Virgin import of BIND v8.2.4-REL

57 files changed, 804 insertions, 403 deletions

diff --git a/contrib/bind/CHANGES b/contrib/bind/CHANGES
index 4952477..4a1f47d 100644
--- a/contrib/bind/CHANGES
+++ b/contrib/bind/CHANGES
@@ -1,3 +1,169 @@
+	--- 8.2.4-REL released --- (Wed May  9 14:36:23 PDT 2001)
+
+1212.	[bug]		some function declarations wern't protected by
+			__BEGIN_DECL/__END_DECL in resolv.h.
+
+1211.	[port]		next: openstep is now supported as well as nextstep.
+
+1210.	[port]		add: SCO Unix 5.0.6.
+
+1209.	[port]		winnt: issues.
+
+	--- 8.2.4-T2B released --- (Thu May  3 05:48:14 PDT 2001)
+
+1207.	[contrib]	new h2n from author.
+
+1206.	[bug]		ixfr_getdelta() uninitialised variable used.
+
+1205.	[bug]		parse_cert_rr() passes wrong buffer size to b64_pton().
+
+1204.	[bug]		memory leak: pathname leaked specifing controls unix.
+
+1203.	[bug]		detect corrupted ixfr logs.
+
+1202.	[bug]		memory leak: dynamic update was leaking.
+
+1200.	[bug]		memory leak: when following CNAMES from of req_query().
+
+1199.	[bug]		memory leak: when defining keys.
+
+1195.	[bug]		memory leak: include in named.conf leaked file name.
+
+1194.	[port]		MPE/IX port updated by Mark Bixby of the
+			HP CSY MPE/iX Internet & Interoperability Team.
+
+1193.	[port]		winnt: path separator.
+
+1192.	[bug]		winnt: fix accept failures.
+
+1191.	[port]		winnt: a CLI tool for controling named 'BINDcmd' now
+			exists.
+
+1190.	[contrib]	nslint upgraded from 1.5.1 to 2.0.2 (by author).
+
+1189.	[port]		redo #1146 to cope w/ differing gettimeofday()
+			function signatures.
+
+1188.	[bug]		memory leak when removing multiple records via dynamic
+			updates.
+
+	--- 8.2.4-T1B released --- (Thu Apr 19 14:38:30 PDT 2001)
+
+1187.	[support]	Don't accept in a query names which would be rejected
+			in responses.
+
+1186.	[bug]		DNSSEC key ids were computed incorrectly.
+
+1185.	[bug]		remember if a notify came in while a zone transfer is
+			in progress and perform a refresh check after the
+			transfer completes.
+
+	--- 8.2.4-T1A released --- (Sun Apr  1 12:15:48 PDT 2001)
+
+1184.	[support]	notify delay limit now "nzones" rather than "nzones/5".
+
+1183.	[port]		new port/cygwin contributed by s_c_biggs@bigfoot.com.
+
+1182.	[contrib]	new contrib/mdnkit (V1.3) from author.
+
+1181.	[bug]		dig -T was only delaying after the first batched query.
+
+1180.	[bug]		NSAP processing did not support leading 0x as required
+			by RFC 1706.
+
+1179.	[contrib]	new contrib/adm from official ftp site.
+
+1178.	[contrib]	new contrib/host from author.
+
+1177.	[contrib]	new contrib/dnsp from author.
+
+1176.	[bug]		fix memory and file descriptor leaks.
+
+1175.	[bug]		statp->nsort could fail to be re-initialised if
+			resolv.conf goes away.
+
+1174.	[port]		winnt: missing call to sockout() in close().
+
+1173.	[bug]		suppress repeated notifies when a nameserver is a
+			CNAME.
+
+1172.	[bug]		allow res_{n}update to take a single unlinked element.
+
+1171.	[doc]		rfc2308-type1 applies to answers from the cache.
+
+1170.	[port]		winnt: does not have unix domain sockets.
+
+1171.	[bug]		xfers_deferred could become out of sync.
+
+1170.	[bug]		check the family before using a cached result from
+			gethostbyname*().
+
+1169.	[cleanup]	namespace cleanup of prand_conf.
+
+1168.	[port]		fix ctk ORD_32 problem on some HPUX 10.20 systems.
+
+1167.	[support]	note possible HAVE_STRNDUP need for AIX4.
+
+1166.	[bug]		bad $TTL could kill the contributed dns_signer.
+
+1165.	[func]		INITIALZONES tuning for large servers (> 1000 zones).
+
+1164.	[bug]		the resolver could leak a file descriptors under
+			certain conditions.
+
+1163.	[func]		ns_critical() is now available.
+
+1162.	[port]		winnt: add strerror.
+
+1161.	[support]	log out of memory during zone transfers.
+
+1160.	[support]	extend "Response from unexpected source" message.
+
+1159.	[doc]		query-source is used for TCP and that the port is
+			ignored.
+
+1158.	[func]		add A6, DNAME, SINK and OPT to list of known RR types
+			in res_debug.
+
+1157.	[perf]		add more ns_wouldlog() calls on mainline.
+
+1156.	[bug]		don't use a known bogus key name.
+
+1155.	[support]	log possible "TSIG BUG" exploit attempts.  Requires
+			LOG_TSIG_BUG to be defined in bin/named/named.h.
+
+1154.	[bug]		RFC2317 support was broken in bin/host command again.
+
+1153.	[support]	be more consist with the use of slave vs secondary.
+
+1152.	[bug]		ixfr processing could leave Z_XFER_RUNNING set.
+
+1151.	[bug]		failed to correctly parse the orginal ttl in SIG
+			records.
+
+1150.	[bug]		forwarders: it was possible to use freed memory.
+
+1149.	[support]	zone rejected message to error level.
+
+1148.	[bug]		non-glue now logged to category load.
+
+1147.	[bug]		handle notify w/ SOA records better.
+
+1146.	[support]	be more gentle in handling bad system clocks.
+
+1145.	[port]		solaris: 2.4 does not have pthreads.
+
+1144.	[support]	log class w/ denied messages.
+
+1143.	[bug]		only use the query-source address, not port, for TCP
+			connections.
+
+1142.	[doc]		document change #924 better (doc/html/controls.html).
+
+1141.	[bug]		DESTDIR is not part of the nslookup help file path.
+
+1140.	[bug]		only reset interval timers if the value has changed.
+
 	--- 8.2.3-REL released ---
 
 1139.	[bug]		inet_{net_,}ntop() had an off-by-one error.
diff --git a/contrib/bind/INSTALL b/contrib/bind/INSTALL
index ca09497..ed7157c 100644
--- a/contrib/bind/INSTALL
+++ b/contrib/bind/INSTALL
@@ -60,7 +60,7 @@ Building
 
 		make depend
 
-	NOTE: "make depend" is a NO-OP for these platforms: AIX, HPUX and NeXT.
+	NOTE: "make depend" is a NO-OP for some platforms, but always harmless.
 
 	Finally,
 
@@ -137,12 +137,27 @@ Operating System Notes
 
 		Build problems have been reported with the AIX "make".
 		We recommend using GNU "make" instead.
+
+	AIX4 with Linux Compatibility API
+
+		May need to define HAVE_STRNDUP in
+		port/aix4/include/port_after.h.
 	
 	FreeBSD, NetBSD, OpenBSD and BSDI
+
 		The kit should compile even if you have intalled the KAME
 		IPv6 kit.
 
+	HPUX
+
+		If you are using gcc you may have to remove the '-ansi'
+		flag.  This is gcc version dependent.
+
+		HPUX 10.20 early versions of the HP C/ANSI C compiler do
+		not work, version B.10.20.15 in known to work.
+
 	IRIX
+
 		build problems have been reported w/ IRIX 6.3, res_debug.c
 		and #include <stdlib.h>.  You may need to comment out
 		the #include <stdlib.h> and declare
diff --git a/contrib/bind/Makefile b/contrib/bind/Makefile
index 3596dd4..45d4b0b 100644
--- a/contrib/bind/Makefile
+++ b/contrib/bind/Makefile
@@ -1,4 +1,4 @@
-## Copyright (c) 1996,1999 by Internet Software Consortium.
+## Copyright (c) 1996,1999 by Internet Software Consortium, Inc.
 ##
 ## Permission to use, copy, modify, and distribute this software for any
 ## purpose with or without fee is hereby granted, provided that the above
@@ -13,56 +13,58 @@
 ## ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 ## SOFTWARE.
 
-# $Id: Makefile,v 8.52 2000/11/21 12:54:37 marka Exp $
+# $Id: Makefile,v 1.10 2000/11/13 02:26:12 vixie Exp $
 
-TOP=
-SUBDIRS= include port lib bin
+# This is just for making distributions.  For the real Makefile, cd src.
 
-SH=sh
+all clean depend: FRC
+	@echo go to the ./src directory, you cannot make '"'$@'"' here.
+	@false
 
-default: all
+tar: bind-doc.tar.gz bind-src.tar.gz bind-contrib.tar.gz
 
-all clean depend install distclean:: FRC
-	@set -e; \
-	version=`cat ${TOP}Version`; \
-	systype=`${SH} ${TOP}port/systype ${TOP}.systype`; \
-	if [ $$systype = "unknown" ]; then \
-		echo "There is no BIND port for this system in this kit."; \
-	else \
-		settings=`${SH} ${TOP}port/settings ${TOP}.settings \
-			< ${TOP}port/$$systype/Makefile.set`; \
-		PATH=`pwd`/port/$$systype/bin:$$PATH; export PATH; \
-		for x in ${SUBDIRS}; do \
-			( cd $$x; pwd; \
-			  eval "${MAKE} $$settings ${MARGS} SYSTYPE=$$systype \
-				VER=$$version \
-				$@"; \
-			) || exit 1; \
-		done \
-	fi
+pgp: bind-doc.tar.gz.asc bind-src.tar.gz.asc bind-contrib.tar.gz.asc
 
-clean distclean::
-	rm -f .systype .settings
+bind-doc.tar.gz: Makefile
+	cd doc/bog; make clean file.psf file.lst
+	cd doc/man; make clean all
+	cd doc/man; make MANROFF="groff -t" OUT_EXT=psf clean all
+	tar cf - Makefile doc | gzip > bind-doc.tar.gz
+	cd doc/man; make clean
+	cd doc/man; make MANROFF="groff -t" OUT_EXT=psf clean
 
-links: FRC
-	@set -e; mkdir ${DST}; cd ${DST}; pwd; ln -s ${SRC} SRC; \
-	ln -s SRC/Version .; cp SRC/Makefile .; chmod +w Makefile; \
-	systype=`${SH} SRC/port/systype`; \
-	for x in ${SUBDIRS} ; do \
-		( mkdir $$x; cd $$x; pwd; ln -s ../SRC/$$x SRC; \
-		  cp SRC/Makefile Makefile; chmod +w Makefile; \
-		  ${MAKE} ${MARGS} SYSTYPE=$$systype links; \
-		) || exit 1; \
-	done
+bind-src.tar.gz: Makefile
+	cd src; make distclean
+	cd src/bin/nslookup; make commands.c
+	cd src/bin/named; make ns_parser.c
+	tar cf - Makefile src | gzip > bind-src.tar.gz
 
-stdlinks: FRC
-	if [ ! -d /var/obj ]; then \
-		mkdir /var/obj; \
-	fi
-	${MAKE} ${MARGS} SRC=`pwd` DST=/var/obj/bind links
+bind-contrib.tar.gz: Makefile
+	tar cf - Makefile contrib | gzip > bind-contrib.tar.gz
 
-uplinks: FRC
-	@set -e; systype=`${SH} ${TOP}port/systype`; pwd=`pwd`; \
-	${MAKE} ${MARGS} SRC=../`basename $$pwd` "DST=../$$systype" links
+bind-doc.tar.gz.asc: bind-doc.tar.gz
+	rm -f bind-doc.tar.gz.asc
+	pgp -u pgpkey@isc.org -sba bind-doc.tar.gz
+	chmod o+r bind-doc.tar.gz.asc
+
+bind-src.tar.gz.asc: bind-src.tar.gz
+	rm -f bind-src.tar.gz.asc
+	pgp -u pgpkey@isc.org -sba bind-src.tar.gz
+	chmod o+r bind-src.tar.gz.asc
+
+bind-contrib.tar.gz.asc: bind-contrib.tar.gz
+	rm -f bind-contrib.tar.gz.asc
+	pgp -u pgpkey@isc.org -sba bind-contrib.tar.gz
+	chmod o+r bind-contrib.tar.gz.asc
+
+noesw: src/Version src/lib/Makefile src/lib/dst/Makefile \
+	src/lib/cylink/. src/lib/dnssafe/.
+	perl -pi.BAK -e 's/$$/-NOESW/' src/Version
+	perl -pi.BAK -e 's/ cylink dnssafe//' src/lib/Makefile
+	perl -pi.BAK -e 's:-I../cylink::' src/lib/dst/Makefile
+	perl -pi.BAK -e 's:-I../dnssafe::' src/lib/dst/Makefile
+	perl -pi.BAK -e 's/-DCYLINK_DSS//' src/lib/dst/Makefile
+	perl -pi.BAK -e 's/-DDNSSAFE//' src/lib/dst/Makefile
+	rm -rf src/lib/cylink src/lib/dnssafe
 
 FRC:
diff --git a/contrib/bind/README b/contrib/bind/README
index 2f1e34f..2a8efb3 100644
--- a/contrib/bind/README
+++ b/contrib/bind/README
@@ -10,6 +10,21 @@ artifacts including BIND, INN, and DHCP.
 Note that BIND 8 is in "end-of-life", having been replaced by BIND 9.  See
 http://www.isc.org/ for more details.
 
+BIND 8.2.4 Highlights
+	NSAP processing was not RFC 1706 compliant. NOTE: OLD MASTER FILES
+	NEED TO BE CORRECTED (0x added to NSAP) AND CACHE FILES REMOVED.
+	Fixes long-standing protocol incompatibility in DNSSEC support.
+	Avoids fwd'ing to root name servers if response will be rejected.
+	new port/cygwin contributed by s_c_biggs@bigfoot.com.
+	new contrib/mdnkit (V1.3) from author.
+	new contrib/adm from official ftp site.
+	new contrib/host from author.
+	new contrib/dnsp from author.
+	fixed file descriptor leak in resolver.
+	fixed a major memory leak in the processing of dynamic updates.
+	numerous portability improvements.
+	numerous bug fixes.
+
 BIND 8.2.3 Highlights
 
 	Improved support for Windows NT and Windows 2000.
diff --git a/contrib/bind/Version b/contrib/bind/Version
index 4dc051b..a2b632d 100644
--- a/contrib/bind/Version
+++ b/contrib/bind/Version
@@ -1 +1 @@
-8.2.3-REL
+8.2.4-REL
diff --git a/contrib/bind/bin/dig/dig.c b/contrib/bind/bin/dig/dig.c
index 01d87a9..f8030fd 100644
--- a/contrib/bind/bin/dig/dig.c
+++ b/contrib/bind/bin/dig/dig.c
@@ -1,5 +1,5 @@
 #ifndef lint
-static const char rcsid[] = "$Id: dig.c,v 8.44 2000/12/23 08:14:31 vixie Exp $";
+static const char rcsid[] = "$Id: dig.c,v 8.46 2001/04/01 17:35:01 vixie Exp $";
 #endif
 
 /*
@@ -346,7 +346,6 @@ main(int argc, char **argv) {
 
 	res.id = 1;
 	gettimeofday(&tv1, NULL);
-	assert(tv1.tv_usec >= 0 && tv1.tv_usec < 1000000);
 
 /*
  * Main section: once if cmd-line query
@@ -862,7 +861,6 @@ main(int argc, char **argv) {
 		if (res.pfcode & RES_PRF_HEAD1)
 			fp_resstat(&res, stdout);
 		(void) gettimeofday(&start_time, NULL);
-		assert(start_time.tv_usec >= 0 && start_time.tv_usec < 1000000);
 		if (keyfile)
 			n = res_nsendsigned(&res, packet, n, &key, answer, sizeof answer);
 		else
@@ -887,7 +885,6 @@ main(int argc, char **argv) {
 			}
 		}
 		(void) gettimeofday(&end_time, NULL);
-		assert(end_time.tv_usec >= 0 && end_time.tv_usec < 1000000);
 
 		if (res.pfcode & RES_PRF_STATS) {
 			query_time = difftv(start_time, end_time);
@@ -919,11 +916,11 @@ main(int argc, char **argv) {
  * batches started at different sites somewhat synchronized.
  */
 		gettimeofday(&tv2, NULL);
-		assert(tv2.tv_usec >= 0 && tv2.tv_usec < 1000000);
 		delay = (int)(tv2.tv_sec - tv1.tv_sec);
 		if (delay < wait) {
 			sleep(wait - delay);
 		}
+		tv1 = tv2;
 	}
 	return (eecode);
 }
@@ -964,7 +961,7 @@ where:	server,\n\
 	fputs("\
 notes:	defname and search don't work; use fully-qualified names.\n\
 	this is DiG version " VSTRING "\n\
-	$Id: dig.c,v 8.44 2000/12/23 08:14:31 vixie Exp $\n\
+	$Id: dig.c,v 8.46 2001/04/01 17:35:01 vixie Exp $\n\
 ", stderr);
 }
 
diff --git a/contrib/bind/bin/dnskeygen/dnskeygen.c b/contrib/bind/bin/dnskeygen/dnskeygen.c
index f226a6f..593fb00 100644
--- a/contrib/bind/bin/dnskeygen/dnskeygen.c
+++ b/contrib/bind/bin/dnskeygen/dnskeygen.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: dnskeygen.c,v 1.11 2000/12/23 08:14:31 vixie Exp $";
+static const char rcsid[] = "$Id: dnskeygen.c,v 1.11.2.1 2001/04/26 02:56:06 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -33,6 +33,9 @@ static const char rcsid[] = "$Id: dnskeygen.c,v 1.11 2000/12/23 08:14:31 vixie E
 #include "port_after.h"
 
 #define PRINT_SUPPORTED 2
+#ifndef PATH_SEP
+#define PATH_SEP '/'
+#endif
 
 static void usage(char *str, int full);
 
@@ -54,7 +57,7 @@ main(int argc, char **argv) {
 	extern char *optarg;
 
 	dst_init();
-	if ((prog = strrchr(argv[0],'/')) == NULL)
+	if ((prog = strrchr(argv[0], PATH_SEP)) == NULL)
 		prog = strdup(argv[0]);
 	else
 		prog = strdup(++prog);
diff --git a/contrib/bind/bin/host/host.c b/contrib/bind/bin/host/host.c
index adb4feb..9303ab1 100644
--- a/contrib/bind/bin/host/host.c
+++ b/contrib/bind/bin/host/host.c
@@ -1,5 +1,5 @@
 #ifndef lint
-static const char rcsid[] = "$Id: host.c,v 8.42 2000/12/23 08:14:32 vixie Exp $";
+static const char rcsid[] = "$Id: host.c,v 8.43.2.1 2001/04/26 02:56:07 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -115,6 +115,9 @@ static const char copyright[] =
 
 /* Global. */
 
+#ifndef PATH_SEP
+#define PATH_SEP '/'
+#endif
 #define SIG_RDATA_BY_NAME	18
 #define NS_HEADERDATA_SIZE 10
 
@@ -190,7 +193,7 @@ static int		getdomaininfo(const char *name, const char *domain);
 static int		getinfo(const char *name, const char *domain,
 				int type);
 static int		printinfo(const querybuf *answer, const u_char *eom,
-				  int filter, int isls);
+				  int filter, int isls, int isinaddr);
 static const u_char *	pr_rr(const u_char *cp, const u_char *msg, FILE *file,
 			      int filter);
 static const char *	pr_type(int type);
@@ -231,7 +234,7 @@ main(int argc, char **argv) {
 
 	dst_init();
 
-	if ((progname = strrchr(argv[0], '/')) == NULL)
+	if ((progname = strrchr(argv[0], PATH_SEP)) == NULL)
 		progname = argv[0];
 	else
 		progname++;
@@ -630,11 +633,13 @@ getinfo(const char *name, const char *domain, int type) {
 		return (0);
 	}
 	eom = answer.qb2 + n;
-	return (printinfo(&answer, eom, ns_t_any, 0));
+	return (printinfo(&answer, eom, ns_t_any, 0, (type == ns_t_ptr)));
 }
 
 static int
-printinfo(const querybuf *answer, const u_char *eom, int filter, int isls) {
+printinfo(const querybuf *answer, const u_char *eom, int filter, int isls,
+	  int isinaddr)
+{
 	int n, nmx, ancount, nscount, arcount, qdcount, buflen, savesigchase;
 	const u_char *bp, *cp;
 	const HEADER *hp;
@@ -705,7 +710,7 @@ printinfo(const querybuf *answer, const u_char *eom, int filter, int isls) {
 			 * don't really want to print the address at this
 			 * point.
 			 */
-                        if (cname && ! verbose)
+                        if (cname && (!verbose) && (!isinaddr))
                                 return (1);
                 }
 	}
@@ -1881,7 +1886,7 @@ ListHosts(char *namePtr, int queryType) {
 			break;
 		}
 
-		result = printinfo(&buf, cp, queryType, 1);
+		result = printinfo(&buf, cp, queryType, 1, 0);
 		if (! result) {
 			error = ERR_PRINTING;
 			break;
diff --git a/contrib/bind/bin/named-xfer/named-xfer.c b/contrib/bind/bin/named-xfer/named-xfer.c
index 774adb9..1a08f7b 100644
--- a/contrib/bind/bin/named-xfer/named-xfer.c
+++ b/contrib/bind/bin/named-xfer/named-xfer.c
@@ -130,7 +130,7 @@ char copyright[] =
 
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)named-xfer.c	4.18 (Berkeley) 3/7/91";
-static const char rcsid[] = "$Id: named-xfer.c,v 8.104 2000/12/23 08:14:44 vixie Exp $";
+static const char rcsid[] = "$Id: named-xfer.c,v 8.105.2.1 2001/04/26 02:56:09 marka Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -169,6 +169,10 @@ static const char rcsid[] = "$Id: named-xfer.c,v 8.104 2000/12/23 08:14:44 vixie
 #include "port_after.h"
 
 
+#ifndef PATH_SEP
+#define PATH_SEP '/'
+#endif
+
 #define MAIN_PROGRAM
 #include "../named/named.h"
 #undef MAIN_PROGRAM
@@ -330,7 +334,7 @@ main(int argc, char *argv[]) {
 	set42sig();
 #endif
 	memset(&axfr_src, 0, sizeof axfr_src);
-	ProgName = strrchr(argv[0], '/');
+	ProgName = strrchr(argv[0], PATH_SEP);
 	if (ProgName != NULL)
 		ProgName++;
 	else
@@ -891,13 +895,13 @@ getzone(struct zoneinfo *zp, u_int32_t serial_no, int port) {
 		(void)fprintf(ddt,"getzone() %s ", zp->z_origin);
 		switch (zp->z_type) {
 		case Z_STUB:
-			fprintf(ddt,"stub\n");
+			fprintf(ddt, "stub\n");
 			break;
 		case Z_SECONDARY:
-			fprintf(ddt,"secondary\n");
+			fprintf(ddt, "slave\n");
 			break;
 		default:
-			fprintf(ddt,"unknown type\n");
+			fprintf(ddt, "unknown type\n");
 		}
 	}
 #endif
diff --git a/contrib/bind/bin/named/db_defs.h b/contrib/bind/bin/named/db_defs.h
index a3e9032..f18acae 100644
--- a/contrib/bind/bin/named/db_defs.h
+++ b/contrib/bind/bin/named/db_defs.h
@@ -1,6 +1,6 @@
 /*
  *	from db.h	4.16 (Berkeley) 6/1/90
- *	$Id: db_defs.h,v 8.40 2000/11/29 06:55:46 marka Exp $
+ *	$Id: db_defs.h,v 8.41 2001/02/08 02:05:50 marka Exp $
  */
 
 /*
@@ -119,7 +119,7 @@ struct databuf {
 					 * d_ttl is actually the time when
 					 * the record will expire.
 					 * otherwise (for authoritative
-					 * primary and secondary zones),
+					 * master and slave zones),
 					 * d_ttl is the time to live.
 					 */
 	unsigned	d_zone :ZONE_BITS; /* zone number or 0 for the cache */
diff --git a/contrib/bind/bin/named/db_dump.c b/contrib/bind/bin/named/db_dump.c
index 5bb9456..a350719 100644
--- a/contrib/bind/bin/named/db_dump.c
+++ b/contrib/bind/bin/named/db_dump.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_dump.c	4.33 (Berkeley) 3/3/91";
-static const char rcsid[] = "$Id: db_dump.c,v 8.48 2000/12/23 08:14:34 vixie Exp $";
+static const char rcsid[] = "$Id: db_dump.c,v 8.49 2001/02/06 06:42:19 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -217,11 +217,13 @@ zt_dump(FILE *fp) {
 static int
 fwd_dump(FILE *fp) {
 	int i;
+
 	fprintf(fp, ";; ++forwarders table++\n");
-	for (i=0;i<fwddata_count;i++) {
-		fprintf(fp,"; %s rtt=%d\n",
-			inet_ntoa(fwddata[i]->fwdaddr.sin_addr),
-			fwddata[i]->nsdata->d_nstime);
+	for (i = 0; i < fwddata_count; i++) {
+		if (fwddata[i] != NULL)
+			fprintf(fp,"; %s rtt=%d\n",
+				inet_ntoa(fwddata[i]->fwdaddr.sin_addr),
+				fwddata[i]->nsdata->d_nstime);
 	}
 	fprintf(fp, ";; --forwarders table--\n");
 	return (0);
diff --git a/contrib/bind/bin/named/db_ixfr.c b/contrib/bind/bin/named/db_ixfr.c
index 14385d6..e515075 100644
--- a/contrib/bind/bin/named/db_ixfr.c
+++ b/contrib/bind/bin/named/db_ixfr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static char     rcsid[] = "$Id: db_ixfr.c,v 8.23 2000/12/23 08:14:35 vixie Exp $";
+static char     rcsid[] = "$Id: db_ixfr.c,v 8.23.2.2 2001/05/03 03:53:18 marka Exp $";
 #endif
 
 /*
@@ -102,8 +102,8 @@ ixfr_get_change_list(struct zoneinfo *zp,
 		}
 		INIT_LINK(dl, d_link);
 		INIT_LIST(dl->d_changes);
-		ret = ixfr_getdelta(zp, fp, zp->z_ixfr_base, origin, &dl->d_changes,
-				    &old_serial, &new_serial);
+		ret = ixfr_getdelta(zp, fp, zp->z_ixfr_base, origin,
+				    &dl->d_changes, &old_serial, &new_serial);
 		switch (ret) {
 		case DBIXFR_ERROR:
 			ns_warning(ns_log_db, "Logical error in %s: unlinking", 
@@ -374,6 +374,7 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 	char           *dname, *cp, *cp1;
 	char            buf[MAXDATA];
 	u_int32_t       serial, ttl;
+	u_int32_t	current_serial;
 	int             nonempty_lineno = -1, prev_pktdone = 0, cont = 0,
 			inside_next = 0;
 	int             id;
@@ -481,6 +482,16 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 				*buf = '\0';
 			n = sscanf(cp, "origin %s class %s serial %lu",
 				   origin, sclass, &serial);
+			if (current_serial == 0)
+				current_serial = serial;
+			else if (current_serial != serial) {
+				ns_debug(ns_log_update, 1,
+					 "%s:line %d serial # askew %d %d",
+					 filename, lineno, serial,
+					 current_serial);
+				current_serial = serial;
+				err++;
+			}
 			if (n != 3 || ns_samename(origin, zp->z_origin) != 1)
 				err++;
 			if (cp)
@@ -647,8 +658,9 @@ ixfr_getdelta(struct zoneinfo *zp, FILE *fp, const char *filename, char *origin,
 					err++;
 					break;
 				}
-				if (opcode == ADD && i == 0)
+				if (opcode == ADD)
 					*new_serial = n;
+				current_serial = n;
 				PUTLONG(n, cp);
 				for (i = 0; i < 4; i++) {
 					if (!getword(buf, sizeof buf, fp, 1)) {
diff --git a/contrib/bind/bin/named/db_load.c b/contrib/bind/bin/named/db_load.c
index 0adb7ab..87bdaed 100644
--- a/contrib/bind/bin/named/db_load.c
+++ b/contrib/bind/bin/named/db_load.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_load.c	4.38 (Berkeley) 3/2/91";
-static const char rcsid[] = "$Id: db_load.c,v 8.110 2001/01/25 05:50:53 marka Exp $";
+static const char rcsid[] = "$Id: db_load.c,v 8.113.2.1 2001/05/03 03:26:48 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -271,7 +271,7 @@ db_load(const char *filename, const char *in_origin,
 		/* Any updates should be saved before we attempt to reload. */
 		INSIST((zp->z_flags & (Z_NEED_DUMP|Z_NEED_SOAUPDATE)) == 0);
 	case Z_HINT:
-		if(filename == NULL) {
+		if (filename == NULL) {
 		 	ns_error(ns_log_load,
 		 	    "Required filename not specified for Hint zone");
 		 	zp->z_flags |= Z_DB_BAD;
@@ -983,6 +983,9 @@ db_load(const char *filename, const char *in_origin,
 				break;
 
 			case ns_t_nsap:
+				if (buf[0] != '0' ||
+				    (buf[1] != 'x' && buf[1] != 'X'))
+					ERRTO("NSAP RR: no leading 0x");
 				n = inet_nsap_addr(buf, (u_char *)data,
 						   sizeof data);
 				if (n == 0)
@@ -1132,11 +1135,11 @@ db_load(const char *filename, const char *in_origin,
 		}
 		if (errs != 0) {
 			if (errs != -1)
-				ns_warning(ns_log_load,
+				ns_error(ns_log_load,
 		   "%s zone \"%s\" (%s) rejected due to errors (serial %u)",
-					   zoneTypeString(zp->z_type),
-					   zp->z_origin,
-					   p_class(zp->z_class), zp->z_serial);
+					 zoneTypeString(zp->z_type),
+					 zp->z_origin,
+					 p_class(zp->z_class), zp->z_serial);
 			if ((zp->z_flags & Z_NOTIFY) != 0)
 				ns_stopnotify(zp->z_origin, zp->z_class);
 			do_reload(zp->z_origin, zp->z_type, zp->z_class,
@@ -2178,8 +2181,7 @@ parse_sig_rr(char *buf, int buf_len, u_char *data, int data_size,
 	} else {
 		/* Parse and output OTTL; scan TEXP */
 		origTTL = wordtouint32(buf);
-		if (origTTL >= 0 || wordtouint32_error ||
-		    (origTTL > 0x7fffffff))
+		if (wordtouint32_error || (origTTL > 0x7fffffffU))
 			ERRTO("Original TTL value bad");
 		cp = &data[i];
 		PUTLONG(origTTL, cp);
@@ -2414,7 +2416,7 @@ parse_cert_rr(char *buf, int buf_len, u_char *data, int data_size,
 	}
 	else {
 		cp = &data[i];
-		certlen = b64_pton(buf, (u_char*)cp, sizeof(data) - i);
+		certlen = b64_pton(buf, (u_char*)cp, data_size - i);
 		if (certlen < 0)
 			ERRTO("CERT blob has encoding error");
 	}
diff --git a/contrib/bind/bin/named/db_update.c b/contrib/bind/bin/named/db_update.c
index b765c4d..d742fe9 100644
--- a/contrib/bind/bin/named/db_update.c
+++ b/contrib/bind/bin/named/db_update.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)db_update.c	4.28 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: db_update.c,v 8.45 2000/12/23 08:14:36 vixie Exp $";
+static const char rcsid[] = "$Id: db_update.c,v 8.46 2001/02/08 02:05:51 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -140,8 +140,8 @@ isRefByNS(const char *name, struct hashbuf *htp) {
  *		if you start at NS.CRL.. here, you're in the cache
  *	    DEC.COM SOA (primary)
  *	CRL.DEC.COM NS  (in primary)
- *	CRL.DEC.COM SOA (secondary)
- *	CRL.DEC.COM NS  (in secondary)
+ *	CRL.DEC.COM SOA (slave)
+ *	CRL.DEC.COM NS  (in slave)
  *		if you start at CRL.. here, you find the CRL.DEC.COM zone
  *		if you start at NS.CRL.. here, you're in the CRL.. zone
  */
@@ -504,7 +504,7 @@ db_update(const char *name,
 					 * being served by the same server.
 					 * named will send NS records for
 					 * sub.a.b.c during zone transfer of
-					 * a.b.c zone.  If we're secondary for
+					 * a.b.c zone.  If we're slave for
 					 * both zones, and we reload zone
 					 * a.b.c, we'll get the NS records
 					 * (and possibly A records to go with
diff --git a/contrib/bind/bin/named/named.h b/contrib/bind/bin/named/named.h
index e9e95fa..29a79fa 100644
--- a/contrib/bind/bin/named/named.h
+++ b/contrib/bind/bin/named/named.h
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: named.h,v 8.27 2000/04/21 06:54:04 vixie Exp $
+ * $Id: named.h,v 8.28 2001/02/12 05:56:15 marka Exp $
  */
 
 /* Options. Change them at your peril. */
@@ -44,6 +44,7 @@
 #define ALLOW_LONG_TXT_RDATA
 #define STRICT_RFC2308
 #undef BIND_ZXFR
+#undef LOG_TSIG_BUG
 
 #include <isc/assertions.h>
 #include <isc/list.h>
diff --git a/contrib/bind/bin/named/ns_config.c b/contrib/bind/bin/named/ns_config.c
index 82b4da6..c4bca96 100644
--- a/contrib/bind/bin/named/ns_config.c
+++ b/contrib/bind/bin/named/ns_config.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_config.c,v 8.118 2000/12/23 08:14:37 vixie Exp $";
+static const char rcsid[] = "$Id: ns_config.c,v 8.121 2001/02/08 02:05:53 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -688,8 +688,7 @@ update_zone_info(struct zoneinfo *zp, struct zoneinfo *new_zp) {
 			zoneinit(zp);
 		else {
 			/* 
-			** Force secondary to try transfer soon
-			** after SIGHUP.
+			** Force slave to try transfer soon after SIGHUP.
 			*/
 			if ((zp->z_flags & (Z_QSERIAL|Z_XFER_RUNNING)) == 0 &&
 			    reloading && !reconfiging) {
@@ -1525,25 +1524,43 @@ periodic_getnetconf(evContext ctx, void *uap, struct timespec due,
 	getnetconf(1);
 }
 
+static int clean_interval = 0;
+static int interface_interval = 0;
+static int stats_interval = 0;
+static int heartbeat_interval = 0;
+
 static void
 set_interval_timer(int which_timer, int interval) {
 	evTimerID *tid = NULL;
 	evTimerFunc func = NULL;
+	int changed = 0;
 
 	switch (which_timer) {
 	case CLEAN_TIMER:
+		if (clean_interval != interval)
+			changed = 1;
+		clean_interval = interval;
 		tid = &clean_timer;
 		func = ns_cleancache;
 		break;
 	case INTERFACE_TIMER:
+		if (interface_interval != interval)
+			changed = 1;
+		interface_interval = interval;
 		tid = &interface_timer;
 		func = periodic_getnetconf;
 		break;
 	case STATS_TIMER:
+		if (stats_interval != interval)
+			changed = 1;
+		stats_interval = interval;
 		tid = &stats_timer;
 		func = ns_logstats;
 		break;
 	case HEARTBEAT_TIMER:
+		if (heartbeat_interval != interval)
+			changed = 1;
+		heartbeat_interval = interval;
 		tid = &heartbeat_timer;
 		func = ns_heartbeat;
 		break;
@@ -1553,7 +1570,8 @@ set_interval_timer(int which_timer, int interval) {
 	}
 	if ((active_timers & which_timer) != 0) {
 		if (interval > 0) {
-			if (evResetTimer(ev, *tid, func, NULL, 
+			if (changed &&
+			    evResetTimer(ev, *tid, func, NULL, 
 					 evAddTime(evNowTime(), 
 						   evConsTime(interval, 0)),
 					 evConsTime(interval, 0)) < 0)
@@ -2259,41 +2277,59 @@ static struct fwddata *
 find_forwarder(struct in_addr address)
 {
 	struct fwddata *fdp;
+	struct fwddata **fdpp = NULL;
 	struct databuf *ns, *nsdata;
 	register int i;
 
-	for (i=0;i<fwddata_count; i++) {
-		fdp=fwddata[i];
-		if (memcmp(&fdp->fwdaddr.sin_addr,&address,sizeof(address))==0) {
+	for (i = 0; i < fwddata_count; i++) {
+		fdp = fwddata[i];
+		if (fdp == NULL) {
+			if (fdpp == NULL)
+				fdpp = &fwddata[i];
+			continue;
+		}
+		if (memcmp(&fdp->fwdaddr.sin_addr, &address,
+			   sizeof(address)) == 0) {
 			fdp->ref_count++;
-			return fdp;
+			return (fdp);
 		}
 	}
 
 	fdp = (struct fwddata *)memget(sizeof(struct fwddata));
 	if (!fdp)
 		panic("memget failed in find_forwarder", NULL);
+
 	fdp->fwdaddr.sin_family = AF_INET;
 	fdp->fwdaddr.sin_addr = address;
 	fdp->fwdaddr.sin_port = ns_port;
+
 	ns = fdp->ns = (struct databuf *)memget(sizeof(*ns));
 	if (!ns)
 		panic("memget failed in find_forwarder", NULL);
-	memset(ns,0,sizeof(*ns));
+	memset(ns, 0, sizeof(*ns));
+
 	nsdata = fdp->nsdata = (struct databuf *)memget(sizeof(*nsdata));
 	if (!nsdata)
 		panic("memget failed in find_forwarder", NULL);
-	memset(nsdata,0,sizeof(*nsdata));
+	memset(nsdata, 0, sizeof(*nsdata));
+
 	ns->d_type = T_NS; 
 	ns->d_class = C_IN;
-	ns->d_rcnt=1;
+	ns->d_rcnt = 1;
+
 	nsdata->d_type = T_A;
 	nsdata->d_class = C_IN;
 	nsdata->d_nstime = 1 + (int)(25.0*rand()/(RAND_MAX + 1.0));
-	nsdata->d_rcnt=1;
-	fdp->ref_count=1;
+	nsdata->d_rcnt = 1;
+
+	fdp->ref_count = 1;
+
+	if (fdpp != NULL) {
+		*fdpp = fdp;
+		return (fdp);
+	}
 	
-	i=0;
+	i = 0;
 	if (fwddata == NULL) {
 		fwddata = memget(sizeof *fwddata);
 		if (fwddata == NULL)
@@ -2301,6 +2337,7 @@ find_forwarder(struct in_addr address)
 	} else {
 		register size_t size;
 		register struct fwddata **an_tmp;
+
 		size = fwddata_count * sizeof *fwddata;
 		an_tmp = memget(size + sizeof *fwddata);
 		if (an_tmp == NULL) {
@@ -2316,13 +2353,13 @@ find_forwarder(struct in_addr address)
 		fwddata[fwddata_count] = fdp;
 		fwddata_count++;
 	} else {
-		ns_warning(ns_log_config,
-		     "forwarder add failed (memget) [%s]",
-			inet_ntoa(address));
+		ns_warning(ns_log_config, "forwarder add failed (memget) [%s]",
+			   inet_ntoa(address));
 	}
 
-	return fdp;
+	return (fdp);
 }
+
 /*
  * Forwarder glue
  *
@@ -2460,14 +2497,20 @@ add_zone_forwarder(zone_config zh, struct in_addr address) {
 void
 free_forwarders(struct fwdinfo *fwdtab) {
 	struct fwdinfo *ftp, *fnext;
+	int i;
 
 	for (ftp = fwdtab; ftp != NULL; ftp = fnext) {
 		fnext = ftp->next;
-		if (!--ftp->fwddata->ref_count) {
+		if (--ftp->fwddata->ref_count == 0) {
+			for (i = 0 ; i < fwddata_count; i++)
+				if (fwddata[i] == ftp->fwddata) {
+					fwddata[i] = NULL;
+					break;
+				}
 			memput(ftp->fwddata->ns, sizeof *ftp->fwddata->ns);
 			memput(ftp->fwddata->nsdata,
 					sizeof *ftp->fwddata->nsdata);
-			memput(ftp->fwddata,sizeof *ftp->fwddata);
+			memput(ftp->fwddata, sizeof *ftp->fwddata);
 		}
 		memput(ftp, sizeof *ftp);
 	}
diff --git a/contrib/bind/bin/named/ns_defs.h b/contrib/bind/bin/named/ns_defs.h
index 8d480f2..64aecce 100644
--- a/contrib/bind/bin/named/ns_defs.h
+++ b/contrib/bind/bin/named/ns_defs.h
@@ -1,6 +1,6 @@
 /*
  *	from ns.h	4.33 (Berkeley) 8/23/90
- *	$Id: ns_defs.h,v 8.102 2000/12/01 05:35:48 vixie Exp $
+ *	$Id: ns_defs.h,v 8.105 2001/04/01 22:41:24 marka Exp $
  */
 
 /*
@@ -113,7 +113,8 @@
  * dies out in a little more than a minute.
  * (sequence RETRYBASE, 2*RETRYBASE, 4*RETRYBASE... for MAXRETRY)
  */
-#define	NEWZONES	64	/* must be a power of two. */
+#define	NEWZONES	64	/* how many zones to grow the zone table by */
+#define	INITIALZONES	NEWZONES /* how many zones are allocated initially */
 #define MINROOTS	2	/* min number of root hints */
 #define NSMAX		16	/* max number of NS addrs to try ([0..255]) */
 #define RETRYBASE	4 	/* base time between retries */
@@ -123,7 +124,7 @@
 #define MAXQUERIES	20	/* max # of queries to be made */
 #define	MAXQSERIAL	4	/* max # of outstanding QSERIAL's */
 				/* (prevent "recursive" loops) */
-#define	INIT_REFRESH	600	/* retry time for initial secondary */
+#define	INIT_REFRESH	600	/* retry time for initial slave */
 				/* contact (10 minutes) */
 #define MIN_REFRESH	2	/* never refresh more frequently than once */
 				/* every MIN_REFRESH seconds */
@@ -420,6 +421,7 @@ enum zonetype { z_nil, z_master, z_slave, z_hint, z_stub, z_forward,
 #define	Z_PARENT_RELOAD	0x00040000	/* we need to reload this as parent */
 #define Z_FORWARD_SET	0x00080000	/* has forwarders been set */
 #define Z_EXPIRED	0x00100000	/* expire timer has gone off */
+#define Z_NEEDREFRESH	0x00200000	/* need to perform a refresh check */
 
 	/* named_xfer exit codes */
 #define	XFER_UPTODATE	0		/* zone is up-to-date */
diff --git a/contrib/bind/bin/named/ns_func.h b/contrib/bind/bin/named/ns_func.h
index ca30823..ef9780f 100644
--- a/contrib/bind/bin/named/ns_func.h
+++ b/contrib/bind/bin/named/ns_func.h
@@ -90,7 +90,7 @@
 
 /* ns_func.h - declarations for ns_*.c's externally visible functions
  *
- * $Id: ns_func.h,v 8.104 2001/01/25 05:50:54 marka Exp $
+ * $Id: ns_func.h,v 8.105 2001/02/16 04:46:12 marka Exp $
  */
 
 /* ++from ns_glue.c++ */
@@ -102,6 +102,7 @@ void			ns_info(int, const char *, ...);
 void			ns_notice(int, const char *, ...);
 void			ns_warning(int, const char *, ...);
 void			ns_error(int, const char *, ...);
+void			ns_critical(int, const char *, ...);
 void			ns_panic(int, int, const char *, ...);
 void			ns_assertion_failed(char *file, int line,
 					    assertion_type type, char *cond,
diff --git a/contrib/bind/bin/named/ns_glue.c b/contrib/bind/bin/named/ns_glue.c
index c1f9be2..a4bd0f1 100644
--- a/contrib/bind/bin/named/ns_glue.c
+++ b/contrib/bind/bin/named/ns_glue.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_glue.c,v 8.18 2000/11/08 06:16:36 marka Exp $";
+static const char rcsid[] = "$Id: ns_glue.c,v 8.20 2001/02/16 04:46:14 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -150,6 +150,17 @@ ns_error(int category, const char *format, ...) {
 }
 
 void
+ns_critical(int category, const char *format, ...) {
+	va_list args;
+
+	if (!log_ctx_valid)
+		return;
+	va_start(args, format);
+	log_vwrite(log_ctx, category, log_critical, format, args);
+	va_end(args);
+}
+
+void
 ns_panic(int category, int dump_core, const char *format, ...) {
 	va_list args;
 
@@ -252,7 +263,6 @@ void
 gettime(struct timeval *ttp) {
 	if (gettimeofday(ttp, NULL) < 0)
 		ns_error(ns_log_default, "gettimeofday: %s", strerror(errno));
-	INSIST(ttp->tv_usec >= 0 && ttp->tv_usec < 1000000);
 }
 
 /*
diff --git a/contrib/bind/bin/named/ns_init.c b/contrib/bind/bin/named/ns_init.c
index c5842f6..553f047 100644
--- a/contrib/bind/bin/named/ns_init.c
+++ b/contrib/bind/bin/named/ns_init.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_init.c	4.38 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: ns_init.c,v 8.70 2000/12/23 08:14:38 vixie Exp $";
+static const char rcsid[] = "$Id: ns_init.c,v 8.73 2001/04/20 00:21:40 vixie Exp $";
 #endif /* not lint */
 
 /*
@@ -118,7 +118,11 @@ ns_refreshtime(struct zoneinfo *zp, time_t timebase) {
 	u_long refresh = (zp->z_refresh > 0) ? zp->z_refresh : INIT_REFRESH;
 	time_t half = (refresh + 1) / 2;
 
-	zp->z_time = timebase + half + (rand() % half);
+	if (zp->z_flags & Z_NEEDREFRESH) {
+		zp->z_flags &= ~Z_NEEDREFRESH;
+		zp->z_time = timebase;
+	} else
+		zp->z_time = timebase + half + (rand() % half);
 }
 
 /*
@@ -126,6 +130,8 @@ ns_refreshtime(struct zoneinfo *zp, time_t timebase) {
  */
 void
 ns_retrytime(struct zoneinfo *zp, time_t timebase) {
+
+	zp->z_flags &= ~Z_NEEDREFRESH;
 	zp->z_time = timebase + zp->z_retry;
 }
 
@@ -469,35 +475,34 @@ ns_nameok(const struct qinfo *qry, const char *name, int class,
 			s = newstr(strlen(transport_strings[transport]) +
 				   sizeof " from [000.000.000.000] for [000.000.000.000]", 0);
 			if (s != NULL) {
-				if ( (transport == response_trans) &&
-					(qry != NULL) ) {
-
-				if ( qry->q_flags & Q_PRIMING ) {
-				   sprintf(s, "%s from [%s] for priming",
-					transport_strings[transport],
-					inet_ntoa(source));
-				} else if ( qry->q_flags & Q_ZSERIAL ) {
-				   sprintf(s, "%s from [%s] for soacheck",
-					transport_strings[transport],
-					inet_ntoa(source));
-				} else if ( qry->q_flags & Q_SYSTEM ) {
-				   sprintf(s, "%s from [%s] for sysquery",
-					transport_strings[transport],
-					inet_ntoa(source));
+			    if (transport == response_trans && qry != NULL) {
+				if ((qry->q_flags & Q_PRIMING) != 0) {
+				    sprintf(s, "%s from [%s] for priming",
+					    transport_strings[transport],
+					    inet_ntoa(source));
+				} else if ((qry->q_flags & Q_ZSERIAL) != 0) {
+				    sprintf(s, "%s from [%s] for soacheck",
+					    transport_strings[transport],
+					    inet_ntoa(source));
+				} else if ((qry->q_flags & Q_SYSTEM) != 0) {
+				    sprintf(s, "%s from [%s] for sysquery",
+					    transport_strings[transport],
+					    inet_ntoa(source));
 				} else {
-				   q=strdup(inet_ntoa(qry->q_from.sin_addr));
-				   sprintf(s, "%s from [%s] for [%s]",
-					transport_strings[transport],
-					inet_ntoa(source),
-					q != NULL ? q : "memget failed");
-				   free(q);
-				}
-
-				} else {
-					sprintf(s, "%s from [%s]",
-						transport_strings[transport],
-						inet_ntoa(source));
+				    q=strdup(inet_ntoa(qry->q_from.sin_addr));
+				    sprintf(s, "%s from [%s] for [%s]",
+					    transport_strings[transport],
+					    inet_ntoa(source),
+					    q != NULL ? q : "memget failed");
+				    free(q);
 				}
+			    } else {
+				sprintf(s, "%s from [%s]",
+					(transport == response_trans)
+						? "query"
+						: transport_strings[transport],
+					inet_ntoa(source));
+			    }
 			}
 		}
 		if (ns_samename(owner, name) == 1)
diff --git a/contrib/bind/bin/named/ns_ixfr.c b/contrib/bind/bin/named/ns_ixfr.c
index 5dd438b..b54a275 100644
--- a/contrib/bind/bin/named/ns_ixfr.c
+++ b/contrib/bind/bin/named/ns_ixfr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_ixfr.c,v 8.25 2000/12/27 06:56:03 vixie Exp $";
+static const char rcsid[] = "$Id: ns_ixfr.c,v 8.26 2001/03/12 01:48:58 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -411,7 +411,8 @@ ixfr_log_maint(struct zoneinfo *zp) {
 	int error = 0;
 	long seek = 0;
 	FILE *to_fp, *from_fp, *db_fp;
-	static char   *tmpname;
+	char *tmpname;
+	int len;
 	struct stat db_sb;
 	struct stat sb;
 	static char buf[MAXBSIZE];
@@ -474,7 +475,8 @@ ixfr_log_maint(struct zoneinfo *zp) {
 		return (-1);
 	}
 
-	tmpname = memget(strlen(zp->z_ixfr_base) + sizeof(".XXXXXX") + 1);
+	len = strlen(zp->z_ixfr_base) + sizeof(".XXXXXX") + 1;
+	tmpname = memget(len);
 	if (!tmpname) {
 		ns_warning(ns_log_default, "memget failed");
 			return (-1);
@@ -489,14 +491,16 @@ ixfr_log_maint(struct zoneinfo *zp) {
 	if ((fd = mkstemp(tmpname)) == -1) {
 		ns_warning(ns_log_db, "can't make tmpfile (%s): %s", 
 				strerror(errno));
-		memput(tmpname, (strlen(zp->z_ixfr_base) + sizeof(".XXXXXX") + 1));
+		memput(tmpname, len);
+		(void) my_fclose(from_fp);
 	 	return (-1);
 	}
 	if ((to_fp = fdopen(fd, "r+")) == NULL) {
 		ns_warning(ns_log_db, "%s: %s",
 			   tmpname, strerror(errno));
 		(void) unlink(tmpname);
-		memput(tmpname, (strlen(zp->z_ixfr_base) + sizeof(".XXXXXX") + 1));
+		memput(tmpname, len);
+		(void) my_fclose(from_fp);
 		(void) close(fd);
 	 	return (-1);
 	}
@@ -539,7 +543,8 @@ ixfr_log_maint(struct zoneinfo *zp) {
 		while ((rcount = fread(buf, sizeof(char), MAXBSIZE, from_fp)) > 0) {
 			wcount = fwrite(buf, sizeof(char), rcount, to_fp);
 			if (rcount != wcount || wcount == -1) {
-					ns_warning(ns_log_default, "ixfr_log_maint: error in writting copy");
+					ns_warning(ns_log_default,
+				     "ixfr_log_maint: error in writting copy");
 					break;
 			}
 		}
@@ -549,7 +554,6 @@ ixfr_log_maint(struct zoneinfo *zp) {
 	}
 	clean_up:
 	(void) my_fclose(to_fp);
-	(void) close(fd);
 	(void) my_fclose(from_fp);
 	if (error == 0) {
 		if (isc_movefile(tmpname, zp->z_ixfr_base) == -1) {
@@ -559,11 +563,13 @@ ixfr_log_maint(struct zoneinfo *zp) {
 		if ((from_fp = fopen(zp->z_ixfr_base, "r")) == NULL) {
 			ns_warning(ns_log_db, "%s: %s",
 				   zp->z_ixfr_base, strerror(errno));
+			memput(tmpname, len);
 			return (-1);
 		}
 		if (fstat(fileno(from_fp), &sb) < 0) {
 			ns_warning(ns_log_db, "%s: %s",
 				   zp->z_ixfr_base, strerror(errno));
+			memput(tmpname, len);
 			(void) my_fclose(from_fp);
 			return (-1);
 		}
@@ -574,10 +580,10 @@ ixfr_log_maint(struct zoneinfo *zp) {
 					"chmod(%s,%o) failed, pressing on: %s",
 					 zp->z_source, sb.st_mode,
 					 strerror(errno));
+		(void) my_fclose(from_fp);
 	}
 	(void) unlink(tmpname);
-	memput(tmpname, (strlen(zp->z_ixfr_base) + sizeof(".XXXXXX") + 1));
-	(void) my_fclose(from_fp);
+	memput(tmpname, len);
 
 	zp->z_serial_ixfr_start = 0; /* signal to read for lowest serial number */	
 
diff --git a/contrib/bind/bin/named/ns_main.c b/contrib/bind/bin/named/ns_main.c
index 5caaae9..1d7bfe8 100644
--- a/contrib/bind/bin/named/ns_main.c
+++ b/contrib/bind/bin/named/ns_main.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_main.c	4.55 (Berkeley) 7/1/91";
-static const char rcsid[] = "$Id: ns_main.c,v 8.142 2001/01/15 20:06:25 vixie Exp $";
+static const char rcsid[] = "$Id: ns_main.c,v 8.145 2001/03/16 12:07:57 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -570,6 +570,31 @@ main(int argc, char *argv[], char *envp[]) {
 	return (0);
 }
 
+static int
+ns_socket(int domain, int type, int protocol) {
+	int fd;
+
+	fd = socket(domain, type, protocol);
+	if (fd == -1)
+		return (-1);
+#ifdef F_DUPFD		/* XXX */
+	/*
+	 * Leave a space for stdio to work in.
+	 */
+	if (fd >= 0 && fd <= 20) {
+		int new, tmp;
+		if ((new = fcntl(fd, F_DUPFD, 20)) == -1)
+			ns_notice(ns_log_default, "fcntl(fd, F_DUPFD, 20): %s",
+				  strerror(errno));
+		tmp = errno;
+		close(fd);
+		errno = tmp;
+		fd = new;
+	}
+#endif
+	return (fd);
+}
+
 #ifndef IP_OPT_BUF_SIZE
 /* arbitrary size */
 #define IP_OPT_BUF_SIZE 50
@@ -595,6 +620,24 @@ stream_accept(evContext lev, void *uap, int rfd,
 
 	INSIST(ifp != NULL);
 
+#ifdef F_DUPFD
+	/*
+	 * Leave a space for stdio to work in.
+	 */
+	if (rfd >= 0 && rfd <= 20) {
+		int new, tmp;
+		new = fcntl(rfd, F_DUPFD, 20);
+		tmp = errno;
+		if (new == -1)
+			ns_notice(ns_log_default,
+				  "fcntl(rfd, F_DUPFD, 20): %s",
+				  strerror(errno));
+		close(rfd);
+		errno = tmp;
+		rfd = new;
+	}
+#endif
+
 	if (rfd < 0) {
 		switch (errno) {
 		case EINTR:
@@ -751,13 +794,14 @@ stream_accept(evContext lev, void *uap, int rfd,
 int
 tcp_send(struct qinfo *qp) {
 	struct qstream *sp;
+	struct sockaddr_in src;
 	int on = 1, n;
 	
 	ns_debug(ns_log_default, 1, "tcp_send");
 	if ((sp = sq_add()) == NULL) {
 		return (SERVFAIL);
 	}
-	if ((sp->s_rfd = socket(AF_INET, SOCK_STREAM, PF_UNSPEC)) == -1) {
+	if ((sp->s_rfd = ns_socket(AF_INET, SOCK_STREAM, PF_UNSPEC)) == -1) {
 		sq_remove(sp);
 		return (SERVFAIL);
 	}
@@ -777,8 +821,9 @@ tcp_send(struct qinfo *qp) {
 			"tcp_send: setsockopt(SO_REUSEPORT): %s",
 			strerror(errno));
 #endif
-	if (bind(sp->s_rfd, (struct sockaddr *)&server_options->query_source,
-		 sizeof server_options->query_source) < 0)
+	src = server_options->query_source;
+	src.sin_port = htons(0);
+	if (bind(sp->s_rfd, (struct sockaddr *)&src, sizeof(src)) < 0)
 		ns_info(ns_log_default, "tcp_send: bind(query_source): %s",
 			strerror(errno));
 	if (fcntl(sp->s_rfd, F_SETFD, 1) < 0) {
@@ -1454,7 +1499,7 @@ opensocket_d(interface *ifp) {
 	nsa.sin_addr = ifp->addr;
 	nsa.sin_port = ifp->port;
 
-	if ((ifp->dfd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
+	if ((ifp->dfd = ns_socket(AF_INET, SOCK_DGRAM, 0)) < 0) {
 		ns_error(ns_log_default, "socket(SOCK_DGRAM): %s",
 			 strerror(errno));
 		return (-1);
@@ -1476,17 +1521,6 @@ opensocket_d(interface *ifp) {
 		(void) close(ifp->dfd);
 		return (-1);
 	}
-#ifdef F_DUPFD		/* XXX */
-	/*
-	 * Leave a space for stdio to work in.
-	 */
-	if ((fd = fcntl(ifp->dfd, F_DUPFD, 20)) != -1) {
-		close(ifp->dfd);
-		ifp->dfd = fd;
-	} else 
-		ns_notice(ns_log_default, "fcntl(dfd, F_DUPFD, 20): %s",
-			  strerror(errno));
-#endif
 	if (fcntl(ifp->dfd, F_SETFD, 1) < 0) {
 		ns_error(ns_log_default, "F_SETFD: %s", strerror(errno));
 		close(ifp->dfd);
@@ -1633,7 +1667,7 @@ opensocket_s(interface *ifp) {
 	 */
 	n = 0;
  again:
-	if ((ifp->sfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
+	if ((ifp->sfd = ns_socket(AF_INET, SOCK_STREAM, 0)) < 0) {
 		ns_error(ns_log_default, "socket(SOCK_STREAM): %s",
 			 strerror(errno));
 		return (-1);
@@ -1643,17 +1677,6 @@ opensocket_s(interface *ifp) {
 		close(ifp->sfd);
 		return (-1);
 	}
-#ifdef F_DUPFD		/* XXX */
-	/*
-	 * Leave a space for stdio to work in.
-	 */
-	if ((fd = fcntl(ifp->sfd, F_DUPFD, 20)) != -1) {
-		close(ifp->sfd);
-		ifp->sfd = fd;
-	} else 
-		ns_notice(ns_log_default, "fcntl(sfd, F_DUPFD, 20): %s",
-			  strerror(errno));
-#endif
 	if (fcntl(ifp->sfd, F_SETFD, 1) < 0) {
 		ns_error(ns_log_default, "F_SETFD: %s", strerror(errno));
 		close(ifp->sfd);
diff --git a/contrib/bind/bin/named/ns_maint.c b/contrib/bind/bin/named/ns_maint.c
index b5ed644..d8e41dc 100644
--- a/contrib/bind/bin/named/ns_maint.c
+++ b/contrib/bind/bin/named/ns_maint.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_maint.c	4.39 (Berkeley) 3/2/91";
-static const char rcsid[] = "$Id: ns_maint.c,v 8.117 2001/01/25 05:50:55 marka Exp $";
+static const char rcsid[] = "$Id: ns_maint.c,v 8.122 2001/03/01 06:26:31 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -926,6 +926,7 @@ startxfer(struct zoneinfo *zp) {
 	zp->z_flags |= Z_XFER_RUNNING;
 	zp->z_xferpid = pid;
 	xfers_running++;
+	xfers_deferred--;
 	if (zp->z_max_transfer_time_in)
 		zp->z_time = tt.tv_sec + zp->z_max_transfer_time_in;
 	else
@@ -1172,6 +1173,10 @@ remove_zone(struct zoneinfo *zp, const char *verb) {
 #endif
 	if ((zp->z_flags & Z_NOTIFY) != 0)
 		ns_stopnotify(zp->z_origin, zp->z_class);
+	if ((zp->z_flags & Z_NEED_XFER) != 0) {
+		zp->z_flags &= ~Z_NEED_XFER;
+		xfers_deferred--;
+	}
 	ns_stopxfrs(zp);
 	do_reload(zp->z_origin, zp->z_type, zp->z_class, 1);
 	ns_notice(ns_log_config, "%s zone \"%s\" (%s) %s",
@@ -1278,7 +1283,7 @@ purge_nonglue_2(const char *dname, struct hashbuf *htp, int class,
 					    zonecut &&
 					    !valid_glue(dp, name, belowcut)) {
 						if (log)
-						    ns_error(ns_log_db,
+						    ns_error(ns_log_load,
 	        "zone: %s/%s: non-glue record %s bottom of zone: %s/%s",
 							 *dname ? dname : ".",
 						         p_class(dp->d_class),
@@ -1599,7 +1604,6 @@ endxfer() {
 					break;
 
 				case XFER_SUCCESSIXFR:
-					zp->z_flags |= Z_XFER_RUNNING;
 					zp->z_xferpid = XFER_ISIXFR;
 					ns_notice(ns_log_default,
 						  "IXFR Success %s",
@@ -1624,8 +1628,6 @@ endxfer() {
 						ns_notice(ns_log_default,
 							"IXFR Merge failed %s",
 							  zp->z_ixfr_tmp);
-					zp->z_flags &=
-						~(Z_XFER_RUNNING|Z_XFER_ABORTED|Z_XFER_GONE);
 						ns_retrytime(zp, tt.tv_sec);
 						sched_zone_maint(zp);
 					}
@@ -1635,7 +1637,7 @@ endxfer() {
 					if (!(zp->z_flags & Z_SYSLOGGED)) {
 						zp->z_flags |= Z_SYSLOGGED;
 						ns_notice(ns_log_default,
-		      "zoneref: Masters for secondary zone \"%s\" unreachable",
+		      "zoneref: Masters for slave zone \"%s\" unreachable",
 							  zp->z_origin);
 					}
 					ns_retrytime(zp, tt.tv_sec);
@@ -1712,7 +1714,6 @@ tryxfer() {
 		if ((xfers = nxfers(zp)) != -1 &&
 		    xfers < server_options->transfers_per_ns &&
 		    (zp->z_flags & Z_NEED_XFER)) {
-			xfers_deferred--;
 			startxfer(zp);
 			sched_zone_maint(zp);
 		}
@@ -1912,7 +1913,7 @@ ns_reload(void) {
 	INSIST(reloading == 0);
 	qflush();
 	sq_flush(NULL);
-	reloading++;	/* To force transfer if secondary and backing up. */
+	reloading++;	/* To force transfer if slave and backing up. */
 	confmtime = ns_init(conffile);
 	time(&resettime);
 	reloading--;
@@ -1946,20 +1947,21 @@ void
 make_new_zones(void) {
 	struct zoneinfo *zp;
 	int n;
+	int newzones = (nzones == 0) ? INITIALZONES : NEWZONES;
 
 	ns_debug(ns_log_config, 1, "Adding %d template zones", NEWZONES);
 	zp = (struct zoneinfo *)
-		memget((nzones + NEWZONES) * sizeof(struct zoneinfo));
+		memget((nzones + newzones) * sizeof(struct zoneinfo));
 	if (zp == NULL)
 		panic("no memory for more zones", NULL);
-	memset(zp, 0, (nzones + NEWZONES) * sizeof(struct zoneinfo));
+	memset(zp, 0, (nzones + newzones) * sizeof(struct zoneinfo));
 	if (zones != NULL) {
 		memcpy(zp, zones, nzones * sizeof(struct zoneinfo));
 		memput(zones, nzones * sizeof(struct zoneinfo));
 	}
 	zones = zp;
 	block_signals();
-	for (n = 0; n < NEWZONES; n++) {
+	for (n = 0; n < newzones; n++) {
 		INIT_LINK(&zones[nzones], z_reloadlink);
 		INIT_LINK(&zones[nzones], z_freelink);
 		if (nzones != 0)
diff --git a/contrib/bind/bin/named/ns_notify.c b/contrib/bind/bin/named/ns_notify.c
index 4523422..20fd700 100644
--- a/contrib/bind/bin/named/ns_notify.c
+++ b/contrib/bind/bin/named/ns_notify.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_notify.c,v 8.12 2000/12/23 08:14:40 vixie Exp $";
+static const char rcsid[] = "$Id: ns_notify.c,v 8.14 2001/04/01 18:38:36 vixie Exp $";
 #endif /* not lint */
 
 /*
@@ -138,7 +138,7 @@ ns_notify(const char *dname, ns_class class, ns_type type) {
 	}
 
 	/* Delay notification for from five seconds up to fifteen minutes. */
-	max_delay = MIN(nzones/5, 895);
+	max_delay = MIN(nzones, 895);
 	max_delay = MAX(max_delay, 25);
 	delay = 5 + (rand() % max_delay);
 	if (evSetTimer(ev, notify_timer, ni,
@@ -352,6 +352,7 @@ sysnotify_ns(const char *dname, const char *aname,
 	struct in_addr nss[NSMAX];
 	struct hashbuf *htp;
 	int is_us, nsc;
+	int cname = 0;
 
 	htp = hashtab;
 	anp = nlookup(aname, &htp, &fname, 0);
@@ -361,6 +362,15 @@ sysnotify_ns(const char *dname, const char *aname,
 		for (adp = anp->n_data; adp; adp = adp->d_next) {
 			struct in_addr ina;
 
+			if (match(adp, class, T_CNAME)) {
+				cname = 1;
+				ns_error(ns_log_notify,
+					 "NS '%s' for '%s/%s' is a CNAME",
+					 *aname ? aname : ".",
+					 *dname ? dname : ".",
+					 p_class(class));
+				break;
+			}
 			if (!match(adp, class, T_A))
 				continue;
 			if (adp->d_type == ns_t_sig)
@@ -374,7 +384,7 @@ sysnotify_ns(const char *dname, const char *aname,
 				nss[nsc++] = ina;
 		} /*next A*/
 	if (nsc == 0) {
-		if (!is_us && !NS_OPTION_P(OPTION_NOFETCHGLUE)) {
+		if (!is_us && !cname && !NS_OPTION_P(OPTION_NOFETCHGLUE)) {
 			struct qinfo *qp;
 
 			qp = sysquery(aname, class, ns_t_a, 0, 0, ns_port,
diff --git a/contrib/bind/bin/named/ns_parser.y b/contrib/bind/bin/named/ns_parser.y
index 680a586..ed49549 100644
--- a/contrib/bind/bin/named/ns_parser.y
+++ b/contrib/bind/bin/named/ns_parser.y
@@ -1,6 +1,6 @@
 %{
 #if !defined(lint) && !defined(SABER)
-static char rcsid[] = "$Id: ns_parser.y,v 8.63 2000/12/23 08:14:41 vixie Exp $";
+static char rcsid[] = "$Id: ns_parser.y,v 8.63.2.4 2001/04/30 08:03:02 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -265,7 +265,11 @@ statement: include_stmt
 	| error L_END_INCLUDE
 	;
 
-include_stmt: T_INCLUDE L_QSTRING L_EOS	{ lexer_begin_file($2, NULL); }
+include_stmt: T_INCLUDE L_QSTRING L_EOS
+	{
+		lexer_begin_file($2, NULL);
+		freestr($2);
+	}
 	;
 
 /*
@@ -601,6 +605,7 @@ control: /* Empty */
 #ifndef NO_SOCKADDR_UN
 		ns_ctl_add(&current_controls, ns_ctl_new_unix($2, $4, $6, $8));
 #endif
+		freestr($2);
 	}
 	| error
 	;
@@ -1273,6 +1278,7 @@ address_match_element: address_match_simple
 		}
 		else
 			$$ = new_ip_match_key(dst_key);
+	        (void)freestr(key_name);
 	}
 	;
 
@@ -1399,13 +1405,11 @@ key_stmt: T_SEC_KEY
 				     $3);
 		} else if (lookup_key(key_name) != NULL) {
 			parser_error(0, "can't redefine key '%s'", key_name);
-			freestr(key_name);
 		} else {
 			if (current_algorithm == NULL ||
 			    current_secret == NULL)  {
 				parser_error(0, "skipping bad key '%s'",
 					     key_name);
-				freestr(key_name);
 			} else {
 				dst_key = new_key_info(key_name,
 						       current_algorithm,
@@ -1420,6 +1424,15 @@ key_stmt: T_SEC_KEY
 				}
 			}
 		}
+		if (key_name != NULL)
+			freestr(key_name);
+		key_name = NULL;
+		if (current_algorithm != NULL)
+			freestr(current_algorithm);
+		current_algorithm = NULL;
+		if (current_secret != NULL)
+			freestr(current_secret);
+		current_secret = NULL;
 		freestr($3);
 	}
 	;
diff --git a/contrib/bind/bin/named/ns_req.c b/contrib/bind/bin/named/ns_req.c
index f103ad6..671b31e 100644
--- a/contrib/bind/bin/named/ns_req.c
+++ b/contrib/bind/bin/named/ns_req.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_req.c	4.47 (Berkeley) 7/1/91";
-static const char rcsid[] = "$Id: ns_req.c,v 8.129 2001/01/08 23:46:41 marka Exp $";
+static const char rcsid[] = "$Id: ns_req.c,v 8.138.2.1 2001/04/27 07:44:05 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -204,16 +204,26 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 			ns_debug(ns_log_default, 1,
 				 "ns_req: bad TSIG key name",
 				 buf);
+			error = ns_r_formerr;
+			hp->rcode = ns_r_formerr;
 			key = NULL;
-		}
-		key = find_key(buf, NULL);
-		if (key == NULL) {
+		} else if ((key = find_key(buf, NULL)) == NULL) {
 			error = ns_r_badkey;
 			hp->rcode = ns_r_notauth;
 			ns_debug(ns_log_default, 1,
 				 "ns_req: TSIG verify failed - unknown key %s",
 				 buf);
 		}
+#ifdef LOG_TSIG_BUG
+		if (n < 0 || key == NULL)
+			ns_error(ns_log_security,
+	  "SECURITY: POSSIBLE ATTEMPT TO EXERCISE \"TSIG BUG\" FROM %s: %s%s%s",
+				 sin_ntoa(from),
+				 (n < 0) ? "bad key (formerr)" :
+					   "unknown key (",
+				 (n < 0) ? "" : (buf[0] != '\0' ? buf : "."),
+				 (n < 0) ? "" : ")");
+#endif
 	}
 	if (has_tsig && key != NULL) {
 		n = ns_verify(msg, &msglen, key, NULL, 0, sig, &siglen, 
@@ -419,10 +429,12 @@ ns_req(u_char *msg, int msglen, int buflen, struct qstream *qsp,
 	}
 
 #ifdef DEBUG
-	ns_debug(ns_log_default, 1,
-		 "ns_req: answer -> %s fd=%d id=%d size=%d rc=%d",
-		 sin_ntoa(from), (qsp == NULL) ? dfd : qsp->s_rfd,
-		 ntohs(hp->id), cp - msg, hp->rcode);
+	if (ns_wouldlog(ns_log_default, 1)) {
+		ns_debug(ns_log_default, 1,
+			 "ns_req: answer -> %s fd=%d id=%d size=%d rc=%d",
+			 sin_ntoa(from), (qsp == NULL) ? dfd : qsp->s_rfd,
+			 ntohs(hp->id), cp - msg, hp->rcode);
+	}
 	if (debug >= 10)
 		res_pquery(&res, msg, cp - msg,
 			    log_get_stream(packet_channel));
@@ -512,6 +524,13 @@ req_notify(HEADER *hp, u_char **cpp, u_char *eom, u_char *msg,
 	/* XXX - when answers are allowed, we'll need to do compression
 	 * correctly here, and we will need to check for packet underflow.
 	 */
+	/*
+	 * We are ignoring the other field, make sure the header reflects
+	 * *cpp.
+	 */
+	hp->ancount = htons(0);
+	hp->nscount = htons(0);
+	hp->arcount = htons(0);
 	/* Find the zone this NOTIFY refers to. */
 	zp = find_auth_zone(dnbuf, class);
 	if (zp == NULL) {
@@ -536,7 +555,7 @@ req_notify(HEADER *hp, u_char **cpp, u_char *eom, u_char *msg,
 			 * AXFR from you.
 			 */
 			ns_info(ns_log_notify,
-			    "NOTIFY(SOA) for non-secondary name (%s), from %s",
+			    "NOTIFY(SOA) for non-slave zone (%s), from %s",
 				dnbuf, sin_ntoa(from));
 			goto refuse;
 		}
@@ -565,6 +584,7 @@ req_notify(HEADER *hp, u_char **cpp, u_char *eom, u_char *msg,
 			ns_info(ns_log_notify,
 				"NOTIFY(SOA) for zone already xferring (%s)",
 				dnbuf);
+			zp->z_flags |= Z_NEEDREFRESH;
 			goto noerror;
 		}
 		zp->z_time = tt.tv_sec;
@@ -804,6 +824,19 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 #endif /*YPKLUDGE*/
 
 	/*
+	 * Don't accept in a query names which would be rejected in responses.
+	 * (This is primarily in case we have to forward it, but it's also a
+	 * matter of architectural symmetry.)
+	 */
+	if (!ns_nameok(NULL, dname, class, NULL, response_trans,
+		       ns_ownercontext(type, response_trans),
+		       dname, from.sin_addr)) {
+		ns_debug(ns_log_default, 1, "bad name in query"); 
+		hp->rcode = ns_r_formerr;
+		return (Refuse);
+	}
+
+	/*
 	 * Begin Access Control Point
 	 */
 
@@ -929,8 +962,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 				}
 			}
 			ns_notice(ns_log_security,
-				  "denied query from %s for \"%s\"",
-				  sin_ntoa(from), *dname ? dname : ".");
+				  "denied query from %s for \"%s\" %s",
+				  sin_ntoa(from), *dname ? dname : ".",
+				  p_class(class));
 			nameserIncr(from.sin_addr, nssRcvdUQ);
 			return (Refuse);
 		}
@@ -949,9 +983,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 					       in_key))
 		{
 			ns_notice(ns_log_security,
-				  "denied %s from %s for \"%s\" (acl)",
+				  "denied %s from %s for \"%s\" %s (acl)",
 				  p_type(type), sin_ntoa(from),
-				  *dname ? dname : ".");
+				  *dname ? dname : ".", p_class(class));
 			nameserIncr(from.sin_addr, nssRcvdUXFR);
 			if (type == ns_t_ixfr) {
 				hp->rcode = ns_r_refused;
@@ -979,9 +1013,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 
 		if ((zp->z_flags & Z_AUTH) == 0) {
 			ns_notice(ns_log_security,
-			 "denied %s from %s for \"%s\" (not authoritative)",
+			 "denied %s from %s for \"%s\" %s (not authoritative)",
 				  p_type(type), sin_ntoa(from),
-				  *dname ? dname : ".");
+				  *dname ? dname : ".", p_class(class));
 			nameserIncr(from.sin_addr, nssRcvdUXFR);
 			if (type == ns_t_ixfr) {
 				hp->rcode = ns_r_refused;
@@ -994,9 +1028,9 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 
 		if (ns_samename(zp->z_origin, dname) != 1) {
 			ns_notice(ns_log_security,
-			  "denied %s from %s for \"%s\" (not zone top)",
+			  "denied %s from %s for \"%s\" %s (not zone top)",
 				  p_type(type), sin_ntoa(from),
-				  *dname ? dname : ".");
+				  *dname ? dname : ".", p_class(class));
 			nameserIncr(from.sin_addr, nssRcvdUXFR);
 			if (type == ns_t_ixfr) {
 				hp->rcode = ns_r_refused;
@@ -1271,8 +1305,8 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 
 	if (!founddata && hp->rd && recursion_blocked_by_acl) {
 		ns_notice(ns_log_security,
-			  "denied recursion for query from %s for %s",
-			  sin_ntoa(from), *dname ? dname : ".");
+			  "denied recursion for query from %s for %s %s",
+			  sin_ntoa(from), *dname ? dname : ".", p_class(class));
 		nameserIncr(from.sin_addr, nssRcvdURQ);
 	}
 
@@ -1333,6 +1367,7 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 			ns_info(ns_log_default, "res_mkquery(%s) failed",
 				dname);
 			hp->rcode = ns_r_servfail;
+			memput(omsg, omsglen);
 			free_nsp(nsp);
 			return (Finish);
 		}
@@ -1350,6 +1385,7 @@ req_query(HEADER *hp, u_char **cpp, u_char *eom, struct qstream *qsp,
 			qp->q_cname = cname;
 			qp->q_cmsg = omsg;
 			qp->q_cmsglen = omsglen;
+			qp->q_cmsgsize = omsglen;
 			qp->q_id = id;
 		}
 		break;
@@ -1557,7 +1593,7 @@ stale(struct databuf *dp) {
 #endif
 	case z_slave:
 		/*
-		 * Check to see whether a secondary zone has expired or
+		 * Check to see whether a slave zone has expired or
 		 * time warped; if so clear authority flag for zone,
 		 * schedule the zone for immediate maintenance, and
 		 * return true.
@@ -1569,7 +1605,7 @@ stale(struct databuf *dp) {
 				zp->z_origin);
 			if (!haveComplained((u_long)zp, (u_long)stale)) {
 				ns_notice(ns_log_default,
-					  "secondary zone \"%s\" expired",
+					  "slave zone \"%s\" expired",
 					  zp->z_origin);
 			}
 			zp->z_flags &= ~Z_AUTH;
@@ -1582,7 +1618,7 @@ stale(struct databuf *dp) {
 		if (zp->z_lastupdate > tt.tv_sec) {
 			if (!haveComplained((u_long)zp, (u_long)stale)) {
 				ns_notice(ns_log_default,
-					  "secondary zone \"%s\" time warp",
+					  "slave zone \"%s\" time warp",
 					  zp->z_origin);
 			}
 			zp->z_flags &= ~Z_AUTH;
@@ -1606,7 +1642,6 @@ stale(struct databuf *dp) {
 
 	default:
 		/* FALLTHROUGH */ ;
-
 	}
 	panic("stale: impossible condition", NULL);
 	/* NOTREACHED */
diff --git a/contrib/bind/bin/named/ns_resp.c b/contrib/bind/bin/named/ns_resp.c
index 2a56e11..31c233a 100644
--- a/contrib/bind/bin/named/ns_resp.c
+++ b/contrib/bind/bin/named/ns_resp.c
@@ -1,6 +1,6 @@
 #if !defined(lint) && !defined(SABER)
 static const char sccsid[] = "@(#)ns_resp.c	4.65 (Berkeley) 3/3/91";
-static const char rcsid[] = "$Id: ns_resp.c,v 8.149 2001/01/03 09:47:27 marka Exp $";
+static const char rcsid[] = "$Id: ns_resp.c,v 8.152 2001/02/13 23:28:31 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -470,8 +470,10 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 			if (!haveComplained(ina_ulong(from.sin_addr),
 					    (u_long)"unexpected source")) {
 				ns_info(ns_log_default,
-					"Response from unexpected source (%s)",
-					sin_ntoa(from));
+					"Response from unexpected source (%s) for query \"%s %s %s\"",
+					sin_ntoa(from),
+                        		*(qp->q_name) ? qp->q_name : ".",
+					p_class(qp->q_class), p_type(qp->q_type));
 			}
 			/* 
 			 * We don't know who this response came from so it
@@ -508,7 +510,7 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 				 (tt.tv_usec - stp->tv_usec) / 1000);
 		}
 		
-		if (ns_wouldlog(ns_log_default,3)) {
+		if (ns_wouldlog(ns_log_default, 3)) {
 			ns_debug(ns_log_default, 3,
 				 "stime %lu/%lu  now %lu/%lu rtt %ld",
 				 (u_long)stp->tv_sec, (u_long)stp->tv_usec,
@@ -546,10 +548,11 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 		 */
 		if (ns && qs->ns && (qp->q_nusedns < NSMAX)) {
 			qp->q_usedns[qp->q_nusedns++] = qs->ns;
-			if (ns_wouldlog(ns_log_default,2)) {
+			if (ns_wouldlog(ns_log_default, 2)) {
 				ns_debug(ns_log_default, 2,
 					 "NS #%d addr %s used, rtt %d",
-					 n, sin_ntoa(qs->ns_addr), ns->d_nstime);
+					 n, sin_ntoa(qs->ns_addr),
+					 ns->d_nstime);
 			}
 		}
 
@@ -587,8 +590,9 @@ ns_resp(u_char *msg, int msglen, struct sockaddr_in from, struct qstream *qsp)
 			if (t > 65535)
 				t = 65535;
 			ns2->d_nstime = (u_int16_t)t;
-			if (ns_wouldlog(ns_log_default,2)) {
-				ns_debug(ns_log_default, 2, "NS #%d %s rtt now %d", n,
+			if (ns_wouldlog(ns_log_default, 2)) {
+				ns_debug(ns_log_default, 2,
+					 "NS #%d %s rtt now %d", n,
 					 sin_ntoa(qs->ns_addr),
 					 ns2->d_nstime);
 			}
@@ -1479,14 +1483,14 @@ tcp_retry:
 	unsched(qp);
 	schedretry(qp, retrytime(qp));
 	nsa = Q_NEXTADDR(qp, 0);
-	if (ns_wouldlog(ns_log_default,1)) {
-	    ns_debug(ns_log_default, 1,
-		     "resp: forw -> %s ds=%d nsid=%d id=%d %dms",
-		     sin_ntoa(*nsa), ds,
-		     ntohs(qp->q_nsid), ntohs(qp->q_id),
-		     (qp->q_addr[0].nsdata != NULL)
-			    ? qp->q_addr[0].nsdata->d_nstime
-			    : -1);
+	if (ns_wouldlog(ns_log_default, 1)) {
+		ns_debug(ns_log_default, 1,
+			 "resp: forw -> %s ds=%d nsid=%d id=%d %dms",
+			 sin_ntoa(*nsa), ds,
+			 ntohs(qp->q_nsid), ntohs(qp->q_id),
+			 (qp->q_addr[0].nsdata != NULL)
+				 ? qp->q_addr[0].nsdata->d_nstime
+				 : -1);
 	}
 #ifdef DEBUG
 	if (debug >= 10)
@@ -2459,11 +2463,13 @@ sysquery(const char *dname, int class, int type,
 	qp->q_addr[0].stime = tt;	/* XXX - why not every? */
 	nsa = Q_NEXTADDR(qp, 0);
 
-	ns_debug(ns_log_default, 1,
-		 "sysquery: send -> %s dfd=%d nsid=%d id=%d retry=%ld",
-		 sin_ntoa(*nsa), qp->q_dfd, 
-		 ntohs(qp->q_nsid), ntohs(qp->q_id),
-		 (long)qp->q_time);
+	if (ns_wouldlog(ns_log_default, 1)) {
+		ns_debug(ns_log_default, 1,
+			 "sysquery: send -> %s dfd=%d nsid=%d id=%d retry=%ld",
+			 sin_ntoa(*nsa), qp->q_dfd, 
+			 ntohs(qp->q_nsid), ntohs(qp->q_id),
+			 (long)qp->q_time);
+	}
 #ifdef DEBUG
 	if (debug >= 10)
 		res_pquery(&res, qp->q_msg, qp->q_msglen,
@@ -2733,7 +2739,7 @@ findns(struct namebuf **npp, int class,
 					return (NXDOMAIN);
 				} else {
 					/* XXX:	zone isn't loaded but we're
-					 *	primary or secondary for it.
+					 *	primary or slave for it.
 					 *	should we fwd this?
 					 */
 					return (SERVFAIL);
diff --git a/contrib/bind/bin/named/ns_update.c b/contrib/bind/bin/named/ns_update.c
index e20d258..4ad697b 100644
--- a/contrib/bind/bin/named/ns_update.c
+++ b/contrib/bind/bin/named/ns_update.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_update.c,v 8.89 2001/01/14 09:46:20 marka Exp $";
+static const char rcsid[] = "$Id: ns_update.c,v 8.91.2.2 2001/04/30 03:20:46 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -1136,7 +1136,7 @@ class=%s, type=%s, ttl=%d, dp=0x%0x",
 static enum req_action
 req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg, 
 		   struct qstream *qsp, int dfd, struct sockaddr_in from,
-		   struct tsig_record *in_tsig, ns_updque curupd)
+		   struct tsig_record *in_tsig, ns_updque *curupd)
 {
 	char dnbuf[MAXDNAME], *dname;
 	u_int zocount, prcount, upcount, adcount, class, type, dlen;
@@ -1205,8 +1205,9 @@ req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg,
 	 */
 
 	if (!ip_addr_or_key_allowed(zp->z_update_acl, from.sin_addr, in_key)) {
-		ns_notice(ns_log_security, "denied update from %s for \"%s\"",
-			  sin_ntoa(from), *dname ? dname : ".");
+		ns_notice(ns_log_security,
+			  "denied update from %s for \"%s\" %s",
+			  sin_ntoa(from), *dname ? dname : ".", p_class(class));
 		nameserIncr(from.sin_addr, nssRcvdUUpd);
 		return (Refuse);
 	}
@@ -1282,7 +1283,7 @@ req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg,
 	rrecp = res_mkupdrec(S_ZONE, dname, class, type, 0);
 	rrecp->r_zone = zonenum;
 
-	APPEND(curupd, rrecp, r_link);
+	APPEND(*curupd, rrecp, r_link);
 
 	/*
 	 * Parse the prerequisite and update sections for format errors.
@@ -1342,7 +1343,7 @@ req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg,
 		DRCNTINC(dp);
 		rrecp->r_dp = dp;
 		/* Append the current record to the end of list of records. */
-		APPEND(curupd, rrecp, r_link);
+		APPEND(*curupd, rrecp, r_link);
 		if (cp > eom) {
 			ns_info(ns_log_update,
 				"Malformed response from %s (overrun)",
@@ -1353,7 +1354,7 @@ req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg,
 	}
 
 	/* Now process all parsed records in the prereq and update sections. */
-	numupdated = process_updates(&curupd, &rcode, from);
+	numupdated = process_updates(curupd, &rcode, from);
 	hp->rcode = rcode;
 	if (numupdated <= 0) {
 		if (rcode != NOERROR)
@@ -1370,7 +1371,7 @@ req_update_private(HEADER *hp, u_char *cp, u_char *eom, u_char *msg,
 	ns_stopxfrs(zp);
 
 	/* Make a log of the update. */
-	(void) printupdatelog(from, &curupd, hp, zp, old_serial);
+	(void) printupdatelog(from, curupd, hp, zp, old_serial);
 
 	return (Finish);
 }
@@ -1394,17 +1395,21 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 			next_rrecp = NEXT(rrecp, r_link);
 		else
 			next_rrecp = PREV(rrecp, r_link);
+		UNLINK(*updlist, rrecp, r_link);
 		if (rrecp->r_section != S_UPDATE) {
 			if (rrecp->r_dp) {
 				DRCNTDEC(rrecp->r_dp);
 				if (rrecp->r_dp->d_rcnt == 0)
 					db_freedata(rrecp->r_dp);
+				rrecp->r_dp = NULL;
 			}
+			INSIST(rrecp->r_deldp == NULL);
 			res_freeupdrec(rrecp);
 			continue;
 		}
 		dname = rrecp->r_dname;
 		dp = rrecp->r_dp;
+		rrecp->r_dp = NULL;
 		if ((dp->d_mark & D_MARK_ADDED) != 0) {
 			if (rcode == NOERROR) {
 				/*
@@ -1437,37 +1442,19 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 					 */
 				}
 			}
-			DRCNTDEC(dp);
-			if (dp->d_rcnt == 0)
-				db_freedata(dp);
-		} else {
-			/*
-			 * Databuf's matching this were deleted by this
-			 * update, or were never executed (because we bailed
-			 * out early).
-			 */
-			DRCNTDEC(dp);
-			if (dp->d_rcnt == 0)
-				db_freedata(dp);
 		}
+		DRCNTDEC(dp);
+		if (dp->d_rcnt == 0)
+			db_freedata(dp);
 
 		/* Process deleted databuf's. */
 		dp = rrecp->r_deldp;
+		rrecp->r_deldp = NULL;
 		while (dp != NULL) {
 			tmpdp = dp;
-			DRCNTDEC(tmpdp);
-			tmpdp->d_next = NULL;
 			dp = dp->d_next;
-			if (rcode == NOERROR) {
-				if (tmpdp->d_rcnt)
-					ns_debug(ns_log_update, 1,
-					   "free_rrecp: type = %d, rcnt = %d",
-						 p_type(tmpdp->d_type),
-						 tmpdp->d_rcnt);
-				else {
-					db_freedata(tmpdp);
-				}
-			} else {
+			tmpdp->d_next = NULL;
+			if (rcode != NOERROR) {
 				/* Add the databuf back. */
 				tmpdp->d_mark &= ~D_MARK_DELETED;
 				if (db_update(dname, tmpdp, tmpdp, NULL,
@@ -1480,13 +1467,13 @@ free_rrecp(ns_updque *updlist, int rcode, struct sockaddr_in from) {
 				      "free_rrecp: added back databuf 0x%0x",
 						 tmpdp);
 				}
-				if (tmpdp->d_rcnt == 0)
-					db_freedata(tmpdp);
 			}
+			DRCNTDEC(tmpdp);
+			if (tmpdp->d_rcnt == 0)
+				db_freedata(tmpdp);
 		}
 		res_freeupdrec(rrecp);
 	}
-	INIT_LIST(*updlist);
 }
 
 enum req_action
@@ -1499,7 +1486,7 @@ req_update(HEADER *hp, u_char *cp, u_char *eom, u_char *msg,
 
 	INIT_LIST(curupd);
 	ret = req_update_private(hp, cp, eom, msg, qsp, dfd, from,
-				 in_tsig, curupd);
+				 in_tsig, &curupd);
 	free_rrecp(&curupd, ret == Refuse ? ns_r_refused : hp->rcode, from);
 	if (ret == Finish) {
 		hp->qdcount = hp->ancount = hp->nscount = hp->arcount = 0;
@@ -2145,7 +2132,6 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 				 "isc_movefile(%s,%s) failed: %s :1",
 				 logname, zp->z_source,
 				 strerror(errno));
-			fclose(fp);
 			return (-1);
 		}
 		/* Finally, tell caller to reload zone. */
@@ -2245,6 +2231,7 @@ merge_logs(struct zoneinfo *zp, char *logname) {
 					ns_error(ns_log_update,
 				 "error merging update id %d from log file %s",
 						 id, logname);
+					fclose(fp);
 					return(-1);
 				}
 				free_rrecp(&curupd, rcode, empty_from);
diff --git a/contrib/bind/bin/named/ns_xfr.c b/contrib/bind/bin/named/ns_xfr.c
index 5c05fe0..836195b 100644
--- a/contrib/bind/bin/named/ns_xfr.c
+++ b/contrib/bind/bin/named/ns_xfr.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ns_xfr.c,v 8.63 2000/12/23 08:14:43 vixie Exp $";
+static const char rcsid[] = "$Id: ns_xfr.c,v 8.64 2001/02/15 00:18:46 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -117,8 +117,10 @@ ns_xfr(struct qstream *qsp, struct namebuf *znp,
 	(void) setsockopt(qsp->s_rfd, SOL_SOCKET, SO_SNDLOWAT,
 			  (char *)&sndlowat, sizeof sndlowat);
 #endif
-	if (sq_openw(qsp, 64*1024) == -1)
+	if (sq_openw(qsp, 64*1024) == -1) {
+		ns_error(ns_log_xfer_out, "ns_xfr: out of memory");
 		goto abort;
+	}
 	memset(&qsp->xfr, 0, sizeof qsp->xfr);
 	qsp->xfr.top.axfr = znp;
 	qsp->xfr.zone = zone;
@@ -129,8 +131,10 @@ ns_xfr(struct qstream *qsp, struct namebuf *znp,
 	qsp->xfr.id = id;
 	qsp->xfr.opcode = opcode;
 	qsp->xfr.msg = memget(XFER_BUFSIZE);
-	if (!qsp->xfr.msg)
+	if (!qsp->xfr.msg) {
+		ns_error(ns_log_xfer_out, "ns_xfr: out of memory");
 		goto abort;
+	}
 	qsp->xfr.eom = qsp->xfr.msg + XFER_BUFSIZE;
 	qsp->xfr.cp = NULL;
 	qsp->xfr.state = s_x_firstsoa;
@@ -199,6 +203,7 @@ ns_xfr(struct qstream *qsp, struct namebuf *znp,
 		}
 	} else {
 		if (sx_pushlev(qsp, znp) < 0) {
+			ns_error(ns_log_xfer_out, "ns_xfr: out of memory");
  abort:
 			(void) shutdown(qsp->s_rfd, 2);
 			sq_remove(qsp);
diff --git a/contrib/bind/bin/ndc/ndc.c b/contrib/bind/bin/ndc/ndc.c
index bc3e2dc..9daf69f 100644
--- a/contrib/bind/bin/ndc/ndc.c
+++ b/contrib/bind/bin/ndc/ndc.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: ndc.c,v 1.16 2000/12/23 08:14:45 vixie Exp $";
+static const char rcsid[] = "$Id: ndc.c,v 1.16.2.1 2001/04/26 02:56:10 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -45,6 +45,9 @@ static const char rcsid[] = "$Id: ndc.c,v 1.16 2000/12/23 08:14:45 vixie Exp $";
 
 #include "port_after.h"
 #include "pathnames.h"
+#ifndef PATH_SEP
+#define PATH_SEP '/'
+#endif
 
 typedef union {
 	struct sockaddr_in in;
@@ -115,7 +118,7 @@ main(int argc, char *argv[], char *envp[]) {
 	char *p;
 	int ch;
 
-	if ((program = strrchr(argv[0], '/')) != NULL)
+	if ((program = strrchr(argv[0], PATH_SEP)) != NULL)
 		program++;
 	else
 		program = argv[0];
diff --git a/contrib/bind/bin/nslookup/Makefile b/contrib/bind/bin/nslookup/Makefile
index 5c564f4..6680bc6 100644
--- a/contrib/bind/bin/nslookup/Makefile
+++ b/contrib/bind/bin/nslookup/Makefile
@@ -13,7 +13,7 @@
 ## ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 ## SOFTWARE.
 
-# $Id: Makefile,v 8.26 2000/12/23 08:02:55 vixie Exp $
+# $Id: Makefile,v 8.27 2001/01/31 08:44:43 marka Exp $
 
 DESTDIR=
 CC= cc
@@ -42,7 +42,7 @@ INSTALL_EXEC=
 INSTALL_LIB=-o bin -g bin
 
 LDFLAGS=
-DEFS=	-D_PATH_HELPFILE=\"${DESTDIR}${DESTHELP}/nslookup.help\"
+DEFS=	-D_PATH_HELPFILE=\"${DESTHELP}/nslookup.help\"
 CFLAGS=	${CDEBUG}
 CPPFLAGS=  -I${PORTINCL} -I${INCL} ${DEFS}
 
diff --git a/contrib/bind/bin/nslookup/getinfo.c b/contrib/bind/bin/nslookup/getinfo.c
index 57aadd3..8b5cf38 100644
--- a/contrib/bind/bin/nslookup/getinfo.c
+++ b/contrib/bind/bin/nslookup/getinfo.c
@@ -53,7 +53,7 @@
 
 #ifndef lint
 static const char sccsid[] = "@(#)getinfo.c	5.26 (Berkeley) 3/21/91";
-static const char rcsid[] = "$Id: getinfo.c,v 8.17 2000/12/23 08:14:46 vixie Exp $";
+static const char rcsid[] = "$Id: getinfo.c,v 8.18 2001/02/27 06:03:40 vixie Exp $";
 #endif /* not lint */
 
 /*
@@ -174,7 +174,7 @@ GetAnswer(nsAddrPtr, queryType, msg, msglen, iquery, hostPtr, isServer)
      */
     FreeHostInfoPtr(hostPtr);
 
-    status = SendRequest(nsAddrPtr, msg, msglen, (u_char *) &answer,
+    status = SendRequest(nsAddrPtr, (u_char *)msg, msglen, (u_char *) &answer,
 			 sizeof(answer), &n);
 
     if (status != SUCCESS) {
diff --git a/contrib/bind/doc/html/controls.html b/contrib/bind/doc/html/controls.html
index 9261926..0789901 100644
--- a/contrib/bind/doc/html/controls.html
+++ b/contrib/bind/doc/html/controls.html
@@ -47,6 +47,11 @@ It is recommended that the
 permissions be restricted to administrative personnel only, or else any
 user on the system might be able to manage the local name server.</P>
 
+<P>On Solaris and SunOS machines the permissions and ownerships are applied
+to the containing directory.
+This is done because these operating systems
+do not honour the permission on the UNIX domain socket.
+
 <P>An <CODE>inet</CODE> control channel is a TCP/IP socket accessible
 to the Internet, created at the specified <VAR>ip_port</VAR> on the
 specified <VAR>ip_addr</VAR>.
@@ -64,7 +69,7 @@ server.</P>
 
 <HR>
 <ADDRESS>
-Last Updated: $Id: controls.html,v 1.4 1999/09/15 20:28:01 cyarnell Exp $
+Last Updated: $Id: controls.html,v 1.5 2001/02/01 04:27:11 marka Exp $
 </ADDRESS>
 </BODY>
 </HTML>
diff --git a/contrib/bind/doc/html/master.html b/contrib/bind/doc/html/master.html
index dbf8503..33487de 100644
--- a/contrib/bind/doc/html/master.html
+++ b/contrib/bind/doc/html/master.html
@@ -42,7 +42,7 @@ WWW.MYZONE.EXAMPLE. CNAME MAIN-SERVER.MYZONE.EXAMPLE.
 Syntax: <CODE>$INCLUDE &lt;filename&gt; [&lt;origin&gt;] [&lt;comment&gt;]</CODE>
 <P>
 Read and process the file filename as if it was included into the file at this
-point.  If origin is specified the file is processed with <CODE>$ORIGIN</CODE>
+point.  If origin is specified the file is processed with <CODE>$ORIGIN</CODE>
 set to that value otherwise the current <CODE>$ORIGIN</CODE> is used.
 <I>NOTE: The  behaviour when &lt;origin&gt; is specified differs from that
 described in 
diff --git a/contrib/bind/doc/html/options.html b/contrib/bind/doc/html/options.html
index d5ea552..ec7126a 100644
--- a/contrib/bind/doc/html/options.html
+++ b/contrib/bind/doc/html/options.html
@@ -243,7 +243,7 @@ See also <CODE>fetch-glue</CODE> above.
 <DT><CODE>rfc2308-type1</CODE>
 <DD>
 If <CODE>yes</CODE>, the server will send NS records along with the SOA
-record for negative answers.
+record for negative answers from the cache.
 You need to set this to <CODE>no</CODE> if you have an old BIND
 server using you as a forwarder that does not understand negative answers
 which contain both SOA and NS records or you have an old version of sendmail.
@@ -433,9 +433,8 @@ The default is
     query-source address * port *;
 </PRE>
 
-<P>Note: <CODE>query-source</CODE> currently applies only to UDP queries;
-TCP queries always use a wildcard IP address and a random unprivileged
-port.
+<P>Note: <CODE>query-source port</CODE> applies only to UDP queries,
+TCP queries always use a random unprivileged port.
 
 <A name="ZoneTransfers"><H4>Zone Transfers</H4></A>
 
@@ -813,7 +812,7 @@ request for the root servers to be accepted.  Default 2.
 
 <HR>
 <ADDRESS>
-Last Updated: $Id: options.html,v 1.41 2000/11/29 11:49:09 marka Exp $
+Last Updated: $Id: options.html,v 1.43 2001/03/03 05:08:55 marka Exp $
 </ADDRESS>
 </BODY>
 </HTML>
diff --git a/contrib/bind/doc/man/named.8 b/contrib/bind/doc/man/named.8
index 80ee217..b978993 100644
--- a/contrib/bind/doc/man/named.8
+++ b/contrib/bind/doc/man/named.8
@@ -54,13 +54,13 @@
 .\"	@(#)named.8	6.6 (Berkeley) 2/14/89
 .\"
 .Dd February 1, 1996
-.Dt @INDOT_U@NAMED @SYS_OPS_EXT_U@ 
+.Dt @INDOT_U@named @SYS_OPS_EXT_U@ 
 .Os BSD 4
 .Sh NAME
 .Nm @INDOT@named 
 .Nd Internet domain name server (DNS)
 .Sh SYNOPSIS
-.Nm @INDOT@NAMED
+.Nm @INDOT@named
 .Op Fl d Ar debuglevel
 .Op Fl p Ar port# 
 .Oo Fl Po 
@@ -114,7 +114,7 @@ is set to
 .Sy NOTE:
 The new debugging framework is considerably more sophisticated than it
 was in older versions of 
-.Nm @INDOT@NAMED .
+.Nm @INDOT@named .
 The configuration file's
 .Dq Li logging
 statement allows for multiple, distinct levels of debugging for each of
@@ -124,7 +124,7 @@ etc.).  Please refer to the configuration file guide included with this
 distribution for further information about these extensive new capabilities.
 .It Fl p Ar port#
 Use the specified remote port number; this is the port number to which 
-.Nm @INDOT@NAMED
+.Nm @INDOT@named
 will send queries.  The default value is the standard port number, i.e.,
 the port number returned by 
 .Xr getservbyname @LIB_NETWORK_EXT@ 
@@ -139,7 +139,7 @@ was supported; the first port was that used when contacting
 servers, and the second one was the service port bound by the 
 .Em local 
 instance of
-.Nm @INDOT_U@NAMED .
+.Nm @INDOT_U@named .
 The current usage is equivalent to the old usage without the 
 .Ar localport#
 specified; this functionality can be specified with the 
@@ -164,7 +164,7 @@ Run this process in the foreground; don't
 and daemonize.  (The default is to daemonize.)
 .It Fl q
 Trace all incoming queries if 
-.Nm @INDOT_U@NAMED 
+.Nm @INDOT_U@named 
 has been compiled with
 .Li QRYLOG 
 defined.  
diff --git a/contrib/bind/include/resolv.h b/contrib/bind/include/resolv.h
index 600e98b..75578ff 100644
--- a/contrib/bind/include/resolv.h
+++ b/contrib/bind/include/resolv.h
@@ -50,7 +50,7 @@
 
 /*
  *	@(#)resolv.h	8.1 (Berkeley) 6/2/93
- *	$Id: resolv.h,v 8.32 2000/12/23 08:14:49 vixie Exp $
+ *	$Id: resolv.h,v 8.32.2.1 2001/05/17 03:01:30 marka Exp $
  */
 
 #ifndef _RESOLV_H_
@@ -96,7 +96,9 @@
 
 #define RES_SET_H_ERRNO(r,x) __h_errno_set(r,x)
 struct __res_state; /* forward */
+__BEGIN_DECLS
 void __h_errno_set(struct __res_state *res, int err);
+__END_DECLS
 
 /*
  * Resolver configuration file.
@@ -239,7 +241,9 @@ typedef struct __res_state *res_state;
 
 /* Things involving an internal (static) resolver context. */
 #ifdef _REENTRANT
+__BEGIN_DECLS
 extern struct __res_state *__res_state(void);
+__END_DECLS
 #define _res (*__res_state())
 #else
 #ifndef __BIND_NOSTATIC
diff --git a/contrib/bind/lib/dst/bsafe_link.c b/contrib/bind/lib/dst/bsafe_link.c
index 7d9345e..ec072b3 100644
--- a/contrib/bind/lib/dst/bsafe_link.c
+++ b/contrib/bind/lib/dst/bsafe_link.c
@@ -1,5 +1,5 @@
 #if defined(BSAFE) || defined(DNSSAFE)
-static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/bsafe_link.c,v 1.11 1999/10/13 16:39:22 vixie Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/bsafe_link.c,v 1.12 2001/04/05 21:59:59 bwelling Exp $";
 
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -489,8 +489,6 @@ dst_bsafe_from_dns_key(DST_KEY *s_key, const u_char *key, const int len)
 
 	B_SetKeyInfo(r_key->rk_Public_Key, KI_RSAPublic, (POINTER) public);
 
-	s_key->dk_id = (u_int16_t)
-		dst_s_get_int16(&public->modulus.data[public->modulus.len - 3]);
 	s_key->dk_key_size = dst_bsafe_key_size(r_key);
 	SAFE_FREE(public->modulus.data);
 	SAFE_FREE(public->exponent.data);
@@ -750,8 +748,6 @@ dst_bsafe_key_from_file_format(DST_KEY *d_key, const char *buff,
 	if (status)
 		return (-1);
 
-	tag = (int)(u_int16_t)
-		dst_s_get_int16(&public->modulus.data[public->modulus.len - 3]);
 	d_key->dk_key_size = dst_bsafe_key_size(b_key);
 
 	SAFE_FREE(private->modulus.data);
@@ -766,7 +762,7 @@ dst_bsafe_key_from_file_format(DST_KEY *d_key, const char *buff,
 	SAFE_FREE(public->modulus.data);
 	SAFE_FREE(public->exponent.data);
 	SAFE_FREE(public);
-	return (tag);
+	return (0);
 }
 
 
@@ -925,10 +921,7 @@ dst_bsafe_generate_keypair(DST_KEY *key, int exp)
 	rsa->rk_Public_Key = public;
 	key->dk_KEY_struct = (void *) rsa;
 
-	/* fill in the footprint on generate key */
 	B_GetKeyInfo((POINTER *) &pk_access, public, KI_RSAPublic);
-	key->dk_id = (u_int16_t)
-		dst_s_get_int16(&pk_access->modulus.data[pk_access->modulus.len - 3]);
 	return (1);
 }
 
diff --git a/contrib/bind/lib/dst/cylink_link.c b/contrib/bind/lib/dst/cylink_link.c
index 0638ef1..60097f5 100644
--- a/contrib/bind/lib/dst/cylink_link.c
+++ b/contrib/bind/lib/dst/cylink_link.c
@@ -1,5 +1,5 @@
 #ifdef CYLINK_DSS
-static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/cylink_link.c,v 1.7 1999/10/13 16:39:22 vixie Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/cylink_link.c,v 1.8 2001/04/05 22:00:00 bwelling Exp $";
 
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -373,7 +373,6 @@ dst_cylink_from_dns_key(DST_KEY *s_key, const u_char *key, const int len)
 	memcpy(d_key->dk_y, key_ptr, d_key->dk_p_bytes);
 	key_ptr += d_key->dk_p_bytes;
 
-	s_key->dk_id = dst_s_id_calc(key, len); 
 	s_key->dk_key_size = d_key->dk_p_bytes * 8;
 	return (1);
 }
@@ -470,9 +469,7 @@ dst_cylink_key_from_file_format(DST_KEY *d_key, const char *buff,
 				const int buff_len)
 {
 	u_char s[DSS_LENGTH_MAX];
-	u_char dns[1024];
 	int len, s_len = sizeof(s);
-	int foot = -1, dnslen;
 	const char *p = buff;
 	DSA_Key *dsa_key;
 
@@ -534,10 +531,8 @@ dst_cylink_key_from_file_format(DST_KEY *d_key, const char *buff,
 	}			/* while p */
 
 	d_key->dk_key_size = dsa_key->dk_p_bytes * 8;
-	dnslen = d_key->dk_func->to_dns_key(d_key, dns, sizeof(dns));
-	foot = dst_s_id_calc(dns, dnslen);
 
-	return (foot);
+	return (0);
 }
 
 
@@ -577,10 +572,9 @@ dst_cylink_free_key_structure(void *key)
 static int
 dst_cylink_generate_keypair(DST_KEY *key, int nothing)
 {
-	int status, dnslen, n;
+	int status, n;
 	DSA_Key *dsa;
 	u_char rand[SHA_LENGTH];
-	u_char dns[1024];
 
 	if (key == NULL || key->dk_alg != KEY_DSA)
 		return (0);
@@ -615,8 +609,6 @@ dst_cylink_generate_keypair(DST_KEY *key, int nothing)
 		return (0);
 	memset(rand, 0, sizeof(rand));
 	key->dk_KEY_struct = (void *) dsa;
-	dnslen = key->dk_func->to_dns_key(key, dns, sizeof(dns));
-	key->dk_id = dst_s_id_calc(dns, dnslen);
 	return (1);
 }
 
diff --git a/contrib/bind/lib/dst/dst_api.c b/contrib/bind/lib/dst/dst_api.c
index e32d075..c296fdd 100644
--- a/contrib/bind/lib/dst/dst_api.c
+++ b/contrib/bind/lib/dst/dst_api.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/dst_api.c,v 1.16 2000/11/13 04:09:23 vixie Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/dst_api.c,v 1.17 2001/04/05 22:00:02 bwelling Exp $";
 #endif
 
 /*
@@ -657,6 +657,7 @@ dst_dnskey_to_key(const char *in_name, const u_char *rdata, const int len)
 
 	if (in_name == NULL)
 		return (NULL);
+	key_st->dk_id = dst_s_dns_key_id(rdata, len);
 	key_st->dk_flags = dst_s_get_int16(rdata);
 	key_st->dk_proto = (u_int16_t) rdata[DST_KEY_PROT];
 	if (key_st->dk_flags & DST_EXTEND_FLAG) {
@@ -760,6 +761,8 @@ dst_buffer_to_key(const char *key_name,		/* name of the key */
 {
 	
 	DST_KEY *dkey = NULL; 
+	int dnslen;
+	u_char dns[2048];
 
 	if (!dst_check_algorithm(alg)) { /* make sure alg is available */
 		EREPORT(("dst_buffer_to_key(): Algorithm %d not suppored\n", alg));
@@ -771,14 +774,17 @@ dst_buffer_to_key(const char *key_name,		/* name of the key */
 
 	if (dkey == NULL)
 		return (NULL);
-	if (dkey->dk_func != NULL && dkey->dk_func->from_dns_key != NULL) {
-		if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
-			EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
-			return (dst_free_key(dkey));
-		}
-		return (dkey);
+	if (dkey->dk_func == NULL || dkey->dk_func->from_dns_key == NULL)
+		return NULL;
+
+	if (dkey->dk_func->from_dns_key(dkey, key_buf, key_len) < 0) {
+		EREPORT(("dst_buffer_to_key(): dst_buffer_to_hmac failed\n"));
+		return (dst_free_key(dkey));
 	}
-	return (NULL);
+
+	dnslen = dst_key_to_dnskey(dkey, dns, sizeof(dns));
+	dkey->dk_id = dst_s_dns_key_id(dns, dnslen);
+	return (dkey);
 }
 
 int 
@@ -816,10 +822,12 @@ dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
 			    int in_alg)
 {
 	int cnt, alg, len, major, minor, file_major, file_minor;
-	int id;
+	int ret, id;
 	char filename[PATH_MAX];
 	u_char in_buff[RAW_KEY_SIZE], *p;
 	FILE *fp;
+	int dnslen;
+	u_char dns[2048];
 
 	if (name == NULL || pk_key == NULL) {
 		EREPORT(("dst_read_private_key_file(): No key name given\n"));
@@ -886,10 +894,13 @@ dst_s_read_private_key_file(char *name, DST_KEY *pk_key, u_int16_t in_id,
 	if (pk_key->dk_func == NULL || pk_key->dk_func->from_file_fmt == NULL)
 		goto fail;
 
-	id = pk_key->dk_func->from_file_fmt(pk_key, (char *)p, &in_buff[len] - p);
-	if (id < 0)
+	ret = pk_key->dk_func->from_file_fmt(pk_key, (char *)p, &in_buff[len] - p);
+	if (ret < 0)
 		goto fail;
 
+	dnslen = dst_key_to_dnskey(pk_key, dns, sizeof(dns));
+	id = dst_s_dns_key_id(dns, dnslen);
+
 	/* Make sure the actual key tag matches the input tag used in the filename
 	 */
 	if (id != in_id) {
@@ -942,6 +953,9 @@ dst_generate_key(const char *name, const int bits, const int exp,
 {
 	DST_KEY *new_key = NULL;
 	int res;
+	int dnslen;
+	u_char dns[2048];
+
 	if (name == NULL)
 		return (NULL);
 
@@ -966,6 +980,13 @@ dst_generate_key(const char *name, const int bits, const int exp,
 			 new_key->dk_key_size, exp));
 		return (dst_free_key(new_key));
 	}
+
+	dnslen = dst_key_to_dnskey(new_key, dns, sizeof(dns));
+	if (dnslen != UNSUPPORTED_KEYALG)
+		new_key->dk_id = dst_s_dns_key_id(dns, dnslen);
+	else
+		new_key->dk_id = 0;
+
 	return (new_key);
 }
 
diff --git a/contrib/bind/lib/dst/eay_dss_link.c b/contrib/bind/lib/dst/eay_dss_link.c
index 8542149..0cc01a8 100644
--- a/contrib/bind/lib/dst/eay_dss_link.c
+++ b/contrib/bind/lib/dst/eay_dss_link.c
@@ -1,5 +1,5 @@
 #ifdef EAY_DSS
-static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/eay_dss_link.c,v 1.4 1999/10/13 16:39:23 vixie Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/eay_dss_link.c,v 1.5 2001/04/05 22:00:03 bwelling Exp $";
 
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -341,7 +341,6 @@ dst_eay_dss_from_dns_key(DST_KEY *s_key, const u_char *key, const int len)
 	d_key->pub_key = BN_bin2bn(key_ptr, p_bytes, NULL);
 	key_ptr += p_bytes;
 
-	s_key->dk_id = dst_s_id_calc(key, len); 
 	s_key->dk_key_size = p_bytes * 8;
 	return (1);
 }
@@ -442,9 +441,7 @@ dst_eay_dss_key_from_file_format(DST_KEY *d_key, const u_char *buff,
 				const int buff_len)
 {
 	char s[128];
-	char dns[1024];
 	int len, s_len = sizeof(s);
-	int foot = -1, dnslen;
 	const char *p = buff;
 	DSA *dsa_key;
 
@@ -499,10 +496,8 @@ dst_eay_dss_key_from_file_format(DST_KEY *d_key, const u_char *buff,
 	}			/* while p */
 
 	d_key->dk_key_size = BN_num_bytes(dsa_key->p);
-	dnslen = d_key->dk_func->to_dns_key(d_key, dns, sizeof(dns));
-	foot = dst_s_id_calc(dns, dnslen);
 
-	return (foot);
+	return (0);
 }
 
 
@@ -543,10 +538,9 @@ dst_eay_dss_free_key_structure(void *key)
 static int
 dst_eay_dss_generate_keypair(DST_KEY *key, int nothing)
 {
-	int status, dnslen, n;
+	int status, n;
 	DSA *dsa;
 	u_char rand[SHA_DIGEST_LENGTH];
-	char dns[1024];
 
 	if (key == NULL || key->dk_alg != KEY_DSA)
 		return (0);
@@ -572,8 +566,6 @@ dst_eay_dss_generate_keypair(DST_KEY *key, int nothing)
 		return(0);
 	}
 	key->dk_KEY_struct = (void *) dsa;
-	dnslen = key->dk_func->to_dns_key(key, dns, sizeof(dns));
-	key->dk_id = dst_s_id_calc(dns, dnslen);
 	return (1);
 }
 
diff --git a/contrib/bind/lib/dst/prandom.c b/contrib/bind/lib/dst/prandom.c
index a17e071..031da2e 100644
--- a/contrib/bind/lib/dst/prandom.c
+++ b/contrib/bind/lib/dst/prandom.c
@@ -1,5 +1,5 @@
 #ifndef LINT
-static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/prandom.c,v 1.9 2000/07/17 07:36:53 vixie Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/prandom.c,v 1.10 2001/02/12 23:13:46 marka Exp $";
 #endif
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -204,7 +204,6 @@ do_time(dst_work *work)
 	zone = (struct timezone *) tmp;
 	mtime = (struct timeval *)(tmp + sizeof(struct timezone));
 	gettimeofday(mtime, zone);
-	assert(mtime->tv_usec >= 0 && mtime->tv_usec < 1000000);
 	cnt = sizeof(tmp);
 	my_digest(work, tmp, sizeof(tmp));
 
@@ -252,7 +251,7 @@ do_ls(dst_work *work)
 	if (stat(dirs[i++], &buf))  /* directory does not exist */
 		return (0);
 
-	gettimeofday(&tv,NULL);
+	gettimeofday(&tv, NULL);
 	if (d_round == 0) 
 		d_round = tv.tv_sec - MAX_OLD;
 	else if (i==1) /* if starting a new round cut what we accept */
diff --git a/contrib/bind/lib/dst/rsaref_link.c b/contrib/bind/lib/dst/rsaref_link.c
index 52a49b4..a45b6f7 100644
--- a/contrib/bind/lib/dst/rsaref_link.c
+++ b/contrib/bind/lib/dst/rsaref_link.c
@@ -1,5 +1,5 @@
 #ifdef RSAREF
-static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/rsaref_link.c,v 1.7 2000/07/17 07:36:53 vixie Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/rsaref_link.c,v 1.9 2001/04/05 22:00:04 bwelling Exp $";
 
 /*
  * Portions Copyright (c) 1995-1998 by Trusted Information Systems, Inc.
@@ -357,8 +357,6 @@ dst_rsaref_from_dns_key(DST_KEY *s_key, const u_char *key, const int len)
 	memcpy(&r_key->rk_Public_Key->modulus[MAX_RSA_MODULUS_LEN - bytes],
 	       key_ptr, bytes);
 	r_key->rk_Public_Key->bits = bytes * 8;
-	s_key->dk_id = (u_int16_t) dst_s_get_int16((u_char *)
-		   &r_key->rk_Public_Key->modulus[MAX_RSA_MODULUS_LEN - 3]);
 	s_key->dk_key_size = r_key->rk_Public_Key->bits;
 
 	return (1);
@@ -544,10 +542,8 @@ dst_rsaref_key_from_file_format(DST_KEY *d_key, const u_char *buff,
 	r_key->rk_signer = strdup(d_key->dk_key_name);
 	d_key->dk_KEY_struct = (void *) r_key;
 	d_key->dk_key_size = r_key->rk_Private_Key->bits;
-	d_key->dk_id = (u_int16_t) dst_s_get_int16((u_char *)
-		   &r_key->rk_Public_Key->modulus[MAX_RSA_MODULUS_LEN - 3]);
-	foot = (int) d_key->dk_id;
-	return (foot);
+
+	return (0);
 }
 
 
@@ -646,8 +642,6 @@ dst_rsaref_generate_keypair(DST_KEY *key, const int exp)
 	rsa->rk_Public_Key = public;
 	key->dk_KEY_struct = (void *) rsa;
 
-	key->dk_id = (u_int16_t) dst_s_get_int16((u_char *)
-		     &rsa->rk_Public_Key->modulus[MAX_RSA_MODULUS_LEN - 3]);
 	return (1);
 }
 
@@ -706,7 +700,6 @@ dst_rsaref_init_random_struct(R_RANDOM_STRUCT * randomstruct)
 	 * This must be the FIRST CALL
 	 */
 	gettimeofday(&tv, 0);
-	assert(tv.tv_usec >= 0 && tv.tv_usec < 1000000);
 	R_RandomUpdate(randomstruct, (u_char *) &tv,
 		       sizeof(struct timeval));
 
diff --git a/contrib/bind/lib/dst/support.c b/contrib/bind/lib/dst/support.c
index d07df5a..d191eb4 100644
--- a/contrib/bind/lib/dst/support.c
+++ b/contrib/bind/lib/dst/support.c
@@ -1,4 +1,4 @@
-static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/support.c,v 1.8 1999/10/13 16:39:24 vixie Exp $";
+static const char rcsid[] = "$Header: /proj/cvs/isc/bind8/src/lib/dst/support.c,v 1.9 2001/04/05 22:00:06 bwelling Exp $";
 
 
 /*
@@ -200,7 +200,7 @@ dst_s_calculate_bits(const u_char *str, const int max_bits)
 
 
 /*
- * calculates a checksum used in kmt for a id.
+ * calculates a checksum used in dst for an id.
  * takes an array of bytes and a length.
  * returns a 16  bit checksum.
  */
@@ -225,34 +225,27 @@ dst_s_id_calc(const u_char *key, const int keysize)
 }
 
 /* 
- * dst_s_dns_key_id() Function to calculated DNSSEC footprint from KEY reocrd
- *   rdata (all of  record)
+ * dst_s_dns_key_id() Function to calculate DNSSEC footprint from KEY record
+ *   rdata
  * Input:
  *	dns_key_rdata: the raw data in wire format 
  *      rdata_len: the size of the input data 
  * Output:
- *      the key footprint/id calcuated from the key data 
+ *      the key footprint/id calculated from the key data 
  */ 
 u_int16_t
 dst_s_dns_key_id(const u_char *dns_key_rdata, const int rdata_len)
 {
-	int key_data = 4;
-
-	if (!dns_key_rdata || (rdata_len < key_data))
+	if (!dns_key_rdata)
 		return 0;
 
-	/* check the extended parameters bit in the DNS Key RR flags */
-	if (dst_s_get_int16(dns_key_rdata) & DST_EXTEND_FLAG)
-		key_data += 2;
-
 	/* compute id */
 	if (dns_key_rdata[3] == KEY_RSA)	/* Algorithm RSA */
 		return dst_s_get_int16((u_char *)
 				       &dns_key_rdata[rdata_len - 3]);
 	else
 		/* compute a checksum on the key part of the key rr */
-		return dst_s_id_calc(&dns_key_rdata[key_data],
-				     (rdata_len - key_data));
+		return dst_s_id_calc(dns_key_rdata, rdata_len);
 }
 
 /*
diff --git a/contrib/bind/lib/inet/nsap_addr.c b/contrib/bind/lib/inet/nsap_addr.c
index b28acec..da388dc 100644
--- a/contrib/bind/lib/inet/nsap_addr.c
+++ b/contrib/bind/lib/inet/nsap_addr.c
@@ -16,7 +16,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static const char rcsid[] = "$Id: nsap_addr.c,v 8.10 1999/10/13 16:39:28 vixie Exp $";
+static const char rcsid[] = "$Id: nsap_addr.c,v 8.11 2001/03/26 07:04:30 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -44,6 +44,9 @@ inet_nsap_addr(const char *ascii, u_char *binary, int maxlen) {
 	u_char c, nib;
 	u_int len = 0;
 
+	if (ascii[0] != '0' || (ascii[1] != 'x' && ascii[1] != 'X'))
+		return (0);
+
 	while ((c = *ascii++) != '\0' && len < (u_int)maxlen) {
 		if (c == '.' || c == '+' || c == '/')
 			continue;
@@ -75,7 +78,7 @@ char *
 inet_nsap_ntoa(int binlen, const u_char *binary, char *ascii) {
 	int nib;
 	int i;
-	static char tmpbuf[255*3];
+	static char tmpbuf[2+255*3];
 	char *start;
 
 	if (ascii)
@@ -85,6 +88,9 @@ inet_nsap_ntoa(int binlen, const u_char *binary, char *ascii) {
 		start = tmpbuf;
 	}
 
+	*ascii = '0';
+	*ascii = 'x';
+
 	if (binlen > 255)
 		binlen = 255;
 
diff --git a/contrib/bind/lib/irs/gethostent.c b/contrib/bind/lib/irs/gethostent.c
index 5d316c8..5aa46c5 100644
--- a/contrib/bind/lib/irs/gethostent.c
+++ b/contrib/bind/lib/irs/gethostent.c
@@ -16,7 +16,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: gethostent.c,v 1.27 2000/04/20 07:10:33 vixie Exp $";
+static const char rcsid[] = "$Id: gethostent.c,v 1.28 2001/03/01 05:47:44 marka Exp $";
 #endif
 
 /* Imports */
@@ -138,7 +138,8 @@ gethostbyname2_p(const char *name, int af, struct net_data *net_data) {
 
 	if (!net_data || !(ho = net_data->ho))
 		return (NULL);
-	if (net_data->ho_stayopen && net_data->ho_last) {
+	if (net_data->ho_stayopen && net_data->ho_last &&
+	    net_data->ho_last->h_addrtype == af) {
 		if (ns_samename(name, net_data->ho_last->h_name) == 1)
 			return (net_data->ho_last);
 		for (hap = net_data->ho_last->h_aliases; hap && *hap; hap++)
diff --git a/contrib/bind/lib/isc/ev_timers.c b/contrib/bind/lib/isc/ev_timers.c
index ff44e49..e5e5684 100644
--- a/contrib/bind/lib/isc/ev_timers.c
+++ b/contrib/bind/lib/isc/ev_timers.c
@@ -20,7 +20,7 @@
  */
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: ev_timers.c,v 1.26 2000/07/17 07:36:54 vixie Exp $";
+static const char rcsid[] = "$Id: ev_timers.c,v 1.30 2001/02/12 23:13:48 marka Exp $";
 #endif
 
 /* Import. */
@@ -38,6 +38,7 @@ static const char rcsid[] = "$Id: ev_timers.c,v 1.26 2000/07/17 07:36:54 vixie E
 
 /* Constants. */
 
+#define	MILLION 1000000
 #define BILLION 1000000000
 
 /* Forward. */
@@ -111,7 +112,6 @@ evNowTime() {
 
 	if (gettimeofday(&now, NULL) < 0)
 		return (evConsTime(0, 0));
-	INSIST(now.tv_usec >= 0 && now.tv_usec < 1000000);
 	return (evTimeSpec(now));
 }
 
diff --git a/contrib/bind/lib/isc/memcluster.c b/contrib/bind/lib/isc/memcluster.c
index b775fa7..d565c05 100644
--- a/contrib/bind/lib/isc/memcluster.c
+++ b/contrib/bind/lib/isc/memcluster.c
@@ -20,10 +20,11 @@
    bigger and some debugging info stuck before and after the region given 
    back to the caller. */
 /* #define DEBUGGING_MEMCLUSTER */
+#define MEMCLUSTER_ATEND
 
 
 #if !defined(LINT) && !defined(CODECENTER)
-static const char rcsid[] = "$Id: memcluster.c,v 8.19 1999/10/13 17:11:22 vixie Exp $";
+static const char rcsid[] = "$Id: memcluster.c,v 8.20 2001/02/13 23:14:54 marka Exp $";
 #endif /* not lint */
 
 #include "port_before.h"
@@ -397,8 +398,19 @@ __memput_record(void *mem, size_t size, const char *file, int line) {
 	e->file = file;
 	e->line = line;
 #endif
+#ifdef MEMCLUSTER_ATEND
+	e->next = NULL;
+	el = freelists[new_size];
+	while (el != NULL && el->next != NULL)
+		el = el->next;
+	if (el)
+		el->next = e;
+	else
+		freelists[new_size] = e;
+#else
 	e->next = freelists[new_size];
 	freelists[new_size] = (void *)e;
+#endif
 #else
 	((memcluster_element *)mem)->next = freelists[new_size];
 	freelists[new_size] = (memcluster_element *)mem;
diff --git a/contrib/bind/lib/nameser/ns_print.c b/contrib/bind/lib/nameser/ns_print.c
index 41b4d65..7348e1d 100644
--- a/contrib/bind/lib/nameser/ns_print.c
+++ b/contrib/bind/lib/nameser/ns_print.c
@@ -16,7 +16,7 @@
  */
 
 #ifndef lint
-static const char rcsid[] = "$Id: ns_print.c,v 8.21 2000/12/09 00:15:38 marka Exp $";
+static const char rcsid[] = "$Id: ns_print.c,v 8.22 2001/03/26 07:04:31 marka Exp $";
 #endif
 
 /* Import. */
@@ -316,7 +316,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		break;
 
 	case ns_t_nsap: {
-		char t[255*3];
+		char t[2+255*3];
 
 		(void) inet_nsap_ntoa(rdlen, rdata, t);
 		T(addstr(t, strlen(t), &buf, &buflen));
diff --git a/contrib/bind/lib/resolv/res_debug.c b/contrib/bind/lib/resolv/res_debug.c
index 7f2453a..cff6473 100644
--- a/contrib/bind/lib/resolv/res_debug.c
+++ b/contrib/bind/lib/resolv/res_debug.c
@@ -95,7 +95,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_debug.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_debug.c,v 8.37 2000/11/13 05:22:53 vixie Exp $";
+static const char rcsid[] = "$Id: res_debug.c,v 8.38 2001/02/13 23:12:56 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -452,6 +452,10 @@ const struct res_sym __p_type_syms[] = {
 	{ns_t_naptr,	"NAPTR",	"URN Naming Authority"},
 	{ns_t_kx,	"KX",		"Key Exchange"},
 	{ns_t_cert,	"CERT",		"Certificate"},
+	{ns_t_a6,	"A6",		"IPv6 Address"},
+	{ns_t_dname,	"DNAME",	"dname"},
+	{ns_t_sink,	"SINK",		"Kitchen Sink (experimental)"},
+	{ns_t_opt,	"OPT",		"EDNS Options"},
 	{ns_t_any,	"ANY",		"\"any\""},
 	{0, 		NULL,		NULL}
 };
diff --git a/contrib/bind/lib/resolv/res_init.c b/contrib/bind/lib/resolv/res_init.c
index 3ea9f02..8c63351 100644
--- a/contrib/bind/lib/resolv/res_init.c
+++ b/contrib/bind/lib/resolv/res_init.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_init.c	8.1 (Berkeley) 6/7/93";
-static const char rcsid[] = "$Id: res_init.c,v 8.17 2000/11/08 06:47:37 marka Exp $";
+static const char rcsid[] = "$Id: res_init.c,v 8.19 2001/03/08 03:57:16 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include "port_before.h"
@@ -179,6 +179,9 @@ __res_vinit(res_state statp, int preinit) {
 	statp->qhook = NULL;
 	statp->rhook = NULL;
 	statp->_u._ext.nscount = 0;
+#ifdef RESOLVSORT
+	statp->nsort = 0;
+#endif
 
 	/* Allow user to override the local domain definition */
 	if ((cp = getenv("LOCALDOMAIN")) != NULL) {
@@ -343,7 +346,8 @@ __res_vinit(res_state statp, int preinit) {
 		    continue;
 		}
 	    }
-	    if (nserv > 1) 
+
+	    if (nserv > 1)
 		statp->nscount = nserv;
 #ifdef RESOLVSORT
 	    statp->nsort = nsort;
@@ -507,5 +511,4 @@ res_nclose(res_state statp) {
 			statp->_u._ext.nssocks[ns] = -1;
 		}
 	}
-	statp->_u._ext.nscount = 0;
 }
diff --git a/contrib/bind/lib/resolv/res_send.c b/contrib/bind/lib/resolv/res_send.c
index 462d65d..ade9eac 100644
--- a/contrib/bind/lib/resolv/res_send.c
+++ b/contrib/bind/lib/resolv/res_send.c
@@ -70,7 +70,7 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)res_send.c	8.1 (Berkeley) 6/4/93";
-static const char rcsid[] = "$Id: res_send.c,v 8.41 2000/12/23 08:14:58 vixie Exp $";
+static const char rcsid[] = "$Id: res_send.c,v 8.42 2001/03/07 06:48:03 marka Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 /*
@@ -307,15 +307,19 @@ res_nsend(res_state statp,
 		struct sockaddr_in ina;
 		int lastns = statp->nscount - 1;
 		int fd;
+		u_int16_t nstime;
 
 		ina = statp->nsaddr_list[0];
 		fd = EXT(statp).nssocks[0];
+		nstime = EXT(statp).nstimes[ns];
 		for (ns = 0; ns < lastns; ns++) {
 			statp->nsaddr_list[ns] = statp->nsaddr_list[ns + 1];
 			EXT(statp).nssocks[ns] = EXT(statp).nssocks[ns + 1];
+			EXT(statp).nstimes[ns] = EXT(statp).nstimes[ns + 1];
 		}
 		statp->nsaddr_list[lastns] = ina;
 		EXT(statp).nssocks[lastns] = fd;
+		EXT(statp).nstimes[lastns] = nstime;
 	}
 
 	/*
diff --git a/contrib/bind/lib/resolv/res_update.c b/contrib/bind/lib/resolv/res_update.c
index 685e467..1434d5c 100644
--- a/contrib/bind/lib/resolv/res_update.c
+++ b/contrib/bind/lib/resolv/res_update.c
@@ -1,5 +1,5 @@
 #if !defined(lint) && !defined(SABER)
-static const char rcsid[] = "$Id: res_update.c,v 1.25 2000/11/22 01:20:47 marka Exp $";
+static const char rcsid[] = "$Id: res_update.c,v 1.26 2001/03/05 04:03:00 marka Exp $";
 #endif /* not lint */
 
 /*
@@ -101,7 +101,8 @@ res_nupdate(res_state statp, ns_updrec *rrecp_in, ns_tsig_key *key) {
 
 	/* Thread all of the updates onto a list of groups. */
 	INIT_LIST(zgrps);
-	for (rrecp = rrecp_in; rrecp; rrecp = NEXT(rrecp, r_link)) {
+	for (rrecp = rrecp_in; rrecp;
+	     rrecp = LINKED(rrecp, r_link) ? NEXT(rrecp, r_link) : NULL) {
 		/* Find the origin for it if there is one. */
 		tgrp.z_class = rrecp->r_class;
 		tgrp.z_nscount =
diff --git a/contrib/bind/port/freebsd/include/port_after.h b/contrib/bind/port/freebsd/include/port_after.h
index a05bd0f..a06bf69 100644
--- a/contrib/bind/port/freebsd/include/port_after.h
+++ b/contrib/bind/port/freebsd/include/port_after.h
@@ -29,6 +29,7 @@
 #if (!defined(BSD)) || (BSD < 199306)
 #include <sys/bitypes.h>
 #endif
+#include <sys/time.h>
 
 /*
  * We need to know the IPv6 address family number even on IPv4-only systems.
@@ -75,4 +76,7 @@ struct sockaddr_in6 {
 #define ISC_FACILITY LOG_DAEMON
 #endif
 
+int isc__gettimeofday(struct timeval *tp, struct timezone *tzp);
+#define gettimeofday isc__gettimeofday
+
 #endif /* ! PORT_AFTER_H */
diff --git a/contrib/bind/port/freebsd/include/port_before.h b/contrib/bind/port/freebsd/include/port_before.h
index 2791652..d90ba14 100644
--- a/contrib/bind/port/freebsd/include/port_before.h
+++ b/contrib/bind/port/freebsd/include/port_before.h
@@ -100,4 +100,3 @@
 #define SERV_R_BAD NULL
 
 #define IRS_LCL_SV_DB
-
diff --git a/contrib/bind/port/freebsd/include/prand_conf.h b/contrib/bind/port/freebsd/include/prand_conf.h
index 7244282..cf33196 100644
--- a/contrib/bind/port/freebsd/include/prand_conf.h
+++ b/contrib/bind/port/freebsd/include/prand_conf.h
@@ -3,10 +3,10 @@
 
 
 #ifndef HAVE_DEV_RANDOM
- # define HAVE_DEV_RANDOM 1
- #endif /* HAVE_DEV_RANDOM */
+# define HAVE_DEV_RANDOM 1
+#endif /* HAVE_DEV_RANDOM */
 
-const char *cmds[] = {
+static const char *cmds[] = {
 	"/bin/ps -axlw 2>&1",
 	"/usr/sbin/arp -an 2>&1",
 	"/usr/bin/netstat -an 2>&1",
@@ -20,7 +20,7 @@ const char *cmds[] = {
 	NULL
 };
 
-const char *dirs[] = {
+static const char *dirs[] = {
 	"/tmp",
 	"/usr/tmp",
 	".",
@@ -33,7 +33,7 @@ const char *dirs[] = {
 	NULL
 };
 
-const char *files[] = {
+static const char *files[] = {
 	"/var/log/messages",
 	"/var/log/wtmp",
 	"/var/log/lastlog",
diff --git a/contrib/bind/port/prand_conf/prand_conf.c b/contrib/bind/port/prand_conf/prand_conf.c
index 5f9bf29..1154e7b 100644
--- a/contrib/bind/port/prand_conf/prand_conf.c
+++ b/contrib/bind/port/prand_conf/prand_conf.c
@@ -1,4 +1,4 @@
-/* $Id: prand_conf.c,v 1.5 1999/07/31 16:44:13 cyarnell Exp $
+/* $Id: prand_conf.c,v 1.7 2001/03/07 06:46:33 marka Exp $
  *
  * Portions Copyright (c) 1995-1998 by TIS Labs at Network Assoociates Inc.
  * Portions Copyright (c) 1998-1998 by TIS Labs @ Network Associates Inc.
@@ -130,7 +130,8 @@ main()
 
 	char *files[] = {"/proc/stat", "/proc/rtc", "/proc/meminfo", 
 			 "/proc/interrupts",  "/proc/self/status", 
-			 "/proc/self/maps", 
+			 "/proc/self/maps",  "/proc/curproc/status",
+			 "/proc/curproc/map",
 			 "/var/log/messages", "/var/log/wtmp", 
 			 "/var/log/lastlog", "/var/adm/messages", 
 			 "/var/adm/wtmp", "/var/adm/lastlog", NULL};
@@ -146,7 +147,7 @@ main()
 
 	fprintf(fd, "#ifndef _PRAND_CMD_H_\n#define _PRAND_CMD_H_\n\n");
 
-	fprintf(fd, "const char *cmds[] = {\n");
+	fprintf(fd, "static const char *cmds[] = {\n");
        
 	if ((ps = my_find("ps", ps_path)) >= 0)
 		res = ex(fd, ps_path[ps], "ps","-axlw", 460) || 
@@ -185,7 +186,7 @@ main()
 		res = ex(fd, w_path[cmd], "w", "", 100);
 	fprintf(fd,"\tNULL\n};\n\n");
 
-	fprintf(fd, "const char *dirs[] = {\n");
+	fprintf(fd, "static const char *dirs[] = {\n");
 
 	for (i=0; dirs[i]; i++) { 
 		if (lstat(dirs[i], &st) == 0) 
@@ -195,12 +196,12 @@ main()
 	fprintf(fd,"\tNULL\n};\n\n");
 
 
-	fprintf(fd, "const char *files[] = {\n");
+	fprintf(fd, "static const char *files[] = {\n");
 	tim = time(NULL);
 	for (i=0; files[i]; i++) {
 		if (lstat(files[i],&st) == 0)
 			if (S_ISREG(st.st_mode) && 
-			    (tim -st.st_mtime) < 84600) 
+			    (tim - st.st_mtime) < 84600) 
 				fprintf(fd,"\t\"%s\",\n", files[i]);
 	}
 	fprintf (fd, "\tNULL\n};\n");