should not implement this
+ * function as a zone transfer would be meaningless.  A SDLZ driver
+ * does not have to implement an all nodes method.
+ */
+
+typedef isc_result_t
+(*dns_sdlzallowzonexfr_t)(void *driverarg, void *dbdata, const char *name,
+			  const char *client);
+
+/*%<
+ * Method prototype.  Drivers implementing the SDLZ interface may
+ * supply an allow zone transfer method.  This method is called when
+ * the DNS server is performing a zone transfer query, before the all
+ * nodes method can be called.  This method and the all node method
+ * are both required for zone transfers to be supported.  If the
+ * driver generates data dynamically (instead of searching in a
+ * database for it) it should not implement this function as a zone
+ * transfer would be meaningless.  A SDLZ driver does not have to
+ * implement an allow zone transfer method.
+ *
+ * This method should return ISC_R_SUCCESS if the zone is supported by
+ * the database and a zone transfer is allowed for the specified
+ * client.  If the zone is supported by the database, but zone
+ * transfers are not allowed for the specified client this method
+ * should return ISC_R_NOPERM..  Lastly the method should return
+ * ISC_R_NOTFOUND if the zone is not supported by the database.  If an
+ * error occurs it should return a result code indicating the type of
+ * error.
+ */
+
+typedef isc_result_t
+(*dns_sdlzauthorityfunc_t)(const char *zone, void *driverarg, void *dbdata,
+			   dns_sdlzlookup_t *lookup);
+
+/*%<
+ * Method prototype.  Drivers implementing the SDLZ interface may
+ * supply an authority method.  This method is called when the DNS
+ * server is performing a query, after both the find zone and lookup
+ * methods have been called.  This method is required if the lookup
+ * function does not supply authority information for the dns
+ * record. A SDLZ driver does not have to implement an authority
+ * method.
+ */
+
+typedef isc_result_t
+(*dns_sdlzcreate_t)(const char *dlzname, unsigned int argc, char *argv[],
+		    void *driverarg, void **dbdata);
+
+/*%<
+ * Method prototype.  Drivers implementing the SDLZ interface may
+ * supply a create method.  This method is called when the DNS server
+ * is starting up and creating drivers for use later. A SDLZ driver
+ * does not have to implement a create method.
+ */
+
+typedef void
+(*dns_sdlzdestroy_t)(void *driverarg, void *dbdata);
+
+/*%<
+ * Method prototype.  Drivers implementing the SDLZ interface may
+ * supply a destroy method.  This method is called when the DNS server
+ * is shuting down and no longer needs the driver.  A SDLZ driver does
+ * not have to implement a destroy method.
+ */
+
+typedef isc_result_t
+(*dns_sdlzfindzone_t)(void *driverarg, void *dbdata, const char *name);
+
+/*%<
+ * Method prototype.  Drivers implementing the SDLZ interface MUST
+ * supply a find zone method.  This method is called when the DNS
+ * server is performing a query to to determine if 'name' is a
+ * supported dns zone.  The find zone method will be called with the
+ * longest possible name first, and continue to be called with
+ * successively shorter domain names, until any of the following
+ * occur:
+ *
+ * \li	1) the function returns (ISC_R_SUCCESS) indicating a zone name
+ *	   match.
+ *
+ * \li	2) a problem occurs, and the functions returns anything other than
+ *	   (ISC_R_NOTFOUND)
+ *
+ * \li	3) we run out of domain name labels. I.E. we have tried the
+ *	   shortest domain name
+ *
+ * \li	4) the number of labels in the domain name is less than min_lables
+ *	   for dns_dlzfindzone
+ *
+ * The driver's find zone method should return ISC_R_SUCCESS if the
+ * zone is supported by the database.  Otherwise it should return
+ * ISC_R_NOTFOUND, if the zone is not supported.  If an error occurs
+ * it should return a result code indicating the type of error.
+ */
+
+typedef isc_result_t
+(*dns_sdlzlookupfunc_t)(const char *zone, const char *name, void *driverarg,
+			void *dbdata, dns_sdlzlookup_t *lookup);
+
+/*%<
+ * Method prototype.  Drivers implementing the SDLZ interface MUST
+ * supply a lookup method.  This method is called when the DNS server
+ * is performing a query, after the find zone and before any other
+ * methods have been called.  This function returns record DNS record
+ * information using the dns_sdlz_putrr and dns_sdlz_putsoa functions.
+ * If this function supplies authority information for the DNS record
+ * the authority method is not required.  If it does not, the
+ * authority function is required.  A SDLZ driver must implement a
+ * lookup method.
+ */
+
+typedef struct dns_sdlzmethods {
+	dns_sdlzcreate_t	create;
+	dns_sdlzdestroy_t	destroy;
+	dns_sdlzfindzone_t	findzone;
+	dns_sdlzlookupfunc_t	lookup;
+	dns_sdlzauthorityfunc_t	authority;
+	dns_sdlzallnodesfunc_t	allnodes;
+	dns_sdlzallowzonexfr_t	allowzonexfr;
+} dns_sdlzmethods_t;
+
+isc_result_t
+dns_sdlzregister(const char *drivername, const dns_sdlzmethods_t *methods,
+		 void *driverarg, unsigned int flags, isc_mem_t *mctx,
+		 dns_sdlzimplementation_t **sdlzimp);
+/*%<
+ * Register a dynamically loadable zones (dlz) driver for the database
+ * type 'drivername', implemented by the functions in '*methods'.
+ *
+ * sdlzimp must point to a NULL dns_sdlzimplementation_t pointer.
+ * That is, sdlzimp != NULL && *sdlzimp == NULL.  It will be assigned
+ * a value that will later be used to identify the driver when
+ * deregistering it.
+ */
+
+void
+dns_sdlzunregister(dns_sdlzimplementation_t **sdlzimp);
+
+/*%<
+ * Removes the sdlz driver from the list of registered sdlz drivers.
+ * There must be no active sdlz drivers of this type when this
+ * function is called.
+ */
+
+isc_result_t
+dns_sdlz_putnamedrr(dns_sdlzallnodes_t *allnodes, const char *name,
+		   const char *type, dns_ttl_t ttl, const char *data);
+/*%<
+ * Add a single resource record to the allnodes structure to be later
+ * parsed into a zone transfer response.
+ */
+
+isc_result_t
+dns_sdlz_putrr(dns_sdlzlookup_t *lookup, const char *type, dns_ttl_t ttl,
+	      const char *data);
+/*%<
+ * Add a single resource record to the lookup structure to be later
+ * parsed into a query response.
+ */
+
+isc_result_t
+dns_sdlz_putsoa(dns_sdlzlookup_t *lookup, const char *mname, const char *rname,
+	       isc_uint32_t serial);
+/*%<
+ * This function may optionally be called from the 'authority'
+ * callback to simplify construction of the SOA record for 'zone'.  It
+ * will provide a SOA listing 'mname' as as the master server and
+ * 'rname' as the responsible person mailbox.  It is the
+ * responsibility of the driver to increment the serial number between
+ * responses if necessary.  All other SOA fields will have reasonable
+ * default values.
+ */
+
+
+ISC_LANG_ENDDECLS
+
+#endif /* SDLZ_H */
diff --git a/contrib/bind9/lib/dns/include/dns/secalg.h b/contrib/bind9/lib/dns/include/dns/secalg.h
index 3f7a16f..0466d91 100644
--- a/contrib/bind9/lib/dns/include/dns/secalg.h
+++ b/contrib/bind9/lib/dns/include/dns/secalg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: secalg.h,v 1.12.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: secalg.h,v 1.13.18.2 2005/04/29 00:16:21 marka Exp $ */
 
 #ifndef DNS_SECALG_H
 #define DNS_SECALG_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -28,40 +30,40 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_secalg_fromtext(dns_secalg_t *secalgp, isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a DNSSEC security algorithm value.
  * The text may contain either a mnemonic algorithm name or a decimal algorithm
  * number.
  *
  * Requires:
- *	'secalgp' is a valid pointer.
+ *\li	'secalgp' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_RANGE			numeric type is out of range
- *	DNS_R_UNKNOWN			mnemonic type is unknown
+ *\li	ISC_R_SUCCESS			on success
+ *\li	ISC_R_RANGE			numeric type is out of range
+ *\li	DNS_R_UNKNOWN			mnemonic type is unknown
  */
 
 isc_result_t
 dns_secalg_totext(dns_secalg_t secalg, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of the DNSSEC security algorithm 'secalg'
  * into 'target'.
  *
  * Requires:
- *	'secalg' is a valid secalg.
+ *\li	'secalg' is a valid secalg.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
- * Ensures:
- *	If the result is success:
- *		The used space in 'target' is updated.
+ * Ensures,
+ *	if the result is success:
+ *\li		The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	ISC_R_SUCCESS			on success
+ *\li	ISC_R_NOSPACE			target buffer is too small
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/secproto.h b/contrib/bind9/lib/dns/include/dns/secproto.h
index da8c1dd..a6cfd5c 100644
--- a/contrib/bind9/lib/dns/include/dns/secproto.h
+++ b/contrib/bind9/lib/dns/include/dns/secproto.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: secproto.h,v 1.9.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: secproto.h,v 1.10.18.2 2005/04/29 00:16:21 marka Exp $ */
 
 #ifndef DNS_SECPROTO_H
 #define DNS_SECPROTO_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -28,40 +30,40 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_secproto_fromtext(dns_secproto_t *secprotop, isc_textregion_t *source);
-/*
+/*%<
  * Convert the text 'source' refers to into a DNSSEC security protocol value.
  * The text may contain either a mnemonic protocol name or a decimal protocol
  * number.
  *
  * Requires:
- *	'secprotop' is a valid pointer.
+ *\li	'secprotop' is a valid pointer.
  *
- *	'source' is a valid text region.
+ *\li	'source' is a valid text region.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_RANGE			numeric type is out of range
- *	DNS_R_UNKNOWN			mnemonic type is unknown
+ *\li	ISC_R_SUCCESS			on success
+ *\li	ISC_R_RANGE			numeric type is out of range
+ *\li	DNS_R_UNKNOWN			mnemonic type is unknown
  */
 
 isc_result_t
 dns_secproto_totext(dns_secproto_t secproto, isc_buffer_t *target);
-/*
+/*%<
  * Put a textual representation of the DNSSEC security protocol 'secproto'
  * into 'target'.
  *
  * Requires:
- *	'secproto' is a valid secproto.
+ *\li	'secproto' is a valid secproto.
  *
- *	'target' is a valid text buffer.
+ *\li	'target' is a valid text buffer.
  *
- * Ensures:
- *	If the result is success:
- *		The used space in 'target' is updated.
+ * Ensures,
+ *	if the result is success:
+ *	\li	The used space in 'target' is updated.
  *
  * Returns:
- *	ISC_R_SUCCESS			on success
- *	ISC_R_NOSPACE			target buffer is too small
+ *\li	ISC_R_SUCCESS			on success
+ *\li	ISC_R_NOSPACE			target buffer is too small
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/soa.h b/contrib/bind9/lib/dns/include/dns/soa.h
index 304ae15..70c6725 100644
--- a/contrib/bind9/lib/dns/include/dns/soa.h
+++ b/contrib/bind9/lib/dns/include/dns/soa.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: soa.h,v 1.2.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: soa.h,v 1.3.18.2 2005/04/29 00:16:22 marka Exp $ */
 
 #ifndef DNS_SOA_H
 #define DNS_SOA_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * SOA utilities.
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/ssu.h b/contrib/bind9/lib/dns/include/dns/ssu.h
index f26a039..b709030 100644
--- a/contrib/bind9/lib/dns/include/dns/ssu.h
+++ b/contrib/bind9/lib/dns/include/dns/ssu.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ssu.h,v 1.11.206.3 2004/03/08 09:04:39 marka Exp $ */
+/* $Id: ssu.h,v 1.13.18.4 2006/02/16 23:51:32 marka Exp $ */
 
 #ifndef DNS_SSU_H
 #define DNS_SSU_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -30,46 +32,50 @@ ISC_LANG_BEGINDECLS
 #define DNS_SSUMATCHTYPE_SUBDOMAIN 1
 #define DNS_SSUMATCHTYPE_WILDCARD 2
 #define DNS_SSUMATCHTYPE_SELF 3
+#define DNS_SSUMATCHTYPE_SELFSUB 4
+#define DNS_SSUMATCHTYPE_SELFWILD 5
+#define DNS_SSUMATCHTYPE_MAX 5		/* maximum defined value */
+
 
 isc_result_t
 dns_ssutable_create(isc_mem_t *mctx, dns_ssutable_t **table);
-/*
+/*%<
  *	Creates a table that will be used to store simple-secure-update rules.
  *	Note: all locking must be provided by the client.
  *
  *	Requires:
- *		'mctx' is a valid memory context
- *		'table' is not NULL, and '*table' is NULL
+ *\li		'mctx' is a valid memory context
+ *\li		'table' is not NULL, and '*table' is NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
+ *\li		ISC_R_SUCCESS
+ *\li		ISC_R_NOMEMORY
  */
 
 void
 dns_ssutable_attach(dns_ssutable_t *source, dns_ssutable_t **targetp);
-/*
+/*%<
  *	Attach '*targetp' to 'source'.
  *
  *	Requires:
- *		'source' is a valid SSU table
- *		'targetp' points to a NULL dns_ssutable_t *.
+ *\li		'source' is a valid SSU table
+ *\li		'targetp' points to a NULL dns_ssutable_t *.
  *
  *	Ensures:
- *		*targetp is attached to source.
+ *\li		*targetp is attached to source.
  */
 
 void
 dns_ssutable_detach(dns_ssutable_t **tablep);
-/*
+/*%<
  *	Detach '*tablep' from its simple-secure-update rule table.
  *
  *	Requires:
- *		'tablep' points to a valid dns_ssutable_t
+ *\li		'tablep' points to a valid dns_ssutable_t
  *
  *	Ensures:
- *		*tablep is NULL
- *		If '*tablep' is the last reference to the SSU table, all
+ *\li		*tablep is NULL
+ *\li		If '*tablep' is the last reference to the SSU table, all
  *			resources used by the table will be freed.
  */
 
@@ -78,78 +84,80 @@ dns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,
 		     dns_name_t *identity, unsigned int matchtype,
 		     dns_name_t *name, unsigned int ntypes,
 		     dns_rdatatype_t *types);
-/*
+/*%<
  *	Adds a new rule to a simple-secure-update rule table.  The rule
  *	either grants or denies update privileges of an identity (or set of
  *	identities) to modify a name (or set of names) or certain types present
  *	at that name.
  *
  *	Notes:
- *		If 'matchtype' is SELF, this rule only matches if the name
+ *\li		If 'matchtype' is SELF, this rule only matches if the name
  *		to be updated matches the signing identity.
  *
- *		If 'ntypes' is 0, this rule applies to all types except
+ *\li		If 'ntypes' is 0, this rule applies to all types except
  *		NS, SOA, RRSIG, and NSEC.
  *
- *		If 'types' includes ANY, this rule applies to all types
+ *\li		If 'types' includes ANY, this rule applies to all types
  *		except NSEC.
  *
  *	Requires:
- *		'table' is a valid SSU table
- *		'identity' is a valid absolute name
- *		'matchtype' must be one of the defined constants.
- *		'name' is a valid absolute name
- *		If 'ntypes' > 0, 'types' must not be NULL
+ *\li		'table' is a valid SSU table
+ *\li		'identity' is a valid absolute name
+ *\li		'matchtype' must be one of the defined constants.
+ *\li		'name' is a valid absolute name
+ *\li		If 'ntypes' > 0, 'types' must not be NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
+ *\li		ISC_R_SUCCESS
+ *\li		ISC_R_NOMEMORY
  */
 
 isc_boolean_t
 dns_ssutable_checkrules(dns_ssutable_t *table, dns_name_t *signer,
 			dns_name_t *name, dns_rdatatype_t type);
-/*
+/*%<
  *	Checks that the attempted update of (name, type) is allowed according
  *	to the rules specified in the simple-secure-update rule table.  If
  *	no rules are matched, access is denied.  If signer is NULL, access
  *	is denied.
  *
  *	Requires:
- *		'table' is a valid SSU table
- *		'signer' is NULL or a valid absolute name
- *		'name' is a valid absolute name
+ *\li		'table' is a valid SSU table
+ *\li		'signer' is NULL or a valid absolute name
+ *\li		'name' is a valid absolute name
  */
 
 
+/*% Accessor functions to extract rule components */
 isc_boolean_t	dns_ssurule_isgrant(const dns_ssurule_t *rule);
+/*% Accessor functions to extract rule components */
 dns_name_t *	dns_ssurule_identity(const dns_ssurule_t *rule);
+/*% Accessor functions to extract rule components */
 unsigned int	dns_ssurule_matchtype(const dns_ssurule_t *rule);
+/*% Accessor functions to extract rule components */
 dns_name_t *	dns_ssurule_name(const dns_ssurule_t *rule);
+/*% Accessor functions to extract rule components */
 unsigned int	dns_ssurule_types(const dns_ssurule_t *rule,
 				  dns_rdatatype_t **types);
-/*
- * Accessor functions to extract rule components
- */
 
 isc_result_t	dns_ssutable_firstrule(const dns_ssutable_t *table,
 				       dns_ssurule_t **rule);
-/*
+/*%<
  * Initiates a rule iterator.  There is no need to maintain any state.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE
  */
 
 isc_result_t	dns_ssutable_nextrule(dns_ssurule_t *rule,
 				      dns_ssurule_t **nextrule);
-/*
+/*%<
  * Returns the next rule in the table.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/stats.h b/contrib/bind9/lib/dns/include/dns/stats.h
index db94b52..6cd95ac 100644
--- a/contrib/bind9/lib/dns/include/dns/stats.h
+++ b/contrib/bind9/lib/dns/include/dns/stats.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,39 +15,43 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stats.h,v 1.4.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: stats.h,v 1.5.18.4 2005/06/27 00:20:03 marka Exp $ */
 
 #ifndef DNS_STATS_H
 #define DNS_STATS_H 1
 
+/*! \file */
+
 #include <dns/types.h>
 
-/*
+/*%
  * Query statistics counter types.
  */
 typedef enum {
-	dns_statscounter_success = 0,    /* Successful lookup */
-	dns_statscounter_referral = 1,   /* Referral result */
-	dns_statscounter_nxrrset = 2,    /* NXRRSET result */
-	dns_statscounter_nxdomain = 3,   /* NXDOMAIN result */
-	dns_statscounter_recursion = 4,  /* Recursion was used */
-	dns_statscounter_failure = 5     /* Some other failure */
+	dns_statscounter_success = 0,    /*%< Successful lookup */
+	dns_statscounter_referral = 1,   /*%< Referral result */
+	dns_statscounter_nxrrset = 2,    /*%< NXRRSET result */
+	dns_statscounter_nxdomain = 3,   /*%< NXDOMAIN result */
+	dns_statscounter_recursion = 4,  /*%< Recursion was used */
+	dns_statscounter_failure = 5,    /*%< Some other failure */
+	dns_statscounter_duplicate = 6,  /*%< Duplicate query */
+	dns_statscounter_dropped = 7     /*%< Duplicate query */
 } dns_statscounter_t;
 
-#define DNS_STATS_NCOUNTERS 6
+#define DNS_STATS_NCOUNTERS 8
 
 LIBDNS_EXTERNAL_DATA extern const char *dns_statscounter_names[];
 
 isc_result_t
 dns_stats_alloccounters(isc_mem_t *mctx, isc_uint64_t **ctrp);
-/*
+/*%<
  * Allocate an array of query statistics counters from the memory
  * context 'mctx'.
  */
 
 void
 dns_stats_freecounters(isc_mem_t *mctx, isc_uint64_t **ctrp);
-/*
+/*%<
  * Free an array of query statistics counters allocated from the memory
  * context 'mctx'.
  */
diff --git a/contrib/bind9/lib/dns/include/dns/tcpmsg.h b/contrib/bind9/lib/dns/include/dns/tcpmsg.h
index ae1d704..075f463 100644
--- a/contrib/bind9/lib/dns/include/dns/tcpmsg.h
+++ b/contrib/bind9/lib/dns/include/dns/tcpmsg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tcpmsg.h,v 1.15.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: tcpmsg.h,v 1.16.18.2 2005/04/29 00:16:22 marka Exp $ */
 
 #ifndef DNS_TCPMSG_H
 #define DNS_TCPMSG_H 1
 
+/*! \file */
+
 #include <isc/buffer.h>
 #include <isc/lang.h>
 #include <isc/socket.h>
@@ -45,56 +47,56 @@ ISC_LANG_BEGINDECLS
 
 void
 dns_tcpmsg_init(isc_mem_t *mctx, isc_socket_t *sock, dns_tcpmsg_t *tcpmsg);
-/*
+/*%<
  * Associate a tcp message state with a given memory context and
  * TCP socket.
  *
  * Requires:
  *
- *	"mctx" and "sock" be non-NULL and valid types.
+ *\li	"mctx" and "sock" be non-NULL and valid types.
  *
- *	"sock" be a read/write TCP socket.
+ *\li	"sock" be a read/write TCP socket.
  *
- *	"tcpmsg" be non-NULL and an uninitialized or invalidated structure.
+ *\li	"tcpmsg" be non-NULL and an uninitialized or invalidated structure.
  *
  * Ensures:
  *
- *	"tcpmsg" is a valid structure.
+ *\li	"tcpmsg" is a valid structure.
  */
 
 void
 dns_tcpmsg_setmaxsize(dns_tcpmsg_t *tcpmsg, unsigned int maxsize);
-/*
+/*%<
  * Set the maximum packet size to "maxsize"
  *
  * Requires:
  *
- *	"tcpmsg" be valid.
+ *\li	"tcpmsg" be valid.
  *
- *	512 <= "maxsize" <= 65536
+ *\li	512 <= "maxsize" <= 65536
  */
 
 isc_result_t
 dns_tcpmsg_readmessage(dns_tcpmsg_t *tcpmsg,
 		       isc_task_t *task, isc_taskaction_t action, void *arg);
-/*
+/*%<
  * Schedule an event to be delivered when a DNS message is readable, or
  * when an error occurs on the socket.
  *
  * Requires:
  *
- *	"tcpmsg" be valid.
+ *\li	"tcpmsg" be valid.
  *
- *	"task", "taskaction", and "arg" be valid.
+ *\li	"task", "taskaction", and "arg" be valid.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- no error
- *	Anything that the isc_socket_recv() call can return.  XXXMLG
+ *\li	ISC_R_SUCCESS		-- no error
+ *\li	Anything that the isc_socket_recv() call can return.  XXXMLG
  *
  * Notes:
  *
- *	The event delivered is a fully generic event.  It will contain no
+ *\li	The event delivered is a fully generic event.  It will contain no
  *	actual data.  The sender will be a pointer to the dns_tcpmsg_t.
  *	The result code inside that structure should be checked to see
  *	what the final result was.
@@ -102,41 +104,41 @@ dns_tcpmsg_readmessage(dns_tcpmsg_t *tcpmsg,
 
 void
 dns_tcpmsg_cancelread(dns_tcpmsg_t *tcpmsg);
-/*
+/*%<
  * Cancel a readmessage() call.  The event will still be posted with a
  * CANCELED result code.
  *
  * Requires:
  *
- *	"tcpmsg" be valid.
+ *\li	"tcpmsg" be valid.
  */
 
 void
 dns_tcpmsg_keepbuffer(dns_tcpmsg_t *tcpmsg, isc_buffer_t *buffer);
-/*
+/*%<
  * If a dns buffer is to be kept between calls, this function marks the
  * internal state-machine buffer as invalid, and copies all the contents
  * of the state into "buffer".
  *
  * Requires:
  *
- *	"tcpmsg" be valid.
+ *\li	"tcpmsg" be valid.
  *
- *	"buffer" be non-NULL.
+ *\li	"buffer" be non-NULL.
  */
 
 void
 dns_tcpmsg_invalidate(dns_tcpmsg_t *tcpmsg);
-/*
+/*%<
  * Clean up all allocated state, and invalidate the structure.
  *
  * Requires:
  *
- *	"tcpmsg" be valid.
+ *\li	"tcpmsg" be valid.
  *
  * Ensures:
  *
- *	"tcpmsg" is invalidated and disassociated with all memory contexts,
+ *\li	"tcpmsg" is invalidated and disassociated with all memory contexts,
  *	sockets, etc.
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/time.h b/contrib/bind9/lib/dns/include/dns/time.h
index 0b82443..9e8f5cc 100644
--- a/contrib/bind9/lib/dns/include/dns/time.h
+++ b/contrib/bind9/lib/dns/include/dns/time.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.h,v 1.9.12.3 2004/03/08 09:04:39 marka Exp $ */
+/* $Id: time.h,v 1.11.18.2 2005/04/29 00:16:23 marka Exp $ */
 
 #ifndef DNS_TIME_H
 #define DNS_TIME_H 1
 
+/*! \file */
+
 /***
  ***	Imports
  ***/
@@ -35,7 +37,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_time64_fromtext(const char *source, isc_int64_t *target);
-/*
+/*%<
  * Convert a date and time in YYYYMMDDHHMMSS text format at 'source'
  * into to a 64-bit count of seconds since Jan 1 1970 0:00 GMT.
  * Store the count at 'target'.
@@ -43,7 +45,7 @@ dns_time64_fromtext(const char *source, isc_int64_t *target);
 
 isc_result_t
 dns_time32_fromtext(const char *source, isc_uint32_t *target);
-/*
+/*%<
  * Like dns_time64_fromtext, but returns the second count modulo 2^32
  * as per RFC2535.
  */
@@ -51,14 +53,14 @@ dns_time32_fromtext(const char *source, isc_uint32_t *target);
 
 isc_result_t
 dns_time64_totext(isc_int64_t value, isc_buffer_t *target);
-/*
+/*%<
  * Convert a 64-bit count of seconds since Jan 1 1970 0:00 GMT into
  * a YYYYMMDDHHMMSS text representation and append it to 'target'.
  */
 
 isc_result_t
 dns_time32_totext(isc_uint32_t value, isc_buffer_t *target);
-/*
+/*%<
  * Like dns_time64_totext, but for a 32-bit cyclic time value.
  * Of those dates whose counts of seconds since Jan 1 1970 0:00 GMT
  * are congruent with 'value' modulo 2^32, the one closest to the
diff --git a/contrib/bind9/lib/dns/include/dns/timer.h b/contrib/bind9/lib/dns/include/dns/timer.h
index 36e2ac3..cd936a0 100644
--- a/contrib/bind9/lib/dns/include/dns/timer.h
+++ b/contrib/bind9/lib/dns/include/dns/timer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.h,v 1.2.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: timer.h,v 1.3.18.2 2005/04/29 00:16:23 marka Exp $ */
 
 #ifndef DNS_TIMER_H
 #define DNS_TIMER_H 1
 
+/*! \file */
+
 /***
  ***	Imports
  ***/
@@ -36,10 +38,10 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 dns_timer_setidle(isc_timer_t *timer, unsigned int maxtime,
 		  unsigned int idletime, isc_boolean_t purge);
-/*
+/*%<
  * Convenience function for setting up simple, one-second-granularity
  * idle timers as used by zone transfers.
- *
+ * \brief
  * Set the timer 'timer' to go off after 'idletime' seconds of inactivity,
  * or after 'maxtime' at the very latest.  Events are purged iff
  * 'purge' is ISC_TRUE.
diff --git a/contrib/bind9/lib/dns/include/dns/tkey.h b/contrib/bind9/lib/dns/include/dns/tkey.h
index e5ca3b3..4e3e80a 100644
--- a/contrib/bind9/lib/dns/include/dns/tkey.h
+++ b/contrib/bind9/lib/dns/include/dns/tkey.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tkey.h,v 1.18.206.1 2004/03/06 08:14:00 marka Exp $ */
+/* $Id: tkey.h,v 1.19.18.2 2005/04/29 00:16:23 marka Exp $ */
 
 #ifndef DNS_TKEY_H
 #define DNS_TKEY_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -45,55 +47,55 @@ struct dns_tkeyctx {
 
 isc_result_t
 dns_tkeyctx_create(isc_mem_t *mctx, isc_entropy_t *ectx, dns_tkeyctx_t **tctxp);
-/*
+/*%<
  *	Create an empty TKEY context.
  *
  * 	Requires:
- *		'mctx' is not NULL
- *		'tctx' is not NULL
- *		'*tctx' is NULL
+ *\li		'mctx' is not NULL
+ *\li		'tctx' is not NULL
+ *\li		'*tctx' is NULL
  *
  *	Returns
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		return codes from dns_name_fromtext()
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		return codes from dns_name_fromtext()
  */
 
 void
 dns_tkeyctx_destroy(dns_tkeyctx_t **tctxp);
-/*
+/*%<
  *      Frees all data associated with the TKEY context
  *
  * 	Requires:
- *		'tctx' is not NULL
- *		'*tctx' is not NULL
+ *\li		'tctx' is not NULL
+ *\li		'*tctx' is not NULL
  */
 
 isc_result_t
 dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 		      dns_tsig_keyring_t *ring);
-/*
+/*%<
  *	Processes a query containing a TKEY record, adding or deleting TSIG
  *	keys if necessary, and modifies the message to contain the response.
  *
  *	Requires:
- *		'msg' is a valid message
- *		'tctx' is a valid TKEY context
- *		'ring' is a valid TSIG keyring
+ *\li		'msg' is a valid message
+ *\li		'tctx' is a valid TKEY context
+ *\li		'ring' is a valid TSIG keyring
  *
  *	Returns
- *		ISC_R_SUCCESS	msg was updated (the TKEY operation succeeded,
+ *\li		#ISC_R_SUCCESS	msg was updated (the TKEY operation succeeded,
  *				or msg now includes a TKEY with an error set)
  *		DNS_R_FORMERR	the packet was malformed (missing a TKEY
  *				or KEY).
- *		other		An error occurred while processing the message
+ *\li		other		An error occurred while processing the message
  */
 
 isc_result_t
 dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
 		      dns_name_t *algorithm, isc_buffer_t *nonce,
 		      isc_uint32_t lifetime);
-/*
+/*%<
  *	Builds a query containing a TKEY that will generate a shared
  *	secret using a Diffie-Hellman key exchange.  The shared key
  *	will be of the specified algorithm (only DNS_TSIG_HMACMD5_NAME
@@ -105,61 +107,61 @@ dns_tkey_builddhquery(dns_message_t *msg, dst_key_t *key, dns_name_t *name,
  *
  *
  *	Requires:
- *		'msg' is a valid message
- *		'key' is a valid Diffie Hellman dst key
- *		'name' is a valid name
- *		'algorithm' is a valid name
+ *\li		'msg' is a valid message
+ *\li		'key' is a valid Diffie Hellman dst key
+ *\li		'name' is a valid name
+ *\li		'algorithm' is a valid name
  *
  *	Returns:
- *		ISC_R_SUCCESS	msg was successfully updated to include the
+ *\li		#ISC_R_SUCCESS	msg was successfully updated to include the
  *				query to be sent
- *		other		an error occurred while building the message
+ *\li		other		an error occurred while building the message
  */
 
 isc_result_t
 dns_tkey_buildgssquery(dns_message_t *msg, dns_name_t *name,
 		       dns_name_t *gname, void *cred,
 		       isc_uint32_t lifetime, void **context);
-/*
+/*%<
  * XXX
  */
 
 isc_result_t
 dns_tkey_builddeletequery(dns_message_t *msg, dns_tsigkey_t *key);
-/*
+/*%<
  *	Builds a query containing a TKEY record that will delete the
  *	specified shared secret from the server.
  *
  *	Requires:
- *		'msg' is a valid message
- *		'key' is a valid TSIG key
+ *\li		'msg' is a valid message
+ *\li		'key' is a valid TSIG key
  *
  *	Returns:
- *		ISC_R_SUCCESS	msg was successfully updated to include the
+ *\li		#ISC_R_SUCCESS	msg was successfully updated to include the
  *				query to be sent
- *		other		an error occurred while building the message
+ *\li		other		an error occurred while building the message
  */
 
 isc_result_t
 dns_tkey_processdhresponse(dns_message_t *qmsg, dns_message_t *rmsg,
                            dst_key_t *key, isc_buffer_t *nonce,
 			   dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring);
-/*
+/*%<
  *	Processes a response to a query containing a TKEY that was
  *	designed to generate a shared secret using a Diffie-Hellman key
  *	exchange.  If the query was successful, a new shared key
  *	is created and added to the list of shared keys.
  *
  *	Requires:
- *		'qmsg' is a valid message (the query)
- *		'rmsg' is a valid message (the response)
- *		'key' is a valid Diffie Hellman dst key
- *		'outkey' is either NULL or a pointer to NULL
- *		'ring' is a valid keyring or NULL
+ *\li		'qmsg' is a valid message (the query)
+ *\li		'rmsg' is a valid message (the response)
+ *\li		'key' is a valid Diffie Hellman dst key
+ *\li		'outkey' is either NULL or a pointer to NULL
+ *\li		'ring' is a valid keyring or NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS	the shared key was successfully added
- *		ISC_R_NOTFOUND	an error occurred while looking for a
+ *\li		#ISC_R_SUCCESS	the shared key was successfully added
+ *\li		#ISC_R_NOTFOUND	an error occurred while looking for a
  *				component of the query or response
  */
 
@@ -167,26 +169,26 @@ isc_result_t
 dns_tkey_processgssresponse(dns_message_t *qmsg, dns_message_t *rmsg,
 			    dns_name_t *gname, void *cred, void **context,
 			    dns_tsigkey_t **outkey, dns_tsig_keyring_t *ring);
-/*
+/*%<
  * XXX
  */
 
 isc_result_t
 dns_tkey_processdeleteresponse(dns_message_t *qmsg, dns_message_t *rmsg,
 			       dns_tsig_keyring_t *ring);
-/*
+/*%<
  *	Processes a response to a query containing a TKEY that was
  *	designed to delete a shared secret.  If the query was successful,
  *	the shared key is deleted from the list of shared keys.
  *
  *	Requires:
- *		'qmsg' is a valid message (the query)
- *		'rmsg' is a valid message (the response)
- *		'ring' is not NULL
+ *\li		'qmsg' is a valid message (the query)
+ *\li		'rmsg' is a valid message (the response)
+ *\li		'ring' is not NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS	the shared key was successfully deleted
- *		ISC_R_NOTFOUND	an error occurred while looking for a
+ *\li		#ISC_R_SUCCESS	the shared key was successfully deleted
+ *\li		#ISC_R_NOTFOUND	an error occurred while looking for a
  *				component of the query or response
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/tsig.h b/contrib/bind9/lib/dns/include/dns/tsig.h
index 7b5b458..b3fd6cc 100644
--- a/contrib/bind9/lib/dns/include/dns/tsig.h
+++ b/contrib/bind9/lib/dns/include/dns/tsig.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tsig.h,v 1.40.2.2.8.3 2004/03/08 09:04:39 marka Exp $ */
+/* $Id: tsig.h,v 1.43.18.4 2006/01/27 23:57:44 marka Exp $ */
 
 #ifndef DNS_TSIG_H
 #define DNS_TSIG_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/refcount.h>
 #include <isc/rwlock.h>
@@ -39,8 +41,18 @@ LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_tsig_gssapi_name;
 #define DNS_TSIG_GSSAPI_NAME		dns_tsig_gssapi_name
 LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_tsig_gssapims_name;
 #define DNS_TSIG_GSSAPIMS_NAME		dns_tsig_gssapims_name
-
-/*
+LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_tsig_hmacsha1_name;
+#define DNS_TSIG_HMACSHA1_NAME		dns_tsig_hmacsha1_name
+LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_tsig_hmacsha224_name;
+#define DNS_TSIG_HMACSHA224_NAME	dns_tsig_hmacsha224_name
+LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_tsig_hmacsha256_name;
+#define DNS_TSIG_HMACSHA256_NAME	dns_tsig_hmacsha256_name
+LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_tsig_hmacsha384_name;
+#define DNS_TSIG_HMACSHA384_NAME	dns_tsig_hmacsha384_name
+LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_tsig_hmacsha512_name;
+#define DNS_TSIG_HMACSHA512_NAME	dns_tsig_hmacsha512_name
+
+/*%
  * Default fudge value.
  */
 #define DNS_TSIG_FUDGE			300
@@ -53,17 +65,17 @@ struct dns_tsig_keyring {
 
 struct dns_tsigkey {
 	/* Unlocked */
-	unsigned int		magic;		/* Magic number. */
+	unsigned int		magic;		/*%< Magic number. */
 	isc_mem_t		*mctx;
-	dst_key_t		*key;		/* Key */
-	dns_name_t		name;		/* Key name */
-	dns_name_t		*algorithm;	/* Algorithm name */
-	dns_name_t		*creator;	/* name that created secret */
-	isc_boolean_t		generated;	/* was this generated? */
-	isc_stdtime_t		inception;	/* start of validity period */
-	isc_stdtime_t		expire;		/* end of validity period */
-	dns_tsig_keyring_t	*ring;		/* the enclosing keyring */
-	isc_refcount_t		refs;		/* reference counter */
+	dst_key_t		*key;		/*%< Key */
+	dns_name_t		name;		/*%< Key name */
+	dns_name_t		*algorithm;	/*%< Algorithm name */
+	dns_name_t		*creator;	/*%< name that created secret */
+	isc_boolean_t		generated;	/*%< was this generated? */
+	isc_stdtime_t		inception;	/*%< start of validity period */
+	isc_stdtime_t		expire;		/*%< end of validity period */
+	dns_tsig_keyring_t	*ring;		/*%< the enclosing keyring */
+	isc_refcount_t		refs;		/*%< reference counter */
 };
 
 #define dns_tsigkey_identity(tsigkey) \
@@ -84,7 +96,7 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
 			  dns_name_t *creator, isc_stdtime_t inception,
 			  isc_stdtime_t expire, isc_mem_t *mctx,
 			  dns_tsig_keyring_t *ring, dns_tsigkey_t **key);
-/*
+/*%<
  *	Creates a tsig key structure and saves it in the keyring.  If key is
  *	not NULL, *key will contain a copy of the key.  The keys validity
  *	period is specified by (inception, expire), and will not expire if
@@ -95,100 +107,100 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
  *	to generate a BADKEY response.
  *
  *	Requires:
- *		'name' is a valid dns_name_t
- *		'algorithm' is a valid dns_name_t
- *		'secret' is a valid pointer
- *		'length' is an integer >= 0
- *		'key' is a valid dst key or NULL
- *		'creator' points to a valid dns_name_t or is NULL
- *		'mctx' is a valid memory context
- *		'ring' is a valid TSIG keyring or NULL
- *		'key' or '*key' must be NULL
+ *\li		'name' is a valid dns_name_t
+ *\li		'algorithm' is a valid dns_name_t
+ *\li		'secret' is a valid pointer
+ *\li		'length' is an integer >= 0
+ *\li		'key' is a valid dst key or NULL
+ *\li		'creator' points to a valid dns_name_t or is NULL
+ *\li		'mctx' is a valid memory context
+ *\li		'ring' is a valid TSIG keyring or NULL
+ *\li		'key' or '*key' must be NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_EXISTS - a key with this name already exists
- *		ISC_R_NOTIMPLEMENTED - algorithm is not implemented
- *		ISC_R_NOMEMORY
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_EXISTS - a key with this name already exists
+ *\li		#ISC_R_NOTIMPLEMENTED - algorithm is not implemented
+ *\li		#ISC_R_NOMEMORY
  */
 
 void
 dns_tsigkey_attach(dns_tsigkey_t *source, dns_tsigkey_t **targetp);
-/*
+/*%<
  *	Attach '*targetp' to 'source'.
  *
  *	Requires:
- *		'key' is a valid TSIG key
+ *\li		'key' is a valid TSIG key
  *
  *	Ensures:
- *		*targetp is attached to source.
+ *\li		*targetp is attached to source.
  */
 
 void
 dns_tsigkey_detach(dns_tsigkey_t **keyp);
-/*
+/*%<
  *	Detaches from the tsig key structure pointed to by '*key'.
  *
  *	Requires:
- *		'keyp' is not NULL and '*keyp' is a valid TSIG key
+ *\li		'keyp' is not NULL and '*keyp' is a valid TSIG key
  *
  *	Ensures:
- *		'keyp' points to NULL
+ *\li		'keyp' points to NULL
  */
 
 void
 dns_tsigkey_setdeleted(dns_tsigkey_t *key);
-/*
+/*%<
  *	Prevents this key from being used again.  It will be deleted when
  *	no references exist.
  *
  *	Requires:
- *		'key' is a valid TSIG key on a keyring
+ *\li		'key' is a valid TSIG key on a keyring
  */
 
 isc_result_t
 dns_tsig_sign(dns_message_t *msg);
-/*
+/*%<
  *	Generates a TSIG record for this message
  *
  *	Requires:
- *		'msg' is a valid message
- *		'msg->tsigkey' is a valid TSIG key
- *		'msg->tsig' is NULL
+ *\li		'msg' is a valid message
+ *\li		'msg->tsigkey' is a valid TSIG key
+ *\li		'msg->tsig' is NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		ISC_R_NOSPACE
- *		DNS_R_EXPECTEDTSIG
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		#ISC_R_NOSPACE
+ *\li		#DNS_R_EXPECTEDTSIG
  *			- this is a response & msg->querytsig is NULL
  */
 
 isc_result_t
 dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		dns_tsig_keyring_t *ring1, dns_tsig_keyring_t *ring2);
-/*
+/*%<
  *	Verifies the TSIG record in this message
  *
  *	Requires:
- *		'source' is a valid buffer containing the unparsed message
- *		'msg' is a valid message
- *		'msg->tsigkey' is a valid TSIG key if this is a response
- *		'msg->tsig' is NULL
- *		'msg->querytsig' is not NULL if this is a response
- *		'ring1' and 'ring2' are each either a valid keyring or NULL
+ *\li		'source' is a valid buffer containing the unparsed message
+ *\li		'msg' is a valid message
+ *\li		'msg->tsigkey' is a valid TSIG key if this is a response
+ *\li		'msg->tsig' is NULL
+ *\li		'msg->querytsig' is not NULL if this is a response
+ *\li		'ring1' and 'ring2' are each either a valid keyring or NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
- *		DNS_R_EXPECTEDTSIG - A TSIG was expected but not seen
- *		DNS_R_UNEXPECTEDTSIG - A TSIG was seen but not expected
- *		DNS_R_TSIGERRORSET - the TSIG verified but ->error was set
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
+ *\li		#DNS_R_EXPECTEDTSIG - A TSIG was expected but not seen
+ *\li		#DNS_R_UNEXPECTEDTSIG - A TSIG was seen but not expected
+ *\li		#DNS_R_TSIGERRORSET - the TSIG verified but ->error was set
  *				     and this is a query
- *		DNS_R_CLOCKSKEW - the TSIG failed to verify because of
+ *\li		#DNS_R_CLOCKSKEW - the TSIG failed to verify because of
  *				  the time was out of the allowed range.
- *		DNS_R_TSIGVERIFYFAILURE - the TSIG failed to verify
- *		DNS_R_EXPECTEDRESPONSE - the message was set over TCP and
+ *\li		#DNS_R_TSIGVERIFYFAILURE - the TSIG failed to verify
+ *\li		#DNS_R_EXPECTEDRESPONSE - the message was set over TCP and
  *					 should have been a response,
  *					 but was not.
  */
@@ -196,45 +208,45 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 isc_result_t
 dns_tsigkey_find(dns_tsigkey_t **tsigkey, dns_name_t *name,
 		 dns_name_t *algorithm, dns_tsig_keyring_t *ring);
-/*
+/*%<
  *	Returns the TSIG key corresponding to this name and (possibly)
  *	algorithm.  Also increments the key's reference counter.
  *
  *	Requires:
- *		'tsigkey' is not NULL
- *		'*tsigkey' is NULL
- *		'name' is a valid dns_name_t
- *		'algorithm' is a valid dns_name_t or NULL
- *		'ring' is a valid keyring
+ *\li		'tsigkey' is not NULL
+ *\li		'*tsigkey' is NULL
+ *\li		'name' is a valid dns_name_t
+ *\li		'algorithm' is a valid dns_name_t or NULL
+ *\li		'ring' is a valid keyring
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOTFOUND
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOTFOUND
  */
 
 
 isc_result_t
 dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp);
-/*
+/*%<
  *	Create an empty TSIG key ring.
  *
  *	Requires:
- *		'mctx' is not NULL
- *		'ringp' is not NULL, and '*ringp' is NULL
+ *\li		'mctx' is not NULL
+ *\li		'ringp' is not NULL, and '*ringp' is NULL
  *
  *	Returns:
- *		ISC_R_SUCCESS
- *		ISC_R_NOMEMORY
+ *\li		#ISC_R_SUCCESS
+ *\li		#ISC_R_NOMEMORY
  */
 
 
 void
 dns_tsigkeyring_destroy(dns_tsig_keyring_t **ringp);
-/*
+/*%<
  *	Destroy a TSIG key ring.
  *
  *	Requires:
- *		'ringp' is not NULL
+ *\li		'ringp' is not NULL
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/ttl.h b/contrib/bind9/lib/dns/include/dns/ttl.h
index dc7167d..ad01578 100644
--- a/contrib/bind9/lib/dns/include/dns/ttl.h
+++ b/contrib/bind9/lib/dns/include/dns/ttl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ttl.h,v 1.12.206.1 2004/03/06 08:14:01 marka Exp $ */
+/* $Id: ttl.h,v 1.13.18.2 2005/04/29 00:16:24 marka Exp $ */
 
 #ifndef DNS_TTL_H
 #define DNS_TTL_H 1
 
+/*! \file */
+
 /***
  ***	Imports
  ***/
@@ -36,7 +38,7 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 dns_ttl_totext(isc_uint32_t src, isc_boolean_t verbose,
 	       isc_buffer_t *target);
-/*
+/*%<
  * Output a TTL or other time interval in a human-readable form.
  * The time interval is given as a count of seconds in 'src'.
  * The text representation is appended to 'target'.
@@ -47,28 +49,28 @@ dns_ttl_totext(isc_uint32_t src, isc_boolean_t verbose,
  * in "dig", like "1 week 2 days 3 hours 4 minutes 5 seconds".
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	ISC_R_NOSPACE
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOSPACE
  */
 
 isc_result_t
 dns_counter_fromtext(isc_textregion_t *source, isc_uint32_t *ttl);
-/*
+/*%<
  * Converts a counter from either a plain number or a BIND 8 style value.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	DNS_R_SYNTAX
+ *\li	ISC_R_SUCCESS
+ *\li	DNS_R_SYNTAX
  */
 
 isc_result_t
 dns_ttl_fromtext(isc_textregion_t *source, isc_uint32_t *ttl);
-/*
+/*%<
  * Converts a ttl from either a plain number or a BIND 8 style value.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	DNS_R_BADTTL
+ *\li	ISC_R_SUCCESS
+ *\li	DNS_R_BADTTL
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dns/types.h b/contrib/bind9/lib/dns/include/dns/types.h
index 27995de..8dcbe57 100644
--- a/contrib/bind9/lib/dns/include/dns/types.h
+++ b/contrib/bind9/lib/dns/include/dns/types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,21 +15,25 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: types.h,v 1.103.12.9 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: types.h,v 1.109.18.12 2006/05/02 12:55:31 shane Exp $ */
 
 #ifndef DNS_TYPES_H
 #define DNS_TYPES_H 1
 
-/*
+/*! \file
+ * \brief
  * Including this file gives you type declarations suitable for use in
  * .h files, which lets us avoid circular type reference problems.
- *
+ * \brief
  * To actually use a type or get declarations of its methods, you must
  * include the appropriate .h file too.
  */
 
 #include <isc/types.h>
 
+typedef struct dns_acache			dns_acache_t;
+typedef struct dns_acacheentry			dns_acacheentry_t;
+typedef struct dns_acachestats			dns_acachestats_t;
 typedef struct dns_acl 				dns_acl_t;
 typedef struct dns_aclelement 			dns_aclelement_t;
 typedef struct dns_aclenv			dns_aclenv_t;
@@ -50,6 +54,9 @@ typedef void					dns_dbload_t;
 typedef void					dns_dbnode_t;
 typedef struct dns_dbtable			dns_dbtable_t;
 typedef void					dns_dbversion_t;
+typedef struct dns_dlzimplementation		dns_dlzimplementation_t;
+typedef struct dns_dlzdb			dns_dlzdb_t;
+typedef struct dns_sdlzimplementation		dns_sdlzimplementation_t;
 typedef struct dns_decompress			dns_decompress_t;
 typedef struct dns_dispatch			dns_dispatch_t;
 typedef struct dns_dispatchevent		dns_dispatchevent_t;
@@ -136,7 +143,8 @@ typedef enum {
 typedef enum {
 	dns_notifytype_no = 0,
 	dns_notifytype_yes = 1,
-	dns_notifytype_explicit = 2
+	dns_notifytype_explicit = 2,
+	dns_notifytype_masteronly = 3
 } dns_notifytype_t;
 
 typedef enum {
@@ -148,13 +156,19 @@ typedef enum {
 	dns_dialuptype_passive = 5
 } dns_dialuptype_t;
 
+typedef enum {
+	dns_masterformat_none = 0,
+	dns_masterformat_text = 1,
+	dns_masterformat_raw = 2
+} dns_masterformat_t;
+
 /*
  * These are generated by gen.c.
  */
 #include <dns/enumtype.h>	/* Provides dns_rdatatype_t. */
 #include <dns/enumclass.h>	/* Provides dns_rdataclass_t. */
 
-/*
+/*%
  * rcodes.
  */
 enum {
@@ -190,7 +204,7 @@ enum {
 #define dns_rcode_badvers		((dns_rcode_t)dns_rcode_badvers)
 };
 
-/*
+/*%
  * TSIG errors.
  */
 enum {
@@ -199,10 +213,11 @@ enum {
 	dns_tsigerror_badtime = 18,
 	dns_tsigerror_badmode = 19,
 	dns_tsigerror_badname = 20,
-	dns_tsigerror_badalg = 21
+	dns_tsigerror_badalg = 21,
+	dns_tsigerror_badtrunc = 22
 };
 
-/*
+/*%
  * Opcodes.
  */
 enum {
@@ -218,7 +233,7 @@ enum {
 #define dns_opcode_update		((dns_opcode_t)dns_opcode_update)
 };
 
-/*
+/*%
  * Trust levels.  Must be kept in sync with trustnames[] in masterdump.c.
  */
 enum {
@@ -226,11 +241,11 @@ enum {
 	dns_trust_none = 0,
 #define dns_trust_none			((dns_trust_t)dns_trust_none)
 
-	/* Subject to DNSSEC validation but has not yet been validated */
+	/*% Subject to DNSSEC validation but has not yet been validated */
 	dns_trust_pending = 1,
 #define dns_trust_pending		((dns_trust_t)dns_trust_pending)
 
-	/* Received in the additional section of a response. */
+	/*% Received in the additional section of a response. */
 	dns_trust_additional = 2,
 #define dns_trust_additional		((dns_trust_t)dns_trust_additional)
 
@@ -260,7 +275,7 @@ enum {
 #define dns_trust_ultimate		((dns_trust_t)dns_trust_ultimate)
 };
 
-/*
+/*%
  * Name checking severites.
  */
 typedef enum {
@@ -294,6 +309,20 @@ typedef void
 (*dns_updatecallback_t)(void *, isc_result_t, dns_message_t *);
 
 typedef int 
-(*dns_rdatasetorderfunc_t)(const dns_rdata_t *rdata, const void *arg);
+(*dns_rdatasetorderfunc_t)(const dns_rdata_t *, const void *);
+
+typedef isc_boolean_t
+(*dns_checkmxfunc_t)(dns_zone_t *, dns_name_t *, dns_name_t *);
+
+typedef isc_boolean_t
+(*dns_checksrvfunc_t)(dns_zone_t *, dns_name_t *, dns_name_t *);
+
+typedef isc_boolean_t
+(*dns_checknsfunc_t)(dns_zone_t *, dns_name_t *, dns_name_t *,
+		     dns_rdataset_t *, dns_rdataset_t *);
+
+typedef isc_boolean_t
+(*dns_isselffunc_t)(dns_view_t *, dns_tsigkey_t *, isc_sockaddr_t *,
+		    isc_sockaddr_t *, dns_rdataclass_t, void *);
 
 #endif /* DNS_TYPES_H */
diff --git a/contrib/bind9/lib/dns/include/dns/validator.h b/contrib/bind9/lib/dns/include/dns/validator.h
index a0d6acb..acce76e 100644
--- a/contrib/bind9/lib/dns/include/dns/validator.h
+++ b/contrib/bind9/lib/dns/include/dns/validator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.h,v 1.18.12.11.6.1 2007/01/11 04:51:39 marka Exp $ */
+/* $Id: validator.h,v 1.27.18.8 2007/01/08 02:42:00 marka Exp $ */
 
 #ifndef DNS_VALIDATOR_H
 #define DNS_VALIDATOR_H 1
diff --git a/contrib/bind9/lib/dns/include/dns/version.h b/contrib/bind9/lib/dns/include/dns/version.h
index 28c83be..bb254534 100644
--- a/contrib/bind9/lib/dns/include/dns/version.h
+++ b/contrib/bind9/lib/dns/include/dns/version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.h,v 1.2.224.3 2004/03/08 09:04:40 marka Exp $ */
+/* $Id: version.h,v 1.3.18.2 2005/04/29 00:16:25 marka Exp $ */
+
+/*! \file */
 
 #include <isc/platform.h>
 
diff --git a/contrib/bind9/lib/dns/include/dns/view.h b/contrib/bind9/lib/dns/include/dns/view.h
index a3cd935..ea3d4c7 100644
--- a/contrib/bind9/lib/dns/include/dns/view.h
+++ b/contrib/bind9/lib/dns/include/dns/view.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.h,v 1.73.2.4.2.12 2004/03/10 02:55:58 marka Exp $ */
+/* $Id: view.h,v 1.91.18.9 2006/03/09 23:38:21 marka Exp $ */
 
 #ifndef DNS_VIEW_H
 #define DNS_VIEW_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * DNS View
  *
  * A "view" is a DNS namespace, together with an optional resolver and a
@@ -41,22 +42,22 @@
  * to be accessed without locking.
  *
  * MP:
- *	Before the view is frozen, the caller must ensure synchronization.
+ *\li	Before the view is frozen, the caller must ensure synchronization.
  *
- *	After the view is frozen, the module guarantees appropriate
+ *\li	After the view is frozen, the module guarantees appropriate
  *	synchronization of any data structures it creates and manipulates.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	None.
+ *\li	None.
  */
 
 #include <stdio.h>
@@ -83,9 +84,11 @@ struct dns_view {
 	dns_rdataclass_t		rdclass;
 	char *				name;
 	dns_zt_t *			zonetable;
+	dns_dlzdb_t *			dlzdatabase;
 	dns_resolver_t *		resolver;
 	dns_adb_t *			adb;
 	dns_requestmgr_t *		requestmgr;
+	dns_acache_t *			acache;
 	dns_cache_t *			cache;
 	dns_db_t *			cachedb;
 	dns_db_t *			hints;
@@ -109,6 +112,8 @@ struct dns_view {
 	isc_boolean_t			additionalfromauth;
 	isc_boolean_t			minimalresponses;
 	isc_boolean_t			enablednssec;
+	isc_boolean_t			enablevalidation;
+	isc_boolean_t			acceptexpired;
 	dns_transfer_format_t		transfer_format;
 	dns_acl_t *			queryacl;
 	dns_acl_t *			recursionacl;
@@ -127,6 +132,7 @@ struct dns_view {
 	isc_boolean_t			checknames;
 	dns_name_t *			dlv;
 	dns_fixedname_t			dlv_fixed;
+	isc_uint16_t			maxudp;
 
 	/*
 	 * Configurable data for server use only,
@@ -156,109 +162,109 @@ struct dns_view {
 isc_result_t
 dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 		const char *name, dns_view_t **viewp);
-/*
+/*%<
  * Create a view.
  *
  * Notes:
  *
- *	The newly created view has no cache, no resolver, and an empty
+ *\li	The newly created view has no cache, no resolver, and an empty
  *	zone table.  The view is not frozen.
  *
  * Requires:
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
- *	'rdclass' is a valid class.
+ *\li	'rdclass' is a valid class.
  *
- *	'name' is a valid C string.
+ *\li	'name' is a valid C string.
  *
- *	viewp != NULL && *viewp == NULL
+ *\li	viewp != NULL && *viewp == NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  *
- *	Other errors are possible.
+ *\li	Other errors are possible.
  */
 
 void
 dns_view_attach(dns_view_t *source, dns_view_t **targetp);
-/*
+/*%<
  * Attach '*targetp' to 'source'.
  *
  * Requires:
  *
- *	'source' is a valid, frozen view.
+ *\li	'source' is a valid, frozen view.
  *
- *	'targetp' points to a NULL dns_view_t *.
+ *\li	'targetp' points to a NULL dns_view_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to source.
+ *\li	*targetp is attached to source.
  *
- *	While *targetp is attached, the view will not shut down.
+ *\li	While *targetp is attached, the view will not shut down.
  */
 
 void
 dns_view_detach(dns_view_t **viewp);
-/*
+/*%<
  * Detach '*viewp' from its view.
  *
  * Requires:
  *
- *	'viewp' points to a valid dns_view_t *
+ *\li	'viewp' points to a valid dns_view_t *
  *
  * Ensures:
  *
- *	*viewp is NULL.
+ *\li	*viewp is NULL.
  */
 
 void
 dns_view_flushanddetach(dns_view_t **viewp);
-/*
+/*%<
  * Detach '*viewp' from its view.  If this was the last reference
  * uncommited changed in zones will be flushed to disk.
  *
  * Requires:
  *
- *	'viewp' points to a valid dns_view_t *
+ *\li	'viewp' points to a valid dns_view_t *
  *
  * Ensures:
  *
- *	*viewp is NULL.
+ *\li	*viewp is NULL.
  */
 
 void
 dns_view_weakattach(dns_view_t *source, dns_view_t **targetp);
-/*
+/*%<
  * Weakly attach '*targetp' to 'source'.
  *
  * Requires:
  *
- *	'source' is a valid, frozen view.
+ *\li	'source' is a valid, frozen view.
  *
- *	'targetp' points to a NULL dns_view_t *.
+ *\li	'targetp' points to a NULL dns_view_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to source.
+ *\li	*targetp is attached to source.
  *
- * 	While *targetp is attached, the view will not be freed.
+ * \li	While *targetp is attached, the view will not be freed.
  */
 
 void
 dns_view_weakdetach(dns_view_t **targetp);
-/*
+/*%<
  * Detach '*viewp' from its view.
  *
  * Requires:
  *
- *	'viewp' points to a valid dns_view_t *.
+ *\li	'viewp' points to a valid dns_view_t *.
  *
  * Ensures:
  *
- *	*viewp is NULL.
+ *\li	*viewp is NULL.
  */
 
 isc_result_t
@@ -270,94 +276,94 @@ dns_view_createresolver(dns_view_t *view,
 			dns_dispatchmgr_t *dispatchmgr,
 			dns_dispatch_t *dispatchv4,
 			dns_dispatch_t *dispatchv6);
-/*
+/*%<
  * Create a resolver and address database for the view.
  *
  * Requires:
  *
- *	'view' is a valid, unfrozen view.
+ *\li	'view' is a valid, unfrozen view.
  *
- *	'view' does not have a resolver already.
+ *\li	'view' does not have a resolver already.
  *
- *	The requirements of dns_resolver_create() apply to 'taskmgr',
+ *\li	The requirements of dns_resolver_create() apply to 'taskmgr',
  *	'ntasks', 'socketmgr', 'timermgr', 'options', 'dispatchv4', and
  *	'dispatchv6'.
  *
  * Returns:
  *
- *     	ISC_R_SUCCESS
+ *\li   	#ISC_R_SUCCESS
  *
- *	Any error that dns_resolver_create() can return.
+ *\li	Any error that dns_resolver_create() can return.
  */
 
 void
 dns_view_setcache(dns_view_t *view, dns_cache_t *cache);
-/*
+/*%<
  * Set the view's cache database.
  *
  * Requires:
  *
- *	'view' is a valid, unfrozen view.
+ *\li	'view' is a valid, unfrozen view.
  *
- *	'cache' is a valid cache.
+ *\li	'cache' is a valid cache.
  *
  * Ensures:
  *
- *     	The cache of 'view' is 'cached.
+ * \li    	The cache of 'view' is 'cached.
  *
- *	If this is not the first call to dns_view_setcache() for this
+ *\li	If this is not the first call to dns_view_setcache() for this
  *	view, then previously set cache is detached.
  */
 
 void
 dns_view_sethints(dns_view_t *view, dns_db_t *hints);
-/*
+/*%<
  * Set the view's hints database.
  *
  * Requires:
  *
- *	'view' is a valid, unfrozen view, whose hints database has not been
+ *\li	'view' is a valid, unfrozen view, whose hints database has not been
  *	set.
  *
- *	'hints' is a valid zone database.
+ *\li	'hints' is a valid zone database.
  *
  * Ensures:
  *
- *     	The hints database of 'view' is 'hints'.
+ * \li    	The hints database of 'view' is 'hints'.
  */
 
 void
 dns_view_setkeyring(dns_view_t *view, dns_tsig_keyring_t *ring);
-/*
+/*%<
  * Set the view's static TSIG keys
  *
  * Requires:
  *
- *      'view' is a valid, unfrozen view, whose static TSIG keyring has not
+ *   \li   'view' is a valid, unfrozen view, whose static TSIG keyring has not
  *	been set.
  *
- *      'ring' is a valid TSIG keyring
+ *\li      'ring' is a valid TSIG keyring
  *
  * Ensures:
  *
- *      The static TSIG keyring of 'view' is 'ring'.
+ *\li      The static TSIG keyring of 'view' is 'ring'.
  */
 
 void
 dns_view_setdstport(dns_view_t *view, in_port_t dstport);
-/*
+/*%<
  * Set the view's destination port.  This is the port to
  * which outgoing queries are sent.  The default is 53,
  * the standard DNS port.
  *
  * Requires:
  *
- *      'view' is a valid view.
+ *\li      'view' is a valid view.
  *
- *      'dstport' is a valid TCP/UDP port number.
+ *\li      'dstport' is a valid TCP/UDP port number.
  *
  * Ensures:
- *	External name servers will be assumed to be listning
+ *\li	External name servers will be assumed to be listning
  *	on 'dstport'.  For servers whose address has already
  *	obtained obtained at the time of the call, the view may
  *	continue to use the previously set port until the address
@@ -367,28 +373,28 @@ dns_view_setdstport(dns_view_t *view, in_port_t dstport);
 
 isc_result_t
 dns_view_addzone(dns_view_t *view, dns_zone_t *zone);
-/*
+/*%<
  * Add zone 'zone' to 'view'.
  *
  * Requires:
  *
- *	'view' is a valid, unfrozen view.
+ *\li	'view' is a valid, unfrozen view.
  *
- *	'zone' is a valid zone.
+ *\li	'zone' is a valid zone.
  */
 
 void
 dns_view_freeze(dns_view_t *view);
-/*
+/*%<
  * Freeze view.
  *
  * Requires:
  *
- *	'view' is a valid, unfrozen view.
+ *\li	'view' is a valid, unfrozen view.
  *
  * Ensures:
  *
- *	'view' is frozen.
+ *\li	'view' is frozen.
  */
 
 isc_result_t
@@ -396,63 +402,63 @@ dns_view_find(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	      isc_stdtime_t now, unsigned int options, isc_boolean_t use_hints,
 	      dns_db_t **dbp, dns_dbnode_t **nodep, dns_name_t *foundname,
 	      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
-/*
+/*%<
  * Find an rdataset whose owner name is 'name', and whose type is
  * 'type'.
  *
  * Notes:
  *
- *	See the description of dns_db_find() for information about 'options'.
- *	If the caller sets DNS_DBFIND_GLUEOK, it must ensure that 'name'
+ *\li	See the description of dns_db_find() for information about 'options'.
+ *	If the caller sets #DNS_DBFIND_GLUEOK, it must ensure that 'name'
  *	and 'type' are appropriate for glue retrieval.
  *
- *	If 'now' is zero, then the current time will be used.
+ *\li	If 'now' is zero, then the current time will be used.
  *
- *	If 'use_hints' is ISC_TRUE, and the view has a hints database, then
+ *\li	If 'use_hints' is ISC_TRUE, and the view has a hints database, then
  *	it will be searched last.  If the answer is found in the hints
  *	database, the result code will be DNS_R_HINT.  If the name is found
  *	in the hints database but not the type, the result code will be
- *	DNS_R_HINTNXRRSET.
+ *	#DNS_R_HINTNXRRSET.
  *
- *	'foundname' must meet the requirements of dns_db_find().
+ *\li	'foundname' must meet the requirements of dns_db_find().
  *
- *	If 'sigrdataset' is not NULL, and there is a SIG rdataset which
+ *\li	If 'sigrdataset' is not NULL, and there is a SIG rdataset which
  *	covers 'type', then 'sigrdataset' will be bound to it.
  *
  * Requires:
  *
- *	'view' is a valid, frozen view.
+ *\li	'view' is a valid, frozen view.
  *
- *	'name' is valid name.
+ *\li	'name' is valid name.
  *
- *	'type' is a valid dns_rdatatype_t, and is not a meta query type
+ *\li	'type' is a valid dns_rdatatype_t, and is not a meta query type
  *	except dns_rdatatype_any.
  *
- *	dbp == NULL || *dbp == NULL
+ *\li	dbp == NULL || *dbp == NULL
  *
- *	nodep == NULL || *nodep == NULL.  If nodep != NULL, dbp != NULL.
+ *\li	nodep == NULL || *nodep == NULL.  If nodep != NULL, dbp != NULL.
  *
- *	'foundname' is a valid name with a dedicated buffer or NULL.
+ *\li	'foundname' is a valid name with a dedicated buffer or NULL.
  *
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  *
- *	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
+ *\li	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
  *
  * Ensures:
  *
- *	In successful cases, 'rdataset', and possibly 'sigrdataset', are
+ *\li	In successful cases, 'rdataset', and possibly 'sigrdataset', are
  *	bound to the found data.
  *
- *	If dbp != NULL, it points to the database containing the data.
+ *\li	If dbp != NULL, it points to the database containing the data.
  *
- *	If nodep != NULL, it points to the database node containing the data.
+ *\li	If nodep != NULL, it points to the database node containing the data.
  *
- *	If foundname != NULL, it contains the full name of the found data.
+ *\li	If foundname != NULL, it contains the full name of the found data.
  *
  * Returns:
  *
- *	Any result that dns_db_find() can return, with the exception of
- *	DNS_R_DELEGATION.
+ *\li	Any result that dns_db_find() can return, with the exception of
+ *	#DNS_R_DELEGATION.
  */
 
 isc_result_t
@@ -460,62 +466,63 @@ dns_view_simplefind(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 		    isc_stdtime_t now, unsigned int options,
 		    isc_boolean_t use_hints,
 		    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
-/*
+/*%<
  * Find an rdataset whose owner name is 'name', and whose type is
  * 'type'.
  *
  * Notes:
  *
- *	This routine is appropriate for simple, exact-match queries of the
+ *\li	This routine is appropriate for simple, exact-match queries of the
  *	view.  'name' must be a canonical name; there is no DNAME or CNAME
  *	processing.
  *
- *	See the description of dns_db_find() for information about 'options'.
+ *\li	See the description of dns_db_find() for information about 'options'.
  *	If the caller sets DNS_DBFIND_GLUEOK, it must ensure that 'name'
  *	and 'type' are appropriate for glue retrieval.
  *
- *	If 'now' is zero, then the current time will be used.
+ *\li	If 'now' is zero, then the current time will be used.
  *
- *	If 'use_hints' is ISC_TRUE, and the view has a hints database, then
+ *\li	If 'use_hints' is ISC_TRUE, and the view has a hints database, then
  *	it will be searched last.  If the answer is found in the hints
  *	database, the result code will be DNS_R_HINT.  If the name is found
  *	in the hints database but not the type, the result code will be
  *	DNS_R_HINTNXRRSET.
  *
- *	If 'sigrdataset' is not NULL, and there is a SIG rdataset which
+ *\li	If 'sigrdataset' is not NULL, and there is a SIG rdataset which
  *	covers 'type', then 'sigrdataset' will be bound to it.
  *
  * Requires:
  *
- *	'view' is a valid, frozen view.
+ *\li	'view' is a valid, frozen view.
  *
- *	'name' is valid name.
+ *\li	'name' is valid name.
  *
- *	'type' is a valid dns_rdatatype_t, and is not a meta query type
+ *\li	'type' is a valid dns_rdatatype_t, and is not a meta query type
  *	(e.g. dns_rdatatype_any), or dns_rdatatype_rrsig.
  *
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  *
- *	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
+ *\li	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
  *
  * Ensures:
  *
- *	In successful cases, 'rdataset', and possibly 'sigrdataset', are
+ *\li	In successful cases, 'rdataset', and possibly 'sigrdataset', are
  *	bound to the found data.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS			Success; result is desired type.
- *	DNS_R_GLUE			Success; result is glue.
- *	DNS_R_HINT			Success; result is a hint.
- *	DNS_R_NCACHENXDOMAIN		Success; result is a ncache entry.
- *	DNS_R_NCACHENXRRSET		Success; result is a ncache entry.
- *	DNS_R_NXDOMAIN			The name does not exist.
- *	DNS_R_NXRRSET			The rrset does not exist.
- *	ISC_R_NOTFOUND			No matching data found,
+ *\li	#ISC_R_SUCCESS			Success; result is desired type.
+ *\li	DNS_R_GLUE			Success; result is glue.
+ *\li	DNS_R_HINT			Success; result is a hint.
+ *\li	DNS_R_NCACHENXDOMAIN		Success; result is a ncache entry.
+ *\li	DNS_R_NCACHENXRRSET		Success; result is a ncache entry.
+ *\li	DNS_R_NXDOMAIN			The name does not exist.
+ *\li	DNS_R_NXRRSET			The rrset does not exist.
+ *\li	#ISC_R_NOTFOUND			No matching data found,
  *					or an error occurred.
  */
 
+/*% See dns_view_findzonecut2() */
 isc_result_t
 dns_view_findzonecut(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 		     isc_stdtime_t now, unsigned int options,
@@ -527,7 +534,7 @@ dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 		      isc_stdtime_t now, unsigned int options,
 		      isc_boolean_t use_hints, isc_boolean_t use_cache,
 		      dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset);
-/*
+/*%<
  * Find the best known zonecut containing 'name'.
  *
  * This uses local authority, cache, and optionally hints data.
@@ -535,69 +542,69 @@ dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
  *
  * Notes:
  *
- *	If 'now' is zero, then the current time will be used.
+ *\li	If 'now' is zero, then the current time will be used.
  *
- *	If 'use_hints' is ISC_TRUE, and the view has a hints database, then
+ *\li	If 'use_hints' is ISC_TRUE, and the view has a hints database, then
  *	it will be searched last.
  *
- *	If 'use_cache' is ISC_TRUE, and the view has a cache, then it will be
+ *\li	If 'use_cache' is ISC_TRUE, and the view has a cache, then it will be
  *	searched.
  *
- *	If 'sigrdataset' is not NULL, and there is a SIG rdataset which
+ *\li	If 'sigrdataset' is not NULL, and there is a SIG rdataset which
  *	covers 'type', then 'sigrdataset' will be bound to it.
  *
- *	If the DNS_DBFIND_NOEXACT option is set, then the zonecut returned
+ *\li	If the DNS_DBFIND_NOEXACT option is set, then the zonecut returned
  *	(if any) will be the deepest known ancestor of 'name'.
  *
  * Requires:
  *
- *	'view' is a valid, frozen view.
+ *\li	'view' is a valid, frozen view.
  *
- *	'name' is valid name.
+ *\li	'name' is valid name.
  *
- *	'rdataset' is a valid, disassociated rdataset.
+ *\li	'rdataset' is a valid, disassociated rdataset.
  *
- *	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
+ *\li	'sigrdataset' is NULL, or is a valid, disassociated rdataset.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS				Success.
+ *\li	#ISC_R_SUCCESS				Success.
  *
- *	Many other results are possible.
+ *\li	Many other results are possible.
  */
 
 isc_result_t
 dns_viewlist_find(dns_viewlist_t *list, const char *name,
 		  dns_rdataclass_t rdclass, dns_view_t **viewp);
-/*
+/*%<
  * Search for a view with name 'name' and class 'rdclass' in 'list'.
  * If found, '*viewp' is (strongly) attached to it.
  *
  * Requires:
  *
- *	'viewp' points to a NULL dns_view_t *.
+ *\li	'viewp' points to a NULL dns_view_t *.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		A matching view was found.
- *	ISC_R_NOTFOUND		No matching view was found.
+ *\li	#ISC_R_SUCCESS		A matching view was found.
+ *\li	#ISC_R_NOTFOUND		No matching view was found.
  */
 
 isc_result_t
 dns_view_findzone(dns_view_t *view, dns_name_t *name, dns_zone_t **zonep);
-/*
+/*%<
  * Search for the zone 'name' in the zone table of 'view'.
  * If found, 'zonep' is (strongly) attached to it.  There
  * are no partial matches.
  *
  * Requires:
  *
- *	'zonep' points to a NULL dns_zone_t *.
+ *\li	'zonep' points to a NULL dns_zone_t *.
  *
  * Returns:
- *	ISC_R_SUCCESS		A matching zone was found.
- *	ISC_R_NOTFOUND		No matching zone was found.
- *	others			An error occurred.
+ *\li	#ISC_R_SUCCESS		A matching zone was found.
+ *\li	#ISC_R_NOTFOUND		No matching zone was found.
+ *\li	others			An error occurred.
  */
 
 isc_result_t
@@ -605,7 +612,7 @@ dns_view_load(dns_view_t *view, isc_boolean_t stop);
 
 isc_result_t
 dns_view_loadnew(dns_view_t *view, isc_boolean_t stop);
-/*
+/*%<
  * Load zones attached to this view.  dns_view_load() loads
  * all zones whose master file has changed since the last
  * load; dns_view_loadnew() loads only zones that have never 
@@ -616,29 +623,29 @@ dns_view_loadnew(dns_view_t *view, isc_boolean_t stop);
  *
  * Requires:
  *
- *	'view' is valid.
+ *\li	'view' is valid.
  */
 
 isc_result_t
 dns_view_gettsig(dns_view_t *view, dns_name_t *keyname,
 		 dns_tsigkey_t **keyp);
-/*
+/*%<
  * Find the TSIG key configured in 'view' with name 'keyname',
  * if any.
  *
  * Reqires:
- *	keyp points to a NULL dns_tsigkey_t *.
+ *\li	keyp points to a NULL dns_tsigkey_t *.
  *
  * Returns:
- *	ISC_R_SUCCESS	A key was found and '*keyp' now points to it.
- *	ISC_R_NOTFOUND	No key was found.
- *	others		An error occurred.
+ *\li	#ISC_R_SUCCESS	A key was found and '*keyp' now points to it.
+ *\li	#ISC_R_NOTFOUND	No key was found.
+ *\li	others		An error occurred.
  */
 
 isc_result_t
 dns_view_getpeertsig(dns_view_t *view, isc_netaddr_t *peeraddr,
 		     dns_tsigkey_t **keyp);
-/*
+/*%<
  * Find the TSIG key configured in 'view' for the server whose
  * address is 'peeraddr', if any.
  *
@@ -646,35 +653,35 @@ dns_view_getpeertsig(dns_view_t *view, isc_netaddr_t *peeraddr,
  *	keyp points to a NULL dns_tsigkey_t *.
  *
  * Returns:
- *	ISC_R_SUCCESS	A key was found and '*keyp' now points to it.
- *	ISC_R_NOTFOUND	No key was found.
- *	others		An error occurred.
+ *\li	#ISC_R_SUCCESS	A key was found and '*keyp' now points to it.
+ *\li	#ISC_R_NOTFOUND	No key was found.
+ *\li	others		An error occurred.
  */
 
 isc_result_t
 dns_view_checksig(dns_view_t *view, isc_buffer_t *source, dns_message_t *msg);
-/*
+/*%<
  * Verifies the signature of a message.
  *
  * Requires:
  *
- *	'view' is a valid view.
- *	'source' is a valid buffer containing the message
- *	'msg' is a valid message
+ *\li	'view' is a valid view.
+ *\li	'source' is a valid buffer containing the message
+ *\li	'msg' is a valid message
  *
  * Returns:
- *	see dns_tsig_verify()
+ *\li	see dns_tsig_verify()
  */
 
 void
 dns_view_dialup(dns_view_t *view);
-/*
+/*%<
  * Perform dialup-time maintenance on the zones of 'view'.
  */
 
 isc_result_t
 dns_view_dumpdbtostream(dns_view_t *view, FILE *fp);
-/*
+/*%<
  * Dump the current state of the view 'view' to the stream 'fp'
  * for purposes of analysis or debugging.
  *
@@ -685,18 +692,18 @@ dns_view_dumpdbtostream(dns_view_t *view, FILE *fp);
  *
  * Requires:
  * 	
- *	'view' is valid.
+ *\li	'view' is valid.
  *
- *	'fp' refers to a file open for writing.
+ *\li	'fp' refers to a file open for writing.
  *
  * Returns:
- * 	ISC_R_SUCCESS	The cache was successfully dumped.
- * 	others		An error occurred (see dns_master_dump)
+ * \li	ISC_R_SUCCESS	The cache was successfully dumped.
+ * \li	others		An error occurred (see dns_master_dump)
  */
 
 isc_result_t
 dns_view_flushcache(dns_view_t *view);
-/*
+/*%<
  * Flush the view's cache (and ADB).
  *
  * Requires:
@@ -705,85 +712,93 @@ dns_view_flushcache(dns_view_t *view);
  * 	No other tasks are executing.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_view_flushname(dns_view_t *view, dns_name_t *);
-/*
+/*%<
  * Flush the given name from the view's cache (and ADB).
  *
  * Requires:
- *	'view' is valid.
- *	'name' is valid.
+ *\li	'view' is valid.
+ *\li	'name' is valid.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *	other returns are failures.
  */
 
 isc_result_t
 dns_view_adddelegationonly(dns_view_t *view, dns_name_t *name);
-/*
+/*%<
  * Add the given name to the delegation only table.
  * 
  *
  * Requires:
- *	'view' is valid.
- *	'name' is valid.
+ *\li	'view' is valid.
+ *\li	'name' is valid.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_view_excludedelegationonly(dns_view_t *view, dns_name_t *name);
-/*
+/*%<
  * Add the given name to be excluded from the root-delegation-only.
  * 
  *
  * Requires:
- *	'view' is valid.
- *	'name' is valid.
+ *\li	'view' is valid.
+ *\li	'name' is valid.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 isc_boolean_t
 dns_view_isdelegationonly(dns_view_t *view, dns_name_t *name);
-/*
+/*%<
  * Check if 'name' is in the delegation only table or if
  * rootdelonly is set that name is not being excluded.
  *
  * Requires:
- *	'view' is valid.
- *	'name' is valid.
+ *\li	'view' is valid.
+ *\li	'name' is valid.
  *
  * Returns:
- *	ISC_TRUE if the name is is the table.
- *	ISC_FALSE othewise.
+ *\li	#ISC_TRUE if the name is is the table.
+ *\li	#ISC_FALSE othewise.
  */
 
 void
 dns_view_setrootdelonly(dns_view_t *view, isc_boolean_t value);
-/*
+/*%<
  * Set the root delegation only flag.
  *
  * Requires:
- *	'view' is valid.
+ *\li	'view' is valid.
  */
 
 isc_boolean_t
 dns_view_getrootdelonly(dns_view_t *view);
-/*
+/*%<
  * Get the root delegation only flag.
  *
  * Requires:
- *	'view' is valid.
+ *\li	'view' is valid.
  */
 
+isc_result_t
+dns_view_freezezones(dns_view_t *view, isc_boolean_t freeze);
+/*%<
+ * Freeze/thaw updates to master zones.
+ *
+ * Requires:
+ * \li	'view' is valid.
+ */
 #endif /* DNS_VIEW_H */
diff --git a/contrib/bind9/lib/dns/include/dns/xfrin.h b/contrib/bind9/lib/dns/include/dns/xfrin.h
index 0f5e086..fcd482e 100644
--- a/contrib/bind9/lib/dns/include/dns/xfrin.h
+++ b/contrib/bind9/lib/dns/include/dns/xfrin.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrin.h,v 1.18.136.4 2006/07/20 01:10:29 marka Exp $ */
+/* $Id: xfrin.h,v 1.20.18.5 2006/07/20 01:10:30 marka Exp $ */
 
 #ifndef DNS_XFRIN_H
 #define DNS_XFRIN_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file 
+ * \brief
  * Incoming zone transfers (AXFR + IXFR).
  */
 
@@ -40,7 +41,7 @@
  *** Types
  ***/
 
-/*
+/*%
  * A transfer in progress.  This is an opaque type.
  */
 typedef struct dns_xfrin_ctx dns_xfrin_ctx_t;
@@ -51,6 +52,7 @@ typedef struct dns_xfrin_ctx dns_xfrin_ctx_t;
 
 ISC_LANG_BEGINDECLS
 
+/*% see dns_xfrin_create2() */
 isc_result_t
 dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 		 isc_sockaddr_t *masteraddr, dns_tsigkey_t *tsigkey,
@@ -65,7 +67,7 @@ dns_xfrin_create2(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 		  isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr,
 		  isc_task_t *task, dns_xfrindone_t done,
 		  dns_xfrin_ctx_t **xfrp);
-/*
+/*%<
  * Attempt to start an incoming zone transfer of 'zone'
  * from 'masteraddr', creating a dns_xfrin_ctx_t object to
  * manage it.  Attach '*xfrp' to the newly created object.
@@ -75,17 +77,17 @@ dns_xfrin_create2(dns_zone_t *zone, dns_rdatatype_t xfrtype,
  * code as arguments when the transfer finishes.
  *
  * Requires:
- *	'xfrtype' is dns_rdatatype_axfr, dns_rdatatype_ixfr
+ *\li	'xfrtype' is dns_rdatatype_axfr, dns_rdatatype_ixfr
  *	or dns_rdatatype_soa (soa query followed by axfr if
  *	serial is greater than current serial).
  *
- *	If 'xfrtype' is dns_rdatatype_ixfr or dns_rdatatype_soa,
+ *\li	If 'xfrtype' is dns_rdatatype_ixfr or dns_rdatatype_soa,
  *	the zone has a database.
  */
 
 void
 dns_xfrin_shutdown(dns_xfrin_ctx_t *xfr);
-/*
+/*%<
  * If the zone transfer 'xfr' has already finished,
  * do nothing.  Otherwise, abort it and cause it to call
  * its done callback with a status of ISC_R_CANCELLED.
@@ -93,14 +95,14 @@ dns_xfrin_shutdown(dns_xfrin_ctx_t *xfr);
 
 void
 dns_xfrin_detach(dns_xfrin_ctx_t **xfrp);
-/*
+/*%<
  * Detach a reference to a zone transfer object.
  * Caller to maintain external locking if required.
  */
 
 void
 dns_xfrin_attach(dns_xfrin_ctx_t *source, dns_xfrin_ctx_t **target);
-/*
+/*%<
  * Caller to maintain external locking if required.
  */
 
diff --git a/contrib/bind9/lib/dns/include/dns/zone.h b/contrib/bind9/lib/dns/include/dns/zone.h
index 4baf36a..7cb8272 100644
--- a/contrib/bind9/lib/dns/include/dns/zone.h
+++ b/contrib/bind9/lib/dns/include/dns/zone.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.h,v 1.106.2.7.4.18 2006/08/01 03:44:00 marka Exp $ */
+/* $Id: zone.h,v 1.126.18.19 2006/08/01 03:45:21 marka Exp $ */
 
 #ifndef DNS_ZONE_H
 #define DNS_ZONE_H 1
 
+/*! \file */
+
 /***
  ***	Imports
  ***/
@@ -30,6 +32,7 @@
 #include <isc/lang.h>
 #include <isc/rwlock.h>
 
+#include <dns/masterdump.h>
 #include <dns/types.h>
 
 typedef enum {
@@ -39,19 +42,30 @@ typedef enum {
 	dns_zone_stub
 } dns_zonetype_t;
 
-#define DNS_ZONEOPT_SERVERS	  0x00000001U	/* perform server checks */
-#define DNS_ZONEOPT_PARENTS	  0x00000002U	/* perform parent checks */
-#define DNS_ZONEOPT_CHILDREN	  0x00000004U	/* perform child checks */
-#define DNS_ZONEOPT_NOTIFY	  0x00000008U	/* perform NOTIFY */
-#define DNS_ZONEOPT_MANYERRORS	  0x00000010U	/* return many errors on load */
-#define DNS_ZONEOPT_IXFRFROMDIFFS 0x00000020U	/* calculate differences */
-#define DNS_ZONEOPT_NOMERGE	  0x00000040U	/* don't merge journal */
-#define DNS_ZONEOPT_CHECKNS	  0x00000080U	/* check if NS's are addresses */
-#define DNS_ZONEOPT_FATALNS	  0x00000100U	/* DNS_ZONEOPT_CHECKNS is fatal */
-#define DNS_ZONEOPT_MULTIMASTER	  0x00000200U	/* this zone has multiple masters */
-#define DNS_ZONEOPT_USEALTXFRSRC  0x00000400U	/* use alternate transfer sources */
-#define DNS_ZONEOPT_CHECKNAMES	  0x00000800U	/* check-names */
-#define DNS_ZONEOPT_CHECKNAMESFAIL 0x00001000U	/* fatal check-name failures */
+#define DNS_ZONEOPT_SERVERS	  0x00000001U	/*%< perform server checks */
+#define DNS_ZONEOPT_PARENTS	  0x00000002U	/*%< perform parent checks */
+#define DNS_ZONEOPT_CHILDREN	  0x00000004U	/*%< perform child checks */
+#define DNS_ZONEOPT_NOTIFY	  0x00000008U	/*%< perform NOTIFY */
+#define DNS_ZONEOPT_MANYERRORS	  0x00000010U	/*%< return many errors on load */
+#define DNS_ZONEOPT_IXFRFROMDIFFS 0x00000020U	/*%< calculate differences */
+#define DNS_ZONEOPT_NOMERGE	  0x00000040U	/*%< don't merge journal */
+#define DNS_ZONEOPT_CHECKNS	  0x00000080U	/*%< check if NS's are addresses */
+#define DNS_ZONEOPT_FATALNS	  0x00000100U	/*%< DNS_ZONEOPT_CHECKNS is fatal */
+#define DNS_ZONEOPT_MULTIMASTER	  0x00000200U	/*%< this zone has multiple masters */
+#define DNS_ZONEOPT_USEALTXFRSRC  0x00000400U	/*%< use alternate transfer sources */
+#define DNS_ZONEOPT_CHECKNAMES	  0x00000800U	/*%< check-names */
+#define DNS_ZONEOPT_CHECKNAMESFAIL 0x00001000U	/*%< fatal check-name failures */
+#define DNS_ZONEOPT_CHECKWILDCARD 0x00002000U	/*%< check for internal wildcards */
+#define DNS_ZONEOPT_CHECKMX	  0x00004000U	/*%< check-mx */
+#define DNS_ZONEOPT_CHECKMXFAIL   0x00008000U	/*%< fatal check-mx failures */
+#define DNS_ZONEOPT_CHECKINTEGRITY 0x00010000U	/*%< perform integrity checks */
+#define DNS_ZONEOPT_CHECKSIBLING  0x00020000U	/*%< perform sibling glue checks */
+#define DNS_ZONEOPT_NOCHECKNS	  0x00040000U	/*%< disable IN NS address checks */
+#define DNS_ZONEOPT_WARNMXCNAME	  0x00080000U	/*%< warn on MX CNAME check */
+#define DNS_ZONEOPT_IGNOREMXCNAME 0x00100000U	/*%< ignore MX CNAME check */
+#define DNS_ZONEOPT_WARNSRVCNAME  0x00200000U	/*%< warn on SRV CNAME check */
+#define DNS_ZONEOPT_IGNORESRVCNAME 0x00400000U	/*%< ignore SRV CNAME check */
+#define DNS_ZONEOPT_UPDATECHECKKSK 0x00800000U	/*%< check dnskey KSK flag */
 
 #ifndef NOMINUM_PUBLIC
 /*
@@ -61,22 +75,22 @@ typedef enum {
 #endif /* NOMINUM_PUBLIC */
 
 #ifndef DNS_ZONE_MINREFRESH
-#define DNS_ZONE_MINREFRESH		    300	/* 5 minutes */
+#define DNS_ZONE_MINREFRESH		    300	/*%< 5 minutes */
 #endif
 #ifndef DNS_ZONE_MAXREFRESH
-#define DNS_ZONE_MAXREFRESH		2419200	/* 4 weeks */
+#define DNS_ZONE_MAXREFRESH		2419200	/*%< 4 weeks */
 #endif
 #ifndef DNS_ZONE_DEFAULTREFRESH
-#define DNS_ZONE_DEFAULTREFRESH		   3600	/* 1 hour */
+#define DNS_ZONE_DEFAULTREFRESH		   3600	/*%< 1 hour */
 #endif
 #ifndef DNS_ZONE_MINRETRY
-#define DNS_ZONE_MINRETRY		    300	/* 5 minutes */
+#define DNS_ZONE_MINRETRY		    300	/*%< 5 minutes */
 #endif
 #ifndef DNS_ZONE_MAXRETRY
-#define DNS_ZONE_MAXRETRY		1209600	/* 2 weeks */
+#define DNS_ZONE_MAXRETRY		1209600	/*%< 2 weeks */
 #endif
 #ifndef DNS_ZONE_DEFAULTRETRY
-#define DNS_ZONE_DEFAULTRETRY		     60	/* 1 minute, subject to
+#define DNS_ZONE_DEFAULTRETRY		     60	/*%< 1 minute, subject to
 						   exponential backoff */
 #endif
 
@@ -93,126 +107,135 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx);
-/*
+/*%<
  *	Creates a new empty zone and attach '*zonep' to it.
  *
  * Requires:
- *	'zonep' to point to a NULL pointer.
- *	'mctx' to be a valid memory context.
+ *\li	'zonep' to point to a NULL pointer.
+ *\li	'mctx' to be a valid memory context.
  *
  * Ensures:
- *	'*zonep' refers to a valid zone.
+ *\li	'*zonep' refers to a valid zone.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
  */
 
 void
 dns_zone_setclass(dns_zone_t *zone, dns_rdataclass_t rdclass);
-/*
+/*%<
  *	Sets the class of a zone.  This operation can only be performed
  *	once on a zone.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	dns_zone_setclass() not to have been called since the zone was
+ *\li	'zone' to be a valid zone.
+ *\li	dns_zone_setclass() not to have been called since the zone was
  *	created.
- *	'rdclass' != dns_rdataclass_none.
+ *\li	'rdclass' != dns_rdataclass_none.
  */
 
 dns_rdataclass_t
 dns_zone_getclass(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the current zone class.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type);
-/*
+/*%<
  *	Sets the zone type. This operation can only be performed once on
  *	a zone.
  *
  * Requires:
- *	'zone' to be a valid zone.
- *	dns_zone_settype() not to have been called since the zone was
+ *\li	'zone' to be a valid zone.
+ *\li	dns_zone_settype() not to have been called since the zone was
  *	created.
- *	'type' != dns_zone_none
+ *\li	'type' != dns_zone_none
  */
 
 void
 dns_zone_setview(dns_zone_t *zone, dns_view_t *view);
-/*
+/*%<
  *	Associate the zone with a view.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 dns_view_t *
 dns_zone_getview(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the zone's associated view.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_setorigin(dns_zone_t *zone, const dns_name_t *origin);
-/*
+/*%<
  *	Sets the zones origin to 'origin'.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'origin' to be non NULL.
+ *\li	'zone' to be a valid zone.
+ *\li	'origin' to be non NULL.
  *
  * Returns:
- *	ISC_R_SUCCESS
- * 	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li 	#ISC_R_NOMEMORY
  */
 
 dns_name_t *
 dns_zone_getorigin(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the value of the origin.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_setfile(dns_zone_t *zone, const char *file);
-/*
- *	Sets the name of the master file from which the zone
- *	loads its database to 'file'.  For zones that have
- *	no associated master file, 'file' will be NULL.
+
+isc_result_t
+dns_zone_setfile2(dns_zone_t *zone, const char *file,
+		  dns_masterformat_t format);
+/*%<
+ *    Sets the name of the master file in the format of 'format' from which
+ *    the zone loads its database to 'file'.
+ *
+ *    For zones that have no associated master file, 'file' will be NULL.
  *
  *	For zones with persistent databases, the file name
  *	setting is ignored.
  *
+ *    dns_zone_setfile() is a backward-compatible form of
+ *    dns_zone_setfile2(), which always specifies the
+ *    dns_masterformat_text (RFC1035) format.
+ *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	ISC_R_NOMEMORY
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
  */
 
 const char *
 dns_zone_getfile(dns_zone_t *zone);
-/*
+/*%<
  * 	Gets the name of the zone's master file, if any.
  *
  * Requires:
- *	'zone' to be valid initialised zone.
+ *\li	'zone' to be valid initialised zone.
  *
  * Returns:
- *	Pointer to null-terminated file name, or NULL.
+ *\li	Pointer to null-terminated file name, or NULL.
  */
 
 isc_result_t
@@ -220,7 +243,7 @@ dns_zone_load(dns_zone_t *zone);
 
 isc_result_t
 dns_zone_loadnew(dns_zone_t *zone);
-/*
+/*%<
  *	Cause the database to be loaded from its backing store.
  *	Confirm that the minimum requirements for the zone type are
  *	met, otherwise DNS_R_BADZONE is returned.
@@ -230,187 +253,216 @@ dns_zone_loadnew(dns_zone_t *zone);
  *	and whose master file has changed since the last load.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	ISC_R_UNEXPECTED
- *	ISC_R_SUCCESS
- *	DNS_R_CONTINUE	  Incremental load has been queued.
- *	DNS_R_UPTODATE	  The zone has already been loaded based on
+ *\li	#ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	DNS_R_CONTINUE	  Incremental load has been queued.
+ *\li	DNS_R_UPTODATE	  The zone has already been loaded based on
  *			  file system timestamps.
- *	DNS_R_BADZONE
- *	Any result value from dns_db_load().
+ *\li	DNS_R_BADZONE
+ *\li	Any result value from dns_db_load().
  */
 
 void
 dns_zone_attach(dns_zone_t *source, dns_zone_t **target);
-/*
+/*%<
  *	Attach '*target' to 'source' incrementing its external
  * 	reference count.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'target' to be non NULL and '*target' to be NULL.
+ *\li	'zone' to be a valid zone.
+ *\li	'target' to be non NULL and '*target' to be NULL.
  */
 
 void
 dns_zone_detach(dns_zone_t **zonep);
-/*
+/*%<
  *	Detach from a zone decrementing its external reference count.
  *	If this was the last external reference to the zone it will be
  * 	shut down and eventually freed.
  *
  * Require:
- *	'zonep' to point to a valid zone.
+ *\li	'zonep' to point to a valid zone.
  */
 
 void
 dns_zone_iattach(dns_zone_t *source, dns_zone_t **target);
-/*
+/*%<
  *	Attach '*target' to 'source' incrementing its internal
  * 	reference count.  This is intended for use by operations
  * 	such as zone transfers that need to prevent the zone
  * 	object from being freed but not from shutting down.
  *
  * Require:
- *	The caller is running in the context of the zone's task.
- *	'zone' to be a valid zone.
- *	'target' to be non NULL and '*target' to be NULL.
+ *\li	The caller is running in the context of the zone's task.
+ *\li	'zone' to be a valid zone.
+ *\li	'target' to be non NULL and '*target' to be NULL.
  */
 
 void
 dns_zone_idetach(dns_zone_t **zonep);
-/*
+/*%<
  *	Detach from a zone decrementing its internal reference count.
  *	If there are no more internal or external references to the
  * 	zone, it will be freed.
  *
  * Require:
- *	The caller is running in the context of the zone's task.
- *	'zonep' to point to a valid zone.
+ *\li	The caller is running in the context of the zone's task.
+ *\li	'zonep' to point to a valid zone.
  */
 
 void
 dns_zone_setflag(dns_zone_t *zone, unsigned int flags, isc_boolean_t value);
-/*
+/*%<
  *	Sets ('value' == 'ISC_TRUE') / clears ('value' == 'IS_FALSE')
  *	zone flags.  Valid flag bits are DNS_ZONE_F_*.
  *
  * Requires
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_getdb(dns_zone_t *zone, dns_db_t **dbp);
-/*
+/*%<
  * 	Attach '*dbp' to the database to if it exists otherwise
  *	return DNS_R_NOTLOADED.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'dbp' to be != NULL && '*dbp' == NULL.
+ *\li	'zone' to be a valid zone.
+ *\li	'dbp' to be != NULL && '*dbp' == NULL.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	DNS_R_NOTLOADED
+ *\li	#ISC_R_SUCCESS
+ *\li	DNS_R_NOTLOADED
  */
 
 isc_result_t
 dns_zone_setdbtype(dns_zone_t *zone,
 		   unsigned int dbargc, const char * const *dbargv);
-/*
+/*%<
  *	Sets the database type to dbargv[0] and database arguments
  *	to subsequent dbargv elements.
  *	'db_type' is not checked to see if it is a valid database type.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'database' to be non NULL.
- *	'dbargc' to be >= 1
- *	'dbargv' to point to dbargc NULL-terminated strings
+ *\li	'zone' to be a valid zone.
+ *\li	'database' to be non NULL.
+ *\li	'dbargc' to be >= 1
+ *\li	'dbargv' to point to dbargc NULL-terminated strings
  *
  * Returns:
- *	ISC_R_NOMEMORY
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ */
+
+isc_result_t
+dns_zone_getdbtype(dns_zone_t *zone, char ***argv, isc_mem_t *mctx);
+/*%<
+ *	Returns the current dbtype.  isc_mem_free() should be used
+ * 	to free 'argv' after use.
+ *
+ * Require:
+ *\li	'zone' to be a valid zone.
+ *\li	'argv' to be non NULL and *argv to be NULL.
+ *\li	'mctx' to be valid.
+ *
+ * Returns:
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
  */
 
 void
 dns_zone_markdirty(dns_zone_t *zone);
-/*
+/*%<
  *	Mark a zone as 'dirty'.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_expire(dns_zone_t *zone);
-/*
+/*%<
  *	Mark the zone as expired.  If the zone requires dumping cause it to
  *	be initiated.  Set the refresh and retry intervals to there default
  *	values and unload the zone.
  *
  * Require
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_refresh(dns_zone_t *zone);
-/*
+/*%<
  *	Initiate zone up to date checks.  The zone must already be being
  *	managed.
  *
  * Require
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_flush(dns_zone_t *zone);
-/*
+/*%<
  *	Write the zone to database if there are uncommited changes.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_dump(dns_zone_t *zone);
-/*
+/*%<
  *	Write the zone to database.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_dumptostream(dns_zone_t *zone, FILE *fd);
-/*
- *	Write the zone to stream 'fd'.
+
+isc_result_t
+dns_zone_dumptostream2(dns_zone_t *zone, FILE *fd, dns_masterformat_t format,
+		       const dns_master_style_t *style);
+/*%<
+ *    Write the zone to stream 'fd' in the specified 'format'.
+ *    If the 'format' is dns_masterformat_text (RFC1035), 'style' also
+ *    specifies the file style (e.g., &dns_master_style_default).
+ *
+ *    dns_zone_dumptostream() is a backward-compatible form of
+ *    dns_zone_dumptostream2(), which always uses the dns_masterformat_text
+ *    format and the dns_master_style_default style.
+ *
+ *    Note that dns_zone_dumptostream2() is the most flexible form.  It
+ *    can also provide the functionality of dns_zone_fulldumptostream().
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'fd' to be a stream open for writing.
+ *\li	'zone' to be a valid zone.
+ *\li	'fd' to be a stream open for writing.
  */
 
 isc_result_t
 dns_zone_fulldumptostream(dns_zone_t *zone, FILE *fd);
-/*
+/*%<
  *	The same as dns_zone_dumptostream, but dumps the zone with
  *	different dump settings (dns_master_style_full).
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'fd' to be a stream open for writing.
+ *\li	'zone' to be a valid zone.
+ *\li	'fd' to be a stream open for writing.
  */
 
 void
 dns_zone_maintenance(dns_zone_t *zone);
-/*
+/*%<
  *	Perform regular maintenace on the zone.  This is called as a
  *	result of a zone being managed.
  *
  * Require
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
@@ -421,108 +473,108 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
 			    const isc_sockaddr_t *masters,
 			    dns_name_t **keynames,
 			    isc_uint32_t count);
-/*
+/*%<
  *	Set the list of master servers for the zone.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'masters' array of isc_sockaddr_t with port set or NULL.
- *	'count' the number of masters.
- *      'keynames' array of dns_name_t's for tsig keys or NULL.
+ *\li	'zone' to be a valid zone.
+ *\li	'masters' array of isc_sockaddr_t with port set or NULL.
+ *\li	'count' the number of masters.
+ *\li      'keynames' array of dns_name_t's for tsig keys or NULL.
  *
- *      dns_zone_setmasters() is just a wrapper to setmasterswithkeys(),
+ *  \li    dns_zone_setmasters() is just a wrapper to setmasterswithkeys(),
  *      passing NULL in the keynames field.
  *
- * 	If 'masters' is NULL then 'count' must be zero.
+ * \li	If 'masters' is NULL then 'count' must be zero.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *      Any result dns_name_dup() can return, if keynames!=NULL
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li      Any result dns_name_dup() can return, if keynames!=NULL
  */
 
 isc_result_t
 dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
 		       isc_uint32_t count);
-/*
+/*%<
  *	Set the list of additional servers to be notified when
  *	a zone changes.	 To clear the list use 'count = 0'.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'notify' to be non-NULL if count != 0.
- *	'count' to be the number of notifyees.
+ *\li	'zone' to be a valid zone.
+ *\li	'notify' to be non-NULL if count != 0.
+ *\li	'count' to be the number of notifyees.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 void
 dns_zone_unload(dns_zone_t *zone);
-/*
+/*%<
  *	detach the database from the zone structure.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_setoption(dns_zone_t *zone, unsigned int option, isc_boolean_t value);
-/*
+/*%<
  *	Set given options on ('value' == ISC_TRUE) or off ('value' ==
- *	ISC_FALSE).
+ *	#ISC_FALSE).
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 unsigned int
 dns_zone_getoptions(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the current zone options.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_setminrefreshtime(dns_zone_t *zone, isc_uint32_t val);
-/*
+/*%<
  *	Set the minimum refresh time.
  *
  * Requires:
- *	'zone' is valid.
- *	val > 0.
+ *\li	'zone' is valid.
+ *\li	val > 0.
  */
 
 void
 dns_zone_setmaxrefreshtime(dns_zone_t *zone, isc_uint32_t val);
-/*
+/*%<
  *	Set the maximum refresh time.
  *
  * Requires:
- *	'zone' is valid.
- *	val > 0.
+ *\li	'zone' is valid.
+ *\li	val > 0.
  */
 
 void
 dns_zone_setminretrytime(dns_zone_t *zone, isc_uint32_t val);
-/*
+/*%<
  *	Set the minimum retry time.
  *
  * Requires:
- *	'zone' is valid.
- *	val > 0.
+ *\li	'zone' is valid.
+ *\li	val > 0.
  */
 
 void
 dns_zone_setmaxretrytime(dns_zone_t *zone, isc_uint32_t val);
-/*
+/*%<
  *	Set the maximum retry time.
  *
  * Requires:
- *	'zone' is valid.
+ *\li	'zone' is valid.
  *	val > 0.
  */
 
@@ -531,436 +583,454 @@ dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 isc_result_t
 dns_zone_setaltxfrsource4(dns_zone_t *zone,
 			  const isc_sockaddr_t *xfrsource);
-/*
+/*%<
  * 	Set the source address to be used in IPv4 zone transfers.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'xfrsource' to contain the address.
+ *\li	'zone' to be a valid zone.
+ *\li	'xfrsource' to contain the address.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  */
 
 isc_sockaddr_t *
 dns_zone_getxfrsource4(dns_zone_t *zone);
 isc_sockaddr_t *
 dns_zone_getaltxfrsource4(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the source address set by a previous dns_zone_setxfrsource4
  *	call, or the default of inaddr_any, port 0.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource);
 isc_result_t
 dns_zone_setaltxfrsource6(dns_zone_t *zone,
-			 const isc_sockaddr_t *xfrsource);
-/*
+			  const isc_sockaddr_t *xfrsource);
+/*%<
  * 	Set the source address to be used in IPv6 zone transfers.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'xfrsource' to contain the address.
+ *\li	'zone' to be a valid zone.
+ *\li	'xfrsource' to contain the address.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  */
 
 isc_sockaddr_t *
 dns_zone_getxfrsource6(dns_zone_t *zone);
 isc_sockaddr_t *
 dns_zone_getaltxfrsource6(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the source address set by a previous dns_zone_setxfrsource6
  *	call, or the default of in6addr_any, port 0.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
-/*
+/*%<
  * 	Set the source address to be used with IPv4 NOTIFY messages.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'notifysrc' to contain the address.
+ *\li	'zone' to be a valid zone.
+ *\li	'notifysrc' to contain the address.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  */
 
 isc_sockaddr_t *
 dns_zone_getnotifysrc4(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the source address set by a previous dns_zone_setnotifysrc4
  *	call, or the default of inaddr_any, port 0.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc);
-/*
+/*%<
  * 	Set the source address to be used with IPv6 NOTIFY messages.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'notifysrc' to contain the address.
+ *\li	'zone' to be a valid zone.
+ *\li	'notifysrc' to contain the address.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  */
 
 isc_sockaddr_t *
 dns_zone_getnotifysrc6(dns_zone_t *zone);
-/*
+/*%<
  *	Returns the source address set by a previous dns_zone_setnotifysrc6
  *	call, or the default of in6addr_any, port 0.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_setnotifyacl(dns_zone_t *zone, dns_acl_t *acl);
-/*
+/*%<
  *	Sets the notify acl list for the zone.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'acl' to be a valid acl.
+ *\li	'zone' to be a valid zone.
+ *\li	'acl' to be a valid acl.
  */
 
 void
 dns_zone_setqueryacl(dns_zone_t *zone, dns_acl_t *acl);
-/*
+/*%<
  *	Sets the query acl list for the zone.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'acl' to be a valid acl.
+ *\li	'zone' to be a valid zone.
+ *\li	'acl' to be a valid acl.
  */
 
 void
 dns_zone_setupdateacl(dns_zone_t *zone, dns_acl_t *acl);
-/*
+/*%<
  *	Sets the update acl list for the zone.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'acl' to be valid acl.
+ *\li	'zone' to be a valid zone.
+ *\li	'acl' to be valid acl.
  */
 
 void
 dns_zone_setforwardacl(dns_zone_t *zone, dns_acl_t *acl);
-/*
+/*%<
  *	Sets the forward unsigned updates acl list for the zone.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'acl' to be valid acl.
+ *\li	'zone' to be a valid zone.
+ *\li	'acl' to be valid acl.
  */
 
 void
 dns_zone_setxfracl(dns_zone_t *zone, dns_acl_t *acl);
-/*
+/*%<
  *	Sets the transfer acl list for the zone.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'acl' to be valid acl.
+ *\li	'zone' to be a valid zone.
+ *\li	'acl' to be valid acl.
  */
 
 dns_acl_t *
 dns_zone_getnotifyacl(dns_zone_t *zone);
-/*
+/*%<
  * 	Returns the current notify acl or NULL.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	acl a pointer to the acl.
- *	NULL
+ *\li	acl a pointer to the acl.
+ *\li	NULL
  */
 
 dns_acl_t *
 dns_zone_getqueryacl(dns_zone_t *zone);
-/*
+/*%<
  * 	Returns the current query acl or NULL.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	acl a pointer to the acl.
- *	NULL
+ *\li	acl a pointer to the acl.
+ *\li	NULL
  */
 
 dns_acl_t *
 dns_zone_getupdateacl(dns_zone_t *zone);
-/*
+/*%<
  * 	Returns the current update acl or NULL.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	acl a pointer to the acl.
- *	NULL
+ *\li	acl a pointer to the acl.
+ *\li	NULL
  */
 
 dns_acl_t *
 dns_zone_getforwardacl(dns_zone_t *zone);
-/*
+/*%<
  * 	Returns the current forward unsigned updates acl or NULL.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	acl a pointer to the acl.
- *	NULL
+ *\li	acl a pointer to the acl.
+ *\li	NULL
  */
 
 dns_acl_t *
 dns_zone_getxfracl(dns_zone_t *zone);
-/*
+/*%<
  * 	Returns the current transfer acl or NULL.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	acl a pointer to the acl.
- *	NULL
+ *\li	acl a pointer to the acl.
+ *\li	NULL
  */
 
 void
 dns_zone_clearupdateacl(dns_zone_t *zone);
-/*
+/*%<
  *	Clear the current update acl.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_clearforwardacl(dns_zone_t *zone);
-/*
+/*%<
  *	Clear the current forward unsigned updates acl.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_clearnotifyacl(dns_zone_t *zone);
-/*
+/*%<
  *	Clear the current notify acl.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_clearqueryacl(dns_zone_t *zone);
-/*
+/*%<
  *	Clear the current query acl.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_clearxfracl(dns_zone_t *zone);
-/*
+/*%<
  *	Clear the current transfer acl.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_boolean_t
 dns_zone_getupdatedisabled(dns_zone_t *zone);
+/*%<
+ * Return update disabled.
+ */
 
 void
 dns_zone_setupdatedisabled(dns_zone_t *zone, isc_boolean_t state);
+/*%<
+ * Set update disabled.
+ */
+
+isc_boolean_t
+dns_zone_getzeronosoattl(dns_zone_t *zone);
+/*%<
+ * Return zero-no-soa-ttl status.
+ */
+
+void
+dns_zone_setzeronosoattl(dns_zone_t *zone, isc_boolean_t state);
+/*%<
+ * Set zero-no-soa-ttl status.
+ */
 
 void
 dns_zone_setchecknames(dns_zone_t *zone, dns_severity_t severity);
-/*
+/*%<
  * 	Set the severity of name checking when loading a zone.
  *
  * Require:
- *      'zone' to be a valid zone.
+ * \li     'zone' to be a valid zone.
  */
 
 dns_severity_t
 dns_zone_getchecknames(dns_zone_t *zone);
-/*
+/*%<
  *	Return the current severity of name checking.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_setjournalsize(dns_zone_t *zone, isc_int32_t size);
-/*
+/*%<
  *	Sets the journal size for the zone.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_int32_t
 dns_zone_getjournalsize(dns_zone_t *zone);
-/*
+/*%<
  *	Return the journal size as set with a previous call to
  *	dns_zone_setjournalsize().
  *
  * Requires:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 		       dns_message_t *msg);
-/*
+/*%<
  *	Tell the zone that it has recieved a NOTIFY message from another
  *	server.  This may cause some zone maintainence activity to occur.
  *
  * Requires:
- *	'zone' to be a valid zone.
- *	'*from' to contain the address of the server from which 'msg'
+ *\li	'zone' to be a valid zone.
+ *\li	'*from' to contain the address of the server from which 'msg'
  *		was recieved.
- *	'msg' a message with opcode NOTIFY and qr clear.
+ *\li	'msg' a message with opcode NOTIFY and qr clear.
  *
  * Returns:
- *	DNS_R_REFUSED
- *	DNS_R_NOTIMP
- *	DNS_R_FORMERR
- *	DNS_R_SUCCESS
+ *\li	DNS_R_REFUSED
+ *\li	DNS_R_NOTIMP
+ *\li	DNS_R_FORMERR
+ *\li	DNS_R_SUCCESS
  */
 
 void
 dns_zone_setmaxxfrin(dns_zone_t *zone, isc_uint32_t maxxfrin);
-/*
+/*%<
  * Set the maximum time (in seconds) that a zone transfer in (AXFR/IXFR)
  * of this zone will use before being aborted.
  *
  * Requires:
- * 	'zone' to be valid initialised zone.
+ * \li	'zone' to be valid initialised zone.
  */
 
 isc_uint32_t
 dns_zone_getmaxxfrin(dns_zone_t *zone);
-/*
+/*%<
  * Returns the maximum transfer time for this zone.  This will be
  * either the value set by the last call to dns_zone_setmaxxfrin() or
  * the default value of 1 hour.
  *
  * Requires:
- *	'zone' to be valid initialised zone.
+ *\li	'zone' to be valid initialised zone.
  */
 
 void
 dns_zone_setmaxxfrout(dns_zone_t *zone, isc_uint32_t maxxfrout);
-/*
+/*%<
  * Set the maximum time (in seconds) that a zone transfer out (AXFR/IXFR)
  * of this zone will use before being aborted.
  *
  * Requires:
- * 	'zone' to be valid initialised zone.
+ * \li	'zone' to be valid initialised zone.
  */
 
 isc_uint32_t
 dns_zone_getmaxxfrout(dns_zone_t *zone);
-/*
+/*%<
  * Returns the maximum transfer time for this zone.  This will be
  * either the value set by the last call to dns_zone_setmaxxfrout() or
  * the default value of 1 hour.
  *
  * Requires:
- *	'zone' to be valid initialised zone.
+ *\li	'zone' to be valid initialised zone.
  */
 
 isc_result_t
 dns_zone_setjournal(dns_zone_t *zone, const char *journal);
-/*
+/*%<
  * Sets the filename used for journaling updates / IXFR transfers.
  * The default journal name is set by dns_zone_setfile() to be
  * "file.jnl".  If 'journal' is NULL, the zone will have no
  * journal name.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 char *
 dns_zone_getjournal(dns_zone_t *zone);
-/*
+/*%<
  * Returns the journal name associated with this zone.
  * If no journal has been set this will be NULL.
  *
  * Requires:
- *	'zone' to be valid initialised zone.
+ *\li	'zone' to be valid initialised zone.
  */
 
 dns_zonetype_t
 dns_zone_gettype(dns_zone_t *zone);
-/*
+/*%<
  * Returns the type of the zone (master/slave/etc.)
  *
  * Requires:
- *	'zone' to be valid initialised zone.
+ *\li	'zone' to be valid initialised zone.
  */
 
 void
 dns_zone_settask(dns_zone_t *zone, isc_task_t *task);
-/*
+/*%<
  * Give a zone a task to work with.  Any current task will be detached.
  *
  * Requires:
- *	'zone' to be valid.
- *	'task' to be valid.
+ *\li	'zone' to be valid.
+ *\li	'task' to be valid.
  */
 
 void
 dns_zone_gettask(dns_zone_t *zone, isc_task_t **target);
-/*
+/*%<
  * Attach '*target' to the zone's task.
  *
  * Requires:
- *	'zone' to be valid initialised zone.
- *	'zone' to have a task.
- *	'target' to be != NULL && '*target' == NULL.
+ *\li	'zone' to be valid initialised zone.
+ *\li	'zone' to have a task.
+ *\li	'target' to be != NULL && '*target' == NULL.
  */
 
 void
 dns_zone_notify(dns_zone_t *zone);
-/*
+/*%<
  * Generate notify events for this zone.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump);
-/*
+/*%<
  * Replace the database of "zone" with a new database "db".
  *
  * If "dump" is ISC_TRUE, then the new zone contents are dumped
@@ -974,11 +1044,11 @@ dns_zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump);
  * journal file, and the master file dump is postponed.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  *
  * Returns:
- *	DNS_R_SUCCESS
- *	DNS_R_BADZONE	zone failed basic consistancy checks:
+ * \li	DNS_R_SUCCESS
+ * \li	DNS_R_BADZONE	zone failed basic consistancy checks:
  *			* a single SOA must exist
  *			* some NS records must exist.
  *	Others
@@ -986,111 +1056,111 @@ dns_zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump);
 
 isc_uint32_t
 dns_zone_getidlein(dns_zone_t *zone);
-/*
+/*%<
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  *
  * Returns:
- *	number of seconds of idle time before we abort the transfer in.
+ * \li	number of seconds of idle time before we abort the transfer in.
  */
 
 void
 dns_zone_setidlein(dns_zone_t *zone, isc_uint32_t idlein);
-/*
- *	Set the idle timeout for transfer the.
- *	Zero set the default value, 1 hour.
+/*%<
+ * \li	Set the idle timeout for transfer the.
+ * \li	Zero set the default value, 1 hour.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 isc_uint32_t
 dns_zone_getidleout(dns_zone_t *zone);
-/*
+/*%<
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  *
  * Returns:
- *	number of seconds of idle time before we abort a transfer out.
+ * \li	number of seconds of idle time before we abort a transfer out.
  */
 
 void
 dns_zone_setidleout(dns_zone_t *zone, isc_uint32_t idleout);
-/*
- *	Set the idle timeout for transfers out.
- *	Zero set the default value, 1 hour.
+/*%<
+ * \li	Set the idle timeout for transfers out.
+ * \li	Zero set the default value, 1 hour.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_getssutable(dns_zone_t *zone, dns_ssutable_t **table);
-/*
+/*%<
  * Get the simple-secure-update policy table.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_setssutable(dns_zone_t *zone, dns_ssutable_t *table);
-/*
+/*%<
  * Set / clear the simple-secure-update policy table.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 isc_mem_t *
 dns_zone_getmctx(dns_zone_t *zone);
-/*
+/*%<
  * Get the memory context of a zone.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 dns_zonemgr_t *
 dns_zone_getmgr(dns_zone_t *zone);
-/*
+/*%<
  *	If 'zone' is managed return the zone manager otherwise NULL.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_setsigvalidityinterval(dns_zone_t *zone, isc_uint32_t interval);
-/*
+/*%<
  * Set the zone's SIG validity interval.  This is the length of time
  * for which DNSSEC signatures created as a result of dynamic updates
  * to secure zones will remain valid, in seconds.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 isc_uint32_t
 dns_zone_getsigvalidityinterval(dns_zone_t *zone);
-/*
+/*%<
  * Get the zone's SIG validity interval.
  *
  * Requires:
- *	'zone' to be a valid zone.
+ * \li	'zone' to be a valid zone.
  */
 
 void
 dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype);
-/*
+/*%<
  * Sets zone notify method to "notifytype"
  */
 
 isc_result_t
 dns_zone_forwardupdate(dns_zone_t *zone, dns_message_t *msg,
                        dns_updatecallback_t callback, void *callback_arg);
-/*
+/*%<
  * Forward 'msg' to each master in turn until we get an answer or we
  * have exausted the list of masters. 'callback' will be called with
  * ISC_R_SUCCESS if we get an answer and the returned message will be
@@ -1100,69 +1170,69 @@ dns_zone_forwardupdate(dns_zone_t *zone, dns_message_t *msg,
  *		(callback)(callback_arg, result, answer_message);
  *
  * Require:
- *	'zone' to be valid
- *	'msg' to be valid.
- *	'callback' to be non NULL.
+ *\li	'zone' to be valid
+ *\li	'msg' to be valid.
+ *\li	'callback' to be non NULL.
  * Returns:
- *	ISC_R_SUCCESS if the message has been forwarded,
- *	ISC_R_NOMEMORY
- *	Others
+ *\li	#ISC_R_SUCCESS if the message has been forwarded,
+ *\li	#ISC_R_NOMEMORY
+ *\li	Others
  */
 
 isc_result_t
 dns_zone_next(dns_zone_t *zone, dns_zone_t **next);
-/*
+/*%<
  * Find the next zone in the list of managed zones.
  *
  * Requires:
- *	'zone' to be valid
- *	The zone manager for the indicated zone MUST be locked
+ *\li	'zone' to be valid
+ *\li	The zone manager for the indicated zone MUST be locked
  *	by the caller.  This is not checked.
- *	'next' be non-NULL, and '*next' be NULL.
+ *\li	'next' be non-NULL, and '*next' be NULL.
  *
  * Ensures:
- *	'next' points to a valid zone (result ISC_R_SUCCESS) or to NULL
+ *\li	'next' points to a valid zone (result ISC_R_SUCCESS) or to NULL
  *	(result ISC_R_NOMORE).
  */
 
 isc_result_t
 dns_zone_first(dns_zonemgr_t *zmgr, dns_zone_t **first);
-/*
+/*%<
  * Find the first zone in the list of managed zones.
  *
  * Requires:
- *	'zonemgr' to be valid
- *	The zone manager for the indicated zone MUST be locked
+ *\li	'zonemgr' to be valid
+ *\li	The zone manager for the indicated zone MUST be locked
  *	by the caller.  This is not checked.
- *	'first' be non-NULL, and '*first' be NULL
+ *\li	'first' be non-NULL, and '*first' be NULL
  *
  * Ensures:
- *	'first' points to a valid zone (result ISC_R_SUCCESS) or to NULL
+ *\li	'first' points to a valid zone (result ISC_R_SUCCESS) or to NULL
  *	(result ISC_R_NOMORE).
  */
 
 isc_result_t
 dns_zone_setkeydirectory(dns_zone_t *zone, const char *directory);
-/*
+/*%<
  *	Sets the name of the directory where private keys used for
  *	online signing of dynamic zones are found.
  *
  * Require:
- *	'zone' to be a valid zone.
+ *\li	'zone' to be a valid zone.
  *
  * Returns:
- *	ISC_R_NOMEMORY
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
  */
 
 const char *
 dns_zone_getkeydirectory(dns_zone_t *zone);
-/*
+/*%<
  * 	Gets the name of the directory where private keys used for
  *	online signing of dynamic zones are found.
  *
  * Requires:
- *	'zone' to be valid initialised zone.
+ *\li	'zone' to be valid initialised zone.
  *
  * Returns:
  *	Pointer to null-terminated file name, or NULL.
@@ -1173,231 +1243,231 @@ isc_result_t
 dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 		   isc_timermgr_t *timermgr, isc_socketmgr_t *socketmgr,
 		   dns_zonemgr_t **zmgrp);
-/*
+/*%<
  * Create a zone manager.
  *
  * Requires:
- *	'mctx' to be a valid memory context.
- *	'taskmgr' to be a valid task manager.
- *	'timermgr' to be a valid timer manager.
- *	'zmgrp'	to point to a NULL pointer.
+ *\li	'mctx' to be a valid memory context.
+ *\li	'taskmgr' to be a valid task manager.
+ *\li	'timermgr' to be a valid timer manager.
+ *\li	'zmgrp'	to point to a NULL pointer.
  */
 
 isc_result_t
 dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone);
-/*
+/*%<
  *	Bring the zone under control of a zone manager.
  *
  * Require:
- *	'zmgr' to be a valid zone manager.
- *	'zone' to be a valid zone.
+ *\li	'zmgr' to be a valid zone manager.
+ *\li	'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zonemgr_forcemaint(dns_zonemgr_t *zmgr);
-/*
+/*%<
  * Force zone maintenance of all zones managed by 'zmgr' at its
  * earliest conveniene.
  */
 
 void
 dns_zonemgr_resumexfrs(dns_zonemgr_t *zmgr);
-/*
+/*%<
  * Attempt to start any stalled zone transfers.
  */
 
 void
 dns_zonemgr_shutdown(dns_zonemgr_t *zmgr);
-/*
+/*%<
  *	Shut down the zone manager.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
+ *\li	'zmgr' to be a valid zone manager.
  */
 
 void
 dns_zonemgr_attach(dns_zonemgr_t *source, dns_zonemgr_t **target);
-/*
+/*%<
  *	Attach '*target' to 'source' incrementing its external
  * 	reference count.
  *
  * Require:
- *	'zone' to be a valid zone.
- *	'target' to be non NULL and '*target' to be NULL.
+ *\li	'zone' to be a valid zone.
+ *\li	'target' to be non NULL and '*target' to be NULL.
  */
 
 void
 dns_zonemgr_detach(dns_zonemgr_t **zmgrp);
-/*
+/*%<
  *	 Detach from a zone manager.
  *
  * Requires:
- *	'*zmgrp' is a valid, non-NULL zone manager pointer.
+ *\li	'*zmgrp' is a valid, non-NULL zone manager pointer.
  *
  * Ensures:
- *	'*zmgrp' is NULL.
+ *\li	'*zmgrp' is NULL.
  */
 
 void
 dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone);
-/*
+/*%<
  *	Release 'zone' from the managed by 'zmgr'.  'zmgr' is implicitly
  *	detached from 'zone'.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
- *	'zone' to be a valid zone.
- *	'zmgr' == 'zone->zmgr'
+ *\li	'zmgr' to be a valid zone manager.
+ *\li	'zone' to be a valid zone.
+ *\li	'zmgr' == 'zone->zmgr'
  *
  * Ensures:
- *	'zone->zmgr' == NULL;
+ *\li	'zone->zmgr' == NULL;
  */
 
 void
 dns_zonemgr_settransfersin(dns_zonemgr_t *zmgr, isc_uint32_t value);
-/*
+/*%<
  *	Set the maximum number of simultaneous transfers in allowed by
  *	the zone manager.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
+ *\li	'zmgr' to be a valid zone manager.
  */
 
 isc_uint32_t
 dns_zonemgr_getttransfersin(dns_zonemgr_t *zmgr);
-/*
+/*%<
  *	Return the the maximum number of simultaneous transfers in allowed.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
+ *\li	'zmgr' to be a valid zone manager.
  */
 
 void
 dns_zonemgr_settransfersperns(dns_zonemgr_t *zmgr, isc_uint32_t value);
-/*
+/*%<
  *	Set the number of zone transfers allowed per nameserver.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager
+ *\li	'zmgr' to be a valid zone manager
  */
 
 isc_uint32_t
 dns_zonemgr_getttransfersperns(dns_zonemgr_t *zmgr);
-/*
+/*%<
  *	Return the number of transfers allowed per nameserver.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
+ *\li	'zmgr' to be a valid zone manager.
  */
 
 void
 dns_zonemgr_setiolimit(dns_zonemgr_t *zmgr, isc_uint32_t iolimit);
-/*
+/*%<
  *	Set the number of simultaneous file descriptors available for 
  *	reading and writing masterfiles.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
- *	'iolimit' to be positive.
+ *\li	'zmgr' to be a valid zone manager.
+ *\li	'iolimit' to be positive.
  */
 
 isc_uint32_t
 dns_zonemgr_getiolimit(dns_zonemgr_t *zmgr);
-/*
+/*%<
  *	Get the number of simultaneous file descriptors available for 
  *	reading and writing masterfiles.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
+ *\li	'zmgr' to be a valid zone manager.
  */
 
 void
 dns_zonemgr_setserialqueryrate(dns_zonemgr_t *zmgr, unsigned int value);
-/*
+/*%<
  *	Set the number of SOA queries sent per second.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager
+ *\li	'zmgr' to be a valid zone manager
  */
 
 unsigned int
 dns_zonemgr_getserialqueryrate(dns_zonemgr_t *zmgr);
-/*
+/*%<
  *	Return the number of SOA queries sent per second.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
+ *\li	'zmgr' to be a valid zone manager.
  */
 
 unsigned int
 dns_zonemgr_getcount(dns_zonemgr_t *zmgr, int state);
-/*
+/*%<
  *	Returns the number of zones in the specified state.
  *
  * Requires:
- *	'zmgr' to be a valid zone manager.
- *	'state' to be a valid DNS_ZONESTATE_ constant.
+ *\li	'zmgr' to be a valid zone manager.
+ *\li	'state' to be a valid DNS_ZONESTATE_ constant.
  */
 
 void
 dns_zone_forcereload(dns_zone_t *zone);
-/*
+/*%<
  *      Force a reload of specified zone.
  *
  * Requires:
- *      'zone' to be a valid zone.
+ *\li      'zone' to be a valid zone.
  */
 
 isc_boolean_t
 dns_zone_isforced(dns_zone_t *zone);
-/*
+/*%<
  *      Check if the zone is waiting a forced reload.
  *
  * Requires:
- *      'zone' to be a valid zone.
+ * \li     'zone' to be a valid zone.
  */
 
 isc_result_t
 dns_zone_setstatistics(dns_zone_t *zone, isc_boolean_t on);
-/*
+/*%<
  *      Make the zone keep or not keep an array of statistics
  * 	counter.
  *
  * Requires:
- *      zone be a valid zone.
+ *   \li   zone be a valid zone.
  */
 
 isc_uint64_t *
 dns_zone_getstatscounters(dns_zone_t *zone);
-/*
+/*%<
  * Requires:
  *      zone be a valid zone.
  *
  * Returns:
- *      A pointer to the zone's array of statistics counters,
+ * \li     A pointer to the zone's array of statistics counters,
  *	or NULL if it has none.
  */
 
 void
 dns_zone_dialup(dns_zone_t *zone);
-/*
+/*%<
  * Perform dialup-time maintenance on 'zone'.
  */
 
 void
 dns_zone_setdialup(dns_zone_t *zone, dns_dialuptype_t dialup);
-/*
+/*%<
  * Set the dialup type of 'zone' to 'dialup'.
  *
  * Requires:
- * 	'zone' to be valid initialised zone.
- *	'dialup' to be a valid dialup type.
+ * \li	'zone' to be valid initialised zone.
+ *\li	'dialup' to be a valid dialup type.
  */
 
 void
 dns_zone_log(dns_zone_t *zone, int level, const char *msg, ...)
 	ISC_FORMAT_PRINTF(3, 4);
-/*
+/*%<
  * Log the message 'msg...' at 'level', including text that identifies
  * the message as applying to 'zone'.
  */
@@ -1405,19 +1475,19 @@ dns_zone_log(dns_zone_t *zone, int level, const char *msg, ...)
 void
 dns_zone_logc(dns_zone_t *zone, isc_logcategory_t *category, int level,
 	      const char *msg, ...) ISC_FORMAT_PRINTF(4, 5);
-/*
+/*%<
  * Log the message 'msg...' at 'level', including text that identifies
  * the message as applying to 'zone'.
  */
 
 void
 dns_zone_name(dns_zone_t *zone, char *buf, size_t len);
-/*
+/*%<
  * Return the name of the zone with class and view.
  * 
  * Requires:
- *	'zone' to be valid.
- *	'buf' to be non NULL.
+ *\li	'zone' to be valid.
+ *\li	'buf' to be non NULL.
  */
 
 isc_result_t
@@ -1436,6 +1506,81 @@ dns_zone_checknames(dns_zone_t *zone, dns_name_t *name, dns_rdata_t *rdata);
  *	DNS_R_BADNAME		failed rdata checks.
  */
 
+void
+dns_zone_setacache(dns_zone_t *zone, dns_acache_t *acache);
+/*
+ *	Associate the zone with an additional cache.
+ *
+ * Require:
+ *	'zone' to be a valid zone.
+ *	'acache' to be a non NULL pointer.
+ *
+ * Ensures:
+ *	'zone' will have a reference to 'acache'
+ */
+
+void
+dns_zone_setcheckmx(dns_zone_t *zone, dns_checkmxfunc_t checkmx);
+/*
+ *	Set the post load integrity callback function 'checkmx'.
+ *	'checkmx' will be called if the MX is not within the zone.
+ *
+ * Require:
+ *	'zone' to be a valid zone.
+ */
+
+void
+dns_zone_setchecksrv(dns_zone_t *zone, dns_checkmxfunc_t checksrv);
+/*
+ *	Set the post load integrity callback function 'checksrv'.
+ *	'checksrv' will be called if the SRV TARGET is not within the zone.
+ *
+ * Require:
+ *	'zone' to be a valid zone.
+ */
+
+void
+dns_zone_setcheckns(dns_zone_t *zone, dns_checknsfunc_t checkns);
+/*
+ *	Set the post load integrity callback function 'checkmx'.
+ *	'checkmx' will be called if the MX is not within the zone.
+ *
+ * Require:
+ *	'zone' to be a valid zone.
+ */
+
+void
+dns_zone_setnotifydelay(dns_zone_t *zone, isc_uint32_t delay);
+/*
+ * Set the minimum delay between sets of notify messages.
+ *
+ * Requires:
+ *	'zone' to be valid.
+ */
+
+isc_uint32_t
+dns_zone_getnotifydelay(dns_zone_t *zone);
+/*
+ * Get the minimum delay between sets of notify messages.
+ *
+ * Requires:
+ *	'zone' to be valid.
+ */
+
+void
+dns_zone_setisself(dns_zone_t *zone, dns_isselffunc_t isself, void *arg);
+/*
+ * Set the isself callback function and argument.
+ *
+ * isc_boolean_t
+ * isself(dns_view_t *myview, dns_tsigkey_t *mykey, isc_netaddr_t *srcaddr,
+ *	  isc_netaddr_t *destaddr, dns_rdataclass_t rdclass, void *arg);
+ *
+ * 'isself' returns ISC_TRUE if a non-recursive query from 'srcaddr' to
+ * 'destaddr' with optional key 'mykey' for class 'rdclass' would be
+ * delivered to 'myview'.
+ */
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_ZONE_H */
diff --git a/contrib/bind9/lib/dns/include/dns/zonekey.h b/contrib/bind9/lib/dns/include/dns/zonekey.h
index 1ac9066..ba4e076 100644
--- a/contrib/bind9/lib/dns/include/dns/zonekey.h
+++ b/contrib/bind9/lib/dns/include/dns/zonekey.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zonekey.h,v 1.3.206.1 2004/03/06 08:14:01 marka Exp $ */
+/* $Id: zonekey.h,v 1.4.18.2 2005/04/29 00:16:26 marka Exp $ */
 
 #ifndef DNS_ZONEKEY_H
 #define DNS_ZONEKEY_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -28,7 +30,7 @@ ISC_LANG_BEGINDECLS
 
 isc_boolean_t
 dns_zonekey_iszonekey(dns_rdata_t *keyrdata);
-/*
+/*%<
  *	Determines if the key record contained in the rdata is a zone key.
  *
  *	Requires:
diff --git a/contrib/bind9/lib/dns/include/dns/zt.h b/contrib/bind9/lib/dns/include/dns/zt.h
index fb43590..436ef4c 100644
--- a/contrib/bind9/lib/dns/include/dns/zt.h
+++ b/contrib/bind9/lib/dns/include/dns/zt.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zt.h,v 1.27.2.2.8.1 2004/03/06 08:14:01 marka Exp $ */
+/* $Id: zt.h,v 1.30.18.3 2005/04/27 05:01:42 sra Exp $ */
 
 #ifndef DNS_ZT_H
 #define DNS_ZT_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -30,101 +32,101 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **zt);
-/*
+/*%<
  * Creates a new zone table.
  *
  * Requires:
- * 	'mctx' to be initialized.
+ * \li	'mctx' to be initialized.
  *
  * Returns:
- *	ISC_R_SUCCESS on success.
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS on success.
+ * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_zt_mount(dns_zt_t *zt, dns_zone_t *zone);
-/*
+/*%<
  * Mounts the zone on the zone table.
  *
  * Requires:
- *	'zt' to be valid
- *	'zone' to be valid
+ * \li	'zt' to be valid
+ * \li	'zone' to be valid
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_EXISTS
- *	ISC_R_NOSPACE
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_EXISTS
+ * \li	#ISC_R_NOSPACE
+ * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_zt_unmount(dns_zt_t *zt, dns_zone_t *zone);
-/*
+/*%<
  * Unmount the given zone from the table.
  *
  * Requires:
  * 	'zt' to be valid
- *	'zone' to be valid
+ * \li	'zone' to be valid
  *
  * Returns:
- * 	ISC_R_SUCCESS
- *	ISC_R_NOTFOUND
- *	ISC_R_NOMEMORY
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND
+ * \li	#ISC_R_NOMEMORY
  */
 
 isc_result_t
 dns_zt_find(dns_zt_t *zt, dns_name_t *name, unsigned int options,
 	    dns_name_t *foundname, dns_zone_t **zone);
-/*
+/*%<
  * Find the best match for 'name' in 'zt'.  If foundname is non NULL
  * then the name of the zone found is returned.
  *
  * Notes:
- *	If the DNS_ZTFIND_NOEXACT is set, the best partial match (if any)
+ * \li	If the DNS_ZTFIND_NOEXACT is set, the best partial match (if any)
  *	to 'name' will be returned.
  *
  * Requires:
- *	'zt' to be valid
- *	'name' to be valid
- *	'foundname' to be initialized and associated with a fixedname or NULL
- *	'zone' to be non NULL and '*zone' to be NULL
+ * \li	'zt' to be valid
+ * \li	'name' to be valid
+ * \li	'foundname' to be initialized and associated with a fixedname or NULL
+ * \li	'zone' to be non NULL and '*zone' to be NULL
  *
  * Returns:
- * 	ISC_R_SUCCESS
- *	DNS_R_PARTIALMATCH
- *	ISC_R_NOTFOUND
- *	ISC_R_NOSPACE
+ * \li	#ISC_R_SUCCESS
+ * \li	#DNS_R_PARTIALMATCH
+ * \li	#ISC_R_NOTFOUND
+ * \li	#ISC_R_NOSPACE
  */
 
 void
 dns_zt_detach(dns_zt_t **ztp);
-/*
+/*%<
  * Detach the given zonetable, if the reference count goes to zero the
  * zonetable will be freed.  In either case 'ztp' is set to NULL.
  *
  * Requires:
- *	'*ztp' to be valid
+ * \li	'*ztp' to be valid
  */
 
 void
 dns_zt_flushanddetach(dns_zt_t **ztp);
-/*
+/*%<
  * Detach the given zonetable, if the reference count goes to zero the
  * zonetable will be flushed and then freed.  In either case 'ztp' is
  * set to NULL.
  *
  * Requires:
- *	'*ztp' to be valid
+ * \li	'*ztp' to be valid
  */
 
 void
 dns_zt_attach(dns_zt_t *zt, dns_zt_t **ztp);
-/*
+/*%<
  * Attach 'zt' to '*ztp'.
  *
  * Requires:
- *	'zt' to be valid
- *	'*ztp' to be NULL
+ * \li	'zt' to be valid
+ * \li	'*ztp' to be NULL
  */
 
 isc_result_t
@@ -132,7 +134,7 @@ dns_zt_load(dns_zt_t *zt, isc_boolean_t stop);
 
 isc_result_t
 dns_zt_loadnew(dns_zt_t *zt, isc_boolean_t stop);
-/*
+/*%<
  * Load all zones in the table.  If 'stop' is ISC_TRUE,
  * stop on the first error and return it.  If 'stop'
  * is ISC_FALSE, ignore errors.
@@ -142,23 +144,37 @@ dns_zt_loadnew(dns_zt_t *zt, isc_boolean_t stop);
  * and whose master file has changed since the last load.
  *
  * Requires:
- *	'zt' to be valid
+ * \li	'zt' to be valid
+ */
+
+isc_result_t
+dns_zt_freezezones(dns_zt_t *zt, isc_boolean_t freeze);
+/*%<
+ * Freeze/thaw updates to master zones.
+ * Any pending updates will be flushed.
+ * Zones will be reloaded on thaw.
  */
 
 isc_result_t
 dns_zt_apply(dns_zt_t *zt, isc_boolean_t stop,
 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap);
-/*
+
+isc_result_t
+dns_zt_apply2(dns_zt_t *zt, isc_boolean_t stop, isc_result_t *sub,
+	      isc_result_t (*action)(dns_zone_t *, void *), void *uap);
+/*%<
  * Apply a given 'action' to all zone zones in the table.
  * If 'stop' is 'ISC_TRUE' then walking the zone tree will stop if
  * 'action' does not return ISC_R_SUCCESS.
  *
  * Requires:
- *	'zt' to be valid.
- *	'action' to be non NULL.
+ * \li	'zt' to be valid.
+ * \li	'action' to be non NULL.
  *
  * Returns:
- *	ISC_R_SUCCESS if action was applied to all nodes.
+ * \li	ISC_R_SUCCESS if action was applied to all nodes.  If 'stop' is
+ *	ISC_FALSE and 'sub' is non NULL then the first error (if any)
+ *	reported by 'action' is returned in '*sub';
  *	any error code from 'action'.
  */
 
diff --git a/contrib/bind9/lib/dns/include/dst/Makefile.in b/contrib/bind9/lib/dns/include/dst/Makefile.in
index efebfaa..deaa221 100644
--- a/contrib/bind9/lib/dns/include/dst/Makefile.in
+++ b/contrib/bind9/lib/dns/include/dst/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.1.4.1 2004/12/09 04:07:19 marka Exp $
+# $Id: Makefile.in,v 1.1.6.1 2004/12/09 04:41:47 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/dns/include/dst/dst.h b/contrib/bind9/lib/dns/include/dst/dst.h
index 1629da5..8d99186 100644
--- a/contrib/bind9/lib/dns/include/dst/dst.h
+++ b/contrib/bind9/lib/dns/include/dst/dst.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst.h,v 1.1.4.1 2004/12/09 04:07:19 marka Exp $ */
+/* $Id: dst.h,v 1.1.6.5 2006/01/27 23:57:44 marka Exp $ */
 
 #ifndef DST_DST_H
 #define DST_DST_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <dns/types.h>
@@ -30,7 +32,7 @@ ISC_LANG_BEGINDECLS
  *** Types
  ***/
 
-/*
+/*%
  * The dst_key structure is opaque.  Applications should use the accessor
  * functions provided to retrieve key attributes.  If an application needs
  * to set attributes, new accessor functions will be written.
@@ -42,27 +44,32 @@ typedef struct dst_context 	dst_context_t;
 /* DST algorithm codes */
 #define DST_ALG_UNKNOWN		0
 #define DST_ALG_RSAMD5		1
-#define DST_ALG_RSA		DST_ALG_RSAMD5	/* backwards compatibility */
+#define DST_ALG_RSA		DST_ALG_RSAMD5	/*%< backwards compatibility */
 #define DST_ALG_DH		2
 #define DST_ALG_DSA		3
 #define DST_ALG_ECC		4
 #define DST_ALG_RSASHA1		5
 #define DST_ALG_HMACMD5		157
 #define DST_ALG_GSSAPI		160
+#define DST_ALG_HMACSHA1	161	/* XXXMPA */
+#define DST_ALG_HMACSHA224	162	/* XXXMPA */
+#define DST_ALG_HMACSHA256	163	/* XXXMPA */
+#define DST_ALG_HMACSHA384	164	/* XXXMPA */
+#define DST_ALG_HMACSHA512	165	/* XXXMPA */
 #define DST_ALG_PRIVATE		254
 #define DST_ALG_EXPAND		255
 #define DST_MAX_ALGS		255
 
-/* A buffer of this size is large enough to hold any key */
+/*% A buffer of this size is large enough to hold any key */
 #define DST_KEY_MAXSIZE		1280
 
-/*
+/*%
  * A buffer of this size is large enough to hold the textual representation
  * of any key
  */
 #define DST_KEY_MAXTEXTSIZE	2048
 
-/* 'Type' for dst_read_key() */
+/*% 'Type' for dst_read_key() */
 #define DST_TYPE_KEY		0x1000000	/* KEY key */
 #define DST_TYPE_PRIVATE	0x2000000
 #define DST_TYPE_PUBLIC		0x4000000
@@ -73,239 +80,262 @@ typedef struct dst_context 	dst_context_t;
 
 isc_result_t
 dst_lib_init(isc_mem_t *mctx, isc_entropy_t *ectx, unsigned int eflags);
-/*
+/*%<
  * Initializes the DST subsystem.
  *
  * Requires:
- * 	"mctx" is a valid memory context
- * 	"ectx" is a valid entropy context
+ * \li 	"mctx" is a valid memory context
+ * \li	"ectx" is a valid entropy context
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	ISC_R_NOMEMORY
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOMEMORY
  *
  * Ensures:
- * 	DST is properly initialized.
+ * \li	DST is properly initialized.
  */
 
 void
 dst_lib_destroy(void);
-/*
+/*%<
  * Releases all resources allocated by DST.
  */
 
 isc_boolean_t
 dst_algorithm_supported(unsigned int alg);
-/*
+/*%<
  * Checks that a given algorithm is supported by DST.
  *
  * Returns:
- * 	ISC_TRUE
- * 	ISC_FALSE
+ * \li	ISC_TRUE
+ * \li	ISC_FALSE
  */
 
 isc_result_t
 dst_context_create(dst_key_t *key, isc_mem_t *mctx, dst_context_t **dctxp);
-/*
+/*%<
  * Creates a context to be used for a sign or verify operation.
  *
  * Requires:
- *	"key" is a valid key.
- * 	"mctx" is a valid memory context.
- * 	dctxp != NULL && *dctxp == NULL
+ * \li	"key" is a valid key.
+ * \li	"mctx" is a valid memory context.
+ * \li	dctxp != NULL && *dctxp == NULL
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	ISC_R_NOMEMORY
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOMEMORY
  *
  * Ensures:
- *	*dctxp will contain a usable context.
+ * \li	*dctxp will contain a usable context.
  */
 
 void
 dst_context_destroy(dst_context_t **dctxp);
-/*
+/*%<
  * Destroys all memory associated with a context.
  *
  * Requires:
- * 	*dctxp != NULL && *dctxp == NULL
+ * \li	*dctxp != NULL && *dctxp == NULL
  *
  * Ensures:
- *	*dctxp == NULL
+ * \li	*dctxp == NULL
  */
 
 isc_result_t
 dst_context_adddata(dst_context_t *dctx, const isc_region_t *data);
-/*
+/*%<
  * Incrementally adds data to the context to be used in a sign or verify
  * operation.
  *
  * Requires:
- * 	"dctx" is a valid context
- * 	"data" is a valid region
+ * \li	"dctx" is a valid context
+ * \li	"data" is a valid region
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	DST_R_SIGNFAILURE
- * 	all other errors indicate failure
+ * \li	ISC_R_SUCCESS
+ * \li	DST_R_SIGNFAILURE
+ * \li	all other errors indicate failure
  */
 
 isc_result_t
 dst_context_sign(dst_context_t *dctx, isc_buffer_t *sig);
-/*
+/*%<
  * Computes a signature using the data and key stored in the context.
  *
  * Requires:
- * 	"dctx" is a valid context.
- *	"sig" is a valid buffer.
+ * \li	"dctx" is a valid context.
+ * \li	"sig" is a valid buffer.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	DST_R_VERIFYFAILURE
- * 	all other errors indicate failure
+ * \li	ISC_R_SUCCESS
+ * \li	DST_R_VERIFYFAILURE
+ * \li	all other errors indicate failure
  *
  * Ensures:
- *	"sig" will contain the signature
+ * \li	"sig" will contain the signature
  */
 
 isc_result_t
 dst_context_verify(dst_context_t *dctx, isc_region_t *sig);
-/*
+/*%<
  * Verifies the signature using the data and key stored in the context.
  *
  * Requires:
- * 	"dctx" is a valid context.
- *	"sig" is a valid region.
+ * \li	"dctx" is a valid context.
+ * \li	"sig" is a valid region.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	all other errors indicate failure
+ * \li	ISC_R_SUCCESS
+ * \li	all other errors indicate failure
  *
  * Ensures:
- *	"sig" will contain the signature
+ * \li	"sig" will contain the signature
  */
 
 isc_result_t
 dst_key_computesecret(const dst_key_t *pub, const dst_key_t *priv,
 		      isc_buffer_t *secret);
-/*
+/*%<
  * Computes a shared secret from two (Diffie-Hellman) keys.
  *
  * Requires:
- *     "pub" is a valid key that can be used to derive a shared secret
- *     "priv" is a valid private key that can be used to derive a shared secret
- *     "secret" is a valid buffer
+ * \li	"pub" is a valid key that can be used to derive a shared secret
+ * \li	"priv" is a valid private key that can be used to derive a shared secret
+ * \li	"secret" is a valid buffer
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ * \li	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *      If successful, secret will contain the derived shared secret.
+ * \li	If successful, secret will contain the derived shared secret.
  */
 
 isc_result_t
 dst_key_fromfile(dns_name_t *name, dns_keytag_t id, unsigned int alg, int type,
 		 const char *directory, isc_mem_t *mctx, dst_key_t **keyp);
-/*
+/*%<
  * Reads a key from permanent storage.  The key can either be a public or
  * private key, and is specified by name, algorithm, and id.  If a private key
  * is specified, the public key must also be present.  If directory is NULL,
  * the current directory is assumed.
  *
  * Requires:
- *	"name" is a valid absolute dns name.
- *	"id" is a valid key tag identifier.
- *	"alg" is a supported key algorithm.
- *	"type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union.
+ * \li	"name" is a valid absolute dns name.
+ * \li	"id" is a valid key tag identifier.
+ * \li	"alg" is a supported key algorithm.
+ * \li	"type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union.
  *		  DST_TYPE_KEY look for a KEY record otherwise DNSKEY
- *	"mctx" is a valid memory context.
- *	"keyp" is not NULL and "*keyp" is NULL.
+ * \li	"mctx" is a valid memory context.
+ * \li	"keyp" is not NULL and "*keyp" is NULL.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ * \li	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, *keyp will contain a valid key.
+ * \li	If successful, *keyp will contain a valid key.
  */
 
 isc_result_t
 dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx,
 		      dst_key_t **keyp);
-/*
+/*%<
  * Reads a key from permanent storage.  The key can either be a public or
  * key, and is specified by filename.  If a private key is specified, the
  * public key must also be present.
  *
  * Requires:
- * 	"filename" is not NULL
- *	"type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union
+ * \li	"filename" is not NULL
+ * \li	"type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union
  *		  DST_TYPE_KEY look for a KEY record otherwise DNSKEY
- *	"mctx" is a valid memory context
- *	"keyp" is not NULL and "*keyp" is NULL.
+ * \li	"mctx" is a valid memory context
+ * \li	"keyp" is not NULL and "*keyp" is NULL.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ * \li	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, *keyp will contain a valid key.
+ * \li	If successful, *keyp will contain a valid key.
+ */
+
+
+isc_result_t
+dst_key_read_public(const char *filename, int type,
+		    isc_mem_t *mctx, dst_key_t **keyp);
+/*%<
+ * Reads a public key from permanent storage.  The key must be a public key.
+ *
+ * Requires:
+ * \li	"filename" is not NULL
+ * \li	"type" is DST_TYPE_KEY look for a KEY record otherwise DNSKEY
+ * \li	"mctx" is a valid memory context
+ * \li	"keyp" is not NULL and "*keyp" is NULL.
+ *
+ * Returns:
+ * \li	ISC_R_SUCCESS
+ * \li	DST_R_BADKEYTYPE if the key type is not the expected one
+ * \li	ISC_R_UNEXPECTEDTOKEN if the file can not be parsed as a public key
+ * \li	any other result indicates failure
+ *
+ * Ensures:
+ * \li	If successful, *keyp will contain a valid key.
  */
 
 isc_result_t
 dst_key_tofile(const dst_key_t *key, int type, const char *directory);
-/*
+/*%<
  * Writes a key to permanent storage.  The key can either be a public or
  * private key.  Public keys are written in DNS format and private keys
  * are written as a set of base64 encoded values.  If directory is NULL,
  * the current directory is assumed.
  *
  * Requires:
- *	"key" is a valid key.
- *	"type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union
+ * \li	"key" is a valid key.
+ * \li	"type" is DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or the bitwise union
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ * \li	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  */
 
 isc_result_t
 dst_key_fromdns(dns_name_t *name, dns_rdataclass_t rdclass,
 		isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
-/*
+/*%<
  * Converts a DNS KEY record into a DST key.
  *
  * Requires:
- *	"name" is a valid absolute dns name.
- *	"source" is a valid buffer.  There must be at least 4 bytes available.
- *	"mctx" is a valid memory context.
- *	"keyp" is not NULL and "*keyp" is NULL.
+ * \li	"name" is a valid absolute dns name.
+ * \li	"source" is a valid buffer.  There must be at least 4 bytes available.
+ * \li	"mctx" is a valid memory context.
+ * \li	"keyp" is not NULL and "*keyp" is NULL.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ * \li	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, *keyp will contain a valid key, and the consumed
+ * \li	If successful, *keyp will contain a valid key, and the consumed
  *	pointer in data will be advanced.
  */
 
 isc_result_t
 dst_key_todns(const dst_key_t *key, isc_buffer_t *target);
-/*
+/*%<
  * Converts a DST key into a DNS KEY record.
  *
  * Requires:
- *	"key" is a valid key.
- *	"target" is a valid buffer.  There must be at least 4 bytes unused.
+ * \li	"key" is a valid key.
+ * \li	"target" is a valid buffer.  There must be at least 4 bytes unused.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ * \li	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, the used pointer in 'target' is advanced by at least 4.
+ * \li	If successful, the used pointer in 'target' is advanced by at least 4.
  */
 
 isc_result_t
@@ -313,80 +343,80 @@ dst_key_frombuffer(dns_name_t *name, unsigned int alg,
 		   unsigned int flags, unsigned int protocol,
 		   dns_rdataclass_t rdclass,
 		   isc_buffer_t *source, isc_mem_t *mctx, dst_key_t **keyp);
-/*
+/*%<
  * Converts a buffer containing DNS KEY RDATA into a DST key.
  *
  * Requires:
- *	"name" is a valid absolute dns name.
- *	"alg" is a supported key algorithm.
- *	"source" is a valid buffer.
- *	"mctx" is a valid memory context.
- *	"keyp" is not NULL and "*keyp" is NULL.
+ *\li	"name" is a valid absolute dns name.
+ *\li	"alg" is a supported key algorithm.
+ *\li	"source" is a valid buffer.
+ *\li	"mctx" is a valid memory context.
+ *\li	"keyp" is not NULL and "*keyp" is NULL.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ *\li 	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, *keyp will contain a valid key, and the consumed
+ *\li	If successful, *keyp will contain a valid key, and the consumed
  *	pointer in source will be advanced.
  */
 
 isc_result_t
 dst_key_tobuffer(const dst_key_t *key, isc_buffer_t *target);
-/*
+/*%<
  * Converts a DST key into DNS KEY RDATA format.
  *
  * Requires:
- *	"key" is a valid key.
- *	"target" is a valid buffer.
+ *\li	"key" is a valid key.
+ *\li	"target" is a valid buffer.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ *\li 	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, the used pointer in 'target' is advanced.
+ *\li	If successful, the used pointer in 'target' is advanced.
  */
 
 isc_result_t
 dst_key_privatefrombuffer(dst_key_t *key, isc_buffer_t *buffer);
-/*
+/*%<
  * Converts a public key into a private key, reading the private key
  * information from the buffer.  The buffer should contain the same data
  * as the .private key file would.
  *
  * Requires:
- * 	"key" is a valid public key.
- *	"buffer" is not NULL.
+ *\li	"key" is a valid public key.
+ *\li	"buffer" is not NULL.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ *\li 	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, key will contain a valid private key.
+ *\li	If successful, key will contain a valid private key.
  */
 
 
 isc_result_t
 dst_key_fromgssapi(dns_name_t *name, void *opaque, isc_mem_t *mctx,
 		                   dst_key_t **keyp);
-/*
+/*%<
  * Converts a GSSAPI opaque context id into a DST key.
  *
  * Requires:
- *	"name" is a valid absolute dns name.
- *	"opaque" is a GSSAPI context id.
- *	"mctx" is a valid memory context.
- *	"keyp" is not NULL and "*keyp" is NULL.
+ *\li	"name" is a valid absolute dns name.
+ *\li	"opaque" is a GSSAPI context id.
+ *\li	"mctx" is a valid memory context.
+ *\li	"keyp" is not NULL and "*keyp" is NULL.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ *\li 	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, *keyp will contain a valid key and be responsible for
+ *\li	If successful, *keyp will contain a valid key and be responsible for
  *	the context id.
  */
 
@@ -396,9 +426,10 @@ dst_key_generate(dns_name_t *name, unsigned int alg,
 		 unsigned int flags, unsigned int protocol,
 		 dns_rdataclass_t rdclass,
 		 isc_mem_t *mctx, dst_key_t **keyp);
-/*
+/*%<
  * Generate a DST key (or keypair) with the supplied parameters.  The
  * interpretation of the "param" field depends on the algorithm:
+ * \code
  * 	RSA:	exponent
  * 		0	use exponent 3
  * 		!0	use Fermat4 (2^16 + 1)
@@ -410,66 +441,67 @@ dst_key_generate(dns_name_t *name, unsigned int alg,
  * 	HMACMD5: entropy
  *		0	default - require good entropy
  *		!0	lack of good entropy is ok
+ *\endcode
  *
  * Requires:
- *	"name" is a valid absolute dns name.
- *	"keyp" is not NULL and "*keyp" is NULL.
+ *\li	"name" is a valid absolute dns name.
+ *\li	"keyp" is not NULL and "*keyp" is NULL.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	any other result indicates failure
+ *\li 	ISC_R_SUCCESS
+ * \li	any other result indicates failure
  *
  * Ensures:
- *	If successful, *keyp will contain a valid key.
+ *\li	If successful, *keyp will contain a valid key.
  */
 
 isc_boolean_t
 dst_key_compare(const dst_key_t *key1, const dst_key_t *key2);
-/*
+/*%<
  * Compares two DST keys.
  *
  * Requires:
- *	"key1" is a valid key.
- *	"key2" is a valid key.
+ *\li	"key1" is a valid key.
+ *\li	"key2" is a valid key.
  *
  * Returns:
- * 	ISC_TRUE
- * 	ISC_FALSE
+ *\li 	ISC_TRUE
+ * \li	ISC_FALSE
  */
 
 isc_boolean_t
 dst_key_paramcompare(const dst_key_t *key1, const dst_key_t *key2);
-/*
+/*%<
  * Compares the parameters of two DST keys.  This is used to determine if
  * two (Diffie-Hellman) keys can be used to derive a shared secret.
  *
  * Requires:
- *	"key1" is a valid key.
- *	"key2" is a valid key.
+ *\li	"key1" is a valid key.
+ *\li	"key2" is a valid key.
  *
  * Returns:
- * 	ISC_TRUE
- * 	ISC_FALSE
+ *\li 	ISC_TRUE
+ * \li	ISC_FALSE
  */
 
 void
 dst_key_free(dst_key_t **keyp);
-/*
+/*%<
  * Release all memory associated with the key.
  *
  * Requires:
- *	"keyp" is not NULL and "*keyp" is a valid key.
+ *\li	"keyp" is not NULL and "*keyp" is a valid key.
  *
  * Ensures:
- *	All memory associated with "*keyp" will be freed.
- *	*keyp == NULL
+ *\li	All memory associated with "*keyp" will be freed.
+ *\li	*keyp == NULL
  */
 
-/*
+/*%<
  * Accessor functions to obtain key fields.
  *
  * Require:
- *	"key" is a valid key.
+ *\li	"key" is a valid key.
  */
 dns_name_t *
 dst_key_name(const dst_key_t *key);
@@ -504,65 +536,83 @@ dst_key_isnullkey(const dst_key_t *key);
 isc_result_t
 dst_key_buildfilename(const dst_key_t *key, int type,
 		      const char *directory, isc_buffer_t *out);
-/*
+/*%<
  * Generates the filename used by dst to store the specified key.
  * If directory is NULL, the current directory is assumed.
  *
  * Requires:
- *	"key" is a valid key
- *	"type" is either DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or 0 for no suffix.
- *	"out" is a valid buffer
+ *\li	"key" is a valid key
+ *\li	"type" is either DST_TYPE_PUBLIC, DST_TYPE_PRIVATE, or 0 for no suffix.
+ *\li	"out" is a valid buffer
  *
  * Ensures:
- *	the file name will be written to "out", and the used pointer will
+ *\li	the file name will be written to "out", and the used pointer will
  *		be advanced.
  */
 
 isc_result_t
 dst_key_sigsize(const dst_key_t *key, unsigned int *n);
-/*
+/*%<
  * Computes the size of a signature generated by the given key.
  *
  * Requires:
- *	"key" is a valid key.
- *	"n" is not NULL
+ *\li	"key" is a valid key.
+ *\li	"n" is not NULL
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	DST_R_UNSUPPORTEDALG
+ *\li	#ISC_R_SUCCESS
+ *\li	DST_R_UNSUPPORTEDALG
  *
  * Ensures:
- * 	"n" stores the size of a generated signature
+ *\li	"n" stores the size of a generated signature
  */
 
 isc_result_t
 dst_key_secretsize(const dst_key_t *key, unsigned int *n);
-/*
+/*%<
  * Computes the size of a shared secret generated by the given key.
  *
  * Requires:
- *	"key" is a valid key.
- *	"n" is not NULL
+ *\li	"key" is a valid key.
+ *\li	"n" is not NULL
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	DST_R_UNSUPPORTEDALG
+ *\li	#ISC_R_SUCCESS
+ *\li	DST_R_UNSUPPORTEDALG
  *
  * Ensures:
- * 	"n" stores the size of a generated shared secret
+ *\li	"n" stores the size of a generated shared secret
  */
 
 isc_uint16_t
 dst_region_computeid(const isc_region_t *source, unsigned int alg);
-/*
+/*%<
  * Computes the key id of the key stored in the provided region with the
  * given algorithm.
  *
  * Requires:
- * 	"source" contains a valid, non-NULL region.
+ *\li	"source" contains a valid, non-NULL region.
  *
  * Returns:
- * 	the key id
+ *\li 	the key id
+ */
+
+isc_uint16_t
+dst_key_getbits(const dst_key_t *key);
+/*
+ * Get the number of digest bits required (0 == MAX).
+ *
+ * Requires:
+ *	"key" is a valid key.
+ */
+
+void
+dst_key_setbits(dst_key_t *key, isc_uint16_t bits);
+/*
+ * Set the number of digest bits required (0 == MAX).
+ *
+ * Requires:
+ *	"key" is a valid key.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/dns/include/dst/gssapi.h b/contrib/bind9/lib/dns/include/dst/gssapi.h
index 1d74656..e30fb0c 100644
--- a/contrib/bind9/lib/dns/include/dst/gssapi.h
+++ b/contrib/bind9/lib/dns/include/dst/gssapi.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gssapi.h,v 1.1.4.1 2004/12/09 04:07:20 marka Exp $ */
+/* $Id: gssapi.h,v 1.1.6.3 2005/04/29 00:16:28 marka Exp $ */
 
 #ifndef DST_GSSAPI_H
 #define DST_GSSAPI_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 #include <isc/types.h>
diff --git a/contrib/bind9/lib/dns/include/dst/lib.h b/contrib/bind9/lib/dns/include/dst/lib.h
index 7a8e73e..bd71261 100644
--- a/contrib/bind9/lib/dns/include/dst/lib.h
+++ b/contrib/bind9/lib/dns/include/dst/lib.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lib.h,v 1.1.4.1 2004/12/09 04:07:20 marka Exp $ */
+/* $Id: lib.h,v 1.1.6.3 2005/04/29 00:16:29 marka Exp $ */
 
 #ifndef DST_LIB_H
 #define DST_LIB_H 1
 
+/*! \file */
+
 #include <isc/types.h>
 #include <isc/lang.h>
 
diff --git a/contrib/bind9/lib/dns/include/dst/result.h b/contrib/bind9/lib/dns/include/dst/result.h
index 015e086..aa03b73 100644
--- a/contrib/bind9/lib/dns/include/dst/result.h
+++ b/contrib/bind9/lib/dns/include/dst/result.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.h,v 1.1.4.1 2004/12/09 04:07:20 marka Exp $ */
+/* $Id: result.h,v 1.1.6.3 2005/04/29 00:16:29 marka Exp $ */
 
 #ifndef DST_RESULT_H
 #define DST_RESULT_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/resultclass.h>
 
diff --git a/contrib/bind9/lib/dns/journal.c b/contrib/bind9/lib/dns/journal.c
index 536416d..1f208c8 100644
--- a/contrib/bind9/lib/dns/journal.c
+++ b/contrib/bind9/lib/dns/journal.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: journal.c,v 1.77.2.1.10.13 2005/11/03 23:08:41 marka Exp $ */
+/* $Id: journal.c,v 1.86.18.8 2005/11/03 23:02:23 marka Exp $ */
 
 #include <config.h>
 
@@ -40,7 +40,44 @@
 #include <dns/result.h>
 #include <dns/soa.h>
 
-/*
+/*! \file 
+ * \brief Journalling.
+ *
+ * A journal file consists of
+ *
+ *   \li A fixed-size header of type journal_rawheader_t.
+ *
+ *   \li The index.  This is an unordered array of index entries
+ *     of type journal_rawpos_t giving the locations
+ *     of some arbitrary subset of the journal's addressable
+ *     transactions.  The index entries are used as hints to
+ *     speed up the process of locating a transaction with a given
+ *     serial number.  Unused index entries have an "offset"
+ *     field of zero.  The size of the index can vary between
+ *     journal files, but does not change during the lifetime
+ *     of a file.  The size can be zero.
+ *
+ *   \li The journal data.  This  consists of one or more transactions.
+ *     Each transaction begins with a transaction header of type
+ *     journal_rawxhdr_t.  The transaction header is followed by a
+ *     sequence of RRs, similar in structure to an IXFR difference
+ *     sequence (RFC1995).  That is, the pre-transaction SOA,
+ *     zero or more other deleted RRs, the post-transaction SOA,
+ *     and zero or more other added RRs.  Unlike in IXFR, each RR
+ *     is prefixed with a 32-bit length.
+ *
+ *     The journal data part grows as new transactions are
+ *     appended to the file.  Only those transactions
+ *     whose serial number is current-(2^31-1) to current
+ *     are considered "addressable" and may be pointed
+ *     to from the header or index.  They may be preceded
+ *     by old transactions that are no longer addressable,
+ *     and they may be followed by transactions that were
+ *     appended to the journal but never committed by updating
+ *     the "end" position in the header.  The latter will
+ *     be overwritten when new transactions are added.
+ */
+/*%
  * When true, accept IXFR difference sequences where the
  * SOA serial number does not change (BIND 8 sends such
  * sequences).
@@ -58,7 +95,7 @@ static isc_boolean_t bind8_compat = ISC_TRUE; /* XXX config */
 #define JOURNAL_DEBUG_LOGARGS(n) \
 	JOURNAL_COMMON_LOGARGS, ISC_LOG_DEBUG(n)
 
-/*
+/*%
  * It would be non-sensical (or at least obtuse) to use FAIL() with an
  * ISC_R_SUCCESS code, but the test is there to keep the Solaris compiler
  * from complaining about "end-of-loop code not reached".
@@ -134,55 +171,16 @@ dns_db_createsoatuple(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 	return (result);
 }
 
-/**************************************************************************/
-/*
- * Journalling.
- */
+/* Journalling */
 
-/*
- * A journal file consists of
- *
- *   - A fixed-size header of type journal_rawheader_t.
- *
- *   - The index.  This is an unordered array of index entries
- *     of type journal_rawpos_t giving the locations
- *     of some arbitrary subset of the journal's addressable
- *     transactions.  The index entries are used as hints to
- *     speed up the process of locating a transaction with a given
- *     serial number.  Unused index entries have an "offset"
- *     field of zero.  The size of the index can vary between
- *     journal files, but does not change during the lifetime
- *     of a file.  The size can be zero.
- *
- *   - The journal data.  This  consists of one or more transactions.
- *     Each transaction begins with a transaction header of type
- *     journal_rawxhdr_t.  The transaction header is followed by a
- *     sequence of RRs, similar in structure to an IXFR difference
- *     sequence (RFC1995).  That is, the pre-transaction SOA,
- *     zero or more other deleted RRs, the post-transaction SOA,
- *     and zero or more other added RRs.  Unlike in IXFR, each RR
- *     is prefixed with a 32-bit length.
- *
- *     The journal data part grows as new transactions are
- *     appended to the file.  Only those transactions
- *     whose serial number is current-(2^31-1) to current
- *     are considered "addressable" and may be pointed
- *     to from the header or index.  They may be preceded
- *     by old transactions that are no longer addressable,
- *     and they may be followed by transactions that were
- *     appended to the journal but never committed by updating
- *     the "end" position in the header.  The latter will
- *     be overwritten when new transactions are added.
- */
-
-/*
+/*%
  * On-disk representation of a "pointer" to a journal entry.
  * These are used in the journal header to locate the beginning
  * and end of the journal, and in the journal index to locate
  * other transactions.
  */
 typedef struct {
-	unsigned char	serial[4];  /* SOA serial before update. */
+	unsigned char	serial[4];  /*%< SOA serial before update. */
 	/*
 	 * XXXRTH  Should offset be 8 bytes?
 	 * XXXDCL ... probably, since isc_offset_t is 8 bytes on many OSs.
@@ -190,54 +188,54 @@ typedef struct {
 	 *            platforms as long as we are using fseek() rather
 	 *            than lseek().
 	 */
-	unsigned char	offset[4];  /* Offset from beginning of file. */
+	unsigned char	offset[4];  /*%< Offset from beginning of file. */
 } journal_rawpos_t;
 
-/*
- * The on-disk representation of the journal header.
- * All numbers are stored in big-endian order.
- */
 
-/*
+/*%
  * The header is of a fixed size, with some spare room for future
  * extensions.
  */
 #define JOURNAL_HEADER_SIZE 64 /* Bytes. */
 
+/*%
+ * The on-disk representation of the journal header.
+ * All numbers are stored in big-endian order.
+ */
 typedef union {
 	struct {
-		/* File format version ID. */
+		/*% File format version ID. */
 		unsigned char 		format[16];
-		/* Position of the first addressable transaction */
+		/*% Position of the first addressable transaction */
 		journal_rawpos_t 	begin;
-		/* Position of the next (yet nonexistent) transaction. */
+		/*% Position of the next (yet nonexistent) transaction. */
 		journal_rawpos_t 	end;
-		/* Number of index entries following the header. */
+		/*% Number of index entries following the header. */
 		unsigned char 		index_size[4];
 	} h;
 	/* Pad the header to a fixed size. */
 	unsigned char pad[JOURNAL_HEADER_SIZE];
 } journal_rawheader_t;
 
-/*
+/*%
  * The on-disk representation of the transaction header.
  * There is one of these at the beginning of each transaction.
  */
 typedef struct {
-	unsigned char	size[4]; 	/* In bytes, excluding header. */
-	unsigned char	serial0[4];	/* SOA serial before update. */
-	unsigned char	serial1[4];	/* SOA serial after update. */
+	unsigned char	size[4]; 	/*%< In bytes, excluding header. */
+	unsigned char	serial0[4];	/*%< SOA serial before update. */
+	unsigned char	serial1[4];	/*%< SOA serial after update. */
 } journal_rawxhdr_t;
 
-/*
+/*%
  * The on-disk representation of the RR header.
  * There is one of these at the beginning of each RR.
  */
 typedef struct {
-	unsigned char	size[4]; 	/* In bytes, excluding header. */
+	unsigned char	size[4]; 	/*%< In bytes, excluding header. */
 } journal_rawrrhdr_t;
 
-/*
+/*%
  * The in-core representation of the journal header.
  */
 typedef struct {
@@ -255,7 +253,7 @@ typedef struct {
 	isc_uint32_t	index_size;
 } journal_header_t;
 
-/*
+/*%
  * The in-core representation of the transaction header.
  */
 
@@ -265,7 +263,7 @@ typedef struct {
 	isc_uint32_t	serial1;
 } journal_xhdr_t;
 
-/*
+/*%
  * The in-core representation of the RR header.
  */
 typedef struct {
@@ -273,7 +271,7 @@ typedef struct {
 } journal_rrhdr_t;
 
 
-/*
+/*%
  * Initial contents to store in the header of a newly created
  * journal file.
  *
@@ -297,40 +295,38 @@ typedef enum {
 } journal_state_t;
 
 struct dns_journal {
-	unsigned int		magic;		/* JOUR */
-	isc_mem_t		*mctx;		/* Memory context */
+	unsigned int		magic;		/*%< JOUR */
+	isc_mem_t		*mctx;		/*%< Memory context */
 	journal_state_t		state;
-	const char 		*filename;	/* Journal file name */
-	FILE *			fp;		/* File handle */
-	isc_offset_t		offset;		/* Current file offset */
-	journal_header_t 	header;		/* In-core journal header */
-	unsigned char		*rawindex;	/* In-core buffer for journal
-						   index in on-disk format */
-	journal_pos_t		*index;		/* In-core journal index */
-
-	/* Current transaction state (when writing). */
+	const char 		*filename;	/*%< Journal file name */
+	FILE *			fp;		/*%< File handle */
+	isc_offset_t		offset;		/*%< Current file offset */
+	journal_header_t 	header;		/*%< In-core journal header */
+	unsigned char		*rawindex;	/*%< In-core buffer for journal index in on-disk format */
+	journal_pos_t		*index;		/*%< In-core journal index */
+
+	/*% Current transaction state (when writing). */
 	struct {
-		unsigned int	n_soa;		/* Number of SOAs seen */
-		journal_pos_t	pos[2];		/* Begin/end position */
+		unsigned int	n_soa;		/*%< Number of SOAs seen */
+		journal_pos_t	pos[2];		/*%< Begin/end position */
 	} x;
 
-	/* Iteration state (when reading). */
+	/*% Iteration state (when reading). */
 	struct {
 		/* These define the part of the journal we iterate over. */
-		journal_pos_t bpos;		/* Position before first, */
-		journal_pos_t epos;		/* and after last
-						   transaction */
+		journal_pos_t bpos;		/*%< Position before first, */
+		journal_pos_t epos;		/*%< and after last transaction */
 		/* The rest is iterator state. */
-		isc_uint32_t current_serial;	/* Current SOA serial */
-		isc_buffer_t source;		/* Data from disk */
-		isc_buffer_t target;		/* Data from _fromwire check */
-		dns_decompress_t dctx;		/* Dummy decompression ctx */
-		dns_name_t name;		/* Current domain name */
-		dns_rdata_t rdata;		/* Current rdata */
-		isc_uint32_t ttl;		/* Current TTL */
-		unsigned int xsize;		/* Size of transaction data */
-		unsigned int xpos;		/* Current position in it */
-		isc_result_t result;		/* Result of last call */
+		isc_uint32_t current_serial;	/*%< Current SOA serial */
+		isc_buffer_t source;		/*%< Data from disk */
+		isc_buffer_t target;		/*%< Data from _fromwire check */
+		dns_decompress_t dctx;		/*%< Dummy decompression ctx */
+		dns_name_t name;		/*%< Current domain name */
+		dns_rdata_t rdata;		/*%< Current rdata */
+		isc_uint32_t ttl;		/*%< Current TTL */
+		unsigned int xsize;		/*%< Size of transaction data */
+		unsigned int xpos;		/*%< Current position in it */
+		isc_result_t result;		/*%< Result of last call */
 	} it;
 };
 
diff --git a/contrib/bind9/lib/dns/key.c b/contrib/bind9/lib/dns/key.c
index 97d970e..b0f2c0a 100644
--- a/contrib/bind9/lib/dns/key.c
+++ b/contrib/bind9/lib/dns/key.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: key.c,v 1.1.4.3 2005/06/09 23:54:29 marka Exp $ */
+/* $Id: key.c,v 1.1.6.6 2006/01/27 23:57:44 marka Exp $ */
 
 #include <config.h>
 
@@ -125,3 +125,23 @@ dst_key_isnullkey(const dst_key_t *key) {
 		return (ISC_FALSE);
 	return (ISC_TRUE);
 }
+
+void
+dst_key_setbits(dst_key_t *key, isc_uint16_t bits) {
+	unsigned int maxbits;
+	REQUIRE(VALID_KEY(key));
+	if (bits != 0) {
+		RUNTIME_CHECK(dst_key_sigsize(key, &maxbits) == ISC_R_SUCCESS);
+		maxbits *= 8;
+		REQUIRE(bits <= maxbits);
+	}
+	key->key_bits = bits;
+}
+
+isc_uint16_t
+dst_key_getbits(const dst_key_t *key) {
+	REQUIRE(VALID_KEY(key));
+	return (key->key_bits);
+}
+
+/*! \file */
diff --git a/contrib/bind9/lib/dns/keytable.c b/contrib/bind9/lib/dns/keytable.c
index 7f3e3cf..ec0f8e4 100644
--- a/contrib/bind9/lib/dns/keytable.c
+++ b/contrib/bind9/lib/dns/keytable.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keytable.c,v 1.26.12.5 2006/01/06 00:01:42 marka Exp $ */
+/* $Id: keytable.c,v 1.28.18.4 2005/12/05 00:00:03 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -87,22 +89,12 @@ dns_keytable_create(isc_mem_t *mctx, dns_keytable_t **keytablep) {
 		goto cleanup_keytable;
 
 	result = isc_mutex_init(&keytable->lock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_rbt;
-	}
 
 	result = isc_rwlock_init(&keytable->rwlock, 0, 0);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_rwlock_init() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_lock;
-	}
 
 	keytable->mctx = mctx;
 	keytable->active_nodes = 0;
diff --git a/contrib/bind9/lib/dns/lib.c b/contrib/bind9/lib/dns/lib.c
index 4449067..423908a 100644
--- a/contrib/bind9/lib/dns/lib.c
+++ b/contrib/bind9/lib/dns/lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lib.c,v 1.9.12.3 2004/03/08 09:04:30 marka Exp $ */
+/* $Id: lib.c,v 1.11.18.3 2005/08/15 01:46:50 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -31,6 +33,7 @@
  *** Globals
  ***/
 
+LIBDNS_EXTERNAL_DATA unsigned int			dns_pps = 0U;
 LIBDNS_EXTERNAL_DATA isc_msgcat_t *			dns_msgcat = NULL;
 
 
diff --git a/contrib/bind9/lib/dns/log.c b/contrib/bind9/lib/dns/log.c
index d240767..939ea36 100644
--- a/contrib/bind9/lib/dns/log.c
+++ b/contrib/bind9/lib/dns/log.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.c,v 1.33.2.2.10.3 2004/03/06 08:13:39 marka Exp $ */
+/* $Id: log.c,v 1.36.18.4 2005/09/05 00:18:24 marka Exp $ */
+
+/*! \file */
 
 /* Principal Authors: DCL */
 
@@ -25,7 +27,7 @@
 
 #include <dns/log.h>
 
-/*
+/*%
  * When adding a new category, be sure to add the appropriate
  * #define to <dns/log.h>.
  */
@@ -44,7 +46,7 @@ LIBDNS_EXTERNAL_DATA isc_logcategory_t dns_categories[] = {
 	{ NULL, 	0 }
 };
 
-/*
+/*%
  * When adding a new module, be sure to add the appropriate
  * #define to <dns/log.h>.
  */
@@ -74,6 +76,8 @@ LIBDNS_EXTERNAL_DATA isc_logmodule_t dns_modules[] = {
 	{ "dns/sdb",		0 },
 	{ "dns/diff",		0 },
 	{ "dns/hints",		0 },
+	{ "dns/acache",		0 },
+	{ "dns/dlz",		0 },
 	{ NULL, 		0 }
 };
 
diff --git a/contrib/bind9/lib/dns/lookup.c b/contrib/bind9/lib/dns/lookup.c
index 1cf5721..642a434 100644
--- a/contrib/bind9/lib/dns/lookup.c
+++ b/contrib/bind9/lib/dns/lookup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lookup.c,v 1.9.12.7 2006/01/04 23:50:20 marka Exp $ */
+/* $Id: lookup.c,v 1.14.18.4 2005/11/30 03:44:39 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/master.c b/contrib/bind9/lib/dns/master.c
index 7a2dab3..8eb1f2d 100644
--- a/contrib/bind9/lib/dns/master.c
+++ b/contrib/bind9/lib/dns/master.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: master.c,v 1.122.2.8.2.14 2004/05/05 01:32:16 marka Exp $ */
+/* $Id: master.c,v 1.148.18.13 2006/12/07 23:57:58 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -25,6 +27,7 @@
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/serial.h>
+#include <isc/stdio.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
 #include <isc/task.h>
@@ -46,33 +49,34 @@
 #include <dns/time.h>
 #include <dns/ttl.h>
 
-/*
- * Grow the number of dns_rdatalist_t (RDLSZ) and dns_rdata_t (RDSZ) structures
+/*!
+ * Grow the number of dns_rdatalist_t (#RDLSZ) and dns_rdata_t (#RDSZ) structures
  * by these sizes when we need to.
  *
- * RDLSZ reflects the number of different types with the same name expected.
+ */
+/*% RDLSZ reflects the number of different types with the same name expected. */
+#define RDLSZ 32
+/*%
  * RDSZ reflects the number of rdata expected at a give name that can fit into
  * 64k.
  */
-
-#define RDLSZ 32
 #define RDSZ 512
 
 #define NBUFS 4
 #define MAXWIRESZ 255
 
-/*
+/*%
  * Target buffer size and minimum target size.
  * MINTSIZ must be big enough to hold the largest rdata record.
- *
+ * \brief
  * TSIZ >= MINTSIZ
  */
 #define TSIZ (128*1024)
-/*
+/*%
  * max message size - header - root - type - class - ttl - rdlen
  */
 #define MINTSIZ (65535 - 12 - 1 - 2 - 2 - 4 - 2)
-/*
+/*%
  * Size for tokens in the presentation format,
  * The largest tokens are the base64 blocks in KEY and CERT records,
  * Largest key allowed is about 1372 bytes but
@@ -87,19 +91,28 @@ typedef ISC_LIST(dns_rdatalist_t) rdatalist_head_t;
 
 typedef struct dns_incctx dns_incctx_t;
 
-/*
+/*%
  * Master file load state.
  */
 
 struct dns_loadctx {
 	unsigned int		magic;
 	isc_mem_t		*mctx;
-	isc_lex_t		*lex;
-	isc_boolean_t		keep_lex;
+	dns_masterformat_t	format;
+
 	dns_rdatacallbacks_t	*callbacks;
 	isc_task_t		*task;
 	dns_loaddonefunc_t	done;
 	void			*done_arg;
+
+	/* Common methods */
+	isc_result_t		(*openfile)(dns_loadctx_t *lctx,
+					    const char *filename);
+	isc_result_t		(*load)(dns_loadctx_t *lctx);
+
+	/* Members specific to the text format: */
+	isc_lex_t		*lex;
+	isc_boolean_t		keep_lex;
 	unsigned int		options;
 	isc_boolean_t		ttl_known;
 	isc_boolean_t		default_ttl_known;
@@ -111,9 +124,14 @@ struct dns_loadctx {
 	isc_uint32_t		default_ttl;
 	dns_rdataclass_t	zclass;
 	dns_fixedname_t		fixed_top;
-	dns_name_t		*top;			/* top of zone */
+	dns_name_t		*top;			/*%< top of zone */
+
+	/* Members specific to the raw format: */
+	FILE			*f;
+	isc_boolean_t		first;
+
 	/* Which fixed buffers we are using? */
-	unsigned int		loop_cnt;		/* records per quantum,
+	unsigned int		loop_cnt;		/*% records per quantum,
 							 * 0 => all. */
 	isc_boolean_t		canceled;
 	isc_mutex_t		lock;
@@ -144,6 +162,18 @@ struct dns_incctx {
 #define DNS_AS_STR(t) ((t).value.as_textregion.base)
 
 static isc_result_t
+openfile_text(dns_loadctx_t *lctx, const char *master_file);
+
+static isc_result_t
+openfile_raw(dns_loadctx_t *lctx, const char *master_file);
+
+static isc_result_t
+load_text(dns_loadctx_t *lctx);
+
+static isc_result_t
+load_raw(dns_loadctx_t *lctx);
+
+static isc_result_t
 pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx);
 
 static isc_result_t
@@ -405,6 +435,7 @@ incctx_destroy(isc_mem_t *mctx, dns_incctx_t *ictx) {
 static void
 loadctx_destroy(dns_loadctx_t *lctx) {
 	isc_mem_t *mctx;
+	isc_result_t result;
 
 	REQUIRE(DNS_LCTX_VALID(lctx));
 
@@ -412,6 +443,15 @@ loadctx_destroy(dns_loadctx_t *lctx) {
 	if (lctx->inc != NULL)
 		incctx_destroy(lctx->mctx, lctx->inc);
 
+	if (lctx->f != NULL) {
+		result = isc_stdio_close(lctx->f);
+		if (result != ISC_R_SUCCESS) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "isc_stdio_close() failed: %s",
+					 isc_result_totext(result));
+		}
+	}
+
 	/* isc_lex_destroy() will close all open streams */
 	if (lctx->lex != NULL && !lctx->keep_lex)
 		isc_lex_destroy(&lctx->lex);
@@ -461,7 +501,8 @@ incctx_create(isc_mem_t *mctx, dns_name_t *origin, dns_incctx_t **ictxp) {
 }
 
 static isc_result_t
-loadctx_create(isc_mem_t *mctx, unsigned int options, dns_name_t *top,
+loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
+	       unsigned int options, dns_name_t *top,
 	       dns_rdataclass_t zclass, dns_name_t *origin,
 	       dns_rdatacallbacks_t *callbacks, isc_task_t *task,
 	       dns_loaddonefunc_t done, void *done_arg, isc_lex_t *lex,
@@ -489,10 +530,7 @@ loadctx_create(isc_mem_t *mctx, unsigned int options, dns_name_t *top,
 	result = isc_mutex_init(&lctx->lock);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, lctx, sizeof(*lctx));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
+		return (result);
 	}
 
 	lctx->inc = NULL;
@@ -500,6 +538,20 @@ loadctx_create(isc_mem_t *mctx, unsigned int options, dns_name_t *top,
 	if (result != ISC_R_SUCCESS) 
 		goto cleanup_ctx;
 
+	lctx->format = format;
+	switch (format) {
+	default:
+		INSIST(0);
+	case dns_masterformat_text:
+		lctx->openfile = openfile_text;
+		lctx->load = load_text;
+		break;
+	case dns_masterformat_raw:
+		lctx->openfile = openfile_raw;
+		lctx->load = load_raw;
+		break;
+	}
+
 	if (lex != NULL) {
 		lctx->lex = lex;
 		lctx->keep_lex = ISC_TRUE;
@@ -534,6 +586,9 @@ loadctx_create(isc_mem_t *mctx, unsigned int options, dns_name_t *top,
 	dns_name_toregion(top, &r);
 	dns_name_fromregion(lctx->top, &r);
 
+	lctx->f = NULL;
+	lctx->first = ISC_TRUE;
+
 	lctx->loop_cnt = (done != NULL) ? 100 : 0;
 	lctx->callbacks = callbacks;
 	lctx->task = NULL;
@@ -640,6 +695,25 @@ genname(char *name, int it, char *buffer, size_t length) {
 }
 
 static isc_result_t
+openfile_text(dns_loadctx_t *lctx, const char *master_file) {
+	return (isc_lex_openfile(lctx->lex, master_file));
+}
+
+static isc_result_t
+openfile_raw(dns_loadctx_t *lctx, const char *master_file) {
+	isc_result_t result;
+
+	result = isc_stdio_open(master_file, "r", &lctx->f);
+	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_stdio_open() failed: %s",
+				 isc_result_totext(result));		
+	}
+
+	return (result);
+}
+
+static isc_result_t
 generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 	 const char *source, unsigned int line)
 {
@@ -711,6 +785,7 @@ generate(dns_loadctx_t *lctx, char *range, char *lhs, char *gtype, char *rhs,
 	case dns_rdatatype_a:
 	case dns_rdatatype_aaaa:
 		if (lctx->zclass == dns_rdataclass_in ||
+		    lctx->zclass == dns_rdataclass_ch ||
 		    lctx->zclass == dns_rdataclass_hs)
 			break;
 		/* FALLTHROUGH */
@@ -862,8 +937,25 @@ check_ns(dns_loadctx_t *lctx, isc_token_t *token, const char *source,
 	return (result);
 }
 
+static void
+check_wildcard(dns_incctx_t *ictx, const char *source, unsigned long line,
+	       dns_rdatacallbacks_t *callbacks)
+{
+	dns_name_t *name;
+
+	name = (ictx->glue != NULL) ? ictx->glue : ictx->current;
+	if (dns_name_internalwildcard(name)) {
+		char namebuf[DNS_NAME_FORMATSIZE];
+
+		dns_name_format(name, namebuf, sizeof(namebuf));
+		(*callbacks->warn)(callbacks, "%s:%lu: warning: ownername "
+				   "'%s' contains an non-terminal wildcard",
+				   source, line, namebuf);
+	}
+}
+
 static isc_result_t
-load(dns_loadctx_t *lctx) {
+load_text(dns_loadctx_t *lctx) {
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t type, covers;
 	isc_uint32_t ttl_offset = 0;
@@ -939,11 +1031,16 @@ load(dns_loadctx_t *lctx) {
 		options |= DNS_RDATA_CHECKNAMES;
 	if ((lctx->options & DNS_MASTER_CHECKNAMESFAIL) != 0)
 		options |= DNS_RDATA_CHECKNAMESFAIL;
+	if ((lctx->options & DNS_MASTER_CHECKMX) != 0)
+		options |= DNS_RDATA_CHECKMX;
+	if ((lctx->options & DNS_MASTER_CHECKMXFAIL) != 0)
+		options |= DNS_RDATA_CHECKMXFAIL;
 	source = isc_lex_getsourcename(lctx->lex);
 	do {
 		initialws = ISC_FALSE;
 		line = isc_lex_getsourceline(lctx->lex);
-		GETTOKEN(lctx->lex, ISC_LEXOPT_INITIALWS, &token, ISC_TRUE);
+		GETTOKEN(lctx->lex, ISC_LEXOPT_INITIALWS | ISC_LEXOPT_QSTRING,
+			 &token, ISC_TRUE);
 		line = isc_lex_getsourceline(lctx->lex);
 
 		if (token.type == isc_tokentype_eof) {
@@ -979,7 +1076,8 @@ load(dns_loadctx_t *lctx) {
 			 * Still working on the same name.
 			 */
 			initialws = ISC_TRUE;
-		} else if (token.type == isc_tokentype_string) {
+		} else if (token.type == isc_tokentype_string ||
+			   token.type == isc_tokentype_qstring) {
 
 			/*
 			 * "$" Support.
@@ -1117,6 +1215,7 @@ load(dns_loadctx_t *lctx) {
 					isc_mem_free(mctx, gtype);
 				if (rhs != NULL)
 					isc_mem_free(mctx, rhs);
+				range = lhs = gtype = rhs = NULL;
 				/* RANGE */
 				GETTOKEN(lctx->lex, 0, &token, ISC_FALSE);
 				range = isc_mem_strdup(mctx,
@@ -1346,6 +1445,14 @@ load(dns_loadctx_t *lctx) {
 					isc_buffer_init(&target, target_mem,
 							target_size);
 				}
+				/*
+				 * Check for internal wildcards.
+				 */
+				if ((lctx->options & DNS_MASTER_CHECKWILDCARD)
+						 != 0)
+					check_wildcard(ictx, source, line,
+						       callbacks);
+
 			}
 			if ((lctx->options & DNS_MASTER_ZONE) != 0 &&
 			    (lctx->options & DNS_MASTER_SLAVE) == 0 &&
@@ -1508,7 +1615,7 @@ load(dns_loadctx_t *lctx) {
 			current_has_delegation = ISC_TRUE;
 
 		/*
-		 * RFC 1123: MD and MF are not allowed to be loaded from
+		 * RFC1123: MD and MF are not allowed to be loaded from
 		 * master files.
 		 */
 		if ((lctx->options & DNS_MASTER_ZONE) != 0 &&
@@ -1571,7 +1678,7 @@ load(dns_loadctx_t *lctx) {
 			isc_boolean_t ok;
 			dns_name_t *name;
 
-			name = (ictx->glue != NULL) ? ictx-> glue :
+			name = (ictx->glue != NULL) ? ictx->glue :
 						      ictx->current;
 			ok = dns_rdata_checkowner(name, lctx->zclass, type,
 						  ISC_TRUE);
@@ -1686,7 +1793,7 @@ load(dns_loadctx_t *lctx) {
 		} else if (!explicit_ttl && lctx->warn_1035) {
 			(*callbacks->warn)(callbacks,
 					   "%s:%lu: "
-					   "using RFC 1035 TTL semantics",
+					   "using RFC1035 TTL semantics",
 					   source, line);
 			lctx->warn_1035 = ISC_FALSE;
 		}
@@ -1879,7 +1986,7 @@ pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx) {
 		new->drop = ictx->drop;
 	}
 
-	result = isc_lex_openfile(lctx->lex, master_file);
+	result = (lctx->openfile)(lctx, master_file);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 	new->parent = ictx;
@@ -1892,25 +1999,352 @@ pushfile(const char *master_file, dns_name_t *origin, dns_loadctx_t *lctx) {
 	return (result);
 }
 
+static inline isc_result_t
+read_and_check(isc_boolean_t do_read, isc_buffer_t *buffer,
+	       size_t len, FILE *f)
+{
+	isc_result_t result;
+
+	if (do_read) {
+		INSIST(isc_buffer_availablelength(buffer) >= len);
+		result = isc_stdio_read(isc_buffer_used(buffer), 1, len,
+					f, NULL);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		isc_buffer_add(buffer, len);
+	} else if (isc_buffer_remaininglength(buffer) < len)
+		return (ISC_R_RANGE);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+load_raw(dns_loadctx_t *lctx) {
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_boolean_t done = ISC_FALSE;
+	unsigned int loop_cnt = 0;
+	dns_rdatacallbacks_t *callbacks;
+	unsigned char namebuf[DNS_NAME_MAXWIRE];
+	isc_region_t r;
+	dns_name_t name;
+	rdatalist_head_t head, dummy;
+	dns_rdatalist_t rdatalist;
+	isc_mem_t *mctx = lctx->mctx;
+	dns_rdata_t *rdata = NULL;
+	unsigned int rdata_size = 0;
+	int target_size = TSIZ;
+	isc_buffer_t target;
+	unsigned char *target_mem = NULL;
+
+	REQUIRE(DNS_LCTX_VALID(lctx));
+	callbacks = lctx->callbacks;
+
+	if (lctx->first) {
+		dns_masterrawheader_t header;
+		isc_uint32_t format, version, dumptime;
+		size_t hdrlen = sizeof(format) + sizeof(version) +
+			sizeof(dumptime);
+
+		INSIST(hdrlen <= sizeof(header));
+		isc_buffer_init(&target, &header, sizeof(header));
+
+		result = isc_stdio_read(&header, 1, hdrlen, lctx->f, NULL);
+		if (result != ISC_R_SUCCESS) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "isc_stdio_read failed: %s",
+					 isc_result_totext(result));
+			return (result);
+		}
+		isc_buffer_add(&target, hdrlen);
+		format = isc_buffer_getuint32(&target);
+		if (format != dns_masterformat_raw) {
+			(*callbacks->error)(callbacks,
+					    "dns_master_load: "
+					    "file format mismatch");
+			return (ISC_R_NOTIMPLEMENTED);
+		}
+
+		version = isc_buffer_getuint32(&target);
+		if (version > DNS_RAWFORMAT_VERSION) {
+			(*callbacks->error)(callbacks,
+					    "dns_master_load: "
+					    "unsupported file format version");
+			return (ISC_R_NOTIMPLEMENTED);
+		}
+
+		/* Empty read: currently, we do not use dumptime */
+		dumptime = isc_buffer_getuint32(&target);
+
+		lctx->first = ISC_FALSE;
+	}
+
+	ISC_LIST_INIT(head);
+	ISC_LIST_INIT(dummy);
+	dns_rdatalist_init(&rdatalist);
+
+	/*
+	 * Allocate target_size of buffer space.  This is greater than twice
+	 * the maximum individual RR data size.
+	 */
+	target_mem = isc_mem_get(mctx, target_size);
+	if (target_mem == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
+	isc_buffer_init(&target, target_mem, target_size);
+
+	/*
+	 * In the following loop, we regard any error fatal regardless of
+	 * whether "MANYERRORS" is set in the context option.  This is because
+	 * normal errors should already have been checked at creation time.
+	 * Besides, it is very unlikely that we can recover from an error
+	 * in this format, and so trying to continue parsing erroneous data
+	 * does not really make sense.
+	 */
+	for (loop_cnt = 0;
+	     (lctx->loop_cnt == 0 || loop_cnt < lctx->loop_cnt);
+	     loop_cnt++) {
+		unsigned int i, rdcount, consumed_name;
+		isc_uint16_t namelen;
+		isc_uint32_t totallen;
+		size_t minlen, readlen;
+		isc_boolean_t sequential_read = ISC_FALSE;
+
+		/* Read the data length */
+		isc_buffer_clear(&target);
+		INSIST(isc_buffer_availablelength(&target) >=
+		       sizeof(totallen));
+		result = isc_stdio_read(target.base, 1, sizeof(totallen),
+					lctx->f, NULL);
+		if (result == ISC_R_EOF) {
+			result = ISC_R_SUCCESS;
+			done = ISC_TRUE;
+			break;
+		}
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
+		isc_buffer_add(&target, sizeof(totallen));
+		totallen = isc_buffer_getuint32(&target);
+		/*
+		 * Validation: the input data must at least contain the common
+		 * header.
+		 */
+		minlen = sizeof(totallen) + sizeof(isc_uint16_t) +
+			sizeof(isc_uint16_t) + sizeof(isc_uint16_t) +
+			sizeof(isc_uint32_t) + sizeof(isc_uint32_t);
+		if (totallen < minlen) {
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+		totallen -= sizeof(totallen);
+
+		isc_buffer_clear(&target);
+		if (totallen > isc_buffer_availablelength(&target)) {
+			/*
+			 * The default buffer size should typically be large
+			 * enough to store the entire RRset.  We could try to
+			 * allocate enough space if this is not the case, but
+			 * it might cause a hazardous result when "totallen"
+			 * is forged.  Thus, we'd rather take an inefficient
+			 * but robust approach in this atypical case: read
+			 * data step by step, and commit partial data when
+			 * necessary.  Note that the buffer must be large
+			 * enough to store the "header part", owner name, and
+			 * at least one rdata (however large it is).
+			 */
+			sequential_read = ISC_TRUE;
+			readlen = minlen - sizeof(totallen);
+		} else {
+			/*
+			 * Typical case.  We can read the whole RRset at once
+			 * with the default buffer.
+			 */
+			readlen = totallen;
+		}
+		result = isc_stdio_read(target.base, 1, readlen,
+					lctx->f, NULL);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
+		isc_buffer_add(&target, readlen);
+
+		/* Construct RRset headers */
+		rdatalist.rdclass = isc_buffer_getuint16(&target);
+		rdatalist.type = isc_buffer_getuint16(&target);
+		rdatalist.covers = isc_buffer_getuint16(&target);
+		rdatalist.ttl =  isc_buffer_getuint32(&target);
+		rdcount = isc_buffer_getuint32(&target);
+		if (rdcount == 0) {
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+		INSIST(isc_buffer_consumedlength(&target) <= readlen);
+
+		/* Owner name: length followed by name */
+		result = read_and_check(sequential_read, &target,
+					sizeof(namelen), lctx->f);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
+		namelen = isc_buffer_getuint16(&target);
+		if (namelen > sizeof(namebuf)) {
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+
+		result = read_and_check(sequential_read, &target, namelen,
+					lctx->f);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
+		isc_buffer_setactive(&target, (unsigned int)namelen);
+		isc_buffer_activeregion(&target, &r);
+		dns_name_init(&name, NULL);
+		dns_name_fromregion(&name, &r);
+		isc_buffer_forward(&target, (unsigned int)namelen);
+		consumed_name = isc_buffer_consumedlength(&target);
+
+		/* Rdata contents. */
+		if (rdcount > rdata_size) {
+			dns_rdata_t *new_rdata = NULL;
+
+			new_rdata = grow_rdata(rdata_size + RDSZ, rdata,
+					       rdata_size, &head,
+					       &dummy, mctx);
+			if (new_rdata == NULL) {
+				result = ISC_R_NOMEMORY;
+				goto cleanup;
+			}
+			rdata_size += RDSZ;
+			rdata = new_rdata;
+		}
+
+	continue_read:
+		for (i = 0; i < rdcount; i++) {
+			isc_uint16_t rdlen;
+
+			dns_rdata_init(&rdata[i]);
+			
+			if (sequential_read &&
+			    isc_buffer_availablelength(&target) < MINTSIZ) {
+				unsigned int j;
+
+				INSIST(i > 0); /* detect an infinite loop */
+
+				/* Partial Commit. */
+				ISC_LIST_APPEND(head, &rdatalist, link);
+				result = commit(callbacks, lctx, &head, &name,
+						NULL, 0);
+				for (j = 0; j < i; j++) {
+					ISC_LIST_UNLINK(rdatalist.rdata,
+							&rdata[j], link);
+					dns_rdata_reset(&rdata[j]);
+				}
+				if (result != ISC_R_SUCCESS)
+					goto cleanup;
+
+				/* Rewind the buffer and continue */
+				isc_buffer_clear(&target);
+				isc_buffer_add(&target, consumed_name);
+				isc_buffer_forward(&target, consumed_name);
+
+				rdcount -= i;
+				i = 0;
+
+				goto continue_read;
+			}
+
+			/* rdata length */
+			result = read_and_check(sequential_read, &target,
+						sizeof(rdlen), lctx->f);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup;
+			rdlen = isc_buffer_getuint16(&target);
+
+			/* rdata */
+			result = read_and_check(sequential_read, &target,
+						rdlen, lctx->f);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup;
+			isc_buffer_setactive(&target, (unsigned int)rdlen);
+			isc_buffer_activeregion(&target, &r);
+			isc_buffer_forward(&target, (unsigned int)rdlen);
+			dns_rdata_fromregion(&rdata[i], rdatalist.rdclass,
+					     rdatalist.type, &r);
+
+			ISC_LIST_APPEND(rdatalist.rdata, &rdata[i], link);
+		}
+
+		/*
+		 * Sanity check.  Still having remaining space is not
+		 * necessarily critical, but it very likely indicates broken
+		 * or malformed data.
+		 */
+		if (isc_buffer_remaininglength(&target) != 0) {
+			result = ISC_R_RANGE;
+			goto cleanup;
+		}
+
+		ISC_LIST_APPEND(head, &rdatalist, link);
+
+		/* Commit this RRset.  rdatalist will be unlinked. */
+		result = commit(callbacks, lctx, &head, &name, NULL, 0);
+
+		for (i = 0; i < rdcount; i++) {
+			ISC_LIST_UNLINK(rdatalist.rdata, &rdata[i], link);
+			dns_rdata_reset(&rdata[i]);
+		}
+
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
+	}
+
+	if (!done) {
+		INSIST(lctx->done != NULL && lctx->task != NULL);
+		result = DNS_R_CONTINUE;
+	} else if (result == ISC_R_SUCCESS && lctx->result != ISC_R_SUCCESS)
+		result = lctx->result;
+
+ cleanup:
+	if (rdata != NULL)
+		isc_mem_put(mctx, rdata, rdata_size * sizeof(*rdata));
+	if (target_mem != NULL)
+		isc_mem_put(mctx, target_mem, target_size);
+	if (result != ISC_R_SUCCESS && result != DNS_R_CONTINUE) {
+		(*callbacks->error)(callbacks, "dns_master_load: %s",
+				    dns_result_totext(result));
+	}
+
+	return (result);
+}
+
 isc_result_t
 dns_master_loadfile(const char *master_file, dns_name_t *top,
 		    dns_name_t *origin,
 		    dns_rdataclass_t zclass, unsigned int options,
 		    dns_rdatacallbacks_t *callbacks, isc_mem_t *mctx)
 {
+	return (dns_master_loadfile2(master_file, top, origin, zclass, options,
+				     callbacks, mctx, dns_masterformat_text));
+}
+
+isc_result_t
+dns_master_loadfile2(const char *master_file, dns_name_t *top,
+		     dns_name_t *origin,
+		     dns_rdataclass_t zclass, unsigned int options,
+		     dns_rdatacallbacks_t *callbacks, isc_mem_t *mctx,
+		     dns_masterformat_t format)
+{
 	dns_loadctx_t *lctx = NULL;
 	isc_result_t result;
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
+	result = loadctx_create(format, mctx, options, top, zclass, origin,
 				callbacks, NULL, NULL, NULL, NULL, &lctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = isc_lex_openfile(lctx->lex, master_file);
+	result = (lctx->openfile)(lctx, master_file);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	result = load(lctx);
+	result = (lctx->load)(lctx);
 	INSIST(result != DNS_R_CONTINUE);
 
  cleanup:
@@ -1926,18 +2360,32 @@ dns_master_loadfileinc(const char *master_file, dns_name_t *top,
 		       isc_task_t *task, dns_loaddonefunc_t done,
 		       void *done_arg, dns_loadctx_t **lctxp, isc_mem_t *mctx)
 {
+	return (dns_master_loadfileinc2(master_file, top, origin, zclass,
+					options, callbacks, task, done,
+					done_arg, lctxp, mctx,
+					dns_masterformat_text));
+}
+
+isc_result_t
+dns_master_loadfileinc2(const char *master_file, dns_name_t *top,
+			dns_name_t *origin, dns_rdataclass_t zclass,
+			unsigned int options, dns_rdatacallbacks_t *callbacks,
+			isc_task_t *task, dns_loaddonefunc_t done,
+			void *done_arg, dns_loadctx_t **lctxp, isc_mem_t *mctx,
+			dns_masterformat_t format)
+{
 	dns_loadctx_t *lctx = NULL;
 	isc_result_t result;
-	
+
 	REQUIRE(task != NULL);
 	REQUIRE(done != NULL);
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
+	result = loadctx_create(format, mctx, options, top, zclass, origin,
 				callbacks, task, done, done_arg, NULL, &lctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = isc_lex_openfile(lctx->lex, master_file);
+	result = (lctx->openfile)(lctx, master_file);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -1963,8 +2411,9 @@ dns_master_loadstream(FILE *stream, dns_name_t *top, dns_name_t *origin,
 
 	REQUIRE(stream != NULL);
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
-				callbacks, NULL, NULL, NULL, NULL, &lctx);
+	result = loadctx_create(dns_masterformat_text, mctx, options, top,
+				zclass, origin, callbacks, NULL, NULL, NULL,
+				NULL, &lctx);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -1972,7 +2421,7 @@ dns_master_loadstream(FILE *stream, dns_name_t *top, dns_name_t *origin,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	result = load(lctx);
+	result = (lctx->load)(lctx);
 	INSIST(result != DNS_R_CONTINUE);
 
  cleanup:
@@ -1995,8 +2444,9 @@ dns_master_loadstreaminc(FILE *stream, dns_name_t *top, dns_name_t *origin,
 	REQUIRE(task != NULL);
 	REQUIRE(done != NULL);
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
-				callbacks, task, done, done_arg, NULL, &lctx);
+	result = loadctx_create(dns_masterformat_text, mctx, options, top,
+				zclass, origin, callbacks, task, done,
+				done_arg, NULL, &lctx);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -2027,8 +2477,9 @@ dns_master_loadbuffer(isc_buffer_t *buffer, dns_name_t *top,
 
 	REQUIRE(buffer != NULL);
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
-				callbacks, NULL, NULL, NULL, NULL, &lctx);
+	result = loadctx_create(dns_masterformat_text, mctx, options, top,
+				zclass, origin, callbacks, NULL, NULL, NULL,
+				NULL, &lctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -2036,7 +2487,7 @@ dns_master_loadbuffer(isc_buffer_t *buffer, dns_name_t *top,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	result = load(lctx);
+	result = (lctx->load)(lctx);
 	INSIST(result != DNS_R_CONTINUE);
 
  cleanup:
@@ -2060,8 +2511,9 @@ dns_master_loadbufferinc(isc_buffer_t *buffer, dns_name_t *top,
 	REQUIRE(task != NULL);
 	REQUIRE(done != NULL);
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
-				callbacks, task, done, done_arg, NULL, &lctx);
+	result = loadctx_create(dns_masterformat_text, mctx, options, top,
+				zclass, origin, callbacks, task, done,
+				done_arg, NULL, &lctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -2092,12 +2544,13 @@ dns_master_loadlexer(isc_lex_t *lex, dns_name_t *top,
 
 	REQUIRE(lex != NULL);
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
-				callbacks, NULL, NULL, NULL, lex, &lctx);
+	result = loadctx_create(dns_masterformat_text, mctx, options, top,
+				zclass, origin, callbacks, NULL, NULL, NULL,
+				lex, &lctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = load(lctx);
+	result = (lctx->load)(lctx);
 	INSIST(result != DNS_R_CONTINUE);
 
 	dns_loadctx_detach(&lctx);
@@ -2119,8 +2572,9 @@ dns_master_loadlexerinc(isc_lex_t *lex, dns_name_t *top,
 	REQUIRE(task != NULL);
 	REQUIRE(done != NULL);
 
-	result = loadctx_create(mctx, options, top, zclass, origin,
-				callbacks, task, done, done_arg, lex, &lctx);
+	result = loadctx_create(dns_masterformat_text, mctx, options, top,
+				zclass, origin, callbacks, task, done,
+				done_arg, lex, &lctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -2281,9 +2735,15 @@ commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx,
 		} else if (result != ISC_R_SUCCESS) {
 			dns_name_format(owner, namebuf,
 					sizeof(namebuf));
-			(*error)(callbacks, "%s: %s:%lu: %s: %s",
-				 "dns_master_load", source, line,
-				 namebuf, dns_result_totext(result));
+			if (source != NULL) {
+				(*error)(callbacks, "%s: %s:%lu: %s: %s",
+					 "dns_master_load", source, line,
+					 namebuf, dns_result_totext(result));
+			} else {
+				(*error)(callbacks, "%s: %s: %s",
+					 "dns_master_load", namebuf,
+					 dns_result_totext(result));
+			}
 		}
 		if (MANYERRS(lctx, result))
 			SETRESULT(lctx, result);
@@ -2342,7 +2802,7 @@ load_quantum(isc_task_t *task, isc_event_t *event) {
 	if (lctx->canceled)
 		result = ISC_R_CANCELED;
 	else
-		result = load(lctx);
+		result = (lctx->load)(lctx);
 	if (result == DNS_R_CONTINUE) {
 		event->ev_arg = lctx;
 		isc_task_send(task, &event);
diff --git a/contrib/bind9/lib/dns/masterdump.c b/contrib/bind9/lib/dns/masterdump.c
index 0f4716d..03716e2 100644
--- a/contrib/bind9/lib/dns/masterdump.c
+++ b/contrib/bind9/lib/dns/masterdump.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: masterdump.c,v 1.56.2.5.2.15 2006/03/10 00:17:21 marka Exp $ */
+/* $Id: masterdump.c,v 1.73.18.14 2006/08/08 06:39:36 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -29,13 +31,16 @@
 #include <isc/stdio.h>
 #include <isc/string.h>
 #include <isc/task.h>
+#include <isc/time.h>
 #include <isc/util.h>
 
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/events.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/log.h>
+#include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -65,7 +70,7 @@ struct dns_master_style {
 	unsigned int tab_width;
 };
 
-/*
+/*%
  * The maximum length of the newline+indentation that is output
  * when inserting a line break in an RR.  This effectively puts an
  * upper limits on the value of "rdata_column", because if it is
@@ -73,7 +78,7 @@ struct dns_master_style {
  */
 #define DNS_TOTEXT_LINEBREAK_MAXLEN 100
 
-/*
+/*%
  * Context structure for a masterfile dump in progress.
  */
 typedef struct dns_totext_ctx {
@@ -134,7 +139,7 @@ dns_master_style_simple = {
 	24, 32, 32, 40, 80, 8
 };
 
-/*
+/*%
  * A style suitable for dns_rdataset_totext().
  */
 LIBDNS_EXTERNAL_DATA const dns_master_style_t
@@ -171,11 +176,16 @@ struct dns_dumpctx {
 	/* dns_master_dumpinc() */
 	char			*file;
 	char 			*tmpfile;
+	dns_masterformat_t	format;
+	isc_result_t		(*dumpsets)(isc_mem_t *mctx, dns_name_t *name,
+					    dns_rdatasetiter_t *rdsiter,
+					    dns_totext_ctx_t *ctx,
+					    isc_buffer_t *buffer, FILE *f);
 };
 
 #define NXDOMAIN(x) (((x)->attributes & DNS_RDATASETATTR_NXDOMAIN) != 0) 
 
-/*
+/*%
  * Output tabs and spaces to go from column '*current' to
  * column 'to', and update '*current' to reflect the new
  * current column.
@@ -348,6 +358,7 @@ rdataset_totext(dns_rdataset_t *rdataset,
 
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 
+	rdataset->attributes |= DNS_RDATASETATTR_LOADORDER;
 	result = dns_rdataset_first(rdataset);
 	REQUIRE(result == ISC_R_SUCCESS);
 
@@ -774,9 +785,9 @@ static const char *trustnames[] = {
 };
 
 static isc_result_t
-dump_rdatasets(isc_mem_t *mctx, dns_name_t *name, dns_rdatasetiter_t *rdsiter,
-	       dns_totext_ctx_t *ctx,
-	       isc_buffer_t *buffer, FILE *f)
+dump_rdatasets_text(isc_mem_t *mctx, dns_name_t *name,
+		    dns_rdatasetiter_t *rdsiter, dns_totext_ctx_t *ctx,
+		    isc_buffer_t *buffer, FILE *f)
 {
 	isc_result_t itresult, dumpresult;
 	isc_region_t r;
@@ -848,6 +859,146 @@ dump_rdatasets(isc_mem_t *mctx, dns_name_t *name, dns_rdatasetiter_t *rdsiter,
 	return (itresult);
 }
 
+/*
+ * Dump given RRsets in the "raw" format.
+ */
+static isc_result_t
+dump_rdataset_raw(isc_mem_t *mctx, dns_name_t *name, dns_rdataset_t *rdataset,
+		  isc_buffer_t *buffer, FILE *f)
+{
+	isc_result_t result;
+	isc_uint32_t totallen;
+	isc_uint16_t dlen;
+	isc_region_t r, r_hdr;
+
+	REQUIRE(buffer->length > 0);
+	REQUIRE(DNS_RDATASET_VALID(rdataset));
+
+ restart:
+	totallen = 0;
+	result = dns_rdataset_first(rdataset);
+	REQUIRE(result == ISC_R_SUCCESS);
+
+	isc_buffer_clear(buffer);
+
+	/*
+	 * Common header and owner name (length followed by name)
+	 * These fields should be in a moderate length, so we assume we
+	 * can store all of them in the initial buffer.
+	 */
+	isc_buffer_availableregion(buffer, &r_hdr);
+	INSIST(r_hdr.length >= sizeof(dns_masterrawrdataset_t));
+	isc_buffer_putuint32(buffer, totallen);	/* XXX: leave space */
+	isc_buffer_putuint16(buffer, rdataset->rdclass); /* 16-bit class */
+	isc_buffer_putuint16(buffer, rdataset->type); /* 16-bit type */
+	isc_buffer_putuint16(buffer, rdataset->covers);	/* same as type */
+	isc_buffer_putuint32(buffer, rdataset->ttl); /* 32-bit TTL */
+	isc_buffer_putuint32(buffer, dns_rdataset_count(rdataset));
+	totallen = isc_buffer_usedlength(buffer);
+	INSIST(totallen <= sizeof(dns_masterrawrdataset_t));
+
+	dns_name_toregion(name, &r);
+	INSIST(isc_buffer_availablelength(buffer) >=
+	       (sizeof(dlen) + r.length));
+	dlen = (isc_uint16_t)r.length;
+	isc_buffer_putuint16(buffer, dlen);
+	isc_buffer_copyregion(buffer, &r);
+	totallen += sizeof(dlen) + r.length;
+
+	do {
+		dns_rdata_t rdata = DNS_RDATA_INIT;
+		isc_region_t r;
+
+		dns_rdataset_current(rdataset, &rdata);
+		dns_rdata_toregion(&rdata, &r);
+		INSIST(r.length <= 0xffffU);
+		dlen = (isc_uint16_t)r.length;
+
+		/*
+		 * Copy the rdata into the buffer.  If the buffer is too small,
+		 * grow it.  This should be rare, so we'll simply restart the
+		 * entire procedure (or should we copy the old data and
+		 * continue?).
+		 */
+		if (isc_buffer_availablelength(buffer) <
+						 sizeof(dlen) + r.length) {
+			int newlength;
+			void *newmem;
+
+			newlength = buffer->length * 2;
+			newmem = isc_mem_get(mctx, newlength);
+			if (newmem == NULL)
+				return (ISC_R_NOMEMORY);
+			isc_mem_put(mctx, buffer->base, buffer->length);
+			isc_buffer_init(buffer, newmem, newlength);
+			goto restart;
+		}
+		isc_buffer_putuint16(buffer, dlen);
+		isc_buffer_copyregion(buffer, &r);
+		totallen += sizeof(dlen) + r.length;
+
+		result = dns_rdataset_next(rdataset);
+	} while (result == ISC_R_SUCCESS);
+
+	if (result != ISC_R_NOMORE)
+		return (result);
+
+	/*
+	 * Fill in the total length field.
+	 * XXX: this is a bit tricky.  Since we have already "used" the space
+	 * for the total length in the buffer, we first remember the entire
+	 * buffer length in the region, "rewind", and then write the value.
+	 */
+	isc_buffer_usedregion(buffer, &r);
+	isc_buffer_clear(buffer);
+	isc_buffer_putuint32(buffer, totallen);
+	INSIST(isc_buffer_usedlength(buffer) < totallen);
+
+	/*
+	 * Write the buffer contents to the raw master file.
+	 */
+	result = isc_stdio_write(r.base, 1, (size_t)r.length, f, NULL);
+
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "raw master file write failed: %s",
+				 isc_result_totext(result));
+		return (result);
+	}
+
+	return (result);
+}
+
+static isc_result_t
+dump_rdatasets_raw(isc_mem_t *mctx, dns_name_t *name,
+		   dns_rdatasetiter_t *rdsiter, dns_totext_ctx_t *ctx,
+		   isc_buffer_t *buffer, FILE *f)
+{
+	isc_result_t result;
+	dns_rdataset_t rdataset;
+
+	for (result = dns_rdatasetiter_first(rdsiter);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdatasetiter_next(rdsiter)) {
+
+		dns_rdataset_init(&rdataset);
+		dns_rdatasetiter_current(rdsiter, &rdataset);
+
+		if (rdataset.type == 0 &&
+		    (ctx->style.flags & DNS_STYLEFLAG_NCACHE) == 0) {
+			/* Omit negative cache entries */
+		} else {
+			result = dump_rdataset_raw(mctx, name, &rdataset,
+						   buffer, f);
+		}
+		dns_rdataset_disassociate(&rdataset);
+	}
+
+	if (result == ISC_R_NOMORE)
+		result = ISC_R_SUCCESS;
+
+	return (result);
+}
 
 /*
  * Initial size of text conversion buffer.  The buffer is used
@@ -856,7 +1007,7 @@ dump_rdatasets(isc_mem_t *mctx, dns_name_t *name, dns_rdatasetiter_t *rdsiter,
  *
  * When converting rdatasets, it is dynamically resized, but
  * when converting origins, timestamps, etc it is not.  Therefore,
- * the  initial size must large enough to hold the longest possible
+ * the initial size must large enough to hold the longest possible
  * text representation of any domain name (for $ORIGIN).
  */
 static const int initial_buffer_length = 1200;
@@ -1021,7 +1172,8 @@ task_send(dns_dumpctx_t *dctx) {
 
 static isc_result_t
 dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
-	       const dns_master_style_t *style, FILE *f, dns_dumpctx_t **dctxp)
+	       const dns_master_style_t *style, FILE *f, dns_dumpctx_t **dctxp,
+	       dns_masterformat_t format)
 {
 	dns_dumpctx_t *dctx;
 	isc_result_t result;
@@ -1044,6 +1196,19 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	dctx->canceled = ISC_FALSE;
 	dctx->file = NULL;
 	dctx->tmpfile = NULL;
+	dctx->format = format;
+
+	switch (format) {
+	case dns_masterformat_text:
+		dctx->dumpsets = dump_rdatasets_text;
+		break;
+	case dns_masterformat_raw:
+		dctx->dumpsets = dump_rdatasets_raw;
+		break;
+	default:
+		INSIST(0);
+		break;
+	}
 
 	result = totext_ctx_init(style, &dctx->tctx);
 	if (result != ISC_R_SUCCESS) {
@@ -1057,8 +1222,11 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 
 	dctx->do_date = dns_db_iscache(dctx->db);
 
-	relative = ((dctx->tctx.style.flags & DNS_STYLEFLAG_REL_OWNER) != 0) ?
-			ISC_TRUE : ISC_FALSE;
+	if (dctx->format == dns_masterformat_text &&
+	    (dctx->tctx.style.flags & DNS_STYLEFLAG_REL_OWNER) != 0) {
+		relative = ISC_TRUE;
+	} else
+		relative = ISC_FALSE;
 	result = dns_db_createiterator(dctx->db, relative, &dctx->dbiter);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
@@ -1095,6 +1263,9 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 	dns_name_t *name;
 	dns_fixedname_t fixname;
 	unsigned int nodes;
+	dns_masterrawheader_t rawheader;
+	isc_uint32_t now32;
+	isc_time_t start;
 
 	bufmem = isc_mem_get(dctx->mctx, initial_buffer_length);
 	if (bufmem == NULL)
@@ -1106,26 +1277,68 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 	name = dns_fixedname_name(&fixname);
 
 	if (dctx->first) {
-		/*
-		 * If the database has cache semantics, output an RFC2540
-		 * $DATE directive so that the TTLs can be adjusted when
-		 * it is reloaded.  For zones it is not really needed, and
-		 * it would make the file incompatible with pre-RFC2540
-		 * software, so we omit it in the zone case.
-		 */
-		if (dctx->do_date) {
-			result = dns_time32_totext(dctx->now, &buffer);
-			RUNTIME_CHECK(result == ISC_R_SUCCESS);
-			isc_buffer_usedregion(&buffer, &r);
-			fprintf(dctx->f, "$DATE %.*s\n",
-				(int) r.length, (char *) r.base);
+		switch (dctx->format) {
+		case dns_masterformat_text:
+			/*
+			 * If the database has cache semantics, output an
+			 * RFC2540 $DATE directive so that the TTLs can be
+			 * adjusted when it is reloaded.  For zones it is not
+			 * really needed, and it would make the file
+			 * incompatible with pre-RFC2540 software, so we omit
+			 * it in the zone case.
+			 */
+			if (dctx->do_date) {
+				result = dns_time32_totext(dctx->now, &buffer);
+				RUNTIME_CHECK(result == ISC_R_SUCCESS);
+				isc_buffer_usedregion(&buffer, &r);
+				fprintf(dctx->f, "$DATE %.*s\n",
+					(int) r.length, (char *) r.base);
+			}
+			break;
+		case dns_masterformat_raw:
+			r.base = (unsigned char *)&rawheader;
+			r.length = sizeof(rawheader);
+			isc_buffer_region(&buffer, &r);
+			isc_buffer_putuint32(&buffer, dns_masterformat_raw);
+			isc_buffer_putuint32(&buffer, DNS_RAWFORMAT_VERSION);
+			if (sizeof(now32) != sizeof(dctx->now)) {
+				/*
+				 * We assume isc_stdtime_t is a 32-bit integer,
+				 * which should be the case on most cases.
+				 * If it turns out to be uncommon, we'll need
+				 * to bump the version number and revise the
+				 * header format.
+				 */
+				isc_log_write(dns_lctx,
+					      ISC_LOGCATEGORY_GENERAL,
+					      DNS_LOGMODULE_MASTERDUMP,
+					      ISC_LOG_INFO,
+					      "dumping master file in raw "
+					      "format: stdtime is not 32bits");
+				now32 = 0;
+			} else
+				now32 = dctx->now;
+			isc_buffer_putuint32(&buffer, now32);
+			INSIST(isc_buffer_usedlength(&buffer) <=
+			       sizeof(rawheader));
+			result = isc_stdio_write(buffer.base, 1,
+						 isc_buffer_usedlength(&buffer),
+						 dctx->f, NULL);
+			if (result != ISC_R_SUCCESS)
+				return (result);
+			isc_buffer_clear(&buffer);
+			break;
+		default:
+			INSIST(0);
 		}
+
 		result = dns_dbiterator_first(dctx->dbiter);
 		dctx->first = ISC_FALSE;
 	} else
 		result = ISC_R_SUCCESS;
 
 	nodes = dctx->nodes;
+	isc_time_now(&start);
 	while (result == ISC_R_SUCCESS && (dctx->nodes == 0 || nodes--)) {
 		dns_rdatasetiter_t *rdsiter = NULL;
 		dns_dbnode_t *node = NULL;
@@ -1148,8 +1361,8 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 			dns_db_detachnode(dctx->db, &node);
 			goto fail;
 		}
-		result = dump_rdatasets(dctx->mctx, name, rdsiter, &dctx->tctx,
-					&buffer, dctx->f);
+		result = (dctx->dumpsets)(dctx->mctx, name, rdsiter,
+					  &dctx->tctx, &buffer, dctx->f);
 		dns_rdatasetiter_destroy(&rdsiter);
 		if (result != ISC_R_SUCCESS) {
 			dns_db_detachnode(dctx->db, &node);
@@ -1159,7 +1372,46 @@ dumptostreaminc(dns_dumpctx_t *dctx) {
 		result = dns_dbiterator_next(dctx->dbiter);
 	}
 
+	/*
+	 * Work out how many nodes can be written in the time between
+	 * two requests to the nameserver.  Smooth the resulting number and
+	 * use it as a estimate for the number of nodes to be written in the
+	 * next iteration.
+	 */
 	if (dctx->nodes != 0 && result == ISC_R_SUCCESS) {
+		unsigned int pps = dns_pps;	/* packets per second */
+		unsigned int interval;
+		isc_uint64_t usecs;
+		isc_time_t end;
+
+		isc_time_now(&end);
+		if (pps < 100)
+			pps = 100;
+		interval = 1000000 / pps;	/* interval in usecs */
+		if (interval == 0)
+			interval = 1;
+		usecs = isc_time_microdiff(&end, &start);
+		if (usecs == 0) {
+			dctx->nodes = dctx->nodes * 2;
+			if (dctx->nodes > 1000)
+				dctx->nodes = 1000;
+		} else {
+			nodes = dctx->nodes * interval;
+			nodes /= (unsigned int)usecs;
+			if (nodes == 0)
+				nodes = 1;
+			else if (nodes > 1000)
+				nodes = 1000;
+
+			/* Smooth and assign. */
+			dctx->nodes = (nodes + dctx->nodes * 7) / 8;
+
+			isc_log_write(dns_lctx, ISC_LOGCATEGORY_GENERAL,
+				      DNS_LOGMODULE_MASTERDUMP,
+				      ISC_LOG_DEBUG(1),
+				      "dumptostreaminc(%p) new nodes -> %d\n",
+				      dctx, dctx->nodes);
+		}
 		result = dns_dbiterator_pause(dctx->dbiter);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		result = DNS_R_CONTINUE;
@@ -1185,7 +1437,8 @@ dns_master_dumptostreaminc(isc_mem_t *mctx, dns_db_t *db,
 	REQUIRE(f != NULL);
 	REQUIRE(done != NULL);
 
-	result = dumpctx_create(mctx, db, version, style, f, &dctx);
+	result = dumpctx_create(mctx, db, version, style, f, &dctx,
+				dns_masterformat_text);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	isc_task_attach(task, &dctx->task);
@@ -1212,10 +1465,20 @@ dns_master_dumptostream(isc_mem_t *mctx, dns_db_t *db,
 			const dns_master_style_t *style,
 			FILE *f)
 {
+	return (dns_master_dumptostream2(mctx, db, version, style,
+					 dns_masterformat_text, f));
+}
+
+isc_result_t
+dns_master_dumptostream2(isc_mem_t *mctx, dns_db_t *db,
+			 dns_dbversion_t *version,
+			 const dns_master_style_t *style,
+			 dns_masterformat_t format, FILE *f)
+{
 	dns_dumpctx_t *dctx = NULL;
 	isc_result_t result;
 
-	result = dumpctx_create(mctx, db, version, style, f, &dctx);
+	result = dumpctx_create(mctx, db, version, style, f, &dctx, format);
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -1264,6 +1527,17 @@ dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		   isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
 		   dns_dumpctx_t **dctxp)
 {
+	return (dns_master_dumpinc2(mctx, db, version, style, filename, task,
+				    done, done_arg, dctxp,
+				    dns_masterformat_text));
+}
+
+isc_result_t
+dns_master_dumpinc2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
+		    const dns_master_style_t *style, const char *filename,
+		    isc_task_t *task, dns_dumpdonefunc_t done, void *done_arg,
+		    dns_dumpctx_t **dctxp, dns_masterformat_t format)
+{
 	FILE *f = NULL;
 	isc_result_t result;
 	char *tempname = NULL;
@@ -1278,7 +1552,7 @@ dns_master_dumpinc(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	result = dumpctx_create(mctx, db, version, style, f, &dctx);
+	result = dumpctx_create(mctx, db, version, style, f, &dctx, format);
 	if (result != ISC_R_SUCCESS) {
 		(void)isc_stdio_close(f);
 		(void)isc_file_remove(tempname);
@@ -1314,6 +1588,15 @@ isc_result_t
 dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		const dns_master_style_t *style, const char *filename)
 {
+	return (dns_master_dump2(mctx, db, version, style, filename,
+				 dns_masterformat_text));
+}
+
+isc_result_t
+dns_master_dump2(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
+		 const dns_master_style_t *style, const char *filename,
+		 dns_masterformat_t format)
+{
 	FILE *f = NULL;
 	isc_result_t result;
 	char *tempname;
@@ -1323,7 +1606,7 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	result = dumpctx_create(mctx, db, version, style, f, &dctx);
+	result = dumpctx_create(mctx, db, version, style, f, &dctx, format);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
@@ -1340,6 +1623,7 @@ dns_master_dump(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 
 /*
  * Dump a database node into a master file.
+ * XXX: this function assumes the text format.
  */
 isc_result_t
 dns_master_dumpnodetostream(isc_mem_t *mctx, dns_db_t *db,
@@ -1373,7 +1657,7 @@ dns_master_dumpnodetostream(isc_mem_t *mctx, dns_db_t *db,
 	result = dns_db_allrdatasets(db, node, version, now, &rdsiter);
 	if (result != ISC_R_SUCCESS)
 		goto failure;
-	result = dump_rdatasets(mctx, name, rdsiter, &ctx, &buffer, f);
+	result = dump_rdatasets_text(mctx, name, rdsiter, &ctx, &buffer, f);
 	if (result != ISC_R_SUCCESS)
 		goto failure;
 	dns_rdatasetiter_destroy(&rdsiter);
@@ -1452,4 +1736,3 @@ dns_master_styledestroy(dns_master_style_t **stylep, isc_mem_t *mctx) {
 	*stylep = NULL;
 	isc_mem_put(mctx, style, sizeof(*style));
 }
-
diff --git a/contrib/bind9/lib/dns/message.c b/contrib/bind9/lib/dns/message.c
index 3387543..a4a1f87 100644
--- a/contrib/bind9/lib/dns/message.c
+++ b/contrib/bind9/lib/dns/message.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.c,v 1.194.2.10.2.24 2006/02/28 06:32:54 marka Exp $ */
+/* $Id: message.c,v 1.222.18.10 2006/03/02 23:19:20 marka Exp $ */
+
+/*! \file */
 
 /***
  *** Imports
@@ -63,7 +65,7 @@
 #define VALID_PSEUDOSECTION(s)	(((s) >= DNS_PSEUDOSECTION_ANY) \
 				 && ((s) < DNS_PSEUDOSECTION_MAX))
 
-/*
+/*%
  * This is the size of each individual scratchpad buffer, and the numbers
  * of various block allocations used within the server.
  * XXXMLG These should come from a config setting.
@@ -75,7 +77,7 @@
 #define RDATALIST_COUNT		  8
 #define RDATASET_COUNT		 RDATALIST_COUNT
 
-/*
+/*%
  * Text representation of the different items, for message_totext
  * functions.
  */
@@ -133,7 +135,7 @@ static const char *rcodetext[] = {
 };
 
 
-/*
+/*%
  * "helper" type, which consists of a block of some type, and is linkable.
  * For it to work, sizeof(dns_msgblock_t) must be a multiple of the pointer
  * size, or the allocated elements will not be alligned correctly.
@@ -1441,7 +1443,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 		/*
 		 * Minimize TTLs.
 		 *
-		 * Section 5.2 of RFC 2181 says we should drop
+		 * Section 5.2 of RFC2181 says we should drop
 		 * nonauthoritative rrsets where the TTLs differ, but we
 		 * currently treat them the as if they were authoritative and
 		 * minimize them.
@@ -2282,6 +2284,18 @@ dns_message_addname(dns_message_t *msg, dns_name_t *name,
 	ISC_LIST_APPEND(msg->sections[section], name, link);
 }
 
+void
+dns_message_removename(dns_message_t *msg, dns_name_t *name,
+		       dns_section_t section)
+{
+	REQUIRE(msg != NULL);
+	REQUIRE(msg->from_to_wire == DNS_MESSAGE_INTENTRENDER);
+	REQUIRE(name != NULL);
+	REQUIRE(VALID_NAMED_SECTION(section));
+
+	ISC_LIST_UNLINK(msg->sections[section], name, link);
+}
+
 isc_result_t
 dns_message_gettempname(dns_message_t *msg, dns_name_t **item) {
 	REQUIRE(DNS_MESSAGE_VALID(msg));
diff --git a/contrib/bind9/lib/dns/name.c b/contrib/bind9/lib/dns/name.c
index 1a257de..7f5d4e9 100644
--- a/contrib/bind9/lib/dns/name.c
+++ b/contrib/bind9/lib/dns/name.c
@@ -15,17 +15,22 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: name.c,v 1.127.2.7.2.16 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: name.c,v 1.144.18.16 2006/12/07 07:03:10 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
 #include <ctype.h>
+#include <stdlib.h>
 
 #include <isc/buffer.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
+#include <isc/once.h>
 #include <isc/print.h>
 #include <isc/string.h>
+#include <isc/thread.h>
 #include <isc/util.h>
 
 #include <dns/compress.h>
@@ -122,7 +127,7 @@ static unsigned char maptolower[] = {
 		set_offsets(name, var, NULL); \
 	}
 
-/*
+/*%
  * Note:  If additional attributes are added that should not be set for
  *	  empty names, MAKE_EMPTY() must be changed so it clears them.
  */
@@ -134,7 +139,7 @@ do { \
 	name->attributes &= ~DNS_NAMEATTR_ABSOLUTE; \
 } while (0);
 
-/*
+/*%
  * A name is "bindable" if it can be set to point to a new value, i.e.
  * name->ndata and name->length may be changed.
  */
@@ -142,7 +147,7 @@ do { \
 	((name->attributes & (DNS_NAMEATTR_READONLY|DNS_NAMEATTR_DYNAMIC)) \
 	 == 0)
 
-/*
+/*%
  * Note that the name data must be a char array, not a string
  * literal, to avoid compiler warnings about discarding
  * the const attribute of a string.
@@ -182,6 +187,19 @@ LIBDNS_EXTERNAL_DATA dns_name_t *dns_wildcardname = &wild;
 unsigned int
 dns_fullname_hash(dns_name_t *name, isc_boolean_t case_sensitive);
 
+/*
+ * dns_name_t to text post-conversion procedure.
+ */
+#ifdef ISC_PLATFORM_USETHREADS
+static int thread_key_initialized = 0;
+static isc_mutex_t thread_key_mutex;
+static isc_mem_t *thread_key_mctx = NULL;
+static isc_thread_key_t totext_filter_proc_key;
+static isc_once_t once = ISC_ONCE_INIT;
+#else
+static dns_name_totextfilter_t totext_filter_proc = NULL;
+#endif
+
 static void
 set_offsets(const dns_name_t *name, unsigned char *offsets,
 	    dns_name_t *set_name);
@@ -385,6 +403,41 @@ dns_name_iswildcard(const dns_name_t *name) {
 	return (ISC_FALSE);
 }
 
+isc_boolean_t
+dns_name_internalwildcard(const dns_name_t *name) {
+	unsigned char *ndata;
+	unsigned int count;
+	unsigned int label;
+
+	/*
+	 * Does 'name' contain a internal wildcard?
+	 */
+
+	REQUIRE(VALID_NAME(name));
+	REQUIRE(name->labels > 0);
+
+	/*
+	 * Skip first label.
+	 */
+	ndata = name->ndata;
+	count = *ndata++;
+	INSIST(count <= 63);
+	ndata += count;
+	label = 1;
+	/*
+	 * Check all but the last of the remaining labels.
+	 */
+	while (label + 1 < name->labels) {
+		count = *ndata++;
+		INSIST(count <= 63);
+		if (count == 1 && *ndata == '*')
+			return (ISC_TRUE);
+		ndata += count;
+		label++;
+	}
+	return (ISC_FALSE);
+}
+
 static inline unsigned int
 name_hash(dns_name_t *name, isc_boolean_t case_sensitive) {
 	unsigned int length;
@@ -664,6 +717,35 @@ dns_name_equal(const dns_name_t *name1, const dns_name_t *name2) {
 	return (ISC_TRUE);
 }
 
+isc_boolean_t
+dns_name_caseequal(const dns_name_t *name1, const dns_name_t *name2) {
+
+	/*
+	 * Are 'name1' and 'name2' equal?
+	 *
+	 * Note: It makes no sense for one of the names to be relative and the
+	 * other absolute.  If both names are relative, then to be meaningfully
+	 * compared the caller must ensure that they are both relative to the
+	 * same domain.
+	 */
+
+	REQUIRE(VALID_NAME(name1));
+	REQUIRE(VALID_NAME(name2));
+	/*
+	 * Either name1 is absolute and name2 is absolute, or neither is.
+	 */
+	REQUIRE((name1->attributes & DNS_NAMEATTR_ABSOLUTE) ==
+		(name2->attributes & DNS_NAMEATTR_ABSOLUTE));
+
+	if (name1->length != name2->length)
+		return (ISC_FALSE);
+
+	if (memcmp(name1->ndata, name2->ndata, name1->length) != 0)
+		return (ISC_FALSE);
+
+	return (ISC_TRUE);
+}
+
 int
 dns_name_rdatacompare(const dns_name_t *name1, const dns_name_t *name2) {
 	unsigned int l1, l2, l, count1, count2, count;
@@ -1189,6 +1271,54 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 	return (ISC_R_SUCCESS);
 }
 
+#ifdef ISC_PLATFORM_USETHREADS
+static void
+free_specific(void *arg) {
+	dns_name_totextfilter_t *mem = arg;
+	isc_mem_put(thread_key_mctx, mem, sizeof(*mem));
+	/* Stop use being called again. */
+	(void)isc_thread_key_setspecific(totext_filter_proc_key, NULL);
+}
+
+static void
+thread_key_mutex_init(void) {
+	RUNTIME_CHECK(isc_mutex_init(&thread_key_mutex) == ISC_R_SUCCESS);
+}
+
+static isc_result_t
+totext_filter_proc_key_init(void) {
+	isc_result_t result;
+
+	/*
+	 * We need the call to isc_once_do() to support profiled mutex
+	 * otherwise thread_key_mutex could be initialized at compile time.
+	 */
+	result = isc_once_do(&once, thread_key_mutex_init);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+        if (!thread_key_initialized) {
+		LOCK(&thread_key_mutex);
+		if (thread_key_mctx == NULL)
+			result = isc_mem_create2(0, 0, &thread_key_mctx, 0);
+		if (result != ISC_R_SUCCESS)
+			goto unlock;
+		isc_mem_setdestroycheck(thread_key_mctx, ISC_FALSE);
+		
+		if (!thread_key_initialized &&
+		     isc_thread_key_create(&totext_filter_proc_key,
+					    free_specific) != 0) {
+			result = ISC_R_FAILURE;
+			isc_mem_detach(&thread_key_mctx);
+		} else
+			thread_key_initialized = 1;
+ unlock:
+		UNLOCK(&thread_key_mutex);
+        }
+	return (result);
+}
+#endif
+
 isc_result_t
 dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 		isc_buffer_t *target)
@@ -1200,6 +1330,12 @@ dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 	unsigned int trem, count;
 	unsigned int labels;
 	isc_boolean_t saw_root = ISC_FALSE;
+	unsigned int oused = target->used;
+#ifdef ISC_PLATFORM_USETHREADS
+	dns_name_totextfilter_t *mem;
+	dns_name_totextfilter_t totext_filter_proc = NULL;
+	isc_result_t result;
+#endif
 
 	/*
 	 * This function assumes the name is in proper uncompressed
@@ -1208,6 +1344,11 @@ dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 	REQUIRE(VALID_NAME(name));
 	REQUIRE(ISC_BUFFER_VALID(target));
 
+#ifdef ISC_PLATFORM_USETHREADS
+	result = totext_filter_proc_key_init();
+	if (result != ISC_R_SUCCESS)
+		return (result);
+#endif
 	ndata = name->ndata;
 	nlen = name->length;
 	labels = name->labels;
@@ -1339,6 +1480,14 @@ dns_name_totext(dns_name_t *name, isc_boolean_t omit_final_dot,
 
 	isc_buffer_add(target, tlen - trem);
 
+#ifdef ISC_PLATFORM_USETHREADS
+	mem = isc_thread_key_getspecific(totext_filter_proc_key);
+	if (mem != NULL)
+		totext_filter_proc = *mem;
+#endif
+	if (totext_filter_proc != NULL)
+		return ((*totext_filter_proc)(target, oused, saw_root));
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1573,7 +1722,7 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 {
 	unsigned char *cdata, *ndata;
 	unsigned int cused; /* Bytes of compressed name data used */
-	unsigned int hops,  nused, labels, n, nmax;
+	unsigned int nused, labels, n, nmax;
 	unsigned int current, new_current, biggest_pointer;
 	isc_boolean_t done;
 	fw_state state = fw_start;
@@ -1581,10 +1730,12 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 	unsigned char *offsets;
 	dns_offsets_t odata;
 	isc_boolean_t downcase;
+	isc_boolean_t seen_pointer;
 
 	/*
 	 * Copy the possibly-compressed name at source into target,
-	 * decompressing it.
+	 * decompressing it.  Loop prevention is performed by checking
+	 * the new pointer against biggest_pointer.
 	 */
 
 	REQUIRE(VALID_NAME(name));
@@ -1618,11 +1769,11 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 	 * Set up.
 	 */
 	labels = 0;
-	hops = 0;
 	done = ISC_FALSE;
 
 	ndata = isc_buffer_used(target);
 	nused = 0;
+	seen_pointer = ISC_FALSE;
 
 	/*
 	 * Find the maximum number of uncompressed target name
@@ -1648,7 +1799,7 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 	while (current < source->active && !done) {
 		c = *cdata++;
 		current++;
-		if (hops == 0)
+		if (!seen_pointer)
 			cused++;
 
 		switch (state) {
@@ -1704,11 +1855,8 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 				return (DNS_R_BADPOINTER);
 			biggest_pointer = new_current;
 			current = new_current;
-			cdata = (unsigned char *)source->base +
-				current;
-			hops++;
-			if (hops > DNS_POINTER_MAXHOPS)
-				return (DNS_R_TOOMANYHOPS);
+			cdata = (unsigned char *)source->base + current;
+			seen_pointer = ISC_TRUE;
 			state = fw_start;
 			break;
 		default:
@@ -1744,7 +1892,6 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 		 * big enough buffer.
 		 */
 		return (ISC_R_NOSPACE);
-
 }
 
 isc_result_t
@@ -2124,6 +2271,49 @@ dns_name_print(dns_name_t *name, FILE *stream) {
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+dns_name_settotextfilter(dns_name_totextfilter_t proc) {
+#ifdef ISC_PLATFORM_USETHREADS
+	isc_result_t result;
+	dns_name_totextfilter_t *mem;
+	int res;
+
+	result = totext_filter_proc_key_init();
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	/*
+	 * If we already have been here set / clear as appropriate.
+	 * Otherwise allocate memory.
+	 */
+	mem = isc_thread_key_getspecific(totext_filter_proc_key);
+	if (mem != NULL && proc != NULL) {
+		*mem = proc;
+		return (ISC_R_SUCCESS);
+	}
+	if (proc == NULL) {
+		isc_mem_put(thread_key_mctx, mem, sizeof(*mem));
+		res = isc_thread_key_setspecific(totext_filter_proc_key, NULL);
+		if (res != 0)
+			result = ISC_R_UNEXPECTED;
+		return (result);
+	}
+	
+	mem = isc_mem_get(thread_key_mctx, sizeof(*mem));
+	if (mem == NULL)
+		return (ISC_R_NOMEMORY);
+	*mem = proc;
+	if (isc_thread_key_setspecific(totext_filter_proc_key, mem) != 0) {
+		isc_mem_put(thread_key_mctx, mem, sizeof(*mem));
+		result = ISC_R_UNEXPECTED;
+	}
+	return (result);
+#else
+	totext_filter_proc = proc;
+	return (ISC_R_SUCCESS);
+#endif
+}
+
 void
 dns_name_format(dns_name_t *name, char *cp, unsigned int size) {
 	isc_result_t result;
@@ -2198,3 +2388,19 @@ dns_name_copy(dns_name_t *source, dns_name_t *dest, isc_buffer_t *target) {
 	return (ISC_R_SUCCESS);
 }
 
+void
+dns_name_destroy(void) {
+#ifdef ISC_PLATFORM_USETHREADS
+	RUNTIME_CHECK(isc_once_do(&once, thread_key_mutex_init)
+				  == ISC_R_SUCCESS);
+
+	LOCK(&thread_key_mutex);
+	if (thread_key_initialized) {
+		isc_mem_detach(&thread_key_mctx);
+		isc_thread_key_delete(totext_filter_proc_key);
+		thread_key_initialized = 0;
+	}
+	UNLOCK(&thread_key_mutex);
+
+#endif
+}
diff --git a/contrib/bind9/lib/dns/ncache.c b/contrib/bind9/lib/dns/ncache.c
index dddde60..1fdc5c8 100644
--- a/contrib/bind9/lib/dns/ncache.c
+++ b/contrib/bind9/lib/dns/ncache.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ncache.c,v 1.24.2.4.2.7 2004/03/08 02:07:54 marka Exp $ */
+/* $Id: ncache.c,v 1.36.18.3 2005/04/29 00:15:59 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -184,7 +186,7 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		 *
 		 * We trust that the caller wants negative caching, so this
 		 * means we have a "type 3 nxdomain" or "type 3 nodata"
-		 * response (see RFC 2308 for details).
+		 * response (see RFC2308 for details).
 		 *
 		 * We will now build a suitable negative cache rdataset that
 		 * will cause zero bytes to be emitted when converted to
@@ -208,7 +210,7 @@ dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 		isc_buffer_putuint16(&buffer, 0);
 		isc_buffer_putuint16(&buffer, 0);
 		/*
-		 * RFC 2308, section 5, says that negative answers without
+		 * RFC2308, section 5, says that negative answers without
 		 * SOAs should not be cached.
 		 */
 		ttl = 0;
@@ -473,6 +475,9 @@ static dns_rdatasetmethods_t rdataset_methods = {
 	rdataset_clone,
 	rdataset_count,
 	NULL,
+	NULL,
+	NULL,
+	NULL,
 	NULL
 };
 
diff --git a/contrib/bind9/lib/dns/nsec.c b/contrib/bind9/lib/dns/nsec.c
index c259706..c1de67e 100644
--- a/contrib/bind9/lib/dns/nsec.c
+++ b/contrib/bind9/lib/dns/nsec.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec.c,v 1.5.2.1 2004/03/08 02:07:55 marka Exp $ */
+/* $Id: nsec.c,v 1.5.20.2 2005/04/29 00:15:59 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/openssl_link.c b/contrib/bind9/lib/dns/openssl_link.c
index 525905c..fda610a 100644
--- a/contrib/bind9/lib/dns/openssl_link.c
+++ b/contrib/bind9/lib/dns/openssl_link.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -18,7 +18,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: openssl_link.c,v 1.1.4.3 2006/05/23 23:51:03 marka Exp $
+ * $Id: openssl_link.c,v 1.1.6.9 2006/05/23 23:51:04 marka Exp $
  */
 #ifdef OPENSSL
 
@@ -37,6 +37,8 @@
 
 #include <openssl/err.h>
 #include <openssl/rand.h>
+#include <openssl/evp.h>
+#include <openssl/conf.h>
 #include <openssl/crypto.h>
 
 #if defined(CRYPTO_LOCK_ENGINE) && (OPENSSL_VERSION_NUMBER != 0x00907000L)
@@ -132,6 +134,11 @@ isc_result_t
 dst__openssl_init() {
 	isc_result_t result;
 
+#ifdef  DNS_CRYPTO_LEAKS
+	CRYPTO_malloc_debug_init();
+	CRYPTO_set_mem_debug_options(V_CRYPTO_MDEBUG_ALL);
+	CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON);
+#endif
 	CRYPTO_set_mem_functions(mem_alloc, mem_realloc, mem_free);
 	nlocks = CRYPTO_num_locks();
 	locks = mem_alloc(sizeof(isc_mutex_t) * nlocks);
@@ -179,6 +186,33 @@ dst__openssl_init() {
 
 void
 dst__openssl_destroy() {
+
+	/*
+	 * Sequence taken from apps_shutdown() in <apps/apps.h>.
+	 */
+#if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+	CONF_modules_unload(1);
+#endif
+	EVP_cleanup();
+#if defined(USE_ENGINE) && OPENSSL_VERSION_NUMBER >= 0x00907000L
+	ENGINE_cleanup();
+#endif
+#if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+	CRYPTO_cleanup_all_ex_data();
+#endif
+	ERR_clear_error();
+	ERR_free_strings();
+	ERR_remove_state(0);
+
+#ifdef  DNS_CRYPTO_LEAKS
+	CRYPTO_mem_leaks_fp(stderr);
+#endif
+
+#if 0
+	/*
+	 * The old error sequence that leaked.  Remove for 9.4.1 if
+	 * there are no issues by then.
+	 */
 	ERR_clear_error();
 #ifdef USE_ENGINE
 	if (e != NULL) {
@@ -186,12 +220,17 @@ dst__openssl_destroy() {
 		e = NULL;
 	}
 #endif
+#endif
 	if (locks != NULL) {
 		DESTROYMUTEXBLOCK(locks, nlocks);
 		mem_free(locks);
 	}
-	if (rm != NULL)
+	if (rm != NULL) {
+#if OPENSSL_VERSION_NUMBER >= 0x00907000L
+		RAND_cleanup();
+#endif
 		mem_free(rm);
+	}
 }
 
 isc_result_t
@@ -217,3 +256,4 @@ dst__openssl_toresult(isc_result_t fallback) {
 EMPTY_TRANSLATION_UNIT
 
 #endif /* OPENSSL */
+/*! \file */
diff --git a/contrib/bind9/lib/dns/openssldh_link.c b/contrib/bind9/lib/dns/openssldh_link.c
index 74ba39a..6f2e987 100644
--- a/contrib/bind9/lib/dns/openssldh_link.c
+++ b/contrib/bind9/lib/dns/openssldh_link.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -18,7 +18,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: openssldh_link.c,v 1.1.4.3 2006/03/02 00:37:20 marka Exp $
+ * $Id: openssldh_link.c,v 1.1.6.9 2007/01/08 02:52:39 marka Exp $
  */
 
 #ifdef OPENSSL
@@ -138,81 +138,11 @@ openssldh_paramcompare(const dst_key_t *key1, const dst_key_t *key2) {
 	return (ISC_TRUE);
 }
 
-#ifndef HAVE_DH_GENERATE_PARAMETERS
-/* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-static DH *
-DH_generate_parameters(int prime_len, int generator,
-		       void (*callback)(int,int,void *), void *cb_arg)
-{
-        BN_GENCB cb;
-        DH *dh = NULL;
-
-	dh = DH_new();
-	if (dh != NULL) {
-		BN_GENCB_set_old(&cb, callback, cb_arg);
-
-		if (DH_generate_parameters_ex(dh, prime_len, generator, &cb))
-			return (dh);
-		DH_free(dh);
-	}
-        return (NULL);
-}
-#endif
-
 static isc_result_t
 openssldh_generate(dst_key_t *key, int generator) {
+#if OPENSSL_VERSION_NUMBER > 0x00908000L
+        BN_GENCB cb;
+#endif
 	DH *dh = NULL;
 
 	if (generator == 0) {
@@ -222,7 +152,7 @@ openssldh_generate(dst_key_t *key, int generator) {
 		{
 			dh = DH_new();
 			if (dh == NULL)
-				return (ISC_R_NOMEMORY);
+				return (dst__openssl_toresult(ISC_R_NOMEMORY));
 			if (key->key_size == 768)
 				dh->p = &bn768;
 			else if (key->key_size == 1024)
@@ -230,14 +160,28 @@ openssldh_generate(dst_key_t *key, int generator) {
 			else
 				dh->p = &bn1536;
 			dh->g = &bn2;
-		}
-		else
+		} else
 			generator = 2;
 	}
 
-	if (generator != 0)
+	if (generator != 0) {
+#if OPENSSL_VERSION_NUMBER > 0x00908000L
+		dh = DH_new();
+		if (dh == NULL)
+			return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+
+		BN_GENCB_set_old(&cb, NULL, NULL);
+
+		if (!DH_generate_parameters_ex(dh, key->key_size, generator,
+					       &cb)) {
+			DH_free(dh);
+			return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+		}
+#else
 		dh = DH_generate_parameters(key->key_size, generator,
 					    NULL, NULL);
+#endif
+	}
 
 	if (dh == NULL)
 		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
@@ -358,7 +302,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
 
 	dh = DH_new();
 	if (dh == NULL)
-		return (ISC_R_NOMEMORY);
+		return (dst__openssl_toresult(ISC_R_NOMEMORY));
 	dh->flags &= ~DH_FLAG_CACHE_MONT_P;
 
 	/*
@@ -637,11 +581,11 @@ openssldh_cleanup(void) {
 }
 
 static dst_func_t openssldh_functions = {
-	NULL, /* createctx */
-	NULL, /* destroyctx */
-	NULL, /* adddata */
-	NULL, /* openssldh_sign */
-	NULL, /* openssldh_verify */
+	NULL, /*%< createctx */
+	NULL, /*%< destroyctx */
+	NULL, /*%< adddata */
+	NULL, /*%< openssldh_sign */
+	NULL, /*%< openssldh_verify */
 	openssldh_computesecret,
 	openssldh_compare,
 	openssldh_paramcompare,
@@ -679,3 +623,4 @@ dst__openssldh_init(dst_func_t **funcp) {
 EMPTY_TRANSLATION_UNIT
 
 #endif /* OPENSSL */
+/*! \file */
diff --git a/contrib/bind9/lib/dns/openssldsa_link.c b/contrib/bind9/lib/dns/openssldsa_link.c
index 267bfe8..64e6159 100644
--- a/contrib/bind9/lib/dns/openssldsa_link.c
+++ b/contrib/bind9/lib/dns/openssldsa_link.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2002  Internet Software Consortium.
  * Portions Copyright (C) 1995-2000 by Network Associates, Inc.
  *
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: openssldsa_link.c,v 1.1.4.3 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: openssldsa_link.c,v 1.1.6.8 2007/01/08 03:03:48 marka Exp $ */
 
 #ifdef OPENSSL
 
@@ -124,7 +124,7 @@ openssldsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 	if (sig->length < 2 * ISC_SHA1_DIGESTLENGTH + 1)
 		return (DST_R_VERIFYFAILURE);
 
-	cp++;	/* Skip T */
+	cp++;	/*%< Skip T */
 	dsasig = DSA_SIG_new();
 	dsasig->r = BN_bin2bn(cp, ISC_SHA1_DIGESTLENGTH, NULL);
 	cp += ISC_SHA1_DIGESTLENGTH;
@@ -169,85 +169,11 @@ openssldsa_compare(const dst_key_t *key1, const dst_key_t *key2) {
 	return (ISC_TRUE);
 }
 
-#ifndef HAVE_DSA_GENERATE_PARAMETERS
-/* ====================================================================
- * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-static DSA *
-DSA_generate_parameters(int bits, unsigned char *seed_in, int seed_len,
-			int *counter_ret, unsigned long *h_ret,
-			void (*callback)(int, int, void *),
-			void *cb_arg)
-{
-        BN_GENCB cb;
-        DSA *dsa;
- 
-        dsa = DSA_new();
-	if (dsa != NULL) {
- 
-		BN_GENCB_set_old(&cb, callback, cb_arg);
-  
-		if (DSA_generate_parameters_ex(dsa, bits, seed_in, seed_len,  
-					       counter_ret, h_ret, &cb))
-			return (dsa);
-		DSA_free(dsa);
-	}
-        return (NULL);
-}
-#endif
-
 static isc_result_t
 openssldsa_generate(dst_key_t *key, int unused) {
+#if OPENSSL_VERSION_NUMBER > 0x00908000L
+        BN_GENCB cb;
+#endif
 	DSA *dsa;
 	unsigned char rand_array[ISC_SHA1_DIGESTLENGTH];
 	isc_result_t result;
@@ -259,12 +185,27 @@ openssldsa_generate(dst_key_t *key, int unused) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
+#if OPENSSL_VERSION_NUMBER > 0x00908000L
+        dsa = DSA_new();
+	if (dsa == NULL)
+		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+
+	BN_GENCB_set_old(&cb, NULL, NULL);
+  
+	if (!DSA_generate_parameters_ex(dsa, key->key_size, rand_array,
+					ISC_SHA1_DIGESTLENGTH,  NULL, NULL,
+					&cb))
+	{
+		DSA_free(dsa);
+		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+	}
+#else
 	dsa = DSA_generate_parameters(key->key_size, rand_array,
 				      ISC_SHA1_DIGESTLENGTH, NULL, NULL,
 				      NULL, NULL);
-
 	if (dsa == NULL)
 		return (dst__openssl_toresult(DST_R_OPENSSLFAILURE));
+#endif
 
 	if (DSA_generate_key(dsa) == 0) {
 		DSA_free(dsa);
@@ -490,9 +431,9 @@ static dst_func_t openssldsa_functions = {
 	openssldsa_adddata,
 	openssldsa_sign,
 	openssldsa_verify,
-	NULL, /* computesecret */
+	NULL, /*%< computesecret */
 	openssldsa_compare,
-	NULL, /* paramcompare */
+	NULL, /*%< paramcompare */
 	openssldsa_generate,
 	openssldsa_isprivate,
 	openssldsa_destroy,
@@ -500,7 +441,7 @@ static dst_func_t openssldsa_functions = {
 	openssldsa_fromdns,
 	openssldsa_tofile,
 	openssldsa_parse,
-	NULL, /* cleanup */
+	NULL, /*%< cleanup */
 };
 
 isc_result_t
@@ -518,3 +459,4 @@ dst__openssldsa_init(dst_func_t **funcp) {
 EMPTY_TRANSLATION_UNIT
 
 #endif /* OPENSSL */
+/*! \file */
diff --git a/contrib/bind9/lib/dns/opensslrsa_link.c b/contrib/bind9/lib/dns/opensslrsa_link.c
index c33913c..2609df6 100644
--- a/contrib/bind9/lib/dns/opensslrsa_link.c
+++ b/contrib/bind9/lib/dns/opensslrsa_link.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.1.4.9 2006/11/07 21:28:40 marka Exp $
+ * $Id: opensslrsa_link.c,v 1.1.6.11 2006/11/07 21:28:49 marka Exp $
  */
 #ifdef OPENSSL
 
@@ -50,7 +50,7 @@
 #ifdef WIN32
 #if !((OPENSSL_VERSION_NUMBER >= 0x009070cfL && \
        OPENSSL_VERSION_NUMBER < 0x00908000L) || \
-      OPENSSL_VERSION_NUMBER >= 0x0090804fL) 
+      OPENSSL_VERSION_NUMBER >= 0x0090804fL)
 #error Please upgrade OpenSSL to 0.9.8d/0.9.7l or greater.
 #endif
 #endif
@@ -367,7 +367,7 @@ opensslrsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 	e_bytes = BN_num_bytes(rsa->e);
 	mod_bytes = BN_num_bytes(rsa->n);
 
-	if (e_bytes < 256) {	/* key exponent is <= 2040 bits */
+	if (e_bytes < 256) {	/*%< key exponent is <= 2040 bits */
 		if (r.length < 1)
 			return (ISC_R_NOSPACE);
 		isc_buffer_putuint8(data, (isc_uint8_t) e_bytes);
@@ -403,7 +403,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
 
 	rsa = RSA_new();
 	if (rsa == NULL)
-		return (ISC_R_NOMEMORY);
+		return (dst__openssl_toresult(ISC_R_NOMEMORY));
 	SET_FLAGS(rsa);
 
 	if (r.length < 1) {
@@ -598,9 +598,9 @@ static dst_func_t opensslrsa_functions = {
 	opensslrsa_adddata,
 	opensslrsa_sign,
 	opensslrsa_verify,
-	NULL, /* computesecret */
+	NULL, /*%< computesecret */
 	opensslrsa_compare,
-	NULL, /* paramcompare */
+	NULL, /*%< paramcompare */
 	opensslrsa_generate,
 	opensslrsa_isprivate,
 	opensslrsa_destroy,
@@ -608,7 +608,7 @@ static dst_func_t opensslrsa_functions = {
 	opensslrsa_fromdns,
 	opensslrsa_tofile,
 	opensslrsa_parse,
-	NULL, /* cleanup */
+	NULL, /*%< cleanup */
 };
 
 isc_result_t
@@ -626,3 +626,4 @@ dst__opensslrsa_init(dst_func_t **funcp) {
 EMPTY_TRANSLATION_UNIT
 
 #endif /* OPENSSL */
+/*! \file */
diff --git a/contrib/bind9/lib/dns/order.c b/contrib/bind9/lib/dns/order.c
index f09afed..1d216b7 100644
--- a/contrib/bind9/lib/dns/order.c
+++ b/contrib/bind9/lib/dns/order.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: order.c,v 1.4.202.4 2004/03/08 09:04:30 marka Exp $ */
+/* $Id: order.c,v 1.5.18.3 2005/07/12 01:22:21 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -53,6 +55,8 @@ struct dns_order {
 isc_result_t
 dns_order_create(isc_mem_t *mctx, dns_order_t **orderp) {
 	dns_order_t *order;
+	isc_result_t result;
+
 	REQUIRE(orderp != NULL && *orderp == NULL);
 
 	order = isc_mem_get(mctx, sizeof(*order));
@@ -60,7 +64,13 @@ dns_order_create(isc_mem_t *mctx, dns_order_t **orderp) {
 		return (ISC_R_NOMEMORY);
 	
 	ISC_LIST_INIT(order->ents);
-	isc_refcount_init(&order->references, 1);     /* Implicit attach. */
+
+	/* Implicit attach. */
+	result = isc_refcount_init(&order->references, 1);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, order, sizeof(*order));
+		return (result);
+	}
 
 	order->mctx = NULL;
 	isc_mem_attach(mctx, &order->mctx);
diff --git a/contrib/bind9/lib/dns/peer.c b/contrib/bind9/lib/dns/peer.c
index 8b6ccdb..7d878b5 100644
--- a/contrib/bind9/lib/dns/peer.c
+++ b/contrib/bind9/lib/dns/peer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: peer.c,v 1.14.2.1.10.6 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: peer.c,v 1.19.18.8 2006/02/28 03:10:48 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -29,7 +31,7 @@
 #include <dns/name.h>
 #include <dns/peer.h>
 
-/*
+/*%
  * Bit positions in the dns_peer_t structure flags field
  */
 #define BOGUS_BIT			0
@@ -38,6 +40,8 @@
 #define PROVIDE_IXFR_BIT		3
 #define REQUEST_IXFR_BIT		4
 #define SUPPORT_EDNS_BIT		5
+#define SERVER_UDPSIZE_BIT		6
+#define SERVER_MAXUDP_BIT		7
 
 static void
 peerlist_delete(dns_peerlist_t **list);
@@ -65,7 +69,6 @@ dns_peerlist_new(isc_mem_t *mem, dns_peerlist_t **list) {
 	return (ISC_R_SUCCESS);
 }
 
-
 void
 dns_peerlist_attach(dns_peerlist_t *source, dns_peerlist_t **target) {
 	REQUIRE(DNS_PEERLIST_VALID(source));
@@ -130,7 +133,20 @@ dns_peerlist_addpeer(dns_peerlist_t *peers, dns_peer_t *peer) {
 
 	dns_peer_attach(peer, &p);
 
-	ISC_LIST_APPEND(peers->elements, peer, next);
+	/*
+	 * More specifics to front of list.
+	 */
+	for (p = ISC_LIST_HEAD(peers->elements);
+	     p != NULL;
+	     p = ISC_LIST_NEXT(p, next))
+		if (p->prefixlen < peer->prefixlen)
+			break;
+
+	if (p != NULL)
+		ISC_LIST_INSERTBEFORE(peers->elements, p, peer, next);
+	else
+		ISC_LIST_APPEND(peers->elements, peer, next);
+		
 }
 
 isc_result_t
@@ -145,7 +161,8 @@ dns_peerlist_peerbyaddr(dns_peerlist_t *servers,
 
 	server = ISC_LIST_HEAD(servers->elements);
 	while (server != NULL) {
-		if (isc_netaddr_equal(addr, &server->address))
+		if (isc_netaddr_eqprefix(addr, &server->address,
+					 server->prefixlen))
 			break;
 
 		server = ISC_LIST_NEXT(server, next);
@@ -176,6 +193,27 @@ dns_peerlist_currpeer(dns_peerlist_t *peers, dns_peer_t **retval) {
 
 isc_result_t
 dns_peer_new(isc_mem_t *mem, isc_netaddr_t *addr, dns_peer_t **peerptr) {
+	unsigned int prefixlen = 0;
+
+	REQUIRE(peerptr != NULL);
+	switch(addr->family) {
+	case AF_INET:
+		prefixlen = 32;
+		break;
+	case AF_INET6:
+		 prefixlen = 128;
+		break;
+	default:
+		INSIST(0);
+	}
+
+	return (dns_peer_newprefix(mem, addr, prefixlen, peerptr));
+}
+
+isc_result_t
+dns_peer_newprefix(isc_mem_t *mem, isc_netaddr_t *addr, unsigned int prefixlen,
+		   dns_peer_t **peerptr)
+{ 
 	dns_peer_t *peer;
 
 	REQUIRE(peerptr != NULL);
@@ -186,6 +224,7 @@ dns_peer_new(isc_mem_t *mem, isc_netaddr_t *addr, dns_peer_t **peerptr) {
 
 	peer->magic = DNS_PEER_MAGIC;
 	peer->address = *addr;
+	peer->prefixlen = prefixlen;
 	peer->mem = mem;
 	peer->bogus = ISC_FALSE;
 	peer->transfer_format = dns_one_answer;
@@ -195,6 +234,8 @@ dns_peer_new(isc_mem_t *mem, isc_netaddr_t *addr, dns_peer_t **peerptr) {
 	peer->key = NULL;
 	peer->refs = 1;
 	peer->transfer_source = NULL;
+	peer->notify_source = NULL;
+	peer->query_source = NULL;
 
 	memset(&peer->bitflags, 0x0, sizeof(peer->bitflags));
 
@@ -522,3 +563,123 @@ dns_peer_gettransfersource(dns_peer_t *peer, isc_sockaddr_t *transfer_source) {
 	*transfer_source = *peer->transfer_source;
 	return (ISC_R_SUCCESS);
 }
+
+isc_result_t
+dns_peer_setnotifysource(dns_peer_t *peer,
+			 const isc_sockaddr_t *notify_source)
+{
+	REQUIRE(DNS_PEER_VALID(peer));
+
+	if (peer->notify_source != NULL) {
+		isc_mem_put(peer->mem, peer->notify_source,
+			    sizeof(*peer->notify_source));
+		peer->notify_source = NULL;
+	}
+	if (notify_source != NULL) {
+		peer->notify_source = isc_mem_get(peer->mem,
+					        sizeof(*peer->notify_source));
+		if (peer->notify_source == NULL)
+			return (ISC_R_NOMEMORY);
+
+		*peer->notify_source = *notify_source;
+	}
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_peer_getnotifysource(dns_peer_t *peer, isc_sockaddr_t *notify_source) {
+	REQUIRE(DNS_PEER_VALID(peer));
+	REQUIRE(notify_source != NULL);
+
+	if (peer->notify_source == NULL)
+		return (ISC_R_NOTFOUND);
+	*notify_source = *peer->notify_source;
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_peer_setquerysource(dns_peer_t *peer, const isc_sockaddr_t *query_source) {
+	REQUIRE(DNS_PEER_VALID(peer));
+
+	if (peer->query_source != NULL) {
+		isc_mem_put(peer->mem, peer->query_source,
+			    sizeof(*peer->query_source));
+		peer->query_source = NULL;
+	}
+	if (query_source != NULL) {
+		peer->query_source = isc_mem_get(peer->mem,
+					        sizeof(*peer->query_source));
+		if (peer->query_source == NULL)
+			return (ISC_R_NOMEMORY);
+
+		*peer->query_source = *query_source;
+	}
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_peer_getquerysource(dns_peer_t *peer, isc_sockaddr_t *query_source) {
+	REQUIRE(DNS_PEER_VALID(peer));
+	REQUIRE(query_source != NULL);
+
+	if (peer->query_source == NULL)
+		return (ISC_R_NOTFOUND);
+	*query_source = *peer->query_source;
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_peer_setudpsize(dns_peer_t *peer, isc_uint16_t udpsize) {
+	isc_boolean_t existed;
+
+	REQUIRE(DNS_PEER_VALID(peer));
+
+	existed = DNS_BIT_CHECK(SERVER_UDPSIZE_BIT, &peer->bitflags);
+
+	peer->udpsize = udpsize;
+	DNS_BIT_SET(SERVER_UDPSIZE_BIT, &peer->bitflags);
+
+	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_peer_getudpsize(dns_peer_t *peer, isc_uint16_t *udpsize) {
+
+	REQUIRE(DNS_PEER_VALID(peer));
+	REQUIRE(udpsize != NULL);
+
+	if (DNS_BIT_CHECK(SERVER_UDPSIZE_BIT, &peer->bitflags)) {
+                *udpsize = peer->udpsize;
+                return (ISC_R_SUCCESS);
+        } else {
+                return (ISC_R_NOTFOUND);
+        }
+}
+
+isc_result_t
+dns_peer_setmaxudp(dns_peer_t *peer, isc_uint16_t maxudp) {
+	isc_boolean_t existed;
+
+	REQUIRE(DNS_PEER_VALID(peer));
+
+	existed = DNS_BIT_CHECK(SERVER_MAXUDP_BIT, &peer->bitflags);
+
+	peer->maxudp = maxudp;
+	DNS_BIT_SET(SERVER_MAXUDP_BIT, &peer->bitflags);
+
+	return (existed ? ISC_R_EXISTS : ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_peer_getmaxudp(dns_peer_t *peer, isc_uint16_t *maxudp) {
+
+	REQUIRE(DNS_PEER_VALID(peer));
+	REQUIRE(maxudp != NULL);
+
+	if (DNS_BIT_CHECK(SERVER_MAXUDP_BIT, &peer->bitflags)) {
+                *maxudp = peer->maxudp;
+                return (ISC_R_SUCCESS);
+        } else {
+                return (ISC_R_NOTFOUND);
+        }
+}
diff --git a/contrib/bind9/lib/dns/portlist.c b/contrib/bind9/lib/dns/portlist.c
index f65910b..7e76171 100644
--- a/contrib/bind9/lib/dns/portlist.c
+++ b/contrib/bind9/lib/dns/portlist.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: portlist.c,v 1.3.72.6 2006/08/25 05:25:50 marka Exp $ */
+/* $Id: portlist.c,v 1.6.18.5 2006/08/25 05:25:51 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -81,12 +83,14 @@ dns_portlist_create(isc_mem_t *mctx, dns_portlist_t **portlistp) {
         result = isc_mutex_init(&portlist->lock);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, portlist, sizeof(*portlist));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
+		return (result);
+	}
+	result = isc_refcount_init(&portlist->refcount, 1);
+	if (result != ISC_R_SUCCESS) {
+		DESTROYLOCK(&portlist->lock);
+		isc_mem_put(mctx, portlist, sizeof(*portlist));
+		return (result);
 	}
-	isc_refcount_init(&portlist->refcount, 1);
 	portlist->list = NULL;
 	portlist->allocated = 0;
 	portlist->active = 0;
diff --git a/contrib/bind9/lib/dns/rbt.c b/contrib/bind9/lib/dns/rbt.c
index ecff783..b8db99a 100644
--- a/contrib/bind9/lib/dns/rbt.c
+++ b/contrib/bind9/lib/dns/rbt.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbt.c,v 1.115.2.2.2.13 2005/06/18 01:03:24 marka Exp $ */
+/* $Id: rbt.c,v 1.128.18.7 2005/10/13 01:26:06 marka Exp $ */
+
+/*! \file */
 
 /* Principal Authors: DCL */
 
@@ -24,10 +26,11 @@
 #include <isc/mem.h>
 #include <isc/platform.h>
 #include <isc/print.h>
+#include <isc/refcount.h>
 #include <isc/string.h>
 #include <isc/util.h>
 
-/*
+/*%
  * This define is so dns/name.h (included by dns/fixedname.h) uses more
  * efficient macro calls instead of functions for a few operations.
  */
@@ -52,7 +55,7 @@
 
 #ifdef RBT_MEM_TEST
 #undef RBT_HASH_SIZE
-#define RBT_HASH_SIZE 2	/* To give the reallocation code a workout. */
+#define RBT_HASH_SIZE 2	/*%< To give the reallocation code a workout. */
 #endif
 
 struct dns_rbt {
@@ -69,7 +72,7 @@ struct dns_rbt {
 #define RED 0
 #define BLACK 1
 
-/*
+/*%
  * Elements of the rbtnode structure.
  */
 #define PARENT(node)		((node)->parent)
@@ -87,16 +90,15 @@ struct dns_rbt {
 #define IS_ROOT(node)		ISC_TF((node)->is_root == 1)
 #define FINDCALLBACK(node)	ISC_TF((node)->find_callback == 1)
 
-/*
+/*%
  * Structure elements from the rbtdb.c, not
  * used as part of the rbt.c algorithms.
  */
 #define DIRTY(node)	((node)->dirty)
 #define WILD(node)	((node)->wild)
 #define LOCKNUM(node)	((node)->locknum)
-#define REFS(node)	((node)->references)
 
-/*
+/*%
  * The variable length stuff stored after the node.
  */
 #define NAME(node)	((unsigned char *)((node) + 1))
@@ -105,7 +107,7 @@ struct dns_rbt {
 #define NODE_SIZE(node)	(sizeof(*node) + \
 			 NAMELEN(node) + OFFSETLEN(node) + PADBYTES(node))
 
-/*
+/*%
  * Color management.
  */
 #define IS_RED(node)		((node) != NULL && (node)->color == RED)
@@ -113,7 +115,7 @@ struct dns_rbt {
 #define MAKE_RED(node)		((node)->color = RED)
 #define MAKE_BLACK(node)	((node)->color = BLACK)
 
-/*
+/*%
  * Chain management.
  *
  * The "ancestors" member of chains were removed, with their job now
@@ -123,7 +125,7 @@ struct dns_rbt {
 #define ADD_LEVEL(chain, node) \
 			(chain)->levels[(chain)->level_count++] = (node)
 
-/*
+/*%
  * The following macros directly access normally private name variables.
  * These macros are used to avoid a lot of function calls in the critical
  * path of the tree traversal code.
@@ -1310,6 +1312,7 @@ dns_rbt_deletenode(dns_rbt_t *rbt, dns_rbtnode_t *node, isc_boolean_t recurse)
 #if DNS_RBT_USEMAGIC
 	node->magic = 0;
 #endif
+	dns_rbtnode_refdestroy(node);
 	isc_mem_put(rbt->mctx, node, NODE_SIZE(node));
 	rbt->nodecount--;
 
@@ -1434,9 +1437,9 @@ create_node(isc_mem_t *mctx, dns_name_t *name, dns_rbtnode_t **nodep) {
 #endif
 
 	LOCKNUM(node) = 0;
-	REFS(node) = 0;
 	WILD(node) = 0;
 	DIRTY(node) = 0;
+	dns_rbtnode_refinit(node, 0);
 	node->find_callback = 0;
 
 	MAKE_BLACK(node);
diff --git a/contrib/bind9/lib/dns/rbtdb.c b/contrib/bind9/lib/dns/rbtdb.c
index 8930d35..cd25608 100644
--- a/contrib/bind9/lib/dns/rbtdb.c
+++ b/contrib/bind9/lib/dns/rbtdb.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.168.2.11.2.26 2006/03/02 23:18:20 marka Exp $ */
+/* $Id: rbtdb.c,v 1.196.18.41 2006/10/26 06:04:29 marka Exp $ */
+
+/*! \file */
 
 /*
  * Principal Author: Bob Halley
@@ -32,12 +34,15 @@
 #include <isc/rwlock.h>
 #include <isc/string.h>
 #include <isc/task.h>
+#include <isc/time.h>
 #include <isc/util.h>
 
+#include <dns/acache.h>
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/events.h>
 #include <dns/fixedname.h>
+#include <dns/lib.h>
 #include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/rbt.h>
@@ -46,6 +51,8 @@
 #include <dns/rdatasetiter.h>
 #include <dns/rdataslab.h>
 #include <dns/result.h>
+#include <dns/view.h>
+#include <dns/zone.h>
 #include <dns/zonekey.h>
 
 #ifdef DNS_RBTDB_VERSION64
@@ -60,7 +67,7 @@
 #define RBTDB_MAGIC			ISC_MAGIC('R', 'B', 'D', '4')
 #endif
 
-/*
+/*%
  * Note that "impmagic" is not the first four bytes of the struct, so
  * ISC_MAGIC_VALID cannot be used.
  */
@@ -69,7 +76,7 @@
 
 #ifdef DNS_RBTDB_VERSION64
 typedef isc_uint64_t			rbtdb_serial_t;
-/*
+/*%
  * Make casting easier in symbolic debuggers by using different names
  * for the 64 bit version.
  */
@@ -98,6 +105,81 @@ typedef isc_uint32_t			rbtdb_rdatatype_t;
 		RBTDB_RDATATYPE_VALUE(0, dns_rdatatype_any)
 
 /*
+ * We use rwlock for DB lock only when ISC_RWLOCK_USEATOMIC is non 0.
+ * Using rwlock is effective with regard to lookup performance only when
+ * it is implemented in an efficient way.
+ * Otherwise, it is generally wise to stick to the simple locking since rwlock
+ * would require more memory or can even make lookups slower due to its own
+ * overhead (when it internally calls mutex locks).
+ */
+#ifdef ISC_RWLOCK_USEATOMIC
+#define DNS_RBTDB_USERWLOCK 1
+#else
+#define DNS_RBTDB_USERWLOCK 0
+#endif
+
+#if DNS_RBTDB_USERWLOCK
+#define RBTDB_INITLOCK(l)	isc_rwlock_init((l), 0, 0)
+#define RBTDB_DESTROYLOCK(l)	isc_rwlock_destroy(l)
+#define RBTDB_LOCK(l, t)	RWLOCK((l), (t))
+#define RBTDB_UNLOCK(l, t)	RWUNLOCK((l), (t))
+#else
+#define RBTDB_INITLOCK(l)	isc_mutex_init(l)
+#define RBTDB_DESTROYLOCK(l)	DESTROYLOCK(l)
+#define RBTDB_LOCK(l, t)	LOCK(l)
+#define RBTDB_UNLOCK(l, t)	UNLOCK(l)
+#endif
+
+/*
+ * Since node locking is sensitive to both performance and memory footprint,
+ * we need some trick here.  If we have both high-performance rwlock and
+ * high performance and small-memory reference counters, we use rwlock for
+ * node lock and isc_refcount for node references.  In this case, we don't have
+ * to protect the access to the counters by locks.
+ * Otherwise, we simply use ordinary mutex lock for node locking, and use
+ * simple integers as reference counters which is protected by the lock.
+ * In most cases, we can simply use wrapper macros such as NODE_LOCK and
+ * NODE_UNLOCK.  In some other cases, however, we need to protect reference
+ * counters first and then protect other parts of a node as read-only data.
+ * Special additional macros, NODE_STRONGLOCK(), NODE_WEAKLOCK(), etc, are also
+ * provided for these special cases.  When we can use the efficient backend
+ * routines, we should only protect the "other members" by NODE_WEAKLOCK(read).
+ * Otherwise, we should use NODE_STRONGLOCK() to protect the entire critical
+ * section including the access to the reference counter.
+ * Note that we cannot use NODE_LOCK()/NODE_UNLOCK() wherever the protected
+ * section is also protected by NODE_STRONGLOCK().
+ */
+#if defined(ISC_RWLOCK_USEATOMIC) && defined(DNS_RBT_USEISCREFCOUNT)
+typedef isc_rwlock_t nodelock_t;
+
+#define NODE_INITLOCK(l)	isc_rwlock_init((l), 0, 0)
+#define NODE_DESTROYLOCK(l)	isc_rwlock_destroy(l)
+#define NODE_LOCK(l, t)		RWLOCK((l), (t))
+#define NODE_UNLOCK(l, t)	RWUNLOCK((l), (t))
+#define NODE_TRYUPGRADE(l)	isc_rwlock_tryupgrade(l)
+
+#define NODE_STRONGLOCK(l)	((void)0)
+#define NODE_STRONGUNLOCK(l)	((void)0)
+#define NODE_WEAKLOCK(l, t)	NODE_LOCK(l, t)
+#define NODE_WEAKUNLOCK(l, t)	NODE_UNLOCK(l, t)
+#define NODE_WEAKDOWNGRADE(l)	isc_rwlock_downgrade(l)
+#else
+typedef isc_mutex_t nodelock_t;
+
+#define NODE_INITLOCK(l)	isc_mutex_init(l)
+#define NODE_DESTROYLOCK(l)	DESTROYLOCK(l)
+#define NODE_LOCK(l, t)		LOCK(l)
+#define NODE_UNLOCK(l, t)	UNLOCK(l)
+#define NODE_TRYUPGRADE(l)	ISC_R_SUCCESS
+
+#define NODE_STRONGLOCK(l)	LOCK(l)
+#define NODE_STRONGUNLOCK(l)	UNLOCK(l)
+#define NODE_WEAKLOCK(l, t)	((void)0)
+#define NODE_WEAKUNLOCK(l, t)	((void)0)
+#define NODE_WEAKDOWNGRADE(l)	((void)0)
+#endif
+
+/*
  * Allow clients with a virtual time of upto 5 minutes in the past to see
  * records that would have otherwise have expired.
  */
@@ -109,8 +191,10 @@ struct noqname {
 	void *	   nsecsig;
 };
 
+typedef struct acachectl acachectl_t;  
+
 typedef struct rdatasetheader {
-	/*
+	/*%
 	 * Locked by the owning node's lock.
 	 */
 	rbtdb_serial_t			serial;
@@ -119,13 +203,13 @@ typedef struct rdatasetheader {
 	isc_uint16_t			attributes;
 	dns_trust_t			trust;
 	struct noqname			*noqname;
-	/*
+	/*%<
 	 * We don't use the LIST macros, because the LIST structure has
 	 * both head and tail pointers, and is doubly linked.
 	 */
 
 	struct rdatasetheader		*next;
-	/*
+	/*%<
 	 * If this is the top header for an rdataset, 'next' points
 	 * to the top header for the next rdataset (i.e., the next type).
 	 * Otherwise, it points up to the header whose down pointer points
@@ -133,19 +217,22 @@ typedef struct rdatasetheader {
 	 */
 	  
 	struct rdatasetheader		*down;
-	/*
+	/*%<
 	 * Points to the header for the next older version of
 	 * this rdataset.
 	 */
 
 	isc_uint32_t			count;
-	/*
+	/*%<
 	 * Monotonously increased every time this rdataset is bound so that
 	 * it is used as the base of the starting point in DNS responses
 	 * when the "cyclic" rrset-order is required.  Since the ordering
 	 * should not be so crucial, no lock is set for the counter for
 	 * performance reasons.
 	 */
+
+	acachectl_t			*additional_auth;
+	acachectl_t			*additional_glue;
 } rdatasetheader_t;
 
 #define RDATASET_ATTR_NONEXISTENT	0x0001
@@ -154,6 +241,19 @@ typedef struct rdatasetheader {
 #define RDATASET_ATTR_RETAIN		0x0008
 #define RDATASET_ATTR_NXDOMAIN		0x0010
 
+typedef struct acache_cbarg {
+	dns_rdatasetadditional_t	type;
+	unsigned int			count;
+	dns_db_t			*db;
+	dns_dbnode_t			*node;
+	rdatasetheader_t		*header;
+} acache_cbarg_t;
+
+struct acachectl {
+	dns_acacheentry_t		*entry;
+	acache_cbarg_t			*cbarg;
+};
+
 /*
  * XXX
  * When the cache will pre-expire data (due to memory low or other
@@ -175,12 +275,14 @@ typedef struct rdatasetheader {
 #define NXDOMAIN(header) \
 	(((header)->attributes & RDATASET_ATTR_NXDOMAIN) != 0)
 
-#define DEFAULT_NODE_LOCK_COUNT		7		/* Should be prime. */
+#define DEFAULT_NODE_LOCK_COUNT		7	/*%< Should be prime. */
+#define DEFAULT_CACHE_NODE_LOCK_COUNT	1009	/*%< Should be prime. */
 
 typedef struct {
-	isc_mutex_t			lock;
+	nodelock_t			lock;
+	/* Protected in the refcount routines. */
+	isc_refcount_t			references;
 	/* Locked by lock. */
-	unsigned int			references;
 	isc_boolean_t			exiting;
 } rbtdb_nodelock_t;
 
@@ -195,9 +297,14 @@ typedef ISC_LIST(rbtdb_changed_t)	rbtdb_changedlist_t;
 typedef struct rbtdb_version {
 	/* Not locked */
 	rbtdb_serial_t			serial;
+	/*
+	 * Protected in the refcount routines.
+	 * XXXJT: should we change the lock policy based on the refcount
+	 * performance?
+	 */
+	isc_refcount_t			references;
 	/* Locked by database lock. */
 	isc_boolean_t			writer;
-	unsigned int			references;
 	isc_boolean_t			commit_ok;
 	rbtdb_changedlist_t		changed_list;
 	ISC_LINK(struct rbtdb_version)	link;
@@ -208,7 +315,11 @@ typedef ISC_LIST(rbtdb_version_t)	rbtdb_versionlist_t;
 typedef struct {
 	/* Unlocked. */
 	dns_db_t			common;
+#if DNS_RBTDB_USERWLOCK
+	isc_rwlock_t			lock;
+#else
 	isc_mutex_t			lock;
+#endif
 	isc_rwlock_t			tree_lock;
 	unsigned int			node_lock_count;
 	rbtdb_nodelock_t *	       	node_locks;
@@ -225,15 +336,20 @@ typedef struct {
 	rbtdb_versionlist_t		open_versions;
 	isc_boolean_t			overmem;
 	isc_task_t *			task;
+	dns_dbnode_t			*soanode;
+	dns_dbnode_t			*nsnode;
 	/* Locked by tree_lock. */
 	dns_rbt_t *			tree;
 	isc_boolean_t			secure;
+
+	/* Unlocked */
+	unsigned int			quantum;
 } dns_rbtdb_t;
 
 #define RBTDB_ATTR_LOADED		0x01
 #define RBTDB_ATTR_LOADING		0x02
 
-/*
+/*%
  * Search Context
  */
 typedef struct {
@@ -252,7 +368,7 @@ typedef struct {
 	isc_stdtime_t		now;
 } rbtdb_search_t;
 
-/*
+/*%
  * Load Context
  */
 typedef struct {
@@ -270,6 +386,30 @@ static isc_result_t rdataset_getnoqname(dns_rdataset_t *rdataset,
 				        dns_name_t *name,
 					dns_rdataset_t *nsec,
 					dns_rdataset_t *nsecsig);
+static isc_result_t rdataset_getadditional(dns_rdataset_t *rdataset,
+					   dns_rdatasetadditional_t type,
+					   dns_rdatatype_t qtype,
+					   dns_acache_t *acache,
+					   dns_zone_t **zonep,
+					   dns_db_t **dbp,
+					   dns_dbversion_t **versionp,
+					   dns_dbnode_t **nodep,
+					   dns_name_t *fname,
+					   dns_message_t *msg,
+					   isc_stdtime_t now);
+static isc_result_t rdataset_setadditional(dns_rdataset_t *rdataset,
+					   dns_rdatasetadditional_t type,
+					   dns_rdatatype_t qtype,
+					   dns_acache_t *acache,
+					   dns_zone_t *zone,
+					   dns_db_t *db,
+					   dns_dbversion_t *version,
+					   dns_dbnode_t *node,
+					   dns_name_t *fname);
+static isc_result_t rdataset_putadditional(dns_acache_t *acache,
+					   dns_rdataset_t *rdataset,
+					   dns_rdatasetadditional_t type,
+					   dns_rdatatype_t qtype);
 
 static dns_rdatasetmethods_t rdataset_methods = {
 	rdataset_disassociate,
@@ -279,7 +419,10 @@ static dns_rdatasetmethods_t rdataset_methods = {
 	rdataset_clone,
 	rdataset_count,
 	NULL,
-	rdataset_getnoqname
+	rdataset_getnoqname,
+	rdataset_getadditional,
+	rdataset_setadditional,
+	rdataset_putadditional
 };
 
 static void rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp);
@@ -403,25 +546,87 @@ free_rbtdb_callback(isc_task_t *task, isc_event_t *event) {
 	free_rbtdb(rbtdb, ISC_TRUE, event);
 }
 
+/*%
+ * Work out how many nodes can be deleted in the time between two
+ * requests to the nameserver.  Smooth the resulting number and use it
+ * as a estimate for the number of nodes to be deleted in the next
+ * iteration.
+ */
+static unsigned int
+adjust_quantum(unsigned int old, isc_time_t *start) {
+	unsigned int pps = dns_pps;	/* packets per second */
+	unsigned int interval;
+	isc_uint64_t usecs;
+	isc_time_t end;
+	unsigned int new;
+
+	if (pps < 100)
+		pps = 100;
+	isc_time_now(&end);
+
+	interval = 1000000 / pps;	/* interval in usec */
+	if (interval == 0)
+		interval = 1;
+	usecs = isc_time_microdiff(&end, start);
+	if (usecs == 0) {
+		/*
+		 * We were unable to measure the amount of time taken.
+		 * Double the nodes deleted next time.
+		 */
+		old *= 2;
+		if (old > 1000)
+			old = 1000;
+		return (old);
+	}
+	new = old * interval;
+	new /= (unsigned int)usecs;
+	if (new == 0)
+		new = 1;
+	else if (new > 1000)
+		new = 1000;
+
+	/* Smooth */
+	new = (new + old * 3) / 4;
+	
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_CACHE,
+		      ISC_LOG_DEBUG(1), "adjust_quantum -> %d", new);
+
+	return (new);
+}
+		
 static void
 free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event) {
 	unsigned int i;
 	isc_ondestroy_t ondest;
 	isc_result_t result;
 	char buf[DNS_NAME_FORMATSIZE];
+	isc_time_t start;
 
-	REQUIRE(EMPTY(rbtdb->open_versions));
+	REQUIRE(rbtdb->current_version != NULL || EMPTY(rbtdb->open_versions));
 	REQUIRE(rbtdb->future_version == NULL);
 
-	if (rbtdb->current_version != NULL)
+	if (rbtdb->current_version != NULL) {
+		unsigned int refs;
+
+		isc_refcount_decrement(&rbtdb->current_version->references,
+				       &refs);
+		INSIST(refs == 0);
+		UNLINK(rbtdb->open_versions, rbtdb->current_version, link);
+		isc_refcount_destroy(&rbtdb->current_version->references);
 		isc_mem_put(rbtdb->common.mctx, rbtdb->current_version,
 			    sizeof(rbtdb_version_t));
+	}
+	if (event == NULL)
+		rbtdb->quantum = (rbtdb->task != NULL) ? 100 : 0;
  again:
 	if (rbtdb->tree != NULL) {
-		result = dns_rbt_destroy2(&rbtdb->tree,
-					  (rbtdb->task != NULL) ? 1000 : 0);
+		isc_time_now(&start);
+		result = dns_rbt_destroy2(&rbtdb->tree, rbtdb->quantum);
 		if (result == ISC_R_QUOTA) {
 			INSIST(rbtdb->task != NULL);
+			if (rbtdb->quantum != 0)
+				rbtdb->quantum = adjust_quantum(rbtdb->quantum,
+								&start);
 			if (event == NULL)
 				event = isc_event_allocate(rbtdb->common.mctx,
 							   NULL,
@@ -450,15 +655,17 @@ free_rbtdb(dns_rbtdb_t *rbtdb, isc_boolean_t log, isc_event_t *event) {
 	}
 	if (dns_name_dynamic(&rbtdb->common.origin))
 		dns_name_free(&rbtdb->common.origin, rbtdb->common.mctx);
-	for (i = 0; i < rbtdb->node_lock_count; i++)
-		DESTROYLOCK(&rbtdb->node_locks[i].lock);
+	for (i = 0; i < rbtdb->node_lock_count; i++) {
+		isc_refcount_destroy(&rbtdb->node_locks[i].references);
+		NODE_DESTROYLOCK(&rbtdb->node_locks[i].lock);
+	}
 	isc_mem_put(rbtdb->common.mctx, rbtdb->node_locks,
 		    rbtdb->node_lock_count * sizeof(rbtdb_nodelock_t));
 	isc_rwlock_destroy(&rbtdb->tree_lock);
 	isc_refcount_destroy(&rbtdb->references);
 	if (rbtdb->task != NULL)
 		isc_task_detach(&rbtdb->task);
-	DESTROYLOCK(&rbtdb->lock);
+	RBTDB_DESTROYLOCK(&rbtdb->lock);
 	rbtdb->common.magic = 0;
 	rbtdb->common.impmagic = 0;
 	ondest = rbtdb->common.ondest;
@@ -474,24 +681,31 @@ maybe_free_rbtdb(dns_rbtdb_t *rbtdb) {
 
 	/* XXX check for open versions here */
 
+	if (rbtdb->soanode != NULL)
+		dns_db_detachnode((dns_db_t *)rbtdb, &rbtdb->soanode);
+	if (rbtdb->nsnode != NULL)
+		dns_db_detachnode((dns_db_t *)rbtdb, &rbtdb->nsnode);
+
 	/*
 	 * Even though there are no external direct references, there still
 	 * may be nodes in use.
 	 */
 	for (i = 0; i < rbtdb->node_lock_count; i++) {
-		LOCK(&rbtdb->node_locks[i].lock);
+		NODE_LOCK(&rbtdb->node_locks[i].lock, isc_rwlocktype_write);
 		rbtdb->node_locks[i].exiting = ISC_TRUE;
-		if (rbtdb->node_locks[i].references == 0)
+		NODE_UNLOCK(&rbtdb->node_locks[i].lock, isc_rwlocktype_write);
+		if (isc_refcount_current(&rbtdb->node_locks[i].references)
+		    == 0) {
 			inactive++;
-		UNLOCK(&rbtdb->node_locks[i].lock);
+		}
 	}
 
 	if (inactive != 0) {
-		LOCK(&rbtdb->lock);
+		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 		rbtdb->active -= inactive;
 		if (rbtdb->active == 0)
 			want_free = ISC_TRUE;
-		UNLOCK(&rbtdb->lock);
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 		if (want_free) {
 			char buf[DNS_NAME_FORMATSIZE];
 			if (dns_name_dynamic(&rbtdb->common.origin))
@@ -526,15 +740,14 @@ static void
 currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 	rbtdb_version_t *version;
+	unsigned int refs;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
-	LOCK(&rbtdb->lock);
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
 	version = rbtdb->current_version;
-	if (version->references == 0)
-		PREPEND(rbtdb->open_versions, version, link);
-	version->references++;
-	UNLOCK(&rbtdb->lock);
+	isc_refcount_increment(&version->references, &refs);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
 
 	*versionp = (dns_dbversion_t *)version;
 }
@@ -543,13 +756,18 @@ static inline rbtdb_version_t *
 allocate_version(isc_mem_t *mctx, rbtdb_serial_t serial,
 		 unsigned int references, isc_boolean_t writer)
 {
+	isc_result_t result;
 	rbtdb_version_t *version;
 
 	version = isc_mem_get(mctx, sizeof(*version));
 	if (version == NULL)
 		return (NULL);
 	version->serial = serial;
-	version->references = references;
+	result = isc_refcount_init(&version->references, references);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, version, sizeof(*version));
+		return (NULL);
+	}
 	version->writer = writer;
 	version->commit_ok = ISC_FALSE;
 	ISC_LIST_INIT(version->changed_list);
@@ -567,7 +785,7 @@ newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 	REQUIRE(versionp != NULL && *versionp == NULL);
 	REQUIRE(rbtdb->future_version == NULL);
 
-	LOCK(&rbtdb->lock);
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 	RUNTIME_CHECK(rbtdb->next_serial != 0);		/* XXX Error? */
 	version = allocate_version(rbtdb->common.mctx, rbtdb->next_serial, 1,
 				   ISC_TRUE);
@@ -576,7 +794,7 @@ newversion(dns_db_t *db, dns_dbversion_t **versionp) {
 		rbtdb->next_serial++;
 		rbtdb->future_version = version;
 	}
-	UNLOCK(&rbtdb->lock);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	if (version == NULL)
 		return (ISC_R_NOMEMORY);
@@ -592,16 +810,12 @@ attachversion(dns_db_t *db, dns_dbversion_t *source,
 {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 	rbtdb_version_t *rbtversion = source;
+	unsigned int refs;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
-	LOCK(&rbtdb->lock);
-
-	INSIST(rbtversion->references > 0);
-	rbtversion->references++;
-	INSIST(rbtversion->references != 0);
-
-	UNLOCK(&rbtdb->lock);
+	isc_refcount_increment(&rbtversion->references, &refs);
+	INSIST(refs > 1);
 
 	*targetp = rbtversion;
 }
@@ -611,32 +825,62 @@ add_changed(dns_rbtdb_t *rbtdb, rbtdb_version_t *version,
 	    dns_rbtnode_t *node)
 {
 	rbtdb_changed_t *changed;
+	unsigned int refs;
 
 	/*
-	 * Caller must be holding the node lock.
+	 * Caller must be holding the node lock if its reference must be
+	 * protected by the lock.
 	 */
 
 	changed = isc_mem_get(rbtdb->common.mctx, sizeof(*changed));
 
-	LOCK(&rbtdb->lock);
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	REQUIRE(version->writer);
 
 	if (changed != NULL) {
-		INSIST(node->references > 0);
-		node->references++;
-		INSIST(node->references != 0);
+		dns_rbtnode_refincrement(node, &refs);
+		INSIST(refs != 0);
 		changed->node = node;
 		changed->dirty = ISC_FALSE;
 		ISC_LIST_INITANDAPPEND(version->changed_list, changed, link);
 	} else
 		version->commit_ok = ISC_FALSE;
 
-	UNLOCK(&rbtdb->lock);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	return (changed);
 }
 
+static void
+free_acachearray(isc_mem_t *mctx, rdatasetheader_t *header,
+		 acachectl_t *array)
+{
+	unsigned int count;
+	unsigned int i;
+	unsigned char *raw;	/* RDATASLAB */
+
+	/*
+	 * The caller must be holding the corresponding node lock.
+	 */
+
+	if (array == NULL)
+		return;
+
+	raw = (unsigned char *)header + sizeof(*header);
+	count = raw[0] * 256 + raw[1];
+
+	/*
+	 * Sanity check: since an additional cache entry has a reference to
+	 * the original DB node (in the callback arg), there should be no
+	 * acache entries when the node can be freed. 
+	 */
+	for (i = 0; i < count; i++)
+		INSIST(array[i].entry == NULL && array[i].cbarg == NULL);
+
+	isc_mem_put(mctx, array, count * sizeof(acachectl_t));
+}
+
 static inline void
 free_noqname(isc_mem_t *mctx, struct noqname **noqname) {
 
@@ -658,7 +902,10 @@ free_rdataset(isc_mem_t *mctx, rdatasetheader_t *rdataset) {
 
 	if (rdataset->noqname != NULL)
 		free_noqname(mctx, &rdataset->noqname);
-	
+
+	free_acachearray(mctx, rdataset, rdataset->additional_auth);
+	free_acachearray(mctx, rdataset, rdataset->additional_glue);
+
 	if ((rdataset->attributes & RDATASET_ATTR_NONEXISTENT) != 0)
 		size = sizeof(*rdataset);
 	else
@@ -700,8 +947,19 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) {
 }
 
 static inline void
+clean_stale_headers(isc_mem_t *mctx, rdatasetheader_t *top) {
+	rdatasetheader_t *d, *down_next;
+
+	for (d = top->down; d != NULL; d = down_next) {
+		down_next = d->down;
+		free_rdataset(mctx, d);
+	}
+	top->down = NULL;
+}
+
+static inline void
 clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
-	rdatasetheader_t *current, *dcurrent, *top_prev, *top_next, *down_next;
+	rdatasetheader_t *current, *top_prev, *top_next;
 	isc_mem_t *mctx = rbtdb->common.mctx;
 
 	/*
@@ -711,15 +969,7 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
 	top_prev = NULL;
 	for (current = node->data; current != NULL; current = top_next) {
 		top_next = current->next;
-		dcurrent = current->down;
-		if (dcurrent != NULL) {
-			do {
-				down_next = dcurrent->down;
-				free_rdataset(mctx, dcurrent);
-				dcurrent = down_next;
-			} while (dcurrent != NULL);
-			current->down = NULL;
-		}
+		clean_stale_headers(mctx, current);
 		/*
 		 * If current is nonexistent or stale, we can clean it up.
 		 */
@@ -862,31 +1112,72 @@ clean_zone_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 		node->dirty = 0;
 }
 
+/*
+ * Caller must be holding the node lock if its reference must be protected
+ * by the lock.
+ */
 static inline void
 new_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) {
-	if (node->references == 0) {
-		rbtdb->node_locks[node->locknum].references++;
-		INSIST(rbtdb->node_locks[node->locknum].references != 0);
+	unsigned int lockrefs, noderefs;
+	isc_refcount_t *lockref;
+
+	dns_rbtnode_refincrement0(node, &noderefs);
+	if (noderefs == 1) {	/* this is the first reference to the node */
+		lockref = &rbtdb->node_locks[node->locknum].references;
+		isc_refcount_increment0(lockref, &lockrefs);
+		INSIST(lockrefs != 0);
 	}
-	node->references++;
-	INSIST(node->references != 0);
+	INSIST(noderefs != 0);
 }
 
-static void
-no_references(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
-	      rbtdb_serial_t least_serial, isc_rwlocktype_t lock)
+/*
+ * Caller must be holding the node lock; either the "strong", read or write
+ * lock.  Note that the lock must be held even when node references are
+ * atomically modified; in that case the decrement operation itself does not
+ * have to be protected, but we must avoid a race condition where multiple
+ * threads are decreasing the reference to zero simultaneously and at least
+ * one of them is going to free the node.
+ * This function returns ISC_TRUE if and only if the node reference decreases
+ * to zero.
+ */
+static isc_boolean_t
+decrement_reference(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
+		    rbtdb_serial_t least_serial,
+		    isc_rwlocktype_t nlock, isc_rwlocktype_t tlock)
 {
 	isc_result_t result;
 	isc_boolean_t write_locked;
-	unsigned int locknum;
-
-	/*
-	 * Caller must be holding the node lock.
-	 */
+	rbtdb_nodelock_t *nodelock;
+	unsigned int refs, nrefs;
+
+	nodelock = &rbtdb->node_locks[node->locknum];
+
+	/* Handle easy and typical case first. */
+	if (!node->dirty && (node->data != NULL || node->down != NULL)) {
+		dns_rbtnode_refdecrement(node, &nrefs);
+		INSIST((int)nrefs >= 0);
+		if (nrefs == 0) {
+			isc_refcount_decrement(&nodelock->references, &refs);
+			INSIST((int)refs >= 0);
+		}
+		return ((nrefs == 0) ? ISC_TRUE : ISC_FALSE);
+	}
 
-	REQUIRE(node->references == 0);
+	/* Upgrade the lock? */
+	if (nlock == isc_rwlocktype_read) {
+		NODE_WEAKUNLOCK(&nodelock->lock, isc_rwlocktype_read);
+		NODE_WEAKLOCK(&nodelock->lock, isc_rwlocktype_write);
+	}
+	dns_rbtnode_refdecrement(node, &nrefs);
+	INSIST((int)nrefs >= 0);
+	if (nrefs > 0) {
+		/* Restore the lock? */
+		if (nlock == isc_rwlocktype_read)
+			NODE_WEAKDOWNGRADE(&nodelock->lock);
+		return (ISC_FALSE);
+	}
 
-	if (node->dirty) {
+	if (node->dirty && dns_rbtnode_refcurrent(node) == 0) {
 		if (IS_CACHE(rbtdb))
 			clean_cache_node(rbtdb, node);
 		else {
@@ -895,35 +1186,38 @@ no_references(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 				 * Caller doesn't know the least serial.
 				 * Get it.
 				 */
-				LOCK(&rbtdb->lock);
+				RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
 				least_serial = rbtdb->least_serial;
-				UNLOCK(&rbtdb->lock);
+				RBTDB_UNLOCK(&rbtdb->lock,
+					     isc_rwlocktype_read);
 			}
 			clean_zone_node(rbtdb, node, least_serial);
 		}
 	}
 
-	locknum = node->locknum;
-
-	INSIST(rbtdb->node_locks[locknum].references > 0);
-	rbtdb->node_locks[locknum].references--;
+	isc_refcount_decrement(&nodelock->references, &refs);
+	INSIST((int)refs >= 0);
 
 	/*
 	 * XXXDCL should this only be done for cache zones?
 	 */
-	if (node->data != NULL || node->down != NULL)
-		return;
+	if (node->data != NULL || node->down != NULL) {
+		/* Restore the lock? */
+		if (nlock == isc_rwlocktype_read)
+			NODE_WEAKDOWNGRADE(&nodelock->lock);
+		return (ISC_TRUE);
+	}
 
 	/*
 	 * XXXDCL need to add a deferred delete method for ISC_R_LOCKBUSY.
 	 */
-	if (lock != isc_rwlocktype_write) {
+	if (tlock != isc_rwlocktype_write) {
 		/*
 		 * Locking hierarchy notwithstanding, we don't need to free
 		 * the node lock before acquiring the tree write lock because
 		 * we only do a trylock.
 		 */
-		if (lock == isc_rwlocktype_read)
+		if (tlock == isc_rwlocktype_read)
 			result = isc_rwlock_tryupgrade(&rbtdb->tree_lock);
 		else
 			result = isc_rwlock_trylock(&rbtdb->tree_lock,
@@ -935,13 +1229,21 @@ no_references(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	} else
 		write_locked = ISC_TRUE;
 
-	if (write_locked) {
+	if (write_locked && dns_rbtnode_refcurrent(node) == 0) {
+		/*
+		 * We can now delete the node if the reference counter is
+		 * zero.  This should be typically the case, but a different
+		 * thread may still gain a (new) reference just before the
+		 * current thread locks the tree (e.g., in findnode()).
+		 */
+
 		if (isc_log_wouldlog(dns_lctx, ISC_LOG_DEBUG(1))) {
 			char printname[DNS_NAME_FORMATSIZE];
 
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 				      DNS_LOGMODULE_CACHE, ISC_LOG_DEBUG(1),
-				      "no_references: delete from rbt: %p %s",
+				      "decrement_reference: "
+				      "delete from rbt: %p %s",
 				      node,
 				      dns_rbt_formatnodename(node, printname,
 							   sizeof(printname)));
@@ -951,20 +1253,27 @@ no_references(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 		if (result != ISC_R_SUCCESS)
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 				      DNS_LOGMODULE_CACHE, ISC_LOG_WARNING,
-				      "no_references: dns_rbt_deletenode: %s",
+				      "decrement_reference: "
+				      "dns_rbt_deletenode: %s",
 				      isc_result_totext(result));
 	}
 
+	/* Restore the lock? */
+	if (nlock == isc_rwlocktype_read)
+		NODE_WEAKDOWNGRADE(&nodelock->lock);
+
 	/*
 	 * Relock a read lock, or unlock the write lock if no lock was held.
 	 */
-	if (lock == isc_rwlocktype_none)
+	if (tlock == isc_rwlocktype_none)
 		if (write_locked)
 			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
 
-	if (lock == isc_rwlocktype_read)
+	if (tlock == isc_rwlocktype_read)
 		if (write_locked)
 			isc_rwlock_downgrade(&rbtdb->tree_lock);
+
+	return (ISC_TRUE);
 }
 
 static inline void
@@ -1061,7 +1370,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
 	rbtdb_changed_t *changed, *next_changed;
 	rbtdb_serial_t serial, least_serial;
 	dns_rbtnode_t *rbtnode;
-	isc_mutex_t *lock;
+	unsigned int refs;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 	version = (rbtdb_version_t *)*versionp;
@@ -1069,113 +1378,146 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
 	cleanup_version = NULL;
 	ISC_LIST_INIT(cleanup_list);
 
-	LOCK(&rbtdb->lock);
-	INSIST(version->references > 0);
-	INSIST(!version->writer || !(commit && version->references > 1));
-	version->references--;
+	isc_refcount_decrement(&version->references, &refs);
+	if (refs > 0) {		/* typical and easy case first */
+		if (commit) {
+			RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+			INSIST(!version->writer);
+			RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+		}
+		goto end;
+	}
+
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 	serial = version->serial;
-	if (version->references == 0) {
-		if (version->writer) {
-			if (commit) {
-				INSIST(version->commit_ok);
-				INSIST(version == rbtdb->future_version);
-				if (EMPTY(rbtdb->open_versions)) {
-					/*
-					 * We're going to become the least open
-					 * version.
-					 */
-					make_least_version(rbtdb, version,
-							   &cleanup_list);
-				} else {
-					/*
-					 * Some other open version is the
-					 * least version.  We can't cleanup
-					 * records that were changed in this
-					 * version because the older versions
-					 * may still be in use by an open
-					 * version.
-					 *
-					 * We can, however, discard the
-					 * changed records for things that
-					 * we've added that didn't exist in
-					 * prior versions.
-					 */
-					cleanup_nondirty(version,
-							 &cleanup_list);
-				}
-				/*
-				 * If the (soon to be former) current version
-				 * isn't being used by anyone, we can clean
-				 * it up.
-				 */
-				if (rbtdb->current_version->references == 0) {
-					cleanup_version =
-						rbtdb->current_version;
-					APPENDLIST(version->changed_list,
-						 cleanup_version->changed_list,
-						   link);
-				}
+	if (version->writer) {
+		if (commit) {
+			unsigned cur_ref;
+			rbtdb_version_t *cur_version;
+
+			INSIST(version->commit_ok);
+			INSIST(version == rbtdb->future_version);
+			/*
+			 * The current version is going to be replaced.
+			 * Release the (likely last) reference to it from the
+			 * DB itself and unlink it from the open list.
+			 */
+			cur_version = rbtdb->current_version;
+			isc_refcount_decrement(&cur_version->references,
+					       &cur_ref);
+			if (cur_ref == 0) {
+				if (cur_version->serial == rbtdb->least_serial)
+					INSIST(EMPTY(cur_version->changed_list));
+				UNLINK(rbtdb->open_versions,
+				       cur_version, link);
+			}
+			if (EMPTY(rbtdb->open_versions)) {
 				/*
-				 * Become the current version.
+				 * We're going to become the least open
+				 * version.
 				 */
-				version->writer = ISC_FALSE;
-				rbtdb->current_version = version;
-				rbtdb->current_serial = version->serial;
-				rbtdb->future_version = NULL;
+				make_least_version(rbtdb, version,
+						   &cleanup_list);
 			} else {
 				/*
-				 * We're rolling back this transaction.
+				 * Some other open version is the
+				 * least version.  We can't cleanup
+				 * records that were changed in this
+				 * version because the older versions
+				 * may still be in use by an open
+				 * version.
+				 *
+				 * We can, however, discard the
+				 * changed records for things that
+				 * we've added that didn't exist in
+				 * prior versions.
 				 */
-				cleanup_list = version->changed_list;
-				ISC_LIST_INIT(version->changed_list);
-				rollback = ISC_TRUE;
-				cleanup_version = version;
-				rbtdb->future_version = NULL;
+				cleanup_nondirty(version, &cleanup_list);
 			}
+			/*
+			 * If the (soon to be former) current version
+			 * isn't being used by anyone, we can clean
+			 * it up.
+			 */
+			if (cur_ref == 0) {
+				cleanup_version = cur_version;
+				APPENDLIST(version->changed_list,
+					   cleanup_version->changed_list,
+					   link);
+			}
+			/*
+			 * Become the current version.
+			 */
+			version->writer = ISC_FALSE;
+			rbtdb->current_version = version;
+			rbtdb->current_serial = version->serial;
+			rbtdb->future_version = NULL;
+
+			/*
+			 * Keep the current version in the open list, and
+			 * gain a reference for the DB itself (see the DB
+			 * creation function below).  This must be the only
+			 * case where we need to increment the counter from
+			 * zero and need to use isc_refcount_increment0().
+			 */
+			isc_refcount_increment0(&version->references,
+						&cur_ref);
+			INSIST(cur_ref == 1);
+			PREPEND(rbtdb->open_versions,
+				rbtdb->current_version, link);
 		} else {
-			if (version != rbtdb->current_version) {
-				/*
-				 * There are no external or internal references
-				 * to this version and it can be cleaned up.
-				 */
-				cleanup_version = version;
+			/*
+			 * We're rolling back this transaction.
+			 */
+			cleanup_list = version->changed_list;
+			ISC_LIST_INIT(version->changed_list);
+			rollback = ISC_TRUE;
+			cleanup_version = version;
+			rbtdb->future_version = NULL;
+		}
+	} else {
+		if (version != rbtdb->current_version) {
+			/*
+			 * There are no external or internal references
+			 * to this version and it can be cleaned up.
+			 */
+			cleanup_version = version;
 
+			/*
+			 * Find the version with the least serial
+			 * number greater than ours.
+			 */
+			least_greater = PREV(version, link);
+			if (least_greater == NULL)
+				least_greater = rbtdb->current_version;
+
+			INSIST(version->serial < least_greater->serial);
+			/*
+			 * Is this the least open version?
+			 */
+			if (version->serial == rbtdb->least_serial) {
 				/*
-				 * Find the version with the least serial
-				 * number greater than ours.
+				 * Yes.  Install the new least open
+				 * version.
 				 */
-				least_greater = PREV(version, link);
-				if (least_greater == NULL)
-					least_greater = rbtdb->current_version;
-
-				INSIST(version->serial < least_greater->serial);
+				make_least_version(rbtdb,
+						   least_greater,
+						   &cleanup_list);
+			} else {
 				/*
-				 * Is this the least open version?
+				 * Add any unexecuted cleanups to
+				 * those of the least greater version.
 				 */
-				if (version->serial == rbtdb->least_serial) {
-					/*
-					 * Yes.  Install the new least open
-					 * version.
-					 */
-					make_least_version(rbtdb,
-							   least_greater,
-							   &cleanup_list);
-				} else {
-					/*
-					 * Add any unexecuted cleanups to
-					 * those of the least greater version.
-					 */
-					APPENDLIST(least_greater->changed_list,
-						   version->changed_list,
-						   link);
-				}
-			} else if (version->serial == rbtdb->least_serial)
-				INSIST(EMPTY(version->changed_list));
-			UNLINK(rbtdb->open_versions, version, link);
-		}
+				APPENDLIST(least_greater->changed_list,
+					   version->changed_list,
+					   link);
+			}
+		} else if (version->serial == rbtdb->least_serial)
+			INSIST(EMPTY(version->changed_list));
+		UNLINK(rbtdb->open_versions, version, link);
 	}
 	least_serial = rbtdb->least_serial;
-	UNLOCK(&rbtdb->lock);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	/*
 	 * Update the zone's secure status.
@@ -1193,28 +1535,26 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
 		for (changed = HEAD(cleanup_list);
 		     changed != NULL;
 		     changed = next_changed) {
+			nodelock_t *lock;
+
 			next_changed = NEXT(changed, link);
 			rbtnode = changed->node;
 			lock = &rbtdb->node_locks[rbtnode->locknum].lock;
 
-			LOCK(lock);
-
-			INSIST(rbtnode->references > 0);
-			rbtnode->references--;
+			NODE_LOCK(lock, isc_rwlocktype_write);
 			if (rollback)
 				rollback_node(rbtnode, serial);
-
-			if (rbtnode->references == 0)
-				no_references(rbtdb, rbtnode, least_serial,
-					      isc_rwlocktype_none);
-
-			UNLOCK(lock);
+			decrement_reference(rbtdb, rbtnode, least_serial,
+					    isc_rwlocktype_write,
+					    isc_rwlocktype_none);
+			NODE_UNLOCK(lock, isc_rwlocktype_write);
 
 			isc_mem_put(rbtdb->common.mctx, changed,
 				    sizeof(*changed));
 		}
 	}
 
+  end:
 	*versionp = NULL;
 }
 
@@ -1287,7 +1627,6 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 	dns_rbtnode_t *node = NULL;
 	dns_name_t nodename;
-	unsigned int locknum;
 	isc_result_t result;
 	isc_rwlocktype_t locktype = isc_rwlocktype_read;
 
@@ -1334,10 +1673,9 @@ findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
 			return (result);
 		}
 	}
-	locknum = node->locknum;
-	LOCK(&rbtdb->node_locks[locknum].lock);
+	NODE_STRONGLOCK(&rbtdb->node_locks[node->locknum].lock);
 	new_reference(rbtdb, node);
-	UNLOCK(&rbtdb->node_locks[locknum].lock);
+	NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock);
 	RWUNLOCK(&rbtdb->tree_lock, locktype);
 
 	*nodep = (dns_dbnode_t *)node;
@@ -1366,7 +1704,8 @@ zone_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 	result = DNS_R_CONTINUE;
 	onode = search->rbtdb->origin_node;
 
-	LOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+	NODE_LOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+		  isc_rwlocktype_read);
 
 	/*
 	 * Look for an NS or DNAME rdataset active in our version.
@@ -1477,7 +1816,8 @@ zone_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 			search->wild = ISC_TRUE;
 	}
 
-	UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+	NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+		    isc_rwlocktype_read);
 
 	return (result);
 }
@@ -1487,10 +1827,14 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node,
 	      rdatasetheader_t *header, isc_stdtime_t now,
 	      dns_rdataset_t *rdataset)
 {
-	unsigned char *raw;
+	unsigned char *raw;	/* RDATASLAB */
 
 	/*
-	 * Caller must be holding the node lock.
+	 * Caller must be holding the node reader lock.
+	 * XXXJT: technically, we need a writer lock, since we'll increment
+	 * the header count below.  However, since the actual counter value
+	 * doesn't matter, we prioritize performance here.  (We may want to
+	 * use atomic increment when available).
 	 */
 
 	if (rdataset == NULL)
@@ -1570,14 +1914,16 @@ setup_delegation(rbtdb_search_t *search, dns_dbnode_t **nodep,
 		search->need_cleanup = ISC_FALSE;
 	}
 	if (rdataset != NULL) {
-		LOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+		NODE_LOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			  isc_rwlocktype_read);
 		bind_rdataset(search->rbtdb, node, search->zonecut_rdataset,
 			      search->now, rdataset);
 		if (sigrdataset != NULL && search->zonecut_sigrdataset != NULL)
 			bind_rdataset(search->rbtdb, node,
 				      search->zonecut_sigrdataset,
 				      search->now, sigrdataset);
-		UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    isc_rwlocktype_read);
 	}
 
 	if (type == dns_rdatatype_dname)
@@ -1589,7 +1935,7 @@ static inline isc_boolean_t
 valid_glue(rbtdb_search_t *search, dns_name_t *name, rbtdb_rdatatype_t type,
 	   dns_rbtnode_t *node)
 {
-	unsigned char *raw;
+	unsigned char *raw;	/* RDATASLAB */
 	unsigned int count, size;
 	dns_name_t ns_name;
 	isc_boolean_t valid = ISC_FALSE;
@@ -1618,12 +1964,12 @@ valid_glue(rbtdb_search_t *search, dns_name_t *name, rbtdb_rdatatype_t type,
 	header = search->zonecut_rdataset;
 	raw = (unsigned char *)header + sizeof(*header);
 	count = raw[0] * 256 + raw[1];
-	raw += 2;
+	raw += 2 + (4 * count);
 
 	while (count > 0) {
 		count--;
 		size = raw[0] * 256 + raw[1];
-		raw += 2;
+		raw += 4;
 		region.base = raw;
 		region.length = size;
 		raw += size;
@@ -1672,7 +2018,8 @@ activeempty(rbtdb_search_t *search, dns_rbtnodechain_t *chain,
 						  origin, &node);
 		if (result != ISC_R_SUCCESS)
 			break;
-		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
+			  isc_rwlocktype_read);
 		for (header = node->data;
 		     header != NULL;
 		     header = header->next) {
@@ -1680,7 +2027,8 @@ activeempty(rbtdb_search_t *search, dns_rbtnodechain_t *chain,
 			    !IGNORE(header) && EXISTS(header))
 				break;
 		}
-		UNLOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    isc_rwlocktype_read);
 		if (header != NULL)
 			break;
 		result = dns_rbtnodechain_next(chain, NULL, NULL);
@@ -1737,7 +2085,8 @@ activeemtpynode(rbtdb_search_t *search, dns_name_t *qname, dns_name_t *wname) {
 						  origin, &node);
 		if (result != ISC_R_SUCCESS)
 			break;
-		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
+			  isc_rwlocktype_read);
 		for (header = node->data;
 		     header != NULL;
 		     header = header->next) {
@@ -1745,7 +2094,8 @@ activeemtpynode(rbtdb_search_t *search, dns_name_t *qname, dns_name_t *wname) {
 			    !IGNORE(header) && EXISTS(header))
 				break;
 		}
-		UNLOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    isc_rwlocktype_read);
 		if (header != NULL)
 			break;
 		result = dns_rbtnodechain_prev(&chain, NULL, NULL);
@@ -1762,7 +2112,8 @@ activeemtpynode(rbtdb_search_t *search, dns_name_t *qname, dns_name_t *wname) {
 						  origin, &node);
 		if (result != ISC_R_SUCCESS)
 			break;
-		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
+			  isc_rwlocktype_read);
 		for (header = node->data;
 		     header != NULL;
 		     header = header->next) {
@@ -1770,7 +2121,8 @@ activeemtpynode(rbtdb_search_t *search, dns_name_t *qname, dns_name_t *wname) {
 			    !IGNORE(header) && EXISTS(header))
 				break;
 		}
-		UNLOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    isc_rwlocktype_read);
 		if (header != NULL)
 			break;
 		result = dns_rbtnodechain_next(&chain, NULL, NULL);
@@ -1838,7 +2190,8 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep,
 	done = ISC_FALSE;
 	node = *nodep;
 	do {
-		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_LOCK(&(rbtdb->node_locks[node->locknum].lock),
+			  isc_rwlocktype_read);
 
 		/*
 		 * First we try to figure out if this node is active in
@@ -1863,7 +2216,8 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep,
 		else
 			wild = ISC_FALSE;
 
-		UNLOCK(&(rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(&(rbtdb->node_locks[node->locknum].lock),
+			    isc_rwlocktype_read);
 
 		if (wild) {
 			/*
@@ -1896,33 +2250,38 @@ find_wildcard(rbtdb_search_t *search, dns_rbtnode_t **nodep,
 						  DNS_RBTFIND_EMPTYDATA,
 						  NULL, NULL);
 			if (result == ISC_R_SUCCESS) {
-			    /*
-			     * We have found the wildcard node.  If it
-			     * is active in the search's version, we're
-			     * done.
-			     */
-			    LOCK(&(rbtdb->node_locks[wnode->locknum].lock));
-			    for (header = wnode->data;
-				 header != NULL;
-				 header = header->next) {
-				    if (header->serial <= search->serial &&
-					!IGNORE(header) && EXISTS(header))
-					    break;
-			    }
-			    UNLOCK(&(rbtdb->node_locks[wnode->locknum].lock));
-			    if (header != NULL ||
-				activeempty(search, &wchain, wname)) {
-				    if (activeemtpynode(search, qname, wname))
+				nodelock_t *lock;
+
+				/*
+				 * We have found the wildcard node.  If it
+				 * is active in the search's version, we're
+				 * done.
+				 */
+				lock = &rbtdb->node_locks[wnode->locknum].lock;
+				NODE_LOCK(lock, isc_rwlocktype_read);
+				for (header = wnode->data;
+				     header != NULL;
+				     header = header->next) {
+					if (header->serial <= search->serial &&
+					    !IGNORE(header) && EXISTS(header))
+						break;
+				}
+				NODE_UNLOCK(lock, isc_rwlocktype_read);
+				if (header != NULL ||
+				    activeempty(search, &wchain, wname)) {
+					if (activeemtpynode(search, qname,
+							    wname)) {
 						return (ISC_R_NOTFOUND);
-				    /*
-				     * The wildcard node is active!
-				     *
-				     * Note: result is still ISC_R_SUCCESS
-				     * so we don't have to set it.
-				     */
-				    *nodep = wnode;
-				    break;
-			    }
+					}
+					/*
+					 * The wildcard node is active!
+					 *
+					 * Note: result is still ISC_R_SUCCESS
+					 * so we don't have to set it.
+					 */
+					*nodep = wnode;
+					break;
+				}
 			} else if (result != ISC_R_NOTFOUND &&
 				   result != DNS_R_PARTIALMATCH) {
 				/*
@@ -1974,7 +2333,8 @@ find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 						  origin, &node);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-		LOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+		NODE_LOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			  isc_rwlocktype_read);
 		found = NULL;
 		foundsig = NULL;
 		empty_node = ISC_TRUE;
@@ -2074,7 +2434,8 @@ find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 			result = dns_rbtnodechain_prev(&search->chain, NULL,
 						       NULL);
 		}
-		UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock),
+			    isc_rwlocktype_read);
 	} while (empty_node && result == ISC_R_SUCCESS);
 
 	/*
@@ -2103,12 +2464,12 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	isc_boolean_t at_zonecut = ISC_FALSE;
 	isc_boolean_t wild;
 	isc_boolean_t empty_node;
-	isc_mutex_t *lock;
 	rdatasetheader_t *header, *header_next, *found, *nsecheader;
 	rdatasetheader_t *foundsig, *cnamesig, *nsecsig;
 	rbtdb_rdatatype_t sigtype;
 	isc_boolean_t active;
 	dns_rbtnodechain_t chain;
+	nodelock_t *lock;
 
 
 	search.rbtdb = (dns_rbtdb_t *)db;
@@ -2243,7 +2604,8 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	 * We now go looking for rdata...
 	 */
 
-	LOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+	NODE_LOCK(&(search.rbtdb->node_locks[node->locknum].lock),
+		  isc_rwlocktype_read);
 
 	found = NULL;
 	foundsig = NULL;
@@ -2391,7 +2753,8 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		 * we really have a partial match.
 		 */
 		if (!wild) {
-			UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+			lock = &search.rbtdb->node_locks[node->locknum].lock;
+			NODE_UNLOCK(lock, isc_rwlocktype_read);
 			goto partial_match;
 		}
 	}
@@ -2401,16 +2764,17 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	 */
 	if (found == NULL) {
 		if (search.zonecut != NULL) {
-		    /*
-		     * We were trying to find glue at a node beneath a
-		     * zone cut, but didn't.
-		     *
-		     * Return the delegation.
-		     */
-		    UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
-		    result = setup_delegation(&search, nodep, foundname,
-					      rdataset, sigrdataset);
-		    goto tree_exit;
+			/*
+			 * We were trying to find glue at a node beneath a
+			 * zone cut, but didn't.
+			 *
+			 * Return the delegation.
+			 */
+			lock = &search.rbtdb->node_locks[node->locknum].lock;
+			NODE_UNLOCK(lock, isc_rwlocktype_read);
+			result = setup_delegation(&search, nodep, foundname,
+						  rdataset, sigrdataset);
+			goto tree_exit;
 		}
 		/*
 		 * The desired type doesn't exist.
@@ -2426,11 +2790,12 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 				result = DNS_R_BADDB;
 				goto node_exit;
 			}
-			
-			UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+
+			lock = &search.rbtdb->node_locks[node->locknum].lock;
+			NODE_UNLOCK(lock, isc_rwlocktype_read);
 			result = find_closest_nsec(&search, nodep, foundname,
-						  rdataset, sigrdataset,
-						  search.rbtdb->secure);
+						   rdataset, sigrdataset,
+						   search.rbtdb->secure);
 			if (result == ISC_R_SUCCESS)
 				result = DNS_R_EMPTYWILD;
 			goto tree_exit;
@@ -2508,9 +2873,10 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		if (result == DNS_R_GLUE &&
 		    (search.options & DNS_DBFIND_VALIDATEGLUE) != 0 &&
 		    !valid_glue(&search, foundname, type, node)) {
-		    UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
-		    result = setup_delegation(&search, nodep, foundname,
-					      rdataset, sigrdataset);
+			lock = &search.rbtdb->node_locks[node->locknum].lock;
+			NODE_UNLOCK(lock, isc_rwlocktype_read);
+			result = setup_delegation(&search, nodep, foundname,
+						  rdataset, sigrdataset);
 		    goto tree_exit;
 		}
 	} else {
@@ -2539,7 +2905,8 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		foundname->attributes |= DNS_NAMEATTR_WILDCARD;
 
  node_exit:
-	UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+	NODE_UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock),
+		    isc_rwlocktype_read);
 
  tree_exit:
 	RWUNLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
@@ -2552,14 +2919,10 @@ zone_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		node = search.zonecut;
 		lock = &(search.rbtdb->node_locks[node->locknum].lock);
 
-		LOCK(lock);
-		INSIST(node->references > 0);
-		node->references--;
-		if (node->references == 0)
-			no_references(search.rbtdb, node, 0,
-				      isc_rwlocktype_none);
-
-		UNLOCK(lock);
+		NODE_LOCK(lock, isc_rwlocktype_read);
+		decrement_reference(search.rbtdb, node, 0,
+				    isc_rwlocktype_read, isc_rwlocktype_none);
+		NODE_UNLOCK(lock, isc_rwlocktype_read);
 	}
 
 	if (close_version)
@@ -2596,6 +2959,8 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 	rdatasetheader_t *header, *header_prev, *header_next;
 	rdatasetheader_t *dname_header, *sigdname_header;
 	isc_result_t result;
+	nodelock_t *lock;
+	isc_rwlocktype_t locktype;
 
 	/* XXX comment */
 
@@ -2606,7 +2971,9 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 	 */
 	UNUSED(name);
 
-	LOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+	lock = &(search->rbtdb->node_locks[node->locknum].lock);
+	locktype = isc_rwlocktype_read; 
+	NODE_LOCK(lock, locktype);
 
 	/*
 	 * Look for a DNAME or RRSIG DNAME rdataset.
@@ -2624,21 +2991,47 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 			 * the node as dirty, so it will get cleaned
 			 * up later.
 			 */
-			if (node->references == 0) {
-				INSIST(header->down == NULL);
-				if (header_prev != NULL)
-					header_prev->next =
-						header->next;
-				else
-					node->data = header->next;
-				free_rdataset(search->rbtdb->common.mctx,
-					      header);
-			} else {
-				header->attributes |=
-					RDATASET_ATTR_STALE;
-				node->dirty = 1;
+			if ((header->ttl <= search->now - RBTDB_VIRTUAL) &&
+			    (locktype == isc_rwlocktype_write ||
+			     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
+				/*
+				 * We update the node's status only when we
+				 * can get write access; otherwise, we leave
+				 * others to this work.  Periodical cleaning
+				 * will eventually take the job as the last
+				 * resort.
+				 * We won't downgrade the lock, since other
+				 * rdatasets are probably stale, too. 
+				 */
+				locktype = isc_rwlocktype_write;
+
+				if (dns_rbtnode_refcurrent(node) == 0) {
+					isc_mem_t *mctx;
+
+					/*
+					 * header->down can be non-NULL if the
+					 * refcount has just decremented to 0
+					 * but decrement_reference() has not
+					 * performed clean_cache_node(), in
+					 * which case we need to purge the
+					 * stale headers first.
+					 */
+					mctx = search->rbtdb->common.mctx;
+					clean_stale_headers(mctx, header);
+					if (header_prev != NULL)
+						header_prev->next =
+							header->next;
+					else
+						node->data = header->next;
+					free_rdataset(mctx, header);
+				} else {
+					header->attributes |=
+						RDATASET_ATTR_STALE;
+					node->dirty = 1;
+					header_prev = header;
+				}
+			} else
 				header_prev = header;
-			}
 		} else if (header->type == dns_rdatatype_dname &&
 			   EXISTS(header)) {
 			dname_header = header;
@@ -2667,7 +3060,7 @@ cache_zonecut_callback(dns_rbtnode_t *node, dns_name_t *name, void *arg) {
 	} else
 		result = DNS_R_CONTINUE;
 
-	UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+	NODE_UNLOCK(lock, locktype);
 
 	return (result);
 }
@@ -2685,6 +3078,8 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
 	dns_name_t name;
 	dns_rbtdb_t *rbtdb;
 	isc_boolean_t done;
+	nodelock_t *lock;
+	isc_rwlocktype_t locktype;
 
 	/*
 	 * Caller must be holding the tree lock.
@@ -2694,7 +3089,9 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
 	i = search->chain.level_matches;
 	done = ISC_FALSE;
 	do {
-		LOCK(&(rbtdb->node_locks[node->locknum].lock));
+		locktype = isc_rwlocktype_read;
+		lock = &rbtdb->node_locks[node->locknum].lock;
+		NODE_LOCK(lock, locktype);
 
 		/*
 		 * Look for NS and RRSIG NS rdatasets.
@@ -2714,21 +3111,37 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
 				 * the node as dirty, so it will get cleaned
 				 * up later.
 				 */
-				if (node->references == 0) {
-					INSIST(header->down == NULL);
-					if (header_prev != NULL)
-						header_prev->next =
-							header->next;
-					else
-						node->data = header->next;
-					free_rdataset(rbtdb->common.mctx,
-						      header);
-				} else {
-					header->attributes |=
-						RDATASET_ATTR_STALE;
-					node->dirty = 1;
+				if ((header->ttl <= search->now -
+						    RBTDB_VIRTUAL) &&
+				    (locktype == isc_rwlocktype_write ||
+				     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
+					/*
+					 * We update the node's status only
+					 * when we can get write access.
+					 */
+					locktype = isc_rwlocktype_write;
+
+					if (dns_rbtnode_refcurrent(node)
+					    == 0) {
+						isc_mem_t *m;
+
+						m = search->rbtdb->common.mctx;
+						clean_stale_headers(m, header);
+						if (header_prev != NULL)
+							header_prev->next =
+								header->next;
+						else
+							node->data =
+								header->next;
+						free_rdataset(m, header);
+					} else {
+						header->attributes |=
+							RDATASET_ATTR_STALE;
+						node->dirty = 1;
+						header_prev = header;
+					}
+				} else
 					header_prev = header;
-				}
 			} else if (EXISTS(header)) {
 				/*
 				 * We've found an extant rdataset.  See if
@@ -2792,7 +3205,7 @@ find_deepest_zonecut(rbtdb_search_t *search, dns_rbtnode_t *node,
 		}
 
 	node_exit:
-		UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(lock, locktype);
 
 		if (found == NULL && i > 0) {
 			i--;
@@ -2818,6 +3231,8 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 	dns_fixedname_t fname, forigin;
 	dns_name_t *name, *origin;
 	rbtdb_rdatatype_t matchtype, sigmatchtype;
+	nodelock_t *lock;
+	isc_rwlocktype_t locktype;
 
 	matchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_nsec, 0);
 	sigmatchtype = RBTDB_RDATATYPE_VALUE(dns_rdatatype_rrsig,
@@ -2833,7 +3248,9 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 						  origin, &node);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-		LOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+		locktype = isc_rwlocktype_read;
+		lock = &(search->rbtdb->node_locks[node->locknum].lock);
+		NODE_LOCK(lock, locktype);
 		found = NULL;
 		foundsig = NULL;
 		empty_node = ISC_TRUE;
@@ -2850,23 +3267,35 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 				 * node as dirty, so it will get cleaned up 
 				 * later.
 				 */
-				if (header->ttl > search->now - RBTDB_VIRTUAL)
-					header_prev = header;
-				else if (node->references == 0) {
-					INSIST(header->down == NULL);
-					if (header_prev != NULL)
-						header_prev->next =
-							header->next;
-					else
-						node->data = header->next;
-					free_rdataset(search->rbtdb->common.mctx,
-						      header);
-				} else {
-					header->attributes |=
-						 RDATASET_ATTR_STALE;
-					node->dirty = 1;
+				if ((header->ttl <= now - RBTDB_VIRTUAL) &&
+				    (locktype == isc_rwlocktype_write ||
+				     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
+					/*
+					 * We update the node's status only
+					 * when we can get write access.
+					 */
+					locktype = isc_rwlocktype_write;
+
+					if (dns_rbtnode_refcurrent(node)
+					    == 0) {
+						isc_mem_t *m;
+
+						m = search->rbtdb->common.mctx;
+						clean_stale_headers(m, header);
+						if (header_prev != NULL)
+							header_prev->next =
+								header->next;
+						else
+							node->data = header->next;
+						free_rdataset(m, header);
+					} else {
+						header->attributes |=
+							RDATASET_ATTR_STALE;
+						node->dirty = 1;
+						header_prev = header;
+					}
+				} else
 					header_prev = header;
-				}
 				continue;
 			}
 			if (NONEXISTENT(header) || NXDOMAIN(header)) {
@@ -2899,7 +3328,7 @@ find_coveringnsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
 			result = dns_rbtnodechain_prev(&search->chain, NULL,
 						       NULL);
  unlock_node:
-		UNLOCK(&(search->rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(lock, locktype);
 	} while (empty_node && result == ISC_R_SUCCESS);
 	return (result);
 }
@@ -2915,7 +3344,8 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	rbtdb_search_t search;
 	isc_boolean_t cname_ok = ISC_TRUE;
 	isc_boolean_t empty_node;
-	isc_mutex_t *lock;
+	nodelock_t *lock;
+	isc_rwlocktype_t locktype;
 	rdatasetheader_t *header, *header_prev, *header_next;
 	rdatasetheader_t *found, *nsheader;
 	rdatasetheader_t *foundsig, *nssig, *cnamesig;
@@ -2989,7 +3419,9 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	 * We now go looking for rdata...
 	 */
 
-	LOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+	lock = &(search.rbtdb->node_locks[node->locknum].lock);
+	locktype = isc_rwlocktype_read;
+	NODE_LOCK(lock, locktype);
 
 	found = NULL;
 	foundsig = NULL;
@@ -3009,21 +3441,34 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 			 * mark it as stale, and the node as dirty, so it will
 			 * get cleaned up later.
 			 */
-			if (header->ttl > now - RBTDB_VIRTUAL)
-				header_prev = header;
-			else if (node->references == 0) {
-				INSIST(header->down == NULL);
-				if (header_prev != NULL)
-					header_prev->next = header->next;
-				else
-					node->data = header->next;
-				free_rdataset(search.rbtdb->common.mctx,
-					      header);
-			} else {
-				header->attributes |= RDATASET_ATTR_STALE;
-				node->dirty = 1;
+			if ((header->ttl <= now - RBTDB_VIRTUAL) &&
+			    (locktype == isc_rwlocktype_write ||
+			     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
+				/*
+				 * We update the node's status only when we
+				 * can get write access.
+				 */
+				locktype = isc_rwlocktype_write;
+
+				if (dns_rbtnode_refcurrent(node) == 0) {
+					isc_mem_t *mctx;
+
+					mctx = search.rbtdb->common.mctx;
+					clean_stale_headers(mctx, header);
+					if (header_prev != NULL)
+						header_prev->next =
+							header->next;
+					else
+						node->data = header->next;
+					free_rdataset(mctx, header);
+				} else {
+					header->attributes |=
+						RDATASET_ATTR_STALE;
+					node->dirty = 1;
+					header_prev = header;
+				}
+			} else
 				header_prev = header;
-			}
 		} else if (EXISTS(header)) {
 			/*
 			 * We now know that there is at least one active
@@ -3103,7 +3548,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		 * extant rdatasets.  That means that this node doesn't
 		 * meaningfully exist, and that we really have a partial match.
 		 */
-		UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(lock, locktype);
 		goto find_ns;
 	}
 
@@ -3136,7 +3581,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		/*
 		 * Go find the deepest zone cut.
 		 */
-		UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(lock, locktype);
 		goto find_ns;
 	}
 
@@ -3183,7 +3628,7 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 	}
 
  node_exit:
-	UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+	NODE_UNLOCK(lock, locktype);
 
  tree_exit:
 	RWUNLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
@@ -3196,13 +3641,10 @@ cache_find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 		node = search.zonecut;
 		lock = &(search.rbtdb->node_locks[node->locknum].lock);
 
-		LOCK(lock);
-		INSIST(node->references > 0);
-		node->references--;
-		if (node->references == 0)
-			no_references(search.rbtdb, node, 0,
-				      isc_rwlocktype_none);
-		UNLOCK(lock);
+		NODE_LOCK(lock, isc_rwlocktype_read);
+		decrement_reference(search.rbtdb, node, 0,
+				    isc_rwlocktype_read, isc_rwlocktype_none);
+		NODE_UNLOCK(lock, isc_rwlocktype_read);
 	}
 
 	dns_rbtnodechain_reset(&search.chain);
@@ -3217,11 +3659,13 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
 		  dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
 {
 	dns_rbtnode_t *node = NULL;
+	nodelock_t *lock;
 	isc_result_t result;
 	rbtdb_search_t search;
 	rdatasetheader_t *header, *header_prev, *header_next;
 	rdatasetheader_t *found, *foundsig;
 	unsigned int rbtoptions = DNS_RBTFIND_EMPTYDATA;
+	isc_rwlocktype_t locktype;
 
 	search.rbtdb = (dns_rbtdb_t *)db;
 
@@ -3264,7 +3708,9 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
 	 * We now go looking for an NS rdataset at the node.
 	 */
 
-	LOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+	lock = &(search.rbtdb->node_locks[node->locknum].lock);
+	locktype = isc_rwlocktype_read;
+	NODE_LOCK(lock, locktype);
 
 	found = NULL;
 	foundsig = NULL;
@@ -3278,21 +3724,34 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
 			 * mark it as stale, and the node as dirty, so it will
 			 * get cleaned up later.
 			 */
-			if (header->ttl > now - RBTDB_VIRTUAL)
-				header_prev = header;
-			else if (node->references == 0) {
-				INSIST(header->down == NULL);
-				if (header_prev != NULL)
-					header_prev->next = header->next;
-				else
-					node->data = header->next;
-				free_rdataset(search.rbtdb->common.mctx,
-					      header);
-			} else {
-				header->attributes |= RDATASET_ATTR_STALE;
-				node->dirty = 1;
+			if ((header->ttl <= now - RBTDB_VIRTUAL) &&
+			    (locktype == isc_rwlocktype_write ||
+			     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
+				/*
+				 * We update the node's status only when we
+				 * can get write access.
+				 */
+				locktype = isc_rwlocktype_write;
+
+				if (dns_rbtnode_refcurrent(node) == 0) {
+					isc_mem_t *mctx;
+
+					mctx = search.rbtdb->common.mctx;
+					clean_stale_headers(mctx, header);
+					if (header_prev != NULL)
+						header_prev->next =
+							header->next;
+					else
+						node->data = header->next;
+					free_rdataset(mctx, header);
+				} else {
+					header->attributes |=
+						RDATASET_ATTR_STALE;
+					node->dirty = 1;
+					header_prev = header;
+				}
+			} else
 				header_prev = header;
-			}
 		} else if (EXISTS(header)) {
 			/*
 			 * If we found a type we were looking for, remember
@@ -3321,7 +3780,7 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
 		/*
 		 * No NS records here.
 		 */
-		UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+		NODE_UNLOCK(lock, locktype);
 		goto find_ns;
 	}
 
@@ -3335,7 +3794,7 @@ cache_findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
 		bind_rdataset(search.rbtdb, node, foundsig, search.now,
 			      sigrdataset);
 
-	UNLOCK(&(search.rbtdb->node_locks[node->locknum].lock));
+	NODE_UNLOCK(lock, locktype);
 
  tree_exit:
 	RWUNLOCK(&search.rbtdb->tree_lock, isc_rwlocktype_read);
@@ -3354,15 +3813,15 @@ static void
 attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
 	dns_rbtnode_t *node = (dns_rbtnode_t *)source;
+	unsigned int refs;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 	REQUIRE(targetp != NULL && *targetp == NULL);
 
-	LOCK(&rbtdb->node_locks[node->locknum].lock);
-	INSIST(node->references > 0);
-	node->references++;
-	INSIST(node->references != 0);			/* Catch overflow. */
-	UNLOCK(&rbtdb->node_locks[node->locknum].lock);
+	NODE_STRONGLOCK(&rbtdb->node_locks[node->locknum].lock);
+	dns_rbtnode_refincrement(node, &refs);
+	INSIST(refs != 0);
+	NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock);
 
 	*targetp = source;
 }
@@ -3373,35 +3832,34 @@ detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
 	dns_rbtnode_t *node;
 	isc_boolean_t want_free = ISC_FALSE;
 	isc_boolean_t inactive = ISC_FALSE;
-	unsigned int locknum;
+	rbtdb_nodelock_t *nodelock;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 	REQUIRE(targetp != NULL && *targetp != NULL);
 
 	node = (dns_rbtnode_t *)(*targetp);
-	locknum = node->locknum;
+	nodelock = &rbtdb->node_locks[node->locknum];
 
-	LOCK(&rbtdb->node_locks[locknum].lock);
+	NODE_LOCK(&nodelock->lock, isc_rwlocktype_read);
 
-	INSIST(node->references > 0);
-	node->references--;
-	if (node->references == 0) {
-		no_references(rbtdb, node, 0, isc_rwlocktype_none);
-		if (rbtdb->node_locks[locknum].references == 0 &&
-		    rbtdb->node_locks[locknum].exiting)
+	if (decrement_reference(rbtdb, node, 0, isc_rwlocktype_read,
+				isc_rwlocktype_none)) {
+		if (isc_refcount_current(&nodelock->references) == 0 &&
+		    nodelock->exiting) {
 			inactive = ISC_TRUE;
+		}
 	}
 
-	UNLOCK(&rbtdb->node_locks[locknum].lock);
+	NODE_UNLOCK(&nodelock->lock, isc_rwlocktype_read);
 
 	*targetp = NULL;
 
 	if (inactive) {
-		LOCK(&rbtdb->lock);
+		RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 		rbtdb->active--;
 		if (rbtdb->active == 0)
 			want_free = ISC_TRUE;
-		UNLOCK(&rbtdb->lock);
+		RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 		if (want_free) {
 			char buf[DNS_NAME_FORMATSIZE];
 			if (dns_name_dynamic(&rbtdb->common.origin))
@@ -3465,14 +3923,19 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
 							   sizeof(printname)));
 	}
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	/*
+	 * We may not need write access, but this code path is not performance
+	 * sensitive, so it should be okay to always lock as a writer.
+	 */
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_write);
 
 	for (header = rbtnode->data; header != NULL; header = header->next)
 		if (header->ttl <= now - RBTDB_VIRTUAL) {
 			/*
-			 * We don't check if rbtnode->references == 0 and try
+			 * We don't check if refcurrent(rbtnode) == 0 and try
 			 * to free like we do in cache_find(), because
-			 * rbtnode->references must be non-zero.  This is so
+			 * refcurrent(rbtnode) must be non-zero.  This is so
 			 * because 'node' is an argument to the function.
 			 */
 			header->attributes |= RDATASET_ATTR_STALE;
@@ -3496,7 +3959,8 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
 			isc_log_write(dns_lctx, category, module, level,
 				      "overmem cache: saved %s", printname);
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_write);
 
 	return (ISC_R_SUCCESS);
 }
@@ -3518,10 +3982,12 @@ printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_read);
 
 	fprintf(out, "node %p, %u references, locknum = %u\n",
-		rbtnode, rbtnode->references, rbtnode->locknum);
+		rbtnode, dns_rbtnode_refcurrent(rbtnode),
+		rbtnode->locknum);
 	if (rbtnode->data != NULL) {
 		rdatasetheader_t *current, *top_next;
 
@@ -3547,7 +4013,8 @@ printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
 	} else
 		fprintf(out, "(empty)\n");
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_read);
 }
 
 static isc_result_t
@@ -3608,7 +4075,8 @@ zone_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	serial = rbtversion->serial;
 	now = 0;
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_read);
 
 	found = NULL;
 	foundsig = NULL;
@@ -3656,7 +4124,8 @@ zone_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 				      sigrdataset);
 	}
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_read);
 
 	if (close_version)
 		closeversion(db, (dns_dbversion_t **) (void *)(&rbtversion),
@@ -3679,6 +4148,8 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	rdatasetheader_t *header, *header_next, *found, *foundsig;
 	rbtdb_rdatatype_t matchtype, sigmatchtype, negtype;
 	isc_result_t result;
+	nodelock_t *lock;
+	isc_rwlocktype_t locktype;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 	REQUIRE(type != dns_rdatatype_any);
@@ -3690,7 +4161,9 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	if (now == 0)
 		isc_stdtime_get(&now);
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	lock = &rbtdb->node_locks[rbtnode->locknum].lock;
+	locktype = isc_rwlocktype_read;
+	NODE_LOCK(lock, locktype);
 
 	found = NULL;
 	foundsig = NULL;
@@ -3704,13 +4177,22 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	for (header = rbtnode->data; header != NULL; header = header_next) {
 		header_next = header->next;
 		if (header->ttl <= now) {
-			/*
-			 * We don't check if rbtnode->references == 0 and try
-			 * to free like we do in cache_find(), because
-			 * rbtnode->references must be non-zero.  This is so
-			 * because 'node' is an argument to the function.
-			 */
-			if (header->ttl <= now - RBTDB_VIRTUAL) {
+			if ((header->ttl <= now - RBTDB_VIRTUAL) &&
+			    (locktype == isc_rwlocktype_write ||
+			     NODE_TRYUPGRADE(lock) == ISC_R_SUCCESS)) {
+				/*
+				 * We update the node's status only when we
+				 * can get write access.
+				 */
+				locktype = isc_rwlocktype_write;
+				
+				/*
+				 * We don't check if refcurrent(rbtnode) == 0
+				 * and try to free like we do in cache_find(),
+				 * because refcurrent(rbtnode) must be
+				 * non-zero.  This is so because 'node' is an
+				 * argument to the function.
+				 */
 				header->attributes |= RDATASET_ATTR_STALE;
 				rbtnode->dirty = 1;
 			}
@@ -3731,7 +4213,7 @@ cache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 				      sigrdataset);
 	}
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(lock, locktype);
 
 	if (found == NULL)
 		return (ISC_R_NOTFOUND);
@@ -3757,6 +4239,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	dns_rbtnode_t *rbtnode = (dns_rbtnode_t *)node;
 	rbtdb_version_t *rbtversion = version;
 	rbtdb_rdatasetiter_t *iterator;
+	unsigned int refs;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
@@ -3770,11 +4253,11 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			currentversion(db,
 				 (dns_dbversion_t **) (void *)(&rbtversion));
 		else {
-			LOCK(&rbtdb->lock);
-			INSIST(rbtversion->references > 0);
-			rbtversion->references++;
-			INSIST(rbtversion->references != 0);
-			UNLOCK(&rbtdb->lock);
+			unsigned int refs;
+
+			isc_refcount_increment(&rbtversion->references,
+					       &refs);
+			INSIST(refs > 1);
 		}
 	} else {
 		if (now == 0)
@@ -3789,14 +4272,14 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	iterator->common.version = (dns_dbversion_t *)rbtversion;
 	iterator->common.now = now;
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_STRONGLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+
+	dns_rbtnode_refincrement(rbtnode, &refs);
+	INSIST(refs != 0);
 
-	INSIST(rbtnode->references > 0);
-	rbtnode->references++;
-	INSIST(rbtnode->references != 0);
 	iterator->current = NULL;
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_STRONGUNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
 
 	*iteratorp = (dns_rdatasetiter_t *)iterator;
 
@@ -3987,6 +4470,7 @@ add(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 					 * The NXDOMAIN/NODATA(QTYPE=ANY)
 					 * is more trusted.
 					 */
+					
 					free_rdataset(rbtdb->common.mctx,
 						      newheader);
 					if (addedrdataset != NULL)
@@ -4343,6 +4827,8 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	newheader->noqname = NULL;
 	newheader->count = 0;
 	newheader->trust = rdataset->trust;
+	newheader->additional_auth = NULL;
+	newheader->additional_glue = NULL;
 	if (rbtversion != NULL) {
 		newheader->serial = rbtversion->serial;
 		now = 0;
@@ -4371,14 +4857,16 @@ addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	} else
 		delegating = ISC_FALSE;
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_write);
 
 	result = add(rbtdb, rbtnode, rbtversion, newheader, options, ISC_FALSE,
 		     addedrdataset, now);
 	if (result == ISC_R_SUCCESS && delegating)
 		rbtnode->find_callback = 1;
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_write);
 
 	if (delegating)
 		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
@@ -4423,13 +4911,17 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	newheader->trust = 0;
 	newheader->noqname = NULL;
 	newheader->count = 0;
+	newheader->additional_auth = NULL;
+	newheader->additional_glue = NULL;
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_write);
 
 	changed = add_changed(rbtdb, rbtversion, rbtnode);
 	if (changed == NULL) {
 		free_rdataset(rbtdb->common.mctx, newheader);
-		UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+		NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+			    isc_rwlocktype_write);
 		return (ISC_R_NOMEMORY);
 	}
 
@@ -4476,6 +4968,13 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			 * header, not newheader.
 			 */
 			newheader->serial = rbtversion->serial;
+			/*
+			 * XXXJT: dns_rdataslab_subtract() copied the pointers
+			 * to additional info.  We need to clear these fields
+			 * to avoid having duplicated references.
+			 */
+			newheader->additional_auth = NULL;
+			newheader->additional_glue = NULL;
 		} else if (result == DNS_R_NXRRSET) {
 			/*
 			 * This subtraction would remove all of the rdata;
@@ -4495,6 +4994,8 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 			newheader->serial = rbtversion->serial;
 			newheader->noqname = NULL;
 			newheader->count = 0;
+			newheader->additional_auth = NULL;
+			newheader->additional_glue = NULL;
 		} else {
 			free_rdataset(rbtdb->common.mctx, newheader);
 			goto unlock;
@@ -4530,7 +5031,8 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		bind_rdataset(rbtdb, rbtnode, newheader, 0, newrdataset);
 
  unlock:
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_write);
 
 	/*
 	 * Update the zone's secure status.  If version is non-NULL
@@ -4567,18 +5069,22 @@ deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	newheader->attributes = RDATASET_ATTR_NONEXISTENT;
 	newheader->trust = 0;
 	newheader->noqname = NULL;
+	newheader->additional_auth = NULL;
+	newheader->additional_glue = NULL;
 	if (rbtversion != NULL)
 		newheader->serial = rbtversion->serial;
 	else
 		newheader->serial = 0;
 	newheader->count = 0;
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_write);
 
 	result = add(rbtdb, rbtnode, rbtversion, newheader, DNS_DBADD_FORCE,
 		     ISC_FALSE, NULL, 0);
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_write);
 
 	/*
 	 * Update the zone's secure status.  If version is non-NULL
@@ -4656,6 +5162,8 @@ loading_addrdataset(void *arg, dns_name_t *name, dns_rdataset_t *rdataset) {
 	newheader->serial = 1;
 	newheader->noqname = NULL;
 	newheader->count = 0;
+	newheader->additional_auth = NULL;
+	newheader->additional_glue = NULL;
 
 	result = add(rbtdb, node, rbtdb->current_version, newheader,
 		     DNS_DBADD_MERGE, ISC_TRUE, NULL, 0);
@@ -4687,13 +5195,13 @@ beginload(dns_db_t *db, dns_addrdatasetfunc_t *addp, dns_dbload_t **dbloadp) {
 	else
 		loadctx->now = 0;
 
-	LOCK(&rbtdb->lock);
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	REQUIRE((rbtdb->attributes & (RBTDB_ATTR_LOADED|RBTDB_ATTR_LOADING))
 		== 0);
 	rbtdb->attributes |= RBTDB_ATTR_LOADING;
 
-	UNLOCK(&rbtdb->lock);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	*addp = loading_addrdataset;
 	*dbloadp = loadctx;
@@ -4711,7 +5219,7 @@ endload(dns_db_t *db, dns_dbload_t **dbloadp) {
 	loadctx = *dbloadp;
 	REQUIRE(loadctx->rbtdb == rbtdb);
 
-	LOCK(&rbtdb->lock);
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	REQUIRE((rbtdb->attributes & RBTDB_ATTR_LOADING) != 0);
 	REQUIRE((rbtdb->attributes & RBTDB_ATTR_LOADED) == 0);
@@ -4719,7 +5227,7 @@ endload(dns_db_t *db, dns_dbload_t **dbloadp) {
 	rbtdb->attributes &= ~RBTDB_ATTR_LOADING;
 	rbtdb->attributes |= RBTDB_ATTR_LOADED;
 
-	UNLOCK(&rbtdb->lock);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
 	/*
 	 * If there's a KEY rdataset at the zone origin containing a
@@ -4736,16 +5244,17 @@ endload(dns_db_t *db, dns_dbload_t **dbloadp) {
 }
 
 static isc_result_t
-dump(dns_db_t *db, dns_dbversion_t *version, const char *filename) {
+dump(dns_db_t *db, dns_dbversion_t *version, const char *filename,
+     dns_masterformat_t masterformat) {
 	dns_rbtdb_t *rbtdb;
 
 	rbtdb = (dns_rbtdb_t *)db;
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
-	return (dns_master_dump(rbtdb->common.mctx, db, version,
-				&dns_master_style_default,
-				filename));
+	return (dns_master_dump2(rbtdb->common.mctx, db, version,
+				 &dns_master_style_default,
+				 filename, masterformat));
 }
 
 static void
@@ -4799,12 +5308,12 @@ settask(dns_db_t *db, isc_task_t *task) {
 
 	REQUIRE(VALID_RBTDB(rbtdb));
 
-	LOCK(&rbtdb->lock);
+	RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
 	if (rbtdb->task != NULL)
 		isc_task_detach(&rbtdb->task);
 	if (task != NULL)
 		isc_task_attach(task, &rbtdb->task);
-	UNLOCK(&rbtdb->lock);
+	RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 }
 
 static isc_boolean_t
@@ -4813,6 +5322,31 @@ ispersistent(dns_db_t *db) {
 	return (ISC_FALSE);
 }
 
+static isc_result_t
+getoriginnode(dns_db_t *db, dns_dbnode_t **nodep) {
+	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)db;
+	dns_rbtnode_t *onode;
+	isc_result_t result = ISC_R_SUCCESS;
+
+	REQUIRE(VALID_RBTDB(rbtdb));
+	REQUIRE(nodep != NULL && *nodep == NULL);
+
+	/* Note that the access to origin_node doesn't require a DB lock */
+	onode = (dns_rbtnode_t *)rbtdb->origin_node;
+	if (onode != NULL) {
+		NODE_STRONGLOCK(&rbtdb->node_locks[onode->locknum].lock);
+		new_reference(rbtdb, onode);
+		NODE_STRONGUNLOCK(&rbtdb->node_locks[onode->locknum].lock);
+
+		*nodep = rbtdb->origin_node;
+	} else {
+		INSIST(!IS_CACHE(rbtdb));
+		result = ISC_R_NOTFOUND;
+	}
+
+	return (result);
+}
+
 static dns_dbmethods_t zone_methods = {
 	attach,
 	detach,
@@ -4840,7 +5374,8 @@ static dns_dbmethods_t zone_methods = {
 	nodecount,
 	ispersistent,
 	overmem,
-	settask
+	settask,
+	getoriginnode
 };
 
 static dns_dbmethods_t cache_methods = {
@@ -4870,7 +5405,8 @@ static dns_dbmethods_t cache_methods = {
 	nodecount,
 	ispersistent,
 	overmem,
-	settask
+	settask,
+	getoriginnode
 };
 
 isc_result_t
@@ -4896,6 +5432,7 @@ dns_rbtdb_create
 	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
 	if (rbtdb == NULL)
 		return (ISC_R_NOMEMORY);
+
 	memset(rbtdb, '\0', sizeof(*rbtdb));
 	dns_name_init(&rbtdb->common.origin, NULL);
 	rbtdb->common.attributes = 0;
@@ -4910,55 +5447,48 @@ dns_rbtdb_create
 	rbtdb->common.rdclass = rdclass;
 	rbtdb->common.mctx = NULL;
 
-	result = isc_mutex_init(&rbtdb->lock);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, rbtdb, sizeof(*rbtdb));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
+	result = RBTDB_INITLOCK(&rbtdb->lock);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup_rbtdb;
 
 	result = isc_rwlock_init(&rbtdb->tree_lock, 0, 0);
-	if (result != ISC_R_SUCCESS) {
-		DESTROYLOCK(&rbtdb->lock);
-		isc_mem_put(mctx, rbtdb, sizeof(*rbtdb));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_rwlock_init() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
+	if (result != ISC_R_SUCCESS)
+		goto cleanup_lock;
 
+	if (rbtdb->node_lock_count == 0) {
+		if (IS_CACHE(rbtdb))
+			rbtdb->node_lock_count = DEFAULT_CACHE_NODE_LOCK_COUNT;
+		else
+			rbtdb->node_lock_count = DEFAULT_NODE_LOCK_COUNT;
+	}
 	INSIST(rbtdb->node_lock_count < (1 << DNS_RBT_LOCKLENGTH));
-
-	if (rbtdb->node_lock_count == 0)
-		rbtdb->node_lock_count = DEFAULT_NODE_LOCK_COUNT;
 	rbtdb->node_locks = isc_mem_get(mctx, rbtdb->node_lock_count *
 					sizeof(rbtdb_nodelock_t));
+	if (rbtdb->node_locks == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup_tree_lock;
+	}
+
 	rbtdb->active = rbtdb->node_lock_count;
+
 	for (i = 0; i < (int)(rbtdb->node_lock_count); i++) {
-		result = isc_mutex_init(&rbtdb->node_locks[i].lock);
+		result = NODE_INITLOCK(&rbtdb->node_locks[i].lock);
+		if (result == ISC_R_SUCCESS) {
+			result = isc_refcount_init(&rbtdb->node_locks[i].references, 0);
+			if (result != ISC_R_SUCCESS)
+				NODE_DESTROYLOCK(&rbtdb->node_locks[i].lock);
+		}
 		if (result != ISC_R_SUCCESS) {
-			i--;
-			while (i >= 0) {
-				DESTROYLOCK(&rbtdb->node_locks[i].lock);
-				i--;
+			while (i-- > 0) {
+				NODE_DESTROYLOCK(&rbtdb->node_locks[i].lock);
+				isc_refcount_decrement(&rbtdb->node_locks[i].references, NULL);
+				isc_refcount_destroy(&rbtdb->node_locks[i].references);
 			}
-			isc_mem_put(mctx, rbtdb->node_locks,
-				    rbtdb->node_lock_count *
-				    sizeof(rbtdb_nodelock_t));
-			isc_rwlock_destroy(&rbtdb->tree_lock);
-			DESTROYLOCK(&rbtdb->lock);
-			isc_mem_put(mctx, rbtdb, sizeof(*rbtdb));
-			UNEXPECTED_ERROR(__FILE__, __LINE__,
-					 "isc_mutex_init() failed: %s",
-					 isc_result_totext(result));
-			return (ISC_R_UNEXPECTED);
+			goto cleanup_node_locks;
 		}
-		rbtdb->node_locks[i].references = 0;
 		rbtdb->node_locks[i].exiting = ISC_FALSE;
 	}
-
+	
 	/*
 	 * Attach to the mctx.  The database will persist so long as there
 	 * are references to it, and attaching to the mctx ensures that our
@@ -5001,7 +5531,7 @@ dns_rbtdb_create
 	 * the top-of-zone node can never be deleted, nor can its address
 	 * change.
 	 */
-	if (! IS_CACHE(rbtdb)) {
+	if (!IS_CACHE(rbtdb)) {
 		rbtdb->origin_node = NULL;
 		result = dns_rbt_addnode(rbtdb->tree, &rbtdb->common.origin,
 					 &rbtdb->origin_node);
@@ -5029,7 +5559,11 @@ dns_rbtdb_create
 	/*
 	 * Misc. Initialization.
 	 */
-	isc_refcount_init(&rbtdb->references, 1);
+	result = isc_refcount_init(&rbtdb->references, 1);
+	if (result != ISC_R_SUCCESS) {
+		free_rbtdb(rbtdb, ISC_FALSE, NULL);
+		return (result);
+	}
 	rbtdb->attributes = 0;
 	rbtdb->secure = ISC_FALSE;
 	rbtdb->overmem = ISC_FALSE;
@@ -5041,13 +5575,20 @@ dns_rbtdb_create
 	rbtdb->current_serial = 1;
 	rbtdb->least_serial = 1;
 	rbtdb->next_serial = 2;
-	rbtdb->current_version = allocate_version(mctx, 1, 0, ISC_FALSE);
+	rbtdb->current_version = allocate_version(mctx, 1, 1, ISC_FALSE);
 	if (rbtdb->current_version == NULL) {
+		isc_refcount_decrement(&rbtdb->references, NULL);
+		isc_refcount_destroy(&rbtdb->references);
 		free_rbtdb(rbtdb, ISC_FALSE, NULL);
 		return (ISC_R_NOMEMORY);
 	}
 	rbtdb->future_version = NULL;
 	ISC_LIST_INIT(rbtdb->open_versions);
+	/*
+	 * Keep the current version in the open list so that list operation
+	 * won't happen in normal lookup operations.
+	 */
+	PREPEND(rbtdb->open_versions, rbtdb->current_version, link);
 
 	rbtdb->common.magic = DNS_DB_MAGIC;
 	rbtdb->common.impmagic = RBTDB_MAGIC;
@@ -5055,6 +5596,20 @@ dns_rbtdb_create
 	*dbp = (dns_db_t *)rbtdb;
 
 	return (ISC_R_SUCCESS);
+
+ cleanup_node_locks:
+	isc_mem_put(mctx, rbtdb->node_locks,
+		    rbtdb->node_lock_count * sizeof(rbtdb_nodelock_t));
+
+ cleanup_tree_lock:
+	isc_rwlock_destroy(&rbtdb->tree_lock);
+
+ cleanup_lock:
+	RBTDB_DESTROYLOCK(&rbtdb->lock);
+
+ cleanup_rbtdb:
+	isc_mem_put(mctx, rbtdb,  sizeof(*rbtdb));
+	return (result);
 }
 
 
@@ -5072,7 +5627,7 @@ rdataset_disassociate(dns_rdataset_t *rdataset) {
 
 static isc_result_t
 rdataset_first(dns_rdataset_t *rdataset) {
-	unsigned char *raw = rdataset->private3;
+	unsigned char *raw = rdataset->private3;	/* RDATASLAB */
 	unsigned int count;
 
 	count = raw[0] * 256 + raw[1];
@@ -5080,11 +5635,20 @@ rdataset_first(dns_rdataset_t *rdataset) {
 		rdataset->private5 = NULL;
 		return (ISC_R_NOMORE);
 	}
-	raw += 2;
+	
+	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0)
+		raw += 2 + (4 * count);
+	else
+		raw += 2;
+
 	/*
-	 * The privateuint4 field is the number of rdata beyond the cursor
-	 * position, so we decrement the total count by one before storing
-	 * it.
+	 * The privateuint4 field is the number of rdata beyond the
+	 * cursor position, so we decrement the total count by one
+	 * before storing it.
+	 *
+	 * If DNS_RDATASETATTR_LOADORDER is not set 'raw' points to the
+	 * first record.  If DNS_RDATASETATTR_LOADORDER is set 'raw' points
+	 * to the first entry in the offset table.
 	 */
 	count--;
 	rdataset->privateuint4 = count;
@@ -5097,30 +5661,47 @@ static isc_result_t
 rdataset_next(dns_rdataset_t *rdataset) {
 	unsigned int count;
 	unsigned int length;
-	unsigned char *raw;
+	unsigned char *raw;	/* RDATASLAB */
 
 	count = rdataset->privateuint4;
 	if (count == 0)
 		return (ISC_R_NOMORE);
 	count--;
 	rdataset->privateuint4 = count;
+
+	/*
+	 * Skip forward one record (length + 4) or one offset (4).
+	 */
 	raw = rdataset->private5;
-	length = raw[0] * 256 + raw[1];
-	raw += length + 2;
-	rdataset->private5 = raw;
+	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) == 0) {
+		length = raw[0] * 256 + raw[1];
+		raw += length;
+	}
+	rdataset->private5 = raw + 4;
 
 	return (ISC_R_SUCCESS);
 }
 
 static void
 rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
-	unsigned char *raw = rdataset->private5;
+	unsigned char *raw = rdataset->private5;	/* RDATASLAB */
+	unsigned int offset;
 	isc_region_t r;
 
 	REQUIRE(raw != NULL);
 
+	/*
+	 * Find the start of the record if not already in private5
+	 * then skip the length and order fields.
+	 */
+	if ((rdataset->attributes & DNS_RDATASETATTR_LOADORDER) != 0) {
+		offset = (raw[0] << 24) + (raw[1] << 16) +
+			 (raw[2] << 8) + raw[3];
+		raw = rdataset->private3;
+		raw += offset;
+	}
 	r.length = raw[0] * 256 + raw[1];
-	raw += 2;
+	raw += 4;
 	r.base = raw;
 	dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r);
 }
@@ -5143,7 +5724,7 @@ rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
 
 static unsigned int
 rdataset_count(dns_rdataset_t *rdataset) {
-	unsigned char *raw = rdataset->private3;
+	unsigned char *raw = rdataset->private3;	/* RDATASLAB */
 	unsigned int count;
 
 	count = raw[0] * 256 + raw[1];
@@ -5233,7 +5814,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
 		now = 0;
 	}
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_read);
 
 	for (header = rbtnode->data; header != NULL; header = top_next) {
 		top_next = header->next;
@@ -5260,7 +5842,8 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) {
 			break;
 	}
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_read);
 
 	rbtiterator->current = header;
 
@@ -5294,7 +5877,8 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
 		now = 0;
 	}
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_read);
 
 	type = header->type;
 	rdtype = RBTDB_RDATATYPE_BASE(header->type);
@@ -5335,7 +5919,8 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) {
 		}
 	}
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_read);
 
 	rbtiterator->current = header;
 
@@ -5355,12 +5940,14 @@ rdatasetiter_current(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset) {
 	header = rbtiterator->current;
 	REQUIRE(header != NULL);
 
-	LOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_LOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		  isc_rwlocktype_read);
 
 	bind_rdataset(rbtdb, rbtnode, header, rbtiterator->common.now,
 		      rdataset);
 
-	UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock);
+	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
+		    isc_rwlocktype_read);
 }
 
 
@@ -5377,26 +5964,25 @@ reference_iter_node(rbtdb_dbiterator_t *rbtdbiter) {
 		return;
 
 	INSIST(rbtdbiter->tree_locked != isc_rwlocktype_none);
-	LOCK(&rbtdb->node_locks[node->locknum].lock);
+	NODE_STRONGLOCK(&rbtdb->node_locks[node->locknum].lock);
 	new_reference(rbtdb, node);
-	UNLOCK(&rbtdb->node_locks[node->locknum].lock);
+	NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock);
 }
 
 static inline void
 dereference_iter_node(rbtdb_dbiterator_t *rbtdbiter) {
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
 	dns_rbtnode_t *node = rbtdbiter->node;
-	isc_mutex_t *lock;
+	nodelock_t *lock;
 
 	if (node == NULL)
 		return;
 
 	lock = &rbtdb->node_locks[node->locknum].lock;
-	LOCK(lock);
-	INSIST(rbtdbiter->node->references > 0);
-	if (--node->references == 0)
-		no_references(rbtdb, node, 0, rbtdbiter->tree_locked);
-	UNLOCK(lock);
+	NODE_LOCK(lock, isc_rwlocktype_read);
+	decrement_reference(rbtdb, node, 0, isc_rwlocktype_read,
+			    rbtdbiter->tree_locked);
+	NODE_UNLOCK(lock, isc_rwlocktype_read);
 
 	rbtdbiter->node = NULL;
 }
@@ -5406,7 +5992,7 @@ flush_deletions(rbtdb_dbiterator_t *rbtdbiter) {
 	dns_rbtnode_t *node;
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)rbtdbiter->common.db;
 	isc_boolean_t was_read_locked = ISC_FALSE;
-	isc_mutex_t *lock;
+	nodelock_t *lock;
 	int i;
 
 	if (rbtdbiter->delete != 0) {
@@ -5433,13 +6019,11 @@ flush_deletions(rbtdb_dbiterator_t *rbtdbiter) {
 			node = rbtdbiter->deletions[i];
 			lock = &rbtdb->node_locks[node->locknum].lock;
 
-			LOCK(lock);
-			INSIST(node->references > 0);
-			node->references--;
-			if (node->references == 0)
-				no_references(rbtdb, node, 0,
-					      rbtdbiter->tree_locked);
-			UNLOCK(lock);
+			NODE_LOCK(lock, isc_rwlocktype_read);
+			decrement_reference(rbtdb, node, 0,
+					    isc_rwlocktype_read,
+					    rbtdbiter->tree_locked);
+			NODE_UNLOCK(lock, isc_rwlocktype_read);
 		}
 
 		rbtdbiter->delete = 0;
@@ -5707,9 +6291,9 @@ dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
 	} else
 		result = ISC_R_SUCCESS;
 
-	LOCK(&rbtdb->node_locks[node->locknum].lock);
+	NODE_STRONGLOCK(&rbtdb->node_locks[node->locknum].lock);
 	new_reference(rbtdb, node);
-	UNLOCK(&rbtdb->node_locks[node->locknum].lock);
+	NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock);
 
 	*nodep = rbtdbiter->node;
 
@@ -5730,10 +6314,13 @@ dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
 		 * expirenode() currently always returns success.
 		 */
 		if (expire_result == ISC_R_SUCCESS && node->down == NULL) {
+			unsigned int refs;
+
 			rbtdbiter->deletions[rbtdbiter->delete++] = node;
-			LOCK(&rbtdb->node_locks[node->locknum].lock);
-			node->references++;
-			UNLOCK(&rbtdb->node_locks[node->locknum].lock);
+			NODE_STRONGLOCK(&rbtdb->node_locks[node->locknum].lock);
+			dns_rbtnode_refincrement(node, &refs);
+			INSIST(refs != 0);
+			NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock);
 		}
 	}
 
@@ -5775,3 +6362,356 @@ dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
 
 	return (dns_name_copy(origin, name, NULL));
 }
+
+/*%
+ * Additional cache routines.
+ */
+static isc_result_t
+rdataset_getadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
+		       dns_rdatatype_t qtype, dns_acache_t *acache,
+		       dns_zone_t **zonep, dns_db_t **dbp,
+		       dns_dbversion_t **versionp, dns_dbnode_t **nodep,
+		       dns_name_t *fname, dns_message_t *msg,
+		       isc_stdtime_t now)
+{
+	dns_rbtdb_t *rbtdb = rdataset->private1;
+	dns_rbtnode_t *rbtnode = rdataset->private2;
+	unsigned char *raw = rdataset->private3;	/* RDATASLAB */
+	unsigned int current_count = rdataset->privateuint4;
+	unsigned int count;
+	rdatasetheader_t *header;
+	nodelock_t *nodelock;
+	unsigned int total_count;
+	acachectl_t *acarray;
+	dns_acacheentry_t *entry;
+	isc_result_t result;
+
+	UNUSED(qtype); /* we do not use this value at least for now */
+	UNUSED(acache);
+
+	header = (struct rdatasetheader *)(raw - sizeof(*header));
+
+	total_count = raw[0] * 256 + raw[1];
+	INSIST(total_count > current_count);
+	count = total_count - current_count - 1;
+
+	acarray = NULL;
+
+	nodelock = &rbtdb->node_locks[rbtnode->locknum].lock;
+	NODE_LOCK(nodelock, isc_rwlocktype_read);
+
+	switch (type) {
+	case dns_rdatasetadditional_fromauth:
+		acarray = header->additional_auth;
+		break;
+	case dns_rdatasetadditional_fromcache:
+		acarray = NULL;
+		break;
+	case dns_rdatasetadditional_fromglue:
+		acarray = header->additional_glue;
+		break;
+	default:
+		INSIST(0);
+	}
+
+	if (acarray == NULL) {
+		if (type != dns_rdatasetadditional_fromcache)
+			dns_acache_countquerymiss(acache);
+		NODE_UNLOCK(nodelock, isc_rwlocktype_read);
+		return (ISC_R_NOTFOUND);
+	}
+
+	if (acarray[count].entry == NULL) {
+		dns_acache_countquerymiss(acache);
+		NODE_UNLOCK(nodelock, isc_rwlocktype_read);
+		return (ISC_R_NOTFOUND);
+	}
+
+	entry = NULL;
+	dns_acache_attachentry(acarray[count].entry, &entry);
+
+	NODE_UNLOCK(nodelock, isc_rwlocktype_read);
+
+	result = dns_acache_getentry(entry, zonep, dbp, versionp,
+				     nodep, fname, msg, now);
+
+	dns_acache_detachentry(&entry);
+
+	return (result);
+}
+
+static void
+acache_callback(dns_acacheentry_t *entry, void **arg) {
+	dns_rbtdb_t *rbtdb;
+	dns_rbtnode_t *rbtnode;
+	nodelock_t *nodelock;
+	acachectl_t *acarray = NULL;
+	acache_cbarg_t *cbarg;
+	unsigned int count;
+
+	REQUIRE(arg != NULL);
+	cbarg = *arg;
+
+	/*
+	 * The caller must hold the entry lock.
+	 */
+
+	rbtdb = (dns_rbtdb_t *)cbarg->db;
+	rbtnode = (dns_rbtnode_t *)cbarg->node;
+
+	nodelock = &rbtdb->node_locks[rbtnode->locknum].lock;
+	NODE_LOCK(nodelock, isc_rwlocktype_write);
+
+	switch (cbarg->type) {
+	case dns_rdatasetadditional_fromauth:
+		acarray = cbarg->header->additional_auth;
+		break;
+	case dns_rdatasetadditional_fromglue:
+		acarray = cbarg->header->additional_glue;
+		break;
+	default:
+		INSIST(0);
+	}
+
+	count = cbarg->count;
+	if (acarray[count].entry == entry)
+		acarray[count].entry = NULL;
+	INSIST(acarray[count].cbarg != NULL);
+	isc_mem_put(rbtdb->common.mctx, acarray[count].cbarg,
+		    sizeof(acache_cbarg_t));
+	acarray[count].cbarg = NULL;
+
+	dns_acache_detachentry(&entry);
+
+	NODE_UNLOCK(nodelock, isc_rwlocktype_write);
+
+	dns_db_detachnode((dns_db_t *)rbtdb, (dns_dbnode_t **)(void*)&rbtnode);
+	dns_db_detach((dns_db_t **)(void*)&rbtdb);
+
+	*arg = NULL;
+}
+
+static void
+acache_cancelentry(isc_mem_t *mctx, dns_acacheentry_t *entry,
+		      acache_cbarg_t **cbargp)
+{
+	acache_cbarg_t *cbarg;
+
+	REQUIRE(mctx != NULL);
+	REQUIRE(entry != NULL);
+	REQUIRE(cbargp != NULL && *cbargp != NULL);
+
+	cbarg = *cbargp;
+
+	dns_acache_cancelentry(entry);
+	dns_db_detachnode(cbarg->db, &cbarg->node);
+	dns_db_detach(&cbarg->db);
+
+	isc_mem_put(mctx, cbarg, sizeof(acache_cbarg_t));
+
+	*cbargp = NULL;
+}
+
+static isc_result_t
+rdataset_setadditional(dns_rdataset_t *rdataset, dns_rdatasetadditional_t type,
+		       dns_rdatatype_t qtype, dns_acache_t *acache,
+		       dns_zone_t *zone, dns_db_t *db,
+		       dns_dbversion_t *version, dns_dbnode_t *node,
+		       dns_name_t *fname)
+{
+	dns_rbtdb_t *rbtdb = rdataset->private1;
+	dns_rbtnode_t *rbtnode = rdataset->private2;
+	unsigned char *raw = rdataset->private3;	/* RDATASLAB */
+	unsigned int current_count = rdataset->privateuint4;
+	rdatasetheader_t *header;
+	unsigned int total_count, count;
+	nodelock_t *nodelock;
+	isc_result_t result;
+	acachectl_t *acarray;
+	dns_acacheentry_t *newentry, *oldentry = NULL;
+	acache_cbarg_t *newcbarg, *oldcbarg = NULL;
+
+	UNUSED(qtype);
+
+	if (type == dns_rdatasetadditional_fromcache)
+		return (ISC_R_SUCCESS);
+
+	header = (struct rdatasetheader *)(raw - sizeof(*header));
+
+	total_count = raw[0] * 256 + raw[1];
+	INSIST(total_count > current_count);
+	count = total_count - current_count - 1; /* should be private data */
+
+	newcbarg = isc_mem_get(rbtdb->common.mctx, sizeof(*newcbarg));
+	if (newcbarg == NULL)
+		return (ISC_R_NOMEMORY);
+	newcbarg->type = type;
+	newcbarg->count = count;
+	newcbarg->header = header;
+	newcbarg->db = NULL;
+	dns_db_attach((dns_db_t *)rbtdb, &newcbarg->db);
+	newcbarg->node = NULL;
+	dns_db_attachnode((dns_db_t *)rbtdb, (dns_dbnode_t *)rbtnode,
+			  &newcbarg->node);
+	newentry = NULL;
+	result = dns_acache_createentry(acache, (dns_db_t *)rbtdb,
+					acache_callback, newcbarg, &newentry);
+	if (result != ISC_R_SUCCESS)
+		goto fail;
+	/* Set cache data in the new entry. */
+	result = dns_acache_setentry(acache, newentry, zone, db,
+				     version, node, fname);
+	if (result != ISC_R_SUCCESS)
+		goto fail;
+
+	nodelock = &rbtdb->node_locks[rbtnode->locknum].lock;
+	NODE_LOCK(nodelock, isc_rwlocktype_write);
+
+	acarray = NULL;
+	switch (type) {
+	case dns_rdatasetadditional_fromauth:
+		acarray = header->additional_auth;
+		break;
+	case dns_rdatasetadditional_fromglue:
+		acarray = header->additional_glue;
+		break;
+	default:
+		INSIST(0);
+	}
+
+	if (acarray == NULL) {
+		unsigned int i;
+
+		acarray = isc_mem_get(rbtdb->common.mctx, total_count *
+				      sizeof(acachectl_t));
+
+		if (acarray == NULL) {
+			NODE_UNLOCK(nodelock, isc_rwlocktype_write);
+			goto fail;
+		}
+
+		for (i = 0; i < total_count; i++) {
+			acarray[i].entry = NULL;
+			acarray[i].cbarg = NULL;
+		}
+	}
+	switch (type) {
+	case dns_rdatasetadditional_fromauth:
+		header->additional_auth = acarray;
+		break;
+	case dns_rdatasetadditional_fromglue:
+		header->additional_glue = acarray;
+		break;
+	default:
+		INSIST(0);
+	}
+
+	if (acarray[count].entry != NULL) {
+		/*
+		 * Swap the entry.  Delay cleaning-up the old entry since
+		 * it would require a node lock.
+		 */
+		oldentry = acarray[count].entry;
+		INSIST(acarray[count].cbarg != NULL);
+		oldcbarg = acarray[count].cbarg;
+	}
+	acarray[count].entry = newentry;
+	acarray[count].cbarg = newcbarg;
+
+	NODE_UNLOCK(nodelock, isc_rwlocktype_write);
+
+	if (oldentry != NULL) {
+		if (oldcbarg != NULL)
+			acache_cancelentry(rbtdb->common.mctx, oldentry,
+					   &oldcbarg); 
+		dns_acache_detachentry(&oldentry);
+	}
+
+	return (ISC_R_SUCCESS);
+
+  fail:
+	if (newcbarg != NULL) {
+		if (newentry != NULL) {
+			acache_cancelentry(rbtdb->common.mctx, newentry,
+					   &newcbarg);
+			dns_acache_detachentry(&newentry);
+		} else {
+			dns_db_detachnode((dns_db_t *)rbtdb, &newcbarg->node);
+			dns_db_detach(&newcbarg->db);
+			isc_mem_put(rbtdb->common.mctx, newcbarg,
+			    sizeof(*newcbarg));
+		}
+	}
+
+	return (result);
+}
+
+static isc_result_t
+rdataset_putadditional(dns_acache_t *acache, dns_rdataset_t *rdataset,
+		       dns_rdatasetadditional_t type, dns_rdatatype_t qtype)
+{ 
+	dns_rbtdb_t *rbtdb = rdataset->private1;
+	dns_rbtnode_t *rbtnode = rdataset->private2;
+	unsigned char *raw = rdataset->private3;	/* RDATASLAB */
+	unsigned int current_count = rdataset->privateuint4;
+	rdatasetheader_t *header;
+	nodelock_t *nodelock;
+	unsigned int total_count, count;
+	acachectl_t *acarray;
+	dns_acacheentry_t *entry;
+	acache_cbarg_t *cbarg;
+
+	UNUSED(qtype);		/* we do not use this value at least for now */
+	UNUSED(acache);
+
+	if (type == dns_rdatasetadditional_fromcache)
+		return (ISC_R_SUCCESS);
+
+	header = (struct rdatasetheader *)(raw - sizeof(*header));
+
+	total_count = raw[0] * 256 + raw[1];
+	INSIST(total_count > current_count);
+	count = total_count - current_count - 1;
+
+	acarray = NULL;
+	entry = NULL;
+
+	nodelock = &rbtdb->node_locks[rbtnode->locknum].lock;
+	NODE_LOCK(nodelock, isc_rwlocktype_write);
+
+	switch (type) {
+	case dns_rdatasetadditional_fromauth:
+		acarray = header->additional_auth;
+		break;
+	case dns_rdatasetadditional_fromglue:
+		acarray = header->additional_glue;
+		break;
+	default:
+		INSIST(0);
+	}
+
+	if (acarray == NULL) {
+		NODE_UNLOCK(nodelock, isc_rwlocktype_write);
+		return (ISC_R_NOTFOUND);
+	}
+
+	entry = acarray[count].entry;
+	if (entry == NULL) {
+		NODE_UNLOCK(nodelock, isc_rwlocktype_write);
+		return (ISC_R_NOTFOUND);
+	}
+
+	acarray[count].entry = NULL;
+	cbarg = acarray[count].cbarg;
+	acarray[count].cbarg = NULL;
+
+	NODE_UNLOCK(nodelock, isc_rwlocktype_write);
+
+	if (entry != NULL) {
+		if (cbarg != NULL)
+			acache_cancelentry(rbtdb->common.mctx, entry, &cbarg);
+		dns_acache_detachentry(&entry);
+	}
+
+	return (ISC_R_SUCCESS);
+}
diff --git a/contrib/bind9/lib/dns/rbtdb.h b/contrib/bind9/lib/dns/rbtdb.h
index 086b75e..f9fb50b 100644
--- a/contrib/bind9/lib/dns/rbtdb.h
+++ b/contrib/bind9/lib/dns/rbtdb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.h,v 1.13.206.1 2004/03/06 08:13:42 marka Exp $ */
+/* $Id: rbtdb.h,v 1.14.18.2 2005/04/29 00:16:02 marka Exp $ */
 
 #ifndef DNS_RBTDB_H
 #define DNS_RBTDB_H 1
@@ -27,7 +27,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * DNS Red-Black Tree DB Implementation
  */
 
diff --git a/contrib/bind9/lib/dns/rbtdb64.c b/contrib/bind9/lib/dns/rbtdb64.c
index f41ab37..773fe91 100644
--- a/contrib/bind9/lib/dns/rbtdb64.c
+++ b/contrib/bind9/lib/dns/rbtdb64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb64.c,v 1.6.206.1 2004/03/06 08:13:42 marka Exp $ */
+/* $Id: rbtdb64.c,v 1.7.18.2 2005/04/29 00:16:02 marka Exp $ */
+
+/*! \file */
 
 #define DNS_RBTDB_VERSION64 1
 #include "rbtdb.c"
diff --git a/contrib/bind9/lib/dns/rbtdb64.h b/contrib/bind9/lib/dns/rbtdb64.h
index 5d426b5..e2de45c 100644
--- a/contrib/bind9/lib/dns/rbtdb64.h
+++ b/contrib/bind9/lib/dns/rbtdb64.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb64.h,v 1.12.206.1 2004/03/06 08:13:43 marka Exp $ */
+/* $Id: rbtdb64.h,v 1.13.18.2 2005/04/29 00:16:02 marka Exp $ */
 
 #ifndef DNS_RBTDB64_H
 #define DNS_RBTDB64_H 1
@@ -26,7 +26,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * DNS Red-Black Tree DB Implementation with 64-bit version numbers
  */
 
diff --git a/contrib/bind9/lib/dns/rcode.c b/contrib/bind9/lib/dns/rcode.c
index 337f649..f61aa35 100644
--- a/contrib/bind9/lib/dns/rcode.c
+++ b/contrib/bind9/lib/dns/rcode.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rcode.c,v 1.1.4.1 2004/03/12 10:31:25 marka Exp $ */
+/* $Id: rcode.c,v 1.2.18.2 2006/01/27 23:57:44 marka Exp $ */
 
 #include <config.h>
 #include <ctype.h>
@@ -76,6 +76,7 @@
 	{ dns_tsigerror_badmode, "BADMODE", 0}, \
 	{ dns_tsigerror_badname, "BADNAME", 0}, \
 	{ dns_tsigerror_badalg, "BADALG", 0}, \
+	{ dns_tsigerror_badtrunc, "BADTRUNC", 0}, \
 	{ 0, NULL, 0 }
 
 /* RFC2538 section 2.1 */
diff --git a/contrib/bind9/lib/dns/rdata.c b/contrib/bind9/lib/dns/rdata.c
index bcd0e150..5641777 100644
--- a/contrib/bind9/lib/dns/rdata.c
+++ b/contrib/bind9/lib/dns/rdata.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata.c,v 1.147.2.11.2.22 2006/07/21 02:05:56 marka Exp $ */
+/* $Id: rdata.c,v 1.184.18.9 2006/07/21 02:05:57 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 #include <ctype.h>
@@ -100,16 +102,16 @@
 #define ARGS_CHECKNAMES dns_rdata_t *rdata, dns_name_t *owner, dns_name_t *bad
 
 
-/*
+/*%
  * Context structure for the totext_ functions.
  * Contains formatting options for rdata-to-text
  * conversion.
  */
 typedef struct dns_rdata_textctx {
-	dns_name_t *origin;	/* Current origin, or NULL. */
-	unsigned int flags;	/* DNS_STYLEFLAG_* */
-	unsigned int width;	/* Width of rdata column. */
-  	const char *linebreak;	/* Line break string. */
+	dns_name_t *origin;	/*%< Current origin, or NULL. */
+	unsigned int flags;	/*%< DNS_STYLEFLAG_*  */
+	unsigned int width;	/*%< Width of rdata column. */
+  	const char *linebreak;	/*%< Line break string. */
 } dns_rdata_textctx_t;
 
 static isc_result_t
@@ -195,6 +197,10 @@ static void
 warn_badname(dns_name_t *name, isc_lex_t *lexer,
 	     dns_rdatacallbacks_t *callbacks);
 
+static void
+warn_badmx(isc_token_t *token, isc_lex_t *lexer,
+	   dns_rdatacallbacks_t *callbacks);
+
 static inline int
 getquad(const void *src, struct in_addr *dst,
 	isc_lex_t *lexer, dns_rdatacallbacks_t *callbacks)
@@ -1581,6 +1587,22 @@ fromtext_warneof(isc_lex_t *lexer, dns_rdatacallbacks_t *callbacks) {
 }
 
 static void
+warn_badmx(isc_token_t *token, isc_lex_t *lexer,
+	   dns_rdatacallbacks_t *callbacks)
+{
+	const char *file;
+	unsigned long line;
+
+	if (lexer != NULL) {
+		file = isc_lex_getsourcename(lexer);
+		line = isc_lex_getsourceline(lexer);
+		(*callbacks->warn)(callbacks, "%s:%u: warning: '%s': %s", 
+				   file, line, DNS_AS_STR(*token),
+				   dns_result_totext(DNS_R_MXISADDRESS));
+	}
+}
+
+static void
 warn_badname(dns_name_t *name, isc_lex_t *lexer,
 	     dns_rdatacallbacks_t *callbacks)
 {
diff --git a/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c b/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c
index c9b52c7..4fdadd3 100644
--- a/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c
+++ b/contrib/bind9/lib/dns/rdata/any_255/tsig_250.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tsig_250.c,v 1.52.2.1.2.8 2005/03/20 22:34:01 marka Exp $ */
+/* $Id: tsig_250.c,v 1.59.18.2 2005/03/20 22:34:32 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 13:39:43 PST 2000 by gson */
 
diff --git a/contrib/bind9/lib/dns/rdata/any_255/tsig_250.h b/contrib/bind9/lib/dns/rdata/any_255/tsig_250.h
index 7b5ccc2..b84a715 100644
--- a/contrib/bind9/lib/dns/rdata/any_255/tsig_250.h
+++ b/contrib/bind9/lib/dns/rdata/any_255/tsig_250.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,13 +15,12 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tsig_250.h,v 1.20.206.1 2004/03/06 08:14:02 marka Exp $ */
-
-/* RFC 2845 */
+/* $Id: tsig_250.h,v 1.21.18.2 2005/04/29 00:16:29 marka Exp $ */
 
 #ifndef ANY_255_TSIG_250_H
 #define ANY_255_TSIG_250_H 1
 
+/*% RFC2845 */
 typedef struct dns_rdata_any_tsig {
 	dns_rdatacommon_t	common;
 	isc_mem_t *		mctx;
diff --git a/contrib/bind9/lib/dns/rdata/ch_3/a_1.c b/contrib/bind9/lib/dns/rdata/ch_3/a_1.c
new file mode 100644
index 0000000..6a9b70c
--- /dev/null
+++ b/contrib/bind9/lib/dns/rdata/ch_3/a_1.c
@@ -0,0 +1,316 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: a_1.c,v 1.2.2.3 2005/08/23 04:10:09 marka Exp $ */
+
+/* by Bjorn.Victor@it.uu.se, 2005-05-07 */
+/* Based on generic/soa_6.c and generic/mx_15.c */
+
+#ifndef RDATA_CH_3_A_1_C
+#define RDATA_CH_3_A_1_C
+
+#include <isc/net.h>
+
+#define RRTYPE_A_ATTRIBUTES (0)
+
+static inline isc_result_t
+fromtext_ch_a(ARGS_FROMTEXT) {
+	isc_token_t token;
+	dns_name_t name;
+	isc_buffer_t buffer;
+
+	REQUIRE(type == 1);
+	REQUIRE(rdclass == dns_rdataclass_ch); /* 3 */
+
+	UNUSED(type);
+	UNUSED(callbacks);
+
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+				      ISC_FALSE));
+
+	/* get domain name */
+	dns_name_init(&name, NULL);
+	buffer_fromregion(&buffer, &token.value.as_region);
+	origin = (origin != NULL) ? origin : dns_rootname;
+	RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target));
+	if ((options & DNS_RDATA_CHECKNAMES) != 0 &&
+	    (options & DNS_RDATA_CHECKREVERSE) != 0) {
+		isc_boolean_t ok;
+		ok = dns_name_ishostname(&name, ISC_FALSE);
+		if (!ok && (options & DNS_RDATA_CHECKNAMESFAIL) != 0)
+			RETTOK(DNS_R_BADNAME);
+		if (!ok && callbacks != NULL)
+			warn_badname(&name, lexer, callbacks);
+	}
+
+	/* 16-bit octal address */
+	RETERR(isc_lex_getoctaltoken(lexer, &token, ISC_FALSE));
+	if (token.value.as_ulong > 0xffffU)
+		RETTOK(ISC_R_RANGE);
+	return (uint16_tobuffer(token.value.as_ulong, target));
+}
+
+static inline isc_result_t
+totext_ch_a(ARGS_TOTEXT) {
+	isc_region_t region;
+	dns_name_t name;
+	dns_name_t prefix;
+	isc_boolean_t sub;
+	char buf[sizeof("0177777")];
+	isc_uint16_t addr;
+
+	REQUIRE(rdata->type == 1);
+	REQUIRE(rdata->rdclass == dns_rdataclass_ch); /* 3 */
+	REQUIRE(rdata->length != 0);
+
+	dns_name_init(&name, NULL);
+	dns_name_init(&prefix, NULL);
+
+	dns_rdata_toregion(rdata, &region);
+	dns_name_fromregion(&name, &region);
+	isc_region_consume(&region, name_length(&name));
+	addr = uint16_fromregion(&region);
+
+	sub = name_prefix(&name, tctx->origin, &prefix);
+	RETERR(dns_name_totext(&prefix, sub, target));
+
+	sprintf(buf, "%o", addr); /* note octal */
+	RETERR(str_totext(" ", target));
+	return (str_totext(buf, target));
+}
+
+static inline isc_result_t
+fromwire_ch_a(ARGS_FROMWIRE) {
+	isc_region_t sregion;
+	isc_region_t tregion;
+	dns_name_t name;
+
+	REQUIRE(type == 1);
+	REQUIRE(rdclass == dns_rdataclass_ch);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	dns_decompress_setmethods(dctx, DNS_COMPRESS_GLOBAL14);
+
+	dns_name_init(&name, NULL);
+	
+	RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+
+	isc_buffer_activeregion(source, &sregion);
+	isc_buffer_availableregion(target, &tregion);
+	if (sregion.length < 2)
+		return (ISC_R_UNEXPECTEDEND);
+	if (tregion.length < 2)
+		return (ISC_R_NOSPACE);
+
+	memcpy(tregion.base, sregion.base, 2);
+	isc_buffer_forward(source, 2);
+	isc_buffer_add(target, 2);
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+towire_ch_a(ARGS_TOWIRE) {
+	dns_name_t name;
+	dns_offsets_t offsets;
+	isc_region_t sregion;
+	isc_region_t tregion;
+
+	REQUIRE(rdata->type == 1);
+	REQUIRE(rdata->rdclass == dns_rdataclass_ch);
+	REQUIRE(rdata->length != 0);
+
+	dns_compress_setmethods(cctx, DNS_COMPRESS_GLOBAL14);
+
+	dns_name_init(&name, offsets);
+
+	dns_rdata_toregion(rdata, &sregion);
+
+	dns_name_fromregion(&name, &sregion);
+	isc_region_consume(&sregion, name_length(&name));
+	RETERR(dns_name_towire(&name, cctx, target));
+
+	isc_buffer_availableregion(target, &tregion);
+	if (tregion.length < 2)
+		return (ISC_R_NOSPACE);
+
+	memcpy(tregion.base, sregion.base, 2);
+	isc_buffer_add(target, 2);
+	return (ISC_R_SUCCESS);
+}
+
+static inline int
+compare_ch_a(ARGS_COMPARE) {
+	dns_name_t name1;
+	dns_name_t name2;
+	isc_region_t region1;
+	isc_region_t region2;
+	int order;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == 1);
+	REQUIRE(rdata1->rdclass == dns_rdataclass_ch);
+	REQUIRE(rdata1->length != 0);
+	REQUIRE(rdata2->length != 0);
+
+	dns_name_init(&name1, NULL);
+	dns_name_init(&name2, NULL);
+
+	dns_rdata_toregion(rdata1, &region1);
+	dns_rdata_toregion(rdata2, &region2);
+
+	dns_name_fromregion(&name1, &region1);
+	dns_name_fromregion(&name2, &region2);
+	isc_region_consume(&region1, name_length(&name1));
+	isc_region_consume(&region2, name_length(&name2));
+
+	order = dns_name_rdatacompare(&name1, &name2);
+	if (order != 0)
+		return (order);
+
+	order = memcmp(rdata1->data, rdata2->data, 2);
+	if (order != 0)
+		order = (order < 0) ? -1 : 1;
+	return (order);
+}
+
+static inline isc_result_t
+fromstruct_ch_a(ARGS_FROMSTRUCT) {
+	dns_rdata_ch_a_t *a = source;
+	isc_region_t region;
+
+	REQUIRE(type == 1);
+	REQUIRE(source != NULL);
+	REQUIRE(a->common.rdtype == type);
+	REQUIRE(a->common.rdclass == rdclass);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	dns_name_toregion(&a->ch_addr_dom, &region);
+	RETERR(isc_buffer_copyregion(target, &region));
+	
+	return (uint16_tobuffer(ntohs(a->ch_addr), target));
+}
+
+static inline isc_result_t
+tostruct_ch_a(ARGS_TOSTRUCT) {
+	dns_rdata_ch_a_t *a = target;
+	isc_region_t region;
+	dns_name_t name;
+
+	REQUIRE(rdata->type == 1);
+	REQUIRE(rdata->rdclass == dns_rdataclass_ch);
+	REQUIRE(rdata->length != 0);
+
+	a->common.rdclass = rdata->rdclass;
+	a->common.rdtype = rdata->type;
+	ISC_LINK_INIT(&a->common, link);
+
+	dns_rdata_toregion(rdata, &region);
+
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &region);
+	isc_region_consume(&region, name_length(&name));
+
+	dns_name_init(&a->ch_addr_dom, NULL);
+	RETERR(name_duporclone(&name, mctx, &a->ch_addr_dom));
+	a->ch_addr = htons(uint16_fromregion(&region));
+	a->mctx = mctx;
+	return (ISC_R_SUCCESS);
+}
+
+static inline void
+freestruct_ch_a(ARGS_FREESTRUCT) {
+	dns_rdata_ch_a_t *a = source;
+
+	REQUIRE(source != NULL);
+	REQUIRE(a->common.rdtype == 1);
+
+	if (a->mctx == NULL)
+		return;
+
+	dns_name_free(&a->ch_addr_dom, a->mctx);
+	a->mctx = NULL;
+}
+
+static inline isc_result_t
+additionaldata_ch_a(ARGS_ADDLDATA) {
+
+	REQUIRE(rdata->type == 1);
+	REQUIRE(rdata->rdclass == dns_rdataclass_ch);
+
+	UNUSED(rdata);
+	UNUSED(add);
+	UNUSED(arg);
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+digest_ch_a(ARGS_DIGEST) {
+	isc_region_t r;
+
+	dns_name_t name;
+
+	REQUIRE(rdata->type == 1);
+	REQUIRE(rdata->rdclass == dns_rdataclass_ch);
+
+	dns_rdata_toregion(rdata, &r);
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &r);
+	isc_region_consume(&r, name_length(&name));
+	RETERR(dns_name_digest(&name, digest, arg));
+	return ((digest)(arg, &r));
+}
+
+static inline isc_boolean_t
+checkowner_ch_a(ARGS_CHECKOWNER) {
+
+	REQUIRE(type == 1);
+	REQUIRE(rdclass == dns_rdataclass_ch);
+
+	UNUSED(type);
+
+	return (dns_name_ishostname(name, wildcard));
+}
+
+static inline isc_boolean_t
+checknames_ch_a(ARGS_CHECKNAMES) {
+	isc_region_t region;
+	dns_name_t name;
+
+	REQUIRE(rdata->type == 1);
+	REQUIRE(rdata->rdclass == dns_rdataclass_ch);
+
+	UNUSED(owner);
+
+	dns_rdata_toregion(rdata, &region);
+	dns_name_init(&name, NULL);
+	dns_name_fromregion(&name, &region);
+	if (!dns_name_ishostname(&name, ISC_FALSE)) {
+		if (bad != NULL)
+			dns_name_clone(&name, bad);
+		return (ISC_FALSE);
+	}
+
+	return (ISC_TRUE);
+}
+
+#endif	/* RDATA_CH_3_A_1_C */
diff --git a/contrib/bind9/lib/dns/rdata/ch_3/a_1.h b/contrib/bind9/lib/dns/rdata/ch_3/a_1.h
new file mode 100644
index 0000000..9f67977
--- /dev/null
+++ b/contrib/bind9/lib/dns/rdata/ch_3/a_1.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: a_1.h,v 1.2.2.2 2005/06/05 00:02:22 marka Exp $ */
+
+/* by Bjorn.Victor@it.uu.se, 2005-05-07 */
+/* Based on generic/mx_15.h */
+
+#ifndef CH_3_A_1_H
+#define CH_3_A_1_H 1
+
+typedef isc_uint16_t ch_addr_t;
+
+typedef struct dns_rdata_ch_a {
+	dns_rdatacommon_t	common;
+	isc_mem_t		*mctx;
+  	dns_name_t		ch_addr_dom; /* ch-addr domain for back mapping */
+	ch_addr_t		ch_addr; /* chaos address (16 bit) network order */
+} dns_rdata_ch_a_t;
+
+#endif /* CH_3_A_1_H */
diff --git a/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c b/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c
index f46844a..24a63e6 100644
--- a/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c
+++ b/contrib/bind9/lib/dns/rdata/generic/afsdb_18.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: afsdb_18.c,v 1.39.2.1.2.3 2004/03/06 08:14:03 marka Exp $ */
+/* $Id: afsdb_18.c,v 1.43.18.2 2005/04/29 00:16:30 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 14:59:00 PST 2000 by explorer */
 
-/* RFC 1183 */
+/* RFC1183 */
 
 #ifndef RDATA_GENERIC_AFSDB_18_C
 #define RDATA_GENERIC_AFSDB_18_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/afsdb_18.h b/contrib/bind9/lib/dns/rdata/generic/afsdb_18.h
index 3f89f9d..1532da1 100644
--- a/contrib/bind9/lib/dns/rdata/generic/afsdb_18.h
+++ b/contrib/bind9/lib/dns/rdata/generic/afsdb_18.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_AFSDB_18_H
 #define GENERIC_AFSDB_18_H 1
 
-/* $Id: afsdb_18.h,v 1.15.206.1 2004/03/06 08:14:03 marka Exp $ */
+/* $Id: afsdb_18.h,v 1.16.18.2 2005/04/29 00:16:30 marka Exp $ */
 
-/* RFC 1183 */
+/*!
+ *  \brief Per RFC1183 */
 
 typedef struct dns_rdata_afsdb {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/cert_37.c b/contrib/bind9/lib/dns/rdata/generic/cert_37.c
index 81a1aa7..c6ba3a8 100644
--- a/contrib/bind9/lib/dns/rdata/generic/cert_37.c
+++ b/contrib/bind9/lib/dns/rdata/generic/cert_37.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cert_37.c,v 1.40.2.1.2.5 2004/03/08 09:04:40 marka Exp $ */
+/* $Id: cert_37.c,v 1.46.18.2 2005/04/29 00:16:30 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 21:14:32 EST 2000 by tale */
 
-/* RFC 2538 */
+/* RFC2538 */
 
 #ifndef RDATA_GENERIC_CERT_37_C
 #define RDATA_GENERIC_CERT_37_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/cert_37.h b/contrib/bind9/lib/dns/rdata/generic/cert_37.h
index 01ae265..2af25b7 100644
--- a/contrib/bind9/lib/dns/rdata/generic/cert_37.h
+++ b/contrib/bind9/lib/dns/rdata/generic/cert_37.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,12 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cert_37.h,v 1.15.206.1 2004/03/06 08:14:03 marka Exp $ */
+/* $Id: cert_37.h,v 1.16.18.2 2005/04/29 00:16:31 marka Exp $ */
 
-/* RFC 2538 */
 #ifndef GENERIC_CERT_37_H
 #define GENERIC_CERT_37_H 1
 
+/*% RFC2538 */
 typedef struct dns_rdata_cert {
 	dns_rdatacommon_t	common;
 	isc_mem_t		*mctx;
diff --git a/contrib/bind9/lib/dns/rdata/generic/cname_5.c b/contrib/bind9/lib/dns/rdata/generic/cname_5.c
index 0ce7aa2..6ea1db1 100644
--- a/contrib/bind9/lib/dns/rdata/generic/cname_5.c
+++ b/contrib/bind9/lib/dns/rdata/generic/cname_5.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cname_5.c,v 1.43.206.2 2004/03/06 08:14:03 marka Exp $ */
+/* $Id: cname_5.c,v 1.45 2004/03/05 05:10:10 marka Exp $ */
 
 /* reviewed: Wed Mar 15 16:48:45 PST 2000 by brister */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/cname_5.h b/contrib/bind9/lib/dns/rdata/generic/cname_5.h
index 2efee44..dc24383 100644
--- a/contrib/bind9/lib/dns/rdata/generic/cname_5.h
+++ b/contrib/bind9/lib/dns/rdata/generic/cname_5.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cname_5.h,v 1.23.206.1 2004/03/06 08:14:04 marka Exp $ */
+/* $Id: cname_5.h,v 1.24 2004/03/05 05:10:10 marka Exp $ */
 
 #ifndef GENERIC_CNAME_5_H
 #define GENERIC_CNAME_5_H 1
diff --git a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c
index b28435c..fa22580 100644
--- a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c
+++ b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dlv_32769.c,v 1.2.4.2 2006/02/19 06:50:46 marka Exp $ */
+/* $Id: dlv_32769.c,v 1.2.2.2 2006/02/19 06:50:47 marka Exp $ */
 
 /* draft-ietf-dnsext-delegation-signer-05.txt */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h
index 08a9b1d..bd03c73 100644
--- a/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h
+++ b/contrib/bind9/lib/dns/rdata/generic/dlv_32769.h
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dlv_32769.h,v 1.2.4.2 2006/02/19 06:50:46 marka Exp $ */
+/* $Id: dlv_32769.h,v 1.2.2.2 2006/02/19 06:50:47 marka Exp $ */
 
 /* draft-ietf-dnsext-delegation-signer-05.txt */
 #ifndef GENERIC_DLV_32769_H
diff --git a/contrib/bind9/lib/dns/rdata/generic/dname_39.c b/contrib/bind9/lib/dns/rdata/generic/dname_39.c
index b532f2e..ed3133c 100644
--- a/contrib/bind9/lib/dns/rdata/generic/dname_39.c
+++ b/contrib/bind9/lib/dns/rdata/generic/dname_39.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dname_39.c,v 1.34.206.2 2004/03/06 08:14:04 marka Exp $ */
+/* $Id: dname_39.c,v 1.36 2004/03/05 05:10:10 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 16:52:38 PST 2000 by explorer */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/dname_39.h b/contrib/bind9/lib/dns/rdata/generic/dname_39.h
index a1b2192..93ec709 100644
--- a/contrib/bind9/lib/dns/rdata/generic/dname_39.h
+++ b/contrib/bind9/lib/dns/rdata/generic/dname_39.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_DNAME_39_H
 #define GENERIC_DNAME_39_H 1
 
-/* $Id: dname_39.h,v 1.16.206.1 2004/03/06 08:14:04 marka Exp $ */
+/* $Id: dname_39.h,v 1.17.18.2 2005/04/29 00:16:31 marka Exp $ */
 
-/* RFC2672 */
+/*! 
+ *  \brief per RFC2672 */
 
 typedef struct dns_rdata_dname {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c
index 5cf58d5..5a4e453 100644
--- a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c
+++ b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,13 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnskey_48.c,v 1.4.2.1 2004/03/08 02:08:02 marka Exp $ */
+/* $Id: dnskey_48.c,v 1.4.20.2 2005/04/29 00:16:31 marka Exp $ */
 
 /*
  * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
  */
 
-/* RFC 2535 */
+/* RFC2535 */
 
 #ifndef RDATA_GENERIC_DNSKEY_48_C
 #define RDATA_GENERIC_DNSKEY_48_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h
index 4dd71d2..9b3d262 100644
--- a/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h
+++ b/contrib/bind9/lib/dns/rdata/generic/dnskey_48.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_DNSKEY_48_H
 #define GENERIC_DNSKEY_48_H 1
 
-/* $Id: dnskey_48.h,v 1.3.2.1 2004/03/08 02:08:02 marka Exp $ */
+/* $Id: dnskey_48.h,v 1.3.20.2 2005/04/29 00:16:32 marka Exp $ */
 
-/* RFC 2535 */
+/*!
+ *  \brief per RFC2535 */
 
 typedef struct dns_rdata_dnskey {
         dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/ds_43.c b/contrib/bind9/lib/dns/rdata/generic/ds_43.c
index 0206b6f..b9a3a3e 100644
--- a/contrib/bind9/lib/dns/rdata/generic/ds_43.c
+++ b/contrib/bind9/lib/dns/rdata/generic/ds_43.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ds_43.c,v 1.6.2.4 2005/09/06 07:29:31 marka Exp $ */
+/* $Id: ds_43.c,v 1.7.18.2 2005/09/06 07:29:32 marka Exp $ */
 
 /* draft-ietf-dnsext-delegation-signer-05.txt */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/ds_43.h b/contrib/bind9/lib/dns/rdata/generic/ds_43.h
index cd4a5ca..dae7bef 100644
--- a/contrib/bind9/lib/dns/rdata/generic/ds_43.h
+++ b/contrib/bind9/lib/dns/rdata/generic/ds_43.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ds_43.h,v 1.3.2.1 2004/03/08 02:08:03 marka Exp $ */
+/* $Id: ds_43.h,v 1.3.20.2 2005/04/29 00:16:32 marka Exp $ */
 
-/* draft-ietf-dnsext-delegation-signer-05.txt */
 #ifndef GENERIC_DS_43_H
 #define GENERIC_DS_43_H 1
 
+/*!
+ *  \brief per draft-ietf-dnsext-delegation-signer-05.txt */
 typedef struct dns_rdata_ds {
 	dns_rdatacommon_t	common;
 	isc_mem_t		*mctx;
diff --git a/contrib/bind9/lib/dns/rdata/generic/gpos_27.c b/contrib/bind9/lib/dns/rdata/generic/gpos_27.c
index 1768f17..9b37905 100644
--- a/contrib/bind9/lib/dns/rdata/generic/gpos_27.c
+++ b/contrib/bind9/lib/dns/rdata/generic/gpos_27.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gpos_27.c,v 1.32.12.5 2004/03/08 09:04:40 marka Exp $ */
+/* $Id: gpos_27.c,v 1.37.18.2 2005/04/29 00:16:32 marka Exp $ */
 
 /* reviewed: Wed Mar 15 16:48:45 PST 2000 by brister */
 
-/* RFC 1712 */
+/* RFC1712 */
 
 #ifndef RDATA_GENERIC_GPOS_27_C
 #define RDATA_GENERIC_GPOS_27_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/gpos_27.h b/contrib/bind9/lib/dns/rdata/generic/gpos_27.h
index 6f9ed37..4949bde 100644
--- a/contrib/bind9/lib/dns/rdata/generic/gpos_27.h
+++ b/contrib/bind9/lib/dns/rdata/generic/gpos_27.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_GPOS_27_H
 #define GENERIC_GPOS_27_H 1
 
-/* $Id: gpos_27.h,v 1.12.206.1 2004/03/06 08:14:04 marka Exp $ */
+/* $Id: gpos_27.h,v 1.13.18.2 2005/04/29 00:16:32 marka Exp $ */
 
-/* RFC 1712 */
+/*!
+ *  \brief per RFC1712 */
 
 typedef struct dns_rdata_gpos {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/hinfo_13.c b/contrib/bind9/lib/dns/rdata/generic/hinfo_13.c
index e432ce5..70c433c 100644
--- a/contrib/bind9/lib/dns/rdata/generic/hinfo_13.c
+++ b/contrib/bind9/lib/dns/rdata/generic/hinfo_13.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: hinfo_13.c,v 1.37.12.5 2004/03/08 09:04:40 marka Exp $ */
+/* $Id: hinfo_13.c,v 1.42 2004/03/05 05:10:11 marka Exp $ */
 
 /*
  * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
diff --git a/contrib/bind9/lib/dns/rdata/generic/hinfo_13.h b/contrib/bind9/lib/dns/rdata/generic/hinfo_13.h
index 61cbdd7..e542c48 100644
--- a/contrib/bind9/lib/dns/rdata/generic/hinfo_13.h
+++ b/contrib/bind9/lib/dns/rdata/generic/hinfo_13.h
@@ -18,7 +18,7 @@
 #ifndef GENERIC_HINFO_13_H
 #define GENERIC_HINFO_13_H 1
 
-/* $Id: hinfo_13.h,v 1.22.206.1 2004/03/06 08:14:05 marka Exp $ */
+/* $Id: hinfo_13.h,v 1.23 2004/03/05 05:10:12 marka Exp $ */
 
 typedef struct dns_rdata_hinfo {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.c b/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.c
new file mode 100644
index 0000000..3c3736e
--- /dev/null
+++ b/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.c
@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: ipseckey_45.c,v 1.2.2.1 2005/07/07 03:17:36 marka Exp $ */
+
+#ifndef RDATA_GENERIC_IPSECKEY_45_C
+#define RDATA_GENERIC_IPSECKEY_45_C
+
+#include <string.h>
+
+#include <isc/net.h>
+
+#define RRTYPE_IPSECKEY_ATTRIBUTES (0)
+
+static inline isc_result_t
+fromtext_ipseckey(ARGS_FROMTEXT) {
+	isc_token_t token;
+	dns_name_t name;
+	isc_buffer_t buffer;
+	unsigned int gateway;
+	struct in_addr addr;
+	unsigned char addr6[16];
+	isc_region_t region;
+
+	REQUIRE(type == 45);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(callbacks);
+
+	/*
+	 * Precedence.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      ISC_FALSE));
+	if (token.value.as_ulong > 0xffU)
+		RETTOK(ISC_R_RANGE);
+	RETERR(uint8_tobuffer(token.value.as_ulong, target));
+
+	/*
+	 * Gateway type.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      ISC_FALSE));
+	if (token.value.as_ulong > 0x3U)
+		RETTOK(ISC_R_RANGE);
+	RETERR(uint8_tobuffer(token.value.as_ulong, target));
+	gateway = token.value.as_ulong;
+
+	/*
+	 * Algorithm.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      ISC_FALSE));
+	if (token.value.as_ulong > 0xffU)
+		RETTOK(ISC_R_RANGE);
+	RETERR(uint8_tobuffer(token.value.as_ulong, target));
+
+	/*
+	 * Gateway.
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
+				      ISC_FALSE));
+
+	switch (gateway) {
+	case 0:
+		if (strcmp(DNS_AS_STR(token), ".") != 0)
+			RETTOK(DNS_R_SYNTAX);
+		break;
+
+	case 1:
+		if (getquad(DNS_AS_STR(token), &addr, lexer, callbacks) != 1)
+			RETTOK(DNS_R_BADDOTTEDQUAD);
+		isc_buffer_availableregion(target, &region);
+		if (region.length < 4)
+			return (ISC_R_NOSPACE);
+		memcpy(region.base, &addr, 4);
+		isc_buffer_add(target, 4);
+		break;
+
+	case 2:
+		if (inet_pton(AF_INET6, DNS_AS_STR(token), addr6) != 1)
+			RETTOK(DNS_R_BADAAAA);
+		isc_buffer_availableregion(target, &region);
+		if (region.length < 16)
+			return (ISC_R_NOSPACE);
+		memcpy(region.base, addr6, 16);
+		isc_buffer_add(target, 16);
+		break;
+
+	case 3:
+		dns_name_init(&name, NULL);
+		buffer_fromregion(&buffer, &token.value.as_region);
+		origin = (origin != NULL) ? origin : dns_rootname;
+		RETTOK(dns_name_fromtext(&name, &buffer, origin,
+					 options, target));
+		break;
+	}
+
+	/*
+	 * Public key.
+	 */
+	return (isc_base64_tobuffer(lexer, target, -1));
+}
+
+static inline isc_result_t
+totext_ipseckey(ARGS_TOTEXT) {
+	isc_region_t region;
+	dns_name_t name;
+	dns_name_t prefix;
+	isc_boolean_t sub;
+	char buf[sizeof("255 ")];
+	unsigned short num;
+	unsigned short gateway;
+
+	REQUIRE(rdata->type == 45);
+	REQUIRE(rdata->length >= 3);
+
+	dns_name_init(&name, NULL);
+	dns_name_init(&prefix, NULL);
+	
+	if (rdata->data[1] > 3U)
+		return (ISC_R_NOTIMPLEMENTED);
+
+        if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+                RETERR(str_totext("( ", target));
+
+	/*
+	 * Precendence.
+	 */
+	dns_rdata_toregion(rdata, &region);
+	num = uint8_fromregion(&region);
+	isc_region_consume(&region, 1);
+	sprintf(buf, "%u ", num);
+	RETERR(str_totext(buf, target));
+
+	/*
+	 * Gateway type.
+	 */
+	gateway = uint8_fromregion(&region);
+	isc_region_consume(&region, 1);
+	sprintf(buf, "%u ", gateway);
+	RETERR(str_totext(buf, target));
+
+	/*
+	 * Algorithm.
+	 */
+	num = uint8_fromregion(&region);
+	isc_region_consume(&region, 1);
+	sprintf(buf, "%u ", num);
+	RETERR(str_totext(buf, target));
+
+	/*
+	 * Gateway.
+	 */
+	switch (gateway) {
+	case 0:
+		RETERR(str_totext(".", target));
+		break;
+
+	case 1:
+		RETERR(inet_totext(AF_INET, &region, target));
+		isc_region_consume(&region, 4);
+		break;
+
+	case 2:
+		RETERR(inet_totext(AF_INET6, &region, target));
+		isc_region_consume(&region, 16);
+		break;
+
+	case 3:
+		dns_name_fromregion(&name, &region);
+		sub = name_prefix(&name, tctx->origin, &prefix);
+		RETERR(dns_name_totext(&prefix, sub, target));
+		isc_region_consume(&region, name_length(&name));
+		break;
+	}
+
+	/*
+	 * Key.
+	 */
+	if (region.length > 0U) {
+		RETERR(str_totext(tctx->linebreak, target));
+		RETERR(isc_base64_totext(&region, tctx->width - 2,
+					 tctx->linebreak, target));
+	}
+
+        if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+                RETERR(str_totext(" )", target));
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+fromwire_ipseckey(ARGS_FROMWIRE) {
+        dns_name_t name;
+	isc_region_t region;
+
+	REQUIRE(type == 45);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	dns_decompress_setmethods(dctx, DNS_COMPRESS_NONE);
+
+        dns_name_init(&name, NULL);
+
+	isc_buffer_activeregion(source, &region);
+	if (region.length < 3)
+		return (ISC_R_UNEXPECTEDEND);
+
+	switch (region.base[1]) {
+	case 0:
+		isc_buffer_forward(source, region.length);
+		return (mem_tobuffer(target, region.base, region.length));
+
+	case 1:
+		if (region.length < 7)
+			return (ISC_R_UNEXPECTEDEND);
+		isc_buffer_forward(source, region.length);
+		return (mem_tobuffer(target, region.base, region.length));
+
+	case 2:
+		if (region.length < 19)
+			return (ISC_R_UNEXPECTEDEND);
+		isc_buffer_forward(source, region.length);
+		return (mem_tobuffer(target, region.base, region.length));
+
+	case 3:
+		RETERR(mem_tobuffer(target, region.base, 3));
+		isc_buffer_forward(source, 3);
+		RETERR(dns_name_fromwire(&name, source, dctx, options, target));
+		isc_buffer_activeregion(source, &region);
+		return(mem_tobuffer(target, region.base, region.length));
+
+	default:
+		return (ISC_R_NOTIMPLEMENTED);
+	}
+}
+
+static inline isc_result_t
+towire_ipseckey(ARGS_TOWIRE) {
+	isc_region_t region;
+
+	REQUIRE(rdata->type == 45);
+	REQUIRE(rdata->length != 0);
+
+	UNUSED(cctx);
+
+	dns_rdata_toregion(rdata, &region);
+	return (mem_tobuffer(target, region.base, region.length));
+}
+
+static inline int
+compare_ipseckey(ARGS_COMPARE) {
+	isc_region_t region1;
+	isc_region_t region2;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == 45);
+	REQUIRE(rdata1->length >= 3);
+	REQUIRE(rdata2->length >= 3);
+
+	dns_rdata_toregion(rdata1, &region1);
+	dns_rdata_toregion(rdata2, &region2);
+
+	return (isc_region_compare(&region1, &region2));
+}
+
+static inline isc_result_t
+fromstruct_ipseckey(ARGS_FROMSTRUCT) {
+	dns_rdata_ipseckey_t *ipseckey = source;
+	isc_region_t region;
+	isc_uint32_t n;
+
+	REQUIRE(type == 45);
+	REQUIRE(source != NULL);
+	REQUIRE(ipseckey->common.rdtype == type);
+	REQUIRE(ipseckey->common.rdclass == rdclass);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	if (ipseckey->gateway_type > 3U)
+		return (ISC_R_NOTIMPLEMENTED);
+
+	RETERR(uint8_tobuffer(ipseckey->precedence, target));
+	RETERR(uint8_tobuffer(ipseckey->gateway_type, target));
+	RETERR(uint8_tobuffer(ipseckey->algorithm, target));
+
+	switch  (ipseckey->gateway_type) {
+	case 0:
+		break;
+
+	case 1:
+		n = ntohl(ipseckey->in_addr.s_addr);
+		RETERR(uint32_tobuffer(n, target));
+		break;
+
+	case 2:
+		RETERR(mem_tobuffer(target, ipseckey->in6_addr.s6_addr, 16));
+		break;
+
+	case 3:
+		dns_name_toregion(&ipseckey->gateway, &region);
+		RETERR(isc_buffer_copyregion(target, &region));
+		break;
+	}
+
+	return (mem_tobuffer(target, ipseckey->key, ipseckey->keylength));
+}
+
+static inline isc_result_t
+tostruct_ipseckey(ARGS_TOSTRUCT) {
+	isc_region_t region;
+	dns_rdata_ipseckey_t *ipseckey = target;
+	dns_name_t name;
+	isc_uint32_t n;
+
+	REQUIRE(rdata->type == 45);
+	REQUIRE(target != NULL);
+	REQUIRE(rdata->length >= 3);
+
+	if (rdata->data[1] > 3U)
+		return (ISC_R_NOTIMPLEMENTED);
+
+	ipseckey->common.rdclass = rdata->rdclass;
+	ipseckey->common.rdtype = rdata->type;
+	ISC_LINK_INIT(&ipseckey->common, link);
+
+	dns_name_init(&name, NULL);
+	dns_rdata_toregion(rdata, &region);
+
+	ipseckey->precedence = uint8_fromregion(&region);
+	isc_region_consume(&region, 1);
+
+	ipseckey->gateway_type = uint8_fromregion(&region);
+	isc_region_consume(&region, 1);
+
+	ipseckey->algorithm = uint8_fromregion(&region);
+	isc_region_consume(&region, 1);
+
+	switch (ipseckey->gateway_type) {
+	case 0:
+		break;
+
+	case 1:
+		n = uint32_fromregion(&region);
+		ipseckey->in_addr.s_addr = htonl(n);
+		isc_region_consume(&region, 4);
+		break;
+
+	case 2:
+		memcpy(ipseckey->in6_addr.s6_addr, region.base, 16);
+		isc_region_consume(&region, 16);
+		break;
+
+	case 3:
+		dns_name_init(&ipseckey->gateway, NULL);
+		dns_name_fromregion(&name, &region);
+		RETERR(name_duporclone(&name, mctx, &ipseckey->gateway));
+		isc_region_consume(&region, name_length(&name));
+		break;
+	}
+
+	ipseckey->keylength = region.length;
+	if (ipseckey->keylength != 0U) {
+		ipseckey->key = mem_maybedup(mctx, region.base,
+					     ipseckey->keylength);
+		if (ipseckey->key == NULL) {
+			if (ipseckey->gateway_type == 3)
+				dns_name_free(&ipseckey->gateway,
+					      ipseckey->mctx);
+			return (ISC_R_NOMEMORY);
+		}
+	} else
+		ipseckey->key = NULL;
+
+	ipseckey->mctx = mctx;
+	return (ISC_R_SUCCESS);
+}
+
+static inline void
+freestruct_ipseckey(ARGS_FREESTRUCT) {
+	dns_rdata_ipseckey_t *ipseckey = source;
+
+	REQUIRE(source != NULL);
+	REQUIRE(ipseckey->common.rdtype == 45);
+
+	if (ipseckey->mctx == NULL)
+		return;
+
+	if (ipseckey->gateway_type == 3)
+		dns_name_free(&ipseckey->gateway, ipseckey->mctx);
+
+	if (ipseckey->key != NULL)
+		isc_mem_free(ipseckey->mctx, ipseckey->key);
+
+	ipseckey->mctx = NULL;
+}
+
+static inline isc_result_t
+additionaldata_ipseckey(ARGS_ADDLDATA) {
+
+	REQUIRE(rdata->type == 45);
+
+	UNUSED(rdata);
+	UNUSED(add);
+	UNUSED(arg);
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+digest_ipseckey(ARGS_DIGEST) {
+	isc_region_t region;
+
+	REQUIRE(rdata->type == 45);
+
+	dns_rdata_toregion(rdata, &region);
+	return ((digest)(arg, &region));
+}
+
+static inline isc_boolean_t
+checkowner_ipseckey(ARGS_CHECKOWNER) {
+
+	REQUIRE(type == 45);
+
+	UNUSED(name);
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(wildcard);
+
+	return (ISC_TRUE);
+}
+
+static inline isc_boolean_t
+checknames_ipseckey(ARGS_CHECKNAMES) {
+
+	REQUIRE(rdata->type == 45);
+
+	UNUSED(rdata);
+	UNUSED(owner);
+	UNUSED(bad);
+
+	return (ISC_TRUE);
+}
+
+#endif	/* RDATA_GENERIC_IPSECKEY_45_C */
diff --git a/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.h b/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.h
new file mode 100644
index 0000000..b766fa0
--- /dev/null
+++ b/contrib/bind9/lib/dns/rdata/generic/ipseckey_45.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: ipseckey_45.h,v 1.2.2.1 2005/07/07 03:17:36 marka Exp $ */
+
+#ifndef GENERIC_IPSECKEY_45_H
+#define GENERIC_IPSECKEY_45_H 1
+
+typedef struct dns_rdata_ipseckey {
+	dns_rdatacommon_t	common;
+	isc_mem_t		*mctx;
+	isc_uint8_t		precedence;
+	isc_uint8_t		gateway_type;
+	isc_uint8_t		algorithm;
+	struct in_addr		in_addr;	/* gateway type 1 */
+	struct in6_addr		in6_addr;	/* gateway type 2 */
+	dns_name_t		gateway;	/* gateway type 3 */
+	unsigned char		*key;
+	isc_uint16_t		keylength;
+} dns_rdata_ipseckey_t;
+
+#endif /* GENERIC_IPSECKEY_45_H */
diff --git a/contrib/bind9/lib/dns/rdata/generic/isdn_20.c b/contrib/bind9/lib/dns/rdata/generic/isdn_20.c
index cc14157..1813759 100644
--- a/contrib/bind9/lib/dns/rdata/generic/isdn_20.c
+++ b/contrib/bind9/lib/dns/rdata/generic/isdn_20.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: isdn_20.c,v 1.30.12.4 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: isdn_20.c,v 1.34.18.2 2005/04/29 00:16:33 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 16:53:11 PST 2000 by bwelling */
 
-/* RFC 1183 */
+/* RFC1183 */
 
 #ifndef RDATA_GENERIC_ISDN_20_C
 #define RDATA_GENERIC_ISDN_20_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/isdn_20.h b/contrib/bind9/lib/dns/rdata/generic/isdn_20.h
index 3a63971..6a51317 100644
--- a/contrib/bind9/lib/dns/rdata/generic/isdn_20.h
+++ b/contrib/bind9/lib/dns/rdata/generic/isdn_20.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_ISDN_20_H
 #define GENERIC_ISDN_20_H 1
 
-/* $Id: isdn_20.h,v 1.13.206.1 2004/03/06 08:14:05 marka Exp $ */
+/* $Id: isdn_20.h,v 1.14.18.2 2005/04/29 00:16:33 marka Exp $ */
 
-/* RFC 1183 */
+/*!
+ * \brief Per RFC1183 */
 
 typedef struct dns_rdata_isdn {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/key_25.c b/contrib/bind9/lib/dns/rdata/generic/key_25.c
index defbe6d..24dc10f 100644
--- a/contrib/bind9/lib/dns/rdata/generic/key_25.c
+++ b/contrib/bind9/lib/dns/rdata/generic/key_25.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,13 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: key_25.c,v 1.41.12.7 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: key_25.c,v 1.47.18.2 2005/04/29 00:16:33 marka Exp $ */
 
 /*
  * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
  */
 
-/* RFC 2535 */
+/* RFC2535 */
 
 #ifndef RDATA_GENERIC_KEY_25_C
 #define RDATA_GENERIC_KEY_25_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/key_25.h b/contrib/bind9/lib/dns/rdata/generic/key_25.h
index e192a1b..03400db 100644
--- a/contrib/bind9/lib/dns/rdata/generic/key_25.h
+++ b/contrib/bind9/lib/dns/rdata/generic/key_25.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_KEY_25_H
 #define GENERIC_KEY_25_H 1
 
-/* $Id: key_25.h,v 1.14.206.1 2004/03/06 08:14:06 marka Exp $ */
+/* $Id: key_25.h,v 1.15.18.2 2005/04/29 00:16:33 marka Exp $ */
 
-/* RFC 2535 */
+/*!
+ * \brief Per RFC2535 */
 
 typedef struct dns_rdata_key_t {
         dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/loc_29.c b/contrib/bind9/lib/dns/rdata/generic/loc_29.c
index 28003ab..c93ac90 100644
--- a/contrib/bind9/lib/dns/rdata/generic/loc_29.c
+++ b/contrib/bind9/lib/dns/rdata/generic/loc_29.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: loc_29.c,v 1.30.2.3.2.6 2004/03/06 08:14:06 marka Exp $ */
+/* $Id: loc_29.c,v 1.41.18.2 2005/04/29 00:16:34 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 18:13:09 PST 2000 by explorer */
 
-/* RFC 1876 */
+/* RFC1876 */
 
 #ifndef RDATA_GENERIC_LOC_29_C
 #define RDATA_GENERIC_LOC_29_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/loc_29.h b/contrib/bind9/lib/dns/rdata/generic/loc_29.h
index cdca67b..d8eae16 100644
--- a/contrib/bind9/lib/dns/rdata/generic/loc_29.h
+++ b/contrib/bind9/lib/dns/rdata/generic/loc_29.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_LOC_29_H
 #define GENERIC_LOC_29_H 1
 
-/* $Id: loc_29.h,v 1.14.206.1 2004/03/06 08:14:06 marka Exp $ */
+/* $Id: loc_29.h,v 1.15.18.2 2005/04/29 00:16:34 marka Exp $ */
 
-/* RFC 1876 */
+/*!
+ * \brief Per RFC1876 */
 
 typedef struct dns_rdata_loc_0 {
 	isc_uint8_t	version;	/* must be first and zero */
diff --git a/contrib/bind9/lib/dns/rdata/generic/mb_7.c b/contrib/bind9/lib/dns/rdata/generic/mb_7.c
index 2562707..94c622d 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mb_7.c
+++ b/contrib/bind9/lib/dns/rdata/generic/mb_7.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mb_7.c,v 1.41.206.2 2004/03/06 08:14:06 marka Exp $ */
+/* $Id: mb_7.c,v 1.43 2004/03/05 05:10:13 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 17:31:26 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/mb_7.h b/contrib/bind9/lib/dns/rdata/generic/mb_7.h
index 115ab49..f6a8b35 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mb_7.h
+++ b/contrib/bind9/lib/dns/rdata/generic/mb_7.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_MB_7_H
 #define GENERIC_MB_7_H 1
 
-/* $Id: mb_7.h,v 1.22.206.1 2004/03/06 08:14:06 marka Exp $ */
+/* $Id: mb_7.h,v 1.23.18.2 2005/04/29 00:16:34 marka Exp $ */
 
 typedef struct dns_rdata_mb {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/md_3.c b/contrib/bind9/lib/dns/rdata/generic/md_3.c
index 7488d84..75e4970 100644
--- a/contrib/bind9/lib/dns/rdata/generic/md_3.c
+++ b/contrib/bind9/lib/dns/rdata/generic/md_3.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: md_3.c,v 1.43.206.2 2004/03/06 08:14:07 marka Exp $ */
+/* $Id: md_3.c,v 1.45 2004/03/05 05:10:13 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 17:48:20 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/md_3.h b/contrib/bind9/lib/dns/rdata/generic/md_3.h
index 8662829..578ce66 100644
--- a/contrib/bind9/lib/dns/rdata/generic/md_3.h
+++ b/contrib/bind9/lib/dns/rdata/generic/md_3.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_MD_3_H
 #define GENERIC_MD_3_H 1
 
-/* $Id: md_3.h,v 1.23.206.1 2004/03/06 08:14:07 marka Exp $ */
+/* $Id: md_3.h,v 1.24.18.2 2005/04/29 00:16:35 marka Exp $ */
 
 typedef struct dns_rdata_md {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/mf_4.c b/contrib/bind9/lib/dns/rdata/generic/mf_4.c
index b6c72d9..362d300 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mf_4.c
+++ b/contrib/bind9/lib/dns/rdata/generic/mf_4.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mf_4.c,v 1.41.206.2 2004/03/06 08:14:07 marka Exp $ */
+/* $Id: mf_4.c,v 1.43 2004/03/05 05:10:14 marka Exp $ */
 
 /* reviewed: Wed Mar 15 17:47:33 PST 2000 by brister */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/mf_4.h b/contrib/bind9/lib/dns/rdata/generic/mf_4.h
index adb8254..2be0eec 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mf_4.h
+++ b/contrib/bind9/lib/dns/rdata/generic/mf_4.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_MF_4_H
 #define GENERIC_MF_4_H 1
 
-/* $Id: mf_4.h,v 1.21.206.1 2004/03/06 08:14:07 marka Exp $ */
+/* $Id: mf_4.h,v 1.22.18.2 2005/04/29 00:16:35 marka Exp $ */
 
 typedef struct dns_rdata_mf {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/mg_8.c b/contrib/bind9/lib/dns/rdata/generic/mg_8.c
index 26eac8dd..602d820 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mg_8.c
+++ b/contrib/bind9/lib/dns/rdata/generic/mg_8.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mg_8.c,v 1.39.206.2 2004/03/06 08:14:07 marka Exp $ */
+/* $Id: mg_8.c,v 1.41 2004/03/05 05:10:14 marka Exp $ */
 
 /* reviewed: Wed Mar 15 17:49:21 PST 2000 by brister */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/mg_8.h b/contrib/bind9/lib/dns/rdata/generic/mg_8.h
index b45c2bf..5679c17 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mg_8.h
+++ b/contrib/bind9/lib/dns/rdata/generic/mg_8.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_MG_8_H
 #define GENERIC_MG_8_H 1
 
-/* $Id: mg_8.h,v 1.21.206.1 2004/03/06 08:14:07 marka Exp $ */
+/* $Id: mg_8.h,v 1.22.18.2 2005/04/29 00:16:35 marka Exp $ */
 
 typedef struct dns_rdata_mg {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/minfo_14.c b/contrib/bind9/lib/dns/rdata/generic/minfo_14.c
index a3c4a9c..b757480 100644
--- a/contrib/bind9/lib/dns/rdata/generic/minfo_14.c
+++ b/contrib/bind9/lib/dns/rdata/generic/minfo_14.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: minfo_14.c,v 1.40.12.4 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: minfo_14.c,v 1.43 2004/03/05 05:10:14 marka Exp $ */
 
 /* reviewed: Wed Mar 15 17:45:32 PST 2000 by brister */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/minfo_14.h b/contrib/bind9/lib/dns/rdata/generic/minfo_14.h
index 84078b9..754fe20 100644
--- a/contrib/bind9/lib/dns/rdata/generic/minfo_14.h
+++ b/contrib/bind9/lib/dns/rdata/generic/minfo_14.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_MINFO_14_H
 #define GENERIC_MINFO_14_H 1
 
-/* $Id: minfo_14.h,v 1.22.206.1 2004/03/06 08:14:08 marka Exp $ */
+/* $Id: minfo_14.h,v 1.23.18.2 2005/04/29 00:16:35 marka Exp $ */
 
 typedef struct dns_rdata_minfo {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/mr_9.c b/contrib/bind9/lib/dns/rdata/generic/mr_9.c
index 30da6cb..ab4c6e0 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mr_9.c
+++ b/contrib/bind9/lib/dns/rdata/generic/mr_9.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mr_9.c,v 1.38.206.2 2004/03/06 08:14:08 marka Exp $ */
+/* $Id: mr_9.c,v 1.40 2004/03/05 05:10:15 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 21:30:35 EST 2000 by tale */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/mr_9.h b/contrib/bind9/lib/dns/rdata/generic/mr_9.h
index ba6e154..e255d70 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mr_9.h
+++ b/contrib/bind9/lib/dns/rdata/generic/mr_9.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_MR_9_H
 #define GENERIC_MR_9_H 1
 
-/* $Id: mr_9.h,v 1.21.206.1 2004/03/06 08:14:08 marka Exp $ */
+/* $Id: mr_9.h,v 1.22.18.2 2005/04/29 00:16:36 marka Exp $ */
 
 typedef struct dns_rdata_mr {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/mx_15.c b/contrib/bind9/lib/dns/rdata/generic/mx_15.c
index 794249c..fd77ec8 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mx_15.c
+++ b/contrib/bind9/lib/dns/rdata/generic/mx_15.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,15 +15,37 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mx_15.c,v 1.48.2.1.2.3 2004/03/06 08:14:08 marka Exp $ */
+/* $Id: mx_15.c,v 1.52.18.2 2005/05/20 01:10:11 marka Exp $ */
 
 /* reviewed: Wed Mar 15 18:05:46 PST 2000 by brister */
 
 #ifndef RDATA_GENERIC_MX_15_C
 #define RDATA_GENERIC_MX_15_C
 
+#include <string.h>
+
+#include <isc/net.h>
+
 #define RRTYPE_MX_ATTRIBUTES (0)
 
+static isc_boolean_t
+check_mx(isc_token_t *token) {
+	char tmp[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123.")];
+	struct in_addr addr;
+	struct in6_addr addr6;
+
+	if (strlcpy(tmp, DNS_AS_STR(*token), sizeof(tmp)) >= sizeof(tmp))
+		return (ISC_TRUE);
+
+	if (tmp[strlen(tmp) - 1] == '.')
+		tmp[strlen(tmp) - 1] = '\0';
+	if (inet_aton(tmp, &addr) == 1 ||
+	    inet_pton(AF_INET6, tmp, &addr6) == 1)
+		return (ISC_FALSE);
+
+	return (ISC_TRUE);
+}
+
 static inline isc_result_t
 fromtext_mx(ARGS_FROMTEXT) {
 	isc_token_t token;
@@ -45,6 +67,15 @@ fromtext_mx(ARGS_FROMTEXT) {
 
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      ISC_FALSE));
+
+	ok = ISC_TRUE;
+	if ((options & DNS_RDATA_CHECKMX) != 0)
+		ok = check_mx(&token);
+	if (!ok && (options & DNS_RDATA_CHECKMXFAIL) != 0)
+		RETTOK(DNS_R_MXISADDRESS);
+	if (!ok && callbacks != NULL)
+		warn_badmx(&token, lexer, callbacks);
+
 	dns_name_init(&name, NULL);
 	buffer_fromregion(&buffer, &token.value.as_region);
 	origin = (origin != NULL) ? origin : dns_rootname;
diff --git a/contrib/bind9/lib/dns/rdata/generic/mx_15.h b/contrib/bind9/lib/dns/rdata/generic/mx_15.h
index 01225fa..4d81b90 100644
--- a/contrib/bind9/lib/dns/rdata/generic/mx_15.h
+++ b/contrib/bind9/lib/dns/rdata/generic/mx_15.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_MX_15_H
 #define GENERIC_MX_15_H 1
 
-/* $Id: mx_15.h,v 1.24.206.1 2004/03/06 08:14:09 marka Exp $ */
+/* $Id: mx_15.h,v 1.25.18.2 2005/04/29 00:16:36 marka Exp $ */
 
 typedef struct dns_rdata_mx {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/ns_2.c b/contrib/bind9/lib/dns/rdata/generic/ns_2.c
index bf32d63..2379433 100644
--- a/contrib/bind9/lib/dns/rdata/generic/ns_2.c
+++ b/contrib/bind9/lib/dns/rdata/generic/ns_2.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ns_2.c,v 1.42.206.2 2004/03/06 08:14:09 marka Exp $ */
+/* $Id: ns_2.c,v 1.44 2004/03/05 05:10:15 marka Exp $ */
 
 /* Reviewed: Wed Mar 15 18:15:00 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/ns_2.h b/contrib/bind9/lib/dns/rdata/generic/ns_2.h
index 2bef1f8..ec8e771 100644
--- a/contrib/bind9/lib/dns/rdata/generic/ns_2.h
+++ b/contrib/bind9/lib/dns/rdata/generic/ns_2.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_NS_2_H
 #define GENERIC_NS_2_H 1
 
-/* $Id: ns_2.h,v 1.22.206.1 2004/03/06 08:14:09 marka Exp $ */
+/* $Id: ns_2.h,v 1.23.18.2 2005/04/29 00:16:37 marka Exp $ */
 
 typedef struct dns_rdata_ns {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/nsec_47.c b/contrib/bind9/lib/dns/rdata/generic/nsec_47.c
index 74b7806..f3e56ca 100644
--- a/contrib/bind9/lib/dns/rdata/generic/nsec_47.c
+++ b/contrib/bind9/lib/dns/rdata/generic/nsec_47.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec_47.c,v 1.7.2.1 2004/03/08 02:08:03 marka Exp $ */
+/* $Id: nsec_47.c,v 1.7 2004/03/05 05:10:15 marka Exp $ */
 
 /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/nsec_47.h b/contrib/bind9/lib/dns/rdata/generic/nsec_47.h
index d76a25c..ff03483 100644
--- a/contrib/bind9/lib/dns/rdata/generic/nsec_47.h
+++ b/contrib/bind9/lib/dns/rdata/generic/nsec_47.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_NSEC_47_H
 #define GENERIC_NSEC_47_H 1
 
-/* $Id: nsec_47.h,v 1.4.2.1 2004/03/08 02:08:03 marka Exp $ */
+/* $Id: nsec_47.h,v 1.4.20.2 2005/04/29 00:16:37 marka Exp $ */
 
-/* draft-ietf-dnsext-nsec-rdata-01.txt */
+/*!
+ * \brief Per draft-ietf-dnsext-nsec-rdata-01.txt */
 
 typedef struct dns_rdata_nsec {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/null_10.c b/contrib/bind9/lib/dns/rdata/generic/null_10.c
index 492044d..a6f8f9f4 100644
--- a/contrib/bind9/lib/dns/rdata/generic/null_10.c
+++ b/contrib/bind9/lib/dns/rdata/generic/null_10.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: null_10.c,v 1.35.2.1.10.4 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: null_10.c,v 1.40 2004/03/05 05:10:16 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 13:57:50 PST 2000 by explorer */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/null_10.h b/contrib/bind9/lib/dns/rdata/generic/null_10.h
index 44a9e8f..5afb1ae 100644
--- a/contrib/bind9/lib/dns/rdata/generic/null_10.h
+++ b/contrib/bind9/lib/dns/rdata/generic/null_10.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_NULL_10_H
 #define GENERIC_NULL_10_H 1
 
-/* $Id: null_10.h,v 1.20.206.1 2004/03/06 08:14:09 marka Exp $ */
+/* $Id: null_10.h,v 1.21.18.2 2005/04/29 00:16:37 marka Exp $ */
 
 typedef struct dns_rdata_null {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/nxt_30.c b/contrib/bind9/lib/dns/rdata/generic/nxt_30.c
index e4dba7f..b7358e0 100644
--- a/contrib/bind9/lib/dns/rdata/generic/nxt_30.c
+++ b/contrib/bind9/lib/dns/rdata/generic/nxt_30.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nxt_30.c,v 1.49.2.2.2.9 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: nxt_30.c,v 1.59.18.2 2005/04/29 00:16:38 marka Exp $ */
 
 /* reviewed: Wed Mar 15 18:21:15 PST 2000 by brister */
 
-/* RFC 2535 */
+/* RFC2535 */
 
 #ifndef RDATA_GENERIC_NXT_30_C
 #define RDATA_GENERIC_NXT_30_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/nxt_30.h b/contrib/bind9/lib/dns/rdata/generic/nxt_30.h
index 540135f..3700fb1 100644
--- a/contrib/bind9/lib/dns/rdata/generic/nxt_30.h
+++ b/contrib/bind9/lib/dns/rdata/generic/nxt_30.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_NXT_30_H
 #define GENERIC_NXT_30_H 1
 
-/* $Id: nxt_30.h,v 1.18.12.3 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: nxt_30.h,v 1.21.18.2 2005/04/29 00:16:38 marka Exp $ */
 
-/* RFC 2535 */
+/*!
+ *  \brief RFC2535 */
 
 typedef struct dns_rdata_nxt {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/opt_41.c b/contrib/bind9/lib/dns/rdata/generic/opt_41.c
index ac74a28..e8f4816 100644
--- a/contrib/bind9/lib/dns/rdata/generic/opt_41.c
+++ b/contrib/bind9/lib/dns/rdata/generic/opt_41.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: opt_41.c,v 1.25.12.4 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: opt_41.c,v 1.29.18.2 2005/04/29 00:16:38 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 14:06:44 PST 2000 by gson */
 
-/* RFC 2671 */
+/* RFC2671 */
 
 #ifndef RDATA_GENERIC_OPT_41_C
 #define RDATA_GENERIC_OPT_41_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/opt_41.h b/contrib/bind9/lib/dns/rdata/generic/opt_41.h
index c70ad90..827936e 100644
--- a/contrib/bind9/lib/dns/rdata/generic/opt_41.h
+++ b/contrib/bind9/lib/dns/rdata/generic/opt_41.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_OPT_41_H
 #define GENERIC_OPT_41_H 1
 
-/* $Id: opt_41.h,v 1.13.206.1 2004/03/06 08:14:10 marka Exp $ */
+/* $Id: opt_41.h,v 1.14.18.2 2005/04/29 00:16:38 marka Exp $ */
 
-/* RFC 2671 */
+/*!
+ *  \brief Per RFC2671 */
 
 typedef struct dns_rdata_opt_opcode {
 		isc_uint16_t	opcode;
diff --git a/contrib/bind9/lib/dns/rdata/generic/proforma.c b/contrib/bind9/lib/dns/rdata/generic/proforma.c
index 21c6577..bf8b2fd 100644
--- a/contrib/bind9/lib/dns/rdata/generic/proforma.c
+++ b/contrib/bind9/lib/dns/rdata/generic/proforma.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: proforma.c,v 1.30.12.4 2004/03/08 09:04:41 marka Exp $ */
+/* $Id: proforma.c,v 1.34 2004/03/05 05:10:17 marka Exp $ */
 
 #ifndef RDATA_GENERIC_#_#_C
 #define RDATA_GENERIC_#_#_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/proforma.h b/contrib/bind9/lib/dns/rdata/generic/proforma.h
index 5d5090e..89d1606 100644
--- a/contrib/bind9/lib/dns/rdata/generic/proforma.h
+++ b/contrib/bind9/lib/dns/rdata/generic/proforma.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_PROFORMA_H
 #define GENERIC_PROFORMA_H 1
 
-/* $Id: proforma.h,v 1.18.206.1 2004/03/06 08:14:11 marka Exp $ */
+/* $Id: proforma.h,v 1.19.18.2 2005/04/29 00:16:39 marka Exp $ */
 
 typedef struct dns_rdata_# {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/ptr_12.c b/contrib/bind9/lib/dns/rdata/generic/ptr_12.c
index 9be93b3..16d5706 100644
--- a/contrib/bind9/lib/dns/rdata/generic/ptr_12.c
+++ b/contrib/bind9/lib/dns/rdata/generic/ptr_12.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ptr_12.c,v 1.39.206.2 2004/03/06 08:14:11 marka Exp $ */
+/* $Id: ptr_12.c,v 1.41 2004/03/05 05:10:17 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 14:05:12 PST 2000 by explorer */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/ptr_12.h b/contrib/bind9/lib/dns/rdata/generic/ptr_12.h
index 53e7920..4eb8fa7 100644
--- a/contrib/bind9/lib/dns/rdata/generic/ptr_12.h
+++ b/contrib/bind9/lib/dns/rdata/generic/ptr_12.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_PTR_12_H
 #define GENERIC_PTR_12_H 1
 
-/* $Id: ptr_12.h,v 1.22.206.1 2004/03/06 08:14:11 marka Exp $ */
+/* $Id: ptr_12.h,v 1.23.18.2 2005/04/29 00:16:39 marka Exp $ */
 
 typedef struct dns_rdata_ptr {
         dns_rdatacommon_t       common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/rp_17.c b/contrib/bind9/lib/dns/rdata/generic/rp_17.c
index 27e02ee..b153643 100644
--- a/contrib/bind9/lib/dns/rdata/generic/rp_17.c
+++ b/contrib/bind9/lib/dns/rdata/generic/rp_17.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rp_17.c,v 1.35.12.4 2004/03/08 09:04:42 marka Exp $ */
+/* $Id: rp_17.c,v 1.38.18.2 2005/04/29 00:16:39 marka Exp $ */
 
-/* RFC 1183 */
+/* RFC1183 */
 
 #ifndef RDATA_GENERIC_RP_17_C
 #define RDATA_GENERIC_RP_17_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/rp_17.h b/contrib/bind9/lib/dns/rdata/generic/rp_17.h
index a88b9c0..533c7e7 100644
--- a/contrib/bind9/lib/dns/rdata/generic/rp_17.h
+++ b/contrib/bind9/lib/dns/rdata/generic/rp_17.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_RP_17_H
 #define GENERIC_RP_17_H 1
 
-/* $Id: rp_17.h,v 1.16.206.1 2004/03/06 08:14:11 marka Exp $ */
+/* $Id: rp_17.h,v 1.17.18.2 2005/04/29 00:16:39 marka Exp $ */
 
-/* RFC 1183 */
+/*!
+ *  \brief Per RFC1183 */
 
 typedef struct dns_rdata_rp {
         dns_rdatacommon_t       common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c b/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c
index ad43295..6561f28 100644
--- a/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c
+++ b/contrib/bind9/lib/dns/rdata/generic/rrsig_46.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rrsig_46.c,v 1.4.2.3 2004/06/24 00:58:06 marka Exp $ */
+/* $Id: rrsig_46.c,v 1.5.18.3 2005/04/29 00:16:39 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
 
-/* RFC 2535 */
+/* RFC2535 */
 
 #ifndef RDATA_GENERIC_RRSIG_46_C
 #define RDATA_GENERIC_RRSIG_46_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/rrsig_46.h b/contrib/bind9/lib/dns/rdata/generic/rrsig_46.h
index 148604b..b8b35a2 100644
--- a/contrib/bind9/lib/dns/rdata/generic/rrsig_46.h
+++ b/contrib/bind9/lib/dns/rdata/generic/rrsig_46.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_DNSSIG_46_H
 #define GENERIC_DNSSIG_46_H 1
 
-/* $Id: rrsig_46.h,v 1.3.2.1 2004/03/08 02:08:04 marka Exp $ */
+/* $Id: rrsig_46.h,v 1.3.20.2 2005/04/29 00:16:39 marka Exp $ */
 
-/* RFC 2535 */
+/*!
+ *  \brief Per RFC2535 */
 typedef struct dns_rdata_rrsig {
 	dns_rdatacommon_t	common;
 	isc_mem_t *		mctx;
diff --git a/contrib/bind9/lib/dns/rdata/generic/rt_21.c b/contrib/bind9/lib/dns/rdata/generic/rt_21.c
index daf9756..6977e98 100644
--- a/contrib/bind9/lib/dns/rdata/generic/rt_21.c
+++ b/contrib/bind9/lib/dns/rdata/generic/rt_21.c
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rt_21.c,v 1.37.2.1.2.5 2005/03/17 03:58:31 marka Exp $ */
+/* $Id: rt_21.c,v 1.41.18.3 2005/04/27 05:01:52 sra Exp $ */
 
 /* reviewed: Thu Mar 16 15:02:31 PST 2000 by brister */
 
-/* RFC 1183 */
+/* RFC1183 */
 
 #ifndef RDATA_GENERIC_RT_21_C
 #define RDATA_GENERIC_RT_21_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/rt_21.h b/contrib/bind9/lib/dns/rdata/generic/rt_21.h
index 32b0352..b8ec969 100644
--- a/contrib/bind9/lib/dns/rdata/generic/rt_21.h
+++ b/contrib/bind9/lib/dns/rdata/generic/rt_21.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_RT_21_H
 #define GENERIC_RT_21_H 1
 
-/* $Id: rt_21.h,v 1.16.206.1 2004/03/06 08:14:12 marka Exp $ */
+/* $Id: rt_21.h,v 1.17.18.2 2005/04/29 00:16:40 marka Exp $ */
 
-/* RFC 1183 */
+/*!
+ *  \brief Per RFC1183 */
 
 typedef struct dns_rdata_rt {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/sig_24.c b/contrib/bind9/lib/dns/rdata/generic/sig_24.c
index 39cb064..9842953 100644
--- a/contrib/bind9/lib/dns/rdata/generic/sig_24.c
+++ b/contrib/bind9/lib/dns/rdata/generic/sig_24.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sig_24.c,v 1.54.2.1.2.7 2004/03/08 09:04:42 marka Exp $ */
+/* $Id: sig_24.c,v 1.62.18.2 2005/04/29 00:16:40 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
 
-/* RFC 2535 */
+/* RFC2535 */
 
 #ifndef RDATA_GENERIC_SIG_24_C
 #define RDATA_GENERIC_SIG_24_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/sig_24.h b/contrib/bind9/lib/dns/rdata/generic/sig_24.h
index 28bcac2..96ed767 100644
--- a/contrib/bind9/lib/dns/rdata/generic/sig_24.h
+++ b/contrib/bind9/lib/dns/rdata/generic/sig_24.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_SIG_24_H
 #define GENERIC_SIG_24_H 1
 
-/* $Id: sig_24.h,v 1.21.206.1 2004/03/06 08:14:12 marka Exp $ */
+/* $Id: sig_24.h,v 1.22.18.2 2005/04/29 00:16:40 marka Exp $ */
 
-/* RFC 2535 */
+/*!
+ *  \brief Per RFC2535 */
 
 typedef struct dns_rdata_sig_t {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/soa_6.c b/contrib/bind9/lib/dns/rdata/generic/soa_6.c
index 7eeb36e..8de678c 100644
--- a/contrib/bind9/lib/dns/rdata/generic/soa_6.c
+++ b/contrib/bind9/lib/dns/rdata/generic/soa_6.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: soa_6.c,v 1.53.12.6 2004/03/08 09:04:42 marka Exp $ */
+/* $Id: soa_6.c,v 1.59 2004/03/05 05:10:18 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 15:18:32 PST 2000 by explorer */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/soa_6.h b/contrib/bind9/lib/dns/rdata/generic/soa_6.h
index eca6dfd..4211786 100644
--- a/contrib/bind9/lib/dns/rdata/generic/soa_6.h
+++ b/contrib/bind9/lib/dns/rdata/generic/soa_6.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,21 +15,22 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_SOA_6_H
 #define GENERIC_SOA_6_H 1
 
-/* $Id: soa_6.h,v 1.27.206.1 2004/03/06 08:14:12 marka Exp $ */
+/* $Id: soa_6.h,v 1.28.18.2 2005/04/29 00:16:40 marka Exp $ */
 
 typedef struct dns_rdata_soa {
 	dns_rdatacommon_t	common;
 	isc_mem_t		*mctx;
 	dns_name_t		origin;
 	dns_name_t		contact;
-	isc_uint32_t		serial;		/* host order */
-	isc_uint32_t		refresh;	/* host order */
-	isc_uint32_t		retry;		/* host order */
-	isc_uint32_t		expire;		/* host order */
-	isc_uint32_t		minimum;	/* host order */
+	isc_uint32_t		serial;		/*%< host order */
+	isc_uint32_t		refresh;	/*%< host order */
+	isc_uint32_t		retry;		/*%< host order */
+	isc_uint32_t		expire;		/*%< host order */
+	isc_uint32_t		minimum;	/*%< host order */
 } dns_rdata_soa_t;
 
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/spf_99.c b/contrib/bind9/lib/dns/rdata/generic/spf_99.c
new file mode 100644
index 0000000..b65f580
--- /dev/null
+++ b/contrib/bind9/lib/dns/rdata/generic/spf_99.c
@@ -0,0 +1,238 @@
+/*
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1998-2002  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: spf_99.c,v 1.1.2.2 2005/07/16 00:40:54 marka Exp $ */
+
+/* Reviewed: Thu Mar 16 15:40:00 PST 2000 by bwelling */
+
+#ifndef RDATA_GENERIC_SPF_99_C
+#define RDATA_GENERIC_SPF_99_C
+
+#define RRTYPE_SPF_ATTRIBUTES (0)
+
+static inline isc_result_t
+fromtext_spf(ARGS_FROMTEXT) {
+	isc_token_t token;
+	int strings;
+
+	REQUIRE(type == 99);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(origin);
+	UNUSED(options);
+	UNUSED(callbacks);
+
+	strings = 0;
+	for (;;) {
+		RETERR(isc_lex_getmastertoken(lexer, &token,
+					      isc_tokentype_qstring,
+					      ISC_TRUE));
+		if (token.type != isc_tokentype_qstring &&
+		    token.type != isc_tokentype_string)
+			break;
+		RETTOK(txt_fromtext(&token.value.as_textregion, target));
+		strings++;
+	}
+	/* Let upper layer handle eol/eof. */
+	isc_lex_ungettoken(lexer, &token);
+	return (strings == 0 ? ISC_R_UNEXPECTEDEND : ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+totext_spf(ARGS_TOTEXT) {
+	isc_region_t region;
+
+	UNUSED(tctx);
+
+	REQUIRE(rdata->type == 99);
+
+	dns_rdata_toregion(rdata, &region);
+
+	while (region.length > 0) {
+		RETERR(txt_totext(&region, target));
+		if (region.length > 0)
+			RETERR(str_totext(" ", target));
+	}
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+fromwire_spf(ARGS_FROMWIRE) {
+	isc_result_t result;
+
+	REQUIRE(type == 99);
+
+	UNUSED(type);
+	UNUSED(dctx);
+	UNUSED(rdclass);
+	UNUSED(options);
+
+	do {
+		result = txt_fromwire(source, target);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	} while (!buffer_empty(source));
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+towire_spf(ARGS_TOWIRE) {
+	isc_region_t region;
+
+	REQUIRE(rdata->type == 99);
+
+	UNUSED(cctx);
+
+	isc_buffer_availableregion(target, &region);
+	if (region.length < rdata->length)
+		return (ISC_R_NOSPACE);
+
+	memcpy(region.base, rdata->data, rdata->length);
+	isc_buffer_add(target, rdata->length);
+	return (ISC_R_SUCCESS);
+}
+
+static inline int
+compare_spf(ARGS_COMPARE) {
+	isc_region_t r1;
+	isc_region_t r2;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == 99);
+
+	dns_rdata_toregion(rdata1, &r1);
+	dns_rdata_toregion(rdata2, &r2);
+	return (isc_region_compare(&r1, &r2));
+}
+
+static inline isc_result_t
+fromstruct_spf(ARGS_FROMSTRUCT) {
+	dns_rdata_spf_t *txt = source;
+	isc_region_t region;
+	isc_uint8_t length;
+
+	REQUIRE(type == 99);
+	REQUIRE(source != NULL);
+	REQUIRE(txt->common.rdtype == type);
+	REQUIRE(txt->common.rdclass == rdclass);
+	REQUIRE(txt->txt != NULL && txt->txt_len != 0);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	region.base = txt->txt;
+	region.length = txt->txt_len;
+	while (region.length > 0) {
+		length = uint8_fromregion(&region);
+		isc_region_consume(&region, 1);
+		if (region.length <= length)
+			return (ISC_R_UNEXPECTEDEND);
+		isc_region_consume(&region, length);
+	}
+
+	return (mem_tobuffer(target, txt->txt, txt->txt_len));
+}
+
+static inline isc_result_t
+tostruct_spf(ARGS_TOSTRUCT) {
+	dns_rdata_spf_t *txt = target;
+	isc_region_t r;
+
+	REQUIRE(rdata->type == 99);
+	REQUIRE(target != NULL);
+
+	txt->common.rdclass = rdata->rdclass;
+	txt->common.rdtype = rdata->type;
+	ISC_LINK_INIT(&txt->common, link);
+
+	dns_rdata_toregion(rdata, &r);
+	txt->txt_len = r.length;
+	txt->txt = mem_maybedup(mctx, r.base, r.length);
+	if (txt->txt == NULL)
+		return (ISC_R_NOMEMORY);
+
+	txt->offset = 0;
+	txt->mctx = mctx;
+	return (ISC_R_SUCCESS);
+}
+
+static inline void
+freestruct_spf(ARGS_FREESTRUCT) {
+	dns_rdata_spf_t *txt = source;
+
+	REQUIRE(source != NULL);
+	REQUIRE(txt->common.rdtype == 99);
+
+	if (txt->mctx == NULL)
+		return;
+
+	if (txt->txt != NULL)
+		isc_mem_free(txt->mctx, txt->txt);
+	txt->mctx = NULL;
+}
+
+static inline isc_result_t
+additionaldata_spf(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == 99);
+
+	UNUSED(rdata);
+	UNUSED(add);
+	UNUSED(arg);
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+digest_spf(ARGS_DIGEST) {
+	isc_region_t r;
+
+	REQUIRE(rdata->type == 99);
+
+	dns_rdata_toregion(rdata, &r);
+
+	return ((digest)(arg, &r));
+}
+
+static inline isc_boolean_t
+checkowner_spf(ARGS_CHECKOWNER) {
+
+	REQUIRE(type == 99);
+
+	UNUSED(name);
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(wildcard);
+
+	return (ISC_TRUE);
+}
+
+static inline isc_boolean_t
+checknames_spf(ARGS_CHECKNAMES) {
+
+	REQUIRE(rdata->type == 99);
+
+	UNUSED(rdata);
+	UNUSED(owner);
+	UNUSED(bad);
+
+	return (ISC_TRUE);
+}
+
+#endif	/* RDATA_GENERIC_SPF_99_C */
diff --git a/contrib/bind9/lib/dns/rdata/generic/spf_99.h b/contrib/bind9/lib/dns/rdata/generic/spf_99.h
new file mode 100644
index 0000000..afe77ec
--- /dev/null
+++ b/contrib/bind9/lib/dns/rdata/generic/spf_99.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1998-2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef GENERIC_SPF_99_H
+#define GENERIC_SPF_99_H 1
+
+/* $Id: spf_99.h,v 1.1.2.2 2005/07/16 00:40:54 marka Exp $ */
+
+typedef struct dns_rdata_spf_string {
+                isc_uint8_t    length;
+                unsigned char   *data;
+} dns_rdata_spf_string_t;
+
+typedef struct dns_rdata_spf {
+        dns_rdatacommon_t       common;
+        isc_mem_t               *mctx;
+        unsigned char           *txt;
+        isc_uint16_t            txt_len;
+        /* private */
+        isc_uint16_t            offset;
+} dns_rdata_spf_t;
+
+/*
+ * ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS are already done
+ * via rdatastructpre.h and rdatastructsuf.h.
+ */
+
+isc_result_t
+dns_rdata_spf_first(dns_rdata_spf_t *);
+
+isc_result_t
+dns_rdata_spf_next(dns_rdata_spf_t *);
+
+isc_result_t
+dns_rdata_spf_current(dns_rdata_spf_t *, dns_rdata_spf_string_t *);
+
+#endif /* GENERIC_SPF_99_H */
diff --git a/contrib/bind9/lib/dns/rdata/generic/sshfp_44.c b/contrib/bind9/lib/dns/rdata/generic/sshfp_44.c
index eabf056..64b51c7 100644
--- a/contrib/bind9/lib/dns/rdata/generic/sshfp_44.c
+++ b/contrib/bind9/lib/dns/rdata/generic/sshfp_44.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sshfp_44.c,v 1.1.8.3 2004/03/06 08:14:13 marka Exp $ */
+/* $Id: sshfp_44.c,v 1.3.18.1 2006/03/10 04:04:32 marka Exp $ */
 
-/* draft-ietf-secsh-dns-05.txt */
+/* RFC 4255 */
 
 #ifndef RDATA_GENERIC_SSHFP_44_C
 #define RDATA_GENERIC_SSHFP_44_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/sshfp_44.h b/contrib/bind9/lib/dns/rdata/generic/sshfp_44.h
index ccdefd4..513eeac 100644
--- a/contrib/bind9/lib/dns/rdata/generic/sshfp_44.h
+++ b/contrib/bind9/lib/dns/rdata/generic/sshfp_44.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sshfp_44.h,v 1.1.8.2 2004/03/06 08:14:13 marka Exp $ */
+/* $Id: sshfp_44.h,v 1.2.18.3 2006/03/10 04:04:32 marka Exp $ */
 
-/* draft-ietf-secsh-dns-05.txt */
+/*!
+ *  \brief Per RFC 4255 */
 
 #ifndef GENERIC_SSHFP_44_H
 #define GENERIC_SSHFP_44_H 1
diff --git a/contrib/bind9/lib/dns/rdata/generic/tkey_249.c b/contrib/bind9/lib/dns/rdata/generic/tkey_249.c
index da63167..cee16ab 100644
--- a/contrib/bind9/lib/dns/rdata/generic/tkey_249.c
+++ b/contrib/bind9/lib/dns/rdata/generic/tkey_249.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tkey_249.c,v 1.48.2.1.2.6 2004/03/08 09:04:42 marka Exp $ */
+/* $Id: tkey_249.c,v 1.55 2004/03/05 05:10:18 marka Exp $ */
 
 /*
  * Reviewed: Thu Mar 16 17:35:30 PST 2000 by halley.
diff --git a/contrib/bind9/lib/dns/rdata/generic/tkey_249.h b/contrib/bind9/lib/dns/rdata/generic/tkey_249.h
index 8e0081c..c1d2f06 100644
--- a/contrib/bind9/lib/dns/rdata/generic/tkey_249.h
+++ b/contrib/bind9/lib/dns/rdata/generic/tkey_249.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_TKEY_249_H
 #define GENERIC_TKEY_249_H 1
 
-/* $Id: tkey_249.h,v 1.18.206.2 2004/03/06 08:14:13 marka Exp $ */
+/* $Id: tkey_249.h,v 1.20.18.2 2005/04/29 00:16:40 marka Exp $ */
 
-/* draft-ietf-dnsind-tkey-00.txt */
+/*!
+ *  \brief Per draft-ietf-dnsind-tkey-00.txt */
 
 typedef struct dns_rdata_tkey {
         dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/txt_16.c b/contrib/bind9/lib/dns/rdata/generic/txt_16.c
index 631d7af..fa3ffef 100644
--- a/contrib/bind9/lib/dns/rdata/generic/txt_16.c
+++ b/contrib/bind9/lib/dns/rdata/generic/txt_16.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: txt_16.c,v 1.37.12.4 2004/03/08 09:04:42 marka Exp $ */
+/* $Id: txt_16.c,v 1.41 2004/03/05 05:10:18 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 15:40:00 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/generic/txt_16.h b/contrib/bind9/lib/dns/rdata/generic/txt_16.h
index db5019c..57d986a 100644
--- a/contrib/bind9/lib/dns/rdata/generic/txt_16.h
+++ b/contrib/bind9/lib/dns/rdata/generic/txt_16.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_TXT_16_H
 #define GENERIC_TXT_16_H 1
 
-/* $Id: txt_16.h,v 1.23.206.1 2004/03/06 08:14:14 marka Exp $ */
+/* $Id: txt_16.h,v 1.24.18.2 2005/04/29 00:16:40 marka Exp $ */
 
 typedef struct dns_rdata_txt_string {
                 isc_uint8_t    length;
diff --git a/contrib/bind9/lib/dns/rdata/generic/unspec_103.c b/contrib/bind9/lib/dns/rdata/generic/unspec_103.c
index 157e9a1..f316ad9 100644
--- a/contrib/bind9/lib/dns/rdata/generic/unspec_103.c
+++ b/contrib/bind9/lib/dns/rdata/generic/unspec_103.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: unspec_103.c,v 1.28.2.1.10.4 2004/03/08 09:04:43 marka Exp $ */
+/* $Id: unspec_103.c,v 1.33 2004/03/05 05:10:18 marka Exp $ */
 
 #ifndef RDATA_GENERIC_UNSPEC_103_C
 #define RDATA_GENERIC_UNSPEC_103_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/unspec_103.h b/contrib/bind9/lib/dns/rdata/generic/unspec_103.h
index 021e308..6575c1a 100644
--- a/contrib/bind9/lib/dns/rdata/generic/unspec_103.h
+++ b/contrib/bind9/lib/dns/rdata/generic/unspec_103.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef GENERIC_UNSPEC_103_H
 #define GENERIC_UNSPEC_103_H 1
 
-/* $Id: unspec_103.h,v 1.12.206.1 2004/03/06 08:14:14 marka Exp $ */
+/* $Id: unspec_103.h,v 1.13.18.2 2005/04/29 00:16:40 marka Exp $ */
 
 typedef struct dns_rdata_unspec_t {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/generic/x25_19.c b/contrib/bind9/lib/dns/rdata/generic/x25_19.c
index 2f123ad..1199195 100644
--- a/contrib/bind9/lib/dns/rdata/generic/x25_19.c
+++ b/contrib/bind9/lib/dns/rdata/generic/x25_19.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: x25_19.c,v 1.31.12.4 2004/03/08 09:04:43 marka Exp $ */
+/* $Id: x25_19.c,v 1.35.18.2 2005/04/29 00:16:40 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 16:15:57 PST 2000 by bwelling */
 
-/* RFC 1183 */
+/* RFC1183 */
 
 #ifndef RDATA_GENERIC_X25_19_C
 #define RDATA_GENERIC_X25_19_C
diff --git a/contrib/bind9/lib/dns/rdata/generic/x25_19.h b/contrib/bind9/lib/dns/rdata/generic/x25_19.h
index bcb74cf..32320d0 100644
--- a/contrib/bind9/lib/dns/rdata/generic/x25_19.h
+++ b/contrib/bind9/lib/dns/rdata/generic/x25_19.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef GENERIC_X25_19_H
 #define GENERIC_X25_19_H 1
 
-/* $Id: x25_19.h,v 1.13.206.1 2004/03/06 08:14:14 marka Exp $ */
+/* $Id: x25_19.h,v 1.14.18.2 2005/04/29 00:16:40 marka Exp $ */
 
-/* RFC 1183 */
+/*!
+ *  \brief Per RFC1183 */
 
 typedef struct dns_rdata_x25 {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/hs_4/a_1.c b/contrib/bind9/lib/dns/rdata/hs_4/a_1.c
index 07d6adc..5d3ddae 100644
--- a/contrib/bind9/lib/dns/rdata/hs_4/a_1.c
+++ b/contrib/bind9/lib/dns/rdata/hs_4/a_1.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: a_1.c,v 1.25.12.4 2004/03/08 09:04:43 marka Exp $ */
+/* $Id: a_1.c,v 1.29 2004/03/05 05:10:20 marka Exp $ */
 
 /* reviewed: Thu Mar 16 15:58:36 PST 2000 by brister */
 
diff --git a/contrib/bind9/lib/dns/rdata/hs_4/a_1.h b/contrib/bind9/lib/dns/rdata/hs_4/a_1.h
index c06c648..59f54b5 100644
--- a/contrib/bind9/lib/dns/rdata/hs_4/a_1.h
+++ b/contrib/bind9/lib/dns/rdata/hs_4/a_1.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef HS_4_A_1_H
 #define HS_4_A_1_H 1
 
-/* $Id: a_1.h,v 1.7.206.1 2004/03/06 08:14:15 marka Exp $ */
+/* $Id: a_1.h,v 1.8.18.2 2005/04/29 00:16:41 marka Exp $ */
 
 typedef struct dns_rdata_hs_a {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/a6_38.c b/contrib/bind9/lib/dns/rdata/in_1/a6_38.c
index ded70c1..50017e1 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a6_38.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/a6_38.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: a6_38.c,v 1.46.2.1.2.5 2004/03/08 09:04:43 marka Exp $ */
+/* $Id: a6_38.c,v 1.52 2004/03/05 05:10:23 marka Exp $ */
 
 /* RFC2874 */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/a6_38.h b/contrib/bind9/lib/dns/rdata/in_1/a6_38.h
index 9134ced..bb15dad 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a6_38.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/a6_38.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef IN_1_A6_38_H
 #define IN_1_A6_38_H 1
 
-/* $Id: a6_38.h,v 1.19.206.1 2004/03/06 08:14:15 marka Exp $ */
+/* $Id: a6_38.h,v 1.20.18.2 2005/04/29 00:16:41 marka Exp $ */
 
-/* RFC2874 */
+/*! 
+ *  \brief Per RFC2874 */
 
 typedef struct dns_rdata_in_a6 {
         dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/a_1.c b/contrib/bind9/lib/dns/rdata/in_1/a_1.c
index 30165c9..e8cb8ce 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a_1.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/a_1.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: a_1.c,v 1.46.12.5 2004/03/08 09:04:43 marka Exp $ */
+/* $Id: a_1.c,v 1.51 2004/03/05 05:10:23 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/a_1.h b/contrib/bind9/lib/dns/rdata/in_1/a_1.h
index 34d7469..d92a973 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/a_1.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/a_1.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef IN_1_A_1_H
 #define IN_1_A_1_H 1
 
-/* $Id: a_1.h,v 1.23.206.1 2004/03/06 08:14:16 marka Exp $ */
+/* $Id: a_1.h,v 1.24.18.2 2005/04/29 00:16:41 marka Exp $ */
 
 typedef struct dns_rdata_in_a {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c
index 489fe01..1dd32cf 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: aaaa_28.c,v 1.36.12.5 2004/03/08 09:04:44 marka Exp $ */
+/* $Id: aaaa_28.c,v 1.41.18.2 2005/04/29 00:16:41 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
-/* RFC 1886 */
+/* RFC1886 */
 
 #ifndef RDATA_IN_1_AAAA_28_C
 #define RDATA_IN_1_AAAA_28_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h
index e8a9319..31ad6a6 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/aaaa_28.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef IN_1_AAAA_28_H
 #define IN_1_AAAA_28_H 1
 
-/* $Id: aaaa_28.h,v 1.16.206.1 2004/03/06 08:14:16 marka Exp $ */
+/* $Id: aaaa_28.h,v 1.17.18.2 2005/04/29 00:16:42 marka Exp $ */
 
-/* RFC 1886 */
+/*! 
+ *  \brief Per RFC1886 */
 
 typedef struct dns_rdata_in_aaaa {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/apl_42.c b/contrib/bind9/lib/dns/rdata/in_1/apl_42.c
index ac39569..42b2e7f 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/apl_42.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/apl_42.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: apl_42.c,v 1.4.200.8 2004/03/16 12:38:15 marka Exp $ */
+/* $Id: apl_42.c,v 1.8.18.2 2005/04/29 00:16:42 marka Exp $ */
 
-/* RFC 3123 */
+/* RFC3123 */
 
 #ifndef RDATA_IN_1_APL_42_C
 #define RDATA_IN_1_APL_42_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/apl_42.h b/contrib/bind9/lib/dns/rdata/in_1/apl_42.h
index 83309a6..d434ace 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/apl_42.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/apl_42.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/* */
 #ifndef IN_1_APL_42_H
 #define IN_1_APL_42_H 1
 
-/* $Id: apl_42.h,v 1.1.202.3 2004/03/08 09:04:44 marka Exp $ */
+/* $Id: apl_42.h,v 1.2.18.2 2005/04/29 00:16:42 marka Exp $ */
 
 typedef struct dns_rdata_apl_ent {
 	isc_boolean_t	negative;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/kx_36.c b/contrib/bind9/lib/dns/rdata/in_1/kx_36.c
index fee1e3d..8a64aac 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/kx_36.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/kx_36.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: kx_36.c,v 1.37.2.1.2.3 2004/03/06 08:14:17 marka Exp $ */
+/* $Id: kx_36.c,v 1.41.18.2 2005/04/29 00:16:42 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 17:24:54 PST 2000 by explorer */
 
-/* RFC 2230 */
+/* RFC2230 */
 
 #ifndef RDATA_IN_1_KX_36_C
 #define RDATA_IN_1_KX_36_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/kx_36.h b/contrib/bind9/lib/dns/rdata/in_1/kx_36.h
index 5ac328d..c44883d 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/kx_36.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/kx_36.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef IN_1_KX_36_H
 #define IN_1_KX_36_H 1
 
-/* $Id: kx_36.h,v 1.15.206.1 2004/03/06 08:14:17 marka Exp $ */
+/* $Id: kx_36.h,v 1.16.18.2 2005/04/29 00:16:42 marka Exp $ */
 
-/* RFC 2230 */
+/*! 
+ *  \brief Per RFC2230 */
 
 typedef struct dns_rdata_in_kx {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c
index f3c93c7..0e5961a 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: naptr_35.c,v 1.43.2.1.2.3 2004/03/06 08:14:17 marka Exp $ */
+/* $Id: naptr_35.c,v 1.47.18.2 2005/04/29 00:16:42 marka Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
-/* RFC 2915 */
+/* RFC2915 */
 
 #ifndef RDATA_IN_1_NAPTR_35_C
 #define RDATA_IN_1_NAPTR_35_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h
index b1deb2ce..2578b48 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/naptr_35.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef IN_1_NAPTR_35_H
 #define IN_1_NAPTR_35_H 1
 
-/* $Id: naptr_35.h,v 1.18.206.1 2004/03/06 08:14:17 marka Exp $ */
+/* $Id: naptr_35.h,v 1.19.18.2 2005/04/29 00:16:42 marka Exp $ */
 
-/* RFC 2915 */
+/*! 
+ *  \brief Per RFC2915 */
 
 typedef struct dns_rdata_in_naptr {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c
index 0fa0fb2..1a65cbe 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsap-ptr_23.c,v 1.32.206.2 2004/03/06 08:14:17 marka Exp $ */
+/* $Id: nsap-ptr_23.c,v 1.34.18.2 2005/04/29 00:16:42 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 10:16:02 PST 2000 by gson */
 
-/* RFC 1348.  Obsoleted in RFC 1706 - use PTR instead. */
+/* RFC1348.  Obsoleted in RFC 1706 - use PTR instead. */
 
 #ifndef RDATA_IN_1_NSAP_PTR_23_C
 #define RDATA_IN_1_NSAP_PTR_23_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h
index 9bf3c65..bd8e025 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap-ptr_23.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef IN_1_NSAP_PTR_23_H
 #define IN_1_NSAP_PTR_23_H 1
 
-/* $Id: nsap-ptr_23.h,v 1.14.206.1 2004/03/06 08:14:18 marka Exp $ */
+/* $Id: nsap-ptr_23.h,v 1.15.18.2 2005/04/29 00:16:43 marka Exp $ */
 
-/* RFC 1348.  Obsoleted in RFC 1706 - use PTR instead. */
+/*! 
+ *  \brief Per RFC1348.  Obsoleted in RFC 1706 - use PTR instead. */
 
 typedef struct dns_rdata_in_nsap_ptr {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c
index 594b97f..a348a30 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsap_22.c,v 1.33.12.5 2004/03/08 09:04:44 marka Exp $ */
+/* $Id: nsap_22.c,v 1.38.18.2 2005/04/29 00:16:43 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 10:41:07 PST 2000 by gson */
 
-/* RFC 1706 */
+/* RFC1706 */
 
 #ifndef RDATA_IN_1_NSAP_22_C
 #define RDATA_IN_1_NSAP_22_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h
index 6467433..583fbac 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/nsap_22.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef IN_1_NSAP_22_H
 #define IN_1_NSAP_22_H 1
 
-/* $Id: nsap_22.h,v 1.13.206.1 2004/03/06 08:14:18 marka Exp $ */
+/* $Id: nsap_22.h,v 1.14.18.2 2005/04/29 00:16:43 marka Exp $ */
 
-/* RFC 1706 */
+/*! 
+ *  \brief Per RFC1706 */
 
 typedef struct dns_rdata_in_nsap {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/px_26.c b/contrib/bind9/lib/dns/rdata/in_1/px_26.c
index 66214dd..3df9b99 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/px_26.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/px_26.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: px_26.c,v 1.34.2.1.2.4 2004/03/06 08:14:18 marka Exp $ */
+/* $Id: px_26.c,v 1.39.18.2 2005/04/29 00:16:43 marka Exp $ */
 
 /* Reviewed: Mon Mar 20 10:44:27 PST 2000 */
 
-/* RFC 2163 */
+/* RFC2163 */
 
 #ifndef RDATA_IN_1_PX_26_C
 #define RDATA_IN_1_PX_26_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/px_26.h b/contrib/bind9/lib/dns/rdata/in_1/px_26.h
index 79d4b18..a38d5f81 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/px_26.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/px_26.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,9 +18,10 @@
 #ifndef IN_1_PX_26_H
 #define IN_1_PX_26_H 1
 
-/* $Id: px_26.h,v 1.14.206.1 2004/03/06 08:14:18 marka Exp $ */
+/* $Id: px_26.h,v 1.15.18.2 2005/04/29 00:16:43 marka Exp $ */
 
-/* RFC 2163 */
+/*! 
+ *  \brief Per RFC2163 */
 
 typedef struct dns_rdata_in_px {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/srv_33.c b/contrib/bind9/lib/dns/rdata/in_1/srv_33.c
index 7bcba1b..2925a77 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/srv_33.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/srv_33.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: srv_33.c,v 1.36.2.1.2.4 2004/03/06 08:14:18 marka Exp $ */
+/* $Id: srv_33.c,v 1.41.18.2 2005/04/29 00:16:43 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 13:01:00 PST 2000 by bwelling */
 
-/* RFC 2782 */
+/* RFC2782 */
 
 #ifndef RDATA_IN_1_SRV_33_C
 #define RDATA_IN_1_SRV_33_C
diff --git a/contrib/bind9/lib/dns/rdata/in_1/srv_33.h b/contrib/bind9/lib/dns/rdata/in_1/srv_33.h
index 91dbf37..7d9fef6 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/srv_33.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/srv_33.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,11 +18,12 @@
 #ifndef IN_1_SRV_33_H
 #define IN_1_SRV_33_H 1
 
-/* $Id: srv_33.h,v 1.14.206.1 2004/03/06 08:14:19 marka Exp $ */
+/* $Id: srv_33.h,v 1.15.18.2 2005/04/29 00:16:43 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 13:01:00 PST 2000 by bwelling */
 
-/* RFC 2782 */
+/*! 
+ *  \brief Per RFC2782 */
 
 typedef struct dns_rdata_in_srv {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/in_1/wks_11.c b/contrib/bind9/lib/dns/rdata/in_1/wks_11.c
index c278686..749b8fd 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/wks_11.c
+++ b/contrib/bind9/lib/dns/rdata/in_1/wks_11.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: wks_11.c,v 1.44.12.8 2004/09/16 01:00:58 marka Exp $ */
+/* $Id: wks_11.c,v 1.51.18.1 2004/09/16 01:02:19 marka Exp $ */
 
 /* Reviewed: Fri Mar 17 15:01:49 PST 2000 by explorer */
 
diff --git a/contrib/bind9/lib/dns/rdata/in_1/wks_11.h b/contrib/bind9/lib/dns/rdata/in_1/wks_11.h
index e734281..a0093b9 100644
--- a/contrib/bind9/lib/dns/rdata/in_1/wks_11.h
+++ b/contrib/bind9/lib/dns/rdata/in_1/wks_11.h
@@ -18,7 +18,7 @@
 #ifndef IN_1_WKS_11_H
 #define IN_1_WKS_11_H 1
 
-/* $Id: wks_11.h,v 1.19.206.1 2004/03/06 08:14:19 marka Exp $ */
+/* $Id: wks_11.h,v 1.20 2004/03/05 05:10:25 marka Exp $ */
 
 typedef	struct dns_rdata_in_wks {
 	dns_rdatacommon_t	common;
diff --git a/contrib/bind9/lib/dns/rdata/rdatastructpre.h b/contrib/bind9/lib/dns/rdata/rdatastructpre.h
index 19af8b4..d641ef5 100644
--- a/contrib/bind9/lib/dns/rdata/rdatastructpre.h
+++ b/contrib/bind9/lib/dns/rdata/rdatastructpre.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatastructpre.h,v 1.13.206.1 2004/03/06 08:14:02 marka Exp $ */
+/* $Id: rdatastructpre.h,v 1.14 2004/03/05 05:10:04 marka Exp $ */
 
 #ifndef DNS_RDATASTRUCT_H
 #define DNS_RDATASTRUCT_H 1
diff --git a/contrib/bind9/lib/dns/rdata/rdatastructsuf.h b/contrib/bind9/lib/dns/rdata/rdatastructsuf.h
index 3eabff2..1ab1b0a 100644
--- a/contrib/bind9/lib/dns/rdata/rdatastructsuf.h
+++ b/contrib/bind9/lib/dns/rdata/rdatastructsuf.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatastructsuf.h,v 1.7.206.1 2004/03/06 08:14:02 marka Exp $ */
+/* $Id: rdatastructsuf.h,v 1.8 2004/03/05 05:10:04 marka Exp $ */
 
 ISC_LANG_ENDDECLS
 
diff --git a/contrib/bind9/lib/dns/rdatalist.c b/contrib/bind9/lib/dns/rdatalist.c
index baa62e5..7229fa3 100644
--- a/contrib/bind9/lib/dns/rdatalist.c
+++ b/contrib/bind9/lib/dns/rdatalist.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatalist.c,v 1.25.2.2.2.2 2004/03/08 02:07:56 marka Exp $ */
+/* $Id: rdatalist.c,v 1.28.18.3 2005/04/29 00:16:02 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -38,7 +40,10 @@ static dns_rdatasetmethods_t methods = {
 	isc__rdatalist_clone,
 	isc__rdatalist_count,
 	isc__rdatalist_addnoqname,
-	isc__rdatalist_getnoqname
+	isc__rdatalist_getnoqname,
+	NULL,
+	NULL,
+	NULL
 };
 
 void
diff --git a/contrib/bind9/lib/dns/rdatalist_p.h b/contrib/bind9/lib/dns/rdatalist_p.h
index 3a7b52c..d697fec 100644
--- a/contrib/bind9/lib/dns/rdatalist_p.h
+++ b/contrib/bind9/lib/dns/rdatalist_p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatalist_p.h,v 1.3.206.2 2004/03/08 02:07:56 marka Exp $ */
+/* $Id: rdatalist_p.h,v 1.5.18.2 2005/04/29 00:16:03 marka Exp $ */
 
 #ifndef DNS_RDATALIST_P_H
 #define DNS_RDATALIST_P_H
 
+/*! \file */
+
 #include <isc/result.h>
 #include <dns/types.h>
 
diff --git a/contrib/bind9/lib/dns/rdataset.c b/contrib/bind9/lib/dns/rdataset.c
index 8af71c3..c86b3c5 100644
--- a/contrib/bind9/lib/dns/rdataset.c
+++ b/contrib/bind9/lib/dns/rdataset.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataset.c,v 1.58.2.2.2.12 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: rdataset.c,v 1.72.18.5 2006/03/02 00:37:21 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -174,6 +176,9 @@ static dns_rdatasetmethods_t question_methods = {
 	question_clone,
 	question_count,
 	NULL,
+	NULL,
+	NULL,
+	NULL,
 	NULL
 };
 
@@ -624,3 +629,81 @@ dns_rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 		return (ISC_R_NOTIMPLEMENTED);
 	return((rdataset->methods->getnoqname)(rdataset, name, nsec, nsecsig));
 }
+
+/*
+ * Additional cache stuff
+ */
+isc_result_t
+dns_rdataset_getadditional(dns_rdataset_t *rdataset,
+			   dns_rdatasetadditional_t type,
+			   dns_rdatatype_t qtype,
+			   dns_acache_t *acache,
+			   dns_zone_t **zonep,
+			   dns_db_t **dbp,
+			   dns_dbversion_t **versionp,
+			   dns_dbnode_t **nodep,
+			   dns_name_t *fname,
+			   dns_message_t *msg,
+			   isc_stdtime_t now)
+{
+	REQUIRE(DNS_RDATASET_VALID(rdataset));
+	REQUIRE(rdataset->methods != NULL);
+	REQUIRE(zonep == NULL || *zonep == NULL);
+	REQUIRE(dbp != NULL && *dbp == NULL);
+	REQUIRE(versionp != NULL && *versionp == NULL);
+	REQUIRE(nodep != NULL && *nodep == NULL);
+	REQUIRE(fname != NULL);
+	REQUIRE(msg != NULL);
+
+	if (acache != NULL && rdataset->methods->getadditional != NULL) {
+		return ((rdataset->methods->getadditional)(rdataset, type,
+							   qtype, acache,
+							   zonep, dbp,
+							   versionp, nodep,
+							   fname, msg, now));
+	}
+
+	return (ISC_R_FAILURE);
+}
+
+isc_result_t
+dns_rdataset_setadditional(dns_rdataset_t *rdataset,
+			   dns_rdatasetadditional_t type,
+			   dns_rdatatype_t qtype,
+			   dns_acache_t *acache,
+			   dns_zone_t *zone,
+			   dns_db_t *db,
+			   dns_dbversion_t *version,
+			   dns_dbnode_t *node,
+			   dns_name_t *fname)
+{
+	REQUIRE(DNS_RDATASET_VALID(rdataset));
+	REQUIRE(rdataset->methods != NULL);
+
+	if (acache != NULL && rdataset->methods->setadditional != NULL) {
+		return ((rdataset->methods->setadditional)(rdataset, type,
+							   qtype, acache, zone,
+							   db, version,
+							   node, fname));
+	}
+
+	return (ISC_R_FAILURE);
+}
+
+isc_result_t
+dns_rdataset_putadditional(dns_acache_t *acache,
+			   dns_rdataset_t *rdataset,
+			   dns_rdatasetadditional_t type,
+			   dns_rdatatype_t qtype)
+{
+	REQUIRE(DNS_RDATASET_VALID(rdataset));
+	REQUIRE(rdataset->methods != NULL);
+
+	if (acache != NULL && rdataset->methods->putadditional != NULL) {
+		return ((rdataset->methods->putadditional)(acache, rdataset,
+							   type, qtype));
+	}
+
+	return (ISC_R_FAILURE);
+}
+
diff --git a/contrib/bind9/lib/dns/rdatasetiter.c b/contrib/bind9/lib/dns/rdatasetiter.c
index f3b0f8b..8089e04 100644
--- a/contrib/bind9/lib/dns/rdatasetiter.c
+++ b/contrib/bind9/lib/dns/rdatasetiter.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatasetiter.c,v 1.11.206.1 2004/03/06 08:13:44 marka Exp $ */
+/* $Id: rdatasetiter.c,v 1.12.18.2 2005/04/29 00:16:03 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/rdataslab.c b/contrib/bind9/lib/dns/rdataslab.c
index 0604cd5..3b5ab2d 100644
--- a/contrib/bind9/lib/dns/rdataslab.c
+++ b/contrib/bind9/lib/dns/rdataslab.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataslab.c,v 1.29.2.2.2.6 2004/03/08 09:04:31 marka Exp $ */
+/* $Id: rdataslab.c,v 1.35.18.5 2006/03/05 23:58:51 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -31,25 +33,95 @@
 #include <dns/rdataset.h>
 #include <dns/rdataslab.h>
 
-/* Note: the "const void *" are just to make qsort happy. */
+/*
+ * The rdataslab structure allows iteration to occur in both load order
+ * and DNSSEC order.  The structure is as follows:
+ *
+ *	header		(reservelen bytes)
+ *	record count	(2 bytes)
+ *	offset table	(4 x record count bytes in load order)
+ *	data records
+ *		data length	(2 bytes)
+ *		order		(2 bytes)
+ *		data		(data length bytes)
+ *
+ * Offsets are from the end of the header.
+ *
+ * Load order traversal is performed by walking the offset table to find
+ * the start of the record.
+ *
+ * DNSSEC order traversal is performed by walking the data records.
+ *
+ * The order is stored with record to allow for efficient reconstuction of
+ * of the offset table following a merge or subtraction.
+ *
+ * The iterator methods here currently only support DNSSEC order iteration.
+ *
+ * The iterator methods in rbtdb support both load order and DNSSEC order
+ * iteration.
+ *
+ * WARNING:
+ *	rbtdb.c directly interacts with the slab's raw structures.  If the
+ *	structure changes then rbtdb.c also needs to be updated to reflect
+ *	the changes.  See the areas tagged with "RDATASLAB".
+ */
+
+struct xrdata {
+	dns_rdata_t	rdata;
+	unsigned int	order;
+};
+
+/*% Note: the "const void *" are just to make qsort happy.  */
 static int
 compare_rdata(const void *p1, const void *p2) {
-	const dns_rdata_t *rdata1 = p1;
-	const dns_rdata_t *rdata2 = p2;
-	return (dns_rdata_compare(rdata1, rdata2));
+	const struct xrdata *x1 = p1;
+	const struct xrdata *x2 = p2;
+	return (dns_rdata_compare(&x1->rdata, &x2->rdata));
+}
+
+static void
+fillin_offsets(unsigned char *offsetbase, unsigned int *offsettable,
+	       unsigned length)
+{
+	unsigned int i, j;
+	unsigned char *raw;
+
+	for (i = 0, j = 0; i < length; i++) {
+
+		if (offsettable[i] == 0)
+			continue;
+
+		/*
+		 * Fill in offset table.
+		 */
+		raw = &offsetbase[j*4 + 2];
+		*raw++ = (offsettable[i] & 0xff000000) >> 24;
+		*raw++ = (offsettable[i] & 0xff0000) >> 16;
+		*raw++ = (offsettable[i] & 0xff00) >> 8;
+		*raw = offsettable[i] & 0xff;
+
+		/*
+		 * Fill in table index.
+		 */
+		raw = offsetbase + offsettable[i] + 2;
+		*raw++ = (j & 0xff00) >> 8;
+		*raw = j++ & 0xff;
+	}
 }
 
 isc_result_t
 dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 			   isc_region_t *region, unsigned int reservelen)
 {
-	dns_rdata_t    *rdatas;
+	struct xrdata  *x;
 	unsigned char  *rawbuf;
+	unsigned char  *offsetbase;
 	unsigned int	buflen;
 	isc_result_t	result;
 	unsigned int	nitems;
 	unsigned int	nalloc;
 	unsigned int	i;
+	unsigned int   *offsettable;
 
 	buflen = reservelen + 2;
 
@@ -58,8 +130,11 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	if (nitems == 0)
 		return (ISC_R_FAILURE);
 
-	rdatas = isc_mem_get(mctx, nalloc * sizeof(dns_rdata_t));
-	if (rdatas == NULL)
+	if (nalloc > 0xffff)
+		return (ISC_R_NOSPACE);
+
+	x = isc_mem_get(mctx, nalloc * sizeof(struct xrdata));
+	if (x == NULL)
 		return (ISC_R_NOMEMORY);
 
 	/*
@@ -70,8 +145,9 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		goto free_rdatas;
 	for (i = 0; i < nalloc && result == ISC_R_SUCCESS; i++) {
 		INSIST(result == ISC_R_SUCCESS);
-		dns_rdata_init(&rdatas[i]);
-		dns_rdataset_current(rdataset, &rdatas[i]);
+		dns_rdata_init(&x[i].rdata);
+		dns_rdataset_current(rdataset, &x[i].rdata);
+		x[i].order = i;
 		result = dns_rdataset_next(rdataset);
 	}
 	if (result != ISC_R_NOMORE)
@@ -85,7 +161,10 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		goto free_rdatas;
 	}
 
-	qsort(rdatas, nalloc, sizeof(dns_rdata_t), compare_rdata);
+	/*
+	 * Put into DNSSEC order.
+	 */
+	qsort(x, nalloc, sizeof(struct xrdata), compare_rdata);
 
 	/*
 	 * Remove duplicates and compute the total storage required.
@@ -93,20 +172,27 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	 * If an rdata is not a duplicate, accumulate the storage size
 	 * required for the rdata.  We do not store the class, type, etc,
 	 * just the rdata, so our overhead is 2 bytes for the number of
-	 * records, and 2 for each rdata length, and then the rdata itself.
+	 * records, and 8 for each rdata, (length(2), offset(4) and order(2))
+	 * and then the rdata itself.
 	 */
 	for (i = 1; i < nalloc; i++) {
-		if (compare_rdata(&rdatas[i-1], &rdatas[i]) == 0) {
-			rdatas[i-1].data = NULL;
-			rdatas[i-1].length = 0;
+		if (compare_rdata(&x[i-1].rdata, &x[i].rdata) == 0) {
+			x[i-1].rdata.data = NULL;
+			x[i-1].rdata.length = 0;
+			/*
+			 * Preserve the least order so A, B, A -> A, B
+			 * after duplicate removal.
+			 */
+			if (x[i-1].order < x[i].order)
+				x[i].order = x[i-1].order;
 			nitems--;
 		} else
-			buflen += (2 + rdatas[i-1].length);
+			buflen += (8 + x[i-1].rdata.length);
 	}
 	/*
 	 * Don't forget the last item!
 	 */
-	buflen += (2 + rdatas[i-1].length);
+	buflen += (8 + x[i-1].rdata.length);
 
 	/*
 	 * Ensure that singleton types are actually singletons.
@@ -129,26 +215,47 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 		result = ISC_R_NOMEMORY;
 		goto free_rdatas;
 	}
+	
+	/* Allocate temporary offset table. */
+	offsettable = isc_mem_get(mctx, nalloc * sizeof(unsigned int));
+	if (offsettable == NULL) {
+		isc_mem_put(mctx, rawbuf, buflen);
+		result = ISC_R_NOMEMORY;
+		goto free_rdatas;
+	}
+	memset(offsettable, 0, nalloc * sizeof(unsigned int));
 
 	region->base = rawbuf;
 	region->length = buflen;
 
 	rawbuf += reservelen;
+	offsetbase = rawbuf;
 
 	*rawbuf++ = (nitems & 0xff00) >> 8;
 	*rawbuf++ = (nitems & 0x00ff);
+
+	/* Skip load order table.  Filled in later. */
+	rawbuf += nitems * 4;
+
 	for (i = 0; i < nalloc; i++) {
-		if (rdatas[i].data == NULL)
+		if (x[i].rdata.data == NULL)
 			continue;
-		*rawbuf++ = (rdatas[i].length & 0xff00) >> 8;
-		*rawbuf++ = (rdatas[i].length & 0x00ff);
-		memcpy(rawbuf, rdatas[i].data, rdatas[i].length);
-		rawbuf += rdatas[i].length;
+		offsettable[x[i].order] = rawbuf - offsetbase;
+		*rawbuf++ = (x[i].rdata.length & 0xff00) >> 8;
+		*rawbuf++ = (x[i].rdata.length & 0x00ff);
+		rawbuf += 2;	/* filled in later */
+		memcpy(rawbuf, x[i].rdata.data, x[i].rdata.length);
+		rawbuf += x[i].rdata.length;
 	}
+	
+	fillin_offsets(offsetbase, offsettable, nalloc);
+
+	isc_mem_put(mctx, offsettable, nalloc * sizeof(unsigned int));
+
 	result = ISC_R_SUCCESS;
 
  free_rdatas:
-	isc_mem_put(mctx, rdatas, nalloc * sizeof(dns_rdata_t));
+	isc_mem_put(mctx, x, nalloc * sizeof(struct xrdata));
 	return (result);
 }
 
@@ -167,7 +274,7 @@ rdataset_first(dns_rdataset_t *rdataset) {
 		rdataset->private5 = NULL;
 		return (ISC_R_NOMORE);
 	}
-	raw += 2;
+	raw += 2 + (4 * count);
 	/*
 	 * The privateuint4 field is the number of rdata beyond the cursor
 	 * position, so we decrement the total count by one before storing
@@ -193,7 +300,7 @@ rdataset_next(dns_rdataset_t *rdataset) {
 	rdataset->privateuint4 = count;
 	raw = rdataset->private5;
 	length = raw[0] * 256 + raw[1];
-	raw += length + 2;
+	raw += length + 4;
 	rdataset->private5 = raw;
 
 	return (ISC_R_SUCCESS);
@@ -207,7 +314,7 @@ rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 	REQUIRE(raw != NULL);
 
 	r.length = raw[0] * 256 + raw[1];
-	raw += 2;
+	raw += 4;
 	r.base = raw;
 	dns_rdata_fromregion(rdata, rdataset->rdclass, rdataset->type, &r);
 }
@@ -241,6 +348,9 @@ static dns_rdatasetmethods_t rdataset_methods = {
 	rdataset_clone,
 	rdataset_count,
 	NULL,
+	NULL,
+	NULL,
+	NULL,
 	NULL
 };
 
@@ -280,11 +390,12 @@ dns_rdataslab_size(unsigned char *slab, unsigned int reservelen) {
 	current = slab + reservelen;
 	count = *current++ * 256;
 	count += *current++;
+	current += (4 * count);
 	while (count > 0) {
 		count--;
 		length = *current++ * 256;
 		length += *current++;
-		current += length;
+		current += length + 2;
 	}
 
 	return ((unsigned int)(current - slab));
@@ -306,6 +417,7 @@ rdata_from_slab(unsigned char **current,
 
 	region.length = *tcurrent++ * 256;
 	region.length += *tcurrent++;
+	tcurrent += 2;
 	region.base = tcurrent;
 	tcurrent += region.length;
 	dns_rdata_fromregion(rdata, rdclass, type, &region);
@@ -325,15 +437,22 @@ rdata_in_slab(unsigned char *slab, unsigned int reservelen,
 	unsigned int count, i;
 	unsigned char *current;
 	dns_rdata_t trdata = DNS_RDATA_INIT;
+	int n;
 
 	current = slab + reservelen;
 	count = *current++ * 256;
 	count += *current++;
 
+	current += (4 * count);
+
 	for (i = 0; i < count; i++) {
 		rdata_from_slab(&current, rdclass, type, &trdata);
-		if (dns_rdata_compare(&trdata, rdata) == 0)
+		
+		n = dns_rdata_compare(&trdata, rdata);
+		if (n == 0)
 			return (ISC_TRUE);
+		if (n > 0)	/* In DNSSEC order. */
+			break;
 		dns_rdata_reset(&trdata);
 	}
 	return (ISC_FALSE);
@@ -354,6 +473,11 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	unsigned int oadded = 0;
 	unsigned int nadded = 0;
 	unsigned int nncount = 0;
+	unsigned int oncount;
+	unsigned int norder = 0;
+	unsigned int oorder = 0;
+	unsigned char *offsetbase;
+	unsigned int *offsettable;
 
 	/*
 	 * XXX  Need parameter to allow "delete rdatasets in nslab" merge,
@@ -366,12 +490,16 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	ocurrent = oslab + reservelen;
 	ocount = *ocurrent++ * 256;
 	ocount += *ocurrent++;
+	ocurrent += (4 * ocount);
 	ostart = ocurrent;
 	ncurrent = nslab + reservelen;
 	ncount = *ncurrent++ * 256;
 	ncount += *ncurrent++;
+	ncurrent += (4 * ncount);
 	INSIST(ocount > 0 && ncount > 0);
 
+	oncount = ncount;
+
 	/*
 	 * Yes, this is inefficient!
 	 */
@@ -383,8 +511,8 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	for (count = 0; count < ocount; count++) {
 		length = *ocurrent++ * 256;
 		length += *ocurrent++;
-		olength += length + 2;
-		ocurrent += length;
+		olength += length + 8;
+		ocurrent += length + 2;
 	}
 
 	/*
@@ -400,6 +528,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	do {
 		nregion.length = *ncurrent++ * 256;
 		nregion.length += *ncurrent++;
+		ncurrent += 2;
 		nregion.base = ncurrent;
 		dns_rdata_init(&nrdata);
 		dns_rdata_fromregion(&nrdata, rdclass, type, &nregion);
@@ -408,7 +537,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 			/*
 			 * This rdata isn't in the old slab.
 			 */
-			tlength += nregion.length + 2;
+			tlength += nregion.length + 8;
 			tcount++;
 			nncount++;
 			added_something = ISC_TRUE;
@@ -436,6 +565,9 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 		return (DNS_R_SINGLETON);
 	}
 
+	if (tcount > 0xffff)
+		return (ISC_R_NOSPACE);
+
 	/*
 	 * Copy the reserved area from the new slab.
 	 */
@@ -444,6 +576,7 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 		return (ISC_R_NOMEMORY);
 	memcpy(tstart, nslab, reservelen);
 	tcurrent = tstart + reservelen;
+	offsetbase = tcurrent;
 
 	/*
 	 * Write the new count.
@@ -452,16 +585,35 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	*tcurrent++ = (tcount & 0x00ff);
 
 	/*
+	 * Skip offset table.
+	 */
+	tcurrent += (tcount * 4);
+
+	offsettable = isc_mem_get(mctx,
+				  (ocount + oncount) * sizeof(unsigned int));
+	if (offsettable == NULL) {
+		isc_mem_put(mctx, tstart, tlength);
+		return (ISC_R_NOMEMORY);
+	}
+	memset(offsettable, 0, (ocount + oncount) * sizeof(unsigned int));
+
+	/*
 	 * Merge the two slabs.
 	 */
 	ocurrent = ostart;
 	INSIST(ocount != 0);
+	oorder = ocurrent[2] * 256 + ocurrent[3];
+	INSIST(oorder < ocount);
 	rdata_from_slab(&ocurrent, rdclass, type, &ordata);
 
 	ncurrent = nslab + reservelen + 2;
+	ncurrent += (4 * oncount);
+
 	if (ncount > 0) {
 		do {
 			dns_rdata_reset(&nrdata);
+			norder = ncurrent[2] * 256 + ncurrent[3];
+			INSIST(norder < oncount);
        			rdata_from_slab(&ncurrent, rdclass, type, &nrdata);
 		} while (rdata_in_slab(oslab, reservelen, rdclass,
 				       type, &nrdata));
@@ -476,27 +628,35 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 		else
 			fromold = ISC_TF(compare_rdata(&ordata, &nrdata) < 0);
 		if (fromold) {
+			offsettable[oorder] = tcurrent - offsetbase;
 			length = ordata.length;
 			*tcurrent++ = (length & 0xff00) >> 8;
 			*tcurrent++ = (length & 0x00ff);
+			tcurrent += 2;	/* fill in later */
 			memcpy(tcurrent, ordata.data, length);
 			tcurrent += length;
 			oadded++;
 			if (oadded < ocount) {
 				dns_rdata_reset(&ordata);
+				oorder = ocurrent[2] * 256 + ocurrent[3];
+				INSIST(oorder < ocount);
        				rdata_from_slab(&ocurrent, rdclass, type,
 						&ordata);
 			}
 		} else {
+			offsettable[ocount + norder] = tcurrent - offsetbase;
 			length = nrdata.length;
 			*tcurrent++ = (length & 0xff00) >> 8;
 			*tcurrent++ = (length & 0x00ff);
+			tcurrent += 2;	/* fill in later */
 			memcpy(tcurrent, nrdata.data, length);
 			tcurrent += length;
 			nadded++;
 			if (nadded < ncount) {
 				do {
 					dns_rdata_reset(&nrdata);
+					norder = ncurrent[2] * 256 + ncurrent[3];
+					INSIST(norder < oncount);
        					rdata_from_slab(&ncurrent, rdclass,
 							type, &nrdata);
 				} while (rdata_in_slab(oslab, reservelen,
@@ -506,6 +666,11 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 		}
 	}
 
+	fillin_offsets(offsetbase, offsettable, ocount + oncount);
+
+	isc_mem_put(mctx, offsettable,
+		    (ocount + oncount) * sizeof(unsigned int));
+
 	INSIST(tcurrent == tstart + tlength);
 
 	*tslabp = tstart;
@@ -520,9 +685,12 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		       unsigned int flags, unsigned char **tslabp)
 {
 	unsigned char *mcurrent, *sstart, *scurrent, *tstart, *tcurrent;
-	unsigned int mcount, scount, rcount ,count, tlength, tcount;
+	unsigned int mcount, scount, rcount ,count, tlength, tcount, i;
 	dns_rdata_t srdata = DNS_RDATA_INIT;
 	dns_rdata_t mrdata = DNS_RDATA_INIT;
+	unsigned char *offsetbase;
+	unsigned int *offsettable;
+	unsigned int order;
 
 	REQUIRE(tslabp != NULL && *tslabp == NULL);
 	REQUIRE(mslab != NULL && sslab != NULL);
@@ -533,7 +701,6 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 	scurrent = sslab + reservelen;
 	scount = *scurrent++ * 256;
 	scount += *scurrent++;
-	sstart = scurrent;
 	INSIST(mcount > 0 && scount > 0);
 
 	/*
@@ -547,11 +714,15 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 	tcount = 0;
 	rcount = 0;
 
+	mcurrent += 4 * mcount;
+	scurrent += 4 * scount;
+	sstart = scurrent;
+
 	/*
 	 * Add in the length of rdata in the mslab that aren't in
 	 * the sslab.
 	 */
-	do {
+	for (i = 0; i < mcount; i++) {
 		unsigned char *mrdatabegin = mcurrent;
 		rdata_from_slab(&mcurrent, rdclass, type, &mrdata);
 		scurrent = sstart;
@@ -570,9 +741,10 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 			tcount++;
 		} else
 			rcount++;
-		mcount--;
 		dns_rdata_reset(&mrdata);
-	} while (mcount > 0);
+	}
+
+	tlength += (4 * tcount);
 
 	/*
 	 * Check that all the records originally existed.  The numeric
@@ -601,6 +773,14 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 		return (ISC_R_NOMEMORY);
 	memcpy(tstart, mslab, reservelen);
 	tcurrent = tstart + reservelen;
+	offsetbase = tcurrent;
+
+	offsettable = isc_mem_get(mctx, mcount * sizeof(unsigned int));
+	if (offsettable == NULL) {
+		isc_mem_put(mctx, tstart, tlength);
+		return (ISC_R_NOMEMORY);
+	}
+	memset(offsettable, 0, mcount * sizeof(unsigned int));
 
 	/*
 	 * Write the new count.
@@ -608,14 +788,19 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 	*tcurrent++ = (tcount & 0xff00) >> 8;
 	*tcurrent++ = (tcount & 0x00ff);
 
+	tcurrent += (4 * tcount);
+
 	/*
 	 * Copy the parts of mslab not in sslab.
 	 */
 	mcurrent = mslab + reservelen;
 	mcount = *mcurrent++ * 256;
 	mcount += *mcurrent++;
-	do {
+	mcurrent += (4 * mcount);
+	for (i = 0; i < mcount; i++) {
 		unsigned char *mrdatabegin = mcurrent;
+		order = mcurrent[2] * 256 + mcurrent[3];
+		INSIST(order < mcount);
 		rdata_from_slab(&mcurrent, rdclass, type, &mrdata);
 		scurrent = sstart;
 		for (count = 0; count < scount; count++) {
@@ -630,12 +815,16 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 			 * copied to the tslab.
 			 */
 			unsigned int length = mcurrent - mrdatabegin;
+			offsettable[order] = tcurrent - offsetbase;
 			memcpy(tcurrent, mrdatabegin, length);
 			tcurrent += length;
 		}
 		dns_rdata_reset(&mrdata);
-		mcount--;
-	} while (mcount > 0);
+	}
+
+	fillin_offsets(offsetbase, offsettable, mcount);
+
+	isc_mem_put(mctx, offsettable, mcount * sizeof(unsigned int));
 
 	INSIST(tcurrent == tstart + tlength);
 
@@ -663,6 +852,9 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
 	if (count1 != count2)
 		return (ISC_FALSE);
 
+	current1 += (4 * count1);
+	current2 += (4 * count2);
+
 	while (count1 > 0) {
 		length1 = *current1++ * 256;
 		length1 += *current1++;
@@ -670,6 +862,9 @@ dns_rdataslab_equal(unsigned char *slab1, unsigned char *slab2,
 		length2 = *current2++ * 256;
 		length2 += *current2++;
 
+		current1 += 2;
+		current2 += 2;
+
 		if (length1 != length2 ||
 		    memcmp(current1, current2, length1) != 0)
 			return (ISC_FALSE);
@@ -703,6 +898,9 @@ dns_rdataslab_equalx(unsigned char *slab1, unsigned char *slab2,
 	if (count1 != count2)
 		return (ISC_FALSE);
 
+	current1 += (4 * count1);
+	current2 += (4 * count2);
+
 	while (count1-- > 0) {
 		rdata_from_slab(&current1, rdclass, type, &rdata1);
 		rdata_from_slab(&current2, rdclass, type, &rdata2);
diff --git a/contrib/bind9/lib/dns/request.c b/contrib/bind9/lib/dns/request.c
index c325fd4..be8f93d 100644
--- a/contrib/bind9/lib/dns/request.c
+++ b/contrib/bind9/lib/dns/request.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: request.c,v 1.64.2.1.10.9 2006/08/21 00:50:48 marka Exp $ */
+/* $Id: request.c,v 1.72.18.5 2006/08/21 00:40:53 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -91,10 +93,10 @@ struct dns_request {
 
 #define DNS_REQUEST_F_CONNECTING 0x0001
 #define DNS_REQUEST_F_SENDING 0x0002
-#define DNS_REQUEST_F_CANCELED 0x0004	/* ctlevent received, or otherwise
+#define DNS_REQUEST_F_CANCELED 0x0004	/*%< ctlevent received, or otherwise
 					   synchronously canceled */
-#define DNS_REQUEST_F_TIMEDOUT 0x0008	/* cancelled due to a timeout */
-#define DNS_REQUEST_F_TCP 0x0010	/* This request used TCP */
+#define DNS_REQUEST_F_TIMEDOUT 0x0008	/*%< cancelled due to a timeout */
+#define DNS_REQUEST_F_TCP 0x0010	/*%< This request used TCP */
 #define DNS_REQUEST_CANCELED(r) \
 	(((r)->flags & DNS_REQUEST_F_CANCELED) != 0)
 #define DNS_REQUEST_CONNECTING(r) \
diff --git a/contrib/bind9/lib/dns/resolver.c b/contrib/bind9/lib/dns/resolver.c
index a56fecf..7312841 100644
--- a/contrib/bind9/lib/dns/resolver.c
+++ b/contrib/bind9/lib/dns/resolver.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.218.2.18.4.64.4.2 2007/01/11 05:05:10 marka Exp $ */
+/* $Id: resolver.c,v 1.284.18.57 2007/02/14 23:41:01 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -99,12 +101,12 @@
 #define QTRACE(m)
 #endif
 
-/*
+/*%
  * Maximum EDNS0 input packet size.
  */
 #define RECV_BUFFER_SIZE		4096		/* XXXRTH  Constant. */
 
-/*
+/*%
  * This defines the maximum number of timeouts we will permit before we
  * disable EDNS0 on the query.
  */
@@ -146,13 +148,13 @@ typedef struct query {
 #define RESQUERY_SENDING(q)		((q)->sends > 0)
 
 typedef enum {
-	fetchstate_init = 0,		/* Start event has not run yet. */
+	fetchstate_init = 0,		/*%< Start event has not run yet. */
 	fetchstate_active,
-	fetchstate_done			/* FETCHDONE events posted. */
+	fetchstate_done			/*%< FETCHDONE events posted. */
 } fetchstate;
 
 struct fetchctx {
-	/* Not locked. */
+	/*% Not locked. */
 	unsigned int			magic;
 	dns_resolver_t *		res;
 	dns_name_t			name;
@@ -160,15 +162,16 @@ struct fetchctx {
 	unsigned int			options;
 	unsigned int			bucketnum;
 	char *				info;
-	/* Locked by appropriate bucket lock. */
+	/*% Locked by appropriate bucket lock. */
 	fetchstate			state;
 	isc_boolean_t			want_shutdown;
 	isc_boolean_t			cloned;
+	isc_boolean_t			spilled;
 	unsigned int			references;
 	isc_event_t			control_event;
 	ISC_LINK(struct fetchctx)	link;
 	ISC_LIST(dns_fetchevent_t)	events;
-	/* Locked by task event serialization. */
+	/*% Locked by task event serialization. */
 	dns_name_t			domain;
 	dns_rdataset_t			nameservers;
 	unsigned int			attributes;
@@ -187,16 +190,18 @@ struct fetchctx {
 	isc_sockaddrlist_t		forwarders;
 	dns_fwdpolicy_t			fwdpolicy;
 	isc_sockaddrlist_t		bad;
+	isc_sockaddrlist_t		edns;
+	isc_sockaddrlist_t		edns512;
 	ISC_LIST(dns_validator_t)	validators;
 	dns_db_t *			cache;
 	dns_adb_t *			adb;
 
-	/*
+	/*%
 	 * The number of events we're waiting for.
 	 */
 	unsigned int			pending;
 
-	/*
+	/*%
 	 * The number of times we've "restarted" the current
 	 * nameserver set.  This acts as a failsafe to prevent
 	 * us from pounding constantly on a particular set of
@@ -206,13 +211,13 @@ struct fetchctx {
 	 */
 	unsigned int			restarts;
 
-	/*
+	/*%
 	 * The number of timeouts that have occurred since we 
 	 * last successfully received a response packet.  This
 	 * is used for EDNS0 black hole detection.
 	 */
 	unsigned int			timeouts;
-	/*
+	/*%
 	 * Look aside state for DS lookups.
 	 */
 	dns_name_t 			nsname; 
@@ -270,6 +275,7 @@ typedef struct fctxbucket {
 	isc_mutex_t			lock;
 	ISC_LIST(fetchctx_t)		fctxs;
 	isc_boolean_t			exiting;
+	isc_mem_t *			mctx;
 } fctxbucket_t;
 
 typedef struct alternate {
@@ -314,12 +320,17 @@ struct dns_resolver {
 	isc_rwlock_t			mbslock;
 #endif
 	dns_rbt_t *			mustbesecure;
+	unsigned int			spillatmax;
+	unsigned int			spillatmin;
+	isc_timer_t *			spillattimer;
+	isc_boolean_t			zero_no_soa_ttl;
 	/* Locked by lock. */
 	unsigned int			references;
 	isc_boolean_t			exiting;
 	isc_eventlist_t			whenshutdown;
 	unsigned int			activebuckets;
 	isc_boolean_t			priming;
+	unsigned int			spillat;
 	/* Locked by primelock. */
 	dns_fetch_t *			primefetch;
 	/* Locked by nlock. */
@@ -329,7 +340,7 @@ struct dns_resolver {
 #define RES_MAGIC			ISC_MAGIC('R', 'e', 's', '!')
 #define VALID_RESOLVER(res)		ISC_MAGIC_VALID(res, RES_MAGIC)
 
-/*
+/*%
  * Private addrinfo flags.  These must not conflict with DNS_FETCHOPT_NOEDNS0,
  * which we also use as an addrinfo flag.
  */
@@ -368,7 +379,8 @@ valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
 	dns_valarg_t *valarg;
 	isc_result_t result;
 
-	valarg = isc_mem_get(fctx->res->mctx, sizeof(*valarg));
+	valarg = isc_mem_get(fctx->res->buckets[fctx->bucketnum].mctx,
+			     sizeof(*valarg));
 	if (valarg == NULL)
 		return (ISC_R_NOMEMORY);
 
@@ -385,7 +397,8 @@ valcreate(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, dns_name_t *name,
 	if (result == ISC_R_SUCCESS)
 		ISC_LIST_APPEND(fctx->validators, validator, link);
 	else
-		isc_mem_put(fctx->res->mctx, valarg, sizeof(*valarg));
+		isc_mem_put(fctx->res->buckets[fctx->bucketnum].mctx,
+			    valarg, sizeof(*valarg));
 	return (result);
 }
 
@@ -571,8 +584,7 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 			 * slow.  We don't know.  Increase the RTT.
 			 */
 			INSIST(no_response);
-			rtt = query->addrinfo->srtt +
-				(200000 * fctx->restarts);
+			rtt = query->addrinfo->srtt + 200000;
 			if (rtt > 10000000)
 				rtt = 10000000;
 			/*
@@ -755,6 +767,9 @@ static inline void
 fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 	dns_fetchevent_t *event, *next_event;
 	isc_task_t *task;
+	unsigned int count = 0;
+	isc_interval_t i;
+	isc_boolean_t logit = ISC_FALSE;
 
 	/*
 	 * Caller must be holding the appropriate bucket lock.
@@ -780,6 +795,31 @@ fctx_sendevents(fetchctx_t *fctx, isc_result_t result) {
 		       fctx->type == dns_rdatatype_sig);
 
 		isc_task_sendanddetach(&task, ISC_EVENT_PTR(&event));
+		count++;
+	}
+
+	if ((fctx->attributes & FCTX_ATTR_HAVEANSWER) != 0 &&
+	    fctx->spilled &&
+	    (count < fctx->res->spillatmax || fctx->res->spillatmax == 0)) {
+		LOCK(&fctx->res->lock);
+	    	if (count == fctx->res->spillat && !fctx->res->exiting) {
+			fctx->res->spillat += 5;
+			if (fctx->res->spillat > fctx->res->spillatmax &&
+			    fctx->res->spillatmax != 0)
+				fctx->res->spillat = fctx->res->spillatmax;
+			isc_interval_set(&i, 20 * 60, 0);
+			result = isc_timer_reset(fctx->res->spillattimer,
+						 isc_timertype_ticker, NULL,
+						 &i, ISC_TRUE);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			logit = ISC_TRUE;
+		}
+		UNLOCK(&fctx->res->lock);
+		if (logit)
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+				      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
+				      "clients-per-query increased to %u",
+				      count + 1);
 	}
 }
 
@@ -884,7 +924,8 @@ resquery_senddone(isc_task_t *task, isc_event_t *event) {
 }
 
 static inline isc_result_t
-fctx_addopt(dns_message_t *message, dns_resolver_t *res) {
+fctx_addopt(dns_message_t *message, unsigned int version, isc_uint16_t udpsize)
+{ 
 	dns_rdataset_t *rdataset;
 	dns_rdatalist_t *rdatalist;
 	dns_rdata_t *rdata;
@@ -910,12 +951,13 @@ fctx_addopt(dns_message_t *message, dns_resolver_t *res) {
 	/*
 	 * Set Maximum UDP buffer size.
 	 */
-	rdatalist->rdclass = res->udpsize;
+	rdatalist->rdclass = udpsize;
 
 	/*
-	 * Set EXTENDED-RCODE, VERSION, and Z to 0, and the DO bit to 1.
+	 * Set EXTENDED-RCODE and Z to 0, DO to 1.
 	 */
-	rdatalist->ttl = DNS_MESSAGEEXTFLAG_DO;
+	rdatalist->ttl = (version << 16);
+	rdatalist->ttl |= DNS_MESSAGEEXTFLAG_DO;
 
 	/*
 	 * No EDNS options.
@@ -936,34 +978,37 @@ fctx_addopt(dns_message_t *message, dns_resolver_t *res) {
 static inline void
 fctx_setretryinterval(fetchctx_t *fctx, unsigned int rtt) {
 	unsigned int seconds;
+	unsigned int us;
 
 	/*
-	 * We retry every 2 seconds the first two times through the address
+	 * We retry every .5 seconds the first two times through the address
 	 * list, and then we do exponential back-off.
 	 */
 	if (fctx->restarts < 3)
-		seconds = 2;
+		us = 500000;
 	else
-		seconds = (2 << (fctx->restarts - 1));
+		us = (500000 << (fctx->restarts - 2));
 
 	/*
-	 * Double the round-trip time and convert to seconds.
+	 * Double the round-trip time.
 	 */
-	rtt /= 500000;
+	rtt *= 2;
 
 	/*
 	 * Always wait for at least the doubled round-trip time.
 	 */
-	if (seconds < rtt)
-		seconds = rtt;
+	if (us < rtt)
+		us = rtt;
 
 	/*
-	 * But don't ever wait for more than 30 seconds.
+	 * But don't ever wait for more than 10 seconds.
 	 */
-	if (seconds > 30)
-		seconds = 30;
+	if (us > 10000000)
+		us = 10000000;
 
-	isc_interval_set(&fctx->interval, seconds, 0);
+	seconds = us / 1000000;
+	us -= seconds * 1000000;
+	isc_interval_set(&fctx->interval, seconds, us * 1000);
 }
 
 static isc_result_t
@@ -974,6 +1019,8 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	isc_task_t *task;
 	isc_result_t result;
 	resquery_t *query;
+	isc_sockaddr_t addr;
+	isc_boolean_t have_addr = ISC_FALSE;
 
 	FCTXTRACE("query");
 
@@ -989,12 +1036,13 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 
 	dns_message_reset(fctx->rmessage, DNS_MESSAGE_INTENTPARSE);
 
-	query = isc_mem_get(res->mctx, sizeof(*query));
+	query = isc_mem_get(res->buckets[fctx->bucketnum].mctx,
+			    sizeof(*query));
 	if (query == NULL) {
 		result = ISC_R_NOMEMORY;
 		goto stop_idle_timer;
 	}
-	query->mctx = res->mctx;
+	query->mctx = res->buckets[fctx->bucketnum].mctx;
 	query->options = options;
 	query->attributes = 0;
 	query->sends = 0;
@@ -1014,28 +1062,42 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	query->dispatchmgr = res->dispatchmgr;
 	query->dispatch = NULL;
 	query->tcpsocket = NULL;
+	if (res->view->peers != NULL) {
+		dns_peer_t *peer = NULL;
+		isc_netaddr_t dstip;
+		isc_netaddr_fromsockaddr(&dstip, &addrinfo->sockaddr);
+		result = dns_peerlist_peerbyaddr(res->view->peers,
+					         &dstip, &peer);
+		if (result == ISC_R_SUCCESS) {
+			result = dns_peer_getquerysource(peer, &addr);
+			if (result == ISC_R_SUCCESS)
+				have_addr = ISC_TRUE;
+		}
+	}
+
 	if ((query->options & DNS_FETCHOPT_TCP) != 0) {
-		isc_sockaddr_t addr;
 		int pf;
 
 		pf = isc_sockaddr_pf(&addrinfo->sockaddr);
-
-		switch (pf) {
-		case PF_INET:
-			result = dns_dispatch_getlocaladdress(res->dispatchv4,
-							      &addr);
-			break;
-		case PF_INET6:
-			result = dns_dispatch_getlocaladdress(res->dispatchv6,
-							      &addr);
-			break;
-		default:
-			result = ISC_R_NOTIMPLEMENTED;
-			break;
+		if (!have_addr) {
+			switch (pf) {
+			case PF_INET:
+				result =
+				  dns_dispatch_getlocaladdress(res->dispatchv4,
+							       &addr);
+				break;
+			case PF_INET6:
+				result =
+				  dns_dispatch_getlocaladdress(res->dispatchv6,
+							       &addr);
+				break;
+			default:
+				result = ISC_R_NOTIMPLEMENTED;
+				break;
+			}
+			if (result != ISC_R_SUCCESS)
+				goto cleanup_query;
 		}
-		if (result != ISC_R_SUCCESS)
-			goto cleanup_query;
-
 		isc_sockaddr_setport(&addr, 0);
 
 		result = isc_socket_create(res->socketmgr, pf,
@@ -1054,16 +1116,46 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 		 * A dispatch will be created once the connect succeeds.
 		 */
 	} else {
-		switch (isc_sockaddr_pf(&addrinfo->sockaddr)) {
-		case PF_INET:
-			dns_dispatch_attach(res->dispatchv4, &query->dispatch);
-			break;
-		case PF_INET6:
-			dns_dispatch_attach(res->dispatchv6, &query->dispatch);
-			break;
-		default:
-			result = ISC_R_NOTIMPLEMENTED;
-			goto cleanup_query;
+		if (have_addr) {
+			unsigned int attrs, attrmask;
+			attrs = DNS_DISPATCHATTR_UDP;
+			switch (isc_sockaddr_pf(&addr)) {
+			case AF_INET:
+				attrs |= DNS_DISPATCHATTR_IPV4;
+				break;
+			case AF_INET6:
+				attrs |= DNS_DISPATCHATTR_IPV6;
+				break;
+			default:
+				result = ISC_R_NOTIMPLEMENTED;
+				goto cleanup_query;
+			}
+			attrmask = DNS_DISPATCHATTR_UDP;
+			attrmask |= DNS_DISPATCHATTR_TCP;
+			attrmask |= DNS_DISPATCHATTR_IPV4;
+			attrmask |= DNS_DISPATCHATTR_IPV6;
+			result = dns_dispatch_getudp(res->dispatchmgr,
+						     res->socketmgr,
+						     res->taskmgr, &addr,
+						     4096, 1000, 32768, 16411,
+						     16433, attrs, attrmask,
+						     &query->dispatch);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup_query;
+		} else {
+			switch (isc_sockaddr_pf(&addrinfo->sockaddr)) {
+			case PF_INET:
+				dns_dispatch_attach(res->dispatchv4,
+						    &query->dispatch);
+				break;
+			case PF_INET6:
+				dns_dispatch_attach(res->dispatchv6,
+						    &query->dispatch);
+				break;
+			default:
+				result = ISC_R_NOTIMPLEMENTED;
+				goto cleanup_query;
+			}
 		}
 		/*
 		 * We should always have a valid dispatcher here.  If we
@@ -1115,7 +1207,8 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 
  cleanup_query:
 	query->magic = 0;
-	isc_mem_put(res->mctx, query, sizeof(*query));
+	isc_mem_put(res->buckets[fctx->bucketnum].mctx,
+		    query, sizeof(*query));
 
  stop_idle_timer:
 	RUNTIME_CHECK(fctx_stopidletimer(fctx) == ISC_R_SUCCESS);
@@ -1123,6 +1216,66 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	return (result);
 }
 
+static isc_boolean_t
+triededns(fetchctx_t *fctx, isc_sockaddr_t *address) {
+	isc_sockaddr_t *sa;
+
+	for (sa = ISC_LIST_HEAD(fctx->edns);
+	     sa != NULL;
+	     sa = ISC_LIST_NEXT(sa, link)) {
+		if (isc_sockaddr_equal(sa, address))
+			return (ISC_TRUE);
+	}
+
+	return (ISC_FALSE);
+}
+
+static void
+add_triededns(fetchctx_t *fctx, isc_sockaddr_t *address) {
+	isc_sockaddr_t *sa;
+
+	if (triededns(fctx, address))
+		return;
+
+	sa = isc_mem_get(fctx->res->buckets[fctx->bucketnum].mctx,
+			 sizeof(*sa));
+	if (sa == NULL)
+		return;
+
+	*sa = *address;
+	ISC_LIST_INITANDAPPEND(fctx->edns, sa, link);
+}
+
+static isc_boolean_t
+triededns512(fetchctx_t *fctx, isc_sockaddr_t *address) {
+	isc_sockaddr_t *sa;
+
+	for (sa = ISC_LIST_HEAD(fctx->edns512);
+	     sa != NULL;
+	     sa = ISC_LIST_NEXT(sa, link)) {
+		if (isc_sockaddr_equal(sa, address))
+			return (ISC_TRUE);
+	}
+
+	return (ISC_FALSE);
+}
+
+static void
+add_triededns512(fetchctx_t *fctx, isc_sockaddr_t *address) {
+	isc_sockaddr_t *sa;
+
+	if (triededns512(fctx, address))
+		return;
+
+	sa = isc_mem_get(fctx->res->buckets[fctx->bucketnum].mctx,
+			 sizeof(*sa));
+	if (sa == NULL)
+		return;
+
+	*sa = *address;
+	ISC_LIST_INITANDAPPEND(fctx->edns512, sa, link);
+}
+
 static isc_result_t
 resquery_send(resquery_t *query) {
 	fetchctx_t *fctx;
@@ -1211,7 +1364,9 @@ resquery_send(resquery_t *query) {
 	 * Set CD if the client says don't validate or the question is
 	 * under a secure entry point.
 	 */
-	if ((query->options & DNS_FETCHOPT_NOVALIDATE) == 0) {
+	if ((query->options & DNS_FETCHOPT_NOVALIDATE) != 0) {
+		fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
+	} else if (res->view->enablevalidation) {
 		result = dns_keytable_issecuredomain(res->view->secroots,
 						     &fctx->name,
 						     &secure_domain);
@@ -1221,8 +1376,7 @@ resquery_send(resquery_t *query) {
 			secure_domain = ISC_TRUE;
 		if (secure_domain)
 			fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
-	} else
-		fctx->qmessage->flags |= DNS_MESSAGEFLAG_CD;
+	}
 
 	/*
 	 * We don't have to set opcode because it defaults to query.
@@ -1271,15 +1425,35 @@ resquery_send(resquery_t *query) {
 	 * Use EDNS0, unless the caller doesn't want it, or we know that
 	 * the remote server doesn't like it.
 	 */
-	if (fctx->timeouts >= MAX_EDNS0_TIMEOUTS &&
+
+	if ((triededns512(fctx, &query->addrinfo->sockaddr) ||
+	     fctx->timeouts >= (MAX_EDNS0_TIMEOUTS * 2)) &&
 	    (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 		query->options |= DNS_FETCHOPT_NOEDNS0;
 		FCTXTRACE("too many timeouts, disabling EDNS0");
+	} else if ((triededns(fctx, &query->addrinfo->sockaddr) ||
+		    fctx->timeouts >= MAX_EDNS0_TIMEOUTS) &&
+	           (query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
+		query->options |= DNS_FETCHOPT_EDNS512;
+		FCTXTRACE("too many timeouts, setting EDNS size to 512");
 	}
 
 	if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0) {
 		if ((query->addrinfo->flags & DNS_FETCHOPT_NOEDNS0) == 0) {
-			result = fctx_addopt(fctx->qmessage, res);
+			unsigned int version = 0;	/* Default version. */
+			unsigned int flags;
+			isc_uint16_t udpsize = res->udpsize;
+
+			flags = query->addrinfo->flags;
+			if ((flags & DNS_FETCHOPT_EDNSVERSIONSET) != 0) {
+				version = flags & DNS_FETCHOPT_EDNSVERSIONMASK;
+				version >>= DNS_FETCHOPT_EDNSVERSIONSHIFT;
+			}
+			if ((query->options & DNS_FETCHOPT_EDNS512) != 0)
+				udpsize = 512;
+			else if (peer != NULL)
+				(void)dns_peer_getudpsize(peer, &udpsize);
+			result = fctx_addopt(fctx->qmessage, version, udpsize);
 			if (result != ISC_R_SUCCESS) {
 				/*
 				 * We couldn't add the OPT, but we'll press on.
@@ -1306,6 +1480,12 @@ resquery_send(resquery_t *query) {
 		goto cleanup_message;
 	}
 
+	if ((query->options & DNS_FETCHOPT_NOEDNS0) == 0)
+		add_triededns(fctx, &query->addrinfo->sockaddr);
+
+	if ((query->options & DNS_FETCHOPT_EDNS512) != 0)
+		add_triededns512(fctx, &query->addrinfo->sockaddr);
+
 	/*
 	 * Clear CD if EDNS is not in use.
 	 */
@@ -1680,7 +1860,8 @@ add_bad(fetchctx_t *fctx, isc_sockaddr_t *address, isc_result_t reason) {
 
 	FCTXTRACE("add_bad");
 
-	sa = isc_mem_get(fctx->res->mctx, sizeof(*sa));
+	sa = isc_mem_get(fctx->res->buckets[fctx->bucketnum].mctx,
+			 sizeof(*sa));
 	if (sa == NULL)
 		return;
 	*sa = *address;
@@ -1795,7 +1976,7 @@ sort_finds(fetchctx_t *fctx) {
 static void
 findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port,
 	 unsigned int options, unsigned int flags, isc_stdtime_t now,
-	 isc_boolean_t *pruned, isc_boolean_t *need_alternate)
+	 isc_boolean_t *need_alternate)
 {
 	dns_adbaddrinfo_t *ai;
 	dns_adbfind_t *find;
@@ -1824,7 +2005,8 @@ findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port,
 	result = dns_adb_createfind(fctx->adb,
 				    res->buckets[fctx->bucketnum].task,
 				    fctx_finddone, fctx, name,
-				    &fctx->domain, options, now, NULL,
+				    &fctx->name, fctx->type,
+				    options, now, NULL,
 				    res->view->dstport, &find);
 	if (result != ISC_R_SUCCESS) {
 		if (result == DNS_R_ALIAS) {
@@ -1887,18 +2069,6 @@ findname(fetchctx_t *fctx, dns_name_t *name, in_port_t port,
 			     (res->dispatchv6 == NULL &&
 			      find->result_v4 == DNS_R_NXRRSET)))
 				*need_alternate = ISC_TRUE;
-			/*
-			 * And ADB isn't going to send us any events
-			 * either.  This find loses.
-			 */
-			if ((find->options & DNS_ADBFIND_LAMEPRUNED) != 0) {
-				/*
-				 * The ADB pruned lame servers for
-				 * this name.  Remember that in case
-				 * we get desperate later on.
-				 */
-				*pruned = ISC_TRUE;
-			}
 			dns_adb_destroyfind(&find);
 		}
 	}
@@ -1913,7 +2083,7 @@ fctx_getaddresses(fetchctx_t *fctx) {
 	unsigned int stdoptions;
 	isc_sockaddr_t *sa;
 	dns_adbaddrinfo_t *ai;
-	isc_boolean_t pruned, all_bad;
+	isc_boolean_t all_bad;
 	dns_rdata_ns_t ns;
 	isc_boolean_t need_alternate = ISC_FALSE;
 
@@ -1929,7 +2099,6 @@ fctx_getaddresses(fetchctx_t *fctx) {
 	}
 
 	res = fctx->res;
-	pruned = ISC_FALSE;
 	stdoptions = 0;		/* Keep compiler happy. */
 
 	/*
@@ -2021,7 +2190,6 @@ fctx_getaddresses(fetchctx_t *fctx) {
 		stdoptions |= DNS_ADBFIND_INET6;
 	isc_stdtime_get(&now);
 
- restart:
 	INSIST(ISC_LIST_EMPTY(fctx->finds));
 	INSIST(ISC_LIST_EMPTY(fctx->altfinds));
 
@@ -2038,7 +2206,7 @@ fctx_getaddresses(fetchctx_t *fctx) {
 			continue;
 
 		findname(fctx, &ns.name, 0, stdoptions, 0, now,
-			 &pruned, &need_alternate);
+			 &need_alternate);
 		dns_rdata_reset(&rdata);
 		dns_rdata_freestruct(&ns);
 	}
@@ -2058,7 +2226,7 @@ fctx_getaddresses(fetchctx_t *fctx) {
 			if (!a->isaddress) {
 				findname(fctx, &a->_u._n.name, a->_u._n.port,
 					 stdoptions, FCTX_ADDRINFO_FORWARDER,
-					 now, &pruned, NULL);
+					 now, NULL);
 				continue;
 			}
 			if (isc_sockaddr_pf(&a->_u.addr) != family)
@@ -2101,18 +2269,6 @@ fctx_getaddresses(fetchctx_t *fctx) {
 			 * yet.   Tell the caller to wait for an answer.
 			 */
 			result = DNS_R_WAIT;
-		} else if (pruned) {
-			/*
-			 * Some addresses were removed by lame pruning.
-			 * Turn pruning off and try again.
-			 */
-			FCTXTRACE("restarting with returnlame");
-			INSIST((stdoptions & DNS_ADBFIND_RETURNLAME) == 0);
-			stdoptions |= DNS_ADBFIND_RETURNLAME;
-			pruned = ISC_FALSE;
-			fctx_cleanupaltfinds(fctx);
-			fctx_cleanupfinds(fctx);
-			goto restart;
 		} else {
 			/*
 			 * We've lost completely.  We don't know any
@@ -2427,21 +2583,37 @@ fctx_destroy(fetchctx_t *fctx) {
 	     sa = next_sa) {
 		next_sa = ISC_LIST_NEXT(sa, link);
 		ISC_LIST_UNLINK(fctx->bad, sa, link);
-		isc_mem_put(res->mctx, sa, sizeof(*sa));
+		isc_mem_put(res->buckets[bucketnum].mctx, sa, sizeof(*sa));
+	}
+
+	for (sa = ISC_LIST_HEAD(fctx->edns);
+	     sa != NULL;
+	     sa = next_sa) {
+		next_sa = ISC_LIST_NEXT(sa, link);
+		ISC_LIST_UNLINK(fctx->edns, sa, link);
+		isc_mem_put(res->buckets[bucketnum].mctx, sa, sizeof(*sa));
+	}
+
+	for (sa = ISC_LIST_HEAD(fctx->edns512);
+	     sa != NULL;
+	     sa = next_sa) {
+		next_sa = ISC_LIST_NEXT(sa, link);
+		ISC_LIST_UNLINK(fctx->edns512, sa, link);
+		isc_mem_put(res->buckets[bucketnum].mctx, sa, sizeof(*sa));
 	}
 
 	isc_timer_detach(&fctx->timer);
 	dns_message_destroy(&fctx->rmessage);
 	dns_message_destroy(&fctx->qmessage);
 	if (dns_name_countlabels(&fctx->domain) > 0)
-		dns_name_free(&fctx->domain, res->mctx);
+		dns_name_free(&fctx->domain, res->buckets[bucketnum].mctx);
 	if (dns_rdataset_isassociated(&fctx->nameservers))
 		dns_rdataset_disassociate(&fctx->nameservers);
-	dns_name_free(&fctx->name, res->mctx);
+	dns_name_free(&fctx->name, res->buckets[bucketnum].mctx);
 	dns_db_detach(&fctx->cache);
 	dns_adb_detach(&fctx->adb);
-	isc_mem_free(res->mctx, fctx->info);
-	isc_mem_put(res->mctx, fctx, sizeof(*fctx));
+	isc_mem_free(res->buckets[bucketnum].mctx, fctx->info);
+	isc_mem_put(res->buckets[bucketnum].mctx, fctx, sizeof(*fctx));
 
 	LOCK(&res->nlock);
 	res->nfctx--;
@@ -2670,8 +2842,9 @@ fctx_start(isc_task_t *task, isc_event_t *event) {
  */
 
 static inline isc_result_t
-fctx_join(fetchctx_t *fctx, isc_task_t *task, isc_taskaction_t action,
-	  void *arg, dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
+fctx_join(fetchctx_t *fctx, isc_task_t *task, isc_sockaddr_t *client,
+	  dns_messageid_t id, isc_taskaction_t action, void *arg,
+	  dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset,
 	  dns_fetch_t *fetch)
 {
 	isc_task_t *clone;
@@ -2687,8 +2860,7 @@ fctx_join(fetchctx_t *fctx, isc_task_t *task, isc_taskaction_t action,
 	clone = NULL;
 	isc_task_attach(task, &clone);
 	event = (dns_fetchevent_t *)
-		isc_event_allocate(fctx->res->mctx, clone,
-				   DNS_EVENT_FETCHDONE,
+		isc_event_allocate(fctx->res->mctx, clone, DNS_EVENT_FETCHDONE,
 				   action, arg, sizeof(*event));
 	if (event == NULL) {
 		isc_task_detach(&clone);
@@ -2701,6 +2873,8 @@ fctx_join(fetchctx_t *fctx, isc_task_t *task, isc_taskaction_t action,
 	event->rdataset = rdataset;
 	event->sigrdataset = sigrdataset;
 	event->fetch = fetch;
+	event->client = client;
+	event->id = id;
 	dns_fixedname_init(&event->foundname);
 
 	/*
@@ -2739,21 +2913,21 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	 */
 	REQUIRE(fctxp != NULL && *fctxp == NULL);
 
-	fctx = isc_mem_get(res->mctx, sizeof(*fctx));
+	fctx = isc_mem_get(res->buckets[bucketnum].mctx, sizeof(*fctx));
 	if (fctx == NULL)
 		return (ISC_R_NOMEMORY);
 	dns_name_format(name, buf, sizeof(buf));
 	dns_rdatatype_format(type, typebuf, sizeof(typebuf));
 	strcat(buf, "/");	/* checked */
 	strcat(buf, typebuf);	/* checked */
-	fctx->info = isc_mem_strdup(res->mctx, buf);
+	fctx->info = isc_mem_strdup(res->buckets[bucketnum].mctx, buf);
 	if (fctx->info == NULL) {
 		result = ISC_R_NOMEMORY;
 		goto cleanup_fetch;
 	}
 	FCTXTRACE("create");
 	dns_name_init(&fctx->name, NULL);
-	result = dns_name_dup(name, res->mctx, &fctx->name);
+	result = dns_name_dup(name, res->buckets[bucketnum].mctx, &fctx->name);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_info;
 	dns_name_init(&fctx->domain, NULL);
@@ -2780,6 +2954,8 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	ISC_LIST_INIT(fctx->forwarders);
 	fctx->fwdpolicy = dns_fwdpolicy_none;
 	ISC_LIST_INIT(fctx->bad);
+	ISC_LIST_INIT(fctx->edns);
+	ISC_LIST_INIT(fctx->edns512);
 	ISC_LIST_INIT(fctx->validators);
 	fctx->find = NULL;
 	fctx->altfind = NULL;
@@ -2787,6 +2963,7 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	fctx->restarts = 0;
 	fctx->timeouts = 0;
 	fctx->attributes = 0;
+	fctx->spilled = ISC_FALSE;
 	fctx->nqueries = 0;
 
 	dns_name_init(&fctx->nsname, NULL);
@@ -2829,7 +3006,9 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 						      NULL);
 			if (result != ISC_R_SUCCESS)
 				goto cleanup_name;
-			result = dns_name_dup(domain, res->mctx, &fctx->domain);
+			result = dns_name_dup(domain,
+					      res->buckets[bucketnum].mctx,
+					      &fctx->domain);
 			if (result != ISC_R_SUCCESS) {
 				dns_rdataset_disassociate(&fctx->nameservers);
 				goto cleanup_name;
@@ -2838,12 +3017,16 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 			/*
 			 * We're in forward-only mode.  Set the query domain.
 			 */
-			result = dns_name_dup(domain, res->mctx, &fctx->domain);
+			result = dns_name_dup(domain,
+					      res->buckets[bucketnum].mctx,
+					      &fctx->domain);
 			if (result != ISC_R_SUCCESS)
 				goto cleanup_name;
 		}
 	} else {
-		result = dns_name_dup(domain, res->mctx, &fctx->domain);
+		result = dns_name_dup(domain,
+				      res->buckets[bucketnum].mctx,
+				      &fctx->domain);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup_name;
 		dns_rdataset_clone(nameservers, &fctx->nameservers);
@@ -2852,14 +3035,16 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	INSIST(dns_name_issubdomain(&fctx->name, &fctx->domain));
 
 	fctx->qmessage = NULL;
-	result = dns_message_create(res->mctx, DNS_MESSAGE_INTENTRENDER,
+	result = dns_message_create(res->buckets[bucketnum].mctx,
+				    DNS_MESSAGE_INTENTRENDER,
 				    &fctx->qmessage);
 
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_domain;
 
 	fctx->rmessage = NULL;
-	result = dns_message_create(res->mctx, DNS_MESSAGE_INTENTPARSE,
+	result = dns_message_create(res->buckets[bucketnum].mctx,
+				    DNS_MESSAGE_INTENTPARSE,
 				    &fctx->rmessage);
 
 	if (result != ISC_R_SUCCESS)
@@ -2932,18 +3117,18 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 
  cleanup_domain:
 	if (dns_name_countlabels(&fctx->domain) > 0)
-		dns_name_free(&fctx->domain, res->mctx);
+		dns_name_free(&fctx->domain, res->buckets[bucketnum].mctx);
 	if (dns_rdataset_isassociated(&fctx->nameservers))
 		dns_rdataset_disassociate(&fctx->nameservers);
 
  cleanup_name:
-	dns_name_free(&fctx->name, res->mctx);
+	dns_name_free(&fctx->name, res->buckets[bucketnum].mctx);
 
  cleanup_info:
-	isc_mem_free(res->mctx, fctx->info);
+	isc_mem_free(res->buckets[bucketnum].mctx, fctx->info);
 
  cleanup_fetch:
-	isc_mem_put(res->mctx, fctx, sizeof(*fctx));
+	isc_mem_put(res->buckets[bucketnum].mctx, fctx, sizeof(*fctx));
 
 	return (result);
 }
@@ -3180,7 +3365,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 	 * destroy the fctx if necessary.
 	 */
 	dns_validator_destroy(&vevent->validator);
-	isc_mem_put(fctx->res->mctx, valarg, sizeof(*valarg));
+	isc_mem_put(fctx->res->buckets[fctx->bucketnum].mctx,
+		    valarg, sizeof(*valarg));
 
 	negative = ISC_TF(vevent->rdataset == NULL);
 
@@ -3290,7 +3476,8 @@ validated(isc_task_t *task, isc_event_t *event) {
 		 */
 		ttl = fctx->res->view->maxncachettl;
 		if (fctx->type == dns_rdatatype_soa &&
-		    covers == dns_rdatatype_any)
+		    covers == dns_rdatatype_any &&
+		    fctx->res->zero_no_soa_ttl)
 			ttl = 0;
 
 		result = ncache_adderesult(fctx->rmessage, fctx->cache, node,
@@ -3471,14 +3658,16 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 	/*
 	 * Is DNSSEC validation required for this name?
 	 */
-	result = dns_keytable_issecuredomain(res->view->secroots, name,
-					     &secure_domain);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	if (res->view->enablevalidation) {
+		result = dns_keytable_issecuredomain(res->view->secroots, name,
+						     &secure_domain);
+		if (result != ISC_R_SUCCESS)
+			return (result);
 
-	if (!secure_domain && res->view->dlv != NULL) {
-		valoptions = DNS_VALIDATOR_DLV;
-		secure_domain = ISC_TRUE;
+		if (!secure_domain && res->view->dlv != NULL) {
+			valoptions = DNS_VALIDATOR_DLV;
+			secure_domain = ISC_TRUE;
+		}
 	}
 
 	if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)
@@ -3899,14 +4088,16 @@ ncache_message(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 	/*
 	 * Is DNSSEC validation required for this name?
 	 */
-	result = dns_keytable_issecuredomain(res->view->secroots, name,
-					     &secure_domain);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	if (fctx->res->view->enablevalidation) {
+		result = dns_keytable_issecuredomain(res->view->secroots, name,
+						     &secure_domain);
+		if (result != ISC_R_SUCCESS)
+			return (result);
 
-	if (!secure_domain && res->view->dlv != NULL) {
-		valoptions = DNS_VALIDATOR_DLV;
-		secure_domain = ISC_TRUE;
+		if (!secure_domain && res->view->dlv != NULL) {
+			valoptions = DNS_VALIDATOR_DLV;
+			secure_domain = ISC_TRUE;
+		}
 	}
 
 	if ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0)
@@ -4211,7 +4402,7 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 	dns_message_t *message;
 	dns_name_t *name, *qname, *ns_name, *soa_name, *ds_name;
 	dns_rdataset_t *rdataset, *ns_rdataset;
-	isc_boolean_t done, aa, negative_response;
+	isc_boolean_t aa, negative_response;
 	dns_rdatatype_t type;
 	dns_section_t section =
 		bind8_ns_resp ? DNS_SECTION_ANSWER : DNS_SECTION_AUTHORITY;
@@ -4270,13 +4461,12 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 	/*
 	 * Process the authority section.
 	 */
-	done = ISC_FALSE;
 	ns_name = NULL;
 	ns_rdataset = NULL;
 	soa_name = NULL;
 	ds_name = NULL;
 	result = dns_message_firstname(message, section);
-	while (!done && result == ISC_R_SUCCESS) {
+	while (result == ISC_R_SUCCESS) {
 		name = NULL;
 		dns_message_currentname(message, section, &name);
 		if (dns_name_issubdomain(name, &fctx->domain)) {
@@ -4338,15 +4528,29 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 							dns_trust_additional;
 				}
 			}
-			/*
-			 * A negative response has a SOA record (Type 2) 
-			 * and a optional NS RRset (Type 1) or it has neither
-			 * a SOA or a NS RRset (Type 3, handled above) or
-			 * rcode is NXDOMAIN (handled above) in which case
-			 * the NS RRset is allowed (Type 4).
-			 */
-			if (soa_name != NULL)
-				negative_response = ISC_TRUE;
+		}
+		result = dns_message_nextname(message, section);
+		if (result == ISC_R_NOMORE)
+			break;
+		else if (result != ISC_R_SUCCESS)
+			return (result);
+	}
+
+	/*
+	 * A negative response has a SOA record (Type 2) 
+	 * and a optional NS RRset (Type 1) or it has neither
+	 * a SOA or a NS RRset (Type 3, handled above) or
+	 * rcode is NXDOMAIN (handled above) in which case
+	 * the NS RRset is allowed (Type 4).
+	 */
+	if (soa_name != NULL)
+		negative_response = ISC_TRUE;
+
+	result = dns_message_firstname(message, section);
+	while (result == ISC_R_SUCCESS) {
+		name = NULL;
+		dns_message_currentname(message, section, &name);
+		if (dns_name_issubdomain(name, &fctx->domain)) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
 			     rdataset = ISC_LIST_NEXT(rdataset, link)) {
@@ -4501,11 +4705,14 @@ noanswer_response(fetchctx_t *fctx, dns_name_t *oqname,
 		 *	   if so we should bail out.
 		 */
 		INSIST(dns_name_countlabels(&fctx->domain) > 0);
-		dns_name_free(&fctx->domain, fctx->res->mctx);
+		dns_name_free(&fctx->domain,
+			      fctx->res->buckets[fctx->bucketnum].mctx);
 		if (dns_rdataset_isassociated(&fctx->nameservers))
 			dns_rdataset_disassociate(&fctx->nameservers);
 		dns_name_init(&fctx->domain, NULL);
-		result = dns_name_dup(ns_name, fctx->res->mctx, &fctx->domain);
+		result = dns_name_dup(ns_name,
+				      fctx->res->buckets[fctx->bucketnum].mctx,
+				      &fctx->domain);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		fctx->attributes |= FCTX_ATTR_WANTCACHE;
@@ -4960,9 +5167,11 @@ resume_dslookup(isc_task_t *task, isc_event_t *event) {
 		if (dns_rdataset_isassociated(&fctx->nameservers))
 			dns_rdataset_disassociate(&fctx->nameservers);
 		dns_rdataset_clone(fevent->rdataset, &fctx->nameservers);
-		dns_name_free(&fctx->domain, fctx->res->mctx);
+		dns_name_free(&fctx->domain,
+			      fctx->res->buckets[bucketnum].mctx);
 		dns_name_init(&fctx->domain, NULL);
-		result = dns_name_dup(&fctx->nsname, fctx->res->mctx,
+		result = dns_name_dup(&fctx->nsname,
+				      fctx->res->buckets[bucketnum].mctx,
 				      &fctx->domain);
 		if (result != ISC_R_SUCCESS) {
 			fctx_done(fctx, DNS_R_SERVFAIL);
@@ -5386,6 +5595,28 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 			 * for this fetch.
 			 */
 			result = DNS_R_YXDOMAIN;
+		} else if (message->rcode == dns_rcode_badvers) {
+			dns_rdataset_t *opt;
+			unsigned int flags, mask;
+			unsigned int version;
+
+			resend = ISC_TRUE;
+			opt = dns_message_getopt(message);
+			version = (opt->ttl >> 16) & 0xff;
+			flags = (version << DNS_FETCHOPT_EDNSVERSIONSHIFT) |
+				DNS_FETCHOPT_EDNSVERSIONSET;
+			mask = DNS_FETCHOPT_EDNSVERSIONMASK |
+			       DNS_FETCHOPT_EDNSVERSIONSET;
+			switch (version) {
+			case 0:
+				dns_adb_changeflags(fctx->adb, query->addrinfo,
+						    flags, mask);
+				break;
+			default:
+				broken_server = DNS_R_BADVERS;
+				keep_trying = ISC_TRUE;
+				break;
+			}
 		} else {
 			/*
 			 * XXXRTH log.
@@ -5415,7 +5646,7 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 	    is_lame(fctx)) {
 		log_lame(fctx, query->addrinfo);
 		result = dns_adb_marklame(fctx->adb, query->addrinfo,
-					  &fctx->domain,
+					  &fctx->name, fctx->type,
 					  now + fctx->res->lame_ttl);
 		if (result != ISC_R_SUCCESS)
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
@@ -5637,9 +5868,11 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
 				fctx_done(fctx, DNS_R_SERVFAIL);
 				return;
 			}
-			dns_name_free(&fctx->domain, fctx->res->mctx);
+			dns_name_free(&fctx->domain,
+				      fctx->res->buckets[fctx->bucketnum].mctx);
 			dns_name_init(&fctx->domain, NULL);
-			result = dns_name_dup(fname, fctx->res->mctx,
+			result = dns_name_dup(fname,
+					      fctx->res->buckets[fctx->bucketnum].mctx,
 					      &fctx->domain);
 			if (result != ISC_R_SUCCESS) {
 				fctx_done(fctx, DNS_R_SERVFAIL);
@@ -5737,6 +5970,7 @@ destroy(dns_resolver_t *res) {
 		isc_task_shutdown(res->buckets[i].task);
 		isc_task_detach(&res->buckets[i].task);
 		DESTROYLOCK(&res->buckets[i].lock);
+		isc_mem_detach(&res->buckets[i].mctx);
 	}
 	isc_mem_put(res->mctx, res->buckets,
 		    res->nbuckets * sizeof(fctxbucket_t));
@@ -5758,6 +5992,7 @@ destroy(dns_resolver_t *res) {
 #if USE_MBSLOCK
 	isc_rwlock_destroy(&res->mbslock);
 #endif
+	isc_timer_detach(&res->spillattimer);
 	res->magic = 0;
 	isc_mem_put(res->mctx, res, sizeof(*res));
 }
@@ -5796,11 +6031,44 @@ empty_bucket(dns_resolver_t *res) {
 	UNLOCK(&res->lock);
 }
 
+static void
+spillattimer_countdown(isc_task_t *task, isc_event_t *event) {
+	dns_resolver_t *res = event->ev_arg;
+	isc_result_t result;
+	unsigned int count;
+	isc_boolean_t logit = ISC_FALSE;
+
+	REQUIRE(VALID_RESOLVER(res));
+
+	UNUSED(task);
+	
+	LOCK(&res->lock);
+	INSIST(!res->exiting);
+	if (res->spillat > res->spillatmin) {
+		res->spillat--;
+		logit = ISC_TRUE;
+	}
+	if (res->spillat <= res->spillatmin) {
+		result = isc_timer_reset(res->spillattimer,
+					 isc_timertype_inactive, NULL,
+					 NULL, ISC_TRUE);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	}
+	count = res->spillat;
+	UNLOCK(&res->lock);
+	if (logit)
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_NOTICE,
+			      "clients-per-query decreased to %u", count);
+
+	isc_event_free(&event);
+}
+
 isc_result_t
 dns_resolver_create(dns_view_t *view,
 		    isc_taskmgr_t *taskmgr, unsigned int ntasks,
 		    isc_socketmgr_t *socketmgr,
-		    isc_timermgr_t *timermgr,
+		    isc_timermgr_t *timermgr, 
 		    unsigned int options,
 		    dns_dispatchmgr_t *dispatchmgr,
 		    dns_dispatch_t *dispatchv4,
@@ -5810,6 +6078,7 @@ dns_resolver_create(dns_view_t *view,
 	dns_resolver_t *res;
 	isc_result_t result = ISC_R_SUCCESS;
 	unsigned int i, buckets_created = 0;
+	isc_task_t *task = NULL;
 	char name[16];
 
 	/*
@@ -5839,6 +6108,10 @@ dns_resolver_create(dns_view_t *view,
 	res->udpsize = RECV_BUFFER_SIZE;
 	res->algorithms = NULL;
 	res->mustbesecure = NULL;
+	res->spillatmin = res->spillat = 10;
+	res->spillatmax = 100;
+	res->spillattimer = NULL;
+	res->zero_no_soa_ttl = ISC_FALSE;
 
 	res->nbuckets = ntasks;
 	res->activebuckets = ntasks;
@@ -5858,6 +6131,13 @@ dns_resolver_create(dns_view_t *view,
 			DESTROYLOCK(&res->buckets[i].lock);
 			goto cleanup_buckets;
 		}
+		res->buckets[i].mctx = NULL;
+		result = isc_mem_create(0, 0, &res->buckets[i].mctx);
+		if (result != ISC_R_SUCCESS) {
+			isc_task_detach(&res->buckets[i].task);
+			DESTROYLOCK(&res->buckets[i].lock);
+			goto cleanup_buckets;
+		}
 		snprintf(name, sizeof(name), "res%u", i);
 		isc_task_setname(res->buckets[i].task, name, res);
 		ISC_LIST_INIT(res->buckets[i].fctxs);
@@ -5892,10 +6172,22 @@ dns_resolver_create(dns_view_t *view,
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_nlock;
 
+	task = NULL;
+	result = isc_task_create(taskmgr, 0, &task);
+	if (result != ISC_R_SUCCESS)
+		 goto cleanup_primelock;
+
+	result = isc_timer_create(timermgr, isc_timertype_inactive, NULL, NULL,
+				  task, spillattimer_countdown, res,
+				  &res->spillattimer);
+	isc_task_detach(&task);
+	if (result != ISC_R_SUCCESS)
+		 goto cleanup_primelock;
+
 #if USE_ALGLOCK
 	result = isc_rwlock_init(&res->alglock, 0, 0);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup_primelock;
+		goto cleanup_spillattimer;
 #endif
 #if USE_MBSLOCK
 	result = isc_rwlock_init(&res->mbslock, 0, 0);
@@ -5916,9 +6208,12 @@ dns_resolver_create(dns_view_t *view,
 #endif
 #endif
 #if USE_ALGLOCK || USE_MBSLOCK
+ cleanup_spillattimer:
+	isc_timer_detach(&res->spillattimer);
+#endif
+
  cleanup_primelock:
 	DESTROYLOCK(&res->primelock);
-#endif
 
  cleanup_nlock:
 	DESTROYLOCK(&res->nlock);
@@ -5934,6 +6229,7 @@ dns_resolver_create(dns_view_t *view,
 
  cleanup_buckets:
 	for (i = 0; i < buckets_created; i++) {
+		isc_mem_detach(&res->buckets[i].mctx);
 		DESTROYLOCK(&res->buckets[i].lock);
 		isc_task_shutdown(res->buckets[i].task);
 		isc_task_detach(&res->buckets[i].task);
@@ -5952,6 +6248,7 @@ prime_done(isc_task_t *task, isc_event_t *event) {
 	dns_resolver_t *res;
 	dns_fetchevent_t *fevent;
 	dns_fetch_t *fetch;
+	dns_db_t *db = NULL;
 
 	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
 	fevent = (dns_fetchevent_t *)event;
@@ -5970,6 +6267,13 @@ prime_done(isc_task_t *task, isc_event_t *event) {
 	UNLOCK(&res->primelock);
 
 	UNLOCK(&res->lock);
+	
+	if (fevent->result == ISC_R_SUCCESS &&
+	    res->view->cache != NULL && res->view->hints != NULL) {
+		dns_cache_attachdb(res->view->cache, &db);
+		dns_root_checkhints(res->view, res->view->hints, db);
+		dns_db_detach(&db);
+	}
 
 	if (fevent->node != NULL)
 		dns_db_detachnode(fevent->db, &fevent->node);
@@ -6111,6 +6415,7 @@ dns_resolver_shutdown(dns_resolver_t *res) {
 	unsigned int i;
 	fetchctx_t *fctx;
 	isc_socket_t *sock;
+	isc_result_t result;
 
 	REQUIRE(VALID_RESOLVER(res));
 
@@ -6147,6 +6452,10 @@ dns_resolver_shutdown(dns_resolver_t *res) {
 		}
 		if (res->activebuckets == 0)
 			send_shutdown_events(res);
+		result = isc_timer_reset(res->spillattimer,
+					 isc_timertype_inactive, NULL,
+					 NULL, ISC_TRUE);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	}
 
 	UNLOCK(&res->lock);
@@ -6217,12 +6526,32 @@ dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name,
 			 dns_rdataset_t *sigrdataset,
 			 dns_fetch_t **fetchp)
 {
+	return (dns_resolver_createfetch2(res, name, type, domain,
+					  nameservers, forwarders, NULL, 0,
+					  options, task, action, arg,
+					  rdataset, sigrdataset, fetchp));
+}
+
+isc_result_t
+dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
+			  dns_rdatatype_t type,
+			  dns_name_t *domain, dns_rdataset_t *nameservers,
+			  dns_forwarders_t *forwarders,
+			  isc_sockaddr_t *client, dns_messageid_t id,
+			  unsigned int options, isc_task_t *task,
+			  isc_taskaction_t action, void *arg,
+			  dns_rdataset_t *rdataset,
+			  dns_rdataset_t *sigrdataset,
+			  dns_fetch_t **fetchp)
+{
 	dns_fetch_t *fetch;
 	fetchctx_t *fctx = NULL;
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	unsigned int bucketnum;
 	isc_boolean_t new_fctx = ISC_FALSE;
 	isc_event_t *event;
+	unsigned int count = 0;
+	unsigned int spillat;
 
 	UNUSED(forwarders);
 
@@ -6249,8 +6578,11 @@ dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name,
 	if (fetch == NULL)
 		return (ISC_R_NOMEMORY);
 
-	bucketnum = dns_name_hash(name, ISC_FALSE) % res->nbuckets;
+	bucketnum = dns_name_fullhash(name, ISC_FALSE) % res->nbuckets;
 
+	LOCK(&res->lock);
+	spillat = res->spillat;
+	UNLOCK(&res->lock);
 	LOCK(&res->buckets[bucketnum].lock);
 
 	if (res->buckets[bucketnum].exiting) {
@@ -6266,6 +6598,31 @@ dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name,
 				break;
 		}
 	}
+	
+	/*
+	 * Is this a duplicate?
+	 */
+	if (fctx != NULL && client != NULL) {
+		dns_fetchevent_t *fevent;
+		for (fevent = ISC_LIST_HEAD(fctx->events);
+		     fevent != NULL;
+		     fevent = ISC_LIST_NEXT(fevent, ev_link)) {
+			if (fevent->client != NULL && fevent->id == id &&
+			    isc_sockaddr_equal(fevent->client, client)) {
+				result = DNS_R_DUPLICATE;
+				goto unlock;
+			}
+			count++;
+		}
+	}
+	if (count >= res->spillatmin && res->spillatmin != 0) {
+		if (count >= spillat)
+			fctx->spilled = ISC_TRUE;
+		if (fctx->spilled) {
+			result = DNS_R_DROP;
+			goto unlock;
+		}
+	}
 
 	/*
 	 * If we didn't have a fetch, would attach to a done fetch, this
@@ -6285,7 +6642,7 @@ dns_resolver_createfetch(dns_resolver_t *res, dns_name_t *name,
 		new_fctx = ISC_TRUE;
 	}
 
-	result = fctx_join(fctx, task, action, arg,
+	result = fctx_join(fctx, task, client, id, action, arg,
 			   rdataset, sigrdataset, fetch);
 	if (new_fctx) {
 		if (result == ISC_R_SUCCESS) {
@@ -6641,6 +6998,13 @@ dns_resolver_algorithm_supported(dns_resolver_t *resolver, dns_name_t *name,
 	return (dst_algorithm_supported(alg));
 }
 
+isc_boolean_t
+dns_resolver_digest_supported(dns_resolver_t *resolver, unsigned int digest) {
+
+	UNUSED(resolver);
+	return (dns_ds_digest_supported(digest));
+}
+
 void
 dns_resolver_resetmustbesecure(dns_resolver_t *resolver) {
 
@@ -6706,3 +7070,45 @@ dns_resolver_getmustbesecure(dns_resolver_t *resolver, dns_name_t *name) {
 #endif
 	return (value);
 }
+
+void
+dns_resolver_getclientsperquery(dns_resolver_t *resolver, isc_uint32_t *cur,
+				isc_uint32_t *min, isc_uint32_t *max)
+{
+	REQUIRE(VALID_RESOLVER(resolver));
+
+	LOCK(&resolver->lock);
+	if (cur != NULL)
+		*cur = resolver->spillat;
+	if (min != NULL)
+		*min = resolver->spillatmin;
+	if (max != NULL)
+		*max = resolver->spillatmax;
+	UNLOCK(&resolver->lock);
+}
+
+void
+dns_resolver_setclientsperquery(dns_resolver_t *resolver, isc_uint32_t min,
+				isc_uint32_t max)
+{
+	REQUIRE(VALID_RESOLVER(resolver));
+
+	LOCK(&resolver->lock);
+	resolver->spillatmin = resolver->spillat = min;
+	resolver->spillatmax = max;
+	UNLOCK(&resolver->lock);
+}
+
+isc_boolean_t
+dns_resolver_getzeronosoattl(dns_resolver_t *resolver) {
+	REQUIRE(VALID_RESOLVER(resolver));
+
+	return (resolver->zero_no_soa_ttl);
+}
+
+void
+dns_resolver_setzeronosoattl(dns_resolver_t *resolver, isc_boolean_t state) {
+	REQUIRE(VALID_RESOLVER(resolver));
+
+	resolver->zero_no_soa_ttl = state;
+}
diff --git a/contrib/bind9/lib/dns/result.c b/contrib/bind9/lib/dns/result.c
index eb8308a..fdb58e0 100644
--- a/contrib/bind9/lib/dns/result.c
+++ b/contrib/bind9/lib/dns/result.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.c,v 1.90.2.9.2.13 2004/05/14 05:06:39 marka Exp $ */
+/* $Id: result.c,v 1.115.10.7 2005/06/17 02:04:31 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -26,155 +28,157 @@
 #include <dns/lib.h>
 
 static const char *text[DNS_R_NRESULTS] = {
-	"label too long",		       /*  0 DNS_R_LABELTOOLONG	     */
-	"bad escape",			       /*  1 DNS_R_BADESCAPE	     */
-	/*
+	"label too long",		       /*%< 0 DNS_R_LABELTOOLONG */
+	"bad escape",			       /*%< 1 DNS_R_BADESCAPE */
+	/*!
 	 * Note that DNS_R_BADBITSTRING and DNS_R_BITSTRINGTOOLONG are
 	 * deprecated.
 	 */
-	"bad bitstring",		       /*  2 DNS_R_BADBITSTRING	     */
-	"bitstring too long",		       /*  3 DNS_R_BITSTRINGTOOLONG  */
-	"empty label",			       /*  4 DNS_R_EMPTYLABEL	     */
-
-	"bad dotted quad",		       /*  5 DNS_R_BADDOTTEDQUAD     */
-	"invalid NS owner name (wildcard)",    /*  6 DNS_R_INVALIDNS	     */
-	"unknown class/type",		       /*  7 DNS_R_UNKNOWN	     */
-	"bad label type",		       /*  8 DNS_R_BADLABELTYPE	     */
-	"bad compression pointer",	       /*  9 DNS_R_BADPOINTER	     */
-
-	"too many hops",		       /* 10 DNS_R_TOOMANYHOPS	     */
-	"disallowed (by application policy)",  /* 11 DNS_R_DISALLOWED	     */
-	"extra input text",		       /* 12 DNS_R_EXTRATOKEN	     */
-	"extra input data",		       /* 13 DNS_R_EXTRADATA	     */
-	"text too long",		       /* 14 DNS_R_TEXTTOOLONG	     */
-
-	"not at top of zone",		       /* 15 DNS_R_NOTZONETOP	     */
-	"syntax error",			       /* 16 DNS_R_SYNTAX	     */
-	"bad checksum",			       /* 17 DNS_R_BADCKSUM	     */
-	"bad IPv6 address",		       /* 18 DNS_R_BADAAAA	     */
-	"no owner",			       /* 19 DNS_R_NOOWNER	     */
-
-	"no ttl",			       /* 20 DNS_R_NOTTL	     */
-	"bad class",			       /* 21 DNS_R_BADCLASS	     */
-	"name too long",		       /* 22 DNS_R_NAMETOOLONG	     */
-	"partial match",		       /* 23 DNS_R_PARTIALMATCH	     */
-	"new origin",			       /* 24 DNS_R_NEWORIGIN	     */
-
-	"unchanged",			       /* 25 DNS_R_UNCHANGED	     */
-	"bad ttl",			       /* 26 DNS_R_BADTTL	     */
-	"more data needed/to be rendered",     /* 27 DNS_R_NOREDATA	     */
-	"continue",			       /* 28 DNS_R_CONTINUE	     */
-	"delegation",			       /* 29 DNS_R_DELEGATION	     */
-
-	"glue",				       /* 30 DNS_R_GLUE		     */
-	"dname",			       /* 31 DNS_R_DNAME	     */
-	"cname",			       /* 32 DNS_R_CNAME	     */
-	"bad database",			       /* 33 DNS_R_BADDB	     */
-	"zonecut",			       /* 34 DNS_R_ZONECUT	     */
-
-	"bad zone",			       /* 35 DNS_R_BADZONE	     */
-	"more data",			       /* 36 DNS_R_MOREDATA	     */
-	"up to date",			       /* 37 DNS_R_UPTODATE	     */
-	"tsig verify failure",		       /* 38 DNS_R_TSIGVERIFYFAILURE */
-	"tsig indicates error",		       /* 39 DNS_R_TSIGERRORSET	     */
-
-	"RRSIG failed to verify",	       /* 40 DNS_R_SIGINVALID	     */
-	"RRSIG has expired",		       /* 41 DNS_R_SIGEXPIRED	     */
-	"RRSIG validity period has not begun", /* 42 DNS_R_SIGFUTURE	     */
-	"key is unauthorized to sign data",    /* 43 DNS_R_KEYUNAUTHORIZED   */
-	"invalid time",			       /* 44 DNS_R_INVALIDTIME	     */
-
-	"expected a TSIG or SIG(0)",	       /* 45 DNS_R_EXPECTEDTSIG	     */
-	"did not expect a TSIG or SIG(0)",     /* 46 DNS_R_UNEXPECTEDTSIG    */
-	"TKEY is unacceptable",		       /* 47 DNS_R_INVALIDTKEY	     */
-	"hint",				       /* 48 DNS_R_HINT		     */
-	"drop",				       /* 49 DNS_R_DROP		     */
-
-	"zone not loaded",		       /* 50 DNS_R_NOTLOADED	     */
-	"ncache nxdomain",		       /* 51 DNS_R_NCACHENXDOMAIN    */
-	"ncache nxrrset",		       /* 52 DNS_R_NCACHENXRRSET     */
-	"wait",				       /* 53 DNS_R_WAIT		     */
-	"not verified yet",		       /* 54 DNS_R_NOTVERIFIEDYET    */
-
-	"no identity",			       /* 55 DNS_R_NOIDENTITY	     */
-	"no journal",			       /* 56 DNS_R_NOJOURNAL	     */
-	"alias",			       /* 57 DNS_R_ALIAS	     */
-	"use TCP",			       /* 58 DNS_R_USETCP	     */
-	"no valid RRSIG",		       /* 59 DNS_R_NOVALIDSIG	     */
-
-	"no valid NSEC",		       /* 60 DNS_R_NOVALIDNSEC	     */
-	"not insecure",			       /* 61 DNS_R_NOTINSECURE	     */
-	"unknown service",		       /* 62 DNS_R_UNKNOWNSERVICE    */
-	"recoverable error occurred",	       /* 63 DNS_R_RECOVERABLE       */
-	"unknown opt attribute record",	       /* 64 DNS_R_UNKNOWNOPT	     */
-
-	"unexpected message id",	       /* 65 DNS_R_UNEXPECTEDID      */
-	"seen include file",		       /* 66 DNS_R_SEENINCLUDE       */
-	"not exact",		       	       /* 67 DNS_R_NOTEXACT	     */
-	"address blackholed",	       	       /* 68 DNS_R_BLACKHOLED	     */
-	"bad algorithm",		       /* 69 DNS_R_BADALG	     */
-
-	"invalid use of a meta type",	       /* 70 DNS_R_METATYPE	     */
-	"CNAME and other data",		       /* 71 DNS_R_CNAMEANDOTHER     */
-	"multiple RRs of singleton type",      /* 72 DNS_R_SINGLETON	     */
-	"hint nxrrset",			       /* 73 DNS_R_HINTNXRRSET	     */
-	"no master file configured",	       /* 74 DNS_R_NOMASTERFILE	     */
-
-	"unknown protocol",		       /* 75 DNS_R_UNKNOWNPROTO	     */
-	"clocks are unsynchronized",	       /* 76 DNS_R_CLOCKSKEW	     */
-	"IXFR failed",			       /* 77 DNS_R_BADIXFR	     */
-	"not authoritative",		       /* 78 DNS_R_NOTAUTHORITATIVE  */
-	"no valid KEY",		       	       /* 79 DNS_R_NOVALIDKEY	     */
-
-	"obsolete",			       /* 80 DNS_R_OBSOLETE	     */
-	"already frozen",		       /* 81 DNS_R_FROZEN	     */
-	"unknown flag",			       /* 82 DNS_R_UNKNOWNFLAG	     */
-	"expected a response",		       /* 83 DNS_R_EXPECTEDRESPONSE  */
-	"no valid DS",			       /* 84 DNS_R_NOVALIDDS	     */
-
-	"NS is an address",		       /* 85 DNS_R_NSISADDRESS	     */
-	"received FORMERR",		       /* 86 DNS_R_REMOTEFORMERR     */
-	"truncated TCP response",	       /* 87 DNS_R_TRUNCATEDTCP	     */
-	"lame server detected",		       /* 88 DNS_R_LAME		     */
-	"unexpected RCODE",		       /* 89 DNS_R_UNEXPECTEDRCODE   */
-
-	"unexpected OPCODE",		       /* 90 DNS_R_UNEXPECTEDOPCODE  */
-	"chase DS servers",		       /* 91 DNS_R_CHASEDSSERVERS    */
-	"empty name",			       /* 92 DNS_R_EMPTYNAME	     */
-	"empty wild",			       /* 93 DNS_R_EMPTYWILD	     */
-	"bad bitmap",			       /* 94 DNS_R_BADBITMAP	     */
-
-	"from wildcard",		       /* 95 DNS_R_FROMWILDCARD	     */
-	"bad owner name (check-names)",	       /* 96 DNS_R_BADOWNERNAME	     */
-	"bad name (check-names)",	       /* 97 DNS_R_BADNAME	     */
-	"dynamic zone",			       /* 98 DNS_R_DYNAMIC	     */
-	"unknown command",		       /* 99 DNS_R_UNKNOWNCOMMAND    */
-
-	"must-be-secure",		       /* 100 DNS_R_MUSTBESECURE     */
-	"covering NSEC record returned"	       /* 101 DNS_R_COVERINGNSEC     */
+	"bad bitstring",		       /*%< 2 DNS_R_BADBITSTRING */
+	"bitstring too long",		       /*%< 3 DNS_R_BITSTRINGTOOLONG */
+	"empty label",			       /*%< 4 DNS_R_EMPTYLABEL */
+
+	"bad dotted quad",		       /*%< 5 DNS_R_BADDOTTEDQUAD */
+	"invalid NS owner name (wildcard)",    /*%< 6 DNS_R_INVALIDNS */
+	"unknown class/type",		       /*%< 7 DNS_R_UNKNOWN */
+	"bad label type",		       /*%< 8 DNS_R_BADLABELTYPE */
+	"bad compression pointer",	       /*%< 9 DNS_R_BADPOINTER */
+
+	"too many hops",		       /*%< 10 DNS_R_TOOMANYHOPS */
+	"disallowed (by application policy)",  /*%< 11 DNS_R_DISALLOWED */
+	"extra input text",		       /*%< 12 DNS_R_EXTRATOKEN */
+	"extra input data",		       /*%< 13 DNS_R_EXTRADATA */
+	"text too long",		       /*%< 14 DNS_R_TEXTTOOLONG */
+
+	"not at top of zone",		       /*%< 15 DNS_R_NOTZONETOP */
+	"syntax error",			       /*%< 16 DNS_R_SYNTAX */
+	"bad checksum",			       /*%< 17 DNS_R_BADCKSUM */
+	"bad IPv6 address",		       /*%< 18 DNS_R_BADAAAA */
+	"no owner",			       /*%< 19 DNS_R_NOOWNER */
+
+	"no ttl",			       /*%< 20 DNS_R_NOTTL */
+	"bad class",			       /*%< 21 DNS_R_BADCLASS */
+	"name too long",		       /*%< 22 DNS_R_NAMETOOLONG */
+	"partial match",		       /*%< 23 DNS_R_PARTIALMATCH */
+	"new origin",			       /*%< 24 DNS_R_NEWORIGIN */
+
+	"unchanged",			       /*%< 25 DNS_R_UNCHANGED */
+	"bad ttl",			       /*%< 26 DNS_R_BADTTL */
+	"more data needed/to be rendered",     /*%< 27 DNS_R_NOREDATA */
+	"continue",			       /*%< 28 DNS_R_CONTINUE */
+	"delegation",			       /*%< 29 DNS_R_DELEGATION */
+
+	"glue",				       /*%< 30 DNS_R_GLUE */
+	"dname",			       /*%< 31 DNS_R_DNAME */
+	"cname",			       /*%< 32 DNS_R_CNAME */
+	"bad database",			       /*%< 33 DNS_R_BADDB */
+	"zonecut",			       /*%< 34 DNS_R_ZONECUT */
+
+	"bad zone",			       /*%< 35 DNS_R_BADZONE */
+	"more data",			       /*%< 36 DNS_R_MOREDATA */
+	"up to date",			       /*%< 37 DNS_R_UPTODATE */
+	"tsig verify failure",		       /*%< 38 DNS_R_TSIGVERIFYFAILURE */
+	"tsig indicates error",		       /*%< 39 DNS_R_TSIGERRORSET */
+
+	"RRSIG failed to verify",	       /*%< 40 DNS_R_SIGINVALID */
+	"RRSIG has expired",		       /*%< 41 DNS_R_SIGEXPIRED */
+	"RRSIG validity period has not begun", /*%< 42 DNS_R_SIGFUTURE */
+	"key is unauthorized to sign data",    /*%< 43 DNS_R_KEYUNAUTHORIZED */
+	"invalid time",			       /*%< 44 DNS_R_INVALIDTIME */
+
+	"expected a TSIG or SIG(0)",	       /*%< 45 DNS_R_EXPECTEDTSIG */
+	"did not expect a TSIG or SIG(0)",     /*%< 46 DNS_R_UNEXPECTEDTSIG */
+	"TKEY is unacceptable",		       /*%< 47 DNS_R_INVALIDTKEY */
+	"hint",				       /*%< 48 DNS_R_HINT */
+	"drop",				       /*%< 49 DNS_R_DROP */
+
+	"zone not loaded",		       /*%< 50 DNS_R_NOTLOADED */
+	"ncache nxdomain",		       /*%< 51 DNS_R_NCACHENXDOMAIN */
+	"ncache nxrrset",		       /*%< 52 DNS_R_NCACHENXRRSET */
+	"wait",				       /*%< 53 DNS_R_WAIT */
+	"not verified yet",		       /*%< 54 DNS_R_NOTVERIFIEDYET */
+
+	"no identity",			       /*%< 55 DNS_R_NOIDENTITY */
+	"no journal",			       /*%< 56 DNS_R_NOJOURNAL */
+	"alias",			       /*%< 57 DNS_R_ALIAS */
+	"use TCP",			       /*%< 58 DNS_R_USETCP */
+	"no valid RRSIG",		       /*%< 59 DNS_R_NOVALIDSIG */
+
+	"no valid NSEC",		       /*%< 60 DNS_R_NOVALIDNSEC */
+	"not insecure",			       /*%< 61 DNS_R_NOTINSECURE */
+	"unknown service",		       /*%< 62 DNS_R_UNKNOWNSERVICE */
+	"recoverable error occurred",	       /*%< 63 DNS_R_RECOVERABLE */
+	"unknown opt attribute record",	       /*%< 64 DNS_R_UNKNOWNOPT */
+
+	"unexpected message id",	       /*%< 65 DNS_R_UNEXPECTEDID */
+	"seen include file",		       /*%< 66 DNS_R_SEENINCLUDE */
+	"not exact",		       	       /*%< 67 DNS_R_NOTEXACT */
+	"address blackholed",	       	       /*%< 68 DNS_R_BLACKHOLED */
+	"bad algorithm",		       /*%< 69 DNS_R_BADALG */
+
+	"invalid use of a meta type",	       /*%< 70 DNS_R_METATYPE */
+	"CNAME and other data",		       /*%< 71 DNS_R_CNAMEANDOTHER */
+	"multiple RRs of singleton type",      /*%< 72 DNS_R_SINGLETON */
+	"hint nxrrset",			       /*%< 73 DNS_R_HINTNXRRSET */
+	"no master file configured",	       /*%< 74 DNS_R_NOMASTERFILE */
+
+	"unknown protocol",		       /*%< 75 DNS_R_UNKNOWNPROTO */
+	"clocks are unsynchronized",	       /*%< 76 DNS_R_CLOCKSKEW */
+	"IXFR failed",			       /*%< 77 DNS_R_BADIXFR */
+	"not authoritative",		       /*%< 78 DNS_R_NOTAUTHORITATIVE */
+	"no valid KEY",		       	       /*%< 79 DNS_R_NOVALIDKEY */
+
+	"obsolete",			       /*%< 80 DNS_R_OBSOLETE */
+	"already frozen",		       /*%< 81 DNS_R_FROZEN */
+	"unknown flag",			       /*%< 82 DNS_R_UNKNOWNFLAG */
+	"expected a response",		       /*%< 83 DNS_R_EXPECTEDRESPONSE */
+	"no valid DS",			       /*%< 84 DNS_R_NOVALIDDS */
+
+	"NS is an address",		       /*%< 85 DNS_R_NSISADDRESS */
+	"received FORMERR",		       /*%< 86 DNS_R_REMOTEFORMERR */
+	"truncated TCP response",	       /*%< 87 DNS_R_TRUNCATEDTCP */
+	"lame server detected",		       /*%< 88 DNS_R_LAME */
+	"unexpected RCODE",		       /*%< 89 DNS_R_UNEXPECTEDRCODE */
+
+	"unexpected OPCODE",		       /*%< 90 DNS_R_UNEXPECTEDOPCODE */
+	"chase DS servers",		       /*%< 91 DNS_R_CHASEDSSERVERS */
+	"empty name",			       /*%< 92 DNS_R_EMPTYNAME */
+	"empty wild",			       /*%< 93 DNS_R_EMPTYWILD */
+	"bad bitmap",			       /*%< 94 DNS_R_BADBITMAP */
+
+	"from wildcard",		       /*%< 95 DNS_R_FROMWILDCARD */
+	"bad owner name (check-names)",	       /*%< 96 DNS_R_BADOWNERNAME */
+	"bad name (check-names)",	       /*%< 97 DNS_R_BADNAME */
+	"dynamic zone",			       /*%< 98 DNS_R_DYNAMIC */
+	"unknown command",		       /*%< 99 DNS_R_UNKNOWNCOMMAND */
+
+	"must-be-secure",		       /*%< 100 DNS_R_MUSTBESECURE */
+	"covering NSEC record returned",       /*%< 101 DNS_R_COVERINGNSEC */
+	"MX is an address",		       /*%< 102 DNS_R_MXISADDRESS */
+	"duplicate query"		       /*%< 103 DNS_R_DUPLICATE */
 };
 
 static const char *rcode_text[DNS_R_NRCODERESULTS] = {
-	"NOERROR",				/*  0 DNS_R_NOEROR	     */
-	"FORMERR",				/*  1 DNS_R_FORMERR	     */
-	"SERVFAIL",				/*  2 DNS_R_SERVFAIL	     */
-	"NXDOMAIN",				/*  3 DNS_R_NXDOMAIN	     */
-	"NOTIMP",				/*  4 DNS_R_NOTIMP	     */
-
-	"REFUSED",				/*  5 DNS_R_REFUSED	     */
-	"YXDOMAIN",				/*  6 DNS_R_YXDOMAIN	     */
-	"YXRRSET",				/*  7 DNS_R_YXRRSET	     */
-	"NXRRSET",				/*  8 DNS_R_NXRRSET	     */
-	"NOTAUTH",				/*  9 DNS_R_NOTAUTH	     */
-
-	"NOTZONE",				/* 10 DNS_R_NOTZONE 	     */
-	"<rcode 11>",				/* 11 has no macro	     */
-	"<rcode 12>",				/* 12 has no macro	     */
-	"<rcode 13>",				/* 13 has no macro	     */
-	"<rcode 14>",				/* 14 has no macro	     */
-
-	"<rcode 15>",				/* 15 has no macro	     */
-	"BADVERS",				/* 16 DNS_R_BADVERS	     */
+	"NOERROR",				/*%< 0 DNS_R_NOEROR */
+	"FORMERR",				/*%< 1 DNS_R_FORMERR */
+	"SERVFAIL",				/*%< 2 DNS_R_SERVFAIL */
+	"NXDOMAIN",				/*%< 3 DNS_R_NXDOMAIN */
+	"NOTIMP",				/*%< 4 DNS_R_NOTIMP */
+
+	"REFUSED",				/*%< 5 DNS_R_REFUSED */
+	"YXDOMAIN",				/*%< 6 DNS_R_YXDOMAIN */
+	"YXRRSET",				/*%< 7 DNS_R_YXRRSET */
+	"NXRRSET",				/*%< 8 DNS_R_NXRRSET */
+	"NOTAUTH",				/*%< 9 DNS_R_NOTAUTH */
+
+	"NOTZONE",				/*%< 10 DNS_R_NOTZONE */
+	"<rcode 11>",				/*%< 11 has no macro */
+	"<rcode 12>",				/*%< 12 has no macro */
+	"<rcode 13>",				/*%< 13 has no macro */
+	"<rcode 14>",				/*%< 14 has no macro */
+
+	"<rcode 15>",				/*%< 15 has no macro */
+	"BADVERS",				/*%< 16 DNS_R_BADVERS */
 };
 
 #define DNS_RESULT_RESULTSET			2
diff --git a/contrib/bind9/lib/dns/rootns.c b/contrib/bind9/lib/dns/rootns.c
index 9e9c940..1c038a4 100644
--- a/contrib/bind9/lib/dns/rootns.c
+++ b/contrib/bind9/lib/dns/rootns.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rootns.c,v 1.20.2.3.2.5 2004/03/08 09:04:32 marka Exp $ */
+/* $Id: rootns.c,v 1.26.18.3 2005/04/27 05:01:26 sra Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -26,15 +28,18 @@
 #include <dns/callbacks.h>
 #include <dns/db.h>
 #include <dns/dbiterator.h>
-#include <dns/log.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/rdata.h>
-#include <dns/rdatasetiter.h>
+#include <dns/rdata.h>
 #include <dns/rdataset.h>
+#include <dns/rdatasetiter.h>
 #include <dns/rdatastruct.h>
+#include <dns/rdatatype.h>
 #include <dns/result.h>
 #include <dns/rootns.h>
+#include <dns/view.h>
 
 static char root_ns[] =
 ";\n"
@@ -245,3 +250,265 @@ dns_rootns_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 
 	return (result);
 }
+
+static void
+report(dns_view_t *view, dns_name_t *name, isc_boolean_t missing,
+       dns_rdata_t *rdata)
+{
+	const char *viewname = "", *sep = "";
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char typebuf[DNS_RDATATYPE_FORMATSIZE];
+	char databuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
+	isc_buffer_t buffer;
+	isc_result_t result;
+
+        if (strcmp(view->name, "_bind") != 0 &&
+            strcmp(view->name, "_default") != 0) {
+                viewname = view->name;
+                sep = ": view ";
+        }
+
+	dns_name_format(name, namebuf, sizeof(namebuf));
+	dns_rdatatype_format(rdata->type, typebuf, sizeof(typebuf));
+	isc_buffer_init(&buffer, databuf, sizeof(databuf) - 1);
+	result = dns_rdata_totext(rdata, NULL, &buffer);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	databuf[isc_buffer_usedlength(&buffer)] = '\0';
+
+	if (missing)
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
+			      "checkhints%s%s: %s/%s (%s) missing from hints",
+			      sep, viewname, namebuf, typebuf, databuf);
+	else
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
+			      "checkhints%s%s: %s/%s (%s) extra record "
+			      "in hints", sep, viewname, namebuf, typebuf,
+			      databuf);
+}
+
+static isc_boolean_t
+inrrset(dns_rdataset_t *rrset, dns_rdata_t *rdata) {
+	isc_result_t result;
+	dns_rdata_t current = DNS_RDATA_INIT;
+
+	result = dns_rdataset_first(rrset);
+	while (result == ISC_R_SUCCESS) {
+		dns_rdataset_current(rrset, &current);
+		if (dns_rdata_compare(rdata, &current) == 0)
+			return (ISC_TRUE);
+		dns_rdata_reset(&current);
+		result = dns_rdataset_next(rrset);
+	}
+	return (ISC_FALSE);
+}
+
+/*
+ * Check that the address RRsets match.
+ *
+ * Note we don't complain about missing glue records.
+ */
+
+static void
+check_address_records(dns_view_t *view, dns_db_t *hints, dns_db_t *db,
+		      dns_name_t *name, isc_stdtime_t now)
+{
+	isc_result_t hresult, rresult, result;
+	dns_rdataset_t hintrrset, rootrrset;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_name_t *foundname;
+	dns_fixedname_t fixed;
+
+	dns_rdataset_init(&hintrrset);
+	dns_rdataset_init(&rootrrset);
+	dns_fixedname_init(&fixed);
+	foundname = dns_fixedname_name(&fixed);
+
+	hresult = dns_db_find(hints, name, NULL, dns_rdatatype_a, 0,
+			      now, NULL, foundname, &hintrrset, NULL);
+	rresult = dns_db_find(db, name, NULL, dns_rdatatype_a,
+			      DNS_DBFIND_GLUEOK, now, NULL, foundname,
+			      &rootrrset, NULL);
+	if (hresult == ISC_R_SUCCESS &&
+	    (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE)) {
+		result = dns_rdataset_first(&rootrrset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&rootrrset, &rdata);
+			if (!inrrset(&hintrrset, &rdata))
+				report(view, name, ISC_TRUE, &rdata);
+			result = dns_rdataset_next(&rootrrset);
+		}
+		result = dns_rdataset_first(&hintrrset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&hintrrset, &rdata);
+			if (!inrrset(&rootrrset, &rdata))
+				report(view, name, ISC_FALSE, &rdata);
+			result = dns_rdataset_next(&hintrrset);
+		}
+	} 
+	if (hresult == ISC_R_NOTFOUND &&
+	    (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE)) {
+		result = dns_rdataset_first(&rootrrset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&rootrrset, &rdata);
+			report(view, name, ISC_TRUE, &rdata);
+			result = dns_rdataset_next(&rootrrset);
+		}
+	}
+	if (dns_rdataset_isassociated(&rootrrset))
+		dns_rdataset_disassociate(&rootrrset);
+	if (dns_rdataset_isassociated(&hintrrset))
+		dns_rdataset_disassociate(&hintrrset);
+
+	/*
+	 * Check AAAA records.
+	 */
+	hresult = dns_db_find(hints, name, NULL, dns_rdatatype_aaaa, 0,
+			      now, NULL, foundname, &hintrrset, NULL);
+	rresult = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
+			      DNS_DBFIND_GLUEOK, now, NULL, foundname,
+			      &rootrrset, NULL);
+	if (hresult == ISC_R_SUCCESS &&
+	    (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE)) {
+		result = dns_rdataset_first(&rootrrset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&rootrrset, &rdata);
+			if (!inrrset(&hintrrset, &rdata))
+				report(view, name, ISC_TRUE, &rdata);
+			dns_rdata_reset(&rdata);
+			result = dns_rdataset_next(&rootrrset);
+		}
+		result = dns_rdataset_first(&hintrrset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&hintrrset, &rdata);
+			if (!inrrset(&rootrrset, &rdata))
+				report(view, name, ISC_FALSE, &rdata);
+			dns_rdata_reset(&rdata);
+			result = dns_rdataset_next(&hintrrset);
+		}
+	} 
+	if (hresult == ISC_R_NOTFOUND &&
+	    (rresult == ISC_R_SUCCESS || rresult == DNS_R_GLUE)) {
+		result = dns_rdataset_first(&rootrrset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&rootrrset, &rdata);
+			report(view, name, ISC_TRUE, &rdata);
+			dns_rdata_reset(&rdata);
+			result = dns_rdataset_next(&rootrrset);
+		}
+	}
+	if (dns_rdataset_isassociated(&rootrrset))
+		dns_rdataset_disassociate(&rootrrset);
+	if (dns_rdataset_isassociated(&hintrrset))
+		dns_rdataset_disassociate(&hintrrset);
+}
+
+void
+dns_root_checkhints(dns_view_t *view, dns_db_t *hints, dns_db_t *db) {
+	isc_result_t result;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdata_ns_t ns;
+	dns_rdataset_t hintns, rootns;
+	const char *viewname = "", *sep = "";
+	isc_stdtime_t now;
+	dns_name_t *name;
+	dns_fixedname_t fixed;
+
+	REQUIRE(hints != NULL);
+	REQUIRE(db != NULL);
+	REQUIRE(view != NULL);
+
+	isc_stdtime_get(&now);
+
+        if (strcmp(view->name, "_bind") != 0 &&
+            strcmp(view->name, "_default") != 0) {
+                viewname = view->name;
+                sep = ": view ";
+        }
+
+	dns_rdataset_init(&hintns);
+	dns_rdataset_init(&rootns);
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
+
+	result = dns_db_find(hints, dns_rootname, NULL, dns_rdatatype_ns, 0,
+			     now, NULL, name, &hintns, NULL);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
+			      "checkhints%s%s: unable to get root NS rrset "
+			      "from hints: %s", sep, viewname,
+			      dns_result_totext(result));
+		goto cleanup;
+	}
+
+	result = dns_db_find(db, dns_rootname, NULL, dns_rdatatype_ns, 0,
+			     now, NULL, name, &rootns, NULL);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+			      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
+			      "checkhints%s%s: unable to get root NS rrset "
+			      "from cache: %s", sep, viewname,
+			      dns_result_totext(result));
+		goto cleanup;
+	}
+	
+	/*
+	 * Look for missing root NS names.
+	 */
+	result = dns_rdataset_first(&rootns);
+	while (result == ISC_R_SUCCESS) {
+		dns_rdataset_current(&rootns, &rdata);
+		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		result = in_rootns(&hintns, &ns.name);
+		if (result != ISC_R_SUCCESS) {
+			char namebuf[DNS_NAME_FORMATSIZE];
+			/* missing from hints */
+			dns_name_format(&ns.name, namebuf, sizeof(namebuf));
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+				      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
+				      "checkhints%s%s: unable to find root "
+				      "NS '%s' in hints", sep, viewname,
+				      namebuf);
+		} else 
+			check_address_records(view, hints, db, &ns.name, now);
+		dns_rdata_reset(&rdata);
+		result = dns_rdataset_next(&rootns);
+	}
+	if (result != ISC_R_NOMORE) {
+		goto cleanup;
+	}
+
+	/*
+	 * Look for extra root NS names.
+	 */
+	result = dns_rdataset_first(&hintns);
+	while (result == ISC_R_SUCCESS) {
+		dns_rdataset_current(&hintns, &rdata);
+		result = dns_rdata_tostruct(&rdata, &ns, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		result = in_rootns(&rootns, &ns.name);
+		if (result != ISC_R_SUCCESS) {
+			char namebuf[DNS_NAME_FORMATSIZE];
+			/* extra entry in hints */
+			dns_name_format(&ns.name, namebuf, sizeof(namebuf));
+			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+				      DNS_LOGMODULE_HINTS, ISC_LOG_WARNING,
+				      "checkhints%s%s: extra NS '%s' in hints",
+				      sep, viewname, namebuf);
+		}
+		dns_rdata_reset(&rdata);
+		result = dns_rdataset_next(&hintns);
+	}
+	if (result != ISC_R_NOMORE) {
+		goto cleanup;
+	}
+
+ cleanup:
+	if (dns_rdataset_isassociated(&rootns))
+		dns_rdataset_disassociate(&rootns);
+	if (dns_rdataset_isassociated(&hintns))
+		dns_rdataset_disassociate(&hintns);
+}
diff --git a/contrib/bind9/lib/dns/sdb.c b/contrib/bind9/lib/dns/sdb.c
index ef22418..79ddef2 100644
--- a/contrib/bind9/lib/dns/sdb.c
+++ b/contrib/bind9/lib/dns/sdb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sdb.c,v 1.35.12.8 2004/07/22 04:01:58 marka Exp $ */
+/* $Id: sdb.c,v 1.45.18.10 2006/12/07 23:57:58 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -99,7 +101,7 @@ typedef struct sdb_rdatasetiter {
 
 #define SDB_MAGIC		ISC_MAGIC('S', 'D', 'B', '-')
 
-/*
+/*%
  * Note that "impmagic" is not the first four bytes of the struct, so
  * ISC_MAGIC_VALID cannot be used.
  */
@@ -110,7 +112,7 @@ typedef struct sdb_rdatasetiter {
 #define VALID_SDBLOOKUP(sdbl)	ISC_MAGIC_VALID(sdbl, SDBLOOKUP_MAGIC)
 #define VALID_SDBNODE(sdbn)	VALID_SDBLOOKUP(sdbn)
 
-/* These values are taken from RFC 1537 */
+/* These values are taken from RFC1537 */
 #define SDB_DEFAULT_REFRESH	(60 * 60 * 8)
 #define SDB_DEFAULT_RETRY	(60 * 60 * 2)
 #define SDB_DEFAULT_EXPIRE	(60 * 60 * 24 * 7)
@@ -225,12 +227,8 @@ dns_sdb_register(const char *drivername, const dns_sdbmethods_t *methods,
 	imp->mctx = NULL;
 	isc_mem_attach(mctx, &imp->mctx);
 	result = isc_mutex_init(&imp->driverlock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_mctx;
-	}
 
 	imp->dbimp = NULL;
 	result = dns_db_register(drivername, dns_sdb_create, imp, mctx,
@@ -269,10 +267,11 @@ dns_sdb_unregister(dns_sdbimplementation_t **sdbimp) {
 static inline unsigned int
 initial_size(unsigned int len) {
 	unsigned int size;
-	for (size = 64; size < (64 * 1024); size *= 2)
+
+	for (size = 1024; size < (64 * 1024); size *= 2)
 		if (len < size)
 			return (size);
-	return (64 * 1024);
+	return (65535);
 }
 
 isc_result_t
@@ -383,6 +382,8 @@ dns_sdb_putrr(dns_sdblookup_t *lookup, const char *type, dns_ttl_t ttl,
 		if (result != ISC_R_SUCCESS)
 			goto failure;
 
+		if (size >= 65535)
+			size = 65535;
 		p = isc_mem_get(mctx, size);
 		if (p == NULL) {
 			result = ISC_R_NOMEMORY;
@@ -398,6 +399,11 @@ dns_sdb_putrr(dns_sdblookup_t *lookup, const char *type, dns_ttl_t ttl,
 		if (result != ISC_R_NOSPACE)
 			break;
 
+		/*
+		 * Is the RR too big?
+		 */
+		if (size >= 65535)
+			break;
 		isc_mem_put(mctx, p, size);
 		p = NULL;
 		size *= 2;
@@ -599,10 +605,12 @@ endload(dns_db_t *db, dns_dbload_t **dbloadp) {
 }
 
 static isc_result_t
-dump(dns_db_t *db, dns_dbversion_t *version, const char *filename) {
+dump(dns_db_t *db, dns_dbversion_t *version, const char *filename,
+     dns_masterformat_t masterformat) {
 	UNUSED(db);
 	UNUSED(version);
 	UNUSED(filename);
+	UNUSED(masterformat);
 	return (ISC_R_NOTIMPLEMENTED);
 }
 
@@ -664,11 +672,8 @@ createnode(dns_sdb_t *sdb, dns_sdbnode_t **nodep) {
 	node->name = NULL;
 	result = isc_mutex_init(&node->lock);
 	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
 		isc_mem_put(sdb->common.mctx, node, sizeof(dns_sdbnode_t));
-		return (ISC_R_UNEXPECTED);
+		return (result);
 	}
 	dns_rdatacallbacks_init(&node->callbacks);
 	node->references = 1;
@@ -930,7 +935,8 @@ find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
 
 		xresult = dns_name_copy(xname, foundname, NULL);
 		if (xresult != ISC_R_SUCCESS) {
-			destroynode(node);
+			if (node != NULL)
+				destroynode(node);
 			if (dns_rdataset_isassociated(rdataset))
 				dns_rdataset_disassociate(rdataset);
 			return (DNS_R_BADDB);
@@ -1234,7 +1240,8 @@ static dns_dbmethods_t sdb_methods = {
 	nodecount,
 	ispersistent,
 	overmem,
-	settask
+	settask,
+	NULL
 };
 
 static isc_result_t
@@ -1270,13 +1277,8 @@ dns_sdb_create(isc_mem_t *mctx, dns_name_t *origin, dns_dbtype_t type,
 	isc_mem_attach(mctx, &sdb->common.mctx);
 
 	result = isc_mutex_init(&sdb->lock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_mctx;
-	}
 
 	result = dns_name_dupwithoffsets(origin, mctx, &sdb->common.origin);
 	if (result != ISC_R_SUCCESS)
@@ -1361,7 +1363,10 @@ static dns_rdatasetmethods_t methods = {
 	rdataset_clone,
 	isc__rdatalist_count,
 	isc__rdatalist_addnoqname,
-	isc__rdatalist_getnoqname
+	isc__rdatalist_getnoqname,
+	NULL,
+	NULL,
+	NULL
 };
 
 static void
diff --git a/contrib/bind9/lib/dns/sdlz.c b/contrib/bind9/lib/dns/sdlz.c
new file mode 100644
index 0000000..2c6ba8d
--- /dev/null
+++ b/contrib/bind9/lib/dns/sdlz.c
@@ -0,0 +1,1781 @@
+/*
+ * Portions Copyright (C) 2005-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 1999-2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * Copyright (C) 2002 Stichting NLnet, Netherlands, stichting@nlnet.nl.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND STICHTING NLNET
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * STICHTING NLNET BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * The development of Dynamically Loadable Zones (DLZ) for Bind 9 was
+ * conceived and contributed by Rob Butler.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the
+ * above copyright notice and this permission notice appear in all
+ * copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ROB BUTLER
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * ROB BUTLER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR
+ * CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+ * OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+ * USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: sdlz.c,v 1.2.2.9 2007/02/14 23:45:43 marka Exp $ */
+
+/*! \file */
+
+#include <config.h>
+#include <string.h>
+
+#include <isc/buffer.h>
+#include <isc/lex.h>
+#include <isc/log.h>
+#include <isc/rwlock.h>
+#include <isc/string.h>
+#include <isc/util.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/once.h>
+#include <isc/print.h>
+#include <isc/region.h>
+
+#include <dns/callbacks.h>
+#include <dns/db.h>
+#include <dns/dbiterator.h>
+#include <dns/dlz.h>
+#include <dns/fixedname.h>
+#include <dns/log.h>
+#include <dns/rdata.h>
+#include <dns/rdatalist.h>
+#include <dns/rdataset.h>
+#include <dns/rdatasetiter.h>
+#include <dns/rdatatype.h>
+#include <dns/result.h>
+#include <dns/master.h>
+#include <dns/sdlz.h>
+#include <dns/types.h>
+
+#include "rdatalist_p.h"
+
+/*
+ * Private Types
+ */
+
+struct dns_sdlzimplementation {
+	const dns_sdlzmethods_t		*methods;
+	isc_mem_t			*mctx;
+	void				*driverarg;
+	unsigned int			flags;
+	isc_mutex_t			driverlock;
+	dns_dlzimplementation_t		*dlz_imp;
+};
+
+struct dns_sdlz_db {
+	/* Unlocked */
+	dns_db_t			common;
+	void				*dbdata;
+	dns_sdlzimplementation_t	*dlzimp;
+	isc_mutex_t			refcnt_lock;
+	/* Locked */
+	unsigned int			references;
+};
+
+struct dns_sdlzlookup {
+	/* Unlocked */
+	unsigned int			magic;
+	dns_sdlz_db_t			*sdlz;
+	ISC_LIST(dns_rdatalist_t)	lists;
+	ISC_LIST(isc_buffer_t)		buffers;
+	dns_name_t			*name;
+	ISC_LINK(dns_sdlzlookup_t)	link;
+	isc_mutex_t			lock;
+	dns_rdatacallbacks_t		callbacks;
+	/* Locked */
+	unsigned int			references;
+};
+
+typedef struct dns_sdlzlookup dns_sdlznode_t;
+
+struct dns_sdlzallnodes {
+	dns_dbiterator_t		common;
+	ISC_LIST(dns_sdlznode_t)	nodelist;
+	dns_sdlznode_t			*current;
+	dns_sdlznode_t			*origin;
+};
+
+typedef dns_sdlzallnodes_t sdlz_dbiterator_t;
+
+typedef struct sdlz_rdatasetiter {
+	dns_rdatasetiter_t		common;
+	dns_rdatalist_t			*current;
+} sdlz_rdatasetiter_t;
+
+
+#define SDLZDB_MAGIC		ISC_MAGIC('D', 'L', 'Z', 'S')
+
+/*
+ * Note that "impmagic" is not the first four bytes of the struct, so
+ * ISC_MAGIC_VALID cannot be used.
+ */
+
+#define VALID_SDLZDB(sdlzdb)	((sdlzdb) != NULL && \
+				 (sdlzdb)->common.impmagic == SDLZDB_MAGIC)
+
+#define SDLZLOOKUP_MAGIC	ISC_MAGIC('D','L','Z','L')
+#define VALID_SDLZLOOKUP(sdlzl)	ISC_MAGIC_VALID(sdlzl, SDLZLOOKUP_MAGIC)
+#define VALID_SDLZNODE(sdlzn)	VALID_SDLZLOOKUP(sdlzn)
+
+/* These values are taken from RFC 1537 */
+#define SDLZ_DEFAULT_REFRESH	(60 * 60 * 8)
+#define SDLZ_DEFAULT_RETRY	(60 * 60 * 2)
+#define SDLZ_DEFAULT_EXPIRE	(60 * 60 * 24 * 7)
+#define SDLZ_DEFAULT_MINIMUM	(60 * 60 * 24)
+
+/* This is a reasonable value */
+#define SDLZ_DEFAULT_TTL	(60 * 60 * 24)
+
+static int dummy;
+
+#define MAYBE_LOCK(imp) \
+	do { \
+		unsigned int flags = imp->flags; \
+		if ((flags & DNS_SDLZFLAG_THREADSAFE) == 0) \
+			LOCK(&imp->driverlock); \
+	} while (0)
+
+#define MAYBE_UNLOCK(imp) \
+	do { \
+		unsigned int flags = imp->flags; \
+		if ((flags & DNS_SDLZFLAG_THREADSAFE) == 0) \
+			UNLOCK(&imp->driverlock); \
+	} while (0)
+
+/*
+ * Forward references.  Try to keep these to a minimum.
+ */
+
+static void list_tordataset(dns_rdatalist_t *rdatalist,
+			    dns_db_t *db, dns_dbnode_t *node,
+			    dns_rdataset_t *rdataset);
+
+static void detachnode(dns_db_t *db, dns_dbnode_t **targetp);
+
+static void		dbiterator_destroy(dns_dbiterator_t **iteratorp);
+static isc_result_t	dbiterator_first(dns_dbiterator_t *iterator);
+static isc_result_t	dbiterator_last(dns_dbiterator_t *iterator);
+static isc_result_t	dbiterator_seek(dns_dbiterator_t *iterator,
+					dns_name_t *name);
+static isc_result_t	dbiterator_prev(dns_dbiterator_t *iterator);
+static isc_result_t	dbiterator_next(dns_dbiterator_t *iterator);
+static isc_result_t	dbiterator_current(dns_dbiterator_t *iterator,
+					   dns_dbnode_t **nodep,
+					   dns_name_t *name);
+static isc_result_t	dbiterator_pause(dns_dbiterator_t *iterator);
+static isc_result_t	dbiterator_origin(dns_dbiterator_t *iterator,
+					  dns_name_t *name);
+
+static dns_dbiteratormethods_t dbiterator_methods = {
+	dbiterator_destroy,
+	dbiterator_first,
+	dbiterator_last,
+	dbiterator_seek,
+	dbiterator_prev,
+	dbiterator_next,
+	dbiterator_current,
+	dbiterator_pause,
+	dbiterator_origin
+};
+
+/*
+ * Utility functions
+ */
+
+/*% Converts the input string to lowercase, in place. */
+
+static void
+dns_sdlz_tolower(char *str) {
+
+	unsigned int len = strlen(str);
+	unsigned int i;
+
+	for (i = 0; i < len; i++) {
+		if (str[i] >= 'A' && str[i] <= 'Z')
+			str[i] += 32;
+	}
+
+}
+
+static inline unsigned int
+initial_size(const char *data) {
+	unsigned int len = (strlen(data) / 64) + 1;
+	return (len * 64 + 64);
+}
+
+/*
+ * Rdataset Iterator Methods. These methods were "borrowed" from the SDB
+ * driver interface.  See the SDB driver interface documentation for more info.
+ */
+
+static void
+rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
+	sdlz_rdatasetiter_t *sdlziterator =
+		(sdlz_rdatasetiter_t *)(*iteratorp);
+
+	detachnode(sdlziterator->common.db, &sdlziterator->common.node);
+	isc_mem_put(sdlziterator->common.db->mctx, sdlziterator,
+		    sizeof(sdlz_rdatasetiter_t));
+	*iteratorp = NULL;
+}
+
+static isc_result_t
+rdatasetiter_first(dns_rdatasetiter_t *iterator) {
+	sdlz_rdatasetiter_t *sdlziterator = (sdlz_rdatasetiter_t *)iterator;
+	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *)iterator->node;
+
+	if (ISC_LIST_EMPTY(sdlznode->lists))
+		return (ISC_R_NOMORE);
+	sdlziterator->current = ISC_LIST_HEAD(sdlznode->lists);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+rdatasetiter_next(dns_rdatasetiter_t *iterator) {
+	sdlz_rdatasetiter_t *sdlziterator = (sdlz_rdatasetiter_t *)iterator;
+
+	sdlziterator->current = ISC_LIST_NEXT(sdlziterator->current, link);
+	if (sdlziterator->current == NULL)
+		return (ISC_R_NOMORE);
+	else
+		return (ISC_R_SUCCESS);
+}
+
+static void
+rdatasetiter_current(dns_rdatasetiter_t *iterator, dns_rdataset_t *rdataset) {
+	sdlz_rdatasetiter_t *sdlziterator = (sdlz_rdatasetiter_t *)iterator;
+
+	list_tordataset(sdlziterator->current, iterator->db, iterator->node,
+			rdataset);
+}
+
+static dns_rdatasetitermethods_t rdatasetiter_methods = {
+	rdatasetiter_destroy,
+	rdatasetiter_first,
+	rdatasetiter_next,
+	rdatasetiter_current
+};
+
+/*
+ * DB routines. These methods were "borrowed" from the SDB driver interface.
+ * See the SDB driver interface documentation for more info.
+ */
+
+static void
+attach(dns_db_t *source, dns_db_t **targetp) {
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *) source;
+
+	REQUIRE(VALID_SDLZDB(sdlz));
+
+	LOCK(&sdlz->refcnt_lock);
+	REQUIRE(sdlz->references > 0);
+	sdlz->references++;
+	UNLOCK(&sdlz->refcnt_lock);
+
+	*targetp = source;
+}
+
+static void
+destroy(dns_sdlz_db_t *sdlz) {
+	isc_mem_t *mctx;
+	mctx = sdlz->common.mctx;
+
+	sdlz->common.magic = 0;
+	sdlz->common.impmagic = 0;
+
+	isc_mutex_destroy(&sdlz->refcnt_lock);
+
+	dns_name_free(&sdlz->common.origin, mctx);
+
+	isc_mem_put(mctx, sdlz, sizeof(dns_sdlz_db_t));
+	isc_mem_detach(&mctx);
+}
+
+static void
+detach(dns_db_t **dbp) {
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)(*dbp);
+	isc_boolean_t need_destroy = ISC_FALSE;
+
+	REQUIRE(VALID_SDLZDB(sdlz));
+	LOCK(&sdlz->refcnt_lock);
+	REQUIRE(sdlz->references > 0);
+	sdlz->references--;
+	if (sdlz->references == 0)
+		need_destroy = ISC_TRUE;
+	UNLOCK(&sdlz->refcnt_lock);
+
+	if (need_destroy)
+		destroy(sdlz);
+
+	*dbp = NULL;
+}
+
+static isc_result_t
+beginload(dns_db_t *db, dns_addrdatasetfunc_t *addp, dns_dbload_t **dbloadp) {
+	UNUSED(db);
+	UNUSED(addp);
+	UNUSED(dbloadp);
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static isc_result_t
+endload(dns_db_t *db, dns_dbload_t **dbloadp) {
+	UNUSED(db);
+	UNUSED(dbloadp);
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static isc_result_t
+dump(dns_db_t *db, dns_dbversion_t *version, const char *filename,
+     dns_masterformat_t masterformat)
+{
+	UNUSED(db);
+	UNUSED(version);
+	UNUSED(filename);
+	UNUSED(masterformat);
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static void
+currentversion(dns_db_t *db, dns_dbversion_t **versionp) {
+	REQUIRE(versionp != NULL && *versionp == NULL);
+
+	UNUSED(db);
+
+	*versionp = (void *) &dummy;
+	return;
+}
+
+static isc_result_t
+newversion(dns_db_t *db, dns_dbversion_t **versionp) {
+	UNUSED(db);
+	UNUSED(versionp);
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static void
+attachversion(dns_db_t *db, dns_dbversion_t *source,
+	      dns_dbversion_t **targetp)
+{
+	REQUIRE(source != NULL && source == (void *) &dummy);
+
+	UNUSED(db);
+	UNUSED(source);
+	UNUSED(targetp);
+	*targetp = source;
+}
+
+static void
+closeversion(dns_db_t *db, dns_dbversion_t **versionp, isc_boolean_t commit) {
+	REQUIRE(versionp != NULL && *versionp == (void *) &dummy);
+	REQUIRE(commit == ISC_FALSE);
+
+	UNUSED(db);
+	UNUSED(commit);
+
+	*versionp = NULL;
+}
+
+static isc_result_t
+createnode(dns_sdlz_db_t *sdlz, dns_sdlznode_t **nodep) {
+	dns_sdlznode_t *node;
+	isc_result_t result;
+
+	node = isc_mem_get(sdlz->common.mctx, sizeof(dns_sdlznode_t));
+	if (node == NULL)
+		return (ISC_R_NOMEMORY);
+
+	node->sdlz = NULL;
+	attach((dns_db_t *)sdlz, (dns_db_t **)&node->sdlz);
+	ISC_LIST_INIT(node->lists);
+	ISC_LIST_INIT(node->buffers);
+	ISC_LINK_INIT(node, link);
+	node->name = NULL;
+	result = isc_mutex_init(&node->lock);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_mutex_init() failed: %s",
+				 isc_result_totext(result));
+		isc_mem_put(sdlz->common.mctx, node, sizeof(dns_sdlznode_t));
+		return (ISC_R_UNEXPECTED);
+	}
+	dns_rdatacallbacks_init(&node->callbacks);
+	node->references = 1;
+	node->magic = SDLZLOOKUP_MAGIC;
+
+	*nodep = node;
+	return (ISC_R_SUCCESS);
+}
+
+static void
+destroynode(dns_sdlznode_t *node) {
+	dns_rdatalist_t *list;
+	dns_rdata_t *rdata;
+	isc_buffer_t *b;
+	dns_sdlz_db_t *sdlz;
+	dns_db_t *db;
+	isc_mem_t *mctx;
+
+	sdlz = node->sdlz;
+	mctx = sdlz->common.mctx;
+
+	while (!ISC_LIST_EMPTY(node->lists)) {
+		list = ISC_LIST_HEAD(node->lists);
+		while (!ISC_LIST_EMPTY(list->rdata)) {
+			rdata = ISC_LIST_HEAD(list->rdata);
+			ISC_LIST_UNLINK(list->rdata, rdata, link);
+			isc_mem_put(mctx, rdata, sizeof(dns_rdata_t));
+		}
+		ISC_LIST_UNLINK(node->lists, list, link);
+		isc_mem_put(mctx, list, sizeof(dns_rdatalist_t));
+	}
+
+	while (!ISC_LIST_EMPTY(node->buffers)) {
+		b = ISC_LIST_HEAD(node->buffers);
+		ISC_LIST_UNLINK(node->buffers, b, link);
+		isc_buffer_free(&b);
+	}
+
+	if (node->name != NULL) {
+		dns_name_free(node->name, mctx);
+		isc_mem_put(mctx, node->name, sizeof(dns_name_t));
+	}
+	DESTROYLOCK(&node->lock);
+	node->magic = 0;
+	isc_mem_put(mctx, node, sizeof(dns_sdlznode_t));
+	db = &sdlz->common;
+	detach(&db);
+}
+
+static isc_result_t
+findnode(dns_db_t *db, dns_name_t *name, isc_boolean_t create,
+	 dns_dbnode_t **nodep)
+{
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
+	dns_sdlznode_t *node = NULL;
+	isc_result_t result;
+	isc_buffer_t b;
+	char namestr[DNS_NAME_MAXTEXT + 1];
+	isc_buffer_t b2;
+	char zonestr[DNS_NAME_MAXTEXT + 1];
+	isc_boolean_t isorigin;
+	dns_sdlzauthorityfunc_t authority;
+
+	REQUIRE(VALID_SDLZDB(sdlz));
+	REQUIRE(create == ISC_FALSE);
+	REQUIRE(nodep != NULL && *nodep == NULL);
+
+	UNUSED(name);
+	UNUSED(create);
+
+	isc_buffer_init(&b, namestr, sizeof(namestr));
+	if ((sdlz->dlzimp->flags & DNS_SDLZFLAG_RELATIVEOWNER) != 0) {
+		dns_name_t relname;
+		unsigned int labels;
+
+		labels = dns_name_countlabels(name) -
+			 dns_name_countlabels(&db->origin);
+		dns_name_init(&relname, NULL);
+		dns_name_getlabelsequence(name, 0, labels, &relname);
+		result = dns_name_totext(&relname, ISC_TRUE, &b);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	} else {
+		result = dns_name_totext(name, ISC_TRUE, &b);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	}
+	isc_buffer_putuint8(&b, 0);
+
+	isc_buffer_init(&b2, zonestr, sizeof(zonestr));
+	result = dns_name_totext(&sdlz->common.origin, ISC_TRUE, &b2);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_buffer_putuint8(&b2, 0);
+
+	result = createnode(sdlz, &node);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	isorigin = dns_name_equal(name, &sdlz->common.origin);
+
+	/* make sure strings are always lowercase */
+	dns_sdlz_tolower(zonestr);
+	dns_sdlz_tolower(namestr);
+
+	MAYBE_LOCK(sdlz->dlzimp);
+
+	/* try to lookup the host (namestr) */
+	result = sdlz->dlzimp->methods->lookup(zonestr, namestr,
+					       sdlz->dlzimp->driverarg,
+					       sdlz->dbdata, node);
+
+	/*
+	 * if the host (namestr) was not found, try to lookup a
+	 * "wildcard" host.
+	 */
+	if (result != ISC_R_SUCCESS) {
+		result = sdlz->dlzimp->methods->lookup(zonestr, "*",
+						       sdlz->dlzimp->driverarg,
+						       sdlz->dbdata, node);
+	}
+
+	MAYBE_UNLOCK(sdlz->dlzimp);
+
+	if (result != ISC_R_SUCCESS && !isorigin) {
+		destroynode(node);
+		return (result);
+	}
+
+	if (isorigin && sdlz->dlzimp->methods->authority != NULL) {
+		MAYBE_LOCK(sdlz->dlzimp);
+		authority = sdlz->dlzimp->methods->authority;
+		result = (*authority)(zonestr, sdlz->dlzimp->driverarg,
+				      sdlz->dbdata, node);
+		MAYBE_UNLOCK(sdlz->dlzimp);
+		if (result != ISC_R_SUCCESS &&
+		    result != ISC_R_NOTIMPLEMENTED) {
+			destroynode(node);
+			return (result);
+		}
+	}
+
+	*nodep = node;
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+findzonecut(dns_db_t *db, dns_name_t *name, unsigned int options,
+	    isc_stdtime_t now, dns_dbnode_t **nodep, dns_name_t *foundname,
+	    dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+{
+	UNUSED(db);
+	UNUSED(name);
+	UNUSED(options);
+	UNUSED(now);
+	UNUSED(nodep);
+	UNUSED(foundname);
+	UNUSED(rdataset);
+	UNUSED(sigrdataset);
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static void
+attachnode(dns_db_t *db, dns_dbnode_t *source, dns_dbnode_t **targetp) {
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
+	dns_sdlznode_t *node = (dns_sdlznode_t *)source;
+
+	REQUIRE(VALID_SDLZDB(sdlz));
+
+	UNUSED(sdlz);
+
+	LOCK(&node->lock);
+	INSIST(node->references > 0);
+	node->references++;
+	INSIST(node->references != 0);		/* Catch overflow. */
+	UNLOCK(&node->lock);
+
+	*targetp = source;
+}
+
+static void
+detachnode(dns_db_t *db, dns_dbnode_t **targetp) {
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
+	dns_sdlznode_t *node;
+	isc_boolean_t need_destroy = ISC_FALSE;
+
+	REQUIRE(VALID_SDLZDB(sdlz));
+	REQUIRE(targetp != NULL && *targetp != NULL);
+
+	UNUSED(sdlz);
+
+	node = (dns_sdlznode_t *)(*targetp);
+
+	LOCK(&node->lock);
+	INSIST(node->references > 0);
+	node->references--;
+	if (node->references == 0)
+		need_destroy = ISC_TRUE;
+	UNLOCK(&node->lock);
+
+	if (need_destroy)
+		destroynode(node);
+
+	*targetp = NULL;
+}
+
+static isc_result_t
+expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
+	UNUSED(db);
+	UNUSED(node);
+	UNUSED(now);
+	INSIST(0);
+	return (ISC_R_UNEXPECTED);
+}
+
+static void
+printnode(dns_db_t *db, dns_dbnode_t *node, FILE *out) {
+	UNUSED(db);
+	UNUSED(node);
+	UNUSED(out);
+	return;
+}
+
+static isc_result_t
+createiterator(dns_db_t *db, isc_boolean_t relative_names,
+	       dns_dbiterator_t **iteratorp)
+{
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
+	sdlz_dbiterator_t *sdlziter;
+	isc_result_t result;
+	isc_buffer_t b;
+	char zonestr[DNS_NAME_MAXTEXT + 1];
+
+	REQUIRE(VALID_SDLZDB(sdlz));
+
+	if (sdlz->dlzimp->methods->allnodes == NULL)
+		return (ISC_R_NOTIMPLEMENTED);
+
+	isc_buffer_init(&b, zonestr, sizeof(zonestr));
+	result = dns_name_totext(&sdlz->common.origin, ISC_TRUE, &b);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_buffer_putuint8(&b, 0);
+
+	sdlziter = isc_mem_get(sdlz->common.mctx, sizeof(sdlz_dbiterator_t));
+	if (sdlziter == NULL)
+		return (ISC_R_NOMEMORY);
+
+	sdlziter->common.methods = &dbiterator_methods;
+	sdlziter->common.db = NULL;
+	dns_db_attach(db, &sdlziter->common.db);
+	sdlziter->common.relative_names = relative_names;
+	sdlziter->common.magic = DNS_DBITERATOR_MAGIC;
+	ISC_LIST_INIT(sdlziter->nodelist);
+	sdlziter->current = NULL;
+	sdlziter->origin = NULL;
+
+	/* make sure strings are always lowercase */
+	dns_sdlz_tolower(zonestr);
+
+	MAYBE_LOCK(sdlz->dlzimp);
+	result = sdlz->dlzimp->methods->allnodes(zonestr,
+						 sdlz->dlzimp->driverarg,
+						 sdlz->dbdata, sdlziter);
+	MAYBE_UNLOCK(sdlz->dlzimp);
+	if (result != ISC_R_SUCCESS) {
+		dns_dbiterator_t *iter = &sdlziter->common;
+		dbiterator_destroy(&iter);
+		return (result);
+	}
+
+	if (sdlziter->origin != NULL) {
+		ISC_LIST_UNLINK(sdlziter->nodelist, sdlziter->origin, link);
+		ISC_LIST_PREPEND(sdlziter->nodelist, sdlziter->origin, link);
+	}
+
+	*iteratorp = (dns_dbiterator_t *)sdlziter;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+	     dns_rdatatype_t type, dns_rdatatype_t covers,
+	     isc_stdtime_t now, dns_rdataset_t *rdataset,
+	     dns_rdataset_t *sigrdataset)
+{
+	dns_rdatalist_t *list;
+	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *)node;
+
+	REQUIRE(VALID_SDLZNODE(node));
+
+	UNUSED(db);
+	UNUSED(version);
+	UNUSED(covers);
+	UNUSED(now);
+	UNUSED(sigrdataset);
+
+	if (type == dns_rdatatype_sig || type == dns_rdatatype_rrsig)
+		return (ISC_R_NOTIMPLEMENTED);
+
+	list = ISC_LIST_HEAD(sdlznode->lists);
+	while (list != NULL) {
+		if (list->type == type)
+			break;
+		list = ISC_LIST_NEXT(list, link);
+	}
+	if (list == NULL)
+		return (ISC_R_NOTFOUND);
+
+	list_tordataset(list, db, node, rdataset);
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+find(dns_db_t *db, dns_name_t *name, dns_dbversion_t *version,
+     dns_rdatatype_t type, unsigned int options, isc_stdtime_t now,
+     dns_dbnode_t **nodep, dns_name_t *foundname,
+     dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset)
+{
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)db;
+	dns_dbnode_t *node = NULL;
+	dns_fixedname_t fname;
+	dns_rdataset_t xrdataset;
+	dns_name_t *xname;
+	unsigned int nlabels, olabels;
+	isc_result_t result;
+	unsigned int i;
+
+	REQUIRE(VALID_SDLZDB(sdlz));
+	REQUIRE(nodep == NULL || *nodep == NULL);
+	REQUIRE(version == NULL || version == (void *) &dummy);
+
+	UNUSED(options);
+	UNUSED(sdlz);
+
+	if (!dns_name_issubdomain(name, &db->origin))
+		return (DNS_R_NXDOMAIN);
+
+	olabels = dns_name_countlabels(&db->origin);
+	nlabels = dns_name_countlabels(name);
+
+	dns_fixedname_init(&fname);
+	xname = dns_fixedname_name(&fname);
+
+	if (rdataset == NULL) {
+		dns_rdataset_init(&xrdataset);
+		rdataset = &xrdataset;
+	}
+
+	result = DNS_R_NXDOMAIN;
+
+	for (i = olabels; i <= nlabels; i++) {
+		/*
+		 * Unless this is an explicit lookup at the origin, don't
+		 * look at the origin.
+		 */
+		if (i == olabels && i != nlabels)
+			continue;
+
+		/*
+		 * Look up the next label.
+		 */
+		dns_name_getlabelsequence(name, nlabels - i, i, xname);
+		result = findnode(db, xname, ISC_FALSE, &node);
+		if (result != ISC_R_SUCCESS) {
+			result = DNS_R_NXDOMAIN;
+			continue;
+		}
+
+		/*
+		 * Look for a DNAME at the current label, unless this is
+		 * the qname.
+		 */
+		if (i < nlabels) {
+			result = findrdataset(db, node, version,
+					      dns_rdatatype_dname,
+					      0, now, rdataset, sigrdataset);
+			if (result == ISC_R_SUCCESS) {
+				result = DNS_R_DNAME;
+				break;
+			}
+		}
+
+		/*
+		 * Look for an NS at the current label, unless this is the
+		 * origin or glue is ok.
+		 */
+		if (i != olabels && (options & DNS_DBFIND_GLUEOK) == 0) {
+			result = findrdataset(db, node, version,
+					      dns_rdatatype_ns,
+					      0, now, rdataset, sigrdataset);
+			if (result == ISC_R_SUCCESS) {
+				if (i == nlabels && type == dns_rdatatype_any)
+				{
+					result = DNS_R_ZONECUT;
+					dns_rdataset_disassociate(rdataset);
+					if (sigrdataset != NULL)
+						dns_rdataset_disassociate
+							(sigrdataset);
+				} else
+					result = DNS_R_DELEGATION;
+				break;
+			}
+		}
+
+		/*
+		 * If the current name is not the qname, add another label
+		 * and try again.
+		 */
+		if (i < nlabels) {
+			destroynode(node);
+			node = NULL;
+			continue;
+		}
+
+		/*
+		 * If we're looking for ANY, we're done.
+		 */
+		if (type == dns_rdatatype_any) {
+			result = ISC_R_SUCCESS;
+			break;
+		}
+
+		/*
+		 * Look for the qtype.
+		 */
+		result = findrdataset(db, node, version, type,
+				      0, now, rdataset, sigrdataset);
+		if (result == ISC_R_SUCCESS)
+			break;
+
+		/*
+		 * Look for a CNAME
+		 */
+		if (type != dns_rdatatype_cname) {
+			result = findrdataset(db, node, version,
+					      dns_rdatatype_cname,
+					      0, now, rdataset, sigrdataset);
+			if (result == ISC_R_SUCCESS) {
+				result = DNS_R_CNAME;
+				break;
+			}
+		}
+
+		result = DNS_R_NXRRSET;
+		break;
+	}
+
+	if (rdataset == &xrdataset && dns_rdataset_isassociated(rdataset))
+		dns_rdataset_disassociate(rdataset);
+
+	if (foundname != NULL) {
+		isc_result_t xresult;
+
+		xresult = dns_name_copy(xname, foundname, NULL);
+		if (xresult != ISC_R_SUCCESS) {
+			if (node != NULL)
+				destroynode(node);
+			if (dns_rdataset_isassociated(rdataset))
+				dns_rdataset_disassociate(rdataset);
+			return (DNS_R_BADDB);
+		}
+	}
+
+	if (nodep != NULL)
+		*nodep = node;
+	else if (node != NULL)
+		detachnode(db, &node);
+
+	return (result);
+}
+
+static isc_result_t
+allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+	     isc_stdtime_t now, dns_rdatasetiter_t **iteratorp)
+{
+	sdlz_rdatasetiter_t *iterator;
+
+	REQUIRE(version == NULL || version == &dummy);
+
+	UNUSED(version);
+	UNUSED(now);
+
+	iterator = isc_mem_get(db->mctx, sizeof(sdlz_rdatasetiter_t));
+	if (iterator == NULL)
+		return (ISC_R_NOMEMORY);
+
+	iterator->common.magic = DNS_RDATASETITER_MAGIC;
+	iterator->common.methods = &rdatasetiter_methods;
+	iterator->common.db = db;
+	iterator->common.node = NULL;
+	attachnode(db, node, &iterator->common.node);
+	iterator->common.version = version;
+	iterator->common.now = now;
+
+	*iteratorp = (dns_rdatasetiter_t *)iterator;
+
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+addrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+	    isc_stdtime_t now, dns_rdataset_t *rdataset, unsigned int options,
+	    dns_rdataset_t *addedrdataset)
+{
+	UNUSED(db);
+	UNUSED(node);
+	UNUSED(version);
+	UNUSED(now);
+	UNUSED(rdataset);
+	UNUSED(options);
+	UNUSED(addedrdataset);
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static isc_result_t
+subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+		 dns_rdataset_t *rdataset, unsigned int options,
+		 dns_rdataset_t *newrdataset)
+{
+	UNUSED(db);
+	UNUSED(node);
+	UNUSED(version);
+	UNUSED(rdataset);
+	UNUSED(options);
+	UNUSED(newrdataset);
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static isc_result_t
+deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
+	       dns_rdatatype_t type, dns_rdatatype_t covers)
+{
+	UNUSED(db);
+	UNUSED(node);
+	UNUSED(version);
+	UNUSED(type);
+	UNUSED(covers);
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static isc_boolean_t
+issecure(dns_db_t *db) {
+	UNUSED(db);
+
+	return (ISC_FALSE);
+}
+
+static unsigned int
+nodecount(dns_db_t *db) {
+	UNUSED(db);
+
+	return (0);
+}
+
+static isc_boolean_t
+ispersistent(dns_db_t *db) {
+	UNUSED(db);
+	return (ISC_TRUE);
+}
+
+static void
+overmem(dns_db_t *db, isc_boolean_t overmem) {
+	UNUSED(db);
+	UNUSED(overmem);
+}
+
+static void
+settask(dns_db_t *db, isc_task_t *task) {
+	UNUSED(db);
+	UNUSED(task);
+}
+
+
+static dns_dbmethods_t sdlzdb_methods = {
+	attach,
+	detach,
+	beginload,
+	endload,
+	dump,
+	currentversion,
+	newversion,
+	attachversion,
+	closeversion,
+	findnode,
+	find,
+	findzonecut,
+	attachnode,
+	detachnode,
+	expirenode,
+	printnode,
+	createiterator,
+	findrdataset,
+	allrdatasets,
+	addrdataset,
+	subtractrdataset,
+	deleterdataset,
+	issecure,
+	nodecount,
+	ispersistent,
+	overmem,
+	settask,
+	NULL,
+};
+
+/*
+ * Database Iterator Methods.  These methods were "borrowed" from the SDB
+ * driver interface.  See the SDB driver interface documentation for more info.
+ */
+
+static void
+dbiterator_destroy(dns_dbiterator_t **iteratorp) {
+	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)(*iteratorp);
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)sdlziter->common.db;
+
+	while (!ISC_LIST_EMPTY(sdlziter->nodelist)) {
+		dns_sdlznode_t *node;
+		node = ISC_LIST_HEAD(sdlziter->nodelist);
+		ISC_LIST_UNLINK(sdlziter->nodelist, node, link);
+		destroynode(node);
+	}
+
+	dns_db_detach(&sdlziter->common.db);
+	isc_mem_put(sdlz->common.mctx, sdlziter, sizeof(sdlz_dbiterator_t));
+
+	*iteratorp = NULL;
+}
+
+static isc_result_t
+dbiterator_first(dns_dbiterator_t *iterator) {
+	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
+
+	sdlziter->current = ISC_LIST_HEAD(sdlziter->nodelist);
+	if (sdlziter->current == NULL)
+		return (ISC_R_NOMORE);
+	else
+		return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+dbiterator_last(dns_dbiterator_t *iterator) {
+	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
+
+	sdlziter->current = ISC_LIST_TAIL(sdlziter->nodelist);
+	if (sdlziter->current == NULL)
+		return (ISC_R_NOMORE);
+	else
+		return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) {
+	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
+
+	sdlziter->current = ISC_LIST_HEAD(sdlziter->nodelist);
+	while (sdlziter->current != NULL)
+		if (dns_name_equal(sdlziter->current->name, name))
+			return (ISC_R_SUCCESS);
+	return (ISC_R_NOTFOUND);
+}
+
+static isc_result_t
+dbiterator_prev(dns_dbiterator_t *iterator) {
+	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
+
+	sdlziter->current = ISC_LIST_PREV(sdlziter->current, link);
+	if (sdlziter->current == NULL)
+		return (ISC_R_NOMORE);
+	else
+		return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+dbiterator_next(dns_dbiterator_t *iterator) {
+	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
+
+	sdlziter->current = ISC_LIST_NEXT(sdlziter->current, link);
+	if (sdlziter->current == NULL)
+		return (ISC_R_NOMORE);
+	else
+		return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+dbiterator_current(dns_dbiterator_t *iterator, dns_dbnode_t **nodep,
+		   dns_name_t *name)
+{
+	sdlz_dbiterator_t *sdlziter = (sdlz_dbiterator_t *)iterator;
+
+	attachnode(iterator->db, sdlziter->current, nodep);
+	if (name != NULL)
+		return (dns_name_copy(sdlziter->current->name, name, NULL));
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+dbiterator_pause(dns_dbiterator_t *iterator) {
+	UNUSED(iterator);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+dbiterator_origin(dns_dbiterator_t *iterator, dns_name_t *name) {
+	UNUSED(iterator);
+	return (dns_name_copy(dns_rootname, name, NULL));
+}
+
+/*
+ * Rdataset Methods. These methods were "borrowed" from the SDB driver
+ * interface.  See the SDB driver interface documentation for more info.
+ */
+
+static void
+disassociate(dns_rdataset_t *rdataset) {
+	dns_dbnode_t *node = rdataset->private5;
+	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *) node;
+	dns_db_t *db = (dns_db_t *) sdlznode->sdlz;
+
+	detachnode(db, &node);
+	isc__rdatalist_disassociate(rdataset);
+}
+
+static void
+rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) {
+	dns_dbnode_t *node = source->private5;
+	dns_sdlznode_t *sdlznode = (dns_sdlznode_t *) node;
+	dns_db_t *db = (dns_db_t *) sdlznode->sdlz;
+	dns_dbnode_t *tempdb = NULL;
+
+	isc__rdatalist_clone(source, target);
+	attachnode(db, node, &tempdb);
+	source->private5 = tempdb;
+}
+
+static dns_rdatasetmethods_t rdataset_methods = {
+	disassociate,
+	isc__rdatalist_first,
+	isc__rdatalist_next,
+	isc__rdatalist_current,
+	rdataset_clone,
+	isc__rdatalist_count,
+	isc__rdatalist_addnoqname,
+	isc__rdatalist_getnoqname,
+	NULL,
+	NULL,
+	NULL
+};
+
+static void
+list_tordataset(dns_rdatalist_t *rdatalist,
+		dns_db_t *db, dns_dbnode_t *node,
+		dns_rdataset_t *rdataset)
+{
+	/*
+	 * The sdlz rdataset is an rdatalist with some additions.
+	 *	- private1 & private2 are used by the rdatalist.
+	 *	- private3 & private 4 are unused.
+	 *	- private5 is the node.
+	 */
+
+	/* This should never fail. */
+	RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset) ==
+		      ISC_R_SUCCESS);
+
+	rdataset->methods = &rdataset_methods;
+	dns_db_attachnode(db, node, &rdataset->private5);
+}
+
+/*
+ * SDLZ core methods. This is the core of the new DLZ functionality.
+ */
+
+/*%
+ * Build a 'bind' database driver structure to be returned by
+ * either the find zone or the allow zone transfer method.
+ * This method is only available in this source file, it is
+ * not made available anywhere else.
+ */
+
+static isc_result_t
+dns_sdlzcreateDBP(isc_mem_t *mctx, void *driverarg, void *dbdata,
+		  dns_name_t *name, dns_rdataclass_t rdclass, dns_db_t **dbp)
+{
+	isc_result_t result;
+	dns_sdlz_db_t *sdlzdb;
+	dns_sdlzimplementation_t *imp;
+
+	/* check that things are as we expect */
+	REQUIRE(dbp != NULL && *dbp == NULL);
+	REQUIRE(name != NULL);
+
+	imp = (dns_sdlzimplementation_t *) driverarg;
+
+	/* allocate and zero memory for driver structure */
+	sdlzdb = isc_mem_get(mctx, sizeof(dns_sdlz_db_t));
+	if (sdlzdb == NULL)
+		return (ISC_R_NOMEMORY);
+	memset(sdlzdb, 0, sizeof(dns_sdlz_db_t));
+
+	/* initialize and set origin */
+	dns_name_init(&sdlzdb->common.origin, NULL);
+	result = dns_name_dupwithoffsets(name, mctx, &sdlzdb->common.origin);
+	if (result != ISC_R_SUCCESS)
+		goto mem_cleanup;
+
+	/* initialize the reference count mutex */
+	result = isc_mutex_init(&sdlzdb->refcnt_lock);
+	if (result != ISC_R_SUCCESS)
+		goto name_cleanup;
+
+	/* set the rest of the database structure attributes */
+	sdlzdb->dlzimp = imp;
+	sdlzdb->common.methods = &sdlzdb_methods;
+	sdlzdb->common.attributes = 0;
+	sdlzdb->common.rdclass = rdclass;
+	sdlzdb->common.mctx = NULL;
+	sdlzdb->dbdata = dbdata;
+	sdlzdb->references = 1;
+
+	/* attach to the memory context */
+	isc_mem_attach(mctx, &sdlzdb->common.mctx);
+
+	/* mark structure as valid */
+	sdlzdb->common.magic = DNS_DB_MAGIC;
+	sdlzdb->common.impmagic = SDLZDB_MAGIC;
+	*dbp = (dns_db_t *) sdlzdb;
+
+	return (result);
+
+	/*
+	 * reference count mutex could not be initialized, clean up
+	 * name memory
+	 */
+ name_cleanup:
+	dns_name_free(&sdlzdb->common.origin, mctx);
+ mem_cleanup:
+	isc_mem_put(mctx, sdlzdb, sizeof(dns_sdlz_db_t));
+	return (result);
+}
+
+static isc_result_t
+dns_sdlzallowzonexfr(void *driverarg, void *dbdata, isc_mem_t *mctx,
+		     dns_rdataclass_t rdclass, dns_name_t *name,
+		     isc_sockaddr_t *clientaddr, dns_db_t **dbp)
+{
+	isc_buffer_t b;
+	isc_buffer_t b2;
+	char namestr[DNS_NAME_MAXTEXT + 1];
+	char clientstr[(sizeof "xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:255.255.255.255")
+		       + 1];
+	isc_netaddr_t netaddr;
+	isc_result_t result;
+	dns_sdlzimplementation_t *imp;
+
+	/*
+	 * Perform checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(driverarg != NULL);
+	REQUIRE(name != NULL);
+	REQUIRE(clientaddr != NULL);
+	REQUIRE(dbp != NULL && *dbp == NULL);
+
+	imp = (dns_sdlzimplementation_t *) driverarg;
+
+	/* Convert DNS name to ascii text */
+	isc_buffer_init(&b, namestr, sizeof(namestr));
+	result = dns_name_totext(name, ISC_TRUE, &b);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_buffer_putuint8(&b, 0);
+
+	/* convert client address to ascii text */
+	isc_buffer_init(&b2, clientstr, sizeof(clientstr));
+	isc_netaddr_fromsockaddr(&netaddr, clientaddr);
+	result = isc_netaddr_totext(&netaddr, &b2);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_buffer_putuint8(&b2, 0);
+
+        /* make sure strings are always lowercase */
+	dns_sdlz_tolower(namestr);
+	dns_sdlz_tolower(clientstr);
+
+	/* Call SDLZ driver's find zone method */
+	if (imp->methods->allowzonexfr != NULL) {
+		MAYBE_LOCK(imp);
+		result = imp->methods->allowzonexfr(imp->driverarg, dbdata,
+						    namestr, clientstr);
+		MAYBE_UNLOCK(imp);
+		/*
+		 * if zone is supported and transfers allowed build a 'bind'
+		 * database driver
+		 */
+		if (result == ISC_R_SUCCESS)
+			result = dns_sdlzcreateDBP(mctx, driverarg, dbdata,
+						   name, rdclass, dbp);
+		return (result);
+	}
+
+	return (ISC_R_NOTIMPLEMENTED);
+}
+
+static isc_result_t
+dns_sdlzcreate(isc_mem_t *mctx, const char *dlzname, unsigned int argc,
+	       char *argv[], void *driverarg, void **dbdata)
+{
+	dns_sdlzimplementation_t *imp;
+	isc_result_t result = ISC_R_NOTFOUND;
+
+	/* Write debugging message to log */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+		      "Loading SDLZ driver.");
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(driverarg != NULL);
+	REQUIRE(dlzname != NULL);
+	REQUIRE(dbdata != NULL);
+	UNUSED(mctx);
+
+	imp = driverarg;
+
+	/* If the create method exists, call it. */
+	if (imp->methods->create != NULL) {
+		MAYBE_LOCK(imp);
+		result = imp->methods->create(dlzname, argc, argv,
+					      imp->driverarg, dbdata);
+		MAYBE_UNLOCK(imp);
+	}
+
+	/* Write debugging message to log */
+	if (result == ISC_R_SUCCESS) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+			      "SDLZ driver loaded successfully.");
+	} else {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DLZ, ISC_LOG_ERROR,
+			      "SDLZ driver failed to load.");
+	}
+
+	return (result);
+}
+
+static void
+dns_sdlzdestroy(void *driverdata, void **dbdata)
+{
+
+	dns_sdlzimplementation_t *imp;
+
+	/* Write debugging message to log */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+		      "Unloading SDLZ driver.");
+
+	imp = driverdata;
+
+	/* If the destroy method exists, call it. */
+	if (imp->methods->destroy != NULL) {
+		MAYBE_LOCK(imp);
+		imp->methods->destroy(imp->driverarg, dbdata);
+		MAYBE_UNLOCK(imp);
+	}
+}
+
+static isc_result_t
+dns_sdlzfindzone(void *driverarg, void *dbdata, isc_mem_t *mctx,
+		 dns_rdataclass_t rdclass, dns_name_t *name, dns_db_t **dbp)
+{
+	isc_buffer_t b;
+	char namestr[DNS_NAME_MAXTEXT + 1];
+	isc_result_t result;
+	dns_sdlzimplementation_t *imp;
+
+	/*
+	 * Perform checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(driverarg != NULL);
+	REQUIRE(name != NULL);
+	REQUIRE(dbp != NULL && *dbp == NULL);
+
+	imp = (dns_sdlzimplementation_t *) driverarg;
+
+	/* Convert DNS name to ascii text */
+	isc_buffer_init(&b, namestr, sizeof(namestr));
+	result = dns_name_totext(name, ISC_TRUE, &b);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	isc_buffer_putuint8(&b, 0);
+
+        /* make sure strings are always lowercase */
+	dns_sdlz_tolower(namestr);
+
+	/* Call SDLZ driver's find zone method */
+	MAYBE_LOCK(imp);
+	result = imp->methods->findzone(imp->driverarg, dbdata, namestr);
+	MAYBE_UNLOCK(imp);
+
+	/*
+	 * if zone is supported build a 'bind' database driver
+	 * structure to return
+	 */
+	if (result == ISC_R_SUCCESS)
+		result = dns_sdlzcreateDBP(mctx, driverarg, dbdata, name,
+					   rdclass, dbp);
+
+	return (result);
+}
+
+static dns_dlzmethods_t sdlzmethods = {
+	dns_sdlzcreate,
+	dns_sdlzdestroy,
+	dns_sdlzfindzone,
+	dns_sdlzallowzonexfr
+};
+
+/*
+ * Public functions.
+ */
+
+isc_result_t
+dns_sdlz_putrr(dns_sdlzlookup_t *lookup, const char *type, dns_ttl_t ttl,
+	       const char *data)
+{
+	dns_rdatalist_t *rdatalist;
+	dns_rdata_t *rdata;
+	dns_rdatatype_t typeval;
+	isc_consttextregion_t r;
+	isc_buffer_t b;
+	isc_buffer_t *rdatabuf = NULL;
+	isc_lex_t *lex;
+	isc_result_t result;
+	unsigned int size;
+	isc_mem_t *mctx;
+	dns_name_t *origin;
+
+	REQUIRE(VALID_SDLZLOOKUP(lookup));
+	REQUIRE(type != NULL);
+	REQUIRE(data != NULL);
+
+	mctx = lookup->sdlz->common.mctx;
+
+	r.base = type;
+	r.length = strlen(type);
+	result = dns_rdatatype_fromtext(&typeval, (void *) &r);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	rdatalist = ISC_LIST_HEAD(lookup->lists);
+	while (rdatalist != NULL) {
+		if (rdatalist->type == typeval)
+			break;
+		rdatalist = ISC_LIST_NEXT(rdatalist, link);
+	}
+
+	if (rdatalist == NULL) {
+		rdatalist = isc_mem_get(mctx, sizeof(dns_rdatalist_t));
+		if (rdatalist == NULL)
+			return (ISC_R_NOMEMORY);
+		rdatalist->rdclass = lookup->sdlz->common.rdclass;
+		rdatalist->type = typeval;
+		rdatalist->covers = 0;
+		rdatalist->ttl = ttl;
+		ISC_LIST_INIT(rdatalist->rdata);
+		ISC_LINK_INIT(rdatalist, link);
+		ISC_LIST_APPEND(lookup->lists, rdatalist, link);
+	} else
+		if (rdatalist->ttl != ttl)
+			return (DNS_R_BADTTL);
+
+	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
+	if (rdata == NULL)
+		return (ISC_R_NOMEMORY);
+	dns_rdata_init(rdata);
+
+	if ((lookup->sdlz->dlzimp->flags & DNS_SDLZFLAG_RELATIVERDATA) != 0)
+		origin = &lookup->sdlz->common.origin;
+	else
+		origin = dns_rootname;
+
+	lex = NULL;
+	result = isc_lex_create(mctx, 64, &lex);
+	if (result != ISC_R_SUCCESS)
+		goto failure;
+
+	size = initial_size(data);
+	do {
+		isc_buffer_init(&b, data, strlen(data));
+		isc_buffer_add(&b, strlen(data));
+
+		result = isc_lex_openbuffer(lex, &b);
+		if (result != ISC_R_SUCCESS)
+			goto failure;
+
+		rdatabuf = NULL;
+		result = isc_buffer_allocate(mctx, &rdatabuf, size);
+		if (result != ISC_R_SUCCESS)
+			goto failure;
+
+		result = dns_rdata_fromtext(rdata, rdatalist->rdclass,
+					    rdatalist->type, lex,
+					    origin, ISC_FALSE,
+					    mctx, rdatabuf,
+					    &lookup->callbacks);
+		if (result != ISC_R_SUCCESS)
+			isc_buffer_free(&rdatabuf);
+		size *= 2;
+	} while (result == ISC_R_NOSPACE);
+
+	if (result != ISC_R_SUCCESS)
+		goto failure;
+
+	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
+	ISC_LIST_APPEND(lookup->buffers, rdatabuf, link);
+
+	if (lex != NULL)
+		isc_lex_destroy(&lex);
+
+	return (ISC_R_SUCCESS);
+
+ failure:
+ 	if (rdatabuf != NULL)
+		isc_buffer_free(&rdatabuf);
+	if (lex != NULL)
+		isc_lex_destroy(&lex);
+	isc_mem_put(mctx, rdata, sizeof(dns_rdata_t));
+
+	return (result);
+}
+
+isc_result_t
+dns_sdlz_putnamedrr(dns_sdlzallnodes_t *allnodes, const char *name,
+		    const char *type, dns_ttl_t ttl, const char *data)
+{
+	dns_name_t *newname, *origin;
+	dns_fixedname_t fnewname;
+	dns_sdlz_db_t *sdlz = (dns_sdlz_db_t *)allnodes->common.db;
+	dns_sdlznode_t *sdlznode;
+	isc_mem_t *mctx = sdlz->common.mctx;
+	isc_buffer_t b;
+	isc_result_t result;
+
+	dns_fixedname_init(&fnewname);
+	newname = dns_fixedname_name(&fnewname);
+
+	if ((sdlz->dlzimp->flags & DNS_SDLZFLAG_RELATIVERDATA) != 0)
+		origin = &sdlz->common.origin;
+	else
+		origin = dns_rootname;
+	isc_buffer_init(&b, name, strlen(name));
+	isc_buffer_add(&b, strlen(name));
+
+	result = dns_name_fromtext(newname, &b, origin, ISC_FALSE, NULL);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	if (allnodes->common.relative_names) {
+		/* All names are relative to the root */
+		unsigned int nlabels = dns_name_countlabels(newname);
+		dns_name_getlabelsequence(newname, 0, nlabels - 1, newname);
+	}
+
+	sdlznode = ISC_LIST_HEAD(allnodes->nodelist);
+	if (sdlznode == NULL || !dns_name_equal(sdlznode->name, newname)) {
+		sdlznode = NULL;
+		result = createnode(sdlz, &sdlznode);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+		sdlznode->name = isc_mem_get(mctx, sizeof(dns_name_t));
+		if (sdlznode->name == NULL) {
+			destroynode(sdlznode);
+			return (ISC_R_NOMEMORY);
+		}
+		dns_name_init(sdlznode->name, NULL);
+		result = dns_name_dup(newname, mctx, sdlznode->name);
+		if (result != ISC_R_SUCCESS) {
+			isc_mem_put(mctx, sdlznode->name, sizeof(dns_name_t));
+			destroynode(sdlznode);
+			return (result);
+		}
+		ISC_LIST_PREPEND(allnodes->nodelist, sdlznode, link);
+		if (allnodes->origin == NULL &&
+		    dns_name_equal(newname, &sdlz->common.origin))
+			allnodes->origin = sdlznode;
+	}
+	return (dns_sdlz_putrr(sdlznode, type, ttl, data));
+
+}
+
+isc_result_t
+dns_sdlz_putsoa(dns_sdlzlookup_t *lookup, const char *mname, const char *rname,
+		isc_uint32_t serial)
+{
+	char str[2 * DNS_NAME_MAXTEXT + 5 * (sizeof("2147483647")) + 7];
+	int n;
+
+	REQUIRE(mname != NULL);
+	REQUIRE(rname != NULL);
+
+	n = snprintf(str, sizeof str, "%s %s %u %u %u %u %u",
+		     mname, rname, serial,
+		     SDLZ_DEFAULT_REFRESH, SDLZ_DEFAULT_RETRY,
+		     SDLZ_DEFAULT_EXPIRE, SDLZ_DEFAULT_MINIMUM);
+	if (n >= (int)sizeof(str) || n < 0)
+		return (ISC_R_NOSPACE);
+	return (dns_sdlz_putrr(lookup, "SOA", SDLZ_DEFAULT_TTL, str));
+}
+
+isc_result_t
+dns_sdlzregister(const char *drivername, const dns_sdlzmethods_t *methods,
+		 void *driverarg, unsigned int flags, isc_mem_t *mctx,
+		 dns_sdlzimplementation_t **sdlzimp)
+{
+
+	dns_sdlzimplementation_t *imp;
+	isc_result_t result;
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(drivername != NULL);
+	REQUIRE(methods != NULL);
+	REQUIRE(methods->findzone != NULL);
+	REQUIRE(methods->lookup != NULL);
+	REQUIRE(mctx != NULL);
+	REQUIRE(sdlzimp != NULL && *sdlzimp == NULL);
+	REQUIRE((flags & ~(DNS_SDLZFLAG_RELATIVEOWNER |
+			   DNS_SDLZFLAG_RELATIVERDATA |
+			   DNS_SDLZFLAG_THREADSAFE)) == 0);
+
+	/* Write debugging message to log */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+		      "Registering SDLZ driver '%s'", drivername);
+
+	/*
+	 * Allocate memory for a sdlz_implementation object.  Error if
+	 * we cannot.
+	 */
+	imp = isc_mem_get(mctx, sizeof(dns_sdlzimplementation_t));
+	if (imp == NULL)
+		return (ISC_R_NOMEMORY);
+
+	/* Make sure memory region is set to all 0's */
+	memset(imp, 0, sizeof(dns_sdlzimplementation_t));
+
+	/* Store the data passed into this method */
+	imp->methods = methods;
+	imp->driverarg = driverarg;
+	imp->flags = flags;
+	imp->mctx = NULL;
+
+	/* attach the new sdlz_implementation object to a memory context */
+	isc_mem_attach(mctx, &imp->mctx);
+
+	/*
+	 * initialize the driver lock, error if we cannot
+	 * (used if a driver does not support multiple threads)
+	 */
+	result = isc_mutex_init(&imp->driverlock);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_mutex_init() failed: %s",
+				 isc_result_totext(result));
+		goto cleanup_mctx;
+	}
+
+	imp->dlz_imp = NULL;
+
+	/*
+	 * register the DLZ driver.  Pass in our "extra" sdlz information as
+	 * a driverarg.  (that's why we stored the passed in driver arg in our
+	 * sdlz_implementation structure)  Also, store the dlz_implementation
+	 * structure in our sdlz_implementation.
+	 */
+	result = dns_dlzregister(drivername, &sdlzmethods, imp, mctx,
+				 &imp->dlz_imp);
+
+	/* if registration fails, cleanup and get outta here. */
+	if (result != ISC_R_SUCCESS)
+		goto cleanup_mutex;
+
+	*sdlzimp = imp;
+
+	return (ISC_R_SUCCESS);
+
+ cleanup_mutex:
+	/* destroy the driver lock, we don't need it anymore */
+	DESTROYLOCK(&imp->driverlock);
+
+ cleanup_mctx:
+	/*
+	 * return the memory back to the available memory pool and
+	 * remove it from the memory context.
+	 */
+	isc_mem_put(mctx, imp, sizeof(dns_sdlzimplementation_t));
+	isc_mem_detach(&mctx);
+	return (result);
+}
+
+void
+dns_sdlzunregister(dns_sdlzimplementation_t **sdlzimp) {
+	dns_sdlzimplementation_t *imp;
+	isc_mem_t *mctx;
+
+	/* Write debugging message to log */
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+		      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(2),
+		      "Unregistering SDLZ driver.");
+
+	/*
+	 * Performs checks to make sure data is as we expect it to be.
+	 */
+	REQUIRE(sdlzimp != NULL && *sdlzimp != NULL);
+
+	imp = *sdlzimp;
+
+	/* Unregister the DLZ driver implementation */
+	dns_dlzunregister(&imp->dlz_imp);
+
+	/* destroy the driver lock, we don't need it anymore */
+	DESTROYLOCK(&imp->driverlock);
+
+	mctx = imp->mctx;
+
+	/*
+	 * return the memory back to the available memory pool and
+	 * remove it from the memory context.
+	 */
+	isc_mem_put(mctx, imp, sizeof(dns_sdlzimplementation_t));
+	isc_mem_detach(&mctx);
+
+	*sdlzimp = NULL;
+}
diff --git a/contrib/bind9/lib/dns/soa.c b/contrib/bind9/lib/dns/soa.c
index c0e0518..20198c0 100644
--- a/contrib/bind9/lib/dns/soa.c
+++ b/contrib/bind9/lib/dns/soa.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: soa.c,v 1.3.206.1 2004/03/06 08:13:45 marka Exp $ */
+/* $Id: soa.c,v 1.4.18.2 2005/04/29 00:16:05 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/ssu.c b/contrib/bind9/lib/dns/ssu.c
index a9ecdce..fa3011c 100644
--- a/contrib/bind9/lib/dns/ssu.c
+++ b/contrib/bind9/lib/dns/ssu.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,8 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/*! \file */
 /*
- * $Id: ssu.c,v 1.22.206.3 2004/03/08 09:04:32 marka Exp $
+ * $Id: ssu.c,v 1.24.18.4 2006/02/16 23:51:32 marka Exp $
  * Principal Author: Brian Wellington
  */
 
@@ -24,9 +25,11 @@
 
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/result.h>
 #include <isc/string.h>		/* Required for HP/UX (and others?) */
 #include <isc/util.h>
 
+#include <dns/fixedname.h>
 #include <dns/name.h>
 #include <dns/ssu.h>
 
@@ -38,13 +41,13 @@
 
 struct dns_ssurule {
 	unsigned int magic;
-	isc_boolean_t grant;	/* is this a grant or a deny? */
-	unsigned int matchtype;	/* which type of pattern match? */
-	dns_name_t *identity;	/* the identity to match */
-	dns_name_t *name;	/* the name being updated */
-	unsigned int ntypes;	/* number of data types covered */
-	dns_rdatatype_t *types;	/* the data types.  Can include ANY, */
-				/* defaults to all but SIG,SOA,NS if NULL*/
+	isc_boolean_t grant;	/*%< is this a grant or a deny? */
+	unsigned int matchtype;	/*%< which type of pattern match? */
+	dns_name_t *identity;	/*%< the identity to match */
+	dns_name_t *name;	/*%< the name being updated */
+	unsigned int ntypes;	/*%< number of data types covered */
+	dns_rdatatype_t *types;	/*%< the data types.  Can include ANY, */
+				/*%< defaults to all but SIG,SOA,NS if NULL */
 	ISC_LINK(dns_ssurule_t) link;
 };
 
@@ -160,7 +163,7 @@ dns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,
 	REQUIRE(VALID_SSUTABLE(table));
 	REQUIRE(dns_name_isabsolute(identity));
 	REQUIRE(dns_name_isabsolute(name));
-	REQUIRE(matchtype <= DNS_SSUMATCHTYPE_SELF);
+	REQUIRE(matchtype <= DNS_SSUMATCHTYPE_MAX);
 	if (matchtype == DNS_SSUMATCHTYPE_WILDCARD)
 		REQUIRE(dns_name_iswildcard(name));
 	if (ntypes > 0)
@@ -208,8 +211,7 @@ dns_ssutable_addrule(dns_ssutable_t *table, isc_boolean_t grant,
 			goto failure;
 		}
 		memcpy(rule->types, types, ntypes * sizeof(dns_rdatatype_t));
-	}
-	else
+	} else
 		rule->types = NULL;
 
 	rule->magic = SSURULEMAGIC;
@@ -249,6 +251,9 @@ dns_ssutable_checkrules(dns_ssutable_t *table, dns_name_t *signer,
 {
 	dns_ssurule_t *rule;
 	unsigned int i;
+	dns_fixedname_t fixed;
+	dns_name_t *wildcard;
+	isc_result_t result;
 
 	REQUIRE(VALID_SSUTABLE(table));
 	REQUIRE(signer == NULL || dns_name_isabsolute(signer));
@@ -265,35 +270,39 @@ dns_ssutable_checkrules(dns_ssutable_t *table, dns_name_t *signer,
 		if (dns_name_iswildcard(rule->identity)) {
 			if (!dns_name_matcheswildcard(signer, rule->identity))
 				continue;
-		}
-		else {
-			if (!dns_name_equal(signer, rule->identity))
+		} else if (!dns_name_equal(signer, rule->identity))
 				continue;
-		}
 
 		if (rule->matchtype == DNS_SSUMATCHTYPE_NAME) {
 			if (!dns_name_equal(name, rule->name))
 				continue;
-		}
-		else if (rule->matchtype == DNS_SSUMATCHTYPE_SUBDOMAIN) {
+		} else if (rule->matchtype == DNS_SSUMATCHTYPE_SUBDOMAIN) {
 			if (!dns_name_issubdomain(name, rule->name))
 				continue;
-		}
-		else if (rule->matchtype == DNS_SSUMATCHTYPE_WILDCARD) {
+		} else if (rule->matchtype == DNS_SSUMATCHTYPE_WILDCARD) {
 			if (!dns_name_matcheswildcard(name, rule->name))
 				continue;
-
-		}
-		else if (rule->matchtype == DNS_SSUMATCHTYPE_SELF) {
+		} else if (rule->matchtype == DNS_SSUMATCHTYPE_SELF) {
 			if (!dns_name_equal(signer, name))
 				continue;
+		} else if (rule->matchtype == DNS_SSUMATCHTYPE_SELFSUB) {
+			if (!dns_name_issubdomain(name, signer))
+				continue;
+		} else if (rule->matchtype == DNS_SSUMATCHTYPE_SELFWILD) {
+			dns_fixedname_init(&fixed);
+			wildcard = dns_fixedname_name(&fixed);
+			result = dns_name_concatenate(dns_wildcardname, signer,
+						      wildcard, NULL);
+			if (result != ISC_R_SUCCESS)
+				continue;
+			if (!dns_name_matcheswildcard(name, wildcard))
+				continue;
 		}
 
 		if (rule->ntypes == 0) {
 			if (!isusertype(type))
 				continue;
-		}
-		else {
+		} else {
 			for (i = 0; i < rule->ntypes; i++) {
 				if (rule->types[i] == dns_rdatatype_any ||
 				    rule->types[i] == type)
diff --git a/contrib/bind9/lib/dns/stats.c b/contrib/bind9/lib/dns/stats.c
index aefcbe0..660046f 100644
--- a/contrib/bind9/lib/dns/stats.c
+++ b/contrib/bind9/lib/dns/stats.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stats.c,v 1.5.206.1 2004/03/06 08:13:46 marka Exp $ */
+/* $Id: stats.c,v 1.6.18.4 2005/06/27 00:20:02 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -30,7 +32,9 @@ LIBDNS_EXTERNAL_DATA const char *dns_statscounter_names[DNS_STATS_NCOUNTERS] =
 	"nxrrset",
 	"nxdomain",
 	"recursion",
-	"failure"
+	"failure",
+	"duplicate",
+	"dropped"
 	};
 
 isc_result_t
diff --git a/contrib/bind9/lib/dns/tcpmsg.c b/contrib/bind9/lib/dns/tcpmsg.c
index a0fddcd..018c4ce 100644
--- a/contrib/bind9/lib/dns/tcpmsg.c
+++ b/contrib/bind9/lib/dns/tcpmsg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tcpmsg.c,v 1.24.206.3 2006/08/10 23:59:28 marka Exp $ */
+/* $Id: tcpmsg.c,v 1.25.18.4 2006/08/10 23:59:29 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/time.c b/contrib/bind9/lib/dns/time.c
index 770f021..b4e7bee 100644
--- a/contrib/bind9/lib/dns/time.c
+++ b/contrib/bind9/lib/dns/time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.c,v 1.18.2.4.2.8 2004/08/28 06:25:20 marka Exp $ */
+/* $Id: time.c,v 1.26.18.3 2005/04/29 00:16:06 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/timer.c b/contrib/bind9/lib/dns/timer.c
index b364f54..b225722 100644
--- a/contrib/bind9/lib/dns/timer.c
+++ b/contrib/bind9/lib/dns/timer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.c,v 1.2.206.1 2004/03/06 08:13:46 marka Exp $ */
+/* $Id: timer.c,v 1.3.18.2 2005/04/29 00:16:06 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/tkey.c b/contrib/bind9/lib/dns/tkey.c
index ca793d2..e4dbdc7 100644
--- a/contrib/bind9/lib/dns/tkey.c
+++ b/contrib/bind9/lib/dns/tkey.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -16,9 +16,9 @@
  */
 
 /*
- * $Id: tkey.c,v 1.71.2.1.10.9 2006/01/04 23:50:20 marka Exp $
+ * $Id: tkey.c,v 1.76.18.5 2005/11/30 03:44:39 marka Exp $
  */
-
+/*! \file */
 #include <config.h>
 
 #include <isc/buffer.h>
diff --git a/contrib/bind9/lib/dns/tsig.c b/contrib/bind9/lib/dns/tsig.c
index 9bdde06..c5107b5 100644
--- a/contrib/bind9/lib/dns/tsig.c
+++ b/contrib/bind9/lib/dns/tsig.c
@@ -16,9 +16,9 @@
  */
 
 /*
- * $Id: tsig.c,v 1.112.2.3.8.10 2006/05/02 04:21:42 marka Exp $
+ * $Id: tsig.c,v 1.117.18.9 2006/05/02 04:23:12 marka Exp $
  */
-
+/*! \file */
 #include <config.h>
 #include <stdlib.h>
 
@@ -48,6 +48,11 @@
 #define is_response(msg) (msg->flags & DNS_MESSAGEFLAG_QR)
 #define algname_is_allocated(algname) \
 	((algname) != dns_tsig_hmacmd5_name && \
+	 (algname) != dns_tsig_hmacsha1_name && \
+	 (algname) != dns_tsig_hmacsha224_name && \
+	 (algname) != dns_tsig_hmacsha256_name && \
+	 (algname) != dns_tsig_hmacsha384_name && \
+	 (algname) != dns_tsig_hmacsha512_name && \
 	 (algname) != dns_tsig_gssapi_name && \
 	 (algname) != dns_tsig_gssapims_name)
 
@@ -96,6 +101,76 @@ static dns_name_t gsstsigms = {
 
 LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_gssapims_name = &gsstsigms;
 
+static unsigned char hmacsha1_ndata[] = "\011hmac-sha1";
+static unsigned char hmacsha1_offsets[] = { 0, 10 };
+
+static dns_name_t  hmacsha1 = {
+        DNS_NAME_MAGIC,
+        hmacsha1_ndata, 11, 2,
+        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+        hmacsha1_offsets, NULL,
+        {(void *)-1, (void *)-1},
+        {NULL, NULL}
+};
+
+LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha1_name = &hmacsha1;
+
+static unsigned char hmacsha224_ndata[] = "\013hmac-sha224";
+static unsigned char hmacsha224_offsets[] = { 0, 12 };
+
+static dns_name_t hmacsha224 = {
+        DNS_NAME_MAGIC,
+        hmacsha224_ndata, 13, 2,
+        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+        hmacsha224_offsets, NULL,
+        {(void *)-1, (void *)-1},
+        {NULL, NULL}
+};
+
+LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha224_name = &hmacsha224;
+
+static unsigned char hmacsha256_ndata[] = "\013hmac-sha256";
+static unsigned char hmacsha256_offsets[] = { 0, 12 };
+
+static dns_name_t hmacsha256 = {
+        DNS_NAME_MAGIC,
+        hmacsha256_ndata, 13, 2,
+        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+        hmacsha256_offsets, NULL,
+        {(void *)-1, (void *)-1},
+        {NULL, NULL}
+};
+
+LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha256_name = &hmacsha256;
+
+static unsigned char hmacsha384_ndata[] = "\013hmac-sha384";
+static unsigned char hmacsha384_offsets[] = { 0, 12 };
+
+static dns_name_t hmacsha384 = {
+        DNS_NAME_MAGIC,
+        hmacsha384_ndata, 13, 2,
+        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+        hmacsha384_offsets, NULL,
+        {(void *)-1, (void *)-1},
+        {NULL, NULL}
+};
+
+LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha384_name = &hmacsha384;
+
+static unsigned char hmacsha512_ndata[] = "\013hmac-sha512";
+static unsigned char hmacsha512_offsets[] = { 0, 12 };
+
+static dns_name_t hmacsha512 = {
+        DNS_NAME_MAGIC,
+        hmacsha512_ndata, 13, 2,
+        DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE,
+        hmacsha512_offsets, NULL,
+        {(void *)-1, (void *)-1},
+        {NULL, NULL}
+};
+
+LIBDNS_EXTERNAL_DATA dns_name_t *dns_tsig_hmacsha512_name = &hmacsha512;
+
 static isc_result_t
 tsig_verify_tcp(isc_buffer_t *source, dns_message_t *msg);
 
@@ -137,6 +212,7 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
 	REQUIRE(name != NULL);
 	REQUIRE(algorithm != NULL);
 	REQUIRE(mctx != NULL);
+	REQUIRE(key != NULL || ring != NULL);
 
 	tkey = (dns_tsigkey_t *) isc_mem_get(mctx, sizeof(dns_tsigkey_t));
 	if (tkey == NULL)
@@ -154,6 +230,40 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
 			ret = DNS_R_BADALG;
 			goto cleanup_name;
 		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA1_NAME)) {
+		tkey->algorithm = DNS_TSIG_HMACSHA1_NAME;
+		if (dstkey != NULL && dst_key_alg(dstkey) != DST_ALG_HMACSHA1) {
+			ret = DNS_R_BADALG;
+			goto cleanup_name;
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA224_NAME)) {
+		tkey->algorithm = DNS_TSIG_HMACSHA224_NAME;
+		if (dstkey != NULL &&
+		    dst_key_alg(dstkey) != DST_ALG_HMACSHA224) {
+			ret = DNS_R_BADALG;
+			goto cleanup_name;
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA256_NAME)) {
+		tkey->algorithm = DNS_TSIG_HMACSHA256_NAME;
+		if (dstkey != NULL &&
+		    dst_key_alg(dstkey) != DST_ALG_HMACSHA256) {
+			ret = DNS_R_BADALG;
+			goto cleanup_name;
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA384_NAME)) {
+		tkey->algorithm = DNS_TSIG_HMACSHA384_NAME;
+		if (dstkey != NULL &&
+		    dst_key_alg(dstkey) != DST_ALG_HMACSHA384) {
+			ret = DNS_R_BADALG;
+			goto cleanup_name;
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA512_NAME)) {
+		tkey->algorithm = DNS_TSIG_HMACSHA512_NAME;
+		if (dstkey != NULL &&
+		    dst_key_alg(dstkey) != DST_ALG_HMACSHA512) {
+			ret = DNS_R_BADALG;
+			goto cleanup_name;
+		}
 	} else if (dns_name_equal(algorithm, DNS_TSIG_GSSAPI_NAME)) {
 		tkey->algorithm = DNS_TSIG_GSSAPI_NAME;
 		if (dstkey != NULL && dst_key_alg(dstkey) != DST_ALG_GSSAPI) {
@@ -202,20 +312,14 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
 	tkey->key = dstkey;
 	tkey->ring = ring;
 
-	if (ring != NULL) {
-		RWLOCK(&ring->lock, isc_rwlocktype_write);
-		ret = dns_rbt_addname(ring->keys, name, tkey);
-		if (ret != ISC_R_SUCCESS) {
-			RWUNLOCK(&ring->lock, isc_rwlocktype_write);
-			goto cleanup_algorithm;
-		}
-		refs++;
-		RWUNLOCK(&ring->lock, isc_rwlocktype_write);
-	}
-
 	if (key != NULL)
 		refs++;
-	isc_refcount_init(&tkey->refs, refs);
+	if (ring != NULL)
+		refs++;
+	ret = isc_refcount_init(&tkey->refs, refs);
+	if (ret != ISC_R_SUCCESS)
+		goto cleanup_creator;
+
 	tkey->generated = generated;
 	tkey->inception = inception;
 	tkey->expire = expire;
@@ -223,6 +327,16 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
 
 	tkey->magic = TSIG_MAGIC;
 
+	if (ring != NULL) {
+		RWLOCK(&ring->lock, isc_rwlocktype_write);
+		ret = dns_rbt_addname(ring->keys, name, tkey);
+		if (ret != ISC_R_SUCCESS) {
+			RWUNLOCK(&ring->lock, isc_rwlocktype_write);
+			goto cleanup_refs;
+		}
+		RWUNLOCK(&ring->lock, isc_rwlocktype_write);
+	}
+
 	if (dstkey != NULL && dst_key_size(dstkey) < 64) {
 		char namestr[DNS_NAME_FORMATSIZE];
 		dns_name_format(name, namestr, sizeof(namestr));
@@ -236,6 +350,16 @@ dns_tsigkey_createfromkey(dns_name_t *name, dns_name_t *algorithm,
 
 	return (ISC_R_SUCCESS);
 
+ cleanup_refs:
+	tkey->magic = 0;
+	while (refs-- > 0)
+		isc_refcount_decrement(&tkey->refs, NULL);
+	isc_refcount_destroy(&tkey->refs);
+ cleanup_creator:
+	if (tkey->creator != NULL) {
+		dns_name_free(tkey->creator, mctx);
+		isc_mem_put(mctx, tkey->creator, sizeof(dns_name_t));
+	}
  cleanup_algorithm:
 	if (algname_is_allocated(tkey->algorithm)) {
 		if (dns_name_dynamic(tkey->algorithm))
@@ -264,22 +388,93 @@ dns_tsigkey_create(dns_name_t *name, dns_name_t *algorithm,
 	if (length > 0)
 		REQUIRE(secret != NULL);
 
-	if (!dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME) && length > 0)
+	if (dns_name_equal(algorithm, DNS_TSIG_HMACMD5_NAME)) {
+		if (secret != NULL) {
+			isc_buffer_t b;
+
+			isc_buffer_init(&b, secret, length);
+			isc_buffer_add(&b, length);
+			result = dst_key_frombuffer(name, DST_ALG_HMACMD5,
+						    DNS_KEYOWNER_ENTITY,
+						    DNS_KEYPROTO_DNSSEC,
+						    dns_rdataclass_in,
+						    &b, mctx, &dstkey);
+				if (result != ISC_R_SUCCESS)
+					return (result);
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA1_NAME)) {
+		if (secret != NULL) {
+			isc_buffer_t b;
+
+			isc_buffer_init(&b, secret, length);
+			isc_buffer_add(&b, length);
+			result = dst_key_frombuffer(name, DST_ALG_HMACSHA1,
+						    DNS_KEYOWNER_ENTITY,
+						    DNS_KEYPROTO_DNSSEC,
+						    dns_rdataclass_in,
+						    &b, mctx, &dstkey);
+				if (result != ISC_R_SUCCESS)
+					return (result);
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA224_NAME)) {
+		if (secret != NULL) {
+			isc_buffer_t b;
+
+			isc_buffer_init(&b, secret, length);
+			isc_buffer_add(&b, length);
+			result = dst_key_frombuffer(name, DST_ALG_HMACSHA224,
+						    DNS_KEYOWNER_ENTITY,
+						    DNS_KEYPROTO_DNSSEC,
+						    dns_rdataclass_in,
+						    &b, mctx, &dstkey);
+				if (result != ISC_R_SUCCESS)
+					return (result);
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA256_NAME)) {
+		if (secret != NULL) {
+			isc_buffer_t b;
+
+			isc_buffer_init(&b, secret, length);
+			isc_buffer_add(&b, length);
+			result = dst_key_frombuffer(name, DST_ALG_HMACSHA256,
+						    DNS_KEYOWNER_ENTITY,
+						    DNS_KEYPROTO_DNSSEC,
+						    dns_rdataclass_in,
+						    &b, mctx, &dstkey);
+				if (result != ISC_R_SUCCESS)
+					return (result);
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA384_NAME)) {
+		if (secret != NULL) {
+			isc_buffer_t b;
+
+			isc_buffer_init(&b, secret, length);
+			isc_buffer_add(&b, length);
+			result = dst_key_frombuffer(name, DST_ALG_HMACSHA384,
+						    DNS_KEYOWNER_ENTITY,
+						    DNS_KEYPROTO_DNSSEC,
+						    dns_rdataclass_in,
+						    &b, mctx, &dstkey);
+				if (result != ISC_R_SUCCESS)
+					return (result);
+		}
+	} else if (dns_name_equal(algorithm, DNS_TSIG_HMACSHA512_NAME)) {
+		if (secret != NULL) {
+			isc_buffer_t b;
+
+			isc_buffer_init(&b, secret, length);
+			isc_buffer_add(&b, length);
+			result = dst_key_frombuffer(name, DST_ALG_HMACSHA512,
+						    DNS_KEYOWNER_ENTITY,
+						    DNS_KEYPROTO_DNSSEC,
+						    dns_rdataclass_in,
+						    &b, mctx, &dstkey);
+				if (result != ISC_R_SUCCESS)
+					return (result);
+		}
+	} else if (length > 0)
 		return (DNS_R_BADALG);
 
-	if (secret != NULL) {
-		isc_buffer_t b;
-
-		isc_buffer_init(&b, secret, length);
-		isc_buffer_add(&b, length);
-		result = dst_key_frombuffer(name, DST_ALG_HMACMD5,
-					    DNS_KEYOWNER_ENTITY,
-					    DNS_KEYPROTO_DNSSEC,
-					    dns_rdataclass_in,
-					    &b, mctx, &dstkey);
-		if (result != ISC_R_SUCCESS)
-			return (result);
-	}
 	result = dns_tsigkey_createfromkey(name, algorithm, dstkey,
 					   generated, creator,
 					   inception, expire, mctx, ring, key);
@@ -423,6 +618,7 @@ dns_tsig_sign(dns_message_t *msg) {
 	if (key->key != NULL && tsig.error != dns_tsigerror_badsig) {
 		unsigned char header[DNS_MESSAGE_HEADERLEN];
 		isc_buffer_t headerbuf;
+		isc_uint16_t digestbits;
 
 		ret = dst_context_create(key->key, mctx, &ctx);
 		if (ret != ISC_R_SUCCESS)
@@ -549,7 +745,16 @@ dns_tsig_sign(dns_message_t *msg) {
 		if (ret != ISC_R_SUCCESS)
 			goto cleanup_signature;
 		dst_context_destroy(&ctx);
-		tsig.siglen = isc_buffer_usedlength(&sigbuf);
+		digestbits = dst_key_getbits(key->key);
+		if (digestbits != 0) {
+			unsigned int bytes = (digestbits + 1) / 8;
+			if (is_response(msg) && bytes < querytsig.siglen)
+				bytes = querytsig.siglen;
+			if (bytes > isc_buffer_usedlength(&sigbuf))
+				bytes = isc_buffer_usedlength(&sigbuf);
+			tsig.siglen = bytes;
+		} else
+			tsig.siglen = isc_buffer_usedlength(&sigbuf);
 	} else {
 		tsig.siglen = 0;
 		tsig.signature = NULL;
@@ -640,6 +845,8 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 	dst_context_t *ctx = NULL;
 	isc_mem_t *mctx;
 	isc_uint16_t addcount, id;
+	unsigned int siglen;
+	unsigned int alg;
 
 	REQUIRE(source != NULL);
 	REQUIRE(DNS_MESSAGE_VALID(msg));
@@ -752,6 +959,42 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg,
 		return (DNS_R_CLOCKSKEW);
 	}
 
+	/*
+	 * Check digest length.
+	 */
+	alg = dst_key_alg(key);
+	ret = dst_key_sigsize(key, &siglen);
+	if (ret != ISC_R_SUCCESS)
+		return (ret);
+	if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
+	    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
+	    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512) {
+		isc_uint16_t digestbits = dst_key_getbits(key);
+		if (tsig.siglen > siglen) {
+			tsig_log(msg->tsigkey, 2, "signature length to big");
+			return (DNS_R_FORMERR);
+		}
+		if (tsig.siglen > 0 &&
+		    (tsig.siglen < 10 || tsig.siglen < ((siglen + 1) / 2))) {
+			tsig_log(msg->tsigkey, 2,
+				 "signature length below minimum");
+			return (DNS_R_FORMERR);
+		}
+		if (tsig.siglen > 0 && digestbits != 0 &&
+		    tsig.siglen < ((digestbits + 1) / 8)) { 
+			msg->tsigstatus = dns_tsigerror_badtrunc;
+			tsig_log(msg->tsigkey, 2,
+				 "truncated signature length too small");
+			return (DNS_R_TSIGVERIFYFAILURE);
+		}
+		if (tsig.siglen > 0 && digestbits == 0 &&
+		    tsig.siglen < siglen) {
+			msg->tsigstatus = dns_tsigerror_badtrunc;
+			tsig_log(msg->tsigkey, 2, "signature length too small");
+			return (DNS_R_TSIGVERIFYFAILURE);
+		}
+	}
+
 	if (tsig.siglen > 0) {
 		sig_r.base = tsig.signature;
 		sig_r.length = tsig.siglen;
@@ -1186,12 +1429,8 @@ dns_tsigkeyring_create(isc_mem_t *mctx, dns_tsig_keyring_t **ringp) {
 		return (ISC_R_NOMEMORY);
 
 	result = isc_rwlock_init(&ring->lock, 0, 0);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_rwlock_init() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
+	if (result != ISC_R_SUCCESS)
+		return (result);
 
 	ring->keys = NULL;
 	result = dns_rbt_create(mctx, free_tsignode, NULL, &ring->keys);
diff --git a/contrib/bind9/lib/dns/ttl.c b/contrib/bind9/lib/dns/ttl.c
index 1dad0fb..39d2ac3 100644
--- a/contrib/bind9/lib/dns/ttl.c
+++ b/contrib/bind9/lib/dns/ttl.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ttl.c,v 1.21.12.5 2004/03/08 09:04:32 marka Exp $ */
+/* $Id: ttl.c,v 1.25.18.2 2005/04/29 00:16:07 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/validator.c b/contrib/bind9/lib/dns/validator.c
index 571ad79..a92d647 100644
--- a/contrib/bind9/lib/dns/validator.c
+++ b/contrib/bind9/lib/dns/validator.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.91.2.5.8.27.6.1 2007/01/11 04:51:39 marka Exp $ */
+/* $Id: validator.c,v 1.119.18.29 2007/01/08 02:41:59 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -69,9 +71,9 @@
  * validator_start -> nsecvalidate -> proveunsecure -> startfinddlvsep ->
  *	dlv_validator_start -> validator_start -> nsecvalidate -> proveunsecure
  *
- * \li When called without a rdataset and with DNS_VALIDATOR_DLV:
- * validator_start -> startfinddlvsep -> dlv_validator_start ->
- *	validator_start -> nsecvalidate -> proveunsecure
+ * Note: there isn't a case for DNS_VALIDATOR_DLV here as we want nsecvalidate()
+ * to always validate the authority section even when it does not contain
+ * signatures.
  *
  * validator_start: determines what type of validation to do.
  * validate: attempts to perform a positive validation.
@@ -90,7 +92,6 @@
 						 * have attempted a verify. */
 #define VALATTR_INSECURITY		0x0010	/*%< Attempting proveunsecure. */
 #define VALATTR_DLVTRIED		0x0020	/*%< Looked for a DLV record. */
-#define VALATTR_AUTHNONPENDING		0x0040	/*%< Tidy up pending auth. */
 
 /*!
  * NSEC proofs to be looked for.
@@ -155,18 +156,11 @@ dlv_validator_start(dns_validator_t *val);
 static isc_result_t
 finddlvsep(dns_validator_t *val, isc_boolean_t resume);
 
-static void
-auth_nonpending(dns_message_t *message);
-
 static isc_result_t
 startfinddlvsep(dns_validator_t *val, dns_name_t *unsecure);
 
 /*%
  * Mark the RRsets as a answer.
- *
- * If VALATTR_AUTHNONPENDING is set then this is a negative answer
- * in a insecure zone.  We need to mark any pending RRsets as
- * dns_trust_authauthority answers (this is deferred from resolver.c).
  */
 static inline void
 markanswer(dns_validator_t *val) {
@@ -175,9 +169,6 @@ markanswer(dns_validator_t *val) {
 		val->event->rdataset->trust = dns_trust_answer;
 	if (val->event->sigrdataset != NULL)
 		val->event->sigrdataset->trust = dns_trust_answer;
-	if (val->event->message != NULL &&
-	    (val->attributes & VALATTR_AUTHNONPENDING) != 0)
-		auth_nonpending(val->event->message);
 }
 
 static void
@@ -217,31 +208,6 @@ exit_check(dns_validator_t *val) {
 }
 
 /*%
- * Mark pending answers in the authority section as dns_trust_authauthority.
- */
-static void
-auth_nonpending(dns_message_t *message) {
-	isc_result_t result;
-	dns_name_t *name;
-	dns_rdataset_t *rdataset;
-
-	for (result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(message, DNS_SECTION_AUTHORITY))
-	{
-		name = NULL;
-		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
-		for (rdataset = ISC_LIST_HEAD(name->list);
-		     rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
-			if (rdataset->trust == dns_trust_pending)
-				rdataset->trust = dns_trust_authauthority;
-		}
-	}
-}
-
-/*%
  * Look in the NSEC record returned from a DS query to see if there is
  * a NS RRset at this name.  If it is found we are at a delegation point.
  */
@@ -613,6 +579,8 @@ nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname,
 	unsigned int olabels, nlabels, labels;
 	dns_rdata_nsec_t nsec;
 	isc_boolean_t atparent;
+	isc_boolean_t ns;
+	isc_boolean_t soa;
 
 	REQUIRE(exists != NULL);
 	REQUIRE(data != NULL);
@@ -644,9 +612,9 @@ nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname,
 		 * The names are the same.
 		 */
 		atparent = dns_rdatatype_atparent(val->event->type);
-		if (dns_nsec_typepresent(&rdata, dns_rdatatype_ns) &&
-		    !dns_nsec_typepresent(&rdata, dns_rdatatype_soa))
-		{
+		ns = dns_nsec_typepresent(&rdata, dns_rdatatype_ns);
+		soa = dns_nsec_typepresent(&rdata, dns_rdatatype_soa);
+		if (ns && !soa) {
 			if (!atparent) {
 				/*
 				 * This NSEC record is from somewhere higher in
@@ -657,7 +625,7 @@ nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname,
 					      "ignoring parent nsec");
 				return (ISC_R_IGNORE);
 			}
-		} else if (atparent) {
+		} else if (atparent && ns && soa) {
 			/*
 			 * This NSEC record is from the child.
 			 * It can not be legitimately used here.
@@ -666,12 +634,20 @@ nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname,
 				      "ignoring child nsec");
 			return (ISC_R_IGNORE);
 		}
-		*exists = ISC_TRUE;
-		*data = dns_nsec_typepresent(&rdata, val->event->type);
-		validator_log(val, ISC_LOG_DEBUG(3),
-			      "nsec proves name exists (owner) data=%d",
-			      *data);
-		return (ISC_R_SUCCESS);
+		if (val->event->type == dns_rdatatype_cname ||
+		    val->event->type == dns_rdatatype_nxt ||
+		    val->event->type == dns_rdatatype_nsec ||
+		    val->event->type == dns_rdatatype_key ||
+		    !dns_nsec_typepresent(&rdata, dns_rdatatype_cname)) {
+			*exists = ISC_TRUE;
+			*data = dns_nsec_typepresent(&rdata, val->event->type);
+			validator_log(val, ISC_LOG_DEBUG(3),
+				      "nsec proves name exists (owner) data=%d",
+				      *data);
+			return (ISC_R_SUCCESS);
+		}
+		validator_log(val, ISC_LOG_DEBUG(3), "NSEC proves CNAME exists");
+		return (ISC_R_IGNORE);
 	}
 
 	if (relation == dns_namereln_subdomain &&
@@ -731,6 +707,7 @@ nsecnoexistnodata(dns_validator_t *val, dns_name_t* name, dns_name_t *nsecname,
 		result = dns_name_concatenate(dns_wildcardname, &common,
 					       wild, NULL);
 		if (result != ISC_R_SUCCESS) {
+			dns_rdata_freestruct(&nsec);
 			validator_log(val, ISC_LOG_DEBUG(3),
 				    "failure generating wildcard name");
 			return (result);
@@ -784,6 +761,7 @@ authvalidated(isc_task_t *task, isc_event_t *event) {
 		}
 	} else {
 		dns_name_t **proofs = val->event->proofs;
+		dns_name_t *wild = dns_fixedname_name(&val->wild);
 		
 		if (rdataset->trust == dns_trust_secure)
 			val->seensig = ISC_TRUE;
@@ -795,10 +773,9 @@ authvalidated(isc_task_t *task, isc_event_t *event) {
 	            (val->attributes & VALATTR_FOUNDNODATA) == 0 &&
 		    (val->attributes & VALATTR_FOUNDNOQNAME) == 0 &&
 		    nsecnoexistnodata(val, val->event->name, devent->name,
-				      rdataset, &exists, &data,
-				      dns_fixedname_name(&val->wild))
+				      rdataset, &exists, &data, wild)
 				      == ISC_R_SUCCESS)
-		 {
+		{
 			if (exists && !data) {
 				val->attributes |= VALATTR_FOUNDNODATA;
 				if (NEEDNODATA(val))
@@ -1285,15 +1262,27 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
 {
 	isc_result_t result;
 	dns_fixedname_t fixed;
+	isc_boolean_t ignore = ISC_FALSE;
 
 	val->attributes |= VALATTR_TRIEDVERIFY;
 	dns_fixedname_init(&fixed);
+ again:
 	result = dns_dnssec_verify2(val->event->name, val->event->rdataset,
-				    key, ISC_FALSE, val->view->mctx, rdata,
+				    key, ignore, val->view->mctx, rdata,
 				    dns_fixedname_name(&fixed));
-	validator_log(val, ISC_LOG_DEBUG(3),
-		      "verify rdataset (keyid=%u): %s",
-		      keyid, isc_result_totext(result));
+	if (result == DNS_R_SIGEXPIRED && val->view->acceptexpired) {
+		ignore = ISC_TRUE;
+		goto again;
+	}
+	if (ignore && (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD))
+		validator_log(val, ISC_LOG_INFO,
+			      "accepted expired %sRRSIG (keyid=%u)",
+			      (result == DNS_R_FROMWILDCARD) ?
+			      "wildcard " : "", keyid);
+	else
+		validator_log(val, ISC_LOG_DEBUG(3),
+			      "verify rdataset (keyid=%u): %s",
+			      keyid, isc_result_totext(result));
 	if (result == DNS_R_FROMWILDCARD) {
 		if (!dns_name_equal(val->event->name,
 				    dns_fixedname_name(&fixed)))
@@ -1485,6 +1474,7 @@ dlv_validatezonekey(dns_validator_t *val) {
 	isc_boolean_t supported_algorithm;
 	isc_result_t result;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
+	isc_uint8_t digest_type;
 
 	validator_log(val, ISC_LOG_DEBUG(3), "dlv_validatezonekey");
 
@@ -1495,6 +1485,31 @@ dlv_validatezonekey(dns_validator_t *val) {
 	 */
 	supported_algorithm = ISC_FALSE;
 
+	/*
+	 * If DNS_DSDIGEST_SHA256 is present we are required to prefer
+	 * it over DNS_DSDIGEST_SHA1.  This in practice means that we
+	 * need to ignore DNS_DSDIGEST_SHA1 if a DNS_DSDIGEST_SHA256
+	 * is present.
+	 */
+	digest_type = DNS_DSDIGEST_SHA1;
+	for (result = dns_rdataset_first(&val->dlv);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(&val->dlv)) {
+		dns_rdata_reset(&dlvrdata);
+		dns_rdataset_current(&val->dlv, &dlvrdata);
+		dns_rdata_tostruct(&dlvrdata, &dlv, NULL);
+
+		if (!dns_resolver_algorithm_supported(val->view->resolver,
+						      val->event->name,
+						      dlv.algorithm))
+			continue;
+
+		if (dlv.digest_type == DNS_DSDIGEST_SHA256) {
+			digest_type = DNS_DSDIGEST_SHA256;
+			break;
+		}
+	}
+
 	for (result = dns_rdataset_first(&val->dlv);
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(&val->dlv))
@@ -1503,8 +1518,14 @@ dlv_validatezonekey(dns_validator_t *val) {
 		dns_rdataset_current(&val->dlv, &dlvrdata);
 		(void)dns_rdata_tostruct(&dlvrdata, &dlv, NULL);
 
-		if (dlv.digest_type != DNS_DSDIGEST_SHA1 ||
-		    !dns_resolver_algorithm_supported(val->view->resolver,
+		if (!dns_resolver_digest_supported(val->view->resolver,
+						   dlv.digest_type))
+			continue;
+		
+		if (dlv.digest_type != digest_type)
+			continue;
+
+		if (!dns_resolver_algorithm_supported(val->view->resolver,
 						      val->event->name,
 						      dlv.algorithm))
 			continue;
@@ -1627,6 +1648,7 @@ validatezonekey(dns_validator_t *val) {
 	dst_key_t *dstkey;
 	isc_boolean_t supported_algorithm;
 	isc_boolean_t atsep = ISC_FALSE;
+	isc_uint8_t digest_type;
 
 	/*
 	 * Caller must be holding the validator lock.
@@ -1796,6 +1818,31 @@ validatezonekey(dns_validator_t *val) {
 
 	supported_algorithm = ISC_FALSE;
 
+	/*
+	 * If DNS_DSDIGEST_SHA256 is present we are required to prefer
+	 * it over DNS_DSDIGEST_SHA1.  This in practice means that we
+	 * need to ignore DNS_DSDIGEST_SHA1 if a DNS_DSDIGEST_SHA256
+	 * is present.
+	 */
+	digest_type = DNS_DSDIGEST_SHA1;
+	for (result = dns_rdataset_first(val->dsset);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(val->dsset)) {
+		dns_rdata_reset(&dsrdata);
+		dns_rdataset_current(val->dsset, &dsrdata);
+		dns_rdata_tostruct(&dsrdata, &ds, NULL);
+
+		if (!dns_resolver_algorithm_supported(val->view->resolver,
+						      val->event->name,
+						      ds.algorithm))
+			continue;
+
+		if (ds.digest_type == DNS_DSDIGEST_SHA256) {
+			digest_type = DNS_DSDIGEST_SHA256;
+			break;
+		}
+	}
+
 	for (result = dns_rdataset_first(val->dsset);
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(val->dsset))
@@ -1804,8 +1851,13 @@ validatezonekey(dns_validator_t *val) {
 		dns_rdataset_current(val->dsset, &dsrdata);
 		(void)dns_rdata_tostruct(&dsrdata, &ds, NULL);
 
-		if (ds.digest_type != DNS_DSDIGEST_SHA1)
+		if (!dns_resolver_digest_supported(val->view->resolver,
+						   ds.digest_type))
 			continue;
+
+		if (ds.digest_type != digest_type)
+			continue;
+
 		if (!dns_resolver_algorithm_supported(val->view->resolver,
 						      val->event->name,
 						      ds.algorithm))
@@ -2044,12 +2096,6 @@ nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
 			if (rdataset->type == dns_rdatatype_rrsig)
 				continue;
 
-			if (rdataset->type == dns_rdatatype_soa) {
-				val->soaset = rdataset;
-				val->soaname = name;
-			} else if (rdataset->type == dns_rdatatype_nsec)
-				val->nsecset = rdataset;
-
 			for (sigrdataset = ISC_LIST_HEAD(name->list);
 			     sigrdataset != NULL;
 			     sigrdataset = ISC_LIST_NEXT(sigrdataset,
@@ -2059,8 +2105,6 @@ nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
 				    sigrdataset->covers == rdataset->type)
 					break;
 			}
-			if (sigrdataset == NULL)
-				continue;
 			/*
 			 * If a signed zone is missing the zone key, bad
 			 * things could happen.  A query for data in the zone
@@ -2149,7 +2193,6 @@ nsecvalidate(dns_validator_t *val, isc_boolean_t resume) {
 
 	validator_log(val, ISC_LOG_DEBUG(3),
 		      "nonexistence proof(s) not found");
-	val->attributes |= VALATTR_AUTHNONPENDING;
 	val->attributes |= VALATTR_INSECURITY;
 	return (proveunsecure(val, ISC_FALSE));
 }
@@ -2166,7 +2209,8 @@ check_ds(dns_validator_t *val, dns_name_t *name, dns_rdataset_t *rdataset) {
 		dns_rdataset_current(rdataset, &dsrdata);
 		(void)dns_rdata_tostruct(&dsrdata, &ds, NULL);
 
-		if (ds.digest_type == DNS_DSDIGEST_SHA1 &&
+		if (dns_resolver_digest_supported(val->view->resolver,
+						  ds.digest_type) &&
 		    dns_resolver_algorithm_supported(val->view->resolver,
 						     name, ds.algorithm)) {
 			dns_rdata_reset(&dsrdata);
@@ -2506,11 +2550,21 @@ proveunsecure(dns_validator_t *val, isc_boolean_t resume) {
 			      namebuf);
 
 		result = view_find(val, tname, dns_rdatatype_ds);
+
 		if (result == DNS_R_NXRRSET || result == DNS_R_NCACHENXRRSET) {
 			/*
 			 * There is no DS.  If this is a delegation,
 			 * we maybe done.
 			 */
+			if (val->frdataset.trust == dns_trust_pending) {
+				result = create_fetch(val, tname,
+						      dns_rdatatype_ds,
+						      dsfetched2,
+						      "proveunsecure");
+				if (result != ISC_R_SUCCESS)
+					goto out;
+				return (DNS_R_WAIT);
+			}
 			if (val->frdataset.trust < dns_trust_secure) {
 				/*
 				 * This shouldn't happen, since the negative
@@ -2675,7 +2729,8 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 
 	LOCK(&val->lock);
 
-	if ((val->options & DNS_VALIDATOR_DLV) != 0) {
+	if ((val->options & DNS_VALIDATOR_DLV) != 0 &&
+	     val->event->rdataset != NULL) {
 		validator_log(val, ISC_LOG_DEBUG(3), "looking for DLV");
 		result = startfinddlvsep(val, dns_rootname);
 	} else if (val->event->rdataset != NULL &&
@@ -2812,9 +2867,6 @@ dns_validator_create(dns_view_t *view, dns_name_t *name, dns_rdatatype_t type,
 	val->keyset = NULL;
 	val->dsset = NULL;
 	dns_rdataset_init(&val->dlv);
-	val->soaset = NULL;
-	val->nsecset = NULL;
-	val->soaname = NULL;
 	val->seensig = ISC_FALSE;
 	val->havedlvsep = ISC_FALSE;
 	val->depth = 0;
diff --git a/contrib/bind9/lib/dns/version.c b/contrib/bind9/lib/dns/version.c
index 6b043ab..1c03774 100644
--- a/contrib/bind9/lib/dns/version.c
+++ b/contrib/bind9/lib/dns/version.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.c,v 1.9.12.3 2004/03/08 09:04:33 marka Exp $ */
+/* $Id: version.c,v 1.11.18.2 2005/04/29 00:16:07 marka Exp $ */
+
+/*! \file */
 
 #include <dns/version.h>
 
diff --git a/contrib/bind9/lib/dns/view.c b/contrib/bind9/lib/dns/view.c
index ac7af61..4938597 100644
--- a/contrib/bind9/lib/dns/view.c
+++ b/contrib/bind9/lib/dns/view.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.c,v 1.103.2.5.2.14 2004/03/10 02:55:58 marka Exp $ */
+/* $Id: view.c,v 1.126.18.11 2006/03/09 23:38:21 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -24,10 +26,12 @@
 #include <isc/string.h>		/* Required for HP/UX (and others?) */
 #include <isc/util.h>
 
+#include <dns/acache.h>
 #include <dns/acl.h>
 #include <dns/adb.h>
 #include <dns/cache.h>
 #include <dns/db.h>
+#include <dns/dlz.h>
 #include <dns/events.h>
 #include <dns/forward.h>
 #include <dns/keytable.h>
@@ -76,13 +80,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 		goto cleanup_view;
 	}
 	result = isc_mutex_init(&view->lock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_name;
-	}
+
 	view->zonetable = NULL;
 	result = dns_zt_create(mctx, rdclass, &view->zonetable);
 	if (result != ISC_R_SUCCESS) {
@@ -120,8 +120,10 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 		goto cleanup_trustedkeys;
 	}
 
+	view->acache = NULL;
 	view->cache = NULL;
 	view->cachedb = NULL;
+	view->dlzdatabase = NULL;
 	view->hints = NULL;
 	view->resolver = NULL;
 	view->adb = NULL;
@@ -130,7 +132,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->rdclass = rdclass;
 	view->frozen = ISC_FALSE;
 	view->task = NULL;
-	isc_refcount_init(&view->references, 1);
+	result = isc_refcount_init(&view->references, 1);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup_fwdtable;
 	view->weakrefs = 0;
 	view->attributes = (DNS_VIEWATTR_RESSHUTDOWN|DNS_VIEWATTR_ADBSHUTDOWN|
 			    DNS_VIEWATTR_REQSHUTDOWN);
@@ -141,7 +145,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->matchrecursiveonly = ISC_FALSE;
 	result = dns_tsigkeyring_create(view->mctx, &view->dynamickeys);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup_fwdtable;
+		goto cleanup_references;
 	view->peers = NULL;
 	view->order = NULL;
 	view->delonly = NULL;
@@ -156,6 +160,8 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->additionalfromcache = ISC_TRUE;
 	view->additionalfromauth = ISC_TRUE;
 	view->enablednssec = ISC_TRUE;
+	view->enablevalidation = ISC_TRUE;
+	view->acceptexpired = ISC_FALSE;
 	view->minimalresponses = ISC_FALSE;
 	view->transfer_format = dns_one_answer;
 	view->queryacl = NULL;
@@ -169,6 +175,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	view->preferred_glue = 0;
 	view->flush = ISC_FALSE;
 	view->dlv = NULL;
+	view->maxudp = 0;
 	dns_fixedname_init(&view->dlv_fixed);
 
 	result = dns_order_create(view->mctx, &view->order);
@@ -208,6 +215,9 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
  cleanup_dynkeys:
 	dns_tsigkeyring_destroy(&view->dynamickeys);
 
+ cleanup_references:
+	isc_refcount_destroy(&view->references);
+
  cleanup_fwdtable:
 	dns_fwdtable_destroy(&view->fwdtable);
 
@@ -253,12 +263,19 @@ destroy(dns_view_t *view) {
 		dns_adb_detach(&view->adb);
 	if (view->resolver != NULL)
 		dns_resolver_detach(&view->resolver);
+	if (view->acache != NULL) {
+		if (view->cachedb != NULL)
+			dns_acache_putdb(view->acache, view->cachedb);
+		dns_acache_detach(&view->acache);
+	}
 	if (view->requestmgr != NULL)
 		dns_requestmgr_detach(&view->requestmgr);
 	if (view->task != NULL)
 		isc_task_detach(&view->task);
 	if (view->hints != NULL)
 		dns_db_detach(&view->hints);
+	if (view->dlzdatabase != NULL)
+		dns_dlzdestroy(&view->dlzdatabase);
 	if (view->cachedb != NULL)
 		dns_db_detach(&view->cachedb);
 	if (view->cache != NULL)
@@ -365,6 +382,8 @@ view_flushanddetach(dns_view_t **viewp, isc_boolean_t flush) {
 			dns_adb_shutdown(view->adb);
 		if (!REQSHUTDOWN(view))
 			dns_requestmgr_shutdown(view->requestmgr);
+		if (view->acache != NULL)
+			dns_acache_shutdown(view->acache);
 		if (view->flush)
 			dns_zt_flushanddetach(&view->zonetable);
 		else
@@ -585,12 +604,17 @@ dns_view_setcache(dns_view_t *view, dns_cache_t *cache) {
 	REQUIRE(!view->frozen);
 
 	if (view->cache != NULL) {
+		if (view->acache != NULL)
+			dns_acache_putdb(view->acache, view->cachedb);
 		dns_db_detach(&view->cachedb);
 		dns_cache_detach(&view->cache);
 	}
 	dns_cache_attach(cache, &view->cache);
 	dns_cache_attachdb(cache, &view->cachedb);
 	INSIST(DNS_DB_VALID(view->cachedb));
+
+	if (view->acache != NULL)
+		dns_acache_setdb(view->acache, view->cachedb);
 }
 
 void
@@ -1198,8 +1222,12 @@ dns_view_flushcache(dns_view_t *view) {
 	result = dns_cache_flush(view->cache);
 	if (result != ISC_R_SUCCESS)
 		return (result);
+	if (view->acache != NULL)
+		dns_acache_putdb(view->acache, view->cachedb);
 	dns_db_detach(&view->cachedb);
 	dns_cache_attachdb(view->cache, &view->cachedb);
+	if (view->acache != NULL)
+		dns_acache_setdb(view->acache, view->cachedb);
 
 	dns_adb_flush(view->adb);
 	return (ISC_R_SUCCESS);
@@ -1330,3 +1358,9 @@ dns_view_getrootdelonly(dns_view_t *view) {
 	REQUIRE(DNS_VIEW_VALID(view));
 	return (view->rootdelonly);
 }
+
+isc_result_t
+dns_view_freezezones(dns_view_t *view, isc_boolean_t value) {
+	REQUIRE(DNS_VIEW_VALID(view));
+	return (dns_zt_freezezones(view->zonetable, value));
+}
diff --git a/contrib/bind9/lib/dns/xfrin.c b/contrib/bind9/lib/dns/xfrin.c
index fdeed14..bec8501 100644
--- a/contrib/bind9/lib/dns/xfrin.c
+++ b/contrib/bind9/lib/dns/xfrin.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.124.2.4.2.16 2006/07/19 01:04:24 marka Exp $ */
+/* $Id: xfrin.c,v 1.135.18.11 2006/07/19 00:58:01 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -51,7 +53,7 @@
  * Incoming AXFR and IXFR.
  */
 
-/*
+/*%
  * It would be non-sensical (or at least obtuse) to use FAIL() with an
  * ISC_R_SUCCESS code, but the test is there to keep the Solaris compiler
  * from complaining about "end-of-loop code not reached".
@@ -66,7 +68,7 @@
 		if (result != ISC_R_SUCCESS) goto failure;	\
 	} while (0)
 
-/*
+/*%
  * The states of the *XFR state machine.  We handle both IXFR and AXFR
  * with a single integrated state machine because they cannot be distinguished
  * immediately - an AXFR response to an IXFR request can only be detected
@@ -85,7 +87,7 @@ typedef enum {
 	XFRST_END
 } xfrin_state_t;
 
-/*
+/*%
  * Incoming zone transfer context.
  */
 
@@ -100,18 +102,18 @@ struct dns_xfrin_ctx {
 	isc_timer_t		*timer;
 	isc_socketmgr_t 	*socketmgr;
 
-	int			connects; 	/* Connect in progress */
-	int			sends;		/* Send in progress */
-	int			recvs;	  	/* Receive in progress */
+	int			connects; 	/*%< Connect in progress */
+	int			sends;		/*%< Send in progress */
+	int			recvs;	  	/*%< Receive in progress */
 	isc_boolean_t		shuttingdown;
 
-	dns_name_t 		name; 		/* Name of zone to transfer */
+	dns_name_t 		name; 		/*%< Name of zone to transfer */
 	dns_rdataclass_t 	rdclass;
 
 	isc_boolean_t		checkid;
 	dns_messageid_t		id;
 
-	/*
+	/*%
 	 * Requested transfer type (dns_rdatatype_axfr or
 	 * dns_rdatatype_ixfr).  The actual transfer type
 	 * may differ due to IXFR->AXFR fallback.
@@ -122,32 +124,32 @@ struct dns_xfrin_ctx {
 	isc_sockaddr_t		sourceaddr;
 	isc_socket_t 		*socket;
 
-	/* Buffer for IXFR/AXFR request message */
+	/*% Buffer for IXFR/AXFR request message */
 	isc_buffer_t 		qbuffer;
 	unsigned char 		qbuffer_data[512];
 
-	/* Incoming reply TCP message */
+	/*% Incoming reply TCP message */
 	dns_tcpmsg_t		tcpmsg;
 	isc_boolean_t		tcpmsg_valid;
 
 	dns_db_t 		*db;
 	dns_dbversion_t 	*ver;
-	dns_diff_t 		diff;		/* Pending database changes */
-	int 			difflen;	/* Number of pending tuples */
+	dns_diff_t 		diff;		/*%< Pending database changes */
+	int 			difflen;	/*%< Number of pending tuples */
 
 	xfrin_state_t 		state;
 	isc_uint32_t 		end_serial;
 	isc_boolean_t 		is_ixfr;
 
-	unsigned int		nmsg;		/* Number of messages recvd */
+	unsigned int		nmsg;		/*%< Number of messages recvd */
 
-	dns_tsigkey_t		*tsigkey;	/* Key used to create TSIG */
-	isc_buffer_t		*lasttsig;	/* The last TSIG */
-	dst_context_t		*tsigctx;	/* TSIG verification context */
-	unsigned int		sincetsig;	/* recvd since the last TSIG */
+	dns_tsigkey_t		*tsigkey;	/*%< Key used to create TSIG */
+	isc_buffer_t		*lasttsig;	/*%< The last TSIG */
+	dst_context_t		*tsigctx;	/*%< TSIG verification context */
+	unsigned int		sincetsig;	/*%< recvd since the last TSIG */
 	dns_xfrindone_t		done;
 
-	/*
+	/*%
 	 * AXFR- and IXFR-specific data.  Only one is used at a time
 	 * according to the is_ixfr flag, so this could be a union,
 	 * but keeping them separate makes it a bit simpler to clean
@@ -224,14 +226,14 @@ static isc_result_t
 render(dns_message_t *msg, isc_mem_t *mctx, isc_buffer_t *buf);
 
 static void
-xfrin_logv(int level, dns_name_t *zonename, dns_rdataclass_t rdclass,
-	   isc_sockaddr_t *masteraddr, const char *fmt, va_list ap)
-     ISC_FORMAT_PRINTF(5, 0);
+xfrin_logv(int level, const char *zonetext, isc_sockaddr_t *masteraddr,
+	   const char *fmt, va_list ap)
+     ISC_FORMAT_PRINTF(4, 0);
 
 static void
-xfrin_log1(int level, dns_name_t *zonename, dns_rdataclass_t rdclass,
-	   isc_sockaddr_t *masteraddr, const char *fmt, ...)
-     ISC_FORMAT_PRINTF(5, 6);
+xfrin_log1(int level, const char *zonetext, isc_sockaddr_t *masteraddr,
+	   const char *fmt, ...)
+     ISC_FORMAT_PRINTF(4, 5);
 
 static void
 xfrin_log(dns_xfrin_ctx_t *xfr, int level, const char *fmt, ...)
@@ -457,7 +459,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, isc_uint32_t ttl,
 			FAIL(DNS_R_FORMERR);
 		}
 		/*
-		 * Remember the serial number in the intial SOA.
+		 * Remember the serial number in the initial SOA.
 		 * We need it to recognize the end of an IXFR.
 		 */
 		xfr->end_serial = dns_soa_getserial(rdata);
@@ -631,9 +633,12 @@ dns_xfrin_create2(dns_zone_t *zone, dns_rdatatype_t xfrtype,
  failure:
 	if (db != NULL)
 		dns_db_detach(&db);
-	if (result != ISC_R_SUCCESS)
-		xfrin_log1(ISC_LOG_ERROR, zonename, dns_zone_getclass(zone),
-			   masteraddr, "zone transfer setup failed");
+	if (result != ISC_R_SUCCESS) {
+		char zonetext[DNS_NAME_MAXTEXT+32];
+		dns_zone_name(zone, zonetext, sizeof(zonetext));
+		xfrin_log1(ISC_LOG_ERROR, zonetext, masteraddr,
+			   "zone transfer setup failed");
+	}
 	return (result);
 }
 
@@ -1400,23 +1405,19 @@ maybe_free(dns_xfrin_ctx_t *xfr) {
  * transfer of <zone> from <address>: <message>
  */
 static void
-xfrin_logv(int level, dns_name_t *zonename, dns_rdataclass_t rdclass,
-	   isc_sockaddr_t *masteraddr, const char *fmt, va_list ap)
+xfrin_logv(int level, const char *zonetext, isc_sockaddr_t *masteraddr,
+	   const char *fmt, va_list ap)
 {
-	char zntext[DNS_NAME_FORMATSIZE];
 	char mastertext[ISC_SOCKADDR_FORMATSIZE];
-	char classtext[DNS_RDATACLASS_FORMATSIZE];
 	char msgtext[2048];
 
-	dns_name_format(zonename, zntext, sizeof(zntext));
-	dns_rdataclass_format(rdclass, classtext, sizeof(classtext));
 	isc_sockaddr_format(masteraddr, mastertext, sizeof(mastertext));
 	vsnprintf(msgtext, sizeof(msgtext), fmt, ap);
 
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_XFER_IN,
 		      DNS_LOGMODULE_XFER_IN, level,
-		      "transfer of '%s/%s' from %s: %s",
-		      zntext, classtext, mastertext, msgtext);
+		      "transfer of '%s' from %s: %s",
+		      zonetext, mastertext, msgtext);
 }
 
 /*
@@ -1424,8 +1425,8 @@ xfrin_logv(int level, dns_name_t *zonename, dns_rdataclass_t rdclass,
  */
 
 static void
-xfrin_log1(int level, dns_name_t *zonename, dns_rdataclass_t rdclass,
-	   isc_sockaddr_t *masteraddr, const char *fmt, ...)
+xfrin_log1(int level, const char *zonetext, isc_sockaddr_t *masteraddr,
+           const char *fmt, ...)
 {
 	va_list ap;
 
@@ -1433,7 +1434,7 @@ xfrin_log1(int level, dns_name_t *zonename, dns_rdataclass_t rdclass,
 		return;
 
 	va_start(ap, fmt);
-	xfrin_logv(level, zonename, rdclass, masteraddr, fmt, ap);
+	xfrin_logv(level, zonetext, masteraddr, fmt, ap);
 	va_end(ap);
 }
 
@@ -1445,11 +1446,14 @@ static void
 xfrin_log(dns_xfrin_ctx_t *xfr, int level, const char *fmt, ...)
 {
 	va_list ap;
+	char zonetext[DNS_NAME_MAXTEXT+32];
 
 	if (isc_log_wouldlog(dns_lctx, level) == ISC_FALSE)
 		return;
 
+	dns_zone_name(xfr->zone, zonetext, sizeof(zonetext));
+
 	va_start(ap, fmt);
-	xfrin_logv(level, &xfr->name, xfr->rdclass, &xfr->masteraddr, fmt, ap);
+	xfrin_logv(level, zonetext, &xfr->masteraddr, fmt, ap);
 	va_end(ap);
 }
diff --git a/contrib/bind9/lib/dns/zone.c b/contrib/bind9/lib/dns/zone.c
index d2a47b0..5a73796 100644
--- a/contrib/bind9/lib/dns/zone.c
+++ b/contrib/bind9/lib/dns/zone.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.333.2.23.2.65 2006/07/19 01:04:24 marka Exp $ */
+/* $Id: zone.c,v 1.410.18.47 2006/12/07 06:21:16 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -25,16 +27,19 @@
 #include <isc/random.h>
 #include <isc/ratelimiter.h>
 #include <isc/refcount.h>
+#include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/string.h>
 #include <isc/taskpool.h>
 #include <isc/timer.h>
 #include <isc/util.h>
 
+#include <dns/acache.h>
 #include <dns/acl.h>
 #include <dns/adb.h>
 #include <dns/callbacks.h>
 #include <dns/db.h>
+#include <dns/dbiterator.h>
 #include <dns/events.h>
 #include <dns/journal.h>
 #include <dns/log.h>
@@ -79,7 +84,7 @@
 #define IO_MAGIC			ISC_MAGIC('Z', 'm', 'I', 'O')
 #define DNS_IO_VALID(load)		ISC_MAGIC_VALID(load, IO_MAGIC)
 
-/*
+/*%
  * Ensure 'a' is at least 'min' but not more than 'max'.
  */
 #define RANGE(a, min, max) \
@@ -88,16 +93,16 @@
 /*
  * Default values.
  */
-#define DNS_DEFAULT_IDLEIN 3600		/* 1 hour */
-#define DNS_DEFAULT_IDLEOUT 3600	/* 1 hour */
-#define MAX_XFER_TIME (2*3600)		/* Documented default is 2 hours */
+#define DNS_DEFAULT_IDLEIN 3600		/*%< 1 hour */
+#define DNS_DEFAULT_IDLEOUT 3600	/*%< 1 hour */
+#define MAX_XFER_TIME (2*3600)		/*%< Documented default is 2 hours */
 
 #ifndef DNS_MAX_EXPIRE
-#define DNS_MAX_EXPIRE	14515200	/* 24 weeks */
+#define DNS_MAX_EXPIRE	14515200	/*%< 24 weeks */
 #endif
 
 #ifndef DNS_DUMP_DELAY
-#define DNS_DUMP_DELAY 900		/* 15 minutes */
+#define DNS_DUMP_DELAY 900		/*%< 15 minutes */
 #endif
 
 typedef struct dns_notify dns_notify_t;
@@ -123,6 +128,18 @@ typedef ISC_LIST(dns_io_t) dns_iolist_t;
 #define LOCKED_ZONE(z) ISC_TRUE
 #endif
 
+#ifdef ISC_RWLOCK_USEATOMIC
+#define ZONEDB_INITLOCK(l)	isc_rwlock_init((l), 0, 0)
+#define ZONEDB_DESTROYLOCK(l)	isc_rwlock_destroy(l)
+#define ZONEDB_LOCK(l, t)	RWLOCK((l), (t))
+#define ZONEDB_UNLOCK(l, t)	RWUNLOCK((l), (t))
+#else
+#define ZONEDB_INITLOCK(l)	isc_mutex_init(l)
+#define ZONEDB_DESTROYLOCK(l)	DESTROYLOCK(l)
+#define ZONEDB_LOCK(l, t)	LOCK(l)
+#define ZONEDB_UNLOCK(l, t)	UNLOCK(l)
+#endif
+
 struct dns_zone {
 	/* Unlocked */
 	unsigned int		magic;
@@ -133,14 +150,21 @@ struct dns_zone {
 	isc_mem_t		*mctx;
 	isc_refcount_t		erefs;
 
+#ifdef ISC_RWLOCK_USEATOMIC
+	isc_rwlock_t		dblock;
+#else
+	isc_mutex_t		dblock;
+#endif
+	dns_db_t		*db;		/* Locked by dblock */
+
 	/* Locked */
-	dns_db_t		*db;
 	dns_zonemgr_t		*zmgr;
 	ISC_LINK(dns_zone_t)	link;		/* Used by zmgr. */
 	isc_timer_t		*timer;
 	unsigned int		irefs;
 	dns_name_t		origin;
 	char			*masterfile;
+	dns_masterformat_t	masterformat;
 	char			*journal;
 	isc_int32_t		journalsize;
 	dns_rdataclass_t	rdclass;
@@ -153,6 +177,7 @@ struct dns_zone {
 	isc_time_t		refreshtime;
 	isc_time_t		dumptime;
 	isc_time_t		loadtime;
+	isc_time_t		notifytime;
 	isc_uint32_t		serial;
 	isc_uint32_t		refresh;
 	isc_uint32_t		retry;
@@ -176,13 +201,13 @@ struct dns_zone {
 	unsigned int		notifycnt;
 	isc_sockaddr_t		notifyfrom;
 	isc_task_t		*task;
-	isc_sockaddr_t	 	notifysrc4;
-	isc_sockaddr_t	 	notifysrc6;
-	isc_sockaddr_t	 	xfrsource4;
-	isc_sockaddr_t	 	xfrsource6;
-	isc_sockaddr_t	 	altxfrsource4;
-	isc_sockaddr_t	 	altxfrsource6;
-	isc_sockaddr_t	 	sourceaddr;
+	isc_sockaddr_t		notifysrc4;
+	isc_sockaddr_t		notifysrc6;
+	isc_sockaddr_t		xfrsource4;
+	isc_sockaddr_t		xfrsource6;
+	isc_sockaddr_t		altxfrsource4;
+	isc_sockaddr_t		altxfrsource6;
+	isc_sockaddr_t		sourceaddr;
 	dns_xfrin_ctx_t		*xfr;		/* task locked */
 	dns_tsigkey_t		*tsigkey;	/* key used for xfr */
 	/* Access Control Lists */
@@ -192,6 +217,7 @@ struct dns_zone {
 	dns_acl_t		*query_acl;
 	dns_acl_t		*xfr_acl;
 	isc_boolean_t		update_disabled;
+	isc_boolean_t		zero_no_soa_ttl;
 	dns_severity_t		check_names;
 	ISC_LIST(dns_notify_t)	notifies;
 	dns_request_t		*request;
@@ -207,7 +233,11 @@ struct dns_zone {
 	dns_ssutable_t		*ssutable;
 	isc_uint32_t		sigvalidityinterval;
 	dns_view_t		*view;
-	/*
+	dns_acache_t		*acache;
+	dns_checkmxfunc_t	checkmx;
+	dns_checksrvfunc_t	checksrv;
+	dns_checknsfunc_t	checkns;
+	/*%
 	 * Zones in certain states such as "waiting for zone transfer"
 	 * or "zone transfer in progress" are kept on per-state linked lists
 	 * in the zone manager using the 'statelink' field.  The 'statelist'
@@ -216,10 +246,13 @@ struct dns_zone {
 	 */
 	ISC_LINK(dns_zone_t)	statelink;
 	dns_zonelist_t		*statelist;
-	/*
+	/*%
 	 * Optional per-zone statistics counters (NULL if not present).
 	 */
-	isc_uint64_t	    *counters;
+	isc_uint64_t	    	*counters;
+	isc_uint32_t		notifydelay;
+	dns_isselffunc_t	isself;
+	void			*isselfarg;
 };
 
 #define DNS_ZONE_FLAG(z,f) (ISC_TF(((z)->flags & (f)) != 0))
@@ -232,35 +265,35 @@ struct dns_zone {
 		(z)->flags &= ~(f); \
 		} while (0)
 	/* XXX MPA these may need to go back into zone.h */
-#define DNS_ZONEFLG_REFRESH	0x00000001U	/* refresh check in progress */
-#define DNS_ZONEFLG_NEEDDUMP	0x00000002U	/* zone need consolidation */
-#define DNS_ZONEFLG_USEVC	0x00000004U	/* use tcp for refresh query */
-#define DNS_ZONEFLG_DUMPING	0x00000008U	/* a dump is in progress */
-#define DNS_ZONEFLG_HASINCLUDE	0x00000010U	/* $INCLUDE in zone file */
-#define DNS_ZONEFLG_LOADED	0x00000020U	/* database has loaded */
-#define DNS_ZONEFLG_EXITING	0x00000040U	/* zone is being destroyed */
-#define DNS_ZONEFLG_EXPIRED	0x00000080U	/* zone has expired */
-#define DNS_ZONEFLG_NEEDREFRESH	0x00000100U	/* refresh check needed */
-#define DNS_ZONEFLG_UPTODATE	0x00000200U	/* zone contents are
+#define DNS_ZONEFLG_REFRESH	0x00000001U	/*%< refresh check in progress */
+#define DNS_ZONEFLG_NEEDDUMP	0x00000002U	/*%< zone need consolidation */
+#define DNS_ZONEFLG_USEVC	0x00000004U	/*%< use tcp for refresh query */
+#define DNS_ZONEFLG_DUMPING	0x00000008U	/*%< a dump is in progress */
+#define DNS_ZONEFLG_HASINCLUDE	0x00000010U	/*%< $INCLUDE in zone file */
+#define DNS_ZONEFLG_LOADED	0x00000020U	/*%< database has loaded */
+#define DNS_ZONEFLG_EXITING	0x00000040U	/*%< zone is being destroyed */
+#define DNS_ZONEFLG_EXPIRED	0x00000080U	/*%< zone has expired */
+#define DNS_ZONEFLG_NEEDREFRESH	0x00000100U	/*%< refresh check needed */
+#define DNS_ZONEFLG_UPTODATE	0x00000200U	/*%< zone contents are
 						 * uptodate */
-#define DNS_ZONEFLG_NEEDNOTIFY	0x00000400U	/* need to send out notify
+#define DNS_ZONEFLG_NEEDNOTIFY	0x00000400U	/*%< need to send out notify
 						 * messages */
-#define DNS_ZONEFLG_DIFFONRELOAD 0x00000800U	/* generate a journal diff on
+#define DNS_ZONEFLG_DIFFONRELOAD 0x00000800U	/*%< generate a journal diff on
 						 * reload */
-#define DNS_ZONEFLG_NOMASTERS	0x00001000U	/* an attempt to refresh a
+#define DNS_ZONEFLG_NOMASTERS	0x00001000U	/*%< an attempt to refresh a
 						 * zone with no masters
 						 * occured */
-#define DNS_ZONEFLG_LOADING	0x00002000U	/* load from disk in progress*/
-#define DNS_ZONEFLG_HAVETIMERS	0x00004000U	/* timer values have been set
+#define DNS_ZONEFLG_LOADING	0x00002000U	/*%< load from disk in progress*/
+#define DNS_ZONEFLG_HAVETIMERS	0x00004000U	/*%< timer values have been set
 						 * from SOA (if not set, we
 						 * are still using
 						 * default timer values) */
-#define DNS_ZONEFLG_FORCEXFER   0x00008000U     /* Force a zone xfer */
+#define DNS_ZONEFLG_FORCEXFER   0x00008000U     /*%< Force a zone xfer */
 #define DNS_ZONEFLG_NOREFRESH	0x00010000U
 #define DNS_ZONEFLG_DIALNOTIFY	0x00020000U
 #define DNS_ZONEFLG_DIALREFRESH	0x00040000U
 #define DNS_ZONEFLG_SHUTDOWN	0x00080000U
-#define DNS_ZONEFLAG_NOIXFR	0x00100000U	/* IXFR failed, force AXFR */
+#define DNS_ZONEFLAG_NOIXFR	0x00100000U	/*%< IXFR failed, force AXFR */
 #define DNS_ZONEFLG_FLUSH	0x00200000U
 #define DNS_ZONEFLG_NOEDNS	0x00400000U
 #define DNS_ZONEFLG_USEALTXFRSRC 0x00800000U
@@ -301,7 +334,7 @@ struct dns_zonemgr {
 	dns_iolist_t		low;
 };
 
-/*
+/*%
  * Hold notify state.
  */
 struct dns_notify {
@@ -318,7 +351,7 @@ struct dns_notify {
 
 #define DNS_NOTIFY_NOSOA	0x0001U
 
-/*
+/*%
  *	dns_stub holds state while performing a 'stub' transfer.
  *	'db' is the zone's 'db' or a new one if this is the initial
  *	transfer.
@@ -332,7 +365,7 @@ struct dns_stub {
 	dns_dbversion_t		*version;
 };
 
-/*
+/*%
  *	Hold load state.
  */
 struct dns_load {
@@ -344,7 +377,7 @@ struct dns_load {
 	dns_rdatacallbacks_t	callbacks;
 };
 
-/*
+/*%
  *	Hold forward state.
  */
 struct dns_forward {
@@ -359,7 +392,7 @@ struct dns_forward {
 	void			*callback_arg;
 };
 
-/*
+/*%
  *	Hold IO request state.
  */
 struct dns_io {
@@ -386,6 +419,8 @@ static void zone_iattach(dns_zone_t *source, dns_zone_t **target);
 static void zone_idetach(dns_zone_t **zonep);
 static isc_result_t zone_replacedb(dns_zone_t *zone, dns_db_t *db,
 				   isc_boolean_t dump);
+static inline void zone_attachdb(dns_zone_t *zone, dns_db_t *db);
+static inline void zone_detachdb(dns_zone_t *zone);
 static isc_result_t default_journal(dns_zone_t *zone);
 static void zone_xfrdone(dns_zone_t *zone, isc_result_t result);
 static isc_result_t zone_postload(dns_zone_t *zone, dns_db_t *db,
@@ -430,17 +465,18 @@ static void zonemgr_putio(dns_io_t **iop);
 static void zonemgr_cancelio(dns_io_t *io);
 
 static isc_result_t
-zone_get_from_db(dns_db_t *db, dns_name_t *origin, unsigned int *nscount,
+zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,
 		 unsigned int *soacount, isc_uint32_t *serial,
 		 isc_uint32_t *refresh, isc_uint32_t *retry,
-		 isc_uint32_t *expire, isc_uint32_t *minimum);
+		 isc_uint32_t *expire, isc_uint32_t *minimum,
+		 unsigned int *errors);
 
 static void zone_freedbargs(dns_zone_t *zone);
 static void forward_callback(isc_task_t *task, isc_event_t *event);
 static void zone_saveunique(dns_zone_t *zone, const char *path,
 			    const char *templat);
 static void zone_maintenance(dns_zone_t *zone);
-static void zone_notify(dns_zone_t *zone);
+static void zone_notify(dns_zone_t *zone, isc_time_t *now);
 static void dump_done(void *arg, isc_result_t result);
 
 #define ENTER zone_debuglog(zone, me, 1, "enter")
@@ -484,36 +520,41 @@ isc_result_t
 dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	isc_result_t result;
 	dns_zone_t *zone;
+	isc_time_t now;
 
 	REQUIRE(zonep != NULL && *zonep == NULL);
 	REQUIRE(mctx != NULL);
 
+	TIME_NOW(&now);
 	zone = isc_mem_get(mctx, sizeof(*zone));
 	if (zone == NULL)
 		return (ISC_R_NOMEMORY);
 
+	zone->mctx = NULL;
+	isc_mem_attach(mctx, &zone->mctx);
+
 	result = isc_mutex_init(&zone->lock);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, zone, sizeof(*zone));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
+	if (result != ISC_R_SUCCESS)
+		goto free_zone;
+
+	result = ZONEDB_INITLOCK(&zone->dblock);
+	if (result != ISC_R_SUCCESS)
+		goto free_mutex;
 
 	/* XXX MPA check that all elements are initialised */
-	zone->mctx = NULL;
 #ifdef DNS_ZONE_CHECKLOCK
 	zone->locked = ISC_FALSE;
 #endif
-	isc_mem_attach(mctx, &zone->mctx);
 	zone->db = NULL;
 	zone->zmgr = NULL;
 	ISC_LINK_INIT(zone, link);
-	isc_refcount_init(&zone->erefs, 1);	/* Implicit attach. */
+	result = isc_refcount_init(&zone->erefs, 1);	/* Implicit attach. */
+	if (result != ISC_R_SUCCESS)
+		goto free_dblock;
 	zone->irefs = 0;
 	dns_name_init(&zone->origin, NULL);
 	zone->masterfile = NULL;
+	zone->masterformat =  dns_masterformat_none;
 	zone->keydirectory = NULL;
 	zone->journalsize = -1;
 	zone->journal = NULL;
@@ -527,6 +568,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	isc_time_settoepoch(&zone->refreshtime);
 	isc_time_settoepoch(&zone->dumptime);
 	isc_time_settoepoch(&zone->loadtime);
+	zone->notifytime = now;
 	zone->serial = 0;
 	zone->refresh = DNS_ZONE_DEFAULTREFRESH;
 	zone->retry = DNS_ZONE_DEFAULTRETRY;
@@ -551,6 +593,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	zone->query_acl = NULL;
 	zone->xfr_acl = NULL;
 	zone->update_disabled = ISC_FALSE;
+	zone->zero_no_soa_ttl = ISC_TRUE;
 	zone->check_names = dns_severity_ignore;
 	zone->request = NULL;
 	zone->lctx = NULL;
@@ -574,16 +617,23 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	zone->ssutable = NULL;
 	zone->sigvalidityinterval = 30 * 24 * 3600;
 	zone->view = NULL;
+	zone->acache = NULL;
+	zone->checkmx = NULL;
+	zone->checksrv = NULL;
+	zone->checkns = NULL;
 	ISC_LINK_INIT(zone, statelink);
 	zone->statelist = NULL;
 	zone->counters = NULL;
+	zone->notifydelay = 5;
+	zone->isself = NULL;
+	zone->isselfarg = NULL;
 
 	zone->magic = ZONE_MAGIC;
 
 	/* Must be after magic is set. */
 	result = dns_zone_setdbtype(zone, dbargc_default, dbargv_default);
 	if (result != ISC_R_SUCCESS)
-		goto free_mutex;
+		goto free_erefs;
 
 	ISC_EVENT_INIT(&zone->ctlevent, sizeof(zone->ctlevent), 0, NULL,
 		       DNS_EVENT_ZONECONTROL, zone_shutdown, zone, zone,
@@ -591,8 +641,17 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	*zonep = zone;
 	return (ISC_R_SUCCESS);
 
+ free_erefs:
+	isc_refcount_decrement(&zone->erefs, NULL);
+	isc_refcount_destroy(&zone->erefs);
+
+ free_dblock:
+	ZONEDB_DESTROYLOCK(&zone->dblock);
+
  free_mutex:
 	DESTROYLOCK(&zone->lock);
+
+ free_zone:
 	isc_mem_putanddetach(&zone->mctx, zone, sizeof(*zone));
 	return (result);
 }
@@ -639,7 +698,9 @@ zone_free(dns_zone_t *zone) {
 	if (zone->counters != NULL)
 		dns_stats_freecounters(zone->mctx, &zone->counters);
 	if (zone->db != NULL)
-		dns_db_detach(&zone->db);
+		zone_detachdb(zone);
+	if (zone->acache != NULL)
+		dns_acache_detach(&zone->acache);
 	zone_freedbargs(zone);
 	RUNTIME_CHECK(dns_zone_setmasterswithkeys(zone, NULL, NULL, 0)
 		      == ISC_R_SUCCESS);
@@ -662,6 +723,7 @@ zone_free(dns_zone_t *zone) {
 		dns_ssutable_detach(&zone->ssutable);
 
 	/* last stuff */
+	ZONEDB_DESTROYLOCK(&zone->dblock);
 	DESTROYLOCK(&zone->lock);
 	isc_refcount_destroy(&zone->erefs);
 	zone->magic = 0;
@@ -739,6 +801,39 @@ zone_freedbargs(dns_zone_t *zone) {
 }
 
 isc_result_t
+dns_zone_getdbtype(dns_zone_t *zone, char ***argv, isc_mem_t *mctx) {
+	size_t size = 0;
+	unsigned int i;
+	isc_result_t result = ISC_R_SUCCESS;
+	void *mem;
+	char **tmp, *tmp2;
+	
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(argv != NULL && *argv == NULL);
+	
+	LOCK_ZONE(zone);
+	size = (zone->db_argc + 1) * sizeof(char *);
+	for (i = 0; i < zone->db_argc; i++)
+		size += strlen(zone->db_argv[i]) + 1;
+	mem = isc_mem_allocate(mctx, size);
+	if (mem != NULL) {
+		tmp = mem;
+		tmp2 = mem;
+		tmp2 += (zone->db_argc + 1) * sizeof(char *);
+		for (i = 0; i < zone->db_argc; i++) {
+			*tmp++ = tmp2;
+			strcpy(tmp2, zone->db_argv[i]);
+			tmp2 += strlen(tmp2) + 1;
+		}
+		*tmp = NULL;
+	} else
+		result = ISC_R_NOMEMORY;
+	UNLOCK_ZONE(zone);
+	*argv = mem;
+	return (result);
+}
+
+isc_result_t
 dns_zone_setdbtype(dns_zone_t *zone,
 		   unsigned int dbargc, const char * const *dbargv) {
 	isc_result_t result = ISC_R_SUCCESS;
@@ -822,6 +917,35 @@ dns_zone_setorigin(dns_zone_t *zone, const dns_name_t *origin) {
 	return (result);
 }
 
+void
+dns_zone_setacache(dns_zone_t *zone, dns_acache_t *acache) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(acache != NULL);
+	
+	LOCK_ZONE(zone);
+	if (zone->acache != NULL)
+		dns_acache_detach(&zone->acache);
+	dns_acache_attach(acache, &zone->acache);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
+	if (zone->db != NULL) {
+		isc_result_t result;
+
+		/*
+		 * If the zone reuses an existing DB, the DB needs to be
+		 * set in the acache explicitly.  We can safely ignore the
+		 * case where the DB is already set.  If other error happens,
+		 * the acache will not work effectively.
+		 */
+		result = dns_acache_setdb(acache, zone->db);
+		if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "dns_acache_setdb() failed: %s",
+					 isc_result_totext(result));
+		}
+	}
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+	UNLOCK_ZONE(zone);
+}
 
 static isc_result_t
 dns_zone_setstring(dns_zone_t *zone, char **field, const char *value) {
@@ -844,14 +968,22 @@ dns_zone_setstring(dns_zone_t *zone, char **field, const char *value) {
 
 isc_result_t
 dns_zone_setfile(dns_zone_t *zone, const char *file) {
+	return (dns_zone_setfile2(zone, file, dns_masterformat_text));
+}
+
+isc_result_t
+dns_zone_setfile2(dns_zone_t *zone, const char *file,
+		  dns_masterformat_t format) {
 	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	LOCK_ZONE(zone);
 	result = dns_zone_setstring(zone, &zone->masterfile, file);
-	if (result == ISC_R_SUCCESS)
+	if (result == ISC_R_SUCCESS) {
+		zone->masterformat = format;
 		result = default_journal(zone);
+	}
 	UNLOCK_ZONE(zone);
 
 	return (result);
@@ -979,31 +1111,42 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 		goto cleanup;
 	}
 
+
+	/*
+	 * Store the current time before the zone is loaded, so that if the
+	 * file changes between the time of the load and the time that
+	 * zone->loadtime is set, then the file will still be reloaded
+	 * the next time dns_zone_load is called.
+	 */
+	TIME_NOW(&loadtime);
+
 	/*
 	 * Don't do the load if the file that stores the zone is older
 	 * than the last time the zone was loaded.  If the zone has not
 	 * been loaded yet, zone->loadtime will be the epoch.
 	 */
-	if (zone->masterfile != NULL && ! isc_time_isepoch(&zone->loadtime)) {
+	if (zone->masterfile != NULL) {
 		/*
 		 * The file is already loaded.  If we are just doing a
 		 * "rndc reconfig", we are done.
 		 */
-		if ((flags & DNS_ZONELOADFLAG_NOSTAT) != 0) {
+		if (!isc_time_isepoch(&zone->loadtime) &&
+		    (flags & DNS_ZONELOADFLAG_NOSTAT) != 0) {
 			result = ISC_R_SUCCESS;
 			goto cleanup;
 		}
-		if (! DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE)) {
-			result = isc_file_getmodtime(zone->masterfile,
-						     &filetime);
-			if (result == ISC_R_SUCCESS &&
+
+		result = isc_file_getmodtime(zone->masterfile, &filetime);
+		if (result == ISC_R_SUCCESS) {
+			if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE) &&
 			    isc_time_compare(&filetime, &zone->loadtime) <= 0) {
 				dns_zone_log(zone, ISC_LOG_DEBUG(1),
-					     "skipping load: master file older "
-					     "than last load");
+					     "skipping load: master file "
+					     "older than last load");
 				result = DNS_R_UPTODATE;
 				goto cleanup;
 			}
+			loadtime = filetime;
 		}
 	}
 
@@ -1024,9 +1167,10 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 	     strcmp(zone->db_argv[0], "rbt64") == 0)) {
 		if (zone->masterfile == NULL ||
 		    !isc_file_exists(zone->masterfile)) {
-			if (zone->masterfile != NULL)
+			if (zone->masterfile != NULL) {
 				dns_zone_log(zone, ISC_LOG_DEBUG(1),
 					     "no master file");
+			}
 			zone->refreshtime = now;
 			if (zone->task != NULL)
 				zone_settimer(zone, &now);
@@ -1037,14 +1181,6 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 
 	dns_zone_log(zone, ISC_LOG_DEBUG(1), "starting load");
 
-	/*
-	 * Store the current time before the zone is loaded, so that if the
-	 * file changes between the time of the load and the time that
-	 * zone->loadtime is set, then the file will still be reloaded
-	 * the next time dns_zone_load is called.
-	 */
-	TIME_NOW(&loadtime);
-
 	result = dns_db_create(zone->mctx, zone->db_argv[0],
 			       &zone->origin, (zone->type == dns_zone_stub) ?
 			       dns_dbtype_stub : dns_dbtype_zone,
@@ -1125,14 +1261,21 @@ zone_gotreadhandle(isc_task_t *task, isc_event_t *event) {
 		options |= DNS_MASTER_CHECKNAMES;
 	if (DNS_ZONE_OPTION(load->zone, DNS_ZONEOPT_CHECKNAMESFAIL))
 		options |= DNS_MASTER_CHECKNAMESFAIL;
-	result = dns_master_loadfileinc(load->zone->masterfile,
-					dns_db_origin(load->db),
-					dns_db_origin(load->db),
-					load->zone->rdclass,
-					options,
-					&load->callbacks, task,
-					zone_loaddone, load,
-					&load->zone->lctx, load->zone->mctx);
+	if (DNS_ZONE_OPTION(load->zone, DNS_ZONEOPT_CHECKMX))
+		options |= DNS_MASTER_CHECKMX;
+	if (DNS_ZONE_OPTION(load->zone, DNS_ZONEOPT_CHECKMXFAIL))
+		options |= DNS_MASTER_CHECKMXFAIL;
+	if (DNS_ZONE_OPTION(load->zone, DNS_ZONEOPT_CHECKWILDCARD))
+		options |= DNS_MASTER_CHECKWILDCARD;
+	result = dns_master_loadfileinc2(load->zone->masterfile,
+					 dns_db_origin(load->db),
+					 dns_db_origin(load->db),
+					 load->zone->rdclass,
+					 options,
+					 &load->callbacks, task,
+					 zone_loaddone, load,
+					 &load->zone->lctx, load->zone->mctx,
+					 load->zone->masterformat);
 	if (result != ISC_R_SUCCESS && result != DNS_R_CONTINUE &&
 	    result != DNS_R_SEENINCLUDE)
 		goto fail;
@@ -1160,12 +1303,14 @@ zone_gotwritehandle(isc_task_t *task, isc_event_t *event) {
 		goto fail;
 
 	LOCK_ZONE(zone);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	dns_db_currentversion(zone->db, &version);
-	result = dns_master_dumpinc(zone->mctx, zone->db, version,
-				    &dns_master_style_default,
-				    zone->masterfile, zone->task,
-				    dump_done, zone, &zone->dctx);
+	result = dns_master_dumpinc2(zone->mctx, zone->db, version,
+				     &dns_master_style_default,
+				     zone->masterfile, zone->task, dump_done,
+				     zone, &zone->dctx, zone->masterformat);
 	dns_db_closeversion(zone->db, &version, ISC_FALSE);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
 	UNLOCK_ZONE(zone);
 	if (result != DNS_R_CONTINUE)
 		goto fail;
@@ -1195,6 +1340,12 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 		options |= DNS_MASTER_CHECKNAMES;
 	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKNAMESFAIL))
 		options |= DNS_MASTER_CHECKNAMESFAIL;
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKMX))
+		options |= DNS_MASTER_CHECKMX;
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKMXFAIL))
+		options |= DNS_MASTER_CHECKMXFAIL;
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKWILDCARD))
+		options |= DNS_MASTER_CHECKWILDCARD;
 
 	if (zone->zmgr != NULL && zone->db != NULL && zone->task != NULL) {
 		load = isc_mem_get(zone->mctx, sizeof(*load));
@@ -1236,9 +1387,10 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 					  &callbacks.add_private);
 		if (result != ISC_R_SUCCESS)
 			return (result);
-		result = dns_master_loadfile(zone->masterfile, &zone->origin,
-					     &zone->origin, zone->rdclass,
-					     options, &callbacks, zone->mctx);
+		result = dns_master_loadfile2(zone->masterfile, &zone->origin,
+					      &zone->origin, zone->rdclass,
+					      options, &callbacks, zone->mctx,
+					      zone->masterformat);
 		tresult = dns_db_endload(db, &callbacks.add_private);
 		if (result == ISC_R_SUCCESS)
 			result = tresult;
@@ -1255,12 +1407,487 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
 	return (result);
 }
 
+static isc_boolean_t
+zone_check_mx(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
+	      dns_name_t *owner)
+{
+	isc_result_t result;
+	char ownerbuf[DNS_NAME_FORMATSIZE];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char altbuf[DNS_NAME_FORMATSIZE];
+	dns_fixedname_t fixed;
+	dns_name_t *foundname;
+	int level;
+	
+	/*
+	 * Outside of zone.
+	 */
+	if (!dns_name_issubdomain(name, &zone->origin)) {
+		if (zone->checkmx != NULL)
+			return ((zone->checkmx)(zone, name, owner));
+		return (ISC_TRUE);
+	}
+
+	if (zone->type == dns_zone_master)
+		level = ISC_LOG_ERROR;
+	else
+		level = ISC_LOG_WARNING;
+
+	dns_fixedname_init(&fixed);
+	foundname = dns_fixedname_name(&fixed);
+
+	result = dns_db_find(db, name, NULL, dns_rdatatype_a,
+			     0, 0, NULL, foundname, NULL, NULL);
+	if (result == ISC_R_SUCCESS)
+		return (ISC_TRUE);
+
+	if (result == DNS_R_NXRRSET) {
+		result = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
+				     0, 0, NULL, foundname, NULL, NULL);
+		if (result == ISC_R_SUCCESS)
+			return (ISC_TRUE);
+	}
+
+	dns_name_format(owner, ownerbuf, sizeof ownerbuf);
+	dns_name_format(name, namebuf, sizeof namebuf);
+	if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
+	    result == DNS_R_EMPTYNAME) {
+		dns_zone_log(zone, level,
+			     "%s/MX '%s' has no address records (A or AAAA)",
+			     ownerbuf, namebuf);
+		/* XXX950 make fatal for 9.5.0. */
+		return (ISC_TRUE);
+	}
+
+	if (result == DNS_R_CNAME) {
+		if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNMXCNAME) ||
+		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME))
+			level = ISC_LOG_WARNING;
+		if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME))
+			dns_zone_log(zone, level,
+				     "%s/MX '%s' is a CNAME (illegal)",
+				     ownerbuf, namebuf);
+		return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
+	}
+
+	if (result == DNS_R_DNAME) {
+		if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNMXCNAME) ||
+		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME))
+			level = ISC_LOG_WARNING;
+		if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME)) {
+			dns_name_format(foundname, altbuf, sizeof altbuf);
+			dns_zone_log(zone, level, "%s/MX '%s' is below a DNAME"
+				     " '%s' (illegal)", ownerbuf, namebuf,
+				     altbuf);
+		}
+		return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
+	}
+
+	if (zone->checkmx != NULL && result == DNS_R_DELEGATION)
+		return ((zone->checkmx)(zone, name, owner));
+
+	return (ISC_TRUE);
+}
+
+static isc_boolean_t
+zone_check_srv(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
+	       dns_name_t *owner)
+{
+	isc_result_t result;
+	char ownerbuf[DNS_NAME_FORMATSIZE];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char altbuf[DNS_NAME_FORMATSIZE];
+	dns_fixedname_t fixed;
+	dns_name_t *foundname;
+	int level;
+	
+	/*
+	 * "." means the services does not exist.
+	 */
+	if (dns_name_equal(name, dns_rootname))
+		return (ISC_TRUE);
+
+	/*
+	 * Outside of zone.
+	 */
+	if (!dns_name_issubdomain(name, &zone->origin)) {
+		if (zone->checksrv != NULL)
+			return ((zone->checksrv)(zone, name, owner));
+		return (ISC_TRUE);
+	}
+
+	if (zone->type == dns_zone_master)
+		level = ISC_LOG_ERROR;
+	else
+		level = ISC_LOG_WARNING;
+
+	dns_fixedname_init(&fixed);
+	foundname = dns_fixedname_name(&fixed);
+
+	result = dns_db_find(db, name, NULL, dns_rdatatype_a,
+			     0, 0, NULL, foundname, NULL, NULL);
+	if (result == ISC_R_SUCCESS)
+		return (ISC_TRUE);
+
+	if (result == DNS_R_NXRRSET) {
+		result = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
+				     0, 0, NULL, foundname, NULL, NULL);
+		if (result == ISC_R_SUCCESS)
+			return (ISC_TRUE);
+	}
+
+	dns_name_format(owner, ownerbuf, sizeof ownerbuf);
+	dns_name_format(name, namebuf, sizeof namebuf);
+	if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
+	    result == DNS_R_EMPTYNAME) {
+		dns_zone_log(zone, level,
+			     "%s/SRV '%s' has no address records (A or AAAA)",
+			     ownerbuf, namebuf);
+		/* XXX950 make fatal for 9.5.0. */
+		return (ISC_TRUE);
+	}
+
+	if (result == DNS_R_CNAME) {
+		if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNSRVCNAME) ||
+		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME))
+			level = ISC_LOG_WARNING;
+		if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME))
+			dns_zone_log(zone, level,
+				     "%s/SRV '%s' is a CNAME (illegal)",
+				     ownerbuf, namebuf);
+		return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
+	}
+
+	if (result == DNS_R_DNAME) {
+		if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNSRVCNAME) ||
+		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME))
+			level = ISC_LOG_WARNING;
+		if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME)) {
+			dns_name_format(foundname, altbuf, sizeof altbuf);
+			dns_zone_log(zone, level, "%s/SRV '%s' is below a "
+				     "DNAME '%s' (illegal)", ownerbuf, namebuf,
+				     altbuf);
+		}
+		return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
+	}
+
+	if (zone->checksrv != NULL && result == DNS_R_DELEGATION)
+		return ((zone->checksrv)(zone, name, owner));
+
+	return (ISC_TRUE);
+}
+
+static isc_boolean_t
+zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
+		dns_name_t *owner)
+{
+	isc_boolean_t answer = ISC_TRUE;
+	isc_result_t result, tresult;
+	char ownerbuf[DNS_NAME_FORMATSIZE];
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char altbuf[DNS_NAME_FORMATSIZE];
+	dns_fixedname_t fixed;
+	dns_name_t *foundname;
+	dns_rdataset_t a;
+	dns_rdataset_t aaaa;
+	int level;
+	
+	/*
+	 * Outside of zone.
+	 */
+	if (!dns_name_issubdomain(name, &zone->origin)) {
+		if (zone->checkns != NULL)
+			return ((zone->checkns)(zone, name, owner, NULL, NULL));
+		return (ISC_TRUE);
+	}
+
+	if (zone->type == dns_zone_master)
+		level = ISC_LOG_ERROR;
+	else
+		level = ISC_LOG_WARNING;
+
+	dns_fixedname_init(&fixed);
+	foundname = dns_fixedname_name(&fixed);
+	dns_rdataset_init(&a);
+	dns_rdataset_init(&aaaa);
+
+	result = dns_db_find(db, name, NULL, dns_rdatatype_a,
+			     DNS_DBFIND_GLUEOK, 0, NULL,
+			     foundname, &a, NULL);
+
+	if (result == ISC_R_SUCCESS) {
+		dns_rdataset_disassociate(&a);
+		return (ISC_TRUE);
+	} else if (result == DNS_R_DELEGATION)
+		dns_rdataset_disassociate(&a);
+
+	if (result == DNS_R_NXRRSET || result == DNS_R_DELEGATION ||
+	    result == DNS_R_GLUE) {
+		tresult = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
+				     DNS_DBFIND_GLUEOK, 0, NULL,
+				     foundname, &aaaa, NULL);
+		if (tresult == ISC_R_SUCCESS) {
+			dns_rdataset_disassociate(&aaaa);
+			return (ISC_TRUE);
+		} 
+		if (tresult == DNS_R_DELEGATION)
+			dns_rdataset_disassociate(&aaaa);
+		if (result == DNS_R_GLUE || tresult == DNS_R_GLUE) {
+			/*
+			 * Check glue against child zone.
+			 */
+			if (zone->checkns != NULL)
+				answer = (zone->checkns)(zone, name, owner,
+							 &a, &aaaa);
+			if (dns_rdataset_isassociated(&a))
+				dns_rdataset_disassociate(&a);
+			if (dns_rdataset_isassociated(&aaaa))
+				dns_rdataset_disassociate(&aaaa);
+			return (answer);
+		}
+	} else
+		tresult = result;
+
+	dns_name_format(owner, ownerbuf, sizeof ownerbuf);
+	dns_name_format(name, namebuf, sizeof namebuf);
+	if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
+	    result == DNS_R_EMPTYNAME || result == DNS_R_DELEGATION) {
+		const char *what;
+		if (dns_name_issubdomain(name, owner))
+			what = "REQUIRED GLUE ";
+		else if (result == DNS_R_DELEGATION)
+			what = "SIBLING GLUE ";
+		else
+			what = "";
+
+		if (result != DNS_R_DELEGATION ||
+		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKSIBLING)) {
+			dns_zone_log(zone, level, "%s/NS '%s' has no %s"
+				     "address records (A or AAAA)",
+				     ownerbuf, namebuf, what);
+			/*
+			 * Log missing address record.
+			 */
+			if (result == DNS_R_DELEGATION && zone->checkns != NULL)
+				(void)(zone->checkns)(zone, name, owner,
+						      &a, &aaaa);
+			/* XXX950 make fatal for 9.5.0. */
+			/* answer = ISC_FALSE; */
+		}
+	} else if (result == DNS_R_CNAME) {
+		dns_zone_log(zone, level, "%s/NS '%s' is a CNAME (illegal)",
+			     ownerbuf, namebuf);
+		/* XXX950 make fatal for 9.5.0. */
+		/* answer = ISC_FALSE; */
+	} else if (result == DNS_R_DNAME) {
+		dns_name_format(foundname, altbuf, sizeof altbuf);
+		dns_zone_log(zone, level,
+			     "%s/NS '%s' is below a DNAME '%s' (illegal)",
+			     ownerbuf, namebuf, altbuf);
+		/* XXX950 make fatal for 9.5.0. */
+		/* answer = ISC_FALSE; */
+	}
+
+	if (dns_rdataset_isassociated(&a))
+		dns_rdataset_disassociate(&a);
+	if (dns_rdataset_isassociated(&aaaa))
+		dns_rdataset_disassociate(&aaaa);
+	return (answer);
+}
+
+static isc_boolean_t
+integrity_checks(dns_zone_t *zone, dns_db_t *db) {
+	dns_dbiterator_t *dbiterator = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_rdataset_t rdataset;
+	dns_fixedname_t fixed;
+	dns_fixedname_t fixedbottom;
+	dns_rdata_mx_t mx;
+	dns_rdata_ns_t ns;
+	dns_rdata_in_srv_t srv;
+	dns_rdata_t rdata;
+	dns_name_t *name;
+	dns_name_t *bottom;
+	isc_result_t result;
+	isc_boolean_t ok = ISC_TRUE;
+
+	dns_fixedname_init(&fixed);
+	name = dns_fixedname_name(&fixed);
+	dns_fixedname_init(&fixedbottom);
+	bottom = dns_fixedname_name(&fixedbottom);
+	dns_rdataset_init(&rdataset);
+	dns_rdata_init(&rdata);
+
+	result = dns_db_createiterator(db, ISC_FALSE, &dbiterator);
+	if (result != ISC_R_SUCCESS)
+		return (ISC_TRUE);
+
+	result = dns_dbiterator_first(dbiterator);
+	while (result == ISC_R_SUCCESS) {
+		result = dns_dbiterator_current(dbiterator, &node, name);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup;
+
+		/*
+		 * Is this name visible in the zone?
+		 */
+		if (!dns_name_issubdomain(name, &zone->origin) ||
+		    (dns_name_countlabels(bottom) > 0 &&
+		     dns_name_issubdomain(name, bottom)))
+			goto next;
+
+		/*
+		 * Don't check the NS records at the origin.
+		 */
+		if (dns_name_equal(name, &zone->origin))
+			goto checkmx;
+
+		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ns, 
+					     0, 0, &rdataset, NULL);
+		if (result != ISC_R_SUCCESS)
+			goto checkmx;
+		/*
+		 * Remember bottom of zone.
+		 */
+		dns_name_copy(name, bottom, NULL);
+
+		result = dns_rdataset_first(&rdataset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&rdataset, &rdata);
+			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			if (!zone_check_glue(zone, db, &ns.name, name))
+				ok = ISC_FALSE;
+			dns_rdata_reset(&rdata);
+			result = dns_rdataset_next(&rdataset);
+		}
+		dns_rdataset_disassociate(&rdataset);
+
+ checkmx:
+		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_mx, 
+					     0, 0, &rdataset, NULL);
+		if (result != ISC_R_SUCCESS)
+			goto checksrv;
+		result = dns_rdataset_first(&rdataset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&rdataset, &rdata);
+			result = dns_rdata_tostruct(&rdata, &mx, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			if (!zone_check_mx(zone, db, &mx.mx, name))
+				ok = ISC_FALSE;
+			dns_rdata_reset(&rdata);
+			result = dns_rdataset_next(&rdataset);
+		}
+		dns_rdataset_disassociate(&rdataset);
+
+ checksrv:
+		if (zone->rdclass != dns_rdataclass_in)
+			goto next;
+		result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_srv, 
+					     0, 0, &rdataset, NULL);
+		if (result != ISC_R_SUCCESS)
+			goto next;
+		result = dns_rdataset_first(&rdataset);
+		while (result == ISC_R_SUCCESS) {
+			dns_rdataset_current(&rdataset, &rdata);
+			result = dns_rdata_tostruct(&rdata, &srv, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			if (!zone_check_srv(zone, db, &srv.target, name))
+				ok = ISC_FALSE;
+			dns_rdata_reset(&rdata);
+			result = dns_rdataset_next(&rdataset);
+		}
+		dns_rdataset_disassociate(&rdataset);
+
+ next:
+		dns_db_detachnode(db, &node);
+		result = dns_dbiterator_next(dbiterator);
+	}
+
+ cleanup:
+	if (node != NULL)
+		dns_db_detachnode(db, &node);
+	dns_dbiterator_destroy(&dbiterator);
+
+	return (ok);
+}
+
+/*
+ * OpenSSL verification of RSA keys with exponent 3 is known to be
+ * broken prior OpenSSL 0.9.8c/0.9.7k.  Look for such keys and warn
+ * if they are in use.
+ */
+static void
+zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
+	dns_dbnode_t *node = NULL;
+	dns_dbversion_t *version = NULL;
+	dns_rdata_dnskey_t dnskey;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	dns_rdataset_t rdataset;
+	isc_result_t result;
+	isc_boolean_t logit, foundrsa = ISC_FALSE, foundmd5 = ISC_FALSE;
+	const char *algorithm;
+
+	result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	dns_db_currentversion(db, &version);
+	dns_rdataset_init(&rdataset);
+	result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
+				     dns_rdatatype_none, 0, &rdataset, NULL);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	for (result = dns_rdataset_first(&rdataset);
+	     result == ISC_R_SUCCESS;
+	     result = dns_rdataset_next(&rdataset)) 
+	{
+		dns_rdataset_current(&rdataset, &rdata);
+		result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
+		INSIST(result == ISC_R_SUCCESS);
+		
+		if ((dnskey.algorithm == DST_ALG_RSASHA1 ||
+		     dnskey.algorithm == DST_ALG_RSAMD5) &&
+		     dnskey.datalen > 1 && dnskey.data[0] == 1 &&
+		     dnskey.data[1] == 3)
+		{
+			if (dnskey.algorithm == DST_ALG_RSASHA1) {
+				logit = !foundrsa;
+				foundrsa = ISC_TRUE;
+				algorithm = "RSASHA1";
+			} else {
+				logit = !foundmd5;
+				foundmd5 = ISC_TRUE;
+				algorithm = "RSAMD5";
+			}
+			if (logit)
+				dns_zone_log(zone, ISC_LOG_WARNING,
+					     "weak %s (%u) key found "
+					     "(exponent=3)", algorithm,
+					     dnskey.algorithm);
+			if (foundrsa && foundmd5)
+				break;
+		}
+		dns_rdata_reset(&rdata);
+	}
+	dns_rdataset_disassociate(&rdataset);
+
+ cleanup:
+	if (node != NULL)
+		dns_db_detachnode(db, &node);
+	if (version != NULL)
+		dns_db_closeversion(db, &version, ISC_FALSE);
+	
+}
+
 static isc_result_t
 zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	      isc_result_t result)
 {
 	unsigned int soacount = 0;
 	unsigned int nscount = 0;
+	unsigned int errors = 0;
 	isc_uint32_t serial, refresh, retry, expire, minimum;
 	isc_time_t now;
 	isc_boolean_t needdump = ISC_FALSE;
@@ -1281,12 +1908,13 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 					     "no master file");
 			else if (result != DNS_R_NOMASTERFILE)
 				dns_zone_log(zone, ISC_LOG_ERROR,
-					     "loading master file %s: %s",
+					     "loading from master file %s "
+					     "failed: %s",
 					     zone->masterfile,
 					     dns_result_totext(result));
 		} else
 			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "loading master file %s: %s",
+				     "loading from master file %s failed: %s",
 				     zone->masterfile,
 				     dns_result_totext(result));
 		goto cleanup;
@@ -1337,14 +1965,12 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded");
 
 	/*
-	 * Obtain ns and soa counts for top of zone.
+	 * Obtain ns, soa and cname counts for top of zone.
 	 */
-	nscount = 0;
-	soacount = 0;
 	INSIST(db != NULL);
-	result = zone_get_from_db(db, &zone->origin, &nscount,
-				  &soacount, &serial, &refresh, &retry,
-				  &expire, &minimum);
+	result = zone_get_from_db(zone, db, &nscount, &soacount, &serial,
+				  &refresh, &retry, &expire, &minimum,
+				  &errors);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
 			     "could not find NS and/or SOA records");
@@ -1371,6 +1997,17 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		}
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
+		if (zone->type == dns_zone_master && errors != 0) {
+			result = DNS_R_BADZONE;
+			goto cleanup;
+		}
+		if (zone->type == dns_zone_master &&
+		    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKINTEGRITY) &&
+		    !integrity_checks(zone, db)) {
+			result = DNS_R_BADZONE;
+			goto cleanup;
+		}
+
 		if (zone->db != NULL) {
 			/*
 			 * This is checked in zone_replacedb() for slave zones
@@ -1397,7 +2034,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 					     "zone serial has gone backwards");
 			else if (serial == zone->serial && !hasinclude) 
 				dns_zone_log(zone, ISC_LOG_ERROR,
-					     "zone serial unchanged");
+					     "zone serial unchanged. "
+					     "zone may fail to transfer "
+					     "to slaves.");
 		}
 		zone->serial = serial;
 		zone->refresh = RANGE(refresh,
@@ -1440,6 +2079,11 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		goto cleanup;
 	}
 
+	/*
+	 * Check for weak DNSKEY's.
+	 */
+	if (zone->type == dns_zone_master)
+		zone_check_dnskeys(zone, db);
 
 #if 0
 	/* destroy notification example. */
@@ -1453,12 +2097,15 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	}
 #endif
 
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
 	if (zone->db != NULL) {
 		result = zone_replacedb(zone, db, ISC_FALSE);
+		ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
 	} else {
-		dns_db_attach(db, &zone->db);
+		zone_attachdb(zone, db);
+		ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
 		DNS_ZONE_SETFLAG(zone,
 				 DNS_ZONEFLG_LOADED|DNS_ZONEFLG_NEEDNOTIFY);
 	}
@@ -1509,36 +2156,111 @@ exit_check(dns_zone_t *zone) {
 	return (ISC_FALSE);
 }
 
+static isc_boolean_t
+zone_check_ns(dns_zone_t *zone, dns_db_t *db, dns_name_t *name) {
+	isc_result_t result;
+	char namebuf[DNS_NAME_FORMATSIZE];
+	char altbuf[DNS_NAME_FORMATSIZE];
+	dns_fixedname_t fixed;
+	dns_name_t *foundname;
+	int level;
+	
+	if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NOCHECKNS))
+		return (ISC_TRUE);
+
+	if (zone->type == dns_zone_master)
+		level = ISC_LOG_ERROR;
+	else
+		level = ISC_LOG_WARNING;
+
+	dns_fixedname_init(&fixed);
+	foundname = dns_fixedname_name(&fixed);
+
+	result = dns_db_find(db, name, NULL, dns_rdatatype_a,
+			     0, 0, NULL, foundname, NULL, NULL);
+	if (result == ISC_R_SUCCESS)
+		return (ISC_TRUE);
+
+	if (result == DNS_R_NXRRSET) {
+		result = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
+				     0, 0, NULL, foundname, NULL, NULL);
+		if (result == ISC_R_SUCCESS)
+			return (ISC_TRUE);
+	}
+
+	dns_name_format(name, namebuf, sizeof namebuf);
+	if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
+	    result == DNS_R_EMPTYNAME) {
+		dns_zone_log(zone, level,
+			     "NS '%s' has no address records (A or AAAA)",
+			     namebuf);
+		/* XXX950 Make fatal ISC_FALSE for 9.5.0. */
+		return (ISC_TRUE);
+	}
+
+	if (result == DNS_R_CNAME) {
+		dns_zone_log(zone, level, "NS '%s' is a CNAME (illegal)",
+			     namebuf);
+		/* XXX950 Make fatal ISC_FALSE for 9.5.0. */
+		return (ISC_TRUE);
+	}
+
+	if (result == DNS_R_DNAME) {
+		dns_name_format(foundname, altbuf, sizeof altbuf);
+		dns_zone_log(zone, level,
+			     "NS '%s' is below a DNAME '%s' (illegal)",
+			     namebuf, altbuf);
+		/* XXX950 Make fatal ISC_FALSE for 9.5.0. */
+		return (ISC_TRUE);
+	}
+
+	return (ISC_TRUE);
+}
+
 static isc_result_t
-zone_count_ns_rr(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
-		 unsigned int *nscount)
+zone_count_ns_rr(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
+		 dns_dbversion_t *version, unsigned int *nscount,
+		 unsigned int *errors)
 {
 	isc_result_t result;
-	unsigned int count;
+	unsigned int count = 0;
+	unsigned int ecount = 0;
 	dns_rdataset_t rdataset;
-
-	REQUIRE(nscount != NULL);
+	dns_rdata_t rdata;
+	dns_rdata_ns_t ns;
 
 	dns_rdataset_init(&rdataset);
 	result = dns_db_findrdataset(db, node, version, dns_rdatatype_ns,
 				     dns_rdatatype_none, 0, &rdataset, NULL);
-	if (result == ISC_R_NOTFOUND) {
-		*nscount = 0;
-		result = ISC_R_SUCCESS;
-		goto invalidate_rdataset;
-	}
+	if (result == ISC_R_NOTFOUND)
+		goto success;
 	if (result != ISC_R_SUCCESS)
 		goto invalidate_rdataset;
 
-	count = 0;
 	result = dns_rdataset_first(&rdataset);
 	while (result == ISC_R_SUCCESS) {
+		if (errors != NULL && zone->rdclass == dns_rdataclass_in &&
+		    (zone->type == dns_zone_master ||
+		     zone->type == dns_zone_slave)) {
+			dns_rdata_init(&rdata);
+			dns_rdataset_current(&rdataset, &rdata);
+			result = dns_rdata_tostruct(&rdata, &ns, NULL);
+			RUNTIME_CHECK(result == ISC_R_SUCCESS);
+			if (dns_name_issubdomain(&ns.name, &zone->origin) &&
+			    !zone_check_ns(zone, db, &ns.name))
+				ecount++;
+		}
 		count++;
 		result = dns_rdataset_next(&rdataset);
 	}
 	dns_rdataset_disassociate(&rdataset);
 
-	*nscount = count;
+ success:
+	if (nscount != NULL)
+		*nscount = count;
+	if (errors != NULL)
+		*errors = ecount;
+
 	result = ISC_R_SUCCESS;
 
  invalidate_rdataset:
@@ -1626,10 +2348,11 @@ zone_load_soa_rr(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
  * zone must be locked.
  */
 static isc_result_t
-zone_get_from_db(dns_db_t *db, dns_name_t *origin, unsigned int *nscount,
+zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,
 		 unsigned int *soacount, isc_uint32_t *serial,
 		 isc_uint32_t *refresh, isc_uint32_t *retry,
-		 isc_uint32_t *expire, isc_uint32_t *minimum)
+		 isc_uint32_t *expire, isc_uint32_t *minimum,
+		 unsigned int *errors)
 {
 	dns_dbversion_t *version;
 	isc_result_t result;
@@ -1637,20 +2360,21 @@ zone_get_from_db(dns_db_t *db, dns_name_t *origin, unsigned int *nscount,
 	dns_dbnode_t *node;
 
 	REQUIRE(db != NULL);
-	REQUIRE(origin != NULL);
+	REQUIRE(zone != NULL);
 
 	version = NULL;
 	dns_db_currentversion(db, &version);
 
 	node = NULL;
-	result = dns_db_findnode(db, origin, ISC_FALSE, &node);
+	result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS) {
 		answer = result;
 		goto closeversion;
 	}
 
-	if (nscount != NULL) {
-		result = zone_count_ns_rr(db, node, version, nscount);
+	if (nscount != NULL || errors != NULL) {
+		result = zone_count_ns_rr(zone, db, node, version,
+					  nscount, errors);
 		if (result != ISC_R_SUCCESS)
 			answer = result;
 	}
@@ -1979,6 +2703,37 @@ dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters,
 	return (result);
 }
 
+static isc_boolean_t
+same_masters(const isc_sockaddr_t *old, const isc_sockaddr_t *new,
+	     isc_uint32_t count)
+{
+	unsigned int i;
+
+	for (i = 0; i < count; i++)
+		if (!isc_sockaddr_equal(&old[i], &new[i]))
+			return (ISC_FALSE);
+	return (ISC_TRUE);
+}
+
+static isc_boolean_t
+same_keynames(dns_name_t **old, dns_name_t **new, isc_uint32_t count) {
+	unsigned int i;
+
+	if (old == NULL && new == NULL)
+		return (ISC_TRUE);
+	if (old == NULL || new == NULL)
+		return (ISC_FALSE);
+
+	for (i = 0; i < count; i++) {
+		if (old[i] == NULL && new[i] == NULL)
+			continue;
+		if (old[i] == NULL || new[i] == NULL ||
+		     !dns_name_equal(old[i], new[i]))
+			return (ISC_FALSE);
+	}
+	return (ISC_TRUE);
+}
+
 isc_result_t
 dns_zone_setmasterswithkeys(dns_zone_t *zone,
 			    const isc_sockaddr_t *masters,
@@ -1998,6 +2753,19 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
 	}
 
 	LOCK_ZONE(zone);
+	/* 
+	 * The refresh code assumes that 'masters' wouldn't change under it.
+	 * If it will change then kill off any current refresh in progress
+	 * and update the masters info.  If it won't change then we can just
+	 * unlock and exit.
+	 */
+	if (count != zone->masterscnt ||
+	    !same_masters(zone->masters, masters, count) ||
+	    !same_keynames(zone->masterkeynames, keynames, count)) {
+		if (zone->request != NULL)
+			dns_request_cancel(zone->request);
+	} else
+		goto unlock;
 	if (zone->masters != NULL) {
 		isc_mem_put(zone->mctx, zone->masters,
 			    zone->masterscnt * sizeof(*new));
@@ -2115,12 +2883,12 @@ dns_zone_getdb(dns_zone_t *zone, dns_db_t **dpb) {
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	LOCK_ZONE(zone);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	if (zone->db == NULL)
 		result = DNS_R_NOTLOADED;
 	else
 		dns_db_attach(zone->db, dpb);
-	UNLOCK_ZONE(zone);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
 
 	return (result);
 }
@@ -2245,8 +3013,9 @@ zone_maintenance(dns_zone_t *zone) {
 	switch (zone->type) {
 	case dns_zone_master:
 	case dns_zone_slave:
-		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY))
-			zone_notify(zone);
+		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY) &&
+		    isc_time_compare(&now, &zone->notifytime) >= 0)
+			zone_notify(zone, &now);
 		break;
 	default:
 		break;
@@ -2498,6 +3267,7 @@ zone_dump(dns_zone_t *zone, isc_boolean_t compact) {
 	isc_boolean_t again;
 	dns_db_t *db = NULL;
 	char *masterfile = NULL;
+	dns_masterformat_t masterformat = dns_masterformat_none;
 
 /*
  * 'compact' MUST only be set if we are task locked.
@@ -2507,11 +3277,15 @@ zone_dump(dns_zone_t *zone, isc_boolean_t compact) {
 	ENTER;
 
  redo:
-	LOCK_ZONE(zone);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	if (zone->db != NULL)
 		dns_db_attach(zone->db, &db);
-	if (zone->masterfile != NULL)
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+	LOCK_ZONE(zone);
+	if (zone->masterfile != NULL) {
 		masterfile = isc_mem_strdup(zone->mctx, zone->masterfile);
+		masterformat = zone->masterformat;
+	}
 	UNLOCK_ZONE(zone);
 	if (db == NULL) {
 		result = DNS_R_NOTLOADED;
@@ -2536,9 +3310,9 @@ zone_dump(dns_zone_t *zone, isc_boolean_t compact) {
 		UNLOCK_ZONE(zone);
 	} else {
 		dns_db_currentversion(db, &version);
-		result = dns_master_dump(zone->mctx, db, version,
-					 &dns_master_style_default,
-					 masterfile);
+		result = dns_master_dump2(zone->mctx, db, version,
+					  &dns_master_style_default,
+					  masterfile, masterformat);
 		dns_db_closeversion(db, &version, ISC_FALSE);
 	}
  fail:
@@ -2576,35 +3350,46 @@ zone_dump(dns_zone_t *zone, isc_boolean_t compact) {
 }
 
 static isc_result_t
-dumptostream(dns_zone_t *zone, FILE *fd, const dns_master_style_t *style) {
+dumptostream(dns_zone_t *zone, FILE *fd, const dns_master_style_t *style,
+	     dns_masterformat_t format)
+{
 	isc_result_t result;
 	dns_dbversion_t *version = NULL;
 	dns_db_t *db = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	LOCK_ZONE(zone);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	if (zone->db != NULL)
 		dns_db_attach(zone->db, &db);
-	UNLOCK_ZONE(zone);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
 	if (db == NULL)
 		return (DNS_R_NOTLOADED);
 
 	dns_db_currentversion(db, &version);
-	result = dns_master_dumptostream(zone->mctx, db, version, style, fd);
+	result = dns_master_dumptostream2(zone->mctx, db, version, style,
+					  format, fd);
 	dns_db_closeversion(db, &version, ISC_FALSE);
 	dns_db_detach(&db);
 	return (result);
 }
 
 isc_result_t
+dns_zone_dumptostream2(dns_zone_t *zone, FILE *fd, dns_masterformat_t format,
+		       const dns_master_style_t *style) {
+	return dumptostream(zone, fd, style, format);
+}
+
+isc_result_t
 dns_zone_dumptostream(dns_zone_t *zone, FILE *fd) {
-	return dumptostream(zone, fd, &dns_master_style_default);
+	return dumptostream(zone, fd, &dns_master_style_default,
+			    dns_masterformat_text);
 }
 
 isc_result_t
 dns_zone_fulldumptostream(dns_zone_t *zone, FILE *fd) {
-	return dumptostream(zone, fd, &dns_master_style_full);
+	return dumptostream(zone, fd, &dns_master_style_full,
+			    dns_masterformat_text);
 }
 
 void
@@ -2645,7 +3430,9 @@ zone_unload(dns_zone_t *zone) {
 
 	REQUIRE(LOCKED_ZONE(zone));
 
-	dns_db_detach(&zone->db);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
+	zone_detachdb(zone);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_LOADED);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDDUMP);
 }
@@ -2700,6 +3487,46 @@ notify_isqueued(dns_zone_t *zone, dns_name_t *name, isc_sockaddr_t *addr) {
 	return (ISC_FALSE);
 }
 
+static isc_boolean_t
+notify_isself(dns_zone_t *zone, isc_sockaddr_t *dst) {
+	dns_tsigkey_t *key = NULL;
+	isc_sockaddr_t src;
+	isc_sockaddr_t any;
+	isc_boolean_t isself;
+	isc_netaddr_t dstaddr;
+
+	if (zone->view == NULL || zone->isself == NULL)
+		return (ISC_FALSE);
+
+	switch (isc_sockaddr_pf(dst)) {
+	case PF_INET:
+		src = zone->notifysrc4;
+		isc_sockaddr_any(&any);
+		break;
+	case PF_INET6:
+		src = zone->notifysrc6;
+		isc_sockaddr_any6(&any);
+		break;
+	default:
+		return (ISC_FALSE);
+	}
+
+	/*
+	 * When sending from any the kernel will assign a source address
+	 * that matches the destination address.
+	 */
+	if (isc_sockaddr_eqaddr(&any, &src))
+		src = *dst;
+
+	isc_netaddr_fromsockaddr(&dstaddr, dst);
+	(void)dns_view_getpeertsig(zone->view, &dstaddr, &key);
+	isself = (zone->isself)(zone->view, key, &src, dst, zone->rdclass,
+				zone->isselfarg);
+	if (key != NULL)
+		dns_tsigkey_detach(&key);
+	return (isself);
+}
+
 static void
 notify_destroy(dns_notify_t *notify, isc_boolean_t locked) {
 	isc_mem_t *mctx;
@@ -2800,7 +3627,7 @@ notify_find_address(dns_notify_t *notify) {
 	result = dns_adb_createfind(notify->zone->view->adb,
 				    notify->zone->task,
 				    process_adb_event, notify,
-				    &notify->ns, dns_rootname,
+				    &notify->ns, dns_rootname, 0,
 				    options, 0, NULL,
 				    notify->zone->view->dstport,
 				    &notify->find);
@@ -2853,6 +3680,7 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	char addrbuf[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_t src;
 	int timeout;
+	isc_boolean_t have_notifysource = ISC_FALSE;
 
 	notify = event->ev_arg;
 	REQUIRE(DNS_NOTIFY_VALID(notify));
@@ -2880,7 +3708,7 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (isc_sockaddr_pf(&notify->dst) == PF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&notify->dst.type.sin6.sin6_addr)) {
-	        isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
+		isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
 		notify_log(notify->zone, ISC_LOG_DEBUG(3),
 			   "notify: ignoring IPv6 mapped IPV4 address: %s",
 			   addrbuf);
@@ -2898,12 +3726,24 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
 	notify_log(notify->zone, ISC_LOG_DEBUG(3), "sending notify to %s",
 		   addrbuf);
+	if (notify->zone->view->peers != NULL) {
+		dns_peer_t *peer = NULL;
+		result = dns_peerlist_peerbyaddr(notify->zone->view->peers,
+						 &dstip, &peer);
+		if (result == ISC_R_SUCCESS) {
+			result = dns_peer_getnotifysource(peer, &src);
+			if (result == ISC_R_SUCCESS)
+				have_notifysource = ISC_TRUE;
+		}
+	}
 	switch (isc_sockaddr_pf(&notify->dst)) {
 	case PF_INET:
-		src = notify->zone->notifysrc4;
+		if (!have_notifysource)
+			src = notify->zone->notifysrc4;
 		break;
 	case PF_INET6:
-		src = notify->zone->notifysrc6;
+		if (!have_notifysource)
+			src = notify->zone->notifysrc6;
 		break;
 	default:
 		result = ISC_R_NOTIMPLEMENTED;
@@ -2947,6 +3787,8 @@ notify_send(dns_notify_t *notify) {
 		dst = ai->sockaddr;
 		if (notify_isqueued(notify->zone, NULL, &dst))
 			continue;
+		if (notify_isself(notify->zone, &dst))
+			continue;
 		new = NULL;
 		result = notify_create(notify->mctx,
 				       (notify->flags & DNS_NOTIFY_NOSOA),
@@ -2982,8 +3824,9 @@ dns_zone_notify(dns_zone_t *zone) {
 }
 
 static void
-zone_notify(dns_zone_t *zone) {
+zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	dns_dbnode_t *node = NULL;
+	dns_db_t *zonedb = NULL;
 	dns_dbversion_t *version = NULL;
 	dns_name_t *origin = NULL;
 	dns_name_t master;
@@ -3001,13 +3844,13 @@ zone_notify(dns_zone_t *zone) {
 	dns_notifytype_t notifytype;
 	unsigned int flags = 0;
 	isc_boolean_t loggednotify = ISC_FALSE;
-	dns_db_t *db = NULL;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	LOCK_ZONE(zone);
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
 	notifytype = zone->notifytype;
+	DNS_ZONE_TIME_ADD(now, zone->notifydelay, &zone->notifytime);
 	UNLOCK_ZONE(zone);
 
 	if (! DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED))
@@ -3016,11 +3859,8 @@ zone_notify(dns_zone_t *zone) {
 	if (notifytype == dns_notifytype_no)
 		return;
 
-	LOCK_ZONE(zone);
-	if (zone->db != NULL)
-		dns_db_attach(zone->db, &db);
-	UNLOCK_ZONE(zone);
-	if (db == NULL)
+	if (notifytype == dns_notifytype_masteronly &&
+	    zone->type != dns_zone_master)
 		return;
 
 	origin = &zone->origin;
@@ -3035,13 +3875,19 @@ zone_notify(dns_zone_t *zone) {
 	/*
 	 * Get SOA RRset.
 	 */
-	dns_db_currentversion(db, &version);
-	result = dns_db_findnode(db, origin, ISC_FALSE, &node);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
+	if (zone->db != NULL)
+		dns_db_attach(zone->db, &zonedb);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+	if (zonedb == NULL)
+		return;
+	dns_db_currentversion(zonedb, &version);
+	result = dns_db_findnode(zonedb, origin, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup1;
 
 	dns_rdataset_init(&soardset);
-	result = dns_db_findrdataset(db, node, version, dns_rdatatype_soa,
+	result = dns_db_findrdataset(zonedb, node, version, dns_rdatatype_soa,
 				     dns_rdatatype_none, 0, &soardset, NULL);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup2;
@@ -3098,7 +3944,7 @@ zone_notify(dns_zone_t *zone) {
 	 */
 
 	dns_rdataset_init(&nsrdset);
-	result = dns_db_findrdataset(db, node, version, dns_rdatatype_ns,
+	result = dns_db_findrdataset(zonedb, node, version, dns_rdatatype_ns,
 				     dns_rdatatype_none, 0, &nsrdset, NULL);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup3;
@@ -3155,10 +4001,10 @@ zone_notify(dns_zone_t *zone) {
 	if (dns_name_dynamic(&master))
 		dns_name_free(&master, zone->mctx);
  cleanup2:
-	dns_db_detachnode(db, &node);
+	dns_db_detachnode(zonedb, &node);
  cleanup1:
-	dns_db_closeversion(db, &version, ISC_FALSE);
-	dns_db_detach(&db);
+	dns_db_closeversion(zonedb, &version, ISC_FALSE);
+	dns_db_detach(&zonedb);
 }
 
 /***
@@ -3406,10 +4252,10 @@ stub_callback(isc_task_t *task, isc_event_t *event) {
 	 * Tidy up.
 	 */
 	dns_db_closeversion(stub->db, &stub->version, ISC_TRUE);
-	LOCK_ZONE(zone);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
 	if (zone->db == NULL)
-		dns_db_attach(stub->db, &zone->db);
-	UNLOCK_ZONE(zone);
+		zone_attachdb(zone, stub->db);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
 	dns_db_detach(&stub->db);
 
 	if (zone->masterfile != NULL) {
@@ -3955,7 +4801,7 @@ create_query(dns_zone_t *zone, dns_rdatatype_t rdtype,
 }
 
 static isc_result_t
-add_opt(dns_message_t *message) {
+add_opt(dns_message_t *message, isc_uint16_t udpsize) {
 	dns_rdataset_t *rdataset = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
 	dns_rdata_t *rdata = NULL;
@@ -3978,7 +4824,7 @@ add_opt(dns_message_t *message) {
 	/*
 	 * Set Maximum UDP buffer size.
 	 */
-	rdatalist->rdclass = SEND_BUFFER_SIZE;
+	rdatalist->rdclass = udpsize;
 
 	/*
 	 * Set EXTENDED-RCODE, VERSION, DO and Z to 0.
@@ -4025,6 +4871,7 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 	isc_boolean_t cancel = ISC_TRUE;
 	int timeout;
 	isc_boolean_t have_xfrsource;
+	isc_uint16_t udpsize = SEND_BUFFER_SIZE;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
@@ -4068,7 +4915,7 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(keyname, namebuf, sizeof(namebuf));
 			dns_zone_log(zone, ISC_LOG_ERROR,
-			             "unable to find key: %s", namebuf);
+				     "unable to find key: %s", namebuf);
 		}
 	}
 	if (key == NULL)
@@ -4088,6 +4935,10 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 							    &zone->sourceaddr);
 			if (result == ISC_R_SUCCESS)
 				have_xfrsource = ISC_TRUE;
+			if (zone->view->resolver != NULL)
+				udpsize =
+				  dns_resolver_getudpsize(zone->view->resolver);
+			(void)dns_peer_getudpsize(peer, &udpsize);
 		}
 	}
 
@@ -4119,7 +4970,7 @@ soa_query(isc_task_t *task, isc_event_t *event) {
 		  DNS_REQUESTOPT_TCP : 0;
 
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
-		result = add_opt(message);
+		result = add_opt(message, udpsize);
 		if (result != ISC_R_SUCCESS)
 			zone_debuglog(zone, me, 1,
 				      "unable to add opt record: %s",
@@ -4184,6 +5035,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	dns_dbnode_t *node = NULL;
 	int timeout;
 	isc_boolean_t have_xfrsource = ISC_FALSE;
+	isc_uint16_t udpsize = SEND_BUFFER_SIZE;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE((soardataset != NULL && stub == NULL) ||
@@ -4213,9 +5065,13 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 		 * new one and attach it to the zone once we have the NS
 		 * RRset and glue.
 		 */
-		if (zone->db != NULL)
+		ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
+		if (zone->db != NULL) {
 			dns_db_attach(zone->db, &stub->db);
-		else {
+			ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+		} else {
+			ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+
 			INSIST(zone->db_argc >= 1);
 			result = dns_db_create(zone->mctx, zone->db_argv[0],
 					       &zone->origin, dns_dbtype_stub,
@@ -4284,7 +5140,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 			char namebuf[DNS_NAME_FORMATSIZE];
 			dns_name_format(keyname, namebuf, sizeof(namebuf));
 			dns_zone_log(zone, ISC_LOG_ERROR,
-			             "unable to find key: %s", namebuf);
+				     "unable to find key: %s", namebuf);
 		}
 	}
 	if (key == NULL)
@@ -4303,11 +5159,15 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 							    &zone->sourceaddr);
 			if (result == ISC_R_SUCCESS)
 				have_xfrsource = ISC_TRUE;
+			if (zone->view->resolver != NULL)
+				udpsize =
+				  dns_resolver_getudpsize(zone->view->resolver);
+			(void)dns_peer_getudpsize(peer, &udpsize);
 		}
 		
 	}
 	if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NOEDNS)) {
-		result = add_opt(message);
+		result = add_opt(message, udpsize);
 		if (result != ISC_R_SUCCESS)
 			zone_debuglog(zone, me, 1,
 				      "unable to add opt record: %s",
@@ -4367,7 +5227,7 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 	if (message != NULL)
 		dns_message_destroy(&message);
   unlock:
-        if (key != NULL)
+	if (key != NULL)
 		dns_tsigkey_detach(&key);
 	UNLOCK_ZONE(zone);
 	return;
@@ -4495,7 +5355,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 	switch (zone->type) {
 	case dns_zone_master:
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY))
-			next = *now;
+			next = zone->notifytime;
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDDUMP) &&
 		    !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING)) {
 			INSIST(!isc_time_isepoch(&zone->dumptime));
@@ -4507,7 +5367,7 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 
 	case dns_zone_slave:
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY))
-			next = *now;
+			next = zone->notifytime;
 		/*FALLTHROUGH*/
 
 	case dns_zone_stub:
@@ -4582,6 +5442,7 @@ static isc_result_t
 notify_createmessage(dns_zone_t *zone, unsigned int flags,
 		     dns_message_t **messagep)
 {
+	dns_db_t *zonedb = NULL;
 	dns_dbnode_t *node = NULL;
 	dns_dbversion_t *version = NULL;
 	dns_message_t *message = NULL;
@@ -4647,15 +5508,20 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 	if (result != ISC_R_SUCCESS)
 		goto soa_cleanup;
 
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
+	INSIST(zone->db != NULL); /* XXXJT: is this assumption correct? */
+	dns_db_attach(zone->db, &zonedb);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
+
 	dns_name_init(tempname, NULL);
 	dns_name_clone(&zone->origin, tempname);
-	dns_db_currentversion(zone->db, &version);
-	result = dns_db_findnode(zone->db, tempname, ISC_FALSE, &node);
+	dns_db_currentversion(zonedb, &version);
+	result = dns_db_findnode(zonedb, tempname, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS)
 		goto soa_cleanup;
 
 	dns_rdataset_init(&rdataset);
-	result = dns_db_findrdataset(zone->db, node, version,
+	result = dns_db_findrdataset(zonedb, node, version,
 				     dns_rdatatype_soa,
 				     dns_rdatatype_none, 0, &rdataset,
 				     NULL);
@@ -4699,9 +5565,11 @@ notify_createmessage(dns_zone_t *zone, unsigned int flags,
 
  soa_cleanup:
 	if (node != NULL)
-		dns_db_detachnode(zone->db, &node);
+		dns_db_detachnode(zonedb, &node);
 	if (version != NULL)
-		dns_db_closeversion(zone->db, &version, ISC_FALSE);
+		dns_db_closeversion(zonedb, &version, ISC_FALSE);
+	if (zonedb != NULL)
+		dns_db_detach(&zonedb);
 	if (tempname != NULL)
 		dns_message_puttempname(message, &tempname);
 	if (temprdata != NULL)
@@ -4744,7 +5612,7 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	 * If type != T_SOA return DNS_R_REFUSED.  We don't yet support
 	 * ROLLOVER.
 	 *
-	 * SOA:	RFC 1996
+	 * SOA:	RFC1996
 	 * Check that 'from' is a valid notify source, (zone->masters).
 	 *	Return DNS_R_REFUSED if not.
 	 *
@@ -5046,6 +5914,19 @@ dns_zone_setupdatedisabled(dns_zone_t *zone, isc_boolean_t state) {
 	zone->update_disabled = state;
 }
 
+isc_boolean_t
+dns_zone_getzeronosoattl(dns_zone_t *zone) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	return (zone->zero_no_soa_ttl);
+
+}
+
+void
+dns_zone_setzeronosoattl(dns_zone_t *zone, isc_boolean_t state) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	zone->zero_no_soa_ttl = state;
+}
+
 void
 dns_zone_setchecknames(dns_zone_t *zone, dns_severity_t severity) {
 
@@ -5244,7 +6125,8 @@ dns_zone_getmaxxfrout(dns_zone_t *zone) {
 	return (zone->maxxfrout);
 }
 
-dns_zonetype_t dns_zone_gettype(dns_zone_t *zone) {
+dns_zonetype_t
+dns_zone_gettype(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	return (zone->type);
@@ -5265,8 +6147,10 @@ dns_zone_settask(dns_zone_t *zone, isc_task_t *task) {
 	if (zone->task != NULL)
 		isc_task_detach(&zone->task);
 	isc_task_attach(task, &zone->task);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
 	if (zone->db != NULL)
 		dns_db_settask(zone->db, zone->task);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
 	UNLOCK_ZONE(zone);
 }
 
@@ -5371,7 +6255,9 @@ dns_zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	LOCK_ZONE(zone);
+	ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
 	result = zone_replacedb(zone, db, dump);
+	ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
 	UNLOCK_ZONE(zone);
 	return (result);
 }
@@ -5384,13 +6270,13 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
 	unsigned int nscount = 0;
 
 	/*
-	 * 'zone' locked by caller.
+	 * 'zone' and 'zonedb' locked by caller.
 	 */
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(LOCKED_ZONE(zone));
 
-	result = zone_get_from_db(db, &zone->origin, &nscount, &soacount,
-				  NULL, NULL, NULL, NULL, NULL);
+	result = zone_get_from_db(zone, db, &nscount, &soacount,
+				  NULL, NULL, NULL, NULL, NULL, NULL);
 	if (result == ISC_R_SUCCESS) {
 		if (soacount != 1) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
@@ -5478,7 +6364,8 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_ZONE, ISC_LOG_DEBUG(3),
 				      "dumping new zone version");
-			result = dns_db_dump(db, ver, zone->masterfile);
+			result = dns_db_dump2(db, ver, zone->masterfile,
+					      zone->masterformat);
 			if (result != ISC_R_SUCCESS)
 				goto fail;
 
@@ -5518,8 +6405,8 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
 		      "replacing zone database");
 
 	if (zone->db != NULL)
-		dns_db_detach(&zone->db);
-	dns_db_attach(db, &zone->db);
+		zone_detachdb(zone);
+	zone_attachdb(zone, db);
 	dns_db_settask(zone->db, zone->task);
 	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED|DNS_ZONEFLG_NEEDNOTIFY);
 	return (ISC_R_SUCCESS);
@@ -5529,6 +6416,33 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
 	return (result);
 }
 
+/* The caller must hold the dblock as a writer. */
+static inline void
+zone_attachdb(dns_zone_t *zone, dns_db_t *db) {
+	REQUIRE(zone->db == NULL && db != NULL);
+
+	dns_db_attach(db, &zone->db);
+	if (zone->acache != NULL) {
+		isc_result_t result;
+		result = dns_acache_setdb(zone->acache, db);
+		if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "dns_acache_setdb() failed: %s",
+					 isc_result_totext(result));
+		}
+	}
+}
+
+/* The caller must hold the dblock as a writer. */
+static inline void
+zone_detachdb(dns_zone_t *zone) {
+	REQUIRE(zone->db != NULL);
+
+	if (zone->acache != NULL)
+		(void)dns_acache_putdb(zone->acache, zone->db);
+	dns_db_detach(&zone->db);
+}
+
 static void
 zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 	isc_time_t now;
@@ -5559,8 +6473,11 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 		/*
 		 * Has the zone expired underneath us?
 		 */
-		if (zone->db == NULL)
+		ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
+		if (zone->db == NULL) {
+			ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
 			goto same_master;
+		}
 
 		/*
 		 * Update the zone structure's data from the actual
@@ -5569,9 +6486,10 @@ zone_xfrdone(dns_zone_t *zone, isc_result_t result) {
 		nscount = 0;
 		soacount = 0;
 		INSIST(zone->db != NULL);
-		result = zone_get_from_db(zone->db, &zone->origin, &nscount,
+		result = zone_get_from_db(zone, zone->db, &nscount,
 					  &soacount, &serial, &refresh,
-					  &retry, &expire, &minimum);
+					  &retry, &expire, &minimum, NULL);
+		ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
 		if (result == ISC_R_SUCCESS) {
 			if (soacount != 1)
 				dns_zone_log(zone, ISC_LOG_ERROR,
@@ -6217,13 +7135,9 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	ISC_LIST_INIT(zmgr->waiting_for_xfrin);
 	ISC_LIST_INIT(zmgr->xfrin_in_progress);
 	result = isc_rwlock_init(&zmgr->rwlock, 0, 0);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_rwlock_init() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto free_mem;
-	}
+
 	zmgr->transfersin = 10;
 	zmgr->transfersperns = 2;
 
@@ -6254,12 +7168,9 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	ISC_LIST_INIT(zmgr->low);
 
 	result = isc_mutex_init(&zmgr->iolock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() failed: %s",
-				 isc_result_totext(result));
+	if (result != ISC_R_SUCCESS)
 		goto free_rl;
-	}
+
 	zmgr->magic = ZONEMGR_MAGIC;
 
 	*zmgrp = zmgr;
@@ -6955,6 +7866,7 @@ dns_zone_getkeydirectory(dns_zone_t *zone) {
 
 	return (zone->keydirectory);
 }
+
 unsigned int
 dns_zonemgr_getcount(dns_zonemgr_t *zmgr, int state) {
 	dns_zone_t *zone;
@@ -7046,3 +7958,47 @@ dns_zone_checknames(dns_zone_t *zone, dns_name_t *name, dns_rdata_t *rdata) {
 
 	return (ISC_R_SUCCESS);
 }
+
+void
+dns_zone_setcheckmx(dns_zone_t *zone, dns_checkmxfunc_t checkmx) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	zone->checkmx = checkmx;
+}
+
+void
+dns_zone_setchecksrv(dns_zone_t *zone, dns_checksrvfunc_t checksrv) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	zone->checksrv = checksrv;
+}
+
+void
+dns_zone_setcheckns(dns_zone_t *zone, dns_checknsfunc_t checkns) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	zone->checkns = checkns;
+}
+
+void
+dns_zone_setisself(dns_zone_t *zone, dns_isselffunc_t isself, void *arg) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	LOCK_ZONE(zone);
+	zone->isself = isself;
+	zone->isselfarg = arg;
+	UNLOCK_ZONE(zone);
+}
+
+void
+dns_zone_setnotifydelay(dns_zone_t *zone, isc_uint32_t delay) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	LOCK_ZONE(zone);
+	zone->notifydelay = delay;
+	UNLOCK_ZONE(zone);
+}
+
+isc_uint32_t
+dns_zone_getnotifydelay(dns_zone_t *zone) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+
+	return (zone->notifydelay);
+}
diff --git a/contrib/bind9/lib/dns/zonekey.c b/contrib/bind9/lib/dns/zonekey.c
index dc7ae0f..0ed63bb 100644
--- a/contrib/bind9/lib/dns/zonekey.c
+++ b/contrib/bind9/lib/dns/zonekey.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zonekey.c,v 1.3.206.3 2004/03/08 09:04:33 marka Exp $ */
+/* $Id: zonekey.c,v 1.5.18.2 2005/04/29 00:16:08 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/dns/zt.c b/contrib/bind9/lib/dns/zt.c
index 7aa6a9f..4cb8f3f 100644
--- a/contrib/bind9/lib/dns/zt.c
+++ b/contrib/bind9/lib/dns/zt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,16 +15,24 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zt.c,v 1.33.12.6 2004/03/08 21:06:28 marka Exp $ */
+/* $Id: zt.c,v 1.38.18.5 2005/11/30 03:44:39 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
+#include <isc/file.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
+#include <isc/string.h>
 #include <isc/util.h>
 
+#include <dns/log.h>
+#include <dns/name.h>
 #include <dns/rbt.h>
+#include <dns/rdataclass.h>
 #include <dns/result.h>
+#include <dns/view.h>
 #include <dns/zone.h>
 #include <dns/zt.h>
 
@@ -51,6 +59,9 @@ load(dns_zone_t *zone, void *uap);
 static isc_result_t
 loadnew(dns_zone_t *zone, void *uap);
 
+static isc_result_t
+freezezones(dns_zone_t *zone, void *uap);
+
 isc_result_t
 dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **ztp) {
 	dns_zt_t *zt;
@@ -68,13 +79,8 @@ dns_zt_create(isc_mem_t *mctx, dns_rdataclass_t rdclass, dns_zt_t **ztp) {
 		goto cleanup_zt;
 
 	result = isc_rwlock_init(&zt->rwlock, 0, 0);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_rwlock_init() failed: %s",
-				 isc_result_totext(result));
-		result = ISC_R_UNEXPECTED;
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_rbt;
-	}
 
 	zt->mctx = mctx;
 	zt->references = 1;
@@ -266,12 +272,90 @@ loadnew(dns_zone_t *zone, void *uap) {
 }
 
 isc_result_t
+dns_zt_freezezones(dns_zt_t *zt, isc_boolean_t freeze) {
+	isc_result_t result, tresult;
+
+	REQUIRE(VALID_ZT(zt));
+
+	RWLOCK(&zt->rwlock, isc_rwlocktype_read);
+	result = dns_zt_apply2(zt, ISC_FALSE, &tresult, freezezones, &freeze);
+	RWUNLOCK(&zt->rwlock, isc_rwlocktype_read);
+	return ((result == ISC_R_SUCCESS) ? tresult : result);
+}
+
+static isc_result_t
+freezezones(dns_zone_t *zone, void *uap) {
+	isc_boolean_t freeze = *(isc_boolean_t *)uap;
+	isc_boolean_t frozen;
+	isc_result_t result = ISC_R_SUCCESS;
+	char classstr[DNS_RDATACLASS_FORMATSIZE];
+	char zonename[DNS_NAME_FORMATSIZE];
+	dns_view_t *view;
+	char *journal;
+	const char *vname;
+	const char *sep;
+	int level;
+
+	if (dns_zone_gettype(zone) != dns_zone_master)
+		return (ISC_R_SUCCESS);
+
+	frozen = dns_zone_getupdatedisabled(zone);
+	if (freeze) {
+		if (frozen)
+			result = DNS_R_FROZEN;
+		if (result == ISC_R_SUCCESS)
+			result = dns_zone_flush(zone);
+		if (result == ISC_R_SUCCESS) {
+			journal = dns_zone_getjournal(zone);
+			if (journal != NULL)
+				(void)isc_file_remove(journal);
+		}
+	} else {
+		if (frozen) {
+			result = dns_zone_load(zone);
+			if (result == DNS_R_CONTINUE ||
+			    result == DNS_R_UPTODATE)
+				result = ISC_R_SUCCESS;
+		}
+	}
+	if (result == ISC_R_SUCCESS)
+		dns_zone_setupdatedisabled(zone, freeze);
+	view = dns_zone_getview(zone);
+	if (strcmp(view->name, "_bind") == 0 ||
+	    strcmp(view->name, "_default") == 0)
+	{
+		vname = "";
+		sep = "";
+	} else {
+		vname = view->name;
+		sep = " ";
+	}
+	dns_rdataclass_format(dns_zone_getclass(zone), classstr,
+			      sizeof(classstr));
+	dns_name_format(dns_zone_getorigin(zone), zonename, sizeof(zonename));
+	level = (result != ISC_R_SUCCESS) ? ISC_LOG_ERROR : ISC_LOG_DEBUG(1);
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_ZONE,
+		      level, "%s zone '%s/%s'%s%s: %s",
+		      freeze ? "freezing" : "thawing",
+		      zonename, classstr, sep, vname,
+		      isc_result_totext(result));
+	return (result);
+}
+
+isc_result_t
 dns_zt_apply(dns_zt_t *zt, isc_boolean_t stop,
 	     isc_result_t (*action)(dns_zone_t *, void *), void *uap)
 {
+	return (dns_zt_apply2(zt, stop, NULL, action, uap));
+}
+
+isc_result_t
+dns_zt_apply2(dns_zt_t *zt, isc_boolean_t stop, isc_result_t *sub,
+	      isc_result_t (*action)(dns_zone_t *, void *), void *uap)
+{
 	dns_rbtnode_t *node;
 	dns_rbtnodechain_t chain;
-	isc_result_t result;
+	isc_result_t result, tresult = ISC_R_SUCCESS;
 	dns_zone_t *zone;
 
 	REQUIRE(VALID_ZT(zt));
@@ -292,8 +376,12 @@ dns_zt_apply(dns_zt_t *zt, isc_boolean_t stop,
 			zone = node->data;
 			if (zone != NULL)
 				result = (action)(zone, uap);
-			if (result != ISC_R_SUCCESS && stop)
+			if (result != ISC_R_SUCCESS && stop) {
+				tresult = result;
 				goto cleanup;	/* don't break */
+			} else if (result != ISC_R_SUCCESS &&
+				   tresult == ISC_R_SUCCESS)
+				tresult = result;
 		}
 		result = dns_rbtnodechain_next(&chain, NULL, NULL);
 	}
@@ -302,6 +390,8 @@ dns_zt_apply(dns_zt_t *zt, isc_boolean_t stop,
 
  cleanup:
 	dns_rbtnodechain_invalidate(&chain);
+	if (sub != NULL)
+		*sub = tresult;
 
 	return (result);
 }
diff --git a/contrib/bind9/lib/isc/Makefile.in b/contrib/bind9/lib/isc/Makefile.in
index 7e53510..c03a3df 100644
--- a/contrib/bind9/lib/isc/Makefile.in
+++ b/contrib/bind9/lib/isc/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.71.2.2.2.8 2004/07/20 07:01:58 marka Exp $
+# $Id: Makefile.in,v 1.81.18.6 2006/01/27 23:57:45 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -25,6 +25,7 @@ top_srcdir =	@top_srcdir@
 
 CINCLUDES =	-I${srcdir}/unix/include \
 		-I${srcdir}/@ISC_THREAD_DIR@/include \
+		-I${srcdir}/@ISC_ARCH_DIR@/include \
 		-I./include \
 		-I${srcdir}/include
 CDEFINES =
@@ -52,25 +53,25 @@ WIN32OBJS = 	win32/condition.@O@ win32/dir.@O@ win32/file.@O@ \
 OBJS =		@ISC_EXTRA_OBJS@ \
 		assertions.@O@ base64.@O@ bitstring.@O@ buffer.@O@ \
 		bufferlist.@O@ commandline.@O@ error.@O@ event.@O@ \
-		hash.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ \
+		hash.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ hmacsha.@O@\
 		lex.@O@ lfsr.@O@ lib.@O@ log.@O@ md5.@O@ \
 		mem.@O@ mutexblock.@O@ netaddr.@O@ netscope.@O@ ondestroy.@O@ \
 		parseint.@O@ quota.@O@ random.@O@ \
-		ratelimiter.@O@ region.@O@ result.@O@ rwlock.@O@ \
-		serial.@O@ sha1.@O@ sockaddr.@O@ string.@O@ strtoul.@O@ \
-		symtab.@O@ task.@O@ taskpool.@O@ timer.@O@ version.@O@ \
-		${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
+		ratelimiter.@O@ refcount.@O@ region.@O@ result.@O@ rwlock.@O@ \
+		serial.@O@ sha1.@O@ sha2.@O@ sockaddr.@O@ string.@O@ \
+	        strtoul.@O@ symtab.@O@ task.@O@ taskpool.@O@ timer.@O@ \
+	        version.@O@ ${UNIXOBJS} ${NLSOBJS} ${THREADOBJS}
 
 # Alphabetically
 SRCS =		@ISC_EXTRA_SRCS@ \
 		assertions.c base64.c bitstring.c buffer.c \
 		bufferlist.c commandline.c error.c event.c \
-		heap.c hex.c hmacmd5.c \
+		heap.c hex.c hmacmd5.c hmacsha.c \
 		lex.c lfsr.c lib.c log.c \
 		md5.c mem.c mutexblock.c netaddr.c netscope.c ondestroy.c \
 		parseint.c quota.c random.c \
-		ratelimiter.c result.c rwlock.c \
-		serial.c sha1.c sockaddr.c string.c strtoul.c symtab.c \
+		ratelimiter.c refcount.c region.c result.c rwlock.c \
+		serial.c sha1.c sha2.c sockaddr.c string.c strtoul.c symtab.c \
 		task.c taskpool.c timer.c version.c
 
 LIBS =		@LIBS@
diff --git a/contrib/bind9/lib/isc/alpha/include/isc/atomic.h b/contrib/bind9/lib/isc/alpha/include/isc/atomic.h
new file mode 100644
index 0000000..a4b9b15
--- /dev/null
+++ b/contrib/bind9/lib/isc/alpha/include/isc/atomic.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.2.2.2 2005/06/16 22:01:01 jinmei Exp $ */
+
+/*
+ * This code was written based on FreeBSD's kernel source whose copyright
+ * follows:
+ */
+
+/*-
+ * Copyright (c) 1998 Doug Rabson
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+#include <isc/platform.h>
+#include <isc/types.h>
+
+#ifdef ISC_PLATFORM_USEOSFASM
+#include <c_asm.h>
+
+#pragma intrinsic(asm)
+
+/*
+ * This routine atomically increments the value stored in 'p' by 'val', and
+ * returns the previous value.
+ */
+static inline isc_int32_t 
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	return (asm("1:"
+		    "ldl_l %t0, 0(%a0);"	/* load old value */
+		    "mov %t0, %v0;"		/* copy the old value */
+		    "addl %t0, %a1, %t0;"	/* calculate new value */
+		    "stl_c %t0, 0(%a0);"	/* attempt to store */
+		    "beq %t0, 1b;",		/* spin if failed */
+		    p, val));
+}
+
+/*
+ * This routine atomically stores the value 'val' in 'p'.
+ */
+static inline void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	(void)asm("1:"
+		  "ldl_l %t0, 0(%a0);"		/* load old value */
+		  "mov %a1, %t0;"		/* value to store */
+		  "stl_c %t0, 0(%a0);"		/* attempt to store */
+		  "beq %t0, 1b;",		/* spin if failed */
+		  p, val);
+}
+
+/*
+ * This routine atomically replaces the value in 'p' with 'val', if the
+ * original value is equal to 'cmpval'.  The original value is returned in any
+ * case.
+ */
+static inline isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+
+	return(asm("1:"
+		   "ldl_l %t0, 0(%a0);"		/* load old value */
+		   "mov %t0, %v0;"		/* copy the old value */
+		   "cmpeq %t0, %a1, %t0;"	/* compare */
+		   "beq %t0, 2f;"		/* exit if not equal */
+		   "mov %a2, %t0;"		/* value to store */
+		   "stl_c %t0, 0(%a0);"		/* attempt to store */
+		   "beq %t0, 1b;"		/* if it failed, spin */
+		   "2:",
+		   p, cmpval, val));
+}
+#elif defined (ISC_PLATFORM_USEGCCASM)
+static inline isc_int32_t 
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	isc_int32_t temp, prev;
+
+	__asm__ volatile(
+		"1:"
+		"ldl_l %0, %1;"			/* load old value */
+		"mov %0, %2;"			/* copy the old value */
+		"addl %0, %3, %0;"		/* calculate new value */
+		"stl_c %0, %1;"			/* attempt to store */
+		"beq %0, 1b;"			/* spin if failed */
+		: "=&r"(temp), "+m"(*p), "=r"(prev)
+		: "r"(val)
+		: "memory");
+
+	return (prev);
+}
+
+static inline void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	isc_int32_t temp;
+
+	__asm__ volatile(
+		"1:"
+		"ldl_l %0, %1;"			/* load old value */
+		"mov %2, %0;"			/* value to store */
+		"stl_c %0, %1;"			/* attempt to store */
+		"beq %0, 1b;"			/* if it failed, spin */
+		: "=&r"(temp), "+m"(*p)
+		: "r"(val)
+		: "memory");
+}
+
+static inline isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+	isc_int32_t temp, prev;
+
+	__asm__ volatile(
+		"1:"
+		"ldl_l %0, %1;"			/* load old value */
+		"mov %0, %2;"			/* copy the old value */
+		"cmpeq %0, %3, %0;"		/* compare */
+		"beq %0, 2f;"			/* exit if not equal */
+		"mov %4, %0;"			/* value to store */
+		"stl_c %0, %1;"			/* attempt to store */
+		"beq %0, 1b;"			/* if it failed, spin */
+		"2:"
+		: "=&r"(temp), "+m"(*p), "=r"(prev)
+		: "r"(cmpval), "r"(val)
+		: "memory");
+
+	return (prev);
+}
+#else
+
+#error "unsupported compiler.  disable atomic ops by --disable-atomic"
+
+#endif
+
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isc/api b/contrib/bind9/lib/isc/api
index b4d0173..759a051 100644
--- a/contrib/bind9/lib/isc/api
+++ b/contrib/bind9/lib/isc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 12
-LIBREVISION = 1
-LIBAGE = 1
+LIBINTERFACE = 32
+LIBREVISION = 3
+LIBAGE = 0
diff --git a/contrib/bind9/lib/isc/assertions.c b/contrib/bind9/lib/isc/assertions.c
index 94c6732..b3fcf4a 100644
--- a/contrib/bind9/lib/isc/assertions.c
+++ b/contrib/bind9/lib/isc/assertions.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: assertions.c,v 1.16.206.1 2004/03/06 08:14:27 marka Exp $ */
+/* $Id: assertions.c,v 1.17.18.2 2005/04/29 00:16:44 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -25,20 +27,20 @@
 #include <isc/assertions.h>
 #include <isc/msgs.h>
 
-/*
+/*%
  * Forward.
  */
-
 static void
 default_callback(const char *, int, isc_assertiontype_t, const char *);
 
-/*
+/*%
  * Public.
  */
 
 LIBISC_EXTERNAL_DATA isc_assertioncallback_t isc_assertion_failed =
 					     default_callback;
 
+/*% Set callback. */
 void
 isc_assertion_setcallback(isc_assertioncallback_t cb) {
 	if (cb == NULL)
@@ -47,6 +49,7 @@ isc_assertion_setcallback(isc_assertioncallback_t cb) {
 		isc_assertion_failed = cb;
 }
 
+/*% Type to Text */
 const char *
 isc_assertion_typetotext(isc_assertiontype_t type) {
 	const char *result;
diff --git a/contrib/bind9/lib/isc/base64.c b/contrib/bind9/lib/isc/base64.c
index 445f8f5..faeae92 100644
--- a/contrib/bind9/lib/isc/base64.c
+++ b/contrib/bind9/lib/isc/base64.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: base64.c,v 1.23.2.2.2.3 2004/03/06 08:14:27 marka Exp $ */
+/* $Id: base64.c,v 1.28.18.2 2005/04/29 00:16:44 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -32,7 +34,8 @@
 	} while (0)
 
 
-/*
+/*@{*/
+/*!
  * These static functions are also present in lib/dns/rdata.c.  I'm not
  * sure where they should go. -- bwelling
  */
@@ -44,6 +47,7 @@ mem_tobuffer(isc_buffer_t *target, void *base, unsigned int length);
 
 static const char base64[] =
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
+/*@}*/
 
 isc_result_t
 isc_base64_totext(isc_region_t *source, int wordlength,
@@ -90,14 +94,14 @@ isc_base64_totext(isc_region_t *source, int wordlength,
 	return (ISC_R_SUCCESS);
 }
 
-/*
+/*%
  * State of a base64 decoding process in progress.
  */
 typedef struct {
-	int length;		/* Desired length of binary data or -1 */
-	isc_buffer_t *target;	/* Buffer for resulting binary data */
-	int digits;		/* Number of buffered base64 digits */
-	isc_boolean_t seen_end;	/* True if "=" end marker seen */
+	int length;		/*%< Desired length of binary data or -1 */
+	isc_buffer_t *target;	/*%< Buffer for resulting binary data */
+	int digits;		/*%< Number of buffered base64 digits */
+	isc_boolean_t seen_end;	/*%< True if "=" end marker seen */
 	int val[4];
 } base64_decode_ctx_t;
 
diff --git a/contrib/bind9/lib/isc/bitstring.c b/contrib/bind9/lib/isc/bitstring.c
index e77ed39..105b5aa 100644
--- a/contrib/bind9/lib/isc/bitstring.c
+++ b/contrib/bind9/lib/isc/bitstring.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: bitstring.c,v 1.12.206.1 2004/03/06 08:14:27 marka Exp $ */
+/* $Id: bitstring.c,v 1.13.18.2 2005/04/29 00:16:44 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/buffer.c b/contrib/bind9/lib/isc/buffer.c
index 30ce529..fc07c00 100644
--- a/contrib/bind9/lib/isc/buffer.c
+++ b/contrib/bind9/lib/isc/buffer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: buffer.c,v 1.36.12.2 2004/03/08 09:04:48 marka Exp $ */
+/* $Id: buffer.c,v 1.40.18.2 2005/04/29 00:16:44 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/bufferlist.c b/contrib/bind9/lib/isc/bufferlist.c
index 6d64a3f..773d075 100644
--- a/contrib/bind9/lib/isc/bufferlist.c
+++ b/contrib/bind9/lib/isc/bufferlist.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: bufferlist.c,v 1.12.206.1 2004/03/06 08:14:28 marka Exp $ */
+/* $Id: bufferlist.c,v 1.13.18.2 2005/04/29 00:16:45 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/commandline.c b/contrib/bind9/lib/isc/commandline.c
index 4c8af7f..679ed6d 100644
--- a/contrib/bind9/lib/isc/commandline.c
+++ b/contrib/bind9/lib/isc/commandline.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -48,9 +48,9 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: commandline.c,v 1.15.206.1 2004/03/06 08:14:28 marka Exp $ */
+/* $Id: commandline.c,v 1.16.18.2 2005/04/29 00:16:45 marka Exp $ */
 
-/*
+/*! \file
  * This file was adapted from the NetBSD project's source tree, RCS ID:
  *    NetBSD: getopt.c,v 1.15 1999/09/20 04:39:37 lukem Exp
  *
@@ -59,8 +59,8 @@
  */
 
 /*
- * Principal Authors: Computer Systems Research Group at UC Berkeley
- * Principal ISC caretaker: DCL
+ * \author Principal Authors: Computer Systems Research Group at UC Berkeley
+ * \author Principal ISC caretaker: DCL
  */
 
 #include <config.h>
@@ -72,17 +72,17 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-/* Index into parent argv vector. */
+/*% Index into parent argv vector. */
 LIBISC_EXTERNAL_DATA int isc_commandline_index = 1;
-/* Character checked for validity. */
+/*% Character checked for validity. */
 LIBISC_EXTERNAL_DATA int isc_commandline_option;
-/* Argument associated with option. */
+/*% Argument associated with option. */
 LIBISC_EXTERNAL_DATA char *isc_commandline_argument;
-/* For printing error messages. */
+/*% For printing error messages. */
 LIBISC_EXTERNAL_DATA char *isc_commandline_progname;
-/* Print error messages. */
+/*% Print error messages. */
 LIBISC_EXTERNAL_DATA isc_boolean_t isc_commandline_errprint = ISC_TRUE;
-/* Reset processing. */
+/*% Reset processing. */
 LIBISC_EXTERNAL_DATA isc_boolean_t isc_commandline_reset = ISC_TRUE;
 
 static char endopt = '\0';
@@ -91,7 +91,7 @@ static char endopt = '\0';
 #define	BADARG	':'
 #define ENDOPT  &endopt
 
-/*
+/*!
  * getopt --
  *	Parse argc/argv argument vector.
  */
diff --git a/contrib/bind9/lib/isc/entropy.c b/contrib/bind9/lib/isc/entropy.c
index 8834eef..3e87d87 100644
--- a/contrib/bind9/lib/isc/entropy.c
+++ b/contrib/bind9/lib/isc/entropy.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,16 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: entropy.c,v 1.3.2.2.2.7 2004/03/08 09:04:48 marka Exp $ */
+/* $Id: entropy.c,v 1.11.18.3 2005/07/12 01:22:28 marka Exp $ */
 
-/*
+/*! \file
+ * \brief
  * This is the system independent part of the entropy module.  It is
  * compiled via inclusion from the relevant OS source file, ie,
- * unix/entropy.c or win32/entropy.c.
+ * \link unix/entropy.c unix/entropy.c \endlink or win32/entropy.c.
+ *
+ * \author Much of this code is modeled after the NetBSD /dev/random implementation,
+ * written by Michael Graff <explorer@netbsd.org>.
  */
 
 #include <errno.h>
@@ -42,10 +46,6 @@
 #include <isc/time.h>
 #include <isc/util.h>
 
-/*
- * Much of this code is modeled after the NetBSD /dev/random implementation,
- * written by Michael Graff <explorer@netbsd.org>.
- */
 
 #define ENTROPY_MAGIC		ISC_MAGIC('E', 'n', 't', 'e')
 #define SOURCE_MAGIC		ISC_MAGIC('E', 'n', 't', 's')
@@ -58,26 +58,28 @@
  *** you are doing.
  ***/
 
-/*
- * size of entropy pool in 32-bit words.  This _MUST_ be a power of 2.
+/*%
+ * Size of entropy pool in 32-bit words.  This _MUST_ be a power of 2.
  */
 #define RND_POOLWORDS	128
+/*% Pool in bytes. */
 #define RND_POOLBYTES	(RND_POOLWORDS * 4)
+/*% Pool in bits. */
 #define RND_POOLBITS	(RND_POOLWORDS * 32)
 
-/*
+/*%
  * Number of bytes returned per hash.  This must be true:
  *	threshold * 2 <= digest_size_in_bytes
  */
 #define RND_ENTROPY_THRESHOLD	10
 #define THRESHOLD_BITS		(RND_ENTROPY_THRESHOLD * 8)
 
-/*
+/*%
  * Size of the input event queue in samples.
  */
 #define RND_EVENTQSIZE	32
 
-/*
+/*%
  * The number of times we'll "reseed" for pseudorandom seeds.  This is an
  * extremely weak pseudorandom seed.  If the caller is using lots of
  * pseudorandom data and they cannot provide a stronger random source,
@@ -86,12 +88,13 @@
  */
 #define RND_INITIALIZE	128
 
+/*% Entropy Pool */
 typedef struct {
-	isc_uint32_t	cursor;		/* current add point in the pool */
-	isc_uint32_t	entropy;	/* current entropy estimate in bits */
-	isc_uint32_t	pseudo;		/* bits extracted in pseudorandom */
-	isc_uint32_t	rotate;		/* how many bits to rotate by */
-	isc_uint32_t	pool[RND_POOLWORDS];	/* random pool data */
+	isc_uint32_t	cursor;		/*%< current add point in the pool */
+	isc_uint32_t	entropy;	/*%< current entropy estimate in bits */
+	isc_uint32_t	pseudo;		/*%< bits extracted in pseudorandom */
+	isc_uint32_t	rotate;		/*%< how many bits to rotate by */
+	isc_uint32_t	pool[RND_POOLWORDS];	/*%< random pool data */
 } isc_entropypool_t;
 
 struct isc_entropy {
@@ -107,13 +110,14 @@ struct isc_entropy {
 	ISC_LIST(isc_entropysource_t)	sources;
 };
 
+/*% Sample Queue */
 typedef struct {
-	isc_uint32_t	last_time;	/* last time recorded */
-	isc_uint32_t	last_delta;	/* last delta value */
-	isc_uint32_t	last_delta2;	/* last delta2 value */
-	isc_uint32_t	nsamples;	/* number of samples filled in */
-	isc_uint32_t   *samples;	/* the samples */
-	isc_uint32_t   *extra;		/* extra samples added in */
+	isc_uint32_t	last_time;	/*%< last time recorded */
+	isc_uint32_t	last_delta;	/*%< last delta value */
+	isc_uint32_t	last_delta2;	/*%< last delta2 value */
+	isc_uint32_t	nsamples;	/*%< number of samples filled in */
+	isc_uint32_t   *samples;	/*%< the samples */
+	isc_uint32_t   *extra;		/*%< extra samples added in */
 } sample_queue_t;
 
 typedef struct {
@@ -137,7 +141,7 @@ struct isc_entropysource {
 	unsigned int	magic;
 	unsigned int	type;
 	isc_entropy_t  *ent;
-	isc_uint32_t	total;		/* entropy from this source */
+	isc_uint32_t	total;		/*%< entropy from this source */
 	ISC_LINK(isc_entropysource_t)	link;
 	char		name[32];
 	isc_boolean_t	bad;
@@ -151,12 +155,13 @@ struct isc_entropysource {
 	} sources;
 };
 
-#define ENTROPY_SOURCETYPE_SAMPLE	1	/* Type is a sample source */
-#define ENTROPY_SOURCETYPE_FILE		2	/* Type is a file source */
-#define ENTROPY_SOURCETYPE_CALLBACK	3	/* Type is a callback source */
-#define ENTROPY_SOURCETYPE_USOCKET	4	/* Type is a Unix socket source */
+#define ENTROPY_SOURCETYPE_SAMPLE	1	/*%< Type is a sample source */
+#define ENTROPY_SOURCETYPE_FILE		2	/*%< Type is a file source */
+#define ENTROPY_SOURCETYPE_CALLBACK	3	/*%< Type is a callback source */
+#define ENTROPY_SOURCETYPE_USOCKET	4	/*%< Type is a Unix socket source */
 
-/*
+/*@{*/
+/*%
  * The random pool "taps"
  */
 #define TAP1	99
@@ -164,8 +169,10 @@ struct isc_entropysource {
 #define TAP3	31
 #define TAP4	 9
 #define TAP5	 7
+/*@}*/
 
-/*
+/*@{*/
+/*%
  * Declarations for function provided by the system dependent sources that
  * include this file.
  */
@@ -181,6 +188,7 @@ destroyfilesource(isc_entropyfilesource_t *source);
 static void
 destroyusocketsource(isc_entropyusocketsource_t *source);
 
+/*@}*/
 
 static void
 samplequeue_release(isc_entropy_t *ent, sample_queue_t *sq) {
@@ -211,7 +219,7 @@ samplesource_allocate(isc_entropy_t *ent, sample_queue_t *sq) {
 	return (ISC_R_SUCCESS);
 }
 
-/*
+/*%
  * Add in entropy, even when the value we're adding in could be
  * very large.
  */
@@ -225,7 +233,7 @@ add_entropy(isc_entropy_t *ent, isc_uint32_t entropy) {
 	ent->pool.entropy = ISC_MIN(entropy, RND_POOLBITS);
 }
 
-/*
+/*%
  * Decrement the amount of entropy the pool has.
  */
 static inline void
@@ -234,7 +242,7 @@ subtract_entropy(isc_entropy_t *ent, isc_uint32_t entropy) {
 	ent->pool.entropy -= entropy;
 }
 
-/*
+/*!
  * Add in entropy, even when the value we're adding in could be
  * very large.
  */
@@ -248,7 +256,7 @@ add_pseudo(isc_entropy_t *ent, isc_uint32_t pseudo) {
 	ent->pool.pseudo = ISC_MIN(pseudo, RND_POOLBITS * 8);
 }
 
-/*
+/*!
  * Decrement the amount of pseudo the pool has.
  */
 static inline void
@@ -257,7 +265,7 @@ subtract_pseudo(isc_entropy_t *ent, isc_uint32_t pseudo) {
 	ent->pool.pseudo -= pseudo;
 }
 
-/*
+/*!
  * Add one word to the pool, rotating the input as needed.
  */
 static inline void
@@ -292,7 +300,7 @@ entropypool_add_word(isc_entropypool_t *rp, isc_uint32_t val) {
 	}
 }
 
-/*
+/*!
  * Add a buffer's worth of data to the pool.
  *
  * Requires that the lock is held on the entropy pool.
@@ -362,7 +370,7 @@ reseed(isc_entropy_t *ent) {
 		entropypool_adddata(ent, &pid, sizeof(pid), 0);
 	}
 
-	/*
+	/*!
 	 * After we've reseeded 100 times, only add new timing info every
 	 * 50 requests.  This will keep us from using lots and lots of
 	 * CPU just to return bad pseudorandom data anyway.
@@ -382,7 +390,7 @@ estimate_entropy(sample_queue_t *sq, isc_uint32_t t) {
 	isc_int32_t		delta2;
 	isc_int32_t		delta3;
 
-	/*
+	/*!
 	 * If the time counter has overflowed, calculate the real difference.
 	 * If it has not, it is simpler.
 	 */
@@ -661,7 +669,7 @@ isc_entropypool_invalidate(isc_entropypool_t *pool) {
 
 isc_result_t
 isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) {
-	isc_result_t ret;
+	isc_result_t result;
 	isc_entropy_t *ent;
 
 	REQUIRE(mctx != NULL);
@@ -674,10 +682,9 @@ isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) {
 	/*
 	 * We need a lock.
 	 */
-	if (isc_mutex_init(&ent->lock) != ISC_R_SUCCESS) {
-		ret = ISC_R_UNEXPECTED;
+	result = isc_mutex_init(&ent->lock);
+	if (result != ISC_R_SUCCESS)
 		goto errout;
-	}
 
 	/*
 	 * From here down, no failures will/can occur.
@@ -700,10 +707,10 @@ isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp) {
  errout:
 	isc_mem_put(mctx, ent, sizeof(isc_entropy_t));
 
-	return (ret);
+	return (result);
 }
 
-/*
+/*!
  * Requires "ent" be locked.
  */
 static void
@@ -851,7 +858,7 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
 				 void *arg,
 				 isc_entropysource_t **sourcep)
 {
-	isc_result_t ret;
+	isc_result_t result;
 	isc_entropysource_t *source;
 	isc_cbsource_t *cbs;
 
@@ -863,15 +870,15 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
 
 	source = isc_mem_get(ent->mctx, sizeof(isc_entropysource_t));
 	if (source == NULL) {
-		ret = ISC_R_NOMEMORY;
+		result = ISC_R_NOMEMORY;
 		goto errout;
 	}
 	source->bad = ISC_FALSE;
 
 	cbs = &source->sources.callback;
 
-	ret = samplesource_allocate(ent, &cbs->samplequeue);
-	if (ret != ISC_R_SUCCESS)
+	result = samplesource_allocate(ent, &cbs->samplequeue);
+	if (result != ISC_R_SUCCESS)
 		goto errout;
 
 	cbs->start_called = ISC_FALSE;
@@ -907,7 +914,7 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
 
 	UNLOCK(&ent->lock);
 
-	return (ret);
+	return (result);
 }
 
 void
@@ -939,7 +946,7 @@ isc_result_t
 isc_entropy_createsamplesource(isc_entropy_t *ent,
 			       isc_entropysource_t **sourcep)
 {
-	isc_result_t ret;
+	isc_result_t result;
 	isc_entropysource_t *source;
 	sample_queue_t *sq;
 
@@ -950,13 +957,13 @@ isc_entropy_createsamplesource(isc_entropy_t *ent,
 
 	source = isc_mem_get(ent->mctx, sizeof(isc_entropysource_t));
 	if (source == NULL) {
-		ret = ISC_R_NOMEMORY;
+		result = ISC_R_NOMEMORY;
 		goto errout;
 	}
 
 	sq = &source->sources.sample.samplequeue;
-	ret = samplesource_allocate(ent, sq);
-	if (ret != ISC_R_SUCCESS)
+	result = samplesource_allocate(ent, sq);
+	if (result != ISC_R_SUCCESS)
 		goto errout;
 
 	/*
@@ -986,10 +993,10 @@ isc_entropy_createsamplesource(isc_entropy_t *ent,
 
 	UNLOCK(&ent->lock);
 
-	return (ret);
+	return (result);
 }
 
-/*
+/*!
  * Add a sample, and return ISC_R_SUCCESS if the queue has become full,
  * ISC_R_NOENTROPY if it has space remaining, and ISC_R_NOMORE if the
  * queue was full when this function was called.
diff --git a/contrib/bind9/lib/isc/error.c b/contrib/bind9/lib/isc/error.c
index ceb7d2a..282986c 100644
--- a/contrib/bind9/lib/isc/error.c
+++ b/contrib/bind9/lib/isc/error.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: error.c,v 1.16.206.1 2004/03/06 08:14:28 marka Exp $ */
+/* $Id: error.c,v 1.17.18.2 2005/04/29 00:16:45 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -25,14 +27,17 @@
 #include <isc/error.h>
 #include <isc/msgs.h>
 
+/*% Default unexpected callback. */
 static void
 default_unexpected_callback(const char *, int, const char *, va_list)
      ISC_FORMAT_PRINTF(3, 0);
 
+/*% Default fatal callback. */
 static void
 default_fatal_callback(const char *, int, const char *, va_list)
      ISC_FORMAT_PRINTF(3, 0);
 
+/*% unexpected_callback */
 static isc_errorcallback_t unexpected_callback = default_unexpected_callback;
 static isc_errorcallback_t fatal_callback = default_fatal_callback;
 
diff --git a/contrib/bind9/lib/isc/event.c b/contrib/bind9/lib/isc/event.c
index f767870..7931061 100644
--- a/contrib/bind9/lib/isc/event.c
+++ b/contrib/bind9/lib/isc/event.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: event.c,v 1.15.12.3 2004/03/08 09:04:48 marka Exp $ */
+/* $Id: event.c,v 1.17.18.2 2005/04/29 00:16:45 marka Exp $ */
 
-/*
- * Principal Author: Bob Halley
+/*!
+ * \file
+ * \author Principal Author: Bob Halley
  */
 
 #include <config.h>
diff --git a/contrib/bind9/lib/isc/fsaccess.c b/contrib/bind9/lib/isc/fsaccess.c
index 1193472..cdab3d8 100644
--- a/contrib/bind9/lib/isc/fsaccess.c
+++ b/contrib/bind9/lib/isc/fsaccess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,16 +15,17 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: fsaccess.c,v 1.5.206.1 2004/03/06 08:14:29 marka Exp $ */
+/* $Id: fsaccess.c,v 1.6.18.2 2005/04/29 00:16:45 marka Exp $ */
 
-/*
+/*! \file
+ * \brief
  * This file contains the OS-independent functionality of the API.
  */
 #include <isc/fsaccess.h>
 #include <isc/result.h>
 #include <isc/util.h>
 
-/*
+/*!
  * Shorthand.  Maybe ISC__FSACCESS_PERMISSIONBITS should not even be in
  * <isc/fsaccess.h>.  Could check consistency with sizeof(isc_fsaccess_t)
  * and the number of bits in each function.
diff --git a/contrib/bind9/lib/isc/hash.c b/contrib/bind9/lib/isc/hash.c
index 1094206..4b6dc06 100644
--- a/contrib/bind9/lib/isc/hash.c
+++ b/contrib/bind9/lib/isc/hash.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,14 +15,12 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: hash.c,v 1.2.2.4.2.3 2006/01/04 00:37:22 marka Exp $ */
+/* $Id: hash.c,v 1.6.18.5 2006/01/04 00:37:23 marka Exp $ */
 
-/*
+/*! \file
  * Some portion of this code was derived from universal hash function
  * libraries of Rice University. 
- */
-
-/*  "UH Universal Hashing Library"
+\section license UH Universal Hashing Library
 
 Copyright ((c)) 2002, Rice University
 All rights reserved.
@@ -74,28 +72,31 @@ if advised of the possibility of such damage.
 #define HASH_MAGIC		ISC_MAGIC('H', 'a', 's', 'h')
 #define VALID_HASH(h)		ISC_MAGIC_VALID((h), HASH_MAGIC)
 
-/*
+/*%
  * A large 32-bit prime number that specifies the range of the hash output.
  */
 #define PRIME32 0xFFFFFFFB              /* 2^32 -  5 */
 
-/*
+/*@{*/
+/*%
  * Types of random seed and hash accumulator.  Perhaps they can be system
  * dependent.
  */
 typedef isc_uint32_t hash_accum_t;
 typedef isc_uint16_t hash_random_t;
+/*@}*/
 
+/*% isc hash structure */
 struct isc_hash {
 	unsigned int	magic;
 	isc_mem_t	*mctx;
 	isc_mutex_t	lock;
 	isc_boolean_t	initialized;
 	isc_refcount_t	refcnt;
-	isc_entropy_t	*entropy; /* entropy source */
-	unsigned int	limit;	/* upper limit of key length */
-	size_t		vectorlen; /* size of the vector below */
-	hash_random_t	*rndvector; /* random vector for universal hashing */
+	isc_entropy_t	*entropy; /*%< entropy source */
+	unsigned int	limit;	/*%< upper limit of key length */
+	size_t		vectorlen; /*%< size of the vector below */
+	hash_random_t	*rndvector; /*%< random vector for universal hashing */
 };
 
 static isc_mutex_t createlock;
@@ -141,7 +142,7 @@ isc_result_t
 isc_hash_ctxcreate(isc_mem_t *mctx, isc_entropy_t *entropy,
 		   unsigned int limit, isc_hash_t **hctxp)
 {
-	isc_result_t ret;
+	isc_result_t result;
 	isc_hash_t *hctx;
 	size_t vlen;
 	hash_random_t *rv;
@@ -167,17 +168,16 @@ isc_hash_ctxcreate(isc_mem_t *mctx, isc_entropy_t *entropy,
 	vlen = sizeof(hash_random_t) * (limit + 1);
 	rv = isc_mem_get(mctx, vlen);
 	if (rv == NULL) {
-		ret = ISC_R_NOMEMORY;
+		result = ISC_R_NOMEMORY;
 		goto errout;
 	}
 
 	/*
 	 * We need a lock.
 	 */
-	if (isc_mutex_init(&hctx->lock) != ISC_R_SUCCESS) {
-		ret = ISC_R_UNEXPECTED;
+	result = isc_mutex_init(&hctx->lock);
+	if (result != ISC_R_SUCCESS)
 		goto errout;
-	}
 
 	/*
 	 * From here down, no failures will/can occur.
@@ -186,7 +186,9 @@ isc_hash_ctxcreate(isc_mem_t *mctx, isc_entropy_t *entropy,
 	hctx->mctx = NULL;
 	isc_mem_attach(mctx, &hctx->mctx);
 	hctx->initialized = ISC_FALSE;
-	isc_refcount_init(&hctx->refcnt, 1);
+	result = isc_refcount_init(&hctx->refcnt, 1);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup_lock;
 	hctx->entropy = NULL;
 	hctx->limit = limit;
 	hctx->vectorlen = vlen;
@@ -198,12 +200,14 @@ isc_hash_ctxcreate(isc_mem_t *mctx, isc_entropy_t *entropy,
 	*hctxp = hctx;
 	return (ISC_R_SUCCESS);
 
+ cleanup_lock:
+	DESTROYLOCK(&hctx->lock);
  errout:
 	isc_mem_put(mctx, hctx, sizeof(isc_hash_t));
 	if (rv != NULL)
 		isc_mem_put(mctx, rv, vlen);
 
-	return (ret);
+	return (result);
 }
 
 static void
diff --git a/contrib/bind9/lib/isc/heap.c b/contrib/bind9/lib/isc/heap.c
index fd67d7b..9c495a7 100644
--- a/contrib/bind9/lib/isc/heap.c
+++ b/contrib/bind9/lib/isc/heap.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: heap.c,v 1.28.12.4 2006/04/17 18:27:20 explorer Exp $ */
+/* $Id: heap.c,v 1.30.18.3 2006/04/17 18:27:33 explorer Exp $ */
 
 /*! \file
  * Heap implementation of priority queues adapted from the following:
diff --git a/contrib/bind9/lib/isc/hex.c b/contrib/bind9/lib/isc/hex.c
index a90f1ce..8dfec02 100644
--- a/contrib/bind9/lib/isc/hex.c
+++ b/contrib/bind9/lib/isc/hex.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: hex.c,v 1.8.2.2.8.3 2004/03/06 08:14:30 marka Exp $ */
+/* $Id: hex.c,v 1.14.18.2 2005/04/29 00:16:46 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -73,13 +75,13 @@ isc_hex_totext(isc_region_t *source, int wordlength,
 	return (ISC_R_SUCCESS);
 }
 
-/*
+/*%
  * State of a hex decoding process in progress.
  */
 typedef struct {
-	int length;		/* Desired length of binary data or -1 */
-	isc_buffer_t *target;	/* Buffer for resulting binary data */
-	int digits;		/* Number of buffered hex digits */
+	int length;		/*%< Desired length of binary data or -1 */
+	isc_buffer_t *target;	/*%< Buffer for resulting binary data */
+	int digits;		/*%< Number of buffered hex digits */
 	int val[2];
 } hex_decode_ctx_t;
 
diff --git a/contrib/bind9/lib/isc/hmacmd5.c b/contrib/bind9/lib/isc/hmacmd5.c
index 5166a98..f832146 100644
--- a/contrib/bind9/lib/isc/hmacmd5.c
+++ b/contrib/bind9/lib/isc/hmacmd5.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: hmacmd5.c,v 1.5.12.5 2006/02/26 23:49:48 marka Exp $ */
+/* $Id: hmacmd5.c,v 1.7.18.5 2006/02/26 22:30:56 marka Exp $ */
 
-/*
+/*! \file
  * This code implements the HMAC-MD5 keyed hash algorithm
- * described in RFC 2104.
+ * described in RFC2104.
  */
 
 #include "config.h"
@@ -35,7 +35,7 @@
 #define IPAD 0x36
 #define OPAD 0x5C
 
-/*
+/*!
  * Start HMAC-MD5 process.  Initialize an md5 context and digest the key.
  */
 void
@@ -67,7 +67,7 @@ isc_hmacmd5_invalidate(isc_hmacmd5_t *ctx) {
 	memset(ctx->key, 0, sizeof(ctx->key));
 }
 
-/*
+/*!
  * Update context to reflect the concatenation of another buffer full
  * of bytes.
  */
@@ -78,7 +78,7 @@ isc_hmacmd5_update(isc_hmacmd5_t *ctx, const unsigned char *buf,
 	isc_md5_update(&ctx->md5ctx, buf, len);
 }
 
-/*
+/*!
  * Compute signature - finalize MD5 operation and reapply MD5.
  */
 void
@@ -99,14 +99,20 @@ isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest) {
 	isc_hmacmd5_invalidate(ctx);
 }
 
-/*
+/*!
  * Verify signature - finalize MD5 operation and reapply MD5, then
  * compare to the supplied digest.
  */
 isc_boolean_t
 isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest) {
+	return (isc_hmacmd5_verify2(ctx, digest, ISC_MD5_DIGESTLENGTH));
+}
+
+isc_boolean_t
+isc_hmacmd5_verify2(isc_hmacmd5_t *ctx, unsigned char *digest, size_t len) {
 	unsigned char newdigest[ISC_MD5_DIGESTLENGTH];
 
+	REQUIRE(len <= ISC_MD5_DIGESTLENGTH);
 	isc_hmacmd5_sign(ctx, newdigest);
-	return (ISC_TF(memcmp(digest, newdigest, ISC_MD5_DIGESTLENGTH) == 0));
+	return (ISC_TF(memcmp(digest, newdigest, len) == 0));
 }
diff --git a/contrib/bind9/lib/isc/hmacsha.c b/contrib/bind9/lib/isc/hmacsha.c
new file mode 100644
index 0000000..8ee16af
--- /dev/null
+++ b/contrib/bind9/lib/isc/hmacsha.c
@@ -0,0 +1,438 @@
+/*
+ * Copyright (C) 2005, 2006  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: hmacsha.c,v 1.2.2.4 2006/08/16 03:18:14 marka Exp $ */
+
+/*
+ * This code implements the HMAC-SHA1, HMAC-SHA224, HMAC-SHA256, HMAC-SHA384
+ * and HMAC-SHA512 keyed hash algorithm described in RFC 2104 and
+ * draft-ietf-dnsext-tsig-sha-01.txt.
+ */
+
+#include "config.h"
+
+#include <isc/assertions.h>
+#include <isc/hmacsha.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
+#include <isc/string.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#define IPAD 0x36
+#define OPAD 0x5C
+
+/*
+ * Start HMAC-SHA1 process.  Initialize an sha1 context and digest the key.
+ */
+void
+isc_hmacsha1_init(isc_hmacsha1_t *ctx, const unsigned char *key,
+		  unsigned int len)
+{
+	unsigned char ipad[ISC_SHA1_BLOCK_LENGTH];
+	unsigned int i;
+
+	memset(ctx->key, 0, sizeof(ctx->key));
+	if (len > sizeof(ctx->key)) {
+		isc_sha1_t sha1ctx;
+		isc_sha1_init(&sha1ctx);
+		isc_sha1_update(&sha1ctx, key, len);
+		isc_sha1_final(&sha1ctx, ctx->key);
+	} else
+		memcpy(ctx->key, key, len);
+
+	isc_sha1_init(&ctx->sha1ctx);
+	memset(ipad, IPAD, sizeof(ipad));
+	for (i = 0; i < ISC_SHA1_BLOCK_LENGTH; i++)
+		ipad[i] ^= ctx->key[i];
+	isc_sha1_update(&ctx->sha1ctx, ipad, sizeof(ipad));
+}
+
+void
+isc_hmacsha1_invalidate(isc_hmacsha1_t *ctx) {
+	isc_sha1_invalidate(&ctx->sha1ctx);
+	memset(ctx->key, 0, sizeof(ctx->key));
+	memset(ctx, 0, sizeof(ctx));
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void
+isc_hmacsha1_update(isc_hmacsha1_t *ctx, const unsigned char *buf,
+		   unsigned int len)
+{
+	isc_sha1_update(&ctx->sha1ctx, buf, len);
+}
+
+/*
+ * Compute signature - finalize SHA1 operation and reapply SHA1.
+ */
+void
+isc_hmacsha1_sign(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char opad[ISC_SHA1_BLOCK_LENGTH];
+	unsigned char newdigest[ISC_SHA1_DIGESTLENGTH];
+	unsigned int i;
+
+	REQUIRE(len <= ISC_SHA1_DIGESTLENGTH);
+	isc_sha1_final(&ctx->sha1ctx, newdigest);
+
+	memset(opad, OPAD, sizeof(opad));
+	for (i = 0; i < ISC_SHA1_BLOCK_LENGTH; i++)
+		opad[i] ^= ctx->key[i];
+
+	isc_sha1_init(&ctx->sha1ctx);
+	isc_sha1_update(&ctx->sha1ctx, opad, sizeof(opad));
+	isc_sha1_update(&ctx->sha1ctx, newdigest, ISC_SHA1_DIGESTLENGTH);
+	isc_sha1_final(&ctx->sha1ctx, newdigest);
+	isc_hmacsha1_invalidate(ctx);
+	memcpy(digest, newdigest, len);
+	memset(newdigest, 0, sizeof(newdigest));
+}
+
+/*
+ * Verify signature - finalize SHA1 operation and reapply SHA1, then
+ * compare to the supplied digest.
+ */
+isc_boolean_t
+isc_hmacsha1_verify(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char newdigest[ISC_SHA1_DIGESTLENGTH];
+
+	REQUIRE(len <= ISC_SHA1_BLOCK_LENGTH);
+	isc_hmacsha1_sign(ctx, newdigest, ISC_SHA1_DIGESTLENGTH);
+	return (ISC_TF(memcmp(digest, newdigest, len) == 0));
+}
+
+/*
+ * Start HMAC-SHA224 process.  Initialize an sha224 context and digest the key.
+ */
+void
+isc_hmacsha224_init(isc_hmacsha224_t *ctx, const unsigned char *key,
+		    unsigned int len)
+{
+	unsigned char ipad[ISC_SHA224_BLOCK_LENGTH];
+	unsigned int i;
+
+	memset(ctx->key, 0, sizeof(ctx->key));
+	if (len > sizeof(ctx->key)) {
+		isc_sha224_t sha224ctx;
+		isc_sha224_init(&sha224ctx);
+		isc_sha224_update(&sha224ctx, key, len);
+		isc_sha224_final(ctx->key, &sha224ctx);
+	} else
+		memcpy(ctx->key, key, len);
+
+	isc_sha224_init(&ctx->sha224ctx);
+	memset(ipad, IPAD, sizeof(ipad));
+	for (i = 0; i < ISC_SHA224_BLOCK_LENGTH; i++)
+		ipad[i] ^= ctx->key[i];
+	isc_sha224_update(&ctx->sha224ctx, ipad, sizeof(ipad));
+}
+
+void
+isc_hmacsha224_invalidate(isc_hmacsha224_t *ctx) {
+	memset(ctx->key, 0, sizeof(ctx->key));
+	memset(ctx, 0, sizeof(ctx));
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void
+isc_hmacsha224_update(isc_hmacsha224_t *ctx, const unsigned char *buf,
+		   unsigned int len)
+{
+	isc_sha224_update(&ctx->sha224ctx, buf, len);
+}
+
+/*
+ * Compute signature - finalize SHA224 operation and reapply SHA224.
+ */
+void
+isc_hmacsha224_sign(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char opad[ISC_SHA224_BLOCK_LENGTH];
+	unsigned char newdigest[ISC_SHA224_DIGESTLENGTH];
+	unsigned int i;
+
+	REQUIRE(len <= ISC_SHA224_DIGESTLENGTH);
+	isc_sha224_final(newdigest, &ctx->sha224ctx);
+
+	memset(opad, OPAD, sizeof(opad));
+	for (i = 0; i < ISC_SHA224_BLOCK_LENGTH; i++)
+		opad[i] ^= ctx->key[i];
+
+	isc_sha224_init(&ctx->sha224ctx);
+	isc_sha224_update(&ctx->sha224ctx, opad, sizeof(opad));
+	isc_sha224_update(&ctx->sha224ctx, newdigest, ISC_SHA224_DIGESTLENGTH);
+	isc_sha224_final(newdigest, &ctx->sha224ctx);
+	memcpy(digest, newdigest, len);
+	memset(newdigest, 0, sizeof(newdigest));
+}
+
+/*
+ * Verify signature - finalize SHA224 operation and reapply SHA224, then
+ * compare to the supplied digest.
+ */
+isc_boolean_t
+isc_hmacsha224_verify(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char newdigest[ISC_SHA224_DIGESTLENGTH];
+
+	REQUIRE(len <= ISC_SHA224_DIGESTLENGTH);
+	isc_hmacsha224_sign(ctx, newdigest, ISC_SHA224_DIGESTLENGTH);
+	return (ISC_TF(memcmp(digest, newdigest, len) == 0));
+}
+
+/*
+ * Start HMAC-SHA256 process.  Initialize an sha256 context and digest the key.
+ */
+void
+isc_hmacsha256_init(isc_hmacsha256_t *ctx, const unsigned char *key,
+		    unsigned int len)
+{
+	unsigned char ipad[ISC_SHA256_BLOCK_LENGTH];
+	unsigned int i;
+
+	memset(ctx->key, 0, sizeof(ctx->key));
+	if (len > sizeof(ctx->key)) {
+		isc_sha256_t sha256ctx;
+		isc_sha256_init(&sha256ctx);
+		isc_sha256_update(&sha256ctx, key, len);
+		isc_sha256_final(ctx->key, &sha256ctx);
+	} else
+		memcpy(ctx->key, key, len);
+
+	isc_sha256_init(&ctx->sha256ctx);
+	memset(ipad, IPAD, sizeof(ipad));
+	for (i = 0; i < ISC_SHA256_BLOCK_LENGTH; i++)
+		ipad[i] ^= ctx->key[i];
+	isc_sha256_update(&ctx->sha256ctx, ipad, sizeof(ipad));
+}
+
+void
+isc_hmacsha256_invalidate(isc_hmacsha256_t *ctx) {
+	memset(ctx->key, 0, sizeof(ctx->key));
+	memset(ctx, 0, sizeof(ctx));
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void
+isc_hmacsha256_update(isc_hmacsha256_t *ctx, const unsigned char *buf,
+		   unsigned int len)
+{
+	isc_sha256_update(&ctx->sha256ctx, buf, len);
+}
+
+/*
+ * Compute signature - finalize SHA256 operation and reapply SHA256.
+ */
+void
+isc_hmacsha256_sign(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char opad[ISC_SHA256_BLOCK_LENGTH];
+	unsigned char newdigest[ISC_SHA256_DIGESTLENGTH];
+	unsigned int i;
+
+	REQUIRE(len <= ISC_SHA256_DIGESTLENGTH);
+	isc_sha256_final(newdigest, &ctx->sha256ctx);
+
+	memset(opad, OPAD, sizeof(opad));
+	for (i = 0; i < ISC_SHA256_BLOCK_LENGTH; i++)
+		opad[i] ^= ctx->key[i];
+
+	isc_sha256_init(&ctx->sha256ctx);
+	isc_sha256_update(&ctx->sha256ctx, opad, sizeof(opad));
+	isc_sha256_update(&ctx->sha256ctx, newdigest, ISC_SHA256_DIGESTLENGTH);
+	isc_sha256_final(newdigest, &ctx->sha256ctx);
+	memcpy(digest, newdigest, len);
+	memset(newdigest, 0, sizeof(newdigest));
+}
+
+/*
+ * Verify signature - finalize SHA256 operation and reapply SHA256, then
+ * compare to the supplied digest.
+ */
+isc_boolean_t
+isc_hmacsha256_verify(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char newdigest[ISC_SHA256_DIGESTLENGTH];
+
+	REQUIRE(len <= ISC_SHA256_DIGESTLENGTH);
+	isc_hmacsha256_sign(ctx, newdigest, ISC_SHA256_DIGESTLENGTH);
+	return (ISC_TF(memcmp(digest, newdigest, len) == 0));
+}
+
+/*
+ * Start HMAC-SHA384 process.  Initialize an sha384 context and digest the key.
+ */
+void
+isc_hmacsha384_init(isc_hmacsha384_t *ctx, const unsigned char *key,
+		    unsigned int len)
+{
+	unsigned char ipad[ISC_SHA384_BLOCK_LENGTH];
+	unsigned int i;
+
+	memset(ctx->key, 0, sizeof(ctx->key));
+	if (len > sizeof(ctx->key)) {
+		isc_sha384_t sha384ctx;
+		isc_sha384_init(&sha384ctx);
+		isc_sha384_update(&sha384ctx, key, len);
+		isc_sha384_final(ctx->key, &sha384ctx);
+	} else
+		memcpy(ctx->key, key, len);
+
+	isc_sha384_init(&ctx->sha384ctx);
+	memset(ipad, IPAD, sizeof(ipad));
+	for (i = 0; i < ISC_SHA384_BLOCK_LENGTH; i++)
+		ipad[i] ^= ctx->key[i];
+	isc_sha384_update(&ctx->sha384ctx, ipad, sizeof(ipad));
+}
+
+void
+isc_hmacsha384_invalidate(isc_hmacsha384_t *ctx) {
+	memset(ctx->key, 0, sizeof(ctx->key));
+	memset(ctx, 0, sizeof(ctx));
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void
+isc_hmacsha384_update(isc_hmacsha384_t *ctx, const unsigned char *buf,
+		   unsigned int len)
+{
+	isc_sha384_update(&ctx->sha384ctx, buf, len);
+}
+
+/*
+ * Compute signature - finalize SHA384 operation and reapply SHA384.
+ */
+void
+isc_hmacsha384_sign(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char opad[ISC_SHA384_BLOCK_LENGTH];
+	unsigned char newdigest[ISC_SHA384_DIGESTLENGTH];
+	unsigned int i;
+
+	REQUIRE(len <= ISC_SHA384_DIGESTLENGTH);
+	isc_sha384_final(newdigest, &ctx->sha384ctx);
+
+	memset(opad, OPAD, sizeof(opad));
+	for (i = 0; i < ISC_SHA384_BLOCK_LENGTH; i++)
+		opad[i] ^= ctx->key[i];
+
+	isc_sha384_init(&ctx->sha384ctx);
+	isc_sha384_update(&ctx->sha384ctx, opad, sizeof(opad));
+	isc_sha384_update(&ctx->sha384ctx, newdigest, ISC_SHA384_DIGESTLENGTH);
+	isc_sha384_final(newdigest, &ctx->sha384ctx);
+	memcpy(digest, newdigest, len);
+	memset(newdigest, 0, sizeof(newdigest));
+}
+
+/*
+ * Verify signature - finalize SHA384 operation and reapply SHA384, then
+ * compare to the supplied digest.
+ */
+isc_boolean_t
+isc_hmacsha384_verify(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char newdigest[ISC_SHA384_DIGESTLENGTH];
+
+	REQUIRE(len <= ISC_SHA384_DIGESTLENGTH);
+	isc_hmacsha384_sign(ctx, newdigest, ISC_SHA384_DIGESTLENGTH);
+	return (ISC_TF(memcmp(digest, newdigest, len) == 0));
+}
+
+/*
+ * Start HMAC-SHA512 process.  Initialize an sha512 context and digest the key.
+ */
+void
+isc_hmacsha512_init(isc_hmacsha512_t *ctx, const unsigned char *key,
+		    unsigned int len)
+{
+	unsigned char ipad[ISC_SHA512_BLOCK_LENGTH];
+	unsigned int i;
+
+	memset(ctx->key, 0, sizeof(ctx->key));
+	if (len > sizeof(ctx->key)) {
+		isc_sha512_t sha512ctx;
+		isc_sha512_init(&sha512ctx);
+		isc_sha512_update(&sha512ctx, key, len);
+		isc_sha512_final(ctx->key, &sha512ctx);
+	} else
+		memcpy(ctx->key, key, len);
+
+	isc_sha512_init(&ctx->sha512ctx);
+	memset(ipad, IPAD, sizeof(ipad));
+	for (i = 0; i < ISC_SHA512_BLOCK_LENGTH; i++)
+		ipad[i] ^= ctx->key[i];
+	isc_sha512_update(&ctx->sha512ctx, ipad, sizeof(ipad));
+}
+
+void
+isc_hmacsha512_invalidate(isc_hmacsha512_t *ctx) {
+	memset(ctx->key, 0, sizeof(ctx->key));
+	memset(ctx, 0, sizeof(ctx));
+}
+
+/*
+ * Update context to reflect the concatenation of another buffer full
+ * of bytes.
+ */
+void
+isc_hmacsha512_update(isc_hmacsha512_t *ctx, const unsigned char *buf,
+		   unsigned int len)
+{
+	isc_sha512_update(&ctx->sha512ctx, buf, len);
+}
+
+/*
+ * Compute signature - finalize SHA512 operation and reapply SHA512.
+ */
+void
+isc_hmacsha512_sign(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char opad[ISC_SHA512_BLOCK_LENGTH];
+	unsigned char newdigest[ISC_SHA512_DIGESTLENGTH];
+	unsigned int i;
+
+	REQUIRE(len <= ISC_SHA512_DIGESTLENGTH);
+	isc_sha512_final(newdigest, &ctx->sha512ctx);
+
+	memset(opad, OPAD, sizeof(opad));
+	for (i = 0; i < ISC_SHA512_BLOCK_LENGTH; i++)
+		opad[i] ^= ctx->key[i];
+
+	isc_sha512_init(&ctx->sha512ctx);
+	isc_sha512_update(&ctx->sha512ctx, opad, sizeof(opad));
+	isc_sha512_update(&ctx->sha512ctx, newdigest, ISC_SHA512_DIGESTLENGTH);
+	isc_sha512_final(newdigest, &ctx->sha512ctx);
+	memcpy(digest, newdigest, len);
+	memset(newdigest, 0, sizeof(newdigest));
+}
+
+/*
+ * Verify signature - finalize SHA512 operation and reapply SHA512, then
+ * compare to the supplied digest.
+ */
+isc_boolean_t
+isc_hmacsha512_verify(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len) {
+	unsigned char newdigest[ISC_SHA512_DIGESTLENGTH];
+
+	REQUIRE(len <= ISC_SHA512_DIGESTLENGTH);
+	isc_hmacsha512_sign(ctx, newdigest, ISC_SHA512_DIGESTLENGTH);
+	return (ISC_TF(memcmp(digest, newdigest, len) == 0));
+}
diff --git a/contrib/bind9/lib/isc/ia64/include/isc/atomic.h b/contrib/bind9/lib/isc/ia64/include/isc/atomic.h
new file mode 100644
index 0000000..20cbabd
--- /dev/null
+++ b/contrib/bind9/lib/isc/ia64/include/isc/atomic.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2006  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.2.2.1 2006/06/21 03:38:32 marka Exp $ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+#include <isc/platform.h>
+#include <isc/types.h>
+
+#ifdef ISC_PLATFORM_USEGCCASM
+/*
+ * This routine atomically increments the value stored in 'p' by 'val', and
+ * returns the previous value.
+ *
+ * Open issue: can 'fetchadd' make the code faster for some particular values
+ * (e.g., 1 and -1)?
+ */
+static inline isc_int32_t
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	isc_int32_t prev, swapped;
+
+	for (prev = *(volatile isc_int32_t *)p; ; prev = swapped) {
+		swapped = prev + val;
+		__asm__ volatile(
+			"mov ar.ccv=%2;"
+			"cmpxchg4.acq %0=%4,%3,ar.ccv"
+			: "=r" (swapped), "=m" (*p)
+			: "r" (prev), "r" (swapped), "m" (*p)
+			: "memory");
+		if (swapped == prev)
+			break;
+	}
+
+	return (prev);
+}
+
+/*
+ * This routine atomically stores the value 'val' in 'p'.
+ */
+static inline void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	__asm__ volatile(
+		"st4.rel %0=%1"
+		: "=m" (*p)
+		: "r" (val)
+		: "memory"
+		);
+}
+
+/*
+ * This routine atomically replaces the value in 'p' with 'val', if the
+ * original value is equal to 'cmpval'.  The original value is returned in any
+ * case.
+ */
+static inline isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+	isc_int32_t ret;
+
+	__asm__ volatile(
+		"mov ar.ccv=%2;"
+		"cmpxchg4.acq %0=%4,%3,ar.ccv"
+		: "=r" (ret), "=m" (*p)
+		: "r" (cmpval), "r" (val), "m" (*p)
+		: "memory");
+
+	return (ret);
+}
+#else /* !ISC_PLATFORM_USEGCCASM */
+
+#error "unsupported compiler.  disable atomic ops by --disable-atomic"
+
+#endif
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isc/include/Makefile.in b/contrib/bind9/lib/isc/include/Makefile.in
index 59d66c7..ceb8eb6 100644
--- a/contrib/bind9/lib/isc/include/Makefile.in
+++ b/contrib/bind9/lib/isc/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.10.206.1 2004/03/06 08:14:38 marka Exp $
+# $Id: Makefile.in,v 1.11 2004/03/05 05:10:53 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/include/isc/Makefile.in b/contrib/bind9/lib/isc/include/isc/Makefile.in
index f484c0b..0f0e936 100644
--- a/contrib/bind9/lib/isc/include/isc/Makefile.in
+++ b/contrib/bind9/lib/isc/include/isc/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 1998-2001, 2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.50.12.6 2005/03/22 02:32:07 marka Exp $
+# $Id: Makefile.in,v 1.54.18.4 2006/01/27 23:57:45 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -35,9 +35,9 @@ HEADERS =	app.h assertions.h base64.h bitstring.h boolean.h buffer.h \
 		mutexblock.h netaddr.h ondestroy.h os.h parseint.h \
 		print.h quota.h random.h ratelimiter.h \
 		refcount.h region.h resource.h \
-		result.h resultclass.h rwlock.h serial.h sha1.h sockaddr.h \
-		socket.h stdio.h stdlib.h string.h symtab.h task.h taskpool.h \
-		timer.h types.h util.h version.h
+		result.h resultclass.h rwlock.h serial.h sha1.h sha2.h \
+		sockaddr.h socket.h stdio.h stdlib.h string.h symtab.h \
+	        task.h taskpool.h timer.h types.h util.h version.h
 
 SUBDIRS =
 TARGETS =
diff --git a/contrib/bind9/lib/isc/include/isc/app.h b/contrib/bind9/lib/isc/include/isc/app.h
index f77057b..f51aff7 100644
--- a/contrib/bind9/lib/isc/include/isc/app.h
+++ b/contrib/bind9/lib/isc/include/isc/app.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: app.h,v 1.1.206.1 2004/03/06 08:14:38 marka Exp $ */
+/* $Id: app.h,v 1.2.18.2 2005/04/29 00:16:52 marka Exp $ */
 
 #ifndef ISC_APP_H
 #define ISC_APP_H 1
@@ -24,18 +24,18 @@
  ***** Module Info
  *****/
 
-/*
- * ISC Application Support
+/*! \file
+ * \brief ISC Application Support
  *
  * Dealing with program termination can be difficult, especially in a
  * multithreaded program.  The routines in this module help coordinate
  * the shutdown process.  They are used as follows by the initial (main)
  * thread of the application:
  *
- *		isc_app_start();	Call very early in main(), before
+ *\li		isc_app_start();	Call very early in main(), before
  *					any other threads have been created.
  *
- *		isc_app_run();		This will post any on-run events,
+ *\li		isc_app_run();		This will post any on-run events,
  *					and then block until application
  *					shutdown is requested.  A shutdown
  *					request is made by calling
@@ -44,7 +44,7 @@
  *					After isc_app_run() returns, the
  *					application should shutdown itself.
  *
- *		isc_app_finish();	Call very late in main().
+ *\li		isc_app_finish();	Call very late in main().
  *
  * Applications that want to use SIGHUP/isc_app_reload() to trigger reloading
  * should check the result of isc_app_run() and call the reload routine if
@@ -54,22 +54,22 @@
  * Use of this module is not required.  In particular, isc_app_start() is
  * NOT an ISC library initialization routine.
  *
- * MP:
+ * \li MP:
  *	Clients must ensure that isc_app_start(), isc_app_run(), and
  *	isc_app_finish() are called at most once.  isc_app_shutdown()
  *	is safe to use by any thread (provided isc_app_start() has been
  *	called previously).
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
+ * \li Resources:
  *	None.
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -87,8 +87,8 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_app_start(void);
-/*
- * Start an ISC library application.
+/*!<
+ * \brief Start an ISC library application.
  *
  * Notes:
  *	This call should be made before any other ISC library call, and as
@@ -98,8 +98,8 @@ isc_app_start(void);
 isc_result_t
 isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action,
 	      void *arg);
-/*
- * Request delivery of an event when the application is run.
+/*!<
+ * \brief Request delivery of an event when the application is run.
  *
  * Requires:
  *	isc_app_start() has been called.
@@ -111,99 +111,99 @@ isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action,
 
 isc_result_t
 isc_app_run(void);
-/*
- * Run an ISC library application.
+/*!<
+ * \brief Run an ISC library application.
  *
  * Notes:
- *	The caller (typically the initial thread of an application) will
+ *\li	The caller (typically the initial thread of an application) will
  *	block until shutdown is requested.  When the call returns, the
  *	caller should start shutting down the application.
  *
  * Requires:
- *	isc_app_start() has been called.
+ *\li	isc_app_start() has been called.
  *
  * Ensures:
- *	Any events requested via isc_app_onrun() will have been posted (in
+ *\li	Any events requested via isc_app_onrun() will have been posted (in
  *	FIFO order) before isc_app_run() blocks.
  *
  * Returns:
- *	ISC_R_SUCCESS			Shutdown has been requested.
- *	ISC_R_RELOAD			Reload has been requested.
+ *\li	ISC_R_SUCCESS			Shutdown has been requested.
+ *\li	ISC_R_RELOAD			Reload has been requested.
  */
 
 isc_result_t
 isc_app_shutdown(void);
-/*
- * Request application shutdown.
+/*!<
+ * \brief Request application shutdown.
  *
  * Notes:
- *	It is safe to call isc_app_shutdown() multiple times.  Shutdown will
+ *\li	It is safe to call isc_app_shutdown() multiple times.  Shutdown will
  *	only be triggered once.
  *
  * Requires:
- *	isc_app_run() has been called.
+ *\li	isc_app_run() has been called.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_UNEXPECTED
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_app_reload(void);
-/*
- * Request application reload.
+/*!<
+ * \brief Request application reload.
  *
  * Requires:
- *	isc_app_run() has been called.
+ *\li	isc_app_run() has been called.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_UNEXPECTED
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_UNEXPECTED
  */
 
 void
 isc_app_finish(void);
-/*
- * Finish an ISC library application.
+/*!<
+ * \brief Finish an ISC library application.
  *
  * Notes:
- *	This call should be made at or near the end of main().
+ *\li	This call should be made at or near the end of main().
  *
  * Requires:
- *	isc_app_start() has been called.
+ *\li	isc_app_start() has been called.
  *
  * Ensures:
- *	Any resources allocated by isc_app_start() have been released.
+ *\li	Any resources allocated by isc_app_start() have been released.
  */
 
 void
 isc_app_block(void);
-/*
- * Indicate that a blocking operation will be performed.
+/*!<
+ * \brief Indicate that a blocking operation will be performed.
  *
  * Notes:
- *	If a blocking operation is in process, a call to isc_app_shutdown()
+ *\li	If a blocking operation is in process, a call to isc_app_shutdown()
  *	or an external signal will abort the program, rather than allowing
  *	clean shutdown.  This is primarily useful for reading user input.
  *
  * Requires:
- * 	isc_app_start() has been called.
- * 	No other blocking operations are in progress.
+ * \li	isc_app_start() has been called.
+ * \li	No other blocking operations are in progress.
  */
 
 void
 isc_app_unblock(void);
-/*
- * Indicate that a blocking operation is complete.
+/*!<
+ * \brief Indicate that a blocking operation is complete.
  *
  * Notes:
- * 	When a blocking operation has completed, return the program to a
+ * \li	When a blocking operation has completed, return the program to a
  * 	state where a call to isc_app_shutdown() or an external signal will
  * 	shutdown normally.
  *
  * Requires:
- * 	isc_app_start() has been called.
- * 	isc_app_block() has been called by the same thread.
+ * \li	isc_app_start() has been called.
+ * \li	isc_app_block() has been called by the same thread.
  */
 
 
diff --git a/contrib/bind9/lib/isc/include/isc/assertions.h b/contrib/bind9/lib/isc/include/isc/assertions.h
index 6091de9..c1e68a1 100644
--- a/contrib/bind9/lib/isc/include/isc/assertions.h
+++ b/contrib/bind9/lib/isc/include/isc/assertions.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -16,7 +16,9 @@
  */
 
 /*
- * $Id: assertions.h,v 1.17.206.1 2004/03/06 08:14:38 marka Exp $
+ * $Id: assertions.h,v 1.18.18.2 2005/04/29 00:16:52 marka Exp $
+ */
+/*! \file assertions.h
  */
 
 #ifndef ISC_ASSERTIONS_H
@@ -27,6 +29,7 @@
 
 ISC_LANG_BEGINDECLS
 
+/*% isc assertion type */
 typedef enum {
 	isc_assertiontype_require,
 	isc_assertiontype_ensure,
diff --git a/contrib/bind9/lib/isc/include/isc/base64.h b/contrib/bind9/lib/isc/include/isc/base64.h
index 260dd1d..26ffa48 100644
--- a/contrib/bind9/lib/isc/include/isc/base64.h
+++ b/contrib/bind9/lib/isc/include/isc/base64.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: base64.h,v 1.15.206.1 2004/03/06 08:14:38 marka Exp $ */
+/* $Id: base64.h,v 1.16.18.2 2005/04/29 00:16:53 marka Exp $ */
 
 #ifndef ISC_BASE64_H
 #define ISC_BASE64_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -32,59 +34,59 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 isc_base64_totext(isc_region_t *source, int wordlength,
 		  const char *wordbreak, isc_buffer_t *target);
-/*
- * Convert data into base64 encoded text.
+/*!<
+ * \brief Convert data into base64 encoded text.
  *
  * Notes:
- *	The base64 encoded text in 'target' will be divided into
+ *\li	The base64 encoded text in 'target' will be divided into
  *	words of at most 'wordlength' characters, separated by
  * 	the 'wordbreak' string.  No parentheses will surround
  *	the text.
  *
  * Requires:
- *	'source' is a region containing binary data
- *	'target' is a text buffer containing available space
- *	'wordbreak' points to a null-terminated string of
+ *\li	'source' is a region containing binary data
+ *\li	'target' is a text buffer containing available space
+ *\li	'wordbreak' points to a null-terminated string of
  *		zero or more whitespace characters
  *
  * Ensures:
- *	target will contain the base64 encoded version of the data
+ *\li	target will contain the base64 encoded version of the data
  *	in source.  The 'used' pointer in target will be advanced as
  *	necessary.
  */
 
 isc_result_t
 isc_base64_decodestring(const char *cstr, isc_buffer_t *target);
-/*
- * Decode a null-terminated base64 string.
+/*!<
+ * \brief Decode a null-terminated base64 string.
  *
  * Requires:
- *	'cstr' is non-null.
- *	'target' is a valid buffer.
+ *\li	'cstr' is non-null.
+ *\li	'target' is a valid buffer.
  *
  * Returns:
- *	ISC_R_SUCCESS	-- the entire decoded representation of 'cstring'
+ *\li	#ISC_R_SUCCESS	-- the entire decoded representation of 'cstring'
  *			   fit in 'target'.
- *	ISC_R_BADBASE64 -- 'cstr' is not a valid base64 encoding.
+ *\li	#ISC_R_BADBASE64 -- 'cstr' is not a valid base64 encoding.
  *
  * 	Other error returns are any possible error code from:
- *		isc_lex_create(),
- *		isc_lex_openbuffer(),
- *		isc_base64_tobuffer().
+ *\li		isc_lex_create(),
+ *\li		isc_lex_openbuffer(),
+ *\li		isc_base64_tobuffer().
  */
 
 isc_result_t
 isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length);
-/*
- * Convert base64 encoded text from a lexer context into data.
+/*!<
+ * \brief Convert base64 encoded text from a lexer context into data.
  *
  * Requires:
- *	'lex' is a valid lexer context
- *	'target' is a buffer containing binary data
- *	'length' is an integer
+ *\li	'lex' is a valid lexer context
+ *\li	'target' is a buffer containing binary data
+ *\li	'length' is an integer
  *
  * Ensures:
- *	target will contain the data represented by the base64 encoded
+ *\li	target will contain the data represented by the base64 encoded
  *	string parsed by the lexer.  No more than length bytes will be read,
  *	if length is positive.  The 'used' pointer in target will be
  *	advanced as necessary.
diff --git a/contrib/bind9/lib/isc/include/isc/bitstring.h b/contrib/bind9/lib/isc/include/isc/bitstring.h
index 6d6a555..3e626b8 100644
--- a/contrib/bind9/lib/isc/include/isc/bitstring.h
+++ b/contrib/bind9/lib/isc/include/isc/bitstring.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: bitstring.h,v 1.7.206.1 2004/03/06 08:14:38 marka Exp $ */
+/* $Id: bitstring.h,v 1.8.18.2 2005/04/29 00:16:53 marka Exp $ */
 
 #ifndef ISC_BITSTRING_H
 #define ISC_BITSTRING_H 1
@@ -24,8 +24,9 @@
  ***** Module Info
  *****/
 
-/*
- * Bitstring
+/*! \file bitstring.h
+ *
+ * \brief Bitstring manipulation functions.
  *
  * A bitstring is a packed array of bits, stored in a contiguous
  * sequence of octets.  The "most significant bit" (msb) of a bitstring
@@ -46,21 +47,25 @@
  * long and will take two octets.  Let "p" denote a pad bit.  In the msb0
  * encoding, it would be
  *
+ * \verbatim
  *             Octet 0           Octet 1
  *                         |
  *         1 1 0 1 0 0 0 1 | 1 1 1 p p p p p
  *         ^               |               ^
  *         |                               |
  *         bit 0                           bit 15
+ * \endverbatim
  *
  * In the lsb0 encoding, it would be
  *
+ * \verbatim
  *             Octet 0           Octet 1
  *                         |
  *         p p p p p 1 1 0 | 1 0 0 0 1 1 1 1 
  *         ^               |               ^
  *         |                               |
  *         bit 15                          bit 0
+ * \endverbatim
  */
 
 /***
@@ -91,59 +96,59 @@ struct isc_bitstring {
 void
 isc_bitstring_init(isc_bitstring_t *bitstring, unsigned char *data,
 		   unsigned int length, unsigned int size, isc_boolean_t lsb0);
-/*
- * Make 'bitstring' refer to the bitstring of 'size' bits starting
+/*!<
+ * \brief Make 'bitstring' refer to the bitstring of 'size' bits starting
  * at 'data'.  'length' bits of the bitstring are valid.  If 'lsb0'
  * is set then, bit 0 refers to the least significant bit of the
  * bitstring.  Otherwise bit 0 is the most significant bit.
  *
  * Requires:
  *
- *	'bitstring' points to a isc_bitstring_t.
+ *\li	'bitstring' points to a isc_bitstring_t.
  *
- *	'data' points to an array of unsigned char large enough to hold
+ *\li	'data' points to an array of unsigned char large enough to hold
  *	'size' bits.
  *
- *	'length' <= 'size'.
+ *\li	'length' <= 'size'.
  *
  * Ensures:
  *
- *	'bitstring' is a valid bitstring.
+ *\li	'bitstring' is a valid bitstring.
  */
 
 void
 isc_bitstring_invalidate(isc_bitstring_t *bitstring);
-/*
- * Invalidate 'bitstring'.
+/*!<
+ * \brief Invalidate 'bitstring'.
  *
  * Requires:
  *
- *	'bitstring' is a valid bitstring.
+ *\li	'bitstring' is a valid bitstring.
  *
  * Ensures:
  *
- *	'bitstring' is not a valid bitstring.
+ *\li	'bitstring' is not a valid bitstring.
  */
 
 void
 isc_bitstring_copy(isc_bitstring_t *source, unsigned int sbitpos,
 		   isc_bitstring_t *target, unsigned int tbitpos,
 		   unsigned int n);
-/*
- * Starting at bit 'sbitpos', copy 'n' bits from 'source' to
+/*!<
+ * \brief Starting at bit 'sbitpos', copy 'n' bits from 'source' to
  * the 'n' bits of 'target' starting at 'tbitpos'.
  *
  * Requires:
  *
- *	'source' and target are valid bitstrings with the same lsb0 setting.
+ *\li	'source' and target are valid bitstrings with the same lsb0 setting.
  *
- *	'sbitpos' + 'n' is less than or equal to the length of 'source'.
+ *\li	'sbitpos' + 'n' is less than or equal to the length of 'source'.
  *
- *	'tbitpos' + 'n' is less than or equal to the size of 'target'.
+ *\li	'tbitpos' + 'n' is less than or equal to the size of 'target'.
  *
  * Ensures:
  *
- *	The specified bits have been copied, and the length of 'target'
+ *\li	The specified bits have been copied, and the length of 'target'
  *	adjusted (if required).
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/boolean.h b/contrib/bind9/lib/isc/include/isc/boolean.h
index 0081447..ad736fe 100644
--- a/contrib/bind9/lib/isc/include/isc/boolean.h
+++ b/contrib/bind9/lib/isc/include/isc/boolean.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: boolean.h,v 1.12.206.1 2004/03/06 08:14:39 marka Exp $ */
+/* $Id: boolean.h,v 1.13.18.2 2005/04/29 00:16:53 marka Exp $ */
 
 #ifndef ISC_BOOLEAN_H
 #define ISC_BOOLEAN_H 1
 
+/*! \file */
+
 typedef enum { isc_boolean_false = 0, isc_boolean_true = 1 } isc_boolean_t;
 
 #define ISC_FALSE isc_boolean_false
diff --git a/contrib/bind9/lib/isc/include/isc/buffer.h b/contrib/bind9/lib/isc/include/isc/buffer.h
index 02b82bc..a285e27 100644
--- a/contrib/bind9/lib/isc/include/isc/buffer.h
+++ b/contrib/bind9/lib/isc/include/isc/buffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: buffer.h,v 1.39.12.2 2004/03/08 09:04:51 marka Exp $ */
+/* $Id: buffer.h,v 1.43.18.2 2005/04/29 00:16:53 marka Exp $ */
 
 #ifndef ISC_BUFFER_H
 #define ISC_BUFFER_H 1
@@ -24,10 +24,9 @@
  ***** Module Info
  *****/
 
-/*
- * Buffers
+/*! \file buffer.h
  *
- * A buffer is a region of memory, together with a set of related subregions.
+ * \brief A buffer is a region of memory, together with a set of related subregions.
  * Buffers are used for parsing and I/O operations.
  *
  * The 'used region' and the 'available' region are disjoint, and their
@@ -51,6 +50,7 @@
  * is empty.  If the current offset advances beyond the chosen offset, the
  * active region will also be empty.
  *
+ * \verbatim
  *  /------------entire length---------------\
  *  /----- used region -----\/-- available --\
  *  +----------------------------------------+
@@ -69,9 +69,11 @@
  * a-b == consumed region.
  * b-d == remaining region.
  * b-c == optional active region.
+ *\endverbatim
  *
  * The following invariants are maintained by all routines:
  *
+ *\code
  *	length > 0
  *
  *	base is a valid pointer to length bytes of memory
@@ -82,21 +84,22 @@
  *
  *	0 <= active <= used
  *	(although active < current implies empty active region)
+ *\endcode
  *
- * MP:
+ * \li MP:
  *	Buffers have no synchronization.  Clients must ensure exclusive
  *	access.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
+ * \li Resources:
  *	Memory: 1 pointer + 6 unsigned integers per buffer.
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -108,7 +111,7 @@
 #include <isc/magic.h>
 #include <isc/types.h>
 
-/*
+/*!
  * To make many functions be inline macros (via #define) define this.
  * If it is undefined, a function will be used.
  */
@@ -116,11 +119,13 @@
 
 ISC_LANG_BEGINDECLS
 
-/***
+/*@{*/
+/*!
  *** Magic numbers
  ***/
 #define ISC_BUFFER_MAGIC		0x42756621U	/* Buf!. */
 #define ISC_BUFFER_VALID(b)		ISC_MAGIC_VALID(b, ISC_BUFFER_MAGIC)
+/*@}*/
 
 /*
  * The following macros MUST be used only on valid buffers.  It is the
@@ -129,7 +134,8 @@ ISC_LANG_BEGINDECLS
  * another macro.)
  */
 
-/*
+/*@{*/
+/*!
  * Fundamental buffer elements.  (A through E in the introductory comment.)
  */
 #define isc_buffer_base(b)    ((void *)(b)->base)			  /*a*/
@@ -140,8 +146,10 @@ ISC_LANG_BEGINDECLS
 #define isc_buffer_used(b)    \
 		((void *)((unsigned char *)(b)->base + (b)->used))        /*d*/
 #define isc_buffer_length(b)  ((b)->length)				  /*e*/
+/*@}*/
 
-/*
+/*@{*/
+/*!
  * Derived lengths.  (Described in the introductory comment.)
  */
 #define isc_buffer_usedlength(b)	((b)->used)		      /* d-a */
@@ -149,8 +157,9 @@ ISC_LANG_BEGINDECLS
 #define isc_buffer_remaininglength(b)	((b)->used - (b)->current)    /* d-b */
 #define isc_buffer_activelength(b)	((b)->active - (b)->current)  /* c-b */
 #define isc_buffer_availablelength(b)	((b)->length - (b)->used)     /* e-d */
+/*@}*/
 
-/*
+/*!
  * Note that the buffer structure is public.  This is principally so buffer
  * operations can be implemented using macros.  Applications are strongly
  * discouraged from directly manipulating the structure.
@@ -159,14 +168,16 @@ ISC_LANG_BEGINDECLS
 struct isc_buffer {
 	unsigned int		magic;
 	void		       *base;
-	/* The following integers are byte offsets from 'base'. */
+        /*@{*/
+	/*! The following integers are byte offsets from 'base'. */
 	unsigned int		length;
 	unsigned int		used;
 	unsigned int 		current;
 	unsigned int 		active;
-	/* linkable */
+        /*@}*/
+	/*! linkable */
 	ISC_LINK(isc_buffer_t)	link;
-	/* private internal elements */
+	/*! private internal elements */
 	isc_mem_t	       *mctx;
 };
 
@@ -177,397 +188,397 @@ struct isc_buffer {
 isc_result_t
 isc_buffer_allocate(isc_mem_t *mctx, isc_buffer_t **dynbuffer,
 		    unsigned int length);
-/*
- * Allocate a dynamic linkable buffer which has "length" bytes in the
+/*!<
+ * \brief Allocate a dynamic linkable buffer which has "length" bytes in the
  * data region.
  *
  * Requires:
- *	"mctx" is valid.
+ *\li	"mctx" is valid.
  *
- *	"dynbuffer" is non-NULL, and "*dynbuffer" is NULL.
+ *\li	"dynbuffer" is non-NULL, and "*dynbuffer" is NULL.
  *
  * Returns:
- *	ISC_R_SUCCESS		- success
- *	ISC_R_NOMEMORY		- no memory available
+ *\li	ISC_R_SUCCESS		- success
+ *\li	ISC_R_NOMEMORY		- no memory available
  *
  * Note:
- *	Changing the buffer's length field is not permitted.
+ *\li	Changing the buffer's length field is not permitted.
  */
 
 void
 isc_buffer_free(isc_buffer_t **dynbuffer);
-/*
- * Release resources allocated for a dynamic buffer.
+/*!<
+ * \brief Release resources allocated for a dynamic buffer.
  *
  * Requires:
- *	"dynbuffer" is not NULL.
+ *\li	"dynbuffer" is not NULL.
  *
- *	"*dynbuffer" is a valid dynamic buffer.
+ *\li	"*dynbuffer" is a valid dynamic buffer.
  *
  * Ensures:
- *	"*dynbuffer" will be NULL on return, and all memory associated with
+ *\li	"*dynbuffer" will be NULL on return, and all memory associated with
  *	the dynamic buffer is returned to the memory context used in
  *	isc_buffer_allocate().
  */
 
 void
 isc__buffer_init(isc_buffer_t *b, const void *base, unsigned int length);
-/*
- * Make 'b' refer to the 'length'-byte region starting at base.
+/*!<
+ * \brief Make 'b' refer to the 'length'-byte region starting at base.
  *
  * Requires:
  *
- *	'length' > 0
+ *\li	'length' > 0
  *
- *	'base' is a pointer to a sequence of 'length' bytes.
+ *\li	'base' is a pointer to a sequence of 'length' bytes.
  *
  */
 
 void
 isc__buffer_invalidate(isc_buffer_t *b);
-/*
- * Make 'b' an invalid buffer.
+/*!<
+ * \brief Make 'b' an invalid buffer.
  *
  * Requires:
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
  * Ensures:
- *	If assertion checking is enabled, future attempts to use 'b' without
+ *\li	If assertion checking is enabled, future attempts to use 'b' without
  *	calling isc_buffer_init() on it will cause an assertion failure.
  */
 
 void
 isc__buffer_region(isc_buffer_t *b, isc_region_t *r);
-/*
- * Make 'r' refer to the region of 'b'.
+/*!<
+ * \brief Make 'r' refer to the region of 'b'.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'r' points to a region structure.
+ *\li	'r' points to a region structure.
  */
 
 void
 isc__buffer_usedregion(isc_buffer_t *b, isc_region_t *r);
-/*
- * Make 'r' refer to the used region of 'b'.
+/*!<
+ * \brief Make 'r' refer to the used region of 'b'.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'r' points to a region structure.
+ *\li	'r' points to a region structure.
  */
 
 void
 isc__buffer_availableregion(isc_buffer_t *b, isc_region_t *r);
-/*
- * Make 'r' refer to the available region of 'b'.
+/*!<
+ * \brief Make 'r' refer to the available region of 'b'.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'r' points to a region structure.
+ *\li	'r' points to a region structure.
  */
 
 void
 isc__buffer_add(isc_buffer_t *b, unsigned int n);
-/*
- * Increase the 'used' region of 'b' by 'n' bytes.
+/*!<
+ * \brief Increase the 'used' region of 'b' by 'n' bytes.
  *
  * Requires:
  *
- *	'b' is a valid buffer
+ *\li	'b' is a valid buffer
  *
- *	used + n <= length
+ *\li	used + n <= length
  *
  */
 
 void
 isc__buffer_subtract(isc_buffer_t *b, unsigned int n);
-/*
- * Decrease the 'used' region of 'b' by 'n' bytes.
+/*!<
+ * \brief Decrease the 'used' region of 'b' by 'n' bytes.
  *
  * Requires:
  *
- *	'b' is a valid buffer
+ *\li	'b' is a valid buffer
  *
- *	used >= n
+ *\li	used >= n
  *
  */
 
 void
 isc__buffer_clear(isc_buffer_t *b);
-/*
- * Make the used region empty.
+/*!<
+ * \brief Make the used region empty.
  *
  * Requires:
  *
- *	'b' is a valid buffer
+ *\li	'b' is a valid buffer
  *
  * Ensures:
  *
- *	used = 0
+ *\li	used = 0
  *
  */
 
 void
 isc__buffer_consumedregion(isc_buffer_t *b, isc_region_t *r);
-/*
- * Make 'r' refer to the consumed region of 'b'.
+/*!<
+ * \brief Make 'r' refer to the consumed region of 'b'.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'r' points to a region structure.
+ *\li	'r' points to a region structure.
  */
 
 void
 isc__buffer_remainingregion(isc_buffer_t *b, isc_region_t *r);
-/*
- * Make 'r' refer to the remaining region of 'b'.
+/*!<
+ * \brief Make 'r' refer to the remaining region of 'b'.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'r' points to a region structure.
+ *\li	'r' points to a region structure.
  */
 
 void
 isc__buffer_activeregion(isc_buffer_t *b, isc_region_t *r);
-/*
- * Make 'r' refer to the active region of 'b'.
+/*!<
+ * \brief Make 'r' refer to the active region of 'b'.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'r' points to a region structure.
+ *\li	'r' points to a region structure.
  */
 
 void
 isc__buffer_setactive(isc_buffer_t *b, unsigned int n);
-/*
- * Sets the end of the active region 'n' bytes after current.
+/*!<
+ * \brief Sets the end of the active region 'n' bytes after current.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	current + n <= used
+ *\li	current + n <= used
  */
 
 void
 isc__buffer_first(isc_buffer_t *b);
-/*
- * Make the consumed region empty.
+/*!<
+ * \brief Make the consumed region empty.
  *
  * Requires:
  *
- *	'b' is a valid buffer
+ *\li	'b' is a valid buffer
  *
  * Ensures:
  *
- *	current == 0
+ *\li	current == 0
  *
  */
 
 void
 isc__buffer_forward(isc_buffer_t *b, unsigned int n);
-/*
- * Increase the 'consumed' region of 'b' by 'n' bytes.
+/*!<
+ * \brief Increase the 'consumed' region of 'b' by 'n' bytes.
  *
  * Requires:
  *
- *	'b' is a valid buffer
+ *\li	'b' is a valid buffer
  *
- *	current + n <= used
+ *\li	current + n <= used
  *
  */
 
 void
 isc__buffer_back(isc_buffer_t *b, unsigned int n);
-/*
- * Decrease the 'consumed' region of 'b' by 'n' bytes.
+/*!<
+ * \brief Decrease the 'consumed' region of 'b' by 'n' bytes.
  *
  * Requires:
  *
- *	'b' is a valid buffer
+ *\li	'b' is a valid buffer
  *
- *	n <= current
+ *\li	n <= current
  *
  */
 
 void
 isc_buffer_compact(isc_buffer_t *b);
-/*
- * Compact the used region by moving the remaining region so it occurs
+/*!<
+ * \brief Compact the used region by moving the remaining region so it occurs
  * at the start of the buffer.  The used region is shrunk by the size of
  * the consumed region, and the consumed region is then made empty.
  *
  * Requires:
  *
- *	'b' is a valid buffer
+ *\li	'b' is a valid buffer
  *
  * Ensures:
  *
- *	current == 0
+ *\li	current == 0
  *
- *	The size of the used region is now equal to the size of the remaining
+ *\li	The size of the used region is now equal to the size of the remaining
  *	region (as it was before the call).  The contents of the used region
  *	are those of the remaining region (as it was before the call).
  */
 
 isc_uint8_t
 isc_buffer_getuint8(isc_buffer_t *b);
-/*
- * Read an unsigned 8-bit integer from 'b' and return it.
+/*!<
+ * \brief Read an unsigned 8-bit integer from 'b' and return it.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	The length of the available region of 'b' is at least 1.
+ *\li	The length of the available region of 'b' is at least 1.
  *
  * Ensures:
  *
- *	The current pointer in 'b' is advanced by 1.
+ *\li	The current pointer in 'b' is advanced by 1.
  *
  * Returns:
  *
- *	A 8-bit unsigned integer.
+ *\li	A 8-bit unsigned integer.
  */
 
 void
 isc__buffer_putuint8(isc_buffer_t *b, isc_uint8_t val);
-/*
- * Store an unsigned 8-bit integer from 'val' into 'b'.
+/*!<
+ * \brief Store an unsigned 8-bit integer from 'val' into 'b'.
  *
  * Requires:
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	The length of the unused region of 'b' is at least 1.
+ *\li	The length of the unused region of 'b' is at least 1.
  *
  * Ensures:
- *	The used pointer in 'b' is advanced by 1.
+ *\li	The used pointer in 'b' is advanced by 1.
  */
 
 isc_uint16_t
 isc_buffer_getuint16(isc_buffer_t *b);
-/*
- * Read an unsigned 16-bit integer in network byte order from 'b', convert
+/*!<
+ * \brief Read an unsigned 16-bit integer in network byte order from 'b', convert
  * it to host byte order, and return it.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	The length of the available region of 'b' is at least 2.
+ *\li	The length of the available region of 'b' is at least 2.
  *
  * Ensures:
  *
- *	The current pointer in 'b' is advanced by 2.
+ *\li	The current pointer in 'b' is advanced by 2.
  *
  * Returns:
  *
- *	A 16-bit unsigned integer.
+ *\li	A 16-bit unsigned integer.
  */
 
 void
 isc__buffer_putuint16(isc_buffer_t *b, isc_uint16_t val);
-/*
- * Store an unsigned 16-bit integer in host byte order from 'val'
+/*!<
+ * \brief Store an unsigned 16-bit integer in host byte order from 'val'
  * into 'b' in network byte order.
  *
  * Requires:
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	The length of the unused region of 'b' is at least 2.
+ *\li	The length of the unused region of 'b' is at least 2.
  *
  * Ensures:
- *	The used pointer in 'b' is advanced by 2.
+ *\li	The used pointer in 'b' is advanced by 2.
  */
 
 isc_uint32_t
 isc_buffer_getuint32(isc_buffer_t *b);
-/*
- * Read an unsigned 32-bit integer in network byte order from 'b', convert
+/*!<
+ * \brief Read an unsigned 32-bit integer in network byte order from 'b', convert
  * it to host byte order, and return it.
  *
  * Requires:
  *
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	The length of the available region of 'b' is at least 4.
+ *\li	The length of the available region of 'b' is at least 4.
  *
  * Ensures:
  *
- *	The current pointer in 'b' is advanced by 4.
+ *\li	The current pointer in 'b' is advanced by 4.
  *
  * Returns:
  *
- *	A 32-bit unsigned integer.
+ *\li	A 32-bit unsigned integer.
  */
 
 void
 isc__buffer_putuint32(isc_buffer_t *b, isc_uint32_t val);
-/*
- * Store an unsigned 32-bit integer in host byte order from 'val'
+/*!<
+ * \brief Store an unsigned 32-bit integer in host byte order from 'val'
  * into 'b' in network byte order.
  *
  * Requires:
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	The length of the unused region of 'b' is at least 4.
+ *\li	The length of the unused region of 'b' is at least 4.
  *
  * Ensures:
- *	The used pointer in 'b' is advanced by 4.
+ *\li	The used pointer in 'b' is advanced by 4.
  */
 
 void
 isc__buffer_putmem(isc_buffer_t *b, const unsigned char *base,
 		   unsigned int length);
-/*
- * Copy 'length' bytes of memory at 'base' into 'b'.
+/*!<
+ * \brief Copy 'length' bytes of memory at 'base' into 'b'.
  *
  * Requires:
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'base' points to 'length' bytes of valid memory.
+ *\li	'base' points to 'length' bytes of valid memory.
  *
  */
 
 void
 isc__buffer_putstr(isc_buffer_t *b, const char *source);
-/*
- * Copy 'source' into 'b', not including terminating NUL.
+/*!<
+ * \brief Copy 'source' into 'b', not including terminating NUL.
  *
  * Requires:
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'source' to be a valid NULL terminated string.
+ *\li	'source' to be a valid NULL terminated string.
  *
- *	strlen(source) <= isc_buffer_available(b)
+ *\li	strlen(source) <= isc_buffer_available(b)
  */
 
 isc_result_t
 isc_buffer_copyregion(isc_buffer_t *b, const isc_region_t *r);
-/*
- * Copy the contents of 'r' into 'b'.
+/*!<
+ * \brief Copy the contents of 'r' into 'b'.
  *
  * Requires:
- *	'b' is a valid buffer.
+ *\li	'b' is a valid buffer.
  *
- *	'r' is a valid region.
+ *\li	'r' is a valid region.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE			The available region of 'b' is not
+ *\li	ISC_R_SUCCESS
+ *\li	ISC_R_NOSPACE			The available region of 'b' is not
  *					big enough.
  */
 
@@ -580,7 +591,7 @@ ISC_LANG_ENDDECLS
  * ones beginning with "isc__"
  */
 
-/*
+/*! \note
  * XXXDCL Something more could be done with initializing buffers that
  * point to const data.  For example, a new function, isc_buffer_initconst,
  * could be used, and a new boolean flag in the buffer structure could
diff --git a/contrib/bind9/lib/isc/include/isc/bufferlist.h b/contrib/bind9/lib/isc/include/isc/bufferlist.h
index b24cde0..7fc2ecc 100644
--- a/contrib/bind9/lib/isc/include/isc/bufferlist.h
+++ b/contrib/bind9/lib/isc/include/isc/bufferlist.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: bufferlist.h,v 1.10.206.1 2004/03/06 08:14:39 marka Exp $ */
+/* $Id: bufferlist.h,v 1.11.18.2 2005/04/29 00:16:53 marka Exp $ */
 
 #ifndef ISC_BUFFERLIST_H
 #define ISC_BUFFERLIST_H 1
@@ -24,19 +24,19 @@
  ***** Module Info
  *****/
 
-/*
- * Buffer Lists
+/*! \file bufferlist.h
+ *
  *
- *	Buffer lists have no synchronization.  Clients must ensure exclusive
+ *\brief	Buffer lists have no synchronization.  Clients must ensure exclusive
  *	access.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
 
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -55,30 +55,30 @@ ISC_LANG_BEGINDECLS
 
 unsigned int
 isc_bufferlist_usedcount(isc_bufferlist_t *bl);
-/*
- * Return the length of the sum of all used regions of all buffers in
+/*!<
+ * \brief Return the length of the sum of all used regions of all buffers in
  * the buffer list 'bl'
  *
  * Requires:
  *
- *	'bl' is not NULL.
+ *\li	'bl' is not NULL.
  *
  * Returns:
- *	sum of all used regions' lengths.
+ *\li	sum of all used regions' lengths.
  */
 
 unsigned int
 isc_bufferlist_availablecount(isc_bufferlist_t *bl);
-/*
- * Return the length of the sum of all available regions of all buffers in
+/*!<
+ * \brief Return the length of the sum of all available regions of all buffers in
  * the buffer list 'bl'
  *
  * Requires:
  *
- *	'bl' is not NULL.
+ *\li	'bl' is not NULL.
  *
  * Returns:
- *	sum of all available regions' lengths.
+ *\li	sum of all available regions' lengths.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/commandline.h b/contrib/bind9/lib/isc/include/isc/commandline.h
index 250f7f0..5ece26f 100644
--- a/contrib/bind9/lib/isc/include/isc/commandline.h
+++ b/contrib/bind9/lib/isc/include/isc/commandline.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,30 +15,33 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: commandline.h,v 1.9.206.1 2004/03/06 08:14:39 marka Exp $ */
+/* $Id: commandline.h,v 1.10.18.2 2005/04/29 00:16:53 marka Exp $ */
 
 #ifndef ISC_COMMANDLINE_H
 #define ISC_COMMANDLINE_H 1
 
+/*! \file */
+
 #include <isc/boolean.h>
 #include <isc/lang.h>
 #include <isc/platform.h>
 
-/* Index into parent argv vector. */
+/*% Index into parent argv vector. */
 LIBISC_EXTERNAL_DATA extern int isc_commandline_index;
-/* Character checked for validity. */
+/*% Character checked for validity. */
 LIBISC_EXTERNAL_DATA extern int isc_commandline_option;
-/* Argument associated with option. */
+/*% Argument associated with option. */
 LIBISC_EXTERNAL_DATA extern char *isc_commandline_argument;
-/* For printing error messages. */
+/*% For printing error messages. */
 LIBISC_EXTERNAL_DATA extern char *isc_commandline_progname;
-/* Print error message. */
+/*% Print error message. */
 LIBISC_EXTERNAL_DATA extern isc_boolean_t isc_commandline_errprint;
-/* Reset getopt. */
+/*% Reset getopt. */
 LIBISC_EXTERNAL_DATA extern isc_boolean_t isc_commandline_reset;
 
 ISC_LANG_BEGINDECLS
 
+/*% parse command line */
 int
 isc_commandline_parse(int argc, char * const *argv, const char *options);
 
diff --git a/contrib/bind9/lib/isc/include/isc/entropy.h b/contrib/bind9/lib/isc/include/isc/entropy.h
index 7200a12..2890f6c 100644
--- a/contrib/bind9/lib/isc/include/isc/entropy.h
+++ b/contrib/bind9/lib/isc/include/isc/entropy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: entropy.h,v 1.23.2.1.10.1 2004/03/06 08:14:40 marka Exp $ */
+/* $Id: entropy.h,v 1.25.18.2 2005/04/29 00:16:54 marka Exp $ */
 
 #ifndef ISC_ENTROPY_H
 #define ISC_ENTROPY_H 1
@@ -24,33 +24,30 @@
  ***** Module Info
  *****/
 
-/*
- * Entropy
- *
- * The entropy API
+/*! \file entropy.h
+ * \brief The entropy API
  *
- * MP:
+ * \li MP:
  *	The entropy object is locked internally.  All callbacks into
  *	application-provided functions (for setup, gathering, and
  *	shutdown of sources) are guaranteed to be called with the
  *	entropy API lock held.  This means these functions are
  *	not permitted to call back into the entropy API.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
+ * \li Resources:
  *	A buffer, used as an entropy pool.
  *
- * Security:
+ * \li Security:
  *	While this code is believed to implement good entropy gathering
  *	and distribution, it has not been reviewed by a cryptographic
  *	expert.
- *
  *	Since the added entropy is only as good as the sources used,
  *	this module could hand out bad data and never know it.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -63,31 +60,37 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-/*
- * Entropy callback function.
- */
+/*@{*/
+/*% Entropy callback function. */
 typedef isc_result_t (*isc_entropystart_t)(isc_entropysource_t *source,
 					   void *arg, isc_boolean_t blocking);
 typedef isc_result_t (*isc_entropyget_t)(isc_entropysource_t *source,
 					 void *arg, isc_boolean_t blocking);
 typedef void (*isc_entropystop_t)(isc_entropysource_t *source, void *arg);
+/*@}*/
 
 /***
  *** Flags.
  ***/
 
-/*
- * _GOODONLY
+/*!
+ * \brief 
  *	Extract only "good" data; return failure if there is not enough
  *	data available and there are no sources which we can poll to get
  *	data, or those sources are empty.
  *
- * _PARTIAL
+ *
+ */
+#define ISC_ENTROPY_GOODONLY	0x00000001U
+/*!
+ * \brief
  *	Extract as much good data as possible, but if there isn't enough
  *	at hand, return what is available.  This flag only makes sense
  *	when used with _GOODONLY.
- *
- * _BLOCKING
+ */
+#define ISC_ENTROPY_PARTIAL	0x00000002U
+/*!
+ * \brief
  *	Block the task until data is available.  This is contrary to the
  *	ISC task system, where tasks should never block.  However, if
  *	this is a special purpose application where blocking a task is
@@ -95,12 +98,10 @@ typedef void (*isc_entropystop_t)(isc_entropysource_t *source, void *arg);
  *	This flag only makes sense when used with _GOODONLY, and will
  *	block regardless of the setting for _PARTIAL.
  */
-#define ISC_ENTROPY_GOODONLY	0x00000001U
-#define ISC_ENTROPY_PARTIAL	0x00000002U
 #define ISC_ENTROPY_BLOCKING	0x00000004U
 
-/*
- * _ESTIMATE
+/*!
+ * \brief
  *	Estimate the amount of entropy contained in the sample pool.
  *	If this is not set, the source will be gathered and perodically
  *	mixed into the entropy pool, but no increment in contained entropy
@@ -110,17 +111,22 @@ typedef void (*isc_entropystop_t)(isc_entropysource_t *source, void *arg);
 
 /*
  * For use with isc_entropy_usebestsource().
- *
- * _KEYBOARDYES
+ */
+/*!
+ * \brief 
  *	Use the keyboard as the only entropy source.
- * _KEYBOARDNO
+ */
+#define ISC_ENTROPY_KEYBOARDYES		1
+/*!
+ * \brief 
  *	Never use the keyboard as an entropy source.
- * _KEYBOARDMAYBE
+ */
+#define ISC_ENTROPY_KEYBOARDNO		2
+/*!
+ * \brief
  *	Use the keyboard as an entropy source only if opening the
  *	random device fails.
  */
-#define ISC_ENTROPY_KEYBOARDYES		1
-#define ISC_ENTROPY_KEYBOARDNO		2
 #define ISC_ENTROPY_KEYBOARDMAYBE	3
 
 ISC_LANG_BEGINDECLS
@@ -131,26 +137,26 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_entropy_create(isc_mem_t *mctx, isc_entropy_t **entp);
-/*
- * Create a new entropy object.
+/*!<
+ * \brief Create a new entropy object.
  */
 
 void
 isc_entropy_attach(isc_entropy_t *ent, isc_entropy_t **entp);
-/*
+/*!<
  * Attaches to an entropy object.
  */
 
 void
 isc_entropy_detach(isc_entropy_t **entp);
-/*
- * Detaches from an entropy object.
+/*!<
+ * \brief Detaches from an entropy object.
  */
 
 isc_result_t
 isc_entropy_createfilesource(isc_entropy_t *ent, const char *fname);
-/*
- * Create a new entropy source from a file.
+/*!<
+ * \brief Create a new entropy source from a file.
  *
  * The file is assumed to contain good randomness, and will be mixed directly
  * into the pool with every byte adding 8 bits of entropy.
@@ -168,15 +174,15 @@ isc_entropy_createfilesource(isc_entropy_t *ent, const char *fname);
 
 void
 isc_entropy_destroysource(isc_entropysource_t **sourcep);
-/*
- * Removes an entropy source from the entropy system.
+/*!<
+ * \brief Removes an entropy source from the entropy system.
  */
 
 isc_result_t
 isc_entropy_createsamplesource(isc_entropy_t *ent,
 			       isc_entropysource_t **sourcep);
-/*
- * Create an entropy source that consists of samples.  Each sample is added
+/*!<
+ * \brief Create an entropy source that consists of samples.  Each sample is added
  * to the source via isc_entropy_addsamples(), below.
  */
 
@@ -187,8 +193,10 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
 				 isc_entropystop_t stop,
 				 void *arg,
 				 isc_entropysource_t **sourcep);
-/*
- * Create an entropy source that is polled via a callback.  This would
+/*!<
+ * \brief Create an entropy source that is polled via a callback.  
+ *
+ * This would
  * be used when keyboard input is used, or a GUI input method.  It can
  * also be used to hook in any external entropy source.
  *
@@ -199,19 +207,22 @@ isc_entropy_createcallbacksource(isc_entropy_t *ent,
 
 void
 isc_entropy_stopcallbacksources(isc_entropy_t *ent);
-/*
- * Call the stop functions for callback sources that have had their
+/*!<
+ * \brief Call the stop functions for callback sources that have had their
  * start functions called.
  */
 
+/*@{*/
 isc_result_t
 isc_entropy_addcallbacksample(isc_entropysource_t *source, isc_uint32_t sample,
 			      isc_uint32_t extra);
 isc_result_t
 isc_entropy_addsample(isc_entropysource_t *source, isc_uint32_t sample,
 		      isc_uint32_t extra);
-/*
- * Add a sample to the sample source.  The sample MUST be a timestamp
+/*!<
+ * \brief Add a sample to the sample source.  
+ *
+ * The sample MUST be a timestamp
  * that increases over time, with the exception of wrap-around for
  * extremely high resolution timers which will quickly wrap-around
  * a 32-bit integer.
@@ -222,20 +233,28 @@ isc_entropy_addsample(isc_entropysource_t *source, isc_uint32_t sample,
  * When in an entropy API callback function, _addcallbacksource() must be
  * used.  At all other times, _addsample() must be used.
  */
+/*@}*/
 
 isc_result_t
 isc_entropy_getdata(isc_entropy_t *ent, void *data, unsigned int length,
 		    unsigned int *returned, unsigned int flags);
-/*
- * Extract data from the entropy pool.  This may load the pool from various
+/*!<
+ * \brief Extract data from the entropy pool.  This may load the pool from various
  * sources.
+ *
+ * Do this by stiring the pool and returning a part of hash as randomness.
+ * Note that no secrets are given away here since parts of the hash are
+ * xored together before returned.
+ *
+ * Honor the request from the caller to only return good data, any data,
+ * etc.
  */
 
 void
 isc_entropy_putdata(isc_entropy_t *ent, void *data, unsigned int length,
 		    isc_uint32_t entropy);
-/*
- * Add "length" bytes in "data" to the entropy pool, incrementing the pool's
+/*!<
+ * \brief Add "length" bytes in "data" to the entropy pool, incrementing the pool's
  * entropy count by "entropy."
  *
  * These bytes will prime the pseudorandom portion even no entropy is actually
@@ -244,42 +263,42 @@ isc_entropy_putdata(isc_entropy_t *ent, void *data, unsigned int length,
 
 void
 isc_entropy_stats(isc_entropy_t *ent, FILE *out);
-/*
- * Dump some (trivial) stats to the stdio stream "out".
+/*!<
+ * \brief Dump some (trivial) stats to the stdio stream "out".
  */
 
 isc_result_t
 isc_entropy_usebestsource(isc_entropy_t *ectx, isc_entropysource_t **source,
 			  const char *randomfile, int use_keyboard);
-/*
- * Use whatever source of entropy is best.
+/*!<
+ * \brief Use whatever source of entropy is best.
  *
  * Notes:
- *	If "randomfile" is not NULL, open it with
+ *\li	If "randomfile" is not NULL, open it with
  *	isc_entropy_createfilesource(). 
  *
- *	If "randomfile" is NULL and the system's random device was detected
+ *\li	If "randomfile" is NULL and the system's random device was detected
  *	when the program was configured and built, open that device with
  *	isc_entropy_createfilesource(). 
  *
- *	If "use_keyboard" is ISC_ENTROPY_KEYBOARDYES, then always open
+ *\li	If "use_keyboard" is #ISC_ENTROPY_KEYBOARDYES, then always open
  *	the keyboard as an entropy source (possibly in addition to
  *	"randomfile" or the random device).
  *
- *	If "use_keyboard" is ISC_ENTROPY_KEYBOARDMAYBE, open the keyboard only
+ *\li	If "use_keyboard" is #ISC_ENTROPY_KEYBOARDMAYBE, open the keyboard only
  *	if opening the random file/device fails.  A message will be
  *	printed describing the need for keyboard input.
  *
- *	If "use_keyboard" is ISC_ENTROPY_KEYBOARDNO, the keyboard will
+ *\li	If "use_keyboard" is #ISC_ENTROPY_KEYBOARDNO, the keyboard will
  *	never be opened.
  *
  * Returns:
- *	ISC_R_SUCCESS if at least one source of entropy could be started.
+ *\li	#ISC_R_SUCCESS if at least one source of entropy could be started.
  *
- *	ISC_R_NOENTROPY if use_keyboard is ISC_ENTROPY_KEYBOARDNO and
+ *\li	#ISC_R_NOENTROPY if use_keyboard is #ISC_ENTROPY_KEYBOARDNO and
  *	there is no random device pathname compiled into the program.
  *
- *	A return code from isc_entropy_createfilesource() or
+ *\li	A return code from isc_entropy_createfilesource() or
  *	isc_entropy_createcallbacksource().
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/error.h b/contrib/bind9/lib/isc/include/isc/error.h
index 6142926..3320ae9 100644
--- a/contrib/bind9/lib/isc/include/isc/error.h
+++ b/contrib/bind9/lib/isc/include/isc/error.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: error.h,v 1.13.206.1 2004/03/06 08:14:40 marka Exp $ */
+/* $Id: error.h,v 1.14.18.2 2005/04/29 00:16:54 marka Exp $ */
 
 #ifndef ISC_ERROR_H
 #define ISC_ERROR_H 1
 
+/*! \file */
+
 #include <stdarg.h>
 
 #include <isc/formatcheck.h>
@@ -29,20 +31,25 @@ ISC_LANG_BEGINDECLS
 
 typedef void (*isc_errorcallback_t)(const char *, int, const char *, va_list);
 
+/*% set unexpected error */
 void
 isc_error_setunexpected(isc_errorcallback_t);
 
+/*% set fatal error */
 void
 isc_error_setfatal(isc_errorcallback_t);
 
+/*% unexpected error */
 void
 isc_error_unexpected(const char *, int, const char *, ...)
      ISC_FORMAT_PRINTF(3, 4);
 
+/*% fatal error */
 void
 isc_error_fatal(const char *, int, const char *, ...)
      ISC_FORMAT_PRINTF(3, 4);
 
+/*% runtimecheck error */
 void
 isc_error_runtimecheck(const char *, int, const char *);
 
diff --git a/contrib/bind9/lib/isc/include/isc/event.h b/contrib/bind9/lib/isc/include/isc/event.h
index 58ef2c3..f1b1d61 100644
--- a/contrib/bind9/lib/isc/include/isc/event.h
+++ b/contrib/bind9/lib/isc/include/isc/event.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: event.h,v 1.24.2.2.8.2 2004/04/15 02:10:41 marka Exp $ */
+/* $Id: event.h,v 1.27.18.3 2005/04/29 00:16:54 marka Exp $ */
 
 #ifndef ISC_EVENT_H
 #define ISC_EVENT_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -41,14 +43,14 @@ typedef void (*isc_eventdestructor_t)(isc_event_t *);
 	void *				ev_destroy_arg; \
 	ISC_LINK(ltype)			ev_link
 
-/*
+/*%
  * Attributes matching a mask of 0x000000ff are reserved for the task library's
  * definition.  Attributes of 0xffffff00 may be used by the application
  * or non-ISC libraries.
  */
 #define ISC_EVENTATTR_NOPURGE		0x00000001
 
-/*
+/*%
  * The ISC_EVENTATTR_CANCELED attribute is intended to indicate
  * that an event is delivered as a result of a canceled operation
  * rather than successful completion, by mutual agreement
@@ -71,7 +73,7 @@ do { \
 	ISC_LINK_INIT((event), ev_link); \
 } while (0)
 
-/*
+/*%
  * This structure is public because "subclassing" it may be useful when
  * defining new event types.
  */
@@ -89,22 +91,26 @@ ISC_LANG_BEGINDECLS
 isc_event_t *
 isc_event_allocate(isc_mem_t *mctx, void *sender, isc_eventtype_t type,
 		   isc_taskaction_t action, const void *arg, size_t size);
-/*
+/*%<
+ * Allocate an event structure. 
+ *
  * Allocate and initialize in a structure with initial elements
  * defined by:
  *
+ * \code
  *	struct {
  *		ISC_EVENT_COMMON(struct isc_event);
  *		...
  *	};
+ * \endcode
  *	
  * Requires:
- *	'size' >= sizeof(struct isc_event)
- *	'action' to be non NULL
+ *\li	'size' >= sizeof(struct isc_event)
+ *\li	'action' to be non NULL
  *
  * Returns:
- *	a pointer to a initialized structure of the requested size.
- *	NULL if unable to allocate memory.
+ *\li	a pointer to a initialized structure of the requested size.
+ *\li	NULL if unable to allocate memory.
  */
 
 void
diff --git a/contrib/bind9/lib/isc/include/isc/eventclass.h b/contrib/bind9/lib/isc/include/isc/eventclass.h
index a783d35..71de715 100644
--- a/contrib/bind9/lib/isc/include/isc/eventclass.h
+++ b/contrib/bind9/lib/isc/include/isc/eventclass.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,25 +15,28 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: eventclass.h,v 1.13.206.1 2004/03/06 08:14:40 marka Exp $ */
+/* $Id: eventclass.h,v 1.14.18.2 2005/04/29 00:16:54 marka Exp $ */
 
 #ifndef ISC_EVENTCLASS_H
 #define ISC_EVENTCLASS_H 1
 
-/*****
+/*! \file isc/eventclass.h
  ***** Registry of Predefined Event Type Classes
  *****/
 
-/*
+/*%
  * An event class is an unsigned 16 bit number.  Each class may contain up
  * to 65536 events.  An event type is formed by adding the event number
  * within the class to the class number.
+ *
  */
 
 #define ISC_EVENTCLASS(eclass)		((eclass) << 16)
 
-/*
+/*@{*/
+/*!
  * Classes < 1024 are reserved for ISC use.
+ * Event classes >= 1024 and <= 65535 are reserved for application use.
  */
 
 #define	ISC_EVENTCLASS_TASK		ISC_EVENTCLASS(0)
@@ -45,9 +48,6 @@
 #define	ISC_EVENTCLASS_OMAPI		ISC_EVENTCLASS(6)
 #define	ISC_EVENTCLASS_RATELIMITER	ISC_EVENTCLASS(7)
 #define	ISC_EVENTCLASS_ISCCC		ISC_EVENTCLASS(8)
-
-/*
- * Event classes >= 1024 and <= 65535 are reserved for application use.
- */
+/*@}*/
 
 #endif /* ISC_EVENTCLASS_H */
diff --git a/contrib/bind9/lib/isc/include/isc/file.h b/contrib/bind9/lib/isc/include/isc/file.h
index 6de6c8a..16b0075 100644
--- a/contrib/bind9/lib/isc/include/isc/file.h
+++ b/contrib/bind9/lib/isc/include/isc/file.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: file.h,v 1.24.12.3 2004/03/08 09:04:51 marka Exp $ */
+/* $Id: file.h,v 1.27.18.2 2005/04/29 00:16:54 marka Exp $ */
 
 #ifndef ISC_FILE_H
 #define ISC_FILE_H 1
 
+/*! \file */
+
 #include <stdio.h>
 
 #include <isc/lang.h>
@@ -32,81 +34,81 @@ isc_file_settime(const char *file, isc_time_t *time);
 
 isc_result_t
 isc_file_getmodtime(const char *file, isc_time_t *time);
-/*
- * Get the time of last modication of a file.
+/*!<
+ * \brief Get the time of last modication of a file.
  *
  * Notes:
- *	The time that is set is relative to the (OS-specific) epoch, as are
+ *\li	The time that is set is relative to the (OS-specific) epoch, as are
  *	all isc_time_t structures.
  *
  * Requires:
- *	file != NULL.
- *	time != NULL.
+ *\li	file != NULL.
+ *\li	time != NULL.
  *
  * Ensures:
- *	If the file could not be accessed, 'time' is unchanged.
+ *\li	If the file could not be accessed, 'time' is unchanged.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *		Success.
- *	ISC_R_NOTFOUND
+ *\li	#ISC_R_NOTFOUND
  *		No such file exists.
- *	ISC_R_INVALIDFILE
+ *\li	#ISC_R_INVALIDFILE
  *		The path specified was not usable by the operating system.
- *	ISC_R_NOPERM
+ *\li	#ISC_R_NOPERM
  *		The file's metainformation could not be retrieved because
  *		permission was denied to some part of the file's path.
- *	ISC_R_EIO
+ *\li	#ISC_R_EIO
  *		Hardware error interacting with the filesystem.
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_UNEXPECTED
  *		Something totally unexpected happened.
  *
  */
 
 isc_result_t
 isc_file_mktemplate(const char *path, char *buf, size_t buflen);
-/*
- * Generate a template string suitable for use with isc_file_openunique.
+/*!<
+ * \brief Generate a template string suitable for use with isc_file_openunique().
  *
  * Notes:
- *	This function is intended to make creating temporary files
+ *\li	This function is intended to make creating temporary files
  *	portable between different operating systems.
  *
- *	The path is prepended to an implementation-defined string and
+ *\li	The path is prepended to an implementation-defined string and
  *	placed into buf.  The string has no path characters in it,
  *	and its maximum length is 14 characters plus a NUL.  Thus
  *	buflen should be at least strlen(path) + 15 characters or
  *	an error will be returned.
  *
  * Requires:
- *	buf != NULL.
+ *\li	buf != NULL.
  *
  * Ensures:
- *	If result == ISC_R_SUCCESS:
+ *\li	If result == #ISC_R_SUCCESS:
  *		buf contains a string suitable for use as the template argument
- *		to isc_file_openunique.
+ *		to isc_file_openunique().
  *
- *	If result != ISC_R_SUCCESS:
+ *\li	If result != #ISC_R_SUCCESS:
  *		buf is unchanged.
  *
  * Returns:
- *	ISC_R_SUCCESS 	Success.
- *	ISC_R_NOSPACE	buflen indicates buf is too small for the catenation
+ *\li	#ISC_R_SUCCESS 	Success.
+ *\li	#ISC_R_NOSPACE	buflen indicates buf is too small for the catenation
  *				of the path with the internal template string.
  */
 
 
 isc_result_t
 isc_file_openunique(char *templet, FILE **fp);
-/*
- * Create and open a file with a unique name based on 'templet'.
+/*!<
+ * \brief Create and open a file with a unique name based on 'templet'.
  *
  * Notes:
- *	'template' is a reserved work in C++.  If you want to complain
+ *\li	'template' is a reserved work in C++.  If you want to complain
  *	about the spelling of 'templet', first look it up in the
  *	Merriam-Webster English dictionary. (http://www.m-w.com/)
  *
- *	This function works by using the template to generate file names.
+ *\li	This function works by using the template to generate file names.
  *	The template must be a writable string, as it is modified in place.
  *	Trailing X characters in the file name (full file name on Unix,
  *	basename on Win32 -- eg, tmp-XXXXXX vs XXXXXX.tmp, respectively)
@@ -114,95 +116,97 @@ isc_file_openunique(char *templet, FILE **fp);
  *	is found.  If the template does not include pathname information,
  *	the files in the working directory of the program are searched.
  *
- *	isc_file_mktemplate is a good, portable way to get a template.
+ *\li	isc_file_mktemplate is a good, portable way to get a template.
  *
  * Requires:
- *	'fp' is non-NULL and '*fp' is NULL.
+ *\li	'fp' is non-NULL and '*fp' is NULL.
  *
- *	'template' is non-NULL, and of a form suitable for use by
+ *\li	'template' is non-NULL, and of a form suitable for use by
  *	the system as described above.
  *
  * Ensures:
- *	If result is ISC_R_SUCCESS:
+ *\li	If result is #ISC_R_SUCCESS:
  *		*fp points to an stream opening in stdio's "w+" mode.
  *
- *	If result is not ISC_R_SUCCESS:
+ *\li	If result is not #ISC_R_SUCCESS:
  *		*fp is NULL.
  *
  *		No file is open.  Even if one was created (but unable
  *		to be reopened as a stdio FILE pointer) then it has been
  *		removed.
  *
- *	This function does *not* ensure that the template string has not been
+ *\li	This function does *not* ensure that the template string has not been
  *	modified, even if the operation was unsuccessful.
  *
  * Returns:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *		Success.
- *	ISC_R_EXISTS
+ *\li	#ISC_R_EXISTS
  *		No file with a unique name could be created based on the
  *		template.
- *	ISC_R_INVALIDFILE
+ *\li	#ISC_R_INVALIDFILE
  *		The path specified was not usable by the operating system.
- *	ISC_R_NOPERM
+ *\li	#ISC_R_NOPERM
  *		The file could not be created because permission was denied
  *		to some part of the file's path.
- *	ISC_R_EIO
+ *\li	#ISC_R_IOERROR
  *		Hardware error interacting with the filesystem.
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_UNEXPECTED
  *		Something totally unexpected happened.
  */
 
 isc_result_t
 isc_file_remove(const char *filename);
-/*
- * Remove the file named by 'filename'.
+/*!<
+ * \brief Remove the file named by 'filename'.
  */
 
 isc_result_t
 isc_file_rename(const char *oldname, const char *newname);
-/*
- * Rename the file 'oldname' to 'newname'.
+/*!<
+ * \brief Rename the file 'oldname' to 'newname'.
  */
 
 isc_boolean_t
 isc_file_exists(const char *pathname);
-/*
- * Return ISC_TRUE iff the calling process can tell that the given file exists.
+/*!<
+ * \brief Return #ISC_TRUE if the calling process can tell that the given file exists.
  * Will not return true if the calling process has insufficient privileges
  * to search the entire path.
  */
 
 isc_boolean_t
 isc_file_isabsolute(const char *filename);
-/*
- * Return ISC_TRUE iff the given file name is absolute.
+/*!<
+ * \brief Return #ISC_TRUE if the given file name is absolute.
  */
 
 isc_boolean_t
 isc_file_iscurrentdir(const char *filename);
-/*
- * Return ISC_TRUE iff the given file name is the current directory (".").
+/*!<
+ * \brief Return #ISC_TRUE if the given file name is the current directory (".").
  */
 
 isc_boolean_t
 isc_file_ischdiridempotent(const char *filename);
-/*
- * Return ISC_TRUE if calling chdir(filename) multiple times will give
+/*%<
+ * Return #ISC_TRUE if calling chdir(filename) multiple times will give
  * the same result as calling it once.
  */
 
 const char *
 isc_file_basename(const char *filename);
-/*
+/*%<
  * Return the final component of the path in the file name.
  */
 
 isc_result_t
 isc_file_progname(const char *filename, char *buf, size_t buflen);
-/*
- * Given an operating system specific file name "filename"
+/*!<
+ * \brief Given an operating system specific file name "filename"
  * referring to a program, return the canonical program name. 
+ *
+ *
  * Any directory prefix or executable file name extension (if
  * used on the OS in case) is stripped.  On systems where program
  * names are case insensitive, the name is canonicalized to all
@@ -210,14 +214,14 @@ isc_file_progname(const char *filename, char *buf, size_t buflen);
  * chars, and null terminated.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE 	The name did not fit in 'buf'.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE 	The name did not fit in 'buf'.
  */
 
 isc_result_t
 isc_file_template(const char *path, const char *templet, char *buf,
 		  size_t buflen);
-/*
+/*%<
  * Create an OS specific template using 'path' to define the directory
  * 'templet' to describe the filename and store the result in 'buf'
  * such that path can be renamed to buf atomically.
@@ -225,13 +229,13 @@ isc_file_template(const char *path, const char *templet, char *buf,
 
 isc_result_t
 isc_file_renameunique(const char *file, char *templet);
-/*
+/*%<
  * Rename 'file' using 'templet' as a template for the new file name.
  */
 
 isc_result_t
 isc_file_absolutepath(const char *filename, char *path, size_t pathlen);
-/*
+/*%<
  * Given a file name, return the fully qualified path to the file.
  */
 
@@ -243,7 +247,7 @@ isc_file_absolutepath(const char *filename, char *path, size_t pathlen);
 
 isc_result_t
 isc_file_truncate(const char *filename, isc_offset_t size);
-/*
+/*%<
  * Truncate/extend the file specified to 'size' bytes.
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/formatcheck.h b/contrib/bind9/lib/isc/include/isc/formatcheck.h
index a7f26c1..93c6232 100644
--- a/contrib/bind9/lib/isc/include/isc/formatcheck.h
+++ b/contrib/bind9/lib/isc/include/isc/formatcheck.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,15 +15,21 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: formatcheck.h,v 1.6.206.1 2004/03/06 08:14:41 marka Exp $ */
+/* $Id: formatcheck.h,v 1.7.18.2 2005/04/29 00:16:54 marka Exp $ */
 
 #ifndef ISC_FORMATCHECK_H
 #define ISC_FORMATCHECK_H 1
 
-/*
- * fmt is the location of the format string parameter.
- * args is the location of the first argument (or 0 for no argument checking).
- * Note: the first parameter is 1, not 0.
+/*! \file */
+
+/*%
+ * ISC_FORMAT_PRINTF().
+ *
+ * \li fmt is the location of the format string parameter.
+ * \li args is the location of the first argument (or 0 for no argument checking).
+ * 
+ * Note:
+ * \li The first parameter is 1, not 0.
  */
 #ifdef __GNUC__
 #define ISC_FORMAT_PRINTF(fmt, args) __attribute__((__format__(__printf__, fmt, args)))
diff --git a/contrib/bind9/lib/isc/include/isc/fsaccess.h b/contrib/bind9/lib/isc/include/isc/fsaccess.h
index 0f0c8ce..70c4d7c 100644
--- a/contrib/bind9/lib/isc/include/isc/fsaccess.h
+++ b/contrib/bind9/lib/isc/include/isc/fsaccess.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,13 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: fsaccess.h,v 1.7.206.1 2004/03/06 08:14:41 marka Exp $ */
+/* $Id: fsaccess.h,v 1.8.18.2 2005/04/29 00:16:55 marka Exp $ */
 
 #ifndef ISC_FSACCESS_H
 #define ISC_FSACCESS_H 1
 
-/*
- * The ISC filesystem access module encapsulates the setting of file
+/*! \file
+ * \brief The ISC filesystem access module encapsulates the setting of file
  * and directory access permissions into one API that is meant to be
  * portable to multiple operating systems.
  *
@@ -41,30 +41,30 @@
  *
  * Some of the more notable dumbing down of NT for this API includes:
  *
- *   o Each of FILE_READ_DATA and FILE_READ_EA are set with ISC_FSACCESS_READ.
+ *\li   Each of FILE_READ_DATA and FILE_READ_EA are set with #ISC_FSACCESS_READ.
  *
- *   o All of FILE_WRITE_DATA, FILE_WRITE_EA and FILE_APPEND_DATA are
- *     set with ISC_FSACCESS_WRITE.  FILE_WRITE_ATTRIBUTES is not set
+ * \li  All of FILE_WRITE_DATA, FILE_WRITE_EA and FILE_APPEND_DATA are
+ *     set with #ISC_FSACCESS_WRITE.  FILE_WRITE_ATTRIBUTES is not set
  *     so as to be consistent with Unix, where only the owner of the file
  *     or the superuser can change the attributes/mode of a file.
  *
- *   o Both of FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY are set with
- *     ISC_FSACCESS_CREATECHILD.  This is similar to setting the WRITE
+ * \li  Both of FILE_ADD_FILE and FILE_ADD_SUBDIRECTORY are set with
+ *     #ISC_FSACCESS_CREATECHILD.  This is similar to setting the WRITE
  *     permission on a Unix directory.
  *
- *   o SYNCHRONIZE is always set for files and directories, unless someone
+ * \li  SYNCHRONIZE is always set for files and directories, unless someone
  *     can give me a reason why this is a bad idea.
  *
- *   o READ_CONTROL and FILE_READ_ATTRIBUTES are always set; this is
+ * \li  READ_CONTROL and FILE_READ_ATTRIBUTES are always set; this is
  *     consistent with Unix, where any file or directory can be stat()'d
  *     unless the directory path disallows complete access somewhere along
  *     the way.
  *
- *   o WRITE_DAC is only set for the owner.  This too is consistent with
+ * \li  WRITE_DAC is only set for the owner.  This too is consistent with
  *     Unix, and is tighter security than allowing anyone else to be
  *     able to set permissions.
  *
- *   o DELETE is only set for the owner.  On Unix the ability to delete
+ * \li  DELETE is only set for the owner.  On Unix the ability to delete
  *     a file is controlled by the directory permissions, but it isn't
  *     currently clear to me what happens on NT if the directory has
  *     FILE_DELETE_CHILD set but a file within it does not have DELETE
@@ -72,19 +72,19 @@
  *     gives maximum flexibility to the owner without exposing the
  *     file to deletion by others.
  *
- *   o WRITE_OWNER is never set.  This too is consistent with Unix,
+ * \li  WRITE_OWNER is never set.  This too is consistent with Unix,
  *     and is also tighter security than allowing anyone to change the
  *     ownership of the file apart from the superu..ahem, Administrator.
  *
- *   o Inheritance is set to NO_INHERITANCE.
+ * \li  Inheritance is set to NO_INHERITANCE.
  *
  * Unix's dumbing down includes:
  *
- *   o The sticky bit cannot be set.
+ * \li  The sticky bit cannot be set.
  *
- *   o setuid and setgid cannot be set.
+ * \li  setuid and setgid cannot be set.
  *
- *   o Only regular files and directories can be set.
+ * \li  Only regular files and directories can be set.
  *
  * The rest of this comment discusses a few of the incompatibilities
  * between the two systems that need more thought if this API is to
@@ -103,24 +103,24 @@
  * set on a directory.  You'd need to coordinate something with file creation
  * so that every file created had DELETE set for the owner but noone else.
  *
- * On Unix systems, setting ISC_FSACCESS_LISTDIRECTORY sets READ.
- * ... setting either of ISC_FSACCESS_(CREATE|DELETE)CHILD sets WRITE.
- * ... setting ISC_FSACCESS_ACCESSCHILD sets EXECUTE.
+ * On Unix systems, setting #ISC_FSACCESS_LISTDIRECTORY sets READ.
+ * ... setting either of #ISC_FSACCESS_(CREATE|DELETE)CHILD sets WRITE.
+ * ... setting #ISC_FSACCESS_ACCESSCHILD sets EXECUTE.
  *
- * On NT systems, setting ISC_FSACCESS_LISTDIRECTORY sets FILE_LIST_DIRECTORY.
+ * On NT systems, setting #ISC_FSACCESS_LISTDIRECTORY sets FILE_LIST_DIRECTORY.
  * ... setting ISC_FSACCESS_(CREATE|DELETE)CHILD sets
  *	FILE_(CREATE|DELETE)_CHILD independently.
- * ... setting ISC_FSACCESS_ACCESSCHILD sets FILE_TRAVERSE.
+ * ... setting #ISC_FSACCESS_ACCESSCHILD sets FILE_TRAVERSE.
  *
  * Unresolved:							XXXDCL
- *   What NT access right controls the ability to rename a file?
- *   How does DELETE work?  If a directory has FILE_DELETE_CHILD but a
+ * \li  What NT access right controls the ability to rename a file?
+ * \li  How does DELETE work?  If a directory has FILE_DELETE_CHILD but a
  *      file or directory within it does not have DELETE, is that file
  *	or directory deletable?
- *   To implement isc_fsaccess_get(), mapping an existing Unix permission
+ * \li  To implement isc_fsaccess_get(), mapping an existing Unix permission
  * 	mode_t back to an isc_fsaccess_t is pretty trivial; however, mapping
  *	an NT DACL could be impossible to do in a responsible way.
- *   Similarly, trying to implement the functionality of being able to
+ * \li  Similarly, trying to implement the functionality of being able to
  *	say "add group writability to whatever permissions already exist"
  *	could be tricky on NT because of the order-of-entry issue combined
  *	with possibly having one or more matching ACEs already explicitly
@@ -135,23 +135,23 @@
 /*
  * Trustees.
  */
-#define ISC_FSACCESS_OWNER	0x1 /* User account. */
-#define ISC_FSACCESS_GROUP	0x2 /* Primary group owner. */
-#define ISC_FSACCESS_OTHER	0x4 /* Not the owner or the group owner. */
-#define ISC_FSACCESS_WORLD	0x7 /* User, Group, Other. */
+#define ISC_FSACCESS_OWNER	0x1 /*%< User account. */
+#define ISC_FSACCESS_GROUP	0x2 /*%< Primary group owner. */
+#define ISC_FSACCESS_OTHER	0x4 /*%< Not the owner or the group owner. */
+#define ISC_FSACCESS_WORLD	0x7 /*%< User, Group, Other. */
 
 /*
  * Types of permission.
  */
-#define ISC_FSACCESS_READ		0x00000001 /* File only. */
-#define ISC_FSACCESS_WRITE		0x00000002 /* File only. */
-#define ISC_FSACCESS_EXECUTE		0x00000004 /* File only. */
-#define ISC_FSACCESS_CREATECHILD	0x00000008 /* Dir only. */
-#define ISC_FSACCESS_DELETECHILD	0x00000010 /* Dir only. */
-#define ISC_FSACCESS_LISTDIRECTORY	0x00000020 /* Dir only. */
-#define ISC_FSACCESS_ACCESSCHILD	0x00000040 /* Dir only. */
+#define ISC_FSACCESS_READ		0x00000001 /*%< File only. */
+#define ISC_FSACCESS_WRITE		0x00000002 /*%< File only. */
+#define ISC_FSACCESS_EXECUTE		0x00000004 /*%< File only. */
+#define ISC_FSACCESS_CREATECHILD	0x00000008 /*%< Dir only. */
+#define ISC_FSACCESS_DELETECHILD	0x00000010 /*%< Dir only. */
+#define ISC_FSACCESS_LISTDIRECTORY	0x00000020 /*%< Dir only. */
+#define ISC_FSACCESS_ACCESSCHILD	0x00000040 /*%< Dir only. */
 
-/*
+/*%
  * Adding any permission bits beyond 0x200 would mean typedef'ing
  * isc_fsaccess_t as isc_uint64_t, and redefining this value to
  * reflect the new range of permission types, Probably to 21 for
diff --git a/contrib/bind9/lib/isc/include/isc/hash.h b/contrib/bind9/lib/isc/include/isc/hash.h
index b94142b..cd29cdf 100644
--- a/contrib/bind9/lib/isc/include/isc/hash.h
+++ b/contrib/bind9/lib/isc/include/isc/hash.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: hash.h,v 1.2.2.1.2.2 2004/03/06 08:14:41 marka Exp $ */
+/* $Id: hash.h,v 1.4.18.2 2005/04/29 00:16:55 marka Exp $ */
 
 #ifndef ISC_HASH_H
 #define ISC_HASH_H 1
@@ -24,12 +24,10 @@
  ***** Module Info
  *****/
 
-/*
- * Hash
- *
- * The hash API
+/*! \file
  *
- *	Provides an unpredictable hash value for variable length data.
+ * \brief The hash API
+ *	provides an unpredictable hash value for variable length data.
  *	A hash object contains a random vector (which is hidden from clients
  *	of this API) to make the actual hash value unpredictable.
  *
@@ -48,27 +46,27 @@
  *	it should be typical to have a single context for an entire system.
  *	To support such cases, the API also provides a single-context mode.
  *
- * MP:
+ * \li MP:
  *	The hash object is almost read-only.  Once the internal random vector
  *	is initialized, no write operation will occur, and there will be no
  *	need to lock the object to calculate actual hash values.
  *
- * Reliability:
+ * \li Reliability:
  *	In some cases this module uses low-level data copy to initialize the
  *	random vector.  Errors in this part are likely to crash the server or
  *	corrupt memory.
  *
- * Resources:
+ * \li Resources:
  *	A buffer, used as a random vector for calculating hash values.
  *
- * Security:
+ * \li Security:
  *	This module intends to provide unpredictable hash values in
  *	adversarial environments in order to avoid denial of service attacks
  *	to hash buckets.
  *	Its unpredictability relies on the quality of entropy to build the
  *	random vector.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -88,10 +86,11 @@ isc_hash_ctxcreate(isc_mem_t *mctx, isc_entropy_t *entropy, unsigned int limit,
 		   isc_hash_t **hctx);
 isc_result_t
 isc_hash_create(isc_mem_t *mctx, isc_entropy_t *entropy, size_t limit);
-/*
- * Create a new hash object.
+/*!<
+ * \brief Create a new hash object.
  *
  * isc_hash_ctxcreate() creates a different object.
+ *
  * isc_hash_create() creates a module-internal object to support the
  * single-context mode.  It should be called only once.
  *
@@ -105,15 +104,16 @@ isc_hash_create(isc_mem_t *mctx, isc_entropy_t *entropy, size_t limit);
 
 void
 isc_hash_ctxattach(isc_hash_t *hctx, isc_hash_t **hctxp);
-/*
- * Attach to a hash object.
+/*!<
+ * \brief Attach to a hash object.
+ *
  * This function is only necessary for the multiple-context mode.
  */
 
 void
 isc_hash_ctxdetach(isc_hash_t **hctxp);
-/*
- * Detach from a hash object.
+/*!<
+ * \brief Detach from a hash object.
  *
  * This function  is for the multiple-context mode, and takes a valid
  * hash object as an argument.
@@ -121,19 +121,23 @@ isc_hash_ctxdetach(isc_hash_t **hctxp);
 
 void
 isc_hash_destroy(void);
-/*
- * This function is for the single-context mode, and is expected to be used
+/*!<
+ * \brief This function is for the single-context mode, and is expected to be used
  * as a counterpart of isc_hash_create().
+ *
  * A valid module-internal hash object must have been created, and this
  * function should be called only once.
  */
 
+/*@{*/
 void
 isc_hash_ctxinit(isc_hash_t *hctx);
 void
 isc_hash_init(void);
-/*
- * Initialize a hash object.  It fills in the random vector with a proper
+/*!<
+ * \brief Initialize a hash object.  
+ *
+ * It fills in the random vector with a proper
  * source of entropy, which is typically from the entropy object specified
  * at the creation.  Thus, it is desirable to call these functions after
  * initializing the entropy object with some good entropy sources.
@@ -142,26 +146,31 @@ isc_hash_init(void);
  *
  * isc_hash_ctxinit() is for the multiple-context mode, and takes a valid hash
  * object as an argument.
+ *
  * isc_hash_init() is for the single-context mode.  A valid module-internal
  * hash object must have been created, and this function should be called only
  * once.
  */
+/*@}*/
 
+/*@{*/
 unsigned int
 isc_hash_ctxcalc(isc_hash_t *hctx, const unsigned char *key,
 		 unsigned int keylen, isc_boolean_t case_sensitive);
 unsigned int
 isc_hash_calc(const unsigned char *key, unsigned int keylen,
 	      isc_boolean_t case_sensitive);
-/*
- * Calculate a hash value.
+/*!<
+ * \brief Calculate a hash value.
  *
  * isc_hash_ctxinit() is for the multiple-context mode, and takes a valid hash
  * object as an argument.
+ *
  * isc_hash_init() is for the single-context mode.  A valid module-internal
  * hash object must have been created.
  *
  * 'key' is the hash key, which is a variable length buffer.
+ *
  * 'keylen' specifies the key length, which must not be larger than the limit
  * specified for the corresponding hash object.
  *
@@ -169,6 +178,7 @@ isc_hash_calc(const unsigned char *key, unsigned int keylen,
  * case_sensitive values.  It should typically be ISC_FALSE if the hash key
  * is a DNS name.
  */
+/*@}*/
 
 ISC_LANG_ENDDECLS
 
diff --git a/contrib/bind9/lib/isc/include/isc/heap.h b/contrib/bind9/lib/isc/include/isc/heap.h
index 7c7f3c2..d54a8d5 100644
--- a/contrib/bind9/lib/isc/include/isc/heap.h
+++ b/contrib/bind9/lib/isc/include/isc/heap.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: heap.h,v 1.16.206.2 2006/04/17 18:27:20 explorer Exp $ */
+/* $Id: heap.h,v 1.17.18.3 2006/04/17 18:27:33 explorer Exp $ */
 
 #ifndef ISC_HEAP_H
 #define ISC_HEAP_H 1
diff --git a/contrib/bind9/lib/isc/include/isc/hex.h b/contrib/bind9/lib/isc/include/isc/hex.h
index cf7dfd0..9124a9b 100644
--- a/contrib/bind9/lib/isc/include/isc/hex.h
+++ b/contrib/bind9/lib/isc/include/isc/hex.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: hex.h,v 1.4.206.1 2004/03/06 08:14:41 marka Exp $ */
+/* $Id: hex.h,v 1.5.18.2 2005/04/29 00:16:55 marka Exp $ */
 
 #ifndef ISC_HEX_H
 #define ISC_HEX_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -32,40 +34,40 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 isc_hex_totext(isc_region_t *source, int wordlength,
 	       const char *wordbreak, isc_buffer_t *target);
-/*
- * Convert data into hex encoded text.
+/*!<
+ * \brief Convert data into hex encoded text.
  *
  * Notes:
- *	The hex encoded text in 'target' will be divided into
+ *\li	The hex encoded text in 'target' will be divided into
  *	words of at most 'wordlength' characters, separated by
  * 	the 'wordbreak' string.  No parentheses will surround
  *	the text.
  *
  * Requires:
- *	'source' is a region containing binary data
- *	'target' is a text buffer containing available space
- *	'wordbreak' points to a null-terminated string of
+ *\li	'source' is a region containing binary data
+ *\li	'target' is a text buffer containing available space
+ *\li	'wordbreak' points to a null-terminated string of
  *		zero or more whitespace characters
  *
  * Ensures:
- *	target will contain the hex encoded version of the data
+ *\li	target will contain the hex encoded version of the data
  *	in source.  The 'used' pointer in target will be advanced as
  *	necessary.
  */
 
 isc_result_t
 isc_hex_decodestring(char *cstr, isc_buffer_t *target);
-/*
- * Decode a null-terminated hex string.
+/*!<
+ * \brief Decode a null-terminated hex string.
  *
  * Requires:
- *	'cstr' is non-null.
- *	'target' is a valid buffer.
+ *\li	'cstr' is non-null.
+ *\li	'target' is a valid buffer.
  *
  * Returns:
- *	ISC_R_SUCCESS	-- the entire decoded representation of 'cstring'
+ *\li	#ISC_R_SUCCESS	-- the entire decoded representation of 'cstring'
  *			   fit in 'target'.
- *	ISC_R_BADHEX -- 'cstr' is not a valid hex encoding.
+ *\li	#ISC_R_BADHEX -- 'cstr' is not a valid hex encoding.
  *
  * 	Other error returns are any possible error code from:
  *		isc_lex_create(),
@@ -75,16 +77,16 @@ isc_hex_decodestring(char *cstr, isc_buffer_t *target);
 
 isc_result_t
 isc_hex_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length);
-/*
- * Convert hex encoded text from a lexer context into data.
+/*!<
+ * \brief Convert hex encoded text from a lexer context into data.
  *
  * Requires:
- *	'lex' is a valid lexer context
- *	'target' is a buffer containing binary data
- *	'length' is an integer
+ *\li	'lex' is a valid lexer context
+ *\li	'target' is a buffer containing binary data
+ *\li	'length' is an integer
  *
  * Ensures:
- *	target will contain the data represented by the hex encoded
+ *\li	target will contain the data represented by the hex encoded
  *	string parsed by the lexer.  No more than length bytes will be read,
  *	if length is positive.  The 'used' pointer in target will be
  *	advanced as necessary.
diff --git a/contrib/bind9/lib/isc/include/isc/hmacmd5.h b/contrib/bind9/lib/isc/include/isc/hmacmd5.h
index 6e8647f..5c05675 100644
--- a/contrib/bind9/lib/isc/include/isc/hmacmd5.h
+++ b/contrib/bind9/lib/isc/include/isc/hmacmd5.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: hmacmd5.h,v 1.4.206.1 2004/03/06 08:14:42 marka Exp $ */
+/* $Id: hmacmd5.h,v 1.5.18.4 2006/01/27 23:57:45 marka Exp $ */
 
-/*
- * This is the header file for the HMAC-MD5 keyed hash algorithm
- * described in RFC 2104.
+/*! \file
+ * \brief This is the header file for the HMAC-MD5 keyed hash algorithm
+ * described in RFC2104.
  */
 
 #ifndef ISC_HMACMD5_H
@@ -55,6 +55,9 @@ isc_hmacmd5_sign(isc_hmacmd5_t *ctx, unsigned char *digest);
 isc_boolean_t
 isc_hmacmd5_verify(isc_hmacmd5_t *ctx, unsigned char *digest);
 
+isc_boolean_t
+isc_hmacmd5_verify2(isc_hmacmd5_t *ctx, unsigned char *digest, size_t len);
+
 ISC_LANG_ENDDECLS
 
 #endif /* ISC_HMACMD5_H */
diff --git a/contrib/bind9/lib/isc/include/isc/hmacsha.h b/contrib/bind9/lib/isc/include/isc/hmacsha.h
new file mode 100644
index 0000000..fce645c5
--- /dev/null
+++ b/contrib/bind9/lib/isc/include/isc/hmacsha.h
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2005, 2006  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: hmacsha.h,v 1.2.2.3 2006/08/16 03:18:14 marka Exp $ */
+
+/*
+ * This is the header file for the HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
+ * HMAC-SHA334 and HMAC-SHA512 hash algorithm described in RFC 2104.
+ */
+
+#ifndef ISC_HMACSHA_H
+#define ISC_HMACSHA_H 1
+
+#include <isc/lang.h>
+#include <isc/sha1.h>
+#include <isc/sha2.h>
+#include <isc/types.h>
+
+#define ISC_HMACSHA1_KEYLENGTH ISC_SHA1_BLOCK_LENGTH
+#define ISC_HMACSHA224_KEYLENGTH ISC_SHA224_BLOCK_LENGTH
+#define ISC_HMACSHA256_KEYLENGTH ISC_SHA256_BLOCK_LENGTH
+#define ISC_HMACSHA384_KEYLENGTH ISC_SHA384_BLOCK_LENGTH
+#define ISC_HMACSHA512_KEYLENGTH ISC_SHA512_BLOCK_LENGTH
+
+typedef struct {
+	isc_sha1_t sha1ctx;
+	unsigned char key[ISC_HMACSHA1_KEYLENGTH];
+} isc_hmacsha1_t;
+
+typedef struct {
+	isc_sha224_t sha224ctx;
+	unsigned char key[ISC_HMACSHA224_KEYLENGTH];
+} isc_hmacsha224_t;
+
+typedef struct {
+	isc_sha256_t sha256ctx;
+	unsigned char key[ISC_HMACSHA256_KEYLENGTH];
+} isc_hmacsha256_t;
+
+typedef struct {
+	isc_sha384_t sha384ctx;
+	unsigned char key[ISC_HMACSHA384_KEYLENGTH];
+} isc_hmacsha384_t;
+
+typedef struct {
+	isc_sha512_t sha512ctx;
+	unsigned char key[ISC_HMACSHA512_KEYLENGTH];
+} isc_hmacsha512_t;
+
+ISC_LANG_BEGINDECLS
+
+void
+isc_hmacsha1_init(isc_hmacsha1_t *ctx, const unsigned char *key,
+		  unsigned int len);
+
+void
+isc_hmacsha1_invalidate(isc_hmacsha1_t *ctx);
+
+void
+isc_hmacsha1_update(isc_hmacsha1_t *ctx, const unsigned char *buf,
+		    unsigned int len);
+
+void
+isc_hmacsha1_sign(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len);
+
+isc_boolean_t
+isc_hmacsha1_verify(isc_hmacsha1_t *ctx, unsigned char *digest, size_t len);
+
+
+void
+isc_hmacsha224_init(isc_hmacsha224_t *ctx, const unsigned char *key,
+		    unsigned int len);
+
+void
+isc_hmacsha224_invalidate(isc_hmacsha224_t *ctx);
+
+void
+isc_hmacsha224_update(isc_hmacsha224_t *ctx, const unsigned char *buf,
+		      unsigned int len);
+
+void
+isc_hmacsha224_sign(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len);
+
+isc_boolean_t
+isc_hmacsha224_verify(isc_hmacsha224_t *ctx, unsigned char *digest, size_t len);
+
+
+void
+isc_hmacsha256_init(isc_hmacsha256_t *ctx, const unsigned char *key,
+		    unsigned int len);
+
+void
+isc_hmacsha256_invalidate(isc_hmacsha256_t *ctx);
+
+void
+isc_hmacsha256_update(isc_hmacsha256_t *ctx, const unsigned char *buf,
+		      unsigned int len);
+
+void
+isc_hmacsha256_sign(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len);
+
+isc_boolean_t
+isc_hmacsha256_verify(isc_hmacsha256_t *ctx, unsigned char *digest, size_t len);
+
+
+void
+isc_hmacsha384_init(isc_hmacsha384_t *ctx, const unsigned char *key,
+		    unsigned int len);
+
+void
+isc_hmacsha384_invalidate(isc_hmacsha384_t *ctx);
+
+void
+isc_hmacsha384_update(isc_hmacsha384_t *ctx, const unsigned char *buf,
+		      unsigned int len);
+
+void
+isc_hmacsha384_sign(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len);
+
+isc_boolean_t
+isc_hmacsha384_verify(isc_hmacsha384_t *ctx, unsigned char *digest, size_t len);
+
+
+void
+isc_hmacsha512_init(isc_hmacsha512_t *ctx, const unsigned char *key,
+		    unsigned int len);
+
+void
+isc_hmacsha512_invalidate(isc_hmacsha512_t *ctx);
+
+void
+isc_hmacsha512_update(isc_hmacsha512_t *ctx, const unsigned char *buf,
+		      unsigned int len);
+
+void
+isc_hmacsha512_sign(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len);
+
+isc_boolean_t
+isc_hmacsha512_verify(isc_hmacsha512_t *ctx, unsigned char *digest, size_t len);
+
+ISC_LANG_ENDDECLS
+
+#endif /* ISC_HMACSHA_H */
diff --git a/contrib/bind9/lib/isc/include/isc/interfaceiter.h b/contrib/bind9/lib/isc/include/isc/interfaceiter.h
index 3a9b21b..12ec188 100644
--- a/contrib/bind9/lib/isc/include/isc/interfaceiter.h
+++ b/contrib/bind9/lib/isc/include/isc/interfaceiter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: interfaceiter.h,v 1.10.206.1 2004/03/06 08:14:42 marka Exp $ */
+/* $Id: interfaceiter.h,v 1.11.18.2 2005/04/29 00:16:55 marka Exp $ */
 
 #ifndef ISC_INTERFACEITER_H
 #define ISC_INTERFACEITER_H 1
@@ -24,10 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * Interface iterator
- *
- * Iterate over the list of network interfaces.
+/*! \file
+ * \brief Iterates over the list of network interfaces.
  *
  * Interfaces whose address family is not supported are ignored and never
  * returned by the iterator.  Interfaces whose netmask, interface flags,
@@ -46,25 +44,26 @@
 #include <isc/netaddr.h>
 #include <isc/types.h>
 
-/*
- * Public structure describing a network interface.
+/*!
+ * \brief Public structure describing a network interface.
  */
 
 struct isc_interface {
-	char name[32];			/* Interface name, null-terminated. */
-	unsigned int af;		/* Address family. */
-	isc_netaddr_t address;		/* Local address. */
-	isc_netaddr_t netmask;		/* Network mask. */
-	isc_netaddr_t dstaddress; 	/* Destination address
-					   (point-to-point only). */
-	isc_uint32_t flags;		/* Flags; see below. */
+	char name[32];			/*%< Interface name, null-terminated. */
+	unsigned int af;		/*%< Address family. */
+	isc_netaddr_t address;		/*%< Local address. */
+	isc_netaddr_t netmask;		/*%< Network mask. */
+	isc_netaddr_t dstaddress; 	/*%< Destination address (point-to-point only). */
+	isc_uint32_t flags;		/*%< Flags; see INTERFACE flags. */
 };
 
-/* Interface flags. */
+/*@{*/
+/*! Interface flags. */
 
 #define INTERFACE_F_UP			0x00000001U
 #define INTERFACE_F_POINTTOPOINT	0x00000002U
 #define INTERFACE_F_LOOPBACK		0x00000004U
+/*@}*/
 
 /***
  *** Functions
@@ -74,59 +73,59 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_interfaceiter_create(isc_mem_t *mctx, isc_interfaceiter_t **iterp);
-/*
- * Create an iterator for traversing the operating system's list
+/*!<
+ * \brief Create an iterator for traversing the operating system's list
  * of network interfaces.
  *
  * Returns:
- *	ISC_R_SUCCESS
- * 	ISC_R_NOMEMORY
- *	Various network-related errors
+ *\li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
+ *\li	Various network-related errors
  */
 
 isc_result_t
 isc_interfaceiter_first(isc_interfaceiter_t *iter);
-/*
- * Position the iterator on the first interface.
+/*!<
+ * \brief Position the iterator on the first interface.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success.
- *	ISC_R_NOMORE		There are no interfaces.
+ *\li	#ISC_R_SUCCESS		Success.
+ *\li	#ISC_R_NOMORE		There are no interfaces.
  */
 
 isc_result_t
 isc_interfaceiter_current(isc_interfaceiter_t *iter,
 			  isc_interface_t *ifdata);
-/*
- * Get information about the interface the iterator is currently
+/*!<
+ * \brief Get information about the interface the iterator is currently
  * positioned at and store it at *ifdata.
  *
  * Requires:
- * 	The iterator has been successfully positioned using
+ *\li 	The iterator has been successfully positioned using
  * 	isc_interface_iter_first() / isc_interface_iter_next().
  *
  * Returns:
- *	ISC_R_SUCCESS		Success.
+ *\li	#ISC_R_SUCCESS		Success.
  */
 
 isc_result_t
 isc_interfaceiter_next(isc_interfaceiter_t *iter);
-/*
- * Position the iterator on the next interface.
+/*!<
+ * \brief Position the iterator on the next interface.
  *
  * Requires:
- * 	The iterator has been successfully positioned using
+ * \li	The iterator has been successfully positioned using
  * 	isc_interface_iter_first() / isc_interface_iter_next().
  *
  * Returns:
- *	ISC_R_SUCCESS		Success.
- *	ISC_R_NOMORE		There are no more interfaces.
+ *\li	#ISC_R_SUCCESS		Success.
+ *\li	#ISC_R_NOMORE		There are no more interfaces.
  */
 
 void
 isc_interfaceiter_destroy(isc_interfaceiter_t **iterp);
-/*
- * Destroy the iterator.
+/*!<
+ * \brief Destroy the iterator.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/ipv6.h b/contrib/bind9/lib/isc/include/isc/ipv6.h
index 8b4b0eb..7c88f2b 100644
--- a/contrib/bind9/lib/isc/include/isc/ipv6.h
+++ b/contrib/bind9/lib/isc/include/isc/ipv6.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,12 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ipv6.h,v 1.17.12.4 2004/03/09 05:21:09 marka Exp $ */
+/* $Id: ipv6.h,v 1.20.18.2 2005/04/29 00:16:56 marka Exp $ */
 
 #ifndef ISC_IPV6_H
 #define ISC_IPV6_H 1
 
-/*
+/*!
  * Also define LWRES_IPV6_H to keep it from being included if liblwres is
  * being used, or redefinition errors will occur.
  */
@@ -30,23 +30,23 @@
  ***** Module Info
  *****/
 
-/*
- * IPv6 definitions for systems which do not support IPv6.
+/*! \file isc/ipv6.h
+ * \brief IPv6 definitions for systems which do not support IPv6.
  *
- * MP:
+ * \li MP:
  *	No impact.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
+ * \li Resources:
  *	N/A.
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
- *	RFC 2553.
+ * \li Standards:
+ *	RFC2553.
  */
 
 /***
@@ -95,7 +95,7 @@ struct sockaddr_in6 {
 #define SIN6_LEN 1
 #endif
 
-/*
+/*%
  * Unspecified
  */
 #define IN6_IS_ADDR_UNSPECIFIED(a)      \
@@ -104,7 +104,7 @@ struct sockaddr_in6 {
          ((a)->s6_addr32[2] == 0) &&    \
          ((a)->s6_addr32[3] == 0))
 
-/*
+/*%
  * Loopback
  */
 #define IN6_IS_ADDR_LOOPBACK(a)         \
@@ -113,7 +113,7 @@ struct sockaddr_in6 {
          ((a)->s6_addr32[2] == 0) &&    \
          ((a)->s6_addr32[3] == htonl(1)))
 
-/*
+/*%
  * IPv4 compatible
  */
 #define IN6_IS_ADDR_V4COMPAT(a)         \
@@ -123,7 +123,7 @@ struct sockaddr_in6 {
          ((a)->s6_addr32[3] != 0) &&    \
          ((a)->s6_addr32[3] != htonl(1)))
 
-/*
+/*%
  * Mapped
  */
 #define IN6_IS_ADDR_V4MAPPED(a)               \
@@ -131,13 +131,13 @@ struct sockaddr_in6 {
          ((a)->s6_addr32[1] == 0) &&          \
          ((a)->s6_addr32[2] == htonl(0x0000ffff)))
 
-/*
+/*%
  * Multicast
  */
 #define IN6_IS_ADDR_MULTICAST(a)	\
 	((a)->s6_addr8[0] == 0xffU)
 
-/*
+/*%
  * Unicast link / site local.
  */
 #define IN6_IS_ADDR_LINKLOCAL(a)	\
diff --git a/contrib/bind9/lib/isc/include/isc/lang.h b/contrib/bind9/lib/isc/include/isc/lang.h
index f94f123..abe16f5 100644
--- a/contrib/bind9/lib/isc/include/isc/lang.h
+++ b/contrib/bind9/lib/isc/include/isc/lang.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lang.h,v 1.6.206.1 2004/03/06 08:14:42 marka Exp $ */
+/* $Id: lang.h,v 1.7.18.2 2005/04/29 00:16:56 marka Exp $ */
 
 #ifndef ISC_LANG_H
 #define ISC_LANG_H 1
 
+/*! \file */
+
 #ifdef __cplusplus
 #define ISC_LANG_BEGINDECLS	extern "C" {
 #define ISC_LANG_ENDDECLS	}
diff --git a/contrib/bind9/lib/isc/include/isc/lex.h b/contrib/bind9/lib/isc/include/isc/lex.h
index 29bdb2f..8c6624a 100644
--- a/contrib/bind9/lib/isc/include/isc/lex.h
+++ b/contrib/bind9/lib/isc/include/isc/lex.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lex.h,v 1.26.2.2.8.3 2004/03/08 09:04:51 marka Exp $ */
+/* $Id: lex.h,v 1.30.18.3 2005/06/04 00:39:05 marka Exp $ */
 
 #ifndef ISC_LEX_H
 #define ISC_LEX_H 1
@@ -24,28 +24,26 @@
  ***** Module Info
  *****/
 
-/*
- * Lex
- *
- * The "lex" module provides a lightweight tokenizer.  It can operate
+/*! \file isc/lex.h
+ * \brief The "lex" module provides a lightweight tokenizer.  It can operate
  * on files or buffers, and can handle "include".  It is designed for
  * parsing of DNS master files and the BIND configuration file, but
  * should be general enough to tokenize other things, e.g. HTTP.
  *
- * MP:
+ * \li MP:
  *	No synchronization is provided.  Clients must ensure exclusive
  *	access.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
- *	<TBS>
+ * \li Resources:
+ *	TBS
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  * 	None.
  */
 
@@ -65,31 +63,36 @@ ISC_LANG_BEGINDECLS
  *** Options
  ***/
 
-/*
+/*@{*/
+/*!
  * Various options for isc_lex_gettoken().
  */
 
-#define ISC_LEXOPT_EOL			0x01	/* Want end-of-line token. */
-#define ISC_LEXOPT_EOF			0x02	/* Want end-of-file token. */
-#define ISC_LEXOPT_INITIALWS		0x04	/* Want initial whitespace. */
-#define ISC_LEXOPT_NUMBER		0x08	/* Recognize numbers. */
-#define ISC_LEXOPT_QSTRING		0x10	/* Recognize qstrings. */
+#define ISC_LEXOPT_EOL			0x01	/*%< Want end-of-line token. */
+#define ISC_LEXOPT_EOF			0x02	/*%< Want end-of-file token. */
+#define ISC_LEXOPT_INITIALWS		0x04	/*%< Want initial whitespace. */
+#define ISC_LEXOPT_NUMBER		0x08	/*%< Recognize numbers. */
+#define ISC_LEXOPT_QSTRING		0x10	/*%< Recognize qstrings. */
+/*@}*/
 
-/*
+/*@{*/
+/*!
  * The ISC_LEXOPT_DNSMULTILINE option handles the processing of '(' and ')' in
  * the DNS master file format.  If this option is set, then the
  * ISC_LEXOPT_INITIALWS and ISC_LEXOPT_EOL options will be ignored when
  * the paren count is > 0.  To use this option, '(' and ')' must be special
  * characters.
  */
-#define ISC_LEXOPT_DNSMULTILINE		0x20	/* Handle '(' and ')'. */
-#define ISC_LEXOPT_NOMORE		0x40	/* Want "no more" token. */
-
-#define ISC_LEXOPT_CNUMBER		0x80    /* Regognise octal and hex */
-#define ISC_LEXOPT_ESCAPE		0x100	/* Recognize escapes. */
-#define ISC_LEXOPT_QSTRINGMULTILINE	0x200	/* Allow multiline "" strings */
-
-/*
+#define ISC_LEXOPT_DNSMULTILINE		0x20	/*%< Handle '(' and ')'. */
+#define ISC_LEXOPT_NOMORE		0x40	/*%< Want "no more" token. */
+
+#define ISC_LEXOPT_CNUMBER		0x80    /*%< Regognize octal and hex. */
+#define ISC_LEXOPT_ESCAPE		0x100	/*%< Recognize escapes. */
+#define ISC_LEXOPT_QSTRINGMULTILINE	0x200	/*%< Allow multiline "" strings */
+#define ISC_LEXOPT_OCTAL		0x400	/*%< Expect a octal number. */
+/*@}*/
+/*@{*/
+/*!
  * Various commenting styles, which may be changed at any time with
  * isc_lex_setcomments().
  */
@@ -98,12 +101,13 @@ ISC_LANG_BEGINDECLS
 #define ISC_LEXCOMMENT_CPLUSPLUS	0x02
 #define ISC_LEXCOMMENT_SHELL		0x04
 #define ISC_LEXCOMMENT_DNSMASTERFILE	0x08
+/*@}*/
 
 /***
  *** Types
  ***/
 
-/* Lex */
+/*! Lex */
 
 typedef char isc_lexspecials_t[256];
 
@@ -140,268 +144,285 @@ typedef struct isc_token {
 
 isc_result_t
 isc_lex_create(isc_mem_t *mctx, size_t max_token, isc_lex_t **lexp);
-/*
+/*%<
  * Create a lexer.
  *
  * 'max_token' is a hint of the number of bytes in the largest token.
  *
  * Requires:
- *	'*lexp' is a valid lexer.
+ *\li	'*lexp' is a valid lexer.
  *
- *	max_token > 0.
+ *\li	max_token > 0.
  *
  * Ensures:
- *	On success, *lexp is attached to the newly created lexer.
+ *\li	On success, *lexp is attached to the newly created lexer.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
  */
 
 void
 isc_lex_destroy(isc_lex_t **lexp);
-/*
+/*%<
  * Destroy the lexer.
  *
  * Requires:
- *	'*lexp' is a valid lexer.
+ *\li	'*lexp' is a valid lexer.
  *
  * Ensures:
- *	*lexp == NULL
+ *\li	*lexp == NULL
  */
 
 unsigned int
 isc_lex_getcomments(isc_lex_t *lex);
-/*
+/*%<
  * Return the current lexer commenting styles.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
  * Returns:
- *	The commenting sytles which are currently allowed.
+ *\li	The commenting sytles which are currently allowed.
  */
 
 void
 isc_lex_setcomments(isc_lex_t *lex, unsigned int comments);
-/*
+/*%<
  * Set allowed lexer commenting styles.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	'comments' has meaningful values.
+ *\li	'comments' has meaningful values.
  */
 
 void
 isc_lex_getspecials(isc_lex_t *lex, isc_lexspecials_t specials);
-/*
+/*%<
  * Put the current list of specials into 'specials'.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  */
 
 void
 isc_lex_setspecials(isc_lex_t *lex, isc_lexspecials_t specials);
-/*
+/*!<
  * The characters in 'specials' are returned as tokens.  Along with
  * whitespace, they delimit strings and numbers.
  *
  * Note:
- *	Comment processing takes precedence over special character
+ *\li	Comment processing takes precedence over special character
  *	recognition.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  */
 
 isc_result_t
 isc_lex_openfile(isc_lex_t *lex, const char *filename);
-/*
+/*%<
  * Open 'filename' and make it the current input source for 'lex'.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	filename is a valid C string.
+ *\li	filename is a valid C string.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY			Out of memory
- *	ISC_R_NOTFOUND			File not found
- *	ISC_R_NOPERM			No permission to open file
- *	ISC_R_FAILURE			Couldn't open file, not sure why
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY			Out of memory
+ *\li	#ISC_R_NOTFOUND			File not found
+ *\li	#ISC_R_NOPERM			No permission to open file
+ *\li	#ISC_R_FAILURE			Couldn't open file, not sure why
+ *\li	#ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_lex_openstream(isc_lex_t *lex, FILE *stream);
-/*
+/*%<
  * Make 'stream' the current input source for 'lex'.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	'stream' is a valid C stream.
+ *\li	'stream' is a valid C stream.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY			Out of memory
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY			Out of memory
  */
 
 isc_result_t
 isc_lex_openbuffer(isc_lex_t *lex, isc_buffer_t *buffer);
-/*
+/*%<
  * Make 'buffer' the current input source for 'lex'.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	'buffer' is a valid buffer.
+ *\li	'buffer' is a valid buffer.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY			Out of memory
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY			Out of memory
  */
 
 isc_result_t
 isc_lex_close(isc_lex_t *lex);
-/*
+/*%<
  * Close the most recently opened object (i.e. file or buffer).
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMORE			No more input sources
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMORE			No more input sources
  */
 
 isc_result_t
 isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp);
-/*
+/*%<
  * Get the next token.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	'lex' has an input source.
+ *\li	'lex' has an input source.
  *
- *	'options' contains valid options.
+ *\li	'options' contains valid options.
  *
- *	'*tokenp' is a valid pointer.
+ *\li	'*tokenp' is a valid pointer.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_UNEXPECTEDEND
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_UNEXPECTEDEND
+ *\li	#ISC_R_NOMEMORY
  *
  *	These two results are returned only if their corresponding lexer
  *	options are not set.
  *
- *	ISC_R_EOF			End of input source
- *	ISC_R_NOMORE			No more input sources
+ *\li	#ISC_R_EOF			End of input source
+ *\li	#ISC_R_NOMORE			No more input sources
  */
 
 isc_result_t
 isc_lex_getmastertoken(isc_lex_t *lex, isc_token_t *token,
 		       isc_tokentype_t expect, isc_boolean_t eol);
-/*
+/*%<
  * Get the next token from a DNS master file type stream.  This is a
  * convenience function that sets appropriate options and handles quoted
  * strings and end of line correctly for master files.  It also ungets
  * unexpected tokens.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	'token' is a valid pointer
+ *\li	'token' is a valid pointer
  *
  * Returns:
  *
- * 	any return code from isc_lex_gettoken.
+ * \li	any return code from isc_lex_gettoken().
+ */
+
+isc_result_t
+isc_lex_getoctaltoken(isc_lex_t *lex, isc_token_t *token, isc_boolean_t eol);
+/*%<
+ * Get the next token from a DNS master file type stream.  This is a
+ * convenience function that sets appropriate options and handles end
+ * of line correctly for master files.  It also ungets unexpected tokens.
+ *
+ * Requires:
+ *\li	'lex' is a valid lexer.
+ *
+ *\li	'token' is a valid pointer
+ *
+ * Returns:
+ *
+ * \li	any return code from isc_lex_gettoken().
  */
 
 void
 isc_lex_ungettoken(isc_lex_t *lex, isc_token_t *tokenp);
-/*
+/*%<
  * Unget the current token.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	'lex' has an input source.
+ *\li	'lex' has an input source.
  *
- *	'tokenp' points to a valid token.
+ *\li	'tokenp' points to a valid token.
  *
- *	There is no ungotten token already.
+ *\li	There is no ungotten token already.
  */
 
 void
 isc_lex_getlasttokentext(isc_lex_t *lex, isc_token_t *tokenp, isc_region_t *r);
-/*
+/*%<
  * Returns a region containing the text of the last token returned.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
- *	'lex' has an input source.
+ *\li	'lex' has an input source.
  *
- *	'tokenp' points to a valid token.
+ *\li	'tokenp' points to a valid token.
  *
- *	A token has been gotten and not ungotten.
+ *\li	A token has been gotten and not ungotten.
  */
 
 char *
 isc_lex_getsourcename(isc_lex_t *lex);
-/*
+/*%<
  * Return the input source name.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
  * Returns:
- * 	source name or NULL if no current source.
- *	result valid while current input source exists.
+ * \li	source name or NULL if no current source.
+ *\li	result valid while current input source exists.
  */
 
 
 unsigned long
 isc_lex_getsourceline(isc_lex_t *lex);
-/*
+/*%<
  * Return the input source line number.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
  * Returns:
- * 	Current line number or 0 if no current source.
+ *\li 	Current line number or 0 if no current source.
  */
 
 isc_result_t
 isc_lex_setsourcename(isc_lex_t *lex, const char *name);
-/*
+/*%<
  * Assigns a new name to the input source.
  *
  * Requires:
  *
- * 	'lex' is a valid lexer.
+ * \li	'lex' is a valid lexer.
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	ISC_R_NOMEMORY
- * 	ISC_R_NOTFOUND - there are no sources.
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOMEMORY
+ * \li	#ISC_R_NOTFOUND - there are no sources.
  */
 
 isc_boolean_t
 isc_lex_isfile(isc_lex_t *lex);
-/*
+/*%<
  * Return whether the current input source is a file.
  *
  * Requires:
- *	'lex' is a valid lexer.
+ *\li	'lex' is a valid lexer.
  *
  * Returns:
- * 	ISC_TRUE if the current input is a file,
- *	ISC_FALSE otherwise.
+ * \li	#ISC_TRUE if the current input is a file,
+ *\li	#ISC_FALSE otherwise.
  */
 
 
diff --git a/contrib/bind9/lib/isc/include/isc/lfsr.h b/contrib/bind9/lib/isc/include/isc/lfsr.h
index e562380..0c2e845 100644
--- a/contrib/bind9/lib/isc/include/isc/lfsr.h
+++ b/contrib/bind9/lib/isc/include/isc/lfsr.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,17 +15,19 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lfsr.h,v 1.10.206.1 2004/03/06 08:14:43 marka Exp $ */
+/* $Id: lfsr.h,v 1.11.18.2 2005/04/29 00:16:56 marka Exp $ */
 
 #ifndef ISC_LFSR_H
 #define ISC_LFSR_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
 typedef struct isc_lfsr isc_lfsr_t;
 
-/*
+/*%
  * This function is called when reseeding is needed.  It is allowed to
  * modify any state in the LFSR in any way it sees fit OTHER THAN "bits".
  *
@@ -36,96 +38,91 @@ typedef struct isc_lfsr isc_lfsr_t;
  */
 typedef void (*isc_lfsrreseed_t)(isc_lfsr_t *, void *);
 
-/*
+/*%
  * The members of this structure can be used by the application, but care
  * needs to be taken to not change state once the lfsr is in operation.
  */
 struct isc_lfsr {
-	isc_uint32_t		state;	/* previous state */
-	unsigned int		bits;	/* length */
-	isc_uint32_t		tap;	/* bit taps */
-	unsigned int		count;	/* reseed count (in BITS!) */
-	isc_lfsrreseed_t	reseed;	/* reseed function */
-	void		       *arg;	/* reseed function argument */
+	isc_uint32_t		state;	/*%< previous state */
+	unsigned int		bits;	/*%< length */
+	isc_uint32_t		tap;	/*%< bit taps */
+	unsigned int		count;	/*%< reseed count (in BITS!) */
+	isc_lfsrreseed_t	reseed;	/*%< reseed function */
+	void		       *arg;	/*%< reseed function argument */
 };
 
 ISC_LANG_BEGINDECLS
 
-/*
- * In all these functions it is important that the caller only use as many
- * bits as the LFSR has state.  Also, it isn't guaranteed that an LFSR of
- * bit length 32 will have 2^32 unique states before repeating.
- */
 
 void 
 isc_lfsr_init(isc_lfsr_t *lfsr, isc_uint32_t state, unsigned int bits,
 		   isc_uint32_t tap, unsigned int count,
 		   isc_lfsrreseed_t reseed, void *arg);
-/*
+/*%<
  * Initialize an LFSR.
  *
  * Note:
  *
- *	Putting untrusted values into this function will cause the LFSR to
+ *\li	Putting untrusted values into this function will cause the LFSR to
  *	generate (perhaps) non-maximal length sequences.
  *
  * Requires:
  *
- *	lfsr != NULL
+ *\li	lfsr != NULL
  *
- *	8 <= bits <= 32
+ *\li	8 <= bits <= 32
  *
- *	tap != 0
+ *\li	tap != 0
  */
 
 void 
 isc_lfsr_generate(isc_lfsr_t *lfsr, void *data, unsigned int count);
-/*
+/*%<
  * Returns "count" bytes of data from the LFSR.
  *
  * Requires:
  *
- *	lfsr be valid.
+ *\li	lfsr be valid.
  *
- *	data != NULL.
+ *\li	data != NULL.
  *
- *	count > 0.
+ *\li	count > 0.
  */
 
 void 
 isc_lfsr_skip(isc_lfsr_t *lfsr, unsigned int skip);
-/*
+/*%<
  * Skip "skip" states.
  *
  * Requires:
  *
- *	lfsr be valid.
+ *\li	lfsr be valid.
  */
 
 isc_uint32_t 
 isc_lfsr_generate32(isc_lfsr_t *lfsr1, isc_lfsr_t *lfsr2);
-/*
+/*%<
  * Given two LFSRs, use the current state from each to skip entries in the
  * other.  The next states are then xor'd together and returned.
  *
  * WARNING:
  *
- *	This function is used only for very, very low security data, such
+ *\li	This function is used only for very, very low security data, such
  *	as DNS message IDs where it is desired to have an unpredictable
  *	stream of bytes that are harder to predict than a simple flooding
  *	attack.
  *
  * Notes:
  *
- *	Since the current state from each of the LFSRs is used to skip
+ *\li	Since the current state from each of the LFSRs is used to skip
  *	state in the other, it is important that no state be leaked
  *	from either LFSR.
  *
  * Requires:
  *
- *	lfsr1 and lfsr2 be valid.
+ *\li	lfsr1 and lfsr2 be valid.
  *
- *	1 <= skipbits <= 31
+ *\li	1 <= skipbits <= 31
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/lib.h b/contrib/bind9/lib/isc/include/isc/lib.h
index 1ad4493..45c547c 100644
--- a/contrib/bind9/lib/isc/include/isc/lib.h
+++ b/contrib/bind9/lib/isc/include/isc/lib.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lib.h,v 1.6.12.3 2004/03/08 09:04:51 marka Exp $ */
+/* $Id: lib.h,v 1.8.18.2 2005/04/29 00:16:58 marka Exp $ */
 
 #ifndef ISC_LIB_H
 #define ISC_LIB_H 1
 
+/*! \file */
+
 #include <isc/types.h>
 #include <isc/lang.h>
 
@@ -29,8 +31,8 @@ LIBISC_EXTERNAL_DATA extern isc_msgcat_t *isc_msgcat;
 
 void
 isc_lib_initmsgcat(void);
-/*
- * Initialize the ISC library's message catalog, isc_msgcat, if it
+/*!<
+ * \brief Initialize the ISC library's message catalog, isc_msgcat, if it
  * has not already been initialized.
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/list.h b/contrib/bind9/lib/isc/include/isc/list.h
index 5fe82e3..2adc33f 100644
--- a/contrib/bind9/lib/isc/include/isc/list.h
+++ b/contrib/bind9/lib/isc/include/isc/list.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: list.h,v 1.18.2.2.8.3 2006/06/06 00:11:40 marka Exp $ */
+/* $Id: list.h,v 1.20.18.2 2006/06/06 00:11:41 marka Exp $ */
 
 #ifndef ISC_LIST_H
 #define ISC_LIST_H 1
diff --git a/contrib/bind9/lib/isc/include/isc/log.h b/contrib/bind9/lib/isc/include/isc/log.h
index 97aeba0..c381775 100644
--- a/contrib/bind9/lib/isc/include/isc/log.h
+++ b/contrib/bind9/lib/isc/include/isc/log.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.h,v 1.39.2.4.2.7 2004/04/10 04:31:40 marka Exp $ */
+/* $Id: log.h,v 1.47.18.3 2005/04/29 00:16:58 marka Exp $ */
 
 #ifndef ISC_LOG_H
 #define ISC_LOG_H 1
 
+/*! \file */
+
 #include <stdio.h>
 #include <stdarg.h>
 #include <syslog.h> /* XXXDCL NT */
@@ -29,29 +31,36 @@
 #include <isc/platform.h>
 #include <isc/types.h>
 
-/*
- * Severity levels, patterned after Unix's syslog levels.
+/*@{*/
+/*!
+ * \brief Severity levels, patterned after Unix's syslog levels.
  *
- * ISC_LOG_DYNAMIC can only be used for defining channels with
- * isc_log_createchannel(), not to specify a level in isc_log_write().
  */
 #define ISC_LOG_DEBUG(level)	(level)
+/*!
+ * #ISC_LOG_DYNAMIC can only be used for defining channels with
+ * isc_log_createchannel(), not to specify a level in isc_log_write().
+ */
 #define ISC_LOG_DYNAMIC	  	  0
 #define ISC_LOG_INFO		(-1)
 #define ISC_LOG_NOTICE		(-2)
 #define ISC_LOG_WARNING 	(-3)
 #define ISC_LOG_ERROR		(-4)
 #define ISC_LOG_CRITICAL	(-5)
+/*@}*/
 
-/*
- * Destinations.
+/*@{*/
+/*!
+ * \brief Destinations.
  */
 #define ISC_LOG_TONULL		1
 #define ISC_LOG_TOSYSLOG	2
 #define ISC_LOG_TOFILE		3
 #define ISC_LOG_TOFILEDESC	4
+/*@}*/
 
-/*
+/*@{*/
+/*%
  * Channel flags.
  */
 #define ISC_LOG_PRINTTIME	0x0001
@@ -62,18 +71,24 @@
 #define ISC_LOG_PRINTALL	0x001F
 #define ISC_LOG_DEBUGONLY	0x1000
 #define ISC_LOG_OPENERR		0x8000		/* internal */
+/*@}*/
 
-/*
- * Other options.
+/*@{*/
+/*!
+ * \brief Other options.
+ *
  * XXXDCL INFINITE doesn't yet work.  Arguably it isn't needed, but
  *   since I am intend to make large number of versions work efficiently,
  *   INFINITE is going to be trivial to add to that.
  */
 #define ISC_LOG_ROLLINFINITE	(-1)
 #define ISC_LOG_ROLLNEVER	(-2)
+/*@}*/
 
-/*
- * Used to name the categories used by a library.  An array of isc_logcategory
+/*!
+ * \brief Used to name the categories used by a library.  
+ *
+ * An array of isc_logcategory
  * structures names each category, and the id value is initialized by calling
  * isc_log_registercategories.
  */
@@ -82,28 +97,30 @@ struct isc_logcategory {
 	unsigned int id;
 };
 
-/*
- * Similar to isc_logcategory above, but for all the modules a library defines.
+/*%
+ * Similar to isc_logcategory, but for all the modules a library defines.
  */
 struct isc_logmodule {
 	const char *name;
 	unsigned int id;
 };
 
-/*
+/*%
  * The isc_logfile structure is initialized as part of an isc_logdestination
- * before calling isc_log_createchannel().  When defining an ISC_LOG_TOFILE
+ * before calling isc_log_createchannel().  
+ *
+ * When defining an #ISC_LOG_TOFILE
  * channel the name, versions and maximum_size should be set before calling
- * isc_log_createchannel().  To define an ISC_LOG_TOFILEDESC channel set only
+ * isc_log_createchannel().  To define an #ISC_LOG_TOFILEDESC channel set only
  * the stream before the call.
  * 
  * Setting maximum_size to zero implies no maximum.
  */
 typedef struct isc_logfile {
-	FILE *stream;		/* Initialized to NULL for ISC_LOG_TOFILE. */
-	const char *name;	/* NULL for ISC_LOG_TOFILEDESC. */
-	int versions;	/* >= 0, ISC_LOG_ROLLNEVER, ISC_LOG_ROLLINFINITE. */
-	/*
+	FILE *stream;		/*%< Initialized to NULL for #ISC_LOG_TOFILE. */
+	const char *name;	/*%< NULL for #ISC_LOG_TOFILEDESC. */
+	int versions;	/* >= 0, #ISC_LOG_ROLLNEVER, #ISC_LOG_ROLLINFINITE. */
+	/*%
 	 * stdio's ftell is standardized to return a long, which may well not
 	 * be big enough for the largest file supportable by the operating
 	 * system (though it is _probably_ big enough for the largest log
@@ -111,10 +128,10 @@ typedef struct isc_logfile {
 	 * to a size large enough for the largest possible file on a system.
 	 */
 	isc_offset_t maximum_size;
-	isc_boolean_t maximum_reached; /* Private. */
+	isc_boolean_t maximum_reached; /*%< Private. */
 } isc_logfile_t;
 
-/*
+/*%
  * Passed to isc_log_createchannel to define the attributes of either
  * a stdio or a syslog log.
  */
@@ -123,7 +140,8 @@ typedef union isc_logdestination {
 	int facility;		/* XXXDCL NT */
 } isc_logdestination_t;
 
-/*
+/*@{*/
+/*%
  * The built-in categories of libisc.
  *
  * Each library registering categories should provide library_LOGCATEGORY_name
@@ -133,13 +151,16 @@ typedef union isc_logdestination {
 LIBISC_EXTERNAL_DATA extern isc_logcategory_t isc_categories[];
 LIBISC_EXTERNAL_DATA extern isc_log_t *isc_lctx;
 LIBISC_EXTERNAL_DATA extern isc_logmodule_t isc_modules[];
+/*@}*/
 
-/*
+/*@{*/
+/*%
  * Do not log directly to DEFAULT.  Use another category.  When in doubt,
  * use GENERAL.
  */
 #define ISC_LOGCATEGORY_DEFAULT	(&isc_categories[0])
 #define ISC_LOGCATEGORY_GENERAL	(&isc_categories[1])
+/*@}*/
 
 #define ISC_LOGMODULE_SOCKET (&isc_modules[0])
 #define ISC_LOGMODULE_TIME (&isc_modules[1])
@@ -150,33 +171,33 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_log_create(isc_mem_t *mctx, isc_log_t **lctxp, isc_logconfig_t **lcfgp);
-/*
+/*%<
  * Establish a new logging context, with default channels.
  *
  * Notes:
- *	isc_log_create calls isc_logconfig_create, so see its comment
+ *\li	isc_log_create() calls isc_logconfig_create(), so see its comment
  *	below for more information.
  *
  * Requires:
- *	mctx is a valid memory context.
- *	lctxp is not null and *lctxp is null.
- *	lcfgp is null or lcfgp is not null and *lcfgp is null.
+ *\li	mctx is a valid memory context.
+ *\li	lctxp is not null and *lctxp is null.
+ *\li	lcfgp is null or lcfgp is not null and *lcfgp is null.
  *
  * Ensures:
- *	*lctxp will point to a valid logging context if all of the necessary
+ *\li	*lctxp will point to a valid logging context if all of the necessary
  *	memory was allocated, or NULL otherwise.
- *	*lcfgp will point to a valid logging configuration if all of the
+ *\li	*lcfgp will point to a valid logging configuration if all of the
  *	necessary memory was allocated, or NULL otherwise.
- *	On failure, no additional memory is allocated.
+ *\li	On failure, no additional memory is allocated.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success
- *	ISC_R_NOMEMORY		Resource limit: Out of memory
+ *\li	#ISC_R_SUCCESS		Success
+ *\li	#ISC_R_NOMEMORY		Resource limit: Out of memory
  */
 
 isc_result_t
 isc_logconfig_create(isc_log_t *lctx, isc_logconfig_t **lcfgp);
-/*
+/*%<
  * Create the data structure that holds all of the configurable information
  * about where messages are actually supposed to be sent -- the information
  * that could changed based on some configuration file, as opposed to the
@@ -184,190 +205,192 @@ isc_logconfig_create(isc_log_t *lctx, isc_logconfig_t **lcfgp);
  * into a program, or the debug_level which is dynamic state information.
  *
  * Notes:
- *	It is necessary to specify the logging context the configuration
+ *\li	It is necessary to specify the logging context the configuration
  * 	will be used with because the number of categories and modules
  *	needs to be known in order to set the configuration.  However,
  *	the configuration is not used by the logging context until the
  *	isc_logconfig_use function is called.
  *
- *	The memory context used for operations that allocate memory for
+ *\li	The memory context used for operations that allocate memory for
  *	the configuration is that of the logging context, as specified
  *	in the isc_log_create call.
  *
- *	Four default channels are established:
+ *\li	Four default channels are established:
+ *\verbatim
  *	    	default_syslog
- *		 - log to syslog's daemon facility ISC_LOG_INFO or higher
+ *		 - log to syslog's daemon facility #ISC_LOG_INFO or higher
  *		default_stderr
- *		 - log to stderr ISC_LOG_INFO or higher
+ *		 - log to stderr #ISC_LOG_INFO or higher
  *		default_debug
- *		 - log to stderr ISC_LOG_DEBUG dynamically
+ *		 - log to stderr #ISC_LOG_DEBUG dynamically
  *		null
  *		 - log nothing
+ *\endverbatim
  *
  * Requires:
- * 	lctx is a valid logging context.
- *	lcftp is not null and *lcfgp is null.
+ *\li 	lctx is a valid logging context.
+ *\li	lcftp is not null and *lcfgp is null.
  *
  * Ensures:
- *	*lcfgp will point to a valid logging context if all of the necessary
+ *\li	*lcfgp will point to a valid logging context if all of the necessary
  *	memory was allocated, or NULL otherwise.
- *	On failure, no additional memory is allocated.
+ *\li	On failure, no additional memory is allocated.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success
- *	ISC_R_NOMEMORY		Resource limit: Out of memory
+ *\li	#ISC_R_SUCCESS		Success
+ *\li	#ISC_R_NOMEMORY		Resource limit: Out of memory
  */
 
 isc_logconfig_t *
 isc_logconfig_get(isc_log_t *lctx);
-/*
+/*%<
  * Returns a pointer to the configuration currently in use by the log context.
  *
  * Requires:
- *	lctx is a valid context.
+ *\li	lctx is a valid context.
  *
  * Ensures:
- *	The configuration pointer is non-null.
+ *\li	The configuration pointer is non-null.
  *
  * Returns:
- *	The configuration pointer.
+ *\li	The configuration pointer.
  */
 
 isc_result_t
 isc_logconfig_use(isc_log_t *lctx, isc_logconfig_t *lcfg);
-/*
+/*%<
  * Associate a new configuration with a logging context.
  *
  * Notes:
- *	This is thread safe.  The logging context will lock a mutex
+ *\li	This is thread safe.  The logging context will lock a mutex
  *	before attempting to swap in the new configuration, and isc_log_doit
  *	(the internal function used by all of isc_log_[v]write[1]) locks
  *	the same lock for the duration of its use of the configuration.
  *
  * Requires:
- *	lctx is a valid logging context.
- *	lcfg is a valid logging configuration.
- *	lctx is the same configuration given to isc_logconfig_create
+ *\li	lctx is a valid logging context.
+ *\li	lcfg is a valid logging configuration.
+ *\li	lctx is the same configuration given to isc_logconfig_create
  *		when the configuration was created.
  *
  * Ensures:
- *	Future calls to isc_log_write will use the new configuration.
+ *\li	Future calls to isc_log_write will use the new configuration.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success
- *	ISC_R_NOMEMORY		Resource limit: Out of memory
+ *\li	#ISC_R_SUCCESS		Success
+ *\li	#ISC_R_NOMEMORY		Resource limit: Out of memory
  */
 
 void
 isc_log_destroy(isc_log_t **lctxp);
-/*
+/*%<
  * Deallocate the memory associated with a logging context.
  *
  * Requires:
- *	*lctx is a valid logging context.
+ *\li	*lctx is a valid logging context.
  *
  * Ensures:
- *	All of the memory associated with the logging context is returned
+ *\li	All of the memory associated with the logging context is returned
  *	to the free memory pool.
  *
- *	Any open files are closed.
+ *\li	Any open files are closed.
  *
- *	The logging context is marked as invalid.
+ *\li	The logging context is marked as invalid.
  */
 
 void
 isc_logconfig_destroy(isc_logconfig_t **lcfgp);
-/*
+/*%<
  * Destroy a logging configuration.
  *
  * Notes:
- *	This function cannot be used directly with the return value of
+ *\li	This function cannot be used directly with the return value of
  *	isc_logconfig_get, because a logging context must always have
  *	a valid configuration associated with it.
  *
  * Requires:
- *	lcfgp is not null and *lcfgp is a valid logging configuration.
- *	The logging configuration is not in use by an existing logging context.
+ *\li	lcfgp is not null and *lcfgp is a valid logging configuration.
+ *\li	The logging configuration is not in use by an existing logging context.
  *
  * Ensures:
- *	All memory allocated for the configuration is freed.
+ *\li	All memory allocated for the configuration is freed.
  *
- *	The configuration is marked as invalid.
+ *\li	The configuration is marked as invalid.
  */
 
 void
 isc_log_registercategories(isc_log_t *lctx, isc_logcategory_t categories[]);
-/*
+/*%<
  * Identify logging categories a library will use.
  *
  * Notes:
- *	A category should only be registered once, but no mechanism enforces
+ *\li	A category should only be registered once, but no mechanism enforces
  *	this rule.
  *
- *	The end of the categories array is identified by a NULL name.
+ *\li	The end of the categories array is identified by a NULL name.
  *
- *	Because the name is used by ISC_LOG_PRINTCATEGORY, it should not
+ *\li	Because the name is used by #ISC_LOG_PRINTCATEGORY, it should not
  *	be altered or destroyed after isc_log_registercategories().
  *
- *	Because each element of the categories array is used by
+ *\li	Because each element of the categories array is used by
  *	isc_log_categorybyname, it should not be altered or destroyed
  *	after registration.
  *
- *	The value of the id integer in each structure is overwritten
+ *\li	The value of the id integer in each structure is overwritten
  *	by this function, and so id need not be initialized to any particular
  *	value prior to the function call.
  *
- *	A subsequent call to isc_log_registercategories with the same
+ *\li	A subsequent call to isc_log_registercategories with the same
  *	logging context (but new categories) will cause the last
  *	element of the categories array from the prior call to have
  *	its "name" member changed from NULL to point to the new
  *	categories array, and its "id" member set to UINT_MAX.
  *
  * Requires:
- *	lctx is a valid logging context.
- *	categories != NULL.
- *	categories[0].name != NULL.
+ *\li	lctx is a valid logging context.
+ *\li	categories != NULL.
+ *\li	categories[0].name != NULL.
  *
  * Ensures:
- * 	There are references to each category in the logging context,
+ * \li	There are references to each category in the logging context,
  * 	so they can be used with isc_log_usechannel() and isc_log_write().
  */
 
 void
 isc_log_registermodules(isc_log_t *lctx, isc_logmodule_t modules[]);
-/*
+/*%<
  * Identify logging categories a library will use.
  *
  * Notes:
- *	A module should only be registered once, but no mechanism enforces
+ *\li	A module should only be registered once, but no mechanism enforces
  *	this rule.
  *
- *	The end of the modules array is identified by a NULL name.
+ *\li	The end of the modules array is identified by a NULL name.
  *
- *	Because the name is used by ISC_LOG_PRINTMODULE, it should not
+ *\li	Because the name is used by #ISC_LOG_PRINTMODULE, it should not
  *	be altered or destroyed after isc_log_registermodules().
  *
- *	Because each element of the modules array is used by
+ *\li	Because each element of the modules array is used by
  *	isc_log_modulebyname, it should not be altered or destroyed
  *	after registration.
  *
- *	The value of the id integer in each structure is overwritten
+ *\li	The value of the id integer in each structure is overwritten
  *	by this function, and so id need not be initialized to any particular
  *	value prior to the function call.
  *
- *	A subsequent call to isc_log_registermodules with the same
+ *\li	A subsequent call to isc_log_registermodules with the same
  *	logging context (but new modules) will cause the last
  *	element of the modules array from the prior call to have
  *	its "name" member changed from NULL to point to the new
  *	modules array, and its "id" member set to UINT_MAX.
  *
  * Requires:
- *	lctx is a valid logging context.
- *	modules != NULL.
- *	modules[0].name != NULL;
+ *\li	lctx is a valid logging context.
+ *\li	modules != NULL.
+ *\li	modules[0].name != NULL;
  *
  * Ensures:
- *	Each module has a reference in the logging context, so they can be
+ *\li	Each module has a reference in the logging context, so they can be
  *	used with isc_log_usechannel() and isc_log_write().
  */
 
@@ -376,68 +399,67 @@ isc_log_createchannel(isc_logconfig_t *lcfg, const char *name,
 		      unsigned int type, int level,
 		      const isc_logdestination_t *destination,
 		      unsigned int flags);
-/*
+/*%<
  * Specify the parameters of a logging channel.
  *
  * Notes:
- *	The name argument is copied to memory in the logging context, so
+ *\li	The name argument is copied to memory in the logging context, so
  *	it can be altered or destroyed after isc_log_createchannel().
  *
- *	Defining a very large number of channels will have a performance
+ *\li	Defining a very large number of channels will have a performance
  *	impact on isc_log_usechannel(), since the names are searched
  *	linearly until a match is made.  This same issue does not affect
  *	isc_log_write, however.
  *
- *	Channel names can be redefined; this is primarily useful for programs
+ *\li	Channel names can be redefined; this is primarily useful for programs
  *	that want their own definition of default_syslog, default_debug
  *	and default_stderr.
  *
- *	Any channel that is redefined will not affect logging that was
+ *\li	Any channel that is redefined will not affect logging that was
  *	already directed to its original definition, _except_ for the
  *	default_stderr channel.  This case is handled specially so that
  *	the default logging category can be changed by redefining
  *	default_stderr.  (XXXDCL Though now that I think of it, the default
  *	logging category can be changed with only one additional function
  *	call by defining a new channel and then calling isc_log_usechannel()
- *	for ISC_LOGCATEGORY_DEFAULT.)
+ *	for #ISC_LOGCATEGORY_DEFAULT.)
  *
- *	Specifying ISC_LOG_PRINTTIME or ISC_LOG_PRINTTAG for syslog is allowed,
+ *\li	Specifying #ISC_LOG_PRINTTIME or #ISC_LOG_PRINTTAG for syslog is allowed,
  *	but probably not what you wanted to do.
  *
- *	ISC_LOG_DEBUGONLY will mark the channel as usable only when the
+ *	#ISC_LOG_DEBUGONLY will mark the channel as usable only when the
  *	debug level of the logging context (see isc_log_setdebuglevel)
  *	is non-zero.
  *
  * Requires:
- *	lcfg is a valid logging configuration.
+ *\li	lcfg is a valid logging configuration.
  *
- *	name is not NULL.
+ *\li	name is not NULL.
  *
- *	type is ISC_LOG_TOSYSLOG, ISC_LOG_TOFILE, ISC_LOG_TOFILEDESC or
- *		ISC_LOG_TONULL.
+ *\li	type is #ISC_LOG_TOSYSLOG, #ISC_LOG_TOFILE, #ISC_LOG_TOFILEDESC or
+ *		#ISC_LOG_TONULL.
  *
- *	destination is not NULL unless type is ISC_LOG_TONULL.
+ *\li	destination is not NULL unless type is #ISC_LOG_TONULL.
  *
- *	level is >= ISC_LOG_CRITICAL (the most negative logging level).
+ *\li	level is >= #ISC_LOG_CRITICAL (the most negative logging level).
  *
- *	flags does not include any bits aside from the ISC_LOG_PRINT* bits
- *	or ISC_LOG_DEBUGONLY.
+ *\li	flags does not include any bits aside from the ISC_LOG_PRINT* bits
+ *	or #ISC_LOG_DEBUGONLY.
  *
  * Ensures:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *		A channel with the given name is usable with
  *		isc_log_usechannel().
  *
- *	ISC_R_NOMEMORY or ISC_R_UNEXPECTED
+ *\li	#ISC_R_NOMEMORY or #ISC_R_UNEXPECTED
  *		No additional memory is being used by the logging context.
- *
  *		Any channel that previously existed with the given name
  *		is not redefined.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success
- *	ISC_R_NOMEMORY		Resource limit: Out of memory
- *	ISC_R_UNEXPECTED	type was out of range and REQUIRE()
+ *\li	#ISC_R_SUCCESS		Success
+ *\li	#ISC_R_NOMEMORY		Resource limit: Out of memory
+ *\li	#ISC_R_UNEXPECTED	type was out of range and REQUIRE()
  *					was disabled.
  */
 
@@ -445,166 +467,186 @@ isc_result_t
 isc_log_usechannel(isc_logconfig_t *lcfg, const char *name,
 		   const isc_logcategory_t *category,
 		   const isc_logmodule_t *module);
-/*
+/*%<
  * Associate a named logging channel with a category and module that
  * will use it.
  *
  * Notes:
- *	The name is searched for linearly in the set of known channel names
+ *\li	The name is searched for linearly in the set of known channel names
  *	until a match is found.  (Note the performance impact of a very large
  *	number of named channels.)  When multiple channels of the same
  *	name are defined, the most recent definition is found.
  *
- *	Specifing a very large number of channels for a category will have
+ *\li	Specifing a very large number of channels for a category will have
  *	a moderate impact on performance in isc_log_write(), as each
  *	call looks up the category for the start of a linked list, which
  *	it follows all the way to the end to find matching modules.  The
  *	test for matching modules is  integral, though.
  *
- *	If category is NULL, then the channel is associated with the indicated
+ *\li	If category is NULL, then the channel is associated with the indicated
  *	module for all known categories (including the "default" category).
  *
- *	If module is NULL, then the channel is associated with every module
+ *\li	If module is NULL, then the channel is associated with every module
  *	that uses that category.
  *
- *	Passing both category and module as NULL would make every log message
+ *\li	Passing both category and module as NULL would make every log message
  *	use the indicated channel.
  *
- * 	Specifying a channel that is ISC_LOG_TONULL for a category/module pair
+ * \li	Specifying a channel that is #ISC_LOG_TONULL for a category/module pair
  *	has no effect on any other channels associated with that pair,
  *	regardless of ordering.  Thus you cannot use it to "mask out" one
  *	category/module pair when you have specified some other channel that
  * 	is also used by that category/module pair.
  *
  * Requires:
- *	lcfg is a valid logging configuration.
+ *\li	lcfg is a valid logging configuration.
  *
- *	category is NULL or has an id that is in the range of known ids.
+ *\li	category is NULL or has an id that is in the range of known ids.
  *
  *	module is NULL or has an id that is in the range of known ids.
  *
  * Ensures:
- *	ISC_R_SUCCESS
+ *\li	#ISC_R_SUCCESS
  *		The channel will be used by the indicated category/module
  *		arguments.
  *
- *	ISC_R_NOMEMORY
+ *\li	#ISC_R_NOMEMORY
  *		If assignment for a specific category has been requested,
  *		the channel has not been associated with the indicated
  *		category/module arguments and no additional memory is
  *		used by the logging context.
- *
  *		If assignment for all categories has been requested
  *		then _some_ may have succeeded (starting with category
  *		"default" and progressing through the order of categories
- *		passed to isc_log_registercategories) and additional memory
+ *		passed to isc_log_registercategories()) and additional memory
  *		is being used by whatever assignments succeeded.
  *
  * Returns:
- *	ISC_R_SUCCESS	Success
- *	ISC_R_NOMEMORY	Resource limit: Out of memory
+ *\li	#ISC_R_SUCCESS	Success
+ *\li	#ISC_R_NOMEMORY	Resource limit: Out of memory
  */
 
-void
-isc_log_write(isc_log_t *lctx, isc_logcategory_t *category,
-	      isc_logmodule_t *module, int level,
-	      const char *format, ...)
-ISC_FORMAT_PRINTF(5, 6);
-/*
+/* Attention: next four comments PRECEED code */
+/*! 
+ *   \brief
  * Write a message to the log channels.
  *
  * Notes:
- *	Log messages containing natural language text should be logged with
+ *\li	Log messages containing natural language text should be logged with
  *	isc_log_iwrite() to allow for localization.
  *
- *	lctx can be NULL; this is allowed so that programs which use
+ *\li	lctx can be NULL; this is allowed so that programs which use
  *	libraries that use the ISC logging system are not required to
  *	also use it.
  *
- *	The format argument is a printf(3) string, with additional arguments
+ *\li	The format argument is a printf(3) string, with additional arguments
  *	as necessary.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  *
- *	The category and module arguments must have ids that are in the
+ *\li	The category and module arguments must have ids that are in the
  *	range of known ids, as estabished by isc_log_registercategories()
  *	and isc_log_registermodules().
  *
- *	level != ISC_LOG_DYNAMIC.  ISC_LOG_DYNAMIC is used only to define
+ *\li	level != #ISC_LOG_DYNAMIC.  ISC_LOG_DYNAMIC is used only to define
  *	channels, and explicit debugging level must be identified for
  *	isc_log_write() via ISC_LOG_DEBUG(level).
  *
- *	format != NULL.
+ *\li	format != NULL.
  *
  * Ensures:
- *	The log message is written to every channel associated with the
+ *\li	The log message is written to every channel associated with the
  *	indicated category/module pair.
  *
  * Returns:
- *	Nothing.  Failure to log a message is not construed as a
+ *\li	Nothing.  Failure to log a message is not construed as a
  *	meaningful error.
  */
-
 void
-isc_log_vwrite(isc_log_t *lctx, isc_logcategory_t *category,
+isc_log_write(isc_log_t *lctx, isc_logcategory_t *category,
 	       isc_logmodule_t *module, int level,
-	       const char *format, va_list args)
-ISC_FORMAT_PRINTF(5, 0);
-/*
+	      const char *format, ...)
+
+ISC_FORMAT_PRINTF(5, 6);
+
+/*%
  * Write a message to the log channels.
  *
  * Notes:
- *	lctx can be NULL; this is allowed so that programs which use
+ *\li	lctx can be NULL; this is allowed so that programs which use
  *	libraries that use the ISC logging system are not required to
  *	also use it.
  *
- *	The format argument is a printf(3) string, with additional arguments
+ *\li	The format argument is a printf(3) string, with additional arguments
  *	as necessary.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  *
- *	The category and module arguments must have ids that are in the
+ *\li	The category and module arguments must have ids that are in the
  *	range of known ids, as estabished by isc_log_registercategories()
  *	and isc_log_registermodules().
  *
- *	level != ISC_LOG_DYNAMIC.  ISC_LOG_DYNAMIC is used only to define
+ *\li	level != #ISC_LOG_DYNAMIC.  ISC_LOG_DYNAMIC is used only to define
  *	channels, and explicit debugging level must be identified for
  *	isc_log_write() via ISC_LOG_DEBUG(level).
  *
- *	format != NULL.
+ *\li	format != NULL.
  *
  * Ensures:
- *	The log message is written to every channel associated with the
+ *\li	The log message is written to every channel associated with the
  *	indicated category/module pair.
  *
  * Returns:
- *	Nothing.  Failure to log a message is not construed as a
+ *\li	Nothing.  Failure to log a message is not construed as a
  *	meaningful error.
  */
+void
+isc_log_vwrite(isc_log_t *lctx, isc_logcategory_t *category,
+	       isc_logmodule_t *module, int level,
+	       const char *format, va_list args)
+
+ISC_FORMAT_PRINTF(5, 0);
 
+/*%
+ * Write a message to the log channels, pruning duplicates that occur within
+ * a configurable amount of seconds (see isc_log_[sg]etduplicateinterval).
+ * This function is otherwise identical to isc_log_write().
+ */
 void
 isc_log_write1(isc_log_t *lctx, isc_logcategory_t *category,
 	       isc_logmodule_t *module, int level, const char *format, ...)
+
 ISC_FORMAT_PRINTF(5, 6);
-/*
+
+/*%
  * Write a message to the log channels, pruning duplicates that occur within
  * a configurable amount of seconds (see isc_log_[sg]etduplicateinterval).
- * This function is otherwise identical to isc_log_write().
+ * This function is otherwise identical to isc_log_vwrite().
  */
-
 void
 isc_log_vwrite1(isc_log_t *lctx, isc_logcategory_t *category,
 		isc_logmodule_t *module, int level, const char *format,
 		va_list args)
+
 ISC_FORMAT_PRINTF(5, 0);
-/*
- * Write a message to the log channels, pruning duplicates that occur within
- * a configurable amount of seconds (see isc_log_[sg]etduplicateinterval).
- * This function is otherwise identical to isc_log_vwrite().
- */
 
+/*%
+ * These are four internationalized versions of the the isc_log_[v]write[1]
+ * functions.  
+ *
+ * The only difference is that they take arguments for a message
+ * catalog, message set, and message number, all immediately preceding the
+ * format argument.  The format argument becomes the default text, a la
+ * isc_msgcat_get.  If the message catalog is NULL, no lookup is attempted
+ * for a message -- which makes the message set and message number irrelevant,
+ * and the non-internationalized call should have probably been used instead.
+ *
+ * Yes, that means there are now *eight* interfaces to logging a message.
+ * Sheesh.   Make the madness stop!
+ */
+/*@{*/
 void
 isc_log_iwrite(isc_log_t *lctx, isc_logcategory_t *category,
 	      isc_logmodule_t *module, int level,
@@ -632,72 +674,61 @@ isc_log_ivwrite1(isc_log_t *lctx, isc_logcategory_t *category,
 		 isc_msgcat_t *msgcat, int msgset, int message,
 		 const char *format, va_list args)
 ISC_FORMAT_PRINTF(8, 0);
-/*
- * These are four internationalized versions of the the isc_log_[v]write[1]
- * functions.  The only difference is that they take arguments for a message
- * catalog, message set, and message number, all immediately preceding the
- * format argument.  The format argument becomes the default text, a la
- * isc_msgcat_get.  If the message catalog is NULL, no lookup is attempted
- * for a message -- which makes the message set and message number irrelevant,
- * and the non-internationalized call should have probably been used instead.
- *
- * Yes, that means there are now *eight* interfaces to logging a message.
- * Sheesh.   Make the madness stop!
- */
+/*@}*/
 
 void
 isc_log_setdebuglevel(isc_log_t *lctx, unsigned int level);
-/*
+/*%<
  * Set the debugging level used for logging.
  *
  * Notes:
- *	Setting the debugging level to 0 disables debugging log messages.
+ *\li	Setting the debugging level to 0 disables debugging log messages.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  *
  * Ensures:
- *	The debugging level is set to the requested value.
+ *\li	The debugging level is set to the requested value.
  */
 
 unsigned int
 isc_log_getdebuglevel(isc_log_t *lctx);
-/*
+/*%<
  * Get the current debugging level.
  *
  * Notes:
- *	This is provided so that a program can have a notion of
+ *\li	This is provided so that a program can have a notion of
  *	"increment debugging level" or "decrement debugging level"
  *	without needing to keep track of what the current level is.
  *
- *	A return value of 0 indicates that debugging messages are disabled.
+ *\li	A return value of 0 indicates that debugging messages are disabled.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  *
  * Ensures:
- *	The current logging debugging level is returned.
+ *\li	The current logging debugging level is returned.
  */
 
 isc_boolean_t
 isc_log_wouldlog(isc_log_t *lctx, int level);
-/*
+/*%<
  * Determine whether logging something to 'lctx' at 'level' would
  * actually cause something to be logged somewhere.
  *
- * If ISC_FALSE is returned, it is guaranteed that nothing would
+ * If #ISC_FALSE is returned, it is guaranteed that nothing would
  * be logged, allowing the caller to omit unnecessary
  * isc_log_write() calls and possible message preformatting.
  */
 
 void
 isc_log_setduplicateinterval(isc_logconfig_t *lcfg, unsigned int interval);
-/*
+/*%<
  * Set the interval over which duplicate log messages will be ignored
  * by isc_log_[v]write1(), in seconds.
  *
  * Notes:
- *	Increasing the duplicate interval from X to Y will not necessarily
+ *\li	Increasing the duplicate interval from X to Y will not necessarily
  *	filter out duplicates of messages logged in Y - X seconds since the
  *	increase.  (Example: Message1 is logged at midnight.  Message2
  *	is logged at 00:01:00, when the interval is only 30 seconds, causing
@@ -707,43 +738,43 @@ isc_log_setduplicateinterval(isc_logconfig_t *lcfg, unsigned int interval);
  *	passed since the first occurrence.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  */
 
 unsigned int
 isc_log_getduplicateinterval(isc_logconfig_t *lcfg);
-/*
+/*%<
  * Get the current duplicate filtering interval.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  *
  * Returns:
- *	The current duplicate filtering interval.
+ *\li	The current duplicate filtering interval.
  */
 
 isc_result_t
 isc_log_settag(isc_logconfig_t *lcfg, const char *tag);
-/*
- * Set the program name or other identifier for ISC_LOG_PRINTTAG.
+/*%<
+ * Set the program name or other identifier for #ISC_LOG_PRINTTAG.
  *
  * Requires:
- *	lcfg is a valid logging configuration.
+ *\li	lcfg is a valid logging configuration.
  *
  * Notes:
- *	If this function has not set the tag to a non-NULL, non-empty value,
- *	then the ISC_LOG_PRINTTAG channel flag will not print anything.
+ *\li	If this function has not set the tag to a non-NULL, non-empty value,
+ *	then the #ISC_LOG_PRINTTAG channel flag will not print anything.
  *	Unlike some implementations of syslog on Unix systems, you *must* set
  *	the tag in order to get it logged.  It is not implicitly derived from
  *	the program name (which is pretty impossible to infer portably).
  *
- *	Setting the tag to NULL or the empty string will also cause the
- *	ISC_LOG_PRINTTAG channel flag to not print anything.  If tag equals the
+ *\li	Setting the tag to NULL or the empty string will also cause the
+ *	#ISC_LOG_PRINTTAG channel flag to not print anything.  If tag equals the
  *	empty string, calls to isc_log_gettag will return NULL.
  *
  * Returns:
- *	ISC_R_SUCCESS	Success
- *	ISC_R_NOMEMORY  Resource Limit: Out of memory
+ *\li	#ISC_R_SUCCESS	Success
+ *\li	#ISC_R_NOMEMORY  Resource Limit: Out of memory
  *
  * XXXDCL when creating a new isc_logconfig_t, it might be nice if the tag
  * of the currently active isc_logconfig_t was inherited.  this does not
@@ -752,33 +783,35 @@ isc_log_settag(isc_logconfig_t *lcfg, const char *tag);
 
 char *
 isc_log_gettag(isc_logconfig_t *lcfg);
-/*
- * Get the current identifier printed with ISC_LOG_PRINTTAG.
+/*%<
+ * Get the current identifier printed with #ISC_LOG_PRINTTAG.
  *
  * Requires:
- *	lcfg is a valid logging configuration.
+ *\li	lcfg is a valid logging configuration.
  *
  * Notes:
- *	Since isc_log_settag() will not associate a zero-length string
+ *\li	Since isc_log_settag() will not associate a zero-length string
  *	with the logging configuration, attempts to do so will cause
  *	this function to return NULL.  However, a determined programmer
  *	will observe that (currently) a tag of length greater than zero
  *	could be set, and then modified to be zero length.
  *
  * Returns:
- *	A pointer to the current identifier, or NULL if none has been set.
+ *\li	A pointer to the current identifier, or NULL if none has been set.
  */
 
 void
 isc_log_opensyslog(const char *tag, int options, int facility);
-/*
+/*%<
  * Initialize syslog logging.
  *
  * Notes:
- *	XXXDCL NT
+ *\li	XXXDCL NT
  *	This is currently equivalent to openlog(), but is not going to remain
  *	that way.  In the meantime, the arguments are all identical to
  *	those used by openlog(3), as follows:
+ *
+ * \code
  *		tag: The string to use in the position of the program
  *			name in syslog messages.  Most (all?) syslogs
  *			will use basename(argv[0]) if tag is NULL.
@@ -789,89 +822,90 @@ isc_log_opensyslog(const char *tag, int options, int facility);
  *		facility: The default syslog facility.  This is irrelevant
  *			since isc_log_write will ALWAYS use the channel's
  *			declared facility.
+ * \endcode
  *
- *	Zero effort has been made (yet) to accomodate systems with openlog()
+ *\li	Zero effort has been made (yet) to accomodate systems with openlog()
  *	that only takes two arguments, or to identify valid syslog
  *	facilities or options for any given architecture.
  *
- *	It is necessary to call isc_log_opensyslog() to initialize
+ *\li	It is necessary to call isc_log_opensyslog() to initialize
  *	syslogging on machines which do not support network connections to
  *	syslogd because they require a Unix domain socket to be used.  Since
  *	this is a chore to determine at run-time, it is suggested that it
  *	always be called by programs using the ISC logging system.
  *
  * Requires:
- *	Nothing.
+ *\li	Nothing.
  *
  * Ensures:
- *	openlog() is called to initialize the syslog system.
+ *\li	openlog() is called to initialize the syslog system.
  */
 
 void
 isc_log_closefilelogs(isc_log_t *lctx);
-/*
- * Close all open files used by ISC_LOG_TOFILE channels.
+/*%<
+ * Close all open files used by #ISC_LOG_TOFILE channels.
  *
  * Notes:
- *	This function is provided for programs that want to use their own
+ *\li	This function is provided for programs that want to use their own
  *	log rolling mechanism rather than the one provided internally.
  *	For example, a program that wanted to keep daily logs would define
- *	a channel which used ISC_LOG_ROLLNEVER, then once a day would
+ *	a channel which used #ISC_LOG_ROLLNEVER, then once a day would
  *	rename the log file and call isc_log_closefilelogs().
  *
- *	ISC_LOG_TOFILEDESC channels are unaffected.
+ *\li	#ISC_LOG_TOFILEDESC channels are unaffected.
  *
  * Requires:
- *	lctx is a valid context.
+ *\li	lctx is a valid context.
  *
  * Ensures:
- *	The open files are closed and will be reopened when they are
+ *\li	The open files are closed and will be reopened when they are
  *	next needed.
  */
 
 isc_logcategory_t *
 isc_log_categorybyname(isc_log_t *lctx, const char *name);
-/*
+/*%<
  * Find a category by its name.
  *
  * Notes:
- *	The string name of a category is not required to be unique.
+ *\li	The string name of a category is not required to be unique.
  *
  * Requires:
- *	lctx is a valid context.
- *	name is not NULL.
+ *\li	lctx is a valid context.
+ *\li	name is not NULL.
  *
  * Returns:
- *	A pointer to the _first_ isc_logcategory_t structure used by "name".
+ *\li	A pointer to the _first_ isc_logcategory_t structure used by "name".
  *
- *	NULL if no category exists by that name.
+ *\li	NULL if no category exists by that name.
  */
 
 isc_logmodule_t *
 isc_log_modulebyname(isc_log_t *lctx, const char *name);
-/*
+/*%<
  * Find a module by its name.
  *
  * Notes:
- *	The string name of a module is not required to be unique.
+ *\li	The string name of a module is not required to be unique.
  *
  * Requires:
- *	lctx is a valid context.
- *	name is not NULL.
+ *\li	lctx is a valid context.
+ *\li	name is not NULL.
  *
  * Returns:
- *	A pointer to the _first_ isc_logmodule_t structure used by "name".
+ *\li	A pointer to the _first_ isc_logmodule_t structure used by "name".
  *
- *	NULL if no module exists by that name.
+ *\li	NULL if no module exists by that name.
  */
 
 void
 isc_log_setcontext(isc_log_t *lctx);
-/*
+/*%<
  * Sets the context used by the libisc for logging.
  *
  * Requires:
- *	lctx be a valid context.
+ *\li	lctx be a valid context.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/magic.h b/contrib/bind9/lib/isc/include/isc/magic.h
index 729e512..045b54f 100644
--- a/contrib/bind9/lib/isc/include/isc/magic.h
+++ b/contrib/bind9/lib/isc/include/isc/magic.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,20 +15,21 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: magic.h,v 1.11.206.1 2004/03/06 08:14:43 marka Exp $ */
+/* $Id: magic.h,v 1.12.18.2 2005/04/29 00:16:59 marka Exp $ */
 
 #ifndef ISC_MAGIC_H
 #define ISC_MAGIC_H 1
 
+/*! \file */
+
 typedef struct {
 	unsigned int magic;
 } isc__magic_t;
 
 
-/*
+/*%
  * To use this macro the magic number MUST be the first thing in the
  * structure, and MUST be of type "unsigned int".
- *
  * The intent of this is to allow magic numbers to be checked even though
  * the object is otherwise opaque.
  */
diff --git a/contrib/bind9/lib/isc/include/isc/md5.h b/contrib/bind9/lib/isc/include/isc/md5.h
index c6c3825..3f9667e 100644
--- a/contrib/bind9/lib/isc/include/isc/md5.h
+++ b/contrib/bind9/lib/isc/include/isc/md5.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: md5.h,v 1.8.206.1 2004/03/06 08:14:43 marka Exp $ */
+/* $Id: md5.h,v 1.9.18.4 2006/02/01 00:10:34 marka Exp $ */
 
-/*
- * This is the header file for the MD5 message-digest algorithm.
+/*! \file 
+ * \brief This is the header file for the MD5 message-digest algorithm.
+ *
  * The algorithm is due to Ron Rivest.  This code was
  * written by Colin Plumb in 1993, no copyright is claimed.
  * This code is in the public domain; do with it what you wish.
@@ -45,7 +46,7 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-#define ISC_MD5_DIGESTLENGTH 16
+#define ISC_MD5_DIGESTLENGTH 16U
 
 typedef struct {
 	isc_uint32_t buf[4];
diff --git a/contrib/bind9/lib/isc/include/isc/mem.h b/contrib/bind9/lib/isc/include/isc/mem.h
index 6455924..dc68bcb 100644
--- a/contrib/bind9/lib/isc/include/isc/mem.h
+++ b/contrib/bind9/lib/isc/include/isc/mem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.h,v 1.54.12.4 2004/10/11 05:55:51 marka Exp $ */
+/* $Id: mem.h,v 1.59.18.9 2006/01/04 23:50:23 marka Exp $ */
 
 #ifndef ISC_MEM_H
 #define ISC_MEM_H 1
 
+/*! \file */
+
 #include <stdio.h>
 
 #include <isc/lang.h>
@@ -36,7 +38,7 @@ typedef void (*isc_mem_water_t)(void *, int);
 typedef void * (*isc_memalloc_t)(void *, size_t);
 typedef void (*isc_memfree_t)(void *, void *);
 
-/*
+/*%
  * Define ISC_MEM_DEBUG=1 to make all functions that free memory
  * set the pointer being freed to NULL after being freed.
  * This is the default; set ISC_MEM_DEBUG=0 to disable it.
@@ -45,7 +47,7 @@ typedef void (*isc_memfree_t)(void *, void *);
 #define ISC_MEM_DEBUG 1
 #endif
 
-/*
+/*%
  * Define ISC_MEM_TRACKLINES=1 to turn on detailed tracing of memory
  * allocation and freeing by file and line number.
  */
@@ -53,7 +55,7 @@ typedef void (*isc_memfree_t)(void *, void *);
 #define ISC_MEM_TRACKLINES 1
 #endif
 
-/*
+/*%
  * Define ISC_MEM_CHECKOVERRUN=1 to turn on checks for using memory outside
  * the requested space.  This will increase the size of each allocation.
  */
@@ -61,7 +63,7 @@ typedef void (*isc_memfree_t)(void *, void *);
 #define ISC_MEM_CHECKOVERRUN 1
 #endif
 
-/*
+/*%
  * Define ISC_MEM_FILL=1 to fill each block of memory returned to the system
  * with the byte string '0xbe'.  This helps track down uninitialized pointers
  * and the like.  On freeing memory, the space is filled with '0xde' for
@@ -71,7 +73,7 @@ typedef void (*isc_memfree_t)(void *, void *);
 #define ISC_MEM_FILL 1
 #endif
 
-/*
+/*%
  * Define ISC_MEMPOOL_NAMES=1 to make memory pools store a symbolic
  * name so that the leaking pool can be more readily identified in
  * case of a memory leak.
@@ -81,27 +83,40 @@ typedef void (*isc_memfree_t)(void *, void *);
 #endif
 
 LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
+/*@{*/
 #define ISC_MEM_DEBUGTRACE		0x00000001U
 #define ISC_MEM_DEBUGRECORD		0x00000002U
 #define ISC_MEM_DEBUGUSAGE		0x00000004U
-/*
+#define ISC_MEM_DEBUGSIZE		0x00000008U
+#define ISC_MEM_DEBUGCTX		0x00000010U
+#define ISC_MEM_DEBUGALL		0x0000001FU
+/*!<
  * The variable isc_mem_debugging holds a set of flags for
  * turning certain memory debugging options on or off at
  * runtime.  Its is intialized to the value ISC_MEM_DEGBUGGING,
  * which is 0 by default but may be overridden at compile time.
  * The following flags can be specified:
  *
- * ISC_MEM_DEBUGTRACE
+ * \li #ISC_MEM_DEBUGTRACE
  *	Log each allocation and free to isc_lctx.
  *
- * ISC_MEM_DEBUGRECORD
+ * \li #ISC_MEM_DEBUGRECORD
  *	Remember each allocation, and match them up on free.
  *	Crash if a free doesn't match an allocation.
  *
- * ISC_MEM_DEBUGUSAGE
+ * \li #ISC_MEM_DEBUGUSAGE
  *	If a hi_water mark is set, print the maximium inuse memory
  *	every time it is raised once it exceeds the hi_water mark.
+ *
+ * \li #ISC_MEM_DEBUGSIZE
+ *	Check the size argument being passed to isc_mem_put() matches
+ *	that passed to isc_mem_get().
+ *
+ * \li #ISC_MEM_DEBUGCTX
+ *	Check the mctx argument being passed to isc_mem_put() matches
+ *	that passed to isc_mem_get().
  */
+/*@}*/
 
 #if ISC_MEM_TRACKLINES
 #define _ISC_MEM_FILELINE	, __FILE__, __LINE__
@@ -111,17 +126,43 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
 #define _ISC_MEM_FLARG
 #endif
 
+/*!
+ * Define ISC_MEM_USE_INTERNAL_MALLOC=1 to use the internal malloc()
+ * implementation in preference to the system one.  The internal malloc()
+ * is very space-efficient, and quite fast on uniprocessor systems.  It
+ * performs poorly on multiprocessor machines.
+ * JT: we can overcome the performance issue on multiprocessor machines
+ * by carefully separating memory contexts.
+ */
+
+#ifndef ISC_MEM_USE_INTERNAL_MALLOC
+#define ISC_MEM_USE_INTERNAL_MALLOC 1
+#endif
+
+/*
+ * Flags for isc_mem_create2()calls.
+ */
+#define ISC_MEMFLAG_NOLOCK	0x00000001	 /* no lock is necessary */
+#define ISC_MEMFLAG_INTERNAL	0x00000002	 /* use internal malloc */
+#if ISC_MEM_USE_INTERNAL_MALLOC
+#define ISC_MEMFLAG_DEFAULT 	ISC_MEMFLAG_INTERNAL
+#else
+#define ISC_MEMFLAG_DEFAULT 	0
+#endif
+
+
 #define isc_mem_get(c, s)	isc__mem_get((c), (s) _ISC_MEM_FILELINE)
 #define isc_mem_allocate(c, s)	isc__mem_allocate((c), (s) _ISC_MEM_FILELINE)
 #define isc_mem_strdup(c, p)	isc__mem_strdup((c), (p) _ISC_MEM_FILELINE)
 #define isc_mempool_get(c)	isc__mempool_get((c) _ISC_MEM_FILELINE)
 
-/*
+/*% 
  * isc_mem_putanddetach() is a convienence function for use where you
  * have a structure with an attached memory context.
  *
  * Given:
  *
+ * \code
  * struct {
  *	...
  *	isc_mem_t *mctx;
@@ -131,14 +172,17 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
  * isc_mem_t *mctx;
  *
  * isc_mem_putanddetach(&ptr->mctx, ptr, sizeof(*ptr));
+ * \endcode
  *
  * is the equivalent of:
  *
+ * \code
  * mctx = NULL;
  * isc_mem_attach(ptr->mctx, &mctx);
  * isc_mem_detach(&ptr->mctx);
  * isc_mem_put(mctx, ptr, sizeof(*ptr));
  * isc_mem_detach(&mctx);
+ * \endcode
  */
 
 #if ISC_MEM_DEBUG
@@ -170,25 +214,35 @@ LIBISC_EXTERNAL_DATA extern unsigned int isc_mem_debugging;
 #define isc_mempool_put(c, p)	isc__mempool_put((c), (p) _ISC_MEM_FILELINE)
 #endif
 
+/*@{*/
 isc_result_t 
 isc_mem_create(size_t max_size, size_t target_size,
 	       isc_mem_t **mctxp);
 
+isc_result_t
+isc_mem_create2(size_t max_size, size_t target_size,
+		isc_mem_t **mctxp, unsigned int flags);
+
 isc_result_t 
 isc_mem_createx(size_t max_size, size_t target_size,
 		isc_memalloc_t memalloc, isc_memfree_t memfree,
 		void *arg, isc_mem_t **mctxp);
-/*
- * Create a memory context.
+
+isc_result_t 
+isc_mem_createx2(size_t max_size, size_t target_size,
+		 isc_memalloc_t memalloc, isc_memfree_t memfree,
+		 void *arg, isc_mem_t **mctxp, unsigned int flags);
+
+/*!<
+ * \brief Create a memory context.
  *
  * 'max_size' and 'target_size' are tuning parameters.  When
- * ISC_MEM_USE_INTERNAL_MALLOC is true, allocations smaller than
- * 'max_size' will be satisfied by getting blocks of size
- * 'target_size' from the system allocator and breaking them up into
- * pieces; larger allocations will use the system allocator directly.
- * If 'max_size' and/or 'target_size' are zero, default values will be
- * used.  When ISC_MEM_USE_INTERNAL_MALLOC is false, 'target_size' is
- * ignored.
+ * ISC_MEMFLAG_INTERNAL is set, allocations smaller than 'max_size'
+ * will be satisfied by getting blocks of size 'target_size' from the
+ * system allocator and breaking them up into pieces; larger allocations
+ * will use the system allocator directly. If 'max_size' and/or
+ * 'target_size' are zero, default values will be * used.  When
+ * ISC_MEMFLAG_INTERNAL is not set, 'target_size' is ignored.
  *
  * 'max_size' is also used to size the statistics arrays and the array
  * used to record active memory when ISC_MEM_DEBUGRECORD is set.  Settin
@@ -200,15 +254,23 @@ isc_mem_createx(size_t max_size, size_t target_size,
  * using isc_mem_create() will use the standard library malloc()
  * and free().
  *
+ * If ISC_MEMFLAG_NOLOCK is set in 'flags', the corresponding memory context
+ * will be accessed without locking.  The user who creates the context must
+ * ensure there be no race.  Since this can be a source of bug, it is generally
+ * inadvisable to use this flag unless the user is very sure about the race
+ * condition and the access to the object is highly performance sensitive.
+ *
  * Requires:
  * mctxp != NULL && *mctxp == NULL */
+/*@}*/
 
+/*@{*/
 void 
 isc_mem_attach(isc_mem_t *, isc_mem_t **);
 void 
 isc_mem_detach(isc_mem_t **);
-/*
- * Attach to / detach from a memory context.
+/*!<
+ * \brief Attach to / detach from a memory context.
  *
  * This is intended for applications that use multiple memory contexts
  * in such a way that it is not obvious when the last allocations from
@@ -219,10 +281,11 @@ isc_mem_detach(isc_mem_t **);
  * and destroy it at the end of main(), thereby guaranteeing that it
  * is not destroyed while there are outstanding allocations.
  */
+/*@}*/
 
 void 
 isc_mem_destroy(isc_mem_t **);
-/*
+/*%<
  * Destroy a memory context.
  */
 
@@ -230,38 +293,40 @@ isc_result_t
 isc_mem_ondestroy(isc_mem_t *ctx,
 		  isc_task_t *task,
 		  isc_event_t **event);
-/*
+/*%<
  * Request to be notified with an event when a memory context has
  * been successfully destroyed.
  */
 
 void 
 isc_mem_stats(isc_mem_t *mctx, FILE *out);
-/*
+/*%<
  * Print memory usage statistics for 'mctx' on the stream 'out'.
  */
 
 void 
 isc_mem_setdestroycheck(isc_mem_t *mctx,
 			isc_boolean_t on);
-/*
- * Iff 'on' is ISC_TRUE, 'mctx' will check for memory leaks when
+/*%<
+ * If 'on' is ISC_TRUE, 'mctx' will check for memory leaks when
  * destroyed and abort the program if any are present.
  */
 
+/*@{*/
 void 
 isc_mem_setquota(isc_mem_t *, size_t);
 size_t 
 isc_mem_getquota(isc_mem_t *);
-/*
+/*%<
  * Set/get the memory quota of 'mctx'.  This is a hard limit
  * on the amount of memory that may be allocated from mctx;
  * if it is exceeded, allocations will fail.
  */
+/*@}*/
 
 size_t 
 isc_mem_inuse(isc_mem_t *mctx);
-/*
+/*%<
  * Get an estimate of the number of memory in use in 'mctx', in bytes.
  * This includes quantization overhead, but does not include memory
  * allocated from the system but not yet used.
@@ -270,11 +335,13 @@ isc_mem_inuse(isc_mem_t *mctx);
 void
 isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
 		 size_t hiwater, size_t lowater);
-/*
- * Set high and low water marks for this memory context.  When the memory
- * usage of 'mctx' exceeds 'hiwater', '(water)(water_arg, ISC_MEM_HIWATER)'
+/*%<
+ * Set high and low water marks for this memory context.  
+ * 
+ * When the memory
+ * usage of 'mctx' exceeds 'hiwater', '(water)(water_arg, #ISC_MEM_HIWATER)'
  * will be called.  When the usage drops below 'lowater', 'water' will
- * again be called, this time with ISC_MEM_LOWATER.
+ * again be called, this time with #ISC_MEM_LOWATER.
  *
  * If 'water' is NULL then 'water_arg', 'hi_water' and 'lo_water' are
  * ignored and the state is reset.
@@ -285,53 +352,77 @@ isc_mem_setwater(isc_mem_t *mctx, isc_mem_water_t water, void *water_arg,
  *	hi_water >= lo_water
  */
 
+void
+isc_mem_printactive(isc_mem_t *mctx, FILE *file);
+/*%<
+ * Print to 'file' all active memory in 'mctx'.
+ *
+ * Requires ISC_MEM_DEBUGRECORD to have been set.
+ */
+
+void
+isc_mem_printallactive(FILE *file);
+/*%<
+ * Print to 'file' all active memory in all contexts.
+ *
+ * Requires ISC_MEM_DEBUGRECORD to have been set.
+ */
+
+void
+isc_mem_checkdestroyed(FILE *file);
+/*%<
+ * Check that all memory contexts have been destroyed.
+ * Prints out those that have not been.
+ * Fatally fails if there are still active contexts.
+ */
+
 /*
  * Memory pools
  */
 
 isc_result_t
 isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp);
-/*
+/*%<
  * Create a memory pool.
  *
  * Requires:
- *	mctx is a valid memory context.
- *	size > 0
- *	mpctxp != NULL and *mpctxp == NULL
+ *\li	mctx is a valid memory context.
+ *\li	size > 0
+ *\li	mpctxp != NULL and *mpctxp == NULL
  *
  * Defaults:
- *	maxalloc = UINT_MAX
- *	freemax = 1
- *	fillcount = 1
+ *\li	maxalloc = UINT_MAX
+ *\li	freemax = 1
+ *\li	fillcount = 1
  *
  * Returns:
- *	ISC_R_NOMEMORY		-- not enough memory to create pool
- *	ISC_R_SUCCESS		-- all is well.
+ *\li	#ISC_R_NOMEMORY		-- not enough memory to create pool
+ *\li	#ISC_R_SUCCESS		-- all is well.
  */
 
 void
 isc_mempool_destroy(isc_mempool_t **mpctxp);
-/*
+/*%<
  * Destroy a memory pool.
  *
  * Requires:
- *	mpctxp != NULL && *mpctxp is a valid pool.
- *	The pool has no un"put" allocations outstanding
+ *\li	mpctxp != NULL && *mpctxp is a valid pool.
+ *\li	The pool has no un"put" allocations outstanding
  */
 
 void
 isc_mempool_setname(isc_mempool_t *mpctx, const char *name);
-/*
+/*%<
  * Associate a name with a memory pool.  At most 15 characters may be used.
  *
  * Requires:
- *	mpctx is a valid pool.
- *	name != NULL;
+ *\li	mpctx is a valid pool.
+ *\li	name != NULL;
  */
 
 void
 isc_mempool_associatelock(isc_mempool_t *mpctx, isc_mutex_t *lock);
-/*
+/*%<
  * Associate a lock with this memory pool.
  *
  * This lock is used when getting or putting items using this memory pool,
@@ -346,13 +437,13 @@ isc_mempool_associatelock(isc_mempool_t *mpctx, isc_mutex_t *lock);
  *
  * Requires:
  *
- *	mpctpx is a valid pool.
+ *\li	mpctpx is a valid pool.
  *
- *	lock != NULL.
+ *\li	lock != NULL.
  *
- *	No previous lock is assigned to this pool.
+ *\li	No previous lock is assigned to this pool.
  *
- *	The lock is initialized before calling this function via the normal
+ *\li	The lock is initialized before calling this function via the normal
  *	means of doing that.
  */
 
@@ -372,57 +463,57 @@ isc_mempool_associatelock(isc_mempool_t *mpctx, isc_mutex_t *lock);
 
 unsigned int
 isc_mempool_getfreemax(isc_mempool_t *mpctx);
-/*
+/*%<
  * Returns the maximum allowed size of the free list.
  */
 
 void
 isc_mempool_setfreemax(isc_mempool_t *mpctx, unsigned int limit);
-/*
+/*%<
  * Sets the maximum allowed size of the free list.
  */
 
 unsigned int
 isc_mempool_getfreecount(isc_mempool_t *mpctx);
-/*
+/*%<
  * Returns current size of the free list.
  */
 
 unsigned int
 isc_mempool_getmaxalloc(isc_mempool_t *mpctx);
-/*
+/*!<
  * Returns the maximum allowed number of allocations.
  */
 
 void
 isc_mempool_setmaxalloc(isc_mempool_t *mpctx, unsigned int limit);
-/*
+/*%<
  * Sets the maximum allowed number of allocations.
  *
  * Additional requirements:
- *	limit > 0
+ *\li	limit > 0
  */
 
 unsigned int
 isc_mempool_getallocated(isc_mempool_t *mpctx);
-/*
+/*%<
  * Returns the number of items allocated from this pool.
  */
 
 unsigned int
 isc_mempool_getfillcount(isc_mempool_t *mpctx);
-/*
+/*%<
  * Returns the number of items allocated as a block from the parent memory
  * context when the free list is empty.
  */
 
 void
 isc_mempool_setfillcount(isc_mempool_t *mpctx, unsigned int limit);
-/*
+/*%<
  * Sets the fillcount.
  *
  * Additional requirements:
- *	limit > 0
+ *\li	limit > 0
  */
 
 
diff --git a/contrib/bind9/lib/isc/include/isc/msgcat.h b/contrib/bind9/lib/isc/include/isc/msgcat.h
index 97839fa..813b57c 100644
--- a/contrib/bind9/lib/isc/include/isc/msgcat.h
+++ b/contrib/bind9/lib/isc/include/isc/msgcat.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: msgcat.h,v 1.8.206.1 2004/03/06 08:14:44 marka Exp $ */
+/* $Id: msgcat.h,v 1.9.18.2 2005/04/29 00:16:59 marka Exp $ */
 
 #ifndef ISC_MSGCAT_H
 #define ISC_MSGCAT_H 1
@@ -24,34 +24,33 @@
  ***** Module Info
  *****/
 
-/*
- * ISC Message Catalog
- *
- * Message catalogs aid internationalization of applications by allowing
+/*! \file isc/msgcat.h
+ * \brief The ISC Message Catalog
+ * aids internationalization of applications by allowing
  * messages to be retrieved from locale-specific files instead of
  * hardwiring them into the application.  This allows translations of
  * messages appropriate to the locale to be supplied without recompiling
  * the application.
  *
  * Notes:
- *	It's very important that message catalogs work, even if only the
+ *\li	It's very important that message catalogs work, even if only the
  *	default_text can be used.
  *
  * MP:
- *	The caller must ensure appropriate synchronization of
+ *\li	The caller must ensure appropriate synchronization of
  *	isc_msgcat_open() and isc_msgcat_close().  isc_msgcat_get()
  *	ensures appropriate synchronization.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	<TBS>
+ *\li	TBS
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -70,61 +69,61 @@ ISC_LANG_BEGINDECLS
 
 void
 isc_msgcat_open(const char *name, isc_msgcat_t **msgcatp);
-/*
+/*%<
  * Open a message catalog.
  *
  * Notes:
  *
- *	If memory cannot be allocated or other failures occur, *msgcatp
+ *\li	If memory cannot be allocated or other failures occur, *msgcatp
  *	will be set to NULL.  If a NULL msgcat is given to isc_msgcat_get(),
  *	the default_text will be returned, ensuring that some message text
  *	will be available, no matter what's going wrong.
  *
  * Requires:
  *
- *	'name' is a valid string.
+ *\li	'name' is a valid string.
  *
- *	msgcatp != NULL && *msgcatp == NULL
+ *\li	msgcatp != NULL && *msgcatp == NULL
  */
 
 void
 isc_msgcat_close(isc_msgcat_t **msgcatp);
-/*
+/*%<
  * Close a message catalog.
  *
  * Notes:
  *
- *	Any string pointers returned by prior calls to isc_msgcat_get() are
+ *\li	Any string pointers returned by prior calls to isc_msgcat_get() are
  *	invalid after isc_msgcat_close() has been called and must not be
  *	used.
  *
  * Requires:
  *
- *	*msgcatp is a valid message catalog or is NULL.
+ *\li	*msgcatp is a valid message catalog or is NULL.
  *
  * Ensures:
  *
- *	All resources associated with the message catalog are released.
+ *\li	All resources associated with the message catalog are released.
  *
- *	*msgcatp == NULL
+ *\li	*msgcatp == NULL
  */
 
 const char *
 isc_msgcat_get(isc_msgcat_t *msgcat, int set, int message,
 	       const char *default_text);
-/*
+/*%<
  * Get message 'message' from message set 'set' in 'msgcat'.  If it
  * is not available, use 'default_text'.
  *
  * Requires:
  *
- *	'msgcat' is a valid message catalog or is NULL.
+ *\li	'msgcat' is a valid message catalog or is NULL.
  *
- *	set > 0
+ *\li	set > 0
  *
- *	message > 0
+ *\li	message > 0
  *
- *	'default_text' is a valid string.
+ *\li	'default_text' is a valid string.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/msgs.h b/contrib/bind9/lib/isc/include/isc/msgs.h
index 967005b..97b2108 100644
--- a/contrib/bind9/lib/isc/include/isc/msgs.h
+++ b/contrib/bind9/lib/isc/include/isc/msgs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,16 +15,20 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: msgs.h,v 1.5.2.2.8.3 2004/03/06 08:14:44 marka Exp $ */
+/* $Id: msgs.h,v 1.9.18.2 2005/04/29 00:16:59 marka Exp $ */
 
 #ifndef ISC_MSGS_H
 #define ISC_MSGS_H 1
 
+/*! \file */
+
 #include <isc/lib.h>		/* Provide isc_msgcat global variable. */
 #include <isc/msgcat.h>		/* Provide isc_msgcat_*() functions. */
 
-/*
- * Message sets, named per source file, excepting "GENERAL".
+/*@{*/
+/*!
+ * \brief Message sets, named per source file, excepting "GENERAL".
+ *
  * IMPORTANT: The original list is alphabetical, but any new sets must
  * be added to the end.
  */
@@ -49,135 +53,139 @@
 #define ISC_MSGSET_TIMER	19
 #define ISC_MSGSET_UTIL		20
 #define ISC_MSGSET_IFITERGETIFADDRS 21
+/*@}*/
 
-/*
- * Message numbers.  They are only required to be unique per message set,
+/*@{*/
+/*!
+ * Message numbers  
+ * are only required to be unique per message set,
  * but are unique throughout the entire catalog to not be as confusing when
  * debugging.
  *
  * The initial numbering was done by multiply by 100 the set number the
  * message appears in then adding the incremental message number.
  */
-#define ISC_MSG_FAILED		101 /* "failed" */
-#define ISC_MSG_SUCCEEDED	102 /* Compatible with "failed" */
-#define ISC_MSG_SUCCESS		103 /* More usual way to say "success" */
-#define ISC_MSG_STARTING	104 /* As in "daemon: starting" */
-#define ISC_MSG_STOPING		105 /* As in "daemon: stopping" */
-#define ISC_MSG_ENTERING	106 /* As in "some_subr: entering" */
-#define ISC_MSG_EXITING		107 /* As in "some_subr: exiting" */
-#define ISC_MSG_CALLING		108 /* As in "calling some_subr()" */
-#define ISC_MSG_RETURNED	109 /* As in "some_subr: returned <foo>" */
-#define ISC_MSG_FATALERROR	110 /* "fatal error" */
-#define ISC_MSG_SHUTTINGDOWN	111 /* "shutting down" */
-#define ISC_MSG_RUNNING		112 /* "running" */
-#define ISC_MSG_WAIT		113 /* "wait" */
-#define ISC_MSG_WAITUNTIL	114 /* "waituntil" */
-
-#define ISC_MSG_SIGNALSETUP	201 /* "handle_signal() %d setup: %s" */
-
-#define ISC_MSG_ILLEGALOPT	301 /* "illegal option" */
-#define ISC_MSG_OPTNEEDARG	302 /* "option requires an argument" */
-
-#define ISC_MSG_ENTROPYSTATS	401 /* "Entropy pool %p:  refcnt %u ..." */
-
-#define ISC_MSG_MAKESCANSOCKET	501 /* "making interface scan socket: %s" */
-#define ISC_MSG_GETIFCONFIG	502 /* "get interface configuration: %s" */
-#define ISC_MSG_BUFFERMAX	503 /* "... maximum buffer size exceeded" */
-#define ISC_MSG_GETDESTADDR	504 /* "%s: getting destination address: %s" */
-#define ISC_MSG_GETNETMASK	505 /* "%s: getting netmask: %s" */
-
-#define ISC_MSG_GETIFLISTSIZE	601 /* "getting interface list size: ..." */
-#define ISC_MSG_GETIFLIST	602 /* "getting interface list: ..." */
-#define ISC_MSG_UNEXPECTEDTYPE	603 /* "... unexpected ... message type" */
-
-#define ISC_MSG_UNEXPECTEDSTATE	701 /* "Unexpected state %d" */
-
-#define ISC_MSG_BADTIME		801 /* "Bad 00 99:99:99.999 " */
-#define ISC_MSG_LEVEL		802 /* "level %d: " */
-
-#define ISC_MSG_ADDTRACE	901 /* "add %p size %u " */
-#define ISC_MSG_DELTRACE	902 /* "del %p size %u " */
-#define ISC_MSG_POOLSTATS	903 /* "[Pool statistics]\n" */
-#define ISC_MSG_POOLNAME	904 /* "name" */
-#define ISC_MSG_POOLSIZE	905 /* "size" */
-#define ISC_MSG_POOLMAXALLOC	906 /* "maxalloc" */
-#define ISC_MSG_POOLALLOCATED	907 /* "allocated" */
-#define ISC_MSG_POOLFREECOUNT	908 /* "freecount" */
-#define ISC_MSG_POOLFREEMAX	909 /* "freemax" */
-#define ISC_MSG_POOLFILLCOUNT	910 /* "fillcount" */
-#define ISC_MSG_POOLGETS	911 /* "gets" */
-#define ISC_MSG_DUMPALLOC	912 /* "DUMP OF ALL OUTSTANDING MEMORY ..." */
-#define ISC_MSG_NONE		913 /* "\tNone.\n" */
-#define ISC_MSG_PTRFILELINE	914 /* "\tptr %p file %s line %u\n" */
-
-#define ISC_MSG_UNKNOWNADDR    1001 /* "<unknown address, family %u>" */
-
-#define ISC_MSG_NOLONGDBL      1104 /* "long doubles are not supported" */
-
-#define ISC_MSG_PRINTLOCK      1201 /* "rwlock %p thread %lu ..." */
-#define ISC_MSG_READ	       1202 /* "read" */
-#define ISC_MSG_WRITE	       1203 /* "write" */
-#define ISC_MSG_READING	       1204 /* "reading" */
-#define ISC_MSG_WRITING	       1205 /* "writing" */
-#define ISC_MSG_PRELOCK	       1206 /* "prelock" */
-#define ISC_MSG_POSTLOCK       1207 /* "postlock" */
-#define ISC_MSG_PREUNLOCK      1208 /* "preunlock" */
-#define ISC_MSG_POSTUNLOCK     1209 /* "postunlock" */
-
-#define ISC_MSG_UNKNOWNFAMILY  1301 /* "unknown address family: %d" */
-
-#define ISC_MSG_WRITEFAILED    1401 /* "write() failed during watcher ..." */
-#define ISC_MSG_READFAILED     1402 /* "read() failed during watcher ... " */
-#define ISC_MSG_PROCESSCMSG    1403 /* "processing cmsg %p" */
-#define ISC_MSG_IFRECEIVED     1404 /* "interface received on ifindex %u" */
-#define ISC_MSG_SENDTODATA     1405 /* "sendto pktinfo data, ifindex %u" */
-#define ISC_MSG_DOIORECV       1406 /* "doio_recv: recvmsg(%d) %d bytes ..." */
-#define ISC_MSG_PKTRECV	       1407 /* "packet received correctly" */
-#define ISC_MSG_DESTROYING     1408 /* "destroying" */
-#define ISC_MSG_CREATED	       1409 /* "created" */
-#define ISC_MSG_ACCEPTLOCK     1410 /* "internal_accept called, locked ..." */
-#define ISC_MSG_ACCEPTEDCXN    1411 /* "accepted connection, new socket %p" */
-#define ISC_MSG_INTERNALRECV   1412 /* "internal_recv: task %p got event %p" */
-#define ISC_MSG_INTERNALSEND   1413 /* "internal_send: task %p got event %p" */
-#define ISC_MSG_WATCHERMSG     1414 /* "watcher got message %d" */
-#define ISC_MSG_SOCKETSREMAIN  1415 /* "sockets exist" */
-#define ISC_MSG_PKTINFOPROVIDED	1416 /* "pktinfo structure provided, ..." */
-#define ISC_MSG_BOUND	       1417 /* "bound" */
-#define ISC_MSG_ACCEPTRETURNED 1418 /* accept() returned %d/%s */
-#define ISC_MSG_TOOMANYFDS     1419 /* %s: too many open file descriptors */
-#define ISC_MSG_ZEROPORT       1420 /* dropping source port zero packet */
-#define ISC_MSG_FILTER	       1420 /* setsockopt(SO_ACCEPTFILTER): %s */
-
-#define ISC_MSG_AWAKE	       1502 /* "awake" */
-#define ISC_MSG_WORKING	       1503 /* "working" */
-#define ISC_MSG_EXECUTE	       1504 /* "execute action" */
-#define ISC_MSG_EMPTY	       1505 /* "empty" */
-#define ISC_MSG_DONE	       1506 /* "done" */
-#define ISC_MSG_QUANTUM	       1507 /* "quantum" */
-
-#define ISC_MSG_SCHEDULE       1601 /* "schedule" */
-#define ISC_MSG_SIGNALSCHED    1602 /* "signal (schedule)" */
-#define ISC_MSG_SIGNALDESCHED  1603 /* "signal (deschedule)" */
-#define ISC_MSG_SIGNALDESTROY  1604 /* "signal (destroy)" */
-#define ISC_MSG_IDLERESCHED    1605 /* "idle reschedule" */
-#define ISC_MSG_EVENTNOTALLOC  1606 /* "couldn't allocate event" */
-#define ISC_MSG_SCHEDFAIL      1607 /* "couldn't schedule timer: %u" */
-#define ISC_MSG_POSTING	       1608 /* "posting" */
-#define ISC_MSG_WAKEUP	       1609 /* "wakeup" */
-
-#define ISC_MSG_LOCK	       1701 /* "LOCK" */
-#define ISC_MSG_LOCKING	       1702 /* "LOCKING" */
-#define ISC_MSG_LOCKED	       1703 /* "LOCKED" */
-#define ISC_MSG_UNLOCKED       1704 /* "UNLOCKED" */
-#define ISC_MSG_RWLOCK	       1705 /* "RWLOCK" */
-#define ISC_MSG_RWLOCKED       1706 /* "RWLOCKED" */
-#define ISC_MSG_RWUNLOCK       1707 /* "RWUNLOCK" */
-#define ISC_MSG_BROADCAST      1708 /* "BROADCAST" */
-#define ISC_MSG_SIGNAL	       1709 /* "SIGNAL" */
-#define ISC_MSG_UTILWAIT       1710 /* "WAIT" */
-#define ISC_MSG_WAITED	       1711 /* "WAITED" */
-
-#define ISC_MSG_GETIFADDRS     1801 /* "getting interface addresses: ..." */
-
+#define ISC_MSG_FAILED		101 /*%< "failed" */
+#define ISC_MSG_SUCCEEDED	102 /*%< Compatible with "failed" */
+#define ISC_MSG_SUCCESS		103 /*%< More usual way to say "success" */
+#define ISC_MSG_STARTING	104 /*%< As in "daemon: starting" */
+#define ISC_MSG_STOPING		105 /*%< As in "daemon: stopping" */
+#define ISC_MSG_ENTERING	106 /*%< As in "some_subr: entering" */
+#define ISC_MSG_EXITING		107 /*%< As in "some_subr: exiting" */
+#define ISC_MSG_CALLING		108 /*%< As in "calling some_subr()" */
+#define ISC_MSG_RETURNED	109 /*%< As in "some_subr: returned <foo>" */
+#define ISC_MSG_FATALERROR	110 /*%< "fatal error" */
+#define ISC_MSG_SHUTTINGDOWN	111 /*%< "shutting down" */
+#define ISC_MSG_RUNNING		112 /*%< "running" */
+#define ISC_MSG_WAIT		113 /*%< "wait" */
+#define ISC_MSG_WAITUNTIL	114 /*%< "waituntil" */
+
+#define ISC_MSG_SIGNALSETUP	201 /*%< "handle_signal() %d setup: %s" */
+
+#define ISC_MSG_ILLEGALOPT	301 /*%< "illegal option" */
+#define ISC_MSG_OPTNEEDARG	302 /*%< "option requires an argument" */
+
+#define ISC_MSG_ENTROPYSTATS	401 /*%< "Entropy pool %p:  refcnt %u ..." */
+
+#define ISC_MSG_MAKESCANSOCKET	501 /*%< "making interface scan socket: %s" */
+#define ISC_MSG_GETIFCONFIG	502 /*%< "get interface configuration: %s" */
+#define ISC_MSG_BUFFERMAX	503 /*%< "... maximum buffer size exceeded" */
+#define ISC_MSG_GETDESTADDR	504 /*%< "%s: getting destination address: %s" */
+#define ISC_MSG_GETNETMASK	505 /*%< "%s: getting netmask: %s" */
+
+#define ISC_MSG_GETIFLISTSIZE	601 /*%< "getting interface list size: ..." */
+#define ISC_MSG_GETIFLIST	602 /*%< "getting interface list: ..." */
+#define ISC_MSG_UNEXPECTEDTYPE	603 /*%< "... unexpected ... message type" */
+
+#define ISC_MSG_UNEXPECTEDSTATE	701 /*%< "Unexpected state %d" */
+
+#define ISC_MSG_BADTIME		801 /*%< "Bad 00 99:99:99.999 " */
+#define ISC_MSG_LEVEL		802 /*%< "level %d: " */
+
+#define ISC_MSG_ADDTRACE	901 /*%< "add %p size %u " */
+#define ISC_MSG_DELTRACE	902 /*%< "del %p size %u " */
+#define ISC_MSG_POOLSTATS	903 /*%< "[Pool statistics]\n" */
+#define ISC_MSG_POOLNAME	904 /*%< "name" */
+#define ISC_MSG_POOLSIZE	905 /*%< "size" */
+#define ISC_MSG_POOLMAXALLOC	906 /*%< "maxalloc" */
+#define ISC_MSG_POOLALLOCATED	907 /*%< "allocated" */
+#define ISC_MSG_POOLFREECOUNT	908 /*%< "freecount" */
+#define ISC_MSG_POOLFREEMAX	909 /*%< "freemax" */
+#define ISC_MSG_POOLFILLCOUNT	910 /*%< "fillcount" */
+#define ISC_MSG_POOLGETS	911 /*%< "gets" */
+#define ISC_MSG_DUMPALLOC	912 /*%< "DUMP OF ALL OUTSTANDING MEMORY ..." */
+#define ISC_MSG_NONE		913 /*%< "\tNone.\n" */
+#define ISC_MSG_PTRFILELINE	914 /*%< "\tptr %p file %s line %u\n" */
+
+#define ISC_MSG_UNKNOWNADDR    1001 /*%< "<unknown address, family %u>" */
+
+#define ISC_MSG_NOLONGDBL      1104 /*%< "long doubles are not supported" */
+
+#define ISC_MSG_PRINTLOCK      1201 /*%< "rwlock %p thread %lu ..." */
+#define ISC_MSG_READ	       1202 /*%< "read" */
+#define ISC_MSG_WRITE	       1203 /*%< "write" */
+#define ISC_MSG_READING	       1204 /*%< "reading" */
+#define ISC_MSG_WRITING	       1205 /*%< "writing" */
+#define ISC_MSG_PRELOCK	       1206 /*%< "prelock" */
+#define ISC_MSG_POSTLOCK       1207 /*%< "postlock" */
+#define ISC_MSG_PREUNLOCK      1208 /*%< "preunlock" */
+#define ISC_MSG_POSTUNLOCK     1209 /*%< "postunlock" */
+
+#define ISC_MSG_UNKNOWNFAMILY  1301 /*%< "unknown address family: %d" */
+
+#define ISC_MSG_WRITEFAILED    1401 /*%< "write() failed during watcher ..." */
+#define ISC_MSG_READFAILED     1402 /*%< "read() failed during watcher ... " */
+#define ISC_MSG_PROCESSCMSG    1403 /*%< "processing cmsg %p" */
+#define ISC_MSG_IFRECEIVED     1404 /*%< "interface received on ifindex %u" */
+#define ISC_MSG_SENDTODATA     1405 /*%< "sendto pktinfo data, ifindex %u" */
+#define ISC_MSG_DOIORECV       1406 /*%< "doio_recv: recvmsg(%d) %d bytes ..." */
+#define ISC_MSG_PKTRECV	       1407 /*%< "packet received correctly" */
+#define ISC_MSG_DESTROYING     1408 /*%< "destroying" */
+#define ISC_MSG_CREATED	       1409 /*%< "created" */
+#define ISC_MSG_ACCEPTLOCK     1410 /*%< "internal_accept called, locked ..." */
+#define ISC_MSG_ACCEPTEDCXN    1411 /*%< "accepted connection, new socket %p" */
+#define ISC_MSG_INTERNALRECV   1412 /*%< "internal_recv: task %p got event %p" */
+#define ISC_MSG_INTERNALSEND   1413 /*%< "internal_send: task %p got event %p" */
+#define ISC_MSG_WATCHERMSG     1414 /*%< "watcher got message %d" */
+#define ISC_MSG_SOCKETSREMAIN  1415 /*%< "sockets exist" */
+#define ISC_MSG_PKTINFOPROVIDED	1416 /*%< "pktinfo structure provided, ..." */
+#define ISC_MSG_BOUND	       1417 /*%< "bound" */
+#define ISC_MSG_ACCEPTRETURNED 1418 /*%< accept() returned %d/%s */
+#define ISC_MSG_TOOMANYFDS     1419 /*%< %s: too many open file descriptors */
+#define ISC_MSG_ZEROPORT       1420 /*%< dropping source port zero packet */
+#define ISC_MSG_FILTER	       1420 /*%< setsockopt(SO_ACCEPTFILTER): %s */
+
+#define ISC_MSG_AWAKE	       1502 /*%< "awake" */
+#define ISC_MSG_WORKING	       1503 /*%< "working" */
+#define ISC_MSG_EXECUTE	       1504 /*%< "execute action" */
+#define ISC_MSG_EMPTY	       1505 /*%< "empty" */
+#define ISC_MSG_DONE	       1506 /*%< "done" */
+#define ISC_MSG_QUANTUM	       1507 /*%< "quantum" */
+
+#define ISC_MSG_SCHEDULE       1601 /*%< "schedule" */
+#define ISC_MSG_SIGNALSCHED    1602 /*%< "signal (schedule)" */
+#define ISC_MSG_SIGNALDESCHED  1603 /*%< "signal (deschedule)" */
+#define ISC_MSG_SIGNALDESTROY  1604 /*%< "signal (destroy)" */
+#define ISC_MSG_IDLERESCHED    1605 /*%< "idle reschedule" */
+#define ISC_MSG_EVENTNOTALLOC  1606 /*%< "couldn't allocate event" */
+#define ISC_MSG_SCHEDFAIL      1607 /*%< "couldn't schedule timer: %u" */
+#define ISC_MSG_POSTING	       1608 /*%< "posting" */
+#define ISC_MSG_WAKEUP	       1609 /*%< "wakeup" */
+
+#define ISC_MSG_LOCK	       1701 /*%< "LOCK" */
+#define ISC_MSG_LOCKING	       1702 /*%< "LOCKING" */
+#define ISC_MSG_LOCKED	       1703 /*%< "LOCKED" */
+#define ISC_MSG_UNLOCKED       1704 /*%< "UNLOCKED" */
+#define ISC_MSG_RWLOCK	       1705 /*%< "RWLOCK" */
+#define ISC_MSG_RWLOCKED       1706 /*%< "RWLOCKED" */
+#define ISC_MSG_RWUNLOCK       1707 /*%< "RWUNLOCK" */
+#define ISC_MSG_BROADCAST      1708 /*%< "BROADCAST" */
+#define ISC_MSG_SIGNAL	       1709 /*%< "SIGNAL" */
+#define ISC_MSG_UTILWAIT       1710 /*%< "WAIT" */
+#define ISC_MSG_WAITED	       1711 /*%< "WAITED" */
+
+#define ISC_MSG_GETIFADDRS     1801 /*%< "getting interface addresses: ..." */
+
+/*@}*/
 
 #endif /* ISC_MSGS_H */
diff --git a/contrib/bind9/lib/isc/include/isc/mutexblock.h b/contrib/bind9/lib/isc/include/isc/mutexblock.h
index 9bfd90c..fa244c9 100644
--- a/contrib/bind9/lib/isc/include/isc/mutexblock.h
+++ b/contrib/bind9/lib/isc/include/isc/mutexblock.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutexblock.h,v 1.10.206.1 2004/03/06 08:14:44 marka Exp $ */
+/* $Id: mutexblock.h,v 1.11.18.2 2005/04/29 00:17:00 marka Exp $ */
 
 #ifndef ISC_MUTEXBLOCK_H
 #define ISC_MUTEXBLOCK_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/mutex.h>
 #include <isc/types.h>
@@ -28,39 +30,39 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_mutexblock_init(isc_mutex_t *block, unsigned int count);
-/*
+/*%<
  * Initialize a block of locks.  If an error occurs all initialized locks
  * will be destroyed, if possible.
  *
  * Requires:
  *
- *	block != NULL
+ *\li	block != NULL
  *
- *	count > 0
+ *\li	count > 0
  *
  * Returns:
  *
- *	Any code isc_mutex_init() can return is a valid return for this
+ *\li	Any code isc_mutex_init() can return is a valid return for this
  *	function.
  */
 
 isc_result_t
 isc_mutexblock_destroy(isc_mutex_t *block, unsigned int count);
-/*
+/*%<
  * Destroy a block of locks.
  *
  * Requires:
  *
- *	block != NULL
+ *\li	block != NULL
  *
- *	count > 0
+ *\li	count > 0
  *
- *	Each lock in the block be initialized via isc_mutex_init() or
+ *\li	Each lock in the block be initialized via isc_mutex_init() or
  * 	the whole block was initialized via isc_mutex_initblock().
  *
  * Returns:
  *
- *	Any code isc_mutex_init() can return is a valid return for this
+ *\li	Any code isc_mutex_init() can return is a valid return for this
  *	function.
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/netaddr.h b/contrib/bind9/lib/isc/include/isc/netaddr.h
index ad3328c..06d063e 100644
--- a/contrib/bind9/lib/isc/include/isc/netaddr.h
+++ b/contrib/bind9/lib/isc/include/isc/netaddr.h
@@ -15,15 +15,22 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: netaddr.h,v 1.18.12.9 2005/07/29 00:13:10 marka Exp $ */
+/* $Id: netaddr.h,v 1.25.18.5 2005/07/28 04:58:47 marka Exp $ */
 
 #ifndef ISC_NETADDR_H
 #define ISC_NETADDR_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/net.h>
 #include <isc/types.h>
 
+#ifdef ISC_PLATFORM_HAVESYSUNH
+#include <sys/types.h>
+#include <sys/un.h>
+#endif
+
 ISC_LANG_BEGINDECLS
 
 struct isc_netaddr {
@@ -31,6 +38,9 @@ struct isc_netaddr {
 	union {
     		struct in_addr in;
 		struct in6_addr in6;
+#ifdef ISC_PLATFORM_HAVESYSUNH
+		char un[sizeof(((struct sockaddr_un *)0)->sun_path)];
+#endif
 	} type;
 	isc_uint32_t zone;
 };
@@ -41,40 +51,40 @@ isc_netaddr_equal(const isc_netaddr_t *a, const isc_netaddr_t *b);
 isc_boolean_t
 isc_netaddr_eqprefix(const isc_netaddr_t *a, const isc_netaddr_t *b,
 		     unsigned int prefixlen);
-/*
+/*%<
  * Compare the 'prefixlen' most significant bits of the network
- * addresses 'a' and 'b'.  Return ISC_TRUE if they are equal,
- * ISC_FALSE if not.
+ * addresses 'a' and 'b'.  Return #ISC_TRUE if they are equal,
+ * #ISC_FALSE if not.
  */
 
 isc_result_t
 isc_netaddr_masktoprefixlen(const isc_netaddr_t *s, unsigned int *lenp);
-/*
+/*%<
  * Convert a netmask in 's' into a prefix length in '*lenp'.
  * The mask should consist of zero or more '1' bits in the most
  * most significant part of the address, followed by '0' bits.
- * If this is not the case, ISC_R_MASKNONCONTIG is returned.
+ * If this is not the case, #ISC_R_MASKNONCONTIG is returned.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_MASKNONCONTIG
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_MASKNONCONTIG
  */
 
 isc_result_t
 isc_netaddr_totext(const isc_netaddr_t *netaddr, isc_buffer_t *target);
-/*
+/*%<
  * Append a text representation of 'sockaddr' to the buffer 'target'.
  * The text is NOT null terminated.  Handles IPv4 and IPv6 addresses.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE	The text or the null termination did not fit.
- *	ISC_R_FAILURE	Unspecified failure
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOSPACE	The text or the null termination did not fit.
+ *\li	#ISC_R_FAILURE	Unspecified failure
  */
 
 void
 isc_netaddr_format(const isc_netaddr_t *na, char *array, unsigned int size);
-/*
+/*%<
  * Format a human-readable representation of the network address '*na'
  * into the character array 'array', which is of size 'size'.
  * The resulting string is guaranteed to be null-terminated.
@@ -82,7 +92,7 @@ isc_netaddr_format(const isc_netaddr_t *na, char *array, unsigned int size);
 
 #define ISC_NETADDR_FORMATSIZE \
 	sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:XXX.XXX.XXX.XXX%SSSSSSSSSS")
-/*
+/*%<
  * Minimum size of array to pass to isc_netaddr_format().
  */
 
@@ -95,6 +105,9 @@ isc_netaddr_fromin(isc_netaddr_t *netaddr, const struct in_addr *ina);
 void
 isc_netaddr_fromin6(isc_netaddr_t *netaddr, const struct in6_addr *ina6);
 
+isc_result_t
+isc_netaddr_frompath(isc_netaddr_t *netaddr, const char *path);
+
 void
 isc_netaddr_setzone(isc_netaddr_t *netaddr, isc_uint32_t zone);
 
@@ -103,46 +116,59 @@ isc_netaddr_getzone(const isc_netaddr_t *netaddr);
 
 void
 isc_netaddr_any(isc_netaddr_t *netaddr);
-/*
+/*%<
  * Return the IPv4 wildcard address.
  */
 
 void
 isc_netaddr_any6(isc_netaddr_t *netaddr);
-/*
+/*%<
  * Return the IPv6 wildcard address.
  */
 
 isc_boolean_t
 isc_netaddr_ismulticast(isc_netaddr_t *na);
-/*
+/*%<
  * Returns ISC_TRUE if the address is a multicast address.
  */
 
 isc_boolean_t
 isc_netaddr_isexperimental(isc_netaddr_t *na);
-/*
+/*%<
  * Returns ISC_TRUE if the address is a experimental (CLASS E) address.
  */
 
 isc_boolean_t
 isc_netaddr_islinklocal(isc_netaddr_t *na);
-/*
- * Returns ISC_TRUE if the address is a link local address.
+/*%<
+ * Returns #ISC_TRUE if the address is a link local address.
  */
 
 isc_boolean_t
 isc_netaddr_issitelocal(isc_netaddr_t *na);
-/*
- * Returns ISC_TRUE if the address is a site local address.
+/*%<
+ * Returns #ISC_TRUE if the address is a site local address.
  */
 
 void
 isc_netaddr_fromv4mapped(isc_netaddr_t *t, const isc_netaddr_t *s);
-/*
+/*%<
  * Convert an IPv6 v4mapped address into an IPv4 address.
  */
 
+isc_result_t
+isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen);
+/*
+ * Test whether the netaddr 'na' and 'prefixlen' are consistant.
+ * e.g. prefixlen within range.
+ *      na does not have bits set which are not covered by the prefixlen.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS
+ *	ISC_R_RANGE		prefixlen out of range
+ *	ISC_R_NOTIMPLENTED	unsupported family
+ *	ISC_R_FAILURE		extra bits.
+ */
 
 ISC_LANG_ENDDECLS
 
diff --git a/contrib/bind9/lib/isc/include/isc/netscope.h b/contrib/bind9/lib/isc/include/isc/netscope.h
index 7cc0f18..d9bea54 100644
--- a/contrib/bind9/lib/isc/include/isc/netscope.h
+++ b/contrib/bind9/lib/isc/include/isc/netscope.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,22 +15,25 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: netscope.h,v 1.4.142.5 2004/03/08 09:04:52 marka Exp $ */
+/* $Id: netscope.h,v 1.5.18.2 2005/04/29 00:17:00 marka Exp $ */
 
 #ifndef ISC_NETSCOPE_H
 #define ISC_NETSCOPE_H 1
 
+/*! \file */
+
 ISC_LANG_BEGINDECLS
 
-/*
+/*%
  * Convert a string of an IPv6 scope zone to zone index.  If the conversion
  * succeeds, 'zoneid' will store the index value.
+ *
  * XXXJT: when a standard interface for this purpose is defined,
  * we should use it.
  *
  * Returns:
- *	ISC_R_SUCCESS: conversion succeeds
- *	ISC_R_FAILURE: conversion fails
+ * \li	ISC_R_SUCCESS: conversion succeeds
+ * \li	ISC_R_FAILURE: conversion fails
  */
 isc_result_t
 isc_netscope_pton(int af, char *scopename, void *addr, isc_uint32_t *zoneid);
diff --git a/contrib/bind9/lib/isc/include/isc/ondestroy.h b/contrib/bind9/lib/isc/include/isc/ondestroy.h
index a2c584a..035873c 100644
--- a/contrib/bind9/lib/isc/include/isc/ondestroy.h
+++ b/contrib/bind9/lib/isc/include/isc/ondestroy.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ondestroy.h,v 1.7.206.1 2004/03/06 08:14:45 marka Exp $ */
+/* $Id: ondestroy.h,v 1.8.18.2 2005/04/29 00:17:00 marka Exp $ */
 
 #ifndef ISC_ONDESTROY_H
 #define ISC_ONDESTROY_H 1
@@ -25,33 +25,39 @@
 
 ISC_LANG_BEGINDECLS
 
-/*
+/*! \file 
  * ondestroy handling.
  *
  * Any class ``X'' of objects that wants to send out notifications
  * on its destruction should declare a field of type isc_ondestroy_t
  * (call it 'ondest').
  *
+ * \code
  * 	typedef struct {
  * 		...
  * 		isc_ondestroy_t	ondest;
  * 		...
  * 	} X;
+ * \endcode
  *
  * When an object ``A'' of type X is created
  * it must initialize the field ondest with a call to
  *
+ * \code
  * 	isc_ondestroy_init(&A->ondest).
+ * \endcode
  *
  * X should also provide a registration function for third-party
  * objects to call to register their interest in being told about
  * the destruction of a particular instance of X.
  *
+ * \code
  *	isc_result_t
  * 	X_ondestroy(X *instance, isc_task_t *task,
  * 		     isc_event_t **eventp) {
  * 		return(isc_ondestroy_register(&instance->ondest, task,eventp));
  * 	}
+ * \endcode
  *
  *	Note: locking of the ondestory structure embedded inside of X, is
  * 	X's responsibility.
@@ -59,15 +65,17 @@ ISC_LANG_BEGINDECLS
  * When an instance of X is destroyed, a call to  isc_ondestroy_notify()
  * sends the notifications:
  *
+ * \code
  *	X *instance;
  *	isc_ondestroy_t ondest = instance->ondest;
  *
  *	... completely cleanup 'instance' here...
  *
  * 	isc_ondestroy_notify(&ondest, instance);
+ * \endcode
  *
  *
- * see dns/zone.c for an ifdef'd-out example.
+ * see lib/dns/zone.c for an ifdef'd-out example.
  */
 
 struct isc_ondestroy {
@@ -77,7 +85,7 @@ struct isc_ondestroy {
 
 void
 isc_ondestroy_init(isc_ondestroy_t *ondest);
-/*
+/*%<
  * Initialize the on ondest structure. *must* be called before first call
  * to isc_ondestroy_register().
  */
@@ -86,7 +94,7 @@ isc_result_t
 isc_ondestroy_register(isc_ondestroy_t *ondest, isc_task_t *task,
 		       isc_event_t **eventp);
 
-/*
+/*%<
  * Stores task and *eventp away inside *ondest.  Ownership of **event is
  * taken from the caller (and *eventp is set to NULL). The task is attached
  * to.
@@ -94,7 +102,7 @@ isc_ondestroy_register(isc_ondestroy_t *ondest, isc_task_t *task,
 
 void
 isc_ondestroy_notify(isc_ondestroy_t *ondest, void *sender);
-/*
+/*%<
  * Dispatches the event(s) to the task(s) that were given in
  * isc_ondestroy_register call(s) (done via calls to
  * isc_task_sendanddetach()).  Before dispatch, the sender value of each
diff --git a/contrib/bind9/lib/isc/include/isc/os.h b/contrib/bind9/lib/isc/include/isc/os.h
index 5c3bd62..b2b76d5 100644
--- a/contrib/bind9/lib/isc/include/isc/os.h
+++ b/contrib/bind9/lib/isc/include/isc/os.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,18 +15,20 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: os.h,v 1.5.206.1 2004/03/06 08:14:45 marka Exp $ */
+/* $Id: os.h,v 1.6.18.2 2005/04/29 00:17:00 marka Exp $ */
 
 #ifndef ISC_OS_H
 #define ISC_OS_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 
 ISC_LANG_BEGINDECLS
 
 unsigned int
 isc_os_ncpus(void);
-/*
+/*%<
  * Return the number of CPUs available on the system, or 1 if this cannot
  * be determined.
  */
diff --git a/contrib/bind9/lib/isc/include/isc/parseint.h b/contrib/bind9/lib/isc/include/isc/parseint.h
index c877131..6940add 100644
--- a/contrib/bind9/lib/isc/include/isc/parseint.h
+++ b/contrib/bind9/lib/isc/include/isc/parseint.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001, 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: parseint.h,v 1.2.202.4 2004/03/08 09:04:52 marka Exp $ */
+/* $Id: parseint.h,v 1.3.18.2 2005/04/29 00:17:00 marka Exp $ */
 
 #ifndef ISC_PARSEINT_H
 #define ISC_PARSEINT_H 1
@@ -23,8 +23,8 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-/*
- * Parse integers, in a saner way than atoi() or strtoul() do.
+/*! \file
+ * \brief Parse integers, in a saner way than atoi() or strtoul() do.
  */
 
 /***
@@ -41,21 +41,22 @@ isc_parse_uint16(isc_uint16_t *uip, const char *string, int base);
 
 isc_result_t
 isc_parse_uint8(isc_uint8_t *uip, const char *string, int base);
-/*
+/*%<
  * Parse the null-terminated string 'string' containing a base 'base'
- * integer, storing the result in '*uip'.  The base is interpreted
+ * integer, storing the result in '*uip'.  
+ * The base is interpreted
  * as in strtoul().  Unlike strtoul(), leading whitespace, minus or
  * plus signs are not accepted, and all errors (including overflow)
  * are reported uniformly through the return value.
  *
  * Requires:
- *	'string' points to a null-terminated string
- *	0 <= 'base' <= 36
+ *\li	'string' points to a null-terminated string
+ *\li	0 <= 'base' <= 36
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_BADNUMBER   The string is not numeric (in the given base)
- *	ISC_R_RANGE	  The number is not representable as the requested type.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_BADNUMBER   The string is not numeric (in the given base)
+ *\li	#ISC_R_RANGE	  The number is not representable as the requested type.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/platform.h.in b/contrib/bind9/lib/isc/include/isc/platform.h.in
index 7a803d7..f74fb19 100644
--- a/contrib/bind9/lib/isc/include/isc/platform.h.in
+++ b/contrib/bind9/lib/isc/include/isc/platform.h.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: platform.h.in,v 1.24.2.1.10.11 2004/03/08 09:04:52 marka Exp $ */
+/* $Id: platform.h.in,v 1.34.18.7 2007/02/13 00:04:50 marka Exp $ */
 
 #ifndef ISC_PLATFORM_H
 #define ISC_PLATFORM_H 1
 
+/*! \file */
+
 /*****
  ***** Platform-dependent defines.
  *****/
@@ -28,195 +30,239 @@
  *** Network.
  ***/
 
-/*
+/*! \brief
  * Define if this system needs the <netinet/in6.h> header file included
  * for full IPv6 support (pretty much only UnixWare).
  */
 @ISC_PLATFORM_NEEDNETINETIN6H@
 
-/*
+/*! \brief
  * Define if this system needs the <netinet6/in6.h> header file included
  * to support in6_pkinfo (pretty much only BSD/OS).
  */
 @ISC_PLATFORM_NEEDNETINET6IN6H@
 
-/*
+/*! \brief
  * If sockaddrs on this system have an sa_len field, ISC_PLATFORM_HAVESALEN
  * will be defined.
  */
 @ISC_PLATFORM_HAVESALEN@
 
-/*
+/*! \brief
  * If this system has the IPv6 structure definitions, ISC_PLATFORM_HAVEIPV6
  * will be defined.
  */
 @ISC_PLATFORM_HAVEIPV6@
 
-/*
+/*! \brief
  * If this system is missing in6addr_any, ISC_PLATFORM_NEEDIN6ADDRANY will
  * be defined.
  */
 @ISC_PLATFORM_NEEDIN6ADDRANY@
 
-/*
+/*! \brief
  * If this system is missing in6addr_loopback, ISC_PLATFORM_NEEDIN6ADDRLOOPBACK
  * will be defined.
  */
 @ISC_PLATFORM_NEEDIN6ADDRLOOPBACK@
 
-/*
+/*! \brief
  * If this system has in6_pktinfo, ISC_PLATFORM_HAVEIN6PKTINFO will be
  * defined.
  */
 @ISC_PLATFORM_HAVEIN6PKTINFO@
 
-/*
+/*! \brief
  * If this system has in_addr6, rather than in6_addr, ISC_PLATFORM_HAVEINADDR6
  * will be defined.
  */
 @ISC_PLATFORM_HAVEINADDR6@
 
-/*
+/*! \brief
  * If this system has sin6_scope_id, ISC_PLATFORM_HAVESCOPEID will be defined.
  */
 @ISC_PLATFORM_HAVESCOPEID@
 
-/*
+/*! \brief
  * If this system needs inet_ntop(), ISC_PLATFORM_NEEDNTOP will be defined.
  */
 @ISC_PLATFORM_NEEDNTOP@
 
-/*
+/*! \brief
  * If this system needs inet_pton(), ISC_PLATFORM_NEEDPTON will be defined.
  */
 @ISC_PLATFORM_NEEDPTON@
 
-/*
+/*! \brief
  * If this system needs inet_aton(), ISC_PLATFORM_NEEDATON will be defined.
  */
 @ISC_PLATFORM_NEEDATON@
 
-/*
+/*! \brief
  * If this system needs in_port_t, ISC_PLATFORM_NEEDPORTT will be defined.
  */
 @ISC_PLATFORM_NEEDPORTT@
 
-/*
+/*! \brief
  * If the system needs strsep(), ISC_PLATFORM_NEEDSTRSEP will be defined.
  */
 @ISC_PLATFORM_NEEDSTRSEP@
 
-/*
+/*! \brief
  * If the system needs strlcpy(), ISC_PLATFORM_NEEDSTRLCPY will be defined.
  */
 @ISC_PLATFORM_NEEDSTRLCPY@
 
-/*
+/*! \brief
  * If the system needs strlcat(), ISC_PLATFORM_NEEDSTRLCAT will be defined.
  */
 @ISC_PLATFORM_NEEDSTRLCAT@
 
-/*
+/*! \brief
  * Define either ISC_PLATFORM_BSD44MSGHDR or ISC_PLATFORM_BSD43MSGHDR.
  */
 @ISC_PLATFORM_MSGHDRFLAVOR@
 
-/*
+/*! \brief
  * Define if PTHREAD_ONCE_INIT should be surrounded by braces to
  * prevent compiler warnings (such as with gcc on Solaris 2.8).
  */
 @ISC_PLATFORM_BRACEPTHREADONCEINIT@
 
-/*
+/*! \brief
  * Define on some UnixWare systems to fix erroneous definitions of various
  * IN6_IS_ADDR_* macros.
  */
 @ISC_PLATFORM_FIXIN6ISADDR@
 
-/***
+/*
  *** Printing.
  ***/
 
-/*
+/*! \brief
  * If this system needs vsnprintf() and snprintf(), ISC_PLATFORM_NEEDVSNPRINTF
  * will be defined.
  */
 @ISC_PLATFORM_NEEDVSNPRINTF@
 
-/*
+/*! \brief
  * If this system need a modern sprintf() that returns (int) not (char*).
  */
 @ISC_PLATFORM_NEEDSPRINTF@
 
-/*
+/*! \brief
  * The printf format string modifier to use with isc_uint64_t values.
  */
 @ISC_PLATFORM_QUADFORMAT@
 
-/*
+/*! \brief
  * Defined if we are using threads.
  */
 @ISC_PLATFORM_USETHREADS@
 
-/*
+/*! \brief
  * Defined if unistd.h does not cause fd_set to be delared.
  */
 @ISC_PLATFORM_NEEDSYSSELECTH@
 
-/*
+/*! \brief
  * Type used for resource limits.
  */
 @ISC_PLATFORM_RLIMITTYPE@
 
-/*
+/*! \brief
  * Define if your compiler supports "long long int".
  */
 @ISC_PLATFORM_HAVELONGLONG@
 
-/*
+/*! \brief
  * Define if the system has struct lifconf which is a extended struct ifconf
  * for IPv6.
  */
 @ISC_PLATFORM_HAVELIFCONF@
 
-/*
+/*! \brief
  * Define if the system has struct if_laddrconf which is a extended struct
  * ifconf for IPv6.
  */
 @ISC_PLATFORM_HAVEIF_LADDRCONF@
 
-/*
+/*! \brief
  * Define if the system has struct if_laddrreq.
  */
 @ISC_PLATFORM_HAVEIF_LADDRREQ@
 
-/*
+/*! \brief
  * Used to control how extern data is linked; needed for Win32 platforms.
  */
 @ISC_PLATFORM_USEDECLSPEC@
 
-/*
+/*! \brief
  * Define if the system supports if_nametoindex.
  */
 @ISC_PLATFORM_HAVEIFNAMETOINDEX@
 
-/*
+/*! \brief
  * Define if this system needs strtoul.
  */
 @ISC_PLATFORM_NEEDSTRTOUL@
 
-/*
+/*! \brief
  * Define if this system needs memmove.
  */
 @ISC_PLATFORM_NEEDMEMMOVE@
 
+/*
+ * Define if the platform has <sys/un.h>.
+ */
+@ISC_PLATFORM_HAVESYSUNH@
+
+/*
+ * If the "xadd" operation is available on this architecture,
+ * ISC_PLATFORM_HAVEXADD will be defined. 
+ */
+@ISC_PLATFORM_HAVEXADD@
+
+/*
+ * If the "atomic swap" operation is available on this architecture,
+ * ISC_PLATFORM_HAVEATOMICSTORE" will be defined. 
+ */
+@ISC_PLATFORM_HAVEATOMICSTORE@
+
+/*
+ * If the "compare-and-exchange" operation is available on this architecture,
+ * ISC_PLATFORM_HAVECMPXCHG will be defined. 
+ */
+@ISC_PLATFORM_HAVECMPXCHG@
+
+/*
+ * Define if gcc ASM extension is available
+ */
+@ISC_PLATFORM_USEGCCASM@
+
+/*
+ * Define if Tru64 style ASM syntax must be used.
+ */
+@ISC_PLATFORM_USEOSFASM@
+
+/*
+ * Define if the standard __asm function must be used.
+ */
+@ISC_PLATFORM_USESTDASM@
+
+/*
+ * Define if MacOS style of PPC assembly must be used.
+ * e.g. "r6", not "6", for register six.
+ */
+@ISC_PLATFORM_USEMACASM@
+
 #ifndef ISC_PLATFORM_USEDECLSPEC
 #define LIBISC_EXTERNAL_DATA
 #define LIBDNS_EXTERNAL_DATA
 #define LIBISCCC_EXTERNAL_DATA
 #define LIBISCCFG_EXTERNAL_DATA
 #define LIBBIND9_EXTERNAL_DATA
-#else /* ISC_PLATFORM_USEDECLSPEC */
+#else /*! \brief ISC_PLATFORM_USEDECLSPEC */
 #ifdef LIBISC_EXPORTS
 #define LIBISC_EXTERNAL_DATA __declspec(dllexport)
 #else
@@ -242,7 +288,7 @@
 #else
 #define LIBBIND9_EXTERNAL_DATA __declspec(dllimport)
 #endif
-#endif /* ISC_PLATFORM_USEDECLSPEC */
+#endif /*! \brief ISC_PLATFORM_USEDECLSPEC */
 
 /*
  * Tell emacs to use C mode for this file.
diff --git a/contrib/bind9/lib/isc/include/isc/print.h b/contrib/bind9/lib/isc/include/isc/print.h
index 1bf3704..95c6b1c 100644
--- a/contrib/bind9/lib/isc/include/isc/print.h
+++ b/contrib/bind9/lib/isc/include/isc/print.h
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: print.h,v 1.17.188.4 2005/06/09 23:54:30 marka Exp $ */
+/* $Id: print.h,v 1.19.18.3 2005/06/08 02:07:56 marka Exp $ */
 
 #ifndef ISC_PRINT_H
 #define ISC_PRINT_H 1
 
+/*! \file */
+
 /***
  *** Imports
  ***/
@@ -28,7 +30,7 @@
 #include <isc/lang.h>
 #include <isc/platform.h>
 
-/*
+/*!
  * This block allows lib/isc/print.c to be cleanly compiled even if
  * the platform does not need it.  The standard Makefile will still
  * not compile print.c or archive print.o, so this is just to make test
diff --git a/contrib/bind9/lib/isc/include/isc/quota.h b/contrib/bind9/lib/isc/include/isc/quota.h
index 4044118..6f95cd5 100644
--- a/contrib/bind9/lib/isc/include/isc/quota.h
+++ b/contrib/bind9/lib/isc/include/isc/quota.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: quota.h,v 1.8.12.6 2005/08/11 15:00:08 marka Exp $ */
+/* $Id: quota.h,v 1.10.18.4 2005/08/11 15:01:54 marka Exp $ */
 
 #ifndef ISC_QUOTA_H
 #define ISC_QUOTA_H 1
@@ -24,10 +24,9 @@
  ***** Module Info
  *****/
 
-/*
- * Quota
+/*! \file isc/quota.h
  *
- * The isc_quota_t object is a simple helper object for implementing
+ * \brief The isc_quota_t object is a simple helper object for implementing
  * quotas on things like the number of simultaneous connections to
  * a server.  It keeps track of the amount of quota in use, and
  * encapsulates the locking necessary to allow multiple tasks to
@@ -48,9 +47,9 @@
 
 ISC_LANG_BEGINDECLS
 
+/*% isc_quota structure */
 struct isc_quota {
-	isc_mutex_t	lock;
-	/* Locked by lock. */
+	isc_mutex_t	lock; /*%< Locked by lock. */
 	int 		max;
 	int 		used;
 	int		soft;
@@ -58,7 +57,7 @@ struct isc_quota {
 
 isc_result_t
 isc_quota_init(isc_quota_t *quota, int max);
-/*
+/*%<
  * Initialize a quota object.
  *
  * Returns:
@@ -68,49 +67,49 @@ isc_quota_init(isc_quota_t *quota, int max);
 
 void
 isc_quota_destroy(isc_quota_t *quota);
-/*
+/*%<
  * Destroy a quota object.
  */
 
 void
 isc_quota_soft(isc_quota_t *quota, int soft);
-/*
- * Turn on/off soft quotas.
+/*%<
+ * Set a soft quota.
  */
 
 void
 isc_quota_max(isc_quota_t *quota, int max);
-/*
+/*%<
  * Re-set a maximum quota.
  */
 
 isc_result_t
 isc_quota_reserve(isc_quota_t *quota);
-/*
+/*%<
  * Attempt to reserve one unit of 'quota'.
  *
  * Returns:
- * 	ISC_R_SUCCESS	Success
- *	ISC_R_SOFTQUOTA	Success soft quota reached
- *	ISC_R_QUOTA	Quota is full
+ * \li 	#ISC_R_SUCCESS		Success
+ * \li	#ISC_R_SOFTQUOTA	Success soft quota reached
+ * \li	#ISC_R_QUOTA		Quota is full
  */
 
 void
 isc_quota_release(isc_quota_t *quota);
-/*
+/*%<
  * Release one unit of quota.
  */
 
 isc_result_t
 isc_quota_attach(isc_quota_t *quota, isc_quota_t **p);
-/*
+/*%<
  * Like isc_quota_reserve, and also attaches '*p' to the
  * quota if successful (ISC_R_SUCCESS or ISC_R_SOFTQUOTA).
  */
 
 void
 isc_quota_detach(isc_quota_t **p);
-/*
+/*%<
  * Like isc_quota_release, and also detaches '*p' from the
  * quota.
  */
diff --git a/contrib/bind9/lib/isc/include/isc/random.h b/contrib/bind9/lib/isc/include/isc/random.h
index ee416c5..c5cef8b 100644
--- a/contrib/bind9/lib/isc/include/isc/random.h
+++ b/contrib/bind9/lib/isc/include/isc/random.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: random.h,v 1.11.206.1 2004/03/06 08:14:46 marka Exp $ */
+/* $Id: random.h,v 1.12.18.2 2005/04/29 00:17:01 marka Exp $ */
 
 #ifndef ISC_RANDOM_H
 #define ISC_RANDOM_H 1
@@ -23,9 +23,11 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-/*
- * Implements a random state pool which will let the caller return a
- * series of possibly non-reproducable random values.  Note that the
+/*! \file
+ * \brief Implements a random state pool which will let the caller return a
+ * series of possibly non-reproducable random values.  
+ *
+ * Note that the
  * strength of these numbers is not all that high, and should not be
  * used in cryptography functions.  It is useful for jittering values
  * a bit here and there, such as timeouts, etc.
@@ -35,13 +37,13 @@ ISC_LANG_BEGINDECLS
 
 void
 isc_random_seed(isc_uint32_t seed);
-/*
+/*%<
  * Set the initial seed of the random state.
  */
 
 void
 isc_random_get(isc_uint32_t *val);
-/*
+/*%<
  * Get a random value.
  *
  * Requires:
@@ -50,7 +52,7 @@ isc_random_get(isc_uint32_t *val);
 
 isc_uint32_t
 isc_random_jitter(isc_uint32_t max, isc_uint32_t jitter);
-/*
+/*%<
  * Get a random value between (max - jitter) and (max).
  * This is useful for jittering timer values.
  */
diff --git a/contrib/bind9/lib/isc/include/isc/ratelimiter.h b/contrib/bind9/lib/isc/include/isc/ratelimiter.h
index 2acab34..1944754 100644
--- a/contrib/bind9/lib/isc/include/isc/ratelimiter.h
+++ b/contrib/bind9/lib/isc/include/isc/ratelimiter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ratelimiter.h,v 1.13.14.3 2004/03/08 09:04:53 marka Exp $ */
+/* $Id: ratelimiter.h,v 1.15.18.2 2005/04/29 00:17:01 marka Exp $ */
 
 #ifndef ISC_RATELIMITER_H
 #define ISC_RATELIMITER_H 1
@@ -24,8 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * A rate limiter is a mechanism for dispatching events at a limited
+/*! \file
+ * \brief A rate limiter is a mechanism for dispatching events at a limited
  * rate.  This is intended to be used when sending zone maintenance
  * SOA queries, NOTIFY messages, etc.
  */
@@ -46,13 +46,13 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 isc_ratelimiter_create(isc_mem_t *mctx, isc_timermgr_t *timermgr,
 		       isc_task_t *task, isc_ratelimiter_t **ratelimiterp);
-/*
+/*%<
  * Create a rate limiter.  The execution interval is initially undefined.
  */
 
 isc_result_t
 isc_ratelimiter_setinterval(isc_ratelimiter_t *rl, isc_interval_t *interval);
-/*
+/*!<
  * Set the mininum interval between event executions.
  * The interval value is copied, so the caller need not preserve it.
  *
@@ -62,7 +62,7 @@ isc_ratelimiter_setinterval(isc_ratelimiter_t *rl, isc_interval_t *interval);
 
 void
 isc_ratelimiter_setpertic(isc_ratelimiter_t *rl, isc_uint32_t perint);
-/*
+/*%<
  * Set the number of events processed per interval timer tick.
  * If 'perint' is zero it is treated as 1.
  */
@@ -70,8 +70,10 @@ isc_ratelimiter_setpertic(isc_ratelimiter_t *rl, isc_uint32_t perint);
 isc_result_t
 isc_ratelimiter_enqueue(isc_ratelimiter_t *rl, isc_task_t *task,
 			isc_event_t **eventp);
-/*
- * Queue an event for rate-limited execution.  This is similar
+/*%<
+ * Queue an event for rate-limited execution.  
+ *
+ * This is similar
  * to doing an isc_task_send() to the 'task', except that the
  * execution may be delayed to achieve the desired rate of
  * execution.
@@ -80,50 +82,50 @@ isc_ratelimiter_enqueue(isc_ratelimiter_t *rl, isc_task_t *task,
  * must ensure that the task exists until the event is delivered.
  *
  * Requires:
- *	An interval has been set by calling
+ *\li	An interval has been set by calling
  *	isc_ratelimiter_setinterval().
  *
- *	'task' to be non NULL.
- *	'(*eventp)->ev_sender' to be NULL.
+ *\li	'task' to be non NULL.
+ *\li	'(*eventp)->ev_sender' to be NULL.
  */
 
 void
 isc_ratelimiter_shutdown(isc_ratelimiter_t *ratelimiter);
-/*
+/*%<
  * Shut down a rate limiter.
  *
  * Ensures:
- *	All events that have not yet been
+ *\li	All events that have not yet been
  * 	dispatched to the task are dispatched immediately with
- *	the ISC_EVENTATTR_CANCELED bit set in ev_attributes.
+ *	the #ISC_EVENTATTR_CANCELED bit set in ev_attributes.
  *
- *	Further attempts to enqueue events will fail with
- * 	ISC_R_SHUTTINGDOWN.
+ *\li	Further attempts to enqueue events will fail with
+ * 	#ISC_R_SHUTTINGDOWN.
  *
- *	The reatelimiter is no longer attached to its task.
+ *\li	The reatelimiter is no longer attached to its task.
  */
 
 void
 isc_ratelimiter_attach(isc_ratelimiter_t *source, isc_ratelimiter_t **target);
-/*
+/*%<
  * Attach to a rate limiter.
  */
 
 void
 isc_ratelimiter_detach(isc_ratelimiter_t **ratelimiterp);
-/*
+/*%<
  * Detach from a rate limiter.
  */
 
 isc_result_t
 isc_ratelimiter_stall(isc_ratelimiter_t *rl);
-/*
+/*%<
  * Stall event processing.
  */
 
 isc_result_t
 isc_ratelimiter_release(isc_ratelimiter_t *rl);
-/*
+/*%<
  * Release a stalled rate limiter.
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/refcount.h b/contrib/bind9/lib/isc/include/isc/refcount.h
index d2c7b6f..b930465 100644
--- a/contrib/bind9/lib/isc/include/isc/refcount.h
+++ b/contrib/bind9/lib/isc/include/isc/refcount.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,19 +15,22 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: refcount.h,v 1.3.2.2.2.2 2004/04/14 05:12:25 marka Exp $ */
+/* $Id: refcount.h,v 1.6.18.5 2005/07/12 01:22:31 marka Exp $ */
 
 #ifndef ISC_REFCOUNT_H
 #define ISC_REFCOUNT_H 1
 
+#include <isc/atomic.h>
 #include <isc/lang.h>
 #include <isc/mutex.h>
 #include <isc/platform.h>
 #include <isc/types.h>
 #include <isc/util.h>
 
-/*
- * Implements a locked reference counter.  These functions may actually be
+/*! \file
+ * \brief Implements a locked reference counter.  
+ *
+ * These functions may actually be
  * implemented using macros, and implementations of these macros are below.
  * The isc_refcount_t type should not be accessed directly, as its contents
  * depend on the implementation.
@@ -39,8 +42,8 @@ ISC_LANG_BEGINDECLS
  * Function prototypes
  */
 
-/*
- * void
+/* 
+ * isc_result_t
  * isc_refcount_init(isc_refcount_t *ref, unsigned int n);
  *
  * Initialize the reference counter.  There will be 'n' initial references.
@@ -63,9 +66,14 @@ ISC_LANG_BEGINDECLS
 /*
  * void
  * isc_refcount_increment(isc_refcount_t *ref, unsigned int *targetp);
+ * isc_refcount_increment0(isc_refcount_t *ref, unsigned int *targetp);
  *
  * Increments the reference count, returning the new value in targetp if it's
- * not NULL.
+ * not NULL.  The reference counter typically begins with the initial counter
+ * of 1, and will be destroyed once the counter reaches 0.  Thus,
+ * isc_refcount_increment() additionally requires the previous counter be
+ * larger than 0 so that an error which violates the usage can be easily
+ * caught.  isc_refcount_increment0() does not have this restriction.
  *
  * Requires:
  *	ref != NULL.
@@ -87,20 +95,54 @@ ISC_LANG_BEGINDECLS
  * Sample implementations
  */
 #ifdef ISC_PLATFORM_USETHREADS
+#ifdef ISC_PLATFORM_HAVEXADD
+
+#define ISC_REFCOUNT_HAVEATOMIC 1
 
 typedef struct isc_refcount {
-	int refs;
-	isc_mutex_t lock;
+	isc_int32_t refs;
 } isc_refcount_t;
 
-#define isc_refcount_init(rp, n) 			\
-	do {						\
-		isc_result_t _r;			\
-		(rp)->refs = (n);			\
-		_r = isc_mutex_init(&(rp)->lock);	\
-		RUNTIME_CHECK(_r == ISC_R_SUCCESS);	\
+#define isc_refcount_destroy(rp) (REQUIRE((rp)->refs == 0))
+#define isc_refcount_current(rp) ((unsigned int)((rp)->refs))
+
+#define isc_refcount_increment0(rp, tp)				\
+	do {							\
+		unsigned int *_tmp = (unsigned int *)(tp);	\
+		isc_int32_t prev;				\
+		prev = isc_atomic_xadd(&(rp)->refs, 1);		\
+		if (_tmp != NULL)				\
+			*_tmp = prev + 1;			\
 	} while (0)
 
+#define isc_refcount_increment(rp, tp)				\
+	do {							\
+		unsigned int *_tmp = (unsigned int *)(tp);	\
+		isc_int32_t prev;				\
+		prev = isc_atomic_xadd(&(rp)->refs, 1);		\
+		REQUIRE(prev > 0);				\
+		if (_tmp != NULL)				\
+			*_tmp = prev + 1;			\
+	} while (0)
+
+#define isc_refcount_decrement(rp, tp)				\
+	do {							\
+		unsigned int *_tmp = (unsigned int *)(tp);	\
+		isc_int32_t prev;				\
+		prev = isc_atomic_xadd(&(rp)->refs, -1);	\
+		REQUIRE(prev > 0);				\
+		if (_tmp != NULL)				\
+			*_tmp = prev - 1;			\
+	} while (0)
+
+#else  /* ISC_PLATFORM_HAVEXADD */
+
+typedef struct isc_refcount {
+	int refs;
+	isc_mutex_t lock;
+} isc_refcount_t;
+
+/*% Destroys a reference counter. */
 #define isc_refcount_destroy(rp)			\
 	do {						\
 		REQUIRE((rp)->refs == 0);		\
@@ -109,6 +151,17 @@ typedef struct isc_refcount {
 
 #define isc_refcount_current(rp) ((unsigned int)((rp)->refs))
 
+/*% Increments the reference count, returning the new value in targetp if it's not NULL. */
+#define isc_refcount_increment0(rp, tp)				\
+	do {							\
+		unsigned int *_tmp = (unsigned int *)(tp);	\
+		LOCK(&(rp)->lock);				\
+		++((rp)->refs);					\
+		if (_tmp != NULL)				\
+			*_tmp = ((rp)->refs);			\
+		UNLOCK(&(rp)->lock);				\
+	} while (0)
+
 #define isc_refcount_increment(rp, tp)				\
 	do {							\
 		unsigned int *_tmp = (unsigned int *)(tp);	\
@@ -120,6 +173,7 @@ typedef struct isc_refcount {
 		UNLOCK(&(rp)->lock);				\
 	} while (0)
 
+/*% Decrements the reference count,  returning the new value in targetp if it's not NULL. */
 #define isc_refcount_decrement(rp, tp)				\
 	do {							\
 		unsigned int *_tmp = (unsigned int *)(tp);	\
@@ -131,17 +185,17 @@ typedef struct isc_refcount {
 		UNLOCK(&(rp)->lock);				\
 	} while (0)
 
-#else
+#endif /* ISC_PLATFORM_HAVEXADD */
+#else  /* ISC_PLATFORM_USETHREADS */
 
 typedef struct isc_refcount {
 	int refs;
 } isc_refcount_t;
 
-#define isc_refcount_init(rp, n) ((rp)->refs = (n))
 #define isc_refcount_destroy(rp) (REQUIRE((rp)->refs == 0))
 #define isc_refcount_current(rp) ((unsigned int)((rp)->refs))
 
-#define isc_refcount_increment(rp, tp)					\
+#define isc_refcount_increment0(rp, tp)					\
 	do {								\
 		unsigned int *_tmp = (unsigned int *)(tp);		\
 		int _n = ++(rp)->refs;					\
@@ -149,15 +203,30 @@ typedef struct isc_refcount {
 			*_tmp = _n;					\
 	} while (0)
 
+#define isc_refcount_increment(rp, tp)					\
+	do {								\
+		unsigned int *_tmp = (unsigned int *)(tp);		\
+		int _n;							\
+		REQUIRE((rp)->refs > 0);				\
+		_n = ++(rp)->refs;					\
+		if (_tmp != NULL)					\
+			*_tmp = _n;					\
+	} while (0)
+
 #define isc_refcount_decrement(rp, tp)					\
 	do {								\
 		unsigned int *_tmp = (unsigned int *)(tp);		\
-		int _n = --(rp)->refs;					\
+		int _n;							\
+		REQUIRE((rp)->refs > 0);				\
+		_n = --(rp)->refs;					\
 		if (_tmp != NULL)					\
 			*_tmp = _n;					\
 	} while (0)
 
-#endif
+#endif /* ISC_PLATFORM_USETHREADS */
+
+isc_result_t
+isc_refcount_init(isc_refcount_t *ref, unsigned int n);
 
 ISC_LANG_ENDDECLS
 
diff --git a/contrib/bind9/lib/isc/include/isc/region.h b/contrib/bind9/lib/isc/include/isc/region.h
index 5622394..9b651fe 100644
--- a/contrib/bind9/lib/isc/include/isc/region.h
+++ b/contrib/bind9/lib/isc/include/isc/region.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: region.h,v 1.16.12.3 2004/03/08 09:04:53 marka Exp $ */
+/* $Id: region.h,v 1.19.18.2 2005/04/29 00:17:01 marka Exp $ */
 
 #ifndef ISC_REGION_H
 #define ISC_REGION_H 1
 
+/*! \file */
+
 #include <isc/types.h>
 
 struct isc_region {
@@ -45,7 +47,8 @@ struct isc_consttextregion {
 	unsigned int	length;
 };
 
-/*
+/*@{*/
+/*!
  * The region structure is not opaque, and is usually directly manipulated.
  * Some macros are defined below for convenience.
  */
@@ -76,20 +79,21 @@ struct isc_consttextregion {
 		_r->base += _l; \
 		_r->length -= _l; \
 	} while (0)
+/*@}*/
 
 int
 isc_region_compare(isc_region_t *r1, isc_region_t *r2);
-/*
+/*%<
  * Compares the contents of two regions 
  *
  * Requires: 
- *	'r1' is a valid region
- *	'r2' is a valid region
+ *\li	'r1' is a valid region
+ *\li	'r2' is a valid region
  *
  * Returns:
- *	 < 0 if r1 is lexicographically less than r2
- *	 = 0 if r1 is lexicographically identical to r2
- *	 > 0 if r1 is lexicographically greater than r2
+ *\li	 < 0 if r1 is lexicographically less than r2
+ *\li	 = 0 if r1 is lexicographically identical to r2
+ *\li	 > 0 if r1 is lexicographically greater than r2
  */
 
 #endif /* ISC_REGION_H */
diff --git a/contrib/bind9/lib/isc/include/isc/resource.h b/contrib/bind9/lib/isc/include/isc/resource.h
index 2c2a829..53b2a4e 100644
--- a/contrib/bind9/lib/isc/include/isc/resource.h
+++ b/contrib/bind9/lib/isc/include/isc/resource.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resource.h,v 1.4.206.1 2004/03/06 08:14:47 marka Exp $ */
+/* $Id: resource.h,v 1.5.18.2 2005/04/29 00:17:02 marka Exp $ */
 
 #ifndef ISC_RESOURCE_H
 #define ISC_RESOURCE_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -29,40 +31,40 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value);
-/*
+/*%<
  * Set the maximum limit for a system resource.
  *
  * Notes:
- *	If 'value' exceeds the maximum possible on the operating system,
+ *\li	If 'value' exceeds the maximum possible on the operating system,
  *	it is silently limited to that maximum -- or to "infinity", if
- *	the operating system has that concept.  ISC_RESOURCE_UNLIMITED
+ *	the operating system has that concept.  #ISC_RESOURCE_UNLIMITED
  *	can be used to explicitly ask for the maximum.
  *
  * Requires:
- *	'resource' is a valid member of the isc_resource_t enumeration.
+ *\li	'resource' is a valid member of the isc_resource_t enumeration.
  *
  * Returns:
- *	ISC_R_SUCCESS	Success.
- *	ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
- *	ISC_R_NOPERM	The calling process did not have adequate permission
+ *\li	#ISC_R_SUCCESS	Success.
+ *\li	#ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
+ *\li	#ISC_R_NOPERM	The calling process did not have adequate permission
  *			to change the resource limit.
  */
 
 isc_result_t
 isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value);
-/*
+/*%<
  * Get the maximum limit for a system resource.
  *
  * Notes:
- *	'value' is set to the maximum limit.
+ *\li	'value' is set to the maximum limit.
  *
- *	ISC_RESOURCE_UNLIMITED is the maximum value of isc_resourcevalue_t.
+ *\li	#ISC_RESOURCE_UNLIMITED is the maximum value of isc_resourcevalue_t.
  *
- *	On many (all?) Unix systems, RLIM_INFINITY is a valid value that is
- *	significantly less than ISC_RESOURCE_UNLIMITED, but which in practice
+ *\li	On many (all?) Unix systems, RLIM_INFINITY is a valid value that is
+ *	significantly less than #ISC_RESOURCE_UNLIMITED, but which in practice
  *	behaves the same.
  *
- *	The current ISC libdns configuration file parser assigns a value
+ *\li	The current ISC libdns configuration file parser assigns a value
  *	of ISC_UINT32_MAX for a size_spec of "unlimited" and ISC_UNIT32_MAX - 1
  *	for "default", the latter of which is supposed to represent "the
  *	limit that was in force when the server started".  Since these are
@@ -72,11 +74,11 @@ isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value);
  *	discrete integral values or generalized concepts.
  *
  * Requires:
- *	'resource' is a valid member of the isc_resource_t enumeration.
+ *\li	'resource' is a valid member of the isc_resource_t enumeration.
  *
  * Returns:
- *	ISC_R_SUCCESS		Success.
- *	ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
+ *\li	#ISC_R_SUCCESS		Success.
+ *\li	#ISC_R_NOTIMPLEMENTED	'resource' is not a type known by the OS.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/result.h b/contrib/bind9/lib/isc/include/isc/result.h
index 93f7cef..0de3493 100644
--- a/contrib/bind9/lib/isc/include/isc/result.h
+++ b/contrib/bind9/lib/isc/include/isc/result.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.h,v 1.57.2.2.8.5 2004/05/15 03:46:13 jinmei Exp $ */
+/* $Id: result.h,v 1.62.18.4 2005/06/22 22:05:49 marka Exp $ */
 
 #ifndef ISC_RESULT_H
 #define ISC_RESULT_H 1
@@ -23,77 +23,75 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-#define ISC_R_SUCCESS			0	/* success */
-#define ISC_R_NOMEMORY			1	/* out of memory */
-#define ISC_R_TIMEDOUT			2	/* timed out */
-#define ISC_R_NOTHREADS			3	/* no available threads */
-#define ISC_R_ADDRNOTAVAIL		4	/* address not available */
-#define ISC_R_ADDRINUSE			5	/* address in use */
-#define ISC_R_NOPERM			6	/* permission denied */
-#define ISC_R_NOCONN			7	/* no pending connections */
-#define ISC_R_NETUNREACH		8	/* network unreachable */
-#define ISC_R_HOSTUNREACH		9	/* host unreachable */
-#define ISC_R_NETDOWN			10	/* network down */
-#define ISC_R_HOSTDOWN			11	/* host down */
-#define ISC_R_CONNREFUSED		12	/* connection refused */
-#define ISC_R_NORESOURCES		13	/* not enough free resources */
-#define ISC_R_EOF			14	/* end of file */
-#define ISC_R_BOUND			15	/* socket already bound */
-#define ISC_R_RELOAD			16	/* reload */
-#define ISC_R_LOCKBUSY			17	/* lock busy */
-#define ISC_R_EXISTS			18	/* already exists */
-#define ISC_R_NOSPACE			19	/* ran out of space */
-#define ISC_R_CANCELED			20	/* operation canceled */
-#define ISC_R_NOTBOUND			21	/* socket is not bound */
-#define ISC_R_SHUTTINGDOWN		22	/* shutting down */
-#define ISC_R_NOTFOUND			23	/* not found */
-#define ISC_R_UNEXPECTEDEND		24	/* unexpected end of input */
-#define ISC_R_FAILURE			25	/* generic failure */
-#define ISC_R_IOERROR			26	/* I/O error */
-#define ISC_R_NOTIMPLEMENTED		27	/* not implemented */
-#define ISC_R_UNBALANCED		28	/* unbalanced parentheses */
-#define ISC_R_NOMORE			29	/* no more */
-#define ISC_R_INVALIDFILE		30	/* invalid file */
-#define ISC_R_BADBASE64			31	/* bad base64 encoding */
-#define ISC_R_UNEXPECTEDTOKEN		32	/* unexpected token */
-#define ISC_R_QUOTA			33	/* quota reached */
-#define ISC_R_UNEXPECTED		34	/* unexpected error */
-#define ISC_R_ALREADYRUNNING		35	/* already running */
-#define ISC_R_IGNORE			36	/* ignore */
-#define ISC_R_MASKNONCONTIG             37	/* addr mask not contiguous */
-#define ISC_R_FILENOTFOUND		38	/* file not found */
-#define ISC_R_FILEEXISTS		39	/* file already exists */
-#define ISC_R_NOTCONNECTED		40	/* socket is not connected */
-#define ISC_R_RANGE			41	/* out of range */
-#define ISC_R_NOENTROPY			42	/* out of entropy */
-#define ISC_R_MULTICAST			43	/* invalid use of multicast */
-#define ISC_R_NOTFILE			44	/* not a file */
-#define ISC_R_NOTDIRECTORY		45	/* not a directory */
-#define ISC_R_QUEUEFULL			46	/* queue is full */
-#define ISC_R_FAMILYMISMATCH		47	/* address family mismatch */
-#define ISC_R_FAMILYNOSUPPORT		48	/* AF not supported */
-#define ISC_R_BADHEX			49	/* bad hex encoding */
-#define ISC_R_TOOMANYOPENFILES		50	/* too many open files */
-#define ISC_R_NOTBLOCKING		51	/* not blocking */
-#define ISC_R_UNBALANCEDQUOTES		52	/* unbalanced quotes */
-#define ISC_R_INPROGRESS		53	/* operation in progress */
-#define ISC_R_CONNECTIONRESET		54	/* connection reset */
-#define ISC_R_SOFTQUOTA			55	/* soft quota reached */
-#define ISC_R_BADNUMBER			56	/* not a valid number */
-#define ISC_R_DISABLED			57	/* disabled */
-#define ISC_R_MAXSIZE			58	/* max size */
-#define ISC_R_BADADDRESSFORM		59	/* invalid address format */
+#define ISC_R_SUCCESS			0	/*%< success */
+#define ISC_R_NOMEMORY			1	/*%< out of memory */
+#define ISC_R_TIMEDOUT			2	/*%< timed out */
+#define ISC_R_NOTHREADS			3	/*%< no available threads */
+#define ISC_R_ADDRNOTAVAIL		4	/*%< address not available */
+#define ISC_R_ADDRINUSE			5	/*%< address in use */
+#define ISC_R_NOPERM			6	/*%< permission denied */
+#define ISC_R_NOCONN			7	/*%< no pending connections */
+#define ISC_R_NETUNREACH		8	/*%< network unreachable */
+#define ISC_R_HOSTUNREACH		9	/*%< host unreachable */
+#define ISC_R_NETDOWN			10	/*%< network down */
+#define ISC_R_HOSTDOWN			11	/*%< host down */
+#define ISC_R_CONNREFUSED		12	/*%< connection refused */
+#define ISC_R_NORESOURCES		13	/*%< not enough free resources */
+#define ISC_R_EOF			14	/*%< end of file */
+#define ISC_R_BOUND			15	/*%< socket already bound */
+#define ISC_R_RELOAD			16	/*%< reload */
+#define ISC_R_LOCKBUSY			17	/*%< lock busy */
+#define ISC_R_EXISTS			18	/*%< already exists */
+#define ISC_R_NOSPACE			19	/*%< ran out of space */
+#define ISC_R_CANCELED			20	/*%< operation canceled */
+#define ISC_R_NOTBOUND			21	/*%< socket is not bound */
+#define ISC_R_SHUTTINGDOWN		22	/*%< shutting down */
+#define ISC_R_NOTFOUND			23	/*%< not found */
+#define ISC_R_UNEXPECTEDEND		24	/*%< unexpected end of input */
+#define ISC_R_FAILURE			25	/*%< generic failure */
+#define ISC_R_IOERROR			26	/*%< I/O error */
+#define ISC_R_NOTIMPLEMENTED		27	/*%< not implemented */
+#define ISC_R_UNBALANCED		28	/*%< unbalanced parentheses */
+#define ISC_R_NOMORE			29	/*%< no more */
+#define ISC_R_INVALIDFILE		30	/*%< invalid file */
+#define ISC_R_BADBASE64			31	/*%< bad base64 encoding */
+#define ISC_R_UNEXPECTEDTOKEN		32	/*%< unexpected token */
+#define ISC_R_QUOTA			33	/*%< quota reached */
+#define ISC_R_UNEXPECTED		34	/*%< unexpected error */
+#define ISC_R_ALREADYRUNNING		35	/*%< already running */
+#define ISC_R_IGNORE			36	/*%< ignore */
+#define ISC_R_MASKNONCONTIG             37	/*%< addr mask not contiguous */
+#define ISC_R_FILENOTFOUND		38	/*%< file not found */
+#define ISC_R_FILEEXISTS		39	/*%< file already exists */
+#define ISC_R_NOTCONNECTED		40	/*%< socket is not connected */
+#define ISC_R_RANGE			41	/*%< out of range */
+#define ISC_R_NOENTROPY			42	/*%< out of entropy */
+#define ISC_R_MULTICAST			43	/*%< invalid use of multicast */
+#define ISC_R_NOTFILE			44	/*%< not a file */
+#define ISC_R_NOTDIRECTORY		45	/*%< not a directory */
+#define ISC_R_QUEUEFULL			46	/*%< queue is full */
+#define ISC_R_FAMILYMISMATCH		47	/*%< address family mismatch */
+#define ISC_R_FAMILYNOSUPPORT		48	/*%< AF not supported */
+#define ISC_R_BADHEX			49	/*%< bad hex encoding */
+#define ISC_R_TOOMANYOPENFILES		50	/*%< too many open files */
+#define ISC_R_NOTBLOCKING		51	/*%< not blocking */
+#define ISC_R_UNBALANCEDQUOTES		52	/*%< unbalanced quotes */
+#define ISC_R_INPROGRESS		53	/*%< operation in progress */
+#define ISC_R_CONNECTIONRESET		54	/*%< connection reset */
+#define ISC_R_SOFTQUOTA			55	/*%< soft quota reached */
+#define ISC_R_BADNUMBER			56	/*%< not a valid number */
+#define ISC_R_DISABLED			57	/*%< disabled */
+#define ISC_R_MAXSIZE			58	/*%< max size */
+#define ISC_R_BADADDRESSFORM		59	/*%< invalid address format */
 
-/*
- * Not a result code: the number of results.
- */
+/*% Not a result code: the number of results. */
 #define ISC_R_NRESULTS 			60
 
 ISC_LANG_BEGINDECLS
 
 const char *
 isc_result_totext(isc_result_t);
-/*
+/*%<
  * Convert an isc_result_t into a string message describing the result.
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/resultclass.h b/contrib/bind9/lib/isc/include/isc/resultclass.h
index adb5338..5e20800 100644
--- a/contrib/bind9/lib/isc/include/isc/resultclass.h
+++ b/contrib/bind9/lib/isc/include/isc/resultclass.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,19 +15,21 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resultclass.h,v 1.11.206.1 2004/03/06 08:14:47 marka Exp $ */
+/* $Id: resultclass.h,v 1.12.18.2 2005/04/29 00:17:02 marka Exp $ */
 
 #ifndef ISC_RESULTCLASS_H
 #define ISC_RESULTCLASS_H 1
 
-/*****
- ***** Registry of Predefined Result Type Classes
- *****/
 
-/*
+/*! \file
+ * \brief Registry of Predefined Result Type Classes
+ *
  * A result class number is an unsigned 16 bit number.  Each class may
  * contain up to 65536 results.  A result code is formed by adding the
  * result number within the class to the class number multiplied by 65536.
+ *
+ * Classes < 1024 are reserved for ISC use.
+ * Result classes >= 1024 and <= 65535 are reserved for application use.
  */
 
 #define ISC_RESULTCLASS_FROMNUM(num)		((num) << 16)
@@ -36,9 +38,6 @@
 #define ISC_RESULTCLASS_INCLASS(rclass, result) \
 	((rclass) == ((result) & 0xFFFF0000))
 
-/*
- * Classes < 1024 are reserved for ISC use.
- */
 
 #define	ISC_RESULTCLASS_ISC		ISC_RESULTCLASS_FROMNUM(0)
 #define	ISC_RESULTCLASS_DNS		ISC_RESULTCLASS_FROMNUM(1)
@@ -47,8 +46,5 @@
 #define	ISC_RESULTCLASS_OMAPI		ISC_RESULTCLASS_FROMNUM(4)
 #define	ISC_RESULTCLASS_ISCCC		ISC_RESULTCLASS_FROMNUM(5)
 
-/*
- * Result classes >= 1024 and <= 65535 are reserved for application use.
- */
 
 #endif /* ISC_RESULTCLASS_H */
diff --git a/contrib/bind9/lib/isc/include/isc/rwlock.h b/contrib/bind9/lib/isc/include/isc/rwlock.h
index 44edfcc..404f93c 100644
--- a/contrib/bind9/lib/isc/include/isc/rwlock.h
+++ b/contrib/bind9/lib/isc/include/isc/rwlock.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rwlock.h,v 1.18.2.3.2.1 2004/03/06 08:14:47 marka Exp $ */
+/* $Id: rwlock.h,v 1.21.18.3 2005/06/04 06:23:44 jinmei Exp $ */
 
 #ifndef ISC_RWLOCK_H
 #define ISC_RWLOCK_H 1
 
+/*! \file */
+
 #include <isc/condition.h>
 #include <isc/lang.h>
 #include <isc/platform.h>
@@ -34,19 +36,56 @@ typedef enum {
 } isc_rwlocktype_t;
 
 #ifdef ISC_PLATFORM_USETHREADS
+#if defined(ISC_PLATFORM_HAVEXADD) && defined(ISC_PLATFORM_HAVECMPXCHG)
+#define ISC_RWLOCK_USEATOMIC 1
+#endif
+
 struct isc_rwlock {
 	/* Unlocked. */
 	unsigned int		magic;
 	isc_mutex_t		lock;
+
+#if defined(ISC_PLATFORM_HAVEXADD) && defined(ISC_PLATFORM_HAVECMPXCHG)
+	/*
+	 * When some atomic instructions with hardware assistance are
+	 * available, rwlock will use those so that concurrent readers do not
+	 * interfere with each other through mutex as long as no writers
+	 * appear, massively reducing the lock overhead in the typical case.
+	 *
+	 * The basic algorithm of this approach is the "simple
+	 * writer-preference lock" shown in the following URL:
+	 * http://www.cs.rochester.edu/u/scott/synchronization/pseudocode/rw.html
+	 * but our implementation does not rely on the spin lock unlike the
+	 * original algorithm to be more portable as a user space application.
+	 */
+
+	/* Read or modified atomically. */
+	isc_int32_t		write_requests;
+	isc_int32_t		write_completions;
+	isc_int32_t		cnt_and_flag;
+
 	/* Locked by lock. */
 	isc_condition_t		readable;
 	isc_condition_t		writeable;
+	unsigned int		readers_waiting;
+
+	/* Locked by rwlock itself. */
+	unsigned int		write_granted;
+
+	/* Unlocked. */
+	unsigned int		write_quota;
+
+#else  /* ISC_PLATFORM_HAVEXADD && ISC_PLATFORM_HAVECMPXCHG */
+
+	/*%< Locked by lock. */
+	isc_condition_t		readable;
+	isc_condition_t		writeable;
 	isc_rwlocktype_t	type;
 
-	/* The number of threads that have the lock. */
+	/*% The number of threads that have the lock. */
 	unsigned int		active;
 
-	/*
+	/*%
 	 * The number of lock grants made since the lock was last switched
 	 * from reading to writing or vice versa; used in determining
 	 * when the quota is reached and it is time to switch.
@@ -58,6 +97,7 @@ struct isc_rwlock {
 	unsigned int		read_quota;
 	unsigned int		write_quota;
 	isc_rwlocktype_t	original;
+#endif  /* ISC_PLATFORM_HAVEXADD && ISC_PLATFORM_HAVECMPXCHG */
 };
 #else /* ISC_PLATFORM_USETHREADS */
 struct isc_rwlock {
diff --git a/contrib/bind9/lib/isc/include/isc/serial.h b/contrib/bind9/lib/isc/include/isc/serial.h
index cb054a6..86d9b2f 100644
--- a/contrib/bind9/lib/isc/include/isc/serial.h
+++ b/contrib/bind9/lib/isc/include/isc/serial.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: serial.h,v 1.9.206.1 2004/03/06 08:14:48 marka Exp $ */
+/* $Id: serial.h,v 1.10.18.2 2005/04/29 00:17:02 marka Exp $ */
 
 #ifndef ISC_SERIAL_H
 #define ISC_SERIAL_H 1
@@ -23,9 +23,8 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-/*
- *	Implement 32 bit serial space arithmetic comparision functions.
- *
+/*! \file
+ *	\brief Implement 32 bit serial space arithmetic comparision functions.
  *	Note: Undefined results are returned as ISC_FALSE.
  */
 
@@ -37,37 +36,37 @@ ISC_LANG_BEGINDECLS
 
 isc_boolean_t
 isc_serial_lt(isc_uint32_t a, isc_uint32_t b);
-/*
+/*%<
  *	Return true if 'a' < 'b' otherwise false.
  */
 
 isc_boolean_t
 isc_serial_gt(isc_uint32_t a, isc_uint32_t b);
-/*
+/*%<
  *	Return true if 'a' > 'b' otherwise false.
  */
 
 isc_boolean_t
 isc_serial_le(isc_uint32_t a, isc_uint32_t b);
-/*
+/*%<
  *	Return true if 'a' <= 'b' otherwise false.
  */
 
 isc_boolean_t
 isc_serial_ge(isc_uint32_t a, isc_uint32_t b);
-/*
+/*%<
  *	Return true if 'a' >= 'b' otherwise false.
  */
 
 isc_boolean_t
 isc_serial_eq(isc_uint32_t a, isc_uint32_t b);
-/*
+/*%<
  *	Return true if 'a' == 'b' otherwise false.
  */
 
 isc_boolean_t
 isc_serial_ne(isc_uint32_t a, isc_uint32_t b);
-/*
+/*%<
  *	Return true if 'a' != 'b' otherwise false.
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/sha1.h b/contrib/bind9/lib/isc/include/isc/sha1.h
index 935578b..bb22f06 100644
--- a/contrib/bind9/lib/isc/include/isc/sha1.h
+++ b/contrib/bind9/lib/isc/include/isc/sha1.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,25 +18,26 @@
 #ifndef ISC_SHA1_H
 #define ISC_SHA1_H 1
 
-/* $Id: sha1.h,v 1.8.206.1 2004/03/06 08:14:48 marka Exp $ */
+/* $Id: sha1.h,v 1.9.18.5 2006/08/16 03:18:14 marka Exp $ */
 
 /*	$NetBSD: sha1.h,v 1.2 1998/05/29 22:55:44 thorpej Exp $	*/
 
-/*
- * SHA-1 in C
- * By Steve Reid <steve@edmweb.com>
- * 100% Public Domain
+/*! \file
+ * \brief SHA-1 in C
+ * \author By Steve Reid <steve@edmweb.com>
+ * \note 100% Public Domain
  */
 
 #include <isc/lang.h>
 #include <isc/types.h>
 
-#define ISC_SHA1_DIGESTLENGTH 20
+#define ISC_SHA1_DIGESTLENGTH 20U
+#define ISC_SHA1_BLOCK_LENGTH 64U
 
 typedef struct {
 	isc_uint32_t state[5];
 	isc_uint32_t count[2];
-	unsigned char buffer[64];
+	unsigned char buffer[ISC_SHA1_BLOCK_LENGTH];
 } isc_sha1_t;
 
 ISC_LANG_BEGINDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/sha2.h b/contrib/bind9/lib/isc/include/isc/sha2.h
new file mode 100644
index 0000000..e54c620
--- /dev/null
+++ b/contrib/bind9/lib/isc/include/isc/sha2.h
@@ -0,0 +1,132 @@
+/*
+ * Copyright (C) 2005, 2006  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: sha2.h,v 1.2.2.6 2006/08/16 03:18:14 marka Exp $ */
+
+/*	$FreeBSD$	*/
+/*	$KAME: sha2.h,v 1.3 2001/03/12 08:27:48 itojun Exp $	*/
+
+/*
+ * sha2.h
+ *
+ * Version 1.0.0beta1
+ *
+ * Written by Aaron D. Gifford <me@aarongifford.com>
+ *
+ * Copyright 2000 Aaron D. Gifford.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+#ifndef ISC_SHA2_H
+#define ISC_SHA2_H
+
+#include <isc/lang.h>
+#include <isc/types.h>
+
+/*** SHA-224/256/384/512 Various Length Definitions ***********************/
+
+#define ISC_SHA224_BLOCK_LENGTH		64U
+#define ISC_SHA224_DIGESTLENGTH	28U
+#define ISC_SHA224_DIGESTSTRINGLENGTH	(ISC_SHA224_DIGESTLENGTH * 2 + 1)
+#define ISC_SHA256_BLOCK_LENGTH		64U
+#define ISC_SHA256_DIGESTLENGTH	32U
+#define ISC_SHA256_DIGESTSTRINGLENGTH	(ISC_SHA256_DIGESTLENGTH * 2 + 1)
+#define ISC_SHA384_BLOCK_LENGTH		128
+#define ISC_SHA384_DIGESTLENGTH	48U
+#define ISC_SHA384_DIGESTSTRINGLENGTH	(ISC_SHA384_DIGESTLENGTH * 2 + 1)
+#define ISC_SHA512_BLOCK_LENGTH		128U
+#define ISC_SHA512_DIGESTLENGTH	64U
+#define ISC_SHA512_DIGESTSTRINGLENGTH	(ISC_SHA512_DIGESTLENGTH * 2 + 1)
+
+
+ISC_LANG_BEGINDECLS
+
+/*** SHA-256/384/512 Context Structures *******************************/
+
+/*
+ * Keep buffer immediately after bitcount to preserve alignment.
+ */
+typedef struct {
+	isc_uint32_t	state[8];
+	isc_uint64_t	bitcount;
+	isc_uint8_t	buffer[ISC_SHA256_BLOCK_LENGTH];
+} isc_sha256_t;
+
+/*
+ * Keep buffer immediately after bitcount to preserve alignment.
+ */
+typedef struct {
+	isc_uint64_t	state[8];
+	isc_uint64_t	bitcount[2];
+	isc_uint8_t	buffer[ISC_SHA512_BLOCK_LENGTH];
+} isc_sha512_t;
+
+typedef isc_sha256_t isc_sha224_t;
+typedef isc_sha512_t isc_sha384_t;
+
+/*** SHA-224/256/384/512 Function Prototypes ******************************/
+
+void isc_sha224_init (isc_sha224_t *);
+void isc_sha224_update (isc_sha224_t *, const isc_uint8_t *, size_t);
+void isc_sha224_final (isc_uint8_t[ISC_SHA224_DIGESTLENGTH], isc_sha224_t *);
+char *isc_sha224_end (isc_sha224_t *, char[ISC_SHA224_DIGESTSTRINGLENGTH]);
+char *isc_sha224_data (const isc_uint8_t *, size_t, char[ISC_SHA224_DIGESTSTRINGLENGTH]);
+
+void isc_sha256_init (isc_sha256_t *);
+void isc_sha256_update (isc_sha256_t *, const isc_uint8_t *, size_t);
+void isc_sha256_final (isc_uint8_t[ISC_SHA256_DIGESTLENGTH], isc_sha256_t *);
+char *isc_sha256_end (isc_sha256_t *, char[ISC_SHA256_DIGESTSTRINGLENGTH]);
+char *isc_sha256_data (const isc_uint8_t *, size_t, char[ISC_SHA256_DIGESTSTRINGLENGTH]);
+
+void isc_sha384_init (isc_sha384_t *);
+void isc_sha384_update (isc_sha384_t *, const isc_uint8_t *, size_t);
+void isc_sha384_final (isc_uint8_t[ISC_SHA384_DIGESTLENGTH], isc_sha384_t *);
+char *isc_sha384_end (isc_sha384_t *, char[ISC_SHA384_DIGESTSTRINGLENGTH]);
+char *isc_sha384_data (const isc_uint8_t *, size_t, char[ISC_SHA384_DIGESTSTRINGLENGTH]);
+
+void isc_sha512_init (isc_sha512_t *);
+void isc_sha512_update (isc_sha512_t *, const isc_uint8_t *, size_t);
+void isc_sha512_final (isc_uint8_t[ISC_SHA512_DIGESTLENGTH], isc_sha512_t *);
+char *isc_sha512_end (isc_sha512_t *, char[ISC_SHA512_DIGESTSTRINGLENGTH]);
+char *isc_sha512_data (const isc_uint8_t *, size_t, char[ISC_SHA512_DIGESTSTRINGLENGTH]);
+
+ISC_LANG_ENDDECLS
+
+#endif /* ISC_SHA2_H */
diff --git a/contrib/bind9/lib/isc/include/isc/sockaddr.h b/contrib/bind9/lib/isc/include/isc/sockaddr.h
index 88e4594..83412d2 100644
--- a/contrib/bind9/lib/isc/include/isc/sockaddr.h
+++ b/contrib/bind9/lib/isc/include/isc/sockaddr.h
@@ -15,20 +15,28 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sockaddr.h,v 1.35.12.10 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: sockaddr.h,v 1.42.18.8 2006/03/02 00:37:22 marka Exp $ */
 
 #ifndef ISC_SOCKADDR_H
 #define ISC_SOCKADDR_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/net.h>
 #include <isc/types.h>
+#ifdef ISC_PLATFORM_HAVESYSUNH
+#include <sys/un.h>
+#endif
 
 struct isc_sockaddr {
 	union {
 		struct sockaddr		sa;
 		struct sockaddr_in	sin;
 		struct sockaddr_in6	sin6;
+#ifdef ISC_PLATFORM_HAVESYSUNH
+		struct sockaddr_un	sunix;
+#endif
 	}				type;
 	unsigned int			length;		/* XXXRTH beginning? */
 	ISC_LINK(struct isc_sockaddr)	link;
@@ -36,17 +44,36 @@ struct isc_sockaddr {
 
 typedef ISC_LIST(struct isc_sockaddr)	isc_sockaddrlist_t;
 
+#define ISC_SOCKADDR_CMPADDR	  0x0001	/*%< compare the address
+						 *   sin_addr/sin6_addr */
+#define ISC_SOCKADDR_CMPPORT 	  0x0002	/*%< compare the port
+						 *   sin_port/sin6_port */
+#define ISC_SOCKADDR_CMPSCOPE     0x0004	/*%< compare the scope
+						 *   sin6_scope */
+#define ISC_SOCKADDR_CMPSCOPEZERO 0x0008	/*%< when comparing scopes
+						 *   zero scopes always match */
+
 ISC_LANG_BEGINDECLS
 
 isc_boolean_t
+isc_sockaddr_compare(const isc_sockaddr_t *a, const isc_sockaddr_t *b,
+		     unsigned int flags);
+/*%<
+ * Compare the elements of the two address ('a' and 'b') as specified
+ * by 'flags' and report if they are equal or not.
+ *
+ * 'flags' is set from ISC_SOCKADDR_CMP*.
+ */
+
+isc_boolean_t
 isc_sockaddr_equal(const isc_sockaddr_t *a, const isc_sockaddr_t *b);
-/*
+/*%<
  * Return ISC_TRUE iff the socket addresses 'a' and 'b' are equal.
  */
 
 isc_boolean_t
 isc_sockaddr_eqaddr(const isc_sockaddr_t *a, const isc_sockaddr_t *b);
-/*
+/*%<
  * Return ISC_TRUE iff the address parts of the socket addresses
  * 'a' and 'b' are equal, ignoring the ports.
  */
@@ -54,14 +81,14 @@ isc_sockaddr_eqaddr(const isc_sockaddr_t *a, const isc_sockaddr_t *b);
 isc_boolean_t
 isc_sockaddr_eqaddrprefix(const isc_sockaddr_t *a, const isc_sockaddr_t *b,
 			  unsigned int prefixlen);
-/*
+/*%<
  * Return ISC_TRUE iff the most significant 'prefixlen' bits of the
  * socket addresses 'a' and 'b' are equal, ignoring the ports.
  */
 
 unsigned int
 isc_sockaddr_hash(const isc_sockaddr_t *sockaddr, isc_boolean_t address_only);
-/*
+/*%<
  * Return a hash value for the socket address 'sockaddr'.  If 'address_only'
  * is ISC_TRUE, the hash value will not depend on the port.
  *
@@ -71,97 +98,97 @@ isc_sockaddr_hash(const isc_sockaddr_t *sockaddr, isc_boolean_t address_only);
 
 void
 isc_sockaddr_any(isc_sockaddr_t *sockaddr);
-/*
+/*%<
  * Return the IPv4 wildcard address.
  */
 
 void
 isc_sockaddr_any6(isc_sockaddr_t *sockaddr);
-/*
+/*%<
  * Return the IPv6 wildcard address.
  */
 
 void
 isc_sockaddr_anyofpf(isc_sockaddr_t *sockaddr, int family);
-/*
+/*%<
  * Set '*sockaddr' to the wildcard address of protocol family
  * 'family'.
  *
  * Requires:
- *	'family' is AF_INET or AF_INET6.
+ * \li	'family' is AF_INET or AF_INET6.
  */
 
 void
 isc_sockaddr_fromin(isc_sockaddr_t *sockaddr, const struct in_addr *ina,
 		    in_port_t port);
-/*
+/*%<
  * Construct an isc_sockaddr_t from an IPv4 address and port.
  */
 
 void
 isc_sockaddr_fromin6(isc_sockaddr_t *sockaddr, const struct in6_addr *ina6,
 		     in_port_t port);
-/*
+/*%<
  * Construct an isc_sockaddr_t from an IPv6 address and port.
  */
 
 void
 isc_sockaddr_v6fromin(isc_sockaddr_t *sockaddr, const struct in_addr *ina,
 		      in_port_t port);
-/*
+/*%<
  * Construct an IPv6 isc_sockaddr_t representing a mapped IPv4 address.
  */
 
 void
 isc_sockaddr_fromnetaddr(isc_sockaddr_t *sockaddr, const isc_netaddr_t *na,
 			 in_port_t port);
-/*
+/*%<
  * Construct an isc_sockaddr_t from an isc_netaddr_t and port.
  */
 
 int
 isc_sockaddr_pf(const isc_sockaddr_t *sockaddr);
-/*
+/*%<
  * Get the protocol family of 'sockaddr'.
  *
  * Requires:
  *
- *	'sockaddr' is a valid sockaddr with an address family of AF_INET
+ *\li	'sockaddr' is a valid sockaddr with an address family of AF_INET
  *	or AF_INET6.
  *
  * Returns:
  *
- *	The protocol family of 'sockaddr', e.g. PF_INET or PF_INET6.
+ *\li	The protocol family of 'sockaddr', e.g. PF_INET or PF_INET6.
  */
 
 void
 isc_sockaddr_setport(isc_sockaddr_t *sockaddr, in_port_t port);
-/*
+/*%<
  * Set the port of 'sockaddr' to 'port'.
  */
 
 in_port_t
 isc_sockaddr_getport(const isc_sockaddr_t *sockaddr);
-/*
+/*%<
  * Get the port stored in 'sockaddr'.
  */
 
 isc_result_t
 isc_sockaddr_totext(const isc_sockaddr_t *sockaddr, isc_buffer_t *target);
-/*
+/*%<
  * Append a text representation of 'sockaddr' to the buffer 'target'.
  * The text will include both the IP address (v4 or v6) and the port.
  * The text is null terminated, but the terminating null is not
  * part of the buffer's used region.
  *
  * Returns:
- *	ISC_R_SUCCESS
- *	ISC_R_NOSPACE	The text or the null termination did not fit.
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOSPACE	The text or the null termination did not fit.
  */
 
 void
 isc_sockaddr_format(const isc_sockaddr_t *sa, char *array, unsigned int size);
-/*
+/*%<
  * Format a human-readable representation of the socket address '*sa'
  * into the character array 'array', which is of size 'size'.
  * The resulting string is guaranteed to be null-terminated.
@@ -169,8 +196,8 @@ isc_sockaddr_format(const isc_sockaddr_t *sa, char *array, unsigned int size);
 
 isc_boolean_t
 isc_sockaddr_ismulticast(const isc_sockaddr_t *sa);
-/*
- * Returns ISC_TRUE if the address is a multicast address.
+/*%<
+ * Returns #ISC_TRUE if the address is a multicast address.
  */
 
 isc_boolean_t
@@ -181,19 +208,30 @@ isc_sockaddr_isexperimental(const isc_sockaddr_t *sa);
 
 isc_boolean_t
 isc_sockaddr_islinklocal(const isc_sockaddr_t *sa);
-/*
+/*%<
  * Returns ISC_TRUE if the address is a link local addresss.
  */
 
 isc_boolean_t
 isc_sockaddr_issitelocal(const isc_sockaddr_t *sa);
-/*
+/*%<
  * Returns ISC_TRUE if the address is a sitelocal address.
  */
 
-#define ISC_SOCKADDR_FORMATSIZE \
-	sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:XXX.XXX.XXX.XXX#YYYYY%SSSSSSSSSS")
+isc_result_t
+isc_sockaddr_frompath(isc_sockaddr_t *sockaddr, const char *path);
 /*
+ *  Create a UNIX domain sockaddr that refers to path.
+ *
+ * Returns:
+ * \li	ISC_R_NOSPACE
+ * \li	ISC_R_NOTIMPLEMENTED
+ * \li	ISC_R_SUCCESS
+ */
+
+#define ISC_SOCKADDR_FORMATSIZE \
+	sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:XXX.XXX.XXX.XXX%SSSSSSSSSS#YYYYY")
+/*%<
  * Minimum size of array to pass to isc_sockaddr_format().
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/socket.h b/contrib/bind9/lib/isc/include/isc/socket.h
index 9dcadb2..ccc49f5 100644
--- a/contrib/bind9/lib/isc/include/isc/socket.h
+++ b/contrib/bind9/lib/isc/include/isc/socket.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.h,v 1.54.12.4 2004/03/08 09:04:53 marka Exp $ */
+/* $Id: socket.h,v 1.57.18.6 2006/06/07 00:29:45 marka Exp $ */
 
 #ifndef ISC_SOCKET_H
 #define ISC_SOCKET_H 1
@@ -24,36 +24,32 @@
  ***** Module Info
  *****/
 
-/*
- * Sockets
- *
- * Provides TCP and UDP sockets for network I/O.  The sockets are event
+/*! \file
+ * \brief Provides TCP and UDP sockets for network I/O.  The sockets are event
  * sources in the task system.
  *
  * When I/O completes, a completion event for the socket is posted to the
  * event queue of the task which requested the I/O.
  *
- * MP:
+ * \li MP:
  *	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
- *
  *	Clients of this module must not be holding a socket's task's lock when
  *	making a call that affects that socket.  Failure to follow this rule
  *	can result in deadlock.
- *
  *	The caller must ensure that isc_socketmgr_destroy() is called only
  *	once for a given manager.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
- *	<TBS>
+ * \li Resources:
+ *	TBS
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -75,7 +71,7 @@ ISC_LANG_BEGINDECLS
  *** Constants
  ***/
 
-/*
+/*%
  * Maximum number of buffers in a scatter/gather read/write.  The operating
  * system in use must support at least this number (plus one on some.)
  */
@@ -87,33 +83,35 @@ ISC_LANG_BEGINDECLS
 
 struct isc_socketevent {
 	ISC_EVENT_COMMON(isc_socketevent_t);
-	isc_result_t		result;		/* OK, EOF, whatever else */
-	unsigned int		minimum;	/* minimum i/o for event */
-	unsigned int		n;		/* bytes read or written */
-	unsigned int		offset;		/* offset into buffer list */
-	isc_region_t		region;		/* for single-buffer i/o */
-	isc_bufferlist_t	bufferlist;	/* list of buffers */
-	isc_sockaddr_t		address;	/* source address */
-	isc_time_t		timestamp;	/* timestamp of packet recv */
-	struct in6_pktinfo	pktinfo;	/* ipv6 pktinfo */
-	isc_uint32_t		attributes;	/* see below */
+	isc_result_t		result;		/*%< OK, EOF, whatever else */
+	unsigned int		minimum;	/*%< minimum i/o for event */
+	unsigned int		n;		/*%< bytes read or written */
+	unsigned int		offset;		/*%< offset into buffer list */
+	isc_region_t		region;		/*%< for single-buffer i/o */
+	isc_bufferlist_t	bufferlist;	/*%< list of buffers */
+	isc_sockaddr_t		address;	/*%< source address */
+	isc_time_t		timestamp;	/*%< timestamp of packet recv */
+	struct in6_pktinfo	pktinfo;	/*%< ipv6 pktinfo */
+	isc_uint32_t		attributes;	/*%< see below */
+	isc_eventdestructor_t   destroy;	/*%< original destructor */
 };
 
 typedef struct isc_socket_newconnev isc_socket_newconnev_t;
 struct isc_socket_newconnev {
 	ISC_EVENT_COMMON(isc_socket_newconnev_t);
 	isc_socket_t *		newsocket;
-	isc_result_t		result;		/* OK, EOF, whatever else */
-	isc_sockaddr_t		address;	/* source address */
+	isc_result_t		result;		/*%< OK, EOF, whatever else */
+	isc_sockaddr_t		address;	/*%< source address */
 };
 
 typedef struct isc_socket_connev isc_socket_connev_t;
 struct isc_socket_connev {
 	ISC_EVENT_COMMON(isc_socket_connev_t);
-	isc_result_t		result;		/* OK, EOF, whatever else */
+	isc_result_t		result;		/*%< OK, EOF, whatever else */
 };
 
-/*
+/*@{*/
+/*!
  * _ATTACHED:	Internal use only.
  * _TRUNC:	Packet was truncated on receive.
  * _CTRUNC:	Packet control information was truncated.  This can
@@ -129,6 +127,7 @@ struct isc_socket_connev {
 #define ISC_SOCKEVENTATTR_TIMESTAMP		0x00200000U /* public */
 #define ISC_SOCKEVENTATTR_PKTINFO		0x00100000U /* public */
 #define ISC_SOCKEVENTATTR_MULTICAST		0x00080000U /* public */
+/*@}*/
 
 #define ISC_SOCKEVENT_ANYEVENT  (0)
 #define ISC_SOCKEVENT_RECVDONE	(ISC_EVENTCLASS_SOCKET + 1)
@@ -144,30 +143,37 @@ struct isc_socket_connev {
 
 typedef enum {
 	isc_sockettype_udp = 1,
-	isc_sockettype_tcp = 2
+	isc_sockettype_tcp = 2,
+	isc_sockettype_unix = 3
 } isc_sockettype_t;
 
-/*
+/*@{*/
+/*!
  * How a socket should be shutdown in isc_socket_shutdown() calls.
  */
-#define ISC_SOCKSHUT_RECV	0x00000001	/* close read side */
-#define ISC_SOCKSHUT_SEND	0x00000002	/* close write side */
-#define ISC_SOCKSHUT_ALL	0x00000003	/* close them all */
+#define ISC_SOCKSHUT_RECV	0x00000001	/*%< close read side */
+#define ISC_SOCKSHUT_SEND	0x00000002	/*%< close write side */
+#define ISC_SOCKSHUT_ALL	0x00000003	/*%< close them all */
+/*@}*/
 
-/*
+/*@{*/
+/*!
  * What I/O events to cancel in isc_socket_cancel() calls.
  */
-#define ISC_SOCKCANCEL_RECV	0x00000001	/* cancel recv */
-#define ISC_SOCKCANCEL_SEND	0x00000002	/* cancel send */
-#define ISC_SOCKCANCEL_ACCEPT	0x00000004	/* cancel accept */
-#define ISC_SOCKCANCEL_CONNECT	0x00000008	/* cancel connect */
-#define ISC_SOCKCANCEL_ALL	0x0000000f	/* cancel everything */
-
-/*
+#define ISC_SOCKCANCEL_RECV	0x00000001	/*%< cancel recv */
+#define ISC_SOCKCANCEL_SEND	0x00000002	/*%< cancel send */
+#define ISC_SOCKCANCEL_ACCEPT	0x00000004	/*%< cancel accept */
+#define ISC_SOCKCANCEL_CONNECT	0x00000008	/*%< cancel connect */
+#define ISC_SOCKCANCEL_ALL	0x0000000f	/*%< cancel everything */
+/*@}*/
+
+/*@{*/
+/*!
  * Flags for isc_socket_send() and isc_socket_recv() calls.
  */
-#define ISC_SOCKFLAG_IMMEDIATE	0x00000001	/* send event only if needed */
-#define ISC_SOCKFLAG_NORETRY	0x00000002	/* drop failed UDP sends */
+#define ISC_SOCKFLAG_IMMEDIATE	0x00000001	/*%< send event only if needed */
+#define ISC_SOCKFLAG_NORETRY	0x00000002	/*%< drop failed UDP sends */
+/*@}*/
 
 /***
  *** Socket and Socket Manager Functions
@@ -181,18 +187,18 @@ isc_socket_create(isc_socketmgr_t *manager,
 		  int pf,
 		  isc_sockettype_t type,
 		  isc_socket_t **socketp);
-/*
+/*%<
  * Create a new 'type' socket managed by 'manager'.
  *
  * Note:
  *
- *	'pf' is the desired protocol family, e.g. PF_INET or PF_INET6.
+ *\li	'pf' is the desired protocol family, e.g. PF_INET or PF_INET6.
  *
  * Requires:
  *
- *	'manager' is a valid manager
+ *\li	'manager' is a valid manager
  *
- *	'socketp' is a valid pointer, and *socketp == NULL
+ *\li	'socketp' is a valid pointer, and *socketp == NULL
  *
  * Ensures:
  *
@@ -200,16 +206,16 @@ isc_socket_create(isc_socketmgr_t *manager,
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_NORESOURCES
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_NORESOURCES
+ *\li	#ISC_R_UNEXPECTED
  */
 
 void
 isc_socket_cancel(isc_socket_t *sock, isc_task_t *task,
 		  unsigned int how);
-/*
+/*%<
  * Cancel pending I/O of the type specified by "how".
  *
  * Note: if "task" is NULL, then the cancel applies to all tasks using the
@@ -217,45 +223,45 @@ isc_socket_cancel(isc_socket_t *sock, isc_task_t *task,
  *
  * Requires:
  *
- *	"socket" is a valid socket
+ * \li	"socket" is a valid socket
  *
- *	"task" is NULL or a valid task
+ * \li	"task" is NULL or a valid task
  *
  * "how" is a bitmask describing the type of cancelation to perform.
  * The type ISC_SOCKCANCEL_ALL will cancel all pending I/O on this
  * socket.
  *
- * ISC_SOCKCANCEL_RECV:
+ * \li ISC_SOCKCANCEL_RECV:
  *	Cancel pending isc_socket_recv() calls.
  *
- * ISC_SOCKCANCEL_SEND:
+ * \li ISC_SOCKCANCEL_SEND:
  *	Cancel pending isc_socket_send() and isc_socket_sendto() calls.
  *
- * ISC_SOCKCANCEL_ACCEPT:
+ * \li ISC_SOCKCANCEL_ACCEPT:
  *	Cancel pending isc_socket_accept() calls.
  *
- * ISC_SOCKCANCEL_CONNECT:
+ * \li ISC_SOCKCANCEL_CONNECT:
  *	Cancel pending isc_socket_connect() call.
  */
 
 void
 isc_socket_shutdown(isc_socket_t *sock, unsigned int how);
-/*
+/*%<
  * Shutdown 'socket' according to 'how'.
  *
  * Requires:
  *
- *	'socket' is a valid socket.
+ * \li	'socket' is a valid socket.
  *
- *	'task' is NULL or is a valid task.
+ * \li	'task' is NULL or is a valid task.
  *
- *	If 'how' is 'ISC_SOCKSHUT_RECV' or 'ISC_SOCKSHUT_ALL' then
+ * \li	If 'how' is 'ISC_SOCKSHUT_RECV' or 'ISC_SOCKSHUT_ALL' then
  *
  *		The read queue must be empty.
  *
  *		No further read requests may be made.
  *
- *	If 'how' is 'ISC_SOCKSHUT_SEND' or 'ISC_SOCKSHUT_ALL' then
+ * \li	If 'how' is 'ISC_SOCKSHUT_SEND' or 'ISC_SOCKSHUT_ALL' then
  *
  *		The write queue must be empty.
  *
@@ -264,39 +270,39 @@ isc_socket_shutdown(isc_socket_t *sock, unsigned int how);
 
 void
 isc_socket_attach(isc_socket_t *sock, isc_socket_t **socketp);
-/*
+/*%<
  * Attach *socketp to socket.
  *
  * Requires:
  *
- *	'socket' is a valid socket.
+ * \li	'socket' is a valid socket.
  *
- *	'socketp' points to a NULL socket.
+ * \li	'socketp' points to a NULL socket.
  *
  * Ensures:
  *
- *	*socketp is attached to socket.
+ * \li	*socketp is attached to socket.
  */
 
 void
 isc_socket_detach(isc_socket_t **socketp);
-/*
+/*%<
  * Detach *socketp from its socket.
  *
  * Requires:
  *
- *	'socketp' points to a valid socket.
+ * \li	'socketp' points to a valid socket.
  *
- *	If '*socketp' is the last reference to the socket,
+ * \li	If '*socketp' is the last reference to the socket,
  *	then:
  *
  *		There must be no pending I/O requests.
  *
  * Ensures:
  *
- *	*socketp is NULL.
+ * \li	*socketp is NULL.
  *
- *	If '*socketp' is the last reference to the socket,
+ * \li	If '*socketp' is the last reference to the socket,
  *	then:
  *
  *		The socket will be shutdown (both reading and writing)
@@ -307,145 +313,146 @@ isc_socket_detach(isc_socket_t **socketp);
 
 isc_result_t
 isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *addressp);
-/*
+/*%<
  * Bind 'socket' to '*addressp'.
  *
  * Requires:
  *
- *	'socket' is a valid socket
+ * \li	'socket' is a valid socket
  *
- *	'addressp' points to a valid isc_sockaddr.
+ * \li	'addressp' points to a valid isc_sockaddr.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOPERM
- *	ISC_R_ADDRNOTAVAIL
- *	ISC_R_ADDRINUSE
- *	ISC_R_BOUND
- *	ISC_R_UNEXPECTED
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOPERM
+ * \li	ISC_R_ADDRNOTAVAIL
+ * \li	ISC_R_ADDRINUSE
+ * \li	ISC_R_BOUND
+ * \li	ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_socket_filter(isc_socket_t *sock, const char *filter);
-/*
+/*%<
  * Inform the kernel that it should perform accept filtering.
  * If filter is NULL the current filter will be removed.:w
  */
 
 isc_result_t
 isc_socket_listen(isc_socket_t *sock, unsigned int backlog);
-/*
+/*%<
  * Set listen mode on the socket.  After this call, the only function that
  * can be used (other than attach and detach) is isc_socket_accept().
  *
  * Notes:
  *
- *	'backlog' is as in the UNIX system call listen() and may be
+ * \li	'backlog' is as in the UNIX system call listen() and may be
  *	ignored by non-UNIX implementations.
  *
- *	If 'backlog' is zero, a reasonable system default is used, usually
+ * \li	If 'backlog' is zero, a reasonable system default is used, usually
  *	SOMAXCONN.
  *
  * Requires:
  *
- *	'socket' is a valid, bound TCP socket.
+ * \li	'socket' is a valid, bound TCP socket or a valid, bound UNIX socket.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_UNEXPECTED
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_socket_accept(isc_socket_t *sock,
 		  isc_task_t *task, isc_taskaction_t action, const void *arg);
-/*
+/*%<
  * Queue accept event.  When a new connection is received, the task will
  * get an ISC_SOCKEVENT_NEWCONN event with the sender set to the listen
  * socket.  The new socket structure is sent inside the isc_socket_newconnev_t
  * event type, and is attached to the task 'task'.
  *
  * REQUIRES:
- *	'socket' is a valid TCP socket that isc_socket_listen() was called
+ * \li	'socket' is a valid TCP socket that isc_socket_listen() was called
  *	on.
  *
- *	'task' is a valid task
+ * \li	'task' is a valid task
  *
- *	'action' is a valid action
+ * \li	'action' is a valid action
  *
  * RETURNS:
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOMEMORY
+ * \li	ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_socket_connect(isc_socket_t *sock, isc_sockaddr_t *addressp,
 		   isc_task_t *task, isc_taskaction_t action,
 		   const void *arg);
-/*
+/*%<
  * Connect 'socket' to peer with address *saddr.  When the connection
  * succeeds, or when an error occurs, a CONNECT event with action 'action'
  * and arg 'arg' will be posted to the event queue for 'task'.
  *
  * Requires:
  *
- *	'socket' is a valid TCP socket
+ * \li	'socket' is a valid TCP socket
  *
- *	'addressp' points to a valid isc_sockaddr
+ * \li	'addressp' points to a valid isc_sockaddr
  *
- *	'task' is a valid task
+ * \li	'task' is a valid task
  *
- *	'action' is a valid action
+ * \li	'action' is a valid action
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_NOMEMORY
+ * \li	ISC_R_UNEXPECTED
  *
  * Posted event's result code:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_TIMEDOUT
- *	ISC_R_CONNREFUSED
- *	ISC_R_NETUNREACH
- *	ISC_R_UNEXPECTED
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_TIMEDOUT
+ * \li	ISC_R_CONNREFUSED
+ * \li	ISC_R_NETUNREACH
+ * \li	ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_socket_getpeername(isc_socket_t *sock, isc_sockaddr_t *addressp);
-/*
+/*%<
  * Get the name of the peer connected to 'socket'.
  *
  * Requires:
  *
- *	'socket' is a valid TCP socket.
+ * \li	'socket' is a valid TCP socket.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_TOOSMALL
- *	ISC_R_UNEXPECTED
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_TOOSMALL
+ * \li	ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_socket_getsockname(isc_socket_t *sock, isc_sockaddr_t *addressp);
-/*
+/*%<
  * Get the name of 'socket'.
  *
  * Requires:
  *
- *	'socket' is a valid socket.
+ * \li	'socket' is a valid socket.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_TOOSMALL
- *	ISC_R_UNEXPECTED
+ * \li	ISC_R_SUCCESS
+ * \li	ISC_R_TOOSMALL
+ * \li	ISC_R_UNEXPECTED
  */
 
+/*@{*/
 isc_result_t
 isc_socket_recv(isc_socket_t *sock, isc_region_t *region,
 		unsigned int minimum,
@@ -460,39 +467,39 @@ isc_socket_recv2(isc_socket_t *sock, isc_region_t *region,
 		 unsigned int minimum, isc_task_t *task,
 		 isc_socketevent_t *event, unsigned int flags);
 
-/*
+/*!
  * Receive from 'socket', storing the results in region.
  *
  * Notes:
  *
- *	Let 'length' refer to the length of 'region' or to the sum of all
+ *\li	Let 'length' refer to the length of 'region' or to the sum of all
  *	available regions in the list of buffers '*buflist'.
  *
- *	If 'minimum' is non-zero and at least that many bytes are read,
+ *\li	If 'minimum' is non-zero and at least that many bytes are read,
  *	the completion event will be posted to the task 'task.'  If minimum
  *	is zero, the exact number of bytes requested in the region must
  * 	be read for an event to be posted.  This only makes sense for TCP
  *	connections, and is always set to 1 byte for UDP.
  *
- *	The read will complete when the desired number of bytes have been
+ *\li	The read will complete when the desired number of bytes have been
  *	read, if end-of-input occurs, or if an error occurs.  A read done
  *	event with the given 'action' and 'arg' will be posted to the
  *	event queue of 'task'.
  *
- *	The caller may not modify 'region', the buffers which are passed
+ *\li	The caller may not modify 'region', the buffers which are passed
  *	into this function, or any data they refer to until the completion
  *	event is received.
  *
- *	For isc_socket_recvv():
+ *\li	For isc_socket_recvv():
  *	On successful completion, '*buflist' will be empty, and the list of
  *	all buffers will be returned in the done event's 'bufferlist'
  *	member.  On error return, '*buflist' will be unchanged.
  *
- *	For isc_socket_recv2():
+ *\li	For isc_socket_recv2():
  *	'event' is not NULL, and the non-socket specific fields are
  *	expected to be initialized.
  *
- *	For isc_socket_recv2():
+ *\li	For isc_socket_recv2():
  *	The only defined value for 'flags' is ISC_SOCKFLAG_IMMEDIATE.  If
  *	set and the operation completes, the return value will be
  *	ISC_R_SUCCESS and the event will be filled in and not sent.  If the
@@ -502,36 +509,38 @@ isc_socket_recv2(isc_socket_t *sock, isc_region_t *region,
  *
  * Requires:
  *
- *	'socket' is a valid, bound socket.
+ *\li	'socket' is a valid, bound socket.
  *
- *	For isc_socket_recv():
+ *\li	For isc_socket_recv():
  *	'region' is a valid region
  *
- *	For isc_socket_recvv():
+ *\li	For isc_socket_recvv():
  *	'buflist' is non-NULL, and '*buflist' contain at least one buffer.
  *
- *	'task' is a valid task
+ *\li	'task' is a valid task
  *
- *	For isc_socket_recv() and isc_socket_recvv():
+ *\li	For isc_socket_recv() and isc_socket_recvv():
  *	action != NULL and is a valid action
  *
- *	For isc_socket_recv2():
+ *\li	For isc_socket_recv2():
  *	event != NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_INPROGRESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_INPROGRESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
  *
  * Event results:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_UNEXPECTED
- *	XXX needs other net-type errors
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_UNEXPECTED
+ *\li	XXX needs other net-type errors
  */
+/*@}*/
 
+/*@{*/
 isc_result_t
 isc_socket_send(isc_socket_t *sock, isc_region_t *region,
 		isc_task_t *task, isc_taskaction_t action, const void *arg);
@@ -552,41 +561,41 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region,
 		   isc_sockaddr_t *address, struct in6_pktinfo *pktinfo,
 		   isc_socketevent_t *event, unsigned int flags);
 
-/*
+/*!
  * Send the contents of 'region' to the socket's peer.
  *
  * Notes:
  *
- *	Shutting down the requestor's task *may* result in any
+ *\li	Shutting down the requestor's task *may* result in any
  *	still pending writes being dropped or completed, depending on the
  *	underlying OS implementation.
  *
- *	If 'action' is NULL, then no completion event will be posted.
+ *\li	If 'action' is NULL, then no completion event will be posted.
  *
- *	The caller may not modify 'region', the buffers which are passed
+ *\li	The caller may not modify 'region', the buffers which are passed
  *	into this function, or any data they refer to until the completion
  *	event is received.
  *
- *	For isc_socket_sendv() and isc_socket_sendtov():
+ *\li	For isc_socket_sendv() and isc_socket_sendtov():
  *	On successful completion, '*buflist' will be empty, and the list of
  *	all buffers will be returned in the done event's 'bufferlist'
  *	member.  On error return, '*buflist' will be unchanged.
  *
- *	For isc_socket_sendto2():
+ *\li	For isc_socket_sendto2():
  *	'event' is not NULL, and the non-socket specific fields are
  *	expected to be initialized.
  *
- *	For isc_socket_sendto2():
+ *\li	For isc_socket_sendto2():
  *	The only defined values for 'flags' are ISC_SOCKFLAG_IMMEDIATE
  *	and ISC_SOCKFLAG_NORETRY.
  *
- *	If ISC_SOCKFLAG_IMMEDIATE is set and the operation completes, the
+ *\li	If ISC_SOCKFLAG_IMMEDIATE is set and the operation completes, the
  *	return value will be ISC_R_SUCCESS and the event will be filled
  *	in and not sent.  If the operation does not complete, the return
  *	value will be ISC_R_INPROGRESS and the event will be sent when
  *	the operation completes.
  *
- *	ISC_SOCKFLAG_NORETRY can only be set for UDP sockets.  If set
+ *\li	ISC_SOCKFLAG_NORETRY can only be set for UDP sockets.  If set
  *	and the send operation fails due to a transient error, the send
  *	will not be retried and the error will be indicated in the event.
  *	Using this option along with ISC_SOCKFLAG_IMMEDIATE allows the caller
@@ -594,109 +603,148 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region,
  *
  * Requires:
  *
- *	'socket' is a valid, bound socket.
+ *\li	'socket' is a valid, bound socket.
  *
- *	For isc_socket_send():
+ *\li	For isc_socket_send():
  *	'region' is a valid region
  *
- *	For isc_socket_sendv() and isc_socket_sendtov():
+ *\li	For isc_socket_sendv() and isc_socket_sendtov():
  *	'buflist' is non-NULL, and '*buflist' contain at least one buffer.
  *
- *	'task' is a valid task
+ *\li	'task' is a valid task
  *
- *	For isc_socket_sendv(), isc_socket_sendtov(), isc_socket_send(), and
+ *\li	For isc_socket_sendv(), isc_socket_sendtov(), isc_socket_send(), and
  *	isc_socket_sendto():
  *	action == NULL or is a valid action
  *
- *	For isc_socket_sendto2():
+ *\li	For isc_socket_sendto2():
  *	event != NULL
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_INPROGRESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_INPROGRESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
  *
  * Event results:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_UNEXPECTED
- *	XXX needs other net-type errors
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_UNEXPECTED
+ *\li	XXX needs other net-type errors
  */
+/*@}*/
 
 isc_result_t
 isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp);
-/*
+/*%<
  * Create a socket manager.
  *
  * Notes:
  *
- *	All memory will be allocated in memory context 'mctx'.
+ *\li	All memory will be allocated in memory context 'mctx'.
  *
  * Requires:
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
- *	'managerp' points to a NULL isc_socketmgr_t.
+ *\li	'managerp' points to a NULL isc_socketmgr_t.
  *
  * Ensures:
  *
- *	'*managerp' is a valid isc_socketmgr_t.
+ *\li	'*managerp' is a valid isc_socketmgr_t.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
  */
 
 void
 isc_socketmgr_destroy(isc_socketmgr_t **managerp);
-/*
+/*%<
  * Destroy a socket manager.
  *
  * Notes:
  *
- *	This routine blocks until there are no sockets left in the manager,
+ *\li	This routine blocks until there are no sockets left in the manager,
  *	so if the caller holds any socket references using the manager, it
  *	must detach them before calling isc_socketmgr_destroy() or it will
  *	block forever.
  *
  * Requires:
  *
- *	'*managerp' is a valid isc_socketmgr_t.
+ *\li	'*managerp' is a valid isc_socketmgr_t.
  *
- *	All sockets managed by this manager are fully detached.
+ *\li	All sockets managed by this manager are fully detached.
  *
  * Ensures:
  *
- *	*managerp == NULL
+ *\li	*managerp == NULL
  *
- *	All resources used by the manager have been freed.
+ *\li	All resources used by the manager have been freed.
  */
 
 isc_sockettype_t
 isc_socket_gettype(isc_socket_t *sock);
-/*
+/*%<
  * Returns the socket type for "sock."
  *
  * Requires:
  *
- *	"sock" is a valid socket.
+ *\li	"sock" is a valid socket.
  */
 
+/*@{*/
 isc_boolean_t
 isc_socket_isbound(isc_socket_t *sock);
 
 void
 isc_socket_ipv6only(isc_socket_t *sock, isc_boolean_t yes);
-/*
+/*%<
  * If the socket is an IPv6 socket set/clear the IPV6_IPV6ONLY socket
  * option if the host OS supports this option.
  *
  * Requires:
- *	'sock' is a valid socket.
+ *\li	'sock' is a valid socket.
+ */
+/*@}*/
+
+void
+isc_socket_cleanunix(isc_sockaddr_t *addr, isc_boolean_t active);
+
+/*%<
+ * Cleanup UNIX domain sockets in the file-system.  If 'active' is true
+ * then just unlink the socket.  If 'active' is false try to determine
+ * if there is a listener of the socket or not.  If no listener is found
+ * then unlink socket.
+ *
+ * Prior to unlinking the path is tested to see if it a socket.
+ *
+ * Note: there are a number of race conditions which cannot be avoided
+ *       both in the filesystem and any application using UNIX domain
+ *	 sockets (e.g. socket is tested between bind() and listen(),
+ *	 the socket is deleted and replaced in the file-system between
+ *	 stat() and unlink()).
+ */
+
+isc_result_t
+isc_socket_permunix(isc_sockaddr_t *sockaddr, isc_uint32_t perm,
+                    isc_uint32_t owner, isc_uint32_t group);
+/*%<
+ * Set ownership and file permissions on the UNIX domain socket.
+ *
+ * Note: On Solaris and SunOS this secures the directory containing
+ *       the socket as Solaris and SunOS do not honour the filesytem
+ *	 permissions on the socket.
+ *
+ * Requires:
+ * \li	'sockaddr' to be a valid UNIX domain sockaddr.
+ *
+ * Returns:
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_FAILURE
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/stdio.h b/contrib/bind9/lib/isc/include/isc/stdio.h
index 7dad284..e3bf0cd 100644
--- a/contrib/bind9/lib/isc/include/isc/stdio.h
+++ b/contrib/bind9/lib/isc/include/isc/stdio.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,22 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdio.h,v 1.6.206.1 2004/03/06 08:14:48 marka Exp $ */
+/* $Id: stdio.h,v 1.7.18.2 2005/04/29 00:17:03 marka Exp $ */
 
 #ifndef ISC_STDIO_H
 #define ISC_STDIO_H 1
 
+/*! \file */
+
+/*% 
+ * These functions are wrappers around the corresponding stdio functions.
+ *
+ * They return a detailed error code in the form of an an isc_result_t.  ANSI C
+ * does not guarantee that stdio functions set errno, hence these functions
+ * must use platform dependent methods (e.g., the POSIX errno) to construct the
+ * error code.
+ */
+
 #include <stdio.h>
 
 #include <isc/lang.h>
@@ -27,36 +38,35 @@
 
 ISC_LANG_BEGINDECLS
 
+/*% Open */
 isc_result_t
 isc_stdio_open(const char *filename, const char *mode, FILE **fp);
 
+/*% Close */
 isc_result_t
 isc_stdio_close(FILE *f);
 
+/*% Seek */
 isc_result_t
 isc_stdio_seek(FILE *f, long offset, int whence);
 
+/*% Read */
 isc_result_t
 isc_stdio_read(void *ptr, size_t size, size_t nmemb, FILE *f,
 	       size_t *nret);
 
+/*% Write */
 isc_result_t
 isc_stdio_write(const void *ptr, size_t size, size_t nmemb, FILE *f,
 		size_t *nret);
 
+/*% Flush */
 isc_result_t
 isc_stdio_flush(FILE *f);
-/*
- * These functions are wrappers around the corresponding stdio functions,
- * returning a detailed error code in the form of an an isc_result_t.  ANSI C
- * does not guarantee that stdio functions set errno, hence these functions
- * must use platform dependent methods (e.g., the POSIX errno) to construct the
- * error code.
- */
 
 isc_result_t
 isc_stdio_sync(FILE *f);
-/*
+/*%<
  * Invoke fsync() on the file descriptor underlying an stdio stream, or an
  * equivalent system-dependent operation.  Note that this function has no
  * direct counterpart in the stdio library.
diff --git a/contrib/bind9/lib/isc/include/isc/stdlib.h b/contrib/bind9/lib/isc/include/isc/stdlib.h
index 7b75584..0e2c697 100644
--- a/contrib/bind9/lib/isc/include/isc/stdlib.h
+++ b/contrib/bind9/lib/isc/include/isc/stdlib.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdlib.h,v 1.1.32.2 2004/03/06 08:14:48 marka Exp $ */
+/* $Id: stdlib.h,v 1.2.18.2 2005/04/29 00:17:03 marka Exp $ */
 
 #ifndef ISC_STDLIB_H
 #define ISC_STDLIB_H 1
 
+/*! \file */
+
 #include <stdlib.h>
 
 #include <isc/lang.h>
diff --git a/contrib/bind9/lib/isc/include/isc/string.h b/contrib/bind9/lib/isc/include/isc/string.h
index 4fbfe19..1373cf2 100644
--- a/contrib/bind9/lib/isc/include/isc/string.h
+++ b/contrib/bind9/lib/isc/include/isc/string.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,22 +15,28 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: string.h,v 1.9.164.3 2004/03/06 08:14:49 marka Exp $ */
+/* $Id: string.h,v 1.12.18.3 2005/08/16 04:39:05 marka Exp $ */
 
 #ifndef ISC_STRING_H
 #define ISC_STRING_H 1
 
+/*! \file */
+
 #include <string.h>
 
+#include <isc/formatcheck.h>
 #include <isc/int.h>
 #include <isc/lang.h>
 #include <isc/platform.h>
+#include <isc/types.h>
+
+#define ISC_STRING_MAGIC 0x5e
 
 ISC_LANG_BEGINDECLS
 
 isc_uint64_t
 isc_string_touint64(char *source, char **endp, int base);
-/*
+/*%<
  * Convert the string pointed to by 'source' to isc_uint64_t.
  *
  * On successful conversion 'endp' points to the first character
@@ -43,6 +49,150 @@ isc_string_touint64(char *source, char **endp, int base);
  * On error 'endp' points to 'source'.
  */
 
+isc_result_t
+isc_string_copy(char *target, size_t size, const char *source);
+/*
+ * Copy the string pointed to by 'source' to 'target' which is a
+ * pointer to a string of at least 'size' bytes.
+ *
+ * Requires:
+ *	'target' is a pointer to a char[] of at least 'size' bytes.
+ *	'size' an integer > 0.
+ *	'source' == NULL or points to a NUL terminated string.
+ *
+ * Ensures:
+ *	If result == ISC_R_SUCCESS
+ *		'target' will be a NUL terminated string of no more
+ *		than 'size' bytes (including NUL).
+ *
+ *	If result == ISC_R_NOSPACE
+ *		'target' is undefined.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS  -- 'source' was successfully copied to 'target'.
+ *	ISC_R_NOSPACE  -- 'source' could not be copied since 'target'
+ *	                  is too small.
+ */
+
+void
+isc_string_copy_truncate(char *target, size_t size, const char *source);
+/*
+ * Copy the string pointed to by 'source' to 'target' which is a
+ * pointer to a string of at least 'size' bytes.
+ *
+ * Requires:
+ *	'target' is a pointer to a char[] of at least 'size' bytes.
+ *	'size' an integer > 0.
+ *	'source' == NULL or points to a NUL terminated string.
+ *
+ * Ensures:
+ *	'target' will be a NUL terminated string of no more
+ *	than 'size' bytes (including NUL).
+ */
+
+isc_result_t
+isc_string_append(char *target, size_t size, const char *source);
+/*
+ * Append the string pointed to by 'source' to 'target' which is a
+ * pointer to a NUL terminated string of at least 'size' bytes.
+ *
+ * Requires:
+ *	'target' is a pointer to a NUL terminated char[] of at
+ *	least 'size' bytes.
+ *	'size' an integer > 0.
+ *	'source' == NULL or points to a NUL terminated string.
+ *
+ * Ensures:
+ *	If result == ISC_R_SUCCESS
+ *		'target' will be a NUL terminated string of no more
+ *		than 'size' bytes (including NUL).
+ *
+ *	If result == ISC_R_NOSPACE
+ *		'target' is undefined.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS  -- 'source' was successfully appended to 'target'.
+ *	ISC_R_NOSPACE  -- 'source' could not be appended since 'target'
+ *	                  is too small.
+ */
+
+void
+isc_string_append_truncate(char *target, size_t size, const char *source);
+/*
+ * Append the string pointed to by 'source' to 'target' which is a
+ * pointer to a NUL terminated string of at least 'size' bytes.
+ *
+ * Requires:
+ *	'target' is a pointer to a NUL terminated char[] of at
+ *	least 'size' bytes.
+ *	'size' an integer > 0.
+ *	'source' == NULL or points to a NUL terminated string.
+ *
+ * Ensures:
+ *	'target' will be a NUL terminated string of no more
+ *	than 'size' bytes (including NUL).
+ */
+
+isc_result_t
+isc_string_printf(char *target, size_t size, const char *format, ...);
+/*
+ * Print 'format' to 'target' which is a pointer to a string of at least
+ * 'size' bytes.
+ *
+ * Requires:
+ *	'target' is a pointer to a char[] of at least 'size' bytes.
+ *	'size' an integer > 0.
+ *	'format' == NULL or points to a NUL terminated string.
+ *
+ * Ensures:
+ *	If result == ISC_R_SUCCESS
+ *		'target' will be a NUL terminated string of no more
+ *		than 'size' bytes (including NUL).
+ *
+ *	If result == ISC_R_NOSPACE
+ *		'target' is undefined.
+ *
+ * Returns:
+ *	ISC_R_SUCCESS  -- 'format' was successfully printed to 'target'.
+ *	ISC_R_NOSPACE  -- 'format' could not be printed to 'target' since it
+ *	                  is too small.
+ */
+
+void
+isc_string_printf_truncate(char *target, size_t size, const char *format, ...)
+	ISC_FORMAT_PRINTF(3, 4);
+/*
+ * Print 'format' to 'target' which is a pointer to a string of at least
+ * 'size' bytes.
+ *
+ * Requires:
+ *	'target' is a pointer to a char[] of at least 'size' bytes.
+ *	'size' an integer > 0.
+ *	'format' == NULL or points to a NUL terminated string.
+ *
+ * Ensures:
+ *	'target' will be a NUL terminated string of no more
+ *	than 'size' bytes (including NUL).
+ */
+
+
+char *
+isc_string_regiondup(isc_mem_t *mctx, const isc_region_t *source);
+/*
+ * Copy the region pointed to by r to a NUL terminated string
+ * allocated from the memory context pointed to by mctx.
+ *
+ * The result should be deallocated using isc_mem_free()
+ *
+ * Requires:
+ *	'mctx' is a point to a valid memory context.
+ *	'source' is a pointer to a valid region.
+ *
+ * Returns:
+ *	a pointer to a NUL terminated string or
+ *	NULL if memory for the copy could not be allocated
+ *
+ */
 
 char *
 isc_string_separate(char **stringp, const char *delim);
diff --git a/contrib/bind9/lib/isc/include/isc/symtab.h b/contrib/bind9/lib/isc/include/isc/symtab.h
index b22fe81..94ea173 100644
--- a/contrib/bind9/lib/isc/include/isc/symtab.h
+++ b/contrib/bind9/lib/isc/include/isc/symtab.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1996-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: symtab.h,v 1.16.206.3 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: symtab.h,v 1.17.18.4 2006/03/02 00:37:22 marka Exp $ */
 
 #ifndef ISC_SYMTAB_H
 #define ISC_SYMTAB_H 1
@@ -24,10 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * Symbol Table
- *
- * Provides a simple memory-based symbol table.
+/*! \file
+ * \brief Provides a simple memory-based symbol table.
  *
  * Keys are C strings, and key comparisons are case-insenstive.  A type may
  * be specified when looking up, defining, or undefining.  A type value of
@@ -38,11 +36,11 @@
  * tuple when a tuple with the given key and type already exists in the table.
  * What to do in this case is specified by the client.  Possible policies are:
  *
- *	isc_symexists_reject	Disallow the define, returning ISC_R_EXISTS
- *	isc_symexists_replace	Replace the old value with the new.  The
+ *\li	#isc_symexists_reject	Disallow the define, returning #ISC_R_EXISTS
+ *\li	#isc_symexists_replace	Replace the old value with the new.  The
  *				undefine action (if provided) will be called
  *				with the old <key, type, value> tuple.
- *	isc_symexists_add	Add the new tuple, leaving the old tuple in
+ *\li	#isc_symexists_add	Add the new tuple, leaving the old tuple in
  *				the table.  Subsequent lookups will retrieve
  *				the most-recently-defined tuple.
  *
@@ -59,19 +57,19 @@
  * undefined.  It can be used to free memory associated with keys and/or
  * values.
  *
- * MP:
+ * \li MP:
  *	The callers of this module must ensure any required synchronization.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
- *	<TBS>
+ * \li Resources:
+ *	TBS
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -82,10 +80,10 @@
 #include <isc/lang.h>
 #include <isc/types.h>
 
-/***
+/*
  *** Symbol Tables.
  ***/
-
+/*% Symbol table value. */
 typedef union isc_symvalue {
 	void *				as_pointer;
 	const void *			as_cpointer;
@@ -95,31 +93,36 @@ typedef union isc_symvalue {
 
 typedef void (*isc_symtabaction_t)(char *key, unsigned int type,
 				   isc_symvalue_t value, void *userarg);
-
+/*% Symbol table exists. */
 typedef enum {
-	isc_symexists_reject = 0,
-	isc_symexists_replace = 1,
-	isc_symexists_add = 2
+	isc_symexists_reject = 0,	/*%< Disallow the define */
+	isc_symexists_replace = 1,	/*%< Replace the old value with the new */
+	isc_symexists_add = 2		/*%< Add the new tuple */
 } isc_symexists_t;
 
 ISC_LANG_BEGINDECLS
 
+/*% Create a symbol table. */
 isc_result_t
 isc_symtab_create(isc_mem_t *mctx, unsigned int size,
 		  isc_symtabaction_t undefine_action, void *undefine_arg,
 		  isc_boolean_t case_sensitive, isc_symtab_t **symtabp);
 
+/*% Destroy a symbol table. */
 void
 isc_symtab_destroy(isc_symtab_t **symtabp);
 
+/*% Lookup a symbol table. */
 isc_result_t
 isc_symtab_lookup(isc_symtab_t *symtab, const char *key, unsigned int type,
 		  isc_symvalue_t *value);
 
+/*% Define a symbol table. */
 isc_result_t
 isc_symtab_define(isc_symtab_t *symtab, const char *key, unsigned int type,
 		  isc_symvalue_t value, isc_symexists_t exists_policy);
 
+/*% Undefine a symbol table. */
 isc_result_t
 isc_symtab_undefine(isc_symtab_t *symtab, const char *key, unsigned int type);
 
diff --git a/contrib/bind9/lib/isc/include/isc/task.h b/contrib/bind9/lib/isc/include/isc/task.h
index 0e8190a..f7d237c 100644
--- a/contrib/bind9/lib/isc/include/isc/task.h
+++ b/contrib/bind9/lib/isc/include/isc/task.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: task.h,v 1.49.206.3 2004/03/09 05:21:09 marka Exp $ */
+/* $Id: task.h,v 1.51.18.2 2005/04/29 00:17:03 marka Exp $ */
 
 #ifndef ISC_TASK_H
 #define ISC_TASK_H 1
@@ -24,33 +24,55 @@
  ***** Module Info
  *****/
 
-/*
- * Task System
- *
- * The task system provides a lightweight execution context, which is
- * basically an event queue.  When a task's event queue is non-empty, the
+/*! \file
+ * \brief The task system provides a lightweight execution context, which is
+ * basically an event queue.  
+
+ * When a task's event queue is non-empty, the
  * task is runnable.  A small work crew of threads, typically one per CPU,
  * execute runnable tasks by dispatching the events on the tasks' event
  * queues.  Context switching between tasks is fast.
  *
- * MP:
+ * \li MP:
  *	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
- *
  *	The caller must ensure that isc_taskmgr_destroy() is called only
  *	once for a given manager.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
- *	<TBS>
+ * \li Resources:
+ *	TBS
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
+ *
+ * \section purge Purging and Unsending
+ *
+ * Events which have been queued for a task but not delivered may be removed
+ * from the task's event queue by purging or unsending.
+ *
+ * With both types, the caller specifies a matching pattern that selects
+ * events based upon their sender, type, and tag.
+ *
+ * Purging calls isc_event_free() on the matching events.
+ *
+ * Unsending returns a list of events that matched the pattern.
+ * The caller is then responsible for them.
+ *
+ * Consumers of events should purge, not unsend.
+ *
+ * Producers of events often want to remove events when the caller indicates
+ * it is no longer interested in the object, e.g. by cancelling a timer.
+ * Sometimes this can be done by purging, but for some event types, the
+ * calls to isc_event_free() cause deadlock because the event free routine
+ * wants to acquire a lock the caller is already holding.  Unsending instead
+ * of purging solves this problem.  As a general rule, producers should only
+ * unsend events which they have sent.
  */
 
 
@@ -76,355 +98,335 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 isc_task_create(isc_taskmgr_t *manager, unsigned int quantum,
 		isc_task_t **taskp);
-/*
+/*%<
  * Create a task.
  *
  * Notes:
  *
- *	If 'quantum' is non-zero, then only that many events can be dispatched
+ *\li	If 'quantum' is non-zero, then only that many events can be dispatched
  *	before the task must yield to other tasks waiting to execute.  If
  *	quantum is zero, then the default quantum of the task manager will
  *	be used.
  *
- *	The 'quantum' option may be removed from isc_task_create() in the
+ *\li	The 'quantum' option may be removed from isc_task_create() in the
  *	future.  If this happens, isc_task_getquantum() and
  *	isc_task_setquantum() will be provided.
  *
  * Requires:
  *
- *	'manager' is a valid task manager.
+ *\li	'manager' is a valid task manager.
  *
- *	taskp != NULL && *taskp == NULL
+ *\li	taskp != NULL && *taskp == NULL
  *
  * Ensures:
  *
- *	On success, '*taskp' is bound to the new task.
+ *\li	On success, '*taskp' is bound to the new task.
  *
  * Returns:
  *
- *     	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
- *	ISC_R_SHUTTINGDOWN
+ *\li   #ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
+ *\li	#ISC_R_SHUTTINGDOWN
  */
 
 void
 isc_task_attach(isc_task_t *source, isc_task_t **targetp);
-/*
+/*%<
  * Attach *targetp to source.
  *
  * Requires:
  *
- *	'source' is a valid task.
+ *\li	'source' is a valid task.
  *
- *	'targetp' points to a NULL isc_task_t *.
+ *\li	'targetp' points to a NULL isc_task_t *.
  *
  * Ensures:
  *
- *	*targetp is attached to source.
+ *\li	*targetp is attached to source.
  */
 
 void
 isc_task_detach(isc_task_t **taskp);
-/*
+/*%<
  * Detach *taskp from its task.
  *
  * Requires:
  *
- *	'*taskp' is a valid task.
+ *\li	'*taskp' is a valid task.
  *
  * Ensures:
  *
- *	*taskp is NULL.
+ *\li	*taskp is NULL.
  *
- *	If '*taskp' is the last reference to the task, the task is idle (has
+ *\li	If '*taskp' is the last reference to the task, the task is idle (has
  *	an empty event queue), and has not been shutdown, the task will be
  *	shutdown.
  *
- *	If '*taskp' is the last reference to the task and
+ *\li	If '*taskp' is the last reference to the task and
  *	the task has been shutdown,
- *
- *		All resources used by the task will be freed.
+ *		all resources used by the task will be freed.
  */
 
 void
 isc_task_send(isc_task_t *task, isc_event_t **eventp);
-/*
+/*%<
  * Send '*event' to 'task'.
  *
  * Requires:
  *
- *	'task' is a valid task.
- *	eventp != NULL && *eventp != NULL.
+ *\li	'task' is a valid task.
+ *\li	eventp != NULL && *eventp != NULL.
  *
  * Ensures:
  *
- *	*eventp == NULL.
+ *\li	*eventp == NULL.
  */
 
 void
 isc_task_sendanddetach(isc_task_t **taskp, isc_event_t **eventp);
-/*
+/*%<
  * Send '*event' to '*taskp' and then detach '*taskp' from its
  * task.
  *
  * Requires:
  *
- *	'*taskp' is a valid task.
- *	eventp != NULL && *eventp != NULL.
+ *\li	'*taskp' is a valid task.
+ *\li	eventp != NULL && *eventp != NULL.
  *
  * Ensures:
  *
- *	*eventp == NULL.
+ *\li	*eventp == NULL.
  *
- *	*taskp == NULL.
+ *\li	*taskp == NULL.
  *
- *	If '*taskp' is the last reference to the task, the task is
+ *\li	If '*taskp' is the last reference to the task, the task is
  *	idle (has an empty event queue), and has not been shutdown,
  *	the task will be shutdown.
  *
- *	If '*taskp' is the last reference to the task and
+ *\li	If '*taskp' is the last reference to the task and
  *	the task has been shutdown,
- *
- *		All resources used by the task will be freed.
+ *		all resources used by the task will be freed.
  */
 
-/*
- * Purging and Unsending
- *
- * Events which have been queued for a task but not delivered may be removed
- * from the task's event queue by purging or unsending.
- *
- * With both types, the caller specifies a matching pattern that selects
- * events based upon their sender, type, and tag.
- *
- * Purging calls isc_event_free() on the matching events.
- *
- * Unsending returns a list of events that matched the pattern.
- * The caller is then responsible for them.
- *
- * Consumers of events should purge, not unsend.
- *
- * Producers of events often want to remove events when the caller indicates
- * it is no longer interested in the object, e.g. by cancelling a timer.
- * Sometimes this can be done by purging, but for some event types, the
- * calls to isc_event_free() cause deadlock because the event free routine
- * wants to acquire a lock the caller is already holding.  Unsending instead
- * of purging solves this problem.  As a general rule, producers should only
- * unsend events which they have sent.
- */
 
 unsigned int
 isc_task_purgerange(isc_task_t *task, void *sender, isc_eventtype_t first,
 		    isc_eventtype_t last, void *tag);
-/*
+/*%<
  * Purge events from a task's event queue.
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	last >= first
+ *\li	last >= first
  *
  * Ensures:
  *
- *	Events in the event queue of 'task' whose sender is 'sender', whose
+ *\li	Events in the event queue of 'task' whose sender is 'sender', whose
  *	type is >= first and <= last, and whose tag is 'tag' will be purged,
  *	unless they are marked as unpurgable.
  *
- *	A sender of NULL will match any sender.  A NULL tag matches any
+ *\li	A sender of NULL will match any sender.  A NULL tag matches any
  *	tag.
  *
  * Returns:
  *
- *	The number of events purged.
+ *\li	The number of events purged.
  */
 
 unsigned int
 isc_task_purge(isc_task_t *task, void *sender, isc_eventtype_t type,
 	       void *tag);
-/*
+/*%<
  * Purge events from a task's event queue.
  *
  * Notes:
  *
- *	This function is equivalent to
+ *\li	This function is equivalent to
  *
+ *\code
  *		isc_task_purgerange(task, sender, type, type, tag);
+ *\endcode
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
  * Ensures:
  *
- *	Events in the event queue of 'task' whose sender is 'sender', whose
+ *\li	Events in the event queue of 'task' whose sender is 'sender', whose
  *	type is 'type', and whose tag is 'tag' will be purged, unless they
  *	are marked as unpurgable.
  *
- *	A sender of NULL will match any sender.  A NULL tag matches any
+ *\li	A sender of NULL will match any sender.  A NULL tag matches any
  *	tag.
  *
  * Returns:
  *
- *	The number of events purged.
+ *\li	The number of events purged.
  */
 
 isc_boolean_t
 isc_task_purgeevent(isc_task_t *task, isc_event_t *event);
-/*
+/*%<
  * Purge 'event' from a task's event queue.
  *
  * XXXRTH:  WARNING:  This method may be removed before beta.
  *
  * Notes:
  *
- *	If 'event' is on the task's event queue, it will be purged,
+ *\li	If 'event' is on the task's event queue, it will be purged,
  * 	unless it is marked as unpurgeable.  'event' does not have to be
  *	on the task's event queue; in fact, it can even be an invalid
  *	pointer.  Purging only occurs if the event is actually on the task's
  *	event queue.
  *
- * 	Purging never changes the state of the task.
+ * \li	Purging never changes the state of the task.
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
  * Ensures:
  *
- *	'event' is not in the event queue for 'task'.
+ *\li	'event' is not in the event queue for 'task'.
  *
  * Returns:
  *
- *	ISC_TRUE			The event was purged.
- *	ISC_FALSE			The event was not in the event queue,
+ *\li	#ISC_TRUE			The event was purged.
+ *\li	#ISC_FALSE			The event was not in the event queue,
  *					or was marked unpurgeable.
  */
 
 unsigned int
 isc_task_unsendrange(isc_task_t *task, void *sender, isc_eventtype_t first,
 		     isc_eventtype_t last, void *tag, isc_eventlist_t *events);
-/*
+/*%<
  * Remove events from a task's event queue.
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	last >= first.
+ *\li	last >= first.
  *
- *	*events is a valid list.
+ *\li	*events is a valid list.
  *
  * Ensures:
  *
- *	Events in the event queue of 'task' whose sender is 'sender', whose
+ *\li	Events in the event queue of 'task' whose sender is 'sender', whose
  *	type is >= first and <= last, and whose tag is 'tag' will be dequeued
  *	and appended to *events.
  *
- *	A sender of NULL will match any sender.  A NULL tag matches any
+ *\li	A sender of NULL will match any sender.  A NULL tag matches any
  *	tag.
  *
  * Returns:
  *
- *	The number of events unsent.
+ *\li	The number of events unsent.
  */
 
 unsigned int
 isc_task_unsend(isc_task_t *task, void *sender, isc_eventtype_t type,
 		void *tag, isc_eventlist_t *events);
-/*
+/*%<
  * Remove events from a task's event queue.
  *
  * Notes:
  *
- *	This function is equivalent to
+ *\li	This function is equivalent to
  *
+ *\code
  *		isc_task_unsendrange(task, sender, type, type, tag, events);
+ *\endcode
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	*events is a valid list.
+ *\li	*events is a valid list.
  *
  * Ensures:
  *
- *	Events in the event queue of 'task' whose sender is 'sender', whose
+ *\li	Events in the event queue of 'task' whose sender is 'sender', whose
  *	type is 'type', and whose tag is 'tag' will be dequeued and appended
  *	to *events.
  *
  * Returns:
  *
- *	The number of events unsent.
+ *\li	The number of events unsent.
  */
 
 isc_result_t
 isc_task_onshutdown(isc_task_t *task, isc_taskaction_t action,
 		    const void *arg);
-/*
+/*%<
  * Send a shutdown event with action 'action' and argument 'arg' when
  * 'task' is shutdown.
  *
  * Notes:
  *
- *	Shutdown events are posted in LIFO order.
+ *\li	Shutdown events are posted in LIFO order.
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
- *	'action' is a valid task action.
+ *\li	'action' is a valid task action.
  *
  * Ensures:
  *
- *	When the task is shutdown, shutdown events requested with
+ *\li	When the task is shutdown, shutdown events requested with
  *	isc_task_onshutdown() will be appended to the task's event queue.
  *
 
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_TASKSHUTTINGDOWN			Task is shutting down.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_TASKSHUTTINGDOWN			Task is shutting down.
  */
 
 void
 isc_task_shutdown(isc_task_t *task);
-/*
+/*%<
  * Shutdown 'task'.
  *
  * Notes:
  *
- *	Shutting down a task causes any shutdown events requested with
+ *\li	Shutting down a task causes any shutdown events requested with
  *	isc_task_onshutdown() to be posted (in LIFO order).  The task
  *	moves into a "shutting down" mode which prevents further calls
  *	to isc_task_onshutdown().
  *
- *	Trying to shutdown a task that has already been shutdown has no
+ *\li	Trying to shutdown a task that has already been shutdown has no
  *	effect.
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
  * Ensures:
  *
- *	Any shutdown events requested with isc_task_onshutdown() have been
+ *\li	Any shutdown events requested with isc_task_onshutdown() have been
  *	posted (in LIFO order).
  */
 
 void
 isc_task_destroy(isc_task_t **taskp);
-/*
+/*%<
  * Destroy '*taskp'.
  *
  * Notes:
  *
- *	This call is equivalent to:
+ *\li	This call is equivalent to:
  *
+ *\code
  *		isc_task_shutdown(*taskp);
  *		isc_task_detach(taskp);
+ *\endcode
  *
  * Requires:
  *
@@ -432,45 +434,44 @@ isc_task_destroy(isc_task_t **taskp);
  *
  * Ensures:
  *
- *	Any shutdown events requested with isc_task_onshutdown() have been
+ *\li	Any shutdown events requested with isc_task_onshutdown() have been
  *	posted (in LIFO order).
  *
- *	*taskp == NULL
+ *\li	*taskp == NULL
  *
- *	If '*taskp' is the last reference to the task,
- *
- *		All resources used by the task will be freed.
+ *\li	If '*taskp' is the last reference to the task,
+ *		all resources used by the task will be freed.
  */
 
 void
 isc_task_setname(isc_task_t *task, const char *name, void *tag);
-/*
+/*%<
  * Name 'task'.
  *
  * Notes:
  *
- *	Only the first 15 characters of 'name' will be copied.
+ *\li	Only the first 15 characters of 'name' will be copied.
  *
- *	Naming a task is currently only useful for debugging purposes.
+ *\li	Naming a task is currently only useful for debugging purposes.
  *
  * Requires:
  *
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  */
 
 const char *
 isc_task_getname(isc_task_t *task);
-/*
+/*%<
  * Get the name of 'task', as previously set using isc_task_setname().
  *
  * Notes:
- *	This function is for debugging purposes only.
+ *\li	This function is for debugging purposes only.
  *
  * Requires:
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  *
  * Returns:
- *	A non-NULL pointer to a null-terminated string.
+ *\li	A non-NULL pointer to a null-terminated string.
  * 	If the task has not been named, the string is
  * 	empty.
  *
@@ -478,19 +479,19 @@ isc_task_getname(isc_task_t *task);
 
 void *
 isc_task_gettag(isc_task_t *task);
-/*
+/*%<
  * Get the tag value for  'task', as previously set using isc_task_settag().
  *
  * Notes:
- *	This function is for debugging purposes only.
+ *\li	This function is for debugging purposes only.
  *
  * Requires:
- *	'task' is a valid task.
+ *\li	'task' is a valid task.
  */
 
 isc_result_t
 isc_task_beginexclusive(isc_task_t *task);
-/*
+/*%<
  * Request exclusive access for 'task', which must be the calling
  * task.  Waits for any other concurrently executing tasks to finish their
  * current event, and prevents any new events from executing in any of the
@@ -500,37 +501,37 @@ isc_task_beginexclusive(isc_task_t *task);
  * isc_task_endexclusive() before returning from the current event handler.
  *
  * Requires:
- *	'task' is the calling task.
+ *\li	'task' is the calling task.
  *
  * Returns:
- *	ISC_R_SUCCESS		The current task now has exclusive access.
- *	ISC_R_LOCKBUSY		Another task has already requested exclusive
+ *\li	#ISC_R_SUCCESS		The current task now has exclusive access.
+ *\li	#ISC_R_LOCKBUSY		Another task has already requested exclusive
  *				access.
  */
 
 void
 isc_task_endexclusive(isc_task_t *task);
-/*
+/*%<
  * Relinquish the exclusive access obtained by isc_task_beginexclusive(), 
  * allowing other tasks to execute.
  *
  * Requires:
- *	'task' is the calling task, and has obtained
+ *\li	'task' is the calling task, and has obtained
  *		exclusive access by calling isc_task_spl().
  */
 
 void
 isc_task_getcurrenttime(isc_task_t *task, isc_stdtime_t *t);
-/*
+/*%<
  * Provide the most recent timestamp on the task.  The timestamp is considered
  * as the "current time" in the second-order granularity.
  *
  * Requires:
- *	'task' is a valid task.
- *	't' is a valid non NULL pointer.
+ *\li	'task' is a valid task.
+ *\li	't' is a valid non NULL pointer.
  *
  * Ensures:
- *	'*t' has the "current time".
+ *\li	'*t' has the "current time".
  */
 
 /*****
@@ -540,73 +541,73 @@ isc_task_getcurrenttime(isc_task_t *task, isc_stdtime_t *t);
 isc_result_t
 isc_taskmgr_create(isc_mem_t *mctx, unsigned int workers,
 		   unsigned int default_quantum, isc_taskmgr_t **managerp);
-/*
+/*%<
  * Create a new task manager.
  *
  * Notes:
  *
- *	'workers' in the number of worker threads to create.  In general,
+ *\li	'workers' in the number of worker threads to create.  In general,
  *	the value should be close to the number of processors in the system.
  *	The 'workers' value is advisory only.  An attempt will be made to
  *	create 'workers' threads, but if at least one thread creation
  *	succeeds, isc_taskmgr_create() may return ISC_R_SUCCESS.
  *
- *	If 'default_quantum' is non-zero, then it will be used as the default
+ *\li	If 'default_quantum' is non-zero, then it will be used as the default
  *	quantum value when tasks are created.  If zero, then an implementation
  *	defined default quantum will be used.
  *
  * Requires:
  *
- *      'mctx' is a valid memory context.
+ *\li      'mctx' is a valid memory context.
  *
- *	workers > 0
+ *\li	workers > 0
  *
- *	managerp != NULL && *managerp == NULL
+ *\li	managerp != NULL && *managerp == NULL
  *
  * Ensures:
  *
- *	On success, '*managerp' will be attached to the newly created task
+ *\li	On success, '*managerp' will be attached to the newly created task
  *	manager.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_NOTHREADS			No threads could be created.
- *	ISC_R_UNEXPECTED		An unexpected error occurred.
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_NOTHREADS			No threads could be created.
+ *\li	#ISC_R_UNEXPECTED		An unexpected error occurred.
  */
 
 void
 isc_taskmgr_destroy(isc_taskmgr_t **managerp);
-/*
+/*%<
  * Destroy '*managerp'.
  *
  * Notes:
  *
- *	Calling isc_taskmgr_destroy() will shutdown all tasks managed by
+ *\li	Calling isc_taskmgr_destroy() will shutdown all tasks managed by
  *	*managerp that haven't already been shutdown.  The call will block
  *	until all tasks have entered the done state.
  *
- *	isc_taskmgr_destroy() must not be called by a task event action,
+ *\li	isc_taskmgr_destroy() must not be called by a task event action,
  *	because it would block forever waiting for the event action to
  *	complete.  An event action that wants to cause task manager shutdown
  *	should request some non-event action thread of execution to do the
  *	shutdown, e.g. by signalling a condition variable or using
  *	isc_app_shutdown().
  *
- *	Task manager references are not reference counted, so the caller
+ *\li	Task manager references are not reference counted, so the caller
  *	must ensure that no attempt will be made to use the manager after
  *	isc_taskmgr_destroy() returns.
  *
  * Requires:
  *
- *	'*managerp' is a valid task manager.
+ *\li	'*managerp' is a valid task manager.
  *
- *	isc_taskmgr_destroy() has not be called previously on '*managerp'.
+ *\li	isc_taskmgr_destroy() has not be called previously on '*managerp'.
  *
  * Ensures:
  *
- *	All resources used by the task manager, and any tasks it managed,
+ *\li	All resources used by the task manager, and any tasks it managed,
  *	have been freed.
  */
 
diff --git a/contrib/bind9/lib/isc/include/isc/taskpool.h b/contrib/bind9/lib/isc/include/isc/taskpool.h
index 42066d2..6c97605 100644
--- a/contrib/bind9/lib/isc/include/isc/taskpool.h
+++ b/contrib/bind9/lib/isc/include/isc/taskpool.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: taskpool.h,v 1.8.206.1 2004/03/06 08:14:49 marka Exp $ */
+/* $Id: taskpool.h,v 1.9.18.2 2005/04/29 00:17:04 marka Exp $ */
 
 #ifndef ISC_TASKPOOL_H
 #define ISC_TASKPOOL_H 1
@@ -24,10 +24,8 @@
  ***** Module Info
  *****/
 
-/*
- * Task Pool
- *
- * A task pool is a mechanism for sharing a small number of tasks
+/*! \file
+ * \brief A task pool is a mechanism for sharing a small number of tasks
  * among a large number of objects such that each object is
  * assigned a unique task, but each task may be shared by several
  * objects.
@@ -62,44 +60,44 @@ isc_result_t
 isc_taskpool_create(isc_taskmgr_t *tmgr, isc_mem_t *mctx,
 		    unsigned int ntasks, unsigned int quantum,
 		    isc_taskpool_t **poolp);
-/*
+/*%<
  * Create a task pool of "ntasks" tasks, each with quantum
  * "quantum".
  *
  * Requires:
  *
- *	'tmgr' is a valid task manager.
+ *\li	'tmgr' is a valid task manager.
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
- *	poolp != NULL && *poolp == NULL
+ *\li	poolp != NULL && *poolp == NULL
  *
  * Ensures:
  *
- *	On success, '*taskp' points to the new task pool.
+ *\li	On success, '*taskp' points to the new task pool.
  *
  * Returns:
  *
- *     	ISC_R_SUCCESS
- *	ISC_R_NOMEMORY
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	#ISC_R_UNEXPECTED
  */
 
 void 
 isc_taskpool_gettask(isc_taskpool_t *pool, unsigned int hash,
 			  isc_task_t **targetp);
-/*
+/*%<
  * Attach to the task corresponding to the hash value "hash".
  */
 
 void
 isc_taskpool_destroy(isc_taskpool_t **poolp);
-/*
+/*%<
  * Destroy a task pool.  The tasks in the pool are detached but not
  * shut down.
  *
  * Requires:
- * 	'*poolp' is a valid task pool.
+ * \li	'*poolp' is a valid task pool.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/include/isc/timer.h b/contrib/bind9/lib/isc/include/isc/timer.h
index 439c943..1e139dd 100644
--- a/contrib/bind9/lib/isc/include/isc/timer.h
+++ b/contrib/bind9/lib/isc/include/isc/timer.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.h,v 1.28.12.6 2005/10/27 00:27:30 marka Exp $ */
+/* $Id: timer.h,v 1.31.18.3 2005/10/26 06:50:50 marka Exp $ */
 
 #ifndef ISC_TIMER_H
 #define ISC_TIMER_H 1
@@ -24,50 +24,46 @@
  ***** Module Info
  *****/
 
-/*
- * Timers
- *
- * Provides timers which are event sources in the task system.
+/*! \file
+ * \brief Provides timers which are event sources in the task system.
  *
  * Three types of timers are supported:
  *
- *	'ticker' timers generate a periodic tick event.
+ *\li	'ticker' timers generate a periodic tick event.
  *
- *	'once' timers generate an idle timeout event if they are idle for too
+ *\li	'once' timers generate an idle timeout event if they are idle for too
  *	long, and generate a life timeout event if their lifetime expires.
  *	They are used to implement both (possibly expiring) idle timers and
  *	'one-shot' timers.
  *
- *	'limited' timers generate a periodic tick event until they reach
+ *\li	'limited' timers generate a periodic tick event until they reach
  *	their lifetime when they generate a life timeout event.
  *
- *	'inactive' timers generate no events.
+ *\li	'inactive' timers generate no events.
  *
  * Timers can change type.  It is typical to create a timer as
  * an 'inactive' timer and then change it into a 'ticker' or
  * 'once' timer.
  *
- * MP:
+ *\li MP:
  *	The module ensures appropriate synchronization of data structures it
  *	creates and manipulates.
- *
  *	Clients of this module must not be holding a timer's task's lock when
  *	making a call that affects that timer.  Failure to follow this rule
  *	can result in deadlock.
- *
  *	The caller must ensure that isc_timermgr_destroy() is called only
  *	once for a given manager.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
- *	<TBS>
+ * \li Resources:
+ *	TBS
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
@@ -87,11 +83,12 @@ ISC_LANG_BEGINDECLS
  *** Types
  ***/
 
+/*% Timer Type */
 typedef enum {
-	isc_timertype_ticker = 0,
-	isc_timertype_once = 1,
-	isc_timertype_limited = 2,
-	isc_timertype_inactive = 3
+	isc_timertype_ticker = 0, 	/*%< Ticker */
+	isc_timertype_once = 1, 	/*%< Once */
+	isc_timertype_limited = 2, 	/*%< Limited */
+	isc_timertype_inactive = 3 	/*%< Inactive */
 } isc_timertype_t;
 
 typedef struct isc_timerevent {
@@ -120,7 +117,7 @@ isc_timer_create(isc_timermgr_t *manager,
 		 isc_taskaction_t action,
 		 const void *arg,
 		 isc_timer_t **timerp);
-/*
+/*%<
  * Create a new 'type' timer managed by 'manager'.  The timers parameters
  * are specified by 'expires' and 'interval'.  Events will be posted to
  * 'task' and when dispatched 'action' will be called with 'arg' as the
@@ -128,51 +125,51 @@ isc_timer_create(isc_timermgr_t *manager,
  *
  * Notes:
  *
- *	For ticker timers, the timer will generate a 'tick' event every
+ *\li	For ticker timers, the timer will generate a 'tick' event every
  *	'interval' seconds.  The value of 'expires' is ignored.
  *
- *	For once timers, 'expires' specifies the time when a life timeout
+ *\li	For once timers, 'expires' specifies the time when a life timeout
  *	event should be generated.  If 'expires' is 0 (the epoch), then no life
  *	timeout will be generated.  'interval' specifies how long the timer
  *	can be idle before it generates an idle timeout.  If 0, then no
  *	idle timeout will be generated.
  *
- *	If 'expires' is NULL, the epoch will be used.
+ *\li	If 'expires' is NULL, the epoch will be used.
  *
  *	If 'interval' is NULL, the zero interval will be used.
  *
  * Requires:
  *
- *	'manager' is a valid manager
+ *\li	'manager' is a valid manager
  *
- *	'task' is a valid task
+ *\li	'task' is a valid task
  *
- *	'action' is a valid action
+ *\li	'action' is a valid action
  *
- *	'expires' points to a valid time, or is NULL.
+ *\li	'expires' points to a valid time, or is NULL.
  *
- *	'interval' points to a valid interval, or is NULL.
+ *\li	'interval' points to a valid interval, or is NULL.
  *
- *	type == isc_timertype_inactive ||
+ *\li	type == isc_timertype_inactive ||
  *	('expires' and 'interval' are not both 0)
  *
- *	'timerp' is a valid pointer, and *timerp == NULL
+ *\li	'timerp' is a valid pointer, and *timerp == NULL
  *
  * Ensures:
  *
- *	'*timerp' is attached to the newly created timer
+ *\li	'*timerp' is attached to the newly created timer
  *
- *	The timer is attached to the task
+ *\li	The timer is attached to the task
  *
- *	An idle timeout will not be generated until at least Now + the
+ *\li	An idle timeout will not be generated until at least Now + the
  *	timer's interval if 'timer' is a once timer with a non-zero
  *	interval.
  *
  * Returns:
  *
- *	Success
- *	No memory
- *	Unexpected error
+ *\li	Success
+ *\li	No memory
+ *\li	Unexpected error
  */
 
 isc_result_t
@@ -181,90 +178,91 @@ isc_timer_reset(isc_timer_t *timer,
 		isc_time_t *expires,
 		isc_interval_t *interval,
 		isc_boolean_t purge);
-/*
+/*%<
  * Change the timer's type, expires, and interval values to the given
  * values.  If 'purge' is TRUE, any pending events from this timer
  * are purged from its task's event queue.
  *
  * Notes:
  *
- *	If 'expires' is NULL, the epoch will be used.
+ *\li	If 'expires' is NULL, the epoch will be used.
  *
- *	If 'interval' is NULL, the zero interval will be used.
+ *\li	If 'interval' is NULL, the zero interval will be used.
  *
  * Requires:
  *
- *	'timer' is a valid timer
+ *\li	'timer' is a valid timer
  *
- *	The same requirements that isc_timer_create() imposes on 'type',
+ *\li	The same requirements that isc_timer_create() imposes on 'type',
  *	'expires' and 'interval' apply.
  *
  * Ensures:
  *
- *	An idle timeout will not be generated until at least Now + the
+ *\li	An idle timeout will not be generated until at least Now + the
  *	timer's interval if 'timer' is a once timer with a non-zero
  *	interval.
  *
  * Returns:
  *
- *	Success
- *	No memory
- *	Unexpected error
+ *\li	Success
+ *\li	No memory
+ *\li	Unexpected error
  */
 
 isc_result_t
 isc_timer_touch(isc_timer_t *timer);
-/*
+/*%<
  * Set the last-touched time of 'timer' to the current time.
  *
  * Requires:
  *
- *	'timer' is a valid once timer.
+ *\li	'timer' is a valid once timer.
  *
  * Ensures:
  *
- *	An idle timeout will not be generated until at least Now + the
+ *\li	An idle timeout will not be generated until at least Now + the
  *	timer's interval if 'timer' is a once timer with a non-zero
  *	interval.
  *
  * Returns:
  *
- *	Success
- *	Unexpected error
+ *\li	Success
+ *\li	Unexpected error
  */
 
 void
 isc_timer_attach(isc_timer_t *timer, isc_timer_t **timerp);
-/*
+/*%<
  * Attach *timerp to timer.
  *
  * Requires:
  *
- *	'timer' is a valid timer.
+ *\li	'timer' is a valid timer.
  *
- *	'timerp' points to a NULL timer.
+ *\li	'timerp' points to a NULL timer.
  *
  * Ensures:
  *
- *	*timerp is attached to timer.
+ *\li	*timerp is attached to timer.
  */
 
 void
 isc_timer_detach(isc_timer_t **timerp);
-/*
+/*%<
  * Detach *timerp from its timer.
  *
  * Requires:
  *
- *	'timerp' points to a valid timer.
+ *\li	'timerp' points to a valid timer.
  *
  * Ensures:
  *
- *	*timerp is NULL.
+ *\li	*timerp is NULL.
  *
- *	If '*timerp' is the last reference to the timer,
+ *\li	If '*timerp' is the last reference to the timer,
  *	then:
  *
+ *\code
  *		The timer will be shutdown
  *
  *		The timer will detach from its task
@@ -275,6 +273,7 @@ isc_timer_detach(isc_timer_t **timerp);
  *		Therefore, if isc_timer_detach() is called in the context
  *		of the timer's task, it is guaranteed that no more
  *		timer event callbacks will run after the call.
+ *\endcode
  */
 
 isc_timertype_t
@@ -289,51 +288,51 @@ isc_timer_gettype(isc_timer_t *timer);
 
 isc_result_t
 isc_timermgr_create(isc_mem_t *mctx, isc_timermgr_t **managerp);
-/*
+/*%<
  * Create a timer manager.
  *
  * Notes:
  *
- *	All memory will be allocated in memory context 'mctx'.
+ *\li	All memory will be allocated in memory context 'mctx'.
  *
  * Requires:
  *
- *	'mctx' is a valid memory context.
+ *\li	'mctx' is a valid memory context.
  *
- *	'managerp' points to a NULL isc_timermgr_t.
+ *\li	'managerp' points to a NULL isc_timermgr_t.
  *
  * Ensures:
  *
- *	'*managerp' is a valid isc_timermgr_t.
+ *\li	'*managerp' is a valid isc_timermgr_t.
  *
  * Returns:
  *
- *	Success
- *	No memory
- *	Unexpected error
+ *\li	Success
+ *\li	No memory
+ *\li	Unexpected error
  */
 
 void
 isc_timermgr_destroy(isc_timermgr_t **managerp);
-/*
+/*%<
  * Destroy a timer manager.
  *
  * Notes:
  *
- *	This routine blocks until there are no timers left in the manager,
+ *\li	This routine blocks until there are no timers left in the manager,
  *	so if the caller holds any timer references using the manager, it
  *	must detach them before calling isc_timermgr_destroy() or it will
  *	block forever.
  *
  * Requires:
  *
- *	'*managerp' is a valid isc_timermgr_t.
+ *\li	'*managerp' is a valid isc_timermgr_t.
  *
  * Ensures:
  *
- *	*managerp == NULL
+ *\li	*managerp == NULL
  *
- *	All resources used by the manager have been freed.
+ *\li	All resources used by the manager have been freed.
  */
 
 void isc_timermgr_poke(isc_timermgr_t *m);
diff --git a/contrib/bind9/lib/isc/include/isc/types.h b/contrib/bind9/lib/isc/include/isc/types.h
index fad77da..35a0be7 100644
--- a/contrib/bind9/lib/isc/include/isc/types.h
+++ b/contrib/bind9/lib/isc/include/isc/types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: types.h,v 1.32.2.3.2.1 2004/03/06 08:14:50 marka Exp $ */
+/* $Id: types.h,v 1.35.18.2 2005/04/29 00:17:04 marka Exp $ */
 
 #ifndef ISC_TYPES_H
 #define ISC_TYPES_H 1
 
-/*
+/*! \file
+ * \brief
  * OS-specific types, from the OS-specific include directories.
  */
 #include <isc/int.h>
@@ -37,57 +38,56 @@
  */
 #include <isc/list.h>
 
-/***
- *** Core Types.  Alphabetized by defined type.
- ***/
+/* Core Types.  Alphabetized by defined type. */
 
-typedef struct isc_bitstring		isc_bitstring_t;
-typedef struct isc_buffer		isc_buffer_t;
-typedef ISC_LIST(isc_buffer_t)		isc_bufferlist_t;
-typedef struct isc_constregion		isc_constregion_t;
-typedef struct isc_consttextregion	isc_consttextregion_t;
-typedef struct isc_entropy		isc_entropy_t;
-typedef struct isc_entropysource	isc_entropysource_t;
-typedef struct isc_event		isc_event_t;
-typedef ISC_LIST(isc_event_t)		isc_eventlist_t;
-typedef unsigned int			isc_eventtype_t;
-typedef isc_uint32_t			isc_fsaccess_t;
-typedef struct isc_hash			isc_hash_t;
-typedef struct isc_interface		isc_interface_t;
-typedef struct isc_interfaceiter	isc_interfaceiter_t;
-typedef struct isc_interval		isc_interval_t;
-typedef struct isc_lex			isc_lex_t;
-typedef struct isc_log 			isc_log_t;
-typedef struct isc_logcategory		isc_logcategory_t;
-typedef struct isc_logconfig		isc_logconfig_t;
-typedef struct isc_logmodule		isc_logmodule_t;
-typedef struct isc_mem			isc_mem_t;
-typedef struct isc_mempool		isc_mempool_t;
-typedef struct isc_msgcat		isc_msgcat_t;
-typedef struct isc_ondestroy		isc_ondestroy_t;
-typedef struct isc_netaddr		isc_netaddr_t;
-typedef struct isc_quota		isc_quota_t;
-typedef struct isc_random		isc_random_t;
-typedef struct isc_ratelimiter		isc_ratelimiter_t;
-typedef struct isc_region		isc_region_t;
-typedef isc_uint64_t			isc_resourcevalue_t;
-typedef unsigned int			isc_result_t;
-typedef struct isc_rwlock		isc_rwlock_t;
-typedef struct isc_sockaddr		isc_sockaddr_t;
-typedef struct isc_socket		isc_socket_t;
-typedef struct isc_socketevent		isc_socketevent_t;
-typedef struct isc_socketmgr		isc_socketmgr_t;
-typedef struct isc_symtab		isc_symtab_t;
-typedef struct isc_task			isc_task_t;
-typedef ISC_LIST(isc_task_t)		isc_tasklist_t;
-typedef struct isc_taskmgr		isc_taskmgr_t;
-typedef struct isc_textregion		isc_textregion_t;
-typedef struct isc_time			isc_time_t;
-typedef struct isc_timer		isc_timer_t;
-typedef struct isc_timermgr		isc_timermgr_t;
+typedef struct isc_bitstring		isc_bitstring_t; 	/*%< Bitstring */
+typedef struct isc_buffer		isc_buffer_t;		/*%< Buffer */
+typedef ISC_LIST(isc_buffer_t)		isc_bufferlist_t;	/*%< Buffer List */
+typedef struct isc_constregion		isc_constregion_t;	/*%< Const region */
+typedef struct isc_consttextregion	isc_consttextregion_t;	/*%< Const Text Region */
+typedef struct isc_entropy		isc_entropy_t;		/*%< Entropy */
+typedef struct isc_entropysource	isc_entropysource_t;	/*%< Entropy Source */
+typedef struct isc_event		isc_event_t;		/*%< Event */
+typedef ISC_LIST(isc_event_t)		isc_eventlist_t;	/*%< Event List */
+typedef unsigned int			isc_eventtype_t;	/*%< Event Type */
+typedef isc_uint32_t			isc_fsaccess_t;		/*%< FS Access */
+typedef struct isc_hash			isc_hash_t;		/*%< Hash */
+typedef struct isc_interface		isc_interface_t;	/*%< Interface */
+typedef struct isc_interfaceiter	isc_interfaceiter_t;	/*%< Interface Iterator */
+typedef struct isc_interval		isc_interval_t;		/*%< Interval */
+typedef struct isc_lex			isc_lex_t;		/*%< Lex */
+typedef struct isc_log 			isc_log_t;		/*%< Log */
+typedef struct isc_logcategory		isc_logcategory_t;	/*%< Log Category */
+typedef struct isc_logconfig		isc_logconfig_t;	/*%< Log Configuration */
+typedef struct isc_logmodule		isc_logmodule_t;	/*%< Log Module */
+typedef struct isc_mem			isc_mem_t;		/*%< Memory */
+typedef struct isc_mempool		isc_mempool_t;		/*%< Memory Pool */
+typedef struct isc_msgcat		isc_msgcat_t;		/*%< Message Catalog */
+typedef struct isc_ondestroy		isc_ondestroy_t;	/*%< On Destroy */
+typedef struct isc_netaddr		isc_netaddr_t;		/*%< Net Address */
+typedef struct isc_quota		isc_quota_t;		/*%< Quota */
+typedef struct isc_random		isc_random_t;		/*%< Random */
+typedef struct isc_ratelimiter		isc_ratelimiter_t;	/*%< Rate Limiter */
+typedef struct isc_region		isc_region_t;		/*%< Region */
+typedef isc_uint64_t			isc_resourcevalue_t;	/*%< Resource Value */
+typedef unsigned int			isc_result_t;		/*%< Result */
+typedef struct isc_rwlock		isc_rwlock_t;		/*%< Read Write Lock */
+typedef struct isc_sockaddr		isc_sockaddr_t;		/*%< Socket Address */
+typedef struct isc_socket		isc_socket_t;		/*%< Socket */
+typedef struct isc_socketevent		isc_socketevent_t;	/*%< Socket Event */
+typedef struct isc_socketmgr		isc_socketmgr_t;	/*%< Socket Manager */
+typedef struct isc_symtab		isc_symtab_t;		/*%< Symbol Table */
+typedef struct isc_task			isc_task_t;		/*%< Task */
+typedef ISC_LIST(isc_task_t)		isc_tasklist_t;		/*%< Task List */
+typedef struct isc_taskmgr		isc_taskmgr_t;		/*%< Task Manager */
+typedef struct isc_textregion		isc_textregion_t;	/*%< Text Region */
+typedef struct isc_time			isc_time_t;		/*%< Time */
+typedef struct isc_timer		isc_timer_t;		/*%< Timer */
+typedef struct isc_timermgr		isc_timermgr_t;		/*%< Timer Manager */
 
 typedef void (*isc_taskaction_t)(isc_task_t *, isc_event_t *);
 
+/*% Resource */
 typedef enum {
 	isc_resource_coresize = 1,
 	isc_resource_cputime,
diff --git a/contrib/bind9/lib/isc/include/isc/util.h b/contrib/bind9/lib/isc/include/isc/util.h
index c2798d6..95fe436 100644
--- a/contrib/bind9/lib/isc/include/isc/util.h
+++ b/contrib/bind9/lib/isc/include/isc/util.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,17 +15,18 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: util.h,v 1.21.12.5 2004/03/08 09:04:53 marka Exp $ */
+/* $Id: util.h,v 1.24.18.2 2005/04/29 00:17:04 marka Exp $ */
 
 #ifndef ISC_UTIL_H
 #define ISC_UTIL_H 1
 
-/*
+/*! \file util.h
  * NOTE:
  *
  * This file is not to be included from any <isc/???.h> (or other) library
  * files.
  *
+ * \brief
  * Including this file puts several macros in your name space that are
  * not protected (as all the other ISC functions/macros do) by prepending
  * ISC_ or isc_ to the name.
@@ -35,21 +36,22 @@
  *** General Macros.
  ***/
 
-/*
+/*%
  * Use this to hide unused function arguments.
- *
+ * \code
  * int
  * foo(char *bar)
  * {
  *	UNUSED(bar);
  * }
+ * \endcode
  */
 #define UNUSED(x)      (void)(x)
 
 #define ISC_MAX(a, b)  ((a) > (b) ? (a) : (b))
 #define ISC_MIN(a, b)  ((a) < (b) ? (a) : (b))
 
-/*
+/*%
  * Use this to remove the const qualifier of a variable to assign it to
  * a non-const variable or pass it as a non-const function argument ...
  * but only when you are sure it won't then be changed!
@@ -64,16 +66,15 @@
 		var = _u.v; \
 	} while (0)
 
-/*
+/*%
  * Use this in translation units that would otherwise be empty, to
  * suppress compiler warnings.
  */
 #define EMPTY_TRANSLATION_UNIT static void isc__empty(void) { isc__empty(); }
 
-/*
+/*%
  * We use macros instead of calling the routines directly because
  * the capital letters make the locking stand out.
- *
  * We RUNTIME_CHECK for success since in general there's no way
  * for us to continue if they fail.
  */
@@ -203,9 +204,13 @@
  */
 #include <isc/assertions.h>	/* Contractual promise. */
 
+/*% Require Assertion */
 #define REQUIRE(e)			ISC_REQUIRE(e)
+/*% Ensure Assertion */
 #define ENSURE(e)			ISC_ENSURE(e)
+/*% Insist Assertion */
 #define INSIST(e)			ISC_INSIST(e)
+/*% Invariant Assertion */
 #define INVARIANT(e)			ISC_INVARIANT(e)
 
 /*
@@ -213,11 +218,14 @@
  */
 #include <isc/error.h>		/* Contractual promise. */
 
+/*% Unexpected Error */
 #define UNEXPECTED_ERROR		isc_error_unexpected
+/*% Fatal Error */
 #define FATAL_ERROR			isc_error_fatal
+/*% Runtime Check */
 #define RUNTIME_CHECK(cond)		ISC_ERROR_RUNTIMECHECK(cond)
 
-/*
+/*%
  * Time
  */
 #define TIME_NOW(tp) 	RUNTIME_CHECK(isc_time_now((tp)) == ISC_R_SUCCESS)
diff --git a/contrib/bind9/lib/isc/include/isc/version.h b/contrib/bind9/lib/isc/include/isc/version.h
index 3da836c..82d4617 100644
--- a/contrib/bind9/lib/isc/include/isc/version.h
+++ b/contrib/bind9/lib/isc/include/isc/version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.h,v 1.2.220.3 2004/03/08 09:04:54 marka Exp $ */
+/* $Id: version.h,v 1.3.18.2 2005/04/29 00:17:04 marka Exp $ */
+
+/*! \file */
 
 #include <isc/platform.h>
 
diff --git a/contrib/bind9/lib/isc/inet_aton.c b/contrib/bind9/lib/isc/inet_aton.c
index 530b010..1602521 100644
--- a/contrib/bind9/lib/isc/inet_aton.c
+++ b/contrib/bind9/lib/isc/inet_aton.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1996-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -67,10 +67,11 @@
  * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
  * SOFTWARE.
  */
+/*! \file */
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static char sccsid[] = "@(#)inet_addr.c	8.1 (Berkeley) 6/17/93";
-static char rcsid[] = "$Id: inet_aton.c,v 1.15.12.3 2004/03/08 09:04:49 marka Exp $";
+static char rcsid[] = "$Id: inet_aton.c,v 1.17.18.2 2005/04/29 00:16:46 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -81,7 +82,7 @@ static char rcsid[] = "$Id: inet_aton.c,v 1.15.12.3 2004/03/08 09:04:49 marka Ex
 #include <isc/types.h>
 #include <isc/net.h>
 
-/*
+/*%
  * Check whether "cp" is a valid ascii representation
  * of an Internet address and convert to a binary address.
  * Returns 1 if the address is valid, 0 if not.
diff --git a/contrib/bind9/lib/isc/inet_ntop.c b/contrib/bind9/lib/isc/inet_ntop.c
index 6dadd73..c0d1161 100644
--- a/contrib/bind9/lib/isc/inet_ntop.c
+++ b/contrib/bind9/lib/isc/inet_ntop.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1996-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/*! \file */
+
 #if defined(LIBC_SCCS) && !defined(lint)
 static char rcsid[] =
-	"$Id: inet_ntop.c,v 1.12.12.4 2004/08/28 06:25:21 marka Exp $";
+	"$Id: inet_ntop.c,v 1.14.18.3 2005/04/29 00:16:46 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -45,12 +47,12 @@ static const char *inet_ntop6(const unsigned char *src, char *dst,
 			      size_t size);
 #endif
 
-/* char *
+/*! char *
  * isc_net_ntop(af, src, dst, size)
  *	convert a network format address to presentation format.
- * return:
+ * \return
  *	pointer to presentation format address (`dst'), or NULL (see errno).
- * author:
+ * \author 
  *	Paul Vixie, 1996.
  */
 const char *
@@ -70,15 +72,16 @@ isc_net_ntop(int af, const void *src, char *dst, size_t size)
 	/* NOTREACHED */
 }
 
-/* const char *
+/*! const char *
  * inet_ntop4(src, dst, size)
  *	format an IPv4 address
- * return:
+ * \return
  *	`dst' (as a const)
- * notes:
+ * \note
  *	(1) uses no statics
+ * \note
  *	(2) takes a unsigned char* not an in_addr as input
- * author:
+ * \author
  *	Paul Vixie, 1996.
  */
 static const char *
@@ -97,10 +100,10 @@ inet_ntop4(const unsigned char *src, char *dst, size_t size)
 	return (dst);
 }
 
-/* const char *
+/*! const char *
  * isc_inet_ntop6(src, dst, size)
  *	convert IPv6 binary address into presentation (printable) format
- * author:
+ * \author
  *	Paul Vixie, 1996.
  */
 #ifdef AF_INET6
diff --git a/contrib/bind9/lib/isc/inet_pton.c b/contrib/bind9/lib/isc/inet_pton.c
index 026fedf..a537e9c 100644
--- a/contrib/bind9/lib/isc/inet_pton.c
+++ b/contrib/bind9/lib/isc/inet_pton.c
@@ -15,9 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/*! \file */
+
 #if defined(LIBC_SCCS) && !defined(lint)
 static char rcsid[] =
-	"$Id: inet_pton.c,v 1.10.2.4.2.3 2005/03/31 23:56:14 marka Exp $";
+	"$Id: inet_pton.c,v 1.13.18.4 2005/04/29 00:16:46 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -27,8 +29,11 @@ static char rcsid[] =
 
 #include <isc/net.h>
 
+/*% INT16 Size */
 #define NS_INT16SZ	 2
+/*% IPv4 Address Size */
 #define NS_INADDRSZ	 4
+/*% IPv6 Address Size */
 #define NS_IN6ADDRSZ	16
 
 /*
@@ -39,15 +44,14 @@ static char rcsid[] =
 static int inet_pton4(const char *src, unsigned char *dst);
 static int inet_pton6(const char *src, unsigned char *dst);
 
-/* int
- * isc_net_pton(af, src, dst)
+/*% 
  *	convert from presentation format (which usually means ASCII printable)
  *	to network format (which is usually some kind of binary format).
- * return:
+ * \return
  *	1 if the address was valid for the specified address family
  *	0 if the address wasn't valid (`dst' is untouched in this case)
  *	-1 if some other error occurred (`dst' is untouched in this case, too)
- * author:
+ * \author
  *	Paul Vixie, 1996.
  */
 int
@@ -64,14 +68,14 @@ isc_net_pton(int af, const char *src, void *dst) {
 	/* NOTREACHED */
 }
 
-/* int
- * inet_pton4(src, dst)
+/*!\fn static int inet_pton4(const char *src, unsigned char *dst)
+ * \brief
  *	like inet_aton() but without all the hexadecimal and shorthand.
- * return:
+ * \return
  *	1 if `src' is a valid dotted quad, else 0.
- * notice:
+ * \note
  *	does not touch `dst' unless it's returning 1.
- * author:
+ * \author
  *	Paul Vixie, 1996.
  */
 static int
@@ -113,17 +117,17 @@ inet_pton4(const char *src, unsigned char *dst) {
 	return (1);
 }
 
-/* int
- * inet_pton6(src, dst)
+/*%
  *	convert presentation level address to network order binary form.
- * return:
+ * \return
  *	1 if `src' is a valid [RFC1884 2.2] address, else 0.
- * notice:
+ * \note
  *	(1) does not touch `dst' unless it's returning 1.
+ * \note
  *	(2) :: in a full address is silently ignored.
- * credit:
+ * \author
  *	inspired by Mark Andrews.
- * author:
+ * \author
  *	Paul Vixie, 1996.
  */
 static int
diff --git a/contrib/bind9/lib/isc/lex.c b/contrib/bind9/lib/isc/lex.c
index 3511d6b..2e4e48a 100644
--- a/contrib/bind9/lib/isc/lex.c
+++ b/contrib/bind9/lib/isc/lex.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lex.c,v 1.66.2.6.2.10 2006/01/04 23:50:21 marka Exp $ */
+/* $Id: lex.c,v 1.78.18.5 2005/11/30 03:44:39 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -563,7 +565,11 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			} else if (isdigit((unsigned char)c) &&
 				   (options & ISC_LEXOPT_NUMBER) != 0) {
 				lex->last_was_eol = ISC_FALSE;
-				state = lexstate_number;
+				if ((options & ISC_LEXOPT_OCTAL) != 0 &&
+				    (c == '8' || c == '9'))
+					state = lexstate_string;
+				else
+					state = lexstate_number;
 				goto no_read;
 			} else {
 				lex->last_was_eol = ISC_FALSE;
@@ -584,7 +590,9 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 				    c == '\n' || c == EOF ||
 				    lex->specials[c]) {
 					int base;
-					if ((options & ISC_LEXOPT_CNUMBER) != 0)
+					if ((options & ISC_LEXOPT_OCTAL) != 0)
+						base = 8;
+					else if ((options & ISC_LEXOPT_CNUMBER) != 0)
 						base = 0;
 					else
 						base = 10;
@@ -620,6 +628,9 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 					/* Above test supports hex numbers */
 					state = lexstate_string;
 				}
+			} else if ((options & ISC_LEXOPT_OCTAL) != 0 &&
+				   (c == '8' || c == '9')) {
+				state = lexstate_string;
 			}
 			if (remaining == 0U) {
 				result = grow_data(lex, &remaining,
@@ -821,6 +832,33 @@ isc_lex_getmastertoken(isc_lex_t *lex, isc_token_t *token,
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+isc_lex_getoctaltoken(isc_lex_t *lex, isc_token_t *token, isc_boolean_t eol)
+{
+	unsigned int options = ISC_LEXOPT_EOL | ISC_LEXOPT_EOF |
+			       ISC_LEXOPT_DNSMULTILINE | ISC_LEXOPT_ESCAPE|
+			       ISC_LEXOPT_NUMBER | ISC_LEXOPT_OCTAL;
+	isc_result_t result;
+
+	result = isc_lex_gettoken(lex, options, token);
+	if (result == ISC_R_RANGE)
+		isc_lex_ungettoken(lex, token);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	if (eol && ((token->type == isc_tokentype_eol) ||
+		    (token->type == isc_tokentype_eof)))
+		return (ISC_R_SUCCESS);
+	if (token->type != isc_tokentype_number) {
+		isc_lex_ungettoken(lex, token);
+		if (token->type == isc_tokentype_eol ||
+		    token->type == isc_tokentype_eof)
+			return (ISC_R_UNEXPECTEDEND);
+		return (ISC_R_BADNUMBER);
+	}
+	return (ISC_R_SUCCESS);
+}
+
 void
 isc_lex_ungettoken(isc_lex_t *lex, isc_token_t *tokenp) {
 	inputsource *source;
diff --git a/contrib/bind9/lib/isc/lfsr.c b/contrib/bind9/lib/isc/lfsr.c
index 6d5b7ff..61f9386 100644
--- a/contrib/bind9/lib/isc/lfsr.c
+++ b/contrib/bind9/lib/isc/lfsr.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lfsr.c,v 1.11.2.2.2.6 2005/10/14 01:38:50 marka Exp $ */
+/* $Id: lfsr.c,v 1.14.18.4 2005/10/14 01:28:29 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -50,7 +52,7 @@ isc_lfsr_init(isc_lfsr_t *lfsr, isc_uint32_t state, unsigned int bits,
 		lfsr->state = 0xffffffffU >> (32 - lfsr->bits);
 }
 
-/*
+/*!
  * Return the next state of the lfsr.
  */
 static inline isc_uint32_t
diff --git a/contrib/bind9/lib/isc/lib.c b/contrib/bind9/lib/isc/lib.c
index fa30abf..7a70c12 100644
--- a/contrib/bind9/lib/isc/lib.c
+++ b/contrib/bind9/lib/isc/lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lib.c,v 1.8.12.3 2004/03/08 09:04:49 marka Exp $ */
+/* $Id: lib.c,v 1.10.18.2 2005/04/29 00:16:47 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -53,7 +55,7 @@ void
 isc_lib_initmsgcat(void) {
 	isc_result_t result;
 
-	/*
+	/*!
 	 * Initialize the ISC library's message catalog, isc_msgcat, if it
 	 * has not already been initialized.
 	 */
diff --git a/contrib/bind9/lib/isc/log.c b/contrib/bind9/lib/isc/log.c
index 511573b..27c01d1 100644
--- a/contrib/bind9/lib/isc/log.c
+++ b/contrib/bind9/lib/isc/log.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.c,v 1.70.2.8.2.14 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: log.c,v 1.84.18.8 2006/03/02 00:37:22 marka Exp $ */
 
-/* Principal Authors: DCL */
+/*! \file
+ * \author  Principal Authors: DCL */
 
 #include <config.h>
 
@@ -56,7 +57,7 @@
 #define PATH_MAX 1024	/* AIX and others don't define this. */
 #endif
 
-/*
+/*!
  * This is the structure that holds each named channel.  A simple linked
  * list chains all of the channels together, so an individual channel is
  * found by doing strcmp()s with the names down the list.  Their should
@@ -76,7 +77,7 @@ struct isc_logchannel {
 	ISC_LINK(isc_logchannel_t)	link;
 };
 
-/*
+/*!
  * The logchannellist structure associates categories and modules with
  * channels.  First the appropriate channellist is found based on the
  * category, and then each structure in the linked list is checked for
@@ -92,7 +93,7 @@ struct isc_logchannellist {
 	ISC_LINK(isc_logchannellist_t)	link;
 };
 
-/*
+/*!
  * This structure is used to remember messages for pruning via
  * isc_log_[v]write1().
  */
@@ -104,7 +105,7 @@ struct isc_logmessage {
 	ISC_LINK(isc_logmessage_t)	link;
 };
 
-/*
+/*!
  * The isc_logconfig structure is used to store the configurable information
  * about where messages are actually supposed to be sent -- the information
  * that could changed based on some configuration file, as opposed to the
@@ -123,7 +124,7 @@ struct isc_logconfig {
 	isc_boolean_t			dynamic;
 };
 
-/*
+/*!
  * This isc_log structure provides the context for the isc_log functions.
  * The log context locks itself in isc_log_doit, the internal backend to
  * isc_log_write.  The locking is necessary both to provide exclusive access
@@ -156,7 +157,7 @@ struct isc_log {
 	ISC_LIST(isc_logmessage_t)	messages;
 };
 
-/*
+/*!
  * Used when ISC_LOG_PRINTLEVEL is enabled for a channel.
  */
 static const char *log_level_strings[] = {
@@ -168,7 +169,7 @@ static const char *log_level_strings[] = {
 	"critical"
 };
 
-/*
+/*!
  * Used to convert ISC_LOG_* priorities into syslog priorities.
  * XXXDCL This will need modification for NT.
  */
@@ -181,7 +182,7 @@ static const int syslog_map[] = {
 	LOG_CRIT
 };
 
-/*
+/*!
  * When adding new categories, a corresponding ISC_LOGCATEGORY_foo
  * definition needs to be added to <isc/log.h>.
  *
@@ -195,8 +196,8 @@ LIBISC_EXTERNAL_DATA isc_logcategory_t isc_categories[] = {
 	{ NULL, 0 }
 };
 
-/*
- * See above comment for categories, and apply it to modules.
+/*!
+ * See above comment for categories on LIBISC_EXTERNAL_DATA, and apply it to modules.
  */
 LIBISC_EXTERNAL_DATA isc_logmodule_t isc_modules[] = {
 	{ "socket", 0 },
@@ -206,19 +207,19 @@ LIBISC_EXTERNAL_DATA isc_logmodule_t isc_modules[] = {
 	{ NULL, 0 }
 };
 
-/*
+/*!
  * This essentially constant structure must be filled in at run time,
  * because its channel member is pointed to a channel that is created
  * dynamically with isc_log_createchannel.
  */
 static isc_logchannellist_t default_channel;
 
-/*
+/*!
  * libisc logs to this context.
  */
 LIBISC_EXTERNAL_DATA isc_log_t *isc_lctx = NULL;
 
-/*
+/*!
  * Forward declarations.
  */
 static isc_result_t
@@ -241,7 +242,8 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 	     const char *format, va_list args)
      ISC_FORMAT_PRINTF(9, 0);
 
-/*
+/*@{*/
+/*!
  * Convenience macros.
  */
 
@@ -252,6 +254,7 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 #define FILE_MAXSIZE(channel)	 (channel->destination.file.maximum_size)
 #define FILE_MAXREACHED(channel) (channel->destination.file.maximum_reached)
 
+/*@}*/
 /****
  **** Public interfaces.
  ****/
@@ -280,7 +283,11 @@ isc_log_create(isc_mem_t *mctx, isc_log_t **lctxp, isc_logconfig_t **lcfgp) {
 
 		ISC_LIST_INIT(lctx->messages);
 
-		RUNTIME_CHECK(isc_mutex_init(&lctx->lock) == ISC_R_SUCCESS);
+		result = isc_mutex_init(&lctx->lock);
+		if (result != ISC_R_SUCCESS) {
+			isc_mem_put(mctx, lctx, sizeof(*lctx));
+			return (result);
+		}
 
 		/*
 		 * Normally setting the magic number is the last step done
diff --git a/contrib/bind9/lib/isc/md5.c b/contrib/bind9/lib/isc/md5.c
index 863612b..07d7546 100644
--- a/contrib/bind9/lib/isc/md5.c
+++ b/contrib/bind9/lib/isc/md5.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: md5.c,v 1.9.206.1 2004/03/06 08:14:32 marka Exp $ */
+/* $Id: md5.c,v 1.10.18.2 2005/04/29 00:16:47 marka Exp $ */
 
-/*
+/*! \file
  * This code implements the MD5 message-digest algorithm.
  * The algorithm is due to Ron Rivest.  This code was
  * written by Colin Plumb in 1993, no copyright is claimed.
@@ -54,7 +54,7 @@ byteSwap(isc_uint32_t *buf, unsigned words)
 	} while (--words);
 }
 
-/*
+/*!
  * Start MD5 accumulation.  Set bit count to 0 and buffer to mysterious
  * initialization constants.
  */
@@ -74,19 +74,21 @@ isc_md5_invalidate(isc_md5_t *ctx) {
 	memset(ctx, 0, sizeof(isc_md5_t));
 }
 
-/* The four core functions - F1 is optimized somewhat */
+/*@{*/
+/*! The four core functions - F1 is optimized somewhat */
 
 /* #define F1(x, y, z) (x & y | ~x & z) */
 #define F1(x, y, z) (z ^ (x & (y ^ z)))
 #define F2(x, y, z) F1(z, x, y)
 #define F3(x, y, z) (x ^ y ^ z)
 #define F4(x, y, z) (y ^ (x | ~z))
+/*@}*/
 
-/* This is the central step in the MD5 algorithm. */
+/*! This is the central step in the MD5 algorithm. */
 #define MD5STEP(f,w,x,y,z,in,s) \
 	 (w += f(x,y,z) + in, w = (w<<s | w>>(32-s)) + x)
 
-/*
+/*!
  * The core of the MD5 algorithm, this alters an existing MD5 hash to
  * reflect the addition of 16 longwords of new data.  MD5Update blocks
  * the data and converts bytes into longwords for this routine.
@@ -174,7 +176,7 @@ transform(isc_uint32_t buf[4], isc_uint32_t const in[16]) {
 	buf[3] += d;
 }
 
-/*
+/*!
  * Update context to reflect the concatenation of another buffer full
  * of bytes.
  */
@@ -213,7 +215,7 @@ isc_md5_update(isc_md5_t *ctx, const unsigned char *buf, unsigned int len) {
 	memcpy(ctx->in, buf, len);
 }
 
-/*
+/*!
  * Final wrapup - pad to 64-byte boundary with the bit pattern
  * 1 0* (64-bit count of bits processed, MSB-first)
  */
diff --git a/contrib/bind9/lib/isc/mem.c b/contrib/bind9/lib/isc/mem.c
index f5069fb..35918dc 100644
--- a/contrib/bind9/lib/isc/mem.c
+++ b/contrib/bind9/lib/isc/mem.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.c,v 1.98.2.7.2.7 2005/03/17 03:58:32 marka Exp $ */
+/* $Id: mem.c,v 1.116.18.12 2006/12/08 05:07:59 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -28,35 +30,29 @@
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/msgs.h>
+#include <isc/once.h>
 #include <isc/ondestroy.h>
 #include <isc/string.h>
 
 #include <isc/mutex.h>
 #include <isc/util.h>
 
+#define MCTXLOCK(m, l) if (((m)->flags & ISC_MEMFLAG_NOLOCK) == 0) LOCK(l)
+#define MCTXUNLOCK(m, l) if (((m)->flags & ISC_MEMFLAG_NOLOCK) == 0) UNLOCK(l)
+
 #ifndef ISC_MEM_DEBUGGING
 #define ISC_MEM_DEBUGGING 0
 #endif
 LIBISC_EXTERNAL_DATA unsigned int isc_mem_debugging = ISC_MEM_DEBUGGING;
 
 /*
- * Define ISC_MEM_USE_INTERNAL_MALLOC=1 to use the internal malloc()
- * implementation in preference to the system one.  The internal malloc()
- * is very space-efficient, and quite fast on uniprocessor systems.  It
- * performs poorly on multiprocessor machines.
- */
-#ifndef ISC_MEM_USE_INTERNAL_MALLOC
-#define ISC_MEM_USE_INTERNAL_MALLOC 0
-#endif
-
-/*
  * Constants.
  */
 
 #define DEF_MAX_SIZE		1100
 #define DEF_MEM_TARGET		4096
-#define ALIGNMENT_SIZE		8		/* must be a power of 2 */
-#define NUM_BASIC_BLOCKS	64		/* must be > 1 */
+#define ALIGNMENT_SIZE		8		/*%< must be a power of 2 */
+#define NUM_BASIC_BLOCKS	64		/*%< must be > 1 */
 #define TABLE_INCREMENT		1024
 #define DEBUGLIST_COUNT		1024
 
@@ -87,11 +83,12 @@ struct element {
 };
 
 typedef struct {
-	/*
+	/*!
 	 * This structure must be ALIGNMENT_SIZE bytes.
 	 */
 	union {
 		size_t		size;
+		isc_mem_t	*ctx;
 		char		bytes[ALIGNMENT_SIZE];
 	} u;
 } size_info;
@@ -99,10 +96,8 @@ typedef struct {
 struct stats {
 	unsigned long		gets;
 	unsigned long		totalgets;
-#if ISC_MEM_USE_INTERNAL_MALLOC
 	unsigned long		blocks;
 	unsigned long		freefrags;
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
 };
 
 #define MEM_MAGIC		ISC_MAGIC('M', 'e', 'm', 'C')
@@ -112,9 +107,16 @@ struct stats {
 typedef ISC_LIST(debuglink_t)	debuglist_t;
 #endif
 
+/* List of all active memory contexts. */
+
+static ISC_LIST(isc_mem_t)	contexts;
+static isc_once_t		once = ISC_ONCE_INIT;
+static isc_mutex_t		lock;
+
 struct isc_mem {
 	unsigned int		magic;
 	isc_ondestroy_t		ondestroy;
+	unsigned int		flags;
 	isc_mutex_t		lock;
 	isc_memalloc_t		memalloc;
 	isc_memfree_t		memfree;
@@ -134,7 +136,7 @@ struct isc_mem {
 	void *			water_arg;
 	ISC_LIST(isc_mempool_t)	pools;
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
+	/*  ISC_MEMFLAG_INTERNAL */
 	size_t			mem_target;
 	element **		freelists;
 	element *		basic_blocks;
@@ -143,13 +145,13 @@ struct isc_mem {
 	unsigned int		basic_table_size;
 	unsigned char *		lowest;
 	unsigned char *		highest;
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
 
 #if ISC_MEM_TRACKLINES
 	debuglist_t *	 	debuglist;
 #endif
 
 	unsigned int		memalloc_failures;
+	ISC_LINK(isc_mem_t)	link;
 };
 
 #define MEMPOOL_MAGIC		ISC_MAGIC('M', 'E', 'M', 'p')
@@ -157,24 +159,24 @@ struct isc_mem {
 
 struct isc_mempool {
 	/* always unlocked */
-	unsigned int	magic;		/* magic number */
-	isc_mutex_t    *lock;		/* optional lock */
-	isc_mem_t      *mctx;		/* our memory context */
-	/* locked via the memory context's lock */
-	ISC_LINK(isc_mempool_t)	link;	/* next pool in this mem context */
-	/* optionally locked from here down */
-	element	       *items;		/* low water item list */
-	size_t		size;		/* size of each item on this pool */
-	unsigned int	maxalloc;	/* max number of items allowed */
-	unsigned int	allocated;	/* # of items currently given out */
-	unsigned int	freecount;	/* # of items on reserved list */
-	unsigned int	freemax;	/* # of items allowed on free list */
-	unsigned int	fillcount;	/* # of items to fetch on each fill */
-	/* Stats only. */
-	unsigned int	gets;		/* # of requests to this pool */
-	/* Debugging only. */
+	unsigned int	magic;		/*%< magic number */
+	isc_mutex_t    *lock;		/*%< optional lock */
+	isc_mem_t      *mctx;		/*%< our memory context */
+	/*%< locked via the memory context's lock */
+	ISC_LINK(isc_mempool_t)	link;	/*%< next pool in this mem context */
+	/*%< optionally locked from here down */
+	element	       *items;		/*%< low water item list */
+	size_t		size;		/*%< size of each item on this pool */
+	unsigned int	maxalloc;	/*%< max number of items allowed */
+	unsigned int	allocated;	/*%< # of items currently given out */
+	unsigned int	freecount;	/*%< # of items on reserved list */
+	unsigned int	freemax;	/*%< # of items allowed on free list */
+	unsigned int	fillcount;	/*%< # of items to fetch on each fill */
+	/*%< Stats only. */
+	unsigned int	gets;		/*%< # of requests to this pool */
+	/*%< Debugging only. */
 #if ISC_MEMPOOL_NAMES
-	char		name[16];	/* printed name in stats reports */
+	char		name[16];	/*%< printed name in stats reports */
 #endif
 };
 
@@ -198,7 +200,7 @@ struct isc_mempool {
 static void
 print_active(isc_mem_t *ctx, FILE *out);
 
-/*
+/*!
  * mctx must be locked.
  */
 static inline void
@@ -309,7 +311,6 @@ delete_trace_entry(isc_mem_t *mctx, const void *ptr, unsigned int size,
 }
 #endif /* ISC_MEM_TRACKLINES */
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
 static inline size_t
 rmsize(size_t size) {
 	/*
@@ -320,13 +321,13 @@ rmsize(size_t size) {
 
 static inline size_t
 quantize(size_t size) {
-	/*
+	/*!
 	 * Round up the result in order to get a size big
 	 * enough to satisfy the request and be aligned on ALIGNMENT_SIZE
 	 * byte boundaries.
 	 */
 
-	if (size == 0)
+	if (size == 0U)
 		return (ALIGNMENT_SIZE);
 	return ((size + ALIGNMENT_SIZE - 1) & (~(ALIGNMENT_SIZE - 1)));
 }
@@ -347,7 +348,7 @@ more_basic_blocks(isc_mem_t *ctx) {
 	 * Did we hit the quota for this context?
 	 */
 	increment = NUM_BASIC_BLOCKS * ctx->mem_target;
-	if (ctx->quota != 0 && ctx->total + increment > ctx->quota)
+	if (ctx->quota != 0U && ctx->total + increment > ctx->quota)
 		return (ISC_FALSE);
 
 	INSIST(ctx->basic_table_count <= ctx->basic_table_size);
@@ -408,7 +409,7 @@ more_frags(isc_mem_t *ctx, size_t new_size) {
 	void *new;
 	unsigned char *curr, *next;
 
-	/*
+	/*!
 	 * Try to get more fragments by chopping up a basic block.
 	 */
 
@@ -448,7 +449,7 @@ more_frags(isc_mem_t *ctx, size_t new_size) {
 	 * Add the remaining fragment of the basic block to a free list.
 	 */
 	total_size = rmsize(total_size);
-	if (total_size > 0) {
+	if (total_size > 0U) {
 		((element *)next)->next = ctx->freelists[total_size];
 		ctx->freelists[total_size] = (element *)next;
 		ctx->stats[total_size].freefrags++;
@@ -472,7 +473,7 @@ mem_getunlocked(isc_mem_t *ctx, size_t size) {
 		/*
 		 * memget() was called on something beyond our upper limit.
 		 */
-		if (ctx->quota != 0 && ctx->total + size > ctx->quota) {
+		if (ctx->quota != 0U && ctx->total + size > ctx->quota) {
 			ret = NULL;
 			goto done;
 		}
@@ -556,7 +557,7 @@ mem_putunlocked(isc_mem_t *ctx, void *mem, size_t size) {
 		memset(mem, 0xde, size); /* Mnemonic for "dead". */
 #endif
 		(ctx->memfree)(ctx->arg, mem);
-		INSIST(ctx->stats[ctx->max_size].gets != 0);
+		INSIST(ctx->stats[ctx->max_size].gets != 0U);
 		ctx->stats[ctx->max_size].gets--;
 		INSIST(size <= ctx->total);
 		ctx->inuse -= size;
@@ -583,15 +584,13 @@ mem_putunlocked(isc_mem_t *ctx, void *mem, size_t size) {
 	 * max. size (max_size) ends up getting recorded as a call to
 	 * max_size.
 	 */
-	INSIST(ctx->stats[size].gets != 0);
+	INSIST(ctx->stats[size].gets != 0U);
 	ctx->stats[size].gets--;
 	ctx->stats[new_size].freefrags++;
 	ctx->inuse -= new_size;
 }
 
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-
-/*
+/*!
  * Perform a malloc, doing memory filling and overrun detection as necessary.
  */
 static inline void *
@@ -619,7 +618,7 @@ mem_get(isc_mem_t *ctx, size_t size) {
 	return (ret);
 }
 
-/*
+/*!
  * Perform a free, doing memory filling and overrun detection as necessary.
  */
 static inline void
@@ -635,7 +634,7 @@ mem_put(isc_mem_t *ctx, void *mem, size_t size) {
 	(ctx->memfree)(ctx->arg, mem);
 }
 
-/*
+/*!
  * Update internal counters after a memory get.
  */
 static inline void
@@ -652,7 +651,7 @@ mem_getstats(isc_mem_t *ctx, size_t size) {
 	}
 }
 
-/*
+/*!
  * Update internal counters after a memory put.
  */
 static inline void
@@ -671,8 +670,6 @@ mem_putstats(isc_mem_t *ctx, void *ptr, size_t size) {
 	}
 }
 
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
-
 /*
  * Private.
  */
@@ -691,6 +688,11 @@ default_memfree(void *arg, void *ptr) {
 	free(ptr);
 }
 
+static void
+initialize_action(void) {
+        RUNTIME_CHECK(isc_mutex_init(&lock) == ISC_R_SUCCESS);
+}
+
 /*
  * Public.
  */
@@ -700,6 +702,16 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 		isc_memalloc_t memalloc, isc_memfree_t memfree, void *arg,
 		isc_mem_t **ctxp)
 {
+	return (isc_mem_createx2(init_max_size, target_size, memalloc, memfree,
+				 arg, ctxp, ISC_MEMFLAG_DEFAULT));
+				 
+}
+
+isc_result_t
+isc_mem_createx2(size_t init_max_size, size_t target_size,
+		 isc_memalloc_t memalloc, isc_memfree_t memfree, void *arg,
+		 isc_mem_t **ctxp, unsigned int flags)
+{
 	isc_mem_t *ctx;
 	isc_result_t result;
 
@@ -709,27 +721,25 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 
 	INSIST((ALIGNMENT_SIZE & (ALIGNMENT_SIZE - 1)) == 0);
 
-#if !ISC_MEM_USE_INTERNAL_MALLOC
-	UNUSED(target_size);
-#endif
+	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
 
 	ctx = (memalloc)(arg, sizeof(*ctx));
 	if (ctx == NULL)
 		return (ISC_R_NOMEMORY);
 
-	if (isc_mutex_init(&ctx->lock) != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		(memfree)(arg, ctx);
-		return (ISC_R_UNEXPECTED);
+	if ((flags & ISC_MEMFLAG_NOLOCK) == 0) {
+		result = isc_mutex_init(&ctx->lock);
+		if (result != ISC_R_SUCCESS) {
+			(memfree)(arg, ctx);
+			return (result);
+		}
 	}
 
 	if (init_max_size == 0U)
 		ctx->max_size = DEF_MAX_SIZE;
 	else
 		ctx->max_size = init_max_size;
+	ctx->flags = flags;
 	ctx->references = 1;
 	ctx->quota = 0;
 	ctx->total = 0;
@@ -751,10 +761,13 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 	ctx->debuglist = NULL;
 #endif
 	ISC_LIST_INIT(ctx->pools);
-
-#if ISC_MEM_USE_INTERNAL_MALLOC
 	ctx->freelists = NULL;
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	ctx->basic_blocks = NULL;
+	ctx->basic_table = NULL;
+	ctx->basic_table_count = 0;
+	ctx->basic_table_size = 0;
+	ctx->lowest = NULL;
+	ctx->highest = NULL;
 
 	ctx->stats = (memalloc)(arg,
 				(ctx->max_size+1) * sizeof(struct stats));
@@ -764,25 +777,20 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 	}
 	memset(ctx->stats, 0, (ctx->max_size + 1) * sizeof(struct stats));
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	if (target_size == 0)
-		ctx->mem_target = DEF_MEM_TARGET;
-	else
-		ctx->mem_target = target_size;
-	ctx->freelists = (memalloc)(arg, ctx->max_size * sizeof(element *));
-	if (ctx->freelists == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto error;
+	if ((flags & ISC_MEMFLAG_INTERNAL) != 0) {
+		if (target_size == 0U)
+			ctx->mem_target = DEF_MEM_TARGET;
+		else
+			ctx->mem_target = target_size;
+		ctx->freelists = (memalloc)(arg, ctx->max_size *
+						 sizeof(element *));
+		if (ctx->freelists == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto error;
+		}
+		memset(ctx->freelists, 0,
+		       ctx->max_size * sizeof(element *));
 	}
-	memset(ctx->freelists, 0,
-	       ctx->max_size * sizeof(element *));
-	ctx->basic_blocks = NULL;
-	ctx->basic_table = NULL;
-	ctx->basic_table_count = 0;
-	ctx->basic_table_size = 0;
-	ctx->lowest = NULL;
-	ctx->highest = NULL;
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
 
 #if ISC_MEM_TRACKLINES
 	if ((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0) {
@@ -801,6 +809,10 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 
 	ctx->memalloc_failures = 0;
 
+	LOCK(&lock);
+	ISC_LIST_INITANDAPPEND(contexts, ctx, link);
+	UNLOCK(&lock);
+
 	*ctxp = ctx;
 	return (ISC_R_SUCCESS);
 
@@ -808,15 +820,14 @@ isc_mem_createx(size_t init_max_size, size_t target_size,
 	if (ctx != NULL) {
 		if (ctx->stats != NULL)
 			(memfree)(arg, ctx->stats);
-#if ISC_MEM_USE_INTERNAL_MALLOC
 		if (ctx->freelists != NULL)
 			(memfree)(arg, ctx->freelists);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
 #if ISC_MEM_TRACKLINES
 		if (ctx->debuglist != NULL)
 			(ctx->memfree)(ctx->arg, ctx->debuglist);
 #endif /* ISC_MEM_TRACKLINES */
-		DESTROYLOCK(&ctx->lock);
+		if ((ctx->flags & ISC_MEMFLAG_NOLOCK) == 0)
+			DESTROYLOCK(&ctx->lock);
 		(memfree)(arg, ctx);
 	}
 
@@ -827,9 +838,18 @@ isc_result_t
 isc_mem_create(size_t init_max_size, size_t target_size,
 	       isc_mem_t **ctxp)
 {
-	return (isc_mem_createx(init_max_size, target_size,
-				default_memalloc, default_memfree, NULL,
-				ctxp));
+	return (isc_mem_createx2(init_max_size, target_size,
+				 default_memalloc, default_memfree, NULL,
+				 ctxp, ISC_MEMFLAG_DEFAULT));
+}
+
+isc_result_t
+isc_mem_create2(size_t init_max_size, size_t target_size,
+		isc_mem_t **ctxp, unsigned int flags)
+{
+	return (isc_mem_createx2(init_max_size, target_size,
+				 default_memalloc, default_memfree, NULL,
+				 ctxp, flags));
 }
 
 static void
@@ -839,9 +859,11 @@ destroy(isc_mem_t *ctx) {
 
 	ctx->magic = 0;
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
+	LOCK(&lock);
+	ISC_LIST_UNLINK(contexts, ctx, link);
+	UNLOCK(&lock);
+
 	INSIST(ISC_LIST_EMPTY(ctx->pools));
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
 
 #if ISC_MEM_TRACKLINES
 	if (ctx->debuglist != NULL) {
@@ -880,16 +902,17 @@ destroy(isc_mem_t *ctx) {
 
 	(ctx->memfree)(ctx->arg, ctx->stats);
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	for (i = 0; i < ctx->basic_table_count; i++)
-		(ctx->memfree)(ctx->arg, ctx->basic_table[i]);
-	(ctx->memfree)(ctx->arg, ctx->freelists);
-	(ctx->memfree)(ctx->arg, ctx->basic_table);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+		for (i = 0; i < ctx->basic_table_count; i++)
+			(ctx->memfree)(ctx->arg, ctx->basic_table[i]);
+		(ctx->memfree)(ctx->arg, ctx->freelists);
+		(ctx->memfree)(ctx->arg, ctx->basic_table);
+	}
 
 	ondest = ctx->ondestroy;
 
-	DESTROYLOCK(&ctx->lock);
+	if ((ctx->flags & ISC_MEMFLAG_NOLOCK) == 0)
+		DESTROYLOCK(&ctx->lock);
 	(ctx->memfree)(ctx->arg, ctx);
 
 	isc_ondestroy_notify(&ondest, ctx);
@@ -900,9 +923,9 @@ isc_mem_attach(isc_mem_t *source, isc_mem_t **targetp) {
 	REQUIRE(VALID_CONTEXT(source));
 	REQUIRE(targetp != NULL && *targetp == NULL);
 
-	LOCK(&source->lock);
+	MCTXLOCK(source, &source->lock);
 	source->references++;
-	UNLOCK(&source->lock);
+	MCTXUNLOCK(source, &source->lock);
 
 	*targetp = source;
 }
@@ -916,12 +939,12 @@ isc_mem_detach(isc_mem_t **ctxp) {
 	ctx = *ctxp;
 	REQUIRE(VALID_CONTEXT(ctx));
 
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 	INSIST(ctx->references > 0);
 	ctx->references--;
 	if (ctx->references == 0)
 		want_destroy = ISC_TRUE;
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	if (want_destroy)
 		destroy(ctx);
@@ -943,6 +966,8 @@ void
 isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size FLARG) {
 	isc_mem_t *ctx;
 	isc_boolean_t want_destroy = ISC_FALSE;
+	size_info *si;
+	size_t oldsize;
 
 	REQUIRE(ctxp != NULL);
 	ctx = *ctxp;
@@ -955,14 +980,35 @@ isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size FLARG) {
 	 */
 	*ctxp = NULL;
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	LOCK(&ctx->lock);
-	mem_putunlocked(ctx, ptr, size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-	mem_put(ctx, ptr, size);
-	LOCK(&ctx->lock);
-	mem_putstats(ctx, ptr, size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	if ((isc_mem_debugging & (ISC_MEM_DEBUGSIZE|ISC_MEM_DEBUGCTX)) != 0) {
+		if ((isc_mem_debugging & ISC_MEM_DEBUGSIZE) != 0) {
+			si = &(((size_info *)ptr)[-1]);
+			oldsize = si->u.size - ALIGNMENT_SIZE;
+			if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0)
+				oldsize -= ALIGNMENT_SIZE;
+			INSIST(oldsize == size);
+		}
+		isc__mem_free(ctx, ptr FLARG_PASS);
+
+		MCTXLOCK(ctx, &ctx->lock);
+		ctx->references--;
+		if (ctx->references == 0)
+			want_destroy = ISC_TRUE;
+		MCTXUNLOCK(ctx, &ctx->lock);
+		if (want_destroy)
+			destroy(ctx);
+
+		return;
+	}
+
+	if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+		MCTXLOCK(ctx, &ctx->lock);
+		mem_putunlocked(ctx, ptr, size);
+	} else {
+		mem_put(ctx, ptr, size);
+		MCTXLOCK(ctx, &ctx->lock);
+		mem_putstats(ctx, ptr, size);
+	}
 
 	DELETE_TRACE(ctx, ptr, size, file, line);
 	INSIST(ctx->references > 0);
@@ -970,7 +1016,7 @@ isc__mem_putanddetach(isc_mem_t **ctxp, void *ptr, size_t size FLARG) {
 	if (ctx->references == 0)
 		want_destroy = ISC_TRUE;
 
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	if (want_destroy)
 		destroy(ctx);
@@ -989,14 +1035,14 @@ isc_mem_destroy(isc_mem_t **ctxp) {
 	ctx = *ctxp;
 	REQUIRE(VALID_CONTEXT(ctx));
 
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 #if ISC_MEM_TRACKLINES
 	if (ctx->references != 1)
 		print_active(ctx, stderr);
 #endif
 	REQUIRE(ctx->references == 1);
 	ctx->references--;
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	destroy(ctx);
 
@@ -1007,9 +1053,9 @@ isc_result_t
 isc_mem_ondestroy(isc_mem_t *ctx, isc_task_t *task, isc_event_t **event) {
 	isc_result_t res;
 
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 	res = isc_ondestroy_register(&ctx->ondestroy, task, event);
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	return (res);
 }
@@ -1022,15 +1068,18 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) {
 
 	REQUIRE(VALID_CONTEXT(ctx));
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	LOCK(&ctx->lock);
-	ptr = mem_getunlocked(ctx, size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-	ptr = mem_get(ctx, size);
-	LOCK(&ctx->lock);
-	if (ptr != NULL)
-		mem_getstats(ctx, size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	if ((isc_mem_debugging & (ISC_MEM_DEBUGSIZE|ISC_MEM_DEBUGCTX)) != 0)
+		return (isc__mem_allocate(ctx, size FLARG_PASS));
+
+	if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+		MCTXLOCK(ctx, &ctx->lock);
+		ptr = mem_getunlocked(ctx, size);
+	} else {
+		ptr = mem_get(ctx, size);
+		MCTXLOCK(ctx, &ctx->lock);
+		if (ptr != NULL)
+			mem_getstats(ctx, size);
+	}
 
 	ADD_TRACE(ctx, ptr, size, file, line);
 	if (ctx->hi_water != 0U && !ctx->hi_called &&
@@ -1045,7 +1094,7 @@ isc__mem_get(isc_mem_t *ctx, size_t size FLARG) {
 			fprintf(stderr, "maxinuse = %lu\n",
 				(unsigned long)ctx->inuse);
 	}
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	if (call_water)
 		(ctx->water)(ctx->water_arg, ISC_MEM_HIWATER);
@@ -1057,18 +1106,32 @@ void
 isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG)
 {
 	isc_boolean_t call_water = ISC_FALSE;
+	size_info *si;
+	size_t oldsize;
 
 	REQUIRE(VALID_CONTEXT(ctx));
 	REQUIRE(ptr != NULL);
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	LOCK(&ctx->lock);
-	mem_putunlocked(ctx, ptr, size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-	mem_put(ctx, ptr, size);
-	LOCK(&ctx->lock);
-	mem_putstats(ctx, ptr, size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	if ((isc_mem_debugging & (ISC_MEM_DEBUGSIZE|ISC_MEM_DEBUGCTX)) != 0) {
+		if ((isc_mem_debugging & ISC_MEM_DEBUGSIZE) != 0) {
+			si = &(((size_info *)ptr)[-1]);
+			oldsize = si->u.size - ALIGNMENT_SIZE;
+			if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0)
+				oldsize -= ALIGNMENT_SIZE;
+			INSIST(oldsize == size);
+		}
+		isc__mem_free(ctx, ptr FLARG_PASS);
+		return;
+	}
+
+	if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+		MCTXLOCK(ctx, &ctx->lock);
+		mem_putunlocked(ctx, ptr, size);
+	} else {
+		mem_put(ctx, ptr, size);
+		MCTXLOCK(ctx, &ctx->lock);
+		mem_putstats(ctx, ptr, size);
+	}
 
 	DELETE_TRACE(ctx, ptr, size, file, line);
 
@@ -1084,7 +1147,7 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size FLARG)
 		if (ctx->water != NULL)
 			call_water = ISC_TRUE;
 	}
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	if (call_water)
 		(ctx->water)(ctx->water_arg, ISC_MEM_LOWATER);
@@ -1141,7 +1204,7 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) {
 	const isc_mempool_t *pool;
 
 	REQUIRE(VALID_CONTEXT(ctx));
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 
 	for (i = 0; i <= ctx->max_size; i++) {
 		s = &ctx->stats[i];
@@ -1151,11 +1214,10 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) {
 		fprintf(out, "%s%5lu: %11lu gets, %11lu rem",
 			(i == ctx->max_size) ? ">=" : "  ",
 			(unsigned long) i, s->totalgets, s->gets);
-#if ISC_MEM_USE_INTERNAL_MALLOC
-		if (s->blocks != 0 || s->freefrags != 0)
+		if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0 &&
+		    (s->blocks != 0U || s->freefrags != 0U))
 			fprintf(out, " (%lu bl, %lu ff)",
 				s->blocks, s->freefrags);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
 		fputc('\n', out);
 	}
 
@@ -1203,7 +1265,7 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) {
 	print_active(ctx, out);
 #endif
 
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 }
 
 /*
@@ -1216,13 +1278,20 @@ isc__mem_allocateunlocked(isc_mem_t *ctx, size_t size) {
 	size_info *si;
 
 	size += ALIGNMENT_SIZE;
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	si = mem_getunlocked(ctx, size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-	si = mem_get(ctx, size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0)
+		size += ALIGNMENT_SIZE;
+
+	if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0)
+		si = mem_getunlocked(ctx, size);
+	else
+		si = mem_get(ctx, size);
+
 	if (si == NULL)
 		return (NULL);
+	if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0) {
+		si->u.ctx = ctx;
+		si++;
+	}
 	si->u.size = size;
 	return (&si[1]);
 }
@@ -1230,24 +1299,39 @@ isc__mem_allocateunlocked(isc_mem_t *ctx, size_t size) {
 void *
 isc__mem_allocate(isc_mem_t *ctx, size_t size FLARG) {
 	size_info *si;
+	isc_boolean_t call_water = ISC_FALSE;
 
 	REQUIRE(VALID_CONTEXT(ctx));
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	LOCK(&ctx->lock);
-	si = isc__mem_allocateunlocked(ctx, size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-	si = isc__mem_allocateunlocked(ctx, size);
-	LOCK(&ctx->lock);
-	if (si != NULL)
-		mem_getstats(ctx, si[-1].u.size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+		MCTXLOCK(ctx, &ctx->lock);
+		si = isc__mem_allocateunlocked(ctx, size);
+	} else {
+		si = isc__mem_allocateunlocked(ctx, size);
+		MCTXLOCK(ctx, &ctx->lock);
+		if (si != NULL)
+			mem_getstats(ctx, si[-1].u.size);
+	}
 
 #if ISC_MEM_TRACKLINES
 	ADD_TRACE(ctx, si, si[-1].u.size, file, line);
 #endif
+	if (ctx->hi_water != 0U && !ctx->hi_called &&
+	    ctx->inuse > ctx->hi_water) {
+		ctx->hi_called = ISC_TRUE;
+		call_water = ISC_TRUE;
+	}
+	if (ctx->inuse > ctx->maxinuse) {
+		ctx->maxinuse = ctx->inuse;
+		if (ctx->hi_water != 0U && ctx->inuse > ctx->hi_water &&
+		    (isc_mem_debugging & ISC_MEM_DEBUGUSAGE) != 0)
+			fprintf(stderr, "maxinuse = %lu\n",
+				(unsigned long)ctx->inuse);
+	}
+	MCTXUNLOCK(ctx, &ctx->lock);
 
-	UNLOCK(&ctx->lock);
+	if (call_water)
+		(ctx->water)(ctx->water_arg, ISC_MEM_HIWATER);
 
 	return (si);
 }
@@ -1256,25 +1340,47 @@ void
 isc__mem_free(isc_mem_t *ctx, void *ptr FLARG) {
 	size_info *si;
 	size_t size;
+	isc_boolean_t call_water= ISC_FALSE;
 
 	REQUIRE(VALID_CONTEXT(ctx));
 	REQUIRE(ptr != NULL);
 
-	si = &(((size_info *)ptr)[-1]);
-	size = si->u.size;
+	if ((isc_mem_debugging & ISC_MEM_DEBUGCTX) != 0) {
+		si = &(((size_info *)ptr)[-2]);
+		REQUIRE(si->u.ctx == ctx);
+		size = si[1].u.size;
+	} else {
+		si = &(((size_info *)ptr)[-1]);
+		size = si->u.size;
+	}
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-	LOCK(&ctx->lock);
-	mem_putunlocked(ctx, si, size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-	mem_put(ctx, si, size);
-	LOCK(&ctx->lock);
-	mem_putstats(ctx, si, size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+	if ((ctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+		MCTXLOCK(ctx, &ctx->lock);
+		mem_putunlocked(ctx, si, size);
+	} else {
+		mem_put(ctx, si, size);
+		MCTXLOCK(ctx, &ctx->lock);
+		mem_putstats(ctx, si, size);
+	}
 
 	DELETE_TRACE(ctx, ptr, size, file, line);
 
-	UNLOCK(&ctx->lock);
+	/*
+	 * The check against ctx->lo_water == 0 is for the condition
+	 * when the context was pushed over hi_water but then had
+	 * isc_mem_setwater() called with 0 for hi_water and lo_water.
+	 */
+	if (ctx->hi_called && 
+	    (ctx->inuse < ctx->lo_water || ctx->lo_water == 0U)) {
+		ctx->hi_called = ISC_FALSE;
+
+		if (ctx->water != NULL)
+			call_water = ISC_TRUE;
+	}
+	MCTXUNLOCK(ctx, &ctx->lock);
+
+	if (call_water)
+		(ctx->water)(ctx->water_arg, ISC_MEM_LOWATER);
 }
 
 
@@ -1303,11 +1409,11 @@ isc__mem_strdup(isc_mem_t *mctx, const char *s FLARG) {
 void
 isc_mem_setdestroycheck(isc_mem_t *ctx, isc_boolean_t flag) {
 	REQUIRE(VALID_CONTEXT(ctx));
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 
 	ctx->checkfree = flag;
 
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 }
 
 /*
@@ -1317,11 +1423,11 @@ isc_mem_setdestroycheck(isc_mem_t *ctx, isc_boolean_t flag) {
 void
 isc_mem_setquota(isc_mem_t *ctx, size_t quota) {
 	REQUIRE(VALID_CONTEXT(ctx));
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 
 	ctx->quota = quota;
 
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 }
 
 size_t
@@ -1329,11 +1435,11 @@ isc_mem_getquota(isc_mem_t *ctx) {
 	size_t quota;
 
 	REQUIRE(VALID_CONTEXT(ctx));
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 
 	quota = ctx->quota;
 
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	return (quota);
 }
@@ -1343,11 +1449,11 @@ isc_mem_inuse(isc_mem_t *ctx) {
 	size_t inuse;
 
 	REQUIRE(VALID_CONTEXT(ctx));
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
 
 	inuse = ctx->inuse;
 
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
 
 	return (inuse);
 }
@@ -1356,24 +1462,38 @@ void
 isc_mem_setwater(isc_mem_t *ctx, isc_mem_water_t water, void *water_arg,
                  size_t hiwater, size_t lowater)
 {
+	isc_boolean_t callwater = ISC_FALSE;
+	isc_mem_water_t oldwater;
+	void *oldwater_arg;
+
 	REQUIRE(VALID_CONTEXT(ctx));
 	REQUIRE(hiwater >= lowater);
 
-	LOCK(&ctx->lock);
+	MCTXLOCK(ctx, &ctx->lock);
+	oldwater = ctx->water;
+	oldwater_arg = ctx->water_arg;
 	if (water == NULL) {
+		callwater = ctx->hi_called;
 		ctx->water = NULL;
 		ctx->water_arg = NULL;
 		ctx->hi_water = 0;
 		ctx->lo_water = 0;
 		ctx->hi_called = ISC_FALSE;
 	} else {
+		if (ctx->hi_called &&
+		    (ctx->water != water || ctx->water_arg != water_arg ||
+		     ctx->inuse < lowater || lowater == 0U))
+			callwater = ISC_TRUE;
 		ctx->water = water;
 		ctx->water_arg = water_arg;
 		ctx->hi_water = hiwater;
 		ctx->lo_water = lowater;
 		ctx->hi_called = ISC_FALSE;
 	}
-	UNLOCK(&ctx->lock);
+	MCTXUNLOCK(ctx, &ctx->lock);
+	
+	if (callwater && oldwater != NULL)
+		(oldwater)(oldwater_arg, ISC_MEM_LOWATER);
 }
 
 /*
@@ -1413,9 +1533,9 @@ isc_mempool_create(isc_mem_t *mctx, size_t size, isc_mempool_t **mpctxp) {
 
 	*mpctxp = mpctx;
 
-	LOCK(&mctx->lock);
+	MCTXLOCK(mctx, &mctx->lock);
 	ISC_LIST_INITANDAPPEND(mctx->pools, mpctx, link);
-	UNLOCK(&mctx->lock);
+	MCTXUNLOCK(mctx, &mctx->lock);
 
 	return (ISC_R_SUCCESS);
 }
@@ -1468,28 +1588,28 @@ isc_mempool_destroy(isc_mempool_t **mpctxp) {
 	/*
 	 * Return any items on the free list
 	 */
-	LOCK(&mctx->lock);
+	MCTXLOCK(mctx, &mctx->lock);
 	while (mpctx->items != NULL) {
 		INSIST(mpctx->freecount > 0);
 		mpctx->freecount--;
 		item = mpctx->items;
 		mpctx->items = item->next;
 
-#if ISC_MEM_USE_INTERNAL_MALLOC
-		mem_putunlocked(mctx, item, mpctx->size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-		mem_put(mctx, item, mpctx->size);
-		mem_putstats(mctx, item, mpctx->size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+		if ((mctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+			mem_putunlocked(mctx, item, mpctx->size);
+		} else {
+			mem_put(mctx, item, mpctx->size);
+			mem_putstats(mctx, item, mpctx->size);
+		}
 	}
-	UNLOCK(&mctx->lock);
+	MCTXUNLOCK(mctx, &mctx->lock);
 
 	/*
 	 * Remove our linked list entry from the memory context.
 	 */
-	LOCK(&mctx->lock);
+	MCTXLOCK(mctx, &mctx->lock);
 	ISC_LIST_UNLINK(mctx->pools, mpctx, link);
-	UNLOCK(&mctx->lock);
+	MCTXUNLOCK(mctx, &mctx->lock);
 
 	mpctx->magic = 0;
 
@@ -1548,22 +1668,22 @@ isc__mempool_get(isc_mempool_t *mpctx FLARG) {
 	 * We need to dip into the well.  Lock the memory context here and
 	 * fill up our free list.
 	 */
-	LOCK(&mctx->lock);
+	MCTXLOCK(mctx, &mctx->lock);
 	for (i = 0; i < mpctx->fillcount; i++) {
-#if ISC_MEM_USE_INTERNAL_MALLOC
-		item = mem_getunlocked(mctx, mpctx->size);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-		item = mem_get(mctx, mpctx->size);
-		if (item != NULL)
-			mem_getstats(mctx, mpctx->size);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+		if ((mctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+			item = mem_getunlocked(mctx, mpctx->size);
+		} else {
+			item = mem_get(mctx, mpctx->size);
+			if (item != NULL)
+				mem_getstats(mctx, mpctx->size);
+		}
 		if (item == NULL)
 			break;
 		item->next = mpctx->items;
 		mpctx->items = item;
 		mpctx->freecount++;
 	}
-	UNLOCK(&mctx->lock);
+	MCTXUNLOCK(mctx, &mctx->lock);
 
 	/*
 	 * If we didn't get any items, return NULL.
@@ -1583,9 +1703,9 @@ isc__mempool_get(isc_mempool_t *mpctx FLARG) {
 
 #if ISC_MEM_TRACKLINES
 	if (item != NULL) {
-		LOCK(&mctx->lock);
+		MCTXLOCK(mctx, &mctx->lock);
 		ADD_TRACE(mctx, item, mpctx->size, file, line);
-		UNLOCK(&mctx->lock);
+		MCTXUNLOCK(mctx, &mctx->lock);
 	}
 #endif /* ISC_MEM_TRACKLINES */
 
@@ -1609,25 +1729,25 @@ isc__mempool_put(isc_mempool_t *mpctx, void *mem FLARG) {
 	mpctx->allocated--;
 
 #if ISC_MEM_TRACKLINES
-	LOCK(&mctx->lock);
+	MCTXLOCK(mctx, &mctx->lock);
 	DELETE_TRACE(mctx, mem, mpctx->size, file, line);
-	UNLOCK(&mctx->lock);
+	MCTXUNLOCK(mctx, &mctx->lock);
 #endif /* ISC_MEM_TRACKLINES */
 
 	/*
 	 * If our free list is full, return this to the mctx directly.
 	 */
 	if (mpctx->freecount >= mpctx->freemax) {
-#if ISC_MEM_USE_INTERNAL_MALLOC
-		LOCK(&mctx->lock);
-		mem_putunlocked(mctx, mem, mpctx->size);
-		UNLOCK(&mctx->lock);
-#else /* ISC_MEM_USE_INTERNAL_MALLOC */
-		mem_put(mctx, mem, mpctx->size);
-		LOCK(&mctx->lock);
-		mem_putstats(mctx, mem, mpctx->size);
-		UNLOCK(&mctx->lock);
-#endif /* ISC_MEM_USE_INTERNAL_MALLOC */
+		if ((mctx->flags & ISC_MEMFLAG_INTERNAL) != 0) {
+			MCTXLOCK(mctx, &mctx->lock);
+			mem_putunlocked(mctx, mem, mpctx->size);
+			MCTXUNLOCK(mctx, &mctx->lock);
+		} else {
+			mem_put(mctx, mem, mpctx->size);
+			MCTXLOCK(mctx, &mctx->lock);
+			mem_putstats(mctx, mem, mpctx->size);
+			MCTXUNLOCK(mctx, &mctx->lock);
+		}
 		if (mpctx->lock != NULL)
 			UNLOCK(mpctx->lock);
 		return;
@@ -1775,3 +1895,60 @@ isc_mempool_getfillcount(isc_mempool_t *mpctx) {
 
 	return (fillcount);
 }
+
+void
+isc_mem_printactive(isc_mem_t *ctx, FILE *file) {
+
+	REQUIRE(VALID_CONTEXT(ctx));
+	REQUIRE(file != NULL);
+
+#if !ISC_MEM_TRACKLINES
+	UNUSED(ctx);
+	UNUSED(file);
+#else
+	print_active(ctx, file);
+#endif
+}
+
+void
+isc_mem_printallactive(FILE *file) {
+#if !ISC_MEM_TRACKLINES
+	UNUSED(file);
+#else
+	isc_mem_t *ctx;
+
+	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
+
+	LOCK(&lock);
+	for (ctx = ISC_LIST_HEAD(contexts);
+	     ctx != NULL;
+	     ctx = ISC_LIST_NEXT(ctx, link)) {
+		fprintf(file, "context: %p\n", ctx);
+		print_active(ctx, file);
+	}
+	UNLOCK(&lock);
+#endif
+}
+
+void    
+isc_mem_checkdestroyed(FILE *file) {
+
+	RUNTIME_CHECK(isc_once_do(&once, initialize_action) == ISC_R_SUCCESS);
+
+	LOCK(&lock);
+	if (!ISC_LIST_EMPTY(contexts))  {
+#if ISC_MEM_TRACKLINES
+		isc_mem_t *ctx;
+
+		for (ctx = ISC_LIST_HEAD(contexts);
+		     ctx != NULL;
+		     ctx = ISC_LIST_NEXT(ctx, link)) {
+			fprintf(file, "context: %p\n", ctx);
+			print_active(ctx, file);
+		}
+		fflush(file);
+#endif
+		INSIST(1);
+	}
+	UNLOCK(&lock);
+}
diff --git a/contrib/bind9/lib/isc/mips/include/isc/atomic.h b/contrib/bind9/lib/isc/mips/include/isc/atomic.h
new file mode 100644
index 0000000..368a6ef
--- /dev/null
+++ b/contrib/bind9/lib/isc/mips/include/isc/atomic.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.1.2.1 2005/07/09 07:14:00 jinmei Exp $ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+#include <isc/platform.h>
+#include <isc/types.h>
+
+#ifdef ISC_PLATFORM_USEGCCASM
+/*
+ * This routine atomically increments the value stored in 'p' by 'val', and
+ * returns the previous value.
+ */
+static inline isc_int32_t
+isc_atomic_xadd(isc_int32_t *p, int val) {
+	isc_int32_t orig;
+
+	/* add is a cheat, since MIPS has no mov instruction */
+	__asm__ volatile (
+	    "1:"
+	    "ll $3, %1\n"
+	    "add %0, $0, $3\n"
+	    "add $3, $3, %2\n"
+	    "sc $3, %1\n"
+	    "beq $3, 0, 1b"
+	    : "=&r"(orig)
+	    : "m"(*p), "r"(val)
+	    : "memory", "$3"
+		);
+
+	return (orig);
+}
+
+/*
+ * This routine atomically stores the value 'val' in 'p'.
+ */
+static inline void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	__asm__ volatile (
+	    "1:"
+	    "ll $3, %0\n"
+	    "add $3, $0, %1\n"
+	    "sc $3, %0\n"
+	    "beq $3, 0, 1b"
+	    :
+	    : "m"(*p), "r"(val)
+	    : "memory", "$3"
+		);
+}
+
+/*
+ * This routine atomically replaces the value in 'p' with 'val', if the
+ * original value is equal to 'cmpval'.  The original value is returned in any
+ * case.
+ */
+static inline isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, int cmpval, int val) {
+	isc_int32_t orig;
+
+	__asm__ volatile(
+	    "1:"
+	    "ll $3, %1\n"
+	    "add %0, $0, $3\n"
+	    "bne $3, %2, 2f\n"
+	    "add $3, $0, %3\n"
+	    "sc $3, %1\n"
+	    "beq $3, 0, 1b\n"
+	    "2:"
+	    : "=&r"(orig)
+	    : "m"(*p), "r"(cmpval), "r"(val)
+	    : "memory", "$3"
+		);
+
+	return (orig);
+}
+
+#else /* !ISC_PLATFORM_USEGCCASM */
+
+#error "unsupported compiler.  disable atomic ops by --disable-atomic"
+
+#endif
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isc/mutexblock.c b/contrib/bind9/lib/isc/mutexblock.c
index dc7c23d..d8a82cc 100644
--- a/contrib/bind9/lib/isc/mutexblock.c
+++ b/contrib/bind9/lib/isc/mutexblock.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutexblock.c,v 1.14.12.3 2004/03/08 09:04:49 marka Exp $ */
+/* $Id: mutexblock.c,v 1.16.18.2 2005/04/29 00:16:47 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/netaddr.c b/contrib/bind9/lib/isc/netaddr.c
index 712ad2c..e56e05b 100644
--- a/contrib/bind9/lib/isc/netaddr.c
+++ b/contrib/bind9/lib/isc/netaddr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: netaddr.c,v 1.18.12.9 2004/05/15 03:46:12 jinmei Exp $ */
+/* $Id: netaddr.c,v 1.27.18.8 2005/04/27 05:02:03 sra Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -51,6 +53,12 @@ isc_netaddr_equal(const isc_netaddr_t *a, const isc_netaddr_t *b) {
 		    a->zone != b->zone)
 			return (ISC_FALSE);
 		break;
+#ifdef ISC_PLATFORM_HAVESYSUNH
+	case AF_UNIX:
+		if (strcmp(a->type.un, b->type.un) != 0)
+			return (ISC_FALSE);
+		break;
+#endif
 	default:
 		return (ISC_FALSE);
 	}
@@ -135,6 +143,16 @@ isc_netaddr_totext(const isc_netaddr_t *netaddr, isc_buffer_t *target) {
 	case AF_INET6:
 		type = &netaddr->type.in6;
 		break;
+#ifdef ISC_PLATFORM_HAVESYSUNH
+	case AF_UNIX:
+		alen = strlen(netaddr->type.un);
+		if (alen > isc_buffer_availablelength(target))
+			return (ISC_R_NOSPACE);
+		isc_buffer_putmem(target,
+				  (const unsigned char *)(netaddr->type.un),
+				  alen);
+		return (ISC_R_SUCCESS);
+#endif
 	default:
 		return (ISC_R_FAILURE);
 	}
@@ -190,6 +208,42 @@ isc_netaddr_format(const isc_netaddr_t *na, char *array, unsigned int size) {
 	}
 }
 
+
+isc_result_t
+isc_netaddr_prefixok(const isc_netaddr_t *na, unsigned int prefixlen) {
+	static const unsigned char zeros[16];
+	unsigned int nbits, nbytes, ipbytes;
+	const unsigned char *p;
+
+	switch (na->family) {
+	case AF_INET:
+		p = (const unsigned char *) &na->type.in;
+		ipbytes = 4;
+		if (prefixlen > 32)
+			return (ISC_R_RANGE);
+		break;
+	case AF_INET6:
+		p = (const unsigned char *) &na->type.in6;
+		ipbytes = 16;
+		if (prefixlen > 128)
+			return (ISC_R_RANGE);
+		break;
+	default:
+		ipbytes = 0;
+		return (ISC_R_NOTIMPLEMENTED);
+	}
+	nbytes = prefixlen / 8;
+	nbits = prefixlen % 8;
+	if (nbits != 0) {
+		if ((p[nbytes] & (0xff>>nbits)) != 0U)
+			return (ISC_R_FAILURE);
+		nbytes++;
+	}
+	if (memcmp(p + nbytes, zeros, ipbytes - nbytes) != 0)
+		return (ISC_R_FAILURE);
+	return (ISC_R_SUCCESS);
+}
+
 isc_result_t
 isc_netaddr_masktoprefixlen(const isc_netaddr_t *s, unsigned int *lenp) {
 	unsigned int nbits, nbytes, ipbytes, i;
@@ -246,6 +300,25 @@ isc_netaddr_fromin6(isc_netaddr_t *netaddr, const struct in6_addr *ina6) {
 	netaddr->type.in6 = *ina6;
 }
 
+isc_result_t
+isc_netaddr_frompath(isc_netaddr_t *netaddr, const char *path) {
+#ifdef ISC_PLATFORM_HAVESYSUNH
+        if (strlen(path) > sizeof(netaddr->type.un) - 1)
+                return (ISC_R_NOSPACE);
+
+        memset(netaddr, 0, sizeof(*netaddr));
+        netaddr->family = AF_UNIX;
+        strcpy(netaddr->type.un, path);
+        netaddr->zone = 0;
+        return (ISC_R_SUCCESS);
+#else 
+	UNUSED(netaddr);
+	UNUSED(path);
+        return (ISC_R_NOTIMPLEMENTED);
+#endif
+}
+
+
 void
 isc_netaddr_setzone(isc_netaddr_t *netaddr, isc_uint32_t zone) {
 	/* we currently only support AF_INET6. */
@@ -276,6 +349,12 @@ isc_netaddr_fromsockaddr(isc_netaddr_t *t, const isc_sockaddr_t *s) {
 		t->zone = 0;
 #endif
 		break;
+#ifdef ISC_PLATFORM_HAVESYSUNH
+	case AF_UNIX:
+		memcpy(t->type.un, s->type.sunix.sun_path, sizeof(t->type.un));
+		t->zone = 0;
+		break;
+#endif
 	default:
 		INSIST(0);
 	}
diff --git a/contrib/bind9/lib/isc/netscope.c b/contrib/bind9/lib/isc/netscope.c
index 8df4483..75827d2 100644
--- a/contrib/bind9/lib/isc/netscope.c
+++ b/contrib/bind9/lib/isc/netscope.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/*! \file */
+
 #if defined(LIBC_SCCS) && !defined(lint)
 static char rcsid[] =
-	"$Id: netscope.c,v 1.5.142.9 2006/08/25 05:25:50 marka Exp $";
+	"$Id: netscope.c,v 1.7.18.4 2006/08/25 05:25:51 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
diff --git a/contrib/bind9/lib/isc/nls/Makefile.in b/contrib/bind9/lib/isc/nls/Makefile.in
index f16b4cb..8211d9b 100644
--- a/contrib/bind9/lib/isc/nls/Makefile.in
+++ b/contrib/bind9/lib/isc/nls/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.11.206.1 2004/03/06 08:14:50 marka Exp $
+# $Id: Makefile.in,v 1.12 2004/03/05 05:11:05 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/nls/msgcat.c b/contrib/bind9/lib/isc/nls/msgcat.c
index 906e26e..ae56de7 100644
--- a/contrib/bind9/lib/isc/nls/msgcat.c
+++ b/contrib/bind9/lib/isc/nls/msgcat.c
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: msgcat.c,v 1.10.12.6 2005/06/09 23:54:31 marka Exp $ */
+/* $Id: msgcat.c,v 1.13.18.3 2005/06/08 02:07:57 marka Exp $ */
 
-/*
- * Principal Author: Bob Halley
+/*! \file msgcat.c
+ *
+ * \author Principal Author: Bob Halley
  */
 
 #include <config.h>
diff --git a/contrib/bind9/lib/isc/noatomic/include/isc/atomic.h b/contrib/bind9/lib/isc/noatomic/include/isc/atomic.h
new file mode 100644
index 0000000..1c7035f
--- /dev/null
+++ b/contrib/bind9/lib/isc/noatomic/include/isc/atomic.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.2.2.1 2005/06/04 06:23:44 jinmei Exp $ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+/* This file is inherently empty. */
+
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isc/nothreads/Makefile.in b/contrib/bind9/lib/isc/nothreads/Makefile.in
index 639c9fa..c9e8637 100644
--- a/contrib/bind9/lib/isc/nothreads/Makefile.in
+++ b/contrib/bind9/lib/isc/nothreads/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.206.1 2004/03/06 08:14:51 marka Exp $
+# $Id: Makefile.in,v 1.5 2004/03/05 05:11:08 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/nothreads/condition.c b/contrib/bind9/lib/isc/nothreads/condition.c
index 395d52f..329fbc8 100644
--- a/contrib/bind9/lib/isc/nothreads/condition.c
+++ b/contrib/bind9/lib/isc/nothreads/condition.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: condition.c,v 1.4.12.5 2006/08/25 05:25:50 marka Exp $ */
+/* $Id: condition.c,v 1.6.18.2 2006/08/25 05:25:51 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/nothreads/include/Makefile.in b/contrib/bind9/lib/isc/nothreads/include/Makefile.in
index 4c58269..ecfc329 100644
--- a/contrib/bind9/lib/isc/nothreads/include/Makefile.in
+++ b/contrib/bind9/lib/isc/nothreads/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.2.206.1 2004/03/06 08:14:52 marka Exp $
+# $Id: Makefile.in,v 1.3 2004/03/05 05:11:11 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in b/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in
index 6717404..f6482fb 100644
--- a/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in
+++ b/contrib/bind9/lib/isc/nothreads/include/isc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.206.1 2004/03/06 08:14:52 marka Exp $
+# $Id: Makefile.in,v 1.5 2004/03/05 05:11:13 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/nothreads/include/isc/condition.h b/contrib/bind9/lib/isc/nothreads/include/isc/condition.h
index b899a82..39889b1 100644
--- a/contrib/bind9/lib/isc/nothreads/include/isc/condition.h
+++ b/contrib/bind9/lib/isc/nothreads/include/isc/condition.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: condition.h,v 1.3.206.1 2004/03/06 08:14:52 marka Exp $ */
+/* $Id: condition.h,v 1.4 2004/03/05 05:11:13 marka Exp $ */
 
 /*
  * This provides a limited subset of the isc_condition_t
diff --git a/contrib/bind9/lib/isc/nothreads/include/isc/mutex.h b/contrib/bind9/lib/isc/nothreads/include/isc/mutex.h
index c80a945..a586435 100644
--- a/contrib/bind9/lib/isc/nothreads/include/isc/mutex.h
+++ b/contrib/bind9/lib/isc/nothreads/include/isc/mutex.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutex.h,v 1.3.206.1 2004/03/06 08:14:53 marka Exp $ */
+/* $Id: mutex.h,v 1.4 2004/03/05 05:11:13 marka Exp $ */
 
 #ifndef ISC_MUTEX_H
 #define ISC_MUTEX_H 1
diff --git a/contrib/bind9/lib/isc/nothreads/include/isc/once.h b/contrib/bind9/lib/isc/nothreads/include/isc/once.h
index 9f54ac8..470120a 100644
--- a/contrib/bind9/lib/isc/nothreads/include/isc/once.h
+++ b/contrib/bind9/lib/isc/nothreads/include/isc/once.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: once.h,v 1.3.206.1 2004/03/06 08:14:53 marka Exp $ */
+/* $Id: once.h,v 1.4 2004/03/05 05:11:13 marka Exp $ */
 
 #ifndef ISC_ONCE_H
 #define ISC_ONCE_H 1
diff --git a/contrib/bind9/lib/isc/nothreads/include/isc/thread.h b/contrib/bind9/lib/isc/nothreads/include/isc/thread.h
index e045b98..6c85913 100644
--- a/contrib/bind9/lib/isc/nothreads/include/isc/thread.h
+++ b/contrib/bind9/lib/isc/nothreads/include/isc/thread.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: thread.h,v 1.3.206.1 2004/03/06 08:14:53 marka Exp $ */
+/* $Id: thread.h,v 1.4 2004/03/05 05:11:13 marka Exp $ */
 
 #ifndef ISC_THREAD_H
 #define ISC_THREAD_H 1
diff --git a/contrib/bind9/lib/isc/nothreads/mutex.c b/contrib/bind9/lib/isc/nothreads/mutex.c
index a707947..0048d87 100644
--- a/contrib/bind9/lib/isc/nothreads/mutex.c
+++ b/contrib/bind9/lib/isc/nothreads/mutex.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutex.c,v 1.4.12.5 2006/08/25 05:25:50 marka Exp $ */
+/* $Id: mutex.c,v 1.6.18.2 2006/08/25 05:25:51 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/nothreads/thread.c b/contrib/bind9/lib/isc/nothreads/thread.c
index 1aea72a..0f20927 100644
--- a/contrib/bind9/lib/isc/nothreads/thread.c
+++ b/contrib/bind9/lib/isc/nothreads/thread.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: thread.c,v 1.2.206.1 2004/03/06 08:14:52 marka Exp $ */
+/* $Id: thread.c,v 1.3 2004/03/05 05:11:09 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/ondestroy.c b/contrib/bind9/lib/isc/ondestroy.c
index aacb8f2..2cd9687 100644
--- a/contrib/bind9/lib/isc/ondestroy.c
+++ b/contrib/bind9/lib/isc/ondestroy.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ondestroy.c,v 1.11.206.1 2004/03/06 08:14:33 marka Exp $ */
+/* $Id: ondestroy.c,v 1.12.18.2 2005/04/29 00:16:48 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/parseint.c b/contrib/bind9/lib/isc/parseint.c
index fe74e57..0696344 100644
--- a/contrib/bind9/lib/isc/parseint.c
+++ b/contrib/bind9/lib/isc/parseint.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: parseint.c,v 1.3.26.5 2004/03/08 09:04:49 marka Exp $ */
+/* $Id: parseint.c,v 1.4.18.2 2005/04/29 00:16:48 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/powerpc/include/isc/atomic.h b/contrib/bind9/lib/isc/powerpc/include/isc/atomic.h
new file mode 100644
index 0000000..2af9835
--- /dev/null
+++ b/contrib/bind9/lib/isc/powerpc/include/isc/atomic.h
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.1.6.5 2007/02/13 00:04:50 marka Exp $ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+#include <isc/platform.h>
+#include <isc/types.h>
+
+/*!\file
+ * static inline isc_int32_t
+ * isc_atomic_xadd(isc_int32_t *p, isc_int32_t val);
+ *
+ * This routine atomically increments the value stored in 'p' by 'val', and
+ * returns the previous value.
+ *
+ * static inline void
+ * isc_atomic_store(void *p, isc_int32_t val);
+ *
+ * This routine atomically stores the value 'val' in 'p'.
+ *
+ * static inline isc_int32_t
+ * isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val);
+ *
+ * This routine atomically replaces the value in 'p' with 'val', if the
+ * original value is equal to 'cmpval'.  The original value is returned in any
+ * case.
+ */
+
+#if defined(_AIX)
+
+#include <sys/atomic_op.h>
+
+#define isc_atomic_xadd(p, v) fetch_and_add(p, v)
+#define isc_atomic_store(p, v) _clear_lock(p, v)
+
+#ifdef __GNUC__
+static inline int
+#else
+static int
+#endif
+isc_atomic_cmpxchg(atomic_p p, int old, int new) {
+        int orig = old;
+
+#ifdef __GNUC__
+        asm("ics");
+#else
+         __isync();
+#endif
+        if (compare_and_swap(p, &orig, new))
+		return (old);
+        return (orig);
+}
+
+#elif defined(ISC_PLATFORM_USEGCCASM) || defined(ISC_PLATFORM_USEMACASM)
+static inline isc_int32_t
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	isc_int32_t orig;
+
+	__asm__ volatile (
+#ifdef ISC_PLATFORM_USEMACASM
+		"1:"
+		"lwarx r6, 0, %1\n"
+	    	"mr %0, r6\n"
+		"add r6, r6, %2\n"
+		"stwcx. r6, 0, %1\n"
+		"bne- 1b"
+#else
+		"1:"
+		"lwarx 6, 0, %1\n"
+	    	"mr %0, 6\n"
+		"add 6, 6, %2\n"
+		"stwcx. 6, 0, %1\n"
+		"bne- 1b"
+#endif
+		: "=&r"(orig)
+		: "r"(p), "r"(val)
+		: "r6", "memory"
+		);
+
+	return (orig);
+}
+
+static inline void
+isc_atomic_store(void *p, isc_int32_t val) {
+	__asm__ volatile (
+#ifdef ISC_PLATFORM_USEMACASM
+		"1:"
+		"lwarx r6, 0, %0\n"
+		"lwz r6, %1\n"
+		"stwcx. r6, 0, %0\n"
+		"bne- 1b"
+#else
+		"1:"
+		"lwarx 6, 0, %0\n"
+		"lwz 6, %1\n"
+		"stwcx. 6, 0, %0\n"
+		"bne- 1b"
+#endif
+		:
+		: "r"(p), "m"(val)
+		: "r6", "memory"
+		);
+}
+
+static inline isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+	isc_int32_t orig;
+
+	__asm__ volatile (
+#ifdef ISC_PLATFORM_USEMACASM
+		"1:"
+		"lwarx r6, 0, %1\n"
+		"mr %0,r6\n"
+		"cmpw r6, %2\n"
+		"bne 2f\n"
+		"mr r6, %3\n"
+		"stwcx. r6, 0, %1\n"
+		"bne- 1b\n"
+		"2:"
+#else
+		"1:"
+		"lwarx 6, 0, %1\n"
+		"mr %0,6\n"
+		"cmpw 6, %2\n"
+		"bne 2f\n"
+		"mr 6, %3\n"
+		"stwcx. 6, 0, %1\n"
+		"bne- 1b\n"
+		"2:"
+#endif
+		: "=&r" (orig)
+		: "r"(p), "r"(cmpval), "r"(val)
+		: "r6", "memory"
+		);
+
+	return (orig);
+}
+
+#else
+
+#error "unsupported compiler.  disable atomic ops by --disable-atomic"
+
+#endif
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isc/print.c b/contrib/bind9/lib/isc/print.c
index ee50b29..59c528b 100644
--- a/contrib/bind9/lib/isc/print.c
+++ b/contrib/bind9/lib/isc/print.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: print.c,v 1.22.2.3.2.4 2006/04/17 18:27:20 explorer Exp $ */
+/* $Id: print.c,v 1.27.18.3 2006/04/17 18:27:33 explorer Exp $ */
 
 /*! \file */
 
diff --git a/contrib/bind9/lib/isc/pthreads/Makefile.in b/contrib/bind9/lib/isc/pthreads/Makefile.in
index f245afa..b9cc906 100644
--- a/contrib/bind9/lib/isc/pthreads/Makefile.in
+++ b/contrib/bind9/lib/isc/pthreads/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.16.206.1 2004/03/06 08:14:53 marka Exp $
+# $Id: Makefile.in,v 1.17 2004/03/05 05:11:16 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/pthreads/condition.c b/contrib/bind9/lib/isc/pthreads/condition.c
index 489980c..b9c26c6 100644
--- a/contrib/bind9/lib/isc/pthreads/condition.c
+++ b/contrib/bind9/lib/isc/pthreads/condition.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: condition.c,v 1.30.2.1.10.1 2004/03/06 08:14:53 marka Exp $ */
+/* $Id: condition.c,v 1.32.18.2 2005/04/29 00:17:05 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -44,7 +46,7 @@ isc_condition_waituntil(isc_condition_t *c, isc_mutex_t *m, isc_time_t *t) {
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	/*
+	/*!
 	 * POSIX defines a timespec's tv_nsec as long.  isc_time_nanoseconds
 	 * ensures its return value is < 1 billion, which will fit in a long.
 	 */
diff --git a/contrib/bind9/lib/isc/pthreads/include/Makefile.in b/contrib/bind9/lib/isc/pthreads/include/Makefile.in
index 5fec836..b1164b6 100644
--- a/contrib/bind9/lib/isc/pthreads/include/Makefile.in
+++ b/contrib/bind9/lib/isc/pthreads/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.11.206.1 2004/03/06 08:14:54 marka Exp $
+# $Id: Makefile.in,v 1.12 2004/03/05 05:11:19 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in b/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in
index dd15a11..2e11f6c 100644
--- a/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in
+++ b/contrib/bind9/lib/isc/pthreads/include/isc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.13.206.1 2004/03/06 08:14:56 marka Exp $
+# $Id: Makefile.in,v 1.14 2004/03/05 05:11:40 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/pthreads/include/isc/condition.h b/contrib/bind9/lib/isc/pthreads/include/isc/condition.h
index c33772f..f7cea75 100644
--- a/contrib/bind9/lib/isc/pthreads/include/isc/condition.h
+++ b/contrib/bind9/lib/isc/pthreads/include/isc/condition.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: condition.h,v 1.21.206.1 2004/03/06 08:14:56 marka Exp $ */
+/* $Id: condition.h,v 1.22.18.2 2005/04/29 00:17:05 marka Exp $ */
 
 #ifndef ISC_CONDITION_H
 #define ISC_CONDITION_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/mutex.h>
 #include <isc/result.h>
diff --git a/contrib/bind9/lib/isc/pthreads/include/isc/mutex.h b/contrib/bind9/lib/isc/pthreads/include/isc/mutex.h
index f6e526d..edafaf6 100644
--- a/contrib/bind9/lib/isc/pthreads/include/isc/mutex.h
+++ b/contrib/bind9/lib/isc/pthreads/include/isc/mutex.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,17 +15,22 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutex.h,v 1.23.26.3 2004/03/08 09:04:55 marka Exp $ */
+/* $Id: mutex.h,v 1.25.18.3 2005/07/12 01:22:33 marka Exp $ */
 
 #ifndef ISC_MUTEX_H
 #define ISC_MUTEX_H 1
 
+/*! \file */
+
 #include <pthread.h>
 #include <stdio.h>
 
+#include <isc/lang.h>
 #include <isc/result.h>		/* for ISC_R_ codes */
 
-/*
+ISC_LANG_BEGINDECLS
+
+/*!
  * Supply mutex attributes that enable deadlock detection
  * (helpful when debugging).  This is system dependent and
  * currently only supported on NetBSD.
@@ -39,7 +44,7 @@ extern pthread_mutexattr_t isc__mutex_attrs;
 
 /* XXX We could do fancier error handling... */
 
-/*
+/*!
  * Define ISC_MUTEX_PROFILE to turn on profiling of mutexes by line.  When
  * enabled, isc_mutex_stats() can be used to print a table showing the
  * number of times each type of mutex was locked and the amount of time
@@ -53,8 +58,8 @@ extern pthread_mutexattr_t isc__mutex_attrs;
 typedef struct isc_mutexstats isc_mutexstats_t;
 
 typedef struct {
-	pthread_mutex_t		mutex;	/* The actual mutex. */
-	isc_mutexstats_t *	stats;	/* Mutex statistics. */
+	pthread_mutex_t		mutex;	/*%< The actual mutex. */
+	isc_mutexstats_t *	stats;	/*%< Mutex statistics. */
 } isc_mutex_t;
 #else
 typedef pthread_mutex_t	isc_mutex_t;
@@ -70,8 +75,8 @@ typedef pthread_mutex_t	isc_mutex_t;
         isc_mutex_init_errcheck((mp))
 #else
 #define isc_mutex_init(mp) \
-	((pthread_mutex_init((mp), ISC__MUTEX_ATTRS) == 0) ? \
-	 ISC_R_SUCCESS : ISC_R_UNEXPECTED)
+	isc__mutex_init((mp), __FILE__, __LINE__)
+isc_result_t isc__mutex_init(isc_mutex_t *mp, const char *file, unsigned int line);
 #endif
 #endif
 
@@ -136,4 +141,5 @@ isc_mutex_init_errcheck(isc_mutex_t *mp);
 
 #endif /* ISC_MUTEX_PROFILE */
 
+ISC_LANG_ENDDECLS
 #endif /* ISC_MUTEX_H */
diff --git a/contrib/bind9/lib/isc/pthreads/include/isc/once.h b/contrib/bind9/lib/isc/pthreads/include/isc/once.h
index 39b4885..7e9f672 100644
--- a/contrib/bind9/lib/isc/pthreads/include/isc/once.h
+++ b/contrib/bind9/lib/isc/pthreads/include/isc/once.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: once.h,v 1.8.206.1 2004/03/06 08:14:57 marka Exp $ */
+/* $Id: once.h,v 1.9.18.2 2005/04/29 00:17:06 marka Exp $ */
 
 #ifndef ISC_ONCE_H
 #define ISC_ONCE_H 1
 
+/*! \file */
+
 #include <pthread.h>
 
 #include <isc/platform.h>
@@ -28,12 +30,12 @@
 typedef pthread_once_t isc_once_t;
 
 #ifdef ISC_PLATFORM_BRACEPTHREADONCEINIT
-/*
+/*!
  * This accomodates systems that define PTHRAD_ONCE_INIT improperly.
  */
 #define ISC_ONCE_INIT { PTHREAD_ONCE_INIT }
 #else
-/*
+/*!
  * This is the usual case.
  */
 #define ISC_ONCE_INIT PTHREAD_ONCE_INIT
diff --git a/contrib/bind9/lib/isc/pthreads/include/isc/thread.h b/contrib/bind9/lib/isc/pthreads/include/isc/thread.h
index 6287dcd..3262607 100644
--- a/contrib/bind9/lib/isc/pthreads/include/isc/thread.h
+++ b/contrib/bind9/lib/isc/pthreads/include/isc/thread.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: thread.h,v 1.19.206.1 2004/03/06 08:14:57 marka Exp $ */
+/* $Id: thread.h,v 1.20.18.4 2005/09/18 07:58:08 marka Exp $ */
 
 #ifndef ISC_THREAD_H
 #define ISC_THREAD_H 1
 
+/*! \file */
+
 #include <pthread.h>
 
 #include <isc/lang.h>
@@ -31,6 +33,7 @@ typedef pthread_t isc_thread_t;
 typedef void * isc_threadresult_t;
 typedef void * isc_threadarg_t;
 typedef isc_threadresult_t (*isc_threadfunc_t)(isc_threadarg_t);
+typedef pthread_key_t isc_thread_key_t;
 
 isc_result_t
 isc_thread_create(isc_threadfunc_t, isc_threadarg_t, isc_thread_t *);
@@ -47,6 +50,11 @@ isc_thread_setconcurrency(unsigned int level);
 #define isc_thread_self \
 	(unsigned long)pthread_self
 
+#define isc_thread_key_create pthread_key_create
+#define isc_thread_key_getspecific pthread_getspecific
+#define isc_thread_key_setspecific pthread_setspecific
+#define isc_thread_key_delete pthread_key_delete
+
 ISC_LANG_ENDDECLS
 
 #endif /* ISC_THREAD_H */
diff --git a/contrib/bind9/lib/isc/pthreads/mutex.c b/contrib/bind9/lib/isc/pthreads/mutex.c
index 71db669..7716980 100644
--- a/contrib/bind9/lib/isc/pthreads/mutex.c
+++ b/contrib/bind9/lib/isc/pthreads/mutex.c
@@ -15,20 +15,25 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mutex.c,v 1.6.26.5 2005/03/17 03:58:32 marka Exp $ */
+/* $Id: mutex.c,v 1.8.18.4 2005/07/12 01:22:32 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
 #include <stdio.h>
 #include <time.h>
 #include <sys/time.h>
+#include <errno.h>
 
 #include <isc/mutex.h>
 #include <isc/util.h>
+#include <isc/strerror.h>
 
 #if ISC_MUTEX_PROFILE
 
-/* Operations on timevals; adapted from FreeBSD's sys/time.h */
+/*@{*/
+/*% Operations on timevals; adapted from FreeBSD's sys/time.h */
 #define timevalclear(tvp)      ((tvp)->tv_sec = (tvp)->tv_usec = 0)
 #define timevaladd(vvp, uvp)                                            \
         do {                                                            \
@@ -49,6 +54,8 @@
                 }                                                       \
         } while (0)
 
+/*@}*/
+
 #define ISC_MUTEX_MAX_LOCKERS 32
 
 typedef struct {
@@ -60,8 +67,8 @@ typedef struct {
 } isc_mutexlocker_t;
 
 struct isc_mutexstats {
-	const char *		file;	/* File mutex was created in. */
-	int 			line;	/* Line mutex was created on. */
+	const char *		file;	/*%< File mutex was created in. */
+	int 			line;	/*%< Line mutex was created on. */
 	unsigned		count;
 	struct timeval		lock_t;
 	struct timeval		locked_total;
@@ -78,10 +85,13 @@ static pthread_mutex_t statslock = PTHREAD_MUTEX_INITIALIZER;
 
 isc_result_t
 isc_mutex_init_profile(isc_mutex_t *mp, const char *file, int line) {
-	int i;
+	int i, err;
 
-	if (pthread_mutex_init(&mp->mutex, NULL) != 0)
-		return ISC_R_UNEXPECTED;
+	err = pthread_mutex_init(&mp->mutex, NULL);
+	if (err == ENOMEM)
+		return (ISC_R_NOMEMORY);
+	if (err != 0)
+		return (ISC_R_UNEXPECTED);
 
 	RUNTIME_CHECK(pthread_mutex_lock(&statslock) == 0);
 
@@ -116,7 +126,7 @@ isc_mutex_init_profile(isc_mutex_t *mp, const char *file, int line) {
 		timevalclear(&mp->stats->lockers[i].wait_total);
 	}
 
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
@@ -159,7 +169,7 @@ isc_mutex_lock_profile(isc_mutex_t *mp, const char *file, int line) {
 
 	mp->stats->cur_locker = locker;
 
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
@@ -219,17 +229,18 @@ isc_result_t
 isc_mutex_init_errcheck(isc_mutex_t *mp)
 {
 	pthread_mutexattr_t attr;
+	int err;
 
 	if (pthread_mutexattr_init(&attr) != 0)
-		return ISC_R_UNEXPECTED;
+		return (ISC_R_UNEXPECTED);
 
 	if (pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_ERRORCHECK) != 0)
-		return ISC_R_UNEXPECTED;
+		return (ISC_R_UNEXPECTED);
   
-	if (pthread_mutex_init(mp, &attr) != 0)
-		return ISC_R_UNEXPECTED;
-
-	return ISC_R_SUCCESS;
+	err = pthread_mutex_init(mp, &attr) != 0)
+	if (err == ENOMEM)
+		return (ISC_R_NOMEMORY);
+	return ((err == 0) ? ISC_R_SUCCESS : ISC_R_UNEXPECTED);
 }
 #endif
 
@@ -239,3 +250,21 @@ pthread_mutexattr_t isc__mutex_attrs = {
 	0				/* m_flags, which appears to be unused. */
 };
 #endif
+
+isc_result_t
+isc__mutex_init(isc_mutex_t *mp, const char *file, unsigned int line) {
+	char strbuf[ISC_STRERRORSIZE];
+	isc_result_t result = ISC_R_SUCCESS;
+	int err;
+
+	err = pthread_mutex_init(mp, ISC__MUTEX_ATTRS);
+	if (err == ENOMEM)
+		return (ISC_R_NOMEMORY);
+	if (err != 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		UNEXPECTED_ERROR(file, line, "isc_mutex_init() failed: %s",
+				 strbuf);
+		result = ISC_R_UNEXPECTED;
+	}
+	return (result);
+}
diff --git a/contrib/bind9/lib/isc/pthreads/thread.c b/contrib/bind9/lib/isc/pthreads/thread.c
index a07daf8..bdbb593 100644
--- a/contrib/bind9/lib/isc/pthreads/thread.c
+++ b/contrib/bind9/lib/isc/pthreads/thread.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: thread.c,v 1.9.2.2.2.2 2004/12/04 06:50:03 marka Exp $ */
+/* $Id: thread.c,v 1.12.18.3 2005/04/29 00:17:05 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/quota.c b/contrib/bind9/lib/isc/quota.c
index 273a1b2..9290167 100644
--- a/contrib/bind9/lib/isc/quota.c
+++ b/contrib/bind9/lib/isc/quota.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: quota.c,v 1.11.12.5 2005/07/29 00:13:09 marka Exp $ */
+/* $Id: quota.c,v 1.13.18.3 2005/07/27 02:44:21 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/random.c b/contrib/bind9/lib/isc/random.c
index e5c4d31..f6c7d6e 100644
--- a/contrib/bind9/lib/isc/random.c
+++ b/contrib/bind9/lib/isc/random.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: random.c,v 1.15.74.5 2004/03/08 09:04:49 marka Exp $ */
+/* $Id: random.c,v 1.21.18.2 2005/04/29 00:16:48 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/ratelimiter.c b/contrib/bind9/lib/isc/ratelimiter.c
index 211363c..3d65139 100644
--- a/contrib/bind9/lib/isc/ratelimiter.c
+++ b/contrib/bind9/lib/isc/ratelimiter.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ratelimiter.c,v 1.18.14.4 2004/03/08 09:04:50 marka Exp $ */
+/* $Id: ratelimiter.c,v 1.21.18.2 2005/04/29 00:16:49 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/refcount.c b/contrib/bind9/lib/isc/refcount.c
new file mode 100644
index 0000000..d5095eb
--- /dev/null
+++ b/contrib/bind9/lib/isc/refcount.c
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: refcount.c,v 1.2.2.2 2005/07/25 00:51:46 marka Exp $ */
+
+#include <config.h>
+
+#include <stddef.h>
+
+#include <isc/mutex.h>
+#include <isc/refcount.h>
+#include <isc/result.h>
+
+isc_result_t
+isc_refcount_init(isc_refcount_t *ref, unsigned int n) {
+	REQUIRE(ref != NULL);
+
+	ref->refs = n;
+#if defined(ISC_PLATFORM_USETHREADS) && !defined(ISC_PLATFORM_HAVEXADD)
+	return (isc_mutex_init(&ref->lock));
+#else
+	return (ISC_R_SUCCESS);
+#endif
+}
diff --git a/contrib/bind9/lib/isc/region.c b/contrib/bind9/lib/isc/region.c
index 92f4f02..bc32b86 100644
--- a/contrib/bind9/lib/isc/region.c
+++ b/contrib/bind9/lib/isc/region.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: region.c,v 1.2.202.3 2004/03/08 09:04:50 marka Exp $ */
+/* $Id: region.c,v 1.3.18.2 2005/04/29 00:16:49 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/result.c b/contrib/bind9/lib/isc/result.c
index fd4e5c6..e0c8653 100644
--- a/contrib/bind9/lib/isc/result.c
+++ b/contrib/bind9/lib/isc/result.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.c,v 1.56.2.2.8.9 2005/06/09 23:54:30 marka Exp $ */
+/* $Id: result.c,v 1.62.18.6 2005/06/22 22:05:48 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -39,66 +41,66 @@ typedef struct resulttable {
 } resulttable;
 
 static const char *text[ISC_R_NRESULTS] = {
-	"success",				/*  0 */
-	"out of memory",			/*  1 */
-	"timed out",				/*  2 */
-	"no available threads",			/*  3 */
-	"address not available",		/*  4 */
-	"address in use",			/*  5 */
-	"permission denied",			/*  6 */
-	"no pending connections",		/*  7 */
-	"network unreachable",			/*  8 */
-	"host unreachable",			/*  9 */
-	"network down",				/* 10 */
-	"host down",				/* 11 */
-	"connection refused",			/* 12 */
-	"not enough free resources",		/* 13 */
-	"end of file",				/* 14 */
-	"socket already bound",			/* 15 */
-	"reload",				/* 16 */
-	"lock busy",				/* 17 */
-	"already exists",			/* 18 */
-	"ran out of space",			/* 19 */
-	"operation canceled",			/* 20 */
-	"socket is not bound",			/* 21 */
-	"shutting down",			/* 22 */
-	"not found",				/* 23 */
-	"unexpected end of input",		/* 24 */
-	"failure",				/* 25 */
-	"I/O error",				/* 26 */
-	"not implemented",			/* 27 */
-	"unbalanced parentheses",		/* 28 */
-	"no more",				/* 29 */
-	"invalid file",				/* 30 */
-	"bad base64 encoding",			/* 31 */
-	"unexpected token",			/* 32 */
-	"quota reached",			/* 33 */
-	"unexpected error",			/* 34 */
-	"already running",			/* 35 */
-	"ignore",				/* 36 */
-	"address mask not contiguous",		/* 37 */
-	"file not found",			/* 38 */
-	"file already exists",			/* 39 */
-	"socket is not connected",		/* 40 */
-	"out of range",				/* 41 */
-	"out of entropy",			/* 42 */
-	"invalid use of multicast address",	/* 43 */
-	"not a file",				/* 44 */
-	"not a directory",			/* 45 */
-	"queue is full",			/* 46 */
-	"address family mismatch",		/* 47 */
-	"address family not supported",		/* 48 */
-	"bad hex encoding",			/* 49 */
-	"too many open files",			/* 50 */
-	"not blocking",				/* 51 */
-	"unbalanced quotes",			/* 52 */
-	"operation in progress",		/* 53 */
-	"connection reset",			/* 54 */
-	"soft quota reached",			/* 55 */
-	"not a valid number",			/* 56 */
-	"disabled",				/* 57 */
-	"max size",				/* 58 */
-	"invalid address format"		/* 59 */
+	"success",				/*%< 0 */
+	"out of memory",			/*%< 1 */
+	"timed out",				/*%< 2 */
+	"no available threads",			/*%< 3 */
+	"address not available",		/*%< 4 */
+	"address in use",			/*%< 5 */
+	"permission denied",			/*%< 6 */
+	"no pending connections",		/*%< 7 */
+	"network unreachable",			/*%< 8 */
+	"host unreachable",			/*%< 9 */
+	"network down",				/*%< 10 */
+	"host down",				/*%< 11 */
+	"connection refused",			/*%< 12 */
+	"not enough free resources",		/*%< 13 */
+	"end of file",				/*%< 14 */
+	"socket already bound",			/*%< 15 */
+	"reload",				/*%< 16 */
+	"lock busy",				/*%< 17 */
+	"already exists",			/*%< 18 */
+	"ran out of space",			/*%< 19 */
+	"operation canceled",			/*%< 20 */
+	"socket is not bound",			/*%< 21 */
+	"shutting down",			/*%< 22 */
+	"not found",				/*%< 23 */
+	"unexpected end of input",		/*%< 24 */
+	"failure",				/*%< 25 */
+	"I/O error",				/*%< 26 */
+	"not implemented",			/*%< 27 */
+	"unbalanced parentheses",		/*%< 28 */
+	"no more",				/*%< 29 */
+	"invalid file",				/*%< 30 */
+	"bad base64 encoding",			/*%< 31 */
+	"unexpected token",			/*%< 32 */
+	"quota reached",			/*%< 33 */
+	"unexpected error",			/*%< 34 */
+	"already running",			/*%< 35 */
+	"ignore",				/*%< 36 */
+	"address mask not contiguous",		/*%< 37 */
+	"file not found",			/*%< 38 */
+	"file already exists",			/*%< 39 */
+	"socket is not connected",		/*%< 40 */
+	"out of range",				/*%< 41 */
+	"out of entropy",			/*%< 42 */
+	"invalid use of multicast address",	/*%< 43 */
+	"not a file",				/*%< 44 */
+	"not a directory",			/*%< 45 */
+	"queue is full",			/*%< 46 */
+	"address family mismatch",		/*%< 47 */
+	"address family not supported",		/*%< 48 */
+	"bad hex encoding",			/*%< 49 */
+	"too many open files",			/*%< 50 */
+	"not blocking",				/*%< 51 */
+	"unbalanced quotes",			/*%< 52 */
+	"operation in progress",		/*%< 53 */
+	"connection reset",			/*%< 54 */
+	"soft quota reached",			/*%< 55 */
+	"not a valid number",			/*%< 56 */
+	"disabled",				/*%< 57 */
+	"max size",				/*%< 58 */
+	"invalid address format"		/*%< 59 */
 };
 
 #define ISC_RESULT_RESULTSET			2
diff --git a/contrib/bind9/lib/isc/rwlock.c b/contrib/bind9/lib/isc/rwlock.c
index 3e444d8..69b8f56 100644
--- a/contrib/bind9/lib/isc/rwlock.c
+++ b/contrib/bind9/lib/isc/rwlock.c
@@ -15,12 +15,15 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rwlock.c,v 1.33.2.4.2.3 2005/03/17 03:58:32 marka Exp $ */
+/* $Id: rwlock.c,v 1.37.18.5 2005/07/12 01:22:30 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
 #include <stddef.h>
 
+#include <isc/atomic.h>
 #include <isc/magic.h>
 #include <isc/msgs.h>
 #include <isc/platform.h>
@@ -81,6 +84,20 @@ isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
 	 */
 	rwl->magic = 0;
 
+#if defined(ISC_PLATFORM_HAVEXADD) && defined(ISC_PLATFORM_HAVECMPXCHG)
+	rwl->write_requests = 0;
+	rwl->write_completions = 0;
+	rwl->cnt_and_flag = 0;
+	rwl->readers_waiting = 0;
+	rwl->write_granted = 0;
+	if (read_quota != 0) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "read quota is not supported");
+	}
+	if (write_quota == 0)
+		write_quota = RWLOCK_DEFAULT_WRITE_QUOTA;
+	rwl->write_quota = write_quota;
+#else
 	rwl->type = isc_rwlocktype_read;
 	rwl->original = isc_rwlocktype_none;
 	rwl->active = 0;
@@ -93,15 +110,12 @@ isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
 	if (write_quota == 0)
 		write_quota = RWLOCK_DEFAULT_WRITE_QUOTA;
 	rwl->write_quota = write_quota;
+#endif
+
 	result = isc_mutex_init(&rwl->lock);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s: %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"),
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
 	result = isc_condition_init(&rwl->readable);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -111,7 +125,6 @@ isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
 				 isc_result_totext(result));
 		result = ISC_R_UNEXPECTED;
 		goto destroy_lock;
-
 	}
 	result = isc_condition_init(&rwl->writeable);
 	if (result != ISC_R_SUCCESS) {
@@ -136,6 +149,389 @@ isc_rwlock_init(isc_rwlock_t *rwl, unsigned int read_quota,
 	return (result);
 }
 
+void
+isc_rwlock_destroy(isc_rwlock_t *rwl) {
+	REQUIRE(VALID_RWLOCK(rwl));
+
+#if defined(ISC_PLATFORM_HAVEXADD) && defined(ISC_PLATFORM_HAVECMPXCHG)
+	REQUIRE(rwl->write_requests == rwl->write_completions &&
+		rwl->cnt_and_flag == 0 && rwl->readers_waiting == 0);
+#else
+	LOCK(&rwl->lock);
+	REQUIRE(rwl->active == 0 &&
+		rwl->readers_waiting == 0 &&
+		rwl->writers_waiting == 0);
+	UNLOCK(&rwl->lock);
+#endif
+
+	rwl->magic = 0;
+	(void)isc_condition_destroy(&rwl->readable);
+	(void)isc_condition_destroy(&rwl->writeable);
+	DESTROYLOCK(&rwl->lock);
+}
+
+#if defined(ISC_PLATFORM_HAVEXADD) && defined(ISC_PLATFORM_HAVECMPXCHG)
+
+/*
+ * When some architecture-dependent atomic operations are available,
+ * rwlock can be more efficient than the generic algorithm defined below.
+ * The basic algorithm is described in the following URL:
+ *   http://www.cs.rochester.edu/u/scott/synchronization/pseudocode/rw.html
+ *
+ * The key is to use the following integer variables modified atomically:
+ *   write_requests, write_completions, and cnt_and_flag.
+ *
+ * write_requests and write_completions act as a waiting queue for writers
+ * in order to ensure the FIFO order.  Both variables begin with the initial
+ * value of 0.  When a new writer tries to get a write lock, it increments
+ * write_requests and gets the previous value of the variable as a "ticket".
+ * When write_completions reaches the ticket number, the new writer can start
+ * writing.  When the writer completes its work, it increments
+ * write_completions so that another new writer can start working.  If the
+ * write_requests is not equal to write_completions, it means a writer is now
+ * working or waiting.  In this case, a new readers cannot start reading, or
+ * in other words, this algorithm basically prefers writers.
+ *
+ * cnt_and_flag is a "lock" shared by all readers and writers.  This integer
+ * variable is a kind of structure with two members: writer_flag (1 bit) and
+ * reader_count (31 bits).  The writer_flag shows whether a writer is working,
+ * and the reader_count shows the number of readers currently working or almost
+ * ready for working.  A writer who has the current "ticket" tries to get the
+ * lock by exclusively setting the writer_flag to 1, provided that the whole
+ * 32-bit is 0 (meaning no readers or writers working).  On the other hand,
+ * a new reader tries to increment the "reader_count" field provided that
+ * the writer_flag is 0 (meaning there is no writer working).
+ *
+ * If some of the above operations fail, the reader or the writer sleeps
+ * until the related condition changes.  When a working reader or writer
+ * completes its work, some readers or writers are sleeping, and the condition
+ * that suspended the reader or writer has changed, it wakes up the sleeping
+ * readers or writers.
+ *
+ * As already noted, this algorithm basically prefers writers.  In order to
+ * prevent readers from starving, however, the algorithm also introduces the
+ * "writer quota" (Q).  When Q consecutive writers have completed their work,
+ * suspending readers, the last writer will wake up the readers, even if a new
+ * writer is waiting.
+ *
+ * Implementation specific note: due to the combination of atomic operations
+ * and a mutex lock, ordering between the atomic operation and locks can be
+ * very sensitive in some cases.  In particular, it is generally very important
+ * to check the atomic variable that requires a reader or writer to sleep after
+ * locking the mutex and before actually sleeping; otherwise, it could be very
+ * likely to cause a deadlock.  For example, assume "var" is a variable
+ * atomically modified, then the corresponding code would be:
+ *	if (var == need_sleep) {
+ *		LOCK(lock);
+ *		if (var == need_sleep)
+ *			WAIT(cond, lock);
+ *		UNLOCK(lock);
+ *	}
+ * The second check is important, since "var" is protected by the atomic
+ * operation, not by the mutex, and can be changed just before sleeping.
+ * (The first "if" could be omitted, but this is also important in order to
+ * make the code efficient by avoiding the use of the mutex unless it is
+ * really necessary.)
+ */
+
+#define WRITER_ACTIVE	0x1
+#define READER_INCR	0x2
+
+isc_result_t
+isc_rwlock_lock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
+	isc_int32_t cntflag;
+
+	REQUIRE(VALID_RWLOCK(rwl));
+
+#ifdef ISC_RWLOCK_TRACE
+	print_lock(isc_msgcat_get(isc_msgcat, ISC_MSGSET_RWLOCK,
+				  ISC_MSG_PRELOCK, "prelock"), rwl, type);
+#endif
+
+	if (type == isc_rwlocktype_read) {
+		if (rwl->write_requests != rwl->write_completions) {
+			/* there is a waiting or active writer */
+			LOCK(&rwl->lock);
+			if (rwl->write_requests != rwl->write_completions) {
+				rwl->readers_waiting++;
+				WAIT(&rwl->readable, &rwl->lock);
+				rwl->readers_waiting--;
+			}
+			UNLOCK(&rwl->lock);
+		}
+
+		cntflag = isc_atomic_xadd(&rwl->cnt_and_flag, READER_INCR);
+		while (1) {
+			if ((rwl->cnt_and_flag & WRITER_ACTIVE) == 0)
+				break;
+
+			/* A writer is still working */
+			LOCK(&rwl->lock);
+			rwl->readers_waiting++;
+			if ((rwl->cnt_and_flag & WRITER_ACTIVE) != 0)
+				WAIT(&rwl->readable, &rwl->lock);
+			rwl->readers_waiting--;
+			UNLOCK(&rwl->lock);
+
+			/*
+			 * Typically, the reader should be able to get a lock
+			 * at this stage:
+			 *   (1) there should have been no pending writer when
+			 *       the reader was trying to increment the
+			 *       counter; otherwise, the writer should be in
+			 *       the waiting queue, preventing the reader from
+			 *       proceeding to this point.
+			 *   (2) once the reader increments the counter, no
+			 *       more writer can get a lock.
+			 * Still, it is possible another writer can work at
+			 * this point, e.g. in the following scenario:
+			 *   A previous writer unlocks the writer lock.
+			 *   This reader proceeds to point (1).
+			 *   A new writer appears, and gets a new lock before
+			 *   the reader increments the counter.
+			 *   The reader then increments the counter.
+			 *   The previous writer notices there is a waiting
+			 *   reader who is almost ready, and wakes it up.
+			 * So, the reader needs to confirm whether it can now
+			 * read explicitly (thus we loop).  Note that this is
+			 * not an infinite process, since the reader has
+			 * incremented the counter at this point.
+			 */
+		}
+
+		/*
+		 * If we are temporarily preferred to writers due to the writer
+		 * quota, reset the condition (race among readers doesn't
+		 * matter).
+		 */
+		rwl->write_granted = 0;
+	} else {
+		isc_int32_t prev_writer;
+
+		/* enter the waiting queue, and wait for our turn */
+		prev_writer = isc_atomic_xadd(&rwl->write_requests, 1);
+		while (rwl->write_completions != prev_writer) {
+			LOCK(&rwl->lock);
+			if (rwl->write_completions != prev_writer) {
+				WAIT(&rwl->writeable, &rwl->lock);
+				UNLOCK(&rwl->lock);
+				continue;
+			}
+			UNLOCK(&rwl->lock);
+			break;
+		}
+
+		while (1) {
+			cntflag = isc_atomic_cmpxchg(&rwl->cnt_and_flag, 0,
+						     WRITER_ACTIVE);
+			if (cntflag == 0)
+				break;
+
+			/* Another active reader or writer is working. */
+			LOCK(&rwl->lock);
+			if (rwl->cnt_and_flag != 0)
+				WAIT(&rwl->writeable, &rwl->lock);
+			UNLOCK(&rwl->lock);
+		}
+
+		INSIST((rwl->cnt_and_flag & WRITER_ACTIVE) != 0);
+		rwl->write_granted++;
+	}
+
+#ifdef ISC_RWLOCK_TRACE
+	print_lock(isc_msgcat_get(isc_msgcat, ISC_MSGSET_RWLOCK,
+				  ISC_MSG_POSTLOCK, "postlock"), rwl, type);
+#endif
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isc_rwlock_trylock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
+	isc_int32_t cntflag;
+
+	REQUIRE(VALID_RWLOCK(rwl));
+
+#ifdef ISC_RWLOCK_TRACE
+	print_lock(isc_msgcat_get(isc_msgcat, ISC_MSGSET_RWLOCK,
+				  ISC_MSG_PRELOCK, "prelock"), rwl, type);
+#endif
+
+	if (type == isc_rwlocktype_read) {
+		/* If a writer is waiting or working, we fail. */
+		if (rwl->write_requests != rwl->write_completions)
+			return (ISC_R_LOCKBUSY);
+
+		/* Otherwise, be ready for reading. */
+		cntflag = isc_atomic_xadd(&rwl->cnt_and_flag, READER_INCR);
+		if ((cntflag & WRITER_ACTIVE) != 0) {
+			/*
+			 * A writer is working.  We lose, and cancel the read
+			 * request.
+			 */
+			cntflag = isc_atomic_xadd(&rwl->cnt_and_flag,
+						  -READER_INCR);
+			/*
+			 * If no other readers are waiting and we've suspended
+			 * new writers in this short period, wake them up.
+			 */
+			if (cntflag == READER_INCR &&
+			    rwl->write_completions != rwl->write_requests) {
+				LOCK(&rwl->lock);
+				BROADCAST(&rwl->writeable);
+				UNLOCK(&rwl->lock);
+			}
+			
+			return (ISC_R_LOCKBUSY);
+		}
+	} else {
+		/* Try locking without entering the waiting queue. */
+		cntflag = isc_atomic_cmpxchg(&rwl->cnt_and_flag, 0,
+					     WRITER_ACTIVE);
+		if (cntflag != 0)
+			return (ISC_R_LOCKBUSY);
+
+		/*
+		 * XXXJT: jump into the queue, possibly breaking the writer
+		 * order.
+		 */
+		(void)isc_atomic_xadd(&rwl->write_completions, -1);
+
+		rwl->write_granted++;
+	}
+
+#ifdef ISC_RWLOCK_TRACE
+	print_lock(isc_msgcat_get(isc_msgcat, ISC_MSGSET_RWLOCK,
+				  ISC_MSG_POSTLOCK, "postlock"), rwl, type);
+#endif
+
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isc_rwlock_tryupgrade(isc_rwlock_t *rwl) {
+	isc_int32_t prevcnt;
+
+	REQUIRE(VALID_RWLOCK(rwl));
+
+	/* Try to acquire write access. */
+	prevcnt = isc_atomic_cmpxchg(&rwl->cnt_and_flag,
+				     READER_INCR, WRITER_ACTIVE);
+	/*
+	 * There must have been no writer, and there must have been at least
+	 * one reader.
+	 */
+	INSIST((prevcnt & WRITER_ACTIVE) == 0 &&
+	       (prevcnt & ~WRITER_ACTIVE) != 0);
+
+	if (prevcnt == READER_INCR) {
+		/*
+		 * We are the only reader and have been upgraded.
+		 * Now jump into the head of the writer waiting queue.
+		 */
+		(void)isc_atomic_xadd(&rwl->write_completions, -1);
+	} else
+		return (ISC_R_LOCKBUSY);
+
+	return (ISC_R_SUCCESS);
+	
+}
+
+void
+isc_rwlock_downgrade(isc_rwlock_t *rwl) {
+	isc_int32_t prev_readers;
+
+	REQUIRE(VALID_RWLOCK(rwl));
+
+	/* Become an active reader. */
+	prev_readers = isc_atomic_xadd(&rwl->cnt_and_flag, READER_INCR);
+	/* We must have been a writer. */
+	INSIST((prev_readers & WRITER_ACTIVE) != 0);
+
+	/* Complete write */
+	(void)isc_atomic_xadd(&rwl->cnt_and_flag, -WRITER_ACTIVE);
+	(void)isc_atomic_xadd(&rwl->write_completions, 1);
+
+	/* Resume other readers */
+	LOCK(&rwl->lock);
+	if (rwl->readers_waiting > 0)
+		BROADCAST(&rwl->readable);
+	UNLOCK(&rwl->lock);
+}
+
+isc_result_t
+isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
+	isc_int32_t prev_cnt;
+
+	REQUIRE(VALID_RWLOCK(rwl));
+
+#ifdef ISC_RWLOCK_TRACE
+	print_lock(isc_msgcat_get(isc_msgcat, ISC_MSGSET_RWLOCK,
+				  ISC_MSG_PREUNLOCK, "preunlock"), rwl, type);
+#endif
+
+	if (type == isc_rwlocktype_read) {
+		prev_cnt = isc_atomic_xadd(&rwl->cnt_and_flag, -READER_INCR);
+
+		/*
+		 * If we're the last reader and any writers are waiting, wake
+		 * them up.  We need to wake up all of them to ensure the
+		 * FIFO order.
+		 */
+		if (prev_cnt == READER_INCR &&
+		    rwl->write_completions != rwl->write_requests) {
+			LOCK(&rwl->lock);
+			BROADCAST(&rwl->writeable);
+			UNLOCK(&rwl->lock);
+		}
+	} else {
+		isc_boolean_t wakeup_writers = ISC_TRUE;
+
+		/*
+		 * Reset the flag, and (implicitly) tell other writers
+		 * we are done.
+		 */
+		(void)isc_atomic_xadd(&rwl->cnt_and_flag, -WRITER_ACTIVE);
+		(void)isc_atomic_xadd(&rwl->write_completions, 1);
+
+		if (rwl->write_granted >= rwl->write_quota ||
+		    rwl->write_requests == rwl->write_completions ||
+		    (rwl->cnt_and_flag & ~WRITER_ACTIVE) != 0) {
+			/*
+			 * We have passed the write quota, no writer is
+			 * waiting, or some readers are almost ready, pending
+			 * possible writers.  Note that the last case can
+			 * happen even if write_requests != write_completions
+			 * (which means a new writer in the queue), so we need
+			 * to catch the case explicitly.
+			 */
+			LOCK(&rwl->lock);
+			if (rwl->readers_waiting > 0) {
+				wakeup_writers = ISC_FALSE;
+				BROADCAST(&rwl->readable);
+			}
+			UNLOCK(&rwl->lock);
+		}
+
+		if (rwl->write_requests != rwl->write_completions &&
+		    wakeup_writers) {
+			LOCK(&rwl->lock);
+			BROADCAST(&rwl->writeable);
+			UNLOCK(&rwl->lock);
+		}
+	}
+
+#ifdef ISC_RWLOCK_TRACE
+	print_lock(isc_msgcat_get(isc_msgcat, ISC_MSGSET_RWLOCK,
+				  ISC_MSG_POSTUNLOCK, "postunlock"),
+		   rwl, type);
+#endif
+
+	return (ISC_R_SUCCESS);
+}
+
+#else /* ISC_PLATFORM_HAVEXADD && ISC_PLATFORM_HAVECMPXCHG */
+
 static isc_result_t
 doit(isc_rwlock_t *rwl, isc_rwlocktype_t type, isc_boolean_t nonblock) {
 	isc_boolean_t skip = ISC_FALSE;
@@ -321,22 +717,7 @@ isc_rwlock_unlock(isc_rwlock_t *rwl, isc_rwlocktype_t type) {
 	return (ISC_R_SUCCESS);
 }
 
-void
-isc_rwlock_destroy(isc_rwlock_t *rwl) {
-	REQUIRE(VALID_RWLOCK(rwl));
-
-	LOCK(&rwl->lock);
-	REQUIRE(rwl->active == 0 &&
-		rwl->readers_waiting == 0 &&
-		rwl->writers_waiting == 0);
-	UNLOCK(&rwl->lock);
-
-	rwl->magic = 0;
-	(void)isc_condition_destroy(&rwl->readable);
-	(void)isc_condition_destroy(&rwl->writeable);
-	DESTROYLOCK(&rwl->lock);
-}
-
+#endif /* ISC_PLATFORM_HAVEXADD && ISC_PLATFORM_HAVECMPXCHG */
 #else /* ISC_PLATFORM_USETHREADS */
 
 isc_result_t
diff --git a/contrib/bind9/lib/isc/serial.c b/contrib/bind9/lib/isc/serial.c
index 4fe0ee5..5d1bde7 100644
--- a/contrib/bind9/lib/isc/serial.c
+++ b/contrib/bind9/lib/isc/serial.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: serial.c,v 1.7.206.1 2004/03/06 08:14:35 marka Exp $ */
+/* $Id: serial.c,v 1.8.18.2 2005/04/29 00:16:49 marka Exp $ */
+
+/*! \file */
+
 #include <config.h>
 
 #include <isc/serial.h>
diff --git a/contrib/bind9/lib/isc/sha1.c b/contrib/bind9/lib/isc/sha1.c
index 0549e88..6f4af6d 100644
--- a/contrib/bind9/lib/isc/sha1.c
+++ b/contrib/bind9/lib/isc/sha1.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,16 +15,16 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sha1.c,v 1.10.2.2.2.3 2004/03/06 08:14:35 marka Exp $ */
+/* $Id: sha1.c,v 1.14.18.2 2005/04/29 00:16:49 marka Exp $ */
 
 /*	$NetBSD: sha1.c,v 1.5 2000/01/22 22:19:14 mycroft Exp $	*/
 /*	$OpenBSD: sha1.c,v 1.9 1997/07/23 21:12:32 kstailey Exp $	*/
 
-/*
+/*! \file
  * SHA-1 in C
- * By Steve Reid <steve@edmweb.com>
+ * \author By Steve Reid <steve@edmweb.com>
  * 100% Public Domain
- *
+ * \verbatim
  * Test Vectors (from FIPS PUB 180-1)
  * "abc"
  *   A9993E36 4706816A BA3E2571 7850C26C 9CD0D89D
@@ -32,6 +32,7 @@
  *   84983E44 1C3BD26E BAAE4AA1 F95129E5 E54670F1
  * A million repetitions of "a"
  *   34AA973C D4C4DAA4 F61EEB2B DBAD2731 6534016F
+ * \endverbatim
  */
 
 #include "config.h"
@@ -44,7 +45,8 @@
 
 #define rol(value, bits) (((value) << (bits)) | ((value) >> (32 - (bits))))
 
-/*
+/*@{*/
+/*!
  * blk0() and blk() perform the initial expand.
  * I got the idea of expanding during the round function from SSLeay
  */
@@ -61,7 +63,9 @@
 				^ block->l[(i + 2) & 15] \
 				^ block->l[i & 15], 1))
 
-/*
+/*@}*/
+/*@{*/
+/*!
  * (R0+R1), R2, R3, R4 are the different operations (rounds) used in SHA1
  */
 #define R0(v,w,x,y,z,i) \
@@ -80,6 +84,8 @@
 	z += (w ^ x ^ y) + blk(i) + 0xCA62C1D6 + rol(v, 5); \
 	w = rol(w, 30);
 
+/*@}*/
+
 typedef union {
 	unsigned char c[64];
 	unsigned int l[16];
@@ -154,7 +160,7 @@ do_R4(isc_uint32_t *a, isc_uint32_t *b, isc_uint32_t *c, isc_uint32_t *d,
 }
 #endif
 
-/*
+/*!
  * Hash a single 512-bit block. This is the core of the algorithm.
  */
 static void
@@ -217,7 +223,7 @@ transform(isc_uint32_t state[5], const unsigned char buffer[64]) {
 }
 
 
-/*
+/*!
  * isc_sha1_init - Initialize new context
  */
 void
@@ -240,7 +246,7 @@ isc_sha1_invalidate(isc_sha1_t *context) {
 	memset(context, 0, sizeof(isc_sha1_t));
 }
 
-/*
+/*!
  * Run your data through this.
  */
 void
@@ -270,7 +276,7 @@ isc_sha1_update(isc_sha1_t *context, const unsigned char *data,
 }
 
 
-/*
+/*!
  * Add padding and return the message digest.
  */
 
diff --git a/contrib/bind9/lib/isc/sha2.c b/contrib/bind9/lib/isc/sha2.c
new file mode 100644
index 0000000..7b41a28
--- /dev/null
+++ b/contrib/bind9/lib/isc/sha2.c
@@ -0,0 +1,1234 @@
+/*
+ * Copyright (C) 2005, 2006  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: sha2.c,v 1.2.2.12 2006/08/16 03:18:14 marka Exp $ */
+
+/*	$FreeBSD$	*/
+/*	$KAME: sha2.c,v 1.8 2001/11/08 01:07:52 itojun Exp $	*/
+
+/*
+ * sha2.c
+ *
+ * Version 1.0.0beta1
+ *
+ * Written by Aaron D. Gifford <me@aarongifford.com>
+ *
+ * Copyright 2000 Aaron D. Gifford.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the copyright holder nor the names of contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */
+
+
+#include <config.h>
+
+#include <isc/assertions.h>
+#include <isc/sha2.h>
+#include <isc/string.h>
+#include <isc/util.h>
+
+/*
+ * UNROLLED TRANSFORM LOOP NOTE:
+ * You can define SHA2_UNROLL_TRANSFORM to use the unrolled transform
+ * loop version for the hash transform rounds (defined using macros
+ * later in this file).  Either define on the command line, for example:
+ *
+ *   cc -DISC_SHA2_UNROLL_TRANSFORM -o sha2 sha2.c sha2prog.c
+ *
+ * or define below:
+ *
+ *   #define ISC_SHA2_UNROLL_TRANSFORM
+ *
+ */
+
+/*** SHA-256/384/512 Machine Architecture Definitions *****************/
+/*
+ * BYTE_ORDER NOTE:
+ *
+ * Please make sure that your system defines BYTE_ORDER.  If your
+ * architecture is little-endian, make sure it also defines
+ * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
+ * equivilent.
+ *
+ * If your system does not define the above, then you can do so by
+ * hand like this:
+ *
+ *   #define LITTLE_ENDIAN 1234
+ *   #define BIG_ENDIAN    4321
+ *
+ * And for little-endian machines, add:
+ *
+ *   #define BYTE_ORDER LITTLE_ENDIAN 
+ *
+ * Or for big-endian machines:
+ *
+ *   #define BYTE_ORDER BIG_ENDIAN
+ *
+ * The FreeBSD machine this was written on defines BYTE_ORDER
+ * appropriately by including <sys/types.h> (which in turn includes
+ * <machine/endian.h> where the appropriate definitions are actually
+ * made).
+ */
+#if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN)
+#ifndef BYTE_ORDER
+#ifndef BIG_ENDIAN
+#define BIG_ENDIAN 4321
+#endif
+#ifndef LITTLE_ENDIAN
+#define LITTLE_ENDIAN 1234
+#endif
+#ifdef WORDS_BIGENDIAN
+#define BYTE_ORDER BIG_ENDIAN
+#else
+#define BYTE_ORDER LITTLE_ENDIAN
+#endif
+#else
+#error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN
+#endif
+#endif
+
+/*** SHA-256/384/512 Various Length Definitions ***********************/
+/* NOTE: Most of these are in sha2.h */
+#define ISC_SHA256_SHORT_BLOCK_LENGTH	(ISC_SHA256_BLOCK_LENGTH - 8)
+#define ISC_SHA384_SHORT_BLOCK_LENGTH	(ISC_SHA384_BLOCK_LENGTH - 16)
+#define ISC_SHA512_SHORT_BLOCK_LENGTH	(ISC_SHA512_BLOCK_LENGTH - 16)
+
+
+/*** ENDIAN REVERSAL MACROS *******************************************/
+#if BYTE_ORDER == LITTLE_ENDIAN
+#define REVERSE32(w,x)	{ \
+	isc_uint32_t tmp = (w); \
+	tmp = (tmp >> 16) | (tmp << 16); \
+	(x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \
+}
+#ifdef WIN32
+#define REVERSE64(w,x)	{ \
+	isc_uint64_t tmp = (w); \
+	tmp = (tmp >> 32) | (tmp << 32); \
+	tmp = ((tmp & 0xff00ff00ff00ff00UL) >> 8) | \
+	      ((tmp & 0x00ff00ff00ff00ffUL) << 8); \
+	(x) = ((tmp & 0xffff0000ffff0000UL) >> 16) | \
+	      ((tmp & 0x0000ffff0000ffffUL) << 16); \
+}
+#else
+#define REVERSE64(w,x)	{ \
+	isc_uint64_t tmp = (w); \
+	tmp = (tmp >> 32) | (tmp << 32); \
+	tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \
+	      ((tmp & 0x00ff00ff00ff00ffULL) << 8); \
+	(x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \
+	      ((tmp & 0x0000ffff0000ffffULL) << 16); \
+}
+#endif
+#endif /* BYTE_ORDER == LITTLE_ENDIAN */
+
+/*
+ * Macro for incrementally adding the unsigned 64-bit integer n to the
+ * unsigned 128-bit integer (represented using a two-element array of
+ * 64-bit words):
+ */
+#define ADDINC128(w,n)	{ \
+	(w)[0] += (isc_uint64_t)(n); \
+	if ((w)[0] < (n)) { \
+		(w)[1]++; \
+	} \
+}
+
+/*** THE SIX LOGICAL FUNCTIONS ****************************************/
+/*
+ * Bit shifting and rotation (used by the six SHA-XYZ logical functions:
+ *
+ *   NOTE:  The naming of R and S appears backwards here (R is a SHIFT and
+ *   S is a ROTATION) because the SHA-256/384/512 description document
+ *   (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this
+ *   same "backwards" definition.
+ */
+/* Shift-right (used in SHA-256, SHA-384, and SHA-512): */
+#define R(b,x) 		((x) >> (b))
+/* 32-bit Rotate-right (used in SHA-256): */
+#define S32(b,x)	(((x) >> (b)) | ((x) << (32 - (b))))
+/* 64-bit Rotate-right (used in SHA-384 and SHA-512): */
+#define S64(b,x)	(((x) >> (b)) | ((x) << (64 - (b))))
+
+/* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */
+#define Ch(x,y,z)	(((x) & (y)) ^ ((~(x)) & (z)))
+#define Maj(x,y,z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
+
+/* Four of six logical functions used in SHA-256: */
+#define Sigma0_256(x)	(S32(2,  (x)) ^ S32(13, (x)) ^ S32(22, (x)))
+#define Sigma1_256(x)	(S32(6,  (x)) ^ S32(11, (x)) ^ S32(25, (x)))
+#define sigma0_256(x)	(S32(7,  (x)) ^ S32(18, (x)) ^ R(3 ,   (x)))
+#define sigma1_256(x)	(S32(17, (x)) ^ S32(19, (x)) ^ R(10,   (x)))
+
+/* Four of six logical functions used in SHA-384 and SHA-512: */
+#define Sigma0_512(x)	(S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x)))
+#define Sigma1_512(x)	(S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x)))
+#define sigma0_512(x)	(S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7,   (x)))
+#define sigma1_512(x)	(S64(19, (x)) ^ S64(61, (x)) ^ R( 6,   (x)))
+
+/*** INTERNAL FUNCTION PROTOTYPES *************************************/
+/* NOTE: These should not be accessed directly from outside this
+ * library -- they are intended for private internal visibility/use
+ * only.
+ */
+void isc_sha512_last(isc_sha512_t *);
+void isc_sha256_transform(isc_sha256_t *, const isc_uint32_t*);
+void isc_sha512_transform(isc_sha512_t *, const isc_uint64_t*);
+
+
+/*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/
+/* Hash constant words K for SHA-224 and SHA-256: */
+static const isc_uint32_t K256[64] = {
+	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
+	0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
+	0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
+	0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
+	0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
+	0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
+	0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
+	0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
+	0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
+	0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
+	0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
+	0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
+	0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
+	0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
+	0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
+	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
+};
+
+/* Initial hash value H for SHA-224: */
+static const isc_uint32_t sha224_initial_hash_value[8] = {
+	0xc1059ed8UL,
+	0x367cd507UL,
+	0x3070dd17UL,
+	0xf70e5939UL,
+	0xffc00b31UL,
+	0x68581511UL,
+	0x64f98fa7UL,
+	0xbefa4fa4UL
+};
+
+/* Initial hash value H for SHA-256: */
+static const isc_uint32_t sha256_initial_hash_value[8] = {
+	0x6a09e667UL,
+	0xbb67ae85UL,
+	0x3c6ef372UL,
+	0xa54ff53aUL,
+	0x510e527fUL,
+	0x9b05688cUL,
+	0x1f83d9abUL,
+	0x5be0cd19UL
+};
+
+#ifdef WIN32
+/* Hash constant words K for SHA-384 and SHA-512: */
+static const isc_uint64_t K512[80] = {
+	0x428a2f98d728ae22UL, 0x7137449123ef65cdUL,
+	0xb5c0fbcfec4d3b2fUL, 0xe9b5dba58189dbbcUL,
+	0x3956c25bf348b538UL, 0x59f111f1b605d019UL,
+	0x923f82a4af194f9bUL, 0xab1c5ed5da6d8118UL,
+	0xd807aa98a3030242UL, 0x12835b0145706fbeUL,
+	0x243185be4ee4b28cUL, 0x550c7dc3d5ffb4e2UL,
+	0x72be5d74f27b896fUL, 0x80deb1fe3b1696b1UL,
+	0x9bdc06a725c71235UL, 0xc19bf174cf692694UL,
+	0xe49b69c19ef14ad2UL, 0xefbe4786384f25e3UL,
+	0x0fc19dc68b8cd5b5UL, 0x240ca1cc77ac9c65UL,
+	0x2de92c6f592b0275UL, 0x4a7484aa6ea6e483UL,
+	0x5cb0a9dcbd41fbd4UL, 0x76f988da831153b5UL,
+	0x983e5152ee66dfabUL, 0xa831c66d2db43210UL,
+	0xb00327c898fb213fUL, 0xbf597fc7beef0ee4UL,
+	0xc6e00bf33da88fc2UL, 0xd5a79147930aa725UL,
+	0x06ca6351e003826fUL, 0x142929670a0e6e70UL,
+	0x27b70a8546d22ffcUL, 0x2e1b21385c26c926UL,
+	0x4d2c6dfc5ac42aedUL, 0x53380d139d95b3dfUL,
+	0x650a73548baf63deUL, 0x766a0abb3c77b2a8UL,
+	0x81c2c92e47edaee6UL, 0x92722c851482353bUL,
+	0xa2bfe8a14cf10364UL, 0xa81a664bbc423001UL,
+	0xc24b8b70d0f89791UL, 0xc76c51a30654be30UL,
+	0xd192e819d6ef5218UL, 0xd69906245565a910UL,
+	0xf40e35855771202aUL, 0x106aa07032bbd1b8UL,
+	0x19a4c116b8d2d0c8UL, 0x1e376c085141ab53UL,
+	0x2748774cdf8eeb99UL, 0x34b0bcb5e19b48a8UL,
+	0x391c0cb3c5c95a63UL, 0x4ed8aa4ae3418acbUL,
+	0x5b9cca4f7763e373UL, 0x682e6ff3d6b2b8a3UL,
+	0x748f82ee5defb2fcUL, 0x78a5636f43172f60UL,
+	0x84c87814a1f0ab72UL, 0x8cc702081a6439ecUL,
+	0x90befffa23631e28UL, 0xa4506cebde82bde9UL,
+	0xbef9a3f7b2c67915UL, 0xc67178f2e372532bUL,
+	0xca273eceea26619cUL, 0xd186b8c721c0c207UL,
+	0xeada7dd6cde0eb1eUL, 0xf57d4f7fee6ed178UL,
+	0x06f067aa72176fbaUL, 0x0a637dc5a2c898a6UL,
+	0x113f9804bef90daeUL, 0x1b710b35131c471bUL,
+	0x28db77f523047d84UL, 0x32caab7b40c72493UL,
+	0x3c9ebe0a15c9bebcUL, 0x431d67c49c100d4cUL,
+	0x4cc5d4becb3e42b6UL, 0x597f299cfc657e2aUL,
+	0x5fcb6fab3ad6faecUL, 0x6c44198c4a475817UL
+};
+
+/* Initial hash value H for SHA-384: */
+static const isc_uint64_t sha384_initial_hash_value[8] = {
+	0xcbbb9d5dc1059ed8UL,
+	0x629a292a367cd507UL,
+	0x9159015a3070dd17UL,
+	0x152fecd8f70e5939UL,
+	0x67332667ffc00b31UL,
+	0x8eb44a8768581511UL,
+	0xdb0c2e0d64f98fa7UL,
+	0x47b5481dbefa4fa4UL
+};
+
+/* Initial hash value H for SHA-512: */
+static const isc_uint64_t sha512_initial_hash_value[8] = {
+	0x6a09e667f3bcc908U,
+	0xbb67ae8584caa73bUL,
+	0x3c6ef372fe94f82bUL,
+	0xa54ff53a5f1d36f1UL,
+	0x510e527fade682d1UL,
+	0x9b05688c2b3e6c1fUL,
+	0x1f83d9abfb41bd6bUL,
+	0x5be0cd19137e2179UL
+};
+#else
+/* Hash constant words K for SHA-384 and SHA-512: */
+static const isc_uint64_t K512[80] = {
+	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
+	0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
+	0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
+	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
+	0xd807aa98a3030242ULL, 0x12835b0145706fbeULL,
+	0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
+	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL,
+	0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
+	0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
+	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL,
+	0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL,
+	0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
+	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL,
+	0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL,
+	0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
+	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
+	0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL,
+	0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
+	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL,
+	0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
+	0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
+	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL,
+	0xd192e819d6ef5218ULL, 0xd69906245565a910ULL,
+	0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
+	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL,
+	0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL,
+	0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
+	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
+	0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL,
+	0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
+	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL,
+	0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
+	0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
+	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL,
+	0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL,
+	0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
+	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL,
+	0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL,
+	0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
+	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
+};
+
+/* Initial hash value H for SHA-384: */
+static const isc_uint64_t sha384_initial_hash_value[8] = {
+	0xcbbb9d5dc1059ed8ULL,
+	0x629a292a367cd507ULL,
+	0x9159015a3070dd17ULL,
+	0x152fecd8f70e5939ULL,
+	0x67332667ffc00b31ULL,
+	0x8eb44a8768581511ULL,
+	0xdb0c2e0d64f98fa7ULL,
+	0x47b5481dbefa4fa4ULL
+};
+
+/* Initial hash value H for SHA-512: */
+static const isc_uint64_t sha512_initial_hash_value[8] = {
+	0x6a09e667f3bcc908ULL,
+	0xbb67ae8584caa73bULL,
+	0x3c6ef372fe94f82bULL,
+	0xa54ff53a5f1d36f1ULL,
+	0x510e527fade682d1ULL,
+	0x9b05688c2b3e6c1fULL,
+	0x1f83d9abfb41bd6bULL,
+	0x5be0cd19137e2179ULL
+};
+#endif
+
+/*
+ * Constant used by SHA256/384/512_End() functions for converting the
+ * digest to a readable hexadecimal character string:
+ */
+static const char *sha2_hex_digits = "0123456789abcdef";
+
+
+
+/*** SHA-224: *********************************************************/
+void
+isc_sha224_init(isc_sha224_t *context) {
+	if (context == (isc_sha256_t *)0) {
+		return;
+	}
+	memcpy(context->state, sha224_initial_hash_value,
+	       ISC_SHA256_DIGESTLENGTH);
+	memset(context->buffer, 0, ISC_SHA256_BLOCK_LENGTH);
+	context->bitcount = 0;
+}
+
+void 
+isc_sha224_update(isc_sha224_t *context, const isc_uint8_t* data, size_t len) {
+	isc_sha256_update((isc_sha256_t *)context, data, len);
+}
+
+void 
+isc_sha224_final(isc_uint8_t digest[], isc_sha224_t *context) {
+	isc_uint8_t sha256_digest[ISC_SHA256_DIGESTLENGTH];
+	isc_sha256_final(sha256_digest, (isc_sha256_t *)context);
+	memcpy(digest, sha256_digest, ISC_SHA224_DIGESTLENGTH);
+	memset(sha256_digest, 0, ISC_SHA256_DIGESTLENGTH);
+}
+
+char *
+isc_sha224_end(isc_sha224_t *context, char buffer[]) {
+	isc_uint8_t	digest[ISC_SHA224_DIGESTLENGTH], *d = digest;
+	unsigned int	i;
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha224_t *)0);
+
+	if (buffer != (char*)0) {
+		isc_sha224_final(digest, context);
+
+		for (i = 0; i < ISC_SHA224_DIGESTLENGTH; i++) {
+			*buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
+			*buffer++ = sha2_hex_digits[*d & 0x0f];
+			d++;
+		}
+		*buffer = (char)0;
+	} else {
+		memset(context, 0, sizeof(context));
+	}
+	memset(digest, 0, ISC_SHA224_DIGESTLENGTH);
+	return buffer;
+}
+
+char*
+isc_sha224_data(const isc_uint8_t *data, size_t len,
+	        char digest[ISC_SHA224_DIGESTSTRINGLENGTH])
+{
+	isc_sha224_t context;
+
+	isc_sha224_init(&context);
+	isc_sha224_update(&context, data, len);
+	return (isc_sha224_end(&context, digest));
+}
+
+/*** SHA-256: *********************************************************/
+void
+isc_sha256_init(isc_sha256_t *context) {
+	if (context == (isc_sha256_t *)0) {
+		return;
+	}
+	memcpy(context->state, sha256_initial_hash_value,
+	       ISC_SHA256_DIGESTLENGTH);
+	memset(context->buffer, 0, ISC_SHA256_BLOCK_LENGTH);
+	context->bitcount = 0;
+}
+
+#ifdef ISC_SHA2_UNROLL_TRANSFORM
+
+/* Unrolled SHA-256 round macros: */
+
+#if BYTE_ORDER == LITTLE_ENDIAN
+
+#define ROUND256_0_TO_15(a,b,c,d,e,f,g,h)	\
+	REVERSE32(*data++, W256[j]); \
+	T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
+             K256[j] + W256[j]; \
+	(d) += T1; \
+	(h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
+	j++
+
+
+#else /* BYTE_ORDER == LITTLE_ENDIAN */
+
+#define ROUND256_0_TO_15(a,b,c,d,e,f,g,h)	\
+	T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
+	     K256[j] + (W256[j] = *data++); \
+	(d) += T1; \
+	(h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
+	j++
+
+#endif /* BYTE_ORDER == LITTLE_ENDIAN */
+
+#define ROUND256(a,b,c,d,e,f,g,h)	\
+	s0 = W256[(j+1)&0x0f]; \
+	s0 = sigma0_256(s0); \
+	s1 = W256[(j+14)&0x0f]; \
+	s1 = sigma1_256(s1); \
+	T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + K256[j] + \
+	     (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); \
+	(d) += T1; \
+	(h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
+	j++
+
+void isc_sha256_transform(isc_sha256_t *context, const isc_uint32_t* data) {
+	isc_uint32_t	a, b, c, d, e, f, g, h, s0, s1;
+	isc_uint32_t	T1, *W256;
+	int		j;
+
+	W256 = (isc_uint32_t*)context->buffer;
+
+	/* Initialize registers with the prev. intermediate value */
+	a = context->state[0];
+	b = context->state[1];
+	c = context->state[2];
+	d = context->state[3];
+	e = context->state[4];
+	f = context->state[5];
+	g = context->state[6];
+	h = context->state[7];
+
+	j = 0;
+	do {
+		/* Rounds 0 to 15 (unrolled): */
+		ROUND256_0_TO_15(a,b,c,d,e,f,g,h);
+		ROUND256_0_TO_15(h,a,b,c,d,e,f,g);
+		ROUND256_0_TO_15(g,h,a,b,c,d,e,f);
+		ROUND256_0_TO_15(f,g,h,a,b,c,d,e);
+		ROUND256_0_TO_15(e,f,g,h,a,b,c,d);
+		ROUND256_0_TO_15(d,e,f,g,h,a,b,c);
+		ROUND256_0_TO_15(c,d,e,f,g,h,a,b);
+		ROUND256_0_TO_15(b,c,d,e,f,g,h,a);
+	} while (j < 16);
+
+	/* Now for the remaining rounds to 64: */
+	do {
+		ROUND256(a,b,c,d,e,f,g,h);
+		ROUND256(h,a,b,c,d,e,f,g);
+		ROUND256(g,h,a,b,c,d,e,f);
+		ROUND256(f,g,h,a,b,c,d,e);
+		ROUND256(e,f,g,h,a,b,c,d);
+		ROUND256(d,e,f,g,h,a,b,c);
+		ROUND256(c,d,e,f,g,h,a,b);
+		ROUND256(b,c,d,e,f,g,h,a);
+	} while (j < 64);
+
+	/* Compute the current intermediate hash value */
+	context->state[0] += a;
+	context->state[1] += b;
+	context->state[2] += c;
+	context->state[3] += d;
+	context->state[4] += e;
+	context->state[5] += f;
+	context->state[6] += g;
+	context->state[7] += h;
+
+	/* Clean up */
+	a = b = c = d = e = f = g = h = T1 = 0;
+}
+
+#else /* ISC_SHA2_UNROLL_TRANSFORM */
+
+void
+isc_sha256_transform(isc_sha256_t *context, const isc_uint32_t* data) {
+	isc_uint32_t	a, b, c, d, e, f, g, h, s0, s1;
+	isc_uint32_t	T1, T2, *W256;
+	int		j;
+
+	W256 = (isc_uint32_t*)context->buffer;
+
+	/* Initialize registers with the prev. intermediate value */
+	a = context->state[0];
+	b = context->state[1];
+	c = context->state[2];
+	d = context->state[3];
+	e = context->state[4];
+	f = context->state[5];
+	g = context->state[6];
+	h = context->state[7];
+
+	j = 0;
+	do {
+#if BYTE_ORDER == LITTLE_ENDIAN
+		/* Copy data while converting to host byte order */
+		REVERSE32(*data++,W256[j]);
+		/* Apply the SHA-256 compression function to update a..h */
+		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + W256[j];
+#else /* BYTE_ORDER == LITTLE_ENDIAN */
+		/* Apply the SHA-256 compression function to update a..h with copy */
+		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + (W256[j] = *data++);
+#endif /* BYTE_ORDER == LITTLE_ENDIAN */
+		T2 = Sigma0_256(a) + Maj(a, b, c);
+		h = g;
+		g = f;
+		f = e;
+		e = d + T1;
+		d = c;
+		c = b;
+		b = a;
+		a = T1 + T2;
+
+		j++;
+	} while (j < 16);
+
+	do {
+		/* Part of the message block expansion: */
+		s0 = W256[(j+1)&0x0f];
+		s0 = sigma0_256(s0);
+		s1 = W256[(j+14)&0x0f];	
+		s1 = sigma1_256(s1);
+
+		/* Apply the SHA-256 compression function to update a..h */
+		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + 
+		     (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0);
+		T2 = Sigma0_256(a) + Maj(a, b, c);
+		h = g;
+		g = f;
+		f = e;
+		e = d + T1;
+		d = c;
+		c = b;
+		b = a;
+		a = T1 + T2;
+
+		j++;
+	} while (j < 64);
+
+	/* Compute the current intermediate hash value */
+	context->state[0] += a;
+	context->state[1] += b;
+	context->state[2] += c;
+	context->state[3] += d;
+	context->state[4] += e;
+	context->state[5] += f;
+	context->state[6] += g;
+	context->state[7] += h;
+
+	/* Clean up */
+	a = b = c = d = e = f = g = h = T1 = T2 = 0;
+}
+
+#endif /* ISC_SHA2_UNROLL_TRANSFORM */
+
+void
+isc_sha256_update(isc_sha256_t *context, const isc_uint8_t *data, size_t len) {
+	unsigned int	freespace, usedspace;
+
+	if (len == 0U) {
+		/* Calling with no data is valid - we do nothing */
+		return;
+	}
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha256_t *)0 && data != (isc_uint8_t*)0);
+
+	usedspace = (unsigned int)((context->bitcount >> 3) %
+				   ISC_SHA256_BLOCK_LENGTH);
+	if (usedspace > 0) {
+		/* Calculate how much free space is available in the buffer */
+		freespace = ISC_SHA256_BLOCK_LENGTH - usedspace;
+
+		if (len >= freespace) {
+			/* Fill the buffer completely and process it */
+			memcpy(&context->buffer[usedspace], data, freespace);
+			context->bitcount += freespace << 3;
+			len -= freespace;
+			data += freespace;
+			isc_sha256_transform(context,
+					     (isc_uint32_t*)context->buffer);
+		} else {
+			/* The buffer is not yet full */
+			memcpy(&context->buffer[usedspace], data, len);
+			context->bitcount += len << 3;
+			/* Clean up: */
+			usedspace = freespace = 0;
+			return;
+		}
+	}
+	while (len >= ISC_SHA256_BLOCK_LENGTH) {
+		/* Process as many complete blocks as we can */
+		memcpy(context->buffer, data, ISC_SHA256_BLOCK_LENGTH);
+		isc_sha256_transform(context, (isc_uint32_t*)context->buffer);
+		context->bitcount += ISC_SHA256_BLOCK_LENGTH << 3;
+		len -= ISC_SHA256_BLOCK_LENGTH;
+		data += ISC_SHA256_BLOCK_LENGTH;
+	}
+	if (len > 0U) {
+		/* There's left-overs, so save 'em */
+		memcpy(context->buffer, data, len);
+		context->bitcount += len << 3;
+	}
+	/* Clean up: */
+	usedspace = freespace = 0;
+}
+
+void
+isc_sha256_final(isc_uint8_t digest[], isc_sha256_t *context) {
+	isc_uint32_t	*d = (isc_uint32_t*)digest;
+	unsigned int	usedspace;
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha256_t *)0);
+
+	/* If no digest buffer is passed, we don't bother doing this: */
+	if (digest != (isc_uint8_t*)0) {
+		usedspace = (unsigned int)((context->bitcount >> 3) %
+					   ISC_SHA256_BLOCK_LENGTH);
+#if BYTE_ORDER == LITTLE_ENDIAN
+		/* Convert FROM host byte order */
+		REVERSE64(context->bitcount,context->bitcount);
+#endif
+		if (usedspace > 0) {
+			/* Begin padding with a 1 bit: */
+			context->buffer[usedspace++] = 0x80;
+
+			if (usedspace <= ISC_SHA256_SHORT_BLOCK_LENGTH) {
+				/* Set-up for the last transform: */
+				memset(&context->buffer[usedspace], 0,
+				       ISC_SHA256_SHORT_BLOCK_LENGTH - usedspace);
+			} else {
+				if (usedspace < ISC_SHA256_BLOCK_LENGTH) {
+					memset(&context->buffer[usedspace], 0,
+					       ISC_SHA256_BLOCK_LENGTH -
+					       usedspace);
+				}
+				/* Do second-to-last transform: */
+				isc_sha256_transform(context,
+					       (isc_uint32_t*)context->buffer);
+
+				/* And set-up for the last transform: */
+				memset(context->buffer, 0,
+				       ISC_SHA256_SHORT_BLOCK_LENGTH);
+			}
+		} else {
+			/* Set-up for the last transform: */
+			memset(context->buffer, 0, ISC_SHA256_SHORT_BLOCK_LENGTH);
+
+			/* Begin padding with a 1 bit: */
+			*context->buffer = 0x80;
+		}
+		/* Set the bit count: */
+		*(isc_uint64_t*)&context->buffer[ISC_SHA256_SHORT_BLOCK_LENGTH] = context->bitcount;
+
+		/* Final transform: */
+		isc_sha256_transform(context, (isc_uint32_t*)context->buffer);
+
+#if BYTE_ORDER == LITTLE_ENDIAN
+		{
+			/* Convert TO host byte order */
+			int	j;
+			for (j = 0; j < 8; j++) {
+				REVERSE32(context->state[j],context->state[j]);
+				*d++ = context->state[j];
+			}
+		}
+#else
+		memcpy(d, context->state, ISC_SHA256_DIGESTLENGTH);
+#endif
+	}
+
+	/* Clean up state data: */
+	memset(context, 0, sizeof(context));
+	usedspace = 0;
+}
+
+char *
+isc_sha256_end(isc_sha256_t *context, char buffer[]) {
+	isc_uint8_t	digest[ISC_SHA256_DIGESTLENGTH], *d = digest;
+	unsigned int	i;
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha256_t *)0);
+
+	if (buffer != (char*)0) {
+		isc_sha256_final(digest, context);
+
+		for (i = 0; i < ISC_SHA256_DIGESTLENGTH; i++) {
+			*buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
+			*buffer++ = sha2_hex_digits[*d & 0x0f];
+			d++;
+		}
+		*buffer = (char)0;
+	} else {
+		memset(context, 0, sizeof(context));
+	}
+	memset(digest, 0, ISC_SHA256_DIGESTLENGTH);
+	return buffer;
+}
+
+char *
+isc_sha256_data(const isc_uint8_t* data, size_t len,
+		char digest[ISC_SHA256_DIGESTSTRINGLENGTH])
+{
+	isc_sha256_t context;
+
+	isc_sha256_init(&context);
+	isc_sha256_update(&context, data, len);
+	return (isc_sha256_end(&context, digest));
+}
+
+
+/*** SHA-512: *********************************************************/
+void
+isc_sha512_init(isc_sha512_t *context) {
+	if (context == (isc_sha512_t *)0) {
+		return;
+	}
+	memcpy(context->state, sha512_initial_hash_value,
+	       ISC_SHA512_DIGESTLENGTH);
+	memset(context->buffer, 0, ISC_SHA512_BLOCK_LENGTH);
+	context->bitcount[0] = context->bitcount[1] =  0;
+}
+
+#ifdef ISC_SHA2_UNROLL_TRANSFORM
+
+/* Unrolled SHA-512 round macros: */
+#if BYTE_ORDER == LITTLE_ENDIAN
+
+#define ROUND512_0_TO_15(a,b,c,d,e,f,g,h)	\
+	REVERSE64(*data++, W512[j]); \
+	T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
+             K512[j] + W512[j]; \
+	(d) += T1, \
+	(h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)), \
+	j++
+
+
+#else /* BYTE_ORDER == LITTLE_ENDIAN */
+
+#define ROUND512_0_TO_15(a,b,c,d,e,f,g,h)	\
+	T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
+             K512[j] + (W512[j] = *data++); \
+	(d) += T1; \
+	(h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
+	j++
+
+#endif /* BYTE_ORDER == LITTLE_ENDIAN */
+
+#define ROUND512(a,b,c,d,e,f,g,h)	\
+	s0 = W512[(j+1)&0x0f]; \
+	s0 = sigma0_512(s0); \
+	s1 = W512[(j+14)&0x0f]; \
+	s1 = sigma1_512(s1); \
+	T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + K512[j] + \
+             (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); \
+	(d) += T1; \
+	(h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
+	j++
+
+void isc_sha512_transform(isc_sha512_t *context, const isc_uint64_t* data) {
+	isc_uint64_t	a, b, c, d, e, f, g, h, s0, s1;
+	isc_uint64_t	T1, *W512 = (isc_uint64_t*)context->buffer;
+	int		j;
+
+	/* Initialize registers with the prev. intermediate value */
+	a = context->state[0];
+	b = context->state[1];
+	c = context->state[2];
+	d = context->state[3];
+	e = context->state[4];
+	f = context->state[5];
+	g = context->state[6];
+	h = context->state[7];
+
+	j = 0;
+	do {
+		ROUND512_0_TO_15(a,b,c,d,e,f,g,h);
+		ROUND512_0_TO_15(h,a,b,c,d,e,f,g);
+		ROUND512_0_TO_15(g,h,a,b,c,d,e,f);
+		ROUND512_0_TO_15(f,g,h,a,b,c,d,e);
+		ROUND512_0_TO_15(e,f,g,h,a,b,c,d);
+		ROUND512_0_TO_15(d,e,f,g,h,a,b,c);
+		ROUND512_0_TO_15(c,d,e,f,g,h,a,b);
+		ROUND512_0_TO_15(b,c,d,e,f,g,h,a);
+	} while (j < 16);
+
+	/* Now for the remaining rounds up to 79: */
+	do {
+		ROUND512(a,b,c,d,e,f,g,h);
+		ROUND512(h,a,b,c,d,e,f,g);
+		ROUND512(g,h,a,b,c,d,e,f);
+		ROUND512(f,g,h,a,b,c,d,e);
+		ROUND512(e,f,g,h,a,b,c,d);
+		ROUND512(d,e,f,g,h,a,b,c);
+		ROUND512(c,d,e,f,g,h,a,b);
+		ROUND512(b,c,d,e,f,g,h,a);
+	} while (j < 80);
+
+	/* Compute the current intermediate hash value */
+	context->state[0] += a;
+	context->state[1] += b;
+	context->state[2] += c;
+	context->state[3] += d;
+	context->state[4] += e;
+	context->state[5] += f;
+	context->state[6] += g;
+	context->state[7] += h;
+
+	/* Clean up */
+	a = b = c = d = e = f = g = h = T1 = 0;
+}
+
+#else /* ISC_SHA2_UNROLL_TRANSFORM */
+
+void
+isc_sha512_transform(isc_sha512_t *context, const isc_uint64_t* data) {
+	isc_uint64_t	a, b, c, d, e, f, g, h, s0, s1;
+	isc_uint64_t	T1, T2, *W512 = (isc_uint64_t*)context->buffer;
+	int		j;
+
+	/* Initialize registers with the prev. intermediate value */
+	a = context->state[0];
+	b = context->state[1];
+	c = context->state[2];
+	d = context->state[3];
+	e = context->state[4];
+	f = context->state[5];
+	g = context->state[6];
+	h = context->state[7];
+
+	j = 0;
+	do {
+#if BYTE_ORDER == LITTLE_ENDIAN
+		/* Convert TO host byte order */
+		REVERSE64(*data++, W512[j]);
+		/* Apply the SHA-512 compression function to update a..h */
+		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j];
+#else /* BYTE_ORDER == LITTLE_ENDIAN */
+		/* Apply the SHA-512 compression function to update a..h with copy */
+		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + (W512[j] = *data++);
+#endif /* BYTE_ORDER == LITTLE_ENDIAN */
+		T2 = Sigma0_512(a) + Maj(a, b, c);
+		h = g;
+		g = f;
+		f = e;
+		e = d + T1;
+		d = c;
+		c = b;
+		b = a;
+		a = T1 + T2;
+
+		j++;
+	} while (j < 16);
+
+	do {
+		/* Part of the message block expansion: */
+		s0 = W512[(j+1)&0x0f];
+		s0 = sigma0_512(s0);
+		s1 = W512[(j+14)&0x0f];
+		s1 =  sigma1_512(s1);
+
+		/* Apply the SHA-512 compression function to update a..h */
+		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] +
+		     (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0);
+		T2 = Sigma0_512(a) + Maj(a, b, c);
+		h = g;
+		g = f;
+		f = e;
+		e = d + T1;
+		d = c;
+		c = b;
+		b = a;
+		a = T1 + T2;
+
+		j++;
+	} while (j < 80);
+
+	/* Compute the current intermediate hash value */
+	context->state[0] += a;
+	context->state[1] += b;
+	context->state[2] += c;
+	context->state[3] += d;
+	context->state[4] += e;
+	context->state[5] += f;
+	context->state[6] += g;
+	context->state[7] += h;
+
+	/* Clean up */
+	a = b = c = d = e = f = g = h = T1 = T2 = 0;
+}
+
+#endif /* ISC_SHA2_UNROLL_TRANSFORM */
+
+void isc_sha512_update(isc_sha512_t *context, const isc_uint8_t *data, size_t len) {
+	unsigned int	freespace, usedspace;
+
+	if (len == 0U) {
+		/* Calling with no data is valid - we do nothing */
+		return;
+	}
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha512_t *)0 && data != (isc_uint8_t*)0);
+
+	usedspace = (unsigned int)((context->bitcount[0] >> 3) %
+				   ISC_SHA512_BLOCK_LENGTH);
+	if (usedspace > 0) {
+		/* Calculate how much free space is available in the buffer */
+		freespace = ISC_SHA512_BLOCK_LENGTH - usedspace;
+
+		if (len >= freespace) {
+			/* Fill the buffer completely and process it */
+			memcpy(&context->buffer[usedspace], data, freespace);
+			ADDINC128(context->bitcount, freespace << 3);
+			len -= freespace;
+			data += freespace;
+			isc_sha512_transform(context,
+					     (isc_uint64_t*)context->buffer);
+		} else {
+			/* The buffer is not yet full */
+			memcpy(&context->buffer[usedspace], data, len);
+			ADDINC128(context->bitcount, len << 3);
+			/* Clean up: */
+			usedspace = freespace = 0;
+			return;
+		}
+	}
+	while (len >= ISC_SHA512_BLOCK_LENGTH) {
+		/* Process as many complete blocks as we can */
+		memcpy(context->buffer, data, ISC_SHA512_BLOCK_LENGTH);
+		isc_sha512_transform(context, (isc_uint64_t*)context->buffer);
+		ADDINC128(context->bitcount, ISC_SHA512_BLOCK_LENGTH << 3);
+		len -= ISC_SHA512_BLOCK_LENGTH;
+		data += ISC_SHA512_BLOCK_LENGTH;
+	}
+	if (len > 0U) {
+		/* There's left-overs, so save 'em */
+		memcpy(context->buffer, data, len);
+		ADDINC128(context->bitcount, len << 3);
+	}
+	/* Clean up: */
+	usedspace = freespace = 0;
+}
+
+void isc_sha512_last(isc_sha512_t *context) {
+	unsigned int	usedspace;
+
+	usedspace = (unsigned int)((context->bitcount[0] >> 3) %
+				    ISC_SHA512_BLOCK_LENGTH);
+#if BYTE_ORDER == LITTLE_ENDIAN
+	/* Convert FROM host byte order */
+	REVERSE64(context->bitcount[0],context->bitcount[0]);
+	REVERSE64(context->bitcount[1],context->bitcount[1]);
+#endif
+	if (usedspace > 0) {
+		/* Begin padding with a 1 bit: */
+		context->buffer[usedspace++] = 0x80;
+
+		if (usedspace <= ISC_SHA512_SHORT_BLOCK_LENGTH) {
+			/* Set-up for the last transform: */
+			memset(&context->buffer[usedspace], 0,
+			       ISC_SHA512_SHORT_BLOCK_LENGTH - usedspace);
+		} else {
+			if (usedspace < ISC_SHA512_BLOCK_LENGTH) {
+				memset(&context->buffer[usedspace], 0,
+				       ISC_SHA512_BLOCK_LENGTH - usedspace);
+			}
+			/* Do second-to-last transform: */
+			isc_sha512_transform(context,
+					    (isc_uint64_t*)context->buffer);
+
+			/* And set-up for the last transform: */
+			memset(context->buffer, 0, ISC_SHA512_BLOCK_LENGTH - 2);
+		}
+	} else {
+		/* Prepare for final transform: */
+		memset(context->buffer, 0, ISC_SHA512_SHORT_BLOCK_LENGTH);
+
+		/* Begin padding with a 1 bit: */
+		*context->buffer = 0x80;
+	}
+	/* Store the length of input data (in bits): */
+	*(isc_uint64_t*)&context->buffer[ISC_SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1];
+	*(isc_uint64_t*)&context->buffer[ISC_SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0];
+
+	/* Final transform: */
+	isc_sha512_transform(context, (isc_uint64_t*)context->buffer);
+}
+
+void isc_sha512_final(isc_uint8_t digest[], isc_sha512_t *context) {
+	isc_uint64_t	*d = (isc_uint64_t*)digest;
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha512_t *)0);
+
+	/* If no digest buffer is passed, we don't bother doing this: */
+	if (digest != (isc_uint8_t*)0) {
+		isc_sha512_last(context);
+
+		/* Save the hash data for output: */
+#if BYTE_ORDER == LITTLE_ENDIAN
+		{
+			/* Convert TO host byte order */
+			int	j;
+			for (j = 0; j < 8; j++) {
+				REVERSE64(context->state[j],context->state[j]);
+				*d++ = context->state[j];
+			}
+		}
+#else
+		memcpy(d, context->state, ISC_SHA512_DIGESTLENGTH);
+#endif
+	}
+
+	/* Zero out state data */
+	memset(context, 0, sizeof(context));
+}
+
+char *
+isc_sha512_end(isc_sha512_t *context, char buffer[]) {
+	isc_uint8_t	digest[ISC_SHA512_DIGESTLENGTH], *d = digest;
+	unsigned int	i;
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha512_t *)0);
+
+	if (buffer != (char*)0) {
+		isc_sha512_final(digest, context);
+
+		for (i = 0; i < ISC_SHA512_DIGESTLENGTH; i++) {
+			*buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
+			*buffer++ = sha2_hex_digits[*d & 0x0f];
+			d++;
+		}
+		*buffer = (char)0;
+	} else {
+		memset(context, 0, sizeof(context));
+	}
+	memset(digest, 0, ISC_SHA512_DIGESTLENGTH);
+	return buffer;
+}
+
+char *
+isc_sha512_data(const isc_uint8_t *data, size_t len,
+		char digest[ISC_SHA512_DIGESTSTRINGLENGTH])
+{
+	isc_sha512_t 	context;
+
+	isc_sha512_init(&context);
+	isc_sha512_update(&context, data, len);
+	return (isc_sha512_end(&context, digest));
+}
+
+
+/*** SHA-384: *********************************************************/
+void
+isc_sha384_init(isc_sha384_t *context) {
+	if (context == (isc_sha384_t *)0) {
+		return;
+	}
+	memcpy(context->state, sha384_initial_hash_value,
+	       ISC_SHA512_DIGESTLENGTH);
+	memset(context->buffer, 0, ISC_SHA384_BLOCK_LENGTH);
+	context->bitcount[0] = context->bitcount[1] = 0;
+}
+
+void 
+isc_sha384_update(isc_sha384_t *context, const isc_uint8_t* data, size_t len) {
+	isc_sha512_update((isc_sha512_t *)context, data, len);
+}
+
+void 
+isc_sha384_final(isc_uint8_t digest[], isc_sha384_t *context) {
+	isc_uint64_t	*d = (isc_uint64_t*)digest;
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha384_t *)0);
+
+	/* If no digest buffer is passed, we don't bother doing this: */
+	if (digest != (isc_uint8_t*)0) {
+		isc_sha512_last((isc_sha512_t *)context);
+
+		/* Save the hash data for output: */
+#if BYTE_ORDER == LITTLE_ENDIAN
+		{
+			/* Convert TO host byte order */
+			int	j;
+			for (j = 0; j < 6; j++) {
+				REVERSE64(context->state[j],context->state[j]);
+				*d++ = context->state[j];
+			}
+		}
+#else
+		memcpy(d, context->state, ISC_SHA384_DIGESTLENGTH);
+#endif
+	}
+
+	/* Zero out state data */
+	memset(context, 0, sizeof(context));
+}
+
+char *
+isc_sha384_end(isc_sha384_t *context, char buffer[]) {
+	isc_uint8_t	digest[ISC_SHA384_DIGESTLENGTH], *d = digest;
+	unsigned int	i;
+
+	/* Sanity check: */
+	REQUIRE(context != (isc_sha384_t *)0);
+
+	if (buffer != (char*)0) {
+		isc_sha384_final(digest, context);
+
+		for (i = 0; i < ISC_SHA384_DIGESTLENGTH; i++) {
+			*buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
+			*buffer++ = sha2_hex_digits[*d & 0x0f];
+			d++;
+		}
+		*buffer = (char)0;
+	} else {
+		memset(context, 0, sizeof(context));
+	}
+	memset(digest, 0, ISC_SHA384_DIGESTLENGTH);
+	return buffer;
+}
+
+char*
+isc_sha384_data(const isc_uint8_t *data, size_t len,
+	        char digest[ISC_SHA384_DIGESTSTRINGLENGTH])
+{
+	isc_sha384_t context;
+
+	isc_sha384_init(&context);
+	isc_sha384_update(&context, data, len);
+	return (isc_sha384_end(&context, digest));
+}
diff --git a/contrib/bind9/lib/isc/sockaddr.c b/contrib/bind9/lib/isc/sockaddr.c
index a40f0c9..2fd73af 100644
--- a/contrib/bind9/lib/isc/sockaddr.c
+++ b/contrib/bind9/lib/isc/sockaddr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sockaddr.c,v 1.48.2.1.2.12 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: sockaddr.c,v 1.59.18.9 2006/06/21 01:25:40 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -33,6 +35,21 @@
 
 isc_boolean_t
 isc_sockaddr_equal(const isc_sockaddr_t *a, const isc_sockaddr_t *b) {
+	return (isc_sockaddr_compare(a, b, ISC_SOCKADDR_CMPADDR|
+					   ISC_SOCKADDR_CMPPORT|
+					   ISC_SOCKADDR_CMPSCOPE));
+}
+
+isc_boolean_t
+isc_sockaddr_eqaddr(const isc_sockaddr_t *a, const isc_sockaddr_t *b) {
+	return (isc_sockaddr_compare(a, b, ISC_SOCKADDR_CMPADDR|
+					   ISC_SOCKADDR_CMPSCOPE));
+}
+
+isc_boolean_t
+isc_sockaddr_compare(const isc_sockaddr_t *a, const isc_sockaddr_t *b,
+		     unsigned int flags)
+{
 	REQUIRE(a != NULL && b != NULL);
 
 	if (a->length != b->length)
@@ -47,21 +64,33 @@ isc_sockaddr_equal(const isc_sockaddr_t *a, const isc_sockaddr_t *b) {
 		return (ISC_FALSE);
 	switch (a->type.sa.sa_family) {
 	case AF_INET:
-		if (memcmp(&a->type.sin.sin_addr, &b->type.sin.sin_addr,
+		if ((flags & ISC_SOCKADDR_CMPADDR) != 0 &&
+		    memcmp(&a->type.sin.sin_addr, &b->type.sin.sin_addr,
 			   sizeof(a->type.sin.sin_addr)) != 0)
 			return (ISC_FALSE);
-		if (a->type.sin.sin_port != b->type.sin.sin_port)
+		if ((flags & ISC_SOCKADDR_CMPPORT) != 0 &&
+		    a->type.sin.sin_port != b->type.sin.sin_port)
 			return (ISC_FALSE);
 		break;
 	case AF_INET6:
-		if (memcmp(&a->type.sin6.sin6_addr, &b->type.sin6.sin6_addr,
+		if ((flags & ISC_SOCKADDR_CMPADDR) != 0 &&
+		    memcmp(&a->type.sin6.sin6_addr, &b->type.sin6.sin6_addr,
 			   sizeof(a->type.sin6.sin6_addr)) != 0)
 			return (ISC_FALSE);
 #ifdef ISC_PLATFORM_HAVESCOPEID
-		if (a->type.sin6.sin6_scope_id != b->type.sin6.sin6_scope_id)
+		/*
+		 * If ISC_SOCKADDR_CMPSCOPEZERO is set then don't return
+		 * ISC_FALSE if one of the scopes in zero.
+		 */
+		if ((flags & ISC_SOCKADDR_CMPSCOPE) != 0 &&
+		    a->type.sin6.sin6_scope_id != b->type.sin6.sin6_scope_id &&
+		    ((flags & ISC_SOCKADDR_CMPSCOPEZERO) == 0 ||
+		      (a->type.sin6.sin6_scope_id != 0 &&
+		       b->type.sin6.sin6_scope_id != 0)))
 			return (ISC_FALSE);
 #endif
-		if (a->type.sin6.sin6_port != b->type.sin6.sin6_port)
+		if ((flags & ISC_SOCKADDR_CMPPORT) != 0 &&
+		    a->type.sin6.sin6_port != b->type.sin6.sin6_port)
 			return (ISC_FALSE);
 		break;
 	default:
@@ -72,37 +101,6 @@ isc_sockaddr_equal(const isc_sockaddr_t *a, const isc_sockaddr_t *b) {
 }
 
 isc_boolean_t
-isc_sockaddr_eqaddr(const isc_sockaddr_t *a, const isc_sockaddr_t *b) {
-	REQUIRE(a != NULL && b != NULL);
-
-	if (a->length != b->length)
-		return (ISC_FALSE);
-
-	if (a->type.sa.sa_family != b->type.sa.sa_family)
-		return (ISC_FALSE);
-	switch (a->type.sa.sa_family) {
-	case AF_INET:
-		if (memcmp(&a->type.sin.sin_addr, &b->type.sin.sin_addr,
-			   sizeof(a->type.sin.sin_addr)) != 0)
-			return (ISC_FALSE);
-		break;
-	case AF_INET6:
-		if (memcmp(&a->type.sin6.sin6_addr, &b->type.sin6.sin6_addr,
-			   sizeof(a->type.sin6.sin6_addr)) != 0)
-			return (ISC_FALSE);
-#ifdef ISC_PLATFORM_HAVESCOPEID
-		if (a->type.sin6.sin6_scope_id != b->type.sin6.sin6_scope_id)
-			return (ISC_FALSE);
-#endif
-		break;
-	default:
-		if (memcmp(&a->type, &b->type, a->length) != 0)
-			return (ISC_FALSE);
-	}
-	return (ISC_TRUE);
-}
-
-isc_boolean_t
 isc_sockaddr_eqaddrprefix(const isc_sockaddr_t *a, const isc_sockaddr_t *b,
 			  unsigned int prefixlen)
 {
@@ -134,6 +132,23 @@ isc_sockaddr_totext(const isc_sockaddr_t *sockaddr, isc_buffer_t *target) {
 	case AF_INET6:
 		snprintf(pbuf, sizeof(pbuf), "%u", ntohs(sockaddr->type.sin6.sin6_port));
 		break;
+#ifdef ISC_PLAFORM_HAVESYSUNH
+	case AF_UNIX:
+		plen = strlen(sockaddr->type.sunix.sun_path);
+		if (plen >= isc_buffer_availablelength(target))
+			return (ISC_R_NOSPACE);
+
+		isc_buffer_putmem(target, sockaddr->type.sunix.sun_path, plen);
+
+		/*
+		 * Null terminate after used region.
+		 */
+		isc_buffer_availableregion(target, &avail);
+		INSIST(avail.length >= 1);
+		avail.base[0] = '\0';
+
+		return (ISC_R_SUCCESS);
+#endif
 	default:
 		return (ISC_R_FAILURE);
 	}
@@ -425,8 +440,12 @@ isc_boolean_t
 isc_sockaddr_ismulticast(const isc_sockaddr_t *sockaddr) {
 	isc_netaddr_t netaddr;
 
-	isc_netaddr_fromsockaddr(&netaddr, sockaddr);
-	return (isc_netaddr_ismulticast(&netaddr));
+	if (sockaddr->type.sa.sa_family == AF_INET ||
+	    sockaddr->type.sa.sa_family == AF_INET6) {
+		isc_netaddr_fromsockaddr(&netaddr, sockaddr);
+		return (isc_netaddr_ismulticast(&netaddr));
+	}
+	return (ISC_FALSE);
 }
 
 isc_boolean_t
@@ -461,3 +480,24 @@ isc_sockaddr_islinklocal(const isc_sockaddr_t *sockaddr) {
 	}
 	return (ISC_FALSE);
 }
+
+isc_result_t
+isc_sockaddr_frompath(isc_sockaddr_t *sockaddr, const char *path) {
+#ifdef ISC_PLATFORM_HAVESYSUNH
+	if (strlen(path) >= sizeof(sockaddr->type.sunix.sun_path))
+		return (ISC_R_NOSPACE);
+	memset(sockaddr, 0, sizeof(*sockaddr));
+	sockaddr->length = sizeof(sockaddr->type.sunix);
+	sockaddr->type.sunix.sun_family = AF_UNIX;
+#ifdef ISC_PLATFORM_HAVESALEN
+	sockaddr->type.sunix.sun_len =
+			(unsigned char)sizeof(sockaddr->type.sunix);
+#endif
+	strcpy(sockaddr->type.sunix.sun_path, path);
+	return (ISC_R_SUCCESS);
+#else
+	UNUSED(sockaddr);
+	UNUSED(path);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif
+}
diff --git a/contrib/bind9/lib/isc/sparc64/include/isc/atomic.h b/contrib/bind9/lib/isc/sparc64/include/isc/atomic.h
new file mode 100644
index 0000000..5c254cf
--- /dev/null
+++ b/contrib/bind9/lib/isc/sparc64/include/isc/atomic.h
@@ -0,0 +1,127 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.2.2.2 2005/06/16 22:01:02 jinmei Exp $ */
+
+/*
+ * This code was written based on FreeBSD's kernel source whose copyright
+ * follows:
+ */
+
+/*-
+ * Copyright (c) 1998 Doug Rabson.
+ * Copyright (c) 2001 Jake Burkholder.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *	from: FreeBSD: src/sys/i386/include/atomic.h,v 1.20 2001/02/11
+ * $FreeBSD$
+ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+#include <isc/platform.h>
+#include <isc/types.h>
+
+#define	ASI_P	0x80		/* Primary Address Space Identifier */
+
+#ifdef ISC_PLATFORM_USEGCCASM
+
+/*
+ * This routine atomically increments the value stored in 'p' by 'val', and
+ * returns the previous value.
+ */
+static inline isc_int32_t
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	isc_int32_t prev, swapped;
+
+	for (prev = *(volatile isc_int32_t *)p; ; prev = swapped) {
+		swapped = prev + val;
+		__asm__ volatile(
+			"casa [%1] %2, %3, %0"
+			: "+r"(swapped)
+			: "r"(p), "n"(ASI_P), "r"(prev));
+		if (swapped == prev)
+			break;
+	}
+
+	return (prev);
+}
+
+/*
+ * This routine atomically stores the value 'val' in 'p'.
+ */
+static inline void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	isc_int32_t prev, swapped;
+
+	for (prev = *(volatile isc_int32_t *)p; ; prev = swapped) {
+		swapped = val;
+		__asm__ volatile(
+			"casa [%1] %2, %3, %0"
+			: "+r"(swapped)
+			: "r"(p), "n"(ASI_P), "r"(prev)
+			: "memory");
+		if (swapped == prev)
+			break;
+	}
+}
+
+/*
+ * This routine atomically replaces the value in 'p' with 'val', if the
+ * original value is equal to 'cmpval'.  The original value is returned in any
+ * case.
+ */
+static inline isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+	isc_int32_t temp = val;
+
+	__asm__ volatile(
+		"casa [%1] %2, %3, %0"
+		: "+r"(temp)
+		: "r"(p), "n"(ASI_P), "r"(cmpval));
+
+	return (temp);
+}
+
+#else  /* ISC_PLATFORM_USEGCCASM */
+
+#error "unsupported compiler.  disable atomic ops by --disable-atomic"
+
+#endif /* ISC_PLATFORM_USEGCCASM */
+
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isc/string.c b/contrib/bind9/lib/isc/string.c
index 2a1e557..c09fa4f 100644
--- a/contrib/bind9/lib/isc/string.c
+++ b/contrib/bind9/lib/isc/string.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,13 +15,19 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: string.c,v 1.6.164.5 2004/09/16 01:00:58 marka Exp $ */
+/* $Id: string.c,v 1.10.18.7 2006/10/03 23:50:51 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
 #include <ctype.h>
 
+#include <isc/mem.h>
+#include <isc/print.h>
+#include <isc/region.h>
 #include <isc/string.h>
+#include <isc/util.h>
 
 static char digits[] = "0123456789abcdefghijklmnoprstuvwxyz";
 
@@ -89,6 +95,105 @@ isc_string_touint64(char *source, char **end, int base) {
 	return (tmp);
 }
 
+isc_result_t
+isc_string_copy(char *target, size_t size, const char *source) {
+	REQUIRE(size > 0U);
+
+	if (strlcpy(target, source, size) >= size) {
+		memset(target, ISC_STRING_MAGIC, size);
+		return (ISC_R_NOSPACE);
+	}
+
+	ENSURE(strlen(target) < size);
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+isc_string_copy_truncate(char *target, size_t size, const char *source) {
+	REQUIRE(size > 0U);
+
+	strlcpy(target, source, size);
+
+	ENSURE(strlen(target) < size);
+}
+
+isc_result_t
+isc_string_append(char *target, size_t size, const char *source) {
+	REQUIRE(size > 0U);
+	REQUIRE(strlen(target) < size);
+
+	if (strlcat(target, source, size) >= size) {
+		memset(target, ISC_STRING_MAGIC, size);
+		return (ISC_R_NOSPACE);
+	}
+
+	ENSURE(strlen(target) < size);
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+isc_string_append_truncate(char *target, size_t size, const char *source) {
+	REQUIRE(size > 0U);
+	REQUIRE(strlen(target) < size);
+
+	strlcat(target, source, size);
+
+	ENSURE(strlen(target) < size);
+}
+
+isc_result_t
+isc_string_printf(char *target, size_t size, const char *format, ...) {
+	va_list args;
+	size_t n;
+
+	REQUIRE(size > 0U);
+
+	va_start(args, format);
+	n = vsnprintf(target, size, format, args);
+	va_end(args);
+
+	if (n >= size) {
+		memset(target, ISC_STRING_MAGIC, size);
+		return (ISC_R_NOSPACE);
+	}
+
+	ENSURE(strlen(target) < size);
+
+	return (ISC_R_SUCCESS);
+}
+
+void
+isc_string_printf_truncate(char *target, size_t size, const char *format, ...) {
+	va_list args;
+	size_t n;
+
+	REQUIRE(size > 0U);
+
+	va_start(args, format);
+	n = vsnprintf(target, size, format, args);
+	va_end(args);
+
+	ENSURE(strlen(target) < size);
+}
+
+char *
+isc_string_regiondup(isc_mem_t *mctx, const isc_region_t *source) {
+	char *target;
+
+	REQUIRE(mctx != NULL);
+	REQUIRE(source != NULL);
+
+	target = (char *) isc_mem_allocate(mctx, source->length + 1);
+	if (target != NULL) {
+		memcpy(source->base, target, source->length);
+		target[source->length] = '\0';
+	}
+
+	return (target);
+}
+
 char *
 isc_string_separate(char **stringp, const char *delim) {
 	char *string = *stringp;
diff --git a/contrib/bind9/lib/isc/strtoul.c b/contrib/bind9/lib/isc/strtoul.c
index b3d7e49..5070c08 100644
--- a/contrib/bind9/lib/isc/strtoul.c
+++ b/contrib/bind9/lib/isc/strtoul.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -48,11 +48,12 @@
  * SUCH DAMAGE.
  */
 
+/*! \file */
 #if defined(LIBC_SCCS) && !defined(lint)
 static char sccsid[] = "@(#)strtoul.c	8.1 (Berkeley) 6/4/93";
 #endif /* LIBC_SCCS and not lint */
 
-/* $Id: strtoul.c,v 1.2.14.3 2004/03/06 08:14:36 marka Exp $ */
+/* $Id: strtoul.c,v 1.3.18.2 2005/04/29 00:16:50 marka Exp $ */
 
 #include <config.h>
 
@@ -63,7 +64,7 @@ static char sccsid[] = "@(#)strtoul.c	8.1 (Berkeley) 6/4/93";
 #include <isc/stdlib.h>
 #include <isc/util.h>
 
-/*
+/*!
  * Convert a string to an unsigned long integer.
  *
  * Ignores `locale' stuff.  Assumes that the upper and lower case
diff --git a/contrib/bind9/lib/isc/symtab.c b/contrib/bind9/lib/isc/symtab.c
index 8b2b8c4..716ca88 100644
--- a/contrib/bind9/lib/isc/symtab.c
+++ b/contrib/bind9/lib/isc/symtab.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1996-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: symtab.c,v 1.24.12.3 2004/03/08 09:04:50 marka Exp $ */
+/* $Id: symtab.c,v 1.26.18.2 2005/04/29 00:16:50 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/task.c b/contrib/bind9/lib/isc/task.c
index 9b31523..5c80712 100644
--- a/contrib/bind9/lib/isc/task.c
+++ b/contrib/bind9/lib/isc/task.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,10 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: task.c,v 1.85.2.3.8.5 2004/10/15 00:45:45 marka Exp $ */
+/* $Id: task.c,v 1.91.18.6 2006/01/04 23:50:23 marka Exp $ */
 
-/*
- * Principal Author: Bob Halley
+/*! \file
+ * \author Principal Author: Bob Halley
  */
 
 /*
@@ -174,6 +174,7 @@ isc_task_create(isc_taskmgr_t *manager, unsigned int quantum,
 {
 	isc_task_t *task;
 	isc_boolean_t exiting;
+	isc_result_t result;
 
 	REQUIRE(VALID_MANAGER(manager));
 	REQUIRE(taskp != NULL && *taskp == NULL);
@@ -183,13 +184,10 @@ isc_task_create(isc_taskmgr_t *manager, unsigned int quantum,
 		return (ISC_R_NOMEMORY);
 	XTRACE("isc_task_create");
 	task->manager = manager;
-	if (isc_mutex_init(&task->lock) != ISC_R_SUCCESS) {
+	result = isc_mutex_init(&task->lock);
+	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(manager->mctx, task, sizeof(*task));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		return (result);
 	}
 	task->state = task_state_idle;
 	task->references = 1;
@@ -1066,14 +1064,10 @@ isc_taskmgr_create(isc_mem_t *mctx, unsigned int workers,
 		return (ISC_R_NOMEMORY);
 	manager->magic = TASK_MANAGER_MAGIC;
 	manager->mctx = NULL;
-	if (isc_mutex_init(&manager->lock) != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		result = ISC_R_UNEXPECTED;
+	result = isc_mutex_init(&manager->lock);
+	if (result != ISC_R_SUCCESS)
 		goto cleanup_mgr;
-	}
+
 #ifdef ISC_PLATFORM_USETHREADS
 	manager->workers = 0;
 	manager->threads = isc_mem_allocate(mctx,
@@ -1235,6 +1229,8 @@ isc_taskmgr_destroy(isc_taskmgr_t **managerp) {
 	UNLOCK(&manager->lock);
 	while (isc__taskmgr_ready())
 		(void)isc__taskmgr_dispatch();
+	if (!ISC_LIST_EMPTY(manager->tasks))
+		isc_mem_printallactive(stderr);
 	INSIST(ISC_LIST_EMPTY(manager->tasks));
 #endif /* ISC_PLATFORM_USETHREADS */
 
diff --git a/contrib/bind9/lib/isc/task_p.h b/contrib/bind9/lib/isc/task_p.h
index f842c5b..8ada721 100644
--- a/contrib/bind9/lib/isc/task_p.h
+++ b/contrib/bind9/lib/isc/task_p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: task_p.h,v 1.6.206.1 2004/03/06 08:14:36 marka Exp $ */
+/* $Id: task_p.h,v 1.7.18.2 2005/04/29 00:16:50 marka Exp $ */
 
 #ifndef ISC_TASK_P_H
 #define ISC_TASK_P_H
 
+/*! \file */
+
 isc_boolean_t
 isc__taskmgr_ready(void);
 
diff --git a/contrib/bind9/lib/isc/taskpool.c b/contrib/bind9/lib/isc/taskpool.c
index a3931a9..f1f619d 100644
--- a/contrib/bind9/lib/isc/taskpool.c
+++ b/contrib/bind9/lib/isc/taskpool.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: taskpool.c,v 1.10.12.5 2006/01/04 23:50:21 marka Exp $ */
+/* $Id: taskpool.c,v 1.12.18.3 2005/11/30 03:44:39 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/timer.c b/contrib/bind9/lib/isc/timer.c
index 6a6acf6..4b96fa5 100644
--- a/contrib/bind9/lib/isc/timer.c
+++ b/contrib/bind9/lib/isc/timer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.c,v 1.64.12.13 2006/01/04 23:50:21 marka Exp $ */
+/* $Id: timer.c,v 1.73.18.5 2005/11/30 03:44:39 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -57,14 +59,14 @@
 #define VALID_TIMER(t)			ISC_MAGIC_VALID(t, TIMER_MAGIC)
 
 struct isc_timer {
-	/* Not locked. */
+	/*! Not locked. */
 	unsigned int			magic;
 	isc_timermgr_t *		manager;
 	isc_mutex_t			lock;
-	/* Locked by timer lock. */
+	/*! Locked by timer lock. */
 	unsigned int			references;
 	isc_time_t			idle;
-	/* Locked by manager lock. */
+	/*! Locked by manager lock. */
 	isc_timertype_t			type;
 	isc_time_t			expires;
 	isc_interval_t			interval;
@@ -99,7 +101,7 @@ struct isc_timermgr {
 };
 
 #ifndef ISC_PLATFORM_USETHREADS
-/*
+/*!
  * If threads are not in use, there can be only one.
  */
 static isc_timermgr_t *timermgr = NULL;
@@ -115,7 +117,7 @@ schedule(isc_timer_t *timer, isc_time_t *now, isc_boolean_t signal_ok) {
 	isc_boolean_t timedwait;
 #endif
 
-	/*
+	/*!
 	 * Note: the caller must ensure locking.
 	 */
 
@@ -128,7 +130,7 @@ schedule(isc_timer_t *timer, isc_time_t *now, isc_boolean_t signal_ok) {
 	manager = timer->manager;
 
 #ifdef ISC_PLATFORM_USETHREADS
-	/*
+	/*!
 	 * If the manager was timed wait, we may need to signal the
 	 * manager to force a wakeup.
 	 */
@@ -373,14 +375,11 @@ isc_timer_create(isc_timermgr_t *manager, isc_timertype_t type,
 	 */
 	DE_CONST(arg, timer->arg);
 	timer->index = 0;
-	if (isc_mutex_init(&timer->lock) != ISC_R_SUCCESS) {
+	result = isc_mutex_init(&timer->lock);
+	if (result != ISC_R_SUCCESS) {
 		isc_task_detach(&timer->task);
 		isc_mem_put(manager->mctx, timer, sizeof(*timer));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		return (result);
 	}
 	ISC_LINK_INIT(timer, link);
 	timer->magic = TIMER_MAGIC;
@@ -583,7 +582,7 @@ dispatch(isc_timermgr_t *manager, isc_time_t *now) {
 	isc_timer_t *timer;
 	isc_result_t result;
 
-	/*
+	/*!
 	 * The caller must be holding the manager lock.
 	 */
 
@@ -783,14 +782,11 @@ isc_timermgr_create(isc_mem_t *mctx, isc_timermgr_t **managerp) {
 		isc_mem_put(mctx, manager, sizeof(*manager));
 		return (ISC_R_NOMEMORY);
 	}
-	if (isc_mutex_init(&manager->lock) != ISC_R_SUCCESS) {
+	result = isc_mutex_init(&manager->lock);
+	if (result != ISC_R_SUCCESS) {
 		isc_heap_destroy(&manager->heap);
 		isc_mem_put(mctx, manager, sizeof(*manager));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		return (result);
 	}
 	isc_mem_attach(mctx, &manager->mctx);
 #ifdef ISC_PLATFORM_USETHREADS
diff --git a/contrib/bind9/lib/isc/timer_p.h b/contrib/bind9/lib/isc/timer_p.h
index ad7a5d0..fcc7b6c 100644
--- a/contrib/bind9/lib/isc/timer_p.h
+++ b/contrib/bind9/lib/isc/timer_p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer_p.h,v 1.4.12.3 2004/03/08 09:04:50 marka Exp $ */
+/* $Id: timer_p.h,v 1.6.18.2 2005/04/29 00:16:51 marka Exp $ */
 
 #ifndef ISC_TIMER_P_H
 #define ISC_TIMER_P_H
 
+/*! \file */
+
 isc_result_t
 isc__timermgr_nextevent(isc_time_t *when);
 
diff --git a/contrib/bind9/lib/isc/unix/Makefile.in b/contrib/bind9/lib/isc/unix/Makefile.in
index 49845d4..afb77a6 100644
--- a/contrib/bind9/lib/isc/unix/Makefile.in
+++ b/contrib/bind9/lib/isc/unix/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.35.2.1.10.2 2004/06/22 02:48:36 marka Exp $
+# $Id: Makefile.in,v 1.38.18.1 2004/06/22 02:54:06 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/unix/app.c b/contrib/bind9/lib/isc/unix/app.c
index 811d67b..59b1f6c 100644
--- a/contrib/bind9/lib/isc/unix/app.c
+++ b/contrib/bind9/lib/isc/unix/app.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: app.c,v 1.43.2.3.8.5 2004/03/08 02:08:05 marka Exp $ */
+/* $Id: app.c,v 1.50.18.2 2005/04/29 00:17:06 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -54,7 +56,7 @@ static isc_eventlist_t		on_run;
 static isc_mutex_t		lock;
 static isc_boolean_t		shutdown_requested = ISC_FALSE;
 static isc_boolean_t		running = ISC_FALSE;
-/*
+/*!
  * We assume that 'want_shutdown' can be read and written atomically.
  */
 static isc_boolean_t		want_shutdown = ISC_FALSE;
@@ -69,14 +71,14 @@ static pthread_t		blockedthread;
 #endif /* ISC_PLATFORM_USETHREADS */
 
 #ifdef HAVE_LINUXTHREADS
-/*
+/*!
  * Linux has sigwait(), but it appears to prevent signal handlers from
  * running, even if they're not in the set being waited for.  This makes
  * it impossible to get the default actions for SIGILL, SIGSEGV, etc.
  * Instead of messing with it, we just use sigsuspend() instead.
  */
 #undef HAVE_SIGWAIT
-/*
+/*!
  * We need to remember which thread is the main thread...
  */
 static pthread_t		main_thread;
@@ -291,7 +293,7 @@ isc_app_onrun(isc_mem_t *mctx, isc_task_t *task, isc_taskaction_t action,
 }
 
 #ifndef ISC_PLATFORM_USETHREADS
-/*
+/*!
  * Event loop for nonthreaded programs.
  */
 static isc_result_t
@@ -371,14 +373,14 @@ evloop() {
  * is set by isc_condition_signal().
  */
 
-/*
- * True iff we are currently executing in the recursive
+/*!
+ * \brief True if we are currently executing in the recursive
  * event loop.
  */
 static isc_boolean_t in_recursive_evloop = ISC_FALSE;
 
-/*
- * True iff we are exiting the event loop as the result of
+/*!
+ * \brief True if we are exiting the event loop as the result of
  * a call to isc_condition_signal() rather than a shutdown
  * or reload.
  */
diff --git a/contrib/bind9/lib/isc/unix/dir.c b/contrib/bind9/lib/isc/unix/dir.c
index 85a1217..b627c88 100644
--- a/contrib/bind9/lib/isc/unix/dir.c
+++ b/contrib/bind9/lib/isc/unix/dir.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,9 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dir.c,v 1.18.2.1.2.3 2004/03/08 09:04:55 marka Exp $ */
+/* $Id: dir.c,v 1.20.18.3 2005/09/05 00:18:30 marka Exp $ */
 
-/* Principal Authors: DCL */
+/*! \file
+ * \author  Principal Authors: DCL */
 
 #include <config.h>
 
@@ -50,18 +51,37 @@ isc_dir_init(isc_dir_t *dir) {
 	dir->magic = ISC_DIR_MAGIC;
 }
 
-/*
- * Allocate workspace and open directory stream. If either one fails,
+/*!
+ * \brief Allocate workspace and open directory stream. If either one fails,
  * NULL will be returned.
  */
 isc_result_t
 isc_dir_open(isc_dir_t *dir, const char *dirname) {
+	char *p;
 	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(VALID_DIR(dir));
 	REQUIRE(dirname != NULL);
 
 	/*
+	 * Copy directory name.  Need to have enough space for the name,
+	 * a possible path separator, the wildcard, and the final NUL.
+	 */
+	if (strlen(dirname) + 3 > sizeof(dir->dirname))
+		/* XXXDCL ? */
+		return (ISC_R_NOSPACE);
+	strcpy(dir->dirname, dirname);
+
+	/*
+	 * Append path separator, if needed, and "*".
+	 */
+	p = dir->dirname + strlen(dir->dirname);
+	if (dir->dirname < p && *(p - 1) != '/')
+		*p++ = '/';
+	*p++ = '*';
+	*p++ = '\0';
+
+	/*
 	 * Open stream.
 	 */
 	dir->handle = opendir(dirname);
@@ -72,8 +92,10 @@ isc_dir_open(isc_dir_t *dir, const char *dirname) {
 	return (result);
 }
 
-/*
- * Return previously retrieved file or get next one.  Unix's dirent has
+/*!
+ * \brief Return previously retrieved file or get next one.  
+
+ * Unix's dirent has
  * separate open and read functions, but the Win32 and DOS interfaces open
  * the dir stream and reads the first file in one operation.
  */
@@ -107,8 +129,8 @@ isc_dir_read(isc_dir_t *dir) {
 	return (ISC_R_SUCCESS);
 }
 
-/*
- * Close directory stream.
+/*!
+ * \brief Close directory stream.
  */
 void
 isc_dir_close(isc_dir_t *dir) {
@@ -118,8 +140,8 @@ isc_dir_close(isc_dir_t *dir) {
        dir->handle = NULL;
 }
 
-/*
- * Reposition directory stream at start.
+/*!
+ * \brief Reposition directory stream at start.
  */
 isc_result_t
 isc_dir_reset(isc_dir_t *dir) {
@@ -132,8 +154,8 @@ isc_dir_reset(isc_dir_t *dir) {
 
 isc_result_t
 isc_dir_chdir(const char *dirname) {
-	/*
-	 * Change the current directory to 'dirname'.
+	/*!
+	 * \brief Change the current directory to 'dirname'.
 	 */
 
 	REQUIRE(dirname != NULL);
@@ -165,8 +187,8 @@ isc_dir_createunique(char *templet) {
 
 	REQUIRE(templet != NULL);
 
-	/*
-	 * mkdtemp is not portable, so this emulates it.
+	/*!
+	 * \brief mkdtemp is not portable, so this emulates it.
 	 */
 
 	pid = getpid();
diff --git a/contrib/bind9/lib/isc/unix/entropy.c b/contrib/bind9/lib/isc/unix/entropy.c
index d52849a..4c0d0d0 100644
--- a/contrib/bind9/lib/isc/unix/entropy.c
+++ b/contrib/bind9/lib/isc/unix/entropy.c
@@ -15,10 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: entropy.c,v 1.60.2.3.8.14 2006/03/02 23:29:17 marka Exp $ */
+/* $Id: entropy.c,v 1.71.18.7 2006/12/07 04:53:03 marka Exp $ */
 
-/*
- * This is the system depenedent part of the ISC entropy API.
+/* \file unix/entropy.c
+ * \brief
+ * This is the system dependent part of the ISC entropy API.
  */
 
 #include <config.h>
@@ -41,7 +42,7 @@
 
 #include "errno2result.h"
 
-/*
+/*%
  * There is only one variable in the entropy data structures that is not
  * system independent, but pulling the structure that uses it into this file
  * ultimately means pulling several other independent structures here also to
@@ -486,8 +487,6 @@ isc_entropy_createfilesource(isc_entropy_t *ent, const char *fname) {
 
 	LOCK(&ent->lock);
 
-	source = NULL;
-
 	if (stat(fname, &_stat) < 0) {
 		ret = isc__errno2result(errno);
 		goto errout;
@@ -589,9 +588,6 @@ isc_entropy_createfilesource(isc_entropy_t *ent, const char *fname) {
 	(void)close(fd);
 
  errout:
-	if (source != NULL)
-		isc_mem_put(ent->mctx, source, sizeof(isc_entropysource_t));
-
 	UNLOCK(&ent->lock);
 
 	return (ret);
diff --git a/contrib/bind9/lib/isc/unix/errno2result.c b/contrib/bind9/lib/isc/unix/errno2result.c
index 66a4e91..d4b188f 100644
--- a/contrib/bind9/lib/isc/unix/errno2result.c
+++ b/contrib/bind9/lib/isc/unix/errno2result.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: errno2result.c,v 1.8.2.4.8.1 2004/03/06 08:14:59 marka Exp $ */
+/* $Id: errno2result.c,v 1.13.18.2 2005/04/29 00:17:07 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -25,7 +27,7 @@
 
 #include "errno2result.h"
 
-/*
+/*%
  * Convert a POSIX errno value into an isc_result_t.  The
  * list of supported errno values is not complete; new users
  * of this function should add any expected errors that are
diff --git a/contrib/bind9/lib/isc/unix/errno2result.h b/contrib/bind9/lib/isc/unix/errno2result.h
index 9a8d07c..5e36116 100644
--- a/contrib/bind9/lib/isc/unix/errno2result.h
+++ b/contrib/bind9/lib/isc/unix/errno2result.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: errno2result.h,v 1.7.206.1 2004/03/06 08:14:59 marka Exp $ */
+/* $Id: errno2result.h,v 1.8.18.2 2005/04/29 00:17:07 marka Exp $ */
 
 #ifndef UNIX_ERRNO2RESULT_H
 #define UNIX_ERRNO2RESULT_H 1
 
+/*! \file */
+
 /* XXXDCL this should be moved to lib/isc/include/isc/errno2result.h. */
 
 #include <errno.h>		/* Provides errno. */
diff --git a/contrib/bind9/lib/isc/unix/file.c b/contrib/bind9/lib/isc/unix/file.c
index 7ed6272..e45e0fe 100644
--- a/contrib/bind9/lib/isc/unix/file.c
+++ b/contrib/bind9/lib/isc/unix/file.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -48,7 +48,9 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: file.c,v 1.38.12.8 2004/03/16 05:50:25 marka Exp $ */
+/* $Id: file.c,v 1.47.18.2 2005/04/29 00:17:07 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -154,7 +156,7 @@ isc_file_settime(const char *file, isc_time_t *time) {
 }
 
 #undef TEMPLATE
-#define TEMPLATE "tmp-XXXXXXXXXX" /* 14 characters. */
+#define TEMPLATE "tmp-XXXXXXXXXX" /*%< 14 characters. */
 
 isc_result_t
 isc_file_mktemplate(const char *path, char *buf, size_t buflen) {
diff --git a/contrib/bind9/lib/isc/unix/fsaccess.c b/contrib/bind9/lib/isc/unix/fsaccess.c
index 3745ca2..f3ed60f 100644
--- a/contrib/bind9/lib/isc/unix/fsaccess.c
+++ b/contrib/bind9/lib/isc/unix/fsaccess.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: fsaccess.c,v 1.6.206.3 2006/08/25 05:25:50 marka Exp $ */
+/* $Id: fsaccess.c,v 1.7.18.4 2006/08/25 05:25:51 marka Exp $ */
 
 #include <config.h>
 
@@ -26,7 +26,8 @@
 
 #include "errno2result.h"
 
-/*
+/*! \file
+ * \brief
  * The OS-independent part of the API is in lib/isc.
  */
 #include "../fsaccess.c"
diff --git a/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c b/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c
index ad6e1e0..7e359aa 100644
--- a/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c
+++ b/contrib/bind9/lib/isc/unix/ifiter_getifaddrs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,28 +15,33 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ifiter_getifaddrs.c,v 1.2.68.3 2004/03/06 08:14:59 marka Exp $ */
+/* $Id: ifiter_getifaddrs.c,v 1.4.18.2 2005/04/29 00:17:08 marka Exp $ */
 
-/*
+/*! \file
+ * \brief
  * Obtain the list of network interfaces using the getifaddrs(3) library.
  */
 
 #include <ifaddrs.h>
 
+/*% Iterator Magic */
 #define IFITER_MAGIC		ISC_MAGIC('I', 'F', 'I', 'G')
+/*% Valid Iterator */
 #define VALID_IFITER(t)		ISC_MAGIC_VALID(t, IFITER_MAGIC)
 
+/*% Iterator structure */
 struct isc_interfaceiter {
-	unsigned int		magic;		/* Magic number. */
+	unsigned int		magic;		/*%< Magic number. */
 	isc_mem_t		*mctx;
-	void			*buf;		/* (unused) */
-	unsigned int		bufsize;	/* (always 0) */
-	struct ifaddrs		*ifaddrs;	/* List of ifaddrs */
-	struct ifaddrs		*pos;		/* Ptr to current ifaddr */
-	isc_interface_t		current;	/* Current interface data. */
-	isc_result_t		result;		/* Last result code. */
+	void			*buf;		/*%< (unused) */
+	unsigned int		bufsize;	/*%< (always 0) */
+	struct ifaddrs		*ifaddrs;	/*%< List of ifaddrs */
+	struct ifaddrs		*pos;		/*%< Ptr to current ifaddr */
+	isc_interface_t		current;	/*%< Current interface data. */
+	isc_result_t		result;		/*%< Last result code. */
 };
 
+
 isc_result_t
 isc_interfaceiter_create(isc_mem_t *mctx, isc_interfaceiter_t **iterp) {
 	isc_interfaceiter_t *iter;
diff --git a/contrib/bind9/lib/isc/unix/ifiter_ioctl.c b/contrib/bind9/lib/isc/unix/ifiter_ioctl.c
index 68a1365..5ebcef8 100644
--- a/contrib/bind9/lib/isc/unix/ifiter_ioctl.c
+++ b/contrib/bind9/lib/isc/unix/ifiter_ioctl.c
@@ -15,9 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ifiter_ioctl.c,v 1.19.2.5.2.19 2006/02/03 23:51:37 marka Exp $ */
+/* $Id: ifiter_ioctl.c,v 1.44.18.11 2006/02/03 23:51:38 marka Exp $ */
 
-/*
+/*! \file
+ * \brief
  * Obtain the list of network interfaces using the SIOCGLIFCONF ioctl.
  * See netintro(4).
  */
@@ -93,7 +94,7 @@ struct isc_interfaceiter {
 #endif
 
 
-/*
+/*%
  * Size of buffer for SIOCGLIFCONF, in bytes.  We assume no sane system
  * will have more than a megabyte of interface configuration data.
  */
diff --git a/contrib/bind9/lib/isc/unix/ifiter_sysctl.c b/contrib/bind9/lib/isc/unix/ifiter_sysctl.c
index b10a2d2..212a478 100644
--- a/contrib/bind9/lib/isc/unix/ifiter_sysctl.c
+++ b/contrib/bind9/lib/isc/unix/ifiter_sysctl.c
@@ -15,9 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ifiter_sysctl.c,v 1.14.12.9 2005/03/17 03:58:33 marka Exp $ */
+/* $Id: ifiter_sysctl.c,v 1.20.18.3 2005/04/27 05:02:35 sra Exp $ */
 
-/*
+/*! \file
+ * \brief
  * Obtain the list of network interfaces using sysctl.
  * See TCP/IP Illustrated Volume 2, sections 19.8, 19.14,
  * and 19.16.
diff --git a/contrib/bind9/lib/isc/unix/include/Makefile.in b/contrib/bind9/lib/isc/unix/include/Makefile.in
index 5a06022..78eba44 100644
--- a/contrib/bind9/lib/isc/unix/include/Makefile.in
+++ b/contrib/bind9/lib/isc/unix/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.11.206.1 2004/03/06 08:15:03 marka Exp $
+# $Id: Makefile.in,v 1.12 2004/03/05 05:11:50 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/unix/include/isc/Makefile.in b/contrib/bind9/lib/isc/unix/include/isc/Makefile.in
index 4c5bae2..9599f7c 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/Makefile.in
+++ b/contrib/bind9/lib/isc/unix/include/isc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.27.206.1 2004/03/06 08:15:03 marka Exp $
+# $Id: Makefile.in,v 1.28 2004/03/05 05:11:52 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isc/unix/include/isc/dir.h b/contrib/bind9/lib/isc/unix/include/isc/dir.h
index 53b51df..cc85706 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/dir.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/dir.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,13 +15,15 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dir.h,v 1.15.12.3 2004/03/08 09:04:57 marka Exp $ */
+/* $Id: dir.h,v 1.17.18.2 2005/04/29 00:17:09 marka Exp $ */
 
 /* Principal Authors: DCL */
 
 #ifndef ISC_DIR_H
 #define ISC_DIR_H 1
 
+/*! \file */
+
 #include <sys/types.h>		/* Required on some systems. */
 #include <dirent.h>
 
@@ -31,8 +33,9 @@
 #define ISC_DIR_NAMEMAX 256
 #define ISC_DIR_PATHMAX 1024
 
+/*% Directory Entry */
 typedef struct isc_direntry {
-	/*
+	/*!
 	 * Ideally, this should be NAME_MAX, but AIX does not define it by
 	 * default and dynamically allocating the space based on pathconf()
 	 * complicates things undesirably, as does adding special conditionals
@@ -42,9 +45,10 @@ typedef struct isc_direntry {
 	unsigned int	length;
 } isc_direntry_t;
 
+/*% Directory */
 typedef struct isc_dir {
 	unsigned int	magic;
-	/*
+	/*!
 	 * As with isc_direntry_t->name, making this "right" for all systems
 	 * is slightly problematic because AIX does not define PATH_MAX.
 	 */
@@ -78,7 +82,7 @@ isc_dir_chroot(const char *dirname);
 
 isc_result_t
 isc_dir_createunique(char *templet);
-/*
+/*!<
  * Use a templet (such as from isc_file_mktemplate()) to create a uniquely
  * named, empty directory.  The templet string is modified in place.
  * If result == ISC_R_SUCCESS, it is the name of the directory that was
diff --git a/contrib/bind9/lib/isc/unix/include/isc/int.h b/contrib/bind9/lib/isc/unix/include/isc/int.h
index be36ccb..1e1de7b 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/int.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/int.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: int.h,v 1.11.206.1 2004/03/06 08:15:04 marka Exp $ */
+/* $Id: int.h,v 1.12.18.2 2005/04/29 00:17:09 marka Exp $ */
 
 #ifndef ISC_INT_H
 #define ISC_INT_H 1
 
+/*! \file */
+
 typedef char				isc_int8_t;
 typedef unsigned char			isc_uint8_t;
 typedef short				isc_int16_t;
@@ -37,7 +39,7 @@ typedef unsigned long long		isc_uint64_t;
 #define ISC_INT16_MAX	32767
 #define ISC_UINT16_MAX	65535
 
-/*
+/*%
  * Note that "int" is 32 bits on all currently supported Unix-like operating
  * systems, but "long" can be either 32 bits or 64 bits, thus the 32 bit
  * constants are not qualified with "L".
diff --git a/contrib/bind9/lib/isc/unix/include/isc/keyboard.h b/contrib/bind9/lib/isc/unix/include/isc/keyboard.h
index 31005b1..4b28cc0 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/keyboard.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/keyboard.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keyboard.h,v 1.6.206.1 2004/03/06 08:15:04 marka Exp $ */
+/* $Id: keyboard.h,v 1.7.18.2 2005/04/29 00:17:09 marka Exp $ */
 
 #ifndef ISC_KEYBOARD_H
 #define ISC_KEYBOARD_H 1
 
+/*! \file */
+
 #include <termios.h>
 
 #include <isc/lang.h>
diff --git a/contrib/bind9/lib/isc/unix/include/isc/net.h b/contrib/bind9/lib/isc/unix/include/isc/net.h
index f1a015f..bdd8c14 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/net.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/net.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: net.h,v 1.31.2.2.10.8 2004/04/29 01:31:23 marka Exp $ */
+/* $Id: net.h,v 1.39.18.4 2005/04/27 05:02:37 sra Exp $ */
 
 #ifndef ISC_NET_H
 #define ISC_NET_H 1
@@ -24,19 +24,20 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * Basic Networking Types
  *
  * This module is responsible for defining the following basic networking
  * types:
  *
- *		struct in_addr
- *		struct in6_addr
- *		struct in6_pktinfo
- *		struct sockaddr
- *		struct sockaddr_in
- *		struct sockaddr_in6
- *		in_port_t
+ *\li		struct in_addr
+ *\li		struct in6_addr
+ *\li		struct in6_pktinfo
+ *\li		struct sockaddr
+ *\li		struct sockaddr_in
+ *\li		struct sockaddr_in6
+ *\li		in_port_t
  *
  * It ensures that the AF_ and PF_ macros are defined.
  *
@@ -44,27 +45,27 @@
  *
  * It declares inet_aton(), inet_ntop(), and inet_pton().
  *
- * It ensures that INADDR_LOOPBACK, INADDR_ANY, IN6ADDR_ANY_INIT,
+ * It ensures that #INADDR_LOOPBACK, #INADDR_ANY, #IN6ADDR_ANY_INIT,
  * in6addr_any, and in6addr_loopback are available.
  *
  * It ensures that IN_MULTICAST() is available to check for multicast
  * addresses.
  *
  * MP:
- *	No impact.
+ *\li	No impact.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	N/A.
+ *\li	N/A.
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	BSD Socket API
- *	RFC 2553
+ *\li	BSD Socket API
+ *\li	RFC2553
  */
 
 /***
@@ -94,19 +95,19 @@
 #include <isc/types.h>
 
 #ifdef ISC_PLATFORM_HAVEINADDR6
-#define in6_addr in_addr6	/* Required for pre RFC2133 implementations. */
+#define in6_addr in_addr6	/*%< Required for pre RFC2133 implementations. */
 #endif
 
 #ifdef ISC_PLATFORM_HAVEIPV6
-/*
+#ifndef IN6ADDR_ANY_INIT
+#ifdef s6_addr
+/*%
  * Required for some pre RFC2133 implementations.
  * IN6ADDR_ANY_INIT and IN6ADDR_LOOPBACK_INIT were added in
  * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt.  
  * If 's6_addr' is defined then assume that there is a union and three
  * levels otherwise assume two levels required.
  */
-#ifndef IN6ADDR_ANY_INIT
-#ifdef s6_addr
 #define IN6ADDR_ANY_INIT { { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 } } }
 #else
 #define IN6ADDR_ANY_INIT { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 } }
@@ -115,6 +116,7 @@
 
 #ifndef IN6ADDR_LOOPBACK_INIT
 #ifdef s6_addr
+/*% IPv6 address loopback init */
 #define IN6ADDR_LOOPBACK_INIT { { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 } } }
 #else
 #define IN6ADDR_LOOPBACK_INIT { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 } }
@@ -122,12 +124,14 @@
 #endif
 
 #ifndef IN6_IS_ADDR_V4MAPPED
+/*% Is IPv6 address V4 mapped? */
 #define IN6_IS_ADDR_V4MAPPED(x) \
 	 (memcmp((x)->s6_addr, in6addr_any.s6_addr, 10) == 0 && \
 	  (x)->s6_addr[10] == 0xff && (x)->s6_addr[11] == 0xff)
 #endif
 
 #ifndef IN6_IS_ADDR_V4COMPAT
+/*% Is IPv6 address V4 compatible? */
 #define IN6_IS_ADDR_V4COMPAT(x) \
 	 (memcmp((x)->s6_addr, in6addr_any.s6_addr, 12) == 0 && \
 	 ((x)->s6_addr[12] != 0 || (x)->s6_addr[13] != 0 || \
@@ -136,50 +140,58 @@
 #endif
 
 #ifndef IN6_IS_ADDR_MULTICAST
+/*% Is IPv6 address multicast? */
 #define IN6_IS_ADDR_MULTICAST(a)        ((a)->s6_addr[0] == 0xff)
 #endif
 
 #ifndef IN6_IS_ADDR_LINKLOCAL
+/*% Is IPv6 address linklocal? */
 #define IN6_IS_ADDR_LINKLOCAL(a) \
 	(((a)->s6_addr[0] == 0xfe) && (((a)->s6_addr[1] & 0xc0) == 0x80))
 #endif
 
 #ifndef IN6_IS_ADDR_SITELOCAL
+/*% is IPv6 address sitelocal? */
 #define IN6_IS_ADDR_SITELOCAL(a) \
 	(((a)->s6_addr[0] == 0xfe) && (((a)->s6_addr[1] & 0xc0) == 0xc0))
 #endif
 
 
 #ifndef IN6_IS_ADDR_LOOPBACK
+/*% is IPv6 address loopback? */
 #define IN6_IS_ADDR_LOOPBACK(x) \
 	(memcmp((x)->s6_addr, in6addr_loopback.s6_addr, 16) == 0)
 #endif
 #endif
 
 #ifndef AF_INET6
+/*% IPv6 */
 #define AF_INET6 99
 #endif
 
 #ifndef PF_INET6
+/*% IPv6 */
 #define PF_INET6 AF_INET6
 #endif
 
 #ifndef INADDR_LOOPBACK
+/*% inaddr loopback */
 #define INADDR_LOOPBACK 0x7f000001UL
 #endif
 
 #ifndef ISC_PLATFORM_HAVEIN6PKTINFO
+/*% IPv6 packet info */
 struct in6_pktinfo {
-	struct in6_addr ipi6_addr;    /* src/dst IPv6 address */
-	unsigned int    ipi6_ifindex; /* send/recv interface index */
+	struct in6_addr ipi6_addr;    /*%< src/dst IPv6 address */
+	unsigned int    ipi6_ifindex; /*%< send/recv interface index */
 };
 #endif
 
-/*
- * Cope with a missing in6addr_any and in6addr_loopback.
- */
 #if defined(ISC_PLATFORM_HAVEIPV6) && defined(ISC_PLATFORM_NEEDIN6ADDRANY)
 extern const struct in6_addr isc_net_in6addrany;
+/*%
+ * Cope with a missing in6addr_any and in6addr_loopback.
+ */
 #define in6addr_any isc_net_in6addrany
 #endif
 
@@ -188,11 +200,12 @@ extern const struct in6_addr isc_net_in6addrloop;
 #define in6addr_loopback isc_net_in6addrloop
 #endif
 
-/*
- * Fix UnixWare 7.1.1's broken IN6_IS_ADDR_* definitions.
- */
 #ifdef ISC_PLATFORM_FIXIN6ISADDR
 #undef  IN6_IS_ADDR_GEOGRAPHIC
+/*! 
+ * \brief
+ * Fix UnixWare 7.1.1's broken IN6_IS_ADDR_* definitions.
+ */
 #define IN6_IS_ADDR_GEOGRAPHIC(a) (((a)->S6_un.S6_l[0] & 0xE0) == 0x80)
 #undef  IN6_IS_ADDR_IPX
 #define IN6_IS_ADDR_IPX(a)        (((a)->S6_un.S6_l[0] & 0xFE) == 0x04)
@@ -208,24 +221,26 @@ extern const struct in6_addr isc_net_in6addrloop;
 #define IN6_IS_ADDR_SITELOCAL(a)  (((a)->S6_un.S6_l[0] & 0xC0FF) == 0xC0FE)
 #endif /* ISC_PLATFORM_FIXIN6ISADDR */
 
-/*
+#ifdef ISC_PLATFORM_NEEDPORTT
+/*%
  * Ensure type in_port_t is defined.
  */
-#ifdef ISC_PLATFORM_NEEDPORTT
 typedef isc_uint16_t in_port_t;
 #endif
 
-/*
+#ifndef MSG_TRUNC
+/*%
  * If this system does not have MSG_TRUNC (as returned from recvmsg())
  * ISC_PLATFORM_RECVOVERFLOW will be defined.  This will enable the MSG_TRUNC
  * faking code in socket.c.
  */
-#ifndef MSG_TRUNC
 #define ISC_PLATFORM_RECVOVERFLOW
 #endif
 
+/*% IP address. */
 #define ISC__IPADDR(x)	((isc_uint32_t)htonl((isc_uint32_t)(x)))
 
+/*% Is IP address multicast? */
 #define ISC_IPADDR_ISMULTICAST(i) \
 		(((isc_uint32_t)(i) & ISC__IPADDR(0xf0000000)) \
 		 == ISC__IPADDR(0xe0000000))
@@ -242,40 +257,40 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_net_probeipv4(void);
-/*
+/*%<
  * Check if the system's kernel supports IPv4.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		IPv4 is supported.
- *	ISC_R_NOTFOUND		IPv4 is not supported.
- *	ISC_R_DISABLED		IPv4 is disabled.
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS		IPv4 is supported.
+ *\li	#ISC_R_NOTFOUND		IPv4 is not supported.
+ *\li	#ISC_R_DISABLED		IPv4 is disabled.
+ *\li	#ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_net_probeipv6(void);
-/*
+/*%<
  * Check if the system's kernel supports IPv6.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		IPv6 is supported.
- *	ISC_R_NOTFOUND		IPv6 is not supported.
- *	ISC_R_DISABLED		IPv6 is disabled.
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS		IPv6 is supported.
+ *\li	#ISC_R_NOTFOUND		IPv6 is not supported.
+ *\li	#ISC_R_DISABLED		IPv6 is disabled.
+ *\li	#ISC_R_UNEXPECTED
  */
 
 isc_result_t
 isc_net_probe_ipv6only(void);
-/*
+/*%<
  * Check if the system's kernel supports the IPV6_V6ONLY socket option.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		the option is supported for both TCP and UDP.
- *	ISC_R_NOTFOUND		IPv6 itself or the option is not supported.
- *	ISC_R_UNEXPECTED
+ *\li	#ISC_R_SUCCESS		the option is supported for both TCP and UDP.
+ *\li	#ISC_R_NOTFOUND		IPv6 itself or the option is not supported.
+ *\li	#ISC_R_UNEXPECTED
  */
 
 isc_result_t
@@ -286,9 +301,9 @@ isc_net_probe_ipv6pktinfo(void);
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		the option is supported.
- *	ISC_R_NOTFOUND		IPv6 itself or the option is not supported.
- *	ISC_R_UNEXPECTED
+ * \li	#ISC_R_SUCCESS		the option is supported.
+ * \li	#ISC_R_NOTFOUND		IPv6 itself or the option is not supported.
+ * \li	#ISC_R_UNEXPECTED
  */
 
 void
@@ -303,6 +318,12 @@ isc_net_enableipv4(void);
 void
 isc_net_enableipv6(void);
 
+isc_result_t
+isc_net_probeunix(void);
+/*
+ * Returns whether UNIX domain sockets are supported.
+ */
+
 #ifdef ISC_PLATFORM_NEEDNTOP
 const char *
 isc_net_ntop(int af, const void *src, char *dst, size_t size);
diff --git a/contrib/bind9/lib/isc/unix/include/isc/netdb.h b/contrib/bind9/lib/isc/unix/include/isc/netdb.h
index beb9137..428f087 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/netdb.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/netdb.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: netdb.h,v 1.6.206.1 2004/03/06 08:15:04 marka Exp $ */
+/* $Id: netdb.h,v 1.7.18.2 2005/04/29 00:17:10 marka Exp $ */
 
 #ifndef ISC_NETDB_H
 #define ISC_NETDB_H 1
@@ -24,25 +24,26 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * Portable netdb.h support.
  *
  * This module is responsible for defining the get<x>by<y> APIs.
  *
  * MP:
- *	No impact.
+ *\li	No impact.
  *
  * Reliability:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Resources:
- *	N/A.
+ *\li	N/A.
  *
  * Security:
- *	No anticipated impact.
+ *\li	No anticipated impact.
  *
  * Standards:
- *	BSD API
+ *\li	BSD API
  */
 
 /***
diff --git a/contrib/bind9/lib/isc/unix/include/isc/offset.h b/contrib/bind9/lib/isc/unix/include/isc/offset.h
index 0ea1362..15fbad4 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/offset.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/offset.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: offset.h,v 1.10.206.1 2004/03/06 08:15:04 marka Exp $ */
+/* $Id: offset.h,v 1.11.18.2 2005/04/29 00:17:10 marka Exp $ */
 
 #ifndef ISC_OFFSET_H
 #define ISC_OFFSET_H 1
 
-/*
+/*! \file
+ * \brief
  * File offsets are operating-system dependent.
  */
 #include <limits.h>             /* Required for CHAR_BIT. */
@@ -28,7 +29,7 @@
 
 typedef off_t isc_offset_t;
 
-/*
+/*%
  * POSIX says "Additionally, blkcnt_t and off_t are extended signed integral
  * types", so the maximum value is all 1s except for the high bit.
  * This definition is more complex than it really needs to be because it was
diff --git a/contrib/bind9/lib/isc/unix/include/isc/stat.h b/contrib/bind9/lib/isc/unix/include/isc/stat.h
index 4304208..d1b2489 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/stat.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/stat.h
@@ -1,6 +1,5 @@
 /*
  * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
- * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stat.h,v 1.1.2.1.4.1 2004/03/06 08:15:05 marka Exp $ */
+/* $Id: stat.h,v 1.2.18.1 2004/08/19 04:42:54 marka Exp $ */
 
 #ifndef ISC_STAT_H
 #define ISC_STAT_H 1
diff --git a/contrib/bind9/lib/isc/unix/include/isc/stdtime.h b/contrib/bind9/lib/isc/unix/include/isc/stdtime.h
index 9b855c7..24a91d2 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/stdtime.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/stdtime.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,31 +15,44 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdtime.h,v 1.8.206.1 2004/03/06 08:15:05 marka Exp $ */
+/* $Id: stdtime.h,v 1.9.18.3 2005/06/04 06:23:45 jinmei Exp $ */
 
 #ifndef ISC_STDTIME_H
 #define ISC_STDTIME_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/int.h>
 
-/*
+/*%
  * It's public information that 'isc_stdtime_t' is an unsigned integral type.
  * Applications that want maximum portability should not assume anything
  * about its size.
  */
 typedef isc_uint32_t isc_stdtime_t;
+/*
+ * isc_stdtime32_t is a 32-bit version of isc_stdtime_t.  A variable of this
+ * type should only be used as an opaque integer (e.g.,) to compare two
+ * time values.
+ */
+typedef isc_uint32_t isc_stdtime32_t;
 
 ISC_LANG_BEGINDECLS
-
+/* */
 void
 isc_stdtime_get(isc_stdtime_t *t);
-/*
+/*%<
  * Set 't' to the number of seconds since 00:00:00 UTC, January 1, 1970.
  *
  * Requires:
  *
- *	't' is a valid pointer.
+ *\li	't' is a valid pointer.
+ */
+
+#define isc_stdtime_convert32(t, t32p) (*(t32p) = t)
+/*
+ * Convert the standard time to its 32-bit version.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/unix/include/isc/strerror.h b/contrib/bind9/lib/isc/unix/include/isc/strerror.h
index f51fbdc..fb2e8a4 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/strerror.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/strerror.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,20 +15,23 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: strerror.h,v 1.2.12.3 2004/03/08 09:04:57 marka Exp $ */
+/* $Id: strerror.h,v 1.4.18.2 2005/04/29 00:17:10 marka Exp $ */
 
 #ifndef ISC_STRERROR_H
 #define ISC_STRERROR_H
 
+/*! \file */
+
 #include <sys/types.h>
 
 #include <isc/lang.h>
 
 ISC_LANG_BEGINDECLS
 
+/*% String Error Size */
 #define ISC_STRERRORSIZE 128
 
-/*
+/*%
  * Provide a thread safe wrapper to strerrror().
  *
  * Requires:
diff --git a/contrib/bind9/lib/isc/unix/include/isc/syslog.h b/contrib/bind9/lib/isc/unix/include/isc/syslog.h
index 2c0625e..08adca1 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/syslog.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/syslog.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: syslog.h,v 1.2.206.1 2004/03/06 08:15:05 marka Exp $ */
+/* $Id: syslog.h,v 1.3.18.2 2005/04/29 00:17:10 marka Exp $ */
 
 #ifndef ISC_SYSLOG_H
 #define ISC_SYSLOG_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -27,17 +29,17 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 isc_syslog_facilityfromstring(const char *str, int *facilityp);
-/*
+/*%<
  * Convert 'str' to the appropriate syslog facility constant.
  *
  * Requires:
  *
- *	'str' is not NULL
- *	'facilityp' is not NULL
+ *\li	'str' is not NULL
+ *\li	'facilityp' is not NULL
  *
  * Returns:
- * 	ISC_R_SUCCESS
- * 	ISC_R_NOTFOUND
+ * \li	#ISC_R_SUCCESS
+ * \li	#ISC_R_NOTFOUND
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isc/unix/include/isc/time.h b/contrib/bind9/lib/isc/unix/include/isc/time.h
index 6021c13..6579439 100644
--- a/contrib/bind9/lib/isc/unix/include/isc/time.h
+++ b/contrib/bind9/lib/isc/unix/include/isc/time.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.h,v 1.25.2.1.10.4 2004/03/08 09:04:58 marka Exp $ */
+/* $Id: time.h,v 1.30.18.2 2005/04/29 00:17:10 marka Exp $ */
 
 #ifndef ISC_TIME_H
 #define ISC_TIME_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/types.h>
 
@@ -27,7 +29,8 @@
  *** Intervals
  ***/
 
-/*
+/*! 
+ *  \brief
  * The contents of this structure are private, and MUST NOT be accessed
  * directly by callers.
  *
@@ -45,32 +48,32 @@ ISC_LANG_BEGINDECLS
 void
 isc_interval_set(isc_interval_t *i,
 		 unsigned int seconds, unsigned int nanoseconds);
-/*
+/*%<
  * Set 'i' to a value representing an interval of 'seconds' seconds and
  * 'nanoseconds' nanoseconds, suitable for use in isc_time_add() and
  * isc_time_subtract().
  *
  * Requires:
  *
- *	't' is a valid pointer.
- *	nanoseconds < 1000000000.
+ *\li	't' is a valid pointer.
+ *\li	nanoseconds < 1000000000.
  */
 
 isc_boolean_t
 isc_interval_iszero(const isc_interval_t *i);
-/*
+/*%<
  * Returns ISC_TRUE iff. 'i' is the zero interval.
  *
  * Requires:
  *
- *	'i' is a valid pointer.
+ *\li	'i' is a valid pointer.
  */
 
 /***
  *** Absolute Times
  ***/
 
-/*
+/*%
  * The contents of this structure are private, and MUST NOT be accessed
  * directly by callers.
  *
@@ -86,116 +89,118 @@ extern isc_time_t *isc_time_epoch;
 
 void
 isc_time_set(isc_time_t *t, unsigned int seconds, unsigned int nanoseconds);
-/*
+/*%<
  * Set 't' to a particular number of seconds + nanoseconds since the epoch.
  *
  * Notes:
- *	This call is equivalent to:
- *
+ *\li	This call is equivalent to:
+ *\code
  *	isc_time_settoepoch(t);
  *	isc_interval_set(i, seconds, nanoseconds);
  *	isc_time_add(t, i, t);
- *
+ *\endcode
  * Requires:
- *	't' is a valid pointer.
- *	nanoseconds < 1000000000.
+ *\li	't' is a valid pointer.
+ *\li	nanoseconds < 1000000000.
  */
 
 void
 isc_time_settoepoch(isc_time_t *t);
-/*
+/*%<
  * Set 't' to the time of the epoch.
  *
  * Notes:
- * 	The date of the epoch is platform-dependent.
+ * \li	The date of the epoch is platform-dependent.
  *
  * Requires:
  *
- *	't' is a valid pointer.
+ *\li	't' is a valid pointer.
  */
 
 isc_boolean_t
 isc_time_isepoch(const isc_time_t *t);
-/*
+/*%<
  * Returns ISC_TRUE iff. 't' is the epoch ("time zero").
  *
  * Requires:
  *
- *	't' is a valid pointer.
+ *\li	't' is a valid pointer.
  */
 
 isc_result_t
 isc_time_now(isc_time_t *t);
-/*
+/*%<
  * Set 't' to the current absolute time.
  *
  * Requires:
  *
- *	't' is a valid pointer.
+ *\li	't' is a valid pointer.
  *
  * Returns:
  *
- *	Success
- *	Unexpected error
+ *\li	Success
+ *\li	Unexpected error
  *		Getting the time from the system failed.
- *	Out of range
+ *\li	Out of range
  *		The time from the system is too large to be represented
  *		in the current definition of isc_time_t.
  */
 
 isc_result_t
 isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i);
-/*
+/*%<
  * Set *t to the current absolute time + i.
  *
  * Note:
- *	This call is equivalent to:
+ *\li	This call is equivalent to:
  *
+ *\code
  *		isc_time_now(t);
  *		isc_time_add(t, i, t);
+ *\endcode
  *
  * Requires:
  *
- *	't' and 'i' are valid pointers.
+ *\li	't' and 'i' are valid pointers.
  *
  * Returns:
  *
- *	Success
- *	Unexpected error
+ *\li	Success
+ *\li	Unexpected error
  *		Getting the time from the system failed.
- *	Out of range
+ *\li	Out of range
  *		The interval added to the time from the system is too large to
  *		be represented in the current definition of isc_time_t.
  */
 
 int
 isc_time_compare(const isc_time_t *t1, const isc_time_t *t2);
-/*
+/*%<
  * Compare the times referenced by 't1' and 't2'
  *
  * Requires:
  *
- *	't1' and 't2' are valid pointers.
+ *\li	't1' and 't2' are valid pointers.
  *
  * Returns:
  *
- *	-1		t1 < t2		(comparing times, not pointers)
- *	0		t1 = t2
- *	1		t1 > t2
+ *\li	-1		t1 < t2		(comparing times, not pointers)
+ *\li	0		t1 = t2
+ *\li	1		t1 > t2
  */
 
 isc_result_t
 isc_time_add(const isc_time_t *t, const isc_interval_t *i, isc_time_t *result);
-/*
+/*%<
  * Add 'i' to 't', storing the result in 'result'.
  *
  * Requires:
  *
- *	't', 'i', and 'result' are valid pointers.
+ *\li	't', 'i', and 'result' are valid pointers.
  *
  * Returns:
- * 	Success
- *	Out of range
+ * \li	Success
+ *\li	Out of range
  * 		The interval added to the time is too large to
  *		be represented in the current definition of isc_time_t.
  */
@@ -203,50 +208,50 @@ isc_time_add(const isc_time_t *t, const isc_interval_t *i, isc_time_t *result);
 isc_result_t
 isc_time_subtract(const isc_time_t *t, const isc_interval_t *i,
 		  isc_time_t *result);
-/*
+/*%<
  * Subtract 'i' from 't', storing the result in 'result'.
  *
  * Requires:
  *
- *	't', 'i', and 'result' are valid pointers.
+ *\li	't', 'i', and 'result' are valid pointers.
  *
  * Returns:
- *	Success
- *	Out of range
+ *\li	Success
+ *\li	Out of range
  *		The interval is larger than the time since the epoch.
  */
 
 isc_uint64_t
 isc_time_microdiff(const isc_time_t *t1, const isc_time_t *t2);
-/*
+/*%<
  * Find the difference in microseconds between time t1 and time t2.
  * t2 is the subtrahend of t1; ie, difference = t1 - t2.
  *
  * Requires:
  *
- *	't1' and 't2' are valid pointers.
+ *\li	't1' and 't2' are valid pointers.
  *
  * Returns:
- *	The difference of t1 - t2, or 0 if t1 <= t2.
+ *\li	The difference of t1 - t2, or 0 if t1 <= t2.
  */
 
 isc_uint32_t
 isc_time_seconds(const isc_time_t *t);
-/*
+/*%<
  * Return the number of seconds since the epoch stored in a time structure.
  *
  * Requires:
  *
- *	't' is a valid pointer.
+ *\li	't' is a valid pointer.
  */
 
 isc_result_t
 isc_time_secondsastimet(const isc_time_t *t, time_t *secondsp);
-/*
+/*%<
  * Ensure the number of seconds in an isc_time_t is representable by a time_t.
  *
  * Notes:
- *	The number of seconds stored in an isc_time_t might be larger
+ *\li	The number of seconds stored in an isc_time_t might be larger
  *	than the number of seconds a time_t is able to handle.  Since
  *	time_t is mostly opaque according to the ANSI/ISO standard
  *	(essentially, all you can be sure of is that it is an arithmetic type,
@@ -256,41 +261,41 @@ isc_time_secondsastimet(const isc_time_t *t, time_t *secondsp);
  *	time_t from an isc_time_t.
  *
  * Requires:
- *	't' is a valid pointer.
+ *\li	't' is a valid pointer.
  *
  * Returns:
- *	Success
- *	Out of range
+ *\li	Success
+ *\li	Out of range
  */
 
 isc_uint32_t
 isc_time_nanoseconds(const isc_time_t *t);
-/*
+/*%<
  * Return the number of nanoseconds stored in a time structure.
  *
  * Notes:
- *	This is the number of nanoseconds in excess of the the number
+ *\li	This is the number of nanoseconds in excess of the the number
  *	of seconds since the epoch; it will always be less than one
  *	full second.
  *
  * Requires:
- *	't' is a valid pointer.
+ *\li	't' is a valid pointer.
  *
  * Ensures:
- *	The returned value is less than 1*10^9.
+ *\li	The returned value is less than 1*10^9.
  */
 
 void
 isc_time_formattimestamp(const isc_time_t *t, char *buf, unsigned int len);
-/*
+/*%<
  * Format the time 't' into the buffer 'buf' of length 'len',
  * using a format like "30-Aug-2000 04:06:47.997" and the local time zone.
  * If the text does not fit in the buffer, the result is indeterminate,
  * but is always guaranteed to be null terminated.
  *
  *  Requires:
- *      'len' > 0
- *      'buf' points to an array of at least len chars
+ *\li      'len' > 0
+ *  \li    'buf' points to an array of at least len chars
  *
  */
 
diff --git a/contrib/bind9/lib/isc/unix/interfaceiter.c b/contrib/bind9/lib/isc/unix/interfaceiter.c
index 9520bdeb..72ecdd2 100644
--- a/contrib/bind9/lib/isc/unix/interfaceiter.c
+++ b/contrib/bind9/lib/isc/unix/interfaceiter.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: interfaceiter.c,v 1.22.2.1.10.14 2004/08/28 06:25:22 marka Exp $ */
+/* $Id: interfaceiter.c,v 1.35.18.5 2005/04/29 00:17:08 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -51,9 +53,9 @@
 
 /* Common utility functions */
 
-/*
+/*%
  * Extract the network address part from a "struct sockaddr".
- *
+ * \brief
  * The address family is given explicitly
  * instead of using src->sa_family, because the latter does not work
  * for copying a network mask obtained by SIOCGIFNETMASK (it does
diff --git a/contrib/bind9/lib/isc/unix/ipv6.c b/contrib/bind9/lib/isc/unix/ipv6.c
index f11262f..3066e0c 100644
--- a/contrib/bind9/lib/isc/unix/ipv6.c
+++ b/contrib/bind9/lib/isc/unix/ipv6.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ipv6.c,v 1.7.206.3 2006/08/25 05:25:50 marka Exp $ */
+/* $Id: ipv6.c,v 1.8.18.4 2006/08/25 05:25:51 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/unix/keyboard.c b/contrib/bind9/lib/isc/unix/keyboard.c
index 146338a..db56b3c 100644
--- a/contrib/bind9/lib/isc/unix/keyboard.c
+++ b/contrib/bind9/lib/isc/unix/keyboard.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keyboard.c,v 1.9.12.3 2004/03/08 09:04:56 marka Exp $ */
+/* $Id: keyboard.c,v 1.11 2004/03/05 05:11:46 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/unix/net.c b/contrib/bind9/lib/isc/unix/net.c
index e0aeccb..6169c2b 100644
--- a/contrib/bind9/lib/isc/unix/net.c
+++ b/contrib/bind9/lib/isc/unix/net.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: net.c,v 1.22.2.2.10.9 2005/03/17 03:58:33 marka Exp $ */
+/* $Id: net.c,v 1.29.18.4 2005/03/16 01:22:50 marka Exp $ */
 
 #include <config.h>
 
@@ -43,6 +43,7 @@ static isc_once_t 	once_ipv6only = ISC_ONCE_INIT;
 static isc_once_t 	once_ipv6pktinfo = ISC_ONCE_INIT;
 static isc_result_t	ipv4_result = ISC_R_NOTFOUND;
 static isc_result_t	ipv6_result = ISC_R_NOTFOUND;
+static isc_result_t	unix_result = ISC_R_NOTFOUND;
 static isc_result_t	ipv6only_result = ISC_R_NOTFOUND;
 static isc_result_t	ipv6pktinfo_result = ISC_R_NOTFOUND;
 
@@ -137,6 +138,9 @@ initialize_action(void) {
 #endif
 #endif
 #endif
+#ifdef ISC_PLATFORM_HAVESYSUNH
+	unix_result = try_proto(PF_UNIX);
+#endif
 }
 
 static void
@@ -156,6 +160,12 @@ isc_net_probeipv6(void) {
 	return (ipv6_result);
 }
 
+isc_result_t
+isc_net_probeunix(void) {
+	initialize();
+	return (unix_result);
+}
+
 #ifdef ISC_PLATFORM_HAVEIPV6
 #ifdef WANT_IPV6
 static void
diff --git a/contrib/bind9/lib/isc/unix/os.c b/contrib/bind9/lib/isc/unix/os.c
index 4d34d8c..6bbf059 100644
--- a/contrib/bind9/lib/isc/unix/os.c
+++ b/contrib/bind9/lib/isc/unix/os.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: os.c,v 1.11.12.6 2005/10/14 02:13:07 marka Exp $ */
+/* $Id: os.c,v 1.13.18.3 2005/10/14 02:13:08 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/unix/resource.c b/contrib/bind9/lib/isc/unix/resource.c
index b6faf32..703ec27 100644
--- a/contrib/bind9/lib/isc/unix/resource.c
+++ b/contrib/bind9/lib/isc/unix/resource.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resource.c,v 1.11.206.1 2004/03/06 08:15:01 marka Exp $ */
+/* $Id: resource.c,v 1.12 2004/03/05 05:11:46 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/unix/socket.c b/contrib/bind9/lib/isc/unix/socket.c
index f95e3c8..6b4c34c 100644
--- a/contrib/bind9/lib/isc/unix/socket.c
+++ b/contrib/bind9/lib/isc/unix/socket.c
@@ -15,13 +15,19 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.207.2.19.2.26 2006/05/19 02:53:36 marka Exp $ */
+/* $Id: socket.c,v 1.237.18.24 2006/06/06 00:56:09 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/socket.h>
+#include <sys/stat.h>
+#ifdef ISC_PLATFORM_HAVESYSUNH
+#include <sys/un.h>
+#endif
 #include <sys/time.h>
 #include <sys/uio.h>
 
@@ -57,7 +63,7 @@
 #include "socket_p.h"
 #endif /* ISC_PLATFORM_USETHREADS */
 
-/*
+/*%
  * Some systems define the socket length argument as an int, some as size_t,
  * some as socklen_t.  This is here so it can be easily changed if needed.
  */
@@ -65,7 +71,7 @@
 #define ISC_SOCKADDR_LEN_T unsigned int
 #endif
 
-/*
+/*%
  * Define what the possible "soft" errors can be.  These are non-fatal returns
  * of various network related functions, like recv() and so on.
  *
@@ -80,7 +86,7 @@
 
 #define DLVL(x) ISC_LOGCATEGORY_GENERAL, ISC_LOGMODULE_SOCKET, ISC_LOG_DEBUG(x)
 
-/*
+/*!<
  * DLVL(90)  --  Function entry/exit and other tracing.
  * DLVL(70)  --  Socket "correctness" -- including returning of events, etc.
  * DLVL(60)  --  Socket data send/receive
@@ -104,7 +110,7 @@ typedef isc_event_t intev_t;
 #define SOCKET_MAGIC		ISC_MAGIC('I', 'O', 'i', 'o')
 #define VALID_SOCKET(t)		ISC_MAGIC_VALID(t, SOCKET_MAGIC)
 
-/*
+/*!
  * IPv6 control information.  If the socket is an IPv6 socket we want
  * to collect the destination address and interface so the client can
  * set them on outgoing packets.
@@ -115,7 +121,7 @@ typedef isc_event_t intev_t;
 #endif
 #endif
 
-/*
+/*%
  * NetBSD and FreeBSD can timestamp packets.  XXXMLG Should we have
  * a setsockopt() like interface to request timestamps, and if the OS
  * doesn't do it for us, call gettimeofday() on every UDP receive?
@@ -126,7 +132,12 @@ typedef isc_event_t intev_t;
 #endif
 #endif
 
-/*
+/*%
+ * The size to raise the recieve buffer to (from BIND 8).
+ */
+#define RCVBUFSIZE (32*1024)
+
+/*%
  * The number of times a send operation is repeated if the result is EINTR.
  */
 #define NRETRIES 10
@@ -238,9 +249,9 @@ static void build_msghdr_recv(isc_socket_t *, isc_socketevent_t *,
 #define SELECT_POKE_SHUTDOWN		(-1)
 #define SELECT_POKE_NOTHING		(-2)
 #define SELECT_POKE_READ		(-3)
-#define SELECT_POKE_ACCEPT		(-3) /* Same as _READ */
+#define SELECT_POKE_ACCEPT		(-3) /*%< Same as _READ */
 #define SELECT_POKE_WRITE		(-4)
-#define SELECT_POKE_CONNECT		(-4) /* Same as _WRITE */
+#define SELECT_POKE_CONNECT		(-4) /*%< Same as _WRITE */
 #define SELECT_POKE_CLOSE		(-5)
 
 #define SOCK_DEAD(s)			((s)->references == 0)
@@ -870,6 +881,15 @@ set_dev_address(isc_sockaddr_t *address, isc_socket_t *sock,
 	}
 }
 
+static void
+destroy_socketevent(isc_event_t *event) {
+	isc_socketevent_t *ev = (isc_socketevent_t *)event;
+
+	INSIST(ISC_LIST_EMPTY(ev->bufferlist));
+
+	(ev->destroy)(event);
+}
+
 static isc_socketevent_t *
 allocate_socketevent(isc_socket_t *sock, isc_eventtype_t eventtype,
 		     isc_taskaction_t action, const void *arg)
@@ -891,6 +911,8 @@ allocate_socketevent(isc_socket_t *sock, isc_eventtype_t eventtype,
 	ev->n = 0;
 	ev->offset = 0;
 	ev->attributes = 0;
+	ev->destroy = ev->ev_destroy;
+	ev->ev_destroy = destroy_socketevent;
 
 	return (ev);
 }
@@ -1225,7 +1247,7 @@ allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
 		isc_socket_t **socketp)
 {
 	isc_socket_t *sock;
-	isc_result_t ret;
+	isc_result_t result;
 	ISC_SOCKADDR_LEN_T cmsgbuflen;
 
 	sock = isc_mem_get(manager->mctx, sizeof(*sock));
@@ -1233,7 +1255,7 @@ allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
 	if (sock == NULL)
 		return (ISC_R_NOMEMORY);
 
-	ret = ISC_R_UNEXPECTED;
+	result = ISC_R_UNEXPECTED;
 
 	sock->magic = 0;
 	sock->references = 0;
@@ -1293,13 +1315,9 @@ allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
 	/*
 	 * initialize the lock
 	 */
-	if (isc_mutex_init(&sock->lock) != ISC_R_SUCCESS) {
+	result = isc_mutex_init(&sock->lock);
+	if (result != ISC_R_SUCCESS) {
 		sock->magic = 0;
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		ret = ISC_R_UNEXPECTED;
 		goto error;
 	}
 
@@ -1327,7 +1345,7 @@ allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
 			    sock->sendcmsgbuflen);
 	isc_mem_put(manager->mctx, sock, sizeof(*sock));
 
-	return (ret);
+	return (result);
 }
 
 /*
@@ -1379,19 +1397,23 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 		  isc_socket_t **socketp)
 {
 	isc_socket_t *sock = NULL;
-	isc_result_t ret;
+	isc_result_t result;
 #if defined(USE_CMSG) || defined(SO_BSDCOMPAT)
 	int on = 1;
 #endif
+#if defined(SO_RCVBUF)
+	ISC_SOCKADDR_LEN_T optlen;
+	int size;
+#endif
 	char strbuf[ISC_STRERRORSIZE];
 	const char *err = "socket";
 
 	REQUIRE(VALID_MANAGER(manager));
 	REQUIRE(socketp != NULL && *socketp == NULL);
 
-	ret = allocate_socket(manager, type, &sock);
-	if (ret != ISC_R_SUCCESS)
-		return (ret);
+	result = allocate_socket(manager, type, &sock);
+	if (result != ISC_R_SUCCESS)
+		return (result);
 
 	sock->pf = pf;
 	switch (type) {
@@ -1401,6 +1423,9 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	case isc_sockettype_tcp:
 		sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP);
 		break;
+	case isc_sockettype_unix:
+		sock->fd = socket(pf, SOCK_STREAM, 0);
+		break;
 	}
 
 #ifdef F_DUPFD
@@ -1468,7 +1493,8 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	}
 
 #ifdef SO_BSDCOMPAT
-	if (setsockopt(sock->fd, SOL_SOCKET, SO_BSDCOMPAT,
+	if (type != isc_sockettype_unix &&
+	    setsockopt(sock->fd, SOL_SOCKET, SO_BSDCOMPAT,
 		       (void *)&on, sizeof(on)) < 0) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -1481,9 +1507,10 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	}
 #endif
 
-#if defined(USE_CMSG)
+#if defined(USE_CMSG) || defined(SO_RCVBUF)
 	if (type == isc_sockettype_udp) {
 
+#if defined(USE_CMSG)
 #if defined(SO_TIMESTAMP)
 		if (setsockopt(sock->fd, SOL_SOCKET, SO_TIMESTAMP,
 			       (void *)&on, sizeof(on)) < 0
@@ -1553,9 +1580,30 @@ isc_socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 		}
 #endif
 #endif /* ISC_PLATFORM_HAVEIPV6 */
-
+#endif /* defined(USE_CMSG) */
+
+#if defined(SO_RCVBUF)
+		optlen = sizeof(size);
+		if (getsockopt(sock->fd, SOL_SOCKET, SO_RCVBUF,
+			       (void *)&size, &optlen) >= 0 &&
+		     size < RCVBUFSIZE) {
+			size = RCVBUFSIZE;
+			if (setsockopt(sock->fd, SOL_SOCKET, SO_RCVBUF,
+				       (void *)&size, sizeof(size)) == -1) {
+				isc__strerror(errno, strbuf, sizeof(strbuf));
+				UNEXPECTED_ERROR(__FILE__, __LINE__,
+					"setsockopt(%d, SO_RCVBUF, %d) %s: %s",
+					sock->fd, size,
+					isc_msgcat_get(isc_msgcat,
+						       ISC_MSGSET_GENERAL,
+						       ISC_MSG_FAILED,
+						       "failed"),
+					strbuf);
+			}
+		}
+#endif
 	}
-#endif /* USE_CMSG */
+#endif /* defined(USE_CMSG) || defined(SO_RCVBUF) */
 
 	sock->references = 1;
 	*socketp = sock;
@@ -2316,6 +2364,7 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 #ifdef ISC_PLATFORM_USETHREADS
 	char strbuf[ISC_STRERRORSIZE];
 #endif
+	isc_result_t result;
 
 	REQUIRE(managerp != NULL && *managerp == NULL);
 
@@ -2335,13 +2384,10 @@ isc_socketmgr_create(isc_mem_t *mctx, isc_socketmgr_t **managerp) {
 	manager->mctx = NULL;
 	memset(manager->fds, 0, sizeof(manager->fds));
 	ISC_LIST_INIT(manager->socklist);
-	if (isc_mutex_init(&manager->lock) != ISC_R_SUCCESS) {
+	result = isc_mutex_init(&manager->lock);
+	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, manager, sizeof(*manager));
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_mutex_init() %s",
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		return (ISC_R_UNEXPECTED);
+		return (result);
 	}
 #ifdef ISC_PLATFORM_USETHREADS
 	if (isc_condition_init(&manager->shutdown_ok) != ISC_R_SUCCESS) {
@@ -2884,6 +2930,190 @@ isc_socket_sendto2(isc_socket_t *sock, isc_region_t *region,
 	return (socket_send(sock, event, task, address, pktinfo, flags));
 }
 
+void
+isc_socket_cleanunix(isc_sockaddr_t *sockaddr, isc_boolean_t active) {
+#ifdef ISC_PLATFORM_HAVESYSUNH
+	int s;
+	struct stat sb;
+	char strbuf[ISC_STRERRORSIZE];
+
+	if (sockaddr->type.sa.sa_family != AF_UNIX)
+		return;
+
+#ifndef S_ISSOCK
+#if defined(S_IFMT) && defined(S_IFSOCK)
+#define S_ISSOCK(mode) ((mode & S_IFMT)==S_IFSOCK)
+#elif defined(_S_IFMT) && defined(S_IFSOCK)
+#define S_ISSOCK(mode) ((mode & _S_IFMT)==S_IFSOCK)
+#endif
+#endif
+
+#ifndef S_ISFIFO
+#if defined(S_IFMT) && defined(S_IFIFO)
+#define S_ISFIFO(mode) ((mode & S_IFMT)==S_IFIFO)
+#elif defined(_S_IFMT) && defined(S_IFIFO)
+#define S_ISFIFO(mode) ((mode & _S_IFMT)==S_IFIFO)
+#endif
+#endif
+
+#if !defined(S_ISFIFO) && !defined(S_ISSOCK)
+#error You need to define S_ISFIFO and S_ISSOCK as appropriate for your platform.  See <sys/stat.h>.
+#endif
+
+#ifndef S_ISFIFO
+#define S_ISFIFO(mode) 0
+#endif
+
+#ifndef S_ISSOCK
+#define S_ISSOCK(mode) 0
+#endif
+
+	if (active) {
+		if (stat(sockaddr->type.sunix.sun_path, &sb) < 0) {
+			isc__strerror(errno, strbuf, sizeof(strbuf));
+			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+				      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+				      "isc_socket_cleanunix: stat(%s): %s",
+				      sockaddr->type.sunix.sun_path, strbuf);
+			return;
+		}
+		if (!(S_ISSOCK(sb.st_mode) || S_ISFIFO(sb.st_mode))) {
+			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+				      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+				      "isc_socket_cleanunix: %s: not a socket",
+				      sockaddr->type.sunix.sun_path);
+			return;
+		}
+		if (unlink(sockaddr->type.sunix.sun_path) < 0) {
+			isc__strerror(errno, strbuf, sizeof(strbuf));
+			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+				      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+				      "isc_socket_cleanunix: unlink(%s): %s",
+				      sockaddr->type.sunix.sun_path, strbuf);
+		}
+		return;
+	}
+
+	s = socket(AF_UNIX, SOCK_STREAM, 0);
+	if (s < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_SOCKET, ISC_LOG_WARNING,
+			      "isc_socket_cleanunix: socket(%s): %s",
+			      sockaddr->type.sunix.sun_path, strbuf);
+		return;
+	}
+
+	if (stat(sockaddr->type.sunix.sun_path, &sb) < 0) {
+		switch (errno) {
+		case ENOENT:    /* We exited cleanly last time */
+			break;
+		default:
+			isc__strerror(errno, strbuf, sizeof(strbuf));
+			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+				      ISC_LOGMODULE_SOCKET, ISC_LOG_WARNING,
+				      "isc_socket_cleanunix: stat(%s): %s",
+				      sockaddr->type.sunix.sun_path, strbuf);
+			break;
+		}
+		goto cleanup;
+	}
+
+	if (!(S_ISSOCK(sb.st_mode) || S_ISFIFO(sb.st_mode))) {
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_SOCKET, ISC_LOG_WARNING,
+			      "isc_socket_cleanunix: %s: not a socket",
+			      sockaddr->type.sunix.sun_path);
+		goto cleanup;
+	}
+
+	if (connect(s, (struct sockaddr *)&sockaddr->type.sunix,
+		    sizeof(sockaddr->type.sunix)) < 0) {
+		switch (errno) {
+		case ECONNREFUSED:
+		case ECONNRESET:
+			if (unlink(sockaddr->type.sunix.sun_path) < 0) {
+				isc__strerror(errno, strbuf, sizeof(strbuf));
+				isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+					      ISC_LOGMODULE_SOCKET,
+					      ISC_LOG_WARNING,
+					      "isc_socket_cleanunix: "
+					      "unlink(%s): %s",
+					      sockaddr->type.sunix.sun_path,
+					      strbuf);
+			}
+			break;
+		default:
+			isc__strerror(errno, strbuf, sizeof(strbuf));
+			isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+				      ISC_LOGMODULE_SOCKET, ISC_LOG_WARNING,
+				      "isc_socket_cleanunix: connect(%s): %s",
+				      sockaddr->type.sunix.sun_path, strbuf);
+			break;
+		}
+	}
+ cleanup:
+	close(s);
+#else
+	UNUSED(sockaddr);
+	UNUSED(active);
+#endif
+}
+
+isc_result_t
+isc_socket_permunix(isc_sockaddr_t *sockaddr, isc_uint32_t perm,
+		    isc_uint32_t owner, isc_uint32_t group)
+{
+#ifdef ISC_PLATFORM_HAVESYSUNH
+	isc_result_t result = ISC_R_SUCCESS;
+	char strbuf[ISC_STRERRORSIZE];
+	char path[sizeof(sockaddr->type.sunix.sun_path)];
+#ifdef NEED_SECURE_DIRECTORY
+	char *slash;
+#endif
+
+	REQUIRE(sockaddr->type.sa.sa_family == AF_UNIX);
+	INSIST(strlen(sockaddr->type.sunix.sun_path) < sizeof(path));
+	strcpy(path, sockaddr->type.sunix.sun_path);
+
+#ifdef NEED_SECURE_DIRECTORY
+	slash = strrchr(path, '/');
+	if (slash != NULL) {
+		if (slash != path)
+			*slash = '\0';
+		else
+			strcpy(path, "/");
+	} else
+		strcpy(path, ".");
+#endif
+	
+	if (chmod(path, perm) < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+			      "isc_socket_permunix: chmod(%s, %d): %s",
+			      path, perm, strbuf);
+		result = ISC_R_FAILURE;
+	}
+	if (chown(path, owner, group) < 0) {
+		isc__strerror(errno, strbuf, sizeof(strbuf));
+		isc_log_write(isc_lctx, ISC_LOGCATEGORY_GENERAL,
+			      ISC_LOGMODULE_SOCKET, ISC_LOG_ERROR,
+			      "isc_socket_permunix: chown(%s, %d, %d): %s",
+			      path, owner, group,
+			      strbuf);
+		result = ISC_R_FAILURE;
+	}
+	return (result);
+#else
+	UNUSED(sockaddr);
+	UNUSED(perm);
+	UNUSED(owner);
+	UNUSED(group);
+	return (ISC_R_NOTIMPLEMENTED);
+#endif
+}
+
 isc_result_t
 isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *sockaddr) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -2900,6 +3130,10 @@ isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *sockaddr) {
 	/*
 	 * Only set SO_REUSEADDR when we want a specific port.
 	 */
+#ifdef AF_UNIX
+	if (sock->pf == AF_UNIX)
+		goto bind_socket;
+#endif
 	if (isc_sockaddr_getport(sockaddr) != (in_port_t)0 &&
 	    setsockopt(sock->fd, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
 		       sizeof(on)) < 0) {
@@ -2909,6 +3143,9 @@ isc_socket_bind(isc_socket_t *sock, isc_sockaddr_t *sockaddr) {
 						ISC_MSG_FAILED, "failed"));
 		/* Press on... */
 	}
+#ifdef AF_UNIX
+ bind_socket:
+#endif
 	if (bind(sock->fd, &sockaddr->type.sa, sockaddr->length) < 0) {
 		UNLOCK(&sock->lock);
 		switch (errno) {
@@ -2985,7 +3222,8 @@ isc_socket_listen(isc_socket_t *sock, unsigned int backlog) {
 
 	REQUIRE(!sock->listener);
 	REQUIRE(sock->bound);
-	REQUIRE(sock->type == isc_sockettype_tcp);
+	REQUIRE(sock->type == isc_sockettype_tcp ||
+		sock->type == isc_sockettype_unix);
 
 	if (backlog == 0)
 		backlog = SOMAXCONN;
@@ -3016,7 +3254,7 @@ isc_socket_accept(isc_socket_t *sock,
 	isc_socketmgr_t *manager;
 	isc_task_t *ntask = NULL;
 	isc_socket_t *nsock;
-	isc_result_t ret;
+	isc_result_t result;
 	isc_boolean_t do_poke = ISC_FALSE;
 
 	REQUIRE(VALID_SOCKET(sock));
@@ -3041,11 +3279,11 @@ isc_socket_accept(isc_socket_t *sock,
 	}
 	ISC_LINK_INIT(dev, ev_link);
 
-	ret = allocate_socket(manager, sock->type, &nsock);
-	if (ret != ISC_R_SUCCESS) {
+	result = allocate_socket(manager, sock->type, &nsock);
+	if (result != ISC_R_SUCCESS) {
 		isc_event_free(ISC_EVENT_PTR(&dev));
 		UNLOCK(&sock->lock);
-		return (ret);
+		return (result);
 	}
 
 	/*
@@ -3309,7 +3547,7 @@ internal_connect(isc_task_t *me, isc_event_t *ev) {
 
 isc_result_t
 isc_socket_getpeername(isc_socket_t *sock, isc_sockaddr_t *addressp) {
-	isc_result_t ret;
+	isc_result_t result;
 
 	REQUIRE(VALID_SOCKET(sock));
 	REQUIRE(addressp != NULL);
@@ -3318,20 +3556,20 @@ isc_socket_getpeername(isc_socket_t *sock, isc_sockaddr_t *addressp) {
 
 	if (sock->connected) {
 		*addressp = sock->address;
-		ret = ISC_R_SUCCESS;
+		result = ISC_R_SUCCESS;
 	} else {
-		ret = ISC_R_NOTCONNECTED;
+		result = ISC_R_NOTCONNECTED;
 	}
 
 	UNLOCK(&sock->lock);
 
-	return (ret);
+	return (result);
 }
 
 isc_result_t
 isc_socket_getsockname(isc_socket_t *sock, isc_sockaddr_t *addressp) {
 	ISC_SOCKADDR_LEN_T len;
-	isc_result_t ret;
+	isc_result_t result;
 	char strbuf[ISC_STRERRORSIZE];
 
 	REQUIRE(VALID_SOCKET(sock));
@@ -3340,18 +3578,18 @@ isc_socket_getsockname(isc_socket_t *sock, isc_sockaddr_t *addressp) {
 	LOCK(&sock->lock);
 
 	if (!sock->bound) {
-		ret = ISC_R_NOTBOUND;
+		result = ISC_R_NOTBOUND;
 		goto out;
 	}
 
-	ret = ISC_R_SUCCESS;
+	result = ISC_R_SUCCESS;
 
 	len = sizeof(addressp->type);
 	if (getsockname(sock->fd, &addressp->type.sa, (void *)&len) < 0) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		UNEXPECTED_ERROR(__FILE__, __LINE__, "getsockname: %s",
 				 strbuf);
-		ret = ISC_R_UNEXPECTED;
+		result = ISC_R_UNEXPECTED;
 		goto out;
 	}
 	addressp->length = (unsigned int)len;
@@ -3359,7 +3597,7 @@ isc_socket_getsockname(isc_socket_t *sock, isc_sockaddr_t *addressp) {
  out:
 	UNLOCK(&sock->lock);
 
-	return (ret);
+	return (result);
 }
 
 /*
diff --git a/contrib/bind9/lib/isc/unix/socket_p.h b/contrib/bind9/lib/isc/unix/socket_p.h
index f430bf2..c260bbc 100644
--- a/contrib/bind9/lib/isc/unix/socket_p.h
+++ b/contrib/bind9/lib/isc/unix/socket_p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket_p.h,v 1.6.206.1 2004/03/06 08:15:02 marka Exp $ */
+/* $Id: socket_p.h,v 1.7.18.2 2005/04/29 00:17:08 marka Exp $ */
 
 #ifndef ISC_SOCKET_P_H
 #define ISC_SOCKET_P_H
 
+/*! \file */
+
 #ifdef ISC_PLATFORM_NEEDSYSSELECTH
 #include <sys/select.h>
 #endif
diff --git a/contrib/bind9/lib/isc/unix/stdio.c b/contrib/bind9/lib/isc/unix/stdio.c
index 794164e..64db925 100644
--- a/contrib/bind9/lib/isc/unix/stdio.c
+++ b/contrib/bind9/lib/isc/unix/stdio.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdio.c,v 1.5.206.1 2004/03/06 08:15:02 marka Exp $ */
+/* $Id: stdio.c,v 1.6 2004/03/05 05:11:47 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/unix/stdtime.c b/contrib/bind9/lib/isc/unix/stdtime.c
index b8d818d..3f240b7 100644
--- a/contrib/bind9/lib/isc/unix/stdtime.c
+++ b/contrib/bind9/lib/isc/unix/stdtime.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdtime.c,v 1.11.2.1.10.5 2005/06/09 23:54:31 marka Exp $ */
+/* $Id: stdtime.c,v 1.14.18.3 2005/06/08 02:07:57 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/unix/strerror.c b/contrib/bind9/lib/isc/unix/strerror.c
index 863867e..18cc367 100644
--- a/contrib/bind9/lib/isc/unix/strerror.c
+++ b/contrib/bind9/lib/isc/unix/strerror.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: strerror.c,v 1.1.2.1.10.3 2004/03/08 09:04:57 marka Exp $ */
+/* $Id: strerror.c,v 1.4.18.2 2005/04/29 00:17:08 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -29,7 +31,7 @@
 #include <isc/util.h>
 
 #ifdef HAVE_STRERROR
-/*
+/*%
  * We need to do this this way for profiled locks.
  */
 static isc_mutex_t isc_strerror_lock;
diff --git a/contrib/bind9/lib/isc/unix/syslog.c b/contrib/bind9/lib/isc/unix/syslog.c
index e531544..cc99339 100644
--- a/contrib/bind9/lib/isc/unix/syslog.c
+++ b/contrib/bind9/lib/isc/unix/syslog.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: syslog.c,v 1.1.12.3 2004/03/08 09:04:57 marka Exp $ */
+/* $Id: syslog.c,v 1.3.18.2 2005/04/29 00:17:09 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isc/unix/time.c b/contrib/bind9/lib/isc/unix/time.c
index 39c851c..bac24d7 100644
--- a/contrib/bind9/lib/isc/unix/time.c
+++ b/contrib/bind9/lib/isc/unix/time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.c,v 1.34.2.6.2.4 2004/03/06 08:15:03 marka Exp $ */
+/* $Id: time.c,v 1.47.18.2 2005/04/29 00:17:09 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -33,9 +35,9 @@
 #include <isc/time.h>
 #include <isc/util.h>
 
-#define NS_PER_S	1000000000	/* Nanoseconds per second. */
-#define NS_PER_US	1000		/* Nanoseconds per microsecond. */
-#define US_PER_S	1000000		/* Microseconds per second. */
+#define NS_PER_S	1000000000	/*%< Nanoseconds per second. */
+#define NS_PER_US	1000		/*%< Nanoseconds per microsecond. */
+#define US_PER_S	1000000		/*%< Microseconds per second. */
 
 /*
  * All of the INSIST()s checks of nanoseconds < NS_PER_S are for
@@ -48,7 +50,7 @@
 #define ISC_FIX_TV_USEC 1
 #endif
 
-/***
+/*%
  *** Intervals
  ***/
 
diff --git a/contrib/bind9/lib/isc/version.c b/contrib/bind9/lib/isc/version.c
index d0f270d..6d3b3d2 100644
--- a/contrib/bind9/lib/isc/version.c
+++ b/contrib/bind9/lib/isc/version.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.c,v 1.9.12.3 2004/03/08 09:04:51 marka Exp $ */
+/* $Id: version.c,v 1.11.18.2 2005/04/29 00:16:51 marka Exp $ */
+
+/*! \file */
 
 #include <isc/version.h>
 
diff --git a/contrib/bind9/lib/isc/x86_32/include/isc/atomic.h b/contrib/bind9/lib/isc/x86_32/include/isc/atomic.h
new file mode 100644
index 0000000..f3136d9
--- /dev/null
+++ b/contrib/bind9/lib/isc/x86_32/include/isc/atomic.h
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.2.2.3 2005/07/27 04:23:33 marka Exp $ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+#include <isc/platform.h>
+#include <isc/types.h>
+
+#ifdef ISC_PLATFORM_USEGCCASM
+/*
+ * This routine atomically increments the value stored in 'p' by 'val', and
+ * returns the previous value.
+ */
+static inline isc_int32_t
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	isc_int32_t prev = val;
+
+	__asm__ volatile(
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+		"xadd %0, %1"
+		:"=q"(prev)
+		:"m"(*p), "0"(prev)
+		:"memory", "cc");
+
+	return (prev);
+}
+
+/*
+ * This routine atomically stores the value 'val' in 'p'.
+ */
+static inline void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	__asm__ volatile(
+#ifdef ISC_PLATFORM_USETHREADS
+		/*
+		 * xchg should automatically lock memory, but we add it
+		 * explicitly just in case (it at least doesn't harm)
+		 */
+		"lock;"		
+#endif
+
+		"xchgl %1, %0"
+		:
+		: "r"(val), "m"(*p)
+		: "memory");
+}
+
+/*
+ * This routine atomically replaces the value in 'p' with 'val', if the
+ * original value is equal to 'cmpval'.  The original value is returned in any
+ * case.
+ */
+static inline isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+	__asm__ volatile(
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+		"cmpxchgl %1, %2"
+		: "=a"(cmpval)
+		: "r"(val), "m"(*p), "a"(cmpval)
+		: "memory");
+
+	return (cmpval);
+}
+
+#elif defined(ISC_PLATFORM_USESTDASM)
+/*
+ * The followings are "generic" assembly code which implements the same
+ * functionality in case the gcc extension cannot be used.  It should be
+ * better to avoid inlining below, since we directly refer to specific
+ * positions of the stack frame, which would not actually point to the
+ * intended address in the embedded mnemonic.
+ */
+#include <isc/util.h>		/* for 'UNUSED' macro */
+
+static isc_int32_t
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	UNUSED(p);
+	UNUSED(val);
+
+	__asm (
+		"movl 8(%ebp), %ecx\n"
+		"movl 12(%ebp), %edx\n"
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+		"xadd %edx, (%ecx)\n"
+
+		/*
+		 * set the return value directly in the register so that we
+		 * can avoid guessing the correct position in the stack for a
+		 * local variable.
+		 */
+		"movl %edx, %eax"
+		);
+}
+
+static void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	UNUSED(p);
+	UNUSED(val);
+
+	__asm (
+		"movl 8(%ebp), %ecx\n"
+		"movl 12(%ebp), %edx\n"
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+		"xchgl (%ecx), %edx\n"
+		);
+}
+
+static isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+	UNUSED(p);
+	UNUSED(cmpval);
+	UNUSED(val);
+
+	__asm (
+		"movl 8(%ebp), %ecx\n"
+		"movl 12(%ebp), %eax\n"	/* must be %eax for cmpxchgl */
+		"movl 16(%ebp), %edx\n"
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+
+		/*
+		 * If (%ecx) == %eax then (%ecx) := %edx.
+		 % %eax is set to old (%ecx), which will be the return value.
+		 */
+		"cmpxchgl %edx, (%ecx)"
+		);
+}
+#else /* !ISC_PLATFORM_USEGCCASM && !ISC_PLATFORM_USESTDASM */
+
+#error "unsupported compiler.  disable atomic ops by --disable-atomic"
+
+#endif
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isc/x86_64/include/isc/atomic.h b/contrib/bind9/lib/isc/x86_64/include/isc/atomic.h
new file mode 100644
index 0000000..0752d8f
--- /dev/null
+++ b/contrib/bind9/lib/isc/x86_64/include/isc/atomic.h
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: atomic.h,v 1.2.20.1 2005/09/02 13:27:12 marka Exp $ */
+
+#ifndef ISC_ATOMIC_H
+#define ISC_ATOMIC_H 1
+
+#include <isc/platform.h>
+#include <isc/types.h>
+
+#ifdef ISC_PLATFORM_USEGCCASM
+
+/* We share the gcc-version with x86_32 */
+#error "impossible case.  check build configuration"
+
+#elif defined(ISC_PLATFORM_USESTDASM)
+/*
+ * The followings are "generic" assembly code which implements the same
+ * functionality in case the gcc extension cannot be used.  It should be
+ * better to avoid inlining below, since we directly refer to specific
+ * registers for arguments, which would not actually correspond to the
+ * intended address or value in the embedded mnemonic.
+ */
+#include <isc/util.h>		/* for 'UNUSED' macro */
+
+static isc_int32_t
+isc_atomic_xadd(isc_int32_t *p, isc_int32_t val) {
+	UNUSED(p);
+	UNUSED(val);
+
+	__asm (
+		"movq %rdi, %rdx\n"
+		"movl %esi, %eax\n"
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+		"xadd %eax, (%rdx)\n"
+
+		/*
+		 * set the return value directly in the register so that we
+		 * can avoid guessing the correct position in the stack for a
+		 * local variable.
+		 */
+		);
+}
+
+static void
+isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
+	UNUSED(p);
+	UNUSED(val);
+
+	__asm (
+		"movq %rdi, %rax\n"
+		"movl %esi, %edx\n"
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+		"xchgl (%rax), %edx\n"
+		);
+}
+
+static isc_int32_t
+isc_atomic_cmpxchg(isc_int32_t *p, isc_int32_t cmpval, isc_int32_t val) {
+	UNUSED(p);
+	UNUSED(cmpval);
+	UNUSED(val);
+
+	__asm (
+		"movl %edx, %ecx\n"
+		"movl %esi, %eax\n"
+		"movq %rdi, %rdx\n"
+
+#ifdef ISC_PLATFORM_USETHREADS
+		"lock;"
+#endif
+		/*
+		 * If (%rdi) == %eax then (%rdi) := %edx.
+		 % %eax is set to old (%ecx), which will be the return value.
+		 */
+		"cmpxchgl %ecx, (%rdx)"
+		);
+}
+
+#else /* !ISC_PLATFORM_USEGCCASM && !ISC_PLATFORM_USESTDASM */
+
+#error "unsupported compiler.  disable atomic ops by --disable-atomic"
+
+#endif
+#endif /* ISC_ATOMIC_H */
diff --git a/contrib/bind9/lib/isccc/Makefile.in b/contrib/bind9/lib/isccc/Makefile.in
index f6ae951..cb41681 100644
--- a/contrib/bind9/lib/isccc/Makefile.in
+++ b/contrib/bind9/lib/isccc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.2.12.5 2004/07/20 07:01:58 marka Exp $
+# $Id: Makefile.in,v 1.6.18.1 2004/07/20 07:03:29 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isccc/alist.c b/contrib/bind9/lib/isccc/alist.c
index 21b14a2..a8335c8 100644
--- a/contrib/bind9/lib/isccc/alist.c
+++ b/contrib/bind9/lib/isccc/alist.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: alist.c,v 1.2.206.1 2004/03/06 08:15:18 marka Exp $ */
+/* $Id: alist.c,v 1.3.18.2 2005/04/29 00:17:11 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isccc/api b/contrib/bind9/lib/isccc/api
index 8c77091..cd8c055 100644
--- a/contrib/bind9/lib/isccc/api
+++ b/contrib/bind9/lib/isccc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 2
-LIBREVISION = 2
-LIBAGE = 2
+LIBINTERFACE = 30
+LIBREVISION = 1
+LIBAGE = 0
diff --git a/contrib/bind9/lib/isccc/base64.c b/contrib/bind9/lib/isccc/base64.c
index 81d356c..e723cf2 100644
--- a/contrib/bind9/lib/isccc/base64.c
+++ b/contrib/bind9/lib/isccc/base64.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: base64.c,v 1.2.206.1 2004/03/06 08:15:19 marka Exp $ */
+/* $Id: base64.c,v 1.3.18.2 2005/04/29 00:17:11 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isccc/cc.c b/contrib/bind9/lib/isccc/cc.c
index ccf8c68..e65349e 100644
--- a/contrib/bind9/lib/isccc/cc.c
+++ b/contrib/bind9/lib/isccc/cc.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001-2003  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cc.c,v 1.4.2.3.2.5 2004/08/28 06:25:23 marka Exp $ */
+/* $Id: cc.c,v 1.10.18.5 2006/12/07 23:57:58 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -44,12 +46,12 @@
 typedef isccc_sexpr_t *sexpr_ptr;
 
 static unsigned char auth_hmd5[] = {
-	0x05, 0x5f, 0x61, 0x75, 0x74, 0x68,		/* len + _auth */
-	ISCCC_CCMSGTYPE_TABLE,				/* message type */
-	0x00, 0x00, 0x00, 0x20,				/* length == 32 */
-	0x04, 0x68, 0x6d, 0x64, 0x35,			/* len + hmd5 */
-	ISCCC_CCMSGTYPE_BINARYDATA,			/* message type */
-	0x00, 0x00, 0x00, 0x16,				/* length == 22 */
+	0x05, 0x5f, 0x61, 0x75, 0x74, 0x68,		/*%< len + _auth */
+	ISCCC_CCMSGTYPE_TABLE,				/*%< message type */
+	0x00, 0x00, 0x00, 0x20,				/*%< length == 32 */
+	0x04, 0x68, 0x6d, 0x64, 0x35,			/*%< len + hmd5 */
+	ISCCC_CCMSGTYPE_BINARYDATA,			/*%< message type */
+	0x00, 0x00, 0x00, 0x16,				/*%< length == 22 */
 	/*
 	 * The base64 encoding of one of our HMAC-MD5 signatures is
 	 * 22 bytes.
@@ -59,7 +61,7 @@ static unsigned char auth_hmd5[] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
-#define HMD5_OFFSET	21		/* 6 + 1 + 4 + 5 + 1 + 4 */
+#define HMD5_OFFSET	21		/*%< 21 = 6 + 1 + 4 + 5 + 1 + 4 */
 #define HMD5_LENGTH	22
 
 static isc_result_t
@@ -466,12 +468,21 @@ createmessage(isc_uint32_t version, const char *from, const char *to,
 	result = ISC_R_NOMEMORY;
 
 	_ctrl = isccc_alist_create();
+	if (_ctrl == NULL)
+		goto bad;
+	if (isccc_alist_define(alist, "_ctrl", _ctrl) == NULL) {
+		isccc_sexpr_free(&_ctrl);
+		goto bad;
+	}
+
 	_data = isccc_alist_create();
-	if (_ctrl == NULL || _data == NULL)
+	if (_data == NULL)
 		goto bad;
-	if (isccc_alist_define(alist, "_ctrl", _ctrl) == NULL ||
-	    isccc_alist_define(alist, "_data", _data) == NULL)
+	if (isccc_alist_define(alist, "_data", _data) == NULL) {
+		isccc_sexpr_free(&_data);
 		goto bad;
+	}
+
 	if (isccc_cc_defineuint32(_ctrl, "_ser", serial) == NULL ||
 	    isccc_cc_defineuint32(_ctrl, "_tim", now) == NULL ||
 	    (want_expires &&
diff --git a/contrib/bind9/lib/isccc/ccmsg.c b/contrib/bind9/lib/isccc/ccmsg.c
index fc5fae8..d624c9b 100644
--- a/contrib/bind9/lib/isccc/ccmsg.c
+++ b/contrib/bind9/lib/isccc/ccmsg.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ccmsg.c,v 1.4.206.1 2004/03/06 08:15:19 marka Exp $ */
+/* $Id: ccmsg.c,v 1.5.18.2 2005/04/29 00:17:11 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isccc/include/Makefile.in b/contrib/bind9/lib/isccc/include/Makefile.in
index 91a2bca..f3d46ab 100644
--- a/contrib/bind9/lib/isccc/include/Makefile.in
+++ b/contrib/bind9/lib/isccc/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.2.206.1 2004/03/06 08:15:20 marka Exp $
+# $Id: Makefile.in,v 1.3 2004/03/05 05:12:12 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isccc/include/isccc/Makefile.in b/contrib/bind9/lib/isccc/include/isccc/Makefile.in
index b86e50c..b7b1d55 100644
--- a/contrib/bind9/lib/isccc/include/isccc/Makefile.in
+++ b/contrib/bind9/lib/isccc/include/isccc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.3.12.3 2004/03/08 09:05:05 marka Exp $
+# $Id: Makefile.in,v 1.5 2004/03/05 05:12:15 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isccc/include/isccc/alist.h b/contrib/bind9/lib/isccc/include/isccc/alist.h
index 409c48b..16b5ba2 100644
--- a/contrib/bind9/lib/isccc/include/isccc/alist.h
+++ b/contrib/bind9/lib/isccc/include/isccc/alist.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,11 +16,13 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: alist.h,v 1.2.206.1 2004/03/06 08:15:21 marka Exp $ */
+/* $Id: alist.h,v 1.3.18.2 2005/04/29 00:17:12 marka Exp $ */
 
 #ifndef ISCCC_ALIST_H
 #define ISCCC_ALIST_H 1
 
+/*! \file */
+
 #include <stdio.h>
 
 #include <isc/lang.h>
diff --git a/contrib/bind9/lib/isccc/include/isccc/base64.h b/contrib/bind9/lib/isccc/include/isccc/base64.h
index 14fbe57..dd70e8d 100644
--- a/contrib/bind9/lib/isccc/include/isccc/base64.h
+++ b/contrib/bind9/lib/isccc/include/isccc/base64.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,11 +16,13 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: base64.h,v 1.2.206.1 2004/03/06 08:15:21 marka Exp $ */
+/* $Id: base64.h,v 1.3.18.2 2005/04/29 00:17:13 marka Exp $ */
 
 #ifndef ISCCC_BASE64_H
 #define ISCCC_BASE64_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isccc/types.h>
 
@@ -33,36 +35,36 @@ ISC_LANG_BEGINDECLS
 isc_result_t
 isccc_base64_encode(isccc_region_t *source, int wordlength,
 		  const char *wordbreak, isccc_region_t *target);
-/*
+/*%<
  * Convert data into base64 encoded text.
  *
  * Notes:
- *	The base64 encoded text in 'target' will be divided into
+ *\li	The base64 encoded text in 'target' will be divided into
  *	words of at most 'wordlength' characters, separated by
  * 	the 'wordbreak' string.  No parentheses will surround
  *	the text.
  *
  * Requires:
- *	'source' is a region containing binary data.
- *	'target' is a text region containing available space.
- *	'wordbreak' points to a null-terminated string of
+ *\li	'source' is a region containing binary data.
+ *\li	'target' is a text region containing available space.
+ *\li	'wordbreak' points to a null-terminated string of
  *		zero or more whitespace characters.
  */
 
 isc_result_t
 isccc_base64_decode(const char *cstr, isccc_region_t *target);
-/*
+/*%<
  * Decode a null-terminated base64 string.
  *
  * Requires:
- *	'cstr' is non-null.
- *	'target' is a valid region.
+ *\li	'cstr' is non-null.
+ *\li	'target' is a valid region.
  *
  * Returns:
- *	ISC_R_SUCCESS	-- the entire decoded representation of 'cstring'
+ *\li	#ISC_R_SUCCESS	-- the entire decoded representation of 'cstring'
  *			   fit in 'target'.
- *	ISC_R_BADBASE64 -- 'cstr' is not a valid base64 encoding.
- *	ISC_R_NOSPACE	-- 'target' is not big enough.
+ *\li	#ISC_R_BADBASE64 -- 'cstr' is not a valid base64 encoding.
+ *\li	#ISC_R_NOSPACE	-- 'target' is not big enough.
  */
 
 ISC_LANG_ENDDECLS
diff --git a/contrib/bind9/lib/isccc/include/isccc/cc.h b/contrib/bind9/lib/isccc/include/isccc/cc.h
index aedf1f7..2e291ea 100644
--- a/contrib/bind9/lib/isccc/include/isccc/cc.h
+++ b/contrib/bind9/lib/isccc/include/isccc/cc.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,69 +16,90 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cc.h,v 1.3.206.1 2004/03/06 08:15:21 marka Exp $ */
+/* $Id: cc.h,v 1.4.18.2 2005/04/29 00:17:13 marka Exp $ */
 
 #ifndef ISCCC_CC_H
 #define ISCCC_CC_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isccc/types.h>
 
 ISC_LANG_BEGINDECLS
 
+/*% Maximum Datagram Package */
 #define ISCCC_CC_MAXDGRAMPACKET		4096
 
+/*% Message Type String */
 #define ISCCC_CCMSGTYPE_STRING		0x00
+/*% Message Type Binary Data */
 #define ISCCC_CCMSGTYPE_BINARYDATA	0x01
+/*% Message Type Table */
 #define ISCCC_CCMSGTYPE_TABLE		0x02
+/*% Message Type List */
 #define ISCCC_CCMSGTYPE_LIST		0x03
 
+/*% Send to Wire */
 isc_result_t
 isccc_cc_towire(isccc_sexpr_t *alist, isccc_region_t *target,
 	      isccc_region_t *secret);
 
+/*% Get From Wire */
 isc_result_t
 isccc_cc_fromwire(isccc_region_t *source, isccc_sexpr_t **alistp,
 		isccc_region_t *secret);
 
+/*% Create Message */
 isc_result_t
 isccc_cc_createmessage(isc_uint32_t version, const char *from, const char *to,
 		     isc_uint32_t serial, isccc_time_t now,
 		     isccc_time_t expires, isccc_sexpr_t **alistp);
 
+/*% Create Acknowledgment */
 isc_result_t
 isccc_cc_createack(isccc_sexpr_t *message, isc_boolean_t ok,
 		 isccc_sexpr_t **ackp);
 
+/*% Is Ack? */
 isc_boolean_t
 isccc_cc_isack(isccc_sexpr_t *message);
 
+/*% Is Reply? */
 isc_boolean_t
 isccc_cc_isreply(isccc_sexpr_t *message);
 
+/*% Create Response */
 isc_result_t
 isccc_cc_createresponse(isccc_sexpr_t *message, isccc_time_t now,
 		      isccc_time_t expires, isccc_sexpr_t **alistp);
 
+/*% Define String */
 isccc_sexpr_t *
 isccc_cc_definestring(isccc_sexpr_t *alist, const char *key, const char *str);
 
+/*% Define uint 32 */
 isccc_sexpr_t *
 isccc_cc_defineuint32(isccc_sexpr_t *alist, const char *key, isc_uint32_t i);
 
+/*% Lookup String */
 isc_result_t
 isccc_cc_lookupstring(isccc_sexpr_t *alist, const char *key, char **strp);
 
+/*% Lookup uint 32 */
 isc_result_t
 isccc_cc_lookupuint32(isccc_sexpr_t *alist, const char *key,
 		    isc_uint32_t *uintp);
 
+/*% Create Symbol Table */
 isc_result_t
 isccc_cc_createsymtab(isccc_symtab_t **symtabp);
 
+/*% Clean up Symbol Table */
 void
 isccc_cc_cleansymtab(isccc_symtab_t *symtab, isccc_time_t now);
 
+/*% Check for Duplicates */
 isc_result_t
 isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message,
 		   isccc_time_t now);
diff --git a/contrib/bind9/lib/isccc/include/isccc/ccmsg.h b/contrib/bind9/lib/isccc/include/isccc/ccmsg.h
index 54734bb..372047d 100644
--- a/contrib/bind9/lib/isccc/include/isccc/ccmsg.h
+++ b/contrib/bind9/lib/isccc/include/isccc/ccmsg.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,15 +16,18 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ccmsg.h,v 1.3.206.1 2004/03/06 08:15:21 marka Exp $ */
+/* $Id: ccmsg.h,v 1.4.18.2 2005/04/29 00:17:13 marka Exp $ */
 
 #ifndef ISCCC_CCMSG_H
 #define ISCCC_CCMSG_H 1
 
+/*! \file */
+
 #include <isc/buffer.h>
 #include <isc/lang.h>
 #include <isc/socket.h>
 
+/*% ISCCC Message Structure */
 typedef struct isccc_ccmsg {
 	/* private (don't touch!) */
 	unsigned int		magic;
@@ -46,56 +49,56 @@ ISC_LANG_BEGINDECLS
 
 void
 isccc_ccmsg_init(isc_mem_t *mctx, isc_socket_t *sock, isccc_ccmsg_t *ccmsg);
-/*
+/*%
  * Associate a cc message state with a given memory context and
  * TCP socket.
  *
  * Requires:
  *
- *	"mctx" and "sock" be non-NULL and valid types.
+ *\li	"mctx" and "sock" be non-NULL and valid types.
  *
- *	"sock" be a read/write TCP socket.
+ *\li	"sock" be a read/write TCP socket.
  *
- *	"ccmsg" be non-NULL and an uninitialized or invalidated structure.
+ *\li	"ccmsg" be non-NULL and an uninitialized or invalidated structure.
  *
  * Ensures:
  *
- *	"ccmsg" is a valid structure.
+ *\li	"ccmsg" is a valid structure.
  */
 
 void
 isccc_ccmsg_setmaxsize(isccc_ccmsg_t *ccmsg, unsigned int maxsize);
-/*
+/*%
  * Set the maximum packet size to "maxsize"
  *
  * Requires:
  *
- *	"ccmsg" be valid.
+ *\li	"ccmsg" be valid.
  *
- *	512 <= "maxsize" <= 4294967296
+ *\li	512 <= "maxsize" <= 4294967296
  */
 
 isc_result_t
 isccc_ccmsg_readmessage(isccc_ccmsg_t *ccmsg,
 		       isc_task_t *task, isc_taskaction_t action, void *arg);
-/*
+/*%
  * Schedule an event to be delivered when a command channel message is
  * readable, or when an error occurs on the socket.
  *
  * Requires:
  *
- *	"ccmsg" be valid.
+ *\li	"ccmsg" be valid.
  *
- *	"task", "taskaction", and "arg" be valid.
+ *\li	"task", "taskaction", and "arg" be valid.
  *
  * Returns:
  *
- *	ISC_R_SUCCESS		-- no error
- *	Anything that the isc_socket_recv() call can return.  XXXMLG
+ *\li	#ISC_R_SUCCESS		-- no error
+ *\li	Anything that the isc_socket_recv() call can return.  XXXMLG
  *
  * Notes:
  *
- *	The event delivered is a fully generic event.  It will contain no
+ *\li	The event delivered is a fully generic event.  It will contain no
  *	actual data.  The sender will be a pointer to the isccc_ccmsg_t.
  *	The result code inside that structure should be checked to see
  *	what the final result was.
@@ -103,27 +106,27 @@ isccc_ccmsg_readmessage(isccc_ccmsg_t *ccmsg,
 
 void
 isccc_ccmsg_cancelread(isccc_ccmsg_t *ccmsg);
-/*
+/*%
  * Cancel a readmessage() call.  The event will still be posted with a
  * CANCELED result code.
  *
  * Requires:
  *
- *	"ccmsg" be valid.
+ *\li	"ccmsg" be valid.
  */
 
 void
 isccc_ccmsg_invalidate(isccc_ccmsg_t *ccmsg);
-/*
+/*%
  * Clean up all allocated state, and invalidate the structure.
  *
  * Requires:
  *
- *	"ccmsg" be valid.
+ *\li	"ccmsg" be valid.
  *
  * Ensures:
  *
- *	"ccmsg" is invalidated and disassociated with all memory contexts,
+ *\li	"ccmsg" is invalidated and disassociated with all memory contexts,
  *	sockets, etc.
  */
 
diff --git a/contrib/bind9/lib/isccc/include/isccc/events.h b/contrib/bind9/lib/isccc/include/isccc/events.h
index b78fc65..0ac365f 100644
--- a/contrib/bind9/lib/isccc/include/isccc/events.h
+++ b/contrib/bind9/lib/isccc/include/isccc/events.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,14 +16,16 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: events.h,v 1.2.206.1 2004/03/06 08:15:22 marka Exp $ */
+/* $Id: events.h,v 1.3.18.2 2005/04/29 00:17:13 marka Exp $ */
 
 #ifndef ISCCC_EVENTS_H
 #define ISCCC_EVENTS_H 1
 
+/*! \file */
+
 #include <isc/eventclass.h>
 
-/*
+/*%
  * Registry of ISCCC event numbers.
  */
 
diff --git a/contrib/bind9/lib/isccc/include/isccc/lib.h b/contrib/bind9/lib/isccc/include/isccc/lib.h
index a57357d..247267c 100644
--- a/contrib/bind9/lib/isccc/include/isccc/lib.h
+++ b/contrib/bind9/lib/isccc/include/isccc/lib.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,11 +16,13 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lib.h,v 1.2.12.3 2004/03/08 09:05:05 marka Exp $ */
+/* $Id: lib.h,v 1.4.18.2 2005/04/29 00:17:13 marka Exp $ */
 
 #ifndef ISCCC_LIB_H
 #define ISCCC_LIB_H 1
 
+/*! \file */
+
 #include <isc/types.h>
 #include <isc/lang.h>
 
@@ -30,7 +32,7 @@ LIBISCCC_EXTERNAL_DATA extern isc_msgcat_t *isccc_msgcat;
 
 void
 isccc_lib_initmsgcat(void);
-/*
+/*%
  * Initialize the ISCCC library's message catalog, isccc_msgcat, if it
  * has not already been initialized.
  */
diff --git a/contrib/bind9/lib/isccc/include/isccc/result.h b/contrib/bind9/lib/isccc/include/isccc/result.h
index 33bbb4f..6fbc298 100644
--- a/contrib/bind9/lib/isccc/include/isccc/result.h
+++ b/contrib/bind9/lib/isccc/include/isccc/result.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001, 2003  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,31 +16,39 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.h,v 1.3.2.2.2.1 2004/03/06 08:15:22 marka Exp $ */
+/* $Id: result.h,v 1.5.18.2 2005/04/29 00:17:14 marka Exp $ */
 
 #ifndef ISCCC_RESULT_H
 #define ISCCC_RESULT_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/resultclass.h>
 #include <isc/result.h>
 
 #include <isccc/types.h>
 
+/*% Unknown Version */
 #define ISCCC_R_UNKNOWNVERSION		(ISC_RESULTCLASS_ISCCC + 0)
+/*% Syntax Error */
 #define ISCCC_R_SYNTAX			(ISC_RESULTCLASS_ISCCC + 1)
+/*% Bad Authorization */
 #define ISCCC_R_BADAUTH			(ISC_RESULTCLASS_ISCCC + 2)
+/*% Expired */
 #define ISCCC_R_EXPIRED			(ISC_RESULTCLASS_ISCCC + 3)
+/*% Clock Skew */
 #define ISCCC_R_CLOCKSKEW		(ISC_RESULTCLASS_ISCCC + 4)
+/*% Duplicate */
 #define ISCCC_R_DUPLICATE		(ISC_RESULTCLASS_ISCCC + 5)
 
-#define ISCCC_R_NRESULTS 		6	/* Number of results */
+#define ISCCC_R_NRESULTS 		6	/*%< Number of results */
 
 ISC_LANG_BEGINDECLS
 
 const char *
 isccc_result_totext(isc_result_t result);
-/*
+/*%
  * Convert a isccc_result_t into a string message describing the result.
  */
 
diff --git a/contrib/bind9/lib/isccc/include/isccc/sexpr.h b/contrib/bind9/lib/isccc/include/isccc/sexpr.h
index 0195a94..cb1d297 100644
--- a/contrib/bind9/lib/isccc/include/isccc/sexpr.h
+++ b/contrib/bind9/lib/isccc/include/isccc/sexpr.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,11 +16,13 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sexpr.h,v 1.3.206.1 2004/03/06 08:15:22 marka Exp $ */
+/* $Id: sexpr.h,v 1.4.18.2 2005/04/29 00:17:14 marka Exp $ */
 
 #ifndef ISCCC_SEXPR_H
 #define ISCCC_SEXPR_H 1
 
+/*! \file */
+
 #include <stdio.h>
 
 #include <isc/lang.h>
@@ -28,11 +30,13 @@
 
 ISC_LANG_BEGINDECLS
 
+/*% dotted pair structure */
 struct isccc_dottedpair {
 	isccc_sexpr_t *car;
 	isccc_sexpr_t *cdr;
 };
 
+/*% iscc_sexpr structure */
 struct isccc_sexpr {
 	unsigned int			type;
 	union {
@@ -42,7 +46,7 @@ struct isccc_sexpr {
 	}				value;
 };
 
-#define ISCCC_SEXPRTYPE_NONE		0x00	/* Illegal. */
+#define ISCCC_SEXPRTYPE_NONE		0x00	/*%< Illegal. */
 #define ISCCC_SEXPRTYPE_T			0x01
 #define ISCCC_SEXPRTYPE_STRING		0x02
 #define ISCCC_SEXPRTYPE_DOTTEDPAIR	0x03
diff --git a/contrib/bind9/lib/isccc/include/isccc/symtab.h b/contrib/bind9/lib/isccc/include/isccc/symtab.h
index 53f30e7..5b11a01 100644
--- a/contrib/bind9/lib/isccc/include/isccc/symtab.h
+++ b/contrib/bind9/lib/isccc/include/isccc/symtab.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: symtab.h,v 1.2.206.1 2004/03/06 08:15:22 marka Exp $ */
+/* $Id: symtab.h,v 1.3.18.2 2005/04/29 00:17:14 marka Exp $ */
 
 #ifndef ISCCC_SYMTAB_H
 #define ISCCC_SYMTAB_H 1
@@ -25,9 +25,8 @@
  ***** Module Info
  *****/
 
-/*
- * Symbol Table
- *
+/*! \file 
+ * \brief
  * Provides a simple memory-based symbol table.
  *
  * Keys are C strings.  A type may be specified when looking up,
@@ -39,11 +38,11 @@
  * exists in the table.  What to do in this case is specified by the
  * client.  Possible policies are:
  *
- *	isccc_symexists_reject	Disallow the define, returning ISC_R_EXISTS
- *	isccc_symexists_replace	Replace the old value with the new.  The
+ *\li	isccc_symexists_reject	Disallow the define, returning #ISC_R_EXISTS
+ *\li	isccc_symexists_replace	Replace the old value with the new.  The
  *				undefine action (if provided) will be called
  *				with the old <key, type, value> tuple.
- *	isccc_symexists_add	Add the new tuple, leaving the old tuple in
+ *\li	isccc_symexists_add	Add the new tuple, leaving the old tuple in
  *				the table.  Subsequent lookups will retrieve
  *				the most-recently-defined tuple.
  *
diff --git a/contrib/bind9/lib/isccc/include/isccc/symtype.h b/contrib/bind9/lib/isccc/include/isccc/symtype.h
index 2c15603..e72ae92 100644
--- a/contrib/bind9/lib/isccc/include/isccc/symtype.h
+++ b/contrib/bind9/lib/isccc/include/isccc/symtype.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,11 +16,13 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: symtype.h,v 1.2.206.1 2004/03/06 08:15:22 marka Exp $ */
+/* $Id: symtype.h,v 1.3.18.2 2005/04/29 00:17:14 marka Exp $ */
 
 #ifndef ISCCC_SYMTYPE_H
 #define ISCCC_SYMTYPE_H 1
 
+/*! \file */
+
 #define ISCCC_SYMTYPE_ZONESTATS			0x0001
 #define ISCCC_SYMTYPE_CCDUP			0x0002
 #define ISCCC_SYMTYPE_TELLSERVICE			0x0003
diff --git a/contrib/bind9/lib/isccc/include/isccc/types.h b/contrib/bind9/lib/isccc/include/isccc/types.h
index 9b21ca1..f46d257 100644
--- a/contrib/bind9/lib/isccc/include/isccc/types.h
+++ b/contrib/bind9/lib/isccc/include/isccc/types.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,20 +16,28 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: types.h,v 1.2.206.1 2004/03/06 08:15:23 marka Exp $ */
+/* $Id: types.h,v 1.3.18.2 2005/04/29 00:17:14 marka Exp $ */
 
 #ifndef ISCCC_TYPES_H
 #define ISCCC_TYPES_H 1
 
+/*! \file */
+
 #include <isc/boolean.h>
 #include <isc/int.h>
 #include <isc/result.h>
 
+/*% isccc_time_t typedef */
 typedef isc_uint32_t isccc_time_t;
+
+/*% isccc_sexpr_t typedef */
 typedef struct isccc_sexpr isccc_sexpr_t;
+/*% isccc_dottedpair_t typedef */
 typedef struct isccc_dottedpair isccc_dottedpair_t;
+/*% isccc_symtab_t typedef */
 typedef struct isccc_symtab isccc_symtab_t;
 
+/*% iscc region structure */
 typedef struct isccc_region {
 	unsigned char *		rstart;
 	unsigned char *		rend;
diff --git a/contrib/bind9/lib/isccc/include/isccc/util.h b/contrib/bind9/lib/isccc/include/isccc/util.h
index 8442586..7662483 100644
--- a/contrib/bind9/lib/isccc/include/isccc/util.h
+++ b/contrib/bind9/lib/isccc/include/isccc/util.h
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,17 +16,18 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: util.h,v 1.3.206.1 2004/03/06 08:15:23 marka Exp $ */
+/* $Id: util.h,v 1.4.18.2 2005/04/29 00:17:14 marka Exp $ */
 
 #ifndef ISCCC_UTIL_H
 #define ISCCC_UTIL_H 1
 
 #include <isc/util.h>
 
-/*
+/*! \file
+ * \brief
  * Macros for dealing with unaligned numbers.
  *
- * Note: no side effects are allowed when invoking these macros!
+ * \note no side effects are allowed when invoking these macros!
  */
 
 #define GET8(v, w) \
@@ -193,7 +194,7 @@
 	(r).rend = (r).rstart + strlen(s); \
 } while (0)
 
-/*
+/*%
  * Use this to remove the const qualifier of a variable to assign it to
  * a non-const variable or pass it as a non-const function argument ...
  * but only when you are sure it won't then be changed!
diff --git a/contrib/bind9/lib/isccc/include/isccc/version.h b/contrib/bind9/lib/isccc/include/isccc/version.h
index 36a909c..b82ed8b 100644
--- a/contrib/bind9/lib/isccc/include/isccc/version.h
+++ b/contrib/bind9/lib/isccc/include/isccc/version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.h,v 1.2.222.3 2004/03/08 09:05:05 marka Exp $ */
+/* $Id: version.h,v 1.3.18.2 2005/04/29 00:17:15 marka Exp $ */
+
+/*! \file */
 
 #include <isc/platform.h>
 
diff --git a/contrib/bind9/lib/isccc/lib.c b/contrib/bind9/lib/isccc/lib.c
index d37e28c..bef2d9a 100644
--- a/contrib/bind9/lib/isccc/lib.c
+++ b/contrib/bind9/lib/isccc/lib.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lib.c,v 1.2.12.3 2004/03/08 09:05:04 marka Exp $ */
+/* $Id: lib.c,v 1.4.18.2 2005/04/29 00:17:12 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isccc/result.c b/contrib/bind9/lib/isccc/result.c
index e63e85f..974e51b 100644
--- a/contrib/bind9/lib/isccc/result.c
+++ b/contrib/bind9/lib/isccc/result.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001, 2003  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.c,v 1.3.2.2.2.1 2004/03/06 08:15:19 marka Exp $ */
+/* $Id: result.c,v 1.5.18.2 2005/04/29 00:17:12 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isccc/sexpr.c b/contrib/bind9/lib/isccc/sexpr.c
index a372a7d..573a63c 100644
--- a/contrib/bind9/lib/isccc/sexpr.c
+++ b/contrib/bind9/lib/isccc/sexpr.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sexpr.c,v 1.2.12.3 2004/03/08 09:05:04 marka Exp $ */
+/* $Id: sexpr.c,v 1.4.18.2 2005/04/29 00:17:12 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isccc/symtab.c b/contrib/bind9/lib/isccc/symtab.c
index 6aca485..2c259d7 100644
--- a/contrib/bind9/lib/isccc/symtab.c
+++ b/contrib/bind9/lib/isccc/symtab.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2001  Internet Software Consortium.
  * Portions Copyright (C) 2001  Nominum, Inc.
  *
@@ -16,7 +16,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: symtab.c,v 1.3.12.3 2004/03/08 09:05:04 marka Exp $ */
+/* $Id: symtab.c,v 1.5.18.2 2005/04/29 00:17:12 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/isccc/version.c b/contrib/bind9/lib/isccc/version.c
index 08cda2f..0d65dcb 100644
--- a/contrib/bind9/lib/isccc/version.c
+++ b/contrib/bind9/lib/isccc/version.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.c,v 1.1.12.3 2004/03/08 09:05:04 marka Exp $ */
+/* $Id: version.c,v 1.3.18.2 2005/04/29 00:17:12 marka Exp $ */
+
+/*! \file */
 
 #include <isccc/version.h>
 
diff --git a/contrib/bind9/lib/isccfg/Makefile.in b/contrib/bind9/lib/isccfg/Makefile.in
index ee80508..7d19123 100644
--- a/contrib/bind9/lib/isccfg/Makefile.in
+++ b/contrib/bind9/lib/isccfg/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001-2003  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6.12.8 2004/07/20 07:01:58 marka Exp $
+# $Id: Makefile.in,v 1.12.18.4 2005/09/05 00:18:30 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -27,7 +27,7 @@ top_srcdir =	@top_srcdir@
 
 CINCLUDES =	-I. ${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES}
 
-CDEFINES =
+CDEFINES =      @USE_DLZ@
 CWARNINGS =
 
 ISCLIBS =	../../lib/isc/libisc.@A@
@@ -43,10 +43,10 @@ LIBS =		@LIBS@
 SUBDIRS =	include
 
 # Alphabetically
-OBJS =		log.@O@ namedconf.@O@ parser.@O@ version.@O@
+OBJS =		aclconf.@O@ log.@O@ namedconf.@O@ parser.@O@ version.@O@
 
 # Alphabetically
-SRCS =		log.c namedconf.c parser.c version.c
+SRCS =		aclconf.c log.c namedconf.c parser.c version.c
 
 TARGETS = 	timestamp
 
diff --git a/contrib/bind9/lib/isccfg/aclconf.c b/contrib/bind9/lib/isccfg/aclconf.c
new file mode 100644
index 0000000..d7b41ce
--- /dev/null
+++ b/contrib/bind9/lib/isccfg/aclconf.c
@@ -0,0 +1,256 @@
+/*
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1999-2002  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: aclconf.c,v 1.2.2.6 2006/03/02 00:37:22 marka Exp $ */
+
+#include <config.h>
+
+#include <isc/mem.h>
+#include <isc/string.h>		/* Required for HP/UX (and others?) */
+#include <isc/util.h>
+
+#include <isccfg/namedconf.h>
+#include <isccfg/aclconf.h>
+
+#include <dns/acl.h>
+#include <dns/fixedname.h>
+#include <dns/log.h>
+
+#define LOOP_MAGIC ISC_MAGIC('L','O','O','P') 
+
+void
+cfg_aclconfctx_init(cfg_aclconfctx_t *ctx) {
+	ISC_LIST_INIT(ctx->named_acl_cache);
+}
+
+void
+cfg_aclconfctx_destroy(cfg_aclconfctx_t *ctx) {
+     	dns_acl_t *dacl, *next;
+	for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
+	     dacl != NULL;
+	     dacl = next)
+	{
+		next = ISC_LIST_NEXT(dacl, nextincache);
+		dns_acl_detach(&dacl);
+	}
+}
+
+/*
+ * Find the definition of the named acl whose name is "name".
+ */
+static isc_result_t
+get_acl_def(const cfg_obj_t *cctx, const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+	const cfg_obj_t *acls = NULL;
+	const cfg_listelt_t *elt;
+	
+	result = cfg_map_get(cctx, "acl", &acls);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	for (elt = cfg_list_first(acls);
+	     elt != NULL;
+	     elt = cfg_list_next(elt)) {
+		const cfg_obj_t *acl = cfg_listelt_value(elt);
+		const char *aclname = cfg_obj_asstring(cfg_tuple_get(acl, "name"));
+		if (strcasecmp(aclname, name) == 0) {
+			*ret = cfg_tuple_get(acl, "value");
+			return (ISC_R_SUCCESS);
+		}
+	}
+	return (ISC_R_NOTFOUND);
+}
+
+static isc_result_t
+convert_named_acl(const cfg_obj_t *nameobj, const cfg_obj_t *cctx,
+		  isc_log_t *lctx, cfg_aclconfctx_t *ctx,
+		  isc_mem_t *mctx, dns_acl_t **target)
+{
+	isc_result_t result;
+	const cfg_obj_t *cacl = NULL;
+	dns_acl_t *dacl;
+	dns_acl_t loop;
+	const char *aclname = cfg_obj_asstring(nameobj);
+
+	/* Look for an already-converted version. */
+	for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache);
+	     dacl != NULL;
+	     dacl = ISC_LIST_NEXT(dacl, nextincache))
+	{
+		if (strcasecmp(aclname, dacl->name) == 0) {
+			if (ISC_MAGIC_VALID(dacl, LOOP_MAGIC)) {
+				cfg_obj_log(nameobj, lctx, ISC_LOG_ERROR,
+					    "acl loop detected: %s", aclname);
+				return (ISC_R_FAILURE);
+			}
+			dns_acl_attach(dacl, target);
+			return (ISC_R_SUCCESS);
+		}
+	}
+	/* Not yet converted.  Convert now. */
+	result = get_acl_def(cctx, aclname, &cacl);
+	if (result != ISC_R_SUCCESS) {
+		cfg_obj_log(nameobj, lctx, ISC_LOG_WARNING,
+			    "undefined ACL '%s'", aclname);
+		return (result);
+	}
+	/*
+	 * Add a loop detection element.
+	 */
+	memset(&loop, 0, sizeof(loop));
+	ISC_LINK_INIT(&loop, nextincache);
+	DE_CONST(aclname, loop.name);
+	loop.magic = LOOP_MAGIC;
+	ISC_LIST_APPEND(ctx->named_acl_cache, &loop, nextincache);
+	result = cfg_acl_fromconfig(cacl, cctx, lctx, ctx, mctx, &dacl);
+	ISC_LIST_UNLINK(ctx->named_acl_cache, &loop, nextincache);
+	loop.magic = 0;
+	loop.name = NULL;
+	if (result != ISC_R_SUCCESS)
+		return (result);
+	dacl->name = isc_mem_strdup(dacl->mctx, aclname);
+	if (dacl->name == NULL)
+		return (ISC_R_NOMEMORY);
+	ISC_LIST_APPEND(ctx->named_acl_cache, dacl, nextincache);
+	dns_acl_attach(dacl, target);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+convert_keyname(const cfg_obj_t *keyobj, isc_log_t *lctx, isc_mem_t *mctx,
+		dns_name_t *dnsname)
+{
+	isc_result_t result;
+	isc_buffer_t buf;
+	dns_fixedname_t fixname;
+	unsigned int keylen;
+	const char *txtname = cfg_obj_asstring(keyobj);
+
+	keylen = strlen(txtname);
+	isc_buffer_init(&buf, txtname, keylen);
+	isc_buffer_add(&buf, keylen);
+	dns_fixedname_init(&fixname);
+	result = dns_name_fromtext(dns_fixedname_name(&fixname), &buf,
+				   dns_rootname, ISC_FALSE, NULL);
+	if (result != ISC_R_SUCCESS) {
+		cfg_obj_log(keyobj, lctx, ISC_LOG_WARNING,
+			    "key name '%s' is not a valid domain name",
+			    txtname);
+		return (result);
+	}
+	return (dns_name_dup(dns_fixedname_name(&fixname), mctx, dnsname));
+}
+
+isc_result_t
+cfg_acl_fromconfig(const cfg_obj_t *caml,
+		   const cfg_obj_t *cctx,
+	 	   isc_log_t *lctx,
+		   cfg_aclconfctx_t *ctx,
+		   isc_mem_t *mctx,
+		   dns_acl_t **target)
+{
+	isc_result_t result;
+	unsigned int count;
+	dns_acl_t *dacl = NULL;
+	dns_aclelement_t *de;
+	const cfg_listelt_t *elt;
+
+	REQUIRE(target != NULL && *target == NULL);
+
+	count = 0;
+	for (elt = cfg_list_first(caml);
+	     elt != NULL;
+	     elt = cfg_list_next(elt))
+		count++;
+
+	result = dns_acl_create(mctx, count, &dacl);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	de = dacl->elements;
+	for (elt = cfg_list_first(caml);
+	     elt != NULL;
+	     elt = cfg_list_next(elt))
+	{
+		const cfg_obj_t *ce = cfg_listelt_value(elt);
+		if (cfg_obj_istuple(ce)) {
+			/* This must be a negated element. */
+			ce = cfg_tuple_get(ce, "value");
+			de->negative = ISC_TRUE;
+		} else {
+			de->negative = ISC_FALSE;
+		}
+
+		if (cfg_obj_isnetprefix(ce)) {
+			/* Network prefix */
+			de->type = dns_aclelementtype_ipprefix;
+
+			cfg_obj_asnetprefix(ce,
+					    &de->u.ip_prefix.address,
+					    &de->u.ip_prefix.prefixlen);
+		} else if (cfg_obj_istype(ce, &cfg_type_keyref)) {
+			/* Key name */
+			de->type = dns_aclelementtype_keyname;
+			dns_name_init(&de->u.keyname, NULL);
+			result = convert_keyname(ce, lctx, mctx,
+						 &de->u.keyname);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup;
+		} else if (cfg_obj_islist(ce)) {
+			/* Nested ACL */
+			de->type = dns_aclelementtype_nestedacl;
+			result = cfg_acl_fromconfig(ce, cctx, lctx, ctx,
+						    mctx, &de->u.nestedacl);
+			if (result != ISC_R_SUCCESS)
+				goto cleanup;
+		} else if (cfg_obj_isstring(ce)) {
+			/* ACL name */
+			const char *name = cfg_obj_asstring(ce);
+			if (strcasecmp(name, "localhost") == 0) {
+				de->type = dns_aclelementtype_localhost;
+			} else if (strcasecmp(name, "localnets") == 0) {
+				de->type = dns_aclelementtype_localnets;
+			}  else if (strcasecmp(name, "any") == 0) {
+				de->type = dns_aclelementtype_any;
+			}  else if (strcasecmp(name, "none") == 0) {
+				de->type = dns_aclelementtype_any;
+				de->negative = ISC_TF(! de->negative);
+			} else {
+				de->type = dns_aclelementtype_nestedacl;
+				result = convert_named_acl(ce, cctx, lctx,
+							   ctx, mctx,
+							   &de->u.nestedacl);
+				if (result != ISC_R_SUCCESS)
+					goto cleanup;
+			}
+		} else {
+			cfg_obj_log(ce, lctx, ISC_LOG_WARNING,
+				    "address match list contains "
+				    "unsupported element type");
+			result = ISC_R_FAILURE;
+			goto cleanup;
+		}
+		de++;
+		dacl->length++;
+	}
+
+	*target = dacl;
+	return (ISC_R_SUCCESS);
+
+ cleanup:
+	dns_acl_detach(&dacl);
+	return (result);
+}
diff --git a/contrib/bind9/lib/isccfg/api b/contrib/bind9/lib/isccfg/api
index 59ed93b..7560ffd 100644
--- a/contrib/bind9/lib/isccfg/api
+++ b/contrib/bind9/lib/isccfg/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 1
-LIBREVISION = 6
+LIBINTERFACE = 30
+LIBREVISION = 2
 LIBAGE = 0
diff --git a/contrib/bind9/lib/isccfg/include/Makefile.in b/contrib/bind9/lib/isccfg/include/Makefile.in
index 77d3219..4eddd92 100644
--- a/contrib/bind9/lib/isccfg/include/Makefile.in
+++ b/contrib/bind9/lib/isccfg/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.206.1 2004/03/06 08:15:27 marka Exp $
+# $Id: Makefile.in,v 1.5 2004/03/05 05:12:24 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in b/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in
index dc8b1b1..d71d2c2 100644
--- a/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in
+++ b/contrib/bind9/lib/isccfg/include/isccfg/Makefile.in
@@ -1,4 +1,4 @@
-# Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
 # Copyright (C) 2001, 2002  Internet Software Consortium.
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.12.3 2004/03/08 09:05:07 marka Exp $
+# $Id: Makefile.in,v 1.8.18.2 2005/01/12 01:54:57 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -26,7 +26,7 @@ top_srcdir =	@top_srcdir@
 # machine generated.  The latter are handled specially in the
 # install target below.
 #
-HEADERS =	cfg.h grammar.h log.h namedconf.h version.h
+HEADERS =	aclconf.h cfg.h grammar.h log.h namedconf.h version.h
 
 SUBDIRS =
 TARGETS =
diff --git a/contrib/bind9/lib/isccfg/include/isccfg/aclconf.h b/contrib/bind9/lib/isccfg/include/isccfg/aclconf.h
new file mode 100644
index 0000000..a13740c
--- /dev/null
+++ b/contrib/bind9/lib/isccfg/include/isccfg/aclconf.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 1999-2001  Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: aclconf.h,v 1.2.2.5 2006/03/02 00:37:22 marka Exp $ */
+
+#ifndef ISCCFG_ACLCONF_H
+#define ISCCFG_ACLCONF_H 1
+
+#include <isc/lang.h>
+
+#include <isccfg/cfg.h>
+
+#include <dns/types.h>
+
+typedef struct cfg_aclconfctx {
+	ISC_LIST(dns_acl_t) named_acl_cache;
+} cfg_aclconfctx_t;
+
+/***
+ *** Functions
+ ***/
+
+ISC_LANG_BEGINDECLS
+
+void
+cfg_aclconfctx_init(cfg_aclconfctx_t *ctx);
+/*
+ * Initialize an ACL configuration context.
+ */
+
+void
+cfg_aclconfctx_destroy(cfg_aclconfctx_t *ctx);
+/*
+ * Destroy an ACL configuration context.
+ */
+
+isc_result_t
+cfg_acl_fromconfig(const cfg_obj_t *caml,
+		   const cfg_obj_t *cctx,
+		   isc_log_t *lctx,
+		   cfg_aclconfctx_t *ctx,
+		   isc_mem_t *mctx,
+		   dns_acl_t **target);
+/*
+ * Construct a new dns_acl_t from configuration data in 'caml' and
+ * 'cctx'.  Memory is allocated through 'mctx'.
+ *
+ * Any named ACLs referred to within 'caml' will be be converted
+ * into nested dns_acl_t objects.  Multiple references to the same
+ * named ACLs will be converted into shared references to a single
+ * nested dns_acl_t object when the referring objects were created
+ * passing the same ACL configuration context 'ctx'.
+ *
+ * On success, attach '*target' to the new dns_acl_t object.
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif /* ISCCFG_ACLCONF_H */
diff --git a/contrib/bind9/lib/isccfg/include/isccfg/cfg.h b/contrib/bind9/lib/isccfg/include/isccfg/cfg.h
index c486719..6a30a1c 100644
--- a/contrib/bind9/lib/isccfg/include/isccfg/cfg.h
+++ b/contrib/bind9/lib/isccfg/include/isccfg/cfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cfg.h,v 1.30.12.6 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: cfg.h,v 1.34.18.5 2006/03/02 00:37:22 marka Exp $ */
 
 #ifndef ISCCFG_CFG_H
 #define ISCCFG_CFG_H 1
@@ -24,7 +24,8 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file
+ * \brief
  * This is the new, table-driven, YACC-free configuration file parser.
  */
 
@@ -42,19 +43,19 @@
  *** Types
  ***/
 
-typedef struct cfg_parser cfg_parser_t;
-/*
+/*%
  * A configuration parser.
  */
+typedef struct cfg_parser cfg_parser_t;
 
-/*
+/*%
  * A configuration type definition object.  There is a single
  * static cfg_type_t object for each data type supported by
  * the configuration parser.
  */
 typedef struct cfg_type cfg_type_t;
 
-/*
+/*%
  * A configuration object.  This is the basic building block of the
  * configuration parse tree.  It contains a value (which may be
  * of one of several types) and information identifying the file
@@ -63,12 +64,12 @@ typedef struct cfg_type cfg_type_t;
  */
 typedef struct cfg_obj cfg_obj_t;
 
-/*
+/*%
  * A configuration object list element.
  */
 typedef struct cfg_listelt cfg_listelt_t;
 
-/*
+/*%
  * A callback function to be called when parsing an option 
  * that needs to be interpreted at parsing time, like
  * "directory".
@@ -84,7 +85,7 @@ ISC_LANG_BEGINDECLS
 
 isc_result_t
 cfg_parser_create(isc_mem_t *mctx, isc_log_t *lctx, cfg_parser_t **ret);
-/*
+/*%<
  * Create a configuration file parser.  Any warning and error
  * messages will be logged to 'lctx'.
  *
@@ -97,7 +98,7 @@ void
 cfg_parser_setcallback(cfg_parser_t *pctx,
 		       cfg_parsecallback_t callback,
 		       void *arg);
-/*
+/*%<
  * Make the parser call 'callback' whenever it encounters
  * a configuration clause with the callback attribute,
  * passing it the clause name, the clause value,
@@ -113,7 +114,7 @@ cfg_parse_file(cfg_parser_t *pctx, const char *filename,
 isc_result_t
 cfg_parse_buffer(cfg_parser_t *pctx, isc_buffer_t *buffer,
 		 const cfg_type_t *type, cfg_obj_t **ret);
-/*
+/*%<
  * Read a configuration containing data of type 'type'
  * and make '*ret' point to its parse tree.
  *
@@ -124,246 +125,246 @@ cfg_parse_buffer(cfg_parser_t *pctx, isc_buffer_t *buffer,
  * Returns an error if the file does not parse correctly.
  * 
  * Requires:
- *      "filename" is valid.
- *      "mem" is valid.
- *	"type" is valid.
- *      "cfg" is non-NULL and "*cfg" is NULL.
+ *\li 	"filename" is valid.
+ *\li 	"mem" is valid.
+ *\li	"type" is valid.
+ *\li 	"cfg" is non-NULL and "*cfg" is NULL.
  *
  * Returns:
- *      ISC_R_SUCCESS                 - success
- *      ISC_R_NOMEMORY                - no memory available
- *      ISC_R_INVALIDFILE             - file doesn't exist or is unreadable
- *      others	                      - file contains errors
+ *     \li #ISC_R_SUCCESS                 - success
+ *\li      #ISC_R_NOMEMORY                - no memory available
+ *\li      #ISC_R_INVALIDFILE             - file doesn't exist or is unreadable
+ *\li      others	                      - file contains errors
  */
 
 void
 cfg_parser_destroy(cfg_parser_t **pctxp);
-/*
+/*%<
  * Destroy a configuration parser.
  */
 
 isc_boolean_t
 cfg_obj_isvoid(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of void type (e.g., an optional 
  * value not specified).
  */
 
 isc_boolean_t
 cfg_obj_ismap(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of a map type.
  */
 
 isc_result_t
 cfg_map_get(const cfg_obj_t *mapobj, const char* name, const cfg_obj_t **obj);
-/*
+/*%<
  * Extract an element from a configuration object, which
  * must be of a map type.
  *
  * Requires:
- *      'mapobj' points to a valid configuration object of a map type.
- *      'name' points to a null-terminated string.
- * 	'obj' is non-NULL and '*obj' is NULL.
+ * \li     'mapobj' points to a valid configuration object of a map type.
+ * \li     'name' points to a null-terminated string.
+ * \li	'obj' is non-NULL and '*obj' is NULL.
  *
  * Returns:
- *      ISC_R_SUCCESS                  - success
- *      ISC_R_NOTFOUND                 - name not found in map
+ * \li     #ISC_R_SUCCESS                  - success
+ * \li     #ISC_R_NOTFOUND                 - name not found in map
  */
 
 const cfg_obj_t *
 cfg_map_getname(const cfg_obj_t *mapobj);
-/*
+/*%<
  * Get the name of a named map object, like a server "key" clause.
  *
  * Requires:
- *      'mapobj' points to a valid configuration object of a map type.
+ *    \li  'mapobj' points to a valid configuration object of a map type.
  *
  * Returns:
- *      A pointer to a configuration object naming the map object,
+ * \li     A pointer to a configuration object naming the map object,
  *	or NULL if the map object does not have a name.
  */
 
 isc_boolean_t
 cfg_obj_istuple(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of a map type.
  */
 
 const cfg_obj_t *
 cfg_tuple_get(const cfg_obj_t *tupleobj, const char *name);
-/*
+/*%<
  * Extract an element from a configuration object, which
  * must be of a tuple type.
  *
  * Requires:
- *      'tupleobj' points to a valid configuration object of a tuple type.
- *      'name' points to a null-terminated string naming one of the
- *	fields of said tuple type.
+ * \li     'tupleobj' points to a valid configuration object of a tuple type.
+ * \li     'name' points to a null-terminated string naming one of the
+ *\li	fields of said tuple type.
  */
 
 isc_boolean_t
 cfg_obj_isuint32(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of integer type.
  */
 
 isc_uint32_t
 cfg_obj_asuint32(const cfg_obj_t *obj);
-/*
+/*%<
  * Returns the value of a configuration object of 32-bit integer type.
  *
  * Requires:
- *      'obj' points to a valid configuration object of 32-bit integer type.
+ * \li     'obj' points to a valid configuration object of 32-bit integer type.
  *
  * Returns:
- *      A 32-bit unsigned integer.
+ * \li     A 32-bit unsigned integer.
  */
 
 isc_boolean_t
 cfg_obj_isuint64(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of integer type.
  */
 
 isc_uint64_t
 cfg_obj_asuint64(const cfg_obj_t *obj);
-/*
+/*%<
  * Returns the value of a configuration object of 64-bit integer type.
  *
  * Requires:
- *      'obj' points to a valid configuration object of 64-bit integer type.
+ * \li     'obj' points to a valid configuration object of 64-bit integer type.
  *
  * Returns:
- *      A 64-bit unsigned integer.
+ * \li     A 64-bit unsigned integer.
  */
 
 isc_boolean_t
 cfg_obj_isstring(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of string type.
  */
 
 const char *
 cfg_obj_asstring(const cfg_obj_t *obj);
-/*
+/*%<
  * Returns the value of a configuration object of a string type
  * as a null-terminated string.
  *
  * Requires:
- *      'obj' points to a valid configuration object of a string type.
+ * \li     'obj' points to a valid configuration object of a string type.
  *
  * Returns:
- *      A pointer to a null terminated string.
+ * \li     A pointer to a null terminated string.
  */
 
 isc_boolean_t
 cfg_obj_isboolean(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of a boolean type.
  */
 
 isc_boolean_t
 cfg_obj_asboolean(const cfg_obj_t *obj);
-/*
+/*%<
  * Returns the value of a configuration object of a boolean type.
  *
  * Requires:
- *      'obj' points to a valid configuration object of a boolean type.
+ * \li     'obj' points to a valid configuration object of a boolean type.
  *
  * Returns:
- *      A boolean value.
+ * \li     A boolean value.
  */
 
 isc_boolean_t
 cfg_obj_issockaddr(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is a socket address.
  */
 
 const isc_sockaddr_t *
 cfg_obj_assockaddr(const cfg_obj_t *obj);
-/*
+/*%<
  * Returns the value of a configuration object representing a socket address.
  *
  * Requires:
- *      'obj' points to a valid configuration object of a socket address type.
+ * \li     'obj' points to a valid configuration object of a socket address type.
  *
  * Returns:
- *      A pointer to a sockaddr.  The sockaddr must be copied by the caller
+ * \li     A pointer to a sockaddr.  The sockaddr must be copied by the caller
  *      if necessary.
  */
 
 isc_boolean_t
 cfg_obj_isnetprefix(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is a network prefix.
  */
 
 void
 cfg_obj_asnetprefix(const cfg_obj_t *obj, isc_netaddr_t *netaddr,
 		    unsigned int *prefixlen);
-/*
+/*%<
  * Gets the value of a configuration object representing a network
  * prefix.  The network address is returned through 'netaddr' and the
  * prefix length in bits through 'prefixlen'.
  *
  * Requires:
- *      'obj' points to a valid configuration object of network prefix type.
- *	'netaddr' and 'prefixlen' are non-NULL.
+ * \li     'obj' points to a valid configuration object of network prefix type.
+ *\li	'netaddr' and 'prefixlen' are non-NULL.
  */
 
 isc_boolean_t
 cfg_obj_islist(const cfg_obj_t *obj);
-/*
+/*%<
  * Return true iff 'obj' is of list type.
  */
 
 const cfg_listelt_t *
 cfg_list_first(const cfg_obj_t *obj);
-/*
+/*%<
  * Returns the first list element in a configuration object of a list type.
  *
  * Requires:
- *      'obj' points to a valid configuration object of a list type or NULL.
+ * \li     'obj' points to a valid configuration object of a list type or NULL.
  *
  * Returns:
- *      A pointer to a cfg_listelt_t representing the first list element,
+ *   \li   A pointer to a cfg_listelt_t representing the first list element,
  * 	or NULL if the list is empty or nonexistent.
  */
 
 const cfg_listelt_t *
 cfg_list_next(const cfg_listelt_t *elt);
-/*
+/*%<
  * Returns the next element of a list of configuration objects.
  *
  * Requires:
- *      'elt' points to cfg_listelt_t obtained from cfg_list_first() or
+ * \li     'elt' points to cfg_listelt_t obtained from cfg_list_first() or
  *	a previous call to cfg_list_next().
  *
  * Returns:
- *      A pointer to a cfg_listelt_t representing the next element,
+ * \li     A pointer to a cfg_listelt_t representing the next element,
  * 	or NULL if there are no more elements.
  */
 
 const cfg_obj_t *
 cfg_listelt_value(const cfg_listelt_t *elt);
-/*
+/*%<
  * Returns the configuration object associated with cfg_listelt_t.
  *
  * Requires:
- *      'elt' points to cfg_listelt_t obtained from cfg_list_first() or
+ * \li     'elt' points to cfg_listelt_t obtained from cfg_list_first() or
  *	cfg_list_next().
  *
  * Returns:
- *      A non-NULL pointer to a configuration object.
+ * \li     A non-NULL pointer to a configuration object.
  */
 
 void
 cfg_print(const cfg_obj_t *obj,
 	  void (*f)(void *closure, const char *text, int textlen),
 	  void *closure);
-/*
+/*%<
  * Print the configuration object 'obj' by repeatedly calling the
  * function 'f', passing 'closure' and a region of text starting
  * at 'text' and comprising 'textlen' characters.
@@ -373,18 +374,18 @@ void
 cfg_print_grammar(const cfg_type_t *type,
 	  void (*f)(void *closure, const char *text, int textlen),
 	  void *closure);
-/*
+/*%<
  * Print a summary of the grammar of the configuration type 'type'.
  */
 
 isc_boolean_t
 cfg_obj_istype(const cfg_obj_t *obj, const cfg_type_t *type);
-/*
+/*%<
  * Return true iff 'obj' is of type 'type'. 
  */
 
 void cfg_obj_destroy(cfg_parser_t *pctx, cfg_obj_t **obj);
-/*
+/*%<
  * Destroy a configuration object.
  */
 
@@ -392,7 +393,7 @@ void
 cfg_obj_log(const cfg_obj_t *obj, isc_log_t *lctx, int level,
             const char *fmt, ...)
 	ISC_FORMAT_PRINTF(4, 5);
-/*
+/*%<
  * Log a message concerning configuration object 'obj' to the logging
  * channel of 'pctx', at log level 'level'.  The message will be prefixed
  * with the file name(s) and line number where 'obj' was defined.
@@ -400,13 +401,13 @@ cfg_obj_log(const cfg_obj_t *obj, isc_log_t *lctx, int level,
 
 const char *
 cfg_obj_file(const cfg_obj_t *obj);
-/*
+/*%<
  * Return the file that defined this object.
  */
 
 unsigned int
 cfg_obj_line(const cfg_obj_t *obj);
-/*
+/*%<
  * Return the line in file where this object was defined.
  */
 
diff --git a/contrib/bind9/lib/isccfg/include/isccfg/grammar.h b/contrib/bind9/lib/isccfg/include/isccfg/grammar.h
index 4aaeb4f..fa66146 100644
--- a/contrib/bind9/lib/isccfg/include/isccfg/grammar.h
+++ b/contrib/bind9/lib/isccfg/include/isccfg/grammar.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: grammar.h,v 1.3.50.6 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: grammar.h,v 1.4.18.8 2006/02/28 03:10:49 marka Exp $ */
 
 #ifndef ISCCFG_GRAMMAR_H
 #define ISCCFG_GRAMMAR_H 1
 
+/*! \file */
+
 #include <isc/lex.h>
 #include <isc/netaddr.h>
 #include <isc/sockaddr.h>
@@ -33,17 +35,17 @@
  * and the grammars; not visible to users of the parser.
  */
 
-/* Clause may occur multiple times (e.g., "zone") */
+/*% Clause may occur multiple times (e.g., "zone") */
 #define CFG_CLAUSEFLAG_MULTI 		0x00000001
-/* Clause is obsolete */
+/*% Clause is obsolete */
 #define CFG_CLAUSEFLAG_OBSOLETE 	0x00000002
-/* Clause is not implemented, and may never be */
+/*% Clause is not implemented, and may never be */
 #define CFG_CLAUSEFLAG_NOTIMP	 	0x00000004
-/* Clause is not implemented yet */
+/*% Clause is not implemented yet */
 #define CFG_CLAUSEFLAG_NYI 		0x00000008
-/* Default value has changed since earlier release */
+/*% Default value has changed since earlier release */
 #define CFG_CLAUSEFLAG_NEWDEFAULT	0x00000010
-/*
+/*%
  * Clause needs to be interpreted during parsing
  * by calling a callback function, like the
  * "directory" option.
@@ -71,7 +73,7 @@ typedef void	     (*cfg_freefunc_t)(cfg_parser_t *, cfg_obj_t *);
  * Structure definitions
  */
 
-/*
+/*%
  * A configuration printer object.  This is an abstract
  * interface to a destination to which text can be printed
  * by calling the function 'f'.
@@ -82,42 +84,39 @@ struct cfg_printer {
 	int indent;
 };
 
-/* A clause definition. */
-
+/*% A clause definition. */
 struct cfg_clausedef {
 	const char      *name;
 	cfg_type_t      *type;
 	unsigned int	flags;
 };
 
-/* A tuple field definition. */
-
+/*% A tuple field definition. */
 struct cfg_tuplefielddef {
 	const char      *name;
 	cfg_type_t      *type;
 	unsigned int	flags;
 };
 
-/* A configuration object type definition. */
+/*% A configuration object type definition. */
 struct cfg_type {
-	const char *name;	/* For debugging purposes only */
+	const char *name;	/*%< For debugging purposes only */
 	cfg_parsefunc_t	parse;
 	cfg_printfunc_t print;
-	cfg_docfunc_t	doc;	/* Print grammar description */
-	cfg_rep_t *	rep;	/* Data representation */
-	const void *	of;	/* Additional data for meta-types */
+	cfg_docfunc_t	doc;	/*%< Print grammar description */
+	cfg_rep_t *	rep;	/*%< Data representation */
+	const void *	of;	/*%< Additional data for meta-types */
 };
 
-/* A keyword-type definition, for things like "port <integer>". */
-
+/*% A keyword-type definition, for things like "port <integer>". */
 typedef struct {
 	const char *name;
 	const cfg_type_t *type;
 } keyword_type_t;
 
 struct cfg_map {
-	cfg_obj_t	 *id; /* Used for 'named maps' like keys, zones, &c */
-	const cfg_clausedef_t * const *clausesets; /* The clauses that
+	cfg_obj_t	 *id; /*%< Used for 'named maps' like keys, zones, &c */
+	const cfg_clausedef_t * const *clausesets; /*%< The clauses that
 						      can occur in this map;
 						      used for printing */
 	isc_symtab_t     *symtab;
@@ -130,15 +129,15 @@ struct cfg_netprefix {
 	unsigned int prefixlen;
 };
 
-/*
+/*%
  * A configuration data representation.
  */
 struct cfg_rep {
-	const char *	name;	/* For debugging only */
-	cfg_freefunc_t 	free;	/* How to free this kind of data. */
+	const char *	name;	/*%< For debugging only */
+	cfg_freefunc_t 	free;	/*%< How to free this kind of data. */
 };
 
-/*
+/*%
  * A configuration object.  This is the main building block
  * of the configuration parse tree.
  */
@@ -148,7 +147,7 @@ struct cfg_obj {
 	union {
 		isc_uint32_t  	uint32;
 		isc_uint64_t  	uint64;
-		isc_textregion_t string; /* null terminated, too */
+		isc_textregion_t string; /*%< null terminated, too */
 		isc_boolean_t 	boolean;
 		cfg_map_t	map;
 		cfg_list_t	list;
@@ -161,14 +160,13 @@ struct cfg_obj {
 };
 
 
-/* A list element. */
-
+/*% A list element. */
 struct cfg_listelt {
 	cfg_obj_t               *obj;
 	ISC_LINK(cfg_listelt_t)  link;
 };
 
-/* The parser object. */
+/*% The parser object. */
 struct cfg_parser {
 	isc_mem_t *	mctx;
 	isc_log_t *	lctx;
@@ -177,13 +175,13 @@ struct cfg_parser {
 	unsigned int    warnings;
 	isc_token_t     token;
 
-	/* We are at the end of all input. */
+	/*% We are at the end of all input. */
 	isc_boolean_t	seen_eof;
 
-	/* The current token has been pushed back. */
+	/*% The current token has been pushed back. */
 	isc_boolean_t	ungotten;
 
-	/*
+	/*%
 	 * The stack of currently active files, represented
 	 * as a configuration list of configuration strings.
 	 * The head is the top-level file, subsequent elements 
@@ -192,7 +190,7 @@ struct cfg_parser {
 	 */
 	cfg_obj_t *	open_files;
 
-	/*
+	/*%
 	 * Names of files that we have parsed and closed
 	 * and were previously on the open_file list.
 	 * We keep these objects around after closing
@@ -203,7 +201,7 @@ struct cfg_parser {
 	 */
 	cfg_obj_t *	closed_files;
 
-	/*
+	/*%
 	 * Current line number.  We maintain our own
 	 * copy of this so that it is available even
 	 * when a file has just been closed.
@@ -215,15 +213,19 @@ struct cfg_parser {
 };
 
 
-/*
+/*@{*/
+/*%
  * Flags defining whether to accept certain types of network addresses.
  */
 #define CFG_ADDR_V4OK 		0x00000001
 #define CFG_ADDR_V4PREFIXOK 	0x00000002
 #define CFG_ADDR_V6OK 		0x00000004
 #define CFG_ADDR_WILDOK		0x00000008
+#define CFG_ADDR_MASK		(CFG_ADDR_V6OK|CFG_ADDR_V4OK)
+/*@}*/
 
-/*
+/*@{*/
+/*%
  * Predefined data representation types.
  */
 LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_uint32;
@@ -236,8 +238,10 @@ LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_tuple;
 LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_sockaddr;
 LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_netprefix;
 LIBISCCFG_EXTERNAL_DATA extern cfg_rep_t cfg_rep_void;
+/*@}*/
 
-/*
+/*@{*/
+/*%
  * Predefined configuration object types.
  */
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_boolean;
@@ -248,10 +252,15 @@ LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_astring;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_ustring;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_sockaddr;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr;
+LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr4;
+LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr4wild;
+LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr6;
+LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netaddr6wild;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_netprefix;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_void;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_token;
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_unsupported;
+/*@}*/
 
 isc_result_t
 cfg_gettoken(cfg_parser_t *pctx, int options);
@@ -314,7 +323,7 @@ cfg_parse_netprefix(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret)
 
 isc_result_t
 cfg_parse_special(cfg_parser_t *pctx, int special);
-/* Parse a required special character 'special'. */
+/*%< Parse a required special character 'special'. */
 
 isc_result_t
 cfg_create_tuple(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **objp);
@@ -358,11 +367,11 @@ cfg_doc_enum(cfg_printer_t *pctx, const cfg_type_t *type);
 
 void
 cfg_print_chars(cfg_printer_t *pctx, const char *text, int len);
-/* Print 'len' characters at 'text' */
+/*%< Print 'len' characters at 'text' */
 
 void
 cfg_print_cstr(cfg_printer_t *pctx, const char *s);
-/* Print the null-terminated string 's' */
+/*%< Print the null-terminated string 's' */
 
 isc_result_t
 cfg_parse_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
@@ -373,6 +382,10 @@ cfg_parse_named_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret)
 isc_result_t
 cfg_parse_addressed_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret);
 
+isc_result_t
+cfg_parse_netprefix_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **
+ret);
+
 void
 cfg_print_map(cfg_printer_t *pctx, const cfg_obj_t *obj);
 
@@ -405,28 +418,28 @@ cfg_print_obj(cfg_printer_t *pctx, const cfg_obj_t *obj);
 
 void
 cfg_doc_obj(cfg_printer_t *pctx, const cfg_type_t *type);
-/*
+/*%<
  * Print a description of the grammar of an arbitrary configuration
  * type 'type'
  */
 
 void
 cfg_doc_terminal(cfg_printer_t *pctx, const cfg_type_t *type);
-/*
+/*%<
  * Document the type 'type' as a terminal by printing its
- * name in angle brackets, e.g., <uint32>.
+ * name in angle brackets, e.g., &lt;uint32>.
  */
 
 void
 cfg_parser_error(cfg_parser_t *pctx, unsigned int flags,
 		 const char *fmt, ...) ISC_FORMAT_PRINTF(3, 4);
-/*
+/*! 
  * Pass one of these flags to cfg_parser_error() to include the
  * token text in log message.
  */
-#define CFG_LOG_NEAR    0x00000001	/* Say "near <token>" */
-#define CFG_LOG_BEFORE  0x00000002	/* Say "before <token>" */
-#define CFG_LOG_NOPREP  0x00000004	/* Say just "<token>" */
+#define CFG_LOG_NEAR    0x00000001	/*%< Say "near <token>" */
+#define CFG_LOG_BEFORE  0x00000002	/*%< Say "before <token>" */
+#define CFG_LOG_NOPREP  0x00000004	/*%< Say just "<token>" */
 
 void
 cfg_parser_warning(cfg_parser_t *pctx, unsigned int flags,
@@ -434,6 +447,6 @@ cfg_parser_warning(cfg_parser_t *pctx, unsigned int flags,
 
 isc_boolean_t
 cfg_is_enum(const char *s, const char *const *enums);
-/* Return true iff the string 's' is one of the strings in 'enums' */
+/*%< Return true iff the string 's' is one of the strings in 'enums' */
 
 #endif /* ISCCFG_GRAMMAR_H */
diff --git a/contrib/bind9/lib/isccfg/include/isccfg/log.h b/contrib/bind9/lib/isccfg/include/isccfg/log.h
index b3d2da7d..f66c37f 100644
--- a/contrib/bind9/lib/isccfg/include/isccfg/log.h
+++ b/contrib/bind9/lib/isccfg/include/isccfg/log.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.h,v 1.3.2.1.10.3 2004/03/08 09:05:07 marka Exp $ */
+/* $Id: log.h,v 1.6.18.2 2005/04/29 00:17:16 marka Exp $ */
 
 #ifndef ISCCFG_LOG_H
 #define ISCCFG_LOG_H 1
 
+/*! \file */
+
 #include <isc/lang.h>
 #include <isc/log.h>
 
@@ -34,17 +36,17 @@ ISC_LANG_BEGINDECLS
 
 void
 cfg_log_init(isc_log_t *lctx);
-/*
+/*%<
  * Make the libisccfg categories and modules available for use with the
  * ISC logging library.
  *
  * Requires:
- *	lctx is a valid logging context.
+ *\li	lctx is a valid logging context.
  *
- *	cfg_log_init() is called only once.
+ *\li	cfg_log_init() is called only once.
  *
  * Ensures:
- * 	The catgories and modules defined above are available for
+ * \li	The catgories and modules defined above are available for
  * 	use by isc_log_usechannnel() and isc_log_write().
  */
 
diff --git a/contrib/bind9/lib/isccfg/include/isccfg/namedconf.h b/contrib/bind9/lib/isccfg/include/isccfg/namedconf.h
index 4d5bd0b..6125b26 100644
--- a/contrib/bind9/lib/isccfg/include/isccfg/namedconf.h
+++ b/contrib/bind9/lib/isccfg/include/isccfg/namedconf.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namedconf.h,v 1.2.202.3 2004/03/08 09:05:07 marka Exp $ */
+/* $Id: namedconf.h,v 1.3.18.2 2005/04/29 00:17:16 marka Exp $ */
 
 #ifndef ISCCFG_NAMEDCONF_H
 #define ISCCFG_NAMEDCONF_H 1
 
-/*
+/*! \file
+ * \brief
  * This module defines the named.conf, rndc.conf, and rndc.key grammars.
  */
 
@@ -30,15 +31,15 @@
  * Configuration object types.
  */
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_namedconf;
-/* A complete named.conf file. */
+/*%< A complete named.conf file. */
 
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_rndcconf;
-/* A complete rndc.conf file. */
+/*%< A complete rndc.conf file. */
 
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_rndckey;
-/* A complete rndc.key file. */
+/*%< A complete rndc.key file. */
 
 LIBISCCFG_EXTERNAL_DATA extern cfg_type_t cfg_type_keyref;
-/* A key reference, used as an ACL element */
+/*%< A key reference, used as an ACL element */
 
 #endif /* ISCCFG_CFG_H */
diff --git a/contrib/bind9/lib/isccfg/include/isccfg/version.h b/contrib/bind9/lib/isccfg/include/isccfg/version.h
index d02a814..38bb14b 100644
--- a/contrib/bind9/lib/isccfg/include/isccfg/version.h
+++ b/contrib/bind9/lib/isccfg/include/isccfg/version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.h,v 1.2.222.3 2004/03/08 09:05:08 marka Exp $ */
+/* $Id: version.h,v 1.3.18.2 2005/04/29 00:17:16 marka Exp $ */
+
+/*! \file */
 
 #include <isc/platform.h>
 
diff --git a/contrib/bind9/lib/isccfg/log.c b/contrib/bind9/lib/isccfg/log.c
index b16b4d3..5d5ccb5 100644
--- a/contrib/bind9/lib/isccfg/log.c
+++ b/contrib/bind9/lib/isccfg/log.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.c,v 1.2.2.1.10.3 2004/03/08 09:05:06 marka Exp $ */
+/* $Id: log.c,v 1.5.18.2 2005/04/29 00:17:15 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -23,7 +25,7 @@
 
 #include <isccfg/log.h>
 
-/*
+/*%
  * When adding a new category, be sure to add the appropriate
  * #define to <isccfg/log.h>.
  */
@@ -32,7 +34,7 @@ LIBISCCFG_EXTERNAL_DATA isc_logcategory_t cfg_categories[] = {
 	{ NULL, 	0 }
 };
 
-/*
+/*%
  * When adding a new module, be sure to add the appropriate
  * #define to <isccfg/log.h>.
  */
diff --git a/contrib/bind9/lib/isccfg/namedconf.c b/contrib/bind9/lib/isccfg/namedconf.c
index d54bbe2..65e30a2 100644
--- a/contrib/bind9/lib/isccfg/namedconf.c
+++ b/contrib/bind9/lib/isccfg/namedconf.c
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namedconf.c,v 1.21.44.34 2006/03/02 00:37:20 marka Exp $ */
+/* $Id: namedconf.c,v 1.30.18.38 2006/05/03 01:46:40 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -32,18 +34,18 @@
 
 #define TOKEN_STRING(pctx) (pctx->token.value.as_textregion.base)
 
-/* Check a return value. */
+/*% Check a return value. */
 #define CHECK(op) 						\
      	do { result = (op); 					\
 		if (result != ISC_R_SUCCESS) goto cleanup; 	\
 	} while (0)
 
-/* Clean up a configuration object if non-NULL. */
+/*% Clean up a configuration object if non-NULL. */
 #define CLEANUP_OBJ(obj) \
 	do { if ((obj) != NULL) cfg_obj_destroy(pctx, &(obj)); } while (0)
 
 
-/*
+/*%
  * Forward declarations of static functions.
  */
 
@@ -71,10 +73,12 @@ static cfg_type_t cfg_type_addrmatchelt;
 static cfg_type_t cfg_type_bracketed_aml;
 static cfg_type_t cfg_type_bracketed_namesockaddrkeylist;
 static cfg_type_t cfg_type_bracketed_sockaddrlist;
+static cfg_type_t cfg_type_bracketed_sockaddrnameportlist;
 static cfg_type_t cfg_type_controls;
 static cfg_type_t cfg_type_controls_sockaddr;
 static cfg_type_t cfg_type_destinationlist;
 static cfg_type_t cfg_type_dialuptype;
+static cfg_type_t cfg_type_ixfrdifftype;
 static cfg_type_t cfg_type_key;
 static cfg_type_t cfg_type_logfile;
 static cfg_type_t cfg_type_logging;
@@ -104,8 +108,35 @@ static cfg_type_t cfg_type_view;
 static cfg_type_t cfg_type_viewopts;
 static cfg_type_t cfg_type_zone;
 static cfg_type_t cfg_type_zoneopts;
+static cfg_type_t cfg_type_dynamically_loadable_zones;
+static cfg_type_t cfg_type_dynamically_loadable_zones_opts;
+
+/*
+ * Clauses that can be found in a 'dynamically loadable zones' statement
+ */
+static cfg_clausedef_t
+dynamically_loadable_zones_clauses[] = {
+	{ "database", &cfg_type_astring, 0 },
+	{ NULL, NULL, 0 }
+};
+
+/*
+ * A dynamically loadable zones statement.
+ */
+static cfg_tuplefielddef_t dynamically_loadable_zones_fields[] = {
+	{ "name", &cfg_type_astring, 0 },
+	{ "options", &cfg_type_dynamically_loadable_zones_opts, 0 },
+	{ NULL, NULL, 0 }
+};
+
+static cfg_type_t cfg_type_dynamically_loadable_zones = {
+	"dlz", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
+	&cfg_rep_tuple,
+	dynamically_loadable_zones_fields
+	};
 
-/* tkey-dhkey */
+
+/*% tkey-dhkey */
 
 static cfg_tuplefielddef_t tkey_dhkey_fields[] = {
 	{ "name", &cfg_type_qstring, 0 },
@@ -118,7 +149,7 @@ static cfg_type_t cfg_type_tkey_dhkey = {
 	tkey_dhkey_fields
 };
 
-/* listen-on */
+/*% listen-on */
 
 static cfg_tuplefielddef_t listenon_fields[] = {
 	{ "port", &cfg_type_optional_port, 0 },
@@ -128,7 +159,7 @@ static cfg_tuplefielddef_t listenon_fields[] = {
 static cfg_type_t cfg_type_listenon = {
 	"listenon", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, listenon_fields };
 
-/* acl */
+/*% acl */
 
 static cfg_tuplefielddef_t acl_fields[] = {
 	{ "name", &cfg_type_astring, 0 },
@@ -139,7 +170,7 @@ static cfg_tuplefielddef_t acl_fields[] = {
 static cfg_type_t cfg_type_acl = {
 	"acl", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, acl_fields };
 
-/* masters */
+/*% masters */
 static cfg_tuplefielddef_t masters_fields[] = {
 	{ "name", &cfg_type_astring, 0 },
 	{ "port", &cfg_type_optional_port, 0 },
@@ -150,7 +181,7 @@ static cfg_tuplefielddef_t masters_fields[] = {
 static cfg_type_t cfg_type_masters = {
 	"masters", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, masters_fields };
 
-/*
+/*%
  * "sockaddrkeylist", a list of socket addresses with optional keys
  * and an optional default port, as used in the masters option.
  * E.g.,
@@ -183,7 +214,7 @@ static cfg_type_t cfg_type_namesockaddrkeylist = {
 	namesockaddrkeylist_fields
 };
 
-/*
+/*%
  * A list of socket addresses with an optional default port,
  * as used in the also-notify option.  E.g.,
  * "port 1234 { 10.0.0.1; 1::2 port 69; }"
@@ -198,7 +229,7 @@ static cfg_type_t cfg_type_portiplist = {
 	portiplist_fields
 };
 
-/*
+/*%
  * A public key, as in the "pubkey" statement.
  */
 static cfg_tuplefielddef_t pubkey_fields[] = {
@@ -211,7 +242,7 @@ static cfg_tuplefielddef_t pubkey_fields[] = {
 static cfg_type_t cfg_type_pubkey = {
 	"pubkey", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, pubkey_fields };
 
-/*
+/*%
  * A list of RR types, used in grant statements.
  * Note that the old parser allows quotes around the RR type names.
  */
@@ -227,13 +258,13 @@ static cfg_type_t cfg_type_mode = {
 };
 
 static const char *matchtype_enums[] = {
-	"name", "subdomain", "wildcard", "self", NULL };
+	"name", "subdomain", "wildcard", "self", "selfsub", "selfwild", NULL };
 static cfg_type_t cfg_type_matchtype = {
 	"matchtype", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum, &cfg_rep_string,
 	&matchtype_enums
 };
 
-/*
+/*%
  * A grant statement, used in the update policy.
  */
 static cfg_tuplefielddef_t grant_fields[] = {
@@ -252,7 +283,7 @@ static cfg_type_t cfg_type_updatepolicy = {
 	&cfg_rep_list, &cfg_type_grant
 };
 
-/*
+/*%
  * A view statement.
  */
 static cfg_tuplefielddef_t view_fields[] = {
@@ -264,7 +295,7 @@ static cfg_tuplefielddef_t view_fields[] = {
 static cfg_type_t cfg_type_view = {
 	"view", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, view_fields };
 
-/*
+/*%
  * A zone statement.
  */
 static cfg_tuplefielddef_t zone_fields[] = {
@@ -276,7 +307,7 @@ static cfg_tuplefielddef_t zone_fields[] = {
 static cfg_type_t cfg_type_zone = {
 	"zone", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, zone_fields };
 
-/*
+/*%
  * A "category" clause in the "logging" statement.
  */
 static cfg_tuplefielddef_t category_fields[] = {
@@ -288,7 +319,7 @@ static cfg_type_t cfg_type_category = {
 	"category", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple, category_fields };
 
 
-/*
+/*%
  * A trusted key, as used in the "trusted-keys" statement.
  */
 static cfg_tuplefielddef_t trustedkey_fields[] = {
@@ -325,7 +356,7 @@ static cfg_type_t cfg_type_optional_wild_name = {
 	print_keyvalue, doc_optional_keyvalue, &cfg_rep_string, &wild_name_kw
 };
 
-/*
+/*%
  * An rrset ordering element.
  */
 static cfg_tuplefielddef_t rrsetorderingelement_fields[] = {
@@ -341,7 +372,7 @@ static cfg_type_t cfg_type_rrsetorderingelement = {
 	rrsetorderingelement_fields
 };
 
-/*
+/*%
  * A global or view "check-names" option.  Note that the zone
  * "check-names" option has a different syntax.
  */
@@ -385,7 +416,7 @@ static cfg_type_t cfg_type_optional_port = {
 	doc_optional_keyvalue, &cfg_rep_uint32, &port_kw
 };
 
-/* A list of keys, as in the "key" clause of the controls statement. */
+/*% A list of keys, as in the "key" clause of the controls statement. */
 static cfg_type_t cfg_type_keylist = {
 	"keylist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list, &cfg_rep_list,
 	&cfg_type_astring
@@ -405,8 +436,8 @@ static cfg_type_t cfg_type_forwardtype = {
 static const char *zonetype_enums[] = {
 	"master", "slave", "stub", "hint", "forward", "delegation-only", NULL };
 static cfg_type_t cfg_type_zonetype = {
-	"zonetype", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum, &cfg_rep_string,
-	&zonetype_enums
+	"zonetype", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+	&cfg_rep_string, &zonetype_enums
 };
 
 static const char *loglevel_enums[] = {
@@ -423,7 +454,7 @@ static cfg_type_t cfg_type_transferformat = {
 	&transferformat_enums
 };
 
-/*
+/*%
  * The special keyword "none", as used in the pid-file option.
  */
 
@@ -437,7 +468,7 @@ static cfg_type_t cfg_type_none = {
 	"none", NULL, print_none, NULL, &cfg_rep_void, NULL
 };
 
-/*
+/*%
  * A quoted string or the special keyword "none".  Used in the pid-file option.
  */
 static isc_result_t
@@ -464,7 +495,7 @@ doc_qstringornone(cfg_printer_t *pctx, const cfg_type_t *type) {
 static cfg_type_t cfg_type_qstringornone = {
 	"qstringornone", parse_qstringornone, NULL, doc_qstringornone, NULL, NULL };
 
-/*
+/*%
  * keyword hostname
  */
 
@@ -478,7 +509,7 @@ static cfg_type_t cfg_type_hostname = {
 	"hostname", NULL, print_hostname, NULL, &cfg_rep_boolean, NULL
 };
 
-/*
+/*%
  * "server-id" argument.
  */
 
@@ -510,7 +541,7 @@ doc_serverid(cfg_printer_t *pctx, const cfg_type_t *type) {
 static cfg_type_t cfg_type_serverid = {
 	"serverid", parse_serverid, NULL, doc_serverid, NULL, NULL };
 
-/*
+/*%
  * Port list.
  */
 static isc_result_t
@@ -539,7 +570,7 @@ static cfg_type_t cfg_type_bracketed_portlist = {
 	&cfg_rep_list, &cfg_type_port
 };
 
-/*
+/*%
  * Clauses that can be found within the top level of the named.conf
  * file only.
  */
@@ -555,7 +586,7 @@ namedconf_clauses[] = {
 	{ NULL, NULL, 0 }
 };
 
-/*
+/*%
  * Clauses that can occur at the top level or in the view
  * statement, but not in the options block.
  */
@@ -563,12 +594,14 @@ static cfg_clausedef_t
 namedconf_or_view_clauses[] = {
 	{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI },
 	{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI },
+	/* only 1 DLZ per view allowed */
+ 	{ "dlz", &cfg_type_dynamically_loadable_zones, 0 },
 	{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI },
 	{ "trusted-keys", &cfg_type_trustedkeys, CFG_CLAUSEFLAG_MULTI },
 	{ NULL, NULL, 0 }
 };
 
-/*
+/*%
  * Clauses that can be found within the 'options' statement.
  */
 static cfg_clausedef_t
@@ -660,7 +693,13 @@ static cfg_type_t cfg_type_mustbesecure = {
 	&cfg_rep_tuple, mustbesecure_fields
 };
 
-/*
+static const char *masterformat_enums[] = { "text", "raw", NULL };
+static cfg_type_t cfg_type_masterformat = {
+	"masterformat", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+	&cfg_rep_string, &masterformat_enums
+};
+
+/*%
  * dnssec-lookaside
  */
 
@@ -682,13 +721,14 @@ static cfg_type_t cfg_type_lookaside = {
 	&cfg_rep_tuple, lookaside_fields
 };
 
-/*
+/*%
  * Clauses that can be found within the 'view' statement,
  * with defaults in the 'options' statement.
  */
 
 static cfg_clausedef_t
 view_clauses[] = {
+	{ "allow-query-cache", &cfg_type_bracketed_aml, 0 },
 	{ "allow-recursion", &cfg_type_bracketed_aml, 0 },
 	{ "allow-v6-synthesis", &cfg_type_bracketed_aml,
 	  CFG_CLAUSEFLAG_OBSOLETE },
@@ -723,17 +763,31 @@ view_clauses[] = {
 	{ "preferred-glue", &cfg_type_astring, 0 },
 	{ "dual-stack-servers", &cfg_type_nameportiplist, 0 },
 	{ "edns-udp-size", &cfg_type_uint32, 0 },
+	{ "max-udp-size", &cfg_type_uint32, 0 },
 	{ "root-delegation-only",  &cfg_type_optional_exclude, 0 },
 	{ "disable-algorithms", &cfg_type_disablealgorithm,
 	  CFG_CLAUSEFLAG_MULTI },
 	{ "dnssec-enable", &cfg_type_boolean, 0 },
+	{ "dnssec-validation", &cfg_type_boolean, 0 },
 	{ "dnssec-lookaside", &cfg_type_lookaside, CFG_CLAUSEFLAG_MULTI },
 	{ "dnssec-must-be-secure",  &cfg_type_mustbesecure,
 	   CFG_CLAUSEFLAG_MULTI },
+	{ "dnssec-accept-expired", &cfg_type_boolean, 0 },
+	{ "ixfr-from-differences", &cfg_type_ixfrdifftype, 0 },
+	{ "acache-enable", &cfg_type_boolean, 0 },
+	{ "acache-cleaning-interval", &cfg_type_uint32, 0 },
+	{ "max-acache-size", &cfg_type_sizenodefault, 0 },
+	{ "clients-per-query", &cfg_type_uint32, 0 },
+	{ "max-clients-per-query", &cfg_type_uint32, 0 },
+	{ "empty-server", &cfg_type_astring, 0 },
+	{ "empty-contact", &cfg_type_astring, 0 },
+	{ "empty-zones-enable", &cfg_type_boolean, 0 },
+	{ "disable-empty-zone", &cfg_type_astring, CFG_CLAUSEFLAG_MULTI },
+	{ "zero-no-soa-ttl-cache", &cfg_type_boolean, 0 },
 	{ NULL, NULL, 0 }
 };
 
-/*
+/*%
  * Clauses that can be found within the 'view' statement only.
  */
 static cfg_clausedef_t
@@ -744,7 +798,7 @@ view_only_clauses[] = {
 	{ NULL, NULL, 0 }
 };
 
-/*
+/*%
  * Clauses that can be found in a 'zone' statement,
  * with defaults in the 'view' or 'options' statement.
  */
@@ -752,16 +806,18 @@ static cfg_clausedef_t
 zone_clauses[] = {
 	{ "allow-query", &cfg_type_bracketed_aml, 0 },
 	{ "allow-transfer", &cfg_type_bracketed_aml, 0 },
+	{ "allow-update", &cfg_type_bracketed_aml, 0 },
 	{ "allow-update-forwarding", &cfg_type_bracketed_aml, 0 },
 	{ "allow-notify", &cfg_type_bracketed_aml, 0 },
+	{ "masterfile-format", &cfg_type_masterformat, 0 },
 	{ "notify", &cfg_type_notifytype, 0 },
 	{ "notify-source", &cfg_type_sockaddr4wild, 0 },
 	{ "notify-source-v6", &cfg_type_sockaddr6wild, 0 },
 	{ "also-notify", &cfg_type_portiplist, 0 },
+	{ "notify-delay", &cfg_type_uint32, 0 },
 	{ "dialup", &cfg_type_dialuptype, 0 },
 	{ "forward", &cfg_type_forwardtype, 0 },
 	{ "forwarders", &cfg_type_portiplist, 0 },
-	{ "ixfr-from-differences", &cfg_type_boolean, 0 },
 	{ "maintain-ixfr-base", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "max-ixfr-log-size", &cfg_type_size, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "max-journal-size", &cfg_type_sizenodefault, 0 },
@@ -782,18 +838,26 @@ zone_clauses[] = {
 	{ "use-alt-transfer-source", &cfg_type_boolean, 0 },
 	{ "zone-statistics", &cfg_type_boolean, 0 },
 	{ "key-directory", &cfg_type_qstring, 0 },
+	{ "check-wildcard", &cfg_type_boolean, 0 },
+	{ "check-integrity", &cfg_type_boolean, 0 },
+	{ "check-mx", &cfg_type_checkmode, 0 },
+	{ "check-mx-cname", &cfg_type_checkmode, 0 },
+	{ "check-srv-cname", &cfg_type_checkmode, 0 },
+	{ "check-sibling", &cfg_type_boolean, 0 },
+	{ "zero-no-soa-ttl", &cfg_type_boolean, 0 },
+	{ "update-check-ksk", &cfg_type_boolean, 0 },
 	{ NULL, NULL, 0 }
 };
 
-/*
+/*%
  * Clauses that can be found in a 'zone' statement
  * only.
  */
 static cfg_clausedef_t
 zone_only_clauses[] = {
 	{ "type", &cfg_type_zonetype, 0 },
-	{ "allow-update", &cfg_type_bracketed_aml, 0 },
 	{ "file", &cfg_type_qstring, 0 },
+	{ "journal", &cfg_type_qstring, 0 },
 	{ "ixfr-base", &cfg_type_qstring, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "ixfr-tmp-file", &cfg_type_qstring, CFG_CLAUSEFLAG_OBSOLETE },
 	{ "masters", &cfg_type_namesockaddrkeylist, 0 },
@@ -807,11 +871,12 @@ zone_only_clauses[] = {
 	 * the zone options and the global/view options.  Ugh.
 	 */
 	{ "check-names", &cfg_type_checkmode, 0 },
+	{ "ixfr-from-differences", &cfg_type_boolean, 0 },
 	{ NULL, NULL, 0 }
 };
 
 
-/* The top-level named.conf syntax. */
+/*% The top-level named.conf syntax. */
 
 static cfg_clausedef_t *
 namedconf_clausesets[] = {
@@ -825,7 +890,7 @@ LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_namedconf = {
 	&cfg_rep_map, namedconf_clausesets
 };
 
-/* The "options" statement syntax. */
+/*% The "options" statement syntax. */
 
 static cfg_clausedef_t *
 options_clausesets[] = {
@@ -837,7 +902,7 @@ options_clausesets[] = {
 static cfg_type_t cfg_type_options = {
 	"options", cfg_parse_map, cfg_print_map, cfg_doc_map, &cfg_rep_map, options_clausesets };
 
-/* The "view" statement syntax. */
+/*% The "view" statement syntax. */
 
 static cfg_clausedef_t *
 view_clausesets[] = {
@@ -845,12 +910,13 @@ view_clausesets[] = {
 	namedconf_or_view_clauses,
 	view_clauses,
 	zone_clauses,
+ 	dynamically_loadable_zones_clauses,
 	NULL
 };
 static cfg_type_t cfg_type_viewopts = {
 	"view", cfg_parse_map, cfg_print_map, cfg_doc_map, &cfg_rep_map, view_clausesets };
 
-/* The "zone" statement syntax. */
+/*% The "zone" statement syntax. */
 
 static cfg_clausedef_t *
 zone_clausesets[] = {
@@ -859,9 +925,23 @@ zone_clausesets[] = {
 	NULL
 };
 static cfg_type_t cfg_type_zoneopts = {
-	"zoneopts", cfg_parse_map, cfg_print_map, cfg_doc_map, &cfg_rep_map, zone_clausesets };
-
-/*
+	"zoneopts", cfg_parse_map, cfg_print_map, 
+	cfg_doc_map, &cfg_rep_map, zone_clausesets };
+ 
+/*% The "dynamically loadable zones" statement syntax. */
+ 
+static cfg_clausedef_t *
+dynamically_loadable_zones_clausesets[] = {
+	dynamically_loadable_zones_clauses,
+ 	NULL
+};
+static cfg_type_t cfg_type_dynamically_loadable_zones_opts = {
+	"dynamically_loadable_zones_opts", cfg_parse_map, 
+	cfg_print_map, cfg_doc_map, &cfg_rep_map,
+	dynamically_loadable_zones_clausesets 
+};
+ 
+/*%
  * Clauses that can be found within the 'key' statement.
  */
 static cfg_clausedef_t
@@ -877,10 +957,12 @@ key_clausesets[] = {
 	NULL
 };
 static cfg_type_t cfg_type_key = {
-	"key", cfg_parse_named_map, cfg_print_map, cfg_doc_map, &cfg_rep_map, key_clausesets };
+	"key", cfg_parse_named_map, cfg_print_map,
+	cfg_doc_map, &cfg_rep_map, key_clausesets 
+};
 
 
-/*
+/*%
  * Clauses that can be found in a 'server' statement.
  */
 static cfg_clausedef_t
@@ -893,6 +975,12 @@ server_clauses[] = {
 	{ "transfer-format", &cfg_type_transferformat, 0 },
 	{ "keys", &cfg_type_server_key_kludge, 0 },
 	{ "edns", &cfg_type_boolean, 0 },
+	{ "edns-udp-size", &cfg_type_uint32, 0 },
+	{ "max-udp-size", &cfg_type_uint32, 0 },
+	{ "notify-source", &cfg_type_sockaddr4wild, 0 },
+	{ "notify-source-v6", &cfg_type_sockaddr6wild, 0 },
+	{ "query-source", &cfg_type_querysource4, 0 },
+	{ "query-source-v6", &cfg_type_querysource6, 0 },
 	{ "transfer-source", &cfg_type_sockaddr4wild, 0 },
 	{ "transfer-source-v6", &cfg_type_sockaddr6wild, 0 },
 	{ NULL, NULL, 0 }
@@ -903,12 +991,12 @@ server_clausesets[] = {
 	NULL
 };
 static cfg_type_t cfg_type_server = {
-	"server", cfg_parse_addressed_map, cfg_print_map, cfg_doc_map, &cfg_rep_map,
+	"server", cfg_parse_netprefix_map, cfg_print_map, cfg_doc_map, &cfg_rep_map,
 	server_clausesets
 };
 
 
-/*
+/*%
  * Clauses that can be found in a 'channel' clause in the
  * 'logging' statement.
  *
@@ -941,12 +1029,12 @@ static cfg_type_t cfg_type_channel = {
 	&cfg_rep_map, channel_clausesets
 };
 
-/* A list of log destination, used in the "category" clause. */
+/*% A list of log destination, used in the "category" clause. */
 static cfg_type_t cfg_type_destinationlist = {
 	"destinationlist", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list,
 	&cfg_rep_list, &cfg_type_astring };
 
-/*
+/*%
  * Clauses that can be found in a 'logging' statement.
  */
 static cfg_clausedef_t
@@ -1028,14 +1116,14 @@ parse_sizeval(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (result);
 }
 
-/*
+/*%
  * A size value (number + optional unit).
  */
 static cfg_type_t cfg_type_sizeval = {
 	"sizeval", parse_sizeval, cfg_print_uint64, cfg_doc_terminal,
 	&cfg_rep_uint64, NULL };
 
-/*
+/*%
  * A size, "unlimited", or "default".
  */
 
@@ -1050,7 +1138,7 @@ static cfg_type_t cfg_type_size = {
 	&cfg_rep_string, size_enums
 };
 
-/*
+/*%
  * A size or "unlimited", but not "default".
  */
 static const char *sizenodefault_enums[] = { "unlimited", NULL };
@@ -1059,7 +1147,7 @@ static cfg_type_t cfg_type_sizenodefault = {
 	&cfg_rep_string, sizenodefault_enums
 };
 
-/*
+/*%
  * optional_keyvalue
  */
 static isc_result_t
@@ -1163,7 +1251,7 @@ static cfg_type_t cfg_type_dialuptype = {
 	&cfg_rep_string, dialup_enums
 };
 
-static const char *notify_enums[] = { "explicit", NULL };
+static const char *notify_enums[] = { "explicit", "master-only", NULL };
 static isc_result_t
 parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
@@ -1173,6 +1261,16 @@ static cfg_type_t cfg_type_notifytype = {
  	&cfg_rep_string, notify_enums,
 };
 
+static const char *ixfrdiff_enums[] = { "master", "slave", NULL };
+static isc_result_t
+parse_ixfrdiff_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+        return (parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+}
+static cfg_type_t cfg_type_ixfrdifftype = {
+        "ixfrdiff", parse_ixfrdiff_type, cfg_print_ustring, doc_enum_or_other,
+        &cfg_rep_string, ixfrdiff_enums,
+};
+
 static keyword_type_t key_kw = { "key", &cfg_type_astring };
 
 LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_keyref = {
@@ -1185,14 +1283,14 @@ static cfg_type_t cfg_type_optional_keyref = {
 	doc_optional_keyvalue, &cfg_rep_string, &key_kw
 };
 
-/*
+/*%
  * A "controls" statement is represented as a map with the multivalued
- * "inet" and "unix" clauses.  Inet controls are tuples; unix controls
- * are cfg_unsupported_t objects.
+ * "inet" and "unix" clauses. 
  */
 
 static keyword_type_t controls_allow_kw = {
 	"allow", &cfg_type_bracketed_aml };
+
 static cfg_type_t cfg_type_controls_allow = {
 	"controls_allow", parse_keyvalue,
 	print_keyvalue, doc_keyvalue,
@@ -1201,6 +1299,7 @@ static cfg_type_t cfg_type_controls_allow = {
 
 static keyword_type_t controls_keys_kw = {
 	"keys", &cfg_type_keylist };
+
 static cfg_type_t cfg_type_controls_keys = {
 	"controls_keys", parse_optional_keyvalue,
 	print_keyvalue, doc_optional_keyvalue,
@@ -1213,16 +1312,57 @@ static cfg_tuplefielddef_t inetcontrol_fields[] = {
 	{ "keys", &cfg_type_controls_keys, 0 },
 	{ NULL, NULL, 0 }
 };
+
 static cfg_type_t cfg_type_inetcontrol = {
 	"inetcontrol", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple,
 	inetcontrol_fields
 };
 
+static keyword_type_t controls_perm_kw = {
+	"perm", &cfg_type_uint32 };
+
+static cfg_type_t cfg_type_controls_perm = {
+	"controls_perm", parse_keyvalue,
+	print_keyvalue, doc_keyvalue,
+	&cfg_rep_uint32, &controls_perm_kw
+};
+
+static keyword_type_t controls_owner_kw = {
+	"owner", &cfg_type_uint32 };
+
+static cfg_type_t cfg_type_controls_owner = {
+	"controls_owner", parse_keyvalue,
+	print_keyvalue, doc_keyvalue,
+	&cfg_rep_uint32, &controls_owner_kw
+};
+
+static keyword_type_t controls_group_kw = {
+	"group", &cfg_type_uint32 };
+
+static cfg_type_t cfg_type_controls_group = {
+	"controls_allow", parse_keyvalue,
+	print_keyvalue, doc_keyvalue,
+	&cfg_rep_uint32, &controls_group_kw
+};
+
+static cfg_tuplefielddef_t unixcontrol_fields[] = {
+	{ "path", &cfg_type_qstring, 0 },
+	{ "perm", &cfg_type_controls_perm, 0 },
+	{ "owner", &cfg_type_controls_owner, 0 },
+	{ "group", &cfg_type_controls_group, 0 },
+	{ "keys", &cfg_type_controls_keys, 0 },
+	{ NULL, NULL, 0 }
+};
+
+static cfg_type_t cfg_type_unixcontrol = {
+	"unixcontrol", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple,
+	unixcontrol_fields
+};
+
 static cfg_clausedef_t
 controls_clauses[] = {
 	{ "inet", &cfg_type_inetcontrol, CFG_CLAUSEFLAG_MULTI },
-	{ "unix", &cfg_type_unsupported,
-	  CFG_CLAUSEFLAG_MULTI|CFG_CLAUSEFLAG_NOTIMP },
+	{ "unix", &cfg_type_unixcontrol, CFG_CLAUSEFLAG_MULTI },
 	{ NULL, NULL, 0 }
 };
 
@@ -1235,7 +1375,7 @@ static cfg_type_t cfg_type_controls = {
 	"controls", cfg_parse_map, cfg_print_map, cfg_doc_map, &cfg_rep_map,	&controls_clausesets
 };
 
-/*
+/*%
  * An optional class, as used in view and zone statements.
  */
 static isc_result_t
@@ -1257,24 +1397,24 @@ static cfg_type_t cfg_type_optional_class = {
 };
 
 static isc_result_t
-parse_querysource(cfg_parser_t *pctx, int flags, cfg_obj_t **ret) {
+parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	isc_result_t result;
 	cfg_obj_t *obj = NULL;
 	isc_netaddr_t netaddr;
 	in_port_t port;
 	unsigned int have_address = 0;
 	unsigned int have_port = 0;
+	const unsigned int *flagp = type->of;
 
-	if ((flags & CFG_ADDR_V4OK) != 0)
+	if ((*flagp & CFG_ADDR_V4OK) != 0)
 		isc_netaddr_any(&netaddr);
-	else if ((flags & CFG_ADDR_V6OK) != 0)
+	else if ((*flagp & CFG_ADDR_V6OK) != 0)
 		isc_netaddr_any6(&netaddr);
 	else
 		INSIST(0);
 
 	port = 0;
 
-	CHECK(cfg_create_obj(pctx, &cfg_type_querysource, &obj));
 	for (;;) {
 		CHECK(cfg_peektoken(pctx, 0));
 		if (pctx->token.type == isc_tokentype_string) {
@@ -1283,8 +1423,7 @@ parse_querysource(cfg_parser_t *pctx, int flags, cfg_obj_t **ret) {
 			{
 				/* read "address" */
 				CHECK(cfg_gettoken(pctx, 0)); 
-				CHECK(cfg_parse_rawaddr(pctx,
-						flags | CFG_ADDR_WILDOK,
+				CHECK(cfg_parse_rawaddr(pctx, *flagp,
 							&netaddr));
 				have_address++;
 			} else if (strcasecmp(TOKEN_STRING(pctx), "port") == 0)
@@ -1295,6 +1434,8 @@ parse_querysource(cfg_parser_t *pctx, int flags, cfg_obj_t **ret) {
 							CFG_ADDR_WILDOK,
 							&port));
 				have_port++;
+			} else if (have_port == 0 && have_address == 0) {
+				return (cfg_parse_sockaddr(pctx, type, ret));
 			} else {
 				cfg_parser_error(pctx, CFG_LOG_NEAR,
 					     "expected 'address' or 'port'");
@@ -1309,6 +1450,7 @@ parse_querysource(cfg_parser_t *pctx, int flags, cfg_obj_t **ret) {
 		return (ISC_R_UNEXPECTEDTOKEN);
 	}
 
+	CHECK(cfg_create_obj(pctx, &cfg_type_querysource, &obj));
 	isc_sockaddr_fromnetaddr(&obj->value.sockaddr, &netaddr, port);
 	*ret = obj;
 	return (ISC_R_SUCCESS);
@@ -1319,18 +1461,6 @@ parse_querysource(cfg_parser_t *pctx, int flags, cfg_obj_t **ret) {
 	return (result);
 }
 
-static isc_result_t
-parse_querysource4(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	UNUSED(type);
-	return (parse_querysource(pctx, CFG_ADDR_V4OK, ret));
-}
-
-static isc_result_t
-parse_querysource6(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	UNUSED(type);
-	return (parse_querysource(pctx, CFG_ADDR_V6OK, ret));
-}
-
 static void
 print_querysource(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	isc_netaddr_t na;
@@ -1341,18 +1471,23 @@ print_querysource(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	cfg_print_rawuint(pctx, isc_sockaddr_getport(&obj->value.sockaddr));
 }
 
+static unsigned int sockaddr4wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V4OK;
+static unsigned int sockaddr6wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V6OK;
 static cfg_type_t cfg_type_querysource4 = {
-	"querysource4", parse_querysource4, NULL, cfg_doc_terminal,
-	NULL, NULL
+	"querysource4", parse_querysource, NULL, cfg_doc_terminal,
+	NULL, &sockaddr4wild_flags
 };
+
 static cfg_type_t cfg_type_querysource6 = {
-	"querysource6", parse_querysource6, NULL, cfg_doc_terminal,
-	NULL, NULL
+	"querysource6", parse_querysource, NULL, cfg_doc_terminal,
+	NULL, &sockaddr6wild_flags
 };
+
 static cfg_type_t cfg_type_querysource = {
-	"querysource", NULL, print_querysource, NULL, &cfg_rep_sockaddr, NULL };
+	"querysource", NULL, print_querysource, NULL, &cfg_rep_sockaddr, NULL
+};
 
-/* addrmatchelt */
+/*% addrmatchelt */
 
 static isc_result_t
 parse_addrmatchelt(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
@@ -1396,7 +1531,7 @@ parse_addrmatchelt(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret)
 	return (result);
 }
 
-/*
+/*%
  * A negated address match list element (like "! 10.0.0.1").
  * Somewhat sneakily, the caller is expected to parse the
  * "!", but not to print it.
@@ -1418,21 +1553,21 @@ static cfg_type_t cfg_type_negated = {
 	&negated_fields
 };
 
-/* An address match list element */
+/*% An address match list element */
 
 static cfg_type_t cfg_type_addrmatchelt = {
 	"address_match_element", parse_addrmatchelt, NULL, cfg_doc_terminal,
 	NULL, NULL
 };
 
-/* A bracketed address match list */
+/*% A bracketed address match list */
 
 static cfg_type_t cfg_type_bracketed_aml = {
 	"bracketed_aml", cfg_parse_bracketed_list, cfg_print_bracketed_list,
 	cfg_doc_bracketed_list, &cfg_rep_list, &cfg_type_addrmatchelt
 };
 
-/*
+/*%
  * The socket address syntax in the "controls" statement is silly.
  * It allows both socket address families, but also allows "*",
  * whis is gratuitously interpreted as the IPv4 wildcard address.
@@ -1444,7 +1579,7 @@ static cfg_type_t cfg_type_controls_sockaddr = {
 	cfg_doc_sockaddr, &cfg_rep_sockaddr, &controls_sockaddr_flags
 };
 
-/*
+/*%
  * Handle the special kludge syntax of the "keys" clause in the "server"
  * statement, which takes a single key with or without braces and semicolon.
  */
@@ -1483,7 +1618,7 @@ static cfg_type_t cfg_type_server_key_kludge = {
 };
 
 
-/*
+/*%
  * An optional logging facility.
  */
 
@@ -1509,7 +1644,7 @@ static cfg_type_t cfg_type_optional_facility = {
 	NULL, NULL };
 
 
-/*
+/*%
  * A log severity.  Return as a string, except "debug N",
  * which is returned as a keyword object.
  */
@@ -1554,7 +1689,7 @@ static cfg_type_t cfg_type_logseverity = {
 	"log_severity", parse_logseverity, NULL, cfg_doc_terminal,
 	NULL, NULL };
 
-/*
+/*%
  * The "file" clause of the "channel" statement.
  * This is yet another special case.
  */
@@ -1642,20 +1777,19 @@ static cfg_type_t cfg_type_logfile = {
 	&cfg_rep_tuple, logfile_fields
 };
 
-/* An IPv4/IPv6 address with optional port, "*" accepted as wildcard. */
-static unsigned int sockaddr4wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V4OK;
+/*% An IPv4 address with optional port, "*" accepted as wildcard. */
 static cfg_type_t cfg_type_sockaddr4wild = {
 	"sockaddr4wild", cfg_parse_sockaddr, cfg_print_sockaddr,
 	cfg_doc_sockaddr, &cfg_rep_sockaddr, &sockaddr4wild_flags
 };
 
-static unsigned int sockaddr6wild_flags = CFG_ADDR_WILDOK | CFG_ADDR_V6OK;
+/*% An IPv6 address with optional port, "*" accepted as wildcard. */
 static cfg_type_t cfg_type_sockaddr6wild = {
 	"v6addrportwild", cfg_parse_sockaddr, cfg_print_sockaddr,
 	cfg_doc_sockaddr, &cfg_rep_sockaddr, &sockaddr6wild_flags
 };
 
-/*
+/*%
  * lwres
  */
 
@@ -1688,17 +1822,21 @@ lwres_clausesets[] = {
 	NULL
 };
 static cfg_type_t cfg_type_lwres = {
-	"lwres", cfg_parse_map, cfg_print_map, cfg_doc_map, &cfg_rep_map, lwres_clausesets };
+	"lwres", cfg_parse_map, cfg_print_map, cfg_doc_map, &cfg_rep_map,
+	lwres_clausesets
+};
 
-/*
+/*%
  * rndc
  */
 
 static cfg_clausedef_t
 rndcconf_options_clauses[] = {
-	{ "default-server", &cfg_type_astring, 0 },
 	{ "default-key", &cfg_type_astring, 0 },
 	{ "default-port", &cfg_type_uint32, 0 },
+	{ "default-server", &cfg_type_astring, 0 },
+	{ "default-source-address", &cfg_type_netaddr4wild, 0 },
+	{ "default-source-address-v6", &cfg_type_netaddr6wild, 0 },
 	{ NULL, NULL, 0 }
 };
 
@@ -1709,14 +1847,17 @@ rndcconf_options_clausesets[] = {
 };
 
 static cfg_type_t cfg_type_rndcconf_options = {
-	"rndcconf_options", cfg_parse_map, cfg_print_map, cfg_doc_map, &cfg_rep_map,
-	rndcconf_options_clausesets
+	"rndcconf_options", cfg_parse_map, cfg_print_map, cfg_doc_map,
+	&cfg_rep_map, rndcconf_options_clausesets
 };
 
 static cfg_clausedef_t
 rndcconf_server_clauses[] = {
 	{ "key", &cfg_type_astring, 0 },
 	{ "port", &cfg_type_uint32, 0 },
+	{ "source-address", &cfg_type_netaddr4wild, 0 },
+	{ "source-address-v6", &cfg_type_netaddr6wild, 0 },
+	{ "addresses", &cfg_type_bracketed_sockaddrnameportlist, 0 },
 	{ NULL, NULL, 0 }
 };
 
@@ -1727,8 +1868,8 @@ rndcconf_server_clausesets[] = {
 };
 
 static cfg_type_t cfg_type_rndcconf_server = {
-	"rndcconf_server", cfg_parse_named_map, cfg_print_map, cfg_doc_map, &cfg_rep_map,
-	rndcconf_server_clausesets
+	"rndcconf_server", cfg_parse_named_map, cfg_print_map, cfg_doc_map,
+	&cfg_rep_map, rndcconf_server_clausesets
 };
 
 static cfg_clausedef_t
@@ -1841,7 +1982,7 @@ static cfg_type_t cfg_type_bracketed_sockaddrnameportlist = {
 	&cfg_rep_list, &cfg_type_sockaddrnameport
 };
 
-/*
+/*%
  * A list of socket addresses or name with an optional default port,
  * as used in the dual-stack-servers option.  E.g.,
  * "port 1234 { dual-stack-servers.net; 10.0.0.1; 1::2 port 69; }"
@@ -1857,7 +1998,7 @@ static cfg_type_t cfg_type_nameportiplist = {
 	&cfg_rep_tuple, nameportiplist_fields
 };
 
-/*
+/*%
  * masters element.
  */
 
diff --git a/contrib/bind9/lib/isccfg/parser.c b/contrib/bind9/lib/isccfg/parser.c
index 42ce9f0..19a51a6 100644
--- a/contrib/bind9/lib/isccfg/parser.c
+++ b/contrib/bind9/lib/isccfg/parser.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: parser.c,v 1.70.2.20.2.21 2006/02/28 06:32:54 marka Exp $ */
+/* $Id: parser.c,v 1.112.18.11 2006/02/28 03:10:49 marka Exp $ */
+
+/*! \file */
 
 #include <config.h>
 
@@ -125,7 +127,7 @@ cfg_rep_t cfg_rep_void = { "void", free_noop };
  * Configuration type definitions.
  */
 
-/*
+/*%
  * An implicit list.  These are formed by clauses that occur multiple times.
  */
 static cfg_type_t cfg_type_implicitlist = {
@@ -1087,7 +1089,6 @@ cfg_print_spacelist(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	}
 }
 
-
 isc_boolean_t
 cfg_obj_islist(const cfg_obj_t *obj) {
 	REQUIRE(obj != NULL);
@@ -1360,13 +1361,22 @@ cfg_parse_named_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret)
 
 /*
  * Parse a map identified by a network address.
- * Used for the "server" statement.
+ * Used to be used for the "server" statement.
  */
 isc_result_t
 cfg_parse_addressed_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (parse_any_named_map(pctx, &cfg_type_netaddr, type, ret));
 }
 
+/*
+ * Parse a map identified by a network prefix.
+ * Used for the "server" statement.
+ */
+isc_result_t
+cfg_parse_netprefix_map(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
+	return (parse_any_named_map(pctx, &cfg_type_netprefix, type, ret));
+}
+
 void
 cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	isc_result_t result = ISC_R_SUCCESS;
@@ -1485,6 +1495,9 @@ cfg_doc_map(cfg_printer_t *pctx, const cfg_type_t *type) {
 	} else if (type->parse == cfg_parse_addressed_map) {
 		cfg_doc_obj(pctx, &cfg_type_netaddr);
 		cfg_print_chars(pctx, " ", 1);
+	} else if (type->parse == cfg_parse_netprefix_map) {
+		cfg_doc_obj(pctx, &cfg_type_netprefix);
+		cfg_print_chars(pctx, " ", 1);
 	}
 	
 	print_open(pctx);
@@ -1717,10 +1730,29 @@ token_addr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na) {
 isc_result_t
 cfg_parse_rawaddr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na) {
 	isc_result_t result;
+	const char *wild = "";
+	const char *prefix = "";
+
 	CHECK(cfg_gettoken(pctx, 0));
 	result = token_addr(pctx, flags, na);
-	if (result == ISC_R_UNEXPECTEDTOKEN)
-		cfg_parser_error(pctx, CFG_LOG_NEAR, "expected IP address");
+	if (result == ISC_R_UNEXPECTEDTOKEN) {
+		if ((flags & CFG_ADDR_WILDOK) != 0)
+			wild = " or '*'";
+		if ((flags & CFG_ADDR_V4PREFIXOK) != 0)
+			wild = " or IPv4 prefix";
+		if ((flags & CFG_ADDR_MASK) == CFG_ADDR_V4OK)
+			cfg_parser_error(pctx, CFG_LOG_NEAR,
+					 "expected IPv4 address%s%s",
+					 prefix, wild);
+		else if ((flags & CFG_ADDR_MASK) == CFG_ADDR_V6OK)
+			cfg_parser_error(pctx, CFG_LOG_NEAR,
+					 "expected IPv6 address%s%s",
+					 prefix, wild);
+		else
+			cfg_parser_error(pctx, CFG_LOG_NEAR,
+					 "expected IP address%s%s",
+					 prefix, wild);
+	}
  cleanup:
 	return (result);
 }
@@ -1775,14 +1807,21 @@ cfg_print_rawaddr(cfg_printer_t *pctx, const isc_netaddr_t *na) {
 
 /* netaddr */
 
+static unsigned int netaddr_flags = CFG_ADDR_V4OK | CFG_ADDR_V6OK;
+static unsigned int netaddr4_flags = CFG_ADDR_V4OK;
+static unsigned int netaddr4wild_flags = CFG_ADDR_V4OK | CFG_ADDR_WILDOK;
+static unsigned int netaddr6_flags = CFG_ADDR_V6OK;
+static unsigned int netaddr6wild_flags = CFG_ADDR_V6OK | CFG_ADDR_WILDOK;
+
 static isc_result_t
 parse_netaddr(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	isc_result_t result;
 	cfg_obj_t *obj = NULL;
 	isc_netaddr_t netaddr;
-	UNUSED(type);
+	unsigned int flags = *(const unsigned int *)type->of;
+
 	CHECK(cfg_create_obj(pctx, type, &obj));
-	CHECK(cfg_parse_rawaddr(pctx, CFG_ADDR_V4OK | CFG_ADDR_V6OK, &netaddr));
+	CHECK(cfg_parse_rawaddr(pctx, flags, &netaddr));
 	isc_sockaddr_fromnetaddr(&obj->value.sockaddr, &netaddr, 0);
 	*ret = obj;
 	return (ISC_R_SUCCESS);
@@ -1791,9 +1830,55 @@ parse_netaddr(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 	return (result);
 }
 
+static void
+cfg_doc_netaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
+	const unsigned int *flagp = type->of;
+	int n = 0;
+	if (*flagp != CFG_ADDR_V4OK && *flagp != CFG_ADDR_V6OK)
+		cfg_print_chars(pctx, "( ", 2);
+	if (*flagp & CFG_ADDR_V4OK) {
+		cfg_print_cstr(pctx, "<ipv4_address>");
+		n++;
+	}
+	if (*flagp & CFG_ADDR_V6OK) {
+		if (n != 0)
+			cfg_print_chars(pctx, " | ", 3);
+		cfg_print_cstr(pctx, "<ipv6_address>");
+		n++;			
+	}
+	if (*flagp & CFG_ADDR_WILDOK) {
+		if (n != 0)
+			cfg_print_chars(pctx, " | ", 3);
+		cfg_print_chars(pctx, "*", 1);
+		n++;
+	}
+	if (*flagp != CFG_ADDR_V4OK && *flagp != CFG_ADDR_V6OK)
+		cfg_print_chars(pctx, " )", 2);
+}
+
 cfg_type_t cfg_type_netaddr = {
-	"netaddr", parse_netaddr, cfg_print_sockaddr, cfg_doc_terminal,
-	&cfg_rep_sockaddr, NULL
+	"netaddr", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
+	&cfg_rep_sockaddr, &netaddr_flags
+};
+
+cfg_type_t cfg_type_netaddr4 = {
+	"netaddr4", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
+	&cfg_rep_sockaddr, &netaddr4_flags
+};
+
+cfg_type_t cfg_type_netaddr4wild = {
+	"netaddr4wild", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
+	&cfg_rep_sockaddr, &netaddr4wild_flags
+};
+
+cfg_type_t cfg_type_netaddr6 = {
+	"netaddr6", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
+	&cfg_rep_sockaddr, &netaddr6_flags
+};
+
+cfg_type_t cfg_type_netaddr6wild = {
+	"netaddr6wild", parse_netaddr, cfg_print_sockaddr, cfg_doc_netaddr,
+	&cfg_rep_sockaddr, &netaddr6wild_flags
 };
 
 /* netprefix */
diff --git a/contrib/bind9/lib/isccfg/version.c b/contrib/bind9/lib/isccfg/version.c
index fe001d7..0b7287b 100644
--- a/contrib/bind9/lib/isccfg/version.c
+++ b/contrib/bind9/lib/isccfg/version.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.c,v 1.1.12.3 2004/03/08 09:05:06 marka Exp $ */
+/* $Id: version.c,v 1.3.18.2 2005/04/29 00:17:15 marka Exp $ */
+
+/*! \file */
 
 #include <isccfg/version.h>
 
diff --git a/contrib/bind9/lib/lwres/Makefile.in b/contrib/bind9/lib/lwres/Makefile.in
index 024b988..a06bd8a 100644
--- a/contrib/bind9/lib/lwres/Makefile.in
+++ b/contrib/bind9/lib/lwres/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.25.12.8 2005/06/09 23:54:32 marka Exp $
+# $Id: Makefile.in,v 1.28.18.4 2005/06/09 23:55:10 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/lwres/api b/contrib/bind9/lib/lwres/api
index 63704dd..d94beab 100644
--- a/contrib/bind9/lib/lwres/api
+++ b/contrib/bind9/lib/lwres/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 10
-LIBREVISION = 5
-LIBAGE = 1
+LIBINTERFACE = 30
+LIBREVISION = 4
+LIBAGE = 0
diff --git a/contrib/bind9/lib/lwres/assert_p.h b/contrib/bind9/lib/lwres/assert_p.h
index 78b4b79..c47ecec 100644
--- a/contrib/bind9/lib/lwres/assert_p.h
+++ b/contrib/bind9/lib/lwres/assert_p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: assert_p.h,v 1.9.206.1 2004/03/06 08:15:30 marka Exp $ */
+/* $Id: assert_p.h,v 1.10.18.2 2005/04/29 00:17:16 marka Exp $ */
 
 #ifndef LWRES_ASSERT_P_H
 #define LWRES_ASSERT_P_H 1
 
+/*! \file */
+
 #include <assert.h>		/* Required for assert() prototype. */
 
 #define REQUIRE(x)		assert(x)
diff --git a/contrib/bind9/lib/lwres/context.c b/contrib/bind9/lib/lwres/context.c
index b606b9d..0da426b 100644
--- a/contrib/bind9/lib/lwres/context.c
+++ b/contrib/bind9/lib/lwres/context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,8 +15,76 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: context.c,v 1.41.2.1.2.4 2004/09/17 05:50:31 marka Exp $ */
-
+/* $Id: context.c,v 1.45.18.3 2005/04/29 00:17:16 marka Exp $ */
+
+/*! \file context.c 
+   lwres_context_create() creates a #lwres_context_t structure for use in
+   lightweight resolver operations. It holds a socket and other data
+   needed for communicating with a resolver daemon. The new
+   lwres_context_t is returned through contextp, a pointer to a
+   lwres_context_t pointer. This lwres_context_t pointer must initially
+   be NULL, and is modified to point to the newly created
+   lwres_context_t.
+
+   When the lightweight resolver needs to perform dynamic memory
+   allocation, it will call malloc_function to allocate memory and
+   free_function to free it. If malloc_function and free_function are
+   NULL, memory is allocated using malloc and free. It is not
+   permitted to have a NULL malloc_function and a non-NULL free_function
+   or vice versa. arg is passed as the first parameter to the memory
+   allocation functions. If malloc_function and free_function are NULL,
+   arg is unused and should be passed as NULL.
+
+   Once memory for the structure has been allocated, it is initialized
+   using lwres_conf_init() and returned via *contextp.
+
+   lwres_context_destroy() destroys a #lwres_context_t, closing its
+   socket. contextp is a pointer to a pointer to the context that is to
+   be destroyed. The pointer will be set to NULL when the context has
+   been destroyed.
+
+   The context holds a serial number that is used to identify resolver
+   request packets and associate responses with the corresponding
+   requests. This serial number is controlled using
+   lwres_context_initserial() and lwres_context_nextserial().
+   lwres_context_initserial() sets the serial number for context *ctx to
+   serial. lwres_context_nextserial() increments the serial number and
+   returns the previous value.
+
+   Memory for a lightweight resolver context is allocated and freed using
+   lwres_context_allocmem() and lwres_context_freemem(). These use
+   whatever allocations were defined when the context was created with
+   lwres_context_create(). lwres_context_allocmem() allocates len bytes
+   of memory and if successful returns a pointer to the allocated
+   storage. lwres_context_freemem() frees len bytes of space starting at
+   location mem.
+
+   lwres_context_sendrecv() performs I/O for the context ctx. Data are
+   read and written from the context's socket. It writes data from
+   sendbase -- typically a lightweight resolver query packet -- and waits
+   for a reply which is copied to the receive buffer at recvbase. The
+   number of bytes that were written to this receive buffer is returned
+   in *recvd_len.
+
+\section context_return Return Values
+
+   lwres_context_create() returns #LWRES_R_NOMEMORY if memory for the
+   struct lwres_context could not be allocated, #LWRES_R_SUCCESS
+   otherwise.
+
+   Successful calls to the memory allocator lwres_context_allocmem()
+   return a pointer to the start of the allocated space. It returns NULL
+   if memory could not be allocated.
+
+   #LWRES_R_SUCCESS is returned when lwres_context_sendrecv() completes
+   successfully. #LWRES_R_IOERROR is returned if an I/O error occurs and
+   #LWRES_R_TIMEOUT is returned if lwres_context_sendrecv() times out
+   waiting for a response.
+
+\section context_see See Also
+
+   lwres_conf_init(), malloc, free.
+ */
 #include <config.h>
 
 #include <fcntl.h>
@@ -37,7 +105,7 @@
 #include "context_p.h"
 #include "assert_p.h"
 
-/*
+/*!
  * Some systems define the socket length argument as an int, some as size_t,
  * some as socklen_t.  The last is what the current POSIX standard mandates.
  * This definition is here so it can be portable but easily changed if needed.
@@ -46,7 +114,7 @@
 #define LWRES_SOCKADDR_LEN_T unsigned int
 #endif
 
-/*
+/*!
  * Make a socket nonblocking.
  */
 #ifndef MAKE_NONBLOCKING
@@ -69,9 +137,16 @@ lwres_malloc(void *, size_t);
 static void
 lwres_free(void *, void *, size_t);
 
+/*!
+ * lwres_result_t
+ */
 static lwres_result_t
 context_connect(lwres_context_t *);
 
+/*%
+ * Creates a #lwres_context_t structure for use in
+ *  lightweight resolver operations.
+ */
 lwres_result_t
 lwres_context_create(lwres_context_t **contextp, void *arg,
 		     lwres_malloc_t malloc_function,
@@ -118,6 +193,12 @@ lwres_context_create(lwres_context_t **contextp, void *arg,
 	return (LWRES_R_SUCCESS);
 }
 
+/*%
+Destroys a #lwres_context_t, closing its socket. 
+contextp is a pointer to a pointer to the context that is 
+to be destroyed. The pointer will be set to NULL 
+when the context has been destroyed.
+ */
 void
 lwres_context_destroy(lwres_context_t **contextp) {
 	lwres_context_t *ctx;
@@ -134,7 +215,7 @@ lwres_context_destroy(lwres_context_t **contextp) {
 
 	CTXFREE(ctx, sizeof(lwres_context_t));
 }
-
+/*% Increments the serial number and returns the previous value. */
 lwres_uint32_t
 lwres_context_nextserial(lwres_context_t *ctx) {
 	REQUIRE(ctx != NULL);
@@ -142,6 +223,7 @@ lwres_context_nextserial(lwres_context_t *ctx) {
 	return (ctx->serial++);
 }
 
+/*% Sets the serial number for context *ctx to serial. */
 void
 lwres_context_initserial(lwres_context_t *ctx, lwres_uint32_t serial) {
 	REQUIRE(ctx != NULL);
@@ -149,6 +231,7 @@ lwres_context_initserial(lwres_context_t *ctx, lwres_uint32_t serial) {
 	ctx->serial = serial;
 }
 
+/*% Frees len bytes of space starting at location mem. */
 void
 lwres_context_freemem(lwres_context_t *ctx, void *mem, size_t len) {
 	REQUIRE(mem != NULL);
@@ -157,6 +240,7 @@ lwres_context_freemem(lwres_context_t *ctx, void *mem, size_t len) {
 	CTXFREE(mem, len);
 }
 
+/*% Allocates len bytes of memory and if successful returns a pointer to the allocated storage. */
 void *
 lwres_context_allocmem(lwres_context_t *ctx, size_t len) {
 	REQUIRE(len != 0U);
@@ -334,6 +418,7 @@ lwres_context_recv(lwres_context_t *ctx,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% performs I/O for the context ctx. */
 lwres_result_t
 lwres_context_sendrecv(lwres_context_t *ctx,
 		       void *sendbase, int sendlen,
diff --git a/contrib/bind9/lib/lwres/context_p.h b/contrib/bind9/lib/lwres/context_p.h
index 3e22bc0..d255ef6 100644
--- a/contrib/bind9/lib/lwres/context_p.h
+++ b/contrib/bind9/lib/lwres/context_p.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,42 +15,48 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: context_p.h,v 1.12.206.1 2004/03/06 08:15:30 marka Exp $ */
+/* $Id: context_p.h,v 1.13.18.2 2005/04/29 00:17:17 marka Exp $ */
 
 #ifndef LWRES_CONTEXT_P_H
 #define LWRES_CONTEXT_P_H 1
 
-/*
+/*! \file */
+
+/*@{*/
+/**
  * Helper functions, assuming the context is always called "ctx" in
  * the scope these functions are called from.
  */
 #define CTXMALLOC(len)		ctx->malloc(ctx->arg, (len))
 #define CTXFREE(addr, len)	ctx->free(ctx->arg, (addr), (len))
+/*@}*/
 
 #define LWRES_DEFAULT_TIMEOUT	120	/* 120 seconds for a reply */
 
-/*
+/**
  * Not all the attributes here are actually settable by the application at
  * this time.
  */
 struct lwres_context {
-	unsigned int		timeout;	/* time to wait for reply */
-	lwres_uint32_t		serial;		/* serial number state */
+	unsigned int		timeout;	/*%< time to wait for reply */
+	lwres_uint32_t		serial;		/*%< serial number state */
 
 	/*
 	 * For network I/O.
 	 */
-	int			sock;		/* socket to send on */
-	lwres_addr_t		address;	/* address to send to */
+	int			sock;		/*%< socket to send on */
+	lwres_addr_t		address;	/*%< address to send to */
 
+	/*@{*/
 	/*
 	 * Function pointers for allocating memory.
 	 */
 	lwres_malloc_t		malloc;
 	lwres_free_t		free;
 	void		       *arg;
+	/*@}*/
 
-	/*
+	/*%
 	 * resolv.conf-like data
 	 */
 	lwres_conf_t		confdata;
diff --git a/contrib/bind9/lib/lwres/gai_strerror.c b/contrib/bind9/lib/lwres/gai_strerror.c
index 06b7fbe..0dcfe40 100644
--- a/contrib/bind9/lib/lwres/gai_strerror.c
+++ b/contrib/bind9/lib/lwres/gai_strerror.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2006  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,12 +15,40 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gai_strerror.c,v 1.14.2.1.10.3 2006/08/25 05:25:50 marka Exp $ */
+/* $Id: gai_strerror.c,v 1.16.18.4 2006/08/25 05:25:51 marka Exp $ */
+
+/*! \file gai_strerror.c
+ * lwres_gai_strerror() returns an error message corresponding to an
+ * error code returned by getaddrinfo(). The following error codes and
+ * their meaning are defined in \link netdb.h include/lwres/netdb.h.\endlink
+ *
+ * \li #EAI_ADDRFAMILY address family for hostname not supported
+ * \li #EAI_AGAIN temporary failure in name resolution
+ * \li #EAI_BADFLAGS invalid value for #ai_flags
+ * \li #EAI_FAIL non-recoverable failure in name resolution
+ * \li #EAI_FAMILY ai_family not supported
+ * \li #EAI_MEMORY memory allocation failure
+ * \li #EAI_NODATA no address associated with hostname
+ * \li #EAI_NONAME hostname or servname not provided, or not known
+ * \li #EAI_SERVICE servname not supported for ai_socktype
+ * \li #EAI_SOCKTYPE ai_socktype not supported
+ * \li #EAI_SYSTEM system error returned in errno
+ *
+ * The message invalid error code is returned if ecode is out of range.
+ *
+ * ai_flags, ai_family and ai_socktype are elements of the struct
+ * addrinfo used by lwres_getaddrinfo().
+ *
+ * \section gai_strerror_see See Also
+ *
+ * strerror, lwres_getaddrinfo(), getaddrinfo(), RFC2133.
+ */
 
 #include <config.h>
 
 #include <lwres/netdb.h>
 
+/*% Text of error messages. */
 static const char *gai_messages[] = {
 	"no error",
 	"address family for hostname not supported",
@@ -38,6 +66,7 @@ static const char *gai_messages[] = {
 	"bad protocol"
 };
 
+/*% Returns an error message corresponding to an error code returned by getaddrinfo() */
 char *
 lwres_gai_strerror(int ecode) {
 	union {
diff --git a/contrib/bind9/lib/lwres/getaddrinfo.c b/contrib/bind9/lib/lwres/getaddrinfo.c
index 9ad10df..e06ca29 100644
--- a/contrib/bind9/lib/lwres/getaddrinfo.c
+++ b/contrib/bind9/lib/lwres/getaddrinfo.c
@@ -18,7 +18,118 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: getaddrinfo.c,v 1.41.206.6 2006/11/13 11:57:41 marka Exp $ */
+/* $Id: getaddrinfo.c,v 1.43.18.6 2006/11/14 01:07:28 marka Exp $ */
+
+/*! \file */
+
+/**
+ *    lwres_getaddrinfo() is used to get a list of IP addresses and port
+ *    numbers for host hostname and service servname. The function is the
+ *    lightweight resolver's implementation of getaddrinfo() as defined in
+ *    RFC2133. hostname and servname are pointers to null-terminated strings
+ *    or NULL. hostname is either a host name or a numeric host address
+ *    string: a dotted decimal IPv4 address or an IPv6 address. servname is
+ *    either a decimal port number or a service name as listed in
+ *    /etc/services.
+ * 
+ *    If the operating system does not provide a struct addrinfo, the
+ *    following structure is used:
+ * 
+ * \code
+ * struct  addrinfo {
+ *         int             ai_flags;       // AI_PASSIVE, AI_CANONNAME
+ *         int             ai_family;      // PF_xxx
+ *         int             ai_socktype;    // SOCK_xxx
+ *         int             ai_protocol;    // 0 or IPPROTO_xxx for IPv4 and IPv6
+ *         size_t          ai_addrlen;     // length of ai_addr
+ *         char            *ai_canonname;  // canonical name for hostname
+ *         struct sockaddr *ai_addr;       // binary address
+ *         struct addrinfo *ai_next;       // next structure in linked list
+ * };
+ * \endcode
+ * 
+ * 
+ *    hints is an optional pointer to a struct addrinfo. This structure can
+ *    be used to provide hints concerning the type of socket that the caller
+ *    supports or wishes to use. The caller can supply the following
+ *    structure elements in *hints:
+ * 
+ * <ul>
+ *    <li>ai_family:
+ *           The protocol family that should be used. When ai_family is set
+ *           to PF_UNSPEC, it means the caller will accept any protocol
+ *           family supported by the operating system.</li>
+ * 
+ *    <li>ai_socktype:
+ *           denotes the type of socket -- SOCK_STREAM, SOCK_DGRAM or
+ *           SOCK_RAW -- that is wanted. When ai_socktype is zero the caller
+ *           will accept any socket type.</li>
+ * 
+ *    <li>ai_protocol:
+ *           indicates which transport protocol is wanted: IPPROTO_UDP or
+ *           IPPROTO_TCP. If ai_protocol is zero the caller will accept any
+ *           protocol.</li>
+ * 
+ *    <li>ai_flags:
+ *           Flag bits. If the AI_CANONNAME bit is set, a successful call to
+ *           lwres_getaddrinfo() will return a null-terminated string
+ *           containing the canonical name of the specified hostname in
+ *           ai_canonname of the first addrinfo structure returned. Setting
+ *           the AI_PASSIVE bit indicates that the returned socket address
+ *           structure is intended for used in a call to bind(2). In this
+ *           case, if the hostname argument is a NULL pointer, then the IP
+ *           address portion of the socket address structure will be set to
+ *           INADDR_ANY for an IPv4 address or IN6ADDR_ANY_INIT for an IPv6
+ *           address.<br /><br />
+ * 
+ *           When ai_flags does not set the AI_PASSIVE bit, the returned
+ *           socket address structure will be ready for use in a call to
+ *           connect(2) for a connection-oriented protocol or connect(2),
+ *           sendto(2), or sendmsg(2) if a connectionless protocol was
+ *           chosen. The IP address portion of the socket address structure
+ *           will be set to the loopback address if hostname is a NULL
+ *           pointer and AI_PASSIVE is not set in ai_flags.<br /><br />
+ * 
+ *           If ai_flags is set to AI_NUMERICHOST it indicates that hostname
+ *           should be treated as a numeric string defining an IPv4 or IPv6
+ *           address and no name resolution should be attempted.
+ * </li></ul>
+ * 
+ *    All other elements of the struct addrinfo passed via hints must be
+ *    zero.
+ * 
+ *    A hints of NULL is treated as if the caller provided a struct addrinfo
+ *    initialized to zero with ai_familyset to PF_UNSPEC.
+ * 
+ *    After a successful call to lwres_getaddrinfo(), *res is a pointer to a
+ *    linked list of one or more addrinfo structures. Each struct addrinfo
+ *    in this list cn be processed by following the ai_next pointer, until a
+ *    NULL pointer is encountered. The three members ai_family, ai_socktype,
+ *    and ai_protocol in each returned addrinfo structure contain the
+ *    corresponding arguments for a call to socket(2). For each addrinfo
+ *    structure in the list, the ai_addr member points to a filled-in socket
+ *    address structure of length ai_addrlen.
+ * 
+ *    All of the information returned by lwres_getaddrinfo() is dynamically
+ *    allocated: the addrinfo structures, and the socket address structures
+ *    and canonical host name strings pointed to by the addrinfostructures.
+ *    Memory allocated for the dynamically allocated structures created by a
+ *    successful call to lwres_getaddrinfo() is released by
+ *    lwres_freeaddrinfo(). ai is a pointer to a struct addrinfo created by
+ *    a call to lwres_getaddrinfo().
+ * 
+ * \section lwresreturn RETURN VALUES
+ * 
+ *    lwres_getaddrinfo() returns zero on success or one of the error codes
+ *    listed in gai_strerror() if an error occurs. If both hostname and
+ *    servname are NULL lwres_getaddrinfo() returns #EAI_NONAME.
+ * 
+ * \section lwressee SEE ALSO
+ * 
+ *    lwres(3), lwres_getaddrinfo(), lwres_freeaddrinfo(),
+ *    lwres_gai_strerror(), RFC2133, getservbyname(3), connect(2),
+ *    sendto(2), sendmsg(2), socket(2).
+ */
 
 #include <config.h>
 
@@ -35,6 +146,8 @@
 #define SIN6(addr)	((struct sockaddr_in6 *)(addr))
 #define SUN(addr)	((struct sockaddr_un *)(addr))
 
+/*! \struct addrinfo
+ */
 static struct addrinfo
 	*ai_reverse(struct addrinfo *oai),
 	*ai_clone(struct addrinfo *oai, int family),
@@ -55,7 +168,7 @@ static void set_order(int, int (**)(const char *, int, struct addrinfo **,
 #define FOUND_MAX	2
 
 #define ISC_AI_MASK (AI_PASSIVE|AI_CANONNAME|AI_NUMERICHOST)
-
+/*% Get a list of IP addresses and port numbers for host hostname and service servname. */
 int
 lwres_getaddrinfo(const char *hostname, const char *servname,
 	const struct addrinfo *hints, struct addrinfo **res)
@@ -137,7 +250,7 @@ lwres_getaddrinfo(const char *hostname, const char *servname,
 	}
 
 #ifdef	AF_LOCAL
-	/*
+	/*!
 	 * First, deal with AF_LOCAL.  If the family was not set,
 	 * then assume AF_LOCAL if the first character of the
 	 * hostname/servname is '/'.
@@ -575,6 +688,7 @@ add_ipv6(const char *hostname, int flags, struct addrinfo **aip,
 	return (result);
 }
 
+/*% Free address info. */
 void
 lwres_freeaddrinfo(struct addrinfo *ai) {
 	struct addrinfo *ai_next;
@@ -617,7 +731,7 @@ get_local(const char *name, int socktype, struct addrinfo **res) {
 }
 #endif
 
-/*
+/*!
  * Allocate an addrinfo structure, and a sockaddr structure
  * of the specificed length.  We initialize:
  *	ai_addrlen
diff --git a/contrib/bind9/lib/lwres/gethost.c b/contrib/bind9/lib/lwres/gethost.c
index 9c362b9..3cd6e4a 100644
--- a/contrib/bind9/lib/lwres/gethost.c
+++ b/contrib/bind9/lib/lwres/gethost.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,139 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gethost.c,v 1.29.206.1 2004/03/06 08:15:30 marka Exp $ */
+/* $Id: gethost.c,v 1.30.18.2 2005/04/29 00:17:17 marka Exp $ */
+
+/*! \file */
+
+/**
+ *    These functions provide hostname-to-address and address-to-hostname
+ *    lookups by means of the lightweight resolver. They are similar to the
+ *    standard gethostent(3) functions provided by most operating systems.
+ *    They use a struct hostent which is usually defined in <namedb.h>.
+ * 
+ * \code
+ * struct  hostent {
+ *         char    *h_name;        // official name of host
+ * 	   char    **h_aliases;    // alias list
+ *         int     h_addrtype;     // host address type
+ *         int     h_length;       // length of address
+ *         char    **h_addr_list;  // list of addresses from name server
+ * };
+ * #define h_addr  h_addr_list[0]  // address, for backward compatibility
+ * \endcode
+ * 
+ *    The members of this structure are:
+ * 
+ * \li   h_name:
+ *           The official (canonical) name of the host.
+ * 
+ * \li   h_aliases:
+ *           A NULL-terminated array of alternate names (nicknames) for the
+ *           host.
+ * 
+ * \li   h_addrtype:
+ *           The type of address being returned -- PF_INET or PF_INET6.
+ * 
+ * \li   h_length:
+ *           The length of the address in bytes.
+ * 
+ * \li   h_addr_list:
+ *           A NULL terminated array of network addresses for the host. Host
+ *           addresses are returned in network byte order.
+ * 
+ *    For backward compatibility with very old software, h_addr is the first
+ *    address in h_addr_list.
+ * 
+ *    lwres_gethostent(), lwres_sethostent(), lwres_endhostent(),
+ *    lwres_gethostent_r(), lwres_sethostent_r() and lwres_endhostent_r()
+ *    provide iteration over the known host entries on systems that provide
+ *    such functionality through facilities like /etc/hosts or NIS. The
+ *    lightweight resolver does not currently implement these functions; it
+ *    only provides them as stub functions that always return failure.
+ * 
+ *    lwres_gethostbyname() and lwres_gethostbyname2() look up the hostname
+ *    name. lwres_gethostbyname() always looks for an IPv4 address while
+ *    lwres_gethostbyname2() looks for an address of protocol family af:
+ *    either PF_INET or PF_INET6 -- IPv4 or IPV6 addresses respectively.
+ *    Successful calls of the functions return a struct hostent for the name
+ *    that was looked up. NULL is returned if the lookups by
+ *    lwres_gethostbyname() or lwres_gethostbyname2() fail.
+ * 
+ *    Reverse lookups of addresses are performed by lwres_gethostbyaddr().
+ *    addr is an address of length len bytes and protocol family type --
+ *    PF_INET or PF_INET6. lwres_gethostbyname_r() is a thread-safe function
+ *    for forward lookups. If an error occurs, an error code is returned in
+ *    *error. resbuf is a pointer to a struct hostent which is initialised
+ *    by a successful call to lwres_gethostbyname_r() . buf is a buffer of
+ *    length len bytes which is used to store the h_name, h_aliases, and
+ *    h_addr_list elements of the struct hostent returned in resbuf.
+ *    Successful calls to lwres_gethostbyname_r() return resbuf, which is a
+ *    pointer to the struct hostent it created.
+ * 
+ *    lwres_gethostbyaddr_r() is a thread-safe function that performs a
+ *    reverse lookup of address addr which is len bytes long and is of
+ *    protocol family type -- PF_INET or PF_INET6. If an error occurs, the
+ *    error code is returned in *error. The other function parameters are
+ *    identical to those in lwres_gethostbyname_r(). resbuf is a pointer to
+ *    a struct hostent which is initialised by a successful call to
+ *    lwres_gethostbyaddr_r(). buf is a buffer of length len bytes which is
+ *    used to store the h_name, h_aliases, and h_addr_list elements of the
+ *    struct hostent returned in resbuf. Successful calls to
+ *    lwres_gethostbyaddr_r() return resbuf, which is a pointer to the
+ *    struct hostent it created.
+ * 
+ * \section gethost_return Return Values
+ * 
+ *    The functions lwres_gethostbyname(), lwres_gethostbyname2(),
+ *    lwres_gethostbyaddr(), and lwres_gethostent() return NULL to indicate
+ *    an error. In this case the global variable lwres_h_errno will contain
+ *    one of the following error codes defined in \link netdb.h <lwres/netdb.h>:\endlink
+ * 
+ * \li #HOST_NOT_FOUND:
+ *           The host or address was not found.
+ * 
+ * \li #TRY_AGAIN:
+ *           A recoverable error occurred, e.g., a timeout. Retrying the
+ *           lookup may succeed.
+ * 
+ * \li #NO_RECOVERY:
+ *           A non-recoverable error occurred.
+ * 
+ * \li #NO_DATA:
+ *           The name exists, but has no address information associated with
+ *           it (or vice versa in the case of a reverse lookup). The code
+ *           NO_ADDRESS is accepted as a synonym for NO_DATA for backwards
+ *           compatibility.
+ * 
+ *    lwres_hstrerror() translates these error codes to suitable error
+ *    messages.
+ * 
+ *    lwres_gethostent() and lwres_gethostent_r() always return NULL.
+ * 
+ *    Successful calls to lwres_gethostbyname_r() and
+ *    lwres_gethostbyaddr_r() return resbuf, a pointer to the struct hostent
+ *    that was initialised by these functions. They return NULL if the
+ *    lookups fail or if buf was too small to hold the list of addresses and
+ *    names referenced by the h_name, h_aliases, and h_addr_list elements of
+ *    the struct hostent. If buf was too small, both lwres_gethostbyname_r()
+ *    and lwres_gethostbyaddr_r() set the global variable errno to ERANGE.
+ * 
+ * \section gethost_see See Also
+ * 
+ *    gethostent(), \link getipnode.c getipnode\endlink, lwres_hstrerror()
+ * 
+ * \section gethost_bugs Bugs
+ * 
+ *    lwres_gethostbyname(), lwres_gethostbyname2(), lwres_gethostbyaddr()
+ *    and lwres_endhostent() are not thread safe; they return pointers to
+ *    static data and provide error codes through a global variable.
+ *    Thread-safe versions for name and address lookup are provided by
+ *    lwres_gethostbyname_r(), and lwres_gethostbyaddr_r() respectively.
+ * 
+ *    The resolver daemon does not currently support any non-DNS name
+ *    services such as /etc/hosts or NIS, consequently the above functions
+ *    don't, either.
+ */
 
 #include <config.h>
 
@@ -34,6 +166,7 @@
 static struct hostent *he = NULL;
 static int copytobuf(struct hostent *, struct hostent *, char *, int);
 
+/*% Always looks for an IPv4 address. */
 struct hostent *
 lwres_gethostbyname(const char *name) {
 
@@ -44,6 +177,7 @@ lwres_gethostbyname(const char *name) {
 	return (he);
 }
 
+/*% Looks for either an IPv4 or IPv6 address. */
 struct hostent *
 lwres_gethostbyname2(const char *name, int af) {
 	if (he != NULL)
@@ -53,6 +187,7 @@ lwres_gethostbyname2(const char *name, int af) {
 	return (he);
 }
 
+/*% Reverse lookup of addresses. */
 struct hostent *
 lwres_gethostbyaddr(const char *addr, int len, int type) {
 
@@ -63,6 +198,7 @@ lwres_gethostbyaddr(const char *addr, int len, int type) {
 	return (he);
 }
 
+/*% Stub function.  Always returns failure. */
 struct hostent *
 lwres_gethostent(void) {
 	if (he != NULL)
@@ -71,6 +207,7 @@ lwres_gethostent(void) {
 	return (NULL);
 }
 
+/*% Stub function.  Always returns failure. */
 void
 lwres_sethostent(int stayopen) {
 	/*
@@ -79,6 +216,7 @@ lwres_sethostent(int stayopen) {
 	UNUSED(stayopen);
 }
 
+/*% Stub function.  Always returns failure. */
 void
 lwres_endhostent(void) {
 	/*
@@ -86,6 +224,7 @@ lwres_endhostent(void) {
 	 */
 }
 
+/*% Thread-safe function for forward lookups. */
 struct hostent *
 lwres_gethostbyname_r(const char *name, struct hostent *resbuf,
 		char *buf, int buflen, int *error)
@@ -105,6 +244,7 @@ lwres_gethostbyname_r(const char *name, struct hostent *resbuf,
 	return (resbuf);
 }
 
+/*% Thread-safe reverse lookup. */
 struct hostent  *
 lwres_gethostbyaddr_r(const char *addr, int len, int type,
 		      struct hostent *resbuf, char *buf, int buflen,
@@ -125,6 +265,7 @@ lwres_gethostbyaddr_r(const char *addr, int len, int type,
 	return (resbuf);
 }
 
+/*% Stub function.  Always returns failure. */
 struct hostent  *
 lwres_gethostent_r(struct hostent *resbuf, char *buf, int buflen, int *error) {
 	UNUSED(resbuf);
@@ -134,6 +275,7 @@ lwres_gethostent_r(struct hostent *resbuf, char *buf, int buflen, int *error) {
 	return (NULL);
 }
 
+/*% Stub function.  Always returns failure. */
 void
 lwres_sethostent_r(int stayopen) {
 	/*
@@ -142,6 +284,7 @@ lwres_sethostent_r(int stayopen) {
 	UNUSED(stayopen);
 }
 
+/*% Stub function.  Always returns failure. */
 void
 lwres_endhostent_r(void) {
 	/*
diff --git a/contrib/bind9/lib/lwres/getipnode.c b/contrib/bind9/lib/lwres/getipnode.c
index 9b1a07b..46eed14 100644
--- a/contrib/bind9/lib/lwres/getipnode.c
+++ b/contrib/bind9/lib/lwres/getipnode.c
@@ -15,7 +15,110 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: getipnode.c,v 1.30.2.4.2.6 2005/04/29 00:03:32 marka Exp $ */
+/* $Id: getipnode.c,v 1.37.18.3 2005/04/29 00:17:18 marka Exp $ */
+
+/*! \file */
+
+/**
+ *    These functions perform thread safe, protocol independent
+ *    nodename-to-address and address-to-nodename translation as defined in
+ *    RFC2553.  This use a struct hostent which is defined in namedb.h:
+ * 
+ * \code
+ * struct  hostent {
+ *         char    *h_name;        // official name of host
+ *         char    **h_aliases;    // alias list
+ *         int     h_addrtype;     // host address type
+ *         int     h_length;       // length of address
+ *         char    **h_addr_list;  // list of addresses from name server
+ * };
+ * #define h_addr  h_addr_list[0]  // address, for backward compatibility
+ * \endcode
+ * 
+ *    The members of this structure are:
+ * 
+ * \li   h_name:
+ *           The official (canonical) name of the host.
+ * 
+ * \li   h_aliases:
+ *           A NULL-terminated array of alternate names (nicknames) for the
+ *           host.
+ * 
+ * \li   h_addrtype:
+ *           The type of address being returned - usually PF_INET or
+ *           PF_INET6.
+ * 
+ * \li   h_length:
+ *           The length of the address in bytes.
+ * 
+ * \li   h_addr_list:
+ *           A NULL terminated array of network addresses for the host. Host
+ *           addresses are returned in network byte order.
+ * 
+ *    lwres_getipnodebyname() looks up addresses of protocol family af for
+ *    the hostname name. The flags parameter contains ORed flag bits to
+ *    specify the types of addresses that are searched for, and the types of
+ *    addresses that are returned. The flag bits are:
+ * 
+ * \li   #AI_V4MAPPED:
+ *           This is used with an af of #AF_INET6, and causes IPv4 addresses
+ *           to be returned as IPv4-mapped IPv6 addresses.
+ * 
+ * \li   #AI_ALL:
+ *           This is used with an af of #AF_INET6, and causes all known
+ *           addresses (IPv6 and IPv4) to be returned. If #AI_V4MAPPED is
+ *           also set, the IPv4 addresses are return as mapped IPv6
+ *           addresses.
+ * 
+ * \li   #AI_ADDRCONFIG:
+ *           Only return an IPv6 or IPv4 address if here is an active
+ *           network interface of that type. This is not currently
+ *           implemented in the BIND 9 lightweight resolver, and the flag is
+ *           ignored.
+ * 
+ * \li   #AI_DEFAULT:
+ *           This default sets the #AI_V4MAPPED and #AI_ADDRCONFIG flag bits.
+ * 
+ *    lwres_getipnodebyaddr() performs a reverse lookup of address src which
+ *    is len bytes long. af denotes the protocol family, typically PF_INET
+ *    or PF_INET6.
+ * 
+ *    lwres_freehostent() releases all the memory associated with the struct
+ *    hostent pointer. Any memory allocated for the h_name, h_addr_list
+ *    and h_aliases is freed, as is the memory for the hostent structure
+ *    itself.
+ * 
+ * \section getipnode_return Return Values
+ * 
+ *    If an error occurs, lwres_getipnodebyname() and
+ *    lwres_getipnodebyaddr() set *error_num to an appropriate error code
+ *    and the function returns a NULL pointer. The error codes and their
+ *    meanings are defined in \link netdb.h <lwres/netdb.h>\endlink:
+ * 
+ * \li   #HOST_NOT_FOUND:
+ *           No such host is known.
+ * 
+ * \li   #NO_ADDRESS:
+ *           The server recognised the request and the name but no address
+ *           is available. Another type of request to the name server for
+ *           the domain might return an answer.
+ * 
+ * \li   #TRY_AGAIN:
+ *           A temporary and possibly transient error occurred, such as a
+ *           failure of a server to respond. The request may succeed if
+ *           retried.
+ * 
+ * \li   #NO_RECOVERY:
+ *           An unexpected failure occurred, and retrying the request is
+ *           pointless.
+ * 
+ *    lwres_hstrerror() translates these error codes to suitable error
+ *    messages.
+ * 
+ * \section getipnode_see See Also
+ * 
+ * getaddrinfo.c, gethost.c, getnameinfo.c, herror.c, RFC2553  
+ */
 
 #include <config.h>
 
@@ -80,7 +183,7 @@ hostfromname(lwres_gabnresponse_t *name, int af);
  ***	Public functions.
  ***/
 
-/*
+/*!
  *	AI_V4MAPPED + AF_INET6
  *	If no IPv6 address then a query for IPv4 and map returned values.
  *
@@ -222,6 +325,7 @@ lwres_getipnodebyname(const char *name, int af, int flags, int *error_num) {
 	return (he3);
 }
 
+/*% performs a reverse lookup of address src which is len bytes long. af denotes the protocol family, typically #PF_INET or PF_INET6. */
 struct hostent *
 lwres_getipnodebyaddr(const void *src, size_t len, int af, int *error_num) {
 	struct hostent *he1, *he2;
@@ -345,6 +449,7 @@ lwres_getipnodebyaddr(const void *src, size_t len, int af, int *error_num) {
 	return (he1);
 }
 
+/*% releases all the memory associated with the struct hostent pointer */
 void
 lwres_freehostent(struct hostent *he) {
 	char **cpp;
diff --git a/contrib/bind9/lib/lwres/getnameinfo.c b/contrib/bind9/lib/lwres/getnameinfo.c
index 059c529..d1874a0 100644
--- a/contrib/bind9/lib/lwres/getnameinfo.c
+++ b/contrib/bind9/lib/lwres/getnameinfo.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: getnameinfo.c,v 1.30.2.3.2.4 2004/08/28 06:25:24 marka Exp $ */
+/* $Id: getnameinfo.c,v 1.34.18.3 2005/04/29 00:17:18 marka Exp $ */
+
+/*! \file */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -53,6 +55,62 @@
  *   but INRIA implementation returns EAI_xxx defined for getaddrinfo().
  */
 
+
+/**
+ *    This function is equivalent to the getnameinfo(3) function defined in
+ *    RFC2133. lwres_getnameinfo() returns the hostname for the struct
+ *    sockaddr sa which is salen bytes long. The hostname is of length
+ *    hostlen and is returned via *host. The maximum length of the hostname
+ *    is 1025 bytes: #NI_MAXHOST.
+ * 
+ *    The name of the service associated with the port number in sa is
+ *    returned in *serv. It is servlen bytes long. The maximum length of the
+ *    service name is #NI_MAXSERV - 32 bytes.
+ * 
+ *    The flags argument sets the following bits:
+ * 
+ * \li   #NI_NOFQDN:
+ *           A fully qualified domain name is not required for local hosts.
+ *           The local part of the fully qualified domain name is returned
+ *           instead.
+ * 
+ * \li   #NI_NUMERICHOST
+ *           Return the address in numeric form, as if calling inet_ntop(),
+ *           instead of a host name.
+ * 
+ * \li   #NI_NAMEREQD
+ *           A name is required. If the hostname cannot be found in the DNS
+ *           and this flag is set, a non-zero error code is returned. If the
+ *           hostname is not found and the flag is not set, the address is
+ *           returned in numeric form.
+ * 
+ * \li   #NI_NUMERICSERV
+ *           The service name is returned as a digit string representing the
+ *           port number.
+ * 
+ * \li   #NI_DGRAM
+ *           Specifies that the service being looked up is a datagram
+ *           service, and causes getservbyport() to be called with a second
+ *           argument of "udp" instead of its default of "tcp". This is
+ *           required for the few ports (512-514) that have different
+ *           services for UDP and TCP.
+ * 
+ * \section getnameinfo_return Return Values
+ * 
+ *    lwres_getnameinfo() returns 0 on success or a non-zero error code if
+ *    an error occurs.
+ * 
+ * \section getname_see See Also
+ * 
+ *    RFC2133, getservbyport(), 
+ *    lwres_getnamebyaddr(). lwres_net_ntop().
+ * 
+ * \section getnameinfo_bugs Bugs
+ * 
+ *    RFC2133 fails to define what the nonzero return values of
+ *    getnameinfo() are.
+ */
+
 #include <config.h>
 
 #include <stdio.h>
@@ -67,12 +125,13 @@
 
 #define SUCCESS 0
 
+/*% afd structure definition */
 static struct afd {
 	int a_af;
 	size_t a_addrlen;
 	size_t a_socklen;
 } afdl [] = {
-	/*
+	/*!
 	 * First entry is linked last...
 	 */
 	{ AF_INET, sizeof(struct in_addr), sizeof(struct sockaddr_in) },
@@ -88,7 +147,7 @@ static struct afd {
 #define ENI_SALEN	6
 #define ENI_NOSOCKET 	7
 
-/*
+/*!
  * The test against 0 is there to keep the Solaris compiler
  * from complaining about "end-of-loop code not reached".
  */
@@ -97,6 +156,7 @@ static struct afd {
 		if (result != 0) goto cleanup;	\
 	} while (0)
 
+/*% lightweight resolver socket address structure to hostname and service name */
 int
 lwres_getnameinfo(const struct sockaddr *sa, size_t salen, char *host,
 		  size_t hostlen, char *serv, size_t servlen, int flags)
diff --git a/contrib/bind9/lib/lwres/getrrset.c b/contrib/bind9/lib/lwres/getrrset.c
index 6160039..6b7e5e5 100644
--- a/contrib/bind9/lib/lwres/getrrset.c
+++ b/contrib/bind9/lib/lwres/getrrset.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,77 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: getrrset.c,v 1.11.2.3.2.2 2004/03/06 08:15:31 marka Exp $ */
+/* $Id: getrrset.c,v 1.14.18.2 2005/04/29 00:17:18 marka Exp $ */
+
+/*! \file */
+
+/**
+ * DESCRIPTION
+ * 
+ *    lwres_getrrsetbyname() gets a set of resource records associated with
+ *    a hostname, class, and type. hostname is a pointer a to
+ *    null-terminated string. The flags field is currently unused and must
+ *    be zero.
+ * 
+ *    After a successful call to lwres_getrrsetbyname(), *res is a pointer
+ *    to an #rrsetinfo structure, containing a list of one or more #rdatainfo
+ *    structures containing resource records and potentially another list of
+ *    rdatainfo structures containing SIG resource records associated with
+ *    those records. The members #rri_rdclass and #rri_rdtype are copied from
+ *    the parameters. #rri_ttl and #rri_name are properties of the obtained
+ *    rrset. The resource records contained in #rri_rdatas and #rri_sigs are
+ *    in uncompressed DNS wire format. Properties of the rdataset are
+ *    represented in the #rri_flags bitfield. If the #RRSET_VALIDATED bit is
+ *    set, the data has been DNSSEC validated and the signatures verified.
+ * 
+ *    All of the information returned by lwres_getrrsetbyname() is
+ *    dynamically allocated: the rrsetinfo and rdatainfo structures, and the
+ *    canonical host name strings pointed to by the rrsetinfostructure.
+ *    Memory allocated for the dynamically allocated structures created by a
+ *    successful call to lwres_getrrsetbyname() is released by
+ *    lwres_freerrset(). rrset is a pointer to a struct rrset created by a
+ *    call to lwres_getrrsetbyname().
+ * 
+ *    The following structures are used:
+ * 
+ * \code
+ * struct  rdatainfo {
+ *         unsigned int            rdi_length;     // length of data
+ *         unsigned char           *rdi_data;      // record data
+ * };
+ * 
+ * struct  rrsetinfo {
+ *         unsigned int            rri_flags;      // RRSET_VALIDATED...
+ *         unsigned int            rri_rdclass;    // class number
+ *         unsigned int            rri_rdtype;     // RR type number
+ *         unsigned int            rri_ttl;        // time to live
+ *         unsigned int            rri_nrdatas;    // size of rdatas array
+ *         unsigned int            rri_nsigs;      // size of sigs array
+ *         char                    *rri_name;      // canonical name
+ *         struct rdatainfo        *rri_rdatas;    // individual records
+ *         struct rdatainfo        *rri_sigs;      // individual signatures
+ * };
+ * \endcode
+ * 
+ * \section getrrset_return Return Values
+ * 
+ *    lwres_getrrsetbyname() returns zero on success, and one of the
+ *    following error codes if an error occurred:
+ * 
+ * \li   #ERRSET_NONAME: the name does not exist
+ * 
+ * \li   #ERRSET_NODATA:
+ *           the name exists, but does not have data of the desired type
+ * 
+ * \li   #ERRSET_NOMEMORY:
+ *           memory could not be allocated
+ * 
+ * \li   #ERRSET_INVAL:
+ *           a parameter is invalid
+ * 
+ * \li   #ERRSET_FAIL:
+ *           other failure
+ */
 
 #include <config.h>
 
@@ -29,6 +99,9 @@
 
 #include "assert_p.h"
 
+/*!
+ * Structure to map results
+ */
 static unsigned int
 lwresult_to_result(lwres_result_t lwresult) {
 	switch (lwresult) {
@@ -40,7 +113,8 @@ lwresult_to_result(lwres_result_t lwresult) {
 	}
 }
 
-/*
+/*@{*/
+/*!
  * malloc / calloc functions that guarantee to only
  * return NULL if there is an error, like they used
  * to before the ANSI C committee broke them.
@@ -61,7 +135,9 @@ sane_calloc(size_t number, size_t size) {
 		memset(mem, 0, len);
 	return (mem);
 }
+/*@}*/
 
+/*% Returns a set of resource records associated with a hostname, class, and type. hostname is a pointer a to null-terminated string. */
 int
 lwres_getrrsetbyname(const char *hostname, unsigned int rdclass,
 		     unsigned int rdtype, unsigned int flags,
@@ -191,6 +267,7 @@ lwres_getrrsetbyname(const char *hostname, unsigned int rdclass,
 	return (result);
 }
 
+/*% Releases memory allocated for the dynamically allocated structures created by a successful call to lwres_getrrsetbyname(). */
 void
 lwres_freerrset(struct rrsetinfo *rrset) {
 	unsigned int i;
diff --git a/contrib/bind9/lib/lwres/herror.c b/contrib/bind9/lib/lwres/herror.c
index 1d0756a..42b6c71 100644
--- a/contrib/bind9/lib/lwres/herror.c
+++ b/contrib/bind9/lib/lwres/herror.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -48,10 +48,31 @@
  * SUCH DAMAGE.
  */
 
+/*! \file herror.c
+   lwres_herror() prints the string s on stderr followed by the string
+   generated by lwres_hstrerror() for the error code stored in the global
+   variable lwres_h_errno.
+
+   lwres_hstrerror() returns an appropriate string for the error code
+   gievn by err. The values of the error codes and messages are as
+   follows:
+
+\li   #NETDB_SUCCESS: Resolver Error 0 (no error)
+
+\li   #HOST_NOT_FOUND: Unknown host
+
+\li #TRY_AGAIN: Host name lookup failure
+
+\li   #NO_RECOVERY: Unknown server error
+
+\li   #NO_DATA: No address associated with name
+
+ */
+
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)herror.c	8.1 (Berkeley) 6/4/93";
 static const char rcsid[] =
-	"$Id: herror.c,v 1.10.12.2 2004/03/06 08:15:31 marka Exp $";
+	"$Id: herror.c,v 1.13.18.2 2005/04/29 00:17:18 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -63,22 +84,22 @@ static const char rcsid[] =
 
 LIBLWRES_EXTERNAL_DATA int	lwres_h_errno;
 
-/*
+/*!
  * these have never been declared in any header file so make them static
  */
 
 static const char *h_errlist[] = {
-	"Resolver Error 0 (no error)",
-	"Unknown host",				/* 1 HOST_NOT_FOUND */
-	"Host name lookup failure",		/* 2 TRY_AGAIN */
-	"Unknown server error",			/* 3 NO_RECOVERY */
-	"No address associated with name",	/* 4 NO_ADDRESS */
+	"Resolver Error 0 (no error)",		/*%< 0 no error */
+	"Unknown host",				/*%< 1 HOST_NOT_FOUND */
+	"Host name lookup failure",		/*%< 2 TRY_AGAIN */
+	"Unknown server error",			/*%< 3 NO_RECOVERY */
+	"No address associated with name",	/*%< 4 NO_ADDRESS */
 };
 
 static int	h_nerr = { sizeof(h_errlist) / sizeof(h_errlist[0]) };
 
 
-/*
+/*!
  * herror --
  *	print the error indicated by the h_errno value.
  */
@@ -87,7 +108,7 @@ lwres_herror(const char *s) {
 	fprintf(stderr, "%s: %s\n", s, lwres_hstrerror(lwres_h_errno));
 }
 
-/*
+/*!
  * hstrerror --
  *	return the string associated with a given "host" errno value.
  */
diff --git a/contrib/bind9/lib/lwres/include/Makefile.in b/contrib/bind9/lib/lwres/include/Makefile.in
index dc075b9..7501060 100644
--- a/contrib/bind9/lib/lwres/include/Makefile.in
+++ b/contrib/bind9/lib/lwres/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.5.206.1 2004/03/06 08:15:33 marka Exp $
+# $Id: Makefile.in,v 1.6 2004/03/05 05:12:49 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/lwres/include/lwres/Makefile.in b/contrib/bind9/lib/lwres/include/lwres/Makefile.in
index 48c28f6..98b8f48 100644
--- a/contrib/bind9/lib/lwres/include/lwres/Makefile.in
+++ b/contrib/bind9/lib/lwres/include/lwres/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.19.12.3 2004/03/08 09:05:11 marka Exp $
+# $Id: Makefile.in,v 1.21 2004/03/05 05:12:52 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/lwres/include/lwres/context.h b/contrib/bind9/lib/lwres/include/lwres/context.h
index 962b142..bd24446 100644
--- a/contrib/bind9/lib/lwres/include/lwres/context.h
+++ b/contrib/bind9/lib/lwres/include/lwres/context.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,18 +15,20 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: context.h,v 1.14.206.1 2004/03/06 08:15:34 marka Exp $ */
+/* $Id: context.h,v 1.15.18.2 2005/04/29 00:17:21 marka Exp $ */
 
 #ifndef LWRES_CONTEXT_H
 #define LWRES_CONTEXT_H 1
 
+/*! \file */
+
 #include <stddef.h>
 
 #include <lwres/lang.h>
 #include <lwres/int.h>
 #include <lwres/result.h>
 
-/*
+/*!
  * Used to set various options such as timeout, authentication, etc
  */
 typedef struct lwres_context lwres_context_t;
@@ -51,7 +53,7 @@ typedef void (*lwres_free_t)(void *arg, void *mem, size_t length);
  * Share /etc/resolv.conf data between contexts.
  */
 
-/*
+/*!
  * _SERVERMODE
  *	Don't allocate and connect a socket to the server, since the
  *	caller _is_ a server.
@@ -63,7 +65,7 @@ lwres_context_create(lwres_context_t **contextp, void *arg,
 		     lwres_malloc_t malloc_function,
 		     lwres_free_t free_function,
 		     unsigned int flags);
-/*
+/**<
  * Allocate a lwres context.  This is used in all lwres calls.
  *
  * Memory management can be replaced here by passing in two functions.
@@ -75,28 +77,22 @@ lwres_context_create(lwres_context_t **contextp, void *arg,
  *
  * If they are NULL, the standard malloc() and free() will be used.
  *
- * Requires:
- *
- *	contextp != NULL && contextp == NULL.
+ *\pre	contextp != NULL && contextp == NULL.
  *
- * Returns:
- *
- *	Returns 0 on success, non-zero on failure.
+ *\return	Returns 0 on success, non-zero on failure.
  */
 
 void
 lwres_context_destroy(lwres_context_t **contextp);
-/*
+/**<
  * Frees all memory associated with a lwres context.
  *
- * Requires:
- *
- *	contextp != NULL && contextp == NULL.
+ *\pre	contextp != NULL && contextp == NULL.
  */
 
 lwres_uint32_t
 lwres_context_nextserial(lwres_context_t *ctx);
-/*
+/**<
  * XXXMLG Document
  */
 
diff --git a/contrib/bind9/lib/lwres/include/lwres/int.h b/contrib/bind9/lib/lwres/include/lwres/int.h
index 2523924..337316e 100644
--- a/contrib/bind9/lib/lwres/include/lwres/int.h
+++ b/contrib/bind9/lib/lwres/include/lwres/int.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: int.h,v 1.7.206.1 2004/03/06 08:15:34 marka Exp $ */
+/* $Id: int.h,v 1.8.18.2 2005/04/29 00:17:21 marka Exp $ */
 
 #ifndef LWRES_INT_H
 #define LWRES_INT_H 1
 
+/*! \file */
+
 typedef char				lwres_int8_t;
 typedef unsigned char			lwres_uint8_t;
 typedef short				lwres_int16_t;
diff --git a/contrib/bind9/lib/lwres/include/lwres/ipv6.h b/contrib/bind9/lib/lwres/include/lwres/ipv6.h
index 5dc06d6..06dab59 100644
--- a/contrib/bind9/lib/lwres/include/lwres/ipv6.h
+++ b/contrib/bind9/lib/lwres/include/lwres/ipv6.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ipv6.h,v 1.9.206.1 2004/03/06 08:15:34 marka Exp $ */
+/* $Id: ipv6.h,v 1.10.18.2 2005/04/29 00:17:21 marka Exp $ */
 
 #ifndef LWRES_IPV6_H
 #define LWRES_IPV6_H 1
@@ -24,7 +24,7 @@
  ***** Module Info
  *****/
 
-/*
+/*! \file ipv6.h
  * IPv6 definitions for systems which do not support IPv6.
  */
 
@@ -39,6 +39,7 @@
  *** Types.
  ***/
 
+/*% in6_addr structure */
 struct in6_addr {
         union {
 		lwres_uint8_t	_S6_u8[16];
@@ -46,10 +47,13 @@ struct in6_addr {
 		lwres_uint32_t	_S6_u32[4];
         } _S6_un;
 };
+/*@{*/
+/*% IP v6 types */
 #define s6_addr		_S6_un._S6_u8
 #define s6_addr8	_S6_un._S6_u8
 #define s6_addr16	_S6_un._S6_u16
 #define s6_addr32	_S6_un._S6_u32
+/*@}*/
 
 #define IN6ADDR_ANY_INIT 	{{{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 }}}
 #define IN6ADDR_LOOPBACK_INIT 	{{{ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 }}}
@@ -57,6 +61,7 @@ struct in6_addr {
 LIBLWRES_EXTERNAL_DATA extern const struct in6_addr in6addr_any;
 LIBLWRES_EXTERNAL_DATA extern const struct in6_addr in6addr_loopback;
 
+/*% used in getaddrinfo.c and getnameinfo.c */
 struct sockaddr_in6 {
 #ifdef LWRES_PLATFORM_HAVESALEN
 	lwres_uint8_t		sin6_len;
@@ -74,13 +79,14 @@ struct sockaddr_in6 {
 #define SIN6_LEN 1
 #endif
 
+/*% in6_pktinfo structure */
 struct in6_pktinfo {
-	struct in6_addr ipi6_addr;    /* src/dst IPv6 address */
-	unsigned int    ipi6_ifindex; /* send/recv interface index */
+	struct in6_addr ipi6_addr;    /*%< src/dst IPv6 address */
+	unsigned int    ipi6_ifindex; /*%< send/recv interface index */
 };
 
-/*
- * Unspecified
+/*!
+ * Unspecified IPv6 address
  */
 #define IN6_IS_ADDR_UNSPECIFIED(a)      \
         (((a)->s6_addr32[0] == 0) &&    \
diff --git a/contrib/bind9/lib/lwres/include/lwres/lang.h b/contrib/bind9/lib/lwres/include/lwres/lang.h
index bd99ec0..a38f19d 100644
--- a/contrib/bind9/lib/lwres/include/lwres/lang.h
+++ b/contrib/bind9/lib/lwres/include/lwres/lang.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lang.h,v 1.6.206.1 2004/03/06 08:15:35 marka Exp $ */
+/* $Id: lang.h,v 1.7.18.2 2005/04/29 00:17:21 marka Exp $ */
 
 #ifndef LWRES_LANG_H
 #define LWRES_LANG_H 1
 
+/*! \file */
+
 #ifdef __cplusplus
 #define LWRES_LANG_BEGINDECLS	extern "C" {
 #define LWRES_LANG_ENDDECLS	}
diff --git a/contrib/bind9/lib/lwres/include/lwres/list.h b/contrib/bind9/lib/lwres/include/lwres/list.h
index 9b61787..c22c596 100644
--- a/contrib/bind9/lib/lwres/include/lwres/list.h
+++ b/contrib/bind9/lib/lwres/include/lwres/list.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: list.h,v 1.7.206.1 2004/03/06 08:15:35 marka Exp $ */
+/* $Id: list.h,v 1.8.18.2 2005/04/29 00:17:22 marka Exp $ */
 
 #ifndef LWRES_LIST_H
 #define LWRES_LIST_H 1
 
+/*! \file */
+
 #define LWRES_LIST(type) struct { type *head, *tail; }
 #define LWRES_LIST_INIT(list) \
 	do { (list).head = NULL; (list).tail = NULL; } while (0)
diff --git a/contrib/bind9/lib/lwres/include/lwres/lwbuffer.h b/contrib/bind9/lib/lwres/include/lwres/lwbuffer.h
index 97f7b9d..51b1aad 100644
--- a/contrib/bind9/lib/lwres/include/lwres/lwbuffer.h
+++ b/contrib/bind9/lib/lwres/include/lwres/lwbuffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,17 +15,10 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwbuffer.h,v 1.15.206.1 2004/03/06 08:15:35 marka Exp $ */
+/* $Id: lwbuffer.h,v 1.16.18.2 2005/04/29 00:17:22 marka Exp $ */
 
-#ifndef LWRES_LWBUFFER_H
-#define LWRES_LWBUFFER_H 1
 
-/*****
- ***** Module Info
- *****/
-
-/*
- * Buffers
+/*! \file lwbuffer.h
  *
  * A buffer is a region of memory, together with a set of related subregions.
  * Buffers are used for parsing and I/O operations.
@@ -51,6 +44,7 @@
  * region is empty.  If the current offset advances beyond the chosen offset,
  * the active region will also be empty.
  *
+ * \verbatim
  *  /----- used region -----\/-- available --\
  *  +----------------------------------------+
  *  | consumed  | remaining |                |
@@ -68,9 +62,11 @@
  * a-b == consumed region.
  * b-d == remaining region.
  * b-c == optional active region.
+ * \endverbatim
  *
  * The following invariants are maintained by all routines:
  *
+ *\verbatim
  *	length > 0
  *
  *	base is a valid pointer to length bytes of memory
@@ -81,24 +77,28 @@
  *
  *	0 <= active <= used
  *	(although active < current implies empty active region)
+ *\endverbatim
  *
- * MP:
+ * \li MP:
  *	Buffers have no synchronization.  Clients must ensure exclusive
  *	access.
  *
- * Reliability:
+ * \li Reliability:
  *	No anticipated impact.
  *
- * Resources:
+ * \li Resources:
  *	Memory: 1 pointer + 6 unsigned integers per buffer.
  *
- * Security:
+ * \li Security:
  *	No anticipated impact.
  *
- * Standards:
+ * \li Standards:
  *	None.
  */
 
+#ifndef LWRES_LWBUFFER_H
+#define LWRES_LWBUFFER_H 1
+
 /***
  *** Imports
  ***/
@@ -116,32 +116,35 @@ LWRES_LANG_BEGINDECLS
 #define LWRES_BUFFER_VALID(b)		((b) != NULL && \
 					 (b)->magic == LWRES_BUFFER_MAGIC)
 
-/*
+/*!
  * The following macros MUST be used only on valid buffers.  It is the
  * caller's responsibility to ensure this by using the LWRES_BUFFER_VALID
  * check above, or by calling another lwres_buffer_*() function (rather than
  * another macro.)
  */
 
-/*
+/*!
  * Get the length of the used region of buffer "b"
  */
 #define LWRES_BUFFER_USEDCOUNT(b)	((b)->used)
 
-/*
+/*!
  * Get the length of the available region of buffer "b"
  */
 #define LWRES_BUFFER_AVAILABLECOUNT(b)	((b)->length - (b)->used)
 
 #define LWRES_BUFFER_REMAINING(b)	((b)->used - (b)->current)
 
-/*
+/*!
  * Note that the buffer structure is public.  This is principally so buffer
  * operations can be implemented using macros.  Applications are strongly
  * discouraged from directly manipulating the structure.
  */
 
 typedef struct lwres_buffer lwres_buffer_t;
+/*!
+ * Buffer data structure
+ */
 struct lwres_buffer {
 	unsigned int		magic;
 	unsigned char 	       *base;
@@ -158,7 +161,7 @@ struct lwres_buffer {
 
 void
 lwres_buffer_init(lwres_buffer_t *b, void *base, unsigned int length);
-/*
+/**<
  * Make 'b' refer to the 'length'-byte region starting at base.
  *
  * Requires:
@@ -171,7 +174,7 @@ lwres_buffer_init(lwres_buffer_t *b, void *base, unsigned int length);
 
 void
 lwres_buffer_invalidate(lwres_buffer_t *b);
-/*
+/**<
  * Make 'b' an invalid buffer.
  *
  * Requires:
@@ -184,7 +187,7 @@ lwres_buffer_invalidate(lwres_buffer_t *b);
 
 void
 lwres_buffer_add(lwres_buffer_t *b, unsigned int n);
-/*
+/**<
  * Increase the 'used' region of 'b' by 'n' bytes.
  *
  * Requires:
@@ -197,7 +200,7 @@ lwres_buffer_add(lwres_buffer_t *b, unsigned int n);
 
 void
 lwres_buffer_subtract(lwres_buffer_t *b, unsigned int n);
-/*
+/**<
  * Decrease the 'used' region of 'b' by 'n' bytes.
  *
  * Requires:
@@ -210,7 +213,7 @@ lwres_buffer_subtract(lwres_buffer_t *b, unsigned int n);
 
 void
 lwres_buffer_clear(lwres_buffer_t *b);
-/*
+/**<
  * Make the used region empty.
  *
  * Requires:
@@ -223,9 +226,10 @@ lwres_buffer_clear(lwres_buffer_t *b);
  *
  */
 
+
 void
 lwres_buffer_first(lwres_buffer_t *b);
-/*
+/**<
  * Make the consumed region empty.
  *
  * Requires:
@@ -240,7 +244,7 @@ lwres_buffer_first(lwres_buffer_t *b);
 
 void
 lwres_buffer_forward(lwres_buffer_t *b, unsigned int n);
-/*
+/**<
  * Increase the 'consumed' region of 'b' by 'n' bytes.
  *
  * Requires:
@@ -253,7 +257,7 @@ lwres_buffer_forward(lwres_buffer_t *b, unsigned int n);
 
 void
 lwres_buffer_back(lwres_buffer_t *b, unsigned int n);
-/*
+/**<
  * Decrease the 'consumed' region of 'b' by 'n' bytes.
  *
  * Requires:
@@ -266,7 +270,7 @@ lwres_buffer_back(lwres_buffer_t *b, unsigned int n);
 
 lwres_uint8_t
 lwres_buffer_getuint8(lwres_buffer_t *b);
-/*
+/**<
  * Read an unsigned 8-bit integer from 'b' and return it.
  *
  * Requires:
@@ -286,7 +290,7 @@ lwres_buffer_getuint8(lwres_buffer_t *b);
 
 void
 lwres_buffer_putuint8(lwres_buffer_t *b, lwres_uint8_t val);
-/*
+/**<
  * Store an unsigned 8-bit integer from 'val' into 'b'.
  *
  * Requires:
@@ -300,7 +304,7 @@ lwres_buffer_putuint8(lwres_buffer_t *b, lwres_uint8_t val);
 
 lwres_uint16_t
 lwres_buffer_getuint16(lwres_buffer_t *b);
-/*
+/**<
  * Read an unsigned 16-bit integer in network byte order from 'b', convert
  * it to host byte order, and return it.
  *
@@ -321,7 +325,7 @@ lwres_buffer_getuint16(lwres_buffer_t *b);
 
 void
 lwres_buffer_putuint16(lwres_buffer_t *b, lwres_uint16_t val);
-/*
+/**<
  * Store an unsigned 16-bit integer in host byte order from 'val'
  * into 'b' in network byte order.
  *
@@ -336,7 +340,7 @@ lwres_buffer_putuint16(lwres_buffer_t *b, lwres_uint16_t val);
 
 lwres_uint32_t
 lwres_buffer_getuint32(lwres_buffer_t *b);
-/*
+/**<
  * Read an unsigned 32-bit integer in network byte order from 'b', convert
  * it to host byte order, and return it.
  *
@@ -357,7 +361,7 @@ lwres_buffer_getuint32(lwres_buffer_t *b);
 
 void
 lwres_buffer_putuint32(lwres_buffer_t *b, lwres_uint32_t val);
-/*
+/**<
  * Store an unsigned 32-bit integer in host byte order from 'val'
  * into 'b' in network byte order.
  *
@@ -373,7 +377,7 @@ lwres_buffer_putuint32(lwres_buffer_t *b, lwres_uint32_t val);
 void
 lwres_buffer_putmem(lwres_buffer_t *b, const unsigned char *base,
 		    unsigned int length);
-/*
+/**<
  * Copy 'length' bytes of memory at 'base' into 'b'.
  *
  * Requires:
@@ -386,7 +390,7 @@ lwres_buffer_putmem(lwres_buffer_t *b, const unsigned char *base,
 void
 lwres_buffer_getmem(lwres_buffer_t *b, unsigned char *base,
 		    unsigned int length);
-/*
+/**<
  * Copy 'length' bytes of memory from 'b' into 'base'.
  *
  * Requires:
diff --git a/contrib/bind9/lib/lwres/include/lwres/lwpacket.h b/contrib/bind9/lib/lwres/include/lwres/lwpacket.h
index 48f6a34..c37353d 100644
--- a/contrib/bind9/lib/lwres/include/lwres/lwpacket.h
+++ b/contrib/bind9/lib/lwres/include/lwres/lwpacket.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwpacket.h,v 1.17.206.1 2004/03/06 08:15:35 marka Exp $ */
+/* $Id: lwpacket.h,v 1.18.18.2 2005/04/29 00:17:22 marka Exp $ */
 
 #ifndef LWRES_LWPACKET_H
 #define LWRES_LWPACKET_H 1
@@ -24,89 +24,124 @@
 #include <lwres/lwbuffer.h>
 #include <lwres/result.h>
 
+/*% lwres_lwpacket_t */
 typedef struct lwres_lwpacket lwres_lwpacket_t;
 
+/*% lwres_lwpacket structure */
 struct lwres_lwpacket {
+	/*! The overall packet length, including the 
+	 *  entire packet header.
+	 *  This field is filled in by the
+	 *  \link lwres_gabn.c lwres_gabn_*()\endlink 
+	 *  and \link lwres_gnba.c lwres_gnba_*()\endlink calls.
+	 */
 	lwres_uint32_t		length;
+	/*! Specifies the header format.  Currently, 
+	 *  there is only one format, #LWRES_LWPACKETVERSION_0.
+	 *  This field is filled in by the
+	 *  \link lwres_gabn.c lwres_gabn_*()\endlink 
+	 *  and \link lwres_gnba.c lwres_gnba_*()\endlink calls.
+         */
 	lwres_uint16_t		version;
+ 	/*! Specifies library-defined flags for this packet, such as
+	 *  whether the packet is a request or a reply.  None of 
+	 *  these are definable by the caller, but library-defined values 
+	 *  can be set by the caller.  For example, one bit in this field 
+	 *  indicates if the packet is a request or a response.
+	 *  This field is filled in by
+	 *  the application wits the exception of the
+	 *  #LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library
+	 *  in the
+	 *  \link lwres_gabn.c lwres_gabn_*()\endlink 
+	 *  and \link lwres_gnba.c lwres_gnba_*()\endlink calls.
+         */
 	lwres_uint16_t		pktflags;
+ 	/*! Set by the requestor and is returned in all replies.  
+	 *  If two packets from the same source have the same serial 
+	 *  number and are from the same source, they are assumed to 
+	 *  be duplicates and the latter ones may be dropped.  
+	 *  (The library does not do this by default on replies, but
+ 	 * does so on requests.)
+         */
 	lwres_uint32_t		serial;
+ 	/*! Opcodes between 0x04000000 and 0xffffffff
+ 	 *  are application defined.  Opcodes between 
+	 *  0x00000000 and 0x03ffffff are
+ 	 * reserved for library use.
+	 *  This field is filled in by the
+	 *  \link lwres_gabn.c lwres_gabn_*()\endlink 
+	 *  and \link lwres_gnba.c lwres_gnba_*()\endlink calls.
+	 */
 	lwres_uint32_t		opcode;
+ 	/*! Only valid for results.  
+	 *  Results between 0x04000000 and 0xffffffff are application 
+	 *  defined.
+ 	 * Results between 0x00000000 and 0x03ffffff are reserved for 
+	 * library use.
+ 	 * (This is the same reserved range defined in <isc/resultclass.h>, 
+	 * so it
+ 	 * would be trivial to map ISC_R_* result codes into packet result 
+	 * codes when appropriate.)
+	 *  This field is filled in by the
+	 *  \link lwres_gabn.c lwres_gabn_*()\endlink 
+	 *  and \link lwres_gnba.c lwres_gnba_*()\endlink calls.
+	 */
 	lwres_uint32_t		result;
+ 	/*! Set to the maximum buffer size that the receiver can
+ 	 *  handle on requests, and the size of the buffer needed to 
+	 *  satisfy a request
+ 	 *  when the buffer is too large for replies.
+	 *  This field is supplied by the application.
+	 */
 	lwres_uint32_t		recvlength;
+ 	/*! The packet level auth type used.
+ 	 *  Authtypes between 0x1000 and 0xffff are application defined.  
+	 *  Authtypes
+ 	 *  between 0x0000 and 0x0fff are reserved for library use.  
+	 *  This is currently
+ 	 *  unused and MUST be set to zero.
+	 */
 	lwres_uint16_t		authtype;
+ 	/*! The length of the authentication data.  
+	 *  See the specific
+ 	 * authtypes for more information on what is contained 
+	 * in this field.  This is currently unused, and 
+	 * MUST be set to zero.
+	 */
 	lwres_uint16_t		authlength;
 };
 
-#define LWRES_LWPACKET_LENGTH		(4 * 5 + 2 * 4)
+#define LWRES_LWPACKET_LENGTH		(4 * 5 + 2 * 4) /*%< Overall length. */
 
-#define LWRES_LWPACKETFLAG_RESPONSE	0x0001U	/* if set, pkt is a response */
+#define LWRES_LWPACKETFLAG_RESPONSE	0x0001U	/*%< If set, pkt is a response. */
 
 
-#define LWRES_LWPACKETVERSION_0		0
+#define LWRES_LWPACKETVERSION_0		0	/*%< Header format. */
 
-/*
- * "length" is the overall packet length, including the entire packet header.
- *
- * "version" specifies the header format.  Currently, there is only one
- * format, LWRES_LWPACKETVERSION_0.
- *
- * "flags" specifies library-defined flags for this packet.  None of these
- * are definable by the caller, but library-defined values can be set by
- * the caller.  For example, one bit in this field indicates if the packet
- * is a request or a response.
- *
- * "serial" is set by the requestor and is returned in all replies.  If two
- * packets from the same source have the same serial number and are from
- * the same source, they are assumed to be duplicates and the latter ones
- * may be dropped.  (The library does not do this by default on replies, but
- * does so on requests.)
- *
- * "opcode" is application defined.  Opcodes between 0x04000000 and 0xffffffff
- * are application defined.  Opcodes between 0x00000000 and 0x03ffffff are
- * reserved for library use.
- *
- * "result" is application defined, and valid only on replies.
- * Results between 0x04000000 and 0xffffffff are application defined.
- * Results between 0x00000000 and 0x03ffffff are reserved for library use.
- * (This is the same reserved range defined in <isc/resultclass.h>, so it
- * would be trivial to map ISC_R_* result codes into packet result codes
- * when appropriate.)
+/*! \file lwpacket.h
  *
- * "recvlength" is set to the maximum buffer size that the receiver can
- * handle on requests, and the size of the buffer needed to satisfy a request
- * when the buffer is too large for replies.
- *
- * "authtype" is the packet level auth type used.
- * Authtypes between 0x1000 and 0xffff are application defined.  Authtypes
- * between 0x0000 and 0x0fff are reserved for library use.  This is currently
- * unused and MUST be set to zero.
- *
- * "authlen" is the length of the authentication data.  See the specific
- * authtypes for more information on what is contained in this field.  This
- * is currently unused, and MUST be set to zero.
  *
  * The remainder of the packet consists of two regions, one described by
  * "authlen" and one of "length - authlen - sizeof(lwres_lwpacket_t)".
  *
  * That is:
  *
+ * \code
  *	pkt header
  *	authlen bytes of auth information
  *	data bytes
- */
-
-/*
+ * \endcode
+ *
  * Currently defined opcodes:
  *
- *	NOOP.  Success is always returned, with the packet contents echoed.
+ *\li	#LWRES_OPCODE_NOOP.  Success is always returned, with the packet contents echoed.
  *
- *	GETADDRSBYNAME.  Return all known addresses for a given name.
+ *\li	#LWRES_OPCODE_GETADDRSBYNAME.  Return all known addresses for a given name.
  *		This may return NIS or /etc/hosts info as well as DNS
  *		information.  Flags will be provided to indicate ip4/ip6
  *		addresses are desired.
  *
- *	GETNAMEBYADDR.	Return the hostname for the given address.  Once
+ *\li	#LWRES_OPCODE_GETNAMEBYADDR.	Return the hostname for the given address.  Once
  *		again, it will return data from multiple sources.
  */
 
diff --git a/contrib/bind9/lib/lwres/include/lwres/lwres.h b/contrib/bind9/lib/lwres/include/lwres/lwres.h
index 7260b00..b245363 100644
--- a/contrib/bind9/lib/lwres/include/lwres/lwres.h
+++ b/contrib/bind9/lib/lwres/include/lwres/lwres.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwres.h,v 1.49.12.3 2004/03/08 09:05:11 marka Exp $ */
+/* $Id: lwres.h,v 1.51.18.2 2005/04/29 00:17:22 marka Exp $ */
 
 #ifndef LWRES_LWRES_H
 #define LWRES_LWRES_H 1
@@ -28,14 +28,16 @@
 #include <lwres/lwpacket.h>
 #include <lwres/platform.h>
 
-/*
+/*! \file */
+
+/*!
  * Design notes:
  *
  * Each opcode has two structures and three functions which operate on each
  * structure.  For example, using the "no operation/ping" opcode as an
  * example:
  *
- *	lwres_nooprequest_t:
+ *	<ul><li>lwres_nooprequest_t:
  *
  *		lwres_nooprequest_render() takes a lwres_nooprequest_t and
  *		and renders it into wire format, storing the allocated
@@ -43,20 +45,20 @@
  *		is no longer needed, it must be freed by
  *		lwres_context_freemem().  All other memory used by the
  *		caller must be freed manually, including the
- *		lwres_nooprequest_t passed in.
+ *		lwres_nooprequest_t passed in.<br /><br />
  *
  *		lwres_nooprequest_parse() takes a wire format message and
  *		breaks it out into a lwres_nooprequest_t.  The structure
  *		must be freed via lwres_nooprequest_free() when it is no longer
- *		needed.
+ *		needed.<br /><br />
  *
  *		lwres_nooprequest_free() releases into the lwres_context_t
- *		any space allocated during parsing.
+ *		any space allocated during parsing.</li>
  *
- *	lwres_noopresponse_t:
+ *	<li>lwres_noopresponse_t:
  *
  *		The functions used are similar to the three used for
- *		requests, just with different names.
+ *		requests, just with different names.</li></ul>
  *
  * Typically, the client will use request_render, response_parse, and
  * response_free, while the daemon will use request_parse, response_render,
@@ -64,62 +66,57 @@
  *
  * The basic flow of a typical client is:
  *
- *	fill in a request_t, and call the render function.
+ *	\li fill in a request_t, and call the render function.
  *
- *	Transmit the buffer returned to the daemon.
+ *	\li Transmit the buffer returned to the daemon.
  *
- *	Wait for a response.
+ *	\li Wait for a response.
  *
- *	When a response is received, parse it into a response_t.
+ *	\li When a response is received, parse it into a response_t.
  *
- *	free the request buffer using lwres_context_freemem().
+ *	\li free the request buffer using lwres_context_freemem().
  *
- *	free the response structure and its associated buffer using
+ *	\li free the response structure and its associated buffer using
  *	response_free().
  */
 
-#define LWRES_UDP_PORT		921
-#define LWRES_RECVLENGTH	16384
-#define LWRES_ADDR_MAXLEN	16	/* changing this breaks ABI */
-#define LWRES_RESOLV_CONF	"/etc/resolv.conf"
+#define LWRES_UDP_PORT		921	/*%< UDP Port Number */
+#define LWRES_RECVLENGTH	16384 /*%< Maximum Packet Length */
+#define LWRES_ADDR_MAXLEN	16	/*%< changing this breaks ABI */
+#define LWRES_RESOLV_CONF	"/etc/resolv.conf" /*%< Location of resolv.conf */
 
-/*
- * Flags.
- *
- * 	These flags are only relevant to rrset queries.
- *
- *	TRUSTNOTREQUIRED:  DNSSEC is not required (input)
- *	SECUREDATA: The data was crypto-verified with DNSSEC (output)
- *
- */
+/*% DNSSEC is not required (input).  Only relevant to rrset queries. */
 #define LWRES_FLAG_TRUSTNOTREQUIRED	0x00000001U
+/*% The data was crypto-verified with DNSSEC (output). */
 #define LWRES_FLAG_SECUREDATA		0x00000002U
 
-/*
- * no-op
- */
+/*% no-op */
 #define LWRES_OPCODE_NOOP		0x00000000U
 
+/*% lwres_nooprequest_t */
 typedef struct {
 	/* public */
 	lwres_uint16_t			datalength;
 	unsigned char		       *data;
 } lwres_nooprequest_t;
 
+/*% lwres_noopresponse_t */
 typedef struct {
 	/* public */
 	lwres_uint16_t			datalength;
 	unsigned char		       *data;
 } lwres_noopresponse_t;
 
-/*
- * get addresses by name
- */
+/*% get addresses by name */
 #define LWRES_OPCODE_GETADDRSBYNAME	0x00010001U
 
+/*% lwres_addr_t */
 typedef struct lwres_addr lwres_addr_t;
+
+/*% LWRES_LIST */
 typedef LWRES_LIST(lwres_addr_t) lwres_addrlist_t;
 
+/*% lwres_addr */
 struct lwres_addr {
 	lwres_uint32_t			family;
 	lwres_uint16_t			length;
@@ -127,6 +124,7 @@ struct lwres_addr {
 	LWRES_LINK(lwres_addr_t)	link;
 };
 
+/*% lwres_gabnrequest_t */
 typedef struct {
 	/* public */
 	lwres_uint32_t			flags;
@@ -135,6 +133,7 @@ typedef struct {
 	char			       *name;
 } lwres_gabnrequest_t;
 
+/*% lwres_gabnresponse_t */
 typedef struct {
 	/* public */
 	lwres_uint32_t			flags;
@@ -145,21 +144,22 @@ typedef struct {
 	lwres_uint16_t			realnamelen;
 	lwres_uint16_t		       *aliaslen;
 	lwres_addrlist_t		addrs;
-	/* if base != NULL, it will be freed when this structure is freed. */
+	/*! if base != NULL, it will be freed when this structure is freed. */
 	void			       *base;
 	size_t				baselen;
 } lwres_gabnresponse_t;
 
-/*
- * get name by address
- */
+/*% get name by address */
 #define LWRES_OPCODE_GETNAMEBYADDR	0x00010002U
+
+/*% lwres_gnbarequest_t */
 typedef struct {
 	/* public */
 	lwres_uint32_t			flags;
 	lwres_addr_t			addr;
 } lwres_gnbarequest_t;
 
+/*% lwres_gnbaresponse_t */
 typedef struct {
 	/* public */
 	lwres_uint32_t			flags;
@@ -168,16 +168,15 @@ typedef struct {
 	char			      **aliases;
 	lwres_uint16_t			realnamelen;
 	lwres_uint16_t		       *aliaslen;
-	/* if base != NULL, it will be freed when this structure is freed. */
+	/*! if base != NULL, it will be freed when this structure is freed. */
 	void			       *base;
 	size_t				baselen;
 } lwres_gnbaresponse_t;
 
-/*
- * get rdata by name
- */
+/*% get rdata by name */
 #define LWRES_OPCODE_GETRDATABYNAME	0x00010003U
 
+/*% lwres_grbnrequest_t */
 typedef struct {
 	/* public */
 	lwres_uint32_t			flags;
@@ -187,6 +186,7 @@ typedef struct {
 	char			       *name;
 } lwres_grbnrequest_t;
 
+/*% lwres_grbnresponse_t */
 typedef struct {
 	/* public */
 	lwres_uint32_t			flags;
@@ -201,58 +201,59 @@ typedef struct {
 	lwres_uint16_t		       *rdatalen;
 	unsigned char		      **sigs;
 	lwres_uint16_t		       *siglen;
-	/* if base != NULL, it will be freed when this structure is freed. */
+	/*% if base != NULL, it will be freed when this structure is freed. */
 	void			       *base;
 	size_t				baselen;
 } lwres_grbnresponse_t;
 
+/*% Used by lwres_getrrsetbyname() */
 #define LWRDATA_VALIDATED	0x00000001
 
-/*
+/*!
  * resolv.conf data
  */
 
-#define LWRES_CONFMAXNAMESERVERS 3	/* max 3 "nameserver" entries */
-#define LWRES_CONFMAXLWSERVERS 1	/* max 1 "lwserver" entry */
-#define LWRES_CONFMAXSEARCH 8		/* max 8 domains in "search" entry */
-#define LWRES_CONFMAXLINELEN 256	/* max size of a line */
-#define LWRES_CONFMAXSORTLIST 10
+#define LWRES_CONFMAXNAMESERVERS 3	/*%< max 3 "nameserver" entries */
+#define LWRES_CONFMAXLWSERVERS 1	/*%< max 1 "lwserver" entry */
+#define LWRES_CONFMAXSEARCH 8		/*%< max 8 domains in "search" entry */
+#define LWRES_CONFMAXLINELEN 256	/*%< max size of a line */
+#define LWRES_CONFMAXSORTLIST 10	/*%< max 10 */
+
+/*% lwres_conf_t */
 typedef struct {
 	lwres_context_t *lwctx;
 	lwres_addr_t    nameservers[LWRES_CONFMAXNAMESERVERS];
-	lwres_uint8_t	nsnext;		/* index for next free slot */
+	lwres_uint8_t	nsnext;		/*%< index for next free slot */
 
 	lwres_addr_t	lwservers[LWRES_CONFMAXLWSERVERS];
-	lwres_uint8_t	lwnext;		/* index for next free slot */
+	lwres_uint8_t	lwnext;		/*%< index for next free slot */
 
 	char	       *domainname;
 
 	char 	       *search[LWRES_CONFMAXSEARCH];
-	lwres_uint8_t	searchnxt;	/* index for next free slot */
+	lwres_uint8_t	searchnxt;	/*%< index for next free slot */
 
 	struct {
 		lwres_addr_t addr;
-		/* mask has a non-zero 'family' and 'length' if set */
+		/*% mask has a non-zero 'family' and 'length' if set */
 		lwres_addr_t mask;
 	} sortlist[LWRES_CONFMAXSORTLIST];
 	lwres_uint8_t	sortlistnxt;
 
-	lwres_uint8_t	resdebug;      /* non-zero if 'options debug' set */
-	lwres_uint8_t	ndots;	       /* set to n in 'options ndots:n' */
-	lwres_uint8_t	no_tld_query;  /* non-zero if 'options no_tld_query' */
+	lwres_uint8_t	resdebug;      /*%< non-zero if 'options debug' set */
+	lwres_uint8_t	ndots;	       /*%< set to n in 'options ndots:n' */
+	lwres_uint8_t	no_tld_query;  /*%< non-zero if 'options no_tld_query' */
 } lwres_conf_t;
 
-#define LWRES_ADDRTYPE_V4		0x00000001U	/* ipv4 */
-#define LWRES_ADDRTYPE_V6		0x00000002U	/* ipv6 */
+#define LWRES_ADDRTYPE_V4		0x00000001U	/*%< ipv4 */
+#define LWRES_ADDRTYPE_V6		0x00000002U	/*%< ipv6 */
 
-#define LWRES_MAX_ALIASES		16		/* max # of aliases */
-#define LWRES_MAX_ADDRS			64		/* max # of addrs */
+#define LWRES_MAX_ALIASES		16		/*%< max # of aliases */
+#define LWRES_MAX_ADDRS			64		/*%< max # of addrs */
 
 LWRES_LANG_BEGINDECLS
 
-/*
- * This is in host byte order.
- */
+/*% This is in host byte order. */
 LIBLWRES_EXTERNAL_DATA extern lwres_uint16_t lwres_udp_port;
 
 LIBLWRES_EXTERNAL_DATA extern const char *lwres_resolv_conf;
@@ -276,12 +277,12 @@ lwres_gabnresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 
 void
 lwres_gabnrequest_free(lwres_context_t *ctx, lwres_gabnrequest_t **structp);
-/*
+/**<
  * Frees any dynamically allocated memory for this structure.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	structp != NULL && *structp != NULL.
  *
@@ -295,12 +296,12 @@ lwres_gabnrequest_free(lwres_context_t *ctx, lwres_gabnrequest_t **structp);
 
 void
 lwres_gabnresponse_free(lwres_context_t *ctx, lwres_gabnresponse_t **structp);
-/*
+/**<
  * Frees any dynamically allocated memory for this structure.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	structp != NULL && *structp != NULL.
  *
@@ -332,12 +333,12 @@ lwres_gnbaresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 
 void
 lwres_gnbarequest_free(lwres_context_t *ctx, lwres_gnbarequest_t **structp);
-/*
+/**<
  * Frees any dynamically allocated memory for this structure.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	structp != NULL && *structp != NULL.
  *
@@ -351,12 +352,12 @@ lwres_gnbarequest_free(lwres_context_t *ctx, lwres_gnbarequest_t **structp);
 
 void
 lwres_gnbaresponse_free(lwres_context_t *ctx, lwres_gnbaresponse_t **structp);
-/*
+/**<
  * Frees any dynamically allocated memory for this structure.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	structp != NULL && *structp != NULL.
  *
@@ -387,12 +388,12 @@ lwres_grbnresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 
 void
 lwres_grbnrequest_free(lwres_context_t *ctx, lwres_grbnrequest_t **structp);
-/*
+/**<
  * Frees any dynamically allocated memory for this structure.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	structp != NULL && *structp != NULL.
  *
@@ -406,12 +407,12 @@ lwres_grbnrequest_free(lwres_context_t *ctx, lwres_grbnrequest_t **structp);
 
 void
 lwres_grbnresponse_free(lwres_context_t *ctx, lwres_grbnresponse_t **structp);
-/*
+/**<
  * Frees any dynamically allocated memory for this structure.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	structp != NULL && *structp != NULL.
  *
@@ -426,12 +427,12 @@ lwres_grbnresponse_free(lwres_context_t *ctx, lwres_grbnresponse_t **structp);
 lwres_result_t
 lwres_nooprequest_render(lwres_context_t *ctx, lwres_nooprequest_t *req,
 			 lwres_lwpacket_t *pkt, lwres_buffer_t *b);
-/*
+/**<
  * Allocate space and render into wire format a noop request packet.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	b != NULL, and points to a lwres_buffer_t.  The contents of the
  *	buffer structure will be initialized to contain the wire-format
@@ -455,7 +456,7 @@ lwres_noopresponse_render(lwres_context_t *ctx, lwres_noopresponse_t *req,
 lwres_result_t
 lwres_nooprequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			lwres_lwpacket_t *pkt, lwres_nooprequest_t **structp);
-/*
+/**<
  * Parse a noop request.  Note that to get here, the lwpacket must have
  * already been parsed and removed by the caller, otherwise it would be
  * pretty hard for it to know this is the right function to call.
@@ -474,12 +475,12 @@ lwres_nooprequest_free(lwres_context_t *ctx, lwres_nooprequest_t **structp);
 void
 lwres_noopresponse_free(lwres_context_t *ctx, lwres_noopresponse_t **structp);
 
-/*
+/**<
  * Frees any dynamically allocated memory for this structure.
  *
  * Requires:
  *
- *	ctx != NULL, and be a context returned via lwres_contextcreate().
+ *	ctx != NULL, and be a context returned via lwres_context_create().
  *
  *	structp != NULL && *structp != NULL.
  *
@@ -493,7 +494,7 @@ lwres_noopresponse_free(lwres_context_t *ctx, lwres_noopresponse_t **structp);
 
 lwres_result_t
 lwres_conf_parse(lwres_context_t *ctx, const char *filename);
-/*
+/**<
  * parses a resolv.conf-format file and stores the results in the structure
  * pointed to by *ctx.
  *
@@ -509,7 +510,7 @@ lwres_conf_parse(lwres_context_t *ctx, const char *filename);
 
 lwres_result_t
 lwres_conf_print(lwres_context_t *ctx, FILE *fp);
-/*
+/**<
  * Prints a resolv.conf-format of confdata output to fp.
  *
  * Requires:
@@ -518,7 +519,7 @@ lwres_conf_print(lwres_context_t *ctx, FILE *fp);
 
 void
 lwres_conf_init(lwres_context_t *ctx);
-/*
+/**<
  * sets all internal fields to a default state. Used to initialize a new
  * lwres_conf_t structure (not reset a used on).
  *
@@ -528,7 +529,7 @@ lwres_conf_init(lwres_context_t *ctx);
 
 void
 lwres_conf_clear(lwres_context_t *ctx);
-/*
+/**<
  * frees all internally allocated memory in confdata. Uses the memory
  * routines supplied by ctx.
  *
@@ -538,8 +539,7 @@ lwres_conf_clear(lwres_context_t *ctx);
 
 lwres_conf_t *
 lwres_conf_get(lwres_context_t *ctx);
-/*
- * returns a pointer to the current config structure.
+/**<
  * Be extremely cautions in modifying the contents of this structure; it
  * needs an API to return the various bits of data, walk lists, etc.
  *
diff --git a/contrib/bind9/lib/lwres/include/lwres/netdb.h.in b/contrib/bind9/lib/lwres/include/lwres/netdb.h.in
index 7bf545f..eaef63b 100644
--- a/contrib/bind9/lib/lwres/include/lwres/netdb.h.in
+++ b/contrib/bind9/lib/lwres/include/lwres/netdb.h.in
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: netdb.h.in,v 1.34.206.1 2004/03/06 08:15:35 marka Exp $ */
+/* $Id: netdb.h.in,v 1.35.18.2 2005/04/29 00:17:22 marka Exp $ */
+
+/*! \file */
 
 #ifndef LWRES_NETDB_H
 #define LWRES_NETDB_H 1
diff --git a/contrib/bind9/lib/lwres/include/lwres/platform.h.in b/contrib/bind9/lib/lwres/include/lwres/platform.h.in
index e995aa4..f69e09f 100644
--- a/contrib/bind9/lib/lwres/include/lwres/platform.h.in
+++ b/contrib/bind9/lib/lwres/include/lwres/platform.h.in
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: platform.h.in,v 1.12.2.1.10.5 2005/06/08 02:08:32 marka Exp $ */
+/* $Id: platform.h.in,v 1.14.18.5 2005/06/08 02:07:59 marka Exp $ */
+
+/*! \file */
 
 #ifndef LWRES_PLATFORM_H
 #define LWRES_PLATFORM_H 1
@@ -108,4 +110,11 @@
 #endif
 #endif
 
+/*
+ * Tell Emacs to use C mode on this file.
+ * Local Variables:
+ * mode: c
+ * End:
+ */
+
 #endif /* LWRES_PLATFORM_H */
diff --git a/contrib/bind9/lib/lwres/include/lwres/result.h b/contrib/bind9/lib/lwres/include/lwres/result.h
index 617ae322..6253fb2 100644
--- a/contrib/bind9/lib/lwres/include/lwres/result.h
+++ b/contrib/bind9/lib/lwres/include/lwres/result.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,11 +15,13 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.h,v 1.14.206.1 2004/03/06 08:15:36 marka Exp $ */
+/* $Id: result.h,v 1.15.18.2 2005/04/29 00:17:23 marka Exp $ */
 
 #ifndef LWRES_RESULT_H
 #define LWRES_RESULT_H 1
 
+/*! \file */
+
 typedef unsigned int lwres_result_t;
 
 #define LWRES_R_SUCCESS			0
diff --git a/contrib/bind9/lib/lwres/include/lwres/stdlib.h b/contrib/bind9/lib/lwres/include/lwres/stdlib.h
index f5d4db2..6855fcf 100644
--- a/contrib/bind9/lib/lwres/include/lwres/stdlib.h
+++ b/contrib/bind9/lib/lwres/include/lwres/stdlib.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdlib.h,v 1.2.4.1 2005/06/08 02:08:32 marka Exp $ */
+/* $Id: stdlib.h,v 1.2.2.1 2005/06/08 02:08:01 marka Exp $ */
 
 #ifndef LWRES_STDLIB_H
 #define LWRES_STDLIB_H 1
diff --git a/contrib/bind9/lib/lwres/include/lwres/version.h b/contrib/bind9/lib/lwres/include/lwres/version.h
index 1b291ce..252b903 100644
--- a/contrib/bind9/lib/lwres/include/lwres/version.h
+++ b/contrib/bind9/lib/lwres/include/lwres/version.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.h,v 1.2.224.3 2004/03/08 09:05:11 marka Exp $ */
+/* $Id: version.h,v 1.3.18.2 2005/04/29 00:17:23 marka Exp $ */
+
+/*! \file */
 
 #include <lwres/platform.h>
 
diff --git a/contrib/bind9/lib/lwres/lwbuffer.c b/contrib/bind9/lib/lwres/lwbuffer.c
index 69009f0..5191592 100644
--- a/contrib/bind9/lib/lwres/lwbuffer.c
+++ b/contrib/bind9/lib/lwres/lwbuffer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,99 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwbuffer.c,v 1.10.206.1 2004/03/06 08:15:31 marka Exp $ */
+/* $Id: lwbuffer.c,v 1.11.18.2 2005/04/29 00:17:18 marka Exp $ */
+
+/*! \file */
+
+/**
+ *    These functions provide bounds checked access to a region of memory
+ *    where data is being read or written. They are based on, and similar
+ *    to, the isc_buffer_ functions in the ISC library.
+ * 
+ *    A buffer is a region of memory, together with a set of related
+ *    subregions. The used region and the available region are disjoint, and
+ *    their union is the buffer's region. The used region extends from the
+ *    beginning of the buffer region to the last used byte. The available
+ *    region extends from one byte greater than the last used byte to the
+ *    end of the buffer's region. The size of the used region can be changed
+ *    using various buffer commands. Initially, the used region is empty.
+ * 
+ *    The used region is further subdivided into two disjoint regions: the
+ *    consumed region and the remaining region. The union of these two
+ *    regions is the used region. The consumed region extends from the
+ *    beginning of the used region to the byte before the current offset (if
+ *    any). The remaining region the current pointer to the end of the used
+ *    region. The size of the consumed region can be changed using various
+ *    buffer commands. Initially, the consumed region is empty.
+ * 
+ *    The active region is an (optional) subregion of the remaining region.
+ *    It extends from the current offset to an offset in the remaining
+ *    region. Initially, the active region is empty. If the current offset
+ *    advances beyond the chosen offset, the active region will also be
+ *    empty.
+ * 
+ * 
+ * \verbatim
+ *    /------------entire length---------------\\
+ *    /----- used region -----\\/-- available --\\
+ *    +----------------------------------------+
+ *    | consumed  | remaining |                |
+ *    +----------------------------------------+
+ *    a           b     c     d                e
+ * 
+ *   a == base of buffer.
+ *   b == current pointer.  Can be anywhere between a and d.
+ *   c == active pointer.  Meaningful between b and d.
+ *   d == used pointer.
+ *   e == length of buffer.
+ * 
+ *   a-e == entire length of buffer.
+ *   a-d == used region.
+ *   a-b == consumed region.
+ *   b-d == remaining region.
+ *   b-c == optional active region.
+ * \endverbatim
+ * 
+ *    lwres_buffer_init() initializes the lwres_buffer_t *b and assocates it
+ *    with the memory region of size length bytes starting at location base.
+ * 
+ *    lwres_buffer_invalidate() marks the buffer *b as invalid. Invalidating
+ *    a buffer after use is not required, but makes it possible to catch its
+ *    possible accidental use.
+ * 
+ *    The functions lwres_buffer_add() and lwres_buffer_subtract()
+ *    respectively increase and decrease the used space in buffer *b by n
+ *    bytes. lwres_buffer_add() checks for buffer overflow and
+ *    lwres_buffer_subtract() checks for underflow. These functions do not
+ *    allocate or deallocate memory. They just change the value of used.
+ * 
+ *    A buffer is re-initialised by lwres_buffer_clear(). The function sets
+ *    used , current and active to zero.
+ * 
+ *    lwres_buffer_first() makes the consumed region of buffer *p empty by
+ *    setting current to zero (the start of the buffer).
+ * 
+ *    lwres_buffer_forward() increases the consumed region of buffer *b by n
+ *    bytes, checking for overflow. Similarly, lwres_buffer_back() decreases
+ *    buffer b's consumed region by n bytes and checks for underflow.
+ * 
+ *    lwres_buffer_getuint8() reads an unsigned 8-bit integer from *b and
+ *    returns it. lwres_buffer_putuint8() writes the unsigned 8-bit integer
+ *    val to buffer *b.
+ * 
+ *    lwres_buffer_getuint16() and lwres_buffer_getuint32() are identical to
+ *    lwres_buffer_putuint8() except that they respectively read an unsigned
+ *    16-bit or 32-bit integer in network byte order from b. Similarly,
+ *    lwres_buffer_putuint16() and lwres_buffer_putuint32() writes the
+ *    unsigned 16-bit or 32-bit integer val to buffer b, in network byte
+ *    order.
+ * 
+ *    Arbitrary amounts of data are read or written from a lightweight
+ *    resolver buffer with lwres_buffer_getmem() and lwres_buffer_putmem()
+ *    respectively. lwres_buffer_putmem() copies length bytes of memory at
+ *    base to b. Conversely, lwres_buffer_getmem() copies length bytes of
+ *    memory from b to base.
+ */
 
 #include <config.h>
 
@@ -42,12 +134,10 @@ lwres_buffer_init(lwres_buffer_t *b, void *base, unsigned int length)
 	b->active = 0;
 }
 
+/*  Make 'b' an invalid buffer. */
 void
 lwres_buffer_invalidate(lwres_buffer_t *b)
 {
-	/*
-	 * Make 'b' an invalid buffer.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 
@@ -59,12 +149,10 @@ lwres_buffer_invalidate(lwres_buffer_t *b)
 	b->active = 0;
 }
 
+/* Increase the 'used' region of 'b' by 'n' bytes. */
 void
 lwres_buffer_add(lwres_buffer_t *b, unsigned int n)
 {
-	/*
-	 * Increase the 'used' region of 'b' by 'n' bytes.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 	REQUIRE(b->used + n <= b->length);
@@ -72,12 +160,10 @@ lwres_buffer_add(lwres_buffer_t *b, unsigned int n)
 	b->used += n;
 }
 
+/* Decrease the 'used' region of 'b' by 'n' bytes. */
 void
 lwres_buffer_subtract(lwres_buffer_t *b, unsigned int n)
 {
-	/*
-	 * Decrease the 'used' region of 'b' by 'n' bytes.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 	REQUIRE(b->used >= n);
@@ -89,12 +175,10 @@ lwres_buffer_subtract(lwres_buffer_t *b, unsigned int n)
 		b->active = b->used;
 }
 
+/* Make the used region empty. */
 void
 lwres_buffer_clear(lwres_buffer_t *b)
 {
-	/*
-	 * Make the used region empty.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 
@@ -103,24 +187,20 @@ lwres_buffer_clear(lwres_buffer_t *b)
 	b->active = 0;
 }
 
+/* Make the consumed region empty. */
 void
 lwres_buffer_first(lwres_buffer_t *b)
 {
-	/*
-	 * Make the consumed region empty.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 
 	b->current = 0;
 }
 
+/* Increase the 'consumed' region of 'b' by 'n' bytes. */
 void
 lwres_buffer_forward(lwres_buffer_t *b, unsigned int n)
 {
-	/*
-	 * Increase the 'consumed' region of 'b' by 'n' bytes.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 	REQUIRE(b->current + n <= b->used);
@@ -128,12 +208,10 @@ lwres_buffer_forward(lwres_buffer_t *b, unsigned int n)
 	b->current += n;
 }
 
+/* Decrease the 'consumed' region of 'b' by 'n' bytes. */
 void
 lwres_buffer_back(lwres_buffer_t *b, unsigned int n)
 {
-	/*
-	 * Decrease the 'consumed' region of 'b' by 'n' bytes.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 	REQUIRE(n <= b->current);
@@ -141,15 +219,13 @@ lwres_buffer_back(lwres_buffer_t *b, unsigned int n)
 	b->current -= n;
 }
 
+/* Read an unsigned 8-bit integer from 'b' and return it. */
 lwres_uint8_t
 lwres_buffer_getuint8(lwres_buffer_t *b)
 {
 	unsigned char *cp;
 	lwres_uint8_t result;
 
-	/*
-	 * Read an unsigned 8-bit integer from 'b' and return it.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 	REQUIRE(b->used - b->current >= 1);
@@ -162,6 +238,7 @@ lwres_buffer_getuint8(lwres_buffer_t *b)
 	return (result);
 }
 
+/* Put an unsigned 8-bit integer */
 void
 lwres_buffer_putuint8(lwres_buffer_t *b, lwres_uint8_t val)
 {
@@ -176,16 +253,13 @@ lwres_buffer_putuint8(lwres_buffer_t *b, lwres_uint8_t val)
 	cp[0] = (val & 0x00ff);
 }
 
+/*  Read an unsigned 16-bit integer in network byte order from 'b', convert it to host byte order, and return it. */
 lwres_uint16_t
 lwres_buffer_getuint16(lwres_buffer_t *b)
 {
 	unsigned char *cp;
 	lwres_uint16_t result;
 
-	/*
-	 * Read an unsigned 16-bit integer in network byte order from 'b',
-	 * convert it to host byte order, and return it.
-	 */
 
 	REQUIRE(LWRES_BUFFER_VALID(b));
 	REQUIRE(b->used - b->current >= 2);
@@ -199,6 +273,7 @@ lwres_buffer_getuint16(lwres_buffer_t *b)
 	return (result);
 }
 
+/* Put an unsigned 16-bit integer. */
 void
 lwres_buffer_putuint16(lwres_buffer_t *b, lwres_uint16_t val)
 {
@@ -214,17 +289,13 @@ lwres_buffer_putuint16(lwres_buffer_t *b, lwres_uint16_t val)
 	cp[1] = (val & 0x00ff);
 }
 
+/*  Read an unsigned 32-bit integer in network byte order from 'b', convert it to host byte order, and return it. */
 lwres_uint32_t
 lwres_buffer_getuint32(lwres_buffer_t *b)
 {
 	unsigned char *cp;
 	lwres_uint32_t result;
 
-	/*
-	 * Read an unsigned 32-bit integer in network byte order from 'b',
-	 * convert it to host byte order, and return it.
-	 */
-
 	REQUIRE(LWRES_BUFFER_VALID(b));
 	REQUIRE(b->used - b->current >= 4);
 
@@ -239,6 +310,7 @@ lwres_buffer_getuint32(lwres_buffer_t *b)
 	return (result);
 }
 
+/* Put an unsigned 32-bit integer. */
 void
 lwres_buffer_putuint32(lwres_buffer_t *b, lwres_uint32_t val)
 {
@@ -256,6 +328,7 @@ lwres_buffer_putuint32(lwres_buffer_t *b, lwres_uint32_t val)
 	cp[3] = (unsigned char)(val & 0x000000ff);
 }
 
+/* copies length bytes of memory at base to b */
 void
 lwres_buffer_putmem(lwres_buffer_t *b, const unsigned char *base,
 		    unsigned int length)
@@ -270,6 +343,7 @@ lwres_buffer_putmem(lwres_buffer_t *b, const unsigned char *base,
 	b->used += length;
 }
 
+/* copies length bytes of memory at b to base */
 void
 lwres_buffer_getmem(lwres_buffer_t *b, unsigned char *base,
 		    unsigned int length)
diff --git a/contrib/bind9/lib/lwres/lwconfig.c b/contrib/bind9/lib/lwres/lwconfig.c
index 4b4886b..cf4f6a7 100644
--- a/contrib/bind9/lib/lwres/lwconfig.c
+++ b/contrib/bind9/lib/lwres/lwconfig.c
@@ -15,26 +15,43 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwconfig.c,v 1.33.2.1.2.10 2006/10/03 23:50:50 marka Exp $ */
-
-/***
- *** Module for parsing resolv.conf files.
- ***
- *** entry points are:
- ***	lwres_conf_init(lwres_context_t *ctx)
- ***		intializes data structure for subsequent config parsing.
- ***
- ***	lwres_conf_parse(lwres_context_t *ctx, const char *filename)
- ***		parses a file and fills in the data structure.
- ***
- ***	lwres_conf_print(lwres_context_t *ctx, FILE *fp)
- ***		prints the config data structure to the FILE.
- ***
- ***	lwres_conf_clear(lwres_context_t *ctx)
- ***		frees up all the internal memory used by the config data
- ***		 structure, returning it to the lwres_context_t.
- ***
- ***/
+/* $Id: lwconfig.c,v 1.38.18.5 2006/10/03 23:50:51 marka Exp $ */
+
+/*! \file */
+
+/**
+ * Module for parsing resolv.conf files.
+ *
+ *    lwres_conf_init() creates an empty lwres_conf_t structure for
+ *    lightweight resolver context ctx.
+ * 
+ *    lwres_conf_clear() frees up all the internal memory used by that
+ *    lwres_conf_t structure in resolver context ctx.
+ * 
+ *    lwres_conf_parse() opens the file filename and parses it to initialise
+ *    the resolver context ctx's lwres_conf_t structure.
+ * 
+ *    lwres_conf_print() prints the lwres_conf_t structure for resolver
+ *    context ctx to the FILE fp.
+ * 
+ * \section lwconfig_return Return Values
+ * 
+ *    lwres_conf_parse() returns #LWRES_R_SUCCESS if it successfully read and
+ *    parsed filename. It returns #LWRES_R_FAILURE if filename could not be
+ *    opened or contained incorrect resolver statements.
+ * 
+ *    lwres_conf_print() returns #LWRES_R_SUCCESS unless an error occurred
+ *    when converting the network addresses to a numeric host address
+ *    string. If this happens, the function returns #LWRES_R_FAILURE.
+ * 
+ * \section lwconfig_see See Also
+ * 
+ *    stdio(3), \link resolver resolver \endlink
+ * 
+ * \section files Files
+ * 
+ *    /etc/resolv.conf
+ */
 
 #include <config.h>
 
@@ -109,7 +126,7 @@ lwresaddr2af(int lwresaddrtype)
 }
 
 
-/*
+/*!
  * Eat characters from FP until EOL or EOF. Returns EOF or '\n'
  */
 static int
@@ -124,7 +141,7 @@ eatline(FILE *fp) {
 }
 
 
-/*
+/*!
  * Eats white space up to next newline or non-whitespace character (of
  * EOF). Returns the last character read. Comments are considered white
  * space.
@@ -144,7 +161,7 @@ eatwhite(FILE *fp) {
 }
 
 
-/*
+/*!
  * Skip over any leading whitespace and then read in the next sequence of
  * non-whitespace characters. In this context newline is not considered
  * whitespace. Returns EOF on end-of-file, or the character
@@ -203,6 +220,7 @@ lwres_strdup(lwres_context_t *ctx, const char *str) {
 	return (p);
 }
 
+/*% intializes data structure for subsequent config parsing. */
 void
 lwres_conf_init(lwres_context_t *ctx) {
 	int i;
@@ -232,6 +250,7 @@ lwres_conf_init(lwres_context_t *ctx) {
 	}
 }
 
+/*% Frees up all the internal memory used by the config data structure, returning it to the lwres_context_t. */
 void
 lwres_conf_clear(lwres_context_t *ctx) {
 	int i;
@@ -542,6 +561,7 @@ lwres_conf_parseoption(lwres_context_t *ctx,  FILE *fp) {
 	return (LWRES_R_SUCCESS);
 }
 
+/*% parses a file and fills in the data structure. */
 lwres_result_t
 lwres_conf_parse(lwres_context_t *ctx, const char *filename) {
 	FILE *fp = NULL;
@@ -600,6 +620,7 @@ lwres_conf_parse(lwres_context_t *ctx, const char *filename) {
 	return (ret);
 }
 
+/*% Prints the config data structure to the FILE. */
 lwres_result_t
 lwres_conf_print(lwres_context_t *ctx, FILE *fp) {
 	int i;
@@ -695,6 +716,7 @@ lwres_conf_print(lwres_context_t *ctx, FILE *fp) {
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Returns a pointer to the current config structure. */
 lwres_conf_t *
 lwres_conf_get(lwres_context_t *ctx) {
 	REQUIRE(ctx != NULL);
diff --git a/contrib/bind9/lib/lwres/lwinetaton.c b/contrib/bind9/lib/lwres/lwinetaton.c
index aa63027..cc4b9bd 100644
--- a/contrib/bind9/lib/lwres/lwinetaton.c
+++ b/contrib/bind9/lib/lwres/lwinetaton.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1996-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -68,9 +68,11 @@
  * SOFTWARE.
  */
 
+/*! \file lwinetaton.c
+ */
 #if defined(LIBC_SCCS) && !defined(lint)
 static char sccsid[] = "@(#)inet_addr.c	8.1 (Berkeley) 6/17/93";
-static char rcsid[] = "$Id: lwinetaton.c,v 1.10.2.1.2.1 2004/03/06 08:15:32 marka Exp $";
+static char rcsid[] = "$Id: lwinetaton.c,v 1.12.18.2 2005/04/29 00:17:19 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -84,7 +86,7 @@ static char rcsid[] = "$Id: lwinetaton.c,v 1.10.2.1.2.1 2004/03/06 08:15:32 mark
 
 #include "assert_p.h"
 
-/*
+/*!
  * Check whether "cp" is a valid ascii representation
  * of an Internet address and convert to a binary address.
  * Returns 1 if the address is valid, 0 if not.
diff --git a/contrib/bind9/lib/lwres/lwinetntop.c b/contrib/bind9/lib/lwres/lwinetntop.c
index 78cd0b0..e65656f 100644
--- a/contrib/bind9/lib/lwres/lwinetntop.c
+++ b/contrib/bind9/lib/lwres/lwinetntop.c
@@ -15,9 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/*! \file lwinetntop.c
+ */
 #if defined(LIBC_SCCS) && !defined(lint)
 static char rcsid[] =
-	"$Id: lwinetntop.c,v 1.9.12.5 2005/11/04 00:16:34 marka Exp $";
+	"$Id: lwinetntop.c,v 1.12.18.4 2005/11/03 23:02:24 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -45,7 +47,7 @@ static const char *inet_ntop6(const unsigned char *src, char *dst,
 			      size_t size);
 #endif
 
-/* char *
+/*! char *
  * lwres_net_ntop(af, src, dst, size)
  *	convert a network format address to presentation format.
  * return:
@@ -69,7 +71,7 @@ lwres_net_ntop(int af, const void *src, char *dst, size_t size) {
 	/* NOTREACHED */
 }
 
-/* const char *
+/*! const char *
  * inet_ntop4(src, dst, size)
  *	format an IPv4 address
  * return:
@@ -96,7 +98,7 @@ inet_ntop4(const unsigned char *src, char *dst, size_t size) {
 	return (dst);
 }
 
-/* const char *
+/*! const char *
  * inet_ntop6(src, dst, size)
  *	convert IPv6 binary address into presentation (printable) format
  * author:
@@ -105,7 +107,7 @@ inet_ntop4(const unsigned char *src, char *dst, size_t size) {
 #ifdef AF_INET6
 static const char *
 inet_ntop6(const unsigned char *src, char *dst, size_t size) {
-	/*
+	/*!
 	 * Note that int32_t and int16_t need only be "at least" large enough
 	 * to contain a value of the specified size.  On some systems, like
 	 * Crays, there is no such thing as an integer variable with 16 bits.
diff --git a/contrib/bind9/lib/lwres/lwinetpton.c b/contrib/bind9/lib/lwres/lwinetpton.c
index e24334b..5155fd1 100644
--- a/contrib/bind9/lib/lwres/lwinetpton.c
+++ b/contrib/bind9/lib/lwres/lwinetpton.c
@@ -15,8 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
+/*! \file lwinetpton.c
+ */
+
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$Id: lwinetpton.c,v 1.6.206.3 2005/03/31 23:56:15 marka Exp $";
+static char rcsid[] = "$Id: lwinetpton.c,v 1.7.18.3 2005/04/27 05:02:48 sra Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
@@ -38,7 +41,8 @@ static char rcsid[] = "$Id: lwinetpton.c,v 1.6.206.3 2005/03/31 23:56:15 marka E
 static int inet_pton4(const char *src, unsigned char *dst);
 static int inet_pton6(const char *src, unsigned char *dst);
 
-/* int
+/*! 
+ * int
  * lwres_net_pton(af, src, dst)
  *	convert from presentation format (which usually means ASCII printable)
  *	to network format (which is usually some kind of binary format).
@@ -63,7 +67,7 @@ lwres_net_pton(int af, const char *src, void *dst) {
 	/* NOTREACHED */
 }
 
-/* int
+/*! int
  * inet_pton4(src, dst)
  *	like inet_aton() but without all the hexadecimal and shorthand.
  * return:
@@ -110,7 +114,7 @@ inet_pton4(const char *src, unsigned char *dst) {
 	return (1);
 }
 
-/* int
+/*! int
  * inet_pton6(src, dst)
  *	convert presentation level address to network order binary form.
  * return:
diff --git a/contrib/bind9/lib/lwres/lwpacket.c b/contrib/bind9/lib/lwres/lwpacket.c
index 6e28df0..964b465 100644
--- a/contrib/bind9/lib/lwres/lwpacket.c
+++ b/contrib/bind9/lib/lwres/lwpacket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,46 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwpacket.c,v 1.13.206.1 2004/03/06 08:15:32 marka Exp $ */
+/* $Id: lwpacket.c,v 1.14.18.2 2005/04/29 00:17:19 marka Exp $ */
+
+/*! \file */
+
+/**
+ *    These functions rely on a struct lwres_lwpacket which is defined in
+ *    \link lwpacket.h lwres/lwpacket.h.\endlink
+ * 
+ *    The following opcodes are currently defined:   
+ * 
+ * \li   #LWRES_OPCODE_NOOP
+ *           Success is always returned and the packet contents are
+ *           echoed. The \link lwres_noop.c lwres_noop_*()\endlink functions should be used for this
+ *           type.
+ * 
+ * \li   #LWRES_OPCODE_GETADDRSBYNAME
+ *           returns all known addresses for a given name. The
+ *           \link lwres_gabn.c lwres_gabn_*()\endlink functions should be used for this type.
+ * 
+ * \li   #LWRES_OPCODE_GETNAMEBYADDR
+ *           return the hostname for the given address. The
+ *           \link lwres_gnba.c lwres_gnba_*() \endlink functions should be used for this type.     
+ * 
+ *    lwres_lwpacket_renderheader() transfers the contents of lightweight
+ *    resolver packet structure #lwres_lwpacket_t *pkt in network byte
+ *    order to the lightweight resolver buffer, *b.
+ * 
+ *    lwres_lwpacket_parseheader() performs the converse operation. It
+ *    transfers data in network byte order from buffer *b to resolver
+ *    packet *pkt. The contents of the buffer b should correspond to a   
+ *    #lwres_lwpacket_t.
+ * 
+ * \section lwpacket_return Return Values
+ * 
+ *    Successful calls to lwres_lwpacket_renderheader() and
+ *    lwres_lwpacket_parseheader() return #LWRES_R_SUCCESS. If there is
+ *    insufficient space to copy data between the buffer *b and
+ *    lightweight resolver packet *pkt both functions return
+ *    #LWRES_R_UNEXPECTEDEND.
+ */
 
 #include <config.h>
 
@@ -29,9 +68,12 @@
 
 #include "assert_p.h"
 
+/*% Length of Packet */
 #define LWPACKET_LENGTH \
 	(sizeof(lwres_uint16_t) * 4 + sizeof(lwres_uint32_t) * 5)
 
+/*% transfers the contents of lightweight resolver packet structure lwres_lwpacket_t *pkt in network byte order to the lightweight resolver buffer, *b. */
+
 lwres_result_t
 lwres_lwpacket_renderheader(lwres_buffer_t *b, lwres_lwpacket_t *pkt) {
 	REQUIRE(b != NULL);
@@ -53,6 +95,8 @@ lwres_lwpacket_renderheader(lwres_buffer_t *b, lwres_lwpacket_t *pkt) {
 	return (LWRES_R_SUCCESS);
 }
 
+/*% transfers data in network byte order from buffer *b to resolver packet *pkt. The contents of the buffer b should correspond to a lwres_lwpacket_t. */
+
 lwres_result_t
 lwres_lwpacket_parseheader(lwres_buffer_t *b, lwres_lwpacket_t *pkt) {
 	lwres_uint32_t space;
diff --git a/contrib/bind9/lib/lwres/lwres_gabn.c b/contrib/bind9/lib/lwres/lwres_gabn.c
index 9df87ce..c6f1139 100644
--- a/contrib/bind9/lib/lwres/lwres_gabn.c
+++ b/contrib/bind9/lib/lwres/lwres_gabn.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,92 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwres_gabn.c,v 1.27.12.3 2004/03/08 09:05:10 marka Exp $ */
+/* $Id: lwres_gabn.c,v 1.29.18.2 2005/04/29 00:17:19 marka Exp $ */
+
+/*! \file lwres_gabn.c
+   These are low-level routines for creating and parsing lightweight
+   resolver name-to-address lookup request and response messages.
+
+   There are four main functions for the getaddrbyname opcode. One render
+   function converts a getaddrbyname request structure --
+   lwres_gabnrequest_t -- to the lighweight resolver's canonical format.
+   It is complemented by a parse function that converts a packet in this
+   canonical format to a getaddrbyname request structure. Another render
+   function converts the getaddrbyname response structure --
+   lwres_gabnresponse_t -- to the canonical format. This is complemented
+   by a parse function which converts a packet in canonical format to a
+   getaddrbyname response structure.
+
+   These structures are defined in \link lwres.h <lwres/lwres.h>.\endlink They are shown below.
+
+\code
+#define LWRES_OPCODE_GETADDRSBYNAME     0x00010001U
+
+typedef struct lwres_addr lwres_addr_t;
+typedef LWRES_LIST(lwres_addr_t) lwres_addrlist_t;
+
+typedef struct {
+        lwres_uint32_t  flags;
+        lwres_uint32_t  addrtypes;
+        lwres_uint16_t  namelen;
+        char           *name;
+} lwres_gabnrequest_t;
+
+typedef struct {
+        lwres_uint32_t          flags;
+        lwres_uint16_t          naliases;
+        lwres_uint16_t          naddrs;
+        char                   *realname;
+        char                  **aliases;
+        lwres_uint16_t          realnamelen;
+        lwres_uint16_t         *aliaslen;
+        lwres_addrlist_t        addrs;
+        void                   *base;
+        size_t                  baselen;
+} lwres_gabnresponse_t;
+\endcode
+
+   lwres_gabnrequest_render() uses resolver context ctx to convert
+   getaddrbyname request structure req to canonical format. The packet
+   header structure pkt is initialised and transferred to buffer b. The
+   contents of *req are then appended to the buffer in canonical format.
+   lwres_gabnresponse_render() performs the same task, except it converts
+   a getaddrbyname response structure lwres_gabnresponse_t to the
+   lightweight resolver's canonical format.
+
+   lwres_gabnrequest_parse() uses context ctx to convert the contents of
+   packet pkt to a lwres_gabnrequest_t structure. Buffer b provides space
+   to be used for storing this structure. When the function succeeds, the
+   resulting lwres_gabnrequest_t is made available through *structp.
+   lwres_gabnresponse_parse() offers the same semantics as
+   lwres_gabnrequest_parse() except it yields a lwres_gabnresponse_t
+   structure.
+
+   lwres_gabnresponse_free() and lwres_gabnrequest_free() release the
+   memory in resolver context ctx that was allocated to the
+   lwres_gabnresponse_t or lwres_gabnrequest_t structures referenced via
+   structp. Any memory associated with ancillary buffers and strings for
+   those structures is also discarded.
+
+\section lwres_gabn_return Return Values
+
+   The getaddrbyname opcode functions lwres_gabnrequest_render(),
+   lwres_gabnresponse_render() lwres_gabnrequest_parse() and
+   lwres_gabnresponse_parse() all return #LWRES_R_SUCCESS on success. They
+   return #LWRES_R_NOMEMORY if memory allocation fails.
+   #LWRES_R_UNEXPECTEDEND is returned if the available space in the buffer
+   b is too small to accommodate the packet header or the
+   lwres_gabnrequest_t and lwres_gabnresponse_t structures.
+   lwres_gabnrequest_parse() and lwres_gabnresponse_parse() will return
+   #LWRES_R_UNEXPECTEDEND if the buffer is not empty after decoding the
+   received packet. These functions will return #LWRES_R_FAILURE if
+   pktflags in the packet header structure #lwres_lwpacket_t indicate that
+   the packet is not a response to an earlier query.
+
+\section lwres_gabn_see See Also
+
+   \link lwpacket.c lwres_lwpacket \endlink
+ */
 
 #include <config.h>
 
@@ -31,6 +116,7 @@
 #include "context_p.h"
 #include "assert_p.h"
 
+/*% uses resolver context ctx to convert getaddrbyname request structure req to canonical format. */
 lwres_result_t
 lwres_gabnrequest_render(lwres_context_t *ctx, lwres_gabnrequest_t *req,
 			 lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -97,7 +183,7 @@ lwres_gabnrequest_render(lwres_context_t *ctx, lwres_gabnrequest_t *req,
 
 	return (LWRES_R_SUCCESS);
 }
-
+/*% converts a getaddrbyname response structure lwres_gabnresponse_t to the lightweight resolver's canonical format. */
 lwres_result_t
 lwres_gabnresponse_render(lwres_context_t *ctx, lwres_gabnresponse_t *req,
 			  lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -194,7 +280,7 @@ lwres_gabnresponse_render(lwres_context_t *ctx, lwres_gabnresponse_t *req,
 
 	return (LWRES_R_SUCCESS);
 }
-
+/*% Uses context ctx to convert the contents of packet pkt to a lwres_gabnrequest_t structure. */
 lwres_result_t
 lwres_gabnrequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			lwres_lwpacket_t *pkt, lwres_gabnrequest_t **structp)
@@ -243,6 +329,8 @@ lwres_gabnrequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Offers the same semantics as lwres_gabnrequest_parse() except it yields a lwres_gabnresponse_t structure. */
+
 lwres_result_t
 lwres_gabnresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			lwres_lwpacket_t *pkt, lwres_gabnresponse_t **structp)
@@ -372,6 +460,7 @@ lwres_gabnresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (ret);
 }
 
+/*% Release the memory in resolver context ctx that was allocated to the lwres_gabnrequest_t. */
 void
 lwres_gabnrequest_free(lwres_context_t *ctx, lwres_gabnrequest_t **structp)
 {
@@ -386,6 +475,7 @@ lwres_gabnrequest_free(lwres_context_t *ctx, lwres_gabnrequest_t **structp)
 	CTXFREE(gabn, sizeof(lwres_gabnrequest_t));
 }
 
+/*% Release the memory in resolver context ctx that was allocated to the lwres_gabnresponse_t. */
 void
 lwres_gabnresponse_free(lwres_context_t *ctx, lwres_gabnresponse_t **structp)
 {
diff --git a/contrib/bind9/lib/lwres/lwres_gnba.c b/contrib/bind9/lib/lwres/lwres_gnba.c
index a11c066..5f41648 100644
--- a/contrib/bind9/lib/lwres/lwres_gnba.c
+++ b/contrib/bind9/lib/lwres/lwres_gnba.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,88 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwres_gnba.c,v 1.20.2.2.8.4 2004/03/08 09:05:11 marka Exp $ */
+/* $Id: lwres_gnba.c,v 1.23.18.2 2005/04/29 00:17:20 marka Exp $ */
+
+/*! \file lwres_gnba.c
+   These are low-level routines for creating and parsing lightweight
+   resolver address-to-name lookup request and response messages.
+
+   There are four main functions for the getnamebyaddr opcode. One
+ render function converts a getnamebyaddr request structure --
+   lwres_gnbarequest_t -- to the lightweight resolver's canonical
+   format. It is complemented by a parse function that converts a
+   packet in this canonical format to a getnamebyaddr request
+   structure. Another render function converts the getnamebyaddr
+   response structure -- lwres_gnbaresponse_t to the canonical format.
+   This is complemented by a parse function which converts a packet in
+   canonical format to a getnamebyaddr response structure.       
+
+   These structures are defined in \link lwres.h <lwres/lwres.h.>\endlink They are shown
+   below.
+
+\code
+#define LWRES_OPCODE_GETNAMEBYADDR      0x00010002U
+
+typedef struct {
+        lwres_uint32_t  flags;
+        lwres_addr_t    addr;
+} lwres_gnbarequest_t;
+
+typedef struct {
+        lwres_uint32_t  flags;
+        lwres_uint16_t  naliases;
+        char           *realname;
+        char          **aliases;
+        lwres_uint16_t  realnamelen;
+        lwres_uint16_t *aliaslen;
+        void           *base;
+        size_t          baselen;
+} lwres_gnbaresponse_t;
+\endcode
+
+   lwres_gnbarequest_render() uses resolver context ctx to convert
+   getnamebyaddr request structure req to canonical format. The packet
+   header structure pkt is initialised and transferred to buffer b.
+   The contents of *req are then appended to the buffer in canonical
+   format. lwres_gnbaresponse_render() performs the same task, except
+   it converts a getnamebyaddr response structure lwres_gnbaresponse_t
+   to the lightweight resolver's canonical format.
+
+   lwres_gnbarequest_parse() uses context ctx to convert the contents
+   of packet pkt to a lwres_gnbarequest_t structure. Buffer b provides
+   space to be used for storing this structure. When the function
+   succeeds, the resulting lwres_gnbarequest_t is made available
+   through *structp. lwres_gnbaresponse_parse() offers the same   
+semantics as lwres_gnbarequest_parse() except it yields a    
+   lwres_gnbaresponse_t structure.
+
+   lwres_gnbaresponse_free() and lwres_gnbarequest_free() release the
+   memory in resolver context ctx that was allocated to the     
+   lwres_gnbaresponse_t or lwres_gnbarequest_t structures referenced  
+   via structp. Any memory associated with ancillary buffers and      
+   strings for those structures is also discarded.
+
+\section lwres_gbna_return Return Values
+
+   The getnamebyaddr opcode functions lwres_gnbarequest_render(),
+   lwres_gnbaresponse_render() lwres_gnbarequest_parse() and
+   lwres_gnbaresponse_parse() all return #LWRES_R_SUCCESS on success.
+   They return #LWRES_R_NOMEMORY if memory allocation fails.
+   #LWRES_R_UNEXPECTEDEND is returned if the available space in the
+   buffer b is too small to accommodate the packet header or the
+   lwres_gnbarequest_t and lwres_gnbaresponse_t structures.
+   lwres_gnbarequest_parse() and lwres_gnbaresponse_parse() will
+   return #LWRES_R_UNEXPECTEDEND if the buffer is not empty after
+   decoding the received packet. These functions will return
+   #LWRES_R_FAILURE if pktflags in the packet header structure
+   #lwres_lwpacket_t indicate that the packet is not a response to an
+   earlier query.
+
+\section lwres_gbna_see See Also
+
+   \link lwpacket.c lwres_packet\endlink
+
+ */
 
 #include <config.h>
 
@@ -31,6 +112,7 @@
 #include "context_p.h"
 #include "assert_p.h"
 
+/*% Uses resolver context ctx to convert getnamebyaddr request structure req to canonical format. */
 lwres_result_t
 lwres_gnbarequest_render(lwres_context_t *ctx, lwres_gnbarequest_t *req,
 			 lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -88,6 +170,7 @@ lwres_gnbarequest_render(lwres_context_t *ctx, lwres_gnbarequest_t *req,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Converts a getnamebyaddr response structure lwres_gnbaresponse_t to the lightweight resolver's canonical format. */
 lwres_result_t
 lwres_gnbaresponse_render(lwres_context_t *ctx, lwres_gnbaresponse_t *req,
 			  lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -159,6 +242,7 @@ lwres_gnbaresponse_render(lwres_context_t *ctx, lwres_gnbaresponse_t *req,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Uses context ctx to convert the contents of packet pkt to a lwres_gnbarequest_t structure. */
 lwres_result_t
 lwres_gnbarequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			lwres_lwpacket_t *pkt, lwres_gnbarequest_t **structp)
@@ -202,6 +286,8 @@ lwres_gnbarequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (ret);
 }
 
+/*% Offers the same semantics as lwres_gnbarequest_parse() except it yields a lwres_gnbaresponse_t structure. */
+
 lwres_result_t
 lwres_gnbaresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			 lwres_lwpacket_t *pkt, lwres_gnbaresponse_t **structp)
@@ -292,6 +378,7 @@ lwres_gnbaresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (ret);
 }
 
+/*% Release the memory in resolver context ctx that was allocated to the lwres_gnbarequest_t. */
 void
 lwres_gnbarequest_free(lwres_context_t *ctx, lwres_gnbarequest_t **structp)
 {
@@ -306,6 +393,7 @@ lwres_gnbarequest_free(lwres_context_t *ctx, lwres_gnbarequest_t **structp)
 	CTXFREE(gnba, sizeof(lwres_gnbarequest_t));
 }
 
+/*% Release the memory in resolver context ctx that was allocated to the lwres_gnbaresponse_t. */
 void
 lwres_gnbaresponse_free(lwres_context_t *ctx, lwres_gnbaresponse_t **structp)
 {
diff --git a/contrib/bind9/lib/lwres/lwres_grbn.c b/contrib/bind9/lib/lwres/lwres_grbn.c
index f8147fc..976708e 100644
--- a/contrib/bind9/lib/lwres/lwres_grbn.c
+++ b/contrib/bind9/lib/lwres/lwres_grbn.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,11 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwres_grbn.c,v 1.4.12.3 2004/03/08 09:05:11 marka Exp $ */
+/* $Id: lwres_grbn.c,v 1.6.18.2 2005/04/29 00:17:20 marka Exp $ */
+
+/*! \file lwres_grbn.c
+
+ */
 
 #include <config.h>
 
@@ -31,6 +35,7 @@
 #include "context_p.h"
 #include "assert_p.h"
 
+/*% Thread-save equivalent to \link lwres_gabn.c lwres_gabn* \endlink routines. */
 lwres_result_t
 lwres_grbnrequest_render(lwres_context_t *ctx, lwres_grbnrequest_t *req,
 			 lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -103,6 +108,7 @@ lwres_grbnrequest_render(lwres_context_t *ctx, lwres_grbnrequest_t *req,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Thread-save equivalent to \link lwres_gabn.c lwres_gabn* \endlink routines. */
 lwres_result_t
 lwres_grbnresponse_render(lwres_context_t *ctx, lwres_grbnresponse_t *req,
 			  lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -190,6 +196,7 @@ lwres_grbnresponse_render(lwres_context_t *ctx, lwres_grbnresponse_t *req,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Thread-save equivalent to \link lwres_gabn.c lwres_gabn* \endlink routines. */
 lwres_result_t
 lwres_grbnrequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			lwres_lwpacket_t *pkt, lwres_grbnrequest_t **structp)
@@ -243,6 +250,7 @@ lwres_grbnrequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Thread-save equivalent to \link lwres_gabn.c lwres_gabn* \endlink routines. */
 lwres_result_t
 lwres_grbnresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			lwres_lwpacket_t *pkt, lwres_grbnresponse_t **structp)
@@ -376,6 +384,7 @@ lwres_grbnresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (ret);
 }
 
+/*% Thread-save equivalent to \link lwres_gabn.c lwres_gabn* \endlink routines. */
 void
 lwres_grbnrequest_free(lwres_context_t *ctx, lwres_grbnrequest_t **structp)
 {
@@ -390,6 +399,7 @@ lwres_grbnrequest_free(lwres_context_t *ctx, lwres_grbnrequest_t **structp)
 	CTXFREE(grbn, sizeof(lwres_grbnrequest_t));
 }
 
+/*% Thread-save equivalent to \link lwres_gabn.c lwres_gabn* \endlink routines. */
 void
 lwres_grbnresponse_free(lwres_context_t *ctx, lwres_grbnresponse_t **structp)
 {
diff --git a/contrib/bind9/lib/lwres/lwres_noop.c b/contrib/bind9/lib/lwres/lwres_noop.c
index f67c2b3..e76bc4d 100644
--- a/contrib/bind9/lib/lwres/lwres_noop.c
+++ b/contrib/bind9/lib/lwres/lwres_noop.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,87 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwres_noop.c,v 1.14.206.1 2004/03/06 08:15:33 marka Exp $ */
+/* $Id: lwres_noop.c,v 1.15.18.2 2005/04/29 00:17:20 marka Exp $ */
+
+/*! \file */
+
+/**
+ *    These are low-level routines for creating and parsing lightweight
+ *    resolver no-op request and response messages.
+ * 
+ *    The no-op message is analogous to a ping packet: a packet is sent to
+ *    the resolver daemon and is simply echoed back. The opcode is intended
+ *    to allow a client to determine if the server is operational or not.
+ * 
+ *    There are four main functions for the no-op opcode. One render
+ *    function converts a no-op request structure -- lwres_nooprequest_t --
+ *    to the lighweight resolver's canonical format. It is complemented by a
+ *    parse function that converts a packet in this canonical format to a
+ *    no-op request structure. Another render function converts the no-op
+ *    response structure -- lwres_noopresponse_t to the canonical format.
+ *    This is complemented by a parse function which converts a packet in
+ *    canonical format to a no-op response structure.
+ * 
+ *    These structures are defined in \link lwres.h <lwres/lwres.h.> \endlink They are shown below.
+ * 
+ * \code
+ * #define LWRES_OPCODE_NOOP       0x00000000U
+ * 
+ * typedef struct {
+ *         lwres_uint16_t  datalength;
+ *         unsigned char   *data;
+ * } lwres_nooprequest_t;
+ * 
+ * typedef struct {
+ *         lwres_uint16_t  datalength;
+ *         unsigned char   *data;
+ * } lwres_noopresponse_t;
+ * \endcode
+ * 
+ *    Although the structures have different types, they are identical. This
+ *    is because the no-op opcode simply echos whatever data was sent: the
+ *    response is therefore identical to the request.
+ * 
+ *    lwres_nooprequest_render() uses resolver context ctx to convert no-op
+ *    request structure req to canonical format. The packet header structure
+ *    pkt is initialised and transferred to buffer b. The contents of *req
+ *    are then appended to the buffer in canonical format.
+ *    lwres_noopresponse_render() performs the same task, except it converts
+ *    a no-op response structure lwres_noopresponse_t to the lightweight
+ *    resolver's canonical format.
+ * 
+ *    lwres_nooprequest_parse() uses context ctx to convert the contents of
+ *    packet pkt to a lwres_nooprequest_t structure. Buffer b provides space
+ *    to be used for storing this structure. When the function succeeds, the
+ *    resulting lwres_nooprequest_t is made available through *structp.
+ *    lwres_noopresponse_parse() offers the same semantics as
+ *    lwres_nooprequest_parse() except it yields a lwres_noopresponse_t
+ *    structure.
+ * 
+ *    lwres_noopresponse_free() and lwres_nooprequest_free() release the
+ *    memory in resolver context ctx that was allocated to the
+ *    lwres_noopresponse_t or lwres_nooprequest_t structures referenced via
+ *    structp.
+ * 
+ * \section lwres_noop_return Return Values
+ * 
+ *    The no-op opcode functions lwres_nooprequest_render(),
+ *    lwres_noopresponse_render() lwres_nooprequest_parse() and
+ *    lwres_noopresponse_parse() all return #LWRES_R_SUCCESS on success. They
+ *    return #LWRES_R_NOMEMORY if memory allocation fails.
+ *    #LWRES_R_UNEXPECTEDEND is returned if the available space in the buffer
+ *    b is too small to accommodate the packet header or the
+ *    lwres_nooprequest_t and lwres_noopresponse_t structures.
+ *    lwres_nooprequest_parse() and lwres_noopresponse_parse() will return
+ *    #LWRES_R_UNEXPECTEDEND if the buffer is not empty after decoding the
+ *    received packet. These functions will return #LWRES_R_FAILURE if
+ *    pktflags in the packet header structure #lwres_lwpacket_t indicate that
+ *    the packet is not a response to an earlier query.
+ * 
+ * \section lwres_noop_see See Also
+ * 
+ *    lwpacket.c
+ */
 
 #include <config.h>
 
@@ -31,6 +111,7 @@
 #include "context_p.h"
 #include "assert_p.h"
 
+/*% Uses resolver context ctx to convert no-op request structure req to canonical format. */
 lwres_result_t
 lwres_nooprequest_render(lwres_context_t *ctx, lwres_nooprequest_t *req,
 			 lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -82,6 +163,8 @@ lwres_nooprequest_render(lwres_context_t *ctx, lwres_nooprequest_t *req,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Converts a no-op response structure lwres_noopresponse_t to the lightweight resolver's canonical format. */
+
 lwres_result_t
 lwres_noopresponse_render(lwres_context_t *ctx, lwres_noopresponse_t *req,
 			  lwres_lwpacket_t *pkt, lwres_buffer_t *b)
@@ -132,6 +215,7 @@ lwres_noopresponse_render(lwres_context_t *ctx, lwres_noopresponse_t *req,
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Uses context ctx to convert the contents of packet pkt to a lwres_nooprequest_t structure. */
 lwres_result_t
 lwres_nooprequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			lwres_lwpacket_t *pkt, lwres_nooprequest_t **structp)
@@ -179,6 +263,7 @@ lwres_nooprequest_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (ret);
 }
 
+/*% Offers the same semantics as lwres_nooprequest_parse() except it yields a lwres_noopresponse_t structure. */
 lwres_result_t
 lwres_noopresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 			 lwres_lwpacket_t *pkt, lwres_noopresponse_t **structp)
@@ -226,6 +311,7 @@ lwres_noopresponse_parse(lwres_context_t *ctx, lwres_buffer_t *b,
 	return (ret);
 }
 
+/*% Release the memory in resolver context ctx. */
 void
 lwres_noopresponse_free(lwres_context_t *ctx, lwres_noopresponse_t **structp)
 {
@@ -240,6 +326,7 @@ lwres_noopresponse_free(lwres_context_t *ctx, lwres_noopresponse_t **structp)
 	CTXFREE(noop, sizeof(lwres_noopresponse_t));
 }
 
+/*% Release the memory in resolver context ctx. */
 void
 lwres_nooprequest_free(lwres_context_t *ctx, lwres_nooprequest_t **structp)
 {
diff --git a/contrib/bind9/lib/lwres/lwresutil.c b/contrib/bind9/lib/lwres/lwresutil.c
index 1035f17..6d6764f 100644
--- a/contrib/bind9/lib/lwres/lwresutil.c
+++ b/contrib/bind9/lib/lwres/lwresutil.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,86 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwresutil.c,v 1.29.206.1 2004/03/06 08:15:33 marka Exp $ */
+/* $Id: lwresutil.c,v 1.30.18.2 2005/04/29 00:17:20 marka Exp $ */
+
+/*! \file */
+
+/**
+ *    lwres_string_parse() retrieves a DNS-encoded string starting the
+ *    current pointer of lightweight resolver buffer b: i.e. b->current.
+ *    When the function returns, the address of the first byte of the
+ *    encoded string is returned via *c and the length of that string is
+ *    given by *len. The buffer's current pointer is advanced to point at
+ *    the character following the string length, the encoded string, and
+ *    the trailing NULL character.
+ * 
+ *    lwres_addr_parse() extracts an address from the buffer b. The
+ *    buffer's current pointer b->current is presumed to point at an
+ *    encoded address: the address preceded by a 32-bit protocol family
+ *    identifier and a 16-bit length field. The encoded address is copied
+ *    to addr->address and addr->length indicates the size in bytes of
+ *    the address that was copied. b->current is advanced to point at the
+ *  next byte of available data in the buffer following the encoded
+ *    address.
+ * 
+ *    lwres_getaddrsbyname() and lwres_getnamebyaddr() use the
+ *    lwres_gnbaresponse_t structure defined below:
+ * 
+ * \code
+ * typedef struct {
+ *         lwres_uint32_t          flags;
+ *         lwres_uint16_t          naliases;
+ *         lwres_uint16_t          naddrs;
+ *         char                   *realname;
+ *         char                  **aliases;
+ *         lwres_uint16_t          realnamelen;
+ *         lwres_uint16_t         *aliaslen;
+ *         lwres_addrlist_t        addrs;
+ *         void                   *base;
+ *         size_t                  baselen;
+ * } lwres_gabnresponse_t;
+ * \endcode
+ * 
+ *    The contents of this structure are not manipulated directly but
+ *    they are controlled through the \link lwres_gabn.c lwres_gabn*\endlink functions.  
+ * 
+ *    The lightweight resolver uses lwres_getaddrsbyname() to perform
+ *    foward lookups. Hostname name is looked up using the resolver
+ *    context ctx for memory allocation. addrtypes is a bitmask      
+ *    indicating which type of addresses are to be looked up. Current
+ *    values for this bitmask are #LWRES_ADDRTYPE_V4 for IPv4 addresses
+ *    and #LWRES_ADDRTYPE_V6 for IPv6 addresses. Results of the lookup are
+ *    returned in *structp.
+ * 
+ *    lwres_getnamebyaddr() performs reverse lookups. Resolver context  
+ *    ctx is used for memory allocation. The address type is indicated by
+ *    addrtype: #LWRES_ADDRTYPE_V4 or #LWRES_ADDRTYPE_V6. The address to be
+ *    looked up is given by addr and its length is addrlen bytes. The    
+ *    result of the function call is made available through *structp.   
+ * 
+ * \section lwresutil_return Return Values
+ * 
+ *    Successful calls to lwres_string_parse() and lwres_addr_parse()
+ *    return #LWRES_R_SUCCESS. Both functions return #LWRES_R_FAILURE if 
+ *    the buffer is corrupt or #LWRES_R_UNEXPECTEDEND if the buffer has   
+ *    less space than expected for the components of the encoded string
+ *    or address.
+ * 
+ * lwres_getaddrsbyname() returns #LWRES_R_SUCCESS on success and it
+ *    returns #LWRES_R_NOTFOUND if the hostname name could not be found.
+ * 
+ *    #LWRES_R_SUCCESS is returned by a successful call to
+ *    lwres_getnamebyaddr().
+ * 
+ *    Both lwres_getaddrsbyname() and lwres_getnamebyaddr() return
+ *    #LWRES_R_NOMEMORY when memory allocation requests fail and
+ *    #LWRES_R_UNEXPECTEDEND if the buffers used for sending queries and
+ *    receiving replies are too small.     
+ * 
+ * \section lwresutil_see See Also
+ * 
+ *    lwbuffer.c, lwres_gabn.c
+ */
 
 #include <config.h>
 
@@ -31,7 +110,8 @@
 #include "assert_p.h"
 #include "context_p.h"
 
-/*
+/*% Parse data. */
+/*!
  * Requires:
  *
  *	The "current" pointer in "b" points to encoded raw data.
@@ -78,7 +158,8 @@ lwres_data_parse(lwres_buffer_t *b, unsigned char **p, lwres_uint16_t *len)
 	return (LWRES_R_SUCCESS);
 }
 
-/*
+/*% Retrieves a DNS-encoded string. */
+/*!
  * Requires:
  *
  *	The "current" pointer in "b" point to an encoded string.
@@ -133,6 +214,7 @@ lwres_string_parse(lwres_buffer_t *b, char **c, lwres_uint16_t *len)
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Extracts an address from the buffer b. */
 lwres_result_t
 lwres_addr_parse(lwres_buffer_t *b, lwres_addr_t *addr)
 {
@@ -154,6 +236,7 @@ lwres_addr_parse(lwres_buffer_t *b, lwres_addr_t *addr)
 	return (LWRES_R_SUCCESS);
 }
 
+/*% Used to perform forward lookups. */
 lwres_result_t
 lwres_getaddrsbyname(lwres_context_t *ctx, const char *name,
 		     lwres_uint32_t addrtypes, lwres_gabnresponse_t **structp)
@@ -268,6 +351,7 @@ lwres_getaddrsbyname(lwres_context_t *ctx, const char *name,
 }
 
 
+/*% Used to perform reverse lookups. */
 lwres_result_t
 lwres_getnamebyaddr(lwres_context_t *ctx, lwres_uint32_t addrtype,
 		    lwres_uint16_t addrlen, const unsigned char *addr,
@@ -376,6 +460,7 @@ lwres_getnamebyaddr(lwres_context_t *ctx, lwres_uint32_t addrtype,
 	return (ret);
 }
 
+/*% Get rdata by name. */
 lwres_result_t
 lwres_getrdatabyname(lwres_context_t *ctx, const char *name,
 		     lwres_uint16_t rdclass, lwres_uint16_t rdtype,
diff --git a/contrib/bind9/lib/lwres/man/Makefile.in b/contrib/bind9/lib/lwres/man/Makefile.in
index a591a2a..e28123c 100644
--- a/contrib/bind9/lib/lwres/man/Makefile.in
+++ b/contrib/bind9/lib/lwres/man/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.6.206.1 2004/03/06 08:15:36 marka Exp $
+# $Id: Makefile.in,v 1.7 2004/03/05 05:12:55 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/lwres/man/lwres.3 b/contrib/bind9/lib/lwres/man/lwres.3
index 886f1f1..968e8f8 100644
--- a/contrib/bind9/lib/lwres/man/lwres.3
+++ b/contrib/bind9/lib/lwres/man/lwres.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres.3,v 1.15.206.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres.3,v 1.17.18.11 2007/01/30 00:23:44 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -159,4 +159,7 @@ bit should be set.
 \fBresolver\fR(5),
 \fBlwresd\fR(8).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres.docbook b/contrib/bind9/lib/lwres/man/lwres.docbook
index 83258a9..2a94ec8 100644
--- a/contrib/bind9/lib/lwres/man/lwres.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,23 +18,28 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres.docbook,v 1.3.206.3 2005/05/12 21:36:11 sra Exp $ -->
-
+<!-- $Id: lwres.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
-<refentryinfo>
 
-<date>Jun 30, 2000</date>
-</refentryinfo>
-<refmeta>
-<refentrytitle>lwres</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
+
+  <refmeta>
+    <refentrytitle>lwres</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
+  <refnamediv>
+    <refname>lwres</refname>
+    <refpurpose>introduction to the lightweight resolver library</refpurpose>
+  </refnamediv>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -44,217 +49,218 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres</refname>
-<refpurpose>introduction to the lightweight resolver library</refpurpose>
-</refnamediv>
-
-<refsynopsisdiv>
-<funcsynopsis>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/lwres.h&gt;</funcsynopsisinfo>
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-The BIND 9 lightweight resolver library is a simple, name service
-independent stub resolver library.  It provides hostname-to-address
-and address-to-hostname lookup services to applications by
-transmitting lookup requests to a resolver daemon
-<command>lwresd</command>
-running on the local host. The resover daemon performs the
-lookup using the DNS or possibly other name service protocols,
-and returns the results to the application through the library.  
-The library and resolver daemon communicate using a simple
-UDP-based protocol.
-</para>
-</refsect1>
+  <refsect1>
+    <title>DESCRIPTION</title>
+    <para>
+      The BIND 9 lightweight resolver library is a simple, name service
+      independent stub resolver library.  It provides hostname-to-address
+      and address-to-hostname lookup services to applications by
+      transmitting lookup requests to a resolver daemon
+      <command>lwresd</command>
+      running on the local host. The resover daemon performs the
+      lookup using the DNS or possibly other name service protocols,
+      and returns the results to the application through the library.
+      The library and resolver daemon communicate using a simple
+      UDP-based protocol.
+    </para>
+  </refsect1>
 
-<refsect1>
-<title>OVERVIEW</title>
-<para>
-The lwresd library implements multiple name service APIs.
-The standard
-<function>gethostbyname()</function>,
-<function>gethostbyaddr()</function>,
-<function>gethostbyname_r()</function>,
-<function>gethostbyaddr_r()</function>,
-<function>getaddrinfo()</function>,
-<function>getipnodebyname()</function>,
-and
-<function>getipnodebyaddr()</function>
-functions are all supported.  To allow the lwres library to coexist
-with system libraries that define functions of the same name,
-the library defines these functions with names prefixed by
-<literal>lwres_</literal>.
-To define the standard names, applications must include the
-header file
-<filename>&lt;lwres/netdb.h&gt;</filename>
-which contains macro definitions mapping the standard function names
-into
-<literal>lwres_</literal>
-prefixed ones.  Operating system vendors who integrate the lwres
-library into their base distributions should rename the functions
-in the library proper so that the renaming macros are not needed.
-</para>
-<para>
-The library also provides a native API consisting of the functions
-<function>lwres_getaddrsbyname()</function>
-and
-<function>lwres_getnamebyaddr()</function>.
-These may be called by applications that require more detailed
-control over the lookup process than the standard functions
-provide.
-</para>
-<para>
-In addition to these name service independent address lookup
-functions, the library implements a new, experimental API
-for looking up arbitrary DNS resource records, using the
-<function>lwres_getaddrsbyname()</function>
-function.
-</para>
-<para>
-Finally, there is a low-level API for converting lookup
-requests and responses to and from raw lwres protocol packets.  
-This API can be used by clients requiring nonblocking operation, 
-and is also used when implementing the server side of the lwres
-protocol, for example in the
-<command>lwresd</command>
-resolver daemon.  The use of this low-level API in clients
-and servers is outlined in the following sections.
-</para>
-</refsect1>
-<refsect1>
-<title>CLIENT-SIDE LOW-LEVEL API CALL FLOW</title>
-<para>
-When a client program wishes to make an lwres request using the
-native low-level API, it typically performs the following 
-sequence of actions.
-</para>
-<para>
-(1) Allocate or use an existing <type>lwres_packet_t</type>,
-called <varname>pkt</varname> below.
-</para>
-<para>
-(2) Set <structfield>pkt.recvlength</structfield> to the maximum length we will accept.  
-This is done so the receiver of our packets knows how large our receive 
-buffer is.  The "default" is a constant in
-<filename>lwres.h</filename>: <constant>LWRES_RECVLENGTH = 4096</constant>.
-</para>
-<para>
-(3) Set <structfield>pkt.serial</structfield>
-to a unique serial number.  This value is echoed
-back to the application by the remote server.
-</para>
-<para>
-(4) Set <structfield>pkt.pktflags</structfield>.  Usually this is set to 0.
-</para>
-<para>
-(5) Set <structfield>pkt.result</structfield> to 0.
-</para>
-<para>
-(6) Call <function>lwres_*request_render()</function>, 
-or marshall in the data using the primitives
-such as <function>lwres_packet_render()</function>
-and storing the packet data.
-</para>
-<para>
-(7) Transmit the resulting buffer.
-</para>
-<para>
-(8) Call <function>lwres_*response_parse()</function>
-to parse any packets received.
-</para>
-<para>
-(9) Verify that the opcode and serial match a request, and process the
-packet specific information contained in the body.
-</para>
-</refsect1>
-<refsect1>
-<title>SERVER-SIDE LOW-LEVEL API CALL FLOW</title>
-<para>
-When implementing the server side of the lightweight resolver
-protocol using the lwres library, a sequence of actions like the
-following is typically involved in processing each request packet.
-</para>
-<para>
-Note that the same <type>lwres_packet_t</type> is used
-in both the <function>_parse()</function> and <function>_render()</function> calls,
-with only a few modifications made
-to the packet header's contents between uses.  This method is recommended
-as it keeps the serial, opcode, and other fields correct.
-</para>
-<para>
-(1) When a packet is received, call <function>lwres_*request_parse()</function> to
-unmarshall it.  This returns a <type>lwres_packet_t</type> (also called <varname>pkt</varname>, below)
-as well as a data specific type, such as <type>lwres_gabnrequest_t</type>.
-</para>
-<para>
-(2) Process the request in the data specific type.
-</para>
-<para>
-(3) Set the <structfield>pkt.result</structfield>,
-<structfield>pkt.recvlength</structfield> as above.  All other fields can
-be left untouched since they were filled in by the <function>*_parse()</function> call
-above.  If using <function>lwres_*response_render()</function>,
-<structfield>pkt.pktflags</structfield> will be set up
-properly.  Otherwise, the <constant>LWRES_LWPACKETFLAG_RESPONSE</constant> bit should be
-set.
-</para>
-<para>
-(4) Call the data specific rendering function, such as
-<function>lwres_gabnresponse_render()</function>.
-</para>
-<para>
-(5) Send the resulting packet to the client.
-</para>
-<para>
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres_gethostent</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+  <refsect1>
+    <title>OVERVIEW</title>
+    <para>
+      The lwresd library implements multiple name service APIs.
+      The standard
+      <function>gethostbyname()</function>,
+      <function>gethostbyaddr()</function>,
+      <function>gethostbyname_r()</function>,
+      <function>gethostbyaddr_r()</function>,
+      <function>getaddrinfo()</function>,
+      <function>getipnodebyname()</function>,
+      and
+      <function>getipnodebyaddr()</function>
+      functions are all supported.  To allow the lwres library to coexist
+      with system libraries that define functions of the same name,
+      the library defines these functions with names prefixed by
+      <literal>lwres_</literal>.
+      To define the standard names, applications must include the
+      header file
+      <filename>&lt;lwres/netdb.h&gt;</filename>
+      which contains macro definitions mapping the standard function names
+      into
+      <literal>lwres_</literal>
+      prefixed ones.  Operating system vendors who integrate the lwres
+      library into their base distributions should rename the functions
+      in the library proper so that the renaming macros are not needed.
+    </para>
+    <para>
+      The library also provides a native API consisting of the functions
+      <function>lwres_getaddrsbyname()</function>
+      and
+      <function>lwres_getnamebyaddr()</function>.
+      These may be called by applications that require more detailed
+      control over the lookup process than the standard functions
+      provide.
+    </para>
+    <para>
+      In addition to these name service independent address lookup
+      functions, the library implements a new, experimental API
+      for looking up arbitrary DNS resource records, using the
+      <function>lwres_getaddrsbyname()</function>
+      function.
+    </para>
+    <para>
+      Finally, there is a low-level API for converting lookup
+      requests and responses to and from raw lwres protocol packets.
+      This API can be used by clients requiring nonblocking operation,
+      and is also used when implementing the server side of the lwres
+      protocol, for example in the
+      <command>lwresd</command>
+      resolver daemon.  The use of this low-level API in clients
+      and servers is outlined in the following sections.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>CLIENT-SIDE LOW-LEVEL API CALL FLOW</title>
+    <para>
+      When a client program wishes to make an lwres request using the
+      native low-level API, it typically performs the following
+      sequence of actions.
+    </para>
+    <para>
+      (1) Allocate or use an existing <type>lwres_packet_t</type>,
+      called <varname>pkt</varname> below.
+    </para>
+    <para>
+      (2) Set <structfield>pkt.recvlength</structfield> to the maximum length
+      we will accept.
+      This is done so the receiver of our packets knows how large our receive
+      buffer is.  The "default" is a constant in
+      <filename>lwres.h</filename>: <constant>LWRES_RECVLENGTH = 4096</constant>.
+    </para>
+    <para>
+      (3) Set <structfield>pkt.serial</structfield>
+      to a unique serial number.  This value is echoed
+      back to the application by the remote server.
+    </para>
+    <para>
+      (4) Set <structfield>pkt.pktflags</structfield>.  Usually this is set to
+      0.
+    </para>
+    <para>
+      (5) Set <structfield>pkt.result</structfield> to 0.
+    </para>
+    <para>
+      (6) Call <function>lwres_*request_render()</function>,
+      or marshall in the data using the primitives
+      such as <function>lwres_packet_render()</function>
+      and storing the packet data.
+    </para>
+    <para>
+      (7) Transmit the resulting buffer.
+    </para>
+    <para>
+      (8) Call <function>lwres_*response_parse()</function>
+      to parse any packets received.
+    </para>
+    <para>
+      (9) Verify that the opcode and serial match a request, and process the
+      packet specific information contained in the body.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SERVER-SIDE LOW-LEVEL API CALL FLOW</title>
+    <para>
+      When implementing the server side of the lightweight resolver
+      protocol using the lwres library, a sequence of actions like the
+      following is typically involved in processing each request packet.
+    </para>
+    <para>
+      Note that the same <type>lwres_packet_t</type> is used
+      in both the <function>_parse()</function> and <function>_render()</function> calls,
+      with only a few modifications made
+      to the packet header's contents between uses.  This method is
+      recommended
+      as it keeps the serial, opcode, and other fields correct.
+    </para>
+    <para>
+      (1) When a packet is received, call <function>lwres_*request_parse()</function> to
+      unmarshall it.  This returns a <type>lwres_packet_t</type> (also called <varname>pkt</varname>, below)
+      as well as a data specific type, such as <type>lwres_gabnrequest_t</type>.
+    </para>
+    <para>
+      (2) Process the request in the data specific type.
+    </para>
+    <para>
+      (3) Set the <structfield>pkt.result</structfield>,
+      <structfield>pkt.recvlength</structfield> as above.  All other fields
+      can
+      be left untouched since they were filled in by the <function>*_parse()</function> call
+      above.  If using <function>lwres_*response_render()</function>,
+      <structfield>pkt.pktflags</structfield> will be set up
+      properly.  Otherwise, the <constant>LWRES_LWPACKETFLAG_RESPONSE</constant> bit should be
+      set.
+    </para>
+    <para>
+      (4) Call the data specific rendering function, such as
+      <function>lwres_gabnresponse_render()</function>.
+    </para>
+    <para>
+      (5) Send the resulting packet to the client.
+    </para>
+    <para></para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres_gethostent</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_getipnode</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getipnode</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_getnameinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getnameinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_noop</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_noop</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_gabn</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_gabn</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_gnba</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_gnba</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_context</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_context</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_config</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_config</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>resolver</refentrytitle><manvolnum>5</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>resolver</refentrytitle><manvolnum>5</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwresd</refentrytitle><manvolnum>8</manvolnum>
-</citerefentry>.
+      <citerefentry>
+        <refentrytitle>lwresd</refentrytitle><manvolnum>8</manvolnum>
+      </citerefentry>.
 
-</para>
-</refsect1>
-</refentry>
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres.html b/contrib/bind9/lib/lwres/man/lwres.html
index 02af1f7..e4bbc09 100644
--- a/contrib/bind9/lib/lwres/man/lwres.html
+++ b/contrib/bind9/lib/lwres/man/lwres.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres.html,v 1.4.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres.html,v 1.5.18.18 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres &#8212; introduction to the lightweight resolver library</p>
@@ -32,185 +32,187 @@
 <div class="funcsynopsis"><pre class="funcsynopsisinfo">#include &lt;lwres/lwres.h&gt;</pre></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549397"></a><h2>DESCRIPTION</h2>
-<p>
-The BIND 9 lightweight resolver library is a simple, name service
-independent stub resolver library.  It provides hostname-to-address
-and address-to-hostname lookup services to applications by
-transmitting lookup requests to a resolver daemon
-<span><strong class="command">lwresd</strong></span>
-running on the local host. The resover daemon performs the
-lookup using the DNS or possibly other name service protocols,
-and returns the results to the application through the library.  
-The library and resolver daemon communicate using a simple
-UDP-based protocol.
-</p>
+<a name="id2543348"></a><h2>DESCRIPTION</h2>
+<p>
+      The BIND 9 lightweight resolver library is a simple, name service
+      independent stub resolver library.  It provides hostname-to-address
+      and address-to-hostname lookup services to applications by
+      transmitting lookup requests to a resolver daemon
+      <span><strong class="command">lwresd</strong></span>
+      running on the local host. The resover daemon performs the
+      lookup using the DNS or possibly other name service protocols,
+      and returns the results to the application through the library.
+      The library and resolver daemon communicate using a simple
+      UDP-based protocol.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549410"></a><h2>OVERVIEW</h2>
-<p>
-The lwresd library implements multiple name service APIs.
-The standard
-<code class="function">gethostbyname()</code>,
-<code class="function">gethostbyaddr()</code>,
-<code class="function">gethostbyname_r()</code>,
-<code class="function">gethostbyaddr_r()</code>,
-<code class="function">getaddrinfo()</code>,
-<code class="function">getipnodebyname()</code>,
-and
-<code class="function">getipnodebyaddr()</code>
-functions are all supported.  To allow the lwres library to coexist
-with system libraries that define functions of the same name,
-the library defines these functions with names prefixed by
-<code class="literal">lwres_</code>.
-To define the standard names, applications must include the
-header file
-<code class="filename">&lt;lwres/netdb.h&gt;</code>
-which contains macro definitions mapping the standard function names
-into
-<code class="literal">lwres_</code>
-prefixed ones.  Operating system vendors who integrate the lwres
-library into their base distributions should rename the functions
-in the library proper so that the renaming macros are not needed.
-</p>
-<p>
-The library also provides a native API consisting of the functions
-<code class="function">lwres_getaddrsbyname()</code>
-and
-<code class="function">lwres_getnamebyaddr()</code>.
-These may be called by applications that require more detailed
-control over the lookup process than the standard functions
-provide.
-</p>
-<p>
-In addition to these name service independent address lookup
-functions, the library implements a new, experimental API
-for looking up arbitrary DNS resource records, using the
-<code class="function">lwres_getaddrsbyname()</code>
-function.
-</p>
-<p>
-Finally, there is a low-level API for converting lookup
-requests and responses to and from raw lwres protocol packets.  
-This API can be used by clients requiring nonblocking operation, 
-and is also used when implementing the server side of the lwres
-protocol, for example in the
-<span><strong class="command">lwresd</strong></span>
-resolver daemon.  The use of this low-level API in clients
-and servers is outlined in the following sections.
-</p>
+<a name="id2543361"></a><h2>OVERVIEW</h2>
+<p>
+      The lwresd library implements multiple name service APIs.
+      The standard
+      <code class="function">gethostbyname()</code>,
+      <code class="function">gethostbyaddr()</code>,
+      <code class="function">gethostbyname_r()</code>,
+      <code class="function">gethostbyaddr_r()</code>,
+      <code class="function">getaddrinfo()</code>,
+      <code class="function">getipnodebyname()</code>,
+      and
+      <code class="function">getipnodebyaddr()</code>
+      functions are all supported.  To allow the lwres library to coexist
+      with system libraries that define functions of the same name,
+      the library defines these functions with names prefixed by
+      <code class="literal">lwres_</code>.
+      To define the standard names, applications must include the
+      header file
+      <code class="filename">&lt;lwres/netdb.h&gt;</code>
+      which contains macro definitions mapping the standard function names
+      into
+      <code class="literal">lwres_</code>
+      prefixed ones.  Operating system vendors who integrate the lwres
+      library into their base distributions should rename the functions
+      in the library proper so that the renaming macros are not needed.
+    </p>
+<p>
+      The library also provides a native API consisting of the functions
+      <code class="function">lwres_getaddrsbyname()</code>
+      and
+      <code class="function">lwres_getnamebyaddr()</code>.
+      These may be called by applications that require more detailed
+      control over the lookup process than the standard functions
+      provide.
+    </p>
+<p>
+      In addition to these name service independent address lookup
+      functions, the library implements a new, experimental API
+      for looking up arbitrary DNS resource records, using the
+      <code class="function">lwres_getaddrsbyname()</code>
+      function.
+    </p>
+<p>
+      Finally, there is a low-level API for converting lookup
+      requests and responses to and from raw lwres protocol packets.
+      This API can be used by clients requiring nonblocking operation,
+      and is also used when implementing the server side of the lwres
+      protocol, for example in the
+      <span><strong class="command">lwresd</strong></span>
+      resolver daemon.  The use of this low-level API in clients
+      and servers is outlined in the following sections.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549474"></a><h2>CLIENT-SIDE LOW-LEVEL API CALL FLOW</h2>
-<p>
-When a client program wishes to make an lwres request using the
-native low-level API, it typically performs the following 
-sequence of actions.
-</p>
-<p>
-(1) Allocate or use an existing <span class="type">lwres_packet_t</span>,
-called <code class="varname">pkt</code> below.
-</p>
-<p>
-(2) Set <em class="structfield"><code>pkt.recvlength</code></em> to the maximum length we will accept.  
-This is done so the receiver of our packets knows how large our receive 
-buffer is.  The "default" is a constant in
-<code class="filename">lwres.h</code>: <code class="constant">LWRES_RECVLENGTH = 4096</code>.
-</p>
-<p>
-(3) Set <em class="structfield"><code>pkt.serial</code></em>
-to a unique serial number.  This value is echoed
-back to the application by the remote server.
-</p>
-<p>
-(4) Set <em class="structfield"><code>pkt.pktflags</code></em>.  Usually this is set to 0.
-</p>
-<p>
-(5) Set <em class="structfield"><code>pkt.result</code></em> to 0.
-</p>
-<p>
-(6) Call <code class="function">lwres_*request_render()</code>, 
-or marshall in the data using the primitives
-such as <code class="function">lwres_packet_render()</code>
-and storing the packet data.
-</p>
-<p>
-(7) Transmit the resulting buffer.
-</p>
-<p>
-(8) Call <code class="function">lwres_*response_parse()</code>
-to parse any packets received.
-</p>
-<p>
-(9) Verify that the opcode and serial match a request, and process the
-packet specific information contained in the body.
-</p>
+<a name="id2543425"></a><h2>CLIENT-SIDE LOW-LEVEL API CALL FLOW</h2>
+<p>
+      When a client program wishes to make an lwres request using the
+      native low-level API, it typically performs the following
+      sequence of actions.
+    </p>
+<p>
+      (1) Allocate or use an existing <span class="type">lwres_packet_t</span>,
+      called <code class="varname">pkt</code> below.
+    </p>
+<p>
+      (2) Set <em class="structfield"><code>pkt.recvlength</code></em> to the maximum length
+      we will accept.
+      This is done so the receiver of our packets knows how large our receive
+      buffer is.  The "default" is a constant in
+      <code class="filename">lwres.h</code>: <code class="constant">LWRES_RECVLENGTH = 4096</code>.
+    </p>
+<p>
+      (3) Set <em class="structfield"><code>pkt.serial</code></em>
+      to a unique serial number.  This value is echoed
+      back to the application by the remote server.
+    </p>
+<p>
+      (4) Set <em class="structfield"><code>pkt.pktflags</code></em>.  Usually this is set to
+      0.
+    </p>
+<p>
+      (5) Set <em class="structfield"><code>pkt.result</code></em> to 0.
+    </p>
+<p>
+      (6) Call <code class="function">lwres_*request_render()</code>,
+      or marshall in the data using the primitives
+      such as <code class="function">lwres_packet_render()</code>
+      and storing the packet data.
+    </p>
+<p>
+      (7) Transmit the resulting buffer.
+    </p>
+<p>
+      (8) Call <code class="function">lwres_*response_parse()</code>
+      to parse any packets received.
+    </p>
+<p>
+      (9) Verify that the opcode and serial match a request, and process the
+      packet specific information contained in the body.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549689"></a><h2>SERVER-SIDE LOW-LEVEL API CALL FLOW</h2>
-<p>
-When implementing the server side of the lightweight resolver
-protocol using the lwres library, a sequence of actions like the
-following is typically involved in processing each request packet.
-</p>
-<p>
-Note that the same <span class="type">lwres_packet_t</span> is used
-in both the <code class="function">_parse()</code> and <code class="function">_render()</code> calls,
-with only a few modifications made
-to the packet header's contents between uses.  This method is recommended
-as it keeps the serial, opcode, and other fields correct.
-</p>
-<p>
-(1) When a packet is received, call <code class="function">lwres_*request_parse()</code> to
-unmarshall it.  This returns a <span class="type">lwres_packet_t</span> (also called <code class="varname">pkt</code>, below)
-as well as a data specific type, such as <span class="type">lwres_gabnrequest_t</span>.
-</p>
-<p>
-(2) Process the request in the data specific type.
-</p>
-<p>
-(3) Set the <em class="structfield"><code>pkt.result</code></em>,
-<em class="structfield"><code>pkt.recvlength</code></em> as above.  All other fields can
-be left untouched since they were filled in by the <code class="function">*_parse()</code> call
-above.  If using <code class="function">lwres_*response_render()</code>,
-<em class="structfield"><code>pkt.pktflags</code></em> will be set up
-properly.  Otherwise, the <code class="constant">LWRES_LWPACKETFLAG_RESPONSE</code> bit should be
-set.
-</p>
-<p>
-(4) Call the data specific rendering function, such as
-<code class="function">lwres_gabnresponse_render()</code>.
-</p>
-<p>
-(5) Send the resulting packet to the client.
-</p>
-<p>
-</p>
+<a name="id2543573"></a><h2>SERVER-SIDE LOW-LEVEL API CALL FLOW</h2>
+<p>
+      When implementing the server side of the lightweight resolver
+      protocol using the lwres library, a sequence of actions like the
+      following is typically involved in processing each request packet.
+    </p>
+<p>
+      Note that the same <span class="type">lwres_packet_t</span> is used
+      in both the <code class="function">_parse()</code> and <code class="function">_render()</code> calls,
+      with only a few modifications made
+      to the packet header's contents between uses.  This method is
+      recommended
+      as it keeps the serial, opcode, and other fields correct.
+    </p>
+<p>
+      (1) When a packet is received, call <code class="function">lwres_*request_parse()</code> to
+      unmarshall it.  This returns a <span class="type">lwres_packet_t</span> (also called <code class="varname">pkt</code>, below)
+      as well as a data specific type, such as <span class="type">lwres_gabnrequest_t</span>.
+    </p>
+<p>
+      (2) Process the request in the data specific type.
+    </p>
+<p>
+      (3) Set the <em class="structfield"><code>pkt.result</code></em>,
+      <em class="structfield"><code>pkt.recvlength</code></em> as above.  All other fields
+      can
+      be left untouched since they were filled in by the <code class="function">*_parse()</code> call
+      above.  If using <code class="function">lwres_*response_render()</code>,
+      <em class="structfield"><code>pkt.pktflags</code></em> will be set up
+      properly.  Otherwise, the <code class="constant">LWRES_LWPACKETFLAG_RESPONSE</code> bit should be
+      set.
+    </p>
+<p>
+      (4) Call the data specific rendering function, such as
+      <code class="function">lwres_gabnresponse_render()</code>.
+    </p>
+<p>
+      (5) Send the resulting packet to the client.
+    </p>
+<p></p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549774"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_gethostent</span>(3)</span>,
+<a name="id2543656"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_gethostent</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_getipnode</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getipnode</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_getnameinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getnameinfo</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_noop</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_noop</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_gabn</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_gabn</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_gnba</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_gnba</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_context</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_context</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_config</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_config</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>,
+      <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>.
+      <span class="citerefentry"><span class="refentrytitle">lwresd</span>(8)</span>.
 
-</p>
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_buffer.3 b/contrib/bind9/lib/lwres/man/lwres_buffer.3
index 6231237..4bebafa 100644
--- a/contrib/bind9/lib/lwres/man/lwres_buffer.3
+++ b/contrib/bind9/lib/lwres/man/lwres_buffer.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_buffer.3,v 1.12.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_buffer.3,v 1.15.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_buffer
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,37 +36,37 @@ lwres_buffer_init, lwres_buffer_invalidate, lwres_buffer_add, lwres_buffer_subtr
 #include <lwres/lwbuffer.h>
 .fi
 .HP 23
-.BI "void lwres_buffer_init(lwres_buffer_t\ *b, void\ *base, unsigned\ int\ length);"
+.BI "void lwres_buffer_init(lwres_buffer_t\ *" "b" ", void\ *" "base" ", unsigned\ int\ " "length" ");"
 .HP 29
-.BI "void lwres_buffer_invalidate(lwres_buffer_t\ *b);"
+.BI "void lwres_buffer_invalidate(lwres_buffer_t\ *" "b" ");"
 .HP 22
-.BI "void lwres_buffer_add(lwres_buffer_t\ *b, unsigned\ int\ n);"
+.BI "void lwres_buffer_add(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");"
 .HP 27
-.BI "void lwres_buffer_subtract(lwres_buffer_t\ *b, unsigned\ int\ n);"
+.BI "void lwres_buffer_subtract(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");"
 .HP 24
-.BI "void lwres_buffer_clear(lwres_buffer_t\ *b);"
+.BI "void lwres_buffer_clear(lwres_buffer_t\ *" "b" ");"
 .HP 24
-.BI "void lwres_buffer_first(lwres_buffer_t\ *b);"
+.BI "void lwres_buffer_first(lwres_buffer_t\ *" "b" ");"
 .HP 26
-.BI "void lwres_buffer_forward(lwres_buffer_t\ *b, unsigned\ int\ n);"
+.BI "void lwres_buffer_forward(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");"
 .HP 23
-.BI "void lwres_buffer_back(lwres_buffer_t\ *b, unsigned\ int\ n);"
+.BI "void lwres_buffer_back(lwres_buffer_t\ *" "b" ", unsigned\ int\ " "n" ");"
 .HP 36
-.BI "lwres_uint8_t lwres_buffer_getuint8(lwres_buffer_t\ *b);"
+.BI "lwres_uint8_t lwres_buffer_getuint8(lwres_buffer_t\ *" "b" ");"
 .HP 27
-.BI "void lwres_buffer_putuint8(lwres_buffer_t\ *b, lwres_uint8_t\ val);"
+.BI "void lwres_buffer_putuint8(lwres_buffer_t\ *" "b" ", lwres_uint8_t\ " "val" ");"
 .HP 38
-.BI "lwres_uint16_t lwres_buffer_getuint16(lwres_buffer_t\ *b);"
+.BI "lwres_uint16_t lwres_buffer_getuint16(lwres_buffer_t\ *" "b" ");"
 .HP 28
-.BI "void lwres_buffer_putuint16(lwres_buffer_t\ *b, lwres_uint16_t\ val);"
+.BI "void lwres_buffer_putuint16(lwres_buffer_t\ *" "b" ", lwres_uint16_t\ " "val" ");"
 .HP 38
-.BI "lwres_uint32_t lwres_buffer_getuint32(lwres_buffer_t\ *b);"
+.BI "lwres_uint32_t lwres_buffer_getuint32(lwres_buffer_t\ *" "b" ");"
 .HP 28
-.BI "void lwres_buffer_putuint32(lwres_buffer_t\ *b, lwres_uint32_t\ val);"
+.BI "void lwres_buffer_putuint32(lwres_buffer_t\ *" "b" ", lwres_uint32_t\ " "val" ");"
 .HP 25
-.BI "void lwres_buffer_putmem(lwres_buffer_t\ *b, const\ unsigned\ char\ *base, unsigned\ int\ length);"
+.BI "void lwres_buffer_putmem(lwres_buffer_t\ *" "b" ", const\ unsigned\ char\ *" "base" ", unsigned\ int\ " "length" ");"
 .HP 25
-.BI "void lwres_buffer_getmem(lwres_buffer_t\ *b, unsigned\ char\ *base, unsigned\ int\ length);"
+.BI "void lwres_buffer_getmem(lwres_buffer_t\ *" "b" ", unsigned\ char\ *" "base" ", unsigned\ int\ " "length" ");"
 .SH "DESCRIPTION"
 .PP
 These functions provide bounds checked access to a region of memory where data is being read or written. They are based on, and similar to, the
@@ -92,8 +92,7 @@ The
 \fIactive region\fR
 is an (optional) subregion of the remaining region. It extends from the current offset to an offset in the remaining region. Initially, the active region is empty. If the current offset advances beyond the chosen offset, the active region will also be empty.
 .PP
-.sp
-.RS 3n
+.RS 4
 .nf
    /\-\-\-\-\-\-\-\-\-\-\-\-entire length\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\\\\
    /\-\-\-\-\- used region \-\-\-\-\-\\\\/\-\- available \-\-\\\\
@@ -101,11 +100,23 @@ is an (optional) subregion of the remaining region. It extends from the current
    | consumed  | remaining |                |
    +\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-+
    a           b     c     d                e
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
   a == base of buffer.
   b == current pointer.  Can be anywhere between a and d.
   c == active pointer.  Meaningful between b and d.
   d == used pointer.
   e == length of buffer.
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
   a\-e == entire length of buffer.
   a\-d == used region.
   a\-b == consumed region.
@@ -146,8 +157,7 @@ used.
 .PP
 A buffer is re\-initialised by
 \fBlwres_buffer_clear()\fR. The function sets
-used
-,
+used,
 current
 and
 active
@@ -217,4 +227,7 @@ bytes of memory from
 to
 \fIbase\fR.
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_buffer.docbook b/contrib/bind9/lib/lwres/man/lwres_buffer.docbook
index c70aee5..ab0c560 100644
--- a/contrib/bind9/lib/lwres/man/lwres_buffer.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_buffer.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,23 +18,23 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_buffer.docbook,v 1.3.206.3 2005/05/12 21:36:11 sra Exp $ -->
-
+<!-- $Id: lwres_buffer.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_buffer</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_buffer</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -44,350 +44,351 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_buffer_init</refname>
-<refname>lwres_buffer_invalidate</refname>
-<refname>lwres_buffer_add</refname>
-<refname>lwres_buffer_subtract</refname>
-<refname>lwres_buffer_clear</refname>
-<refname>lwres_buffer_first</refname>
-<refname>lwres_buffer_forward</refname>
-<refname>lwres_buffer_back</refname>
-<refname>lwres_buffer_getuint8</refname>
-<refname>lwres_buffer_putuint8</refname>
-<refname>lwres_buffer_getuint16</refname>
-<refname>lwres_buffer_putuint16</refname>
-<refname>lwres_buffer_getuint32</refname>
-<refname>lwres_buffer_putuint32</refname>
-<refname>lwres_buffer_putmem</refname>
-<refname>lwres_buffer_getmem</refname>
-<refpurpose>lightweight resolver buffer management</refpurpose>
-</refnamediv>
+  <refnamediv>
+    <refname>lwres_buffer_init</refname>
+    <refname>lwres_buffer_invalidate</refname>
+    <refname>lwres_buffer_add</refname>
+    <refname>lwres_buffer_subtract</refname>
+    <refname>lwres_buffer_clear</refname>
+    <refname>lwres_buffer_first</refname>
+    <refname>lwres_buffer_forward</refname>
+    <refname>lwres_buffer_back</refname>
+    <refname>lwres_buffer_getuint8</refname>
+    <refname>lwres_buffer_putuint8</refname>
+    <refname>lwres_buffer_getuint16</refname>
+    <refname>lwres_buffer_putuint16</refname>
+    <refname>lwres_buffer_getuint32</refname>
+    <refname>lwres_buffer_putuint32</refname>
+    <refname>lwres_buffer_putmem</refname>
+    <refname>lwres_buffer_getmem</refname>
+    <refpurpose>lightweight resolver buffer management</refpurpose>
+  </refnamediv>
 
-<refsynopsisdiv>
+  <refsynopsisdiv>
 
-<funcsynopsis>
+    <funcsynopsis>
 <funcsynopsisinfo>
 #include &lt;lwres/lwbuffer.h&gt;
 </funcsynopsisinfo>
 
 <funcprototype>
 
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_init</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>void *base</paramdef>
-<paramdef>unsigned int length</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>void *<parameter>base</parameter></paramdef>
+        <paramdef>unsigned int <parameter>length</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_invalidate</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_add</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>unsigned int n</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>unsigned int <parameter>n</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_subtract</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>unsigned int n</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>unsigned int <parameter>n</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_clear</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_first</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_forward</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>unsigned int n</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>unsigned int <parameter>n</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
 
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_back</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>unsigned int n</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>unsigned int <parameter>n</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_uint8_t
 <function>lwres_buffer_getuint8</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_putuint8</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_uint8_t val</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_uint8_t <parameter>val</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_uint16_t
 <function>lwres_buffer_getuint16</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_putuint16</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_uint16_t val</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_uint16_t <parameter>val</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_uint32_t
 <function>lwres_buffer_getuint32</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_putuint32</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_uint32_t val</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_uint32_t <parameter>val</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_putmem</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>const unsigned char *base</paramdef>
-<paramdef>unsigned int length</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>const unsigned char *<parameter>base</parameter></paramdef>
+        <paramdef>unsigned int <parameter>length</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_buffer_getmem</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>unsigned char *base</paramdef>
-<paramdef>unsigned int length</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>unsigned char *<parameter>base</parameter></paramdef>
+        <paramdef>unsigned int <parameter>length</parameter></paramdef>
+      </funcprototype>
 
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
+  <refsect1>
 
-<title>DESCRIPTION</title>
-<para>
-These functions provide bounds checked access to a region of memory
-where data is being read or written.
-They are based on, and similar to, the
-<literal>isc_buffer_</literal>
-functions in the ISC library.
-</para>
-<para>
-A buffer is a region of memory, together with a set of related
-subregions.
-The <emphasis>used region</emphasis> and the
-<emphasis>available</emphasis> region are disjoint, and
-their union is the buffer's region.
-The used region extends from the beginning of the buffer region to the
-last used byte.
-The available region extends from one byte greater than the last used
-byte to the end of the  buffer's region.
-The size of the used region can be changed using various
-buffer commands.
-Initially, the used region is empty.
-</para>
-<para>
-The used region is further subdivided into two disjoint regions: the
-<emphasis>consumed region</emphasis> and the <emphasis>remaining region</emphasis>.
-The union of these two regions is the used region.
-The consumed region extends from the beginning of the used region to
-the byte before the <emphasis>current</emphasis> offset (if any).
-The <emphasis>remaining</emphasis> region the current pointer to the end of the used
-region.
-The size of the consumed region can be changed using various
-buffer commands.
-Initially, the consumed region is empty.
-</para>
-<para>
-The <emphasis>active region</emphasis> is an (optional) subregion of the remaining
-region.
-It extends from the current offset to an offset in the
-remaining region.
-Initially, the active region is empty.
-If the current offset advances beyond the chosen offset,
-the active region will also be empty.
-</para>
-<para>
-<programlisting>
- 
+    <title>DESCRIPTION</title>
+    <para>
+      These functions provide bounds checked access to a region of memory
+      where data is being read or written.
+      They are based on, and similar to, the
+      <literal>isc_buffer_</literal>
+      functions in the ISC library.
+    </para>
+    <para>
+      A buffer is a region of memory, together with a set of related
+      subregions.
+      The <emphasis>used region</emphasis> and the
+      <emphasis>available</emphasis> region are disjoint, and
+      their union is the buffer's region.
+      The used region extends from the beginning of the buffer region to the
+      last used byte.
+      The available region extends from one byte greater than the last used
+      byte to the end of the  buffer's region.
+      The size of the used region can be changed using various
+      buffer commands.
+      Initially, the used region is empty.
+    </para>
+    <para>
+      The used region is further subdivided into two disjoint regions: the
+      <emphasis>consumed region</emphasis> and the <emphasis>remaining region</emphasis>.
+      The union of these two regions is the used region.
+      The consumed region extends from the beginning of the used region to
+      the byte before the <emphasis>current</emphasis> offset (if any).
+      The <emphasis>remaining</emphasis> region the current pointer to the end
+      of the used
+      region.
+      The size of the consumed region can be changed using various
+      buffer commands.
+      Initially, the consumed region is empty.
+    </para>
+    <para>
+      The <emphasis>active region</emphasis> is an (optional) subregion of the
+      remaining
+      region.
+      It extends from the current offset to an offset in the
+      remaining region.
+      Initially, the active region is empty.
+      If the current offset advances beyond the chosen offset,
+      the active region will also be empty.
+    </para>
+    <para><programlisting>
    /------------entire length---------------\\
    /----- used region -----\\/-- available --\\
    +----------------------------------------+
    | consumed  | remaining |                |
    +----------------------------------------+
    a           b     c     d                e
- 
+      </programlisting>
+    </para>
+    <para><programlisting>
   a == base of buffer.
   b == current pointer.  Can be anywhere between a and d.
   c == active pointer.  Meaningful between b and d.
   d == used pointer.
   e == length of buffer.
- 
+      </programlisting>
+    </para>
+    <para><programlisting>
   a-e == entire length of buffer.
   a-d == used region.
   a-b == consumed region.
   b-d == remaining region.
   b-c == optional active region.
 </programlisting>
-</para>
-<para>
-<function>lwres_buffer_init()</function>
-initializes the
-<type>lwres_buffer_t</type>
-<parameter>*b</parameter>
-and assocates it with the memory region of size
-<parameter>length</parameter>
-bytes starting at location
-<parameter>base.</parameter>
-</para>
-<para>
-<function>lwres_buffer_invalidate()</function>
-marks the buffer
-<parameter>*b</parameter>
-as invalid.  Invalidating a buffer after use is not required,
-but makes it possible to catch its possible accidental use.
-</para>
-<para>
-The functions
-<function>lwres_buffer_add()</function>
-and
-<function>lwres_buffer_subtract()</function>
-respectively increase and decrease the used space in
-buffer
-<parameter>*b</parameter>
-by
-<parameter>n</parameter>
-bytes.
-<function>lwres_buffer_add()</function>
-checks for buffer overflow and
-<function>lwres_buffer_subtract()</function>
-checks for underflow.
-These functions do not allocate or deallocate memory.
-They just change the value of
-<structfield>used</structfield>.
-</para>
-<para>
-A buffer is re-initialised by
-<function>lwres_buffer_clear()</function>.
-The function sets
-<structfield>used</structfield> ,
-<structfield>current</structfield>
-and
-<structfield>active</structfield>
-to zero.
-</para>
-<para>
-<function>lwres_buffer_first</function>
-makes the consumed region of buffer
-<parameter>*p</parameter>
-empty by setting
-<structfield>current</structfield>
-to zero (the start of the buffer).
-</para>
-<para>
-<function>lwres_buffer_forward()</function>
-increases the consumed region of buffer
-<parameter>*b</parameter>
-by
-<parameter>n</parameter>
-bytes, checking for overflow.
-Similarly,
-<function>lwres_buffer_back()</function>
-decreases buffer
-<parameter>b</parameter>'s
-consumed region by
-<parameter>n</parameter>
-bytes and checks for underflow.
-</para>
-<para>
-<function>lwres_buffer_getuint8()</function>
-reads an unsigned 8-bit integer from
-<parameter>*b</parameter>
-and returns it.
-<function>lwres_buffer_putuint8()</function>
-writes the unsigned 8-bit integer
-<parameter>val</parameter>
-to buffer
-<parameter>*b</parameter>.
-</para>
-<para>
-<function>lwres_buffer_getuint16()</function>
-and
-<function>lwres_buffer_getuint32()</function>
-are identical to
-<function>lwres_buffer_putuint8()</function>
-except that they respectively read an unsigned 16-bit or 32-bit integer 
-in network byte order from
-<parameter>b</parameter>.
-Similarly,
-<function>lwres_buffer_putuint16()</function>
-and
-<function>lwres_buffer_putuint32()</function>
-writes the unsigned 16-bit or 32-bit integer
-<parameter>val</parameter>
-to buffer
-<parameter>b</parameter>,
-in network byte order.
-</para>
-<para>
-Arbitrary amounts of data are read or written from a lightweight
-resolver buffer with
-<function>lwres_buffer_getmem()</function>
-and
-<function>lwres_buffer_putmem()</function>
-respectively.
-<function>lwres_buffer_putmem()</function>
-copies
-<parameter>length</parameter>
-bytes of memory at
-<parameter>base</parameter>
-to
-<parameter>b</parameter>.
-Conversely,
-<function>lwres_buffer_getmem()</function>
-copies
-<parameter>length</parameter>
-bytes of memory from
-<parameter>b</parameter>
-to
-<parameter>base</parameter>.
-</para>
-</refsect1>
-</refentry>
+    </para>
+    <para><function>lwres_buffer_init()</function>
+      initializes the
+      <type>lwres_buffer_t</type>
+      <parameter>*b</parameter>
+      and assocates it with the memory region of size
+      <parameter>length</parameter>
+      bytes starting at location
+      <parameter>base.</parameter>
+    </para>
+    <para><function>lwres_buffer_invalidate()</function>
+      marks the buffer <parameter>*b</parameter>
+      as invalid.  Invalidating a buffer after use is not required,
+      but makes it possible to catch its possible accidental use.
+    </para>
+    <para>
+      The functions
+      <function>lwres_buffer_add()</function>
+      and
+      <function>lwres_buffer_subtract()</function>
+      respectively increase and decrease the used space in
+      buffer
+      <parameter>*b</parameter>
+      by
+      <parameter>n</parameter>
+      bytes.
+      <function>lwres_buffer_add()</function>
+      checks for buffer overflow and
+      <function>lwres_buffer_subtract()</function>
+      checks for underflow.
+      These functions do not allocate or deallocate memory.
+      They just change the value of
+      <structfield>used</structfield>.
+    </para>
+    <para>
+      A buffer is re-initialised by
+      <function>lwres_buffer_clear()</function>.
+      The function sets
+      <structfield>used</structfield>,
+      <structfield>current</structfield>
+      and
+      <structfield>active</structfield>
+      to zero.
+    </para>
+    <para><function>lwres_buffer_first</function>
+      makes the consumed region of buffer
+      <parameter>*p</parameter>
+      empty by setting
+      <structfield>current</structfield>
+      to zero (the start of the buffer).
+    </para>
+    <para><function>lwres_buffer_forward()</function>
+      increases the consumed region of buffer
+      <parameter>*b</parameter>
+      by
+      <parameter>n</parameter>
+      bytes, checking for overflow.
+      Similarly,
+      <function>lwres_buffer_back()</function>
+      decreases buffer
+      <parameter>b</parameter>'s
+      consumed region by
+      <parameter>n</parameter>
+      bytes and checks for underflow.
+    </para>
+    <para><function>lwres_buffer_getuint8()</function>
+      reads an unsigned 8-bit integer from
+      <parameter>*b</parameter>
+      and returns it.
+      <function>lwres_buffer_putuint8()</function>
+      writes the unsigned 8-bit integer
+      <parameter>val</parameter>
+      to buffer
+      <parameter>*b</parameter>.
+    </para>
+    <para><function>lwres_buffer_getuint16()</function>
+      and
+      <function>lwres_buffer_getuint32()</function>
+      are identical to
+      <function>lwres_buffer_putuint8()</function>
+      except that they respectively read an unsigned 16-bit or 32-bit integer
+      in network byte order from
+      <parameter>b</parameter>.
+      Similarly,
+      <function>lwres_buffer_putuint16()</function>
+      and
+      <function>lwres_buffer_putuint32()</function>
+      writes the unsigned 16-bit or 32-bit integer
+      <parameter>val</parameter>
+      to buffer
+      <parameter>b</parameter>,
+      in network byte order.
+    </para>
+    <para>
+      Arbitrary amounts of data are read or written from a lightweight
+      resolver buffer with
+      <function>lwres_buffer_getmem()</function>
+      and
+      <function>lwres_buffer_putmem()</function>
+      respectively.
+      <function>lwres_buffer_putmem()</function>
+      copies
+      <parameter>length</parameter>
+      bytes of memory at
+      <parameter>base</parameter>
+      to
+      <parameter>b</parameter>.
+      Conversely,
+      <function>lwres_buffer_getmem()</function>
+      copies
+      <parameter>length</parameter>
+      bytes of memory from
+      <parameter>b</parameter>
+      to
+      <parameter>base</parameter>.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_buffer.html b/contrib/bind9/lib/lwres/man/lwres_buffer.html
index 9443fbd..ed3e427 100644
--- a/contrib/bind9/lib/lwres/man/lwres_buffer.html
+++ b/contrib/bind9/lib/lwres/man/lwres_buffer.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_buffer.html,v 1.4.2.1.4.10 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_buffer.html,v 1.5.18.16 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_buffer</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_buffer_init, lwres_buffer_invalidate, lwres_buffer_add, lwres_buffer_subtract, lwres_buffer_clear, lwres_buffer_first, lwres_buffer_forward, lwres_buffer_back, lwres_buffer_getuint8, lwres_buffer_putuint8, lwres_buffer_getuint16, lwres_buffer_putuint16, lwres_buffer_getuint32, lwres_buffer_putuint32, lwres_buffer_putmem, lwres_buffer_getmem &#8212; lightweight resolver buffer management</p>
@@ -38,60 +38,45 @@
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_init</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>void * </td>
+<td>
+<var class="pdparam">base</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>unsigned int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">length</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_invalidate</b>(</code></td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">b</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_add</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>unsigned int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">n</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -99,71 +84,47 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_subtract</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>unsigned int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">n</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_clear</b>(</code></td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-</table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<var class="pdparam">b</var><code>)</code>;</td>
+</tr></table>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_first</b>(</code></td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">b</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_forward</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>unsigned int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">n</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -171,127 +132,87 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_back</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>unsigned int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">n</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 lwres_uint8_t
 <b class="fsfunc">lwres_buffer_getuint8</b>(</code></td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">b</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_putuint8</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_uint8_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">val</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 lwres_uint16_t
 <b class="fsfunc">lwres_buffer_getuint16</b>(</code></td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">b</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_putuint16</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_uint16_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">val</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 lwres_uint32_t
 <b class="fsfunc">lwres_buffer_getuint32</b>(</code></td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">b</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_putuint32</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_uint32_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">val</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -299,24 +220,21 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_putmem</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>const unsigned char * </td>
+<td>
+<var class="pdparam">base</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>unsigned int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">length</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
@@ -324,89 +242,91 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_buffer_getmem</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>unsigned char * </td>
+<td>
+<var class="pdparam">base</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>unsigned int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">length</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549674"></a><h2>DESCRIPTION</h2>
+<a name="id2543892"></a><h2>DESCRIPTION</h2>
 <p>
-These functions provide bounds checked access to a region of memory
-where data is being read or written.
-They are based on, and similar to, the
-<code class="literal">isc_buffer_</code>
-functions in the ISC library.
-</p>
+      These functions provide bounds checked access to a region of memory
+      where data is being read or written.
+      They are based on, and similar to, the
+      <code class="literal">isc_buffer_</code>
+      functions in the ISC library.
+    </p>
 <p>
-A buffer is a region of memory, together with a set of related
-subregions.
-The <span class="emphasis"><em>used region</em></span> and the
-<span class="emphasis"><em>available</em></span> region are disjoint, and
-their union is the buffer's region.
-The used region extends from the beginning of the buffer region to the
-last used byte.
-The available region extends from one byte greater than the last used
-byte to the end of the  buffer's region.
-The size of the used region can be changed using various
-buffer commands.
-Initially, the used region is empty.
-</p>
+      A buffer is a region of memory, together with a set of related
+      subregions.
+      The <span class="emphasis"><em>used region</em></span> and the
+      <span class="emphasis"><em>available</em></span> region are disjoint, and
+      their union is the buffer's region.
+      The used region extends from the beginning of the buffer region to the
+      last used byte.
+      The available region extends from one byte greater than the last used
+      byte to the end of the  buffer's region.
+      The size of the used region can be changed using various
+      buffer commands.
+      Initially, the used region is empty.
+    </p>
 <p>
-The used region is further subdivided into two disjoint regions: the
-<span class="emphasis"><em>consumed region</em></span> and the <span class="emphasis"><em>remaining region</em></span>.
-The union of these two regions is the used region.
-The consumed region extends from the beginning of the used region to
-the byte before the <span class="emphasis"><em>current</em></span> offset (if any).
-The <span class="emphasis"><em>remaining</em></span> region the current pointer to the end of the used
-region.
-The size of the consumed region can be changed using various
-buffer commands.
-Initially, the consumed region is empty.
-</p>
+      The used region is further subdivided into two disjoint regions: the
+      <span class="emphasis"><em>consumed region</em></span> and the <span class="emphasis"><em>remaining region</em></span>.
+      The union of these two regions is the used region.
+      The consumed region extends from the beginning of the used region to
+      the byte before the <span class="emphasis"><em>current</em></span> offset (if any).
+      The <span class="emphasis"><em>remaining</em></span> region the current pointer to the end
+      of the used
+      region.
+      The size of the consumed region can be changed using various
+      buffer commands.
+      Initially, the consumed region is empty.
+    </p>
 <p>
-The <span class="emphasis"><em>active region</em></span> is an (optional) subregion of the remaining
-region.
-It extends from the current offset to an offset in the
-remaining region.
-Initially, the active region is empty.
-If the current offset advances beyond the chosen offset,
-the active region will also be empty.
-</p>
-<p>
-</p>
+      The <span class="emphasis"><em>active region</em></span> is an (optional) subregion of the
+      remaining
+      region.
+      It extends from the current offset to an offset in the
+      remaining region.
+      Initially, the active region is empty.
+      If the current offset advances beyond the chosen offset,
+      the active region will also be empty.
+    </p>
 <pre class="programlisting">
- 
    /------------entire length---------------\\
    /----- used region -----\\/-- available --\\
    +----------------------------------------+
    | consumed  | remaining |                |
    +----------------------------------------+
    a           b     c     d                e
- 
+      </pre>
+<p>
+    </p>
+<pre class="programlisting">
   a == base of buffer.
   b == current pointer.  Can be anywhere between a and d.
   c == active pointer.  Meaningful between b and d.
   d == used pointer.
   e == length of buffer.
- 
+      </pre>
+<p>
+    </p>
+<pre class="programlisting">
   a-e == entire length of buffer.
   a-d == used region.
   a-b == consumed region.
@@ -414,129 +334,122 @@ the active region will also be empty.
   b-c == optional active region.
 </pre>
 <p>
-</p>
-<p>
-<code class="function">lwres_buffer_init()</code>
-initializes the
-<span class="type">lwres_buffer_t</span>
-<em class="parameter"><code>*b</code></em>
-and assocates it with the memory region of size
-<em class="parameter"><code>length</code></em>
-bytes starting at location
-<em class="parameter"><code>base.</code></em>
-</p>
-<p>
-<code class="function">lwres_buffer_invalidate()</code>
-marks the buffer
-<em class="parameter"><code>*b</code></em>
-as invalid.  Invalidating a buffer after use is not required,
-but makes it possible to catch its possible accidental use.
-</p>
-<p>
-The functions
-<code class="function">lwres_buffer_add()</code>
-and
-<code class="function">lwres_buffer_subtract()</code>
-respectively increase and decrease the used space in
-buffer
-<em class="parameter"><code>*b</code></em>
-by
-<em class="parameter"><code>n</code></em>
-bytes.
-<code class="function">lwres_buffer_add()</code>
-checks for buffer overflow and
-<code class="function">lwres_buffer_subtract()</code>
-checks for underflow.
-These functions do not allocate or deallocate memory.
-They just change the value of
-<em class="structfield"><code>used</code></em>.
-</p>
-<p>
-A buffer is re-initialised by
-<code class="function">lwres_buffer_clear()</code>.
-The function sets
-<em class="structfield"><code>used</code></em> ,
-<em class="structfield"><code>current</code></em>
-and
-<em class="structfield"><code>active</code></em>
-to zero.
-</p>
-<p>
-<code class="function">lwres_buffer_first</code>
-makes the consumed region of buffer
-<em class="parameter"><code>*p</code></em>
-empty by setting
-<em class="structfield"><code>current</code></em>
-to zero (the start of the buffer).
-</p>
-<p>
-<code class="function">lwres_buffer_forward()</code>
-increases the consumed region of buffer
-<em class="parameter"><code>*b</code></em>
-by
-<em class="parameter"><code>n</code></em>
-bytes, checking for overflow.
-Similarly,
-<code class="function">lwres_buffer_back()</code>
-decreases buffer
-<em class="parameter"><code>b</code></em>'s
-consumed region by
-<em class="parameter"><code>n</code></em>
-bytes and checks for underflow.
-</p>
+    </p>
+<p><code class="function">lwres_buffer_init()</code>
+      initializes the
+      <span class="type">lwres_buffer_t</span>
+      <em class="parameter"><code>*b</code></em>
+      and assocates it with the memory region of size
+      <em class="parameter"><code>length</code></em>
+      bytes starting at location
+      <em class="parameter"><code>base.</code></em>
+    </p>
+<p><code class="function">lwres_buffer_invalidate()</code>
+      marks the buffer <em class="parameter"><code>*b</code></em>
+      as invalid.  Invalidating a buffer after use is not required,
+      but makes it possible to catch its possible accidental use.
+    </p>
 <p>
-<code class="function">lwres_buffer_getuint8()</code>
-reads an unsigned 8-bit integer from
-<em class="parameter"><code>*b</code></em>
-and returns it.
-<code class="function">lwres_buffer_putuint8()</code>
-writes the unsigned 8-bit integer
-<em class="parameter"><code>val</code></em>
-to buffer
-<em class="parameter"><code>*b</code></em>.
-</p>
+      The functions
+      <code class="function">lwres_buffer_add()</code>
+      and
+      <code class="function">lwres_buffer_subtract()</code>
+      respectively increase and decrease the used space in
+      buffer
+      <em class="parameter"><code>*b</code></em>
+      by
+      <em class="parameter"><code>n</code></em>
+      bytes.
+      <code class="function">lwres_buffer_add()</code>
+      checks for buffer overflow and
+      <code class="function">lwres_buffer_subtract()</code>
+      checks for underflow.
+      These functions do not allocate or deallocate memory.
+      They just change the value of
+      <em class="structfield"><code>used</code></em>.
+    </p>
 <p>
-<code class="function">lwres_buffer_getuint16()</code>
-and
-<code class="function">lwres_buffer_getuint32()</code>
-are identical to
-<code class="function">lwres_buffer_putuint8()</code>
-except that they respectively read an unsigned 16-bit or 32-bit integer 
-in network byte order from
-<em class="parameter"><code>b</code></em>.
-Similarly,
-<code class="function">lwres_buffer_putuint16()</code>
-and
-<code class="function">lwres_buffer_putuint32()</code>
-writes the unsigned 16-bit or 32-bit integer
-<em class="parameter"><code>val</code></em>
-to buffer
-<em class="parameter"><code>b</code></em>,
-in network byte order.
-</p>
+      A buffer is re-initialised by
+      <code class="function">lwres_buffer_clear()</code>.
+      The function sets
+      <em class="structfield"><code>used</code></em>,
+      <em class="structfield"><code>current</code></em>
+      and
+      <em class="structfield"><code>active</code></em>
+      to zero.
+    </p>
+<p><code class="function">lwres_buffer_first</code>
+      makes the consumed region of buffer
+      <em class="parameter"><code>*p</code></em>
+      empty by setting
+      <em class="structfield"><code>current</code></em>
+      to zero (the start of the buffer).
+    </p>
+<p><code class="function">lwres_buffer_forward()</code>
+      increases the consumed region of buffer
+      <em class="parameter"><code>*b</code></em>
+      by
+      <em class="parameter"><code>n</code></em>
+      bytes, checking for overflow.
+      Similarly,
+      <code class="function">lwres_buffer_back()</code>
+      decreases buffer
+      <em class="parameter"><code>b</code></em>'s
+      consumed region by
+      <em class="parameter"><code>n</code></em>
+      bytes and checks for underflow.
+    </p>
+<p><code class="function">lwres_buffer_getuint8()</code>
+      reads an unsigned 8-bit integer from
+      <em class="parameter"><code>*b</code></em>
+      and returns it.
+      <code class="function">lwres_buffer_putuint8()</code>
+      writes the unsigned 8-bit integer
+      <em class="parameter"><code>val</code></em>
+      to buffer
+      <em class="parameter"><code>*b</code></em>.
+    </p>
+<p><code class="function">lwres_buffer_getuint16()</code>
+      and
+      <code class="function">lwres_buffer_getuint32()</code>
+      are identical to
+      <code class="function">lwres_buffer_putuint8()</code>
+      except that they respectively read an unsigned 16-bit or 32-bit integer
+      in network byte order from
+      <em class="parameter"><code>b</code></em>.
+      Similarly,
+      <code class="function">lwres_buffer_putuint16()</code>
+      and
+      <code class="function">lwres_buffer_putuint32()</code>
+      writes the unsigned 16-bit or 32-bit integer
+      <em class="parameter"><code>val</code></em>
+      to buffer
+      <em class="parameter"><code>b</code></em>,
+      in network byte order.
+    </p>
 <p>
-Arbitrary amounts of data are read or written from a lightweight
-resolver buffer with
-<code class="function">lwres_buffer_getmem()</code>
-and
-<code class="function">lwres_buffer_putmem()</code>
-respectively.
-<code class="function">lwres_buffer_putmem()</code>
-copies
-<em class="parameter"><code>length</code></em>
-bytes of memory at
-<em class="parameter"><code>base</code></em>
-to
-<em class="parameter"><code>b</code></em>.
-Conversely,
-<code class="function">lwres_buffer_getmem()</code>
-copies
-<em class="parameter"><code>length</code></em>
-bytes of memory from
-<em class="parameter"><code>b</code></em>
-to
-<em class="parameter"><code>base</code></em>.
-</p>
+      Arbitrary amounts of data are read or written from a lightweight
+      resolver buffer with
+      <code class="function">lwres_buffer_getmem()</code>
+      and
+      <code class="function">lwres_buffer_putmem()</code>
+      respectively.
+      <code class="function">lwres_buffer_putmem()</code>
+      copies
+      <em class="parameter"><code>length</code></em>
+      bytes of memory at
+      <em class="parameter"><code>base</code></em>
+      to
+      <em class="parameter"><code>b</code></em>.
+      Conversely,
+      <code class="function">lwres_buffer_getmem()</code>
+      copies
+      <em class="parameter"><code>length</code></em>
+      bytes of memory from
+      <em class="parameter"><code>b</code></em>
+      to
+      <em class="parameter"><code>base</code></em>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_config.3 b/contrib/bind9/lib/lwres/man/lwres_config.3
index 0a23923..5a4123d 100644
--- a/contrib/bind9/lib/lwres/man/lwres_config.3
+++ b/contrib/bind9/lib/lwres/man/lwres_config.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_config.3,v 1.12.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_config.3,v 1.15.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_config
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,15 +36,15 @@ lwres_conf_init, lwres_conf_clear, lwres_conf_parse, lwres_conf_print, lwres_con
 #include <lwres/lwres.h>
 .fi
 .HP 21
-.BI "void lwres_conf_init(lwres_context_t\ *ctx);"
+.BI "void lwres_conf_init(lwres_context_t\ *" "ctx" ");"
 .HP 22
-.BI "void lwres_conf_clear(lwres_context_t\ *ctx);"
+.BI "void lwres_conf_clear(lwres_context_t\ *" "ctx" ");"
 .HP 32
-.BI "lwres_result_t lwres_conf_parse(lwres_context_t\ *ctx, const\ char\ *filename);"
+.BI "lwres_result_t lwres_conf_parse(lwres_context_t\ *" "ctx" ", const\ char\ *" "filename" ");"
 .HP 32
-.BI "lwres_result_t lwres_conf_print(lwres_context_t\ *ctx, FILE\ *fp);"
+.BI "lwres_result_t lwres_conf_print(lwres_context_t\ *" "ctx" ", FILE\ *" "fp" ");"
 .HP 30
-.BI "lwres_conf_t * lwres_conf_get(lwres_context_t\ *ctx);"
+.BI "lwres_conf_t * lwres_conf_get(lwres_context_t\ *" "ctx" ");"
 .SH "DESCRIPTION"
 .PP
 \fBlwres_conf_init()\fR
@@ -100,4 +100,7 @@ unless an error occurred when converting the network addresses to a numeric host
 .PP
 \fI/etc/resolv.conf\fR
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_config.docbook b/contrib/bind9/lib/lwres/man/lwres_config.docbook
index 03426be..13113d3 100644
--- a/contrib/bind9/lib/lwres/man/lwres_config.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_config.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_config.docbook,v 1.2.206.3 2005/05/12 21:36:12 sra Exp $ -->
-
+<!-- $Id: lwres_config.docbook,v 1.3.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
-<refentryinfo>
+  <refentryinfo>
 
-<date>Jun 30, 2000</date>
-</refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_config</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_config</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,131 +45,129 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_conf_init</refname>
-<refname>lwres_conf_clear</refname>
-<refname>lwres_conf_parse</refname>
-<refname>lwres_conf_print</refname>
-<refname>lwres_conf_get</refname>
-<refpurpose>lightweight resolver configuration</refpurpose>
-</refnamediv>
+  <refnamediv>
+    <refname>lwres_conf_init</refname>
+    <refname>lwres_conf_clear</refname>
+    <refname>lwres_conf_parse</refname>
+    <refname>lwres_conf_print</refname>
+    <refname>lwres_conf_get</refname>
+    <refpurpose>lightweight resolver configuration</refpurpose>
+  </refnamediv>
 
-<refsynopsisdiv>
-<funcsynopsis>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/lwres.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_conf_init</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_conf_clear</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_conf_parse</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>const char *filename</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>const char *<parameter>filename</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_conf_print</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>FILE *fp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>FILE *<parameter>fp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_conf_t *
 <function>lwres_conf_get</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>DESCRIPTION</title>
+
+    <para><function>lwres_conf_init()</function>
+      creates an empty
+      <type>lwres_conf_t</type>
+      structure for lightweight resolver context
+      <parameter>ctx</parameter>.
+    </para>
+
+    <para><function>lwres_conf_clear()</function>
+      frees up all the internal memory used by
+      that
+      <type>lwres_conf_t</type>
+      structure in resolver context
+      <parameter>ctx</parameter>.
+    </para>
 
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-<function>lwres_conf_init()</function>
-creates an empty
-<type>lwres_conf_t</type>
-structure for lightweight resolver context
-<parameter>ctx</parameter>.
-</para>
-<para>
-<function>lwres_conf_clear()</function>
-frees up all the internal memory used by
-that
-<type>lwres_conf_t</type>
-structure in resolver context
-<parameter>ctx</parameter>.
-</para>
-<para>
-<function>lwres_conf_parse()</function>
-opens the file
-<parameter>filename</parameter>
-and parses it to initialise the resolver context
-<parameter>ctx</parameter>'s
-<type>lwres_conf_t</type>
-structure.
-</para>
-<para>
-<function>lwres_conf_print()</function>
-prints the
-<type>lwres_conf_t</type>
-structure for resolver context
-<parameter>ctx</parameter>
-to the
-<type>FILE</type>
-<parameter>fp</parameter>.
-</para>
-</refsect1>
-<refsect1>
+    <para><function>lwres_conf_parse()</function>
+      opens the file
+      <parameter>filename</parameter>
+      and parses it to initialise the resolver context
+      <parameter>ctx</parameter>'s
+      <type>lwres_conf_t</type>
+      structure.
+    </para>
 
-<title>RETURN VALUES</title>
-<para>
-<function>lwres_conf_parse()</function>
-returns
-<errorcode>LWRES_R_SUCCESS</errorcode>
-if it successfully read and parsed
-<parameter>filename</parameter>.
-It returns
-<errorcode>LWRES_R_FAILURE</errorcode>
-if
-<parameter>filename</parameter>
-could not be opened or contained incorrect
-resolver statements.
-</para>
-<para>
-<function>lwres_conf_print()</function>
-returns
-<errorcode>LWRES_R_SUCCESS</errorcode>
-unless an error occurred when converting the network addresses to a
-numeric host address string.
-If this happens, the function returns
-<errorcode>LWRES_R_FAILURE</errorcode>.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>stdio</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-<citerefentry>
-<refentrytitle>resolver</refentrytitle><manvolnum>5</manvolnum>
-</citerefentry>.
-</para>
-</refsect1>
-<refsect1>
-<title>FILES</title>
-<para>
-<filename>/etc/resolv.conf</filename>
-</para>
-</refsect1>
-</refentry>
+    <para><function>lwres_conf_print()</function>
+      prints the
+      <type>lwres_conf_t</type>
+      structure for resolver context
+      <parameter>ctx</parameter>
+      to the
+      <type>FILE</type>
+      <parameter>fp</parameter>.
+    </para>
+  </refsect1>
+  <refsect1>
+
+    <title>RETURN VALUES</title>
+
+    <para><function>lwres_conf_parse()</function>
+      returns <errorcode>LWRES_R_SUCCESS</errorcode>
+      if it successfully read and parsed
+      <parameter>filename</parameter>.
+      It returns <errorcode>LWRES_R_FAILURE</errorcode>
+      if <parameter>filename</parameter>
+      could not be opened or contained incorrect
+      resolver statements.
+    </para>
+
+    <para><function>lwres_conf_print()</function>
+      returns <errorcode>LWRES_R_SUCCESS</errorcode>
+      unless an error occurred when converting the network addresses to a
+      numeric host address string.
+      If this happens, the function returns
+      <errorcode>LWRES_R_FAILURE</errorcode>.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>stdio</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>resolver</refentrytitle><manvolnum>5</manvolnum>
+      </citerefentry>.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>FILES</title>
+    <para><filename>/etc/resolv.conf</filename>
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_config.html b/contrib/bind9/lib/lwres/man/lwres_config.html
index 339a487..efa33d8 100644
--- a/contrib/bind9/lib/lwres/man/lwres_config.html
+++ b/contrib/bind9/lib/lwres/man/lwres_config.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_config.html,v 1.4.2.1.4.11 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_config.html,v 1.5.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_config</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_conf_init, lwres_conf_clear, lwres_conf_parse, lwres_conf_print, lwres_conf_get &#8212; lightweight resolver configuration</p>
@@ -31,56 +31,36 @@
 <h2>Synopsis</h2>
 <div class="funcsynopsis">
 <pre class="funcsynopsisinfo">#include &lt;lwres/lwres.h&gt;</pre>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_conf_init</b>(</code></td>
-<td> </td>
+<td>lwres_context_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<var class="pdparam">ctx</var><code>)</code>;</td>
+</tr></table>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_conf_clear</b>(</code></td>
-<td> </td>
+<td>lwres_context_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">ctx</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_conf_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>const char * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">filename</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -88,113 +68,89 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_conf_print</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>FILE * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">fp</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0"><tr>
 <td><code class="funcdef">
 lwres_conf_t *
 <b class="fsfunc">lwres_conf_get</b>(</code></td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
+<td>lwres_context_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">ctx</var><code>)</code>;</td>
+</tr></table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549475"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_conf_init()</code>
-creates an empty
-<span class="type">lwres_conf_t</span>
-structure for lightweight resolver context
-<em class="parameter"><code>ctx</code></em>.
-</p>
-<p>
-<code class="function">lwres_conf_clear()</code>
-frees up all the internal memory used by
-that
-<span class="type">lwres_conf_t</span>
-structure in resolver context
-<em class="parameter"><code>ctx</code></em>.
-</p>
-<p>
-<code class="function">lwres_conf_parse()</code>
-opens the file
-<em class="parameter"><code>filename</code></em>
-and parses it to initialise the resolver context
-<em class="parameter"><code>ctx</code></em>'s
-<span class="type">lwres_conf_t</span>
-structure.
-</p>
-<p>
-<code class="function">lwres_conf_print()</code>
-prints the
-<span class="type">lwres_conf_t</span>
-structure for resolver context
-<em class="parameter"><code>ctx</code></em>
-to the
-<span class="type">FILE</span>
-<em class="parameter"><code>fp</code></em>.
-</p>
+<a name="id2543441"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_conf_init()</code>
+      creates an empty
+      <span class="type">lwres_conf_t</span>
+      structure for lightweight resolver context
+      <em class="parameter"><code>ctx</code></em>.
+    </p>
+<p><code class="function">lwres_conf_clear()</code>
+      frees up all the internal memory used by
+      that
+      <span class="type">lwres_conf_t</span>
+      structure in resolver context
+      <em class="parameter"><code>ctx</code></em>.
+    </p>
+<p><code class="function">lwres_conf_parse()</code>
+      opens the file
+      <em class="parameter"><code>filename</code></em>
+      and parses it to initialise the resolver context
+      <em class="parameter"><code>ctx</code></em>'s
+      <span class="type">lwres_conf_t</span>
+      structure.
+    </p>
+<p><code class="function">lwres_conf_print()</code>
+      prints the
+      <span class="type">lwres_conf_t</span>
+      structure for resolver context
+      <em class="parameter"><code>ctx</code></em>
+      to the
+      <span class="type">FILE</span>
+      <em class="parameter"><code>fp</code></em>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549546"></a><h2>RETURN VALUES</h2>
-<p>
-<code class="function">lwres_conf_parse()</code>
-returns
-<span class="errorcode">LWRES_R_SUCCESS</span>
-if it successfully read and parsed
-<em class="parameter"><code>filename</code></em>.
-It returns
-<span class="errorcode">LWRES_R_FAILURE</span>
-if
-<em class="parameter"><code>filename</code></em>
-could not be opened or contained incorrect
-resolver statements.
-</p>
-<p>
-<code class="function">lwres_conf_print()</code>
-returns
-<span class="errorcode">LWRES_R_SUCCESS</span>
-unless an error occurred when converting the network addresses to a
-numeric host address string.
-If this happens, the function returns
-<span class="errorcode">LWRES_R_FAILURE</span>.
-</p>
+<a name="id2543508"></a><h2>RETURN VALUES</h2>
+<p><code class="function">lwres_conf_parse()</code>
+      returns <span class="errorcode">LWRES_R_SUCCESS</span>
+      if it successfully read and parsed
+      <em class="parameter"><code>filename</code></em>.
+      It returns <span class="errorcode">LWRES_R_FAILURE</span>
+      if <em class="parameter"><code>filename</code></em>
+      could not be opened or contained incorrect
+      resolver statements.
+    </p>
+<p><code class="function">lwres_conf_print()</code>
+      returns <span class="errorcode">LWRES_R_SUCCESS</span>
+      unless an error occurred when converting the network addresses to a
+      numeric host address string.
+      If this happens, the function returns
+      <span class="errorcode">LWRES_R_FAILURE</span>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549586"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">stdio</span>(3)</span>,
-<span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.
-</p>
+<a name="id2543545"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">stdio</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549612"></a><h2>FILES</h2>
-<p>
-<code class="filename">/etc/resolv.conf</code>
-</p>
+<a name="id2543571"></a><h2>FILES</h2>
+<p><code class="filename">/etc/resolv.conf</code>
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_context.3 b/contrib/bind9/lib/lwres/man/lwres_context.3
index ba68e40..8883a01 100644
--- a/contrib/bind9/lib/lwres/man/lwres_context.3
+++ b/contrib/bind9/lib/lwres/man/lwres_context.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_context.3,v 1.13.2.2.2.7 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_context.3,v 1.17.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_context
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,19 +36,19 @@ lwres_context_create, lwres_context_destroy, lwres_context_nextserial, lwres_con
 #include <lwres/lwres.h>
 .fi
 .HP 36
-.BI "lwres_result_t lwres_context_create(lwres_context_t\ **contextp, void\ *arg, lwres_malloc_t\ malloc_function, lwres_free_t\ free_function);"
+.BI "lwres_result_t lwres_context_create(lwres_context_t\ **" "contextp" ", void\ *" "arg" ", lwres_malloc_t\ " "malloc_function" ", lwres_free_t\ " "free_function" ");"
 .HP 37
-.BI "lwres_result_t lwres_context_destroy(lwres_context_t\ **contextp);"
+.BI "lwres_result_t lwres_context_destroy(lwres_context_t\ **" "contextp" ");"
 .HP 30
-.BI "void lwres_context_initserial(lwres_context_t\ *ctx, lwres_uint32_t\ serial);"
+.BI "void lwres_context_initserial(lwres_context_t\ *" "ctx" ", lwres_uint32_t\ " "serial" ");"
 .HP 40
-.BI "lwres_uint32_t lwres_context_nextserial(lwres_context_t\ *ctx);"
+.BI "lwres_uint32_t lwres_context_nextserial(lwres_context_t\ *" "ctx" ");"
 .HP 27
-.BI "void lwres_context_freemem(lwres_context_t\ *ctx, void\ *mem, size_t\ len);"
+.BI "void lwres_context_freemem(lwres_context_t\ *" "ctx" ", void\ *" "mem" ", size_t\ " "len" ");"
 .HP 28
-.BI "void lwres_context_allocmem(lwres_context_t\ *ctx, size_t\ len);"
+.BI "void lwres_context_allocmem(lwres_context_t\ *" "ctx" ", size_t\ " "len" ");"
 .HP 30
-.BI "void * lwres_context_sendrecv(lwres_context_t\ *ctx, void\ *sendbase, int\ sendlen, void\ *recvbase, int\ recvlen, int\ *recvd_len);"
+.BI "void * lwres_context_sendrecv(lwres_context_t\ *" "ctx" ", void\ *" "sendbase" ", int\ " "sendlen" ", void\ *" "recvbase" ", int\ " "recvlen" ", int\ *" "recvd_len" ");"
 .SH "DESCRIPTION"
 .PP
 \fBlwres_context_create()\fR
@@ -72,7 +72,8 @@ to free it. If
 \fImalloc_function\fR
 and
 \fIfree_function\fR
-are NULL, memory is allocated using .Xr malloc 3 and
+are NULL, memory is allocated using
+\fBmalloc\fR(3). and
 \fBfree\fR(3). It is not permitted to have a NULL
 \fImalloc_function\fR
 and a non\-NULL
@@ -161,6 +162,9 @@ times out waiting for a response.
 .PP
 \fBlwres_conf_init\fR(3),
 \fBmalloc\fR(3),
-\fBfree\fR(3 ).
+\fBfree\fR(3).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_context.docbook b/contrib/bind9/lib/lwres/man/lwres_context.docbook
index 48d4336..65f157c 100644
--- a/contrib/bind9/lib/lwres/man/lwres_context.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_context.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_context.docbook,v 1.3.2.2.2.3 2005/05/12 21:36:12 sra Exp $ -->
-
+<!-- $Id: lwres_context.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
-<refentryinfo>
 
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<date>Jun 30, 2000</date>
-</refentryinfo>
-<refmeta>
-<refentrytitle>lwres_context</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_context</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -46,255 +46,217 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_context_create</refname>
-<refname>lwres_context_destroy</refname>
-<refname>lwres_context_nextserial</refname>
-<refname>lwres_context_initserial</refname>
-<refname>lwres_context_freemem</refname>
-<refname>lwres_context_allocmem</refname>
-<refname>lwres_context_sendrecv</refname>
-<refpurpose>lightweight resolver context management</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_context_create</refname>
+    <refname>lwres_context_destroy</refname>
+    <refname>lwres_context_nextserial</refname>
+    <refname>lwres_context_initserial</refname>
+    <refname>lwres_context_freemem</refname>
+    <refname>lwres_context_allocmem</refname>
+    <refname>lwres_context_sendrecv</refname>
+    <refpurpose>lightweight resolver context management</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/lwres.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_context_create</function></funcdef>
-<paramdef>lwres_context_t **contextp</paramdef>
-<paramdef>void *arg</paramdef>
-<paramdef>lwres_malloc_t malloc_function</paramdef>
-<paramdef>lwres_free_t free_function</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t **<parameter>contextp</parameter></paramdef>
+        <paramdef>void *<parameter>arg</parameter></paramdef>
+        <paramdef>lwres_malloc_t <parameter>malloc_function</parameter></paramdef>
+        <paramdef>lwres_free_t <parameter>free_function</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_context_destroy</function></funcdef>
-<paramdef>lwres_context_t **contextp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t **<parameter>contextp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_context_initserial</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_uint32_t serial</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_uint32_t <parameter>serial</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_uint32_t
 <function>lwres_context_nextserial</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_context_freemem</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>void *mem</paramdef>
-<paramdef>size_t len</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>void *<parameter>mem</parameter></paramdef>
+        <paramdef>size_t <parameter>len</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_context_allocmem</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>size_t len</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>size_t <parameter>len</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void *
 <function>lwres_context_sendrecv</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>void *sendbase</paramdef>
-<paramdef>int sendlen</paramdef>
-<paramdef>void *recvbase</paramdef>
-<paramdef>int recvlen</paramdef>
-<paramdef>int *recvd_len</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>void *<parameter>sendbase</parameter></paramdef>
+        <paramdef>int <parameter>sendlen</parameter></paramdef>
+        <paramdef>void *<parameter>recvbase</parameter></paramdef>
+        <paramdef>int <parameter>recvlen</parameter></paramdef>
+        <paramdef>int *<parameter>recvd_len</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-<function>lwres_context_create()</function>
-creates a
-<type>lwres_context_t</type>
-structure for use in lightweight resolver operations.
-It holds a socket and other data needed for communicating
-with a resolver daemon.
-The new
-<type>lwres_context_t</type>
-is returned through
-<parameter>contextp</parameter>,
-
-a pointer to a
-<type>lwres_context_t</type>
-pointer.  This 
-<type>lwres_context_t</type>
-pointer must initially be NULL, and is modified 
-to point to the newly created
-<type>lwres_context_t</type>.
-
-</para>
-<para>
-When the lightweight resolver needs to perform dynamic memory
-allocation, it will call
-<parameter>malloc_function</parameter>
-to allocate memory and
-<parameter>free_function</parameter>
-
-to free it.  If 
-<parameter>malloc_function</parameter>
-and
-<parameter>free_function</parameter>
+  </refsynopsisdiv>
+  <refsect1>
+    <title>DESCRIPTION</title>
 
-are NULL, memory is allocated using
-.Xr malloc 3
-and
-<citerefentry>
-<refentrytitle>free</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
+    <para><function>lwres_context_create()</function>
+      creates a <type>lwres_context_t</type> structure for use in
+      lightweight resolver operations.  It holds a socket and other
+      data needed for communicating with a resolver daemon.  The new
+      <type>lwres_context_t</type> is returned through
+      <parameter>contextp</parameter>, a pointer to a
+      <type>lwres_context_t</type> pointer.  This
+      <type>lwres_context_t</type> pointer must initially be NULL, and
+      is modified to point to the newly created
+      <type>lwres_context_t</type>.
+    </para>
+    <para>
+      When the lightweight resolver needs to perform dynamic memory
+      allocation, it will call
+      <parameter>malloc_function</parameter>
+      to allocate memory and
+      <parameter>free_function</parameter>
+      to free it.  If
+      <parameter>malloc_function</parameter>
+      and
+      <parameter>free_function</parameter>
+      are NULL, memory is allocated using
+      <citerefentry>
+        <refentrytitle>malloc</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+      and
+      <citerefentry>
+        <refentrytitle>free</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
 
-It is not permitted to have a NULL
-<parameter>malloc_function</parameter>
-and a non-NULL
-<parameter>free_function</parameter>
-or vice versa.
-<parameter>arg</parameter>
-is passed as the first parameter to the memory
-allocation functions.  
-If
-<parameter>malloc_function</parameter>
-and
-<parameter>free_function</parameter>
-are NULL,
-<parameter>arg</parameter>
+      It is not permitted to have a NULL
+      <parameter>malloc_function</parameter> and a non-NULL
+      <parameter>free_function</parameter> or vice versa.
+      <parameter>arg</parameter> is passed as the first parameter to
+      the memory allocation functions.  If
+      <parameter>malloc_function</parameter> and
+      <parameter>free_function</parameter> are NULL,
+      <parameter>arg</parameter> is unused and should be passed as
+      NULL.
+    </para>
 
-is unused and should be passed as NULL.
-</para>
-<para>
-Once memory for the structure has been allocated,
-it is initialized using
-<citerefentry>
-<refentrytitle>lwres_conf_init</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>
+    <para>
+      Once memory for the structure has been allocated,
+      it is initialized using
+      <citerefentry>
+        <refentrytitle>lwres_conf_init</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+      and returned via <parameter>*contextp</parameter>.
+    </para>
 
-and returned via
-<parameter>*contextp</parameter>.
+    <para><function>lwres_context_destroy()</function>
+      destroys a <type>lwres_context_t</type>, closing its socket.
+      <parameter>contextp</parameter> is a pointer to a pointer to the
+      context that is to be destroyed.  The pointer will be set to
+      NULL when the context has been destroyed.
+    </para>
 
-</para>
-<para>
-<function>lwres_context_destroy()</function>
-destroys a 
-<type>lwres_context_t</type>,
+    <para>
+      The context holds a serial number that is used to identify
+      resolver request packets and associate responses with the
+      corresponding requests.  This serial number is controlled using
+      <function>lwres_context_initserial()</function> and
+      <function>lwres_context_nextserial()</function>.
+      <function>lwres_context_initserial()</function> sets the serial
+      number for context <parameter>*ctx</parameter> to
+      <parameter>serial</parameter>.
+      <function>lwres_context_nextserial()</function> increments the
+      serial number and returns the previous value.
+    </para>
 
-closing its socket.
-<parameter>contextp</parameter>
-is a pointer to a pointer to the context that is to be destroyed.
-The pointer will be set to NULL when the context has been destroyed.
-</para>
-<para>
-The context holds a serial number that is used to identify resolver
-request packets and associate responses with the corresponding requests.
-This serial number is controlled using
-<function>lwres_context_initserial()</function>
-and
-<function>lwres_context_nextserial()</function>.
-<function>lwres_context_initserial()</function>
-sets the serial number for context
-<parameter>*ctx</parameter>
-to
-<parameter>serial</parameter>.
+    <para>
+      Memory for a lightweight resolver context is allocated and freed
+      using <function>lwres_context_allocmem()</function> and
+      <function>lwres_context_freemem()</function>.  These use
+      whatever allocations were defined when the context was created
+      with <function>lwres_context_create()</function>.
+      <function>lwres_context_allocmem()</function> allocates
+      <parameter>len</parameter> bytes of memory and if successful
+      returns a pointer to the allocated storage.
+      <function>lwres_context_freemem()</function> frees
+      <parameter>len</parameter> bytes of space starting at location
+      <parameter>mem</parameter>.
+    </para>
 
-<function>lwres_context_nextserial()</function>
-increments the serial number and returns the previous value.
-</para>
-<para>
-Memory for a lightweight resolver context is allocated and freed using
-<function>lwres_context_allocmem()</function>
-and
-<function>lwres_context_freemem()</function>.
-These use whatever allocations were defined when the context was
-created with
-<function>lwres_context_create()</function>.
-<function>lwres_context_allocmem()</function>
-allocates
-<parameter>len</parameter>
-bytes of memory and if successful returns a pointer to the allocated
-storage.
-<function>lwres_context_freemem()</function>
-frees
-<parameter>len</parameter>
-bytes of space starting at location
-<parameter>mem</parameter>.
+    <para><function>lwres_context_sendrecv()</function>
+      performs I/O for the context <parameter>ctx</parameter>.  Data
+      are read and written from the context's socket.  It writes data
+      from <parameter>sendbase</parameter> &mdash; typically a
+      lightweight resolver query packet &mdash; and waits for a reply
+      which is copied to the receive buffer at
+      <parameter>recvbase</parameter>.  The number of bytes that were
+      written to this receive buffer is returned in
+      <parameter>*recvd_len</parameter>.
+    </para>
+  </refsect1>
 
-</para>
-<para>
-<function>lwres_context_sendrecv()</function>
-performs I/O for the context
-<parameter>ctx</parameter>.
+  <refsect1>
+    <title>RETURN VALUES</title>
 
-Data are read and written from the context's socket.
-It writes data from
-<parameter>sendbase</parameter>
-&mdash; typically a lightweight resolver query packet &mdash;
-and waits for a reply which is copied to the receive buffer at
-<parameter>recvbase</parameter>.
+    <para><function>lwres_context_create()</function>
+      returns <errorcode>LWRES_R_NOMEMORY</errorcode> if memory for
+      the <type>struct lwres_context</type> could not be allocated,
+      <errorcode>LWRES_R_SUCCESS</errorcode> otherwise.
+    </para>
+    <para>
+      Successful calls to the memory allocator
+      <function>lwres_context_allocmem()</function>
+      return a pointer to the start of the allocated space.
+      It returns NULL if memory could not be allocated.
+    </para>
+    <para><errorcode>LWRES_R_SUCCESS</errorcode>
+      is returned when
+      <function>lwres_context_sendrecv()</function>
+      completes successfully.
+      <errorcode>LWRES_R_IOERROR</errorcode>
+      is returned if an I/O error occurs and
+      <errorcode>LWRES_R_TIMEOUT</errorcode>
+      is returned if
+      <function>lwres_context_sendrecv()</function>
+      times out waiting for a response.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres_conf_init</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-The number of bytes that were written to this receive buffer is
-returned in
-<parameter>*recvd_len</parameter>.
+      <citerefentry>
+        <refentrytitle>malloc</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-</para>
-</refsect1>
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-<function>lwres_context_create()</function>
-returns
-<errorcode>LWRES_R_NOMEMORY</errorcode>
-if memory for the
-<type>struct lwres_context</type>
-could not be allocated, 
-<errorcode>LWRES_R_SUCCESS</errorcode>
-otherwise.
-</para>
-<para>
-Successful calls to the memory allocator
-<function>lwres_context_allocmem()</function>
-return a pointer to the start of the allocated space.
-It returns NULL if memory could not be allocated.
-</para>
-<para>
-<errorcode>LWRES_R_SUCCESS</errorcode>
-is returned when
-<function>lwres_context_sendrecv()</function>
-completes successfully.
-<errorcode>LWRES_R_IOERROR</errorcode>
-is returned if an I/O error occurs and
-<errorcode>LWRES_R_TIMEOUT</errorcode>
-is returned if
-<function>lwres_context_sendrecv()</function>
-times out waiting for a response.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres_conf_init</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>malloc</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>free</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>.
-</para>
-</refsect1>
-</refentry>
+      <citerefentry>
+        <refentrytitle>free</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_context.html b/contrib/bind9/lib/lwres/man/lwres_context.html
index 6f7fbec..f2aa7e1 100644
--- a/contrib/bind9/lib/lwres/man/lwres_context.html
+++ b/contrib/bind9/lib/lwres/man/lwres_context.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_context.html,v 1.5.2.2.2.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_context.html,v 1.7.18.16 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_context</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_context_create, lwres_context_destroy, lwres_context_nextserial, lwres_context_initserial, lwres_context_freemem, lwres_context_allocmem, lwres_context_sendrecv &#8212; lightweight resolver context management</p>
@@ -36,106 +36,81 @@
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_context_create</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t ** </td>
+<td>
+<var class="pdparam">contextp</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>void * </td>
+<td>
+<var class="pdparam">arg</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_malloc_t  </td>
+<td>
+<var class="pdparam">malloc_function</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_free_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">free_function</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_context_destroy</b>(</code></td>
-<td> </td>
+<td>lwres_context_t ** </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">contextp</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_context_initserial</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_uint32_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">serial</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 lwres_uint32_t
 <b class="fsfunc">lwres_context_nextserial</b>(</code></td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
+<td>lwres_context_t * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">ctx</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_context_freemem</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>void * </td>
+<td>
+<var class="pdparam">mem</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>size_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">len</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -143,19 +118,15 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_context_allocmem</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>size_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">len</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
@@ -163,214 +134,162 @@ void
 <td><code class="funcdef">
 void *
 <b class="fsfunc">lwres_context_sendrecv</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>void * </td>
+<td>
+<var class="pdparam">sendbase</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">sendlen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>void * </td>
+<td>
+<var class="pdparam">recvbase</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">recvlen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">recvd_len</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549540"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_context_create()</code>
-creates a
-<span class="type">lwres_context_t</span>
-structure for use in lightweight resolver operations.
-It holds a socket and other data needed for communicating
-with a resolver daemon.
-The new
-<span class="type">lwres_context_t</span>
-is returned through
-<em class="parameter"><code>contextp</code></em>,
-
-a pointer to a
-<span class="type">lwres_context_t</span>
-pointer.  This 
-<span class="type">lwres_context_t</span>
-pointer must initially be NULL, and is modified 
-to point to the newly created
-<span class="type">lwres_context_t</span>.
-
-</p>
-<p>
-When the lightweight resolver needs to perform dynamic memory
-allocation, it will call
-<em class="parameter"><code>malloc_function</code></em>
-to allocate memory and
-<em class="parameter"><code>free_function</code></em>
-
-to free it.  If 
-<em class="parameter"><code>malloc_function</code></em>
-and
-<em class="parameter"><code>free_function</code></em>
-
-are NULL, memory is allocated using
-.Xr malloc 3
-and
-<span class="citerefentry"><span class="refentrytitle">free</span>(3)</span>.
-
-It is not permitted to have a NULL
-<em class="parameter"><code>malloc_function</code></em>
-and a non-NULL
-<em class="parameter"><code>free_function</code></em>
-or vice versa.
-<em class="parameter"><code>arg</code></em>
-is passed as the first parameter to the memory
-allocation functions.  
-If
-<em class="parameter"><code>malloc_function</code></em>
-and
-<em class="parameter"><code>free_function</code></em>
-are NULL,
-<em class="parameter"><code>arg</code></em>
-
-is unused and should be passed as NULL.
-</p>
+<a name="id2543531"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_context_create()</code>
+      creates a <span class="type">lwres_context_t</span> structure for use in
+      lightweight resolver operations.  It holds a socket and other
+      data needed for communicating with a resolver daemon.  The new
+      <span class="type">lwres_context_t</span> is returned through
+      <em class="parameter"><code>contextp</code></em>, a pointer to a
+      <span class="type">lwres_context_t</span> pointer.  This
+      <span class="type">lwres_context_t</span> pointer must initially be NULL, and
+      is modified to point to the newly created
+      <span class="type">lwres_context_t</span>.
+    </p>
 <p>
-Once memory for the structure has been allocated,
-it is initialized using
-<span class="citerefentry"><span class="refentrytitle">lwres_conf_init</span>(3)</span>
+      When the lightweight resolver needs to perform dynamic memory
+      allocation, it will call
+      <em class="parameter"><code>malloc_function</code></em>
+      to allocate memory and
+      <em class="parameter"><code>free_function</code></em>
+      to free it.  If
+      <em class="parameter"><code>malloc_function</code></em>
+      and
+      <em class="parameter"><code>free_function</code></em>
+      are NULL, memory is allocated using
+      <span class="citerefentry"><span class="refentrytitle">malloc</span>(3)</span>.
+      and
+      <span class="citerefentry"><span class="refentrytitle">free</span>(3)</span>.
 
-and returned via
-<em class="parameter"><code>*contextp</code></em>.
-
-</p>
-<p>
-<code class="function">lwres_context_destroy()</code>
-destroys a 
-<span class="type">lwres_context_t</span>,
-
-closing its socket.
-<em class="parameter"><code>contextp</code></em>
-is a pointer to a pointer to the context that is to be destroyed.
-The pointer will be set to NULL when the context has been destroyed.
-</p>
+      It is not permitted to have a NULL
+      <em class="parameter"><code>malloc_function</code></em> and a non-NULL
+      <em class="parameter"><code>free_function</code></em> or vice versa.
+      <em class="parameter"><code>arg</code></em> is passed as the first parameter to
+      the memory allocation functions.  If
+      <em class="parameter"><code>malloc_function</code></em> and
+      <em class="parameter"><code>free_function</code></em> are NULL,
+      <em class="parameter"><code>arg</code></em> is unused and should be passed as
+      NULL.
+    </p>
 <p>
-The context holds a serial number that is used to identify resolver
-request packets and associate responses with the corresponding requests.
-This serial number is controlled using
-<code class="function">lwres_context_initserial()</code>
-and
-<code class="function">lwres_context_nextserial()</code>.
-<code class="function">lwres_context_initserial()</code>
-sets the serial number for context
-<em class="parameter"><code>*ctx</code></em>
-to
-<em class="parameter"><code>serial</code></em>.
-
-<code class="function">lwres_context_nextserial()</code>
-increments the serial number and returns the previous value.
-</p>
+      Once memory for the structure has been allocated,
+      it is initialized using
+      <span class="citerefentry"><span class="refentrytitle">lwres_conf_init</span>(3)</span>
+      and returned via <em class="parameter"><code>*contextp</code></em>.
+    </p>
+<p><code class="function">lwres_context_destroy()</code>
+      destroys a <span class="type">lwres_context_t</span>, closing its socket.
+      <em class="parameter"><code>contextp</code></em> is a pointer to a pointer to the
+      context that is to be destroyed.  The pointer will be set to
+      NULL when the context has been destroyed.
+    </p>
 <p>
-Memory for a lightweight resolver context is allocated and freed using
-<code class="function">lwres_context_allocmem()</code>
-and
-<code class="function">lwres_context_freemem()</code>.
-These use whatever allocations were defined when the context was
-created with
-<code class="function">lwres_context_create()</code>.
-<code class="function">lwres_context_allocmem()</code>
-allocates
-<em class="parameter"><code>len</code></em>
-bytes of memory and if successful returns a pointer to the allocated
-storage.
-<code class="function">lwres_context_freemem()</code>
-frees
-<em class="parameter"><code>len</code></em>
-bytes of space starting at location
-<em class="parameter"><code>mem</code></em>.
-
-</p>
+      The context holds a serial number that is used to identify
+      resolver request packets and associate responses with the
+      corresponding requests.  This serial number is controlled using
+      <code class="function">lwres_context_initserial()</code> and
+      <code class="function">lwres_context_nextserial()</code>.
+      <code class="function">lwres_context_initserial()</code> sets the serial
+      number for context <em class="parameter"><code>*ctx</code></em> to
+      <em class="parameter"><code>serial</code></em>.
+      <code class="function">lwres_context_nextserial()</code> increments the
+      serial number and returns the previous value.
+    </p>
 <p>
-<code class="function">lwres_context_sendrecv()</code>
-performs I/O for the context
-<em class="parameter"><code>ctx</code></em>.
-
-Data are read and written from the context's socket.
-It writes data from
-<em class="parameter"><code>sendbase</code></em>
-&#8212; typically a lightweight resolver query packet &#8212;
-and waits for a reply which is copied to the receive buffer at
-<em class="parameter"><code>recvbase</code></em>.
-
-The number of bytes that were written to this receive buffer is
-returned in
-<em class="parameter"><code>*recvd_len</code></em>.
-
-</p>
+      Memory for a lightweight resolver context is allocated and freed
+      using <code class="function">lwres_context_allocmem()</code> and
+      <code class="function">lwres_context_freemem()</code>.  These use
+      whatever allocations were defined when the context was created
+      with <code class="function">lwres_context_create()</code>.
+      <code class="function">lwres_context_allocmem()</code> allocates
+      <em class="parameter"><code>len</code></em> bytes of memory and if successful
+      returns a pointer to the allocated storage.
+      <code class="function">lwres_context_freemem()</code> frees
+      <em class="parameter"><code>len</code></em> bytes of space starting at location
+      <em class="parameter"><code>mem</code></em>.
+    </p>
+<p><code class="function">lwres_context_sendrecv()</code>
+      performs I/O for the context <em class="parameter"><code>ctx</code></em>.  Data
+      are read and written from the context's socket.  It writes data
+      from <em class="parameter"><code>sendbase</code></em> &#8212; typically a
+      lightweight resolver query packet &#8212; and waits for a reply
+      which is copied to the receive buffer at
+      <em class="parameter"><code>recvbase</code></em>.  The number of bytes that were
+      written to this receive buffer is returned in
+      <em class="parameter"><code>*recvd_len</code></em>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549789"></a><h2>RETURN VALUES</h2>
-<p>
-<code class="function">lwres_context_create()</code>
-returns
-<span class="errorcode">LWRES_R_NOMEMORY</span>
-if memory for the
-<span class="type">struct lwres_context</span>
-could not be allocated, 
-<span class="errorcode">LWRES_R_SUCCESS</span>
-otherwise.
-</p>
+<a name="id2543719"></a><h2>RETURN VALUES</h2>
+<p><code class="function">lwres_context_create()</code>
+      returns <span class="errorcode">LWRES_R_NOMEMORY</span> if memory for
+      the <span class="type">struct lwres_context</span> could not be allocated,
+      <span class="errorcode">LWRES_R_SUCCESS</span> otherwise.
+    </p>
 <p>
-Successful calls to the memory allocator
-<code class="function">lwres_context_allocmem()</code>
-return a pointer to the start of the allocated space.
-It returns NULL if memory could not be allocated.
-</p>
-<p>
-<span class="errorcode">LWRES_R_SUCCESS</span>
-is returned when
-<code class="function">lwres_context_sendrecv()</code>
-completes successfully.
-<span class="errorcode">LWRES_R_IOERROR</span>
-is returned if an I/O error occurs and
-<span class="errorcode">LWRES_R_TIMEOUT</span>
-is returned if
-<code class="function">lwres_context_sendrecv()</code>
-times out waiting for a response.
-</p>
+      Successful calls to the memory allocator
+      <code class="function">lwres_context_allocmem()</code>
+      return a pointer to the start of the allocated space.
+      It returns NULL if memory could not be allocated.
+    </p>
+<p><span class="errorcode">LWRES_R_SUCCESS</span>
+      is returned when
+      <code class="function">lwres_context_sendrecv()</code>
+      completes successfully.
+      <span class="errorcode">LWRES_R_IOERROR</span>
+      is returned if an I/O error occurs and
+      <span class="errorcode">LWRES_R_TIMEOUT</span>
+      is returned if
+      <code class="function">lwres_context_sendrecv()</code>
+      times out waiting for a response.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549841"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_conf_init</span>(3)</span>,
+<a name="id2543769"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_conf_init</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">malloc</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">malloc</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">free</span>(3
-)</span>.
-</p>
+      <span class="citerefentry"><span class="refentrytitle">free</span>(3)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_gabn.3 b/contrib/bind9/lib/lwres/man/lwres_gabn.3
index 593ebc5..69d311f 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gabn.3
+++ b/contrib/bind9/lib/lwres/man/lwres_gabn.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_gabn.3,v 1.13.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_gabn.3,v 1.16.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_gabn
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,17 +36,17 @@ lwres_gabnrequest_render, lwres_gabnresponse_render, lwres_gabnrequest_parse, lw
 #include <lwres/lwres.h>
 .fi
 .HP 40
-.BI "lwres_result_t lwres_gabnrequest_render(lwres_context_t\ *ctx, lwres_gabnrequest_t\ *req, lwres_lwpacket_t\ *pkt, lwres_buffer_t\ *b);"
+.BI "lwres_result_t lwres_gabnrequest_render(lwres_context_t\ *" "ctx" ", lwres_gabnrequest_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");"
 .HP 41
-.BI "lwres_result_t lwres_gabnresponse_render(lwres_context_t\ *ctx, lwres_gabnresponse_t\ *req, lwres_lwpacket_t\ *pkt, lwres_buffer_t\ *b);"
+.BI "lwres_result_t lwres_gabnresponse_render(lwres_context_t\ *" "ctx" ", lwres_gabnresponse_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");"
 .HP 39
-.BI "lwres_result_t lwres_gabnrequest_parse(lwres_context_t\ *ctx, lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt, lwres_gabnrequest_t\ **structp);"
+.BI "lwres_result_t lwres_gabnrequest_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gabnrequest_t\ **" "structp" ");"
 .HP 40
-.BI "lwres_result_t lwres_gabnresponse_parse(lwres_context_t\ *ctx, lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt, lwres_gabnresponse_t\ **structp);"
+.BI "lwres_result_t lwres_gabnresponse_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gabnresponse_t\ **" "structp" ");"
 .HP 29
-.BI "void lwres_gabnresponse_free(lwres_context_t\ *ctx, lwres_gabnresponse_t\ **structp);"
+.BI "void lwres_gabnresponse_free(lwres_context_t\ *" "ctx" ", lwres_gabnresponse_t\ **" "structp" ");"
 .HP 28
-.BI "void lwres_gabnrequest_free(lwres_context_t\ *ctx, lwres_gabnrequest_t\ **structp);"
+.BI "void lwres_gabnrequest_free(lwres_context_t\ *" "ctx" ", lwres_gabnrequest_t\ **" "structp" ");"
 .SH "DESCRIPTION"
 .PP
 These are low\-level routines for creating and parsing lightweight resolver name\-to\-address lookup request and response messages.
@@ -59,18 +59,36 @@ There are four main functions for the getaddrbyname opcode. One render function
 .PP
 These structures are defined in
 \fI<lwres/lwres.h>\fR. They are shown below.
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 #define LWRES_OPCODE_GETADDRSBYNAME     0x00010001U
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 typedef struct lwres_addr lwres_addr_t;
 typedef LWRES_LIST(lwres_addr_t) lwres_addrlist_t;
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 typedef struct {
         lwres_uint32_t  flags;
         lwres_uint32_t  addrtypes;
         lwres_uint16_t  namelen;
         char           *name;
 } lwres_gabnrequest_t;
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 typedef struct {
         lwres_uint32_t          flags;
         lwres_uint16_t          naliases;
@@ -169,6 +187,9 @@ in the packet header structure
 indicate that the packet is not a response to an earlier query.
 .SH "SEE ALSO"
 .PP
-\fBlwres_packet\fR(3 )
+\fBlwres_packet\fR(3)
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_gabn.docbook b/contrib/bind9/lib/lwres/man/lwres_gabn.docbook
index 6e90ea3..3b81acf 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gabn.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_gabn.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_gabn.docbook,v 1.3.206.3 2005/05/12 21:36:12 sra Exp $ -->
-
+<!-- $Id: lwres_gabn.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
-<refentryinfo>
 
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<date>Jun 30, 2000</date>
-</refentryinfo>
-<refmeta>
-<refentrytitle>lwres_gabn</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_gabn</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,106 +45,114 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_gabnrequest_render</refname>
-<refname>lwres_gabnresponse_render</refname>
-<refname>lwres_gabnrequest_parse</refname>
-<refname>lwres_gabnresponse_parse</refname>
-<refname>lwres_gabnresponse_free</refname>
-<refname>lwres_gabnrequest_free</refname>
-<refpurpose>lightweight resolver getaddrbyname message handling</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_gabnrequest_render</refname>
+    <refname>lwres_gabnresponse_render</refname>
+    <refname>lwres_gabnrequest_parse</refname>
+    <refname>lwres_gabnresponse_parse</refname>
+    <refname>lwres_gabnresponse_free</refname>
+    <refname>lwres_gabnrequest_free</refname>
+    <refpurpose>lightweight resolver getaddrbyname message handling</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/lwres.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gabnrequest_render</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_gabnrequest_t *req</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gabnrequest_t *<parameter>req</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gabnresponse_render</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_gabnresponse_t *req</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gabnresponse_t *<parameter>req</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gabnrequest_parse</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_gabnrequest_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_gabnrequest_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gabnresponse_parse</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_gabnresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_gabnresponse_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_gabnresponse_free</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_gabnresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gabnresponse_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_gabnrequest_free</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_gabnrequest_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gabnrequest_t **<parameter>structp</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-These are low-level routines for creating and parsing
-lightweight resolver name-to-address lookup request and 
-response messages.
-</para><para>
-There are four main functions for the getaddrbyname opcode.
-One render function converts a getaddrbyname request structure &mdash;
-<type>lwres_gabnrequest_t</type> &mdash;
-to the lighweight resolver's canonical format.
-It is complemented by a parse function that converts a packet in this
-canonical format to a getaddrbyname request structure.
-Another render function converts the getaddrbyname response structure &mdash;
-<type>lwres_gabnresponse_t</type> &mdash;
-to the canonical format.
-This is complemented by a parse function which converts a packet in
-canonical format to a getaddrbyname response structure.
-</para>
-<para>
-These structures are defined in
-<filename>&lt;lwres/lwres.h&gt;</filename>.
-They are shown below.
-<programlisting>
+  </refsynopsisdiv>
+  <refsect1>
+    <title>DESCRIPTION</title>
+    <para>
+      These are low-level routines for creating and parsing
+      lightweight resolver name-to-address lookup request and
+      response messages.
+    </para>
+    <para>
+      There are four main functions for the getaddrbyname opcode.
+      One render function converts a getaddrbyname request structure &mdash;
+      <type>lwres_gabnrequest_t</type> &mdash;
+      to the lighweight resolver's canonical format.
+      It is complemented by a parse function that converts a packet in this
+      canonical format to a getaddrbyname request structure.
+      Another render function converts the getaddrbyname response structure
+      &mdash; <type>lwres_gabnresponse_t</type> &mdash;
+      to the canonical format.
+      This is complemented by a parse function which converts a packet in
+      canonical format to a getaddrbyname response structure.
+    </para>
+    <para>
+      These structures are defined in
+      <filename>&lt;lwres/lwres.h&gt;</filename>.
+      They are shown below.
+    </para>
+    <para><programlisting>
 #define LWRES_OPCODE_GETADDRSBYNAME     0x00010001U
-
+</programlisting>
+    </para>
+    <para><programlisting>
 typedef struct lwres_addr lwres_addr_t;
 typedef LWRES_LIST(lwres_addr_t) lwres_addrlist_t;
-
+</programlisting>
+    </para>
+    <para><programlisting>
 typedef struct {
         lwres_uint32_t  flags;
         lwres_uint32_t  addrtypes;
         lwres_uint16_t  namelen;
         char           *name;
 } lwres_gabnrequest_t;
-
+</programlisting>
+    </para>
+    <para><programlisting>
 typedef struct {
         lwres_uint32_t          flags;
         lwres_uint16_t          naliases;
@@ -158,114 +166,95 @@ typedef struct {
         size_t                  baselen;
 } lwres_gabnresponse_t;
 </programlisting>
-</para>
-<para>
-<function>lwres_gabnrequest_render()</function>
-uses resolver context
-<parameter>ctx</parameter>
-to convert getaddrbyname request structure
-<parameter>req</parameter>
-to canonical format.
-The packet header structure
-<parameter>pkt</parameter>
-is initialised and transferred to
-buffer
-<parameter>b</parameter>.
+    </para>
+
+    <para><function>lwres_gabnrequest_render()</function>
+      uses resolver context <parameter>ctx</parameter> to convert
+      getaddrbyname request structure <parameter>req</parameter> to
+      canonical format.  The packet header structure
+      <parameter>pkt</parameter> is initialised and transferred to
+      buffer <parameter>b</parameter>.
+
+      The contents of <parameter>*req</parameter> are then appended to
+      the buffer in canonical format.
+      <function>lwres_gabnresponse_render()</function> performs the
+      same task, except it converts a getaddrbyname response structure
+      <type>lwres_gabnresponse_t</type> to the lightweight resolver's
+      canonical format.
+    </para>
 
-The contents of
-<parameter>*req</parameter>
-are then appended to the buffer in canonical format.
-<function>lwres_gabnresponse_render()</function>
-performs the same task, except it converts a getaddrbyname response structure
-<type>lwres_gabnresponse_t</type>
-to the lightweight resolver's canonical format.
-</para>
-<para>
-<function>lwres_gabnrequest_parse()</function>
-uses context
-<parameter>ctx</parameter>
-to convert the contents of packet
-<parameter>pkt</parameter>
-to a
-<type>lwres_gabnrequest_t</type>
-structure.
-Buffer
-<parameter>b</parameter>
-provides space to be used for storing this structure.
-When the function succeeds, the resulting
-<type>lwres_gabnrequest_t</type>
-is made available through
-<parameter>*structp</parameter>.
+    <para><function>lwres_gabnrequest_parse()</function>
+      uses context <parameter>ctx</parameter> to convert the contents
+      of packet <parameter>pkt</parameter> to a
+      <type>lwres_gabnrequest_t</type> structure.  Buffer
+      <parameter>b</parameter> provides space to be used for storing
+      this structure.  When the function succeeds, the resulting
+      <type>lwres_gabnrequest_t</type> is made available through
+      <parameter>*structp</parameter>.
 
-<function>lwres_gabnresponse_parse()</function>
-offers the same semantics as
-<function>lwres_gabnrequest_parse()</function>
-except it yields a
-<type>lwres_gabnresponse_t</type>
-structure.
-</para>
-<para>
-<function>lwres_gabnresponse_free()</function>
-and
-<function>lwres_gabnrequest_free()</function>
-release the memory in resolver context
-<parameter>ctx</parameter>
-that was allocated to the
-<type>lwres_gabnresponse_t</type>
-or
-<type>lwres_gabnrequest_t</type>
-structures referenced via
-<parameter>structp</parameter>.
+      <function>lwres_gabnresponse_parse()</function> offers the same
+      semantics as <function>lwres_gabnrequest_parse()</function>
+      except it yields a <type>lwres_gabnresponse_t</type> structure.
+    </para>
 
-Any memory associated with ancillary buffers and strings for those
-structures is also discarded.
-</para>
-</refsect1>
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-The getaddrbyname opcode functions
-<function>lwres_gabnrequest_render()</function>, 
-<function>lwres_gabnresponse_render()</function>
-<function>lwres_gabnrequest_parse()</function>
-and
-<function>lwres_gabnresponse_parse()</function>
-all return
-<errorcode>LWRES_R_SUCCESS</errorcode>
-on success.
-They return
-<errorcode>LWRES_R_NOMEMORY</errorcode>
-if memory allocation fails.
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-is returned if the available space in the buffer
-<parameter>b</parameter>
-is too small to accommodate the packet header or the
-<type>lwres_gabnrequest_t</type>
-and
-<type>lwres_gabnresponse_t</type>
-structures.
-<function>lwres_gabnrequest_parse()</function>
-and
-<function>lwres_gabnresponse_parse()</function>
-will return
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-if the buffer is not empty after decoding the received packet.
-These functions will return
-<errorcode>LWRES_R_FAILURE</errorcode>
-if
-<structfield>pktflags</structfield>
-in the packet header structure
-<type>lwres_lwpacket_t</type>
-indicate that the packet is not a response to an earlier query.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres_packet</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-</para>
-</refsect1>
-</refentry>
+    <para><function>lwres_gabnresponse_free()</function>
+      and <function>lwres_gabnrequest_free()</function> release the
+      memory in resolver context <parameter>ctx</parameter> that was
+      allocated to the <type>lwres_gabnresponse_t</type> or
+      <type>lwres_gabnrequest_t</type> structures referenced via
+      <parameter>structp</parameter>.
+
+      Any memory associated with ancillary buffers and strings for
+      those structures is also discarded.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      The getaddrbyname opcode functions
+      <function>lwres_gabnrequest_render()</function>,
+      <function>lwres_gabnresponse_render()</function>
+      <function>lwres_gabnrequest_parse()</function>
+      and
+      <function>lwres_gabnresponse_parse()</function>
+      all return
+      <errorcode>LWRES_R_SUCCESS</errorcode>
+      on success.
+      They return
+      <errorcode>LWRES_R_NOMEMORY</errorcode>
+      if memory allocation fails.
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      is returned if the available space in the buffer
+      <parameter>b</parameter>
+      is too small to accommodate the packet header or the
+      <type>lwres_gabnrequest_t</type>
+      and
+      <type>lwres_gabnresponse_t</type>
+      structures.
+      <function>lwres_gabnrequest_parse()</function>
+      and
+      <function>lwres_gabnresponse_parse()</function>
+      will return
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      if the buffer is not empty after decoding the received packet.
+      These functions will return
+      <errorcode>LWRES_R_FAILURE</errorcode>
+      if
+      <structfield>pktflags</structfield>
+      in the packet header structure
+      <type>lwres_lwpacket_t</type>
+      indicate that the packet is not a response to an earlier query.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres_packet</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_gabn.html b/contrib/bind9/lib/lwres/man/lwres_gabn.html
index fce25c5..e27954b 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gabn.html
+++ b/contrib/bind9/lib/lwres/man/lwres_gabn.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_gabn.html,v 1.6.2.1.4.11 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_gabn.html,v 1.7.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_gabn</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_gabnrequest_render, lwres_gabnresponse_render, lwres_gabnrequest_parse, lwres_gabnresponse_parse, lwres_gabnresponse_free, lwres_gabnrequest_free &#8212; lightweight resolver getaddrbyname message handling</p>
@@ -36,29 +36,27 @@
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_gabnrequest_render</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_gabnrequest_t * </td>
+<td>
+<var class="pdparam">req</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">b</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -66,29 +64,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_gabnresponse_render</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_gabnresponse_t * </td>
+<td>
+<var class="pdparam">req</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">b</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -96,29 +92,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_gabnrequest_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gabnrequest_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -126,29 +120,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_gabnresponse_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gabnresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -156,19 +148,15 @@ lwres_result_t
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_gabnresponse_free</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gabnresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
@@ -176,61 +164,66 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_gabnrequest_free</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gabnrequest_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549528"></a><h2>DESCRIPTION</h2>
+<a name="id2543522"></a><h2>DESCRIPTION</h2>
 <p>
-These are low-level routines for creating and parsing
-lightweight resolver name-to-address lookup request and 
-response messages.
-</p>
+      These are low-level routines for creating and parsing
+      lightweight resolver name-to-address lookup request and
+      response messages.
+    </p>
 <p>
-There are four main functions for the getaddrbyname opcode.
-One render function converts a getaddrbyname request structure &#8212;
-<span class="type">lwres_gabnrequest_t</span> &#8212;
-to the lighweight resolver's canonical format.
-It is complemented by a parse function that converts a packet in this
-canonical format to a getaddrbyname request structure.
-Another render function converts the getaddrbyname response structure &#8212;
-<span class="type">lwres_gabnresponse_t</span> &#8212;
-to the canonical format.
-This is complemented by a parse function which converts a packet in
-canonical format to a getaddrbyname response structure.
-</p>
+      There are four main functions for the getaddrbyname opcode.
+      One render function converts a getaddrbyname request structure &#8212;
+      <span class="type">lwres_gabnrequest_t</span> &#8212;
+      to the lighweight resolver's canonical format.
+      It is complemented by a parse function that converts a packet in this
+      canonical format to a getaddrbyname request structure.
+      Another render function converts the getaddrbyname response structure
+      &#8212; <span class="type">lwres_gabnresponse_t</span> &#8212;
+      to the canonical format.
+      This is complemented by a parse function which converts a packet in
+      canonical format to a getaddrbyname response structure.
+    </p>
 <p>
-These structures are defined in
-<code class="filename">&lt;lwres/lwres.h&gt;</code>.
-They are shown below.
-</p>
+      These structures are defined in
+      <code class="filename">&lt;lwres/lwres.h&gt;</code>.
+      They are shown below.
+    </p>
 <pre class="programlisting">
 #define LWRES_OPCODE_GETADDRSBYNAME     0x00010001U
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 typedef struct lwres_addr lwres_addr_t;
 typedef LWRES_LIST(lwres_addr_t) lwres_addrlist_t;
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 typedef struct {
         lwres_uint32_t  flags;
         lwres_uint32_t  addrtypes;
         lwres_uint16_t  namelen;
         char           *name;
 } lwres_gabnrequest_t;
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 typedef struct {
         lwres_uint32_t          flags;
         lwres_uint16_t          naliases;
@@ -245,113 +238,87 @@ typedef struct {
 } lwres_gabnresponse_t;
 </pre>
 <p>
-</p>
-<p>
-<code class="function">lwres_gabnrequest_render()</code>
-uses resolver context
-<em class="parameter"><code>ctx</code></em>
-to convert getaddrbyname request structure
-<em class="parameter"><code>req</code></em>
-to canonical format.
-The packet header structure
-<em class="parameter"><code>pkt</code></em>
-is initialised and transferred to
-buffer
-<em class="parameter"><code>b</code></em>.
+    </p>
+<p><code class="function">lwres_gabnrequest_render()</code>
+      uses resolver context <em class="parameter"><code>ctx</code></em> to convert
+      getaddrbyname request structure <em class="parameter"><code>req</code></em> to
+      canonical format.  The packet header structure
+      <em class="parameter"><code>pkt</code></em> is initialised and transferred to
+      buffer <em class="parameter"><code>b</code></em>.
 
-The contents of
-<em class="parameter"><code>*req</code></em>
-are then appended to the buffer in canonical format.
-<code class="function">lwres_gabnresponse_render()</code>
-performs the same task, except it converts a getaddrbyname response structure
-<span class="type">lwres_gabnresponse_t</span>
-to the lightweight resolver's canonical format.
-</p>
-<p>
-<code class="function">lwres_gabnrequest_parse()</code>
-uses context
-<em class="parameter"><code>ctx</code></em>
-to convert the contents of packet
-<em class="parameter"><code>pkt</code></em>
-to a
-<span class="type">lwres_gabnrequest_t</span>
-structure.
-Buffer
-<em class="parameter"><code>b</code></em>
-provides space to be used for storing this structure.
-When the function succeeds, the resulting
-<span class="type">lwres_gabnrequest_t</span>
-is made available through
-<em class="parameter"><code>*structp</code></em>.
+      The contents of <em class="parameter"><code>*req</code></em> are then appended to
+      the buffer in canonical format.
+      <code class="function">lwres_gabnresponse_render()</code> performs the
+      same task, except it converts a getaddrbyname response structure
+      <span class="type">lwres_gabnresponse_t</span> to the lightweight resolver's
+      canonical format.
+    </p>
+<p><code class="function">lwres_gabnrequest_parse()</code>
+      uses context <em class="parameter"><code>ctx</code></em> to convert the contents
+      of packet <em class="parameter"><code>pkt</code></em> to a
+      <span class="type">lwres_gabnrequest_t</span> structure.  Buffer
+      <em class="parameter"><code>b</code></em> provides space to be used for storing
+      this structure.  When the function succeeds, the resulting
+      <span class="type">lwres_gabnrequest_t</span> is made available through
+      <em class="parameter"><code>*structp</code></em>.
 
-<code class="function">lwres_gabnresponse_parse()</code>
-offers the same semantics as
-<code class="function">lwres_gabnrequest_parse()</code>
-except it yields a
-<span class="type">lwres_gabnresponse_t</span>
-structure.
-</p>
-<p>
-<code class="function">lwres_gabnresponse_free()</code>
-and
-<code class="function">lwres_gabnrequest_free()</code>
-release the memory in resolver context
-<em class="parameter"><code>ctx</code></em>
-that was allocated to the
-<span class="type">lwres_gabnresponse_t</span>
-or
-<span class="type">lwres_gabnrequest_t</span>
-structures referenced via
-<em class="parameter"><code>structp</code></em>.
+      <code class="function">lwres_gabnresponse_parse()</code> offers the same
+      semantics as <code class="function">lwres_gabnrequest_parse()</code>
+      except it yields a <span class="type">lwres_gabnresponse_t</span> structure.
+    </p>
+<p><code class="function">lwres_gabnresponse_free()</code>
+      and <code class="function">lwres_gabnrequest_free()</code> release the
+      memory in resolver context <em class="parameter"><code>ctx</code></em> that was
+      allocated to the <span class="type">lwres_gabnresponse_t</span> or
+      <span class="type">lwres_gabnrequest_t</span> structures referenced via
+      <em class="parameter"><code>structp</code></em>.
 
-Any memory associated with ancillary buffers and strings for those
-structures is also discarded.
-</p>
+      Any memory associated with ancillary buffers and strings for
+      those structures is also discarded.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549720"></a><h2>RETURN VALUES</h2>
+<a name="id2543667"></a><h2>RETURN VALUES</h2>
 <p>
-The getaddrbyname opcode functions
-<code class="function">lwres_gabnrequest_render()</code>, 
-<code class="function">lwres_gabnresponse_render()</code>
-<code class="function">lwres_gabnrequest_parse()</code>
-and
-<code class="function">lwres_gabnresponse_parse()</code>
-all return
-<span class="errorcode">LWRES_R_SUCCESS</span>
-on success.
-They return
-<span class="errorcode">LWRES_R_NOMEMORY</span>
-if memory allocation fails.
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-is returned if the available space in the buffer
-<em class="parameter"><code>b</code></em>
-is too small to accommodate the packet header or the
-<span class="type">lwres_gabnrequest_t</span>
-and
-<span class="type">lwres_gabnresponse_t</span>
-structures.
-<code class="function">lwres_gabnrequest_parse()</code>
-and
-<code class="function">lwres_gabnresponse_parse()</code>
-will return
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-if the buffer is not empty after decoding the received packet.
-These functions will return
-<span class="errorcode">LWRES_R_FAILURE</span>
-if
-<em class="structfield"><code>pktflags</code></em>
-in the packet header structure
-<span class="type">lwres_lwpacket_t</span>
-indicate that the packet is not a response to an earlier query.
-</p>
+      The getaddrbyname opcode functions
+      <code class="function">lwres_gabnrequest_render()</code>,
+      <code class="function">lwres_gabnresponse_render()</code>
+      <code class="function">lwres_gabnrequest_parse()</code>
+      and
+      <code class="function">lwres_gabnresponse_parse()</code>
+      all return
+      <span class="errorcode">LWRES_R_SUCCESS</span>
+      on success.
+      They return
+      <span class="errorcode">LWRES_R_NOMEMORY</span>
+      if memory allocation fails.
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      is returned if the available space in the buffer
+      <em class="parameter"><code>b</code></em>
+      is too small to accommodate the packet header or the
+      <span class="type">lwres_gabnrequest_t</span>
+      and
+      <span class="type">lwres_gabnresponse_t</span>
+      structures.
+      <code class="function">lwres_gabnrequest_parse()</code>
+      and
+      <code class="function">lwres_gabnresponse_parse()</code>
+      will return
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      if the buffer is not empty after decoding the received packet.
+      These functions will return
+      <span class="errorcode">LWRES_R_FAILURE</span>
+      if
+      <em class="structfield"><code>pktflags</code></em>
+      in the packet header structure
+      <span class="type">lwres_lwpacket_t</span>
+      indicate that the packet is not a response to an earlier query.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549853"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3
-)</span>
-</p>
+<a name="id2543733"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3)</span>
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3 b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3
index e6efcd0..4fd03e2 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3
+++ b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_gai_strerror.3,v 1.13.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_gai_strerror.3,v 1.16.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_gai_strerror
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -30,56 +30,78 @@
 .\" disable justification (adjust text to left margin only)
 .ad l
 .SH "NAME"
-gai_strerror \- print suitable error string
+lwres_gai_strerror \- print suitable error string
 .SH "SYNOPSIS"
 .nf
 #include <lwres/netdb.h>
 .fi
 .HP 20
-.BI "char * gai_strerror(int\ ecode);"
+.BI "char * gai_strerror(int\ " "ecode" ");"
 .SH "DESCRIPTION"
 .PP
 \fBlwres_gai_strerror()\fR
 returns an error message corresponding to an error code returned by
 \fBgetaddrinfo()\fR. The following error codes and their meaning are defined in
 \fIinclude/lwres/netdb.h\fR.
-.TP 3n
+.PP
 \fBEAI_ADDRFAMILY\fR
+.RS 4
 address family for hostname not supported
-.TP 3n
+.RE
+.PP
 \fBEAI_AGAIN\fR
+.RS 4
 temporary failure in name resolution
-.TP 3n
+.RE
+.PP
 \fBEAI_BADFLAGS\fR
+.RS 4
 invalid value for
 \fBai_flags\fR
-.TP 3n
+.RE
+.PP
 \fBEAI_FAIL\fR
+.RS 4
 non\-recoverable failure in name resolution
-.TP 3n
+.RE
+.PP
 \fBEAI_FAMILY\fR
+.RS 4
 \fBai_family\fR
 not supported
-.TP 3n
+.RE
+.PP
 \fBEAI_MEMORY\fR
+.RS 4
 memory allocation failure
-.TP 3n
+.RE
+.PP
 \fBEAI_NODATA\fR
+.RS 4
 no address associated with hostname
-.TP 3n
+.RE
+.PP
 \fBEAI_NONAME\fR
+.RS 4
 hostname or servname not provided, or not known
-.TP 3n
+.RE
+.PP
 \fBEAI_SERVICE\fR
+.RS 4
 servname not supported for
 \fBai_socktype\fR
-.TP 3n
+.RE
+.PP
 \fBEAI_SOCKTYPE\fR
+.RS 4
 \fBai_socktype\fR
 not supported
-.TP 3n
+.RE
+.PP
 \fBEAI_SYSTEM\fR
+.RS 4
 system error returned in errno
+.RE
 The message
 invalid error code
 is returned if
@@ -101,4 +123,7 @@ used by
 \fBgetaddrinfo\fR(3),
 \fBRFC2133\fR().
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook
index f34836d..77a211b 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_gai_strerror.docbook,v 1.3.206.3 2005/05/12 21:36:13 sra Exp $ -->
-
+<!-- $Id: lwres_gai_strerror.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
-<refentryinfo>
 
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<date>Jun 30, 2000</date>
-</refentryinfo>
-<refmeta>
-<refentrytitle>lwres_gai_strerror</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_gai_strerror</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,133 +45,156 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>gai_strerror</refname>
-<refpurpose>print suitable error string</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_gai_strerror</refname>
+    <refpurpose>print suitable error string</refpurpose>
+  </refnamediv>
+
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/netdb.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 char *
 <function>gai_strerror</function></funcdef>
-<paramdef>int ecode</paramdef>
-</funcprototype>
+        <paramdef>int <parameter>ecode</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-<function>lwres_gai_strerror()</function>
-returns an error message corresponding to an error code returned by
-<function>getaddrinfo()</function>.
-The following error codes and their meaning are defined in
-<filename>include/lwres/netdb.h</filename>.
-<variablelist>
-<varlistentry><term><errorcode>EAI_ADDRFAMILY</errorcode></term>
-<listitem>
-<para>
-address family for hostname not supported
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_AGAIN</errorcode></term>
-<listitem>
-<para>
-temporary failure in name resolution
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_BADFLAGS</errorcode></term>
-<listitem>
-<para>
-invalid value for
-<constant>ai_flags</constant>
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_FAIL</errorcode></term>
-<listitem>
-<para>
-non-recoverable failure in name resolution
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_FAMILY</errorcode></term>
-<listitem>
-<para>
-<constant>ai_family</constant> not supported
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_MEMORY</errorcode></term>
-<listitem>
-<para>
-memory allocation failure
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_NODATA</errorcode></term>
-<listitem>
-<para>
-no address associated with hostname
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_NONAME</errorcode></term>
-<listitem>
-<para>
-hostname or servname not provided, or not known
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_SERVICE</errorcode></term>
-<listitem>
-<para>
-servname not supported for <constant>ai_socktype</constant>
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_SOCKTYPE</errorcode></term>
-<listitem>
-<para>
-<constant>ai_socktype</constant> not supported
-</para>
-</listitem></varlistentry>
-<varlistentry><term><errorcode>EAI_SYSTEM</errorcode></term>
-<listitem>
-<para>
-system error returned in errno
-</para>
-</listitem></varlistentry>
-</variablelist>
-The message <errorname>invalid error code</errorname> is returned if
-<parameter>ecode</parameter>
-is out of range.
-</para>
-<para>
-<constant>ai_flags</constant>,
-<constant>ai_family</constant>
-and
-<constant>ai_socktype</constant>
-are elements of the
-<type>struct  addrinfo</type>
-used by
-<function>lwres_getaddrinfo()</function>.
-</para>
-</refsect1>
+  <refsect1>
+    <title>DESCRIPTION</title>
 
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>strerror</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+    <para><function>lwres_gai_strerror()</function>
+      returns an error message corresponding to an error code returned by
+      <function>getaddrinfo()</function>.
+      The following error codes and their meaning are defined in
+      <filename>include/lwres/netdb.h</filename>.
+      <variablelist>
+        <varlistentry>
+          <term><errorcode>EAI_ADDRFAMILY</errorcode></term>
+          <listitem>
+            <para>
+              address family for hostname not supported
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_AGAIN</errorcode></term>
+          <listitem>
+            <para>
+              temporary failure in name resolution
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_BADFLAGS</errorcode></term>
+          <listitem>
+            <para>
+              invalid value for
+              <constant>ai_flags</constant>
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_FAIL</errorcode></term>
+          <listitem>
+            <para>
+              non-recoverable failure in name resolution
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_FAMILY</errorcode></term>
+          <listitem>
+            <para><constant>ai_family</constant> not supported
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_MEMORY</errorcode></term>
+          <listitem>
+            <para>
+              memory allocation failure
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_NODATA</errorcode></term>
+          <listitem>
+            <para>
+              no address associated with hostname
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_NONAME</errorcode></term>
+          <listitem>
+            <para>
+              hostname or servname not provided, or not known
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_SERVICE</errorcode></term>
+          <listitem>
+            <para>
+              servname not supported for <constant>ai_socktype</constant>
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_SOCKTYPE</errorcode></term>
+          <listitem>
+            <para><constant>ai_socktype</constant> not supported
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>EAI_SYSTEM</errorcode></term>
+          <listitem>
+            <para>
+              system error returned in errno
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+      The message <errorname>invalid error code</errorname> is returned if
+      <parameter>ecode</parameter>
+      is out of range.
+    </para>
+    <para><constant>ai_flags</constant>,
+      <constant>ai_family</constant>
+      and
+      <constant>ai_socktype</constant>
+      are elements of the
+      <type>struct  addrinfo</type>
+      used by
+      <function>lwres_getaddrinfo()</function>.
+    </para>
+  </refsect1>
 
-<citerefentry>
-<refentrytitle>lwres_getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>strerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>RFC2133</refentrytitle>
-</citerefentry>.
-</para>
-</refsect1>
-</refentry>
+      <citerefentry>
+        <refentrytitle>getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>RFC2133</refentrytitle>
+      </citerefentry>.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html
index 4b244e3..9673253 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html
+++ b/contrib/bind9/lib/lwres/man/lwres_gai_strerror.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,111 +14,111 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_gai_strerror.html,v 1.5.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_gai_strerror.html,v 1.6.18.18 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_gai_strerror</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
-<p>gai_strerror &#8212; print suitable error string</p>
+<p>lwres_gai_strerror &#8212; print suitable error string</p>
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
 <div class="funcsynopsis">
 <pre class="funcsynopsisinfo">#include &lt;lwres/netdb.h&gt;</pre>
-<p><code class="funcdef">
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0"><tr>
+<td><code class="funcdef">
 char *
-<b class="fsfunc">gai_strerror</b>(</code>int ecode<code>)</code>;</p>
+<b class="fsfunc">gai_strerror</b>(</code></td>
+<td>int  </td>
+<td>
+<var class="pdparam">ecode</var><code>)</code>;</td>
+</tr></table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549408"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_gai_strerror()</code>
-returns an error message corresponding to an error code returned by
-<code class="function">getaddrinfo()</code>.
-The following error codes and their meaning are defined in
-<code class="filename">include/lwres/netdb.h</code>.
-</p>
+<a name="id2543361"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_gai_strerror()</code>
+      returns an error message corresponding to an error code returned by
+      <code class="function">getaddrinfo()</code>.
+      The following error codes and their meaning are defined in
+      <code class="filename">include/lwres/netdb.h</code>.
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><span class="errorcode">EAI_ADDRFAMILY</span></span></dt>
 <dd><p>
-address family for hostname not supported
-</p></dd>
+              address family for hostname not supported
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_AGAIN</span></span></dt>
 <dd><p>
-temporary failure in name resolution
-</p></dd>
+              temporary failure in name resolution
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_BADFLAGS</span></span></dt>
 <dd><p>
-invalid value for
-<code class="constant">ai_flags</code>
-</p></dd>
+              invalid value for
+              <code class="constant">ai_flags</code>
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_FAIL</span></span></dt>
 <dd><p>
-non-recoverable failure in name resolution
-</p></dd>
+              non-recoverable failure in name resolution
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_FAMILY</span></span></dt>
-<dd><p>
-<code class="constant">ai_family</code> not supported
-</p></dd>
+<dd><p><code class="constant">ai_family</code> not supported
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_MEMORY</span></span></dt>
 <dd><p>
-memory allocation failure
-</p></dd>
+              memory allocation failure
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_NODATA</span></span></dt>
 <dd><p>
-no address associated with hostname
-</p></dd>
+              no address associated with hostname
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_NONAME</span></span></dt>
 <dd><p>
-hostname or servname not provided, or not known
-</p></dd>
+              hostname or servname not provided, or not known
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_SERVICE</span></span></dt>
 <dd><p>
-servname not supported for <code class="constant">ai_socktype</code>
-</p></dd>
+              servname not supported for <code class="constant">ai_socktype</code>
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_SOCKTYPE</span></span></dt>
-<dd><p>
-<code class="constant">ai_socktype</code> not supported
-</p></dd>
+<dd><p><code class="constant">ai_socktype</code> not supported
+            </p></dd>
 <dt><span class="term"><span class="errorcode">EAI_SYSTEM</span></span></dt>
 <dd><p>
-system error returned in errno
-</p></dd>
+              system error returned in errno
+            </p></dd>
 </dl></div>
 <p>
-The message <span class="errorname">invalid error code</span> is returned if
-<em class="parameter"><code>ecode</code></em>
-is out of range.
-</p>
-<p>
-<code class="constant">ai_flags</code>,
-<code class="constant">ai_family</code>
-and
-<code class="constant">ai_socktype</code>
-are elements of the
-<span class="type">struct  addrinfo</span>
-used by
-<code class="function">lwres_getaddrinfo()</code>.
-</p>
+      The message <span class="errorname">invalid error code</span> is returned if
+      <em class="parameter"><code>ecode</code></em>
+      is out of range.
+    </p>
+<p><code class="constant">ai_flags</code>,
+      <code class="constant">ai_family</code>
+      and
+      <code class="constant">ai_socktype</code>
+      are elements of the
+      <span class="type">struct  addrinfo</span>
+      used by
+      <code class="function">lwres_getaddrinfo()</code>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549605"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">strerror</span>(3)</span>,
+<a name="id2543576"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">strerror</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">getaddrinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">getaddrinfo</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">RFC2133</span></span>.
-</p>
+      <span class="citerefentry"><span class="refentrytitle">RFC2133</span></span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3 b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3
index fe52cd5..9d198d6 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3
+++ b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_getaddrinfo.3,v 1.16.2.1.8.7 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_getaddrinfo.3,v 1.20.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_getaddrinfo
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,14 +36,14 @@ lwres_getaddrinfo, lwres_freeaddrinfo \- socket address structure to host and se
 #include <lwres/netdb.h>
 .fi
 .HP 22
-.BI "int lwres_getaddrinfo(const\ char\ *hostname, const\ char\ *servname, const\ struct\ addrinfo\ *hints, struct\ addrinfo\ **res);"
+.BI "int lwres_getaddrinfo(const\ char\ *" "hostname" ", const\ char\ *" "servname" ", const\ struct\ addrinfo\ *" "hints" ", struct\ addrinfo\ **" "res" ");"
 .HP 24
-.BI "void lwres_freeaddrinfo(struct\ addrinfo\ *ai);"
+.BI "void lwres_freeaddrinfo(struct\ addrinfo\ *" "ai" ");"
 .PP
 If the operating system does not provide a
 \fBstruct addrinfo\fR, the following structure is used:
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 struct  addrinfo {
         int             ai_flags;       /* AI_PASSIVE, AI_CANONNAME */
@@ -82,14 +82,17 @@ is either a decimal port number or a service name as listed in
 is an optional pointer to a
 \fBstruct addrinfo\fR. This structure can be used to provide hints concerning the type of socket that the caller supports or wishes to use. The caller can supply the following structure elements in
 \fI*hints\fR:
-.TP 3n
+.PP
 \fBai_family\fR
+.RS 4
 The protocol family that should be used. When
 \fBai_family\fR
 is set to
 \fBPF_UNSPEC\fR, it means the caller will accept any protocol family supported by the operating system.
-.TP 3n
+.RE
+.PP
 \fBai_socktype\fR
+.RS 4
 denotes the type of socket \(em
 \fBSOCK_STREAM\fR,
 \fBSOCK_DGRAM\fR
@@ -98,13 +101,17 @@ or
 \(em that is wanted. When
 \fBai_socktype\fR
 is zero the caller will accept any socket type.
-.TP 3n
+.RE
+.PP
 \fBai_protocol\fR
+.RS 4
 indicates which transport protocol is wanted: IPPROTO_UDP or IPPROTO_TCP. If
 \fBai_protocol\fR
 is zero the caller will accept any protocol.
-.TP 3n
+.RE
+.PP
 \fBai_flags\fR
+.RS 4
 Flag bits. If the
 \fBAI_CANONNAME\fR
 bit is set, a successful call to
@@ -129,11 +136,11 @@ When
 does not set the
 \fBAI_PASSIVE\fR
 bit, the returned socket address structure will be ready for use in a call to
-\fBconnect\fR(2 )
+\fBconnect\fR(2)
 for a connection\-oriented protocol or
 \fBconnect\fR(2),
 \fBsendto\fR(2), or
-\fBsendmsg\fR(2 )
+\fBsendmsg\fR(2)
 if a connectionless protocol was chosen. The IP address portion of the socket address structure will be set to the loopback address if
 \fIhostname\fR
 is a
@@ -150,6 +157,7 @@ is set to
 it indicates that
 \fIhostname\fR
 should be treated as a numeric string defining an IPv4 or IPv6 address and no name resolution should be attempted.
+.RE
 .PP
 All other elements of the
 \fBstruct addrinfo\fR
@@ -208,7 +216,7 @@ created by a call to
 .PP
 \fBlwres_getaddrinfo()\fR
 returns zero on success or one of the error codes listed in
-\fBgai_strerror\fR(3 )
+\fBgai_strerror\fR(3)
 if an error occurs. If both
 \fIhostname\fR
 and
@@ -232,4 +240,7 @@ returns
 \fBsendmsg\fR(2),
 \fBsocket\fR(2).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook
index 1907219..fa7c086 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_getaddrinfo.docbook,v 1.5.206.4 2005/05/12 21:36:14 sra Exp $ -->
-
+<!-- $Id: lwres_getaddrinfo.docbook,v 1.7.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_getaddrinfo</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_getaddrinfo</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -46,37 +46,37 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_getaddrinfo</refname>
-<refname>lwres_freeaddrinfo</refname>
-<refpurpose>socket address structure to host and service name</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_getaddrinfo</refname>
+    <refname>lwres_freeaddrinfo</refname>
+    <refpurpose>socket address structure to host and service name</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/netdb.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 int
 <function>lwres_getaddrinfo</function></funcdef>
-<paramdef>const char *hostname</paramdef>
-<paramdef>const char *servname</paramdef>
-<paramdef>const struct addrinfo *hints</paramdef>
-<paramdef>struct addrinfo **res</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>hostname</parameter></paramdef>
+        <paramdef>const char *<parameter>servname</parameter></paramdef>
+        <paramdef>const struct addrinfo *<parameter>hints</parameter></paramdef>
+        <paramdef>struct addrinfo **<parameter>res</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_freeaddrinfo</function></funcdef>
-<paramdef>struct addrinfo *ai</paramdef>
-</funcprototype>
+        <paramdef>struct addrinfo *<parameter>ai</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
 
-<para>
-If the operating system does not provide a
-<type>struct addrinfo</type>,
-the following structure is used:
-
-<programlisting>
+    <para>
+      If the operating system does not provide a
+      <type>struct addrinfo</type>,
+      the following structure is used:
+    </para>
+    <para><programlisting>
 struct  addrinfo {
         int             ai_flags;       /* AI_PASSIVE, AI_CANONNAME */
         int             ai_family;      /* PF_xxx */
@@ -88,301 +88,300 @@ struct  addrinfo {
         struct addrinfo *ai_next;       /* next structure in linked list */
 };
 </programlisting>
-</para>
-
-</refsynopsisdiv>
-
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-<function>lwres_getaddrinfo()</function>
-is used to get a list of IP addresses and port numbers for host
-<parameter>hostname</parameter>
-and service
-<parameter>servname</parameter>.
-
-The function is the lightweight resolver's implementation of
-<function>getaddrinfo()</function>
-as defined in RFC2133.
-<parameter>hostname</parameter>
-and
-<parameter>servname</parameter>
-are pointers to null-terminated
-strings or
-<type>NULL</type>.
-
-<parameter>hostname</parameter>
-is either a host name or a numeric host address string: a dotted decimal
-IPv4 address or an IPv6 address.
-<parameter>servname</parameter>
-is either a decimal port number or a service name as listed in
-<filename>/etc/services</filename>.
-</para>
-
-<para>
-<parameter>hints</parameter>
-is an optional pointer to a
-<type>struct addrinfo</type>.
-This structure can be used to provide hints concerning the type of socket
-that the caller supports or wishes to use.
-The caller can supply the following structure elements in
-<parameter>*hints</parameter>:
-
-<variablelist>
-<varlistentry><term><constant>ai_family</constant></term>
-<listitem>
-<para>The protocol family that should be used.
-When
-<constant>ai_family</constant>
-is set to
-<type>PF_UNSPEC</type>,
-it means the caller will accept any protocol family supported by the
-operating system.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>ai_socktype</constant></term>
-<listitem>
-<para>
-denotes the type of socket &mdash;
-<type>SOCK_STREAM</type>,
-<type>SOCK_DGRAM</type>
-or
-<type>SOCK_RAW</type>
-&mdash; that is wanted.
-When
-<constant>ai_socktype</constant>
-is zero the caller will accept any socket type.
-</para>
-</listitem>
-</varlistentry>
-<varlistentry><term><constant>ai_protocol</constant></term>
-<listitem>
-<para>
-indicates which transport protocol is wanted: IPPROTO_UDP or 
-IPPROTO_TCP.
-If
-<constant>ai_protocol</constant>
-is zero the caller will accept any protocol.
-</para>
-</listitem>
-</varlistentry>
-<varlistentry><term><constant>ai_flags</constant></term>
-<listitem>
-<para>
-Flag bits.
-If the
-<type>AI_CANONNAME</type>
-bit is set, a successful call to
-<function>lwres_getaddrinfo()</function>
-will return a null-terminated string containing the canonical name
-of the specified hostname in
-<constant>ai_canonname</constant>
-of the first
-<type>addrinfo</type>
-structure returned.
-Setting the
-<type>AI_PASSIVE</type>
-bit indicates that the returned socket address structure is intended
-for used in a call to
-<citerefentry>
-<refentrytitle>bind</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>.
-
-In this case, if the hostname argument is a
-<type>NULL</type>
-pointer, then the IP address portion of the socket
-address structure will be set to
-<type>INADDR_ANY</type>
-for an IPv4 address or
-<type>IN6ADDR_ANY_INIT</type>
-for an IPv6 address.
-</para>
-<para>
-When
-<constant>ai_flags</constant>
-does not set the
-<type>AI_PASSIVE</type>
-bit, the returned socket address structure will be ready
-for use in a call to
-<citerefentry>
-<refentrytitle>connect</refentrytitle><manvolnum>2
-</manvolnum>
-</citerefentry>
-for a connection-oriented protocol or
-<citerefentry>
-<refentrytitle>connect</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>sendto</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>,
-
-or
-<citerefentry>
-<refentrytitle>sendmsg</refentrytitle><manvolnum>2
-</manvolnum>
-</citerefentry>
-if a connectionless protocol was chosen.
-The IP address portion of the socket address structure will be
-set to the loopback address if
-<parameter>hostname</parameter>
-is a
-<type>NULL</type>
-pointer and
-<type>AI_PASSIVE</type>
-is not set in
-<constant>ai_flags</constant>.
-</para>
-<para>
-If
-<constant>ai_flags</constant>
-is set to
-<type>AI_NUMERICHOST</type>
-it indicates that
-<parameter>hostname</parameter>
-should be treated as a numeric string defining an IPv4 or IPv6 address
-and no name resolution should be attempted.
-</para>
-</listitem>
-</varlistentry>
-</variablelist>
-</para>
-
-<para>
-All other elements of the <type>struct addrinfo</type> passed
-via <parameter>hints</parameter> must be zero.
-</para>
-
-<para>
-A <parameter>hints</parameter> of <type>NULL</type> is treated as if
-the caller provided a <type>struct addrinfo</type> initialized to zero
-with <constant>ai_family</constant>set to
-<constant>PF_UNSPEC</constant>.
-</para>
-
-<para>
-After a successful call to
-<function>lwres_getaddrinfo()</function>,
-<parameter>*res</parameter>
-is a pointer to a linked list of one or more
-<type>addrinfo</type>
-structures.
-Each
-<type>struct addrinfo</type>
-in this list cn be processed by following
-the
-<constant>ai_next</constant>
-pointer, until a
-<type>NULL</type>
-pointer is encountered.
-The three members
-<constant>ai_family</constant>,
-<constant>ai_socktype</constant>,
-and
-<constant>ai_protocol</constant>
-in each
-returned
-<type>addrinfo</type>
-structure contain the corresponding arguments for a call to
-<citerefentry>
-<refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>.
-For each
-<type>addrinfo</type>
-structure in the list, the
-<constant>ai_addr</constant>
-member points to a filled-in socket address structure of length
-<constant>ai_addrlen</constant>.
-</para>
-
-<para>
-All of the information returned by
-<function>lwres_getaddrinfo()</function>
-is dynamically allocated: the addrinfo structures, and the socket
-address structures and canonical host name strings pointed to by the
-<constant>addrinfo</constant>structures.
-Memory allocated for the dynamically allocated structures created by
-a successful call to
-<function>lwres_getaddrinfo()</function>
-is released by
-<function>lwres_freeaddrinfo()</function>.
-<parameter>ai</parameter>
-is a pointer to a
-<type>struct addrinfo</type>
-created by a call to
-<function>lwres_getaddrinfo()</function>.
-</para>
-
-</refsect1>
-
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-<function>lwres_getaddrinfo()</function>
-returns zero on success or one of the error codes listed in
-<citerefentry>
-<refentrytitle>gai_strerror</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-if an error occurs.
-If both
-<parameter>hostname</parameter>
-and
-<parameter>servname</parameter>
-are
-<type>NULL</type>
-<function>lwres_getaddrinfo()</function>
-returns
-<errorcode>EAI_NONAME</errorcode>.
-
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>lwres_getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>lwres_freeaddrinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>lwres_gai_strerror</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>RFC2133</refentrytitle>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>getservbyname</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>bind</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>connect</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>sendto</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>sendmsg</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum>
-</citerefentry>.
-</para>
-
-</refsect1>
-</refentry>
+    </para>
+
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>DESCRIPTION</title>
+
+    <para><function>lwres_getaddrinfo()</function>
+      is used to get a list of IP addresses and port numbers for host
+      <parameter>hostname</parameter> and service
+      <parameter>servname</parameter>.
+
+      The function is the lightweight resolver's implementation of
+      <function>getaddrinfo()</function> as defined in RFC2133.
+      <parameter>hostname</parameter> and
+      <parameter>servname</parameter> are pointers to null-terminated
+      strings or <type>NULL</type>.
+
+      <parameter>hostname</parameter> is either a host name or a
+      numeric host address string: a dotted decimal IPv4 address or an
+      IPv6 address.  <parameter>servname</parameter> is either a
+      decimal port number or a service name as listed in
+      <filename>/etc/services</filename>.
+    </para>
+
+    <para><parameter>hints</parameter>
+      is an optional pointer to a
+      <type>struct addrinfo</type>.
+      This structure can be used to provide hints concerning the type of
+      socket
+      that the caller supports or wishes to use.
+      The caller can supply the following structure elements in
+      <parameter>*hints</parameter>:
+
+      <variablelist>
+        <varlistentry>
+          <term><constant>ai_family</constant></term>
+          <listitem>
+            <para>
+              The protocol family that should be used.
+              When
+              <constant>ai_family</constant>
+              is set to
+              <type>PF_UNSPEC</type>,
+              it means the caller will accept any protocol family supported by
+              the
+              operating system.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>ai_socktype</constant></term>
+          <listitem>
+            <para>
+              denotes the type of socket &mdash;
+              <type>SOCK_STREAM</type>,
+              <type>SOCK_DGRAM</type>
+              or
+              <type>SOCK_RAW</type>
+              &mdash; that is wanted.
+              When
+              <constant>ai_socktype</constant>
+              is zero the caller will accept any socket type.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>ai_protocol</constant></term>
+          <listitem>
+            <para>
+              indicates which transport protocol is wanted: IPPROTO_UDP or
+              IPPROTO_TCP.
+              If
+              <constant>ai_protocol</constant>
+              is zero the caller will accept any protocol.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>ai_flags</constant></term>
+          <listitem>
+            <para>
+              Flag bits.
+              If the
+              <type>AI_CANONNAME</type>
+              bit is set, a successful call to
+              <function>lwres_getaddrinfo()</function>
+              will return a null-terminated string containing the canonical
+              name
+              of the specified hostname in
+              <constant>ai_canonname</constant>
+              of the first
+              <type>addrinfo</type>
+              structure returned.
+              Setting the
+              <type>AI_PASSIVE</type>
+              bit indicates that the returned socket address structure is
+              intended
+              for used in a call to
+              <citerefentry>
+                <refentrytitle>bind</refentrytitle><manvolnum>2</manvolnum>
+              </citerefentry>.
+
+              In this case, if the hostname argument is a
+              <type>NULL</type>
+              pointer, then the IP address portion of the socket
+              address structure will be set to
+              <type>INADDR_ANY</type>
+              for an IPv4 address or
+              <type>IN6ADDR_ANY_INIT</type>
+              for an IPv6 address.
+            </para>
+            <para>
+              When
+              <constant>ai_flags</constant>
+              does not set the
+              <type>AI_PASSIVE</type>
+              bit, the returned socket address structure will be ready
+              for use in a call to
+              <citerefentry>
+                <refentrytitle>connect</refentrytitle><manvolnum>2</manvolnum>
+              </citerefentry>
+              for a connection-oriented protocol or
+              <citerefentry>
+                <refentrytitle>connect</refentrytitle><manvolnum>2</manvolnum>
+              </citerefentry>,
+
+              <citerefentry>
+                <refentrytitle>sendto</refentrytitle><manvolnum>2</manvolnum>
+              </citerefentry>,
+
+              or
+              <citerefentry>
+                <refentrytitle>sendmsg</refentrytitle><manvolnum>2</manvolnum>
+              </citerefentry>
+              if a connectionless protocol was chosen.
+              The IP address portion of the socket address structure will be
+              set to the loopback address if
+              <parameter>hostname</parameter>
+              is a
+              <type>NULL</type>
+              pointer and
+              <type>AI_PASSIVE</type>
+              is not set in
+              <constant>ai_flags</constant>.
+            </para>
+            <para>
+              If
+              <constant>ai_flags</constant>
+              is set to
+              <type>AI_NUMERICHOST</type>
+              it indicates that
+              <parameter>hostname</parameter>
+              should be treated as a numeric string defining an IPv4 or IPv6
+              address
+              and no name resolution should be attempted.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
+
+    <para>
+      All other elements of the <type>struct addrinfo</type> passed
+      via <parameter>hints</parameter> must be zero.
+    </para>
+
+    <para>
+      A <parameter>hints</parameter> of <type>NULL</type> is
+      treated as if
+      the caller provided a <type>struct addrinfo</type> initialized to zero
+      with <constant>ai_family</constant>set to
+      <constant>PF_UNSPEC</constant>.
+    </para>
+
+    <para>
+      After a successful call to
+      <function>lwres_getaddrinfo()</function>,
+      <parameter>*res</parameter>
+      is a pointer to a linked list of one or more
+      <type>addrinfo</type>
+      structures.
+      Each
+      <type>struct addrinfo</type>
+      in this list cn be processed by following
+      the
+      <constant>ai_next</constant>
+      pointer, until a
+      <type>NULL</type>
+      pointer is encountered.
+      The three members
+      <constant>ai_family</constant>,
+      <constant>ai_socktype</constant>,
+      and
+      <constant>ai_protocol</constant>
+      in each
+      returned
+      <type>addrinfo</type>
+      structure contain the corresponding arguments for a call to
+      <citerefentry>
+        <refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>.
+      For each
+      <type>addrinfo</type>
+      structure in the list, the
+      <constant>ai_addr</constant>
+      member points to a filled-in socket address structure of length
+      <constant>ai_addrlen</constant>.
+    </para>
+
+    <para>
+      All of the information returned by
+      <function>lwres_getaddrinfo()</function>
+      is dynamically allocated: the addrinfo structures, and the socket
+      address structures and canonical host name strings pointed to by the
+      <constant>addrinfo</constant>structures.
+      Memory allocated for the dynamically allocated structures created by
+      a successful call to
+      <function>lwres_getaddrinfo()</function>
+      is released by
+      <function>lwres_freeaddrinfo()</function>.
+      <parameter>ai</parameter>
+      is a pointer to a
+      <type>struct addrinfo</type>
+      created by a call to
+      <function>lwres_getaddrinfo()</function>.
+    </para>
+
+  </refsect1>
+
+  <refsect1>
+    <title>RETURN VALUES</title>
+
+    <para><function>lwres_getaddrinfo()</function>
+      returns zero on success or one of the error codes listed in
+      <citerefentry>
+        <refentrytitle>gai_strerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+      if an error occurs.  If both <parameter>hostname</parameter> and
+      <parameter>servname</parameter> are <type>NULL</type>
+      <function>lwres_getaddrinfo()</function> returns
+      <errorcode>EAI_NONAME</errorcode>.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>lwres_getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>lwres_freeaddrinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>lwres_gai_strerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>RFC2133</refentrytitle>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>getservbyname</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>bind</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>connect</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>sendto</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>sendmsg</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>socket</refentrytitle><manvolnum>2</manvolnum>
+      </citerefentry>.
+    </para>
+
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html
index 375c319..d2dcdd9 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html
+++ b/contrib/bind9/lib/lwres/man/lwres_getaddrinfo.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_getaddrinfo.html,v 1.8.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_getaddrinfo.html,v 1.10.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_getaddrinfo</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_getaddrinfo, lwres_freeaddrinfo &#8212; socket address structure to host and service name</p>
@@ -36,54 +36,43 @@
 <td><code class="funcdef">
 int
 <b class="fsfunc">lwres_getaddrinfo</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">hostname</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">servname</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>const struct addrinfo * </td>
+<td>
+<var class="pdparam">hints</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>struct addrinfo ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">res</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_freeaddrinfo</b>(</code></td>
-<td> </td>
+<td>struct addrinfo * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">ai</var><code>)</code>;</td>
+</tr></table>
 </div>
 <p>
-If the operating system does not provide a
-<span class="type">struct addrinfo</span>,
-the following structure is used:
-
-</p>
+      If the operating system does not provide a
+      <span class="type">struct addrinfo</span>,
+      the following structure is used:
+    </p>
 <pre class="programlisting">
 struct  addrinfo {
         int             ai_flags;       /* AI_PASSIVE, AI_CANONNAME */
@@ -97,250 +86,237 @@ struct  addrinfo {
 };
 </pre>
 <p>
-</p>
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549448"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_getaddrinfo()</code>
-is used to get a list of IP addresses and port numbers for host
-<em class="parameter"><code>hostname</code></em>
-and service
-<em class="parameter"><code>servname</code></em>.
+<a name="id2543412"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_getaddrinfo()</code>
+      is used to get a list of IP addresses and port numbers for host
+      <em class="parameter"><code>hostname</code></em> and service
+      <em class="parameter"><code>servname</code></em>.
 
-The function is the lightweight resolver's implementation of
-<code class="function">getaddrinfo()</code>
-as defined in RFC2133.
-<em class="parameter"><code>hostname</code></em>
-and
-<em class="parameter"><code>servname</code></em>
-are pointers to null-terminated
-strings or
-<span class="type">NULL</span>.
+      The function is the lightweight resolver's implementation of
+      <code class="function">getaddrinfo()</code> as defined in RFC2133.
+      <em class="parameter"><code>hostname</code></em> and
+      <em class="parameter"><code>servname</code></em> are pointers to null-terminated
+      strings or <span class="type">NULL</span>.
 
-<em class="parameter"><code>hostname</code></em>
-is either a host name or a numeric host address string: a dotted decimal
-IPv4 address or an IPv6 address.
-<em class="parameter"><code>servname</code></em>
-is either a decimal port number or a service name as listed in
-<code class="filename">/etc/services</code>.
-</p>
-<p>
-<em class="parameter"><code>hints</code></em>
-is an optional pointer to a
-<span class="type">struct addrinfo</span>.
-This structure can be used to provide hints concerning the type of socket
-that the caller supports or wishes to use.
-The caller can supply the following structure elements in
-<em class="parameter"><code>*hints</code></em>:
+      <em class="parameter"><code>hostname</code></em> is either a host name or a
+      numeric host address string: a dotted decimal IPv4 address or an
+      IPv6 address.  <em class="parameter"><code>servname</code></em> is either a
+      decimal port number or a service name as listed in
+      <code class="filename">/etc/services</code>.
+    </p>
+<p><em class="parameter"><code>hints</code></em>
+      is an optional pointer to a
+      <span class="type">struct addrinfo</span>.
+      This structure can be used to provide hints concerning the type of
+      socket
+      that the caller supports or wishes to use.
+      The caller can supply the following structure elements in
+      <em class="parameter"><code>*hints</code></em>:
 
-</p>
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">ai_family</code></span></dt>
-<dd><p>The protocol family that should be used.
-When
-<code class="constant">ai_family</code>
-is set to
-<span class="type">PF_UNSPEC</span>,
-it means the caller will accept any protocol family supported by the
-operating system.
-</p></dd>
+<dd><p>
+              The protocol family that should be used.
+              When
+              <code class="constant">ai_family</code>
+              is set to
+              <span class="type">PF_UNSPEC</span>,
+              it means the caller will accept any protocol family supported by
+              the
+              operating system.
+            </p></dd>
 <dt><span class="term"><code class="constant">ai_socktype</code></span></dt>
 <dd><p>
-denotes the type of socket &#8212;
-<span class="type">SOCK_STREAM</span>,
-<span class="type">SOCK_DGRAM</span>
-or
-<span class="type">SOCK_RAW</span>
-&#8212; that is wanted.
-When
-<code class="constant">ai_socktype</code>
-is zero the caller will accept any socket type.
-</p></dd>
+              denotes the type of socket &#8212;
+              <span class="type">SOCK_STREAM</span>,
+              <span class="type">SOCK_DGRAM</span>
+              or
+              <span class="type">SOCK_RAW</span>
+              &#8212; that is wanted.
+              When
+              <code class="constant">ai_socktype</code>
+              is zero the caller will accept any socket type.
+            </p></dd>
 <dt><span class="term"><code class="constant">ai_protocol</code></span></dt>
 <dd><p>
-indicates which transport protocol is wanted: IPPROTO_UDP or 
-IPPROTO_TCP.
-If
-<code class="constant">ai_protocol</code>
-is zero the caller will accept any protocol.
-</p></dd>
+              indicates which transport protocol is wanted: IPPROTO_UDP or
+              IPPROTO_TCP.
+              If
+              <code class="constant">ai_protocol</code>
+              is zero the caller will accept any protocol.
+            </p></dd>
 <dt><span class="term"><code class="constant">ai_flags</code></span></dt>
 <dd>
 <p>
-Flag bits.
-If the
-<span class="type">AI_CANONNAME</span>
-bit is set, a successful call to
-<code class="function">lwres_getaddrinfo()</code>
-will return a null-terminated string containing the canonical name
-of the specified hostname in
-<code class="constant">ai_canonname</code>
-of the first
-<span class="type">addrinfo</span>
-structure returned.
-Setting the
-<span class="type">AI_PASSIVE</span>
-bit indicates that the returned socket address structure is intended
-for used in a call to
-<span class="citerefentry"><span class="refentrytitle">bind</span>(2)</span>.
+              Flag bits.
+              If the
+              <span class="type">AI_CANONNAME</span>
+              bit is set, a successful call to
+              <code class="function">lwres_getaddrinfo()</code>
+              will return a null-terminated string containing the canonical
+              name
+              of the specified hostname in
+              <code class="constant">ai_canonname</code>
+              of the first
+              <span class="type">addrinfo</span>
+              structure returned.
+              Setting the
+              <span class="type">AI_PASSIVE</span>
+              bit indicates that the returned socket address structure is
+              intended
+              for used in a call to
+              <span class="citerefentry"><span class="refentrytitle">bind</span>(2)</span>.
 
-In this case, if the hostname argument is a
-<span class="type">NULL</span>
-pointer, then the IP address portion of the socket
-address structure will be set to
-<span class="type">INADDR_ANY</span>
-for an IPv4 address or
-<span class="type">IN6ADDR_ANY_INIT</span>
-for an IPv6 address.
-</p>
+              In this case, if the hostname argument is a
+              <span class="type">NULL</span>
+              pointer, then the IP address portion of the socket
+              address structure will be set to
+              <span class="type">INADDR_ANY</span>
+              for an IPv4 address or
+              <span class="type">IN6ADDR_ANY_INIT</span>
+              for an IPv6 address.
+            </p>
 <p>
-When
-<code class="constant">ai_flags</code>
-does not set the
-<span class="type">AI_PASSIVE</span>
-bit, the returned socket address structure will be ready
-for use in a call to
-<span class="citerefentry"><span class="refentrytitle">connect</span>(2
-)</span>
-for a connection-oriented protocol or
-<span class="citerefentry"><span class="refentrytitle">connect</span>(2)</span>,
+              When
+              <code class="constant">ai_flags</code>
+              does not set the
+              <span class="type">AI_PASSIVE</span>
+              bit, the returned socket address structure will be ready
+              for use in a call to
+              <span class="citerefentry"><span class="refentrytitle">connect</span>(2)</span>
+              for a connection-oriented protocol or
+              <span class="citerefentry"><span class="refentrytitle">connect</span>(2)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">sendto</span>(2)</span>,
+              <span class="citerefentry"><span class="refentrytitle">sendto</span>(2)</span>,
 
-or
-<span class="citerefentry"><span class="refentrytitle">sendmsg</span>(2
-)</span>
-if a connectionless protocol was chosen.
-The IP address portion of the socket address structure will be
-set to the loopback address if
-<em class="parameter"><code>hostname</code></em>
-is a
-<span class="type">NULL</span>
-pointer and
-<span class="type">AI_PASSIVE</span>
-is not set in
-<code class="constant">ai_flags</code>.
-</p>
+              or
+              <span class="citerefentry"><span class="refentrytitle">sendmsg</span>(2)</span>
+              if a connectionless protocol was chosen.
+              The IP address portion of the socket address structure will be
+              set to the loopback address if
+              <em class="parameter"><code>hostname</code></em>
+              is a
+              <span class="type">NULL</span>
+              pointer and
+              <span class="type">AI_PASSIVE</span>
+              is not set in
+              <code class="constant">ai_flags</code>.
+            </p>
 <p>
-If
-<code class="constant">ai_flags</code>
-is set to
-<span class="type">AI_NUMERICHOST</span>
-it indicates that
-<em class="parameter"><code>hostname</code></em>
-should be treated as a numeric string defining an IPv4 or IPv6 address
-and no name resolution should be attempted.
-</p>
+              If
+              <code class="constant">ai_flags</code>
+              is set to
+              <span class="type">AI_NUMERICHOST</span>
+              it indicates that
+              <em class="parameter"><code>hostname</code></em>
+              should be treated as a numeric string defining an IPv4 or IPv6
+              address
+              and no name resolution should be attempted.
+            </p>
 </dd>
 </dl></div>
 <p>
-</p>
+    </p>
 <p>
-All other elements of the <span class="type">struct addrinfo</span> passed
-via <em class="parameter"><code>hints</code></em> must be zero.
-</p>
+      All other elements of the <span class="type">struct addrinfo</span> passed
+      via <em class="parameter"><code>hints</code></em> must be zero.
+    </p>
 <p>
-A <em class="parameter"><code>hints</code></em> of <span class="type">NULL</span> is treated as if
-the caller provided a <span class="type">struct addrinfo</span> initialized to zero
-with <code class="constant">ai_family</code>set to
-<code class="constant">PF_UNSPEC</code>.
-</p>
+      A <em class="parameter"><code>hints</code></em> of <span class="type">NULL</span> is
+      treated as if
+      the caller provided a <span class="type">struct addrinfo</span> initialized to zero
+      with <code class="constant">ai_family</code>set to
+      <code class="constant">PF_UNSPEC</code>.
+    </p>
 <p>
-After a successful call to
-<code class="function">lwres_getaddrinfo()</code>,
-<em class="parameter"><code>*res</code></em>
-is a pointer to a linked list of one or more
-<span class="type">addrinfo</span>
-structures.
-Each
-<span class="type">struct addrinfo</span>
-in this list cn be processed by following
-the
-<code class="constant">ai_next</code>
-pointer, until a
-<span class="type">NULL</span>
-pointer is encountered.
-The three members
-<code class="constant">ai_family</code>,
-<code class="constant">ai_socktype</code>,
-and
-<code class="constant">ai_protocol</code>
-in each
-returned
-<span class="type">addrinfo</span>
-structure contain the corresponding arguments for a call to
-<span class="citerefentry"><span class="refentrytitle">socket</span>(2)</span>.
-For each
-<span class="type">addrinfo</span>
-structure in the list, the
-<code class="constant">ai_addr</code>
-member points to a filled-in socket address structure of length
-<code class="constant">ai_addrlen</code>.
-</p>
+      After a successful call to
+      <code class="function">lwres_getaddrinfo()</code>,
+      <em class="parameter"><code>*res</code></em>
+      is a pointer to a linked list of one or more
+      <span class="type">addrinfo</span>
+      structures.
+      Each
+      <span class="type">struct addrinfo</span>
+      in this list cn be processed by following
+      the
+      <code class="constant">ai_next</code>
+      pointer, until a
+      <span class="type">NULL</span>
+      pointer is encountered.
+      The three members
+      <code class="constant">ai_family</code>,
+      <code class="constant">ai_socktype</code>,
+      and
+      <code class="constant">ai_protocol</code>
+      in each
+      returned
+      <span class="type">addrinfo</span>
+      structure contain the corresponding arguments for a call to
+      <span class="citerefentry"><span class="refentrytitle">socket</span>(2)</span>.
+      For each
+      <span class="type">addrinfo</span>
+      structure in the list, the
+      <code class="constant">ai_addr</code>
+      member points to a filled-in socket address structure of length
+      <code class="constant">ai_addrlen</code>.
+    </p>
 <p>
-All of the information returned by
-<code class="function">lwres_getaddrinfo()</code>
-is dynamically allocated: the addrinfo structures, and the socket
-address structures and canonical host name strings pointed to by the
-<code class="constant">addrinfo</code>structures.
-Memory allocated for the dynamically allocated structures created by
-a successful call to
-<code class="function">lwres_getaddrinfo()</code>
-is released by
-<code class="function">lwres_freeaddrinfo()</code>.
-<em class="parameter"><code>ai</code></em>
-is a pointer to a
-<span class="type">struct addrinfo</span>
-created by a call to
-<code class="function">lwres_getaddrinfo()</code>.
-</p>
+      All of the information returned by
+      <code class="function">lwres_getaddrinfo()</code>
+      is dynamically allocated: the addrinfo structures, and the socket
+      address structures and canonical host name strings pointed to by the
+      <code class="constant">addrinfo</code>structures.
+      Memory allocated for the dynamically allocated structures created by
+      a successful call to
+      <code class="function">lwres_getaddrinfo()</code>
+      is released by
+      <code class="function">lwres_freeaddrinfo()</code>.
+      <em class="parameter"><code>ai</code></em>
+      is a pointer to a
+      <span class="type">struct addrinfo</span>
+      created by a call to
+      <code class="function">lwres_getaddrinfo()</code>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549874"></a><h2>RETURN VALUES</h2>
-<p>
-<code class="function">lwres_getaddrinfo()</code>
-returns zero on success or one of the error codes listed in
-<span class="citerefentry"><span class="refentrytitle">gai_strerror</span>(3
-)</span>
-if an error occurs.
-If both
-<em class="parameter"><code>hostname</code></em>
-and
-<em class="parameter"><code>servname</code></em>
-are
-<span class="type">NULL</span>
-<code class="function">lwres_getaddrinfo()</code>
-returns
-<span class="errorcode">EAI_NONAME</span>.
-
-</p>
+<a name="id2543789"></a><h2>RETURN VALUES</h2>
+<p><code class="function">lwres_getaddrinfo()</code>
+      returns zero on success or one of the error codes listed in
+      <span class="citerefentry"><span class="refentrytitle">gai_strerror</span>(3)</span>
+      if an error occurs.  If both <em class="parameter"><code>hostname</code></em> and
+      <em class="parameter"><code>servname</code></em> are <span class="type">NULL</span>
+      <code class="function">lwres_getaddrinfo()</code> returns
+      <span class="errorcode">EAI_NONAME</span>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549912"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
+<a name="id2543827"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_freeaddrinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_freeaddrinfo</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_gai_strerror</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_gai_strerror</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">RFC2133</span></span>,
+      <span class="citerefentry"><span class="refentrytitle">RFC2133</span></span>,
 
-<span class="citerefentry"><span class="refentrytitle">getservbyname</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">getservbyname</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">bind</span>(2)</span>,
+      <span class="citerefentry"><span class="refentrytitle">bind</span>(2)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">connect</span>(2)</span>,
+      <span class="citerefentry"><span class="refentrytitle">connect</span>(2)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">sendto</span>(2)</span>,
+      <span class="citerefentry"><span class="refentrytitle">sendto</span>(2)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">sendmsg</span>(2)</span>,
+      <span class="citerefentry"><span class="refentrytitle">sendmsg</span>(2)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">socket</span>(2)</span>.
-</p>
+      <span class="citerefentry"><span class="refentrytitle">socket</span>(2)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_gethostent.3 b/contrib/bind9/lib/lwres/man/lwres_gethostent.3
index 6fe933d7..e6fbcd7 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gethostent.3
+++ b/contrib/bind9/lib/lwres/man/lwres_gethostent.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_gethostent.3,v 1.16.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_gethostent.3,v 1.19.18.10 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_gethostent
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,37 +36,37 @@ lwres_gethostbyname, lwres_gethostbyname2, lwres_gethostbyaddr, lwres_gethostent
 #include <lwres/netdb.h>
 .fi
 .HP 37
-.BI "struct hostent * lwres_gethostbyname(const\ char\ *name);"
+.BI "struct hostent * lwres_gethostbyname(const\ char\ *" "name" ");"
 .HP 38
-.BI "struct hostent * lwres_gethostbyname2(const\ char\ *name, int\ af);"
+.BI "struct hostent * lwres_gethostbyname2(const\ char\ *" "name" ", int\ " "af" ");"
 .HP 37
-.BI "struct hostent * lwres_gethostbyaddr(const\ char\ *addr, int\ len, int\ type);"
+.BI "struct hostent * lwres_gethostbyaddr(const\ char\ *" "addr" ", int\ " "len" ", int\ " "type" ");"
 .HP 34
 .BI "struct hostent * lwres_gethostent(void);"
 .HP 22
-.BI "void lwres_sethostent(int\ stayopen);"
+.BI "void lwres_sethostent(int\ " "stayopen" ");"
 .HP 22
 .BI "void lwres_endhostent(void);"
 .HP 39
-.BI "struct hostent * lwres_gethostbyname_r(const\ char\ *name, struct\ hostent\ *resbuf, char\ *buf, int\ buflen, int\ *error);"
+.BI "struct hostent * lwres_gethostbyname_r(const\ char\ *" "name" ", struct\ hostent\ *" "resbuf" ", char\ *" "buf" ", int\ " "buflen" ", int\ *" "error" ");"
 .HP 39
-.BI "struct hostent * lwres_gethostbyaddr_r(const\ char\ *addr, int\ len, int\ type, struct\ hostent\ *resbuf, char\ *buf, int\ buflen, int\ *error);"
+.BI "struct hostent * lwres_gethostbyaddr_r(const\ char\ *" "addr" ", int\ " "len" ", int\ " "type" ", struct\ hostent\ *" "resbuf" ", char\ *" "buf" ", int\ " "buflen" ", int\ *" "error" ");"
 .HP 36
-.BI "struct hostent * lwres_gethostent_r(struct\ hostent\ *resbuf, char\ *buf, int\ buflen, int\ *error);"
+.BI "struct hostent * lwres_gethostent_r(struct\ hostent\ *" "resbuf" ", char\ *" "buf" ", int\ " "buflen" ", int\ *" "error" ");"
 .HP 24
-.BI "void lwres_sethostent_r(int\ stayopen);"
+.BI "void lwres_sethostent_r(int\ " "stayopen" ");"
 .HP 24
 .BI "void lwres_endhostent_r(void);"
 .SH "DESCRIPTION"
 .PP
 These functions provide hostname\-to\-address and address\-to\-hostname lookups by means of the lightweight resolver. They are similar to the standard
-\fBgethostent\fR(3 )
+\fBgethostent\fR(3)
 functions provided by most operating systems. They use a
 \fBstruct hostent\fR
 which is usually defined in
 \fI<namedb.h>\fR.
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 struct  hostent {
         char    *h_name;        /* official name of host */
@@ -81,26 +81,36 @@ struct  hostent {
 .sp
 .PP
 The members of this structure are:
-.TP 3n
+.PP
 \fBh_name\fR
+.RS 4
 The official (canonical) name of the host.
-.TP 3n
+.RE
+.PP
 \fBh_aliases\fR
+.RS 4
 A NULL\-terminated array of alternate names (nicknames) for the host.
-.TP 3n
+.RE
+.PP
 \fBh_addrtype\fR
+.RS 4
 The type of address being returned \(em
 \fBPF_INET\fR
 or
 \fBPF_INET6\fR.
-.TP 3n
+.RE
+.PP
 \fBh_length\fR
+.RS 4
 The length of the address in bytes.
-.TP 3n
+.RE
+.PP
 \fBh_addr_list\fR
+.RS 4
 A
 \fBNULL\fR
 terminated array of network addresses for the host. Host addresses are returned in network byte order.
+.RE
 .PP
 For backward compatibility with very old software,
 \fBh_addr\fR
@@ -158,8 +168,7 @@ is a thread\-safe function for forward lookups. If an error occurs, an error cod
 is a pointer to a
 \fBstruct hostent\fR
 which is initialised by a successful call to
-\fBlwres_gethostbyname_r()\fR
-.
+\fBlwres_gethostbyname_r()\fR.
 \fIbuf\fR
 is a buffer of length
 \fIlen\fR
@@ -222,20 +231,28 @@ return NULL to indicate an error. In this case the global variable
 \fBlwres_h_errno\fR
 will contain one of the following error codes defined in
 \fI<lwres/netdb.h>\fR:
-.TP 3n
+.PP
 \fBHOST_NOT_FOUND\fR
+.RS 4
 The host or address was not found.
-.TP 3n
+.RE
+.PP
 \fBTRY_AGAIN\fR
+.RS 4
 A recoverable error occurred, e.g., a timeout. Retrying the lookup may succeed.
-.TP 3n
+.RE
+.PP
 \fBNO_RECOVERY\fR
+.RS 4
 A non\-recoverable error occurred.
-.TP 3n
+.RE
+.PP
 \fBNO_DATA\fR
+.RS 4
 The name exists, but has no address information associated with it (or vice versa in the case of a reverse lookup). The code NO_ADDRESS is accepted as a synonym for NO_DATA for backwards compatibility.
+.RE
 .PP
-\fBlwres_hstrerror\fR(3 )
+\fBlwres_hstrerror\fR(3)
 translates these error codes to suitable error messages.
 .PP
 \fBlwres_gethostent()\fR
@@ -274,7 +291,7 @@ to
 .PP
 \fBgethostent\fR(3),
 \fBlwres_getipnode\fR(3),
-\fBlwres_hstrerror\fR(3 )
+\fBlwres_hstrerror\fR(3)
 .SH "BUGS"
 .PP
 \fBlwres_gethostbyname()\fR,
@@ -292,4 +309,7 @@ The resolver daemon does not currently support any non\-DNS name services such a
 or
 \fBNIS\fR, consequently the above functions don't, either.
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook b/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook
index 9f92d3b..41a3bc3 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_gethostent.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_gethostent.docbook,v 1.5.206.3 2005/05/13 01:22:36 marka Exp $ -->
-
+<!-- $Id: lwres_gethostent.docbook,v 1.6.18.4 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_gethostent</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_gethostent</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -44,125 +44,124 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_gethostbyname</refname>
-<refname>lwres_gethostbyname2</refname>
-<refname>lwres_gethostbyaddr</refname>
-<refname>lwres_gethostent</refname>
-<refname>lwres_sethostent</refname>
-<refname>lwres_endhostent</refname>
-<refname>lwres_gethostbyname_r</refname>
-<refname>lwres_gethostbyaddr_r</refname>
-<refname>lwres_gethostent_r</refname>
-<refname>lwres_sethostent_r</refname>
-<refname>lwres_endhostent_r</refname>
-<refpurpose>lightweight resolver get network host entry</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_gethostbyname</refname>
+    <refname>lwres_gethostbyname2</refname>
+    <refname>lwres_gethostbyaddr</refname>
+    <refname>lwres_gethostent</refname>
+    <refname>lwres_sethostent</refname>
+    <refname>lwres_endhostent</refname>
+    <refname>lwres_gethostbyname_r</refname>
+    <refname>lwres_gethostbyaddr_r</refname>
+    <refname>lwres_gethostent_r</refname>
+    <refname>lwres_sethostent_r</refname>
+    <refname>lwres_endhostent_r</refname>
+    <refpurpose>lightweight resolver get network host entry</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/netdb.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent *
 <function>lwres_gethostbyname</function></funcdef>
-<paramdef>const char *name</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>name</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent *
 <function>lwres_gethostbyname2</function></funcdef>
-<paramdef>const char *name</paramdef>
-<paramdef>int af</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>name</parameter></paramdef>
+        <paramdef>int <parameter>af</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent *
 <function>lwres_gethostbyaddr</function></funcdef>
-<paramdef>const char *addr</paramdef>
-<paramdef>int len</paramdef>
-<paramdef>int type</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>addr</parameter></paramdef>
+        <paramdef>int <parameter>len</parameter></paramdef>
+        <paramdef>int <parameter>type</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent *
 <function>lwres_gethostent</function></funcdef>
-<paramdef>void</paramdef>
-</funcprototype>
+        <paramdef>void</paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_sethostent</function></funcdef>
-<paramdef>int stayopen</paramdef>
-</funcprototype>
+        <paramdef>int <parameter>stayopen</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_endhostent</function></funcdef>
-<paramdef>void</paramdef>
-</funcprototype>
+        <paramdef>void</paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent *
 <function>lwres_gethostbyname_r</function></funcdef>
-<paramdef>const char *name</paramdef>
-<paramdef>struct hostent *resbuf</paramdef>
-<paramdef>char *buf</paramdef>
-<paramdef>int buflen</paramdef>
-<paramdef>int *error</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>name</parameter></paramdef>
+        <paramdef>struct hostent *<parameter>resbuf</parameter></paramdef>
+        <paramdef>char *<parameter>buf</parameter></paramdef>
+        <paramdef>int <parameter>buflen</parameter></paramdef>
+        <paramdef>int *<parameter>error</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent  *
 <function>lwres_gethostbyaddr_r</function></funcdef>
-<paramdef>const char *addr</paramdef>
-<paramdef>int len</paramdef>
-<paramdef>int type</paramdef>
-<paramdef>struct hostent *resbuf</paramdef>
-<paramdef>char *buf</paramdef>
-<paramdef>int buflen</paramdef>
-<paramdef>int *error</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>addr</parameter></paramdef>
+        <paramdef>int <parameter>len</parameter></paramdef>
+        <paramdef>int <parameter>type</parameter></paramdef>
+        <paramdef>struct hostent *<parameter>resbuf</parameter></paramdef>
+        <paramdef>char *<parameter>buf</parameter></paramdef>
+        <paramdef>int <parameter>buflen</parameter></paramdef>
+        <paramdef>int *<parameter>error</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent  *
 <function>lwres_gethostent_r</function></funcdef>
-<paramdef>struct hostent *resbuf</paramdef>
-<paramdef>char *buf</paramdef>
-<paramdef>int buflen</paramdef>
-<paramdef>int *error</paramdef>
-</funcprototype>
+        <paramdef>struct hostent *<parameter>resbuf</parameter></paramdef>
+        <paramdef>char *<parameter>buf</parameter></paramdef>
+        <paramdef>int <parameter>buflen</parameter></paramdef>
+        <paramdef>int *<parameter>error</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_sethostent_r</function></funcdef>
-<paramdef>int stayopen</paramdef>
-</funcprototype>
+        <paramdef>int <parameter>stayopen</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_endhostent_r</function></funcdef>
-<paramdef>void</paramdef>
-</funcprototype>
+        <paramdef>void</paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
-
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-These functions provide hostname-to-address and
-address-to-hostname lookups by means of the lightweight resolver.
-They are similar to the standard
-<citerefentry>
-<refentrytitle>gethostent</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-functions provided by most operating systems.
-They use a
-<type>struct hostent</type>
-which is usually defined in
-<filename>&lt;namedb.h&gt;</filename>.
+  </refsynopsisdiv>
 
-<programlisting>
+  <refsect1>
+    <title>DESCRIPTION</title>
+    <para>
+      These functions provide hostname-to-address and
+      address-to-hostname lookups by means of the lightweight resolver.
+      They are similar to the standard
+      <citerefentry>
+        <refentrytitle>gethostent</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+      functions provided by most operating systems.
+      They use a
+      <type>struct hostent</type>
+      which is usually defined in
+      <filename>&lt;namedb.h&gt;</filename>.
+    </para>
+    <para><programlisting>
 struct  hostent {
         char    *h_name;        /* official name of host */
         char    **h_aliases;    /* alias list */
@@ -172,250 +171,269 @@ struct  hostent {
 };
 #define h_addr  h_addr_list[0]  /* address, for backward compatibility */
 </programlisting>
-</para>
-<para>
-The members of this structure are:
-<variablelist>
-<varlistentry><term><constant>h_name</constant></term>
-<listitem>
-<para>
-The official (canonical) name of the host.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_aliases</constant></term>
-<listitem>
-<para>
-A NULL-terminated array of alternate names (nicknames) for the host.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_addrtype</constant></term>
-<listitem>
-<para>
-The type of address being returned &mdash;
-<type>PF_INET</type>
-or
-<type>PF_INET6</type>.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_length</constant></term>
-<listitem>
-<para>
-The length of the address in bytes.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_addr_list</constant></term>
-<listitem>
-<para>
-A <type>NULL</type>
-terminated array of network addresses for the host.
-Host addresses are returned in network byte order.
-</para>
-</listitem></varlistentry>
-</variablelist>
-</para>
-<para>
-For backward compatibility with very old software,
-<constant>h_addr</constant>
-is the first address in
-<constant>h_addr_list.</constant>
-</para>
-<para>
-<function>lwres_gethostent()</function>,
-<function>lwres_sethostent()</function>,
-<function>lwres_endhostent()</function>,
-<function>lwres_gethostent_r()</function>,
-<function>lwres_sethostent_r()</function>
-and
-<function>lwres_endhostent_r()</function>
-provide iteration over the known host entries on systems that
-provide such functionality through facilities like
-<filename>/etc/hosts</filename>
-or NIS.  The lightweight resolver does not currently implement
-these functions; it only provides them as stub functions that always
-return failure.
-</para>
+    </para>
+    <para>
+      The members of this structure are:
+      <variablelist>
+        <varlistentry>
+          <term><constant>h_name</constant></term>
+          <listitem>
+            <para>
+              The official (canonical) name of the host.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_aliases</constant></term>
+          <listitem>
+            <para>
+              A NULL-terminated array of alternate names (nicknames) for the
+              host.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_addrtype</constant></term>
+          <listitem>
+            <para>
+              The type of address being returned &mdash;
+              <type>PF_INET</type>
+              or
+              <type>PF_INET6</type>.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_length</constant></term>
+          <listitem>
+            <para>
+              The length of the address in bytes.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_addr_list</constant></term>
+          <listitem>
+            <para>
+              A <type>NULL</type>
+              terminated array of network addresses for the host.
+              Host addresses are returned in network byte order.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
+    <para>
+      For backward compatibility with very old software,
+      <constant>h_addr</constant>
+      is the first address in
+      <constant>h_addr_list.</constant>
+    </para>
+    <para><function>lwres_gethostent()</function>,
+      <function>lwres_sethostent()</function>,
+      <function>lwres_endhostent()</function>,
+      <function>lwres_gethostent_r()</function>,
+      <function>lwres_sethostent_r()</function>
+      and
+      <function>lwres_endhostent_r()</function>
+      provide iteration over the known host entries on systems that
+      provide such functionality through facilities like
+      <filename>/etc/hosts</filename>
+      or NIS.  The lightweight resolver does not currently implement
+      these functions; it only provides them as stub functions that always
+      return failure.
+    </para>
 
-<para>
-<function>lwres_gethostbyname()</function> and
-<function>lwres_gethostbyname2()</function> look up the hostname
-<parameter>name</parameter>.
-<function>lwres_gethostbyname()</function> always looks for an IPv4
-address while <function>lwres_gethostbyname2()</function> looks for an
-address of protocol family <parameter>af</parameter>: either
-<type>PF_INET</type> or <type>PF_INET6</type> &mdash; IPv4 or IPV6
-addresses respectively.  Successful calls of the functions return a
-<type>struct hostent</type>for the name that was looked up.
-<type>NULL</type> is returned if the lookups by
-<function>lwres_gethostbyname()</function> or
-<function>lwres_gethostbyname2()</function> fail.
-</para>
+    <para><function>lwres_gethostbyname()</function>
+      and <function>lwres_gethostbyname2()</function> look up the
+      hostname <parameter>name</parameter>.
+      <function>lwres_gethostbyname()</function> always looks for an
+      IPv4 address while <function>lwres_gethostbyname2()</function>
+      looks for an address of protocol family
+      <parameter>af</parameter>: either <type>PF_INET</type> or
+      <type>PF_INET6</type> &mdash; IPv4 or IPV6 addresses
+      respectively.  Successful calls of the functions return a
+      <type>struct hostent</type>for the name that was looked up.
+      <type>NULL</type> is returned if the lookups by
+      <function>lwres_gethostbyname()</function> or
+      <function>lwres_gethostbyname2()</function> fail.
+    </para>
 
-<para>
-Reverse lookups of addresses are performed by
-<function>lwres_gethostbyaddr()</function>.
-<parameter>addr</parameter> is an address of length
-<parameter>len</parameter> bytes and protocol family
-<parameter>type</parameter> &mdash; <type>PF_INET</type> or
-<type>PF_INET6</type>.
-<function>lwres_gethostbyname_r()</function> is a thread-safe function
-for forward lookups.  If an error occurs, an error code is returned in
-<parameter>*error</parameter>.
-<parameter>resbuf</parameter> is a pointer to a <type>struct
-hostent</type> which is initialised by a successful call to
-<function>lwres_gethostbyname_r()</function> .
-<parameter>buf</parameter> is a buffer of length
-<parameter>len</parameter> bytes which is used to store the
-<constant>h_name</constant>, <constant>h_aliases</constant>, and
-<constant>h_addr_list</constant> elements of the <type>struct
-hostent</type> returned in <parameter>resbuf</parameter>.
-Successful calls to <function>lwres_gethostbyname_r()</function>
-return <parameter>resbuf</parameter>,
-which is a pointer to the <type>struct hostent</type> it created.
-</para>
+    <para>
+      Reverse lookups of addresses are performed by
+      <function>lwres_gethostbyaddr()</function>.
+      <parameter>addr</parameter> is an address of length
+      <parameter>len</parameter> bytes and protocol family
+      <parameter>type</parameter> &mdash; <type>PF_INET</type> or
+      <type>PF_INET6</type>.
+      <function>lwres_gethostbyname_r()</function> is a
+      thread-safe function
+      for forward lookups.  If an error occurs, an error code is returned in
+      <parameter>*error</parameter>.
+      <parameter>resbuf</parameter> is a pointer to a
+      <type>struct hostent</type> which is initialised by a successful call to
+      <function>lwres_gethostbyname_r()</function>.
+      <parameter>buf</parameter> is a buffer of length
+      <parameter>len</parameter> bytes which is used to store the
+      <constant>h_name</constant>, <constant>h_aliases</constant>, and
+      <constant>h_addr_list</constant> elements of the
+      <type>struct hostent</type> returned in <parameter>resbuf</parameter>.
+      Successful calls to <function>lwres_gethostbyname_r()</function>
+      return <parameter>resbuf</parameter>,
+      which is a pointer to the <type>struct hostent</type> it created.
+    </para>
 
-<para>
-<function>lwres_gethostbyaddr_r()</function> is a thread-safe function
-that performs a reverse lookup of address <parameter>addr</parameter>
-which is <parameter>len</parameter> bytes long and is of protocol
-family <parameter>type</parameter> &mdash; <type>PF_INET</type> or
-<type>PF_INET6</type>.  If an error occurs, the error code is returned
-in <parameter>*error</parameter>.  The other function parameters are
-identical to those in <function>lwres_gethostbyname_r()</function>.
-<parameter>resbuf</parameter> is a pointer to a <type>struct
-hostent</type> which is initialised by a successful call to
-<function>lwres_gethostbyaddr_r()</function>.
-<parameter>buf</parameter> is a buffer of length
-<parameter>len</parameter> bytes which is used to store the
-<constant>h_name</constant>, <constant>h_aliases</constant>, and
-<constant>h_addr_list</constant> elements of the <type>struct
-hostent</type> returned in <parameter>resbuf</parameter>.  Successful
-calls to <function>lwres_gethostbyaddr_r()</function> return
-<parameter>resbuf</parameter>, which is a pointer to the
-<function>struct hostent()</function> it created.
-</para>
+    <para><function>lwres_gethostbyaddr_r()</function>
+      is a thread-safe function
+      that performs a reverse lookup of address <parameter>addr</parameter>
+      which is <parameter>len</parameter> bytes long and is of
+      protocol
+      family <parameter>type</parameter> &mdash; <type>PF_INET</type> or
+      <type>PF_INET6</type>.  If an error occurs, the error code is returned
+      in <parameter>*error</parameter>.  The other function
+      parameters are
+      identical to those in <function>lwres_gethostbyname_r()</function>.
+      <parameter>resbuf</parameter> is a pointer to a
+      <type>struct hostent</type> which is initialised by a successful call to
+      <function>lwres_gethostbyaddr_r()</function>.
+      <parameter>buf</parameter> is a buffer of length
+      <parameter>len</parameter> bytes which is used to store the
+      <constant>h_name</constant>, <constant>h_aliases</constant>, and
+      <constant>h_addr_list</constant> elements of the
+      <type>struct hostent</type> returned in <parameter>resbuf</parameter>.
+      Successful calls to <function>lwres_gethostbyaddr_r()</function> return
+      <parameter>resbuf</parameter>, which is a pointer to the
+      <function>struct hostent()</function> it created.
+    </para>
 
-</refsect1>
+  </refsect1>
 
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-The functions
-<function>lwres_gethostbyname()</function>,
-<function>lwres_gethostbyname2()</function>,
-<function>lwres_gethostbyaddr()</function>,
-and
-<function>lwres_gethostent()</function>
-return NULL to indicate an error.  In this case the global variable
-<type>lwres_h_errno</type>
-will contain one of the following error codes defined in
-<filename>&lt;lwres/netdb.h&gt;</filename>:
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      The functions
+      <function>lwres_gethostbyname()</function>,
+      <function>lwres_gethostbyname2()</function>,
+      <function>lwres_gethostbyaddr()</function>,
+      and
+      <function>lwres_gethostent()</function>
+      return NULL to indicate an error.  In this case the global variable
+      <type>lwres_h_errno</type>
+      will contain one of the following error codes defined in
+      <filename>&lt;lwres/netdb.h&gt;</filename>:
 
-<variablelist>
-<varlistentry><term><constant>HOST_NOT_FOUND</constant></term>
-<listitem>
-<para>
-The host or address was not found.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>TRY_AGAIN</constant></term>
-<listitem>
-<para>
-A recoverable error occurred, e.g., a timeout.
-Retrying the lookup may succeed.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>NO_RECOVERY</constant></term>
-<listitem>
-<para>
-A non-recoverable error occurred.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>NO_DATA</constant></term>
-<listitem>
-<para>
-The name exists, but has no address information
-associated with it (or vice versa in the case
-of a reverse lookup).  The code NO_ADDRESS
-is accepted as a synonym for NO_DATA for backwards
-compatibility.
-</para>
-</listitem></varlistentry>
-</variablelist>
-</para>
+      <variablelist>
+        <varlistentry>
+          <term><constant>HOST_NOT_FOUND</constant></term>
+          <listitem>
+            <para>
+              The host or address was not found.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>TRY_AGAIN</constant></term>
+          <listitem>
+            <para>
+              A recoverable error occurred, e.g., a timeout.
+              Retrying the lookup may succeed.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NO_RECOVERY</constant></term>
+          <listitem>
+            <para>
+              A non-recoverable error occurred.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NO_DATA</constant></term>
+          <listitem>
+            <para>
+              The name exists, but has no address information
+              associated with it (or vice versa in the case
+              of a reverse lookup).  The code NO_ADDRESS
+              is accepted as a synonym for NO_DATA for backwards
+              compatibility.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
 
-<para>
-<citerefentry>
-<refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-translates these error codes to suitable error messages.
-</para>
+    <para><citerefentry>
+        <refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+      translates these error codes to suitable error messages.
+    </para>
 
-<para>
-<function>lwres_gethostent()</function>
-and
-<function>lwres_gethostent_r()</function>
-always return
-<type>NULL</type>.
-</para>
+    <para><function>lwres_gethostent()</function>
+      and <function>lwres_gethostent_r()</function>
+      always return <type>NULL</type>.
+    </para>
 
-<para>
-Successful calls to <function>lwres_gethostbyname_r()</function> and
-<function>lwres_gethostbyaddr_r()</function> return
-<parameter>resbuf</parameter>, a pointer to the <type>struct
-hostent</type> that was initialised by these functions.  They return
-<type>NULL</type> if the lookups fail or if <parameter>buf</parameter>
-was too small to hold the list of addresses and names referenced by
-the <constant>h_name</constant>, <constant>h_aliases</constant>, and
-<constant>h_addr_list</constant> elements of the <type>struct
-hostent</type>.  If <parameter>buf</parameter> was too small, both
-<function>lwres_gethostbyname_r()</function> and
-<function>lwres_gethostbyaddr_r()</function> set the global variable
-<type>errno</type> to <errorcode>ERANGE</errorcode>.
-</para>
+    <para>
+      Successful calls to <function>lwres_gethostbyname_r()</function> and
+      <function>lwres_gethostbyaddr_r()</function> return
+      <parameter>resbuf</parameter>, a pointer to the
+      <type>struct hostent</type> that was initialised by these functions.  They return
+      <type>NULL</type> if the lookups fail or if <parameter>buf</parameter>
+      was too small to hold the list of addresses and names referenced by
+      the <constant>h_name</constant>, <constant>h_aliases</constant>, and
+      <constant>h_addr_list</constant> elements of the
+      <type>struct hostent</type>.
+      If <parameter>buf</parameter> was too small, both
+      <function>lwres_gethostbyname_r()</function> and
+      <function>lwres_gethostbyaddr_r()</function> set the global
+      variable
+      <type>errno</type> to <errorcode>ERANGE</errorcode>.
+    </para>
 
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>gethostent</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>gethostent</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_getipnode</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getipnode</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-</para>
-</refsect1>
+      <citerefentry>
+        <refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+    </para>
+  </refsect1>
 
-<refsect1>
-<title>BUGS</title>
-<para>
-<function>lwres_gethostbyname()</function>,
-<function>lwres_gethostbyname2()</function>,
-<function>lwres_gethostbyaddr()</function>
-and
-<function>lwres_endhostent()</function>
-are not thread safe; they return pointers to static data and 
-provide error codes through a global variable.
-Thread-safe versions for name and address lookup are provided by
-<function>lwres_gethostbyname_r()</function>,
-and
-<function>lwres_gethostbyaddr_r()</function>
-respectively.
-</para>
-<para>
-The resolver daemon does not currently support any non-DNS
-name services such as 
-<filename>/etc/hosts</filename>
-or
-<type>NIS</type>,
-consequently the above functions don't, either.
-</para>
-</refsect1>
-</refentry>
+  <refsect1>
+    <title>BUGS</title>
+    <para><function>lwres_gethostbyname()</function>,
+      <function>lwres_gethostbyname2()</function>,
+      <function>lwres_gethostbyaddr()</function>
+      and
+      <function>lwres_endhostent()</function>
+      are not thread safe; they return pointers to static data and
+      provide error codes through a global variable.
+      Thread-safe versions for name and address lookup are provided by
+      <function>lwres_gethostbyname_r()</function>,
+      and
+      <function>lwres_gethostbyaddr_r()</function>
+      respectively.
+    </para>
+    <para>
+      The resolver daemon does not currently support any non-DNS
+      name services such as
+      <filename>/etc/hosts</filename>
+      or
+      <type>NIS</type>,
+      consequently the above functions don't, either.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_gethostent.html b/contrib/bind9/lib/lwres/man/lwres_gethostent.html
index fefc67b..0b7ba442 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gethostent.html
+++ b/contrib/bind9/lib/lwres/man/lwres_gethostent.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_gethostent.html,v 1.8.2.1.4.10 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_gethostent.html,v 1.9.18.15 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_gethostent</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_gethostbyname, lwres_gethostbyname2, lwres_gethostbyaddr, lwres_gethostent, lwres_sethostent, lwres_endhostent, lwres_gethostbyname_r, lwres_gethostbyaddr_r, lwres_gethostent_r, lwres_sethostent_r, lwres_endhostent_r &#8212; lightweight resolver get network host entry</p>
@@ -31,40 +31,28 @@
 <h2>Synopsis</h2>
 <div class="funcsynopsis">
 <pre class="funcsynopsisinfo">#include &lt;lwres/netdb.h&gt;</pre>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
 <td><code class="funcdef">
 struct hostent *
 <b class="fsfunc">lwres_gethostbyname</b>(</code></td>
-<td> </td>
+<td>const char * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">name</var><code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 struct hostent *
 <b class="fsfunc">lwres_gethostbyname2</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">name</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">af</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -72,68 +60,79 @@ struct hostent *
 <td><code class="funcdef">
 struct hostent *
 <b class="fsfunc">lwres_gethostbyaddr</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">addr</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">len</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">type</var><code>)</code>;</td>
 </tr>
 </table>
-<p><code class="funcdef">
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
+<td><code class="funcdef">
 struct hostent *
-<b class="fsfunc">lwres_gethostent</b>(</code>void<code>)</code>;</p>
-<p><code class="funcdef">
+<b class="fsfunc">lwres_gethostent</b>(</code></td>
+<td> </td>
+<td>
+<code>)</code>;</td>
+</tr></table>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
+<td><code class="funcdef">
 void
-<b class="fsfunc">lwres_sethostent</b>(</code>int stayopen<code>)</code>;</p>
-<p><code class="funcdef">
+<b class="fsfunc">lwres_sethostent</b>(</code></td>
+<td>int  </td>
+<td>
+<var class="pdparam">stayopen</var><code>)</code>;</td>
+</tr></table>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
+<td><code class="funcdef">
 void
-<b class="fsfunc">lwres_endhostent</b>(</code>void<code>)</code>;</p>
+<b class="fsfunc">lwres_endhostent</b>(</code></td>
+<td> </td>
+<td>
+<code>)</code>;</td>
+</tr></table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
 <tr>
 <td><code class="funcdef">
 struct hostent *
 <b class="fsfunc">lwres_gethostbyname_r</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">name</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>struct hostent * </td>
+<td>
+<var class="pdparam">resbuf</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>char * </td>
+<td>
+<var class="pdparam">buf</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">buflen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">error</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -141,44 +140,45 @@ struct hostent *
 <td><code class="funcdef">
 struct hostent  *
 <b class="fsfunc">lwres_gethostbyaddr_r</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">addr</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">len</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">type</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>struct hostent * </td>
+<td>
+<var class="pdparam">resbuf</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>char * </td>
+<td>
+<var class="pdparam">buf</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">buflen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">error</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -186,54 +186,60 @@ struct hostent  *
 <td><code class="funcdef">
 struct hostent  *
 <b class="fsfunc">lwres_gethostent_r</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>struct hostent * </td>
+<td>
+<var class="pdparam">resbuf</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>char * </td>
+<td>
+<var class="pdparam">buf</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">buflen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">error</var><code>)</code>;</td>
 </tr>
 </table>
-<p><code class="funcdef">
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
+<td><code class="funcdef">
 void
-<b class="fsfunc">lwres_sethostent_r</b>(</code>int stayopen<code>)</code>;</p>
-<p><code class="funcdef">
+<b class="fsfunc">lwres_sethostent_r</b>(</code></td>
+<td>int  </td>
+<td>
+<var class="pdparam">stayopen</var><code>)</code>;</td>
+</tr></table>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0"><tr>
+<td><code class="funcdef">
 void
-<b class="fsfunc">lwres_endhostent_r</b>(</code>void<code>)</code>;</p>
+<b class="fsfunc">lwres_endhostent_r</b>(</code></td>
+<td> </td>
+<td>
+<code>)</code>;</td>
+</tr></table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549606"></a><h2>DESCRIPTION</h2>
+<a name="id2543608"></a><h2>DESCRIPTION</h2>
 <p>
-These functions provide hostname-to-address and
-address-to-hostname lookups by means of the lightweight resolver.
-They are similar to the standard
-<span class="citerefentry"><span class="refentrytitle">gethostent</span>(3
-)</span>
-functions provided by most operating systems.
-They use a
-<span class="type">struct hostent</span>
-which is usually defined in
-<code class="filename">&lt;namedb.h&gt;</code>.
-
-</p>
+      These functions provide hostname-to-address and
+      address-to-hostname lookups by means of the lightweight resolver.
+      They are similar to the standard
+      <span class="citerefentry"><span class="refentrytitle">gethostent</span>(3)</span>
+      functions provided by most operating systems.
+      They use a
+      <span class="type">struct hostent</span>
+      which is usually defined in
+      <code class="filename">&lt;namedb.h&gt;</code>.
+    </p>
 <pre class="programlisting">
 struct  hostent {
         char    *h_name;        /* official name of host */
@@ -245,219 +251,216 @@ struct  hostent {
 #define h_addr  h_addr_list[0]  /* address, for backward compatibility */
 </pre>
 <p>
-</p>
+    </p>
 <p>
-The members of this structure are:
-</p>
+      The members of this structure are:
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">h_name</code></span></dt>
 <dd><p>
-The official (canonical) name of the host.
-</p></dd>
+              The official (canonical) name of the host.
+            </p></dd>
 <dt><span class="term"><code class="constant">h_aliases</code></span></dt>
 <dd><p>
-A NULL-terminated array of alternate names (nicknames) for the host.
-</p></dd>
+              A NULL-terminated array of alternate names (nicknames) for the
+              host.
+            </p></dd>
 <dt><span class="term"><code class="constant">h_addrtype</code></span></dt>
 <dd><p>
-The type of address being returned &#8212;
-<span class="type">PF_INET</span>
-or
-<span class="type">PF_INET6</span>.
-</p></dd>
+              The type of address being returned &#8212;
+              <span class="type">PF_INET</span>
+              or
+              <span class="type">PF_INET6</span>.
+            </p></dd>
 <dt><span class="term"><code class="constant">h_length</code></span></dt>
 <dd><p>
-The length of the address in bytes.
-</p></dd>
+              The length of the address in bytes.
+            </p></dd>
 <dt><span class="term"><code class="constant">h_addr_list</code></span></dt>
 <dd><p>
-A <span class="type">NULL</span>
-terminated array of network addresses for the host.
-Host addresses are returned in network byte order.
-</p></dd>
+              A <span class="type">NULL</span>
+              terminated array of network addresses for the host.
+              Host addresses are returned in network byte order.
+            </p></dd>
 </dl></div>
 <p>
-</p>
-<p>
-For backward compatibility with very old software,
-<code class="constant">h_addr</code>
-is the first address in
-<code class="constant">h_addr_list.</code>
-</p>
+    </p>
 <p>
-<code class="function">lwres_gethostent()</code>,
-<code class="function">lwres_sethostent()</code>,
-<code class="function">lwres_endhostent()</code>,
-<code class="function">lwres_gethostent_r()</code>,
-<code class="function">lwres_sethostent_r()</code>
-and
-<code class="function">lwres_endhostent_r()</code>
-provide iteration over the known host entries on systems that
-provide such functionality through facilities like
-<code class="filename">/etc/hosts</code>
-or NIS.  The lightweight resolver does not currently implement
-these functions; it only provides them as stub functions that always
-return failure.
-</p>
+      For backward compatibility with very old software,
+      <code class="constant">h_addr</code>
+      is the first address in
+      <code class="constant">h_addr_list.</code>
+    </p>
+<p><code class="function">lwres_gethostent()</code>,
+      <code class="function">lwres_sethostent()</code>,
+      <code class="function">lwres_endhostent()</code>,
+      <code class="function">lwres_gethostent_r()</code>,
+      <code class="function">lwres_sethostent_r()</code>
+      and
+      <code class="function">lwres_endhostent_r()</code>
+      provide iteration over the known host entries on systems that
+      provide such functionality through facilities like
+      <code class="filename">/etc/hosts</code>
+      or NIS.  The lightweight resolver does not currently implement
+      these functions; it only provides them as stub functions that always
+      return failure.
+    </p>
+<p><code class="function">lwres_gethostbyname()</code>
+      and <code class="function">lwres_gethostbyname2()</code> look up the
+      hostname <em class="parameter"><code>name</code></em>.
+      <code class="function">lwres_gethostbyname()</code> always looks for an
+      IPv4 address while <code class="function">lwres_gethostbyname2()</code>
+      looks for an address of protocol family
+      <em class="parameter"><code>af</code></em>: either <span class="type">PF_INET</span> or
+      <span class="type">PF_INET6</span> &#8212; IPv4 or IPV6 addresses
+      respectively.  Successful calls of the functions return a
+      <span class="type">struct hostent</span>for the name that was looked up.
+      <span class="type">NULL</span> is returned if the lookups by
+      <code class="function">lwres_gethostbyname()</code> or
+      <code class="function">lwres_gethostbyname2()</code> fail.
+    </p>
 <p>
-<code class="function">lwres_gethostbyname()</code> and
-<code class="function">lwres_gethostbyname2()</code> look up the hostname
-<em class="parameter"><code>name</code></em>.
-<code class="function">lwres_gethostbyname()</code> always looks for an IPv4
-address while <code class="function">lwres_gethostbyname2()</code> looks for an
-address of protocol family <em class="parameter"><code>af</code></em>: either
-<span class="type">PF_INET</span> or <span class="type">PF_INET6</span> &#8212; IPv4 or IPV6
-addresses respectively.  Successful calls of the functions return a
-<span class="type">struct hostent</span>for the name that was looked up.
-<span class="type">NULL</span> is returned if the lookups by
-<code class="function">lwres_gethostbyname()</code> or
-<code class="function">lwres_gethostbyname2()</code> fail.
-</p>
-<p>
-Reverse lookups of addresses are performed by
-<code class="function">lwres_gethostbyaddr()</code>.
-<em class="parameter"><code>addr</code></em> is an address of length
-<em class="parameter"><code>len</code></em> bytes and protocol family
-<em class="parameter"><code>type</code></em> &#8212; <span class="type">PF_INET</span> or
-<span class="type">PF_INET6</span>.
-<code class="function">lwres_gethostbyname_r()</code> is a thread-safe function
-for forward lookups.  If an error occurs, an error code is returned in
-<em class="parameter"><code>*error</code></em>.
-<em class="parameter"><code>resbuf</code></em> is a pointer to a <span class="type">struct
-hostent</span> which is initialised by a successful call to
-<code class="function">lwres_gethostbyname_r()</code> .
-<em class="parameter"><code>buf</code></em> is a buffer of length
-<em class="parameter"><code>len</code></em> bytes which is used to store the
-<code class="constant">h_name</code>, <code class="constant">h_aliases</code>, and
-<code class="constant">h_addr_list</code> elements of the <span class="type">struct
-hostent</span> returned in <em class="parameter"><code>resbuf</code></em>.
-Successful calls to <code class="function">lwres_gethostbyname_r()</code>
-return <em class="parameter"><code>resbuf</code></em>,
-which is a pointer to the <span class="type">struct hostent</span> it created.
-</p>
-<p>
-<code class="function">lwres_gethostbyaddr_r()</code> is a thread-safe function
-that performs a reverse lookup of address <em class="parameter"><code>addr</code></em>
-which is <em class="parameter"><code>len</code></em> bytes long and is of protocol
-family <em class="parameter"><code>type</code></em> &#8212; <span class="type">PF_INET</span> or
-<span class="type">PF_INET6</span>.  If an error occurs, the error code is returned
-in <em class="parameter"><code>*error</code></em>.  The other function parameters are
-identical to those in <code class="function">lwres_gethostbyname_r()</code>.
-<em class="parameter"><code>resbuf</code></em> is a pointer to a <span class="type">struct
-hostent</span> which is initialised by a successful call to
-<code class="function">lwres_gethostbyaddr_r()</code>.
-<em class="parameter"><code>buf</code></em> is a buffer of length
-<em class="parameter"><code>len</code></em> bytes which is used to store the
-<code class="constant">h_name</code>, <code class="constant">h_aliases</code>, and
-<code class="constant">h_addr_list</code> elements of the <span class="type">struct
-hostent</span> returned in <em class="parameter"><code>resbuf</code></em>.  Successful
-calls to <code class="function">lwres_gethostbyaddr_r()</code> return
-<em class="parameter"><code>resbuf</code></em>, which is a pointer to the
-<code class="function">struct hostent()</code> it created.
-</p>
+      Reverse lookups of addresses are performed by
+      <code class="function">lwres_gethostbyaddr()</code>.
+      <em class="parameter"><code>addr</code></em> is an address of length
+      <em class="parameter"><code>len</code></em> bytes and protocol family
+      <em class="parameter"><code>type</code></em> &#8212; <span class="type">PF_INET</span> or
+      <span class="type">PF_INET6</span>.
+      <code class="function">lwres_gethostbyname_r()</code> is a
+      thread-safe function
+      for forward lookups.  If an error occurs, an error code is returned in
+      <em class="parameter"><code>*error</code></em>.
+      <em class="parameter"><code>resbuf</code></em> is a pointer to a
+      <span class="type">struct hostent</span> which is initialised by a successful call to
+      <code class="function">lwres_gethostbyname_r()</code>.
+      <em class="parameter"><code>buf</code></em> is a buffer of length
+      <em class="parameter"><code>len</code></em> bytes which is used to store the
+      <code class="constant">h_name</code>, <code class="constant">h_aliases</code>, and
+      <code class="constant">h_addr_list</code> elements of the
+      <span class="type">struct hostent</span> returned in <em class="parameter"><code>resbuf</code></em>.
+      Successful calls to <code class="function">lwres_gethostbyname_r()</code>
+      return <em class="parameter"><code>resbuf</code></em>,
+      which is a pointer to the <span class="type">struct hostent</span> it created.
+    </p>
+<p><code class="function">lwres_gethostbyaddr_r()</code>
+      is a thread-safe function
+      that performs a reverse lookup of address <em class="parameter"><code>addr</code></em>
+      which is <em class="parameter"><code>len</code></em> bytes long and is of
+      protocol
+      family <em class="parameter"><code>type</code></em> &#8212; <span class="type">PF_INET</span> or
+      <span class="type">PF_INET6</span>.  If an error occurs, the error code is returned
+      in <em class="parameter"><code>*error</code></em>.  The other function
+      parameters are
+      identical to those in <code class="function">lwres_gethostbyname_r()</code>.
+      <em class="parameter"><code>resbuf</code></em> is a pointer to a
+      <span class="type">struct hostent</span> which is initialised by a successful call to
+      <code class="function">lwres_gethostbyaddr_r()</code>.
+      <em class="parameter"><code>buf</code></em> is a buffer of length
+      <em class="parameter"><code>len</code></em> bytes which is used to store the
+      <code class="constant">h_name</code>, <code class="constant">h_aliases</code>, and
+      <code class="constant">h_addr_list</code> elements of the
+      <span class="type">struct hostent</span> returned in <em class="parameter"><code>resbuf</code></em>.
+      Successful calls to <code class="function">lwres_gethostbyaddr_r()</code> return
+      <em class="parameter"><code>resbuf</code></em>, which is a pointer to the
+      <code class="function">struct hostent()</code> it created.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2550013"></a><h2>RETURN VALUES</h2>
+<a name="id2543959"></a><h2>RETURN VALUES</h2>
 <p>
-The functions
-<code class="function">lwres_gethostbyname()</code>,
-<code class="function">lwres_gethostbyname2()</code>,
-<code class="function">lwres_gethostbyaddr()</code>,
-and
-<code class="function">lwres_gethostent()</code>
-return NULL to indicate an error.  In this case the global variable
-<span class="type">lwres_h_errno</span>
-will contain one of the following error codes defined in
-<code class="filename">&lt;lwres/netdb.h&gt;</code>:
+      The functions
+      <code class="function">lwres_gethostbyname()</code>,
+      <code class="function">lwres_gethostbyname2()</code>,
+      <code class="function">lwres_gethostbyaddr()</code>,
+      and
+      <code class="function">lwres_gethostent()</code>
+      return NULL to indicate an error.  In this case the global variable
+      <span class="type">lwres_h_errno</span>
+      will contain one of the following error codes defined in
+      <code class="filename">&lt;lwres/netdb.h&gt;</code>:
 
-</p>
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">HOST_NOT_FOUND</code></span></dt>
 <dd><p>
-The host or address was not found.
-</p></dd>
+              The host or address was not found.
+            </p></dd>
 <dt><span class="term"><code class="constant">TRY_AGAIN</code></span></dt>
 <dd><p>
-A recoverable error occurred, e.g., a timeout.
-Retrying the lookup may succeed.
-</p></dd>
+              A recoverable error occurred, e.g., a timeout.
+              Retrying the lookup may succeed.
+            </p></dd>
 <dt><span class="term"><code class="constant">NO_RECOVERY</code></span></dt>
 <dd><p>
-A non-recoverable error occurred.
-</p></dd>
+              A non-recoverable error occurred.
+            </p></dd>
 <dt><span class="term"><code class="constant">NO_DATA</code></span></dt>
 <dd><p>
-The name exists, but has no address information
-associated with it (or vice versa in the case
-of a reverse lookup).  The code NO_ADDRESS
-is accepted as a synonym for NO_DATA for backwards
-compatibility.
-</p></dd>
+              The name exists, but has no address information
+              associated with it (or vice versa in the case
+              of a reverse lookup).  The code NO_ADDRESS
+              is accepted as a synonym for NO_DATA for backwards
+              compatibility.
+            </p></dd>
 </dl></div>
 <p>
-</p>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3
-)</span>
-translates these error codes to suitable error messages.
-</p>
+    </p>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>
+      translates these error codes to suitable error messages.
+    </p>
+<p><code class="function">lwres_gethostent()</code>
+      and <code class="function">lwres_gethostent_r()</code>
+      always return <span class="type">NULL</span>.
+    </p>
 <p>
-<code class="function">lwres_gethostent()</code>
-and
-<code class="function">lwres_gethostent_r()</code>
-always return
-<span class="type">NULL</span>.
-</p>
-<p>
-Successful calls to <code class="function">lwres_gethostbyname_r()</code> and
-<code class="function">lwres_gethostbyaddr_r()</code> return
-<em class="parameter"><code>resbuf</code></em>, a pointer to the <span class="type">struct
-hostent</span> that was initialised by these functions.  They return
-<span class="type">NULL</span> if the lookups fail or if <em class="parameter"><code>buf</code></em>
-was too small to hold the list of addresses and names referenced by
-the <code class="constant">h_name</code>, <code class="constant">h_aliases</code>, and
-<code class="constant">h_addr_list</code> elements of the <span class="type">struct
-hostent</span>.  If <em class="parameter"><code>buf</code></em> was too small, both
-<code class="function">lwres_gethostbyname_r()</code> and
-<code class="function">lwres_gethostbyaddr_r()</code> set the global variable
-<span class="type">errno</span> to <span class="errorcode">ERANGE</span>.
-</p>
+      Successful calls to <code class="function">lwres_gethostbyname_r()</code> and
+      <code class="function">lwres_gethostbyaddr_r()</code> return
+      <em class="parameter"><code>resbuf</code></em>, a pointer to the
+      <span class="type">struct hostent</span> that was initialised by these functions.  They return
+      <span class="type">NULL</span> if the lookups fail or if <em class="parameter"><code>buf</code></em>
+      was too small to hold the list of addresses and names referenced by
+      the <code class="constant">h_name</code>, <code class="constant">h_aliases</code>, and
+      <code class="constant">h_addr_list</code> elements of the
+      <span class="type">struct hostent</span>.
+      If <em class="parameter"><code>buf</code></em> was too small, both
+      <code class="function">lwres_gethostbyname_r()</code> and
+      <code class="function">lwres_gethostbyaddr_r()</code> set the global
+      variable
+      <span class="type">errno</span> to <span class="errorcode">ERANGE</span>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2550173"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">gethostent</span>(3)</span>,
+<a name="id2544193"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">gethostent</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_getipnode</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getipnode</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3
-)</span>
-</p>
+      <span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2550209"></a><h2>BUGS</h2>
-<p>
-<code class="function">lwres_gethostbyname()</code>,
-<code class="function">lwres_gethostbyname2()</code>,
-<code class="function">lwres_gethostbyaddr()</code>
-and
-<code class="function">lwres_endhostent()</code>
-are not thread safe; they return pointers to static data and 
-provide error codes through a global variable.
-Thread-safe versions for name and address lookup are provided by
-<code class="function">lwres_gethostbyname_r()</code>,
-and
-<code class="function">lwres_gethostbyaddr_r()</code>
-respectively.
-</p>
+<a name="id2544227"></a><h2>BUGS</h2>
+<p><code class="function">lwres_gethostbyname()</code>,
+      <code class="function">lwres_gethostbyname2()</code>,
+      <code class="function">lwres_gethostbyaddr()</code>
+      and
+      <code class="function">lwres_endhostent()</code>
+      are not thread safe; they return pointers to static data and
+      provide error codes through a global variable.
+      Thread-safe versions for name and address lookup are provided by
+      <code class="function">lwres_gethostbyname_r()</code>,
+      and
+      <code class="function">lwres_gethostbyaddr_r()</code>
+      respectively.
+    </p>
 <p>
-The resolver daemon does not currently support any non-DNS
-name services such as 
-<code class="filename">/etc/hosts</code>
-or
-<span class="type">NIS</span>,
-consequently the above functions don't, either.
-</p>
+      The resolver daemon does not currently support any non-DNS
+      name services such as
+      <code class="filename">/etc/hosts</code>
+      or
+      <span class="type">NIS</span>,
+      consequently the above functions don't, either.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_getipnode.3 b/contrib/bind9/lib/lwres/man/lwres_getipnode.3
index f7ab62b..9c9f374 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getipnode.3
+++ b/contrib/bind9/lib/lwres/man/lwres_getipnode.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_getipnode.3,v 1.13.2.2.4.7 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_getipnode.3,v 1.17.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_getipnode
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,11 +36,11 @@ lwres_getipnodebyname, lwres_getipnodebyaddr, lwres_freehostent \- lightweight r
 #include <lwres/netdb.h>
 .fi
 .HP 39
-.BI "struct hostent * lwres_getipnodebyname(const\ char\ *name, int\ af, int\ flags, int\ *error_num);"
+.BI "struct hostent * lwres_getipnodebyname(const\ char\ *" "name" ", int\ " "af" ", int\ " "flags" ", int\ *" "error_num" ");"
 .HP 39
-.BI "struct hostent * lwres_getipnodebyaddr(const\ void\ *src, size_t\ len, int\ af, int\ *error_num);"
+.BI "struct hostent * lwres_getipnodebyaddr(const\ void\ *" "src" ", size_t\ " "len" ", int\ " "af" ", int\ *" "error_num" ");"
 .HP 23
-.BI "void lwres_freehostent(struct\ hostent\ *he);"
+.BI "void lwres_freehostent(struct\ hostent\ *" "he" ");"
 .SH "DESCRIPTION"
 .PP
 These functions perform thread safe, protocol independent nodename\-to\-address and address\-to\-nodename translation as defined in RFC2553.
@@ -49,8 +49,8 @@ They use a
 \fBstruct hostent\fR
 which is defined in
 \fInamedb.h\fR:
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 struct  hostent {
         char    *h_name;        /* official name of host */
@@ -65,26 +65,36 @@ struct  hostent {
 .sp
 .PP
 The members of this structure are:
-.TP 3n
+.PP
 \fBh_name\fR
+.RS 4
 The official (canonical) name of the host.
-.TP 3n
+.RE
+.PP
 \fBh_aliases\fR
+.RS 4
 A NULL\-terminated array of alternate names (nicknames) for the host.
-.TP 3n
+.RE
+.PP
 \fBh_addrtype\fR
+.RS 4
 The type of address being returned \- usually
 \fBPF_INET\fR
 or
 \fBPF_INET6\fR.
-.TP 3n
+.RE
+.PP
 \fBh_length\fR
+.RS 4
 The length of the address in bytes.
-.TP 3n
+.RE
+.PP
 \fBh_addr_list\fR
+.RS 4
 A
 \fBNULL\fR
 terminated array of network addresses for the host. Host addresses are returned in network byte order.
+.RE
 .PP
 \fBlwres_getipnodebyname()\fR
 looks up addresses of protocol family
@@ -93,26 +103,34 @@ for the hostname
 \fIname\fR. The
 \fIflags\fR
 parameter contains ORed flag bits to specify the types of addresses that are searched for, and the types of addresses that are returned. The flag bits are:
-.TP 3n
+.PP
 \fBAI_V4MAPPED\fR
+.RS 4
 This is used with an
 \fIaf\fR
 of AF_INET6, and causes IPv4 addresses to be returned as IPv4\-mapped IPv6 addresses.
-.TP 3n
+.RE
+.PP
 \fBAI_ALL\fR
+.RS 4
 This is used with an
 \fIaf\fR
 of AF_INET6, and causes all known addresses (IPv6 and IPv4) to be returned. If AI_V4MAPPED is also set, the IPv4 addresses are return as mapped IPv6 addresses.
-.TP 3n
+.RE
+.PP
 \fBAI_ADDRCONFIG\fR
+.RS 4
 Only return an IPv6 or IPv4 address if here is an active network interface of that type. This is not currently implemented in the BIND 9 lightweight resolver, and the flag is ignored.
-.TP 3n
+.RE
+.PP
 \fBAI_DEFAULT\fR
+.RS 4
 This default sets the
 \fBAI_V4MAPPED\fR
 and
 \fBAI_ADDRCONFIG\fR
 flag bits.
+.RE
 .PP
 \fBlwres_getipnodebyaddr()\fR
 performs a reverse lookup of address
@@ -150,20 +168,28 @@ to an appropriate error code and the function returns a
 \fBNULL\fR
 pointer. The error codes and their meanings are defined in
 \fI<lwres/netdb.h>\fR:
-.TP 3n
+.PP
 \fBHOST_NOT_FOUND\fR
+.RS 4
 No such host is known.
-.TP 3n
+.RE
+.PP
 \fBNO_ADDRESS\fR
+.RS 4
 The server recognised the request and the name but no address is available. Another type of request to the name server for the domain might return an answer.
-.TP 3n
+.RE
+.PP
 \fBTRY_AGAIN\fR
+.RS 4
 A temporary and possibly transient error occurred, such as a failure of a server to respond. The request may succeed if retried.
-.TP 3n
+.RE
+.PP
 \fBNO_RECOVERY\fR
+.RS 4
 An unexpected failure occurred, and retrying the request is pointless.
+.RE
 .PP
-\fBlwres_hstrerror\fR(3 )
+\fBlwres_hstrerror\fR(3)
 translates these error codes to suitable error messages.
 .SH "SEE ALSO"
 .PP
@@ -174,4 +200,7 @@ translates these error codes to suitable error messages.
 \fBlwres_getnameinfo\fR(3),
 \fBlwres_hstrerror\fR(3).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook b/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook
index 94de72c..6bd4803 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_getipnode.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_getipnode.docbook,v 1.4.2.2.4.3 2005/05/12 21:36:14 sra Exp $ -->
-
+<!-- $Id: lwres_getipnode.docbook,v 1.6.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_getipnode</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_getipnode</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -46,57 +46,58 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_getipnodebyname</refname>
-<refname>lwres_getipnodebyaddr</refname>
-<refname>lwres_freehostent</refname>
-<refpurpose>lightweight resolver nodename / address translation API</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_getipnodebyname</refname>
+    <refname>lwres_getipnodebyaddr</refname>
+    <refname>lwres_freehostent</refname>
+    <refpurpose>lightweight resolver nodename / address translation API</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/netdb.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent *
 <function>lwres_getipnodebyname</function></funcdef>
-<paramdef>const char *name</paramdef>
-<paramdef>int af</paramdef>
-<paramdef>int flags</paramdef>
-<paramdef>int *error_num</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>name</parameter></paramdef>
+        <paramdef>int <parameter>af</parameter></paramdef>
+        <paramdef>int <parameter>flags</parameter></paramdef>
+        <paramdef>int *<parameter>error_num</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 struct hostent *
 <function>lwres_getipnodebyaddr</function></funcdef>
-<paramdef>const void *src</paramdef>
-<paramdef>size_t len</paramdef>
-<paramdef>int af</paramdef>
-<paramdef>int *error_num</paramdef>
-</funcprototype>
+        <paramdef>const void *<parameter>src</parameter></paramdef>
+        <paramdef>size_t <parameter>len</parameter></paramdef>
+        <paramdef>int <parameter>af</parameter></paramdef>
+        <paramdef>int *<parameter>error_num</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_freehostent</function></funcdef>
-<paramdef>struct hostent *he</paramdef>
-</funcprototype>
+        <paramdef>struct hostent *<parameter>he</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
-<title>DESCRIPTION</title>
+  <refsect1>
+    <title>DESCRIPTION</title>
 
-<para>
-These functions perform thread safe, protocol independent
-nodename-to-address and address-to-nodename 
-translation as defined in RFC2553.
-</para>
+    <para>
+      These functions perform thread safe, protocol independent
+      nodename-to-address and address-to-nodename
+      translation as defined in RFC2553.
+    </para>
 
-<para>
-They use a
-<type>struct hostent</type>
-which is defined in
-<filename>namedb.h</filename>:
-<programlisting>
+    <para>
+      They use a
+      <type>struct hostent</type>
+      which is defined in
+      <filename>namedb.h</filename>:
+    </para>
+    <para><programlisting>
 struct  hostent {
         char    *h_name;        /* official name of host */
         char    **h_aliases;    /* alias list */
@@ -106,218 +107,225 @@ struct  hostent {
 };
 #define h_addr  h_addr_list[0]  /* address, for backward compatibility */
 </programlisting>
-</para>
-
-<para>
-The members of this structure are:
-<variablelist>
-<varlistentry><term><constant>h_name</constant></term>
-<listitem>
-<para>
-The official (canonical) name of the host.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_aliases</constant></term>
-<listitem>
-<para>
-A NULL-terminated array of alternate names (nicknames) for the host.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_addrtype</constant></term>
-<listitem>
-<para>
-The type of address being returned - usually
-<type>PF_INET</type>
-or
-<type>PF_INET6</type>.
+    </para>
 
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_length</constant></term>
-<listitem>
-<para>
-The length of the address in bytes.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>h_addr_list</constant></term>
-<listitem>
-<para>
-A
-<type>NULL</type>
-terminated array of network addresses for the host.
-Host addresses are returned in network byte order.
-</para>
-</listitem></varlistentry>
-</variablelist>
-</para>
-<para>
-<function>lwres_getipnodebyname()</function>
-looks up addresses of protocol family
-<parameter>af</parameter>
+    <para>
+      The members of this structure are:
+      <variablelist>
+        <varlistentry>
+          <term><constant>h_name</constant></term>
+          <listitem>
+            <para>
+              The official (canonical) name of the host.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_aliases</constant></term>
+          <listitem>
+            <para>
+              A NULL-terminated array of alternate names (nicknames) for the
+              host.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_addrtype</constant></term>
+          <listitem>
+            <para>
+              The type of address being returned - usually
+              <type>PF_INET</type>
+              or
+              <type>PF_INET6</type>.
 
-for the hostname
-<parameter>name</parameter>.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_length</constant></term>
+          <listitem>
+            <para>
+              The length of the address in bytes.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>h_addr_list</constant></term>
+          <listitem>
+            <para>
+              A
+              <type>NULL</type>
+              terminated array of network addresses for the host.
+              Host addresses are returned in network byte order.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
 
-The
-<parameter>flags</parameter>
-parameter contains ORed flag bits to 
-specify the types of addresses that are searched
-for, and the types of addresses that are returned. 
-The flag bits are:
-<variablelist>
-<varlistentry><term><constant>AI_V4MAPPED</constant></term>
-<listitem>
-<para>
-This is used with an
-<parameter>af</parameter>
-of AF_INET6, and causes IPv4 addresses to be returned as IPv4-mapped
-IPv6 addresses.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>AI_ALL</constant></term>
-<listitem>
-<para>
-This is used with an
-<parameter>af</parameter>
-of AF_INET6, and causes all known addresses (IPv6 and IPv4) to be returned.
-If AI_V4MAPPED is also set, the IPv4 addresses are return as mapped
-IPv6 addresses.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>AI_ADDRCONFIG</constant></term>
-<listitem>
-<para>
-Only return an IPv6 or IPv4 address if here is an active network
-interface of that type.  This is not currently implemented
-in the BIND 9 lightweight resolver, and the flag is ignored.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>AI_DEFAULT</constant></term>
-<listitem>
-<para>
-This default sets the
-<constant>AI_V4MAPPED</constant>
-and
-<constant>AI_ADDRCONFIG</constant>
-flag bits.
-</para>
-</listitem></varlistentry>
-</variablelist>
-</para>
-<para>
-<function>lwres_getipnodebyaddr()</function>
-performs a reverse lookup
-of address
-<parameter>src</parameter>
-which is
-<parameter>len</parameter>
-bytes long.
-<parameter>af</parameter>
-denotes the protocol family, typically
-<type>PF_INET</type>
-or
-<type>PF_INET6</type>.
+    <para><function>lwres_getipnodebyname()</function>
+      looks up addresses of protocol family <parameter>af</parameter>
+      for the hostname <parameter>name</parameter>.  The
+      <parameter>flags</parameter> parameter contains ORed flag bits
+      to specify the types of addresses that are searched for, and the
+      types of addresses that are returned.  The flag bits are:
 
-</para>
-<para>
-<function>lwres_freehostent()</function>
-releases all the memory associated with
-the
-<type>struct hostent</type>
-pointer
-<parameter>he</parameter>.
+      <variablelist>
+        <varlistentry>
+          <term><constant>AI_V4MAPPED</constant></term>
+          <listitem>
+            <para>
+              This is used with an
+              <parameter>af</parameter>
+              of AF_INET6, and causes IPv4 addresses to be returned as
+              IPv4-mapped
+              IPv6 addresses.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>AI_ALL</constant></term>
+          <listitem>
+            <para>
+              This is used with an
+              <parameter>af</parameter>
+              of AF_INET6, and causes all known addresses (IPv6 and IPv4) to
+              be returned.
+              If AI_V4MAPPED is also set, the IPv4 addresses are return as
+              mapped
+              IPv6 addresses.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>AI_ADDRCONFIG</constant></term>
+          <listitem>
+            <para>
+              Only return an IPv6 or IPv4 address if here is an active network
+              interface of that type.  This is not currently implemented
+              in the BIND 9 lightweight resolver, and the flag is ignored.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>AI_DEFAULT</constant></term>
+          <listitem>
+            <para>
+              This default sets the
+              <constant>AI_V4MAPPED</constant>
+              and
+              <constant>AI_ADDRCONFIG</constant>
+              flag bits.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
 
-Any memory allocated for the
-<constant>h_name</constant>,
+    <para><function>lwres_getipnodebyaddr()</function>
+      performs a reverse lookup of address <parameter>src</parameter>
+      which is <parameter>len</parameter> bytes long.
+      <parameter>af</parameter> denotes the protocol family, typically
+      <type>PF_INET</type> or <type>PF_INET6</type>.
+    </para>
+    <para><function>lwres_freehostent()</function>
+      releases all the memory associated with the <type>struct
+      hostent</type> pointer <parameter>he</parameter>.  Any memory
+      allocated for the <constant>h_name</constant>,
+      <constant>h_addr_list</constant> and
+      <constant>h_aliases</constant> is freed, as is the memory for
+      the <type>hostent</type> structure itself.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      If an error occurs,
+      <function>lwres_getipnodebyname()</function>
+      and
+      <function>lwres_getipnodebyaddr()</function>
+      set
+      <parameter>*error_num</parameter>
+      to an appropriate error code and the function returns a
+      <type>NULL</type>
+      pointer.
+      The error codes and their meanings are defined in
+      <filename>&lt;lwres/netdb.h&gt;</filename>:
+      <variablelist>
+        <varlistentry>
+          <term><constant>HOST_NOT_FOUND</constant></term>
+          <listitem>
+            <para>
+              No such host is known.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NO_ADDRESS</constant></term>
+          <listitem>
+            <para>
+              The server recognised the request and the name but no address is
+              available.  Another type of request to the name server for the
+              domain might return an answer.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>TRY_AGAIN</constant></term>
+          <listitem>
+            <para>
+              A temporary and possibly transient error occurred, such as a
+              failure of a server to respond.  The request may succeed if
+              retried.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NO_RECOVERY</constant></term>
+          <listitem>
+            <para>
+              An unexpected failure occurred, and retrying the request
+              is pointless.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
+    <para><citerefentry>
+        <refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+      translates these error codes to suitable error messages.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>RFC2553</refentrytitle>
+      </citerefentry>,
 
-<constant>h_addr_list</constant>
-and
-<constant>h_aliases</constant>
-is freed, as is the memory for the
-<type>hostent</type>
-structure itself.
-</para>
-</refsect1>
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-If an error occurs,
-<function>lwres_getipnodebyname()</function>
-and
-<function>lwres_getipnodebyaddr()</function>
-set
-<parameter>*error_num</parameter>
-to an appropriate error code and the function returns a
-<type>NULL</type>
-pointer.
-The error codes and their meanings are defined in
-<filename>&lt;lwres/netdb.h&gt;</filename>:
-<variablelist>
-<varlistentry><term><constant>HOST_NOT_FOUND</constant></term>
-<listitem>
-<para>
-No such host is known.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>NO_ADDRESS</constant></term>
-<listitem>
-<para>
-The server recognised the request and the name but no address is
-available.  Another type of request to the name server for the
-domain might return an answer.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>TRY_AGAIN</constant></term>
-<listitem>
-<para>
-A temporary and possibly transient error occurred, such as a
-failure of a server to respond.  The request may succeed if
-retried.
-</para>
-</listitem></varlistentry>
-<varlistentry><term><constant>NO_RECOVERY</constant></term>
-<listitem>
-<para>
-An unexpected failure occurred, and retrying the request
-is pointless.
-</para>
-</listitem></varlistentry>
-</variablelist>
-</para>
-<para>
-<citerefentry>
-<refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-translates these error codes to suitable error messages.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>RFC2553</refentrytitle>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_gethostent</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_gethostent</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_getaddrinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getnameinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_getnameinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
-</para>
-</refsect1>
-</refentry>
+      <citerefentry>
+        <refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_getipnode.html b/contrib/bind9/lib/lwres/man/lwres_getipnode.html
index 779da90..a585f1d 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getipnode.html
+++ b/contrib/bind9/lib/lwres/man/lwres_getipnode.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_getipnode.html,v 1.7.2.1.4.11 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_getipnode.html,v 1.9.18.16 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_getipnode</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_getipnodebyname, lwres_getipnodebyaddr, lwres_freehostent &#8212; lightweight resolver nodename / address translation API</p>
@@ -36,29 +36,27 @@
 <td><code class="funcdef">
 struct hostent *
 <b class="fsfunc">lwres_getipnodebyname</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">name</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">af</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">flags</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">error_num</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -66,62 +64,52 @@ struct hostent *
 <td><code class="funcdef">
 struct hostent *
 <b class="fsfunc">lwres_getipnodebyaddr</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const void * </td>
+<td>
+<var class="pdparam">src</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>size_t  </td>
+<td>
+<var class="pdparam">len</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">af</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">error_num</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_freehostent</b>(</code></td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
+<td>struct hostent * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">he</var><code>)</code>;</td>
+</tr></table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549461"></a><h2>DESCRIPTION</h2>
+<a name="id2543431"></a><h2>DESCRIPTION</h2>
 <p>
-These functions perform thread safe, protocol independent
-nodename-to-address and address-to-nodename 
-translation as defined in RFC2553.
-</p>
+      These functions perform thread safe, protocol independent
+      nodename-to-address and address-to-nodename
+      translation as defined in RFC2553.
+    </p>
 <p>
-They use a
-<span class="type">struct hostent</span>
-which is defined in
-<code class="filename">namedb.h</code>:
-</p>
+      They use a
+      <span class="type">struct hostent</span>
+      which is defined in
+      <code class="filename">namedb.h</code>:
+    </p>
 <pre class="programlisting">
 struct  hostent {
         char    *h_name;        /* official name of host */
@@ -133,184 +121,159 @@ struct  hostent {
 #define h_addr  h_addr_list[0]  /* address, for backward compatibility */
 </pre>
 <p>
-</p>
+    </p>
 <p>
-The members of this structure are:
-</p>
+      The members of this structure are:
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">h_name</code></span></dt>
 <dd><p>
-The official (canonical) name of the host.
-</p></dd>
+              The official (canonical) name of the host.
+            </p></dd>
 <dt><span class="term"><code class="constant">h_aliases</code></span></dt>
 <dd><p>
-A NULL-terminated array of alternate names (nicknames) for the host.
-</p></dd>
+              A NULL-terminated array of alternate names (nicknames) for the
+              host.
+            </p></dd>
 <dt><span class="term"><code class="constant">h_addrtype</code></span></dt>
 <dd><p>
-The type of address being returned - usually
-<span class="type">PF_INET</span>
-or
-<span class="type">PF_INET6</span>.
+              The type of address being returned - usually
+              <span class="type">PF_INET</span>
+              or
+              <span class="type">PF_INET6</span>.
 
-</p></dd>
+            </p></dd>
 <dt><span class="term"><code class="constant">h_length</code></span></dt>
 <dd><p>
-The length of the address in bytes.
-</p></dd>
+              The length of the address in bytes.
+            </p></dd>
 <dt><span class="term"><code class="constant">h_addr_list</code></span></dt>
 <dd><p>
-A
-<span class="type">NULL</span>
-terminated array of network addresses for the host.
-Host addresses are returned in network byte order.
-</p></dd>
+              A
+              <span class="type">NULL</span>
+              terminated array of network addresses for the host.
+              Host addresses are returned in network byte order.
+            </p></dd>
 </dl></div>
 <p>
-</p>
-<p>
-<code class="function">lwres_getipnodebyname()</code>
-looks up addresses of protocol family
-<em class="parameter"><code>af</code></em>
-
-for the hostname
-<em class="parameter"><code>name</code></em>.
+    </p>
+<p><code class="function">lwres_getipnodebyname()</code>
+      looks up addresses of protocol family <em class="parameter"><code>af</code></em>
+      for the hostname <em class="parameter"><code>name</code></em>.  The
+      <em class="parameter"><code>flags</code></em> parameter contains ORed flag bits
+      to specify the types of addresses that are searched for, and the
+      types of addresses that are returned.  The flag bits are:
 
-The
-<em class="parameter"><code>flags</code></em>
-parameter contains ORed flag bits to 
-specify the types of addresses that are searched
-for, and the types of addresses that are returned. 
-The flag bits are:
-</p>
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">AI_V4MAPPED</code></span></dt>
 <dd><p>
-This is used with an
-<em class="parameter"><code>af</code></em>
-of AF_INET6, and causes IPv4 addresses to be returned as IPv4-mapped
-IPv6 addresses.
-</p></dd>
+              This is used with an
+              <em class="parameter"><code>af</code></em>
+              of AF_INET6, and causes IPv4 addresses to be returned as
+              IPv4-mapped
+              IPv6 addresses.
+            </p></dd>
 <dt><span class="term"><code class="constant">AI_ALL</code></span></dt>
 <dd><p>
-This is used with an
-<em class="parameter"><code>af</code></em>
-of AF_INET6, and causes all known addresses (IPv6 and IPv4) to be returned.
-If AI_V4MAPPED is also set, the IPv4 addresses are return as mapped
-IPv6 addresses.
-</p></dd>
+              This is used with an
+              <em class="parameter"><code>af</code></em>
+              of AF_INET6, and causes all known addresses (IPv6 and IPv4) to
+              be returned.
+              If AI_V4MAPPED is also set, the IPv4 addresses are return as
+              mapped
+              IPv6 addresses.
+            </p></dd>
 <dt><span class="term"><code class="constant">AI_ADDRCONFIG</code></span></dt>
 <dd><p>
-Only return an IPv6 or IPv4 address if here is an active network
-interface of that type.  This is not currently implemented
-in the BIND 9 lightweight resolver, and the flag is ignored.
-</p></dd>
+              Only return an IPv6 or IPv4 address if here is an active network
+              interface of that type.  This is not currently implemented
+              in the BIND 9 lightweight resolver, and the flag is ignored.
+            </p></dd>
 <dt><span class="term"><code class="constant">AI_DEFAULT</code></span></dt>
 <dd><p>
-This default sets the
-<code class="constant">AI_V4MAPPED</code>
-and
-<code class="constant">AI_ADDRCONFIG</code>
-flag bits.
-</p></dd>
+              This default sets the
+              <code class="constant">AI_V4MAPPED</code>
+              and
+              <code class="constant">AI_ADDRCONFIG</code>
+              flag bits.
+            </p></dd>
 </dl></div>
 <p>
-</p>
-<p>
-<code class="function">lwres_getipnodebyaddr()</code>
-performs a reverse lookup
-of address
-<em class="parameter"><code>src</code></em>
-which is
-<em class="parameter"><code>len</code></em>
-bytes long.
-<em class="parameter"><code>af</code></em>
-denotes the protocol family, typically
-<span class="type">PF_INET</span>
-or
-<span class="type">PF_INET6</span>.
-
-</p>
-<p>
-<code class="function">lwres_freehostent()</code>
-releases all the memory associated with
-the
-<span class="type">struct hostent</span>
-pointer
-<em class="parameter"><code>he</code></em>.
-
-Any memory allocated for the
-<code class="constant">h_name</code>,
-
-<code class="constant">h_addr_list</code>
-and
-<code class="constant">h_aliases</code>
-is freed, as is the memory for the
-<span class="type">hostent</span>
-structure itself.
-</p>
+    </p>
+<p><code class="function">lwres_getipnodebyaddr()</code>
+      performs a reverse lookup of address <em class="parameter"><code>src</code></em>
+      which is <em class="parameter"><code>len</code></em> bytes long.
+      <em class="parameter"><code>af</code></em> denotes the protocol family, typically
+      <span class="type">PF_INET</span> or <span class="type">PF_INET6</span>.
+    </p>
+<p><code class="function">lwres_freehostent()</code>
+      releases all the memory associated with the <span class="type">struct
+      hostent</span> pointer <em class="parameter"><code>he</code></em>.  Any memory
+      allocated for the <code class="constant">h_name</code>,
+      <code class="constant">h_addr_list</code> and
+      <code class="constant">h_aliases</code> is freed, as is the memory for
+      the <span class="type">hostent</span> structure itself.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549832"></a><h2>RETURN VALUES</h2>
+<a name="id2543689"></a><h2>RETURN VALUES</h2>
 <p>
-If an error occurs,
-<code class="function">lwres_getipnodebyname()</code>
-and
-<code class="function">lwres_getipnodebyaddr()</code>
-set
-<em class="parameter"><code>*error_num</code></em>
-to an appropriate error code and the function returns a
-<span class="type">NULL</span>
-pointer.
-The error codes and their meanings are defined in
-<code class="filename">&lt;lwres/netdb.h&gt;</code>:
-</p>
+      If an error occurs,
+      <code class="function">lwres_getipnodebyname()</code>
+      and
+      <code class="function">lwres_getipnodebyaddr()</code>
+      set
+      <em class="parameter"><code>*error_num</code></em>
+      to an appropriate error code and the function returns a
+      <span class="type">NULL</span>
+      pointer.
+      The error codes and their meanings are defined in
+      <code class="filename">&lt;lwres/netdb.h&gt;</code>:
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">HOST_NOT_FOUND</code></span></dt>
 <dd><p>
-No such host is known.
-</p></dd>
+              No such host is known.
+            </p></dd>
 <dt><span class="term"><code class="constant">NO_ADDRESS</code></span></dt>
 <dd><p>
-The server recognised the request and the name but no address is
-available.  Another type of request to the name server for the
-domain might return an answer.
-</p></dd>
+              The server recognised the request and the name but no address is
+              available.  Another type of request to the name server for the
+              domain might return an answer.
+            </p></dd>
 <dt><span class="term"><code class="constant">TRY_AGAIN</code></span></dt>
 <dd><p>
-A temporary and possibly transient error occurred, such as a
-failure of a server to respond.  The request may succeed if
-retried.
-</p></dd>
+              A temporary and possibly transient error occurred, such as a
+              failure of a server to respond.  The request may succeed if
+              retried.
+            </p></dd>
 <dt><span class="term"><code class="constant">NO_RECOVERY</code></span></dt>
 <dd><p>
-An unexpected failure occurred, and retrying the request
-is pointless.
-</p></dd>
+              An unexpected failure occurred, and retrying the request
+              is pointless.
+            </p></dd>
 </dl></div>
 <p>
-</p>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3
-)</span>
-translates these error codes to suitable error messages.
-</p>
+    </p>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>
+      translates these error codes to suitable error messages.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549923"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">RFC2553</span></span>,
+<a name="id2543786"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">RFC2553</span></span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_gethostent</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_gethostent</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getaddrinfo</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_getnameinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getnameinfo</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>.
-</p>
+      <span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3 b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3
index a9af04b..449f591 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3
+++ b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_getnameinfo.3,v 1.15.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_getnameinfo.3,v 1.18.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_getnameinfo
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,7 +36,7 @@ lwres_getnameinfo \- lightweight resolver socket address structure to hostname a
 #include <lwres/netdb.h>
 .fi
 .HP 22
-.BI "int lwres_getnameinfo(const\ struct\ sockaddr\ *sa, size_t\ salen, char\ *host, size_t\ hostlen, char\ *serv, size_t\ servlen, int\ flags);"
+.BI "int lwres_getnameinfo(const\ struct\ sockaddr\ *" "sa" ", size_t\ " "salen" ", char\ *" "host" ", size_t\ " "hostlen" ", char\ *" "serv" ", size_t\ " "servlen" ", int\ " "flags" ");"
 .SH "DESCRIPTION"
 .PP
 This function is equivalent to the
@@ -68,21 +68,31 @@ bytes long. The maximum length of the service name is
 The
 \fIflags\fR
 argument sets the following bits:
-.TP 3n
+.PP
 \fBNI_NOFQDN\fR
+.RS 4
 A fully qualified domain name is not required for local hosts. The local part of the fully qualified domain name is returned instead.
-.TP 3n
+.RE
+.PP
 \fBNI_NUMERICHOST\fR
+.RS 4
 Return the address in numeric form, as if calling inet_ntop(), instead of a host name.
-.TP 3n
+.RE
+.PP
 \fBNI_NAMEREQD\fR
+.RS 4
 A name is required. If the hostname cannot be found in the DNS and this flag is set, a non\-zero error code is returned. If the hostname is not found and the flag is not set, the address is returned in numeric form.
-.TP 3n
+.RE
+.PP
 \fBNI_NUMERICSERV\fR
+.RS 4
 The service name is returned as a digit string representing the port number.
-.TP 3n
+.RE
+.PP
 \fBNI_DGRAM\fR
+.RS 4
 Specifies that the service being looked up is a datagram service, and causes getservbyport() to be called with a second argument of "udp" instead of its default of "tcp". This is required for the few ports (512\-514) that have different services for UDP and TCP.
+.RE
 .SH "RETURN VALUES"
 .PP
 \fBlwres_getnameinfo()\fR
@@ -101,4 +111,7 @@ RFC2133 fails to define what the nonzero return values of
 \fBgetnameinfo\fR(3)
 are.
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook
index b6e10ac..4886196 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_getnameinfo.docbook,v 1.3.206.3 2005/05/12 21:36:15 sra Exp $ -->
-
+<!-- $Id: lwres_getnameinfo.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_getnameinfo</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_getnameinfo</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,126 +45,161 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_getnameinfo</refname>
-<refpurpose>lightweight resolver socket address structure to hostname and service name</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_getnameinfo</refname>
+    <refpurpose>lightweight resolver socket address structure to hostname and
+      service name
+    </refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/netdb.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 int
 <function>lwres_getnameinfo</function></funcdef>
-<paramdef>const struct sockaddr *sa</paramdef>
-<paramdef>size_t salen</paramdef>
-<paramdef>char *host</paramdef>
-<paramdef>size_t hostlen</paramdef>
-<paramdef>char *serv</paramdef>
-<paramdef>size_t servlen</paramdef>
-<paramdef>int flags</paramdef>
-</funcprototype>
+        <paramdef>const struct sockaddr *<parameter>sa</parameter></paramdef>
+        <paramdef>size_t <parameter>salen</parameter></paramdef>
+        <paramdef>char *<parameter>host</parameter></paramdef>
+        <paramdef>size_t <parameter>hostlen</parameter></paramdef>
+        <paramdef>char *<parameter>serv</parameter></paramdef>
+        <paramdef>size_t <parameter>servlen</parameter></paramdef>
+        <paramdef>int <parameter>flags</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
-<title>DESCRIPTION</title>
+  <refsect1>
+    <title>DESCRIPTION</title>
 
-<para> This function is equivalent to the <citerefentry>
-<refentrytitle>getnameinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry> function defined in RFC2133.
-<function>lwres_getnameinfo()</function> returns the hostname for the
-<type>struct sockaddr</type> <parameter>sa</parameter> which is
-<parameter>salen</parameter> bytes long.  The hostname is of length
-<parameter>hostlen</parameter> and is returned via
-<parameter>*host.</parameter> The maximum length of the hostname is
-1025 bytes: <constant>NI_MAXHOST</constant>.</para>
+    <para>
+       This function is equivalent to the
+      <citerefentry>
+        <refentrytitle>getnameinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry> function defined in RFC2133.
+      <function>lwres_getnameinfo()</function> returns the
+      hostname for the
+      <type>struct sockaddr</type> <parameter>sa</parameter> which
+      is
+      <parameter>salen</parameter> bytes long.  The hostname is of
+      length
+      <parameter>hostlen</parameter> and is returned via
+      <parameter>*host.</parameter> The maximum length of the
+      hostname is
+      1025 bytes: <constant>NI_MAXHOST</constant>.
+    </para>
 
-<para> The name of the service associated with the port number in
-<parameter>sa</parameter> is returned in <parameter>*serv.</parameter>
-It is <parameter>servlen</parameter> bytes long.  The maximum length
-of the service name is <constant>NI_MAXSERV</constant> - 32 bytes.
-</para>
+    <para> The name of the service associated with the port number in
+      <parameter>sa</parameter> is returned in <parameter>*serv.</parameter>
+      It is <parameter>servlen</parameter> bytes long.  The
+      maximum length
+      of the service name is <constant>NI_MAXSERV</constant> - 32
+      bytes.
+    </para>
 
-<para> The <parameter>flags</parameter> argument sets the following
-bits:
-<variablelist>
-<varlistentry><term><constant>NI_NOFQDN</constant></term>
-<listitem>
-<para>
-A fully qualified domain name is not required for local hosts.
-The local part of the fully qualified domain name is returned instead.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>NI_NUMERICHOST</constant></term>
-<listitem>
-<para>
-Return the address in numeric form, as if calling inet_ntop(),
-instead of a host name.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>NI_NAMEREQD</constant></term>
-<listitem>
-<para>
-A name is required. If the hostname cannot be found in the DNS and
-this flag is set, a non-zero error code is returned.
-If the hostname is not found and the flag is not set, the 
-address is returned in numeric form.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>NI_NUMERICSERV</constant></term>
-<listitem>
-<para>
-The service name is returned as a digit string representing the port number.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>NI_DGRAM</constant></term>
-<listitem>
-<para>
-Specifies that the service being looked up is a datagram
-service,  and causes getservbyport() to be called with a second
-argument of "udp" instead of its default of "tcp".  This is required
-for the few ports (512-514) that have different services for UDP and
-TCP.
-</para></listitem></varlistentry>
-</variablelist>
-</para>
-</refsect1>
+    <para>
+       The <parameter>flags</parameter> argument sets the
+      following
+      bits:
+      <variablelist>
+        <varlistentry>
+          <term><constant>NI_NOFQDN</constant></term>
+          <listitem>
+            <para>
+              A fully qualified domain name is not required for local hosts.
+              The local part of the fully qualified domain name is returned
+              instead.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NI_NUMERICHOST</constant></term>
+          <listitem>
+            <para>
+              Return the address in numeric form, as if calling inet_ntop(),
+              instead of a host name.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NI_NAMEREQD</constant></term>
+          <listitem>
+            <para>
+              A name is required. If the hostname cannot be found in the DNS
+              and
+              this flag is set, a non-zero error code is returned.
+              If the hostname is not found and the flag is not set, the
+              address is returned in numeric form.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NI_NUMERICSERV</constant></term>
+          <listitem>
+            <para>
+              The service name is returned as a digit string representing the
+              port number.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>NI_DGRAM</constant></term>
+          <listitem>
+            <para>
+              Specifies that the service being looked up is a datagram
+              service,  and causes getservbyport() to be called with a second
+              argument of "udp" instead of its default of "tcp".  This is
+              required
+              for the few ports (512-514) that have different services for UDP
+              and
+              TCP.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
+  </refsect1>
 
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-<function>lwres_getnameinfo()</function>
-returns 0 on success or a non-zero error code if an error occurs.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>RFC2133</refentrytitle>
-</citerefentry>,
-<citerefentry>
-<refentrytitle>getservbyport</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-<citerefentry>
-<refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-<citerefentry>
-<refentrytitle>lwres_getnameinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-<citerefentry>
-<refentrytitle>lwres_getnamebyaddr</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
-<citerefentry>
-<refentrytitle>lwres_net_ntop</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
-</para>
-</refsect1>
-<refsect1>
-<title>BUGS</title>
-<para>
-RFC2133 fails to define what the nonzero return values of
-<citerefentry>
-<refentrytitle>getnameinfo</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>
-are.
-</para>
-</refsect1>
-</refentry>
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para><function>lwres_getnameinfo()</function>
+      returns 0 on success or a non-zero error code if an error occurs.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>RFC2133</refentrytitle>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>getservbyport</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getnameinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>lwres_getnamebyaddr</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+      <citerefentry>
+        <refentrytitle>lwres_net_ntop</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>BUGS</title>
+    <para>
+      RFC2133 fails to define what the nonzero return values of
+      <citerefentry>
+        <refentrytitle>getnameinfo</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+      are.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html
index 3111730..312cfe5 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html
+++ b/contrib/bind9/lib/lwres/man/lwres_getnameinfo.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,18 +14,20 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_getnameinfo.html,v 1.5.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_getnameinfo.html,v 1.6.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_getnameinfo</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
-<p>lwres_getnameinfo &#8212; lightweight resolver socket address structure to hostname and service name</p>
+<p>lwres_getnameinfo &#8212; lightweight resolver socket address structure to hostname and
+      service name
+    </p>
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
@@ -36,124 +38,139 @@
 <td><code class="funcdef">
 int
 <b class="fsfunc">lwres_getnameinfo</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const struct sockaddr * </td>
+<td>
+<var class="pdparam">sa</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>size_t  </td>
+<td>
+<var class="pdparam">salen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>char * </td>
+<td>
+<var class="pdparam">host</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>size_t  </td>
+<td>
+<var class="pdparam">hostlen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>char * </td>
+<td>
+<var class="pdparam">serv</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>size_t  </td>
+<td>
+<var class="pdparam">servlen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>int  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">flags</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549427"></a><h2>DESCRIPTION</h2>
-<p> This function is equivalent to the <span class="citerefentry"><span class="refentrytitle">getnameinfo</span>(3)</span> function defined in RFC2133.
-<code class="function">lwres_getnameinfo()</code> returns the hostname for the
-<span class="type">struct sockaddr</span> <em class="parameter"><code>sa</code></em> which is
-<em class="parameter"><code>salen</code></em> bytes long.  The hostname is of length
-<em class="parameter"><code>hostlen</code></em> and is returned via
-<em class="parameter"><code>*host.</code></em> The maximum length of the hostname is
-1025 bytes: <code class="constant">NI_MAXHOST</code>.</p>
+<a name="id2543393"></a><h2>DESCRIPTION</h2>
+<p>
+       This function is equivalent to the
+      <span class="citerefentry"><span class="refentrytitle">getnameinfo</span>(3)</span> function defined in RFC2133.
+      <code class="function">lwres_getnameinfo()</code> returns the
+      hostname for the
+      <span class="type">struct sockaddr</span> <em class="parameter"><code>sa</code></em> which
+      is
+      <em class="parameter"><code>salen</code></em> bytes long.  The hostname is of
+      length
+      <em class="parameter"><code>hostlen</code></em> and is returned via
+      <em class="parameter"><code>*host.</code></em> The maximum length of the
+      hostname is
+      1025 bytes: <code class="constant">NI_MAXHOST</code>.
+    </p>
 <p> The name of the service associated with the port number in
-<em class="parameter"><code>sa</code></em> is returned in <em class="parameter"><code>*serv.</code></em>
-It is <em class="parameter"><code>servlen</code></em> bytes long.  The maximum length
-of the service name is <code class="constant">NI_MAXSERV</code> - 32 bytes.
-</p>
-<p> The <em class="parameter"><code>flags</code></em> argument sets the following
-bits:
-</p>
+      <em class="parameter"><code>sa</code></em> is returned in <em class="parameter"><code>*serv.</code></em>
+      It is <em class="parameter"><code>servlen</code></em> bytes long.  The
+      maximum length
+      of the service name is <code class="constant">NI_MAXSERV</code> - 32
+      bytes.
+    </p>
+<p>
+       The <em class="parameter"><code>flags</code></em> argument sets the
+      following
+      bits:
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">NI_NOFQDN</code></span></dt>
 <dd><p>
-A fully qualified domain name is not required for local hosts.
-The local part of the fully qualified domain name is returned instead.
-</p></dd>
+              A fully qualified domain name is not required for local hosts.
+              The local part of the fully qualified domain name is returned
+              instead.
+            </p></dd>
 <dt><span class="term"><code class="constant">NI_NUMERICHOST</code></span></dt>
 <dd><p>
-Return the address in numeric form, as if calling inet_ntop(),
-instead of a host name.
-</p></dd>
+              Return the address in numeric form, as if calling inet_ntop(),
+              instead of a host name.
+            </p></dd>
 <dt><span class="term"><code class="constant">NI_NAMEREQD</code></span></dt>
 <dd><p>
-A name is required. If the hostname cannot be found in the DNS and
-this flag is set, a non-zero error code is returned.
-If the hostname is not found and the flag is not set, the 
-address is returned in numeric form.
-</p></dd>
+              A name is required. If the hostname cannot be found in the DNS
+              and
+              this flag is set, a non-zero error code is returned.
+              If the hostname is not found and the flag is not set, the
+              address is returned in numeric form.
+            </p></dd>
 <dt><span class="term"><code class="constant">NI_NUMERICSERV</code></span></dt>
 <dd><p>
-The service name is returned as a digit string representing the port number.
-</p></dd>
+              The service name is returned as a digit string representing the
+              port number.
+            </p></dd>
 <dt><span class="term"><code class="constant">NI_DGRAM</code></span></dt>
 <dd><p>
-Specifies that the service being looked up is a datagram
-service,  and causes getservbyport() to be called with a second
-argument of "udp" instead of its default of "tcp".  This is required
-for the few ports (512-514) that have different services for UDP and
-TCP.
-</p></dd>
+              Specifies that the service being looked up is a datagram
+              service,  and causes getservbyport() to be called with a second
+              argument of "udp" instead of its default of "tcp".  This is
+              required
+              for the few ports (512-514) that have different services for UDP
+              and
+              TCP.
+            </p></dd>
 </dl></div>
 <p>
-</p>
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549553"></a><h2>RETURN VALUES</h2>
-<p>
-<code class="function">lwres_getnameinfo()</code>
-returns 0 on success or a non-zero error code if an error occurs.
-</p>
+<a name="id2543534"></a><h2>RETURN VALUES</h2>
+<p><code class="function">lwres_getnameinfo()</code>
+      returns 0 on success or a non-zero error code if an error occurs.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549634"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">RFC2133</span></span>,
-<span class="citerefentry"><span class="refentrytitle">getservbyport</span>(3)</span>,
-<span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
-<span class="citerefentry"><span class="refentrytitle">lwres_getnameinfo</span>(3)</span>,
-<span class="citerefentry"><span class="refentrytitle">lwres_getnamebyaddr</span>(3)</span>.
-<span class="citerefentry"><span class="refentrytitle">lwres_net_ntop</span>(3)</span>.
-</p>
+<a name="id2543546"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">RFC2133</span></span>,
+      <span class="citerefentry"><span class="refentrytitle">getservbyport</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getnameinfo</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">lwres_getnamebyaddr</span>(3)</span>.
+      <span class="citerefentry"><span class="refentrytitle">lwres_net_ntop</span>(3)</span>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549692"></a><h2>BUGS</h2>
+<a name="id2543604"></a><h2>BUGS</h2>
 <p>
-RFC2133 fails to define what the nonzero return values of
-<span class="citerefentry"><span class="refentrytitle">getnameinfo</span>(3)</span>
-are.
-</p>
+      RFC2133 fails to define what the nonzero return values of
+      <span class="citerefentry"><span class="refentrytitle">getnameinfo</span>(3)</span>
+      are.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3 b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3
index 1aeca28..548b8e7 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3
+++ b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_getrrsetbyname.3,v 1.11.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_getrrsetbyname.3,v 1.14.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_getrrsetbyname
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Oct 18, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,18 +36,24 @@ lwres_getrrsetbyname, lwres_freerrset \- retrieve DNS records
 #include <lwres/netdb.h>
 .fi
 .HP 25
-.BI "int lwres_getrrsetbyname(const\ char\ *hostname, unsigned\ int\ rdclass, unsigned\ int\ rdtype, unsigned\ int\ flags, struct\ rrsetinfo\ **res);"
+.BI "int lwres_getrrsetbyname(const\ char\ *" "hostname" ", unsigned\ int\ " "rdclass" ", unsigned\ int\ " "rdtype" ", unsigned\ int\ " "flags" ", struct\ rrsetinfo\ **" "res" ");"
 .HP 21
-.BI "void lwres_freerrset(struct\ rrsetinfo\ *rrset);"
+.BI "void lwres_freerrset(struct\ rrsetinfo\ *" "rrset" ");"
 .PP
 The following structures are used:
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 struct  rdatainfo {
         unsigned int            rdi_length;     /* length of data */
         unsigned char           *rdi_data;      /* record data */
 };
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 struct  rrsetinfo {
         unsigned int            rri_flags;      /* RRSET_VALIDATED... */
         unsigned int            rri_rdclass;    /* class number */
@@ -120,24 +126,39 @@ created by a call to
 .PP
 \fBlwres_getrrsetbyname()\fR
 returns zero on success, and one of the following error codes if an error occurred:
-.TP 3n
+.PP
 \fBERRSET_NONAME\fR
+.RS 4
 the name does not exist
-.TP 3n
+.RE
+.PP
 \fBERRSET_NODATA\fR
+.RS 4
 the name exists, but does not have data of the desired type
-.TP 3n
+.RE
+.PP
 \fBERRSET_NOMEMORY\fR
+.RS 4
 memory could not be allocated
-.TP 3n
+.RE
+.PP
 \fBERRSET_INVAL\fR
+.RS 4
 a parameter is invalid
-.TP 3n
+.RE
+.PP
 \fBERRSET_FAIL\fR
+.RS 4
 other failure
-.TP 3n
+.RE
+.PP
+.RS 4
+.RE
 .SH "SEE ALSO"
 .PP
 \fBlwres\fR(3).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook
index 53c33be..2fd996b 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_getrrsetbyname.docbook,v 1.3.206.3 2005/05/12 21:36:15 sra Exp $ -->
-
+<!-- $Id: lwres_getrrsetbyname.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
-<refentryinfo>
 
+  <refentryinfo>
+    <date>Oct 18, 2000</date>
+  </refentryinfo>
 
-<date>Oct 18, 2000</date>
-</refentryinfo>
-<refmeta>
-<refentrytitle>lwres_getrrsetbyname</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_getrrsetbyname</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,40 +45,43 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_getrrsetbyname</refname>
-<refname>lwres_freerrset</refname>
-<refpurpose>retrieve DNS records</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_getrrsetbyname</refname>
+    <refname>lwres_freerrset</refname>
+    <refpurpose>retrieve DNS records</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/netdb.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 int
 <function>lwres_getrrsetbyname</function></funcdef>
-<paramdef>const char *hostname</paramdef>
-<paramdef>unsigned int rdclass</paramdef>
-<paramdef>unsigned int rdtype</paramdef>
-<paramdef>unsigned int flags</paramdef>
-<paramdef>struct rrsetinfo **res</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>hostname</parameter></paramdef>
+        <paramdef>unsigned int <parameter>rdclass</parameter></paramdef>
+        <paramdef>unsigned int <parameter>rdtype</parameter></paramdef>
+        <paramdef>unsigned int <parameter>flags</parameter></paramdef>
+        <paramdef>struct rrsetinfo **<parameter>res</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_freerrset</function></funcdef>
-<paramdef>struct rrsetinfo *rrset</paramdef>
-</funcprototype>
+        <paramdef>struct rrsetinfo *<parameter>rrset</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
 
-<para>
-The following structures are used:
-<programlisting>
+    <para>
+      The following structures are used:
+    </para>
+    <para><programlisting>
 struct  rdatainfo {
         unsigned int            rdi_length;     /* length of data */
         unsigned char           *rdi_data;      /* record data */
 };
-
+</programlisting>
+    </para>
+    <para><programlisting>
 struct  rrsetinfo {
         unsigned int            rri_flags;      /* RRSET_VALIDATED... */
         unsigned int            rri_rdclass;    /* class number */
@@ -91,134 +94,130 @@ struct  rrsetinfo {
         struct rdatainfo        *rri_sigs;      /* individual signatures */
 };
 </programlisting>
-</para>
-</refsynopsisdiv>
-
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-<function>lwres_getrrsetbyname()</function>
-gets a set of resource records associated with a
-<parameter>hostname</parameter>,
-
-<parameter>class</parameter>,
-
-and
-<parameter>type</parameter>.
-
-<parameter>hostname</parameter>
-is
-a pointer a to null-terminated string.  The
-<parameter>flags</parameter>
-field is currently unused and must be zero.
-</para>
-<para>
-After a successful call to
-<function>lwres_getrrsetbyname()</function>,
-
-<parameter>*res</parameter>
-is a pointer to an
-<type>rrsetinfo</type>
-structure, containing a list of one or more
-<type>rdatainfo</type>
-structures containing resource records and potentially another list of
-<type>rdatainfo</type>
-structures containing SIG resource records
-associated with those records.
-The members
-<constant>rri_rdclass</constant>
-and
-<constant>rri_rdtype</constant>
-are copied from the parameters.
-<constant>rri_ttl</constant>
-and
-<constant>rri_name</constant>
-are properties of the obtained rrset.
-The resource records contained in
-<constant>rri_rdatas</constant>
-and
-<constant>rri_sigs</constant>
-are in uncompressed DNS wire format.
-Properties of the rdataset are represented in the
-<constant>rri_flags</constant>
-bitfield.  If the RRSET_VALIDATED bit is set, the data has been DNSSEC
-validated and the signatures verified.  
-</para>
-<para>
-All of the information returned by
-<function>lwres_getrrsetbyname()</function>
-is dynamically allocated: the
-<constant>rrsetinfo</constant>
-and
-<constant>rdatainfo</constant>
-structures,
-and the canonical host name strings pointed to by the
-<constant>rrsetinfo</constant>structure.
-
-Memory allocated for the dynamically allocated structures created by
-a successful call to
-<function>lwres_getrrsetbyname()</function>
-is released by
-<function>lwres_freerrset()</function>.
-
-<parameter>rrset</parameter>
-is a pointer to a
-<type>struct rrset</type>
-created by a call to
-<function>lwres_getrrsetbyname()</function>.
-
-</para>
-<para>
-</para>
-</refsect1>
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-<function>lwres_getrrsetbyname()</function>
-returns zero on success, and one of the following error
-codes if an error occurred:
-<variablelist>
-
-<varlistentry><term><constant>ERRSET_NONAME</constant></term>
-<listitem><para>
-the name does not exist
-</para></listitem></varlistentry>
-
-<varlistentry><term><constant>ERRSET_NODATA</constant></term>
-<listitem><para>
-the name exists, but does not have data of the desired type
-</para></listitem></varlistentry>
-
-<varlistentry><term><constant>ERRSET_NOMEMORY</constant></term>
-<listitem><para>
-memory could not be allocated
-</para></listitem></varlistentry>
-
-<varlistentry><term><constant>ERRSET_INVAL</constant></term>
-<listitem><para>
-a parameter is invalid
-</para></listitem></varlistentry>
-
-<varlistentry><term><constant>ERRSET_FAIL</constant></term>
-<listitem><para>
-other failure
-</para></listitem></varlistentry>
-
-<varlistentry><term><constant></constant></term>
-<listitem><para>
-</para></listitem></varlistentry>
-
-</variablelist>
-
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
-</para>
-
-</refsect1>
-</refentry>
+    </para>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>DESCRIPTION</title>
+    <para><function>lwres_getrrsetbyname()</function>
+      gets a set of resource records associated with a
+      <parameter>hostname</parameter>, <parameter>class</parameter>,
+      and <parameter>type</parameter>.
+      <parameter>hostname</parameter> is a pointer a to
+      null-terminated string.  The <parameter>flags</parameter> field
+      is currently unused and must be zero.
+    </para>
+    <para>
+      After a successful call to
+      <function>lwres_getrrsetbyname()</function>,
+      <parameter>*res</parameter> is a pointer to an
+      <type>rrsetinfo</type> structure, containing a list of one or
+      more <type>rdatainfo</type> structures containing resource
+      records and potentially another list of <type>rdatainfo</type>
+      structures containing SIG resource records associated with those
+      records.  The members <constant>rri_rdclass</constant> and
+      <constant>rri_rdtype</constant> are copied from the parameters.
+      <constant>rri_ttl</constant> and <constant>rri_name</constant>
+      are properties of the obtained rrset.  The resource records
+      contained in <constant>rri_rdatas</constant> and
+      <constant>rri_sigs</constant> are in uncompressed DNS wire
+      format.  Properties of the rdataset are represented in the
+      <constant>rri_flags</constant> bitfield.  If the RRSET_VALIDATED
+      bit is set, the data has been DNSSEC validated and the
+      signatures verified.
+    </para>
+    <para>
+      All of the information returned by
+      <function>lwres_getrrsetbyname()</function> is dynamically
+      allocated: the <constant>rrsetinfo</constant> and
+      <constant>rdatainfo</constant> structures, and the canonical
+      host name strings pointed to by the
+      <constant>rrsetinfo</constant>structure.
+
+      Memory allocated for the dynamically allocated structures
+      created by a successful call to
+      <function>lwres_getrrsetbyname()</function> is released by
+      <function>lwres_freerrset()</function>.
+
+      <parameter>rrset</parameter> is a pointer to a <type>struct
+      rrset</type> created by a call to
+      <function>lwres_getrrsetbyname()</function>.
+    </para>
+    <para></para>
+  </refsect1>
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para><function>lwres_getrrsetbyname()</function>
+      returns zero on success, and one of the following error codes if
+      an error occurred:
+      <variablelist>
+
+        <varlistentry>
+          <term><constant>ERRSET_NONAME</constant></term>
+          <listitem>
+            <para>
+              the name does not exist
+            </para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><constant>ERRSET_NODATA</constant></term>
+          <listitem>
+            <para>
+              the name exists, but does not have data of the desired type
+            </para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><constant>ERRSET_NOMEMORY</constant></term>
+          <listitem>
+            <para>
+              memory could not be allocated
+            </para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><constant>ERRSET_INVAL</constant></term>
+          <listitem>
+            <para>
+              a parameter is invalid
+            </para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><constant>ERRSET_FAIL</constant></term>
+          <listitem>
+            <para>
+              other failure
+            </para>
+          </listitem>
+        </varlistentry>
+
+        <varlistentry>
+          <term><constant/></term>
+          <listitem>
+            <para></para>
+          </listitem>
+        </varlistentry>
+
+      </variablelist>
+
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
+
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html
index 6cbed6f..0925367 100644
--- a/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html
+++ b/contrib/bind9/lib/lwres/man/lwres_getrrsetbyname.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_getrrsetbyname.html,v 1.5.2.1.4.11 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_getrrsetbyname.html,v 1.6.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_getrrsetbyname</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_getrrsetbyname, lwres_freerrset &#8212; retrieve DNS records</p>
@@ -36,62 +36,56 @@
 <td><code class="funcdef">
 int
 <b class="fsfunc">lwres_getrrsetbyname</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">hostname</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>unsigned int  </td>
+<td>
+<var class="pdparam">rdclass</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>unsigned int  </td>
+<td>
+<var class="pdparam">rdtype</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>unsigned int  </td>
+<td>
+<var class="pdparam">flags</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>struct rrsetinfo ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">res</var><code>)</code>;</td>
 </tr>
 </table>
-<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
-<tr>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0"><tr>
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_freerrset</b>(</code></td>
-<td> </td>
-<td>
-<code>)</code>;</td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
+<td>struct rrsetinfo * </td>
 <td>
-<code>)</code>;</td>
-</tr>
-</table>
+<var class="pdparam">rrset</var><code>)</code>;</td>
+</tr></table>
 </div>
 <p>
-The following structures are used:
-</p>
+      The following structures are used:
+    </p>
 <pre class="programlisting">
 struct  rdatainfo {
         unsigned int            rdi_length;     /* length of data */
         unsigned char           *rdi_data;      /* record data */
 };
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 struct  rrsetinfo {
         unsigned int            rri_flags;      /* RRSET_VALIDATED... */
         unsigned int            rri_rdclass;    /* class number */
@@ -105,126 +99,94 @@ struct  rrsetinfo {
 };
 </pre>
 <p>
-</p>
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549443"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_getrrsetbyname()</code>
-gets a set of resource records associated with a
-<em class="parameter"><code>hostname</code></em>,
-
-<em class="parameter"><code>class</code></em>,
-
-and
-<em class="parameter"><code>type</code></em>.
-
-<em class="parameter"><code>hostname</code></em>
-is
-a pointer a to null-terminated string.  The
-<em class="parameter"><code>flags</code></em>
-field is currently unused and must be zero.
-</p>
+<a name="id2543414"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_getrrsetbyname()</code>
+      gets a set of resource records associated with a
+      <em class="parameter"><code>hostname</code></em>, <em class="parameter"><code>class</code></em>,
+      and <em class="parameter"><code>type</code></em>.
+      <em class="parameter"><code>hostname</code></em> is a pointer a to
+      null-terminated string.  The <em class="parameter"><code>flags</code></em> field
+      is currently unused and must be zero.
+    </p>
 <p>
-After a successful call to
-<code class="function">lwres_getrrsetbyname()</code>,
-
-<em class="parameter"><code>*res</code></em>
-is a pointer to an
-<span class="type">rrsetinfo</span>
-structure, containing a list of one or more
-<span class="type">rdatainfo</span>
-structures containing resource records and potentially another list of
-<span class="type">rdatainfo</span>
-structures containing SIG resource records
-associated with those records.
-The members
-<code class="constant">rri_rdclass</code>
-and
-<code class="constant">rri_rdtype</code>
-are copied from the parameters.
-<code class="constant">rri_ttl</code>
-and
-<code class="constant">rri_name</code>
-are properties of the obtained rrset.
-The resource records contained in
-<code class="constant">rri_rdatas</code>
-and
-<code class="constant">rri_sigs</code>
-are in uncompressed DNS wire format.
-Properties of the rdataset are represented in the
-<code class="constant">rri_flags</code>
-bitfield.  If the RRSET_VALIDATED bit is set, the data has been DNSSEC
-validated and the signatures verified.  
-</p>
+      After a successful call to
+      <code class="function">lwres_getrrsetbyname()</code>,
+      <em class="parameter"><code>*res</code></em> is a pointer to an
+      <span class="type">rrsetinfo</span> structure, containing a list of one or
+      more <span class="type">rdatainfo</span> structures containing resource
+      records and potentially another list of <span class="type">rdatainfo</span>
+      structures containing SIG resource records associated with those
+      records.  The members <code class="constant">rri_rdclass</code> and
+      <code class="constant">rri_rdtype</code> are copied from the parameters.
+      <code class="constant">rri_ttl</code> and <code class="constant">rri_name</code>
+      are properties of the obtained rrset.  The resource records
+      contained in <code class="constant">rri_rdatas</code> and
+      <code class="constant">rri_sigs</code> are in uncompressed DNS wire
+      format.  Properties of the rdataset are represented in the
+      <code class="constant">rri_flags</code> bitfield.  If the RRSET_VALIDATED
+      bit is set, the data has been DNSSEC validated and the
+      signatures verified.
+    </p>
 <p>
-All of the information returned by
-<code class="function">lwres_getrrsetbyname()</code>
-is dynamically allocated: the
-<code class="constant">rrsetinfo</code>
-and
-<code class="constant">rdatainfo</code>
-structures,
-and the canonical host name strings pointed to by the
-<code class="constant">rrsetinfo</code>structure.
-
-Memory allocated for the dynamically allocated structures created by
-a successful call to
-<code class="function">lwres_getrrsetbyname()</code>
-is released by
-<code class="function">lwres_freerrset()</code>.
+      All of the information returned by
+      <code class="function">lwres_getrrsetbyname()</code> is dynamically
+      allocated: the <code class="constant">rrsetinfo</code> and
+      <code class="constant">rdatainfo</code> structures, and the canonical
+      host name strings pointed to by the
+      <code class="constant">rrsetinfo</code>structure.
 
-<em class="parameter"><code>rrset</code></em>
-is a pointer to a
-<span class="type">struct rrset</span>
-created by a call to
-<code class="function">lwres_getrrsetbyname()</code>.
+      Memory allocated for the dynamically allocated structures
+      created by a successful call to
+      <code class="function">lwres_getrrsetbyname()</code> is released by
+      <code class="function">lwres_freerrset()</code>.
 
-</p>
-<p>
-</p>
+      <em class="parameter"><code>rrset</code></em> is a pointer to a <span class="type">struct
+      rrset</span> created by a call to
+      <code class="function">lwres_getrrsetbyname()</code>.
+    </p>
+<p></p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549623"></a><h2>RETURN VALUES</h2>
-<p>
-<code class="function">lwres_getrrsetbyname()</code>
-returns zero on success, and one of the following error
-codes if an error occurred:
-</p>
+<a name="id2543526"></a><h2>RETURN VALUES</h2>
+<p><code class="function">lwres_getrrsetbyname()</code>
+      returns zero on success, and one of the following error codes if
+      an error occurred:
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">ERRSET_NONAME</code></span></dt>
 <dd><p>
-the name does not exist
-</p></dd>
+              the name does not exist
+            </p></dd>
 <dt><span class="term"><code class="constant">ERRSET_NODATA</code></span></dt>
 <dd><p>
-the name exists, but does not have data of the desired type
-</p></dd>
+              the name exists, but does not have data of the desired type
+            </p></dd>
 <dt><span class="term"><code class="constant">ERRSET_NOMEMORY</code></span></dt>
 <dd><p>
-memory could not be allocated
-</p></dd>
+              memory could not be allocated
+            </p></dd>
 <dt><span class="term"><code class="constant">ERRSET_INVAL</code></span></dt>
 <dd><p>
-a parameter is invalid
-</p></dd>
+              a parameter is invalid
+            </p></dd>
 <dt><span class="term"><code class="constant">ERRSET_FAIL</code></span></dt>
 <dd><p>
-other failure
-</p></dd>
+              other failure
+            </p></dd>
 <dt><span class="term"><code class="constant"></code></span></dt>
-<dd><p>
-</p></dd>
+<dd><p></p></dd>
 </dl></div>
 <p>
 
-</p>
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549697"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>.
-</p>
+<a name="id2543626"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_gnba.3 b/contrib/bind9/lib/lwres/man/lwres_gnba.3
index dc546d2..1c6574f 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gnba.3
+++ b/contrib/bind9/lib/lwres/man/lwres_gnba.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_gnba.3,v 1.13.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_gnba.3,v 1.16.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_gnba
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -38,15 +38,15 @@ lwres_gnbarequest_render, lwres_gnbaresponse_render, lwres_gnbarequest_parse, lw
 .HP 40
 .BI "lwres_result_t lwres_gnbarequest_render(lwres_context_t\ *" "ctx" ", lwres_gnbarequest_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");"
 .HP 41
-.BI "lwres_result_t lwres_gnbaresponse_render(lwres_context_t\ *ctx, lwres_gnbaresponse_t\ *req, lwres_lwpacket_t\ *pkt, lwres_buffer_t\ *b);"
+.BI "lwres_result_t lwres_gnbaresponse_render(lwres_context_t\ *" "ctx" ", lwres_gnbaresponse_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");"
 .HP 39
-.BI "lwres_result_t lwres_gnbarequest_parse(lwres_context_t\ *ctx, lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt, lwres_gnbarequest_t\ **structp);"
+.BI "lwres_result_t lwres_gnbarequest_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gnbarequest_t\ **" "structp" ");"
 .HP 40
-.BI "lwres_result_t lwres_gnbaresponse_parse(lwres_context_t\ *ctx, lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt, lwres_gnbaresponse_t\ **structp);"
+.BI "lwres_result_t lwres_gnbaresponse_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_gnbaresponse_t\ **" "structp" ");"
 .HP 29
-.BI "void lwres_gnbaresponse_free(lwres_context_t\ *ctx, lwres_gnbaresponse_t\ **structp);"
+.BI "void lwres_gnbaresponse_free(lwres_context_t\ *" "ctx" ", lwres_gnbaresponse_t\ **" "structp" ");"
 .HP 28
-.BI "void lwres_gnbarequest_free(lwres_context_t\ *ctx, lwres_gnbarequest_t\ **structp);"
+.BI "void lwres_gnbarequest_free(lwres_context_t\ *" "ctx" ", lwres_gnbarequest_t\ **" "structp" ");"
 .SH "DESCRIPTION"
 .PP
 These are low\-level routines for creating and parsing lightweight resolver address\-to\-name lookup request and response messages.
@@ -59,14 +59,26 @@ to the canonical format. This is complemented by a parse function which converts
 .PP
 These structures are defined in
 \fIlwres/lwres.h\fR. They are shown below.
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 #define LWRES_OPCODE_GETNAMEBYADDR      0x00010002U
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 typedef struct {
         lwres_uint32_t  flags;
         lwres_addr_t    addr;
 } lwres_gnbarequest_t;
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 typedef struct {
         lwres_uint32_t  flags;
         lwres_uint16_t  naliases;
@@ -165,4 +177,7 @@ indicate that the packet is not a response to an earlier query.
 .PP
 \fBlwres_packet\fR(3).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_gnba.docbook b/contrib/bind9/lib/lwres/man/lwres_gnba.docbook
index 7531486..5a76889 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gnba.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_gnba.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_gnba.docbook,v 1.4.206.3 2005/05/12 21:36:15 sra Exp $ -->
-
+<!-- $Id: lwres_gnba.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_gnba</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_gnba</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,114 +45,120 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_gnbarequest_render</refname>
-<refname>lwres_gnbaresponse_render</refname>
-<refname>lwres_gnbarequest_parse</refname>
-<refname>lwres_gnbaresponse_parse</refname>
-<refname>lwres_gnbaresponse_free</refname>
-<refname>lwres_gnbarequest_free</refname>
-<refpurpose>lightweight resolver getnamebyaddress message handling</refpurpose>
-</refnamediv>
+  <refnamediv>
+    <refname>lwres_gnbarequest_render</refname>
+    <refname>lwres_gnbaresponse_render</refname>
+    <refname>lwres_gnbarequest_parse</refname>
+    <refname>lwres_gnbaresponse_parse</refname>
+    <refname>lwres_gnbaresponse_free</refname>
+    <refname>lwres_gnbarequest_free</refname>
+    <refpurpose>lightweight resolver getnamebyaddress message handling</refpurpose>
+  </refnamediv>
 
-<refsynopsisdiv>
+  <refsynopsisdiv>
 
-<funcsynopsis>
+    <funcsynopsis>
 <funcsynopsisinfo>
 #include &lt;lwres/lwres.h&gt;
 </funcsynopsisinfo>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gnbarequest_render</function>
 </funcdef>
-<paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
-<paramdef>lwres_gnbarequest_t *<parameter>req</parameter></paramdef>
-<paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
-<paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gnbarequest_t *<parameter>req</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gnbaresponse_render</function>
 </funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_gnbaresponse_t *req</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gnbaresponse_t *<parameter>req</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gnbarequest_parse</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_gnbarequest_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_gnbarequest_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_gnbaresponse_parse</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_gnbaresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_gnbaresponse_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_gnbaresponse_free</function>
 </funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_gnbaresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gnbaresponse_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_gnbarequest_free</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_gnbarequest_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_gnbarequest_t **<parameter>structp</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
 
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-These are low-level routines for creating and parsing
-lightweight resolver address-to-name lookup request and 
-response messages.
-</para>
-<para>
-There are four main functions for the getnamebyaddr opcode.
-One render function converts a getnamebyaddr request structure &mdash;
-<type>lwres_gnbarequest_t</type> &mdash;
-to the lightweight resolver's canonical format.
-It is complemented by a parse function that converts a packet in this
-canonical format to a getnamebyaddr request structure.
-Another render function converts the getnamebyaddr response structure &mdash;
-<type>lwres_gnbaresponse_t</type>
-to the canonical format.
-This is complemented by a parse function which converts a packet in
-canonical format to a getnamebyaddr response structure.
-</para>
-<para>
-These structures are defined in
-<filename>lwres/lwres.h</filename>.
-They are shown below.
-<programlisting>
+  <refsect1>
+    <title>DESCRIPTION</title>
+    <para>
+      These are low-level routines for creating and parsing
+      lightweight resolver address-to-name lookup request and
+      response messages.
+    </para>
+    <para>
+      There are four main functions for the getnamebyaddr opcode.
+      One render function converts a getnamebyaddr request structure &mdash;
+      <type>lwres_gnbarequest_t</type> &mdash;
+      to the lightweight resolver's canonical format.
+      It is complemented by a parse function that converts a packet in this
+      canonical format to a getnamebyaddr request structure.
+      Another render function converts the getnamebyaddr response structure
+      &mdash;
+      <type>lwres_gnbaresponse_t</type>
+      to the canonical format.
+      This is complemented by a parse function which converts a packet in
+      canonical format to a getnamebyaddr response structure.
+    </para>
+    <para>
+      These structures are defined in
+      <filename>lwres/lwres.h</filename>.
+      They are shown below.
+    </para>
+    <para><programlisting>
 #define LWRES_OPCODE_GETNAMEBYADDR      0x00010002U
-
+</programlisting>
+    </para>
+    <para><programlisting>
 typedef struct {
         lwres_uint32_t  flags;
         lwres_addr_t    addr;
 } lwres_gnbarequest_t;
-
+</programlisting>
+    </para>
+    <para><programlisting>
 typedef struct {
         lwres_uint32_t  flags;
         lwres_uint16_t  naliases;
@@ -164,111 +170,92 @@ typedef struct {
         size_t          baselen;
 } lwres_gnbaresponse_t;
 </programlisting>
-</para>
-<para>
-<function>lwres_gnbarequest_render()</function>
-uses resolver context
-<varname>ctx</varname>
-to convert getnamebyaddr request structure
-<varname>req</varname>
-to canonical format.
-The packet header structure
-<varname>pkt</varname>
-is initialised and transferred to
-buffer
-<varname>b</varname>.
-The contents of
-<varname>*req</varname>
-are then appended to the buffer in canonical format.
-<function>lwres_gnbaresponse_render()</function>
-performs the same task, except it converts a getnamebyaddr response structure
-<type>lwres_gnbaresponse_t</type>
-to the lightweight resolver's canonical format.
-</para>
-<para>
-<function>lwres_gnbarequest_parse()</function>
-uses context
-<varname>ctx</varname>
-to convert the contents of packet
-<varname>pkt</varname>
-to a
-<type>lwres_gnbarequest_t</type>
-structure.
-Buffer
-<varname>b</varname>
-provides space to be used for storing this structure.
-When the function succeeds, the resulting
-<type>lwres_gnbarequest_t</type>
-is made available through
-<varname>*structp</varname>.
-<function>lwres_gnbaresponse_parse()</function>
-offers the same semantics as
-<function>lwres_gnbarequest_parse()</function>
-except it yields a
-<type>lwres_gnbaresponse_t</type>
-structure.
-</para>
-<para>
-<function>lwres_gnbaresponse_free()</function>
-and
-<function>lwres_gnbarequest_free()</function>
-release the memory in resolver context
-<varname>ctx</varname>
-that was allocated to the
-<type>lwres_gnbaresponse_t</type>
-or
-<type>lwres_gnbarequest_t</type>
-structures referenced via
-<varname>structp</varname>.
-Any memory associated with ancillary buffers and strings for those
-structures is also discarded.
-</para>
-</refsect1>
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-The getnamebyaddr opcode functions
-<function>lwres_gnbarequest_render()</function>,
-<function>lwres_gnbaresponse_render()</function>
-<function>lwres_gnbarequest_parse()</function>
-and
-<function>lwres_gnbaresponse_parse()</function>
-all return
-<errorcode>LWRES_R_SUCCESS</errorcode>
-on success.
-They return
-<errorcode>LWRES_R_NOMEMORY</errorcode>
-if memory allocation fails.
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-is returned if the available space in the buffer
-<varname>b</varname>
-is too small to accommodate the packet header or the
-<type>lwres_gnbarequest_t</type>
-and
-<type>lwres_gnbaresponse_t</type>
-structures.
-<function>lwres_gnbarequest_parse()</function>
-and
-<function>lwres_gnbaresponse_parse()</function>
-will return
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-if the buffer is not empty after decoding the received packet.
-These functions will return
-<errorcode>LWRES_R_FAILURE</errorcode>
-if
-<structfield>pktflags</structfield>
-in the packet header structure
-<type>lwres_lwpacket_t</type>
-indicate that the packet is not a response to an earlier query.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres_packet</refentrytitle>
-<manvolnum>3</manvolnum>
-</citerefentry>.
-</para>
-</refsect1>
-</refentry>
+    </para>
+
+    <para><function>lwres_gnbarequest_render()</function>
+      uses resolver context <varname>ctx</varname> to convert
+      getnamebyaddr request structure <varname>req</varname> to
+      canonical format.  The packet header structure
+      <varname>pkt</varname> is initialised and transferred to buffer
+      <varname>b</varname>.  The contents of <varname>*req</varname>
+      are then appended to the buffer in canonical format.
+      <function>lwres_gnbaresponse_render()</function> performs the
+      same task, except it converts a getnamebyaddr response structure
+      <type>lwres_gnbaresponse_t</type> to the lightweight resolver's
+      canonical format.
+    </para>
+
+    <para><function>lwres_gnbarequest_parse()</function>
+      uses context <varname>ctx</varname> to convert the contents of
+      packet <varname>pkt</varname> to a
+      <type>lwres_gnbarequest_t</type> structure.  Buffer
+      <varname>b</varname> provides space to be used for storing this
+      structure.  When the function succeeds, the resulting
+      <type>lwres_gnbarequest_t</type> is made available through
+      <varname>*structp</varname>.
+      <function>lwres_gnbaresponse_parse()</function> offers the same
+      semantics as <function>lwres_gnbarequest_parse()</function>
+      except it yields a <type>lwres_gnbaresponse_t</type> structure.
+    </para>
+
+    <para><function>lwres_gnbaresponse_free()</function>
+      and <function>lwres_gnbarequest_free()</function> release the
+      memory in resolver context <varname>ctx</varname> that was
+      allocated to the <type>lwres_gnbaresponse_t</type> or
+      <type>lwres_gnbarequest_t</type> structures referenced via
+      <varname>structp</varname>.  Any memory associated with
+      ancillary buffers and strings for those structures is also
+      discarded.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      The getnamebyaddr opcode functions
+      <function>lwres_gnbarequest_render()</function>,
+      <function>lwres_gnbaresponse_render()</function>
+      <function>lwres_gnbarequest_parse()</function>
+      and
+      <function>lwres_gnbaresponse_parse()</function>
+      all return
+      <errorcode>LWRES_R_SUCCESS</errorcode>
+      on success.
+      They return
+      <errorcode>LWRES_R_NOMEMORY</errorcode>
+      if memory allocation fails.
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      is returned if the available space in the buffer
+      <varname>b</varname>
+      is too small to accommodate the packet header or the
+      <type>lwres_gnbarequest_t</type>
+      and
+      <type>lwres_gnbaresponse_t</type>
+      structures.
+      <function>lwres_gnbarequest_parse()</function>
+      and
+      <function>lwres_gnbaresponse_parse()</function>
+      will return
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      if the buffer is not empty after decoding the received packet.
+      These functions will return
+      <errorcode>LWRES_R_FAILURE</errorcode>
+      if
+      <structfield>pktflags</structfield>
+      in the packet header structure
+      <type>lwres_lwpacket_t</type>
+      indicate that the packet is not a response to an earlier query.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres_packet</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_gnba.html b/contrib/bind9/lib/lwres/man/lwres_gnba.html
index 4d07580..aac60c6 100644
--- a/contrib/bind9/lib/lwres/man/lwres_gnba.html
+++ b/contrib/bind9/lib/lwres/man/lwres_gnba.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_gnba.html,v 1.6.2.1.4.11 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_gnba.html,v 1.7.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_gnba</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_gnbarequest_render, lwres_gnbaresponse_render, lwres_gnbarequest_parse, lwres_gnbaresponse_parse, lwres_gnbaresponse_free, lwres_gnbarequest_free &#8212; lightweight resolver getnamebyaddress message handling</p>
@@ -39,31 +39,25 @@
 lwres_result_t
 <b class="fsfunc">lwres_gnbarequest_render</b>
 (</code></td>
-<td> </td>
-<td>
-<var class="pdparam">ctx</var>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
+<td>lwres_context_t * </td>
 <td>
 <var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gnbarequest_t * </td>
 <td>
 <var class="pdparam">req</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_lwpacket_t * </td>
 <td>
 <var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
 <var class="pdparam">b</var><code>)</code>;</td>
 </tr>
@@ -74,29 +68,27 @@ lwres_result_t
 lwres_result_t
 <b class="fsfunc">lwres_gnbaresponse_render</b>
 (</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_gnbaresponse_t * </td>
+<td>
+<var class="pdparam">req</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">b</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -104,29 +96,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_gnbarequest_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gnbarequest_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -134,29 +124,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_gnbaresponse_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gnbaresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -165,19 +153,15 @@ lwres_result_t
 void
 <b class="fsfunc">lwres_gnbaresponse_free</b>
 (</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gnbaresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
@@ -185,56 +169,59 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_gnbarequest_free</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gnbarequest_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549540"></a><h2>DESCRIPTION</h2>
+<a name="id2543525"></a><h2>DESCRIPTION</h2>
 <p>
-These are low-level routines for creating and parsing
-lightweight resolver address-to-name lookup request and 
-response messages.
-</p>
+      These are low-level routines for creating and parsing
+      lightweight resolver address-to-name lookup request and
+      response messages.
+    </p>
 <p>
-There are four main functions for the getnamebyaddr opcode.
-One render function converts a getnamebyaddr request structure &#8212;
-<span class="type">lwres_gnbarequest_t</span> &#8212;
-to the lightweight resolver's canonical format.
-It is complemented by a parse function that converts a packet in this
-canonical format to a getnamebyaddr request structure.
-Another render function converts the getnamebyaddr response structure &#8212;
-<span class="type">lwres_gnbaresponse_t</span>
-to the canonical format.
-This is complemented by a parse function which converts a packet in
-canonical format to a getnamebyaddr response structure.
-</p>
+      There are four main functions for the getnamebyaddr opcode.
+      One render function converts a getnamebyaddr request structure &#8212;
+      <span class="type">lwres_gnbarequest_t</span> &#8212;
+      to the lightweight resolver's canonical format.
+      It is complemented by a parse function that converts a packet in this
+      canonical format to a getnamebyaddr request structure.
+      Another render function converts the getnamebyaddr response structure
+      &#8212;
+      <span class="type">lwres_gnbaresponse_t</span>
+      to the canonical format.
+      This is complemented by a parse function which converts a packet in
+      canonical format to a getnamebyaddr response structure.
+    </p>
 <p>
-These structures are defined in
-<code class="filename">lwres/lwres.h</code>.
-They are shown below.
-</p>
+      These structures are defined in
+      <code class="filename">lwres/lwres.h</code>.
+      They are shown below.
+    </p>
 <pre class="programlisting">
 #define LWRES_OPCODE_GETNAMEBYADDR      0x00010002U
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 typedef struct {
         lwres_uint32_t  flags;
         lwres_addr_t    addr;
 } lwres_gnbarequest_t;
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 typedef struct {
         lwres_uint32_t  flags;
         lwres_uint16_t  naliases;
@@ -247,109 +234,83 @@ typedef struct {
 } lwres_gnbaresponse_t;
 </pre>
 <p>
-</p>
-<p>
-<code class="function">lwres_gnbarequest_render()</code>
-uses resolver context
-<code class="varname">ctx</code>
-to convert getnamebyaddr request structure
-<code class="varname">req</code>
-to canonical format.
-The packet header structure
-<code class="varname">pkt</code>
-is initialised and transferred to
-buffer
-<code class="varname">b</code>.
-The contents of
-<code class="varname">*req</code>
-are then appended to the buffer in canonical format.
-<code class="function">lwres_gnbaresponse_render()</code>
-performs the same task, except it converts a getnamebyaddr response structure
-<span class="type">lwres_gnbaresponse_t</span>
-to the lightweight resolver's canonical format.
-</p>
-<p>
-<code class="function">lwres_gnbarequest_parse()</code>
-uses context
-<code class="varname">ctx</code>
-to convert the contents of packet
-<code class="varname">pkt</code>
-to a
-<span class="type">lwres_gnbarequest_t</span>
-structure.
-Buffer
-<code class="varname">b</code>
-provides space to be used for storing this structure.
-When the function succeeds, the resulting
-<span class="type">lwres_gnbarequest_t</span>
-is made available through
-<code class="varname">*structp</code>.
-<code class="function">lwres_gnbaresponse_parse()</code>
-offers the same semantics as
-<code class="function">lwres_gnbarequest_parse()</code>
-except it yields a
-<span class="type">lwres_gnbaresponse_t</span>
-structure.
-</p>
-<p>
-<code class="function">lwres_gnbaresponse_free()</code>
-and
-<code class="function">lwres_gnbarequest_free()</code>
-release the memory in resolver context
-<code class="varname">ctx</code>
-that was allocated to the
-<span class="type">lwres_gnbaresponse_t</span>
-or
-<span class="type">lwres_gnbarequest_t</span>
-structures referenced via
-<code class="varname">structp</code>.
-Any memory associated with ancillary buffers and strings for those
-structures is also discarded.
-</p>
+    </p>
+<p><code class="function">lwres_gnbarequest_render()</code>
+      uses resolver context <code class="varname">ctx</code> to convert
+      getnamebyaddr request structure <code class="varname">req</code> to
+      canonical format.  The packet header structure
+      <code class="varname">pkt</code> is initialised and transferred to buffer
+      <code class="varname">b</code>.  The contents of <code class="varname">*req</code>
+      are then appended to the buffer in canonical format.
+      <code class="function">lwres_gnbaresponse_render()</code> performs the
+      same task, except it converts a getnamebyaddr response structure
+      <span class="type">lwres_gnbaresponse_t</span> to the lightweight resolver's
+      canonical format.
+    </p>
+<p><code class="function">lwres_gnbarequest_parse()</code>
+      uses context <code class="varname">ctx</code> to convert the contents of
+      packet <code class="varname">pkt</code> to a
+      <span class="type">lwres_gnbarequest_t</span> structure.  Buffer
+      <code class="varname">b</code> provides space to be used for storing this
+      structure.  When the function succeeds, the resulting
+      <span class="type">lwres_gnbarequest_t</span> is made available through
+      <code class="varname">*structp</code>.
+      <code class="function">lwres_gnbaresponse_parse()</code> offers the same
+      semantics as <code class="function">lwres_gnbarequest_parse()</code>
+      except it yields a <span class="type">lwres_gnbaresponse_t</span> structure.
+    </p>
+<p><code class="function">lwres_gnbaresponse_free()</code>
+      and <code class="function">lwres_gnbarequest_free()</code> release the
+      memory in resolver context <code class="varname">ctx</code> that was
+      allocated to the <span class="type">lwres_gnbaresponse_t</span> or
+      <span class="type">lwres_gnbarequest_t</span> structures referenced via
+      <code class="varname">structp</code>.  Any memory associated with
+      ancillary buffers and strings for those structures is also
+      discarded.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549733"></a><h2>RETURN VALUES</h2>
+<a name="id2543665"></a><h2>RETURN VALUES</h2>
 <p>
-The getnamebyaddr opcode functions
-<code class="function">lwres_gnbarequest_render()</code>,
-<code class="function">lwres_gnbaresponse_render()</code>
-<code class="function">lwres_gnbarequest_parse()</code>
-and
-<code class="function">lwres_gnbaresponse_parse()</code>
-all return
-<span class="errorcode">LWRES_R_SUCCESS</span>
-on success.
-They return
-<span class="errorcode">LWRES_R_NOMEMORY</span>
-if memory allocation fails.
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-is returned if the available space in the buffer
-<code class="varname">b</code>
-is too small to accommodate the packet header or the
-<span class="type">lwres_gnbarequest_t</span>
-and
-<span class="type">lwres_gnbaresponse_t</span>
-structures.
-<code class="function">lwres_gnbarequest_parse()</code>
-and
-<code class="function">lwres_gnbaresponse_parse()</code>
-will return
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-if the buffer is not empty after decoding the received packet.
-These functions will return
-<span class="errorcode">LWRES_R_FAILURE</span>
-if
-<em class="structfield"><code>pktflags</code></em>
-in the packet header structure
-<span class="type">lwres_lwpacket_t</span>
-indicate that the packet is not a response to an earlier query.
-</p>
+      The getnamebyaddr opcode functions
+      <code class="function">lwres_gnbarequest_render()</code>,
+      <code class="function">lwres_gnbaresponse_render()</code>
+      <code class="function">lwres_gnbarequest_parse()</code>
+      and
+      <code class="function">lwres_gnbaresponse_parse()</code>
+      all return
+      <span class="errorcode">LWRES_R_SUCCESS</span>
+      on success.
+      They return
+      <span class="errorcode">LWRES_R_NOMEMORY</span>
+      if memory allocation fails.
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      is returned if the available space in the buffer
+      <code class="varname">b</code>
+      is too small to accommodate the packet header or the
+      <span class="type">lwres_gnbarequest_t</span>
+      and
+      <span class="type">lwres_gnbaresponse_t</span>
+      structures.
+      <code class="function">lwres_gnbarequest_parse()</code>
+      and
+      <code class="function">lwres_gnbaresponse_parse()</code>
+      will return
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      if the buffer is not empty after decoding the received packet.
+      These functions will return
+      <span class="errorcode">LWRES_R_FAILURE</span>
+      if
+      <em class="structfield"><code>pktflags</code></em>
+      in the packet header structure
+      <span class="type">lwres_lwpacket_t</span>
+      indicate that the packet is not a response to an earlier query.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549866"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3)</span>.
-</p>
+<a name="id2543731"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_hstrerror.3 b/contrib/bind9/lib/lwres/man/lwres_hstrerror.3
index d6fc8f5..6fa744e 100644
--- a/contrib/bind9/lib/lwres/man/lwres_hstrerror.3
+++ b/contrib/bind9/lib/lwres/man/lwres_hstrerror.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_hstrerror.3,v 1.13.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_hstrerror.3,v 1.16.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_hstrerror
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,9 +36,9 @@ lwres_herror, lwres_hstrerror \- lightweight resolver error message generation
 #include <lwres/netdb.h>
 .fi
 .HP 18
-.BI "void lwres_herror(const\ char\ *s);"
+.BI "void lwres_herror(const\ char\ *" "s" ");"
 .HP 29
-.BI "const char * lwres_hstrerror(int\ err);"
+.BI "const char * lwres_hstrerror(int\ " "err" ");"
 .SH "DESCRIPTION"
 .PP
 \fBlwres_herror()\fR
@@ -54,21 +54,31 @@ for the error code stored in the global variable
 \fBlwres_hstrerror()\fR
 returns an appropriate string for the error code gievn by
 \fIerr\fR. The values of the error codes and messages are as follows:
-.TP 3n
+.PP
 \fBNETDB_SUCCESS\fR
+.RS 4
 Resolver Error 0 (no error)
-.TP 3n
+.RE
+.PP
 \fBHOST_NOT_FOUND\fR
+.RS 4
 Unknown host
-.TP 3n
+.RE
+.PP
 \fBTRY_AGAIN\fR
+.RS 4
 Host name lookup failure
-.TP 3n
+.RE
+.PP
 \fBNO_RECOVERY\fR
+.RS 4
 Unknown server error
-.TP 3n
+.RE
+.PP
 \fBNO_DATA\fR
+.RS 4
 No address associated with name
+.RE
 .SH "RETURN VALUES"
 .PP
 The string
@@ -83,4 +93,7 @@ is not a valid error code.
 \fBherror\fR(3),
 \fBlwres_hstrerror\fR(3).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook b/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook
index a36c072..8150e8c 100644
--- a/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_hstrerror.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_hstrerror.docbook,v 1.4.206.3 2005/05/12 21:36:15 sra Exp $ -->
-
+<!-- $Id: lwres_hstrerror.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_hstrerror</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_hstrerror</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,95 +45,108 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_herror</refname>
-<refname>lwres_hstrerror</refname>
-<refpurpose>lightweight resolver error message generation</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_herror</refname>
+    <refname>lwres_hstrerror</refname>
+    <refpurpose>lightweight resolver error message generation</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/netdb.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_herror</function></funcdef>
-<paramdef>const char *s</paramdef>
-</funcprototype>
+        <paramdef>const char *<parameter>s</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 const char *
 <function>lwres_hstrerror</function></funcdef>
-<paramdef>int err</paramdef>
-</funcprototype>
+        <paramdef>int <parameter>err</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
-<title>DESCRIPTION</title>
+  <refsect1>
+    <title>DESCRIPTION</title>
 
-<para>
-<function>lwres_herror()</function> prints the string
-<parameter>s</parameter> on <type>stderr</type> followed by the string
-generated by <function>lwres_hstrerror()</function> for the error code
-stored in the global variable <constant>lwres_h_errno</constant>.
-</para>
+    <para><function>lwres_herror()</function>
+      prints the string <parameter>s</parameter> on
+      <type>stderr</type> followed by the string generated by
+      <function>lwres_hstrerror()</function> for the error code stored
+      in the global variable <constant>lwres_h_errno</constant>.
+    </para>
 
-<para>
-<function>lwres_hstrerror()</function> returns an appropriate string
-for the error code gievn by <parameter>err</parameter>.  The values of
-the error codes and messages are as follows:
+    <para><function>lwres_hstrerror()</function>
+      returns an appropriate string for the error code gievn by
+      <parameter>err</parameter>.  The values of the error codes and
+      messages are as follows:
 
-<variablelist>
-<varlistentry><term><errorcode>NETDB_SUCCESS</errorcode></term>
-<listitem>
-<para>
-<errorname>Resolver Error 0 (no error)</errorname>
-</para></listitem></varlistentry>
-<varlistentry><term><errorcode>HOST_NOT_FOUND</errorcode></term>
-<listitem>
-<para>
-<errorname>Unknown host</errorname>
-</para></listitem></varlistentry>
-<varlistentry><term><errorcode>TRY_AGAIN</errorcode></term>
-<listitem>
-<para>
-<errorname>Host name lookup failure</errorname>
-</para></listitem></varlistentry>
-<varlistentry><term><errorcode>NO_RECOVERY</errorcode></term>
-<listitem>
-<para>
-<errorname>Unknown server error</errorname>
-</para></listitem></varlistentry>
-<varlistentry><term><errorcode>NO_DATA</errorcode></term>
-<listitem>
-<para>
-<errorname>No address associated with name</errorname>
-</para></listitem></varlistentry>
-</variablelist>
-</para>
-</refsect1>
+      <variablelist>
+        <varlistentry>
+          <term><errorcode>NETDB_SUCCESS</errorcode></term>
+          <listitem>
+            <para><errorname>Resolver Error 0 (no error)</errorname>
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>HOST_NOT_FOUND</errorcode></term>
+          <listitem>
+            <para><errorname>Unknown host</errorname>
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>TRY_AGAIN</errorcode></term>
+          <listitem>
+            <para><errorname>Host name lookup failure</errorname>
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>NO_RECOVERY</errorcode></term>
+          <listitem>
+            <para><errorname>Unknown server error</errorname>
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><errorcode>NO_DATA</errorcode></term>
+          <listitem>
+            <para><errorname>No address associated with name</errorname>
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
+  </refsect1>
 
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-The string <errorname>Unknown resolver error</errorname> is returned by
-<function>lwres_hstrerror()</function>
-when the value of
-<constant>lwres_h_errno</constant>
-is not a valid error code.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>herror</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      The string <errorname>Unknown resolver error</errorname> is returned by
+      <function>lwres_hstrerror()</function>
+      when the value of
+      <constant>lwres_h_errno</constant>
+      is not a valid error code.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>herror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
 
-<citerefentry>
-<refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
-</para>
+      <citerefentry>
+        <refentrytitle>lwres_hstrerror</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
 
-</refsect1>
-</refentry>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_hstrerror.html b/contrib/bind9/lib/lwres/man/lwres_hstrerror.html
index d2f1e4a..b52ff06 100644
--- a/contrib/bind9/lib/lwres/man/lwres_hstrerror.html
+++ b/contrib/bind9/lib/lwres/man/lwres_hstrerror.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_hstrerror.html,v 1.5.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_hstrerror.html,v 1.6.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_hstrerror</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_herror, lwres_hstrerror &#8212; lightweight resolver error message generation</p>
@@ -31,70 +31,74 @@
 <h2>Synopsis</h2>
 <div class="funcsynopsis">
 <pre class="funcsynopsisinfo">#include &lt;lwres/netdb.h&gt;</pre>
-<p><code class="funcdef">
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em"><tr>
+<td><code class="funcdef">
 void
-<b class="fsfunc">lwres_herror</b>(</code>const char *s<code>)</code>;</p>
-<p><code class="funcdef">
+<b class="fsfunc">lwres_herror</b>(</code></td>
+<td>const char * </td>
+<td>
+<var class="pdparam">s</var><code>)</code>;</td>
+</tr></table>
+<table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0"><tr>
+<td><code class="funcdef">
 const char *
-<b class="fsfunc">lwres_hstrerror</b>(</code>int err<code>)</code>;</p>
+<b class="fsfunc">lwres_hstrerror</b>(</code></td>
+<td>int  </td>
+<td>
+<var class="pdparam">err</var><code>)</code>;</td>
+</tr></table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549424"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_herror()</code> prints the string
-<em class="parameter"><code>s</code></em> on <span class="type">stderr</span> followed by the string
-generated by <code class="function">lwres_hstrerror()</code> for the error code
-stored in the global variable <code class="constant">lwres_h_errno</code>.
-</p>
-<p>
-<code class="function">lwres_hstrerror()</code> returns an appropriate string
-for the error code gievn by <em class="parameter"><code>err</code></em>.  The values of
-the error codes and messages are as follows:
+<a name="id2543379"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_herror()</code>
+      prints the string <em class="parameter"><code>s</code></em> on
+      <span class="type">stderr</span> followed by the string generated by
+      <code class="function">lwres_hstrerror()</code> for the error code stored
+      in the global variable <code class="constant">lwres_h_errno</code>.
+    </p>
+<p><code class="function">lwres_hstrerror()</code>
+      returns an appropriate string for the error code gievn by
+      <em class="parameter"><code>err</code></em>.  The values of the error codes and
+      messages are as follows:
 
-</p>
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><span class="errorcode">NETDB_SUCCESS</span></span></dt>
-<dd><p>
-<span class="errorname">Resolver Error 0 (no error)</span>
-</p></dd>
+<dd><p><span class="errorname">Resolver Error 0 (no error)</span>
+            </p></dd>
 <dt><span class="term"><span class="errorcode">HOST_NOT_FOUND</span></span></dt>
-<dd><p>
-<span class="errorname">Unknown host</span>
-</p></dd>
+<dd><p><span class="errorname">Unknown host</span>
+            </p></dd>
 <dt><span class="term"><span class="errorcode">TRY_AGAIN</span></span></dt>
-<dd><p>
-<span class="errorname">Host name lookup failure</span>
-</p></dd>
+<dd><p><span class="errorname">Host name lookup failure</span>
+            </p></dd>
 <dt><span class="term"><span class="errorcode">NO_RECOVERY</span></span></dt>
-<dd><p>
-<span class="errorname">Unknown server error</span>
-</p></dd>
+<dd><p><span class="errorname">Unknown server error</span>
+            </p></dd>
 <dt><span class="term"><span class="errorcode">NO_DATA</span></span></dt>
-<dd><p>
-<span class="errorname">No address associated with name</span>
-</p></dd>
+<dd><p><span class="errorname">No address associated with name</span>
+            </p></dd>
 </dl></div>
 <p>
-</p>
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549536"></a><h2>RETURN VALUES</h2>
+<a name="id2543497"></a><h2>RETURN VALUES</h2>
 <p>
-The string <span class="errorname">Unknown resolver error</span> is returned by
-<code class="function">lwres_hstrerror()</code>
-when the value of
-<code class="constant">lwres_h_errno</code>
-is not a valid error code.
-</p>
+      The string <span class="errorname">Unknown resolver error</span> is returned by
+      <code class="function">lwres_hstrerror()</code>
+      when the value of
+      <code class="constant">lwres_h_errno</code>
+      is not a valid error code.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549555"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">herror</span>(3)</span>,
+<a name="id2543517"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">herror</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>.
-</p>
+      <span class="citerefentry"><span class="refentrytitle">lwres_hstrerror</span>(3)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_inetntop.3 b/contrib/bind9/lib/lwres/man/lwres_inetntop.3
index 6395e60..4cb09f8 100644
--- a/contrib/bind9/lib/lwres/man/lwres_inetntop.3
+++ b/contrib/bind9/lib/lwres/man/lwres_inetntop.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_inetntop.3,v 1.12.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_inetntop.3,v 1.15.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_inetntop
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,7 +36,7 @@ lwres_net_ntop \- lightweight resolver IP address presentation
 #include <lwres/net.h>
 .fi
 .HP 28
-.BI "const char * lwres_net_ntop(int\ af, const\ void\ *src, char\ *dst, size_t\ size);"
+.BI "const char * lwres_net_ntop(int\ " "af" ", const\ void\ *" "src" ", char\ *" "dst" ", size_t\ " "size" ");"
 .SH "DESCRIPTION"
 .PP
 \fBlwres_net_ntop()\fR
@@ -71,4 +71,7 @@ is not supported.
 \fBinet_ntop\fR(3),
 \fBerrno\fR(3).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook b/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook
index 651ef04..7b80fe4 100644
--- a/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_inetntop.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_inetntop.docbook,v 1.3.206.3 2005/05/12 21:36:15 sra Exp $ -->
-
+<!-- $Id: lwres_inetntop.docbook,v 1.4.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_inetntop</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_inetntop</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,70 +45,76 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_net_ntop</refname>
-<refpurpose>lightweight resolver IP address presentation</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_net_ntop</refname>
+    <refpurpose>lightweight resolver IP address presentation</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/net.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 const char *
 <function>lwres_net_ntop</function></funcdef>
-<paramdef>int af</paramdef>
-<paramdef>const void *src</paramdef>
-<paramdef>char *dst</paramdef>
-<paramdef>size_t size</paramdef>
-</funcprototype>
+        <paramdef>int <parameter>af</parameter></paramdef>
+        <paramdef>const void *<parameter>src</parameter></paramdef>
+        <paramdef>char *<parameter>dst</parameter></paramdef>
+        <paramdef>size_t <parameter>size</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
+  </refsynopsisdiv>
 
-<refsect1>
-<title>DESCRIPTION</title>
+  <refsect1>
+    <title>DESCRIPTION</title>
 
-<para>
-<function>lwres_net_ntop()</function> converts an IP address of
-protocol family <parameter>af</parameter> &mdash; IPv4 or IPv6 &mdash;
-at location <parameter>src</parameter> from network format to its
-conventional representation as a string.  For IPv4 addresses, that
-string would be a dotted-decimal.  An IPv6 address would be
-represented in colon notation as described in RFC1884.
-</para>
+    <para><function>lwres_net_ntop()</function>
+      converts an IP address of protocol family
+      <parameter>af</parameter> &mdash; IPv4 or IPv6 &mdash; at
+      location <parameter>src</parameter> from network format to its
+      conventional representation as a string.  For IPv4 addresses,
+      that string would be a dotted-decimal.  An IPv6 address would be
+      represented in colon notation as described in RFC1884.
+    </para>
 
-<para>
-The generated string is copied to <parameter>dst</parameter> provided
-<parameter>size</parameter> indicates it is long enough to store the
-ASCII representation of the address.
-</para>
+    <para>
+      The generated string is copied to <parameter>dst</parameter>
+      provided
+      <parameter>size</parameter> indicates it is long enough to
+      store the
+      ASCII representation of the address.
+    </para>
 
-</refsect1>
-<refsect1>
-<title>RETURN VALUES</title>
+  </refsect1>
+  <refsect1>
+    <title>RETURN VALUES</title>
 
-<para>
-If successful, the function returns <parameter>dst</parameter>:
-a pointer to a string containing the presentation format of the
-address.  <function>lwres_net_ntop()</function> returns
-<type>NULL</type> and sets the global variable
-<constant>errno</constant> to <errorcode>EAFNOSUPPORT</errorcode> if
-the protocol family given in <parameter>af</parameter> is not
-supported.
-</para>
+    <para>
+      If successful, the function returns <parameter>dst</parameter>:
+      a pointer to a string containing the presentation format of the
+      address.  <function>lwres_net_ntop()</function> returns
+      <type>NULL</type> and sets the global variable
+      <constant>errno</constant> to <errorcode>EAFNOSUPPORT</errorcode> if
+      the protocol family given in <parameter>af</parameter> is
+      not
+      supported.
+    </para>
 
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>RFC1884</refentrytitle>
-</citerefentry>,
-<citerefentry>
-<refentrytitle>inet_ntop</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-<citerefentry>
-<refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
-</para>
-</refsect1>
-</refentry>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>RFC1884</refentrytitle>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>inet_ntop</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+      <citerefentry>
+        <refentrytitle>errno</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_inetntop.html b/contrib/bind9/lib/lwres/man/lwres_inetntop.html
index ca5c0bd..532d500 100644
--- a/contrib/bind9/lib/lwres/man/lwres_inetntop.html
+++ b/contrib/bind9/lib/lwres/man/lwres_inetntop.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_inetntop.html,v 1.5.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_inetntop.html,v 1.6.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_inetntop</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_net_ntop &#8212; lightweight resolver IP address presentation</p>
@@ -36,68 +36,68 @@
 <td><code class="funcdef">
 const char *
 <b class="fsfunc">lwres_net_ntop</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>int  </td>
+<td>
+<var class="pdparam">af</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>const void * </td>
+<td>
+<var class="pdparam">src</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>char * </td>
+<td>
+<var class="pdparam">dst</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>size_t  </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">size</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549419"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_net_ntop()</code> converts an IP address of
-protocol family <em class="parameter"><code>af</code></em> &#8212; IPv4 or IPv6 &#8212;
-at location <em class="parameter"><code>src</code></em> from network format to its
-conventional representation as a string.  For IPv4 addresses, that
-string would be a dotted-decimal.  An IPv6 address would be
-represented in colon notation as described in RFC1884.
-</p>
+<a name="id2543379"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_net_ntop()</code>
+      converts an IP address of protocol family
+      <em class="parameter"><code>af</code></em> &#8212; IPv4 or IPv6 &#8212; at
+      location <em class="parameter"><code>src</code></em> from network format to its
+      conventional representation as a string.  For IPv4 addresses,
+      that string would be a dotted-decimal.  An IPv6 address would be
+      represented in colon notation as described in RFC1884.
+    </p>
 <p>
-The generated string is copied to <em class="parameter"><code>dst</code></em> provided
-<em class="parameter"><code>size</code></em> indicates it is long enough to store the
-ASCII representation of the address.
-</p>
+      The generated string is copied to <em class="parameter"><code>dst</code></em>
+      provided
+      <em class="parameter"><code>size</code></em> indicates it is long enough to
+      store the
+      ASCII representation of the address.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549452"></a><h2>RETURN VALUES</h2>
+<a name="id2543411"></a><h2>RETURN VALUES</h2>
 <p>
-If successful, the function returns <em class="parameter"><code>dst</code></em>:
-a pointer to a string containing the presentation format of the
-address.  <code class="function">lwres_net_ntop()</code> returns
-<span class="type">NULL</span> and sets the global variable
-<code class="constant">errno</code> to <span class="errorcode">EAFNOSUPPORT</span> if
-the protocol family given in <em class="parameter"><code>af</code></em> is not
-supported.
-</p>
+      If successful, the function returns <em class="parameter"><code>dst</code></em>:
+      a pointer to a string containing the presentation format of the
+      address.  <code class="function">lwres_net_ntop()</code> returns
+      <span class="type">NULL</span> and sets the global variable
+      <code class="constant">errno</code> to <span class="errorcode">EAFNOSUPPORT</span> if
+      the protocol family given in <em class="parameter"><code>af</code></em> is
+      not
+      supported.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549483"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">RFC1884</span></span>,
-<span class="citerefentry"><span class="refentrytitle">inet_ntop</span>(3)</span>,
-<span class="citerefentry"><span class="refentrytitle">errno</span>(3)</span>.
-</p>
+<a name="id2543444"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">RFC1884</span></span>,
+      <span class="citerefentry"><span class="refentrytitle">inet_ntop</span>(3)</span>,
+      <span class="citerefentry"><span class="refentrytitle">errno</span>(3)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_noop.3 b/contrib/bind9/lib/lwres/man/lwres_noop.3
index e32c2f8..7884109 100644
--- a/contrib/bind9/lib/lwres/man/lwres_noop.3
+++ b/contrib/bind9/lib/lwres/man/lwres_noop.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_noop.3,v 1.14.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_noop.3,v 1.17.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_noop
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,17 +36,17 @@ lwres_nooprequest_render, lwres_noopresponse_render, lwres_nooprequest_parse, lw
 #include <lwres/lwres.h>
 .fi
 .HP 40
-.BI "lwres_result_t lwres_nooprequest_render(lwres_context_t\ *ctx, lwres_nooprequest_t\ *req, lwres_lwpacket_t\ *pkt, lwres_buffer_t\ *b);"
+.BI "lwres_result_t lwres_nooprequest_render(lwres_context_t\ *" "ctx" ", lwres_nooprequest_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");"
 .HP 41
-.BI "lwres_result_t lwres_noopresponse_render(lwres_context_t\ *ctx, lwres_noopresponse_t\ *req, lwres_lwpacket_t\ *pkt, lwres_buffer_t\ *b);"
+.BI "lwres_result_t lwres_noopresponse_render(lwres_context_t\ *" "ctx" ", lwres_noopresponse_t\ *" "req" ", lwres_lwpacket_t\ *" "pkt" ", lwres_buffer_t\ *" "b" ");"
 .HP 39
-.BI "lwres_result_t lwres_nooprequest_parse(lwres_context_t\ *ctx, lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt, lwres_nooprequest_t\ **structp);"
+.BI "lwres_result_t lwres_nooprequest_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_nooprequest_t\ **" "structp" ");"
 .HP 40
-.BI "lwres_result_t lwres_noopresponse_parse(lwres_context_t\ *ctx, lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt, lwres_noopresponse_t\ **structp);"
+.BI "lwres_result_t lwres_noopresponse_parse(lwres_context_t\ *" "ctx" ", lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ", lwres_noopresponse_t\ **" "structp" ");"
 .HP 29
-.BI "void lwres_noopresponse_free(lwres_context_t\ *ctx, lwres_noopresponse_t\ **structp);"
+.BI "void lwres_noopresponse_free(lwres_context_t\ *" "ctx" ", lwres_noopresponse_t\ **" "structp" ");"
 .HP 28
-.BI "void lwres_nooprequest_free(lwres_context_t\ *ctx, lwres_nooprequest_t\ **structp);"
+.BI "void lwres_nooprequest_free(lwres_context_t\ *" "ctx" ", lwres_nooprequest_t\ **" "structp" ");"
 .SH "DESCRIPTION"
 .PP
 These are low\-level routines for creating and parsing lightweight resolver no\-op request and response messages.
@@ -63,14 +63,26 @@ to the canonical format. This is complemented by a parse function which converts
 .PP
 These structures are defined in
 \fIlwres/lwres.h\fR. They are shown below.
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 #define LWRES_OPCODE_NOOP       0x00000000U
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 typedef struct {
         lwres_uint16_t  datalength;
         unsigned char   *data;
 } lwres_nooprequest_t;
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 typedef struct {
         lwres_uint16_t  datalength;
         unsigned char   *data;
@@ -78,6 +90,7 @@ typedef struct {
 .fi
 .RE
 .sp
+.PP
 Although the structures have different types, they are identical. This is because the no\-op opcode simply echos whatever data was sent: the response is therefore identical to the request.
 .PP
 \fBlwres_nooprequest_render()\fR
@@ -162,6 +175,9 @@ in the packet header structure
 indicate that the packet is not a response to an earlier query.
 .SH "SEE ALSO"
 .PP
-\fBlwres_packet\fR(3 )
+\fBlwres_packet\fR(3)
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_noop.docbook b/contrib/bind9/lib/lwres/man/lwres_noop.docbook
index fcb3c59..cef6d87 100644
--- a/contrib/bind9/lib/lwres/man/lwres_noop.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_noop.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_noop.docbook,v 1.4.206.3 2005/05/12 21:36:16 sra Exp $ -->
-
+<!-- $Id: lwres_noop.docbook,v 1.5.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_noop</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_noop</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,200 +45,211 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_nooprequest_render</refname>
-<refname>lwres_noopresponse_render</refname>
-<refname>lwres_nooprequest_parse</refname>
-<refname>lwres_noopresponse_parse</refname>
-<refname>lwres_noopresponse_free</refname>
-<refname>lwres_nooprequest_free</refname>
-<refpurpose>lightweight resolver no-op message handling</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_nooprequest_render</refname>
+    <refname>lwres_noopresponse_render</refname>
+    <refname>lwres_nooprequest_parse</refname>
+    <refname>lwres_noopresponse_parse</refname>
+    <refname>lwres_noopresponse_free</refname>
+    <refname>lwres_nooprequest_free</refname>
+    <refpurpose>lightweight resolver no-op message handling</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>
 #include &lt;lwres/lwres.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_nooprequest_render</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_nooprequest_t *req</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_nooprequest_t *<parameter>req</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_noopresponse_render</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_noopresponse_t *req</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_noopresponse_t *<parameter>req</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_nooprequest_parse</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_nooprequest_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_nooprequest_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_noopresponse_parse</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-<paramdef>lwres_noopresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        <paramdef>lwres_noopresponse_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_noopresponse_free</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_noopresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_noopresponse_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 void
 <function>lwres_nooprequest_free</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_nooprequest_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_nooprequest_t **<parameter>structp</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-These are low-level routines for creating and parsing
-lightweight resolver no-op request and response messages.
-</para>
-<para>
-The no-op message is analogous to a <command>ping</command> packet: 
-a packet is sent to the resolver daemon and is simply echoed back.
-The opcode is intended to allow a client to determine if the server is
-operational or not.
-</para>
-<para>
-There are four main functions for the no-op opcode.
-One render function converts a no-op request structure &mdash;
-<type>lwres_nooprequest_t</type> &mdash;
-to the lighweight resolver's canonical format.
-It is complemented by a parse function that converts a packet in this
-canonical format to a no-op request structure.
-Another render function converts the no-op response structure &mdash;
-<type>lwres_noopresponse_t</type>
-to the canonical format.
-This is complemented by a parse function which converts a packet in
-canonical format to a no-op response structure.
-</para>
-<para>
-These structures are defined in
-<filename>lwres/lwres.h</filename>.
+  </refsynopsisdiv>
+  <refsect1>
+    <title>DESCRIPTION</title>
+    <para>
+      These are low-level routines for creating and parsing
+      lightweight resolver no-op request and response messages.
+    </para>
+    <para>
+      The no-op message is analogous to a <command>ping</command>
+      packet:
+      a packet is sent to the resolver daemon and is simply echoed back.
+      The opcode is intended to allow a client to determine if the server is
+      operational or not.
+    </para>
+    <para>
+      There are four main functions for the no-op opcode.
+      One render function converts a no-op request structure &mdash;
+      <type>lwres_nooprequest_t</type> &mdash;
+      to the lighweight resolver's canonical format.
+      It is complemented by a parse function that converts a packet in this
+      canonical format to a no-op request structure.
+      Another render function converts the no-op response structure &mdash;
+      <type>lwres_noopresponse_t</type>
+      to the canonical format.
+      This is complemented by a parse function which converts a packet in
+      canonical format to a no-op response structure.
+    </para>
+    <para>
+      These structures are defined in
+      <filename>lwres/lwres.h</filename>.
 
-They are shown below.
-<programlisting>
+      They are shown below.
+    </para>
+    <para><programlisting>
 #define LWRES_OPCODE_NOOP       0x00000000U
-
+</programlisting>
+    </para>
+    <para><programlisting>
 typedef struct {
         lwres_uint16_t  datalength;
         unsigned char   *data;
 } lwres_nooprequest_t;
-
+</programlisting>
+    </para>
+    <para><programlisting>
 typedef struct {
         lwres_uint16_t  datalength;
         unsigned char   *data;
 } lwres_noopresponse_t;
 </programlisting>
-Although the structures have different types, they are identical.
-This is because the no-op opcode simply echos whatever data was sent:
-the response is therefore identical to the request.
-</para>
+    </para>
+    <para>
+      Although the structures have different types, they are identical.
+      This is because the no-op opcode simply echos whatever data was sent:
+      the response is therefore identical to the request.
+    </para>
 
-<para>
-<function>lwres_nooprequest_render()</function> uses resolver
-context <parameter>ctx</parameter> to convert no-op request structure
-<parameter>req</parameter> to canonical format.  The packet header
-structure <parameter>pkt</parameter> is initialised and transferred to
-buffer <parameter>b</parameter>.  The contents of
-<parameter>*req</parameter> are then appended to the buffer in
-canonical format.  <function>lwres_noopresponse_render()</function>
-performs the same task, except it converts a no-op response structure
-<type>lwres_noopresponse_t</type> to the lightweight resolver's
-canonical format.
-</para>
+    <para><function>lwres_nooprequest_render()</function>
+      uses resolver context <parameter>ctx</parameter> to convert
+      no-op request structure <parameter>req</parameter> to canonical
+      format.  The packet header structure <parameter>pkt</parameter>
+      is initialised and transferred to buffer
+      <parameter>b</parameter>.  The contents of
+      <parameter>*req</parameter> are then appended to the buffer in
+      canonical format.
+      <function>lwres_noopresponse_render()</function> performs the
+      same task, except it converts a no-op response structure
+      <type>lwres_noopresponse_t</type> to the lightweight resolver's
+      canonical format.
+    </para>
 
-<para>
-<function>lwres_nooprequest_parse()</function> uses context
-<parameter>ctx</parameter> to convert the contents of packet
-<parameter>pkt</parameter> to a <type>lwres_nooprequest_t</type>
-structure.  Buffer <parameter>b</parameter> provides space to be used
-for storing this structure.  When the function succeeds, the resulting
-<type>lwres_nooprequest_t</type> is made available through
-<parameter>*structp</parameter>.
-<function>lwres_noopresponse_parse()</function> offers the same
-semantics as <function>lwres_nooprequest_parse()</function> except it
-yields a <type>lwres_noopresponse_t</type> structure.
-</para>
+    <para><function>lwres_nooprequest_parse()</function>
+      uses context <parameter>ctx</parameter> to convert the contents
+      of packet <parameter>pkt</parameter> to a
+      <type>lwres_nooprequest_t</type> structure.  Buffer
+      <parameter>b</parameter> provides space to be used for storing
+      this structure.  When the function succeeds, the resulting
+      <type>lwres_nooprequest_t</type> is made available through
+      <parameter>*structp</parameter>.
+      <function>lwres_noopresponse_parse()</function> offers the same
+      semantics as <function>lwres_nooprequest_parse()</function>
+      except it yields a <type>lwres_noopresponse_t</type> structure.
+    </para>
 
-<para>
-<function>lwres_noopresponse_free()</function> and
-<function>lwres_nooprequest_free()</function> release the memory in
-resolver context <parameter>ctx</parameter> that was allocated to the
-<type>lwres_noopresponse_t</type> or <type>lwres_nooprequest_t</type>
-structures referenced via <parameter>structp</parameter>.
-</para>
+    <para><function>lwres_noopresponse_free()</function>
+      and <function>lwres_nooprequest_free()</function> release the
+      memory in resolver context <parameter>ctx</parameter> that was
+      allocated to the <type>lwres_noopresponse_t</type> or
+      <type>lwres_nooprequest_t</type> structures referenced via
+      <parameter>structp</parameter>.
+    </para>
 
-</refsect1>
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-The no-op opcode functions
-<function>lwres_nooprequest_render()</function>,
+  </refsect1>
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      The no-op opcode functions
+      <function>lwres_nooprequest_render()</function>,
 
-<function>lwres_noopresponse_render()</function>
-<function>lwres_nooprequest_parse()</function>
-and
-<function>lwres_noopresponse_parse()</function>
-all return
-<errorcode>LWRES_R_SUCCESS</errorcode>
-on success.
-They return
-<errorcode>LWRES_R_NOMEMORY</errorcode>
-if memory allocation fails.
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-is returned if the available space in the buffer
-<parameter>b</parameter>
-is too small to accommodate the packet header or the
-<type>lwres_nooprequest_t</type>
-and
-<type>lwres_noopresponse_t</type>
-structures.
-<function>lwres_nooprequest_parse()</function>
-and
-<function>lwres_noopresponse_parse()</function>
-will return
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-if the buffer is not empty after decoding the received packet.
-These functions will return
-<errorcode>LWRES_R_FAILURE</errorcode>
-if
-<constant>pktflags</constant>
-in the packet header structure
-<type>lwres_lwpacket_t</type>
-indicate that the packet is not a response to an earlier query.
-</para>
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres_packet</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-</para>
-</refsect1>
-</refentry>
+      <function>lwres_noopresponse_render()</function>
+      <function>lwres_nooprequest_parse()</function>
+      and
+      <function>lwres_noopresponse_parse()</function>
+      all return
+      <errorcode>LWRES_R_SUCCESS</errorcode>
+      on success.
+      They return
+      <errorcode>LWRES_R_NOMEMORY</errorcode>
+      if memory allocation fails.
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      is returned if the available space in the buffer
+      <parameter>b</parameter>
+      is too small to accommodate the packet header or the
+      <type>lwres_nooprequest_t</type>
+      and
+      <type>lwres_noopresponse_t</type>
+      structures.
+      <function>lwres_nooprequest_parse()</function>
+      and
+      <function>lwres_noopresponse_parse()</function>
+      will return
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      if the buffer is not empty after decoding the received packet.
+      These functions will return
+      <errorcode>LWRES_R_FAILURE</errorcode>
+      if
+      <constant>pktflags</constant>
+      in the packet header structure
+      <type>lwres_lwpacket_t</type>
+      indicate that the packet is not a response to an earlier query.
+    </para>
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres_packet</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+    </para>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_noop.html b/contrib/bind9/lib/lwres/man/lwres_noop.html
index 145bcac..4705ecb 100644
--- a/contrib/bind9/lib/lwres/man/lwres_noop.html
+++ b/contrib/bind9/lib/lwres/man/lwres_noop.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_noop.html,v 1.7.2.1.4.11 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_noop.html,v 1.8.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_noop</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_nooprequest_render, lwres_noopresponse_render, lwres_nooprequest_parse, lwres_noopresponse_parse, lwres_noopresponse_free, lwres_nooprequest_free &#8212; lightweight resolver no-op message handling</p>
@@ -37,29 +37,27 @@
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_nooprequest_render</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_nooprequest_t * </td>
+<td>
+<var class="pdparam">req</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">b</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -67,29 +65,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_noopresponse_render</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_noopresponse_t * </td>
+<td>
+<var class="pdparam">req</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_buffer_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">b</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -97,29 +93,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_nooprequest_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_nooprequest_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -127,29 +121,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_noopresponse_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_lwpacket_t * </td>
+<td>
+<var class="pdparam">pkt</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_noopresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -157,19 +149,15 @@ lwres_result_t
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_noopresponse_free</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_noopresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
@@ -177,149 +165,153 @@ void
 <td><code class="funcdef">
 void
 <b class="fsfunc">lwres_nooprequest_free</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_nooprequest_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549528"></a><h2>DESCRIPTION</h2>
+<a name="id2543522"></a><h2>DESCRIPTION</h2>
 <p>
-These are low-level routines for creating and parsing
-lightweight resolver no-op request and response messages.
-</p>
+      These are low-level routines for creating and parsing
+      lightweight resolver no-op request and response messages.
+    </p>
 <p>
-The no-op message is analogous to a <span><strong class="command">ping</strong></span> packet: 
-a packet is sent to the resolver daemon and is simply echoed back.
-The opcode is intended to allow a client to determine if the server is
-operational or not.
-</p>
+      The no-op message is analogous to a <span><strong class="command">ping</strong></span>
+      packet:
+      a packet is sent to the resolver daemon and is simply echoed back.
+      The opcode is intended to allow a client to determine if the server is
+      operational or not.
+    </p>
 <p>
-There are four main functions for the no-op opcode.
-One render function converts a no-op request structure &#8212;
-<span class="type">lwres_nooprequest_t</span> &#8212;
-to the lighweight resolver's canonical format.
-It is complemented by a parse function that converts a packet in this
-canonical format to a no-op request structure.
-Another render function converts the no-op response structure &#8212;
-<span class="type">lwres_noopresponse_t</span>
-to the canonical format.
-This is complemented by a parse function which converts a packet in
-canonical format to a no-op response structure.
-</p>
+      There are four main functions for the no-op opcode.
+      One render function converts a no-op request structure &#8212;
+      <span class="type">lwres_nooprequest_t</span> &#8212;
+      to the lighweight resolver's canonical format.
+      It is complemented by a parse function that converts a packet in this
+      canonical format to a no-op request structure.
+      Another render function converts the no-op response structure &#8212;
+      <span class="type">lwres_noopresponse_t</span>
+      to the canonical format.
+      This is complemented by a parse function which converts a packet in
+      canonical format to a no-op response structure.
+    </p>
 <p>
-These structures are defined in
-<code class="filename">lwres/lwres.h</code>.
+      These structures are defined in
+      <code class="filename">lwres/lwres.h</code>.
 
-They are shown below.
-</p>
+      They are shown below.
+    </p>
 <pre class="programlisting">
 #define LWRES_OPCODE_NOOP       0x00000000U
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 typedef struct {
         lwres_uint16_t  datalength;
         unsigned char   *data;
 } lwres_nooprequest_t;
-
+</pre>
+<p>
+    </p>
+<pre class="programlisting">
 typedef struct {
         lwres_uint16_t  datalength;
         unsigned char   *data;
 } lwres_noopresponse_t;
 </pre>
 <p>
-Although the structures have different types, they are identical.
-This is because the no-op opcode simply echos whatever data was sent:
-the response is therefore identical to the request.
-</p>
-<p>
-<code class="function">lwres_nooprequest_render()</code> uses resolver
-context <em class="parameter"><code>ctx</code></em> to convert no-op request structure
-<em class="parameter"><code>req</code></em> to canonical format.  The packet header
-structure <em class="parameter"><code>pkt</code></em> is initialised and transferred to
-buffer <em class="parameter"><code>b</code></em>.  The contents of
-<em class="parameter"><code>*req</code></em> are then appended to the buffer in
-canonical format.  <code class="function">lwres_noopresponse_render()</code>
-performs the same task, except it converts a no-op response structure
-<span class="type">lwres_noopresponse_t</span> to the lightweight resolver's
-canonical format.
-</p>
+    </p>
 <p>
-<code class="function">lwres_nooprequest_parse()</code> uses context
-<em class="parameter"><code>ctx</code></em> to convert the contents of packet
-<em class="parameter"><code>pkt</code></em> to a <span class="type">lwres_nooprequest_t</span>
-structure.  Buffer <em class="parameter"><code>b</code></em> provides space to be used
-for storing this structure.  When the function succeeds, the resulting
-<span class="type">lwres_nooprequest_t</span> is made available through
-<em class="parameter"><code>*structp</code></em>.
-<code class="function">lwres_noopresponse_parse()</code> offers the same
-semantics as <code class="function">lwres_nooprequest_parse()</code> except it
-yields a <span class="type">lwres_noopresponse_t</span> structure.
-</p>
-<p>
-<code class="function">lwres_noopresponse_free()</code> and
-<code class="function">lwres_nooprequest_free()</code> release the memory in
-resolver context <em class="parameter"><code>ctx</code></em> that was allocated to the
-<span class="type">lwres_noopresponse_t</span> or <span class="type">lwres_nooprequest_t</span>
-structures referenced via <em class="parameter"><code>structp</code></em>.
-</p>
+      Although the structures have different types, they are identical.
+      This is because the no-op opcode simply echos whatever data was sent:
+      the response is therefore identical to the request.
+    </p>
+<p><code class="function">lwres_nooprequest_render()</code>
+      uses resolver context <em class="parameter"><code>ctx</code></em> to convert
+      no-op request structure <em class="parameter"><code>req</code></em> to canonical
+      format.  The packet header structure <em class="parameter"><code>pkt</code></em>
+      is initialised and transferred to buffer
+      <em class="parameter"><code>b</code></em>.  The contents of
+      <em class="parameter"><code>*req</code></em> are then appended to the buffer in
+      canonical format.
+      <code class="function">lwres_noopresponse_render()</code> performs the
+      same task, except it converts a no-op response structure
+      <span class="type">lwres_noopresponse_t</span> to the lightweight resolver's
+      canonical format.
+    </p>
+<p><code class="function">lwres_nooprequest_parse()</code>
+      uses context <em class="parameter"><code>ctx</code></em> to convert the contents
+      of packet <em class="parameter"><code>pkt</code></em> to a
+      <span class="type">lwres_nooprequest_t</span> structure.  Buffer
+      <em class="parameter"><code>b</code></em> provides space to be used for storing
+      this structure.  When the function succeeds, the resulting
+      <span class="type">lwres_nooprequest_t</span> is made available through
+      <em class="parameter"><code>*structp</code></em>.
+      <code class="function">lwres_noopresponse_parse()</code> offers the same
+      semantics as <code class="function">lwres_nooprequest_parse()</code>
+      except it yields a <span class="type">lwres_noopresponse_t</span> structure.
+    </p>
+<p><code class="function">lwres_noopresponse_free()</code>
+      and <code class="function">lwres_nooprequest_free()</code> release the
+      memory in resolver context <em class="parameter"><code>ctx</code></em> that was
+      allocated to the <span class="type">lwres_noopresponse_t</span> or
+      <span class="type">lwres_nooprequest_t</span> structures referenced via
+      <em class="parameter"><code>structp</code></em>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549797"></a><h2>RETURN VALUES</h2>
+<a name="id2543672"></a><h2>RETURN VALUES</h2>
 <p>
-The no-op opcode functions
-<code class="function">lwres_nooprequest_render()</code>,
+      The no-op opcode functions
+      <code class="function">lwres_nooprequest_render()</code>,
 
-<code class="function">lwres_noopresponse_render()</code>
-<code class="function">lwres_nooprequest_parse()</code>
-and
-<code class="function">lwres_noopresponse_parse()</code>
-all return
-<span class="errorcode">LWRES_R_SUCCESS</span>
-on success.
-They return
-<span class="errorcode">LWRES_R_NOMEMORY</span>
-if memory allocation fails.
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-is returned if the available space in the buffer
-<em class="parameter"><code>b</code></em>
-is too small to accommodate the packet header or the
-<span class="type">lwres_nooprequest_t</span>
-and
-<span class="type">lwres_noopresponse_t</span>
-structures.
-<code class="function">lwres_nooprequest_parse()</code>
-and
-<code class="function">lwres_noopresponse_parse()</code>
-will return
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-if the buffer is not empty after decoding the received packet.
-These functions will return
-<span class="errorcode">LWRES_R_FAILURE</span>
-if
-<code class="constant">pktflags</code>
-in the packet header structure
-<span class="type">lwres_lwpacket_t</span>
-indicate that the packet is not a response to an earlier query.
-</p>
+      <code class="function">lwres_noopresponse_render()</code>
+      <code class="function">lwres_nooprequest_parse()</code>
+      and
+      <code class="function">lwres_noopresponse_parse()</code>
+      all return
+      <span class="errorcode">LWRES_R_SUCCESS</span>
+      on success.
+      They return
+      <span class="errorcode">LWRES_R_NOMEMORY</span>
+      if memory allocation fails.
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      is returned if the available space in the buffer
+      <em class="parameter"><code>b</code></em>
+      is too small to accommodate the packet header or the
+      <span class="type">lwres_nooprequest_t</span>
+      and
+      <span class="type">lwres_noopresponse_t</span>
+      structures.
+      <code class="function">lwres_nooprequest_parse()</code>
+      and
+      <code class="function">lwres_noopresponse_parse()</code>
+      will return
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      if the buffer is not empty after decoding the received packet.
+      These functions will return
+      <span class="errorcode">LWRES_R_FAILURE</span>
+      if
+      <code class="constant">pktflags</code>
+      in the packet header structure
+      <span class="type">lwres_lwpacket_t</span>
+      indicate that the packet is not a response to an earlier query.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549861"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3
-)</span>
-</p>
+<a name="id2543738"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_packet</span>(3)</span>
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_packet.3 b/contrib/bind9/lib/lwres/man/lwres_packet.3
index 35a8f10..14109085 100644
--- a/contrib/bind9/lib/lwres/man/lwres_packet.3
+++ b/contrib/bind9/lib/lwres/man/lwres_packet.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_packet.3,v 1.15.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_packet.3,v 1.18.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_packet
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,19 +36,25 @@ lwres_lwpacket_renderheader, lwres_lwpacket_parseheader \- lightweight resolver
 #include <lwres/lwpacket.h>
 .fi
 .HP 43
-.BI "lwres_result_t lwres_lwpacket_renderheader(lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt);"
+.BI "lwres_result_t lwres_lwpacket_renderheader(lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ");"
 .HP 42
-.BI "lwres_result_t lwres_lwpacket_parseheader(lwres_buffer_t\ *b, lwres_lwpacket_t\ *pkt);"
+.BI "lwres_result_t lwres_lwpacket_parseheader(lwres_buffer_t\ *" "b" ", lwres_lwpacket_t\ *" "pkt" ");"
 .SH "DESCRIPTION"
 .PP
 These functions rely on a
 \fBstruct lwres_lwpacket\fR
 which is defined in
 \fIlwres/lwpacket.h\fR.
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 typedef struct lwres_lwpacket lwres_lwpacket_t;
+.fi
+.RE
+.sp
+.PP
+.RS 4
+.nf
 struct lwres_lwpacket {
         lwres_uint32_t          length;
         lwres_uint16_t          version;
@@ -65,45 +71,69 @@ struct lwres_lwpacket {
 .sp
 .PP
 The elements of this structure are:
-.TP 3n
+.PP
 \fBlength\fR
+.RS 4
 the overall packet length, including the entire packet header. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls.
-.TP 3n
+.RE
+.PP
 \fBversion\fR
+.RS 4
 the header format. There is currently only one format,
 \fBLWRES_LWPACKETVERSION_0\fR. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls.
-.TP 3n
+.RE
+.PP
 \fBpktflags\fR
+.RS 4
 library\-defined flags for this packet: for instance whether the packet is a request or a reply. Flag values can be set, but not defined by the caller. This field is filled in by the application wit the exception of the LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library in the lwres_gabn_*() and lwres_gnba_*() calls.
-.TP 3n
+.RE
+.PP
 \fBserial\fR
+.RS 4
 is set by the requestor and is returned in all replies. If two or more packets from the same source have the same serial number and are from the same source, they are assumed to be duplicates and the latter ones may be dropped. This field must be set by the application.
-.TP 3n
+.RE
+.PP
 \fBopcode\fR
+.RS 4
 indicates the operation. Opcodes between 0x00000000 and 0x03ffffff are reserved for use by the lightweight resolver library. Opcodes between 0x04000000 and 0xffffffff are application defined. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls.
-.TP 3n
+.RE
+.PP
 \fBresult\fR
+.RS 4
 is only valid for replies. Results between 0x04000000 and 0xffffffff are application defined. Results between 0x00000000 and 0x03ffffff are reserved for library use. This field is filled in by the lwres_gabn_*() and lwres_gnba_*() calls.
-.TP 3n
+.RE
+.PP
 \fBrecvlength\fR
+.RS 4
 is the maximum buffer size that the receiver can handle on requests and the size of the buffer needed to satisfy a request when the buffer is too large for replies. This field is supplied by the application.
-.TP 3n
+.RE
+.PP
 \fBauthtype\fR
+.RS 4
 defines the packet level authentication that is used. Authorisation types between 0x1000 and 0xffff are application defined and types between 0x0000 and 0x0fff are reserved for library use. Currently these are not used and must be zero.
-.TP 3n
+.RE
+.PP
 \fBauthlen\fR
+.RS 4
 gives the length of the authentication data. Since packet authentication is currently not used, this must be zero.
+.RE
 .PP
 The following opcodes are currently defined:
-.TP 3n
+.PP
 \fBNOOP\fR
+.RS 4
 Success is always returned and the packet contents are echoed. The lwres_noop_*() functions should be used for this type.
-.TP 3n
+.RE
+.PP
 \fBGETADDRSBYNAME\fR
+.RS 4
 returns all known addresses for a given name. The lwres_gabn_*() functions should be used for this type.
-.TP 3n
+.RE
+.PP
 \fBGETNAMEBYADDR\fR
+.RS 4
 return the hostname for the given address. The lwres_gnba_*() functions should be used for this type.
+.RE
 .PP
 \fBlwres_lwpacket_renderheader()\fR
 transfers the contents of lightweight resolver packet structure
@@ -134,4 +164,7 @@ and lightweight resolver packet
 both functions return
 \fBLWRES_R_UNEXPECTEDEND\fR.
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_packet.docbook b/contrib/bind9/lib/lwres/man/lwres_packet.docbook
index 226f994..71b3e1b 100644
--- a/contrib/bind9/lib/lwres/man/lwres_packet.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_packet.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_packet.docbook,v 1.6.206.3 2005/05/12 21:36:16 sra Exp $ -->
-
+<!-- $Id: lwres_packet.docbook,v 1.7.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-<refentrytitle>lwres_packet</refentrytitle>
-<manvolnum>3</manvolnum>
-<refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_packet</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,41 +45,44 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_lwpacket_renderheader</refname>
-<refname>lwres_lwpacket_parseheader</refname>
-<refpurpose>lightweight resolver packet handling functions</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_lwpacket_renderheader</refname>
+    <refname>lwres_lwpacket_parseheader</refname>
+    <refpurpose>lightweight resolver packet handling functions</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/lwpacket.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_lwpacket_renderheader</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_lwpacket_parseheader</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_lwpacket_t *pkt</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_lwpacket_t *<parameter>pkt</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
-<refsect1>
-<title>DESCRIPTION</title>
-<para>
-These functions rely on a
-<type>struct lwres_lwpacket</type>
-which is defined in
-<filename>lwres/lwpacket.h</filename>.
+  </refsynopsisdiv>
+  <refsect1>
+    <title>DESCRIPTION</title>
+    <para>
+      These functions rely on a
+      <type>struct lwres_lwpacket</type>
+      which is defined in
+      <filename>lwres/lwpacket.h</filename>.
+    </para>
 
-<programlisting>
+    <para><programlisting>
 typedef struct lwres_lwpacket lwres_lwpacket_t;
-
+      </programlisting>
+    </para>
+    <para><programlisting>
 struct lwres_lwpacket {
         lwres_uint32_t          length;
         lwres_uint16_t          version;
@@ -92,142 +95,197 @@ struct lwres_lwpacket {
         lwres_uint16_t          authlength;
 };
 </programlisting>
-</para>
+    </para>
 
-<para>
-The elements of this structure are:
-<variablelist>
-<varlistentry><term><constant>length</constant></term>
-<listitem>
-<para>
-the overall packet length, including the entire packet header.
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>version</constant></term>
-<listitem>
-<para>
-the header format. There is currently only one format,
-<type>LWRES_LWPACKETVERSION_0</type>.
+    <para>
+      The elements of this structure are:
+      <variablelist>
+        <varlistentry>
+          <term><constant>length</constant></term>
+          <listitem>
+            <para>
+              the overall packet length, including the entire packet header.
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>version</constant></term>
+          <listitem>
+            <para>
+              the header format. There is currently only one format,
+              <type>LWRES_LWPACKETVERSION_0</type>.
 
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>pktflags</constant></term>
-<listitem>
-<para>
-library-defined flags for this packet: for instance whether the packet
-is a request or a reply. Flag values can be set, but not defined by
-the caller.
-This field is filled in by the application wit the exception of the
-LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library in the
-lwres_gabn_*() and lwres_gnba_*() calls.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>serial</constant></term>
-<listitem>
-<para>
-is set by the requestor and is returned in all replies. If two or more
-packets from the same source have the same serial number and are from
-the same source, they are assumed to be duplicates and the latter ones
-may be dropped.
-This field must be set by the application.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>opcode</constant></term>
-<listitem>
-<para>
-indicates the operation.
-Opcodes between 0x00000000 and 0x03ffffff are
-reserved for use by the lightweight resolver library. Opcodes between
-0x04000000 and 0xffffffff are application defined.
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>result</constant></term>
-<listitem>
-<para>
-is only valid for replies.
-Results between 0x04000000 and 0xffffffff are application defined.
-Results between 0x00000000 and 0x03ffffff are reserved for library use.
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>recvlength</constant></term>
-<listitem>
-<para>
-is the maximum buffer size that the receiver can handle on requests
-and the size of the buffer needed to satisfy a request when the buffer
-is too large for replies.
-This field is supplied by the application.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>authtype</constant></term>
-<listitem>
-<para>
-defines the packet level authentication that is used.
-Authorisation types between 0x1000 and 0xffff are application defined
-and types between 0x0000 and 0x0fff are reserved for library use.
-Currently these are not used and must be zero.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>authlen</constant></term>
-<listitem>
-<para>
-gives the length of the authentication data.
-Since packet authentication is currently not used, this must be zero.
-</para></listitem></varlistentry>
-</variablelist>
-</para>
-<para>
-The following opcodes are currently defined:
-<variablelist>
-<varlistentry><term><constant>NOOP</constant></term>
-<listitem>
-<para>
-Success is always returned and the packet contents are echoed.
-The lwres_noop_*() functions should be used for this type.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>GETADDRSBYNAME</constant></term>
-<listitem>
-<para>
-returns all known addresses for a given name.
-The lwres_gabn_*() functions should be used for this type.
-</para></listitem></varlistentry>
-<varlistentry><term><constant>GETNAMEBYADDR</constant></term>
-<listitem>
-<para>
-return the hostname for the given address.
-The lwres_gnba_*() functions should be used for this type.
-</para></listitem></varlistentry>
-</variablelist>
-</para>
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>pktflags</constant></term>
+          <listitem>
+            <para>
+              library-defined flags for this packet: for instance whether the
+              packet
+              is a request or a reply. Flag values can be set, but not defined
+              by
+              the caller.
+              This field is filled in by the application wit the exception of
+              the
+              LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library in
+              the
+              lwres_gabn_*() and lwres_gnba_*() calls.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>serial</constant></term>
+          <listitem>
+            <para>
+              is set by the requestor and is returned in all replies. If two
+              or more
+              packets from the same source have the same serial number and are
+              from
+              the same source, they are assumed to be duplicates and the
+              latter ones
+              may be dropped.
+              This field must be set by the application.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>opcode</constant></term>
+          <listitem>
+            <para>
+              indicates the operation.
+              Opcodes between 0x00000000 and 0x03ffffff are
+              reserved for use by the lightweight resolver library. Opcodes
+              between
+              0x04000000 and 0xffffffff are application defined.
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>result</constant></term>
+          <listitem>
+            <para>
+              is only valid for replies.
+              Results between 0x04000000 and 0xffffffff are application
+              defined.
+              Results between 0x00000000 and 0x03ffffff are reserved for
+              library use.
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>recvlength</constant></term>
+          <listitem>
+            <para>
+              is the maximum buffer size that the receiver can handle on
+              requests
+              and the size of the buffer needed to satisfy a request when the
+              buffer
+              is too large for replies.
+              This field is supplied by the application.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>authtype</constant></term>
+          <listitem>
+            <para>
+              defines the packet level authentication that is used.
+              Authorisation types between 0x1000 and 0xffff are application
+              defined
+              and types between 0x0000 and 0x0fff are reserved for library
+              use.
+              Currently these are not used and must be zero.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>authlen</constant></term>
+          <listitem>
+            <para>
+              gives the length of the authentication data.
+              Since packet authentication is currently not used, this must be
+              zero.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
+    <para>
+      The following opcodes are currently defined:
+      <variablelist>
+        <varlistentry>
+          <term><constant>NOOP</constant></term>
+          <listitem>
+            <para>
+              Success is always returned and the packet contents are echoed.
+              The lwres_noop_*() functions should be used for this type.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>GETADDRSBYNAME</constant></term>
+          <listitem>
+            <para>
+              returns all known addresses for a given name.
+              The lwres_gabn_*() functions should be used for this type.
+            </para>
+          </listitem>
+        </varlistentry>
+        <varlistentry>
+          <term><constant>GETNAMEBYADDR</constant></term>
+          <listitem>
+            <para>
+              return the hostname for the given address.
+              The lwres_gnba_*() functions should be used for this type.
+            </para>
+          </listitem>
+        </varlistentry>
+      </variablelist>
+    </para>
 
-<para>
-<function>lwres_lwpacket_renderheader()</function> transfers the
-contents of lightweight resolver packet structure
-<type>lwres_lwpacket_t</type> <parameter>*pkt</parameter> in network
-byte order to the lightweight resolver buffer,
-<parameter>*b</parameter>.
-</para>
+    <para><function>lwres_lwpacket_renderheader()</function>
+      transfers the contents of lightweight resolver packet structure
+      <type>lwres_lwpacket_t</type> <parameter>*pkt</parameter> in
+      network byte order to the lightweight resolver buffer,
+      <parameter>*b</parameter>.
+    </para>
 
-<para>
-<function>lwres_lwpacket_parseheader()</function> performs the
-converse operation.  It transfers data in network byte order from
-buffer <parameter>*b</parameter> to resolver packet
-<parameter>*pkt</parameter>.  The contents of the buffer
-<parameter>b</parameter> should correspond to a
-<type>lwres_lwpacket_t</type>.
-</para>
+    <para><function>lwres_lwpacket_parseheader()</function>
+      performs the converse operation.  It transfers data in network
+      byte order from buffer <parameter>*b</parameter> to resolver
+      packet <parameter>*pkt</parameter>.  The contents of the buffer
+      <parameter>b</parameter> should correspond to a
+      <type>lwres_lwpacket_t</type>.
+    </para>
 
-</refsect1>
+  </refsect1>
 
-<refsect1>
-<title>RETURN VALUES</title>
-<para> Successful calls to
-<function>lwres_lwpacket_renderheader()</function> and
-<function>lwres_lwpacket_parseheader()</function> return
-<errorcode>LWRES_R_SUCCESS</errorcode>.  If there is insufficient
-space to copy data between the buffer <parameter>*b</parameter> and
-lightweight resolver packet <parameter>*pkt</parameter> both functions
-return <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>.
-</para>
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      Successful calls to
+      <function>lwres_lwpacket_renderheader()</function> and
+      <function>lwres_lwpacket_parseheader()</function> return
+      <errorcode>LWRES_R_SUCCESS</errorcode>.  If there is insufficient
+      space to copy data between the buffer <parameter>*b</parameter> and
+      lightweight resolver packet <parameter>*pkt</parameter> both
+      functions
+      return <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>.
+    </para>
 
-</refsect1>
-</refentry>
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_packet.html b/contrib/bind9/lib/lwres/man/lwres_packet.html
index 32bb81e..eeb7ebd 100644
--- a/contrib/bind9/lib/lwres/man/lwres_packet.html
+++ b/contrib/bind9/lib/lwres/man/lwres_packet.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_packet.html,v 1.8.2.1.4.12 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_packet.html,v 1.9.18.17 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_packet</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_lwpacket_renderheader, lwres_lwpacket_parseheader &#8212; lightweight resolver packet handling functions</p>
@@ -36,19 +36,15 @@
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_lwpacket_renderheader</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_lwpacket_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">pkt</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
@@ -56,35 +52,33 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_lwpacket_parseheader</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_lwpacket_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">pkt</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549430"></a><h2>DESCRIPTION</h2>
+<a name="id2543389"></a><h2>DESCRIPTION</h2>
 <p>
-These functions rely on a
-<span class="type">struct lwres_lwpacket</span>
-which is defined in
-<code class="filename">lwres/lwpacket.h</code>.
-
-</p>
+      These functions rely on a
+      <span class="type">struct lwres_lwpacket</span>
+      which is defined in
+      <code class="filename">lwres/lwpacket.h</code>.
+    </p>
 <pre class="programlisting">
 typedef struct lwres_lwpacket lwres_lwpacket_t;
-
+      </pre>
+<p>
+    </p>
+<pre class="programlisting">
 struct lwres_lwpacket {
         lwres_uint32_t          length;
         lwres_uint16_t          version;
@@ -98,129 +92,144 @@ struct lwres_lwpacket {
 };
 </pre>
 <p>
-</p>
+    </p>
 <p>
-The elements of this structure are:
-</p>
+      The elements of this structure are:
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">length</code></span></dt>
 <dd><p>
-the overall packet length, including the entire packet header.
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</p></dd>
+              the overall packet length, including the entire packet header.
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </p></dd>
 <dt><span class="term"><code class="constant">version</code></span></dt>
 <dd><p>
-the header format. There is currently only one format,
-<span class="type">LWRES_LWPACKETVERSION_0</span>.
+              the header format. There is currently only one format,
+              <span class="type">LWRES_LWPACKETVERSION_0</span>.
 
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</p></dd>
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </p></dd>
 <dt><span class="term"><code class="constant">pktflags</code></span></dt>
 <dd><p>
-library-defined flags for this packet: for instance whether the packet
-is a request or a reply. Flag values can be set, but not defined by
-the caller.
-This field is filled in by the application wit the exception of the
-LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library in the
-lwres_gabn_*() and lwres_gnba_*() calls.
-</p></dd>
+              library-defined flags for this packet: for instance whether the
+              packet
+              is a request or a reply. Flag values can be set, but not defined
+              by
+              the caller.
+              This field is filled in by the application wit the exception of
+              the
+              LWRES_LWPACKETFLAG_RESPONSE bit, which is set by the library in
+              the
+              lwres_gabn_*() and lwres_gnba_*() calls.
+            </p></dd>
 <dt><span class="term"><code class="constant">serial</code></span></dt>
 <dd><p>
-is set by the requestor and is returned in all replies. If two or more
-packets from the same source have the same serial number and are from
-the same source, they are assumed to be duplicates and the latter ones
-may be dropped.
-This field must be set by the application.
-</p></dd>
+              is set by the requestor and is returned in all replies. If two
+              or more
+              packets from the same source have the same serial number and are
+              from
+              the same source, they are assumed to be duplicates and the
+              latter ones
+              may be dropped.
+              This field must be set by the application.
+            </p></dd>
 <dt><span class="term"><code class="constant">opcode</code></span></dt>
 <dd><p>
-indicates the operation.
-Opcodes between 0x00000000 and 0x03ffffff are
-reserved for use by the lightweight resolver library. Opcodes between
-0x04000000 and 0xffffffff are application defined.
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</p></dd>
+              indicates the operation.
+              Opcodes between 0x00000000 and 0x03ffffff are
+              reserved for use by the lightweight resolver library. Opcodes
+              between
+              0x04000000 and 0xffffffff are application defined.
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </p></dd>
 <dt><span class="term"><code class="constant">result</code></span></dt>
 <dd><p>
-is only valid for replies.
-Results between 0x04000000 and 0xffffffff are application defined.
-Results between 0x00000000 and 0x03ffffff are reserved for library use.
-This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
-calls.
-</p></dd>
+              is only valid for replies.
+              Results between 0x04000000 and 0xffffffff are application
+              defined.
+              Results between 0x00000000 and 0x03ffffff are reserved for
+              library use.
+              This field is filled in by the lwres_gabn_*() and lwres_gnba_*()
+              calls.
+            </p></dd>
 <dt><span class="term"><code class="constant">recvlength</code></span></dt>
 <dd><p>
-is the maximum buffer size that the receiver can handle on requests
-and the size of the buffer needed to satisfy a request when the buffer
-is too large for replies.
-This field is supplied by the application.
-</p></dd>
+              is the maximum buffer size that the receiver can handle on
+              requests
+              and the size of the buffer needed to satisfy a request when the
+              buffer
+              is too large for replies.
+              This field is supplied by the application.
+            </p></dd>
 <dt><span class="term"><code class="constant">authtype</code></span></dt>
 <dd><p>
-defines the packet level authentication that is used.
-Authorisation types between 0x1000 and 0xffff are application defined
-and types between 0x0000 and 0x0fff are reserved for library use.
-Currently these are not used and must be zero.
-</p></dd>
+              defines the packet level authentication that is used.
+              Authorisation types between 0x1000 and 0xffff are application
+              defined
+              and types between 0x0000 and 0x0fff are reserved for library
+              use.
+              Currently these are not used and must be zero.
+            </p></dd>
 <dt><span class="term"><code class="constant">authlen</code></span></dt>
 <dd><p>
-gives the length of the authentication data.
-Since packet authentication is currently not used, this must be zero.
-</p></dd>
+              gives the length of the authentication data.
+              Since packet authentication is currently not used, this must be
+              zero.
+            </p></dd>
 </dl></div>
 <p>
-</p>
+    </p>
 <p>
-The following opcodes are currently defined:
-</p>
+      The following opcodes are currently defined:
+      </p>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="constant">NOOP</code></span></dt>
 <dd><p>
-Success is always returned and the packet contents are echoed.
-The lwres_noop_*() functions should be used for this type.
-</p></dd>
+              Success is always returned and the packet contents are echoed.
+              The lwres_noop_*() functions should be used for this type.
+            </p></dd>
 <dt><span class="term"><code class="constant">GETADDRSBYNAME</code></span></dt>
 <dd><p>
-returns all known addresses for a given name.
-The lwres_gabn_*() functions should be used for this type.
-</p></dd>
+              returns all known addresses for a given name.
+              The lwres_gabn_*() functions should be used for this type.
+            </p></dd>
 <dt><span class="term"><code class="constant">GETNAMEBYADDR</code></span></dt>
 <dd><p>
-return the hostname for the given address.
-The lwres_gnba_*() functions should be used for this type.
-</p></dd>
+              return the hostname for the given address.
+              The lwres_gnba_*() functions should be used for this type.
+            </p></dd>
 </dl></div>
 <p>
-</p>
-<p>
-<code class="function">lwres_lwpacket_renderheader()</code> transfers the
-contents of lightweight resolver packet structure
-<span class="type">lwres_lwpacket_t</span> <em class="parameter"><code>*pkt</code></em> in network
-byte order to the lightweight resolver buffer,
-<em class="parameter"><code>*b</code></em>.
-</p>
-<p>
-<code class="function">lwres_lwpacket_parseheader()</code> performs the
-converse operation.  It transfers data in network byte order from
-buffer <em class="parameter"><code>*b</code></em> to resolver packet
-<em class="parameter"><code>*pkt</code></em>.  The contents of the buffer
-<em class="parameter"><code>b</code></em> should correspond to a
-<span class="type">lwres_lwpacket_t</span>.
-</p>
+    </p>
+<p><code class="function">lwres_lwpacket_renderheader()</code>
+      transfers the contents of lightweight resolver packet structure
+      <span class="type">lwres_lwpacket_t</span> <em class="parameter"><code>*pkt</code></em> in
+      network byte order to the lightweight resolver buffer,
+      <em class="parameter"><code>*b</code></em>.
+    </p>
+<p><code class="function">lwres_lwpacket_parseheader()</code>
+      performs the converse operation.  It transfers data in network
+      byte order from buffer <em class="parameter"><code>*b</code></em> to resolver
+      packet <em class="parameter"><code>*pkt</code></em>.  The contents of the buffer
+      <em class="parameter"><code>b</code></em> should correspond to a
+      <span class="type">lwres_lwpacket_t</span>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549769"></a><h2>RETURN VALUES</h2>
-<p> Successful calls to
-<code class="function">lwres_lwpacket_renderheader()</code> and
-<code class="function">lwres_lwpacket_parseheader()</code> return
-<span class="errorcode">LWRES_R_SUCCESS</span>.  If there is insufficient
-space to copy data between the buffer <em class="parameter"><code>*b</code></em> and
-lightweight resolver packet <em class="parameter"><code>*pkt</code></em> both functions
-return <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>.
-</p>
+<a name="id2543706"></a><h2>RETURN VALUES</h2>
+<p>
+      Successful calls to
+      <code class="function">lwres_lwpacket_renderheader()</code> and
+      <code class="function">lwres_lwpacket_parseheader()</code> return
+      <span class="errorcode">LWRES_R_SUCCESS</span>.  If there is insufficient
+      space to copy data between the buffer <em class="parameter"><code>*b</code></em> and
+      lightweight resolver packet <em class="parameter"><code>*pkt</code></em> both
+      functions
+      return <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/man/lwres_resutil.3 b/contrib/bind9/lib/lwres/man/lwres_resutil.3
index 907706c..9aebc9f 100644
--- a/contrib/bind9/lib/lwres/man/lwres_resutil.3
+++ b/contrib/bind9/lib/lwres/man/lwres_resutil.3
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -13,13 +13,13 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwres_resutil.3,v 1.14.2.1.8.6 2006/06/29 13:02:31 marka Exp $
+.\" $Id: lwres_resutil.3,v 1.17.18.11 2007/01/30 00:23:45 marka Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: lwres_resutil
 .\"    Author: 
-.\" Generator: DocBook XSL Stylesheets v1.70.1 <http://docbook.sf.net/>
+.\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
 .\"      Date: Jun 30, 2000
 .\"    Manual: BIND9
 .\"    Source: BIND9
@@ -36,13 +36,13 @@ lwres_string_parse, lwres_addr_parse, lwres_getaddrsbyname, lwres_getnamebyaddr
 #include <lwres/lwres.h>
 .fi
 .HP 34
-.BI "lwres_result_t lwres_string_parse(lwres_buffer_t\ *b, char\ **c, lwres_uint16_t\ *len);"
+.BI "lwres_result_t lwres_string_parse(lwres_buffer_t\ *" "b" ", char\ **" "c" ", lwres_uint16_t\ *" "len" ");"
 .HP 32
-.BI "lwres_result_t lwres_addr_parse(lwres_buffer_t\ *b, lwres_addr_t\ *addr);"
+.BI "lwres_result_t lwres_addr_parse(lwres_buffer_t\ *" "b" ", lwres_addr_t\ *" "addr" ");"
 .HP 36
-.BI "lwres_result_t lwres_getaddrsbyname(lwres_context_t\ *ctx, const\ char\ *name, lwres_uint32_t\ addrtypes, lwres_gabnresponse_t\ **structp);"
+.BI "lwres_result_t lwres_getaddrsbyname(lwres_context_t\ *" "ctx" ", const\ char\ *" "name" ", lwres_uint32_t\ " "addrtypes" ", lwres_gabnresponse_t\ **" "structp" ");"
 .HP 35
-.BI "lwres_result_t lwres_getnamebyaddr(lwres_context_t\ *ctx, lwres_uint32_t\ addrtype, lwres_uint16_t\ addrlen, const\ unsigned\ char\ *addr, lwres_gnbaresponse_t\ **structp);"
+.BI "lwres_result_t lwres_getnamebyaddr(lwres_context_t\ *" "ctx" ", lwres_uint32_t\ " "addrtype" ", lwres_uint16_t\ " "addrlen" ", const\ unsigned\ char\ *" "addr" ", lwres_gnbaresponse_t\ **" "structp" ");"
 .SH "DESCRIPTION"
 .PP
 \fBlwres_string_parse()\fR
@@ -73,8 +73,8 @@ and
 use the
 \fBlwres_gnbaresponse_t\fR
 structure defined below:
-.sp
-.RS 3n
+.PP
+.RS 4
 .nf
 typedef struct {
         lwres_uint32_t          flags;
@@ -90,9 +90,9 @@ typedef struct {
 } lwres_gabnresponse_t;
 .fi
 .RE
-.sp
+.PP
 The contents of this structure are not manipulated directly but they are controlled through the
-\fBlwres_gabn\fR(3 )
+\fBlwres_gabn\fR(3)
 functions.
 .PP
 The lightweight resolver uses
@@ -164,4 +164,7 @@ if the buffers used for sending queries and receiving replies are too small.
 \fBlwres_buffer\fR(3),
 \fBlwres_gabn\fR(3).
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
+.br
+Copyright \(co 2000, 2001 Internet Software Consortium.
+.br
diff --git a/contrib/bind9/lib/lwres/man/lwres_resutil.docbook b/contrib/bind9/lib/lwres/man/lwres_resutil.docbook
index 7ab2146..3b60f06 100644
--- a/contrib/bind9/lib/lwres/man/lwres_resutil.docbook
+++ b/contrib/bind9/lib/lwres/man/lwres_resutil.docbook
@@ -1,8 +1,8 @@
-<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.0//EN"
-               "http://www.oasis-open.org/docbook/xml/4.0/docbookx.dtd"
+<!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
+               "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and distribute this software for any
@@ -18,24 +18,24 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: lwres_resutil.docbook,v 1.5.206.3 2005/05/12 21:36:16 sra Exp $ -->
-
+<!-- $Id: lwres_resutil.docbook,v 1.6.18.5 2007/01/29 23:57:21 marka Exp $ -->
 <refentry>
 
-<refentryinfo>
-<date>Jun 30, 2000</date>
-</refentryinfo>
+  <refentryinfo>
+    <date>Jun 30, 2000</date>
+  </refentryinfo>
 
-<refmeta>
-  <refentrytitle>lwres_resutil</refentrytitle>
-  <manvolnum>3</manvolnum>
-  <refmiscinfo>BIND9</refmiscinfo>
-</refmeta>
+  <refmeta>
+    <refentrytitle>lwres_resutil</refentrytitle>
+    <manvolnum>3</manvolnum>
+    <refmiscinfo>BIND9</refmiscinfo>
+  </refmeta>
 
   <docinfo>
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2007</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -45,89 +45,88 @@
     </copyright>
   </docinfo>
 
-<refnamediv>
-<refname>lwres_string_parse</refname>
-<refname>lwres_addr_parse</refname>
-<refname>lwres_getaddrsbyname</refname>
-<refname>lwres_getnamebyaddr</refname>
-<refpurpose>lightweight resolver utility functions</refpurpose>
-</refnamediv>
-<refsynopsisdiv>
-<funcsynopsis>
+  <refnamediv>
+    <refname>lwres_string_parse</refname>
+    <refname>lwres_addr_parse</refname>
+    <refname>lwres_getaddrsbyname</refname>
+    <refname>lwres_getnamebyaddr</refname>
+    <refpurpose>lightweight resolver utility functions</refpurpose>
+  </refnamediv>
+  <refsynopsisdiv>
+    <funcsynopsis>
 <funcsynopsisinfo>#include &lt;lwres/lwres.h&gt;</funcsynopsisinfo>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_string_parse</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>char **c</paramdef>
-<paramdef>lwres_uint16_t *len</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>char **<parameter>c</parameter></paramdef>
+        <paramdef>lwres_uint16_t *<parameter>len</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_addr_parse</function></funcdef>
-<paramdef>lwres_buffer_t *b</paramdef>
-<paramdef>lwres_addr_t *addr</paramdef>
-</funcprototype>
+        <paramdef>lwres_buffer_t *<parameter>b</parameter></paramdef>
+        <paramdef>lwres_addr_t *<parameter>addr</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_getaddrsbyname</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>const char *name</paramdef>
-<paramdef>lwres_uint32_t addrtypes</paramdef>
-<paramdef>lwres_gabnresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>const char *<parameter>name</parameter></paramdef>
+        <paramdef>lwres_uint32_t <parameter>addrtypes</parameter></paramdef>
+        <paramdef>lwres_gabnresponse_t **<parameter>structp</parameter></paramdef>
+        </funcprototype>
 <funcprototype>
-<funcdef>
+        <funcdef>
 lwres_result_t
 <function>lwres_getnamebyaddr</function></funcdef>
-<paramdef>lwres_context_t *ctx</paramdef>
-<paramdef>lwres_uint32_t addrtype</paramdef>
-<paramdef>lwres_uint16_t addrlen</paramdef>
-<paramdef>const unsigned char *addr</paramdef>
-<paramdef>lwres_gnbaresponse_t **structp</paramdef>
-</funcprototype>
+        <paramdef>lwres_context_t *<parameter>ctx</parameter></paramdef>
+        <paramdef>lwres_uint32_t <parameter>addrtype</parameter></paramdef>
+        <paramdef>lwres_uint16_t <parameter>addrlen</parameter></paramdef>
+        <paramdef>const unsigned char *<parameter>addr</parameter></paramdef>
+        <paramdef>lwres_gnbaresponse_t **<parameter>structp</parameter></paramdef>
+      </funcprototype>
 </funcsynopsis>
-</refsynopsisdiv>
-
-<refsect1>
-<title>DESCRIPTION</title>
-
-<para>
-<function>lwres_string_parse()</function> retrieves a DNS-encoded
-string starting the current pointer of lightweight resolver buffer
-<parameter>b</parameter>: i.e.  <constant>b-&gt;current</constant>.
-When the function returns, the address of the first byte of the
-encoded string is returned via <parameter>*c</parameter> and the
-length of that string is given by <parameter>*len</parameter>.  The
-buffer's current pointer is advanced to point at the character
-following the string length, the encoded string, and the trailing
-<type>NULL</type> character.
-</para>
-
-<para>
-<function>lwres_addr_parse()</function> extracts an address from the
-buffer <parameter>b</parameter>.  The buffer's current pointer
-<constant>b-&gt;current</constant> is presumed to point at an encoded
-address: the address preceded by a 32-bit protocol family identifier
-and a 16-bit length field.  The encoded address is copied to
-<constant>addr-&gt;address</constant> and
-<constant>addr-&gt;length</constant> indicates the size in bytes of
-the address that was copied.  <constant>b-&gt;current</constant> is
-advanced to point at the next byte of available data in the buffer
-following the encoded address.
-</para>
-
-<para>
-<function>lwres_getaddrsbyname()</function>
-and
-<function>lwres_getnamebyaddr()</function>
-use the
-<type>lwres_gnbaresponse_t</type>
-structure defined below:
-<programlisting>
+  </refsynopsisdiv>
+
+  <refsect1>
+    <title>DESCRIPTION</title>
+
+    <para><function>lwres_string_parse()</function>
+      retrieves a DNS-encoded string starting the current pointer of
+      lightweight resolver buffer <parameter>b</parameter>: i.e.
+      <constant>b-&gt;current</constant>.  When the function returns,
+      the address of the first byte of the encoded string is returned
+      via <parameter>*c</parameter> and the length of that string is
+      given by <parameter>*len</parameter>.  The buffer's current
+      pointer is advanced to point at the character following the
+      string length, the encoded string, and the trailing
+      <type>NULL</type> character.
+    </para>
+
+    <para><function>lwres_addr_parse()</function>
+      extracts an address from the buffer <parameter>b</parameter>.
+      The buffer's current pointer <constant>b-&gt;current</constant>
+      is presumed to point at an encoded address: the address preceded
+      by a 32-bit protocol family identifier and a 16-bit length
+      field.  The encoded address is copied to
+      <constant>addr-&gt;address</constant> and
+      <constant>addr-&gt;length</constant> indicates the size in bytes
+      of the address that was copied.
+      <constant>b-&gt;current</constant> is advanced to point at the
+      next byte of available data in the buffer following the encoded
+      address.
+    </para>
+
+    <para><function>lwres_getaddrsbyname()</function>
+      and <function>lwres_getnamebyaddr()</function> use the
+      <type>lwres_gnbaresponse_t</type> structure defined below:
+    </para>
+
+<para><programlisting>
 typedef struct {
         lwres_uint32_t          flags;
         lwres_uint16_t          naliases;
@@ -140,97 +139,100 @@ typedef struct {
         void                   *base;
         size_t                  baselen;
 } lwres_gabnresponse_t;
-</programlisting>
-The contents of this structure are not manipulated directly but
-they are controlled through the
-<citerefentry>
-<refentrytitle>lwres_gabn</refentrytitle><manvolnum>3
-</manvolnum>
-</citerefentry>
-functions.
-</para>
-
-<para>
-The lightweight resolver uses
-<function>lwres_getaddrsbyname()</function> to perform foward lookups.
-Hostname <parameter>name</parameter> is looked up using the resolver
-context <parameter>ctx</parameter> for memory allocation.
-<parameter>addrtypes</parameter> is a bitmask indicating which type of
-addresses are to be looked up.  Current values for this bitmask are
-<type>LWRES_ADDRTYPE_V4</type> for IPv4 addresses and
-<type>LWRES_ADDRTYPE_V6</type> for IPv6 addresses.  Results of the
-lookup are returned in <parameter>*structp</parameter>.
-</para>
-
-<para>
-<function>lwres_getnamebyaddr()</function> performs reverse lookups.
-Resolver context <parameter>ctx</parameter> is used for memory
-allocation.  The address type is indicated by
-<parameter>addrtype</parameter>: <type>LWRES_ADDRTYPE_V4</type> or
-<type>LWRES_ADDRTYPE_V6</type>.  The address to be looked up is given
-by <parameter>addr</parameter> and its length is
-<parameter>addrlen</parameter> bytes.  The result of the function call
-is made available through <parameter>*structp</parameter>.
-</para>
-</refsect1>
-
-<refsect1>
-<title>RETURN VALUES</title>
-<para>
-Successful calls to
-<function>lwres_string_parse()</function>
-and
-<function>lwres_addr_parse()</function>
-return
-<errorcode>LWRES_R_SUCCESS.</errorcode>
-Both functions return
-<errorcode>LWRES_R_FAILURE</errorcode>
-if the buffer is corrupt or
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-if the buffer has less space than expected for the components of the
-encoded string or address.
-</para>
-<para>
-<function>lwres_getaddrsbyname()</function>
-returns
-<errorcode>LWRES_R_SUCCESS</errorcode>
-on success and it returns
-<errorcode>LWRES_R_NOTFOUND</errorcode>
-if the hostname
-<parameter>name</parameter>
-could not be found.
-</para>
-<para>
-<errorcode>LWRES_R_SUCCESS</errorcode>
-is returned by a successful call to
-<function>lwres_getnamebyaddr()</function>.
-</para>
-
-<para>
-Both
-<function>lwres_getaddrsbyname()</function>
-and
-<function>lwres_getnamebyaddr()</function>
-return
-<errorcode>LWRES_R_NOMEMORY</errorcode>
-when memory allocation requests fail and
-<errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
-if the buffers used for sending queries and receiving replies are too
-small.
-</para>
-
-</refsect1>
-<refsect1>
-<title>SEE ALSO</title>
-<para>
-<citerefentry>
-<refentrytitle>lwres_buffer</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>,
-
-<citerefentry>
-<refentrytitle>lwres_gabn</refentrytitle><manvolnum>3</manvolnum>
-</citerefentry>.
-</para>
-
-</refsect1>
-</refentry>
+</programlisting></para>
+
+    <para>
+      The contents of this structure are not manipulated directly but
+      they are controlled through the
+      <citerefentry>
+        <refentrytitle>lwres_gabn</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>
+      functions.
+    </para>
+
+    <para>
+      The lightweight resolver uses
+      <function>lwres_getaddrsbyname()</function> to perform
+      foward lookups.
+      Hostname <parameter>name</parameter> is looked up using the
+      resolver
+      context <parameter>ctx</parameter> for memory allocation.
+      <parameter>addrtypes</parameter> is a bitmask indicating
+      which type of
+      addresses are to be looked up.  Current values for this bitmask are
+      <type>LWRES_ADDRTYPE_V4</type> for IPv4 addresses and
+      <type>LWRES_ADDRTYPE_V6</type> for IPv6 addresses.  Results of the
+      lookup are returned in <parameter>*structp</parameter>.
+    </para>
+
+    <para><function>lwres_getnamebyaddr()</function>
+      performs reverse lookups.  Resolver context
+      <parameter>ctx</parameter> is used for memory allocation.  The
+      address type is indicated by <parameter>addrtype</parameter>:
+      <type>LWRES_ADDRTYPE_V4</type> or
+      <type>LWRES_ADDRTYPE_V6</type>.  The address to be looked up is
+      given by <parameter>addr</parameter> and its length is
+      <parameter>addrlen</parameter> bytes.  The result of the
+      function call is made available through
+      <parameter>*structp</parameter>.
+    </para>
+  </refsect1>
+
+  <refsect1>
+    <title>RETURN VALUES</title>
+    <para>
+      Successful calls to
+      <function>lwres_string_parse()</function>
+      and
+      <function>lwres_addr_parse()</function>
+      return
+      <errorcode>LWRES_R_SUCCESS.</errorcode>
+      Both functions return
+      <errorcode>LWRES_R_FAILURE</errorcode>
+      if the buffer is corrupt or
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      if the buffer has less space than expected for the components of the
+      encoded string or address.
+    </para>
+
+    <para><function>lwres_getaddrsbyname()</function>
+      returns <errorcode>LWRES_R_SUCCESS</errorcode> on success and it
+      returns <errorcode>LWRES_R_NOTFOUND</errorcode> if the hostname
+      <parameter>name</parameter> could not be found.
+    </para>
+    <para><errorcode>LWRES_R_SUCCESS</errorcode>
+      is returned by a successful call to
+      <function>lwres_getnamebyaddr()</function>.
+    </para>
+
+    <para>
+      Both
+      <function>lwres_getaddrsbyname()</function>
+      and
+      <function>lwres_getnamebyaddr()</function>
+      return
+      <errorcode>LWRES_R_NOMEMORY</errorcode>
+      when memory allocation requests fail and
+      <errorcode>LWRES_R_UNEXPECTEDEND</errorcode>
+      if the buffers used for sending queries and receiving replies are too
+      small.
+    </para>
+
+  </refsect1>
+  <refsect1>
+    <title>SEE ALSO</title>
+    <para><citerefentry>
+        <refentrytitle>lwres_buffer</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>,
+
+      <citerefentry>
+        <refentrytitle>lwres_gabn</refentrytitle><manvolnum>3</manvolnum>
+      </citerefentry>.
+    </para>
+
+  </refsect1>
+</refentry><!--
+ - Local variables:
+ - mode: sgml
+ - End:
+-->
diff --git a/contrib/bind9/lib/lwres/man/lwres_resutil.html b/contrib/bind9/lib/lwres/man/lwres_resutil.html
index a9bc1ee..dfa2e1c 100644
--- a/contrib/bind9/lib/lwres/man/lwres_resutil.html
+++ b/contrib/bind9/lib/lwres/man/lwres_resutil.html
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004, 2005 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and distribute this software for any
@@ -14,15 +14,15 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwres_resutil.html,v 1.8.2.1.4.11 2006/06/29 13:02:31 marka Exp $ -->
+<!-- $Id: lwres_resutil.html,v 1.9.18.16 2007/01/30 00:23:45 marka Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>lwres_resutil</title>
-<meta name="generator" content="DocBook XSL Stylesheets V1.70.1">
+<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="refentry" lang="en">
-<a name="id2482688"></a><div class="titlepage"></div>
+<a name="id2476275"></a><div class="titlepage"></div>
 <div class="refnamediv">
 <h2>Name</h2>
 <p>lwres_string_parse, lwres_addr_parse, lwres_getaddrsbyname, lwres_getnamebyaddr &#8212; lightweight resolver utility functions</p>
@@ -36,24 +36,21 @@
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_string_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>char ** </td>
+<td>
+<var class="pdparam">c</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_uint16_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">len</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -61,19 +58,15 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_addr_parse</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_buffer_t * </td>
+<td>
+<var class="pdparam">b</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_addr_t * </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">addr</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0" style="padding-bottom: 1em">
@@ -81,29 +74,27 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_getaddrsbyname</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>const char * </td>
+<td>
+<var class="pdparam">name</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_uint32_t  </td>
+<td>
+<var class="pdparam">addrtypes</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gabnresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 <table border="0" summary="Function synopsis" cellspacing="0" cellpadding="0">
@@ -111,71 +102,67 @@ lwres_result_t
 <td><code class="funcdef">
 lwres_result_t
 <b class="fsfunc">lwres_getnamebyaddr</b>(</code></td>
-<td> </td>
-<td>, </td>
-</tr>
-<tr>
-<td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_context_t * </td>
+<td>
+<var class="pdparam">ctx</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_uint32_t  </td>
+<td>
+<var class="pdparam">addrtype</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>lwres_uint16_t  </td>
+<td>
+<var class="pdparam">addrlen</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
-<td>, </td>
+<td>const unsigned char * </td>
+<td>
+<var class="pdparam">addr</var>, </td>
 </tr>
 <tr>
 <td> </td>
-<td> </td>
+<td>lwres_gnbaresponse_t ** </td>
 <td>
-<code>)</code>;</td>
+<var class="pdparam">structp</var><code>)</code>;</td>
 </tr>
 </table>
 </div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549485"></a><h2>DESCRIPTION</h2>
-<p>
-<code class="function">lwres_string_parse()</code> retrieves a DNS-encoded
-string starting the current pointer of lightweight resolver buffer
-<em class="parameter"><code>b</code></em>: i.e.  <code class="constant">b-&gt;current</code>.
-When the function returns, the address of the first byte of the
-encoded string is returned via <em class="parameter"><code>*c</code></em> and the
-length of that string is given by <em class="parameter"><code>*len</code></em>.  The
-buffer's current pointer is advanced to point at the character
-following the string length, the encoded string, and the trailing
-<span class="type">NULL</span> character.
-</p>
-<p>
-<code class="function">lwres_addr_parse()</code> extracts an address from the
-buffer <em class="parameter"><code>b</code></em>.  The buffer's current pointer
-<code class="constant">b-&gt;current</code> is presumed to point at an encoded
-address: the address preceded by a 32-bit protocol family identifier
-and a 16-bit length field.  The encoded address is copied to
-<code class="constant">addr-&gt;address</code> and
-<code class="constant">addr-&gt;length</code> indicates the size in bytes of
-the address that was copied.  <code class="constant">b-&gt;current</code> is
-advanced to point at the next byte of available data in the buffer
-following the encoded address.
-</p>
-<p>
-<code class="function">lwres_getaddrsbyname()</code>
-and
-<code class="function">lwres_getnamebyaddr()</code>
-use the
-<span class="type">lwres_gnbaresponse_t</span>
-structure defined below:
-</p>
+<a name="id2543466"></a><h2>DESCRIPTION</h2>
+<p><code class="function">lwres_string_parse()</code>
+      retrieves a DNS-encoded string starting the current pointer of
+      lightweight resolver buffer <em class="parameter"><code>b</code></em>: i.e.
+      <code class="constant">b-&gt;current</code>.  When the function returns,
+      the address of the first byte of the encoded string is returned
+      via <em class="parameter"><code>*c</code></em> and the length of that string is
+      given by <em class="parameter"><code>*len</code></em>.  The buffer's current
+      pointer is advanced to point at the character following the
+      string length, the encoded string, and the trailing
+      <span class="type">NULL</span> character.
+    </p>
+<p><code class="function">lwres_addr_parse()</code>
+      extracts an address from the buffer <em class="parameter"><code>b</code></em>.
+      The buffer's current pointer <code class="constant">b-&gt;current</code>
+      is presumed to point at an encoded address: the address preceded
+      by a 32-bit protocol family identifier and a 16-bit length
+      field.  The encoded address is copied to
+      <code class="constant">addr-&gt;address</code> and
+      <code class="constant">addr-&gt;length</code> indicates the size in bytes
+      of the address that was copied.
+      <code class="constant">b-&gt;current</code> is advanced to point at the
+      next byte of available data in the buffer following the encoded
+      address.
+    </p>
+<p><code class="function">lwres_getaddrsbyname()</code>
+      and <code class="function">lwres_getnamebyaddr()</code> use the
+      <span class="type">lwres_gnbaresponse_t</span> structure defined below:
+    </p>
 <pre class="programlisting">
 typedef struct {
         lwres_uint32_t          flags;
@@ -191,85 +178,81 @@ typedef struct {
 } lwres_gabnresponse_t;
 </pre>
 <p>
-The contents of this structure are not manipulated directly but
-they are controlled through the
-<span class="citerefentry"><span class="refentrytitle">lwres_gabn</span>(3
-)</span>
-functions.
-</p>
-<p>
-The lightweight resolver uses
-<code class="function">lwres_getaddrsbyname()</code> to perform foward lookups.
-Hostname <em class="parameter"><code>name</code></em> is looked up using the resolver
-context <em class="parameter"><code>ctx</code></em> for memory allocation.
-<em class="parameter"><code>addrtypes</code></em> is a bitmask indicating which type of
-addresses are to be looked up.  Current values for this bitmask are
-<span class="type">LWRES_ADDRTYPE_V4</span> for IPv4 addresses and
-<span class="type">LWRES_ADDRTYPE_V6</span> for IPv6 addresses.  Results of the
-lookup are returned in <em class="parameter"><code>*structp</code></em>.
-</p>
+      The contents of this structure are not manipulated directly but
+      they are controlled through the
+      <span class="citerefentry"><span class="refentrytitle">lwres_gabn</span>(3)</span>
+      functions.
+    </p>
 <p>
-<code class="function">lwres_getnamebyaddr()</code> performs reverse lookups.
-Resolver context <em class="parameter"><code>ctx</code></em> is used for memory
-allocation.  The address type is indicated by
-<em class="parameter"><code>addrtype</code></em>: <span class="type">LWRES_ADDRTYPE_V4</span> or
-<span class="type">LWRES_ADDRTYPE_V6</span>.  The address to be looked up is given
-by <em class="parameter"><code>addr</code></em> and its length is
-<em class="parameter"><code>addrlen</code></em> bytes.  The result of the function call
-is made available through <em class="parameter"><code>*structp</code></em>.
-</p>
+      The lightweight resolver uses
+      <code class="function">lwres_getaddrsbyname()</code> to perform
+      foward lookups.
+      Hostname <em class="parameter"><code>name</code></em> is looked up using the
+      resolver
+      context <em class="parameter"><code>ctx</code></em> for memory allocation.
+      <em class="parameter"><code>addrtypes</code></em> is a bitmask indicating
+      which type of
+      addresses are to be looked up.  Current values for this bitmask are
+      <span class="type">LWRES_ADDRTYPE_V4</span> for IPv4 addresses and
+      <span class="type">LWRES_ADDRTYPE_V6</span> for IPv6 addresses.  Results of the
+      lookup are returned in <em class="parameter"><code>*structp</code></em>.
+    </p>
+<p><code class="function">lwres_getnamebyaddr()</code>
+      performs reverse lookups.  Resolver context
+      <em class="parameter"><code>ctx</code></em> is used for memory allocation.  The
+      address type is indicated by <em class="parameter"><code>addrtype</code></em>:
+      <span class="type">LWRES_ADDRTYPE_V4</span> or
+      <span class="type">LWRES_ADDRTYPE_V6</span>.  The address to be looked up is
+      given by <em class="parameter"><code>addr</code></em> and its length is
+      <em class="parameter"><code>addrlen</code></em> bytes.  The result of the
+      function call is made available through
+      <em class="parameter"><code>*structp</code></em>.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549693"></a><h2>RETURN VALUES</h2>
-<p>
-Successful calls to
-<code class="function">lwres_string_parse()</code>
-and
-<code class="function">lwres_addr_parse()</code>
-return
-<span class="errorcode">LWRES_R_SUCCESS.</span>
-Both functions return
-<span class="errorcode">LWRES_R_FAILURE</span>
-if the buffer is corrupt or
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-if the buffer has less space than expected for the components of the
-encoded string or address.
-</p>
+<a name="id2543605"></a><h2>RETURN VALUES</h2>
 <p>
-<code class="function">lwres_getaddrsbyname()</code>
-returns
-<span class="errorcode">LWRES_R_SUCCESS</span>
-on success and it returns
-<span class="errorcode">LWRES_R_NOTFOUND</span>
-if the hostname
-<em class="parameter"><code>name</code></em>
-could not be found.
-</p>
+      Successful calls to
+      <code class="function">lwres_string_parse()</code>
+      and
+      <code class="function">lwres_addr_parse()</code>
+      return
+      <span class="errorcode">LWRES_R_SUCCESS.</span>
+      Both functions return
+      <span class="errorcode">LWRES_R_FAILURE</span>
+      if the buffer is corrupt or
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      if the buffer has less space than expected for the components of the
+      encoded string or address.
+    </p>
+<p><code class="function">lwres_getaddrsbyname()</code>
+      returns <span class="errorcode">LWRES_R_SUCCESS</span> on success and it
+      returns <span class="errorcode">LWRES_R_NOTFOUND</span> if the hostname
+      <em class="parameter"><code>name</code></em> could not be found.
+    </p>
+<p><span class="errorcode">LWRES_R_SUCCESS</span>
+      is returned by a successful call to
+      <code class="function">lwres_getnamebyaddr()</code>.
+    </p>
 <p>
-<span class="errorcode">LWRES_R_SUCCESS</span>
-is returned by a successful call to
-<code class="function">lwres_getnamebyaddr()</code>.
-</p>
-<p>
-Both
-<code class="function">lwres_getaddrsbyname()</code>
-and
-<code class="function">lwres_getnamebyaddr()</code>
-return
-<span class="errorcode">LWRES_R_NOMEMORY</span>
-when memory allocation requests fail and
-<span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
-if the buffers used for sending queries and receiving replies are too
-small.
-</p>
+      Both
+      <code class="function">lwres_getaddrsbyname()</code>
+      and
+      <code class="function">lwres_getnamebyaddr()</code>
+      return
+      <span class="errorcode">LWRES_R_NOMEMORY</span>
+      when memory allocation requests fail and
+      <span class="errorcode">LWRES_R_UNEXPECTEDEND</span>
+      if the buffers used for sending queries and receiving replies are too
+      small.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2549763"></a><h2>SEE ALSO</h2>
-<p>
-<span class="citerefentry"><span class="refentrytitle">lwres_buffer</span>(3)</span>,
+<a name="id2543676"></a><h2>SEE ALSO</h2>
+<p><span class="citerefentry"><span class="refentrytitle">lwres_buffer</span>(3)</span>,
 
-<span class="citerefentry"><span class="refentrytitle">lwres_gabn</span>(3)</span>.
-</p>
+      <span class="citerefentry"><span class="refentrytitle">lwres_gabn</span>(3)</span>.
+    </p>
 </div>
 </div></body>
 </html>
diff --git a/contrib/bind9/lib/lwres/print.c b/contrib/bind9/lib/lwres/print.c
index 1552228..49da037 100644
--- a/contrib/bind9/lib/lwres/print.c
+++ b/contrib/bind9/lib/lwres/print.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: print.c,v 1.2.4.7 2005/10/14 01:38:51 marka Exp $ */
+/* $Id: print.c,v 1.2.2.7 2005/10/14 01:28:30 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/lwres/print_p.h b/contrib/bind9/lib/lwres/print_p.h
index 4e27e55..4c2d2bf 100644
--- a/contrib/bind9/lib/lwres/print_p.h
+++ b/contrib/bind9/lib/lwres/print_p.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: print_p.h,v 1.2.4.1 2004/08/28 06:25:25 marka Exp $ */
+/* $Id: print_p.h,v 1.2.2.1 2004/08/28 06:21:13 marka Exp $ */
 
 #ifndef LWRES_PRINT_P_H
 #define LWRES_PRINT_P_H 1
diff --git a/contrib/bind9/lib/lwres/strtoul.c b/contrib/bind9/lib/lwres/strtoul.c
index 9cda194..3fc8971 100644
--- a/contrib/bind9/lib/lwres/strtoul.c
+++ b/contrib/bind9/lib/lwres/strtoul.c
@@ -53,7 +53,7 @@
 static char sccsid[] = "@(#)strtoul.c	8.1 (Berkeley) 6/4/93";
 #endif /* LIBC_SCCS and not lint */
 
-/* $Id: strtoul.c,v 1.2.4.1 2005/06/08 02:08:31 marka Exp $ */
+/* $Id: strtoul.c,v 1.2.2.1 2005/06/08 02:07:59 marka Exp $ */
 
 #include <config.h>
 
diff --git a/contrib/bind9/lib/lwres/unix/Makefile.in b/contrib/bind9/lib/lwres/unix/Makefile.in
index b734bc1..577e3d3 100644
--- a/contrib/bind9/lib/lwres/unix/Makefile.in
+++ b/contrib/bind9/lib/lwres/unix/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.1.206.1 2004/03/06 08:15:43 marka Exp $
+# $Id: Makefile.in,v 1.2 2004/03/05 05:12:59 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/lwres/unix/include/Makefile.in b/contrib/bind9/lib/lwres/unix/include/Makefile.in
index 8f3798e..8ca7489 100644
--- a/contrib/bind9/lib/lwres/unix/include/Makefile.in
+++ b/contrib/bind9/lib/lwres/unix/include/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.1.206.1 2004/03/06 08:15:43 marka Exp $
+# $Id: Makefile.in,v 1.2 2004/03/05 05:13:03 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/lwres/unix/include/lwres/Makefile.in b/contrib/bind9/lib/lwres/unix/include/lwres/Makefile.in
index e969f50..7e0b594 100644
--- a/contrib/bind9/lib/lwres/unix/include/lwres/Makefile.in
+++ b/contrib/bind9/lib/lwres/unix/include/lwres/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.1.206.1 2004/03/06 08:15:43 marka Exp $
+# $Id: Makefile.in,v 1.2 2004/03/05 05:13:06 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/contrib/bind9/lib/lwres/unix/include/lwres/net.h b/contrib/bind9/lib/lwres/unix/include/lwres/net.h
index b214de6..8fb14ee 100644
--- a/contrib/bind9/lib/lwres/unix/include/lwres/net.h
+++ b/contrib/bind9/lib/lwres/unix/include/lwres/net.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: net.h,v 1.3.12.3 2004/03/08 09:05:12 marka Exp $ */
+/* $Id: net.h,v 1.5.18.2 2005/04/29 00:17:23 marka Exp $ */
 
 #ifndef LWRES_NET_H
 #define LWRES_NET_H 1
@@ -24,17 +24,15 @@
  ***** Module Info
  *****/
 
-/*
- * Basic Networking Types
- *
+/*! \file net.h
  * This module is responsible for defining the following basic networking
  * types:
  *
- *		struct in_addr
- *		struct in6_addr
- *		struct sockaddr
- *		struct sockaddr_in
- *		struct sockaddr_in6
+ *\li		struct in_addr
+ *\li		struct in6_addr
+ *\li		struct sockaddr
+ *\li		struct sockaddr_in
+ *\li		struct sockaddr_in6
  *
  * It ensures that the AF_ and PF_ macros are defined.
  *
@@ -42,7 +40,7 @@
  *
  * It declares lwres_net_aton(), lwres_net_ntop(), and lwres_net_pton().
  *
- * It ensures that INADDR_LOOPBACK, INADDR_ANY and IN6ADDR_ANY_INIT
+ * It ensures that #INADDR_LOOPBACK, #INADDR_ANY and #IN6ADDR_ANY_INIT
  * are defined.
  */
 
@@ -79,7 +77,7 @@
 #define in6_addr in_addr6	/* Required for pre RFC2133 implementations. */
 #endif
 
-/*
+/*!
  * Required for some pre RFC2133 implementations.
  * IN6ADDR_ANY_INIT and IN6ADDR_LOOPBACK_INIT were added in
  * draft-ietf-ipngwg-bsd-api-04.txt or draft-ietf-ipngwg-bsd-api-05.txt.  
@@ -94,6 +92,9 @@
 #endif
 #endif
 
+/*!
+ * Initialize address loopback.  See IN6ADDR_ANY_INIT
+ */
 #ifndef IN6ADDR_LOOPBACK_INIT
 #ifdef s6_addr
 #define IN6ADDR_LOOPBACK_INIT { { { 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 } } }
@@ -102,14 +103,18 @@
 #endif
 #endif
 
+/*% Used by AI_ALL */
 #ifndef AF_INET6
 #define AF_INET6 99
 #endif
 
+
+/*% Used to return IPV6 address types. */
 #ifndef PF_INET6
 #define PF_INET6 AF_INET6
 #endif
 
+/*% inaddr Loopback */
 #ifndef INADDR_LOOPBACK
 #define INADDR_LOOPBACK 0x7f000001UL
 #endif
diff --git a/contrib/bind9/lib/lwres/version.c b/contrib/bind9/lib/lwres/version.c
index ac3e6c8..33561fd 100644
--- a/contrib/bind9/lib/lwres/version.c
+++ b/contrib/bind9/lib/lwres/version.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -15,7 +15,9 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: version.c,v 1.6.12.3 2004/03/08 09:05:11 marka Exp $ */
+/* $Id: version.c,v 1.8.18.2 2005/04/29 00:17:21 marka Exp $ */
+
+/*! \file */
 
 #include <lwres/version.h>