9.9.0a1

author: Internet Software Consortium, Inc <@isc.org> 2011-11-01 14:44:10 -0600
committer: Internet Software Consortium, Inc <@isc.org> 2011-11-01 14:44:10 -0600
commit: 0985d8a79623e77e4d2c801a661d1b1180f41285 (patch)
tree: d72acdc49feea21a0f2bccbe043f325b566fdbd5 /lib
parent: 00d5712510aa66b262594f8846d3666c0de2a204 (diff)
download: bind9-0985d8a79623e77e4d2c801a661d1b1180f41285.tar.gz
173 files changed, 5605 insertions, 790 deletions
diff --git a/lib/bind9/api b/lib/bind9/api
index 26a5fba6..3d2fa6ef 100644
--- a/lib/bind9/api
+++ b/lib/bind9/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 80
-LIBREVISION = 3
+LIBINTERFACE = 90
+LIBREVISION = 0
 LIBAGE = 0
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 6711f284..2b7b894d 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: check.c,v 1.125.14.6 2011-06-17 07:04:31 each Exp $ */
+/* $Id: check.c,v 1.133 2011-06-17 07:05:02 each Exp $ */
 
 /*! \file */
 
@@ -1223,7 +1223,9 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 #define FORWARDZONE	16
 #define DELEGATIONZONE	32
 #define STATICSTUBZONE	64
-#define CHECKACL	128
+#define REDIRECTZONE	128
+#define STREDIRECTZONE	0	/* Set to REDIRECTZONE to allow xfr-in. */
+#define CHECKACL	256
 
 typedef struct {
 	const char *name;
@@ -1252,30 +1254,30 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	const cfg_listelt_t *element;
 
 	static optionstable options[] = {
-	{ "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | CHECKACL |
-	  STATICSTUBZONE },
+	{ "allow-query", MASTERZONE | SLAVEZONE | STUBZONE | REDIRECTZONE |
+	  CHECKACL | STATICSTUBZONE },
 	{ "allow-notify", SLAVEZONE | CHECKACL },
 	{ "allow-transfer", MASTERZONE | SLAVEZONE | CHECKACL },
 	{ "notify", MASTERZONE | SLAVEZONE },
 	{ "also-notify", MASTERZONE | SLAVEZONE },
-	{ "dialup", MASTERZONE | SLAVEZONE | STUBZONE },
+	{ "dialup", MASTERZONE | SLAVEZONE | STUBZONE | STREDIRECTZONE },
 	{ "delegation-only", HINTZONE | STUBZONE | DELEGATIONZONE },
 	{ "forward", MASTERZONE | SLAVEZONE | STUBZONE | FORWARDZONE },
 	{ "forwarders", MASTERZONE | SLAVEZONE | STUBZONE | FORWARDZONE },
-	{ "maintain-ixfr-base", MASTERZONE | SLAVEZONE },
-	{ "max-ixfr-log-size", MASTERZONE | SLAVEZONE },
+	{ "maintain-ixfr-base", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
+	{ "max-ixfr-log-size", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
 	{ "notify-source", MASTERZONE | SLAVEZONE },
 	{ "notify-source-v6", MASTERZONE | SLAVEZONE },
-	{ "transfer-source", SLAVEZONE | STUBZONE },
-	{ "transfer-source-v6", SLAVEZONE | STUBZONE },
-	{ "max-transfer-time-in", SLAVEZONE | STUBZONE },
+	{ "transfer-source", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+	{ "transfer-source-v6", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+	{ "max-transfer-time-in", SLAVEZONE | STUBZONE | STREDIRECTZONE },
 	{ "max-transfer-time-out", MASTERZONE | SLAVEZONE },
-	{ "max-transfer-idle-in", SLAVEZONE | STUBZONE },
+	{ "max-transfer-idle-in", SLAVEZONE | STUBZONE | STREDIRECTZONE },
 	{ "max-transfer-idle-out", MASTERZONE | SLAVEZONE },
-	{ "max-retry-time", SLAVEZONE | STUBZONE },
-	{ "min-retry-time", SLAVEZONE | STUBZONE },
-	{ "max-refresh-time", SLAVEZONE | STUBZONE },
-	{ "min-refresh-time", SLAVEZONE | STUBZONE },
+	{ "max-retry-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+	{ "min-retry-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+	{ "max-refresh-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+	{ "min-refresh-time", SLAVEZONE | STUBZONE | STREDIRECTZONE },
 	{ "dnssec-secure-to-insecure", MASTERZONE },
 	{ "sig-validity-interval", MASTERZONE },
 	{ "sig-re-signing-interval", MASTERZONE },
@@ -1283,17 +1285,17 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	{ "sig-signing-type", MASTERZONE },
 	{ "sig-signing-signatures", MASTERZONE },
 	{ "zone-statistics", MASTERZONE | SLAVEZONE | STUBZONE |
-	  STATICSTUBZONE},
+	  STATICSTUBZONE| REDIRECTZONE },
 	{ "allow-update", MASTERZONE | CHECKACL },
 	{ "allow-update-forwarding", SLAVEZONE | CHECKACL },
-	{ "file", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE },
-	{ "journal", MASTERZONE | SLAVEZONE },
+	{ "file", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE | REDIRECTZONE },
+	{ "journal", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
 	{ "ixfr-base", MASTERZONE | SLAVEZONE },
 	{ "ixfr-tmp-file", MASTERZONE | SLAVEZONE },
-	{ "masters", SLAVEZONE | STUBZONE },
+	{ "masters", SLAVEZONE | STUBZONE | REDIRECTZONE },
 	{ "pubkey", MASTERZONE | SLAVEZONE | STUBZONE },
 	{ "update-policy", MASTERZONE },
-	{ "database", MASTERZONE | SLAVEZONE | STUBZONE },
+	{ "database", MASTERZONE | SLAVEZONE | STUBZONE | REDIRECTZONE },
 	{ "key-directory", MASTERZONE },
 	{ "check-wildcard", MASTERZONE },
 	{ "check-mx", MASTERZONE },
@@ -1301,20 +1303,22 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	{ "integrity-check", MASTERZONE },
 	{ "check-mx-cname", MASTERZONE },
 	{ "check-srv-cname", MASTERZONE },
-	{ "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE },
+	{ "masterfile-format", MASTERZONE | SLAVEZONE | STUBZONE | HINTZONE |
+	  REDIRECTZONE },
 	{ "update-check-ksk", MASTERZONE },
 	{ "dnssec-dnskey-kskonly", MASTERZONE },
+	{ "dnssec-loadkeys-interval", MASTERZONE },
 	{ "auto-dnssec", MASTERZONE },
-	{ "try-tcp-refresh", SLAVEZONE },
+	{ "try-tcp-refresh", SLAVEZONE | STREDIRECTZONE },
 	{ "server-addresses", STATICSTUBZONE },
 	{ "server-names", STATICSTUBZONE },
 	};
 
 	static optionstable dialups[] = {
-	{ "notify", MASTERZONE | SLAVEZONE },
-	{ "notify-passive", SLAVEZONE },
-	{ "refresh", SLAVEZONE | STUBZONE },
-	{ "passive", SLAVEZONE | STUBZONE },
+	{ "notify", MASTERZONE | SLAVEZONE | STREDIRECTZONE },
+	{ "notify-passive", SLAVEZONE | STREDIRECTZONE },
+	{ "refresh", SLAVEZONE | STUBZONE | STREDIRECTZONE },
+	{ "passive", SLAVEZONE | STUBZONE | STREDIRECTZONE },
 	};
 
 	znamestr = cfg_obj_asstring(cfg_tuple_get(zconfig, "name"));
@@ -1344,6 +1348,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		ztype = HINTZONE;
 	else if (strcasecmp(typestr, "delegation-only") == 0)
 		ztype = DELEGATIONZONE;
+	else if (strcasecmp(typestr, "redirect") == 0)
+		ztype = REDIRECTZONE;
 	else {
 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 			    "zone '%s': invalid type %s",
@@ -1351,6 +1357,11 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		return (ISC_R_FAILURE);
 	}
 
+	if (ztype == REDIRECTZONE && strcmp(znamestr, ".") != 0) {
+		cfg_obj_log(zconfig, logctx, ISC_LOG_ERROR,
+			    "redirect zones must be called \".\"");
+		return (ISC_R_FAILURE);
+	}
 	obj = cfg_tuple_get(zconfig, "class");
 	if (cfg_obj_isstring(obj)) {
 		isc_textregion_t r;
@@ -1392,7 +1403,8 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 
 		zname = dns_fixedname_name(&fixedname);
 		dns_name_format(zname, namebuf, sizeof(namebuf));
-		tresult = nameexist(zconfig, namebuf, ztype == HINTZONE ? 1 : 2,
+		tresult = nameexist(zconfig, namebuf, ztype == HINTZONE ? 1 :
+				    ztype == REDIRECTZONE ? 2 : 3,
 				    symtab, "zone '%s': already exists "
 				    "previous definition: %s:%u", logctx, mctx);
 		if (tresult != ISC_R_SUCCESS)
diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
index 5bbf7935..e037806d 100644
--- a/lib/dns/Makefile.in
+++ b/lib/dns/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.176.8.2 2011-03-10 04:29:17 each Exp $
+# $Id: Makefile.in,v 1.179 2011-07-01 02:25:47 marka Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -69,7 +69,7 @@ DNSOBJS =	acache.@O@ acl.@O@ adb.@O@ byaddr.@O@ \
 		rriterator.@O@ sdb.@O@ \
 		sdlz.@O@ soa.@O@ ssu.@O@ ssu_external.@O@ \
 		stats.@O@ tcpmsg.@O@ time.@O@ timer.@O@ tkey.@O@ \
-		tsec.@O@ tsig.@O@ ttl.@O@ validator.@O@ \
+		tsec.@O@ tsig.@O@ ttl.@O@ update.@O@ validator.@O@ \
 		version.@O@ view.@O@ xfrin.@O@ zone.@O@ zonekey.@O@ zt.@O@
 
 OBJS=		${DNSOBJS} ${OTHEROBJS} ${DSTOBJS}
@@ -95,7 +95,7 @@ DNSSRCS =	acache.c acl.c adb.c byaddr.c \
 		resolver.c result.c rootns.c rpz.c rriterator.c \
 		sdb.c sdlz.c soa.c ssu.c ssu_external.c \
 		stats.c tcpmsg.c time.c timer.c tkey.c \
-		tsec.c tsig.c ttl.c validator.c \
+		tsec.c tsig.c ttl.c update.c validator.c \
 		version.c view.c xfrin.c zone.c zonekey.c zt.c ${OTHERSRCS}
 
 SRCS = ${DSTSRCS} ${DNSSRCS}
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index 9880216a..b593d54e 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: acl.c,v 1.53.426.2 2011-06-17 23:47:11 tbox Exp $ */
+/* $Id: acl.c,v 1.55 2011-06-17 23:47:49 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index ba896548..ebc43604 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: adb.c,v 1.254.14.4 2011-03-13 03:36:47 marka Exp $ */
+/* $Id: adb.c,v 1.258 2011-03-13 02:49:28 marka Exp $ */
 
 /*! \file
  *
diff --git a/lib/dns/api b/lib/dns/api
index d724b616..3d2fa6ef 100644
--- a/lib/dns/api
+++ b/lib/dns/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 84
-LIBREVISION = 1
-LIBAGE = 3
+LIBINTERFACE = 90
+LIBREVISION = 0
+LIBAGE = 0
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index eb32c6c8..38821c43 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cache.c,v 1.87.262.2 2011-03-03 23:47:09 tbox Exp $ */
+/* $Id: cache.c,v 1.90 2011-08-02 20:36:12 each Exp $ */
 
 /*! \file */
 
@@ -1153,31 +1153,14 @@ dns_cache_flush(dns_cache_t *cache) {
 	return (ISC_R_SUCCESS);
 }
 
-isc_result_t
-dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
+static isc_result_t
+clearnode(dns_db_t *db, dns_dbnode_t *node) {
 	isc_result_t result;
 	dns_rdatasetiter_t *iter = NULL;
-	dns_dbnode_t *node = NULL;
-	dns_db_t *db = NULL;
-
-	LOCK(&cache->lock);
-	if (cache->db != NULL)
-		dns_db_attach(cache->db, &db);
-	UNLOCK(&cache->lock);
-	if (db == NULL)
-		return (ISC_R_SUCCESS);
-	result = dns_db_findnode(cache->db, name, ISC_FALSE, &node);
-	if (result == ISC_R_NOTFOUND) {
-		result = ISC_R_SUCCESS;
-		goto cleanup_db;
-	}
-	if (result != ISC_R_SUCCESS)
-		goto cleanup_db;
 
-	result = dns_db_allrdatasets(cache->db, node, NULL,
-				     (isc_stdtime_t)0, &iter);
+	result = dns_db_allrdatasets(db, node, NULL, (isc_stdtime_t)0, &iter);
 	if (result != ISC_R_SUCCESS)
-		goto cleanup_node;
+		return (result);
 
 	for (result = dns_rdatasetiter_first(iter);
 	     result == ISC_R_SUCCESS;
@@ -1187,19 +1170,98 @@ dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
 		dns_rdataset_init(&rdataset);
 
 		dns_rdatasetiter_current(iter, &rdataset);
-		result = dns_db_deleterdataset(cache->db, node, NULL,
+		result = dns_db_deleterdataset(db, node, NULL,
 					       rdataset.type, rdataset.covers);
 		dns_rdataset_disassociate(&rdataset);
 		if (result != ISC_R_SUCCESS && result != DNS_R_UNCHANGED)
 			break;
 	}
+
 	if (result == ISC_R_NOMORE)
 		result = ISC_R_SUCCESS;
 
 	dns_rdatasetiter_destroy(&iter);
+	return (result);
+}
 
- cleanup_node:
-	dns_db_detachnode(cache->db, &node);
+static isc_result_t
+cleartree(dns_db_t *db, dns_name_t *name) {
+	isc_result_t result;
+	dns_dbiterator_t *iter = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_fixedname_t fnodename;
+	dns_name_t *nodename;
+
+	dns_fixedname_init(&fnodename);
+	nodename = dns_fixedname_name(&fnodename);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	result = dns_dbiterator_seek(iter, name);
+	if (result != ISC_R_SUCCESS)
+		goto cleanup;
+
+	while (result == ISC_R_SUCCESS) {
+		result = dns_dbiterator_current(iter, &node, nodename);
+		if (result != ISC_R_SUCCESS && result != DNS_R_NEWORIGIN)
+			goto cleanup;
+		if (! dns_name_issubdomain(nodename, name))
+			goto cleanup;
+
+		result = clearnode(db, node);
+		dns_db_detachnode(db, &node);
+		result = dns_dbiterator_next(iter);
+	}
+
+ cleanup:
+	if (result == ISC_R_NOMORE || result == ISC_R_NOTFOUND)
+		result = ISC_R_SUCCESS;
+	if (node != NULL)
+		dns_db_detachnode(db, &node);
+	if (iter != NULL)
+		dns_dbiterator_destroy(&iter);
+
+	return (result);
+}
+
+isc_result_t
+dns_cache_flushname(dns_cache_t *cache, dns_name_t *name) {
+	return (dns_cache_flushnode(cache, name, ISC_FALSE));
+}
+
+isc_result_t
+dns_cache_flushnode(dns_cache_t *cache, dns_name_t *name,
+		    isc_boolean_t tree)
+{
+	isc_result_t result;
+	dns_dbnode_t *node = NULL;
+	dns_db_t *db = NULL;
+
+	if (dns_name_equal(name, dns_rootname))
+		return (dns_cache_flush(cache));
+
+	LOCK(&cache->lock);
+	if (cache->db != NULL)
+		dns_db_attach(cache->db, &db);
+	UNLOCK(&cache->lock);
+	if (db == NULL)
+		return (ISC_R_SUCCESS);
+
+	if (tree) {
+		result = cleartree(cache->db, name);
+	} else {
+		result = dns_db_findnode(cache->db, name, ISC_FALSE, &node);
+		if (result == ISC_R_NOTFOUND) {
+			result = ISC_R_SUCCESS;
+			goto cleanup_db;
+		}
+		if (result != ISC_R_SUCCESS)
+			goto cleanup_db;
+		result = clearnode(cache->db, node);
+		dns_db_detachnode(cache->db, &node);
+	}
 
  cleanup_db:
 	dns_db_detach(&db);
diff --git a/lib/dns/client.c b/lib/dns/client.c
index 77a419e2..2c22fd38 100644
--- a/lib/dns/client.c
+++ b/lib/dns/client.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.12.24.2 2011-03-12 04:59:16 tbox Exp $ */
+/* $Id: client.c,v 1.14 2011-03-12 04:59:47 tbox Exp $ */
 
 #include <config.h>
 
diff --git a/lib/dns/diff.c b/lib/dns/diff.c
index a2c99c1c..37c4f58e 100644
--- a/lib/dns/diff.c
+++ b/lib/dns/diff.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: diff.c,v 1.23.248.3 2011-03-25 23:53:52 each Exp $ */
+/* $Id: diff.c,v 1.26 2011-03-25 23:53:02 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 486965e4..f9acc101 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.c,v 1.168.248.4 2011-04-06 10:30:08 marka Exp $ */
+/* $Id: dispatch.c,v 1.174 2011-07-28 23:47:58 tbox Exp $ */
 
 /*! \file */
 
@@ -312,14 +312,16 @@ static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr,
 				  dns_dispatch_t *disp,
 				  isc_socketmgr_t *sockmgr,
 				  isc_sockaddr_t *localaddr,
-				  isc_socket_t **sockp);
+				  isc_socket_t **sockp,
+				  isc_socket_t *dup_socket);
 static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 				       isc_socketmgr_t *sockmgr,
 				       isc_taskmgr_t *taskmgr,
 				       isc_sockaddr_t *localaddr,
 				       unsigned int maxrequests,
 				       unsigned int attributes,
-				       dns_dispatch_t **dispp);
+				       dns_dispatch_t **dispp,
+				       isc_socket_t *dup_socket);
 static isc_boolean_t destroy_mgr_ok(dns_dispatchmgr_t *mgr);
 static void destroy_mgr(dns_dispatchmgr_t **mgrp);
 static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
@@ -327,7 +329,8 @@ static isc_result_t qid_allocate(dns_dispatchmgr_t *mgr, unsigned int buckets,
 				 isc_boolean_t needaddrtable);
 static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
 static isc_result_t open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
-				unsigned int options, isc_socket_t **sockp);
+				unsigned int options, isc_socket_t **sockp,
+				isc_socket_t *dup_socket);
 static isc_boolean_t portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 				   isc_sockaddr_t *sockaddrp);
 
@@ -902,7 +905,8 @@ get_dispsocket(dns_dispatch_t *disp, isc_sockaddr_t *dest,
 		portentry = port_search(disp, port);
 		if (portentry != NULL)
 			bindoptions |= ISC_SOCKET_REUSEADDRESS;
-		result = open_socket(sockmgr, &localaddr, bindoptions, &sock);
+		result = open_socket(sockmgr, &localaddr, bindoptions, &sock,
+				     NULL);
 		if (result == ISC_R_SUCCESS) {
 			if (portentry == NULL) {
 				portentry = new_portentry(disp, port);
@@ -1787,19 +1791,14 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 
 static isc_result_t
 open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
-	    unsigned int options, isc_socket_t **sockp)
+	    unsigned int options, isc_socket_t **sockp,
+	    isc_socket_t *dup_socket)
 {
 	isc_socket_t *sock;
 	isc_result_t result;
 
 	sock = *sockp;
-	if (sock == NULL) {
-		result = isc_socket_create(mgr, isc_sockaddr_pf(local),
-					   isc_sockettype_udp, &sock);
-		if (result != ISC_R_SUCCESS)
-			return (result);
-		isc_socket_setname(sock, "dispatcher", NULL);
-	} else {
+	if (sock != NULL) {
 #ifdef BIND9
 		result = isc_socket_open(sock);
 		if (result != ISC_R_SUCCESS)
@@ -1807,8 +1806,19 @@ open_socket(isc_socketmgr_t *mgr, isc_sockaddr_t *local,
 #else
 		INSIST(0);
 #endif
+	} else if (dup_socket != NULL) {
+		result = isc_socket_dup(dup_socket, &sock);
+		if (result != ISC_R_SUCCESS)
+			return (result);
+	} else {
+		result = isc_socket_create(mgr, isc_sockaddr_pf(local),
+					isc_sockettype_udp, &sock);
+		if (result != ISC_R_SUCCESS)
+			return (result);
 	}
 
+	isc_socket_setname(sock, "dispatcher", NULL);
+
 #ifndef ISC_ALLOW_MAPPED
 	isc_socket_ipv6only(sock, ISC_TRUE);
 #endif
@@ -2646,13 +2656,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 }
 
 isc_result_t
-dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
+dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		    isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr,
 		    unsigned int buffersize,
 		    unsigned int maxbuffers, unsigned int maxrequests,
 		    unsigned int buckets, unsigned int increment,
 		    unsigned int attributes, unsigned int mask,
-		    dns_dispatch_t **dispp)
+		    dns_dispatch_t **dispp, dns_dispatch_t *dup_dispatch)
 {
 	isc_result_t result;
 	dns_dispatch_t *disp = NULL;
@@ -2683,28 +2693,31 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	/*
 	 * See if we have a dispatcher that matches.
 	 */
-	result = dispatch_find(mgr, localaddr, attributes, mask, &disp);
-	if (result == ISC_R_SUCCESS) {
-		disp->refcount++;
-
-		if (disp->maxrequests < maxrequests)
-			disp->maxrequests = maxrequests;
-
-		if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0 &&
-		    (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
-		{
-			disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
-			if (disp->recv_pending != 0)
-				isc_socket_cancel(disp->socket, disp->task[0],
-						  ISC_SOCKCANCEL_RECV);
-		}
+	if (dup_dispatch == NULL) {
+		result = dispatch_find(mgr, localaddr, attributes, mask, &disp);
+		if (result == ISC_R_SUCCESS) {
+			disp->refcount++;
+
+			if (disp->maxrequests < maxrequests)
+				disp->maxrequests = maxrequests;
+
+			if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0
+			    && (attributes & DNS_DISPATCHATTR_NOLISTEN) != 0)
+			{
+				disp->attributes |= DNS_DISPATCHATTR_NOLISTEN;
+				if (disp->recv_pending != 0)
+					isc_socket_cancel(disp->socket,
+							  disp->task[0],
+							  ISC_SOCKCANCEL_RECV);
+			}
 
-		UNLOCK(&disp->lock);
-		UNLOCK(&mgr->lock);
+			UNLOCK(&disp->lock);
+			UNLOCK(&mgr->lock);
 
-		*dispp = disp;
+			*dispp = disp;
 
-		return (ISC_R_SUCCESS);
+			return (ISC_R_SUCCESS);
+		}
 	}
 
  createudp:
@@ -2712,7 +2725,11 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	 * Nope, create one.
 	 */
 	result = dispatch_createudp(mgr, sockmgr, taskmgr, localaddr,
-				    maxrequests, attributes, &disp);
+				    maxrequests, attributes, &disp,
+				    dup_dispatch == NULL
+					    ? NULL
+					    : dup_dispatch->socket);
+
 	if (result != ISC_R_SUCCESS) {
 		UNLOCK(&mgr->lock);
 		return (result);
@@ -2720,9 +2737,24 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 
 	UNLOCK(&mgr->lock);
 	*dispp = disp;
+
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
+		    isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr,
+		    unsigned int buffersize,
+		    unsigned int maxbuffers, unsigned int maxrequests,
+		    unsigned int buckets, unsigned int increment,
+		    unsigned int attributes, unsigned int mask,
+		    dns_dispatch_t **dispp)
+{
+	return dns_dispatch_getudp_dup(mgr, sockmgr, taskmgr, localaddr,
+		    buffersize, maxbuffers, maxrequests, buckets, increment,
+		    attributes, mask, dispp, NULL);
+}
+
 /*
  * mgr should be locked.
  */
@@ -2734,7 +2766,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 static isc_result_t
 get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	      isc_socketmgr_t *sockmgr, isc_sockaddr_t *localaddr,
-	      isc_socket_t **sockp)
+	      isc_socket_t **sockp, isc_socket_t *dup_socket)
 {
 	unsigned int i, j;
 	isc_socket_t *held[DNS_DISPATCH_HELD];
@@ -2774,7 +2806,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 					nports)];
 			isc_sockaddr_setport(&localaddr_bound, prt);
 			result = open_socket(sockmgr, &localaddr_bound,
-					     0, &sock);
+					     0, &sock, NULL);
 			if (result == ISC_R_SUCCESS ||
 			    result != ISC_R_ADDRINUSE) {
 				disp->localport = prt;
@@ -2790,7 +2822,8 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	} else {
 		/* Allow to reuse address for non-random ports. */
 		result = open_socket(sockmgr, localaddr,
-				     ISC_SOCKET_REUSEADDRESS, &sock);
+				     ISC_SOCKET_REUSEADDRESS, &sock,
+				     dup_socket);
 
 		if (result == ISC_R_SUCCESS)
 			*sockp = sock;
@@ -2802,7 +2835,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	i = 0;
 
 	for (j = 0; j < 0xffffU; j++) {
-		result = open_socket(sockmgr, localaddr, 0, &sock);
+		result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto end;
 		else if (!anyport)
@@ -2841,7 +2874,8 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		   isc_sockaddr_t *localaddr,
 		   unsigned int maxrequests,
 		   unsigned int attributes,
-		   dns_dispatch_t **dispp)
+		   dns_dispatch_t **dispp,
+		   isc_socket_t *dup_socket)
 {
 	isc_result_t result;
 	dns_dispatch_t *disp;
@@ -2857,9 +2891,21 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		return (result);
 
 	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
-		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock);
+		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock,
+				       dup_socket);
 		if (result != ISC_R_SUCCESS)
 			goto deallocate_dispatch;
+
+		if (isc_log_wouldlog(dns_lctx, 90)) {
+			char addrbuf[ISC_SOCKADDR_FORMATSIZE];
+
+			isc_sockaddr_format(localaddr, addrbuf,
+					    ISC_SOCKADDR_FORMATSIZE);
+			mgr_log(mgr, LVL(90), "dns_dispatch_createudp: Created"
+				" UDP dispatch for %s with socket fd %d\n",
+				addrbuf, isc_socket_getfd(sock));
+		}
+
 	} else {
 		isc_sockaddr_t sa_any;
 
@@ -2871,7 +2917,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		 */
 		isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
 		if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
-			result = open_socket(sockmgr, localaddr, 0, &sock);
+			result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
 			if (sock != NULL)
 				isc_socket_detach(&sock);
 			if (result != ISC_R_SUCCESS)
@@ -2938,6 +2984,7 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
 
 	*dispp = disp;
+
 	return (result);
 
 	/*
diff --git a/lib/dns/dlz.c b/lib/dns/dlz.c
index e69fc696..ace2d728 100644
--- a/lib/dns/dlz.c
+++ b/lib/dns/dlz.c
@@ -50,7 +50,7 @@
  * USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dlz.c,v 1.10.14.2 2011-03-12 04:59:16 tbox Exp $ */
+/* $Id: dlz.c,v 1.12 2011-03-12 04:59:47 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/dns64.c b/lib/dns/dns64.c
index b2b4138f..6d10f04e 100644
--- a/lib/dns/dns64.c
+++ b/lib/dns/dns64.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dns64.c,v 1.6.22.2 2011-03-12 04:59:16 tbox Exp $ */
+/* $Id: dns64.c,v 1.8 2011-03-12 04:59:47 tbox Exp $ */
 
 #include <config.h>
 
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 6dc42a0f..33cfd361 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: dnssec.c,v 1.119.170.4 2011-05-06 21:07:50 each Exp $
+ * $Id: dnssec.c,v 1.124 2011-05-06 21:08:33 each Exp $
  */
 
 /*! \file */
@@ -625,6 +625,8 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
 		pubkey = NULL;
 		dns_rdataset_current(&rdataset, &rdata);
 		RETERR(dns_dnssec_keyfromrdata(name, &rdata, mctx, &pubkey));
+		dst_key_setttl(pubkey, rdataset.ttl);
+
 		if (!is_zone_key(pubkey) ||
 		    (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
 			goto next;
@@ -702,6 +704,12 @@ dns_dnssec_findzonekeys2(dns_db_t *db, dns_dbversion_t *ver,
 			goto next;
 		}
 
+		/*
+		 * Whatever the key's default TTL may have
+		 * been, the rdataset TTL takes priority.
+		 */
+		dst_key_setttl(keys[count], rdataset.ttl);
+
 		if ((dst_key_flags(keys[count]) & DNS_KEYTYPE_NOAUTH) != 0) {
 			/* We should never get here. */
 			dst_key_free(&keys[count]);
@@ -1446,6 +1454,7 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
 		dns_rdata_reset(&rdata);
 		dns_rdataset_current(&keys, &rdata);
 		RETERR(dns_dnssec_keyfromrdata(origin, &rdata, mctx, &pubkey));
+		dst_key_setttl(pubkey, keys.ttl);
 
 		if (!is_zone_key(pubkey) ||
 		    (dst_key_flags(pubkey) & DNS_KEYTYPE_NOAUTH) != 0)
@@ -1518,6 +1527,12 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
 		if ((dst_key_flags(privkey) & DNS_KEYTYPE_NOAUTH) != 0)
 			goto skip;
 
+		/*
+		 * Whatever the key's default TTL may have
+		 * been, the rdataset TTL takes priority.
+		 */
+		dst_key_setttl(privkey, dst_key_getttl(pubkey));
+
 		addkey(keylist, &privkey, savekeys, mctx);
  skip:
 		if (pubkey != NULL)
@@ -1643,16 +1658,22 @@ remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, dns_name_t *origin,
 isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, dns_name_t *origin,
-		      dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk,
-		      isc_mem_t *mctx, void (*report)(const char *, ...))
+		      dns_ttl_t hint_ttl, dns_diff_t *diff,
+		      isc_boolean_t allzsk, isc_mem_t *mctx,
+		      void (*report)(const char *, ...))
 {
 	isc_result_t result;
 	dns_dnsseckey_t *key, *key1, *key2, *next;
+	isc_boolean_t found_ttl = ISC_FALSE;
+	dns_ttl_t ttl = hint_ttl;
 
 	/*
 	 * First, look through the existing key list to find keys
 	 * supplied from the command line which are not in the zone.
 	 * Update the zone to include them.
+	 *
+	 * Also, if there are keys published in the zone already,
+	 * use their TTL for all subsequent published keys.
 	 */
 	for (key = ISC_LIST_HEAD(*keys);
 	     key != NULL;
@@ -1662,6 +1683,32 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 			RETERR(publish_key(diff, key, origin, ttl,
 					   mctx, allzsk, report));
 		}
+		if (key->source == dns_keysource_zoneapex) {
+			ttl = dst_key_getttl(key->key);
+			found_ttl = ISC_TRUE;
+		}
+	}
+
+	/*
+	 * If there were no existing keys, use the smallest nonzero
+	 * TTL of the keys found in the repository.
+	 */
+	if (!found_ttl && !ISC_LIST_EMPTY(*newkeys)) {
+		dns_ttl_t shortest = 0;
+
+		for (key = ISC_LIST_HEAD(*newkeys);
+		     key != NULL;
+		     key = ISC_LIST_NEXT(key, link)) {
+			dns_ttl_t thisttl = dst_key_getttl(key->key);
+			if (thisttl != 0 &&
+			    (shortest == 0 || thisttl < shortest))
+				shortest = thisttl;
+		}
+
+		if (shortest != 0) {
+			found_ttl = ISC_TRUE;
+			ttl = shortest;
+		}
 	}
 
 	/*
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 4a06486f..c8e4e897 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -31,7 +31,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: dst_api.c,v 1.57.10.1 2011-03-21 19:53:34 each Exp $
+ * $Id: dst_api.c,v 1.63 2011-08-18 23:46:34 tbox Exp $
  */
 
 /*! \file */
@@ -91,6 +91,7 @@ static dst_key_t *	get_key_struct(dns_name_t *name,
 				       unsigned int protocol,
 				       unsigned int bits,
 				       dns_rdataclass_t rdclass,
+				       dns_ttl_t ttl,
 				       isc_mem_t *mctx);
 static isc_result_t	write_public_key(const dst_key_t *key, int type,
 					 const char *directory);
@@ -514,7 +515,7 @@ dst_key_fromnamedfile(const char *filename, const char *dirname,
 
 	key = get_key_struct(pubkey->key_name, pubkey->key_alg,
 			     pubkey->key_flags, pubkey->key_proto, 0,
-			     pubkey->key_class, mctx);
+			     pubkey->key_class, pubkey->key_ttl, mctx);
 	if (key == NULL) {
 		dst_key_free(&pubkey);
 		return (ISC_R_NOMEMORY);
@@ -712,7 +713,7 @@ dst_key_fromgssapi(dns_name_t *name, gss_ctx_id_t gssctx, isc_mem_t *mctx,
 	REQUIRE(keyp != NULL && *keyp == NULL);
 
 	key = get_key_struct(name, DST_ALG_GSSAPI, 0, DNS_KEYPROTO_DNSSEC,
-			     0, dns_rdataclass_in, mctx);
+			     0, dns_rdataclass_in, 0, mctx);
 	if (key == NULL)
 		return (ISC_R_NOMEMORY);
 
@@ -750,7 +751,7 @@ dst_key_fromlabel(dns_name_t *name, int alg, unsigned int flags,
 
 	CHECKALG(alg);
 
-	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
+	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
 	if (key == NULL)
 		return (ISC_R_NOMEMORY);
 
@@ -804,7 +805,8 @@ dst_key_generate2(dns_name_t *name, unsigned int alg,
 
 	CHECKALG(alg);
 
-	key = get_key_struct(name, alg, flags, protocol, bits, rdclass, mctx);
+	key = get_key_struct(name, alg, flags, protocol, bits,
+			     rdclass, 0, mctx);
 	if (key == NULL)
 		return (ISC_R_NOMEMORY);
 
@@ -1210,7 +1212,7 @@ dst_key_restore(dns_name_t *name, unsigned int alg, unsigned int flags,
 	if (dst_t_func[alg]->restore == NULL)
 		return (ISC_R_NOTIMPLEMENTED);
 
-	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
+	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
 	if (key == NULL)
 		return (ISC_R_NOMEMORY);
 
@@ -1234,7 +1236,7 @@ static dst_key_t *
 get_key_struct(dns_name_t *name, unsigned int alg,
 	       unsigned int flags, unsigned int protocol,
 	       unsigned int bits, dns_rdataclass_t rdclass,
-	       isc_mem_t *mctx)
+	       dns_ttl_t ttl, isc_mem_t *mctx)
 {
 	dst_key_t *key;
 	isc_result_t result;
@@ -1274,6 +1276,7 @@ get_key_struct(dns_name_t *name, unsigned int alg,
 	key->keydata.generic = NULL;
 	key->key_size = bits;
 	key->key_class = rdclass;
+	key->key_ttl = ttl;
 	key->func = dst_t_func[alg];
 	key->fmt_major = 0;
 	key->fmt_minor = 0;
@@ -1301,7 +1304,7 @@ dst_key_read_public(const char *filename, int type,
 	unsigned int opt = ISC_LEXOPT_DNSMULTILINE;
 	dns_rdataclass_t rdclass = dns_rdataclass_in;
 	isc_lexspecials_t specials;
-	isc_uint32_t ttl;
+	isc_uint32_t ttl = 0;
 	isc_result_t result;
 	dns_rdatatype_t keytype;
 
@@ -1402,6 +1405,8 @@ dst_key_read_public(const char *filename, int type,
 	if (ret != ISC_R_SUCCESS)
 		goto cleanup;
 
+	dst_key_setttl(*keyp, ttl);
+
  cleanup:
 	if (lex != NULL)
 		isc_lex_destroy(&lex);
@@ -1568,11 +1573,14 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 
 	/* Now print the actual key */
 	ret = dns_name_print(key->key_name, fp);
-
 	fprintf(fp, " ");
 
+	if (key->key_ttl != 0)
+		fprintf(fp, "%d ", key->key_ttl);
+
 	isc_buffer_usedregion(&classb, &r);
-	isc_util_fwrite(r.base, 1, r.length, fp);
+	if ((unsigned)isc_util_fwrite(r.base, 1, r.length, fp) != r.length)
+	       ret = DST_R_WRITEERROR;
 
 	if ((type & DST_TYPE_KEY) != 0)
 		fprintf(fp, " KEY ");
@@ -1580,7 +1588,8 @@ write_public_key(const dst_key_t *key, int type, const char *directory) {
 		fprintf(fp, " DNSKEY ");
 
 	isc_buffer_usedregion(&textb, &r);
-	isc_util_fwrite(r.base, 1, r.length, fp);
+	if ((unsigned)isc_util_fwrite(r.base, 1, r.length, fp) != r.length)
+	       ret = DST_R_WRITEERROR;
 
 	fputc('\n', fp);
 	fflush(fp);
@@ -1659,7 +1668,7 @@ frombuffer(dns_name_t *name, unsigned int alg, unsigned int flags,
 	REQUIRE(mctx != NULL);
 	REQUIRE(keyp != NULL && *keyp == NULL);
 
-	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, mctx);
+	key = get_key_struct(name, alg, flags, protocol, 0, rdclass, 0, mctx);
 	if (key == NULL)
 		return (ISC_R_NOMEMORY);
 
diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
index 220b3da8..2ebb0c36 100644
--- a/lib/dns/dst_internal.h
+++ b/lib/dns/dst_internal.h
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst_internal.h,v 1.29 2011-01-11 23:47:13 tbox Exp $ */
+/* $Id: dst_internal.h,v 1.30 2011-03-17 01:40:39 each Exp $ */
 
 #ifndef DST_DST_INTERNAL_H
 #define DST_DST_INTERNAL_H 1
@@ -96,6 +96,7 @@ struct dst_key {
 	isc_uint16_t	key_id;		/*%< identifier of the key */
 	isc_uint16_t	key_bits;	/*%< hmac digest bits */
 	dns_rdataclass_t key_class;	/*%< class of the key record */
+	dns_ttl_t	key_ttl;	/*%< default/initial dnskey ttl */
 	isc_mem_t	*mctx;		/*%< memory context */
 	char		*engine;	/*%< engine name (HSM) */
 	char		*label;		/*%< engine label (HSM) */
diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h
index 0fbb1e42..8b4cbfa6 100644
--- a/lib/dns/dst_openssl.h
+++ b/lib/dns/dst_openssl.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst_openssl.h,v 1.9.302.2 2011-03-12 04:59:16 tbox Exp $ */
+/* $Id: dst_openssl.h,v 1.11 2011-03-12 04:59:48 tbox Exp $ */
 
 #ifndef DST_OPENSSL_H
 #define DST_OPENSSL_H 1
diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
index 4d7d784f..46a6c80c 100644
--- a/lib/dns/dst_parse.c
+++ b/lib/dns/dst_parse.c
@@ -1,5 +1,5 @@
 /*
- * Portions Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -31,7 +31,7 @@
 
 /*%
  * Principal Author: Brian Wellington
- * $Id: dst_parse.c,v 1.27 2010-12-23 04:07:58 marka Exp $
+ * $Id: dst_parse.c,v 1.29 2011-08-18 23:46:35 tbox Exp $
  */
 
 #include <config.h>
@@ -641,9 +641,7 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 		}
 		isc_buffer_usedregion(&b, &r);
 
-		fprintf(fp, "%s ", s);
-		isc_util_fwrite(r.base, 1, r.length, fp);
-		fprintf(fp, "\n");
+	       fprintf(fp, "%s %.*s\n", s, (int)r.length, r.base);
 	}
 
 	/* Add the metadata tags */
@@ -661,14 +659,15 @@ dst__privstruct_writefile(const dst_key_t *key, const dst_private_t *priv,
 
 			isc_buffer_init(&b, buffer, sizeof(buffer));
 			result = dns_time32_totext(when, &b);
-			if (result != ISC_R_SUCCESS)
-				continue;
+		       if (result != ISC_R_SUCCESS) {
+			       fclose(fp);
+			       return (DST_R_INVALIDPRIVATEKEY);
+		       }
 
 			isc_buffer_usedregion(&b, &r);
 
-			fprintf(fp, "%s ", timetags[i]);
-			isc_util_fwrite(r.base, 1, r.length, fp);
-			fprintf(fp, "\n");
+		       fprintf(fp, "%s %.*s\n", timetags[i], (int)r.length,
+				r.base);
 		}
 	}
 
diff --git a/lib/dns/gssapi_link.c b/lib/dns/gssapi_link.c
index c443fcbe..8df08820 100644
--- a/lib/dns/gssapi_link.c
+++ b/lib/dns/gssapi_link.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: gssapi_link.c,v 1.16.10.1 2011-03-28 05:36:05 marka Exp $
+ * $Id: gssapi_link.c,v 1.17 2011-03-28 05:32:16 marka Exp $
  */
 
 #include <config.h>
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 24f4b9c8..a6c5f450 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: gssapictx.c,v 1.26.12.2 2011-04-07 23:05:01 marka Exp $ */
+/* $Id: gssapictx.c,v 1.28 2011-04-07 23:03:22 marka Exp $ */
 
 #include <config.h>
 
diff --git a/lib/dns/include/dns/Makefile.in b/lib/dns/include/dns/Makefile.in
index 3382cc99..5161b0ef 100644
--- a/lib/dns/include/dns/Makefile.in
+++ b/lib/dns/include/dns/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.57.296.2 2011-02-28 01:20:02 tbox Exp $
+# $Id: Makefile.in,v 1.59 2011-03-01 23:48:07 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/lib/dns/include/dns/acl.h b/lib/dns/include/dns/acl.h
index d066507e..dca6120f 100644
--- a/lib/dns/include/dns/acl.h
+++ b/lib/dns/include/dns/acl.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: acl.h,v 1.33.426.2 2011-06-17 23:47:11 tbox Exp $ */
+/* $Id: acl.h,v 1.35 2011-06-17 23:47:49 tbox Exp $ */
 
 #ifndef DNS_ACL_H
 #define DNS_ACL_H 1
diff --git a/lib/dns/include/dns/cache.h b/lib/dns/include/dns/cache.h
index 225f3bf9..ea752422 100644
--- a/lib/dns/include/dns/cache.h
+++ b/lib/dns/include/dns/cache.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cache.h,v 1.28.428.2 2011-03-03 23:47:09 tbox Exp $ */
+/* $Id: cache.h,v 1.32 2011-08-02 23:47:52 tbox Exp $ */
 
 #ifndef DNS_CACHE_H
 #define DNS_CACHE_H 1
@@ -280,9 +280,27 @@ dns_cache_flush(dns_cache_t *cache);
  */
 
 isc_result_t
+dns_cache_flushnode(dns_cache_t *cache, dns_name_t *name,
+		    isc_boolean_t tree);
+/*
+ * Flush a given name from the cache.  If 'tree' is true, then
+ * also flush all names under 'name'.
+ *
+ * Requires:
+ *\li	'cache' to be valid.
+ *\li	'name' to be valid.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *\li	#ISC_R_NOMEMORY
+ *\li	other error returns.
+ */
+
+isc_result_t
 dns_cache_flushname(dns_cache_t *cache, dns_name_t *name);
 /*
- * Flushes a given name from the cache.
+ * Flush a given name from the cache.  Equivalent to
+ * dns_cache_flushpartial(cache, name, ISC_FALSE).
  *
  * Requires:
  *\li	'cache' to be valid.
diff --git a/lib/dns/include/dns/db.h b/lib/dns/include/dns/db.h
index b8136227..38fab175 100644
--- a/lib/dns/include/dns/db.h
+++ b/lib/dns/include/dns/db.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: db.h,v 1.104.8.1 2011-05-19 04:42:51 each Exp $ */
+/* $Id: db.h,v 1.105 2011-05-19 00:31:57 smann Exp $ */
 
 #ifndef DNS_DB_H
 #define DNS_DB_H 1
diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h
index 3d252a13..f6c6fbc5 100644
--- a/lib/dns/include/dns/dispatch.h
+++ b/lib/dns/include/dns/dispatch.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dispatch.h,v 1.62 2009-01-27 23:47:54 tbox Exp $ */
+/* $Id: dispatch.h,v 1.64 2011-07-28 23:47:58 tbox Exp $ */
 
 #ifndef DNS_DISPATCH_H
 #define DNS_DISPATCH_H 1
@@ -245,6 +245,15 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		    unsigned int buckets, unsigned int increment,
 		    unsigned int attributes, unsigned int mask,
 		    dns_dispatch_t **dispp);
+
+isc_result_t
+dns_dispatch_getudp_dup(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
+		    isc_taskmgr_t *taskmgr, isc_sockaddr_t *localaddr,
+		    unsigned int buffersize,
+		    unsigned int maxbuffers, unsigned int maxrequests,
+		    unsigned int buckets, unsigned int increment,
+		    unsigned int attributes, unsigned int mask,
+		    dns_dispatch_t **dispp, dns_dispatch_t *dup);
 /*%<
  * Attach to existing dns_dispatch_t if one is found with dns_dispatchmgr_find,
  * otherwise create a new UDP dispatch.
diff --git a/lib/dns/include/dns/dlz.h b/lib/dns/include/dns/dlz.h
index 29c29269..9faf3d5b 100644
--- a/lib/dns/include/dns/dlz.h
+++ b/lib/dns/include/dns/dlz.h
@@ -50,7 +50,7 @@
  * USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dlz.h,v 1.12.14.2 2011-03-17 23:47:06 tbox Exp $ */
+/* $Id: dlz.h,v 1.14 2011-03-17 23:47:30 tbox Exp $ */
 
 /*! \file dns/dlz.h */
 
diff --git a/lib/dns/include/dns/dlz_dlopen.h b/lib/dns/include/dns/dlz_dlopen.h
index 3e87d10c..7c2f5a3d 100644
--- a/lib/dns/include/dns/dlz_dlopen.h
+++ b/lib/dns/include/dns/dlz_dlopen.h
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dlz_dlopen.h,v 1.2.2.2 2011-03-17 09:41:07 fdupont Exp $ */
+/* $Id: dlz_dlopen.h,v 1.2 2011-03-17 09:25:54 fdupont Exp $ */
 
 /*! \file dns/dlz_open.h */
 
diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h
index 354f8803..696e9951 100644
--- a/lib/dns/include/dns/dnssec.h
+++ b/lib/dns/include/dns/dnssec.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec.h,v 1.42.178.2 2011-05-06 23:47:05 tbox Exp $ */
+/* $Id: dnssec.h,v 1.46 2011-05-06 23:47:29 tbox Exp $ */
 
 #ifndef DNS_DNSSEC_H
 #define DNS_DNSSEC_H 1
@@ -303,7 +303,7 @@ dns_dnssec_keylistfromrdataset(dns_name_t *origin,
 isc_result_t
 dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      dns_dnsseckeylist_t *removed, dns_name_t *origin,
-		      dns_ttl_t ttl, dns_diff_t *diff, isc_boolean_t allzsk,
+		      dns_ttl_t hint_ttl, dns_diff_t *diff, isc_boolean_t allzsk,
 		      isc_mem_t *mctx, void (*report)(const char *, ...));
 /*%<
  * Update the list of keys in 'keys' with new key information in 'newkeys'.
@@ -322,9 +322,11 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
  * If 'allzsk' is true, we are allowing KSK-flagged keys to be used as
  * ZSKs.
  *
- * 'ttl' is the TTL of the DNSKEY RRset; if it is longer than the
- * time until a new key will be activated, then we have to delay the
- * key's activation.
+ * 'hint_ttl' is the TTL to use for the DNSKEY RRset if there is no
+ * existing RRset, and if none of the keys to be added has a default TTL
+ * (in which case we would use the shortest one).  If the TTL is longer
+ * than the time until a new key will be activated, then we have to delay
+ * the key's activation.
  *
  * 'report' points to a function for reporting status.
  *
diff --git a/lib/dns/include/dns/masterdump.h b/lib/dns/include/dns/masterdump.h
index e5bfe045..be43875b 100644
--- a/lib/dns/include/dns/masterdump.h
+++ b/lib/dns/include/dns/masterdump.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: masterdump.h,v 1.42.524.2 2011-05-28 00:27:48 tbox Exp $ */
+/* $Id: masterdump.h,v 1.45 2011-05-26 07:56:39 marka Exp $ */
 
 #ifndef DNS_MASTERDUMP_H
 #define DNS_MASTERDUMP_H 1
@@ -329,6 +329,12 @@ dns_master_stylecreate(dns_master_style_t **style, unsigned int flags,
 		       unsigned int line_length, unsigned int tab_width,
 		       isc_mem_t *mctx);
 
+isc_result_t
+dns_master_stylecreate2(dns_master_style_t **style, unsigned int flags,
+		       unsigned int ttl_column, unsigned int class_column,
+		       unsigned int type_column, unsigned int rdata_column,
+		       unsigned int line_length, unsigned int tab_width,
+		       unsigned int split_width, isc_mem_t *mctx);
 void
 dns_master_styledestroy(dns_master_style_t **style, isc_mem_t *mctx);
 
diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h
index d97f1b66..09d6e980 100644
--- a/lib/dns/include/dns/nsec.h
+++ b/lib/dns/include/dns/nsec.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec.h,v 1.12 2008-09-25 04:02:39 tbox Exp $ */
+/* $Id: nsec.h,v 1.14 2011-06-10 23:47:32 tbox Exp $ */
 
 #ifndef DNS_NSEC_H
 #define DNS_NSEC_H 1
@@ -69,7 +69,8 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version,
 		  isc_boolean_t *answer);
 /*
  * Report whether the DNSKEY RRset has a NSEC only algorithm.  Unknown
- * algorithms are assumed to support NSEC3.
+ * algorithms are assumed to support NSEC3.  If DNSKEY is not found,
+ * *answer is set to ISC_FALSE, and ISC_R_NOTFOUND is returned.
  *
  * Requires:
  * 	'answer' to be non NULL.
diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h
index b70a353d..08366343 100644
--- a/lib/dns/include/dns/rdata.h
+++ b/lib/dns/include/dns/rdata.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata.h,v 1.77 2009-12-04 21:09:33 marka Exp $ */
+/* $Id: rdata.h,v 1.80 2011-03-20 02:31:53 marka Exp $ */
 
 #ifndef DNS_RDATA_H
 #define DNS_RDATA_H 1
@@ -158,6 +158,7 @@ struct dns_rdata {
 
 /*% Output explanatory comments. */
 #define DNS_STYLEFLAG_COMMENT		0x00000002U
+#define DNS_STYLEFLAG_RRCOMMENT		0x00000004U
 
 #define DNS_RDATA_DOWNCASE		DNS_NAME_DOWNCASE
 #define DNS_RDATA_CHECKNAMES		DNS_NAME_CHECKNAMES
@@ -423,8 +424,8 @@ dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target);
 
 isc_result_t
 dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags,
-		    unsigned int width, const char *linebreak,
-		    isc_buffer_t *target);
+		    unsigned int width, unsigned int split_width,
+		    const char *linebreak, isc_buffer_t *target);
 /*%<
  * Like dns_rdata_totext, but do formatted output suitable for
  * database dumps.  This is intended for use by dns_db_dump();
@@ -446,6 +447,11 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin, unsigned int flags,
  * comments next to things like the SOA timer fields.  Some
  * comments (e.g., the SOA ones) are only printed when multiline
  * output is selected.
+ *
+ * base64 rdata text (e.g., DNSKEY records) will be split into chunks
+ * of 'split_width' characters.  If split_width == 0, the text will
+ * not be split at all.  If split_width == UINT_MAX (0xffffffff), then
+ * it is undefined and falls back to the default value of 'width'
  */
 
 isc_result_t
diff --git a/lib/dns/include/dns/rdataset.h b/lib/dns/include/dns/rdataset.h
index 492a1cec..329b7303 100644
--- a/lib/dns/include/dns/rdataset.h
+++ b/lib/dns/include/dns/rdataset.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataset.h,v 1.69.148.3 2011-06-08 23:02:43 each Exp $ */
+/* $Id: rdataset.h,v 1.72 2011-06-08 22:13:51 each Exp $ */
 
 #ifndef DNS_RDATASET_H
 #define DNS_RDATASET_H 1
diff --git a/lib/dns/include/dns/resolver.h b/lib/dns/include/dns/resolver.h
index 9c93fdfb..460edc2a 100644
--- a/lib/dns/include/dns/resolver.h
+++ b/lib/dns/include/dns/resolver.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.h,v 1.67.86.2 2011-02-28 01:20:02 tbox Exp $ */
+/* $Id: resolver.h,v 1.69 2011-02-03 12:18:11 tbox Exp $ */
 
 #ifndef DNS_RESOLVER_H
 #define DNS_RESOLVER_H 1
diff --git a/lib/dns/include/dns/result.h b/lib/dns/include/dns/result.h
index adc1215a..1baf9d22 100644
--- a/lib/dns/include/dns/result.h
+++ b/lib/dns/include/dns/result.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.h,v 1.122 2011-01-11 23:47:13 tbox Exp $ */
+/* $Id: result.h,v 1.123 2011-03-21 07:22:14 each Exp $ */
 
 #ifndef DNS_RESULT_H
 #define DNS_RESULT_H 1
@@ -151,8 +151,9 @@
 #define DNS_R_NOTMASTER 		(ISC_RESULTCLASS_DNS + 105)
 #define DNS_R_BROKENCHAIN		(ISC_RESULTCLASS_DNS + 106)
 #define DNS_R_EXPIRED			(ISC_RESULTCLASS_DNS + 107)
+#define DNS_R_NOTDYNAMIC 		(ISC_RESULTCLASS_DNS + 108)
 
-#define DNS_R_NRESULTS			108	/*%< Number of results */
+#define DNS_R_NRESULTS			109	/*%< Number of results */
 
 /*
  * DNS wire format rcodes.
diff --git a/lib/dns/include/dns/sdlz.h b/lib/dns/include/dns/sdlz.h
index 76eff3ca..bd7b521c 100644
--- a/lib/dns/include/dns/sdlz.h
+++ b/lib/dns/include/dns/sdlz.h
@@ -50,7 +50,7 @@
  * USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sdlz.h,v 1.14.8.2 2011-03-17 23:47:06 tbox Exp $ */
+/* $Id: sdlz.h,v 1.16 2011-03-17 23:47:30 tbox Exp $ */
 
 /*! \file dns/sdlz.h */
 
diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h
index dc02c865..3814aef4 100644
--- a/lib/dns/include/dns/types.h
+++ b/lib/dns/include/dns/types.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: types.h,v 1.143 2010-12-08 02:46:16 marka Exp $ */
+/* $Id: types.h,v 1.145 2011-07-01 23:47:44 tbox Exp $ */
 
 #ifndef DNS_TYPES_H
 #define DNS_TYPES_H 1
@@ -332,6 +332,20 @@ typedef enum {
 	dns_severity_fail
 } dns_severity_t;
 
+/*%
+ * DNS Serial Number Update Method.
+ *
+ * \li	_increment:	Add one to the current serial, skipping 0.
+ * \li	_unixtime:	Set to the seconds since 00:00 Jan 1, 1970,
+ *			if possible.
+ * \li	_yyyymmvv:	Set to Year, Month, Version, if possible.
+ *			(Not yet implemented)
+ */
+typedef enum {
+	dns_updatemethod_increment = 0,
+	dns_updatemethod_unixtime
+} dns_updatemethod_t;
+
 /*
  * Functions.
  */
diff --git a/lib/dns/include/dns/update.h b/lib/dns/include/dns/update.h
new file mode 100644
index 00000000..cf5d0146
--- /dev/null
+++ b/lib/dns/include/dns/update.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: update.h,v 1.2 2011-07-01 02:25:48 marka Exp $ */
+
+#ifndef DNS_UPDATE_H
+#define DNS_UPDATE_H 1
+
+/*! \file dns/update.h */
+
+/***
+ ***	Imports
+ ***/
+
+#include <isc/lang.h>
+
+#include <dns/types.h>
+
+ISC_LANG_BEGINDECLS
+
+/***
+ ***	Functions
+ ***/
+
+isc_uint32_t
+dns_update_soaserial(isc_uint32_t serial, dns_updatemethod_t method);
+/*%<
+ * Return the next serial number after 'serial', depending on the
+ * update method 'method':
+ *
+ *\li	* dns_updatemethod_increment increments the serial number by one
+ *\li	* dns_updatemethod_unixtime sets the serial number to the current
+ *	  time (seconds since UNIX epoch) if possible, or increments by one
+ *	  if not.
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif /* DNS_UPDATE_H */
diff --git a/lib/dns/include/dns/view.h b/lib/dns/include/dns/view.h
index 4b240239..9b6e2e66 100644
--- a/lib/dns/include/dns/view.h
+++ b/lib/dns/include/dns/view.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.h,v 1.132 2011-01-13 01:59:28 marka Exp $ */
+/* $Id: view.h,v 1.134 2011-08-02 20:36:13 each Exp $ */
 
 #ifndef DNS_VIEW_H
 #define DNS_VIEW_H 1
@@ -182,6 +182,7 @@ struct dns_view {
 	dns_viewlist_t *		viewlist;
 
 	dns_zone_t *			managed_keys;
+	dns_zone_t *			redirect;
 
 #ifdef BIND9
 	/* File in which to store configuration for newly added zones */
@@ -838,9 +839,31 @@ dns_view_flushcache2(dns_view_t *view, isc_boolean_t fixuponly);
  */
 
 isc_result_t
-dns_view_flushname(dns_view_t *view, dns_name_t *);
+dns_view_flushnode(dns_view_t *view, dns_name_t *name, isc_boolean_t tree);
 /*%<
- * Flush the given name from the view's cache (and ADB).
+ * Flush the given name from the view's cache (and optionally ADB/badcache).
+ *
+ * If 'tree' is true, flush 'name' and all names below it
+ * from the cache, but do not flush ADB.
+ *
+ * If 'tree' is false, flush 'name' frmo both the cache and ADB,
+ * but do not touch any other nodes.
+ *
+ * Requires:
+ *\li	'view' is valid.
+ *\li	'name' is valid.
+ *
+ * Returns:
+ *\li	#ISC_R_SUCCESS
+ *	other returns are failures.
+ */
+
+isc_result_t
+dns_view_flushname(dns_view_t *view, dns_name_t *name);
+/*%<
+ * Flush the given name from the view's cache, ADB and badcache.
+ * Equivalent to dns_view_flushnode(view, name, ISC_FALSE).
+ *
  *
  * Requires:
  *\li	'view' is valid.
@@ -856,7 +879,6 @@ dns_view_adddelegationonly(dns_view_t *view, dns_name_t *name);
 /*%<
  * Add the given name to the delegation only table.
  *
- *
  * Requires:
  *\li	'view' is valid.
  *\li	'name' is valid.
diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h
index a8b78dc0..6e4e2e3f 100644
--- a/lib/dns/include/dns/zone.h
+++ b/lib/dns/include/dns/zone.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.h,v 1.182.16.2 2011-07-08 23:47:16 tbox Exp $ */
+/* $Id: zone.h,v 1.191 2011-07-06 01:36:32 each Exp $ */
 
 #ifndef DNS_ZONE_H
 #define DNS_ZONE_H 1
@@ -43,7 +43,8 @@ typedef enum {
 	dns_zone_stub,
 	dns_zone_staticstub,
 	dns_zone_key,
-	dns_zone_dlz
+	dns_zone_dlz,
+	dns_zone_redirect,
 } dns_zonetype_t;
 
 #define DNS_ZONEOPT_SERVERS	  0x00000001U	/*%< perform server checks */
@@ -92,6 +93,7 @@ typedef enum {
 #define DNS_ZONEKEY_MAINTAIN	0x00000002U	/*%< publish/sign on schedule */
 #define DNS_ZONEKEY_CREATE	0x00000004U	/*%< make keys when needed */
 #define DNS_ZONEKEY_FULLSIGN    0x00000008U     /*%< roll to new keys immediately */
+#define DNS_ZONEKEY_NORESIGN	0x00000010U	/*%< no automatic resigning */
 
 #ifndef DNS_ZONE_MINREFRESH
 #define DNS_ZONE_MINREFRESH		    300	/*%< 5 minutes */
@@ -556,10 +558,16 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
 isc_result_t
 dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
 		       isc_uint32_t count);
+isc_result_t
+dns_zone_setalsonotifywithkeys(dns_zone_t *zone, const isc_sockaddr_t *notify,
+							   dns_name_t **keynames, isc_uint32_t count);
 /*%<
  *	Set the list of additional servers to be notified when
  *	a zone changes.	 To clear the list use 'count = 0'.
  *
+ *	dns_zone_alsonotifywithkeys() allows each notify address to
+ *	be associated with a TSIG key.
+ *
  * Require:
  *\li	'zone' to be a valid zone.
  *\li	'notify' to be non-NULL if count != 0.
@@ -1865,6 +1873,56 @@ dns_zone_dlzpostload(dns_zone_t *zone, dns_db_t *db);
  * Load the origin names for a writeable DLZ database.
  */
 
+isc_boolean_t
+dns_zone_isdynamic(dns_zone_t *zone, isc_boolean_t ignore_freeze);
+/*%
+ * Return true iff the zone is "dynamic", in the sense that the zone's
+ * master file (if any) is written by the server, rather than being
+ * updated manually and read by the server.
+ *
+ * This is true for slave zones, stub zones, key zones, and zones that
+ * allow dynamic updates either by having an update policy ("ssutable")
+ * or an "allow-update" ACL with a value other than exactly "{ none; }".
+ *
+ * If 'ignore_freeze' is true, then the zone which has had updates disabled
+ * will still report itself to be dynamic.
+ *
+ * Requires:
+ * \li	'zone' to be valid.
+ */
+
+isc_result_t
+dns_zone_setrefreshkeyinterval(dns_zone_t *zone, isc_uint32_t interval);
+/*%
+ * Sets the frequency, in minutes, with which the key repository will be
+ * checked to see if the keys for this zone have been updated.  Any value
+ * higher than 1440 minutes (24 hours) will be silently reduced.  A
+ * value of zero will return an out-of-range error.
+ *
+ * Requires:
+ * \li	'zone' to be valid.
+ */
+
+void
+dns_zone_setserialupdatemethod(dns_zone_t *zone, dns_updatemethod_t method);
+/*%
+ * Sets the update method to use when incrementing the zone serial number
+ * due to a DDNS update.  Valid options are dns_updatemethod_increment
+ * and dns_updatemethod_unixtime.
+ *
+ * Requires:
+ * \li	'zone' to be valid.
+ */
+
+dns_updatemethod_t
+dns_zone_getserialupdatemethod(dns_zone_t *zone);
+/*%
+ * Returns the update method to be used when incrementing the zone serial
+ * number due to a DDNS update.
+ *
+ * Requires:
+ * \li	'zone' to be valid.
+ */
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_ZONE_H */
diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
index eec9b39b..598f6659 100644
--- a/lib/dns/include/dst/dst.h
+++ b/lib/dns/include/dst/dst.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dst.h,v 1.31.10.1 2011-03-21 19:53:35 each Exp $ */
+/* $Id: dst.h,v 1.33 2011-03-21 19:54:03 each Exp $ */
 
 #ifndef DST_DST_H
 #define DST_DST_H 1
@@ -735,6 +735,26 @@ dst_key_setbits(dst_key_t *key, isc_uint16_t bits);
  *	"key" is a valid key.
  */
 
+void
+dst_key_setttl(dst_key_t *key, dns_ttl_t ttl);
+/*%<
+ * Set the default TTL to use when converting the key
+ * to a KEY or DNSKEY RR.
+ *
+ * Requires:
+ *	"key" is a valid key.
+ */
+
+dns_ttl_t
+dst_key_getttl(const dst_key_t *key);
+/*%<
+ * Get the default TTL to use when converting the key
+ * to a KEY or DNSKEY RR.
+ *
+ * Requires:
+ *	"key" is a valid key.
+ */
+
 isc_result_t
 dst_key_setflags(dst_key_t *key, isc_uint32_t flags);
 /*
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 27e9bdb6..c6350d63 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: journal.c,v 1.112.38.2 2011-03-12 04:59:17 tbox Exp $ */
+/* $Id: journal.c,v 1.114 2011-03-12 04:59:48 tbox Exp $ */
 
 #include <config.h>
 
diff --git a/lib/dns/key.c b/lib/dns/key.c
index 7c8114e7..9882bad1 100644
--- a/lib/dns/key.c
+++ b/lib/dns/key.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: key.c,v 1.8 2007-06-19 23:47:16 tbox Exp $ */
+/* $Id: key.c,v 1.10 2011-03-17 23:47:30 tbox Exp $ */
 
 #include <config.h>
 
@@ -144,4 +144,16 @@ dst_key_getbits(const dst_key_t *key) {
 	return (key->key_bits);
 }
 
+void
+dst_key_setttl(dst_key_t *key, dns_ttl_t ttl) {
+	REQUIRE(VALID_KEY(key));
+	key->key_ttl = ttl;
+}
+
+dns_ttl_t
+dst_key_getttl(const dst_key_t *key) {
+	REQUIRE(VALID_KEY(key));
+	return (key->key_ttl);
+}
+
 /*! \file */
diff --git a/lib/dns/master.c b/lib/dns/master.c
index 1e9fead6..d6ac002a 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: master.c,v 1.178.346.2 2011-03-12 04:59:17 tbox Exp $ */
+/* $Id: master.c,v 1.180 2011-03-12 04:59:48 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index c137b108..8d911c10 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: masterdump.c,v 1.99.258.7 2011-06-08 23:02:42 each Exp $ */
+/* $Id: masterdump.c,v 1.108 2011-06-08 22:13:50 each Exp $ */
 
 /*! \file */
 
@@ -74,6 +74,7 @@ struct dns_master_style {
 	unsigned int rdata_column;
 	unsigned int line_length;
 	unsigned int tab_width;
+	unsigned int split_width;
 };
 
 /*%
@@ -108,15 +109,16 @@ dns_master_style_default = {
 	DNS_STYLEFLAG_OMIT_TTL |
 	DNS_STYLEFLAG_TTL |
 	DNS_STYLEFLAG_COMMENT |
+	DNS_STYLEFLAG_RRCOMMENT |
 	DNS_STYLEFLAG_MULTILINE,
-	24, 24, 24, 32, 80, 8
+	24, 24, 24, 32, 80, 8, UINT_MAX
 };
 
 LIBDNS_EXTERNAL_DATA const dns_master_style_t
 dns_master_style_full = {
 	DNS_STYLEFLAG_COMMENT |
 	DNS_STYLEFLAG_RESIGN,
-	46, 46, 46, 64, 120, 8
+	46, 46, 46, 64, 120, 8, UINT_MAX
 };
 
 LIBDNS_EXTERNAL_DATA const dns_master_style_t
@@ -126,8 +128,9 @@ dns_master_style_explicitttl = {
 	DNS_STYLEFLAG_REL_OWNER |
 	DNS_STYLEFLAG_REL_DATA |
 	DNS_STYLEFLAG_COMMENT |
+	DNS_STYLEFLAG_RRCOMMENT |
 	DNS_STYLEFLAG_MULTILINE,
-	24, 32, 32, 40, 80, 8
+	24, 32, 32, 40, 80, 8, UINT_MAX
 };
 
 LIBDNS_EXTERNAL_DATA const dns_master_style_t
@@ -137,13 +140,13 @@ dns_master_style_cache = {
 	DNS_STYLEFLAG_MULTILINE |
 	DNS_STYLEFLAG_TRUST |
 	DNS_STYLEFLAG_NCACHE,
-	24, 32, 32, 40, 80, 8
+	24, 32, 32, 40, 80, 8, UINT_MAX
 };
 
 LIBDNS_EXTERNAL_DATA const dns_master_style_t
 dns_master_style_simple = {
 	0,
-	24, 32, 32, 40, 80, 8
+	24, 32, 32, 40, 80, 8, UINT_MAX
 };
 
 /*%
@@ -152,7 +155,7 @@ dns_master_style_simple = {
 LIBDNS_EXTERNAL_DATA const dns_master_style_t
 dns_master_style_debug = {
 	DNS_STYLEFLAG_REL_OWNER,
-	24, 32, 40, 48, 80, 8
+	24, 32, 40, 48, 80, 8, UINT_MAX
 };
 
 
@@ -373,7 +376,7 @@ ncache_summary(dns_rdataset_t *rdataset, isc_boolean_t omit_final_dot,
 				dns_rdataset_current(&rds, &rdata);
 				CHECK(str_totext(" ", target));
 				CHECK(dns_rdata_tofmttext(&rdata, dns_rootname,
-							  0, 0, " ", target));
+							  0, 0, 0, " ", target));
 				CHECK(str_totext("\n", target));
 			}
 		}
@@ -534,6 +537,7 @@ rdataset_totext(dns_rdataset_t *rdataset,
 						   ctx->style.flags,
 						   ctx->style.line_length -
 						       ctx->style.rdata_column,
+						   ctx->style.split_width,
 						   ctx->linebreak,
 						   target));
 
@@ -1773,6 +1777,19 @@ dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags,
 		       unsigned int line_length, unsigned int tab_width,
 		       isc_mem_t *mctx)
 {
+	return (dns_master_stylecreate2(stylep, flags, ttl_column,
+					class_column, type_column,
+					rdata_column, line_length,
+					tab_width, 0xffffffff, mctx));
+}
+
+isc_result_t
+dns_master_stylecreate2(dns_master_style_t **stylep, unsigned int flags,
+			unsigned int ttl_column, unsigned int class_column,
+			unsigned int type_column, unsigned int rdata_column,
+			unsigned int line_length, unsigned int tab_width,
+			unsigned int split_width, isc_mem_t *mctx)
+{
 	dns_master_style_t *style;
 
 	REQUIRE(stylep != NULL && *stylep == NULL);
@@ -1787,6 +1804,7 @@ dns_master_stylecreate(dns_master_style_t **stylep, unsigned int flags,
 	style->rdata_column = rdata_column;
 	style->line_length = line_length;
 	style->tab_width = tab_width;
+	style->split_width = split_width;
 
 	*stylep = style;
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 4ca37b75..84d9c9a4 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: message.c,v 1.254.114.3 2011-06-08 23:02:42 each Exp $ */
+/* $Id: message.c,v 1.257 2011-06-08 22:13:50 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 23835138..63aa4cb0 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: name.c,v 1.174.8.1 2011-03-11 06:47:04 marka Exp $ */
+/* $Id: name.c,v 1.175 2011-03-11 06:11:23 marka Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c
index 1ac85e5f..aba67afc 100644
--- a/lib/dns/ncache.c
+++ b/lib/dns/ncache.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ncache.c,v 1.50.124.4 2011-06-08 23:02:42 each Exp $ */
+/* $Id: ncache.c,v 1.54 2011-06-08 22:13:50 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 506f5b78..461386f5 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec.c,v 1.13.428.2 2011-03-12 04:59:17 tbox Exp $ */
+/* $Id: nsec.c,v 1.16 2011-06-10 01:51:09 each Exp $ */
 
 /*! \file */
 
@@ -245,10 +245,8 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version,
 				     0, 0, &rdataset, NULL);
 	dns_db_detachnode(db, &node);
 
-	if (result == ISC_R_NOTFOUND) {
+	if (result == ISC_R_NOTFOUND)
 		*answer = ISC_FALSE;
-		return (ISC_R_SUCCESS);
-	}
 	if (result != ISC_R_SUCCESS)
 		return (result);
 	for (result = dns_rdataset_first(&rdataset);
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index d99f90ec..4210135b 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec3.c,v 1.19.24.3 2011-06-08 23:02:42 each Exp $ */
+/* $Id: nsec3.c,v 1.23 2011-06-10 01:51:09 each Exp $ */
 
 #include <config.h>
 
@@ -49,6 +49,7 @@
 
 #define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
 #define CREATE(x) (((x) & DNS_NSEC3FLAG_CREATE) != 0)
+#define INITIAL(x) (((x) & DNS_NSEC3FLAG_INITIAL) != 0)
 #define REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)
 
 static void
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
index 49670b1a..904ab1a4 100644
--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
@@ -31,7 +31,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: openssl_link.c,v 1.29.54.2 2011-03-12 04:59:17 tbox Exp $
+ * $Id: openssl_link.c,v 1.31 2011-03-12 04:59:48 tbox Exp $
  */
 #ifdef OPENSSL
 
diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
index c266a26e..9da5619f 100644
--- a/lib/dns/openssldsa_link.c
+++ b/lib/dns/openssldsa_link.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: openssldsa_link.c,v 1.20.10.1 2011-03-11 06:47:04 marka Exp $ */
+/* $Id: openssldsa_link.c,v 1.21 2011-03-11 06:11:24 marka Exp $ */
 
 #ifdef OPENSSL
 #ifndef USE_EVP
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index 098529a8..44000395 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -17,7 +17,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: opensslrsa_link.c,v 1.39.10.2 2011-03-11 02:57:35 marka Exp $
+ * $Id: opensslrsa_link.c,v 1.41 2011-03-11 02:59:37 marka Exp $
  */
 #ifdef OPENSSL
 #include <config.h>
diff --git a/lib/dns/private.c b/lib/dns/private.c
index ba3e8ed3..9602d59d 100644
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: private.c,v 1.3 2009-10-09 23:48:09 tbox Exp $ */
+/* $Id: private.c,v 1.6 2011-06-10 01:51:09 each Exp $ */
 
 #include "config.h"
 
@@ -44,6 +44,7 @@
 
 #define REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)
 #define CREATE(x) (((x) & DNS_NSEC3FLAG_CREATE) != 0)
+#define INITIAL(x) (((x) & DNS_NSEC3FLAG_INITIAL) != 0)
 #define NONSEC(x) (((x) & DNS_NSEC3FLAG_NONSEC) != 0)
 
 #define CHECK(x) do {					\
@@ -149,7 +150,7 @@ dns_private_chains(dns_db_t *db, dns_dbversion_t *ver,
 	}
 
 	/*
-	 * Look to see if we also need to be creating a NSEC3 chains.
+	 * Look to see if we also need to be creating a NSEC3 chain.
 	 */
 	if (dns_rdataset_isassociated(&nsecset)) {
 		if (build_nsec != NULL)
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index c733e505..1b4ff3ac 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbt.c,v 1.146.278.2 2011-03-12 04:59:17 tbox Exp $ */
+/* $Id: rbt.c,v 1.148 2011-03-12 04:59:48 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 9d66006b..91f33bf5 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.310.8.5 2011-06-08 23:02:42 each Exp $ */
+/* $Id: rbtdb.c,v 1.316 2011-08-23 00:59:23 each Exp $ */
 
 /*! \file */
 
@@ -8480,7 +8480,7 @@ dbiterator_last(dns_dbiterator_t *iterator) {
 
 static isc_result_t
 dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) {
-	isc_result_t result;
+	isc_result_t result, tresult;
 	rbtdb_dbiterator_t *rbtdbiter = (rbtdb_dbiterator_t *)iterator;
 	dns_rbtdb_t *rbtdb = (dns_rbtdb_t *)iterator->db;
 	dns_name_t *iname, *origin;
@@ -8523,13 +8523,14 @@ dbiterator_seek(dns_dbiterator_t *iterator, dns_name_t *name) {
 					  DNS_RBTFIND_EMPTYDATA, NULL, NULL);
 		if (result == DNS_R_PARTIALMATCH) {
 			dns_rbtnode_t *node = NULL;
-			result = dns_rbt_findnode(rbtdb->nsec3, name, NULL,
+			tresult = dns_rbt_findnode(rbtdb->nsec3, name, NULL,
 						  &node, &rbtdbiter->nsec3chain,
 						  DNS_RBTFIND_EMPTYDATA,
 						  NULL, NULL);
-			if (result == ISC_R_SUCCESS) {
+			if (tresult == ISC_R_SUCCESS) {
 				rbtdbiter->node = node;
 				rbtdbiter->current = &rbtdbiter->nsec3chain;
+				result = tresult;
 			}
 		}
 	}
diff --git a/lib/dns/rbtdb.h b/lib/dns/rbtdb.h
index efa3944c..92f21845 100644
--- a/lib/dns/rbtdb.h
+++ b/lib/dns/rbtdb.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.h,v 1.18.814.2 2011-03-03 23:47:09 tbox Exp $ */
+/* $Id: rbtdb.h,v 1.20 2011-03-03 23:47:32 tbox Exp $ */
 
 #ifndef DNS_RBTDB_H
 #define DNS_RBTDB_H 1
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
index 81a4549c..0a2ca20b 100644
--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rcode.c,v 1.16.14.2 2011-02-28 01:20:02 tbox Exp $ */
+/* $Id: rcode.c,v 1.18 2011-02-21 23:47:45 tbox Exp $ */
 
 #include <config.h>
 #include <ctype.h>
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index 063b1f66..6710a1cf 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdata.c,v 1.209.8.2 2011-03-11 06:47:05 marka Exp $ */
+/* $Id: rdata.c,v 1.213 2011-03-11 06:11:24 marka Exp $ */
 
 /*! \file */
 
@@ -124,6 +124,15 @@ txt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
 static isc_result_t
 txt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
 
+static isc_result_t
+multitxt_totext(isc_region_t *source, isc_buffer_t *target);
+
+static isc_result_t
+multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target);
+
+static isc_result_t
+multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target);
+
 static isc_boolean_t
 name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target);
 
@@ -718,7 +727,13 @@ rdata_totext(dns_rdata_t *rdata, dns_rdata_textctx_t *tctx,
 				result = str_totext(" ( ", target);
 			else
 				result = str_totext(" ", target);
-			if (result == ISC_R_SUCCESS)
+
+			if (result != ISC_R_SUCCESS)
+				return (result);
+
+			if (tctx->width == 0) /* No splitting */
+				result = isc_hex_totext(&sr, 0, "", target);
+			else
 				result = isc_hex_totext(&sr, tctx->width - 2,
 							tctx->linebreak,
 							target);
@@ -751,7 +766,8 @@ dns_rdata_totext(dns_rdata_t *rdata, dns_name_t *origin, isc_buffer_t *target)
 isc_result_t
 dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin,
 		    unsigned int flags, unsigned int width,
-		    const char *linebreak, isc_buffer_t *target)
+		    unsigned int split_width, const char *linebreak,
+		    isc_buffer_t *target)
 {
 	dns_rdata_textctx_t tctx;
 
@@ -762,11 +778,16 @@ dns_rdata_tofmttext(dns_rdata_t *rdata, dns_name_t *origin,
 	 */
 	tctx.origin = origin;
 	tctx.flags = flags;
-	if ((flags & DNS_STYLEFLAG_MULTILINE) != 0) {
+	if (split_width == 0xffffffff)
 		tctx.width = width;
+	else
+		tctx.width = split_width;
+
+	if ((flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		tctx.linebreak = linebreak;
-	} else {
-		tctx.width = 60; /* Used for hex word length only. */
+	else {
+		if (split_width == 0xffffffff)
+			tctx.width = 60; /* Used for hex word length only. */
 		tctx.linebreak = " ";
 	}
 	return (rdata_totext(rdata, &tctx, target));
@@ -1133,6 +1154,157 @@ txt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+multitxt_totext(isc_region_t *source, isc_buffer_t *target) {
+	unsigned int tl;
+	unsigned int n0, n;
+	unsigned char *sp;
+	char *tp;
+	isc_region_t region;
+
+	isc_buffer_availableregion(target, &region);
+	sp = source->base;
+	tp = (char *)region.base;
+	tl = region.length;
+
+	if (tl < 1)
+		return (ISC_R_NOSPACE);
+	*tp++ = '"';
+	tl--;
+	do {
+		n0 = n = *sp++;
+
+		REQUIRE(n0 + 1 <= source->length);
+
+		while (n--) {
+			if (*sp < 0x20 || *sp >= 0x7f) {
+				if (tl < 4)
+					return (ISC_R_NOSPACE);
+				*tp++ = 0x5c;
+				*tp++ = 0x30 + ((*sp / 100) % 10);
+				*tp++ = 0x30 + ((*sp / 10) % 10);
+				*tp++ = 0x30 + (*sp % 10);
+				sp++;
+				tl -= 4;
+				continue;
+			}
+			/* double quote, semi-colon, backslash */
+			if (*sp == 0x22 || *sp == 0x3b || *sp == 0x5c) {
+				if (tl < 2)
+					return (ISC_R_NOSPACE);
+				*tp++ = '\\';
+				tl--;
+			}
+			if (tl < 1)
+				return (ISC_R_NOSPACE);
+			*tp++ = *sp++;
+			tl--;
+		}
+		isc_region_consume(source, n0 + 1);
+	} while (source->length != 0);
+	if (tl < 1)
+		return (ISC_R_NOSPACE);
+	*tp++ = '"';
+	tl--;
+	isc_buffer_add(target, tp - (char *)region.base);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+multitxt_fromtext(isc_textregion_t *source, isc_buffer_t *target) {
+	isc_region_t tregion;
+	isc_boolean_t escape;
+	unsigned int n, nrem;
+	char *s;
+	unsigned char *t0, *t;
+	int d;
+	int c;
+
+	s = source->base;
+	n = source->length;
+	escape = ISC_FALSE;
+
+	do {
+		isc_buffer_availableregion(target, &tregion);
+		t0 = tregion.base;
+		nrem = tregion.length;
+		if (nrem < 1)
+			return (ISC_R_NOSPACE);
+		/* length byte */
+		t = t0;
+		nrem--;
+		t++;
+		/* 255 byte character-string slice */
+		if (nrem > 255)
+			nrem = 255;
+		while (n != 0) {
+			--n;
+			c = (*s++) & 0xff;
+			if (escape && (d = decvalue((char)c)) != -1) {
+				c = d;
+				if (n == 0)
+					return (DNS_R_SYNTAX);
+				n--;
+				if ((d = decvalue(*s++)) != -1)
+					c = c * 10 + d;
+				else
+					return (DNS_R_SYNTAX);
+				if (n == 0)
+					return (DNS_R_SYNTAX);
+				n--;
+				if ((d = decvalue(*s++)) != -1)
+					c = c * 10 + d;
+				else
+					return (DNS_R_SYNTAX);
+				if (c > 255)
+					return (DNS_R_SYNTAX);
+			} else if (!escape && c == '\\') {
+				escape = ISC_TRUE;
+				continue;
+			}
+			escape = ISC_FALSE;
+			*t++ = c;
+			nrem--;
+			if (nrem == 0)
+				break;
+		}
+		if (escape)
+			return (DNS_R_SYNTAX);
+		*t0 = t - t0 - 1;
+		isc_buffer_add(target, *t0 + 1);
+	} while (n != 0);
+	return (ISC_R_SUCCESS);
+}
+
+static isc_result_t
+multitxt_fromwire(isc_buffer_t *source, isc_buffer_t *target) {
+	unsigned int n;
+	isc_region_t sregion;
+	isc_region_t tregion;
+
+	isc_buffer_activeregion(source, &sregion);
+	if (sregion.length == 0)
+		return(ISC_R_UNEXPECTEDEND);
+	n = 256U;
+	do {
+		if (n != 256U)
+			return (DNS_R_SYNTAX);
+		n = *sregion.base + 1;
+		if (n > sregion.length)
+			return (ISC_R_UNEXPECTEDEND);
+
+		isc_buffer_availableregion(target, &tregion);
+		if (n > tregion.length)
+			return (ISC_R_NOSPACE);
+
+		memcpy(tregion.base, sregion.base, n);
+		isc_buffer_forward(source, n);
+		isc_buffer_add(target, n);
+		isc_buffer_activeregion(source, &sregion);
+	} while (sregion.length != 0);
+	return (ISC_R_SUCCESS);
+}
+
 static isc_boolean_t
 name_prefix(dns_name_t *name, dns_name_t *origin, dns_name_t *target) {
 	int l1, l2;
diff --git a/lib/dns/rdata/any_255/tsig_250.c b/lib/dns/rdata/any_255/tsig_250.c
index 9763f6d0..acad4fcc 100644
--- a/lib/dns/rdata/any_255/tsig_250.c
+++ b/lib/dns/rdata/any_255/tsig_250.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tsig_250.c,v 1.65 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: tsig_250.c,v 1.67 2011-03-05 23:52:30 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 13:39:43 PST 2000 by gson */
 
@@ -202,8 +202,11 @@ totext_any_tsig(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&sigr, tctx->width - 2,
-				 tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sigr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&sigr, tctx->width - 2,
+					 tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" ) ", target));
 	else
@@ -241,7 +244,10 @@ totext_any_tsig(ARGS_TOTEXT) {
 	/*
 	 * Other.
 	 */
-	return (isc_base64_totext(&sr, 60, " ", target));
+	if (tctx->width == 0)   /* No splitting */
+		return (isc_base64_totext(&sr, 60, "", target));
+	else
+		return (isc_base64_totext(&sr, 60, " ", target));
 }
 
 static inline isc_result_t
diff --git a/lib/dns/rdata/generic/cert_37.c b/lib/dns/rdata/generic/cert_37.c
index d06b4e63..a04a1fb3 100644
--- a/lib/dns/rdata/generic/cert_37.c
+++ b/lib/dns/rdata/generic/cert_37.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: cert_37.c,v 1.52 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: cert_37.c,v 1.54 2011-03-05 23:52:30 tbox Exp $ */
 
 /* Reviewed: Wed Mar 15 21:14:32 EST 2000 by tale */
 
@@ -109,8 +109,11 @@ totext_cert(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&sr, tctx->width - 2,
-				 tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&sr, tctx->width - 2,
+					 tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" )", target));
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/rdata/generic/dlv_32769.c b/lib/dns/rdata/generic/dlv_32769.c
index 0f87433c..7d1cb84e 100644
--- a/lib/dns/rdata/generic/dlv_32769.c
+++ b/lib/dns/rdata/generic/dlv_32769.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007, 2009-2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dlv_32769.c,v 1.10 2010-12-23 23:47:08 tbox Exp $ */
+/* $Id: dlv_32769.c,v 1.12 2011-03-05 23:52:31 tbox Exp $ */
 
 /* draft-ietf-dnsext-delegation-signer-05.txt */
 
@@ -134,7 +134,11 @@ totext_dlv(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target));
+	if (tctx->width == 0) /* No splitting */
+		RETERR(isc_hex_totext(&sr, 0, "", target));
+	else
+		RETERR(isc_hex_totext(&sr, tctx->width - 2,
+				      tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" )", target));
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/rdata/generic/dnskey_48.c b/lib/dns/rdata/generic/dnskey_48.c
index 91fe9f8d..ab4462c7 100644
--- a/lib/dns/rdata/generic/dnskey_48.c
+++ b/lib/dns/rdata/generic/dnskey_48.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnskey_48.c,v 1.10 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: dnskey_48.c,v 1.12 2011-03-05 23:52:31 tbox Exp $ */
 
 /*
  * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
@@ -76,7 +76,8 @@ totext_dnskey(ARGS_TOTEXT) {
 	char buf[sizeof("64000")];
 	unsigned int flags;
 	unsigned char algorithm;
-	char namebuf[DNS_NAME_FORMATSIZE];
+	char algbuf[DNS_NAME_FORMATSIZE];
+	const char *keyinfo;
 
 	REQUIRE(rdata->type == 48);
 	REQUIRE(rdata->length != 0);
@@ -89,6 +90,13 @@ totext_dnskey(ARGS_TOTEXT) {
 	sprintf(buf, "%u", flags);
 	RETERR(str_totext(buf, target));
 	RETERR(str_totext(" ", target));
+	if ((flags & DNS_KEYFLAG_KSK) != 0) {
+		if (flags & DNS_KEYFLAG_REVOKE)
+			keyinfo = "revoked KSK";
+		else
+			keyinfo = "KSK";
+	} else
+		keyinfo = "ZSK";
 
 	/* protocol */
 	sprintf(buf, "%u", sr.base[0]);
@@ -106,23 +114,28 @@ totext_dnskey(ARGS_TOTEXT) {
 	if ((flags & 0xc000) == 0xc000)
 		return (ISC_R_SUCCESS);
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0 &&
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 &&
 	     algorithm == DNS_KEYALG_PRIVATEDNS) {
 		dns_name_t name;
 		dns_name_init(&name, NULL);
 		dns_name_fromregion(&name, &sr);
-		dns_name_format(&name, namebuf, sizeof(namebuf));
-	} else
-		namebuf[0] = 0;
+		dns_name_format(&name, algbuf, sizeof(algbuf));
+	} else {
+		dns_secalg_format((dns_secalg_t) algorithm, algbuf,
+				  sizeof(algbuf));
+	}
 
 	/* key */
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&sr, tctx->width - 2,
-				 tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sr, 0, "", target));
+	else
+		RETERR(isc_base64_totext(&sr, tctx->width - 2,
+					 tctx->linebreak, target));
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
 		RETERR(str_totext(tctx->linebreak, target));
 	else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" ", target));
@@ -130,18 +143,17 @@ totext_dnskey(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(")", target));
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
 		isc_region_t tmpr;
 
-		RETERR(str_totext(" ; key id = ", target));
+		RETERR(str_totext(" ; ", target));
+		RETERR(str_totext(keyinfo, target));
+		RETERR(str_totext("; alg = ", target));
+		RETERR(str_totext(algbuf, target));
+		RETERR(str_totext("; key id = ", target));
 		dns_rdata_toregion(rdata, &tmpr);
 		sprintf(buf, "%u", dst_region_computeid(&tmpr, algorithm));
 		RETERR(str_totext(buf, target));
-		if (algorithm == DNS_KEYALG_PRIVATEDNS) {
-			RETERR(str_totext(tctx->linebreak, target));
-			RETERR(str_totext("; alg = ", target));
-			RETERR(str_totext(namebuf, target));
-		}
 	}
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/generic/ds_43.c b/lib/dns/rdata/generic/ds_43.c
index ee74ab67..2760d157 100644
--- a/lib/dns/rdata/generic/ds_43.c
+++ b/lib/dns/rdata/generic/ds_43.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ds_43.c,v 1.16 2010-12-23 23:47:08 tbox Exp $ */
+/* $Id: ds_43.c,v 1.18 2011-03-05 23:52:31 tbox Exp $ */
 
 /* draft-ietf-dnsext-delegation-signer-05.txt */
 
@@ -134,7 +134,11 @@ totext_ds(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target));
+	if (tctx->width == 0) /* No splitting */
+		RETERR(isc_hex_totext(&sr, 0, "", target));
+	else
+		RETERR(isc_hex_totext(&sr, tctx->width - 2,
+				      tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" )", target));
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/rdata/generic/ipseckey_45.c b/lib/dns/rdata/generic/ipseckey_45.c
index 995a1353..abed90ec 100644
--- a/lib/dns/rdata/generic/ipseckey_45.c
+++ b/lib/dns/rdata/generic/ipseckey_45.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ipseckey_45.c,v 1.11 2011-01-13 04:59:26 tbox Exp $ */
+/* $Id: ipseckey_45.c,v 1.12 2011-03-05 19:39:07 each Exp $ */
 
 #ifndef RDATA_GENERIC_IPSECKEY_45_C
 #define RDATA_GENERIC_IPSECKEY_45_C
@@ -190,8 +190,11 @@ totext_ipseckey(ARGS_TOTEXT) {
 	 */
 	if (region.length > 0U) {
 		RETERR(str_totext(tctx->linebreak, target));
-		RETERR(isc_base64_totext(&region, tctx->width - 2,
-					 tctx->linebreak, target));
+		if (tctx->width == 0)   /* No splitting */
+			RETERR(isc_base64_totext(&region, 60, "", target));
+		else
+			RETERR(isc_base64_totext(&region, tctx->width - 2,
+						 tctx->linebreak, target));
 	}
 
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
diff --git a/lib/dns/rdata/generic/key_25.c b/lib/dns/rdata/generic/key_25.c
index 6fe27cbb..7d00bed8 100644
--- a/lib/dns/rdata/generic/key_25.c
+++ b/lib/dns/rdata/generic/key_25.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: key_25.c,v 1.53 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: key_25.c,v 1.55 2011-03-05 23:52:31 tbox Exp $ */
 
 /*
  * Reviewed: Wed Mar 15 16:47:10 PST 2000 by halley.
@@ -106,7 +106,7 @@ totext_key(ARGS_TOTEXT) {
 	if ((flags & 0xc000) == 0xc000)
 		return (ISC_R_SUCCESS);
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0 &&
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0 &&
 	     algorithm == DNS_KEYALG_PRIVATEDNS) {
 		dns_name_t name;
 		dns_name_init(&name, NULL);
@@ -119,10 +119,13 @@ totext_key(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&sr, tctx->width - 2,
-				 tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&sr, tctx->width - 2,
+					 tctx->linebreak, target));
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
 		RETERR(str_totext(tctx->linebreak, target));
 	else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" ", target));
@@ -130,7 +133,7 @@ totext_key(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(")", target));
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
 		isc_region_t tmpr;
 
 		RETERR(str_totext(" ; key id = ", target));
diff --git a/lib/dns/rdata/generic/keydata_65533.c b/lib/dns/rdata/generic/keydata_65533.c
index 3636209d..15fa466b 100644
--- a/lib/dns/rdata/generic/keydata_65533.c
+++ b/lib/dns/rdata/generic/keydata_65533.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: keydata_65533.c,v 1.3 2009-12-04 21:09:33 marka Exp $ */
+/* $Id: keydata_65533.c,v 1.5 2011-03-05 23:52:31 tbox Exp $ */
 
 #ifndef GENERIC_KEYDATA_65533_C
 #define GENERIC_KEYDATA_65533_C 1
@@ -89,6 +89,8 @@ totext_keydata(ARGS_TOTEXT) {
 	unsigned int flags;
 	unsigned char algorithm;
 	unsigned long when;
+	char algbuf[DNS_NAME_FORMATSIZE];
+	const char *keyinfo;
 
 	REQUIRE(rdata->type == 65533);
 	REQUIRE(rdata->length != 0);
@@ -119,6 +121,13 @@ totext_keydata(ARGS_TOTEXT) {
 	sprintf(buf, "%u", flags);
 	RETERR(str_totext(buf, target));
 	RETERR(str_totext(" ", target));
+	if ((flags & DNS_KEYFLAG_KSK) != 0) {
+		if (flags & DNS_KEYFLAG_REVOKE)
+			keyinfo = "revoked KSK";
+		else
+			keyinfo = "KSK";
+	} else
+		keyinfo = "ZSK";
 
 	/* protocol */
 	sprintf(buf, "%u", sr.base[0]);
@@ -140,10 +149,13 @@ totext_keydata(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&sr, tctx->width - 2,
-				 tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&sr, tctx->width - 2,
+					 tctx->linebreak, target));
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0)
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0)
 		RETERR(str_totext(tctx->linebreak, target));
 	else if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" ", target));
@@ -151,10 +163,16 @@ totext_keydata(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(")", target));
 
-	if ((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0) {
+	if ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0) {
 		isc_region_t tmpr;
 
-		RETERR(str_totext(" ; key id = ", target));
+		RETERR(str_totext(" ; ", target));
+		RETERR(str_totext(keyinfo, target));
+		dns_secalg_format((dns_secalg_t) algorithm, algbuf,
+				  sizeof(algbuf));
+		RETERR(str_totext("; alg = ", target));
+		RETERR(str_totext(algbuf, target));
+		RETERR(str_totext("; key id = ", target));
 		dns_rdata_toregion(rdata, &tmpr);
 		/* Skip over refresh, addhd, and removehd */
 		isc_region_consume(&tmpr, 12);
diff --git a/lib/dns/rdata/in_1/naptr_35.c b/lib/dns/rdata/generic/naptr_35.c
index 3d097570..4628e739 100644
--- a/lib/dns/rdata/in_1/naptr_35.c
+++ b/lib/dns/rdata/generic/naptr_35.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,14 +15,14 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: naptr_35.c,v 1.56 2009-12-04 21:09:34 marka Exp $ */
+/* $Id: naptr_35.c,v 1.2 2011-08-16 23:46:36 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 16:52:50 PST 2000 by bwelling */
 
 /* RFC2915 */
 
-#ifndef RDATA_IN_1_NAPTR_35_C
-#define RDATA_IN_1_NAPTR_35_C
+#ifndef RDATA_GENERIC_NAPTR_35_C
+#define RDATA_GENERIC_NAPTR_35_C
 
 #define RRTYPE_NAPTR_ATTRIBUTES (0)
 #ifdef HAVE_REGEX_H
@@ -148,14 +148,13 @@ txt_valid_regex(const unsigned char *txt) {
 }
 
 static inline isc_result_t
-fromtext_in_naptr(ARGS_FROMTEXT) {
+fromtext_naptr(ARGS_FROMTEXT) {
 	isc_token_t token;
 	dns_name_t name;
 	isc_buffer_t buffer;
 	unsigned char *regex;
 
 	REQUIRE(type == 35);
-	REQUIRE(rdclass == 1);
 
 	UNUSED(type);
 	UNUSED(rdclass);
@@ -215,7 +214,7 @@ fromtext_in_naptr(ARGS_FROMTEXT) {
 }
 
 static inline isc_result_t
-totext_in_naptr(ARGS_TOTEXT) {
+totext_naptr(ARGS_TOTEXT) {
 	isc_region_t region;
 	dns_name_t name;
 	dns_name_t prefix;
@@ -224,7 +223,6 @@ totext_in_naptr(ARGS_TOTEXT) {
 	unsigned short num;
 
 	REQUIRE(rdata->type == 35);
-	REQUIRE(rdata->rdclass == 1);
 	REQUIRE(rdata->length != 0);
 
 	dns_name_init(&name, NULL);
@@ -277,13 +275,12 @@ totext_in_naptr(ARGS_TOTEXT) {
 }
 
 static inline isc_result_t
-fromwire_in_naptr(ARGS_FROMWIRE) {
+fromwire_naptr(ARGS_FROMWIRE) {
 	dns_name_t name;
 	isc_region_t sr;
 	unsigned char *regex;
 
 	REQUIRE(type == 35);
-	REQUIRE(rdclass == 1);
 
 	UNUSED(type);
 	UNUSED(rdclass);
@@ -325,13 +322,12 @@ fromwire_in_naptr(ARGS_FROMWIRE) {
 }
 
 static inline isc_result_t
-towire_in_naptr(ARGS_TOWIRE) {
+towire_naptr(ARGS_TOWIRE) {
 	dns_name_t name;
 	dns_offsets_t offsets;
 	isc_region_t sr;
 
 	REQUIRE(rdata->type == 35);
-	REQUIRE(rdata->rdclass == 1);
 	REQUIRE(rdata->length != 0);
 
 	dns_compress_setmethods(cctx, DNS_COMPRESS_NONE);
@@ -369,7 +365,7 @@ towire_in_naptr(ARGS_TOWIRE) {
 }
 
 static inline int
-compare_in_naptr(ARGS_COMPARE) {
+compare_naptr(ARGS_COMPARE) {
 	dns_name_t name1;
 	dns_name_t name2;
 	isc_region_t region1;
@@ -379,7 +375,6 @@ compare_in_naptr(ARGS_COMPARE) {
 	REQUIRE(rdata1->type == rdata2->type);
 	REQUIRE(rdata1->rdclass == rdata2->rdclass);
 	REQUIRE(rdata1->type == 35);
-	REQUIRE(rdata1->rdclass == 1);
 	REQUIRE(rdata1->length != 0);
 	REQUIRE(rdata2->length != 0);
 
@@ -438,12 +433,11 @@ compare_in_naptr(ARGS_COMPARE) {
 }
 
 static inline isc_result_t
-fromstruct_in_naptr(ARGS_FROMSTRUCT) {
-	dns_rdata_in_naptr_t *naptr = source;
+fromstruct_naptr(ARGS_FROMSTRUCT) {
+	dns_rdata_naptr_t *naptr = source;
 	isc_region_t region;
 
 	REQUIRE(type == 35);
-	REQUIRE(rdclass == 1);
 	REQUIRE(source != NULL);
 	REQUIRE(naptr->common.rdtype == type);
 	REQUIRE(naptr->common.rdclass == rdclass);
@@ -467,14 +461,13 @@ fromstruct_in_naptr(ARGS_FROMSTRUCT) {
 }
 
 static inline isc_result_t
-tostruct_in_naptr(ARGS_TOSTRUCT) {
-	dns_rdata_in_naptr_t *naptr = target;
+tostruct_naptr(ARGS_TOSTRUCT) {
+	dns_rdata_naptr_t *naptr = target;
 	isc_region_t r;
 	isc_result_t result;
 	dns_name_t name;
 
 	REQUIRE(rdata->type == 35);
-	REQUIRE(rdata->rdclass == 1);
 	REQUIRE(target != NULL);
 	REQUIRE(rdata->length != 0);
 
@@ -538,11 +531,10 @@ tostruct_in_naptr(ARGS_TOSTRUCT) {
 }
 
 static inline void
-freestruct_in_naptr(ARGS_FREESTRUCT) {
-	dns_rdata_in_naptr_t *naptr = source;
+freestruct_naptr(ARGS_FREESTRUCT) {
+	dns_rdata_naptr_t *naptr = source;
 
 	REQUIRE(source != NULL);
-	REQUIRE(naptr->common.rdclass == 1);
 	REQUIRE(naptr->common.rdtype == 35);
 
 	if (naptr->mctx == NULL)
@@ -559,7 +551,7 @@ freestruct_in_naptr(ARGS_FREESTRUCT) {
 }
 
 static inline isc_result_t
-additionaldata_in_naptr(ARGS_ADDLDATA) {
+additionaldata_naptr(ARGS_ADDLDATA) {
 	dns_name_t name;
 	dns_offsets_t offsets;
 	isc_region_t sr;
@@ -568,7 +560,6 @@ additionaldata_in_naptr(ARGS_ADDLDATA) {
 	char *cp;
 
 	REQUIRE(rdata->type == 35);
-	REQUIRE(rdata->rdclass == 1);
 
 	/*
 	 * Order, preference.
@@ -617,14 +608,13 @@ additionaldata_in_naptr(ARGS_ADDLDATA) {
 }
 
 static inline isc_result_t
-digest_in_naptr(ARGS_DIGEST) {
+digest_naptr(ARGS_DIGEST) {
 	isc_region_t r1, r2;
 	unsigned int length, n;
 	isc_result_t result;
 	dns_name_t name;
 
 	REQUIRE(rdata->type == 35);
-	REQUIRE(rdata->rdclass == 1);
 
 	dns_rdata_toregion(rdata, &r1);
 	r2 = r1;
@@ -676,10 +666,9 @@ digest_in_naptr(ARGS_DIGEST) {
 }
 
 static inline isc_boolean_t
-checkowner_in_naptr(ARGS_CHECKOWNER) {
+checkowner_naptr(ARGS_CHECKOWNER) {
 
 	REQUIRE(type == 35);
-	REQUIRE(rdclass == 1);
 
 	UNUSED(name);
 	UNUSED(type);
@@ -690,10 +679,9 @@ checkowner_in_naptr(ARGS_CHECKOWNER) {
 }
 
 static inline isc_boolean_t
-checknames_in_naptr(ARGS_CHECKNAMES) {
+checknames_naptr(ARGS_CHECKNAMES) {
 
 	REQUIRE(rdata->type == 35);
-	REQUIRE(rdata->rdclass == 1);
 
 	UNUSED(rdata);
 	UNUSED(owner);
@@ -703,8 +691,8 @@ checknames_in_naptr(ARGS_CHECKNAMES) {
 }
 
 static inline int
-casecompare_in_naptr(ARGS_COMPARE) {
-	return (compare_in_naptr(rdata1, rdata2));
+casecompare_naptr(ARGS_COMPARE) {
+	return (compare_naptr(rdata1, rdata2));
 }
 
-#endif	/* RDATA_IN_1_NAPTR_35_C */
+#endif	/* RDATA_GENERIC_NAPTR_35_C */
diff --git a/lib/dns/rdata/in_1/naptr_35.h b/lib/dns/rdata/generic/naptr_35.h
index 03acbdd3..d48c8c08 100644
--- a/lib/dns/rdata/in_1/naptr_35.h
+++ b/lib/dns/rdata/generic/naptr_35.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,15 +15,15 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-#ifndef IN_1_NAPTR_35_H
-#define IN_1_NAPTR_35_H 1
+#ifndef GENERIC_NAPTR_35_H
+#define GENERIC_NAPTR_35_H 1
 
-/* $Id: naptr_35.h,v 1.23 2007-06-19 23:47:17 tbox Exp $ */
+/* $Id: naptr_35.h,v 1.2 2011-08-16 23:46:36 tbox Exp $ */
 
-/*! 
+/*!
  *  \brief Per RFC2915 */
 
-typedef struct dns_rdata_in_naptr {
+typedef struct dns_rdata_naptr {
 	dns_rdatacommon_t	common;
 	isc_mem_t		*mctx;
 	isc_uint16_t		order;
@@ -35,6 +35,6 @@ typedef struct dns_rdata_in_naptr {
 	char			*regexp;
 	isc_uint8_t		regexp_len;
 	dns_name_t		replacement;
-} dns_rdata_in_naptr_t;
+} dns_rdata_naptr_t;
 
-#endif /* IN_1_NAPTR_35_H */
+#endif /* GENERIC_NAPTR_35_H */
diff --git a/lib/dns/rdata/generic/nsec3_50.c b/lib/dns/rdata/generic/nsec3_50.c
index d21b009f..36ef3772 100644
--- a/lib/dns/rdata/generic/nsec3_50.c
+++ b/lib/dns/rdata/generic/nsec3_50.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsec3_50.c,v 1.7 2009-12-04 21:09:34 marka Exp $ */
+/* $Id: nsec3_50.c,v 1.10 2011-03-07 13:42:11 marka Exp $ */
 
 /*
  * Copyright (C) 2004  Nominet, Ltd.
@@ -142,32 +142,32 @@ totext_nsec3(ARGS_TOTEXT) {
 	unsigned char flags;
 	char buf[sizeof("65535 ")];
 	isc_uint32_t iterations;
+	isc_boolean_t first;
 
 	REQUIRE(rdata->type == 50);
 	REQUIRE(rdata->length != 0);
 
-	UNUSED(tctx);
-
 	dns_rdata_toregion(rdata, &sr);
 
+	/* Hash */
 	hash = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
-
-	flags = uint8_fromregion(&sr);
-	isc_region_consume(&sr, 1);
-
-	iterations = uint16_fromregion(&sr);
-	isc_region_consume(&sr, 2);
-
 	sprintf(buf, "%u ", hash);
 	RETERR(str_totext(buf, target));
 
+	/* Flags */
+	flags = uint8_fromregion(&sr);
+	isc_region_consume(&sr, 1);
 	sprintf(buf, "%u ", flags);
 	RETERR(str_totext(buf, target));
 
+	/* Iterations */
+	iterations = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
 	sprintf(buf, "%u ", iterations);
 	RETERR(str_totext(buf, target));
 
+	/* Salt */
 	j = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 	INSIST(j <= sr.length);
@@ -177,10 +177,14 @@ totext_nsec3(ARGS_TOTEXT) {
 		sr.length = j;
 		RETERR(isc_hex_totext(&sr, 1, "", target));
 		sr.length = i - j;
-		RETERR(str_totext(" ", target));
 	} else
-		RETERR(str_totext("- ", target));
+		RETERR(str_totext("-", target));
+
+	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+		RETERR(str_totext(" (", target));
+	RETERR(str_totext(tctx->linebreak, target));
 
+	/* Next hash */
 	j = uint8_fromregion(&sr);
 	isc_region_consume(&sr, 1);
 	INSIST(j <= sr.length);
@@ -190,7 +194,16 @@ totext_nsec3(ARGS_TOTEXT) {
 	RETERR(isc_base32hex_totext(&sr, 1, "", target));
 	sr.length = i - j;
 
+	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+		RETERR(str_totext(tctx->linebreak, target));
+	else
+		RETERR(str_totext(" ", target));
+
+	/* Types covered */
+	first = ISC_TRUE;
 	for (i = 0; i < sr.length; i += len) {
+		if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+			first = ISC_TRUE;
 		INSIST(i + 2 <= sr.length);
 		window = sr.base[i];
 		len = sr.base[i + 1];
@@ -205,7 +218,9 @@ totext_nsec3(ARGS_TOTEXT) {
 				if ((sr.base[i + j] & (0x80 >> k)) == 0)
 					continue;
 				t = window * 256 + j * 8 + k;
-				RETERR(str_totext(" ", target));
+				if (!first)
+					RETERR(str_totext(" ", target));
+				first = ISC_FALSE;
 				if (dns_rdatatype_isknown(t)) {
 					RETERR(dns_rdatatype_totext(t, target));
 				} else {
@@ -216,6 +231,10 @@ totext_nsec3(ARGS_TOTEXT) {
 			}
 		}
 	}
+
+	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+		RETERR(str_totext(" )", target));
+
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/rdata/generic/nsec3_50.h b/lib/dns/rdata/generic/nsec3_50.h
index 06274a7a..f3ab6895 100644
--- a/lib/dns/rdata/generic/nsec3_50.h
+++ b/lib/dns/rdata/generic/nsec3_50.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008, 2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -18,7 +18,7 @@
 #ifndef GENERIC_NSEC3_50_H
 #define GENERIC_NSEC3_50_H 1
 
-/* $Id: nsec3_50.h,v 1.4 2008-09-25 04:02:39 tbox Exp $ */
+/* $Id: nsec3_50.h,v 1.6 2011-06-10 23:47:32 tbox Exp $ */
 
 /*!
  * \brief Per RFC 5155 */
@@ -46,7 +46,16 @@ typedef struct dns_rdata_nsec3 {
 #define DNS_NSEC3FLAG_OPTOUT 0x01U
 
 /*%
- * Non-standard, NSEC3PARAM only.
+ * The following flags are used in the private-type record (implemented in
+ * lib/dns/private.c) which is used to store NSEC3PARAM data during the
+ * time when it is not legal to have an actual NSEC3PARAM record in the
+ * zone.  They are defined here because the private-type record uses the
+ * same flags field for the OPTOUT flag above and for the private flags
+ * below.  XXX: This should be considered for refactoring.
+ */
+
+/*%
+ * Non-standard, private type only.
  *
  * Create a corresponding NSEC3 chain.
  * Once the NSEC3 chain is complete this flag will be removed to signal
@@ -55,13 +64,14 @@ typedef struct dns_rdata_nsec3 {
  * This flag is automatically set when a NSEC3PARAM record is added to
  * the zone via UPDATE.
  *
- * NSEC3PARAM records with this flag set are supposed to be ignored by
- * RFC 5155 compliant nameservers.
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
  */
 #define DNS_NSEC3FLAG_CREATE 0x80U
 
 /*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
  *
  * The corresponding NSEC3 set is to be removed once the NSEC chain
  * has been generated.
@@ -69,24 +79,39 @@ typedef struct dns_rdata_nsec3 {
  * This flag is automatically set when the last active NSEC3PARAM record
  * is removed from the zone via UPDATE.
  *
- * NSEC3PARAM records with this flag set are supposed to be ignored by
- * RFC 5155 compliant nameservers.
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
  */
 #define DNS_NSEC3FLAG_REMOVE 0x40U
 
 /*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
  *
- * Used to identify NSEC3PARAM records added in this UPDATE request.
+ * When set with the CREATE flag, a corresponding NSEC3 chain will be
+ * created when the zone becomes capable of supporting one (i.e., when it
+ * has a DNSKEY RRset containing at least one NSEC3-capable algorithm).
+ * Without this flag, NSEC3 chain creation would be attempted immediately,
+ * fail, and the private type record would be removed.  With it, the NSEC3
+ * parameters are stored until they can be used.  When the zone has the
+ * necessary prerequisites for NSEC3, then the INITIAL flag can be cleared,
+ * and the record will be cleaned up normally.
+ *
+ * NSEC3PARAM records containing this flag should never be published, but
+ * if they are, they should be ignored by RFC 5155 compliant nameservers.
  */
-#define DNS_NSEC3FLAG_UPDATE 0x20U
+#define DNS_NSEC3FLAG_INITIAL 0x20U
 
 /*%
- * Non-standard, NSEC3PARAM only.
+ * Non-standard, private type only.
  *
  * Prevent the creation of a NSEC chain before the last NSEC3 chain
  * is removed.  This will normally only be set when the zone is
  * transitioning from secure with NSEC3 chains to insecure.
+ *
+ * NSEC3PARAM records containing this flag should never be published,
+ * but if they are, they should be ignored by RFC 5155 compliant
+ * nameservers.
  */
 #define DNS_NSEC3FLAG_NONSEC 0x10U
 
diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c
index 695057dc..9624668f 100644
--- a/lib/dns/rdata/generic/opt_41.c
+++ b/lib/dns/rdata/generic/opt_41.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: opt_41.c,v 1.35 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: opt_41.c,v 1.37 2011-03-05 23:52:31 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 14:06:44 PST 2000 by gson */
 
@@ -76,8 +76,12 @@ totext_opt(ARGS_TOTEXT) {
 			RETERR(str_totext(tctx->linebreak, target));
 			or = r;
 			or.length = length;
-			RETERR(isc_base64_totext(&or, tctx->width - 2,
-						 tctx->linebreak, target));
+			if (tctx->width == 0)   /* No splitting */
+				RETERR(isc_base64_totext(&or, 60, "", target));
+			else
+				RETERR(isc_base64_totext(&or, tctx->width - 2,
+							 tctx->linebreak,
+							 target));
 			isc_region_consume(&r, length);
 			if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 				RETERR(str_totext(" )", target));
diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c
index 1fa7d07b..65ce38b2 100644
--- a/lib/dns/rdata/generic/rrsig_46.c
+++ b/lib/dns/rdata/generic/rrsig_46.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rrsig_46.c,v 1.14 2011-01-13 04:59:26 tbox Exp $ */
+/* $Id: rrsig_46.c,v 1.15 2011-03-05 19:39:07 each Exp $ */
 
 /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
 
@@ -181,7 +181,10 @@ totext_rrsig(ARGS_TOTEXT) {
 	isc_region_consume(&sr, 4);
 	sprintf(buf, "%lu", ttl);
 	RETERR(str_totext(buf, target));
-	RETERR(str_totext(" ", target));
+
+	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
+		RETERR(str_totext(" (", target));
+	RETERR(str_totext(tctx->linebreak, target));
 
 	/*
 	 * Sig exp.
@@ -189,10 +192,7 @@ totext_rrsig(ARGS_TOTEXT) {
 	exp = uint32_fromregion(&sr);
 	isc_region_consume(&sr, 4);
 	RETERR(dns_time32_totext(exp, target));
-
-	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
-		RETERR(str_totext(" (", target));
-	RETERR(str_totext(tctx->linebreak, target));
+	RETERR(str_totext(" ", target));
 
 	/*
 	 * Time signed.
@@ -223,8 +223,11 @@ totext_rrsig(ARGS_TOTEXT) {
 	 * Sig.
 	 */
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&sr, tctx->width - 2,
-				    tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&sr, tctx->width - 2,
+					 tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" )", target));
 
diff --git a/lib/dns/rdata/generic/sig_24.c b/lib/dns/rdata/generic/sig_24.c
index 63663095..e27911c7 100644
--- a/lib/dns/rdata/generic/sig_24.c
+++ b/lib/dns/rdata/generic/sig_24.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sig_24.c,v 1.68 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: sig_24.c,v 1.70 2011-03-05 23:52:31 tbox Exp $ */
 
 /* Reviewed: Fri Mar 17 09:05:02 PST 2000 by gson */
 
@@ -227,8 +227,11 @@ totext_sig(ARGS_TOTEXT) {
 	 * Sig.
 	 */
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&sr, tctx->width - 2,
-				    tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&sr, tctx->width - 2,
+					 tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" )", target));
 
diff --git a/lib/dns/rdata/generic/soa_6.c b/lib/dns/rdata/generic/soa_6.c
index 34361a8e..890e76bb 100644
--- a/lib/dns/rdata/generic/soa_6.c
+++ b/lib/dns/rdata/generic/soa_6.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: soa_6.c,v 1.64 2009-12-04 21:09:34 marka Exp $ */
+/* $Id: soa_6.c,v 1.66 2011-03-05 23:52:31 tbox Exp $ */
 
 /* Reviewed: Thu Mar 16 15:18:32 PST 2000 by explorer */
 
@@ -102,7 +102,7 @@ totext_soa(ARGS_TOTEXT) {
 
 	multiline = ISC_TF((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0);
 	if (multiline)
-		comment = ISC_TF((tctx->flags & DNS_STYLEFLAG_COMMENT) != 0);
+		comment = ISC_TF((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0);
 	else
 		comment = ISC_FALSE;
 
diff --git a/lib/dns/rdata/generic/sshfp_44.c b/lib/dns/rdata/generic/sshfp_44.c
index 7b344517..77249b0b 100644
--- a/lib/dns/rdata/generic/sshfp_44.c
+++ b/lib/dns/rdata/generic/sshfp_44.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2006, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sshfp_44.c,v 1.9 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: sshfp_44.c,v 1.11 2011-03-05 23:52:31 tbox Exp $ */
 
 /* RFC 4255 */
 
@@ -96,7 +96,11 @@ totext_sshfp(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_hex_totext(&sr, tctx->width - 2, tctx->linebreak, target));
+	if (tctx->width == 0) /* No splitting */
+		RETERR(isc_hex_totext(&sr, 0, "", target));
+	else
+		RETERR(isc_hex_totext(&sr, tctx->width - 2,
+				      tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" )", target));
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/rdata/generic/tkey_249.c b/lib/dns/rdata/generic/tkey_249.c
index 64acc0ff..6594c9ce 100644
--- a/lib/dns/rdata/generic/tkey_249.c
+++ b/lib/dns/rdata/generic/tkey_249.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: tkey_249.c,v 1.59 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: tkey_249.c,v 1.61 2011-03-05 23:52:31 tbox Exp $ */
 
 /*
  * Reviewed: Thu Mar 16 17:35:30 PST 2000 by halley.
@@ -201,8 +201,11 @@ totext_tkey(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" (", target));
 	RETERR(str_totext(tctx->linebreak, target));
-	RETERR(isc_base64_totext(&dr, tctx->width - 2,
-				 tctx->linebreak, target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&dr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&dr, tctx->width - 2,
+					 tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext(" ) ", target));
 	else
@@ -227,8 +230,11 @@ totext_tkey(ARGS_TOTEXT) {
 	    if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		    RETERR(str_totext(" (", target));
 	    RETERR(str_totext(tctx->linebreak, target));
-	    RETERR(isc_base64_totext(&dr, tctx->width - 2,
-				     tctx->linebreak, target));
+		if (tctx->width == 0)   /* No splitting */
+			RETERR(isc_base64_totext(&dr, 60, "", target));
+		else
+			RETERR(isc_base64_totext(&dr, tctx->width - 2,
+						 tctx->linebreak, target));
 	    if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		    RETERR(str_totext(" )", target));
 	}
diff --git a/lib/dns/rdata/generic/uri_256.c b/lib/dns/rdata/generic/uri_256.c
new file mode 100644
index 00000000..5140dbc6
--- /dev/null
+++ b/lib/dns/rdata/generic/uri_256.c
@@ -0,0 +1,331 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: uri_256.c,v 1.2 2011-03-03 14:10:27 fdupont Exp $ */
+
+#ifndef GENERIC_URI_256_C
+#define GENERIC_URI_256_C 1
+
+#define RRTYPE_URI_ATTRIBUTES (0)
+
+static inline isc_result_t
+fromtext_uri(ARGS_FROMTEXT) {
+	isc_token_t token;
+
+	REQUIRE(type == 256);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(origin);
+	UNUSED(options);
+	UNUSED(callbacks);
+
+	/*
+	 * Priority
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      ISC_FALSE));
+	if (token.value.as_ulong > 0xffffU)
+		RETTOK(ISC_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/*
+	 * Weight
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_number,
+				      ISC_FALSE));
+	if (token.value.as_ulong > 0xffffU)
+		RETTOK(ISC_R_RANGE);
+	RETERR(uint16_tobuffer(token.value.as_ulong, target));
+
+	/*
+	 * Target URI
+	 */
+	RETERR(isc_lex_getmastertoken(lexer, &token,
+				      isc_tokentype_qstring, ISC_FALSE));
+	if (token.type != isc_tokentype_qstring)
+		RETTOK(DNS_R_SYNTAX);
+	RETTOK(multitxt_fromtext(&token.value.as_textregion, target));
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+totext_uri(ARGS_TOTEXT) {
+	isc_region_t region;
+	unsigned short priority, weight;
+	char buf[sizeof("65000 ")];
+
+	UNUSED(tctx);
+
+	REQUIRE(rdata->type == 256);
+	REQUIRE(rdata->length != 0);
+
+	dns_rdata_toregion(rdata, &region);
+
+	/*
+	 * Priority
+	 */
+	priority = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	sprintf(buf, "%u ", priority);
+	RETERR(str_totext(buf, target));
+
+	/*
+	 * Weight
+	 */
+	weight = uint16_fromregion(&region);
+	isc_region_consume(&region, 2);
+	sprintf(buf, "%u ", weight);
+	RETERR(str_totext(buf, target));
+
+	/*
+	 * Target URI
+	 */
+	RETERR(multitxt_totext(&region, target));
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+fromwire_uri(ARGS_FROMWIRE) {
+	isc_region_t region;
+
+	REQUIRE(type == 256);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(dctx);
+	UNUSED(options);
+
+	/*
+	 * Priority, weight
+	 */
+	isc_buffer_activeregion(source, &region);
+	if (region.length < 4)
+		return (ISC_R_UNEXPECTEDEND);
+	RETERR(mem_tobuffer(target, region.base, 4));
+	isc_buffer_forward(source, 4);
+
+	/*
+	 * Target URI
+	 */
+	RETERR(multitxt_fromwire(source, target));
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+towire_uri(ARGS_TOWIRE) {
+	isc_region_t region;
+
+	REQUIRE(rdata->type == 256);
+	REQUIRE(rdata->length != 0);
+
+	UNUSED(cctx);
+
+	dns_rdata_toregion(rdata, &region);
+	return (mem_tobuffer(target, region.base, region.length));
+}
+
+static inline int
+compare_uri(ARGS_COMPARE) {
+	isc_region_t r1;
+	isc_region_t r2;
+	int order;
+
+	REQUIRE(rdata1->type == rdata2->type);
+	REQUIRE(rdata1->rdclass == rdata2->rdclass);
+	REQUIRE(rdata1->type == 256);
+	REQUIRE(rdata1->length != 0);
+	REQUIRE(rdata2->length != 0);
+
+	dns_rdata_toregion(rdata1, &r1);
+	dns_rdata_toregion(rdata2, &r2);
+
+	/*
+	 * Priority
+	 */
+	order = memcmp(r1.base, r2.base, 2);
+	if (order != 0)
+		return (order < 0 ? -1 : 1);
+	isc_region_consume(&r1, 2);
+	isc_region_consume(&r2, 2);
+
+	/*
+	 * Weight
+	 */
+	order = memcmp(r1.base, r2.base, 2);
+	if (order != 0)
+		return (order < 0 ? -1 : 1);
+	isc_region_consume(&r1, 2);
+	isc_region_consume(&r2, 2);
+
+	return (isc_region_compare(&r1, &r2));
+}
+
+static inline isc_result_t
+fromstruct_uri(ARGS_FROMSTRUCT) {
+	dns_rdata_uri_t *uri = source;
+	isc_region_t region;
+	isc_uint8_t len;
+
+	REQUIRE(type == 256);
+	REQUIRE(source != NULL);
+	REQUIRE(uri->common.rdtype == type);
+	REQUIRE(uri->common.rdclass == rdclass);
+	REQUIRE(uri->target != NULL && uri->tgt_len != 0);
+
+	UNUSED(type);
+	UNUSED(rdclass);
+
+	/*
+	 * Priority
+	 */
+	RETERR(uint16_tobuffer(uri->priority, target));
+
+	/*
+	 * Weight
+	 */
+	RETERR(uint16_tobuffer(uri->weight, target));
+
+	/*
+	 * Target URI
+	 */
+	len = 255U;
+	region.base = uri->target;
+	region.length = uri->tgt_len;
+	while (region.length > 0) {
+		REQUIRE(len == 255U);
+		len = uint8_fromregion(&region);
+		isc_region_consume(&region, 1);
+		if (region.length < len)
+			return (ISC_R_UNEXPECTEDEND);
+		isc_region_consume(&region, len);
+	}
+
+	return (mem_tobuffer(target, uri->target, uri->tgt_len));
+}
+
+static inline isc_result_t
+tostruct_uri(ARGS_TOSTRUCT) {
+	dns_rdata_uri_t *uri = target;
+	isc_region_t sr;
+
+	REQUIRE(rdata->type == 256);
+	REQUIRE(target != NULL);
+	REQUIRE(rdata->length != 0);
+
+	uri->common.rdclass = rdata->rdclass;
+	uri->common.rdtype = rdata->type;
+	ISC_LINK_INIT(&uri->common, link);
+
+	dns_rdata_toregion(rdata, &sr);
+
+	/*
+	 * Priority
+	 */
+	if (sr.length < 2)
+		return (ISC_R_UNEXPECTEDEND);
+	uri->priority = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+
+	/*
+	 * Weight
+	 */
+	if (sr.length < 2)
+		return (ISC_R_UNEXPECTEDEND);
+	uri->weight = uint16_fromregion(&sr);
+	isc_region_consume(&sr, 2);
+
+	/*
+	 * Target URI
+	 */
+	uri->tgt_len = sr.length;
+	uri->target = mem_maybedup(mctx, sr.base, sr.length);
+	if (uri->target == NULL)
+		return (ISC_R_NOMEMORY);
+
+	uri->mctx = mctx;
+	return (ISC_R_SUCCESS);
+}
+
+static inline void
+freestruct_uri(ARGS_FREESTRUCT) {
+	dns_rdata_uri_t *uri = (dns_rdata_uri_t *) source;
+
+	REQUIRE(source != NULL);
+	REQUIRE(uri->common.rdtype == 256);
+
+	if (uri->mctx == NULL)
+		return;
+
+	if (uri->target != NULL)
+		isc_mem_free(uri->mctx, uri->target);
+	uri->mctx = NULL;
+}
+
+static inline isc_result_t
+additionaldata_uri(ARGS_ADDLDATA) {
+	REQUIRE(rdata->type == 256);
+
+	UNUSED(rdata);
+	UNUSED(add);
+	UNUSED(arg);
+
+	return (ISC_R_SUCCESS);
+}
+
+static inline isc_result_t
+digest_uri(ARGS_DIGEST) {
+	isc_region_t r;
+
+	REQUIRE(rdata->type == 256);
+
+	dns_rdata_toregion(rdata, &r);
+
+	return ((digest)(arg, &r));
+}
+
+static inline isc_boolean_t
+checkowner_uri(ARGS_CHECKOWNER) {
+
+	REQUIRE(type == 256);
+
+	UNUSED(name);
+	UNUSED(type);
+	UNUSED(rdclass);
+	UNUSED(wildcard);
+
+	return (ISC_TRUE);
+}
+
+static inline isc_boolean_t
+checknames_uri(ARGS_CHECKNAMES) {
+
+	REQUIRE(rdata->type == 256);
+
+	UNUSED(rdata);
+	UNUSED(owner);
+	UNUSED(bad);
+
+	return (ISC_TRUE);
+}
+
+static inline int
+casecompare_uri(ARGS_COMPARE) {
+	return (compare_uri(rdata1, rdata2));
+}
+
+#endif /* GENERIC_URI_256_C */
diff --git a/lib/dns/rdata/generic/uri_256.h b/lib/dns/rdata/generic/uri_256.h
new file mode 100644
index 00000000..099c4d6f
--- /dev/null
+++ b/lib/dns/rdata/generic/uri_256.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef GENERIC_URI_256_H
+#define GENERIC_URI_256_H 1
+
+/* $Id: uri_256.h,v 1.2 2011-03-03 14:10:27 fdupont Exp $ */
+
+typedef struct dns_rdata_uri {
+	dns_rdatacommon_t	common;
+	isc_mem_t *		mctx;
+	isc_uint16_t		priority;
+	isc_uint16_t		weight;
+	unsigned char *		target;
+	isc_uint16_t		tgt_len;
+} dns_rdata_uri_t;
+
+#endif /* GENERIC_URI_256_H */
diff --git a/lib/dns/rdata/in_1/dhcid_49.c b/lib/dns/rdata/in_1/dhcid_49.c
index 9eca46f4..c8f1778f 100644
--- a/lib/dns/rdata/in_1/dhcid_49.c
+++ b/lib/dns/rdata/in_1/dhcid_49.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2006, 2007, 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dhcid_49.c,v 1.7 2009-12-04 22:06:37 tbox Exp $ */
+/* $Id: dhcid_49.c,v 1.9 2011-03-05 23:52:31 tbox Exp $ */
 
 /* RFC 4701 */
 
@@ -52,8 +52,11 @@ totext_in_dhcid(ARGS_TOTEXT) {
 
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0)
 		RETERR(str_totext("( " /*)*/, target));
-	RETERR(isc_base64_totext(&sr, tctx->width - 2, tctx->linebreak,
-				 target));
+	if (tctx->width == 0)   /* No splitting */
+		RETERR(isc_base64_totext(&sr, 60, "", target));
+	else
+		RETERR(isc_base64_totext(&sr, tctx->width - 2,
+					 tctx->linebreak, target));
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
 		RETERR(str_totext(/* ( */ " )", target));
 		if (rdata->length > 2) {
diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
index dcf6b453..c6686af4 100644
--- a/lib/dns/rdatalist.c
+++ b/lib/dns/rdatalist.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdatalist.c,v 1.40.40.2 2011-02-28 01:20:02 tbox Exp $ */
+/* $Id: rdatalist.c,v 1.42 2011-02-21 23:47:45 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c
index 627f20de..93f67f9c 100644
--- a/lib/dns/rdataset.c
+++ b/lib/dns/rdataset.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataset.c,v 1.86.148.4 2011-06-08 23:02:42 each Exp $ */
+/* $Id: rdataset.c,v 1.90 2011-06-08 22:13:50 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index a41f16f7..1b20bd52 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rdataslab.c,v 1.52.148.2 2011-02-28 01:20:02 tbox Exp $ */
+/* $Id: rdataslab.c,v 1.54 2011-02-03 12:18:11 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/request.c b/lib/dns/request.c
index bc378afa..ec850e07 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: request.c,v 1.87.148.2 2011-03-12 04:59:17 tbox Exp $ */
+/* $Id: request.c,v 1.89 2011-03-12 04:59:48 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 717c9321..59cdfd6c 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.428.6.7 2011-06-08 23:02:43 each Exp $ */
+/* $Id: resolver.c,v 1.434 2011-06-08 22:13:50 each Exp $ */
 
 /*! \file */
 
@@ -106,7 +106,7 @@
 #endif
 
 #ifndef DEFAULT_QUERY_TIMEOUT
-#define DEFAULT_QUERY_TIMEOUT 30  /* The default time in seconds for the whole query to live. */
+#define DEFAULT_QUERY_TIMEOUT 10  /* The default time in seconds for the whole query to live. */
 #endif
 
 #ifndef MAXIMUM_QUERY_TIMEOUT
diff --git a/lib/dns/result.c b/lib/dns/result.c
index 4cc194dc..fde94724 100644
--- a/lib/dns/result.c
+++ b/lib/dns/result.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: result.c,v 1.132 2011-01-11 23:47:13 tbox Exp $ */
+/* $Id: result.c,v 1.133 2011-03-21 07:22:13 each Exp $ */
 
 /*! \file */
 
@@ -161,6 +161,7 @@ static const char *text[DNS_R_NRESULTS] = {
 	"not master",			       /*%< 105 DNS_R_NOTMASTER */
 	"broken trust chain",		       /*%< 106 DNS_R_BROKENCHAIN */
 	"expired",			       /*%< 106 DNS_R_EXPIRED */
+	"not dynamic",			       /*%< 107 DNS_R_NOTDYNAMIC */
 };
 
 static const char *rcode_text[DNS_R_NRCODERESULTS] = {
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index f6449911..10e3c1c4 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sdb.c,v 1.76.8.1 2011-03-14 13:40:14 fdupont Exp $ */
+/* $Id: sdb.c,v 1.78 2011-03-14 13:40:52 fdupont Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index ba618721..7706064f 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -50,7 +50,7 @@
  * USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sdlz.c,v 1.31.8.2 2011-03-21 19:53:34 each Exp $ */
+/* $Id: sdlz.c,v 1.33 2011-03-21 19:54:03 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
index 883242d2..f71d6cc6 100644
--- a/lib/dns/spnego.c
+++ b/lib/dns/spnego.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: spnego.c,v 1.16.10.2 2011-04-04 11:10:57 marka Exp $ */
+/* $Id: spnego.c,v 1.18 2011-04-04 11:09:11 marka Exp $ */
 
 /*! \file
  * \brief
diff --git a/lib/dns/ssu_external.c b/lib/dns/ssu_external.c
index 3cb0d3ec..11a4788a 100644
--- a/lib/dns/ssu_external.c
+++ b/lib/dns/ssu_external.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ssu_external.c,v 1.7.8.1 2011-03-21 19:53:34 each Exp $ */
+/* $Id: ssu_external.c,v 1.8 2011-03-21 19:54:03 each Exp $ */
 
 /*
  * This implements external update-policy rules.  This allows permission
diff --git a/lib/dns/tests/Makefile.in b/lib/dns/tests/Makefile.in
index 2ccb6240..0056d9d4 100644
--- a/lib/dns/tests/Makefile.in
+++ b/lib/dns/tests/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.2.2.4 2011-07-08 22:57:25 smann Exp $
+# $Id: Makefile.in,v 1.7 2011-08-23 01:29:38 each Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -37,10 +37,12 @@ DNSDEPLIBS =	../libdns.@A@
 LIBS =		@LIBS@ @ATFLIBS@
 
 OBJS =		dnstest.@O@
-SRCS =		dnstest.c master_test.c time_test.c zonemgr_test.c
+SRCS =		dnstest.c master_test.c time_test.c update_test.c \
+		zonemgr_test.c dbiterator_test.c
 
 SUBDIRS =
-TARGETS =	master_test@EXEEXT@ time_test@EXEEXT@ zonemgr_test@EXEEXT@
+TARGETS =	master_test@EXEEXT@ time_test@EXEEXT@ update_test@EXEEXT@ \
+		zonemgr_test@EXEEXT@ dbiterator_test@EXEEXT@
 
 @BIND9_MAKE_RULES@
 
@@ -54,10 +56,24 @@ time_test@EXEEXT@: time_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 			time_test.@O@ dnstest.@O@ ${DNSLIBS} \
 				${ISCLIBS} ${LIBS}
 
+update_test@EXEEXT@: update_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			update_test.@O@ dnstest.@O@ ${DNSLIBS} \
+				${ISCLIBS} ${LIBS}
+
 zonemgr_test@EXEEXT@: zonemgr_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 			zonemgr_test.@O@ dnstest.@O@ ${DNSLIBS} \
 				${ISCLIBS} ${LIBS}
 
+dbiterator_test@EXEEXT@: dbiterator_test.@O@ dnstest.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			dbiterator_test.@O@ dnstest.@O@ ${DNSLIBS} \
+				${ISCLIBS} ${LIBS}
+
+unit::
+	sh ${top_srcdir}/unit/unittest.sh
+
 clean distclean::
 	rm -f ${TARGETS}
+	rm -f atf.out
diff --git a/lib/dns/tests/dbiterator_test.c b/lib/dns/tests/dbiterator_test.c
new file mode 100644
index 00000000..b8787a9e
--- /dev/null
+++ b/lib/dns/tests/dbiterator_test.c
@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: dbiterator_test.c,v 1.4 2011-08-23 23:54:00 tbox Exp $ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <atf-c.h>
+
+#include <unistd.h>
+#include <stdlib.h>
+
+#include <dns/db.h>
+#include <dns/dbiterator.h>
+#include <dns/name.h>
+
+#include "dnstest.h"
+
+/*
+ * Helper functions
+ */
+
+#define	BUFLEN		255
+#define	BIGBUFLEN	(64 * 1024)
+#define TEST_ORIGIN	"test"
+
+static isc_result_t
+setup_db(const char *testfile, dns_dbtype_t dbtype, dns_db_t **db) {
+	isc_result_t		result;
+	int			len;
+	char			origin[sizeof(TEST_ORIGIN)];
+	dns_name_t		dns_origin;
+	isc_buffer_t		source;
+	isc_buffer_t		target;
+	unsigned char		name_buf[BUFLEN];
+
+	strcpy(origin, TEST_ORIGIN);
+	len = strlen(origin);
+	isc_buffer_init(&source, origin, len);
+	isc_buffer_add(&source, len);
+	isc_buffer_setactive(&source, len);
+	isc_buffer_init(&target, name_buf, BUFLEN);
+	dns_name_init(&dns_origin, NULL);
+
+	result = dns_name_fromtext(&dns_origin, &source, dns_rootname,
+				   0, &target);
+	if (result != ISC_R_SUCCESS)
+		return(result);
+
+	result = dns_db_create(mctx, "rbt", &dns_origin, dbtype,
+			       dns_rdataclass_in, 0, NULL, db);
+	if (result != ISC_R_SUCCESS)
+		return (result);
+
+	/*
+	 * atf-run changes us to a /tmp directory, so tests
+	 * that access test data files must first chdir to the proper
+	 * location.
+	 */
+	if (chdir(TESTS) == -1)
+		return (ISC_R_FAILURE);
+
+	result = dns_db_load(*db, testfile);
+	return (result);
+}
+
+static isc_result_t
+make_name(const char *src, dns_name_t *name) {
+	isc_buffer_t b;
+	isc_buffer_init(&b, src, strlen(src));
+	isc_buffer_add(&b, strlen(src));
+	return (dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
+}
+
+/*
+ * Individual unit tests
+ */
+
+/* create: make sure we can create a dbiterator */
+static void
+test_create(const atf_tc_t *tc) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = setup_db(atf_tc_get_md_var(tc, "X-filename"),
+			  dns_dbtype_cache, &db);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+	dns_test_end();
+}
+
+ATF_TC(create);
+ATF_TC_HEAD(create, tc) {
+	atf_tc_set_md_var(tc, "descr", "create a database iterator");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone1.data");
+}
+ATF_TC_BODY(create, tc) {
+	test_create(tc);
+}
+
+ATF_TC(create_nsec3);
+ATF_TC_HEAD(create_nsec3, tc) {
+	atf_tc_set_md_var(tc, "descr", "create a database iterator (NSEC3)");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone2.data");
+}
+ATF_TC_BODY(create_nsec3, tc) {
+	test_create(tc);
+}
+
+/* walk: walk a database */
+static void
+test_walk(const atf_tc_t *tc) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_name_t *name;
+	dns_fixedname_t f;
+	int i = 0;
+
+	UNUSED(tc);
+
+	dns_fixedname_init(&f);
+	name = dns_fixedname_name(&f);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = setup_db(atf_tc_get_md_var(tc, "X-filename"),
+			  dns_dbtype_cache, &db);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	for (result = dns_dbiterator_first(iter);
+	     result == ISC_R_SUCCESS;
+	     result = dns_dbiterator_next(iter)) {
+		result = dns_dbiterator_current(iter, &node, name);
+		dns_db_detachnode(db, &node);
+		i++;
+	}
+
+	ATF_CHECK_EQ(i, atoi(atf_tc_get_md_var(tc, "X-nodes")));
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+	dns_test_end();
+}
+
+ATF_TC(walk);
+ATF_TC_HEAD(walk, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone1.data");
+	atf_tc_set_md_var(tc, "X-nodes", "12");
+}
+ATF_TC_BODY(walk, tc) {
+	test_walk(tc);
+}
+
+ATF_TC(walk_nsec3);
+ATF_TC_HEAD(walk_nsec3, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone2.data");
+	atf_tc_set_md_var(tc, "X-nodes", "33");
+}
+ATF_TC_BODY(walk_nsec3, tc) {
+	test_walk(tc);
+}
+
+/* reverse: walk database backwards */
+static void test_reverse(const atf_tc_t *tc) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_name_t *name;
+	dns_fixedname_t f;
+	int i = 0;
+
+	UNUSED(tc);
+
+	dns_fixedname_init(&f);
+	name = dns_fixedname_name(&f);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = setup_db(atf_tc_get_md_var(tc, "X-filename"),
+			  dns_dbtype_cache, &db);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	for (result = dns_dbiterator_last(iter);
+	     result == ISC_R_SUCCESS;
+	     result = dns_dbiterator_prev(iter)) {
+		result = dns_dbiterator_current(iter, &node, name);
+		dns_db_detachnode(db, &node);
+		i++;
+	}
+
+	ATF_CHECK_EQ(i, 12);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+	dns_test_end();
+}
+
+ATF_TC(reverse);
+ATF_TC_HEAD(reverse, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database backwards");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone1.data");
+}
+ATF_TC_BODY(reverse, tc) {
+	test_reverse(tc);
+}
+
+ATF_TC(reverse_nsec3);
+ATF_TC_HEAD(reverse_nsec3, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database backwards");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone2.data");
+}
+ATF_TC_BODY(reverse_nsec3, tc) {
+	test_reverse(tc);
+}
+
+/* seek: walk database starting at a particular node */
+static void test_seek(const atf_tc_t *tc) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_name_t *name, *seekname;
+	dns_fixedname_t f1, f2;
+	int i = 0;
+
+	UNUSED(tc);
+
+	dns_fixedname_init(&f1);
+	name = dns_fixedname_name(&f1);
+	dns_fixedname_init(&f2);
+	seekname = dns_fixedname_name(&f2);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = setup_db(atf_tc_get_md_var(tc, "X-filename"),
+			  dns_dbtype_cache, &db);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = make_name("c." TEST_ORIGIN, seekname);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_dbiterator_seek(iter, seekname);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+
+	while (result == ISC_R_SUCCESS) {
+		result = dns_dbiterator_current(iter, &node, name);
+		dns_db_detachnode(db, &node);
+		result = dns_dbiterator_next(iter);
+		i++;
+	}
+
+	ATF_CHECK_EQ(i, atoi(atf_tc_get_md_var(tc, "X-nodes")));
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+	dns_test_end();
+}
+
+ATF_TC(seek);
+ATF_TC_HEAD(seek, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database starting at "
+				       "a particular node");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone1.data");
+	atf_tc_set_md_var(tc, "X-nodes", "9");
+}
+ATF_TC_BODY(seek, tc) {
+	test_seek(tc);
+}
+
+ATF_TC(seek_nsec3);
+ATF_TC_HEAD(seek_nsec3, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database starting at "
+				       "a particular node");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone2.data");
+	atf_tc_set_md_var(tc, "X-nodes", "30");
+}
+ATF_TC_BODY(seek_nsec3, tc) {
+	test_seek(tc);
+}
+
+/*
+ * seek_emty: walk database starting at an empty nonterminal node
+ * (should fail)
+ */
+static void test_seek_empty(const atf_tc_t *tc) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_name_t *seekname;
+	dns_fixedname_t f1;
+
+	UNUSED(tc);
+
+	dns_fixedname_init(&f1);
+	seekname = dns_fixedname_name(&f1);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = setup_db(atf_tc_get_md_var(tc, "X-filename"),
+			  dns_dbtype_cache, &db);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = make_name("d." TEST_ORIGIN, seekname);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_dbiterator_seek(iter, seekname);
+	ATF_CHECK_EQ(result, ISC_R_NOTFOUND);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+	dns_test_end();
+}
+
+ATF_TC(seek_empty);
+ATF_TC_HEAD(seek_empty, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database starting at an "
+				       "empty nonterminal node");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone1.data");
+}
+ATF_TC_BODY(seek_empty, tc) {
+	test_seek_empty(tc);
+}
+
+ATF_TC(seek_empty_nsec3);
+ATF_TC_HEAD(seek_empty_nsec3, tc) {
+	atf_tc_set_md_var(tc, "descr", "walk database starting at an "
+				       "empty nonterminal node");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone2.data");
+}
+ATF_TC_BODY(seek_empty_nsec3, tc) {
+	test_seek_empty(tc);
+}
+
+/*
+ * seek_emty: walk database starting at an empty nonterminal node
+ * (should fail)
+ */
+static void test_seek_nx(const atf_tc_t *tc) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbiterator_t *iter = NULL;
+	dns_name_t *seekname;
+	dns_fixedname_t f1;
+
+	UNUSED(tc);
+
+	dns_fixedname_init(&f1);
+	seekname = dns_fixedname_name(&f1);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = setup_db(atf_tc_get_md_var(tc, "X-filename"),
+			  dns_dbtype_cache, &db);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_db_createiterator(db, 0, &iter);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = make_name("nonexistent." TEST_ORIGIN, seekname);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = dns_dbiterator_seek(iter, seekname);
+	ATF_CHECK_EQ(result, ISC_R_NOTFOUND);
+
+	dns_dbiterator_destroy(&iter);
+	dns_db_detach(&db);
+	dns_test_end();
+}
+
+ATF_TC(seek_nx);
+ATF_TC_HEAD(seek_nx, tc) {
+	atf_tc_set_md_var(tc, "descr", "attempt to walk database starting "
+				       "at a nonexistent node");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone1.data");
+}
+ATF_TC_BODY(seek_nx, tc) {
+	test_seek_nx(tc);
+}
+
+ATF_TC(seek_nx_nsec3);
+ATF_TC_HEAD(seek_nx_nsec3, tc) {
+	atf_tc_set_md_var(tc, "descr", "attempt to walk database starting "
+				       "at a nonexistent node");
+	atf_tc_set_md_var(tc, "X-filename", "testdata/dbiterator/zone2.data");
+}
+ATF_TC_BODY(seek_nx_nsec3, tc) {
+	test_seek_nx(tc);
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, create);
+	ATF_TP_ADD_TC(tp, create_nsec3);
+	ATF_TP_ADD_TC(tp, walk);
+	ATF_TP_ADD_TC(tp, walk_nsec3);
+	ATF_TP_ADD_TC(tp, reverse);
+	ATF_TP_ADD_TC(tp, reverse_nsec3);
+	ATF_TP_ADD_TC(tp, seek);
+	ATF_TP_ADD_TC(tp, seek_nsec3);
+	ATF_TP_ADD_TC(tp, seek_empty);
+	ATF_TP_ADD_TC(tp, seek_empty_nsec3);
+	ATF_TP_ADD_TC(tp, seek_nx);
+	ATF_TP_ADD_TC(tp, seek_nx_nsec3);
+	return (atf_no_error());
+}
+
+/*
+ * XXX:
+ * dns_dbiterator API calls that are not yet part of this unit test:
+ *
+ * dns_dbiterator_pause
+ * dns_dbiterator_origin
+ * dns_dbiterator_setcleanmode
+ */
diff --git a/lib/dns/tests/dnstest.c b/lib/dns/tests/dnstest.c
index d49c6ce4..300a429b 100644
--- a/lib/dns/tests/dnstest.c
+++ b/lib/dns/tests/dnstest.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnstest.c,v 1.2.2.4 2011-07-08 22:57:25 smann Exp $ */
+/* $Id: dnstest.c,v 1.4 2011-07-06 01:36:32 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/tests/dnstest.h b/lib/dns/tests/dnstest.h
index 1971e902..00a2c376 100644
--- a/lib/dns/tests/dnstest.h
+++ b/lib/dns/tests/dnstest.h
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnstest.h,v 1.2.2.3 2011-07-08 22:57:25 smann Exp $ */
+/* $Id: dnstest.h,v 1.3 2011-07-06 01:36:32 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/tests/master_test.c b/lib/dns/tests/master_test.c
index 1ef5aa1c..2920b8cf 100644
--- a/lib/dns/tests/master_test.c
+++ b/lib/dns/tests/master_test.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: master_test.c,v 1.2.2.4 2011-07-08 22:57:25 smann Exp $ */
+/* $Id: master_test.c,v 1.4 2011-07-06 01:36:32 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/tests/testdata/dbiterator/zone1.data b/lib/dns/tests/testdata/dbiterator/zone1.data
new file mode 100644
index 00000000..e494ca38
--- /dev/null
+++ b/lib/dns/tests/testdata/dbiterator/zone1.data
@@ -0,0 +1,37 @@
+; Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: zone1.data,v 1.3 2011-08-23 23:54:00 tbox Exp $
+
+$TTL 600
+@		in	soa	localhost. postmaster.localhost. (
+				2011080901	;serial
+				3600		;refresh
+				1800		;retry
+				604800		;expiration
+				600 )		;minimum
+ 		in	ns	ns
+ 		in	ns	ns2
+ns		in	a	10.0.0.1
+ns2		in	a	10.0.0.2
+
+a		in	txt	"test"
+b		in	txt	"test"
+c		in	txt	"test"
+d.e.f		in	txt	"test"
+e		in	txt	"test"
+f.g.h		in	txt	"test"
+f.g.i		in	txt	"test"
+f.g.j		in	txt	"test"
+k		in	txt	"test"
diff --git a/lib/dns/tests/testdata/dbiterator/zone2.data b/lib/dns/tests/testdata/dbiterator/zone2.data
new file mode 100644
index 00000000..7265c274
--- /dev/null
+++ b/lib/dns/tests/testdata/dbiterator/zone2.data
@@ -0,0 +1,319 @@
+; File written on Mon Aug 15 16:51:56 2011
+; dnssec_signzone version 9.7.3rc1
+test.			600	IN SOA	localhost. postmaster.localhost. (
+					2011080901 ; serial
+					3600       ; refresh (1 hour)
+					1800       ; retry (30 minutes)
+					604800     ; expire (1 week)
+					600        ; minimum (10 minutes)
+					)
+			600	RRSIG	SOA 7 1 600 20110914225156 (
+					20110815225156 39833 test.
+					IoQPcpx+Y2btVBBdM2H/9ppRMjphB1thwrdh
+					midhKH+MXDAauUIENucugi3zLsc1o2ke8LnQ
+					v3lCLd/bb5MD1otuS8vOw1GWEFhXOUBZU6wS
+					QwEIcG4BiSlz7/GvOlRa2znkOmZ3c8bD/J3Y
+					XUWDI3BEDPgrZqfxEvoMyPEWjO8= )
+			600	NS	ns.test.
+			600	NS	ns2.test.
+			600	RRSIG	NS 7 1 600 20110914225156 (
+					20110815225156 39833 test.
+					OgEimhmFIAqlH0hyQy3pTsveBHKyqs9WfO1S
+					uDPRj3DFgFEAjoY473T8GxG2C+jTVL/UMVcb
+					BTZ8wIAiUHhqKLcmr0q/1X+kNUs7tNi+6oMn
+					/jxaOuRL6c8Kf2gl2t4g6JTwQqLQhUHTfQP+
+					bEfKUr75VsVfxCQZIHlZ3/AlxZM= )
+			600	DNSKEY	256 3 7 (
+					AwEAAc0FzrE7jUiaKIGZpIaFE8E989topAJN
+					dWIQUQ7BSKabmpBP2M+SXHwIiQ/yC25iqudO
+					IxjRcK7nHB1VoP84xU2oMj6eeSqQHf/bYaji
+					Y8IfR7lgrzoDWzq+0rtnKMJc/JM8SMkcoBAS
+					llvxarDJTZheZjlrCvhpRJC+FAkBsx81
+					) ; key id = 39833
+			600	DNSKEY	257 3 7 (
+					AwEAAc55LPDhBLqfDUpjYYbBt+N63CiZtKrD
+					UDGeFAerbw0MWIUi3PgMr7yGVrj8e5Qjp9UN
+					zBUax6NdhlYVtFA8CwMTXGBjxgyqUoWpce08
+					lswxfE70BpgUA6w5efs0/mYtX9/A76etCaSI
+					oNH2vfa47BCdCPDfC1uTgyeuNuDvhszHaSiD
+					8OY7tLa/voecUlq38sdqi2raf2DvgOm7rdFa
+					reXOS/WIj7zd4XYrV1JGthxOMVlQ7zdv9rVd
+					UNUIF2d4hwCZJQr0ejhmvB3m/DuNmNOPYmnv
+					KTmLSE+IJ6baqYvKOVxwV+SaCnuJEjv+3Yrx
+					8WQYD/iS9WBhC9FUit0dy+0=
+					) ; key id = 57183
+			600	RRSIG	DNSKEY 7 1 600 20110914225156 (
+					20110815225156 39833 test.
+					xPV+bSGUlbxA5MKBeeRbwUDh3Qc+dm77+OHQ
+					BHIr1L8/kRP5o5J7MqPA37kea6nhyltYf9xM
+					RsxyiaBGUUeLyWg/q6hTtkNgAHifOPAhiDz8
+					AJDSTdSsq9RVtjdobAD0jyzz9sWnB+TPSOmj
+					Nlyd7VtPVEuSYljgawwfBBO3Kho= )
+			600	RRSIG	DNSKEY 7 1 600 20110914225156 (
+					20110815225156 57183 test.
+					S3jkC7AvyFc4ShfHt6AWgS4zpx9DzWHBK9gV
+					2H23OJzy8H1At/CjKxWVHLJ/io+ygryVnt/I
+					47Jyhh9i43TnXj8il475YsweGnXGZSorrcXA
+					3IsD2lOuRYnp3yetxe2ZrMGNDqqImE6X4x1a
+					UJI0cbE2UMZfUt8Rm5USiGzwAEgFD1OXxvMD
+					UT3flyp+Ote9FConK8gewV4wlJuBFemWT7BZ
+					lUYnoqfuAeEn2+1pIBS0iA0LNFjNBaEgtcjo
+					QeweN32yKoApau47Dl/Klw7KFT8+PLZ0QPbt
+					XAkJU7q94Q5aucDuHCSCTCc+2vZxdEnXKvRY
+					rfLuG8r/V5Kn+1iYrQ== )
+			0	NSEC3PARAM 1 0 10 -
+			0	RRSIG	NSEC3PARAM 7 1 0 20110914225156 (
+					20110815225156 39833 test.
+					kghSSeP8AZiQ/zmxgxAyG0itoUMo5adG5pxD
+					p8T3ZmbxEUSyG5acxBFkmeY39wVU0Cda8tWc
+					HHrMbB5e2GN8z6xJ0A4rVyXfKSYJSz+iKWfk
+					7sOFRjd8OLYE3di6PwIpk6ORUiRPMFLDQCH0
+					Q27hLsSoKyd50orKKI+ncjz7WzU= )
+a.test.			600	IN TXT	"test"
+			600	RRSIG	TXT 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					UEVOlnL6CDRNCfk/Xge2oaGYCV1+ewwi5zJ0
+					CX4DdwiNEkItL4HgBe8xXfxgFC3qySdsSYPE
+					1krdFyIkAclMCwHECd1UwZbGlMTEUGrE1KOB
+					8vQY+OhIV9TAhqNwnjbu7s2ZdNUv3wiUPcfk
+					hCJ4rzP6yeV2inLwZulXnhxb6Pk= )
+b.test.			600	IN TXT	"test"
+			600	RRSIG	TXT 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					HcyQlO9io6Rc5e4vVqlRmK5PacOaFQJmdERG
+					5Aobpgm1FuCLC7F+IMZ0d1XvBWnsw9iDzV43
+					UKzTGqUSmDiSBzs4QzHlacGickIW8EOV4xyJ
+					+mcJ0FZh4YNbkt6CiX+8SF6IxfCMhRMjpSsK
+					rWqJMG3LXkI6W9stShzsYAFBOzQ= )
+e.test.			600	IN TXT	"test"
+			600	RRSIG	TXT 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					jUn5FGRTL9OcFU7tvfkUnSwY8jA+8JynE0hi
+					ZJbYXDU5CiWGmR2B3yPHxUCewRqouyVCV8bc
+					xZsSuBxvcdYKryYDbjsmB83GlSEuxE9J7XZs
+					8SxUP8PobLVqzXgEZS/XRU2G+R915ZDP9/iL
+					z9oYwc9TkeyXbp8J/ZsH88tG980= )
+c.test.			600	IN TXT	"test"
+			600	RRSIG	TXT 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					cRxAj45oFDDCd8xQXxD1F0Qq8XeBWAj8EYS3
+					7nFXAgAy8sTczFvYCNGj79o7BALJwM4vc/wx
+					6rjsiO/sHgfTMEBDq6lH9Wql72uhwavI2SrL
+					/h/wBP5q4BXlQ4xp6cLhhdifOWhNTvLP+Fe5
+					U6yjvqneiKspze9SiFbcmRDiJds= )
+d.e.f.test.		600	IN TXT	"test"
+			600	RRSIG	TXT 7 4 600 20110914225156 (
+					20110815225156 39833 test.
+					ENjCzr/P9rJmj5OJLzYwWtHtBg2Uz+qJDucz
+					I97Pq9F819/c5sxNfT4hgICCw6ZfT4ffbzye
+					fFJ0JVrh2cYOzu68ozlgek/Uml1UW0pDQVdI
+					s4zEgp4XK9wXUxtWChSqp5YXMdeHegZFu32i
+					IMNTbJDudwYSwhr2FyG92ZRi8Y8= )
+f.g.h.test.		600	IN TXT	"test"
+			600	RRSIG	TXT 7 4 600 20110914225156 (
+					20110815225156 39833 test.
+					HT7iocFsfDjeX6j9RJdE3xfVGkIxhajFHgM/
+					T/mJj/al4HKV6Ajia8DhpdfDrgM2m7r+Pgcn
+					FSIstfebQsuFCnHX/gIalDND/grHKsetQnMP
+					Y7O4QLsRnTV53fdlqQ4eT+jBW6fzJdGySVN+
+					bg6kNJZS8DebjmlKtZz7tXjkP+4= )
+f.g.i.test.		600	IN TXT	"test"
+			600	RRSIG	TXT 7 4 600 20110914225156 (
+					20110815225156 39833 test.
+					kHJJeNSL1rz4QRYqOzhGMQl1yIdio7l8Lg8H
+					f0TsvFLa6BudVtwKUm+Kz2QiDn7/Lew8w0KX
+					vVHxX/Vwl3Ixk54YgMKLNogz2TEvnh/VGiS7
+					8r0oSUrg0CFd+xDfxnLeRqX5NNfMuSJap5WH
+					Aw7IVeRjXDwJFYnytMEnTrhHHHg= )
+f.g.j.test.		600	IN TXT	"test"
+			600	RRSIG	TXT 7 4 600 20110914225156 (
+					20110815225156 39833 test.
+					lIEHEhDFhOWK8W/F2xWELU2p/X77S2KTivm9
+					sY4k3RPsLNHE7p+lF8p72Lcb79rtltnoVYtE
+					pTIiaUcmgGwfaI4cwfXbeuEgnuTiLg7Xrefx
+					3GT86Q+8gfgbMXUmRA/eouWZhCOaYJN99gYz
+					urzDMiRLYmILHmLlnvo82SgXeuk= )
+k.test.			600	IN TXT	"test"
+			600	RRSIG	TXT 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					wC3zgYWsuLga8Vu3QFu/Ci8SzRbA5bvjSmDj
+					NzcpjU5cvJBxtgzatCr02AaUC94bI0JzNrEB
+					nFyWCYw55lyy+bAHU1u05UcQmz0n5yxkvmHX
+					i8ZjMyQkAvNKodJHaFQqUKKIDuSHD2EziKqg
+					eNn55YRS11ihkODehUVNl7TnYeA= )
+ns.test.		600	IN A	10.0.0.1
+			600	RRSIG	A 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					VyK/WlQ6ikXdjF/arGzyAyYhOc8IYNBp4QLW
+					gtYjvbjIcV5+9JINWmUs61VjJ14nES1sI0xb
+					9vQJuiPXTM1awUAnvOKLhaX6fbJaEiR1w6Cf
+					RT5QKBMxNBKVStqdabHcigY4DUuc1PQk1vCw
+					yMUJt3nHNVMZk+XAycNHzBeYjik= )
+ns2.test.		600	IN A	10.0.0.2
+			600	RRSIG	A 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					CX6UlZL+5NQJViKfbe/E3uIJk/wjUzoiHBhY
+					B6gS8nxZzlRPdTTXyMZoRa4etTZEbrRjnyXk
+					1rP47faCUwbh//XqukN9f7FZ4Y39NpPS2XpX
+					0Lx6M93Jz46lbzmseMFs2YmNMzzhN4uhRvl/
+					8gPtYsn9KMXnAlFfa4XrE5LNVyY= )
+1F3JQ6EANHNHOCMUPQTVNM339VDTR51C.test. 600 IN NSEC3 1 0 10 - 7QKPELF33JOK9BVJ7CKE99AHG40B0SH7 A RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					w7aS12lxLNh+G1B/2kEq1BO6IzYvyC8n/MGV
+					0jvFnapNXGZMPrPxGeO2wkw1JXepuXCv98be
+					M4SjQywaH+VP6ZMTIfjxRxtcCM+aLAFhiz0l
+					/MILEkjemmxjAfvV7emRVMwCGcoGI7qC3Xxq
+					q5g8EzJiYyTCOnI5LKRggn97wGg= )
+7QKPELF33JOK9BVJ7CKE99AHG40B0SH7.test. 600 IN NSEC3 1 0 10 - 94Q15K1V1VE5F87EI37T2B9A39EEC368 TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					J4ObL3p4eN0jWh06M+rX2SSPANQoKfnosElB
+					KcKE7fLqEjKK7N6Yh6KUlbEP25tfeZ7W6GBJ
+					b7q6Nh0Ax8fYdc/6JVvmxcwWcx5Lw1TfITGB
+					ttFntJlbp1A8lwP3pn8Ksql1X2ogh78AsgTb
+					X5kmXVukC1oEzt98EAa/V/an8QA= )
+CS8M3UVG0UJDR6USBES4U9SNUGQI2RJE.test. 600 IN NSEC3 1 0 10 - ETEQB5V431INUIIE547FKSOF7O4DJ62J A RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					Vyd/2b0S15fACJ8TiPXKtScV9A/ZztVumZAm
+					o2S6jaVJKWik+8orDW+WiJ4/PEl26PK2m1uv
+					HD2beuUCHj9EnYkN/dzL3Bsc302qr9xqsh0q
+					VFS2moznoNG415ZV3vgYR7L9DAp43ZeFuw6I
+					7sr21hLYLUeo31xBsJg7RlOL+4s= )
+ETEQB5V431INUIIE547FKSOF7O4DJ62J.test. 600 IN NSEC3 1 0 10 - F8G1MB0JUEU3FBI11CAVFIPGEA3POOIM
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					oOHs1eb3JYeOMOnzE2PS6NIXBNzSoTYPIxo/
+					P0d/ihsLKra3yNJNPTlu4kf+FZoNYAGtMK/D
+					6dZWFvtdswDdi2C5WSgsanuHqXq5Lr3A1nCe
+					cQI5PO4RrLymB+MtYg15CNKcnc0WmJO8deSR
+					WzNOarC+Iz1Xj3FkKDS4FFr+02Q= )
+94Q15K1V1VE5F87EI37T2B9A39EEC368.test. 600 IN NSEC3 1 0 10 - CS8M3UVG0UJDR6USBES4U9SNUGQI2RJE
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					K0PvN7YtHQ63x/x2yXXa2S9GBGuTNJywDZ8M
+					wyMSwytCb9mn4hnKD5mJHaXGTw3YX7usbnEO
+					ce6hiJdN/VhMfbRMOvUpgyblOj4kXiYVZY1a
+					SyycfugK/Hu1j4az7lIhhnnx58GChA6mg8Vx
+					3Uz6cNDDCSTBTl09NyeUUrKWsHQ= )
+FBH6B0LHT9PPQB1P98D228HA1H52L8PO.test. 600 IN NSEC3 1 0 10 - JGU2L7C3LKLHAKC5RHUOORTI2DCKK3KL
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					giXRE+4ZeIzDrhx1XkFSpIKGFd3UGzlrLZnO
+					Ur9nMUfwvU5A3fitEkdayo3ZDH7MQGpSotaH
+					ReiFXx3Z6Hm2NIN/RHYZQr9e0vbMYSjkANdu
+					HWBA1SrSq5SHyuy970mPd4jfTHiABCo6fJGB
+					ykGClZGou0WSaB+Ak19fMbeQ2Wo= )
+JGU2L7C3LKLHAKC5RHUOORTI2DCKK3KL.test. 600 IN NSEC3 1 0 10 - KFMJ88CKMKUQQJE59IKFBOLLLD4DF55H TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					BHTDUgZdWNLgz3xHYMqvlWK/IJ0xrXESoREc
+					6D3sO9bcLTMYPO9t80itOlipwp4AmaVOBXPt
+					cKSdgsUXDEtHqNSxtGbNr5xQ+Aqsep0GX71V
+					HkcIuiNdTUw83dkajCHMkmQCbEjp9mbdiTmS
+					haNW2EsscldfaS1aq5tYUhCT3l4= )
+L993U6VC0DUV5QJ8TRPD2IQLM8FJ7AT9.test. 600 IN NSEC3 1 0 10 - LSMRLLNBQGGK8J6V40KLM2LG5TE4FS0P
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					vE7K0Nrju4qLFDYkIyMY5bIMT0wu8MJdxL6u
+					7WVA4HepccKQcUnvVoBAcrA9+MUeteyrad8Y
+					SJvQIt7sz5t7FViWSq5IMPVPujWtW5J30LhJ
+					mOLd1KmnFWoVthJ1oFNzBM80A60seKNnEw1M
+					lV6Y+v0gNYIQensUb9w6SVMTpxE= )
+F8G1MB0JUEU3FBI11CAVFIPGEA3POOIM.test. 600 IN NSEC3 1 0 10 - FA1T7MKUUV9SD4VDBJQ3GRFK1IDTCKL7
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					DkL9ONc0vpsKdG20ol8XPAaVfLb7kf1wnKbR
+					rQUB1trGSHm/Igo06of43zm9J+56htFJg1xD
+					I2de0sCUBQYyHVBBDiBAd1g+ZvcpUlLP0w8M
+					NxMviMiG/WQAdGXHwYfUimwMWD7gNGl1m05H
+					HwYmzGs+d1bClDNBrFhdfdL2+iA= )
+LSMRLLNBQGGK8J6V40KLM2LG5TE4FS0P.test. 600 IN NSEC3 1 0 10 - LUAN2Q3I2OCVSD41MP08HNA9JP22D38K
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					ZgiWuMqodQuhwuAF6CIiJTsdRahi+poOiZAM
+					WXNP0wXfdptcG2uhbdDwy+0crhe3tuybhwcb
+					CuiaQUh0XNPhgF+qmXpGobaqBhCEvCF4K9qY
+					OCIoMfsI1pIBVbMw0+YXVarFZ8+mfNU/+6n6
+					yy2+1nCg3k4XR2Dpv4CeDBfcAuM= )
+NAL1UIEBM38NKMN6RQOKE8T781IA7UKI.test. 600 IN NSEC3 1 0 10 - OUSGP0LO9FGAROHDULQVSTI3OLQIBB39 TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					x8JiXPI+EXHz8ZO/VW0/+9wWsBNqeSMxXZIV
+					ibOnogSg7Wi7Yq1xftKC2+xEevNxSZnBibEy
+					Sgro5xKTf0n7pD9hHVBLoYmOOnbXY3QNQ2EQ
+					y3LdPT355WmwVddVOOxNpNRp2zQyqg7BhVA3
+					wxY7tyVQd4x1+95ATUQBnFditdE= )
+KFMJ88CKMKUQQJE59IKFBOLLLD4DF55H.test. 600 IN NSEC3 1 0 10 - L993U6VC0DUV5QJ8TRPD2IQLM8FJ7AT9 TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					KQPaN2Ecebifbl4Bz5Yo0x2DgGmZiVhpSydm
+					oy/5NtMjt7G472JrKlqByap+VxW0bpzo3IER
+					3P8Dsv7pfBD4/Cl5sFqwZL7wYy7RB4dQLVCi
+					Pepc/Mr3gR2XmL91fpGttMj5jGscnVQJCyFa
+					obzhsVaVImUQZFDPb0UQUHwIhOA= )
+LUAN2Q3I2OCVSD41MP08HNA9JP22D38K.test. 600 IN NSEC3 1 0 10 - NAL1UIEBM38NKMN6RQOKE8T781IA7UKI TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					NJ+X3d0qh2+fbSnG0iQPxAeDIOzX5NTmY9fS
+					x7IO/DDcgUhPvl1YYdz5J999cec1zzOKp10J
+					YbsIAzg0w/Y4D4CBUw3IkcOrUFOODb6eJQGb
+					rVFRqmp3BUP4qOAWUZvx4oQ0KG4K/h/KJMbU
+					Vcdl7PF7G5O5hMyR9UWg4zal7Sk= )
+OUSGP0LO9FGAROHDULQVSTI3OLQIBB39.test. 600 IN NSEC3 1 0 10 - PQQ28M3U2MM08GGFV3JKR76G2H9IUJPC TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					A/qxYrSE/smBGbST8j8eGPCrRnwvVa25kDha
+					IuA3nv0vzXhFvlruc9f0HRGwsq6A2pw3I5W+
+					xo2/JxsNyFOotdwaDDEBzqPkJmrzupxQS4Hm
+					rHSLnRnNw4QzvzNjAGWMYAoe3OeHC47wmAtI
+					qE91EHZTlPP28CUXOMo+7sCaOa8= )
+U0UVS2SUP89P2TM3PJO4TC1GPJ2O6519.test. 600 IN NSEC3 1 0 10 - VA2VG5BEMCKQP6MS5NHHGL18031BIA7M NS SOA RRSIG DNSKEY NSEC3PARAM
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					rahhkfiF+Rk6oqbWTdu9qcwhmj5hbDuIFdiJ
+					GmaG+cFSv5Mjp+txNVCvBK9Hq/VpW0ypen/3
+					JC0sVAugSX+HAKAgyaMKmgWCvoQZ6ZSJUh7o
+					LRPcT+oxVXQAqjovxpaV8k6sYo44tpljPdOD
+					UluWAP5SrmJKjzCxs27KGRx8MK4= )
+VA2VG5BEMCKQP6MS5NHHGL18031BIA7M.test. 600 IN NSEC3 1 0 10 - VAKOQ2TPD7S25NFBJT73J3C4OGU10RJ5 TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					XcBeZ8lo9Qo8z56+1FdGDjh6ZHCfO+MQ/wnY
+					TEUo/aWLkPTyq39nLhe0qVBJxmDpM+KQFuG9
+					cjQT5fvrlrY+lv6dedB64EBMYy4kKbIv7N5+
+					r6+sfWlvtKsfXxysLSk2+jLEm5NuLFrOdNas
+					WLVsq741D3YcWt4kM1HCyk3DNF8= )
+FA1T7MKUUV9SD4VDBJQ3GRFK1IDTCKL7.test. 600 IN NSEC3 1 0 10 - FBH6B0LHT9PPQB1P98D228HA1H52L8PO TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					jB/vLrvx4sQQD7J3ZacAAyhcFmIPh7LH3ljw
+					IAIaeLb10oX5q1/nQKYdfq976TMy5sWpBcmd
+					i91WLxd+T/gOSumyP8bC3g+SUoyZ9wxY6A6a
+					MMx1rn0QA9IKrxMqojs9M3urJ8QAeIS+KyAn
+					rbyyJuG+EVm0prqlPZtzUi28WCI= )
+PQQ28M3U2MM08GGFV3JKR76G2H9IUJPC.test. 600 IN NSEC3 1 0 10 - U0UVS2SUP89P2TM3PJO4TC1GPJ2O6519
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					asCOU9OkVWMvUU2IUpwMgdYf0faA04zPbaFf
+					qywYsv3NH01Lky6G3a0WUPAbBm7TAYx/ln8a
+					559vlpp/gpXEl9CcLrjO6wy5i0ryp8gVHtKJ
+					rQlEc/uw4SY+S5t7FuZc2rNRdAbxVMYuwrvm
+					HBsKDPblre3e06ZZFEmnGFzCgmg= )
+VAKOQ2TPD7S25NFBJT73J3C4OGU10RJ5.test. 600 IN NSEC3 1 0 10 - VNCCJH8JPOLGLAGVMV3FKS09M7RRDU47 TXT RRSIG
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					Pt4tKB1p/jsyLYab9LSt5MF1KTRT18nRTOox
+					q0IACkXkKx7W5xv6nSYXIB+nQzNp1Y1hhoXn
+					9IFi0liPnIAOp73w4vybhfIdTFiEmHPHT6O9
+					VIx5cSriqBI6Qda8GtfeIb96P8SojbUk5BDI
+					g18iYjviGhQYRgpU3tg1qd7pbcc= )
+VNCCJH8JPOLGLAGVMV3FKS09M7RRDU47.test. 600 IN NSEC3 1 0 10 - 1F3JQ6EANHNHOCMUPQTVNM339VDTR51C
+			600	RRSIG	NSEC3 7 2 600 20110914225156 (
+					20110815225156 39833 test.
+					ZMZPHawhkuzSV7C7zkgghH/jpw9CQVR1JUXq
+					pAeY2iIIWwNhfuskJaLgtu/5SuKnJtrv6D4N
+					g+lfEkBReia5xO/SCcHv8/hXEPH8vZ4xe1C9
+					6GVB6ip2hKw2g5HpyF7X18WgwZ0cqPWVg+Q+
+					xRLpXH+53391Wt5rG7qJswn5RLE= )
diff --git a/lib/dns/tests/time_test.c b/lib/dns/tests/time_test.c
index d2dbeced..84db7a9d 100644
--- a/lib/dns/tests/time_test.c
+++ b/lib/dns/tests/time_test.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time_test.c,v 1.2.2.3 2011-07-08 22:57:25 smann Exp $ */
+/* $Id: time_test.c,v 1.3 2011-07-06 01:36:32 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/tests/update_test.c b/lib/dns/tests/update_test.c
new file mode 100644
index 00000000..6ed9335c
--- /dev/null
+++ b/lib/dns/tests/update_test.c
@@ -0,0 +1,277 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: update_test.c,v 1.5 2011-08-23 01:29:38 each Exp $ */
+
+/* $Id: */
+
+/*! \file */
+
+#include <config.h>
+
+#include <atf-c.h>
+
+#include <unistd.h>
+#include <time.h>
+
+#include <isc/serial.h>
+#include <isc/stdtime.h>
+
+#include <dns/update.h>
+
+#include "dnstest.h"
+
+static isc_uint32_t mystdtime;
+
+static void set_mystdtime(int year, int month, int day) {
+	struct tm tm;
+
+	memset(&tm, 0, sizeof(tm));
+	tm.tm_year = year - 1900;
+	tm.tm_mon = month;
+	tm.tm_mday = day;
+	mystdtime = timegm(&tm) ;
+}
+
+void isc_stdtime_get(isc_stdtime_t *now) {
+	*now = mystdtime;
+}
+
+/*
+ * Individual unit tests
+ */
+
+ATF_TC(increment);
+ATF_TC_HEAD(increment, tc) {
+  atf_tc_set_md_var(tc, "descr", "simple increment by 1");
+}
+ATF_TC_BODY(increment, tc) {
+	isc_uint32_t old = 50;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_increment);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK_MSG(new != 0, "new (%d) should not equal 0", new);
+	ATF_REQUIRE_EQ(new, 51);
+	dns_test_end();
+}
+
+/* 0xfffffffff -> 1 */
+ATF_TC(increment_past_zero);
+ATF_TC_HEAD(increment_past_zero, tc) {
+  atf_tc_set_md_var(tc, "descr", "increment past zero, ffffffff -> 1");
+}
+ATF_TC_BODY(increment_past_zero, tc) {
+	isc_uint32_t old = 0xffffffffu;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_increment);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, 1u);
+	dns_test_end();
+}
+
+ATF_TC(past_to_unix);
+ATF_TC_HEAD(past_to_unix, tc) {
+  atf_tc_set_md_var(tc, "descr", "past to unixtime");
+}
+ATF_TC_BODY(past_to_unix, tc) {
+	isc_uint32_t old;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime - 1;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_unixtime);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, mystdtime);
+	dns_test_end();
+}
+
+ATF_TC(now_to_unix);
+ATF_TC_HEAD(now_to_unix, tc) {
+  atf_tc_set_md_var(tc, "descr", "now to unixtime");
+}
+ATF_TC_BODY(now_to_unix, tc) {
+	isc_uint32_t old;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_unixtime);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, old+1);
+	dns_test_end();
+}
+
+ATF_TC(future_to_unix);
+ATF_TC_HEAD(future_to_unix, tc) {
+  atf_tc_set_md_var(tc, "descr", "future to unixtime");
+}
+ATF_TC_BODY(future_to_unix, tc) {
+	isc_uint32_t old;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime + 1;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_unixtime);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, old+1);
+	dns_test_end();
+}
+
+ATF_TC(undefined_plus1_to_unix);
+ATF_TC_HEAD(undefined_plus1_to_unix, tc) {
+  atf_tc_set_md_var(tc, "descr", "undefined plus 1 to unixtime");
+}
+ATF_TC_BODY(undefined_plus1_to_unix, tc) {
+	isc_uint32_t old;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime ^ 0x80000000u;
+	old += 1;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_unixtime);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, mystdtime);
+	dns_test_end();
+}
+
+ATF_TC(undefined_minus1_to_unix);
+ATF_TC_HEAD(undefined_minus1_to_unix, tc) {
+  atf_tc_set_md_var(tc, "descr", "undefined minus 1 to unixtime");
+}
+ATF_TC_BODY(undefined_minus1_to_unix, tc) {
+	isc_uint32_t old;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime ^ 0x80000000u;
+	old -= 1;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_unixtime);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, old+1);
+	dns_test_end();
+}
+
+ATF_TC(undefined_to_unix);
+ATF_TC_HEAD(undefined_to_unix, tc) {
+  atf_tc_set_md_var(tc, "descr", "undefined to unixtime");
+}
+ATF_TC_BODY(undefined_to_unix, tc) {
+	isc_uint32_t old;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	set_mystdtime(2011, 6, 22);
+	old = mystdtime ^ 0x80000000u;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_unixtime);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, old+1);
+	dns_test_end();
+}
+
+ATF_TC(unixtime_zero);
+ATF_TC_HEAD(unixtime_zero, tc) {
+  atf_tc_set_md_var(tc, "descr", "handle unixtime being zero");
+}
+ATF_TC_BODY(unixtime_zero, tc) {
+	isc_uint32_t old;
+	isc_uint32_t new;
+	isc_result_t result;
+
+	UNUSED(tc);
+
+	mystdtime = 0;
+	old = 0xfffffff0;
+
+	result = dns_test_begin(NULL, ISC_FALSE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	new = dns_update_soaserial(old, dns_updatemethod_unixtime);
+	ATF_REQUIRE_EQ(isc_serial_lt(old, new), ISC_TRUE);
+	ATF_CHECK(new != 0);
+	ATF_REQUIRE_EQ(new, old+1);
+	dns_test_end();
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, increment);
+	ATF_TP_ADD_TC(tp, increment_past_zero);
+	ATF_TP_ADD_TC(tp, past_to_unix);
+	ATF_TP_ADD_TC(tp, now_to_unix);
+	ATF_TP_ADD_TC(tp, future_to_unix);
+	ATF_TP_ADD_TC(tp, undefined_to_unix);
+	ATF_TP_ADD_TC(tp, undefined_plus1_to_unix);
+	ATF_TP_ADD_TC(tp, undefined_minus1_to_unix);
+	ATF_TP_ADD_TC(tp, unixtime_zero);
+
+	return (atf_no_error());
+}
+
diff --git a/lib/dns/tests/zonemgr_test.c b/lib/dns/tests/zonemgr_test.c
index c4cd741d..502e7ec7 100644
--- a/lib/dns/tests/zonemgr_test.c
+++ b/lib/dns/tests/zonemgr_test.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zonemgr_test.c,v 1.2.8.2 2011-07-09 01:57:05 each Exp $ */
+/* $Id: zonemgr_test.c,v 1.2 2011-07-06 05:05:51 each Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/time.c b/lib/dns/time.c
index a20a9362..48b67777 100644
--- a/lib/dns/time.c
+++ b/lib/dns/time.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.c,v 1.35.132.2 2011-03-09 23:46:55 tbox Exp $ */
+/* $Id: time.c,v 1.37 2011-03-09 23:47:17 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 887c356d..f871b628 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tkey.c,v 1.100.12.1 2011-03-11 06:47:05 marka Exp $
+ * $Id: tkey.c,v 1.101 2011-03-11 06:11:24 marka Exp $
  */
 /*! \file */
 #include <config.h>
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 74ef8d42..06fe182e 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -16,7 +16,7 @@
  */
 
 /*
- * $Id: tsig.c,v 1.147.10.1 2011-03-21 19:53:34 each Exp $
+ * $Id: tsig.c,v 1.148 2011-03-21 19:54:03 each Exp $
  */
 /*! \file */
 #include <config.h>
diff --git a/lib/dns/ttl.c b/lib/dns/ttl.c
index d31503ec..9efd6f66 100644
--- a/lib/dns/ttl.c
+++ b/lib/dns/ttl.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ttl.c,v 1.29.814.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: ttl.c,v 1.31 2011-03-12 04:59:48 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/update.c b/lib/dns/update.c
new file mode 100644
index 00000000..a9b1dfad
--- /dev/null
+++ b/lib/dns/update.c
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: update.c,v 1.3 2011-07-01 23:47:44 tbox Exp $ */
+
+#include "config.h"
+
+#include <isc/stdtime.h>
+#include <isc/serial.h>
+
+#include <dns/update.h>
+
+isc_uint32_t
+dns_update_soaserial(isc_uint32_t serial, dns_updatemethod_t method) {
+	isc_stdtime_t now;
+
+	if (method == dns_updatemethod_unixtime) {
+		isc_stdtime_get(&now);
+		if (now != 0 && isc_serial_gt(now, serial))
+			return (now);
+	}
+
+	/* RFC1982 */
+	serial = (serial + 1) & 0xFFFFFFFF;
+	if (serial == 0)
+		serial = 1;
+
+	return (serial);
+}
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 9c532a24..f3bd4d5b 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.197.14.7 2011-06-08 23:02:43 each Exp $ */
+/* $Id: validator.c,v 1.204 2011-06-08 22:13:51 each Exp $ */
 
 #include <config.h>
 
diff --git a/lib/dns/view.c b/lib/dns/view.c
index 034c44ea..fafbae06 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: view.c,v 1.178.8.1 2011-03-11 06:47:06 marka Exp $ */
+/* $Id: view.c,v 1.181 2011-08-02 20:36:12 each Exp $ */
 
 /*! \file */
 
@@ -195,6 +195,7 @@ dns_view_create(isc_mem_t *mctx, dns_rdataclass_t rdclass,
 	ISC_LIST_INIT(view->rpz_zones);
 	dns_fixedname_init(&view->dlv_fixed);
 	view->managed_keys = NULL;
+	view->redirect = NULL;
 #ifdef BIND9
 	view->new_zone_file = NULL;
 	view->new_zone_config = NULL;
@@ -430,6 +431,8 @@ destroy(dns_view_t *view) {
 	}
 	if (view->managed_keys != NULL)
 		dns_zone_detach(&view->managed_keys);
+	if (view->redirect != NULL)
+		dns_zone_detach(&view->redirect);
 	dns_view_setnewzones(view, ISC_FALSE, NULL, NULL);
 #endif
 	dns_fwdtable_destroy(&view->fwdtable);
@@ -499,6 +502,11 @@ view_flushanddetach(dns_view_t **viewp, isc_boolean_t flush) {
 				dns_zone_flush(view->managed_keys);
 			dns_zone_detach(&view->managed_keys);
 		}
+		if (view->redirect != NULL) {
+			if (view->flush)
+				dns_zone_flush(view->redirect);
+			dns_zone_detach(&view->redirect);
+		}
 #endif
 		done = all_done(view);
 		UNLOCK(&view->lock);
@@ -1521,16 +1529,23 @@ dns_view_flushcache2(dns_view_t *view, isc_boolean_t fixuponly) {
 
 isc_result_t
 dns_view_flushname(dns_view_t *view, dns_name_t *name) {
+	return (dns_view_flushnode(view, name, ISC_FALSE));
+}
+
+isc_result_t
+dns_view_flushnode(dns_view_t *view, dns_name_t *name, isc_boolean_t tree) {
 
 	REQUIRE(DNS_VIEW_VALID(view));
 
-	if (view->adb != NULL)
-		dns_adb_flushname(view->adb, name);
-	if (view->cache == NULL)
-		return (ISC_R_SUCCESS);
-	if (view->resolver != NULL)
-		dns_resolver_flushbadcache(view->resolver, name);
-	return (dns_cache_flushname(view->cache, name));
+	if (!tree) {
+		if (view->adb != NULL)
+			dns_adb_flushname(view->adb, name);
+		if (view->cache == NULL)
+			return (ISC_R_SUCCESS);
+		if (view->resolver != NULL)
+			dns_resolver_flushbadcache(view->resolver, name);
+	}
+	return (dns_cache_flushnode(view->cache, name, tree));
 }
 
 isc_result_t
diff --git a/lib/dns/win32/libdns.def b/lib/dns/win32/libdns.def
index 239d7407..493ed6b2 100644
--- a/lib/dns/win32/libdns.def
+++ b/lib/dns/win32/libdns.def
@@ -175,6 +175,7 @@ dns_dispatch_detach
 dns_dispatch_getlocaladdress
 dns_dispatch_getsocket
 dns_dispatch_getudp
+dns_dispatch_getudp_dup
 dns_dispatch_importrecv
 dns_dispatch_removeresponse
 dns_dispatch_starttcp
@@ -208,8 +209,8 @@ dns_dnssec_keyfromrdata
 dns_dnssec_keylistfromrdataset
 dns_dnssec_selfsigns
 dns_dnssec_sign
-dns_dnssec_signs
 dns_dnssec_signmessage
+dns_dnssec_signs
 dns_dnssec_updatekeys
 dns_dnssec_verify
 dns_dnssec_verify2
@@ -295,6 +296,7 @@ dns_master_loadstreaminc
 dns_master_questiontotext
 dns_master_rdatasettotext
 dns_master_stylecreate
+dns_master_stylecreate2
 dns_master_styledestroy
 dns_message_addname
 dns_message_checksig
@@ -590,7 +592,6 @@ dns_resolver_freeze
 dns_resolver_getbadcache
 dns_resolver_getlamettl
 dns_resolver_getoptions
-dns_resolver_gettimeout
 dns_resolver_getudpsize
 dns_resolver_getzeronosoattl
 dns_resolver_logfetch
@@ -603,7 +604,6 @@ dns_resolver_setclientsperquery
 dns_resolver_setlamettl
 dns_resolver_setmustbesecure
 dns_resolver_settimeout
-dns_resolver_settimeout
 dns_resolver_setudpsize
 dns_resolver_setzeronosoattl
 dns_resolver_shutdown
@@ -699,6 +699,7 @@ dns_tsigrcode_fromtext
 dns_tsigrcode_totext
 dns_ttl_fromtext
 dns_ttl_totext
+dns_update_soaserial
 dns_validator_cancel
 dns_validator_create
 dns_validator_destroy
@@ -720,6 +721,7 @@ dns_view_flushanddetach
 dns_view_flushcache
 dns_view_flushcache2
 dns_view_flushname
+dns_view_flushnode
 dns_view_freeze
 dns_view_freezezones
 dns_view_getdynamickeyring
@@ -802,6 +804,7 @@ dns_zone_getqueryacl
 dns_zone_getrequeststats
 dns_zone_getserial
 dns_zone_getserial2
+dns_zone_getserialupdatemethod
 dns_zone_getsigresigninginterval
 dns_zone_getsigvalidityinterval
 dns_zone_getssutable
@@ -817,6 +820,7 @@ dns_zone_getxfrsource6
 dns_zone_getzeronosoattl
 dns_zone_iattach
 dns_zone_idetach
+dns_zone_isdynamic
 dns_zone_isforced
 dns_zone_load
 dns_zone_loadandthaw
@@ -835,6 +839,7 @@ dns_zone_replacedb
 dns_zone_setacache
 dns_zone_setadded
 dns_zone_setalsonotify
+dns_zone_setalsonotifywithkeys
 dns_zone_setaltxfrsource4
 dns_zone_setaltxfrsource6
 dns_zone_setcheckmx
@@ -875,7 +880,9 @@ dns_zone_setorigin
 dns_zone_setprivatetype
 dns_zone_setqueryacl
 dns_zone_setqueryonacl
+dns_zone_setrefreshkeyinterval
 dns_zone_setrequeststats
+dns_zone_setserialupdatemethod
 dns_zone_setsignatures
 dns_zone_setsigresigninginterval
 dns_zone_setsigvalidityinterval
@@ -950,6 +957,7 @@ dst_key_generate
 dst_key_generate2
 dst_key_getprivateformat
 dst_key_gettime
+dst_key_getttl
 dst_key_id
 dst_key_isnullkey
 dst_key_isprivate
@@ -964,6 +972,7 @@ dst_key_setbits
 dst_key_setflags
 dst_key_setprivateformat
 dst_key_settime
+dst_key_setttl
 dst_key_sigsize
 dst_key_size
 dst_key_tobuffer
diff --git a/lib/dns/win32/libdns.dsp b/lib/dns/win32/libdns.dsp
index 765ccc6d..c8d4a162 100644
--- a/lib/dns/win32/libdns.dsp
+++ b/lib/dns/win32/libdns.dsp
@@ -402,6 +402,10 @@ SOURCE=..\include\dns\types.h
 # End Source File
 # Begin Source File
 
+SOURCE=..\include\dns\update.h
+# End Source File
+# Begin Source File
+
 SOURCE=..\include\dns\validator.h
 # End Source File
 # Begin Source File
@@ -690,6 +694,10 @@ SOURCE=..\ttl.c
 # End Source File
 # Begin Source File
 
+SOURCE=..\update.c
+# End Source File
+# Begin Source File
+
 SOURCE=..\validator.c
 # End Source File
 # Begin Source File
diff --git a/lib/dns/win32/libdns.mak b/lib/dns/win32/libdns.mak
index 404da4e2..a03d9fa3 100644
--- a/lib/dns/win32/libdns.mak
+++ b/lib/dns/win32/libdns.mak
@@ -195,6 +195,7 @@ CLEAN :
 	-@erase "$(INTDIR)\tkey.obj"
 	-@erase "$(INTDIR)\tsig.obj"
 	-@erase "$(INTDIR)\ttl.obj"
+	-@erase "$(INTDIR)\update.obj"
 	-@erase "$(INTDIR)\validator.obj"
 	-@erase "$(INTDIR)\vc60.idb"
 	-@erase "$(INTDIR)\version.obj"
@@ -319,6 +320,7 @@ LINK32_OBJS= \
 	"$(INTDIR)\tkey.obj" \
 	"$(INTDIR)\tsig.obj" \
 	"$(INTDIR)\ttl.obj" \
+	"$(INTDIR)\update.obj" \
 	"$(INTDIR)\validator.obj" \
 	"$(INTDIR)\version.obj" \
 	"$(INTDIR)\view.obj" \
@@ -525,6 +527,8 @@ CLEAN :
 	-@erase "$(INTDIR)\tsig.sbr"
 	-@erase "$(INTDIR)\ttl.obj"
 	-@erase "$(INTDIR)\ttl.sbr"
+	-@erase "$(INTDIR)\update.obj"
+	-@erase "$(INTDIR)\update.sbr"
 	-@erase "$(INTDIR)\validator.obj"
 	-@erase "$(INTDIR)\validator.sbr"
 	-@erase "$(INTDIR)\vc60.idb"
@@ -655,6 +659,7 @@ BSC32_SBRS= \
 	"$(INTDIR)\tkey.sbr" \
 	"$(INTDIR)\tsig.sbr" \
 	"$(INTDIR)\ttl.sbr" \
+	"$(INTDIR)\update.sbr" \
 	"$(INTDIR)\validator.sbr" \
 	"$(INTDIR)\version.sbr" \
 	"$(INTDIR)\view.sbr" \
@@ -750,6 +755,7 @@ LINK32_OBJS= \
 	"$(INTDIR)\tkey.obj" \
 	"$(INTDIR)\tsig.obj" \
 	"$(INTDIR)\ttl.obj" \
+	"$(INTDIR)\update.obj" \
 	"$(INTDIR)\validator.obj" \
 	"$(INTDIR)\version.obj" \
 	"$(INTDIR)\view.obj" \
@@ -1930,6 +1936,24 @@ SOURCE=..\ttl.c
 
 !ENDIF 
 
+SOURCE=..\update.c
+
+!IF  "$(CFG)" == "libdns - Win32 Release"
+
+
+"$(INTDIR)\update.obj" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ELSEIF  "$(CFG)" == "libdns - Win32 Debug"
+
+
+"$(INTDIR)\update.obj"	"$(INTDIR)\update.sbr" : $(SOURCE) "$(INTDIR)"
+	$(CPP) $(CPP_PROJ) $(SOURCE)
+
+
+!ENDIF 
+
 SOURCE=..\validator.c
 
 !IF  "$(CFG)" == "libdns - Win32 Release"
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index f87344b1..31d21891 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrin.c,v 1.166.522.4 2011-03-11 06:47:06 marka Exp $ */
+/* $Id: xfrin.c,v 1.170 2011-03-11 06:11:25 marka Exp $ */
 
 /*! \file */
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 9e05684e..930bbb21 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.582.8.26 2011-08-09 02:34:24 marka Exp $ */
+/* $Id: zone.c,v 1.623 2011-08-09 02:24:28 marka Exp $ */
 
 /*! \file */
 
@@ -61,6 +61,7 @@
 #include <dns/private.h>
 #include <dns/rbt.h>
 #include <dns/rcode.h>
+#include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -75,6 +76,7 @@
 #include <dns/ssu.h>
 #include <dns/stats.h>
 #include <dns/tsig.h>
+#include <dns/update.h>
 #include <dns/xfrin.h>
 #include <dns/zone.h>
 
@@ -215,6 +217,7 @@ struct dns_zone {
 	isc_time_t		signingtime;
 	isc_time_t		nsec3chaintime;
 	isc_time_t		refreshkeytime;
+	isc_uint32_t		refreshkeyinterval;
 	isc_uint32_t		refreshkeycount;
 	isc_uint32_t		refresh;
 	isc_uint32_t		retry;
@@ -237,6 +240,7 @@ struct dns_zone {
 	isc_sockaddr_t		masteraddr;
 	dns_notifytype_t	notifytype;
 	isc_sockaddr_t		*notify;
+	dns_name_t		**notifykeynames;
 	unsigned int		notifycnt;
 	isc_sockaddr_t		notifyfrom;
 	isc_task_t		*task;
@@ -336,6 +340,11 @@ struct dns_zone {
 	 * whether a rpz radix was needed when last loaded
 	 */
 	isc_boolean_t           rpz_zone;
+
+	/*%
+	 * Serial number update method.
+	 */
+	dns_updatemethod_t	updatemethod;
 };
 
 #define DNS_ZONE_FLAG(z,f) (ISC_TF(((z)->flags & (f)) != 0))
@@ -456,6 +465,7 @@ struct dns_notify {
 	dns_request_t		*request;
 	dns_name_t		ns;
 	isc_sockaddr_t		dst;
+	dns_tsigkey_t		*key;
 	ISC_LINK(dns_notify_t)	link;
 };
 
@@ -781,6 +791,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	isc_time_settoepoch(&zone->signingtime);
 	isc_time_settoepoch(&zone->nsec3chaintime);
 	isc_time_settoepoch(&zone->refreshkeytime);
+	zone->refreshkeyinterval = 0;
 	zone->refreshkeycount = 0;
 	zone->refresh = DNS_ZONE_DEFAULTREFRESH;
 	zone->retry = DNS_ZONE_DEFAULTRETRY;
@@ -796,6 +807,7 @@ dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
 	zone->masterscnt = 0;
 	zone->curmaster = 0;
 	zone->notify = NULL;
+	zone->notifykeynames = NULL;
 	zone->notifytype = dns_notifytype_yes;
 	zone->notifycnt = 0;
 	zone->task = NULL;
@@ -1070,6 +1082,7 @@ dns_zone_getserial(dns_zone_t *zone) {
  */
 void
 dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type) {
+	char namebuf[1024];
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 	REQUIRE(type != dns_zone_none);
@@ -1080,6 +1093,12 @@ dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type) {
 	LOCK_ZONE(zone);
 	REQUIRE(zone->type == dns_zone_none || zone->type == type);
 	zone->type = type;
+
+	if (zone->strnamerd != NULL)
+		isc_mem_free(zone->mctx, zone->strnamerd);
+
+	zone_namerd_tostr(zone, namebuf, sizeof namebuf);
+	zone->strnamerd = isc_mem_strdup(zone->mctx, namebuf);
 	UNLOCK_ZONE(zone);
 }
 
@@ -1372,18 +1391,25 @@ dns_zone_getjournal(dns_zone_t *zone) {
  * allow dynamic updates either by having an update policy ("ssutable")
  * or an "allow-update" ACL with a value other than exactly "{ none; }".
  */
-static isc_boolean_t
-zone_isdynamic(dns_zone_t *zone) {
+isc_boolean_t
+dns_zone_isdynamic(dns_zone_t *zone, isc_boolean_t ignore_freeze) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	return (ISC_TF(zone->type == dns_zone_slave ||
-		       zone->type == dns_zone_stub ||
-		       zone->type == dns_zone_key ||
-		       (!zone->update_disabled && zone->ssutable != NULL) ||
-		       (!zone->update_disabled && zone->update_acl != NULL &&
-			!dns_acl_isnone(zone->update_acl))));
-}
+	if (zone->type == dns_zone_slave || zone->type == dns_zone_stub ||
+	    zone->type == dns_zone_key ||
+	    (zone->type == dns_zone_redirect && zone->masters != NULL))
+		return (ISC_TRUE);
 
+	/* If !ignore_freeze, we need check whether updates are disabled.  */
+	if (zone->type == dns_zone_master &&
+	    (!zone->update_disabled || ignore_freeze) &&
+	    ((zone->ssutable != NULL) ||
+	     (zone->update_acl != NULL && !dns_acl_isnone(zone->update_acl))))
+		return (ISC_TRUE);
+
+	return (ISC_FALSE);
+
+}
 
 static isc_result_t
 zone_load(dns_zone_t *zone, unsigned int flags) {
@@ -1421,7 +1447,7 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 		goto cleanup;
 	}
 
-	if (zone->db != NULL && zone_isdynamic(zone)) {
+	if (zone->db != NULL && dns_zone_isdynamic(zone, ISC_FALSE)) {
 		/*
 		 * This is a slave, stub, or dynamically updated
 		 * zone being reloaded.  Do nothing - the database
@@ -1488,7 +1514,8 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 		goto cleanup;
 	}
 
-	if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub) &&
+	if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub ||
+	     (zone->type == dns_zone_redirect && zone->masters != NULL)) &&
 	    rbt) {
 		if (zone->masterfile == NULL ||
 		    !isc_file_exists(zone->masterfile)) {
@@ -1526,7 +1553,9 @@ zone_load(dns_zone_t *zone, unsigned int flags) {
 			result = zone_startload(db, zone, loadtime);
 		} else {
 			result = DNS_R_NOMASTERFILE;
-			if (zone->type == dns_zone_master) {
+			if (zone->type == dns_zone_master ||
+			    (zone->type == dns_zone_redirect &&
+			     zone->masters == NULL)) {
 				dns_zone_log(zone, ISC_LOG_ERROR,
 					     "loading zone: "
 					     "no master file configured");
@@ -1572,8 +1601,8 @@ dns_zone_loadandthaw(dns_zone_t *zone) {
 	case DNS_R_CONTINUE:
 		/* Deferred thaw. */
 		break;
-	case ISC_R_SUCCESS:
 	case DNS_R_UPTODATE:
+	case ISC_R_SUCCESS:
 	case DNS_R_SEENINCLUDE:
 		zone->update_disabled = ISC_FALSE;
 		break;
@@ -1592,7 +1621,8 @@ get_master_options(dns_zone_t *zone) {
 	unsigned int options;
 
 	options = DNS_MASTER_ZONE;
-	if (zone->type == dns_zone_slave)
+	if (zone->type == dns_zone_slave ||
+	    (zone->type == dns_zone_redirect && zone->masters == NULL))
 		options |= DNS_MASTER_SLAVE;
 	if (zone->type == dns_zone_key)
 		options |= DNS_MASTER_KEY;
@@ -2405,13 +2435,22 @@ resume_signingwithkey(dns_zone_t *zone) {
 static isc_result_t
 zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 	dns_nsec3chain_t *nsec3chain, *current;
+	dns_dbversion_t *version = NULL;
+	isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
 	isc_result_t result;
 	isc_time_t now;
 	unsigned int options = 0;
 	char saltbuf[255*2+1];
-	char flags[sizeof("REMOVE|CREATE|NONSEC|OPTOUT")];
+	char flags[sizeof("INITIAL|REMOVE|CREATE|NONSEC|OPTOUT")];
 	int i;
 
+	dns_db_currentversion(zone->db, &version);
+	result = dns_nsec_nseconly(zone->db, version, &nseconly);
+	nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
+	dns_db_closeversion(zone->db, &version, ISC_FALSE);
+	if (!nsec3ok && (nsec3param->flags & DNS_NSEC3FLAG_REMOVE) == 0)
+		return (ISC_R_SUCCESS);
+
 	nsec3chain = isc_mem_get(zone->mctx, sizeof *nsec3chain);
 	if (nsec3chain == NULL)
 		return (ISC_R_NOMEMORY);
@@ -2438,6 +2477,12 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 		flags[0] = '\0';
 		if (nsec3param->flags & DNS_NSEC3FLAG_REMOVE)
 			strlcat(flags, "REMOVE", sizeof(flags));
+		if (nsec3param->flags & DNS_NSEC3FLAG_INITIAL) {
+			if (flags[0] == '\0')
+				strlcpy(flags, "INITIAL", sizeof(flags));
+			else
+				strlcat(flags, "|INITIAL", sizeof(flags));
+		}
 		if (nsec3param->flags & DNS_NSEC3FLAG_CREATE) {
 			if (flags[0] == '\0')
 				strlcpy(flags, "CREATE", sizeof(flags));
@@ -2466,6 +2511,7 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 		     "zone_addnsec3chain(%u,%s,%u,%s)",
 		      nsec3param->hash, flags, nsec3param->iterations,
 		      saltbuf);
+
 	for (current = ISC_LIST_HEAD(zone->nsec3chain);
 	     current != NULL;
 	     current = ISC_LIST_NEXT(current, link)) {
@@ -2518,6 +2564,7 @@ resume_addnsec3chain(dns_zone_t *zone) {
 	dns_rdataset_t rdataset;
 	isc_result_t result;
 	dns_rdata_nsec3param_t nsec3param;
+	isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
 
 	if (zone->privatetype == 0)
 		return;
@@ -2527,6 +2574,10 @@ resume_addnsec3chain(dns_zone_t *zone) {
 		goto cleanup;
 
 	dns_db_currentversion(zone->db, &version);
+
+	result = dns_nsec_nseconly(zone->db, version, &nseconly);
+	nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
+
 	dns_rdataset_init(&rdataset);
 	result = dns_db_findrdataset(zone->db, node, version,
 				     zone->privatetype, dns_rdatatype_none,
@@ -2550,8 +2601,9 @@ resume_addnsec3chain(dns_zone_t *zone) {
 			continue;
 		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		if ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 ||
-		    (nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) {
+		if (((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) ||
+		    ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 && nsec3ok))
+		{
 			result = zone_addnsec3chain(zone, &nsec3param);
 			if (result != ISC_R_SUCCESS) {
 				dns_zone_log(zone, ISC_LOG_ERROR,
@@ -2601,7 +2653,7 @@ check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
 	isc_result_t result;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_boolean_t dynamic = (zone->type == dns_zone_master) ?
-				zone_isdynamic(zone) : ISC_FALSE;
+				dns_zone_isdynamic(zone, ISC_FALSE) : ISC_FALSE;
 
 	dns_rdataset_init(&rdataset);
 	result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
@@ -3023,8 +3075,8 @@ update_one_rr(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
 }
 
 static isc_result_t
-increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver,
-		     dns_diff_t *diff, isc_mem_t *mctx) {
+update_soa_serial(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
+		  isc_mem_t *mctx, dns_updatemethod_t method) {
 	dns_difftuple_t *deltuple = NULL;
 	dns_difftuple_t *addtuple = NULL;
 	isc_uint32_t serial;
@@ -3035,12 +3087,7 @@ increment_soa_serial(dns_db_t *db, dns_dbversion_t *ver,
 	addtuple->op = DNS_DIFFOP_ADD;
 
 	serial = dns_soa_getserial(&addtuple->rdata);
-
-	/* RFC1982 */
-	serial = (serial + 1) & 0xFFFFFFFF;
-	if (serial == 0)
-		serial = 1;
-
+	serial = dns_update_soaserial(serial, method);
 	dns_soa_setserial(serial, &addtuple->rdata);
 	CHECK(do_one_tuple(&deltuple, db, ver, diff));
 	CHECK(do_one_tuple(&addtuple, db, ver, diff));
@@ -3265,7 +3312,8 @@ sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
 
 	if (changed) {
 		/* Write changes to journal file. */
-		CHECK(increment_soa_serial(db, ver, &diff, zone->mctx));
+		CHECK(update_soa_serial(db, ver, &diff, zone->mctx,
+					zone->updatemethod));
 		CHECK(zone_journal(zone, &diff, "sync_keyzone"));
 
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
@@ -3308,7 +3356,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	 */
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
 		if (zone->type == dns_zone_slave ||
-		    zone->type == dns_zone_stub) {
+		    zone->type == dns_zone_stub ||
+		    (zone->type == dns_zone_redirect &&
+		     zone->masters == NULL)) {
 			if (result == ISC_R_FILENOTFOUND)
 				dns_zone_log(zone, ISC_LOG_DEBUG(1),
 					     "no master file");
@@ -3388,9 +3438,6 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			needdump = ISC_TRUE;
 	}
 
-	zone->loadtime = loadtime;
-
-	dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded");
 	/*
 	 * Obtain ns, soa and cname counts for top of zone.
 	 */
@@ -3404,6 +3451,48 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	}
 
 	/*
+	 * Check to make sure the journal is up to date, and remove the
+	 * journal file if it isn't, as we wouldn't be able to apply
+	 * updates otherwise.
+	 */
+	if (zone->journal != NULL && dns_zone_isdynamic(zone, ISC_TRUE) &&
+	    ! DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS)) {
+		isc_uint32_t jserial;
+		dns_journal_t *journal = NULL;
+
+		result = dns_journal_open(zone->mctx, zone->journal,
+					  ISC_FALSE, &journal);
+		if (result == ISC_R_SUCCESS) {
+			jserial = dns_journal_last_serial(journal);
+			dns_journal_destroy(&journal);
+		} else {
+			jserial = serial;
+			result = ISC_R_SUCCESS;
+		}
+
+		if (jserial != serial) {
+			dns_zone_log(zone, ISC_LOG_INFO,
+				     "journal file is out of date: "
+				     "removing journal file");
+			if (remove(zone->journal) < 0 && errno != ENOENT) {
+				char strbuf[ISC_STRERRORSIZE];
+				isc__strerror(errno, strbuf, sizeof(strbuf));
+				isc_log_write(dns_lctx,
+					      DNS_LOGCATEGORY_GENERAL,
+					      DNS_LOGMODULE_ZONE,
+					      ISC_LOG_WARNING,
+					      "unable to remove journal "
+					      "'%s': '%s'",
+					      zone->journal, strbuf);
+			}
+		}
+	}
+
+	zone->loadtime = loadtime;
+
+	dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded");
+
+	/*
 	 * Master / Slave / Stub zones require both NS and SOA records at
 	 * the top of the zone.
 	 */
@@ -3413,6 +3502,7 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 	case dns_zone_master:
 	case dns_zone_slave:
 	case dns_zone_stub:
+	case dns_zone_redirect:
 		if (soacount != 1) {
 			dns_zone_log(zone, ISC_LOG_ERROR,
 				     "has %d SOA records", soacount);
@@ -3429,7 +3519,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 			result = DNS_R_BADZONE;
 			goto cleanup;
 		}
-		if (zone->type != dns_zone_stub) {
+		if (zone->type != dns_zone_stub &&
+		    zone->type != dns_zone_redirect) {
 			result = check_nsec3param(zone, db);
 			if (result != ISC_R_SUCCESS)
 				goto cleanup;
@@ -3505,7 +3596,9 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HAVETIMERS);
 
 		if (zone->type == dns_zone_slave ||
-		    zone->type == dns_zone_stub) {
+		    zone->type == dns_zone_stub ||
+		    (zone->type == dns_zone_redirect &&
+		     zone->masters != NULL)) {
 			isc_time_t t;
 			isc_uint32_t delay;
 
@@ -3597,7 +3690,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		}
 
 		if (zone->type == dns_zone_master &&
-		    zone_isdynamic(zone) &&
+		    !DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN) &&
+		    dns_zone_isdynamic(zone, ISC_FALSE) &&
 		    dns_db_issecure(db)) {
 			dns_name_t *name;
 			dns_fixedname_t fixed;
@@ -3640,7 +3734,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
  cleanup:
 	if (zone->type == dns_zone_slave ||
 	    zone->type == dns_zone_stub ||
-	    zone->type == dns_zone_key) {
+	    zone->type == dns_zone_key ||
+	    (zone->type == dns_zone_redirect && zone->masters != NULL)) {
 		if (zone->journal != NULL)
 			zone_saveunique(zone, zone->journal, "jn-XXXXXXXX");
 		if (zone->masterfile != NULL)
@@ -3651,7 +3746,8 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
 		if (zone->task != NULL)
 			zone_settimer(zone, &now);
 		result = ISC_R_SUCCESS;
-	} else if (zone->type == dns_zone_master)
+	} else if (zone->type == dns_zone_master ||
+		   zone->type == dns_zone_redirect)
 		dns_zone_log(zone, ISC_LOG_ERROR, "not loaded due to errors.");
 	return (result);
 }
@@ -4212,48 +4308,8 @@ dns_zone_getnotifysrc6(dns_zone_t *zone) {
 	return (&zone->notifysrc6);
 }
 
-isc_result_t
-dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
-		       isc_uint32_t count)
-{
-	isc_sockaddr_t *new;
-
-	REQUIRE(DNS_ZONE_VALID(zone));
-	REQUIRE(count == 0 || notify != NULL);
-
-	LOCK_ZONE(zone);
-	if (zone->notify != NULL) {
-		isc_mem_put(zone->mctx, zone->notify,
-			    zone->notifycnt * sizeof(*new));
-		zone->notify = NULL;
-		zone->notifycnt = 0;
-	}
-	if (count != 0) {
-		new = isc_mem_get(zone->mctx, count * sizeof(*new));
-		if (new == NULL) {
-			UNLOCK_ZONE(zone);
-			return (ISC_R_NOMEMORY);
-		}
-		memcpy(new, notify, count * sizeof(*new));
-		zone->notify = new;
-		zone->notifycnt = count;
-	}
-	UNLOCK_ZONE(zone);
-	return (ISC_R_SUCCESS);
-}
-
-isc_result_t
-dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters,
-		    isc_uint32_t count)
-{
-	isc_result_t result;
-
-	result = dns_zone_setmasterswithkeys(zone, masters, NULL, count);
-	return (result);
-}
-
 static isc_boolean_t
-same_masters(const isc_sockaddr_t *old, const isc_sockaddr_t *new,
+same_addrs(const isc_sockaddr_t *old, const isc_sockaddr_t *new,
 	     isc_uint32_t count)
 {
 	unsigned int i;
@@ -4283,15 +4339,172 @@ same_keynames(dns_name_t **old, dns_name_t **new, isc_uint32_t count) {
 	return (ISC_TRUE);
 }
 
+static void
+clear_addresskeylist(isc_sockaddr_t **addrsp, dns_name_t ***keynamesp,
+		     unsigned int *countp, isc_mem_t *mctx)
+{
+	unsigned int count;
+	isc_sockaddr_t *addrs;
+	dns_name_t **keynames;
+
+	REQUIRE(countp != NULL && addrsp != NULL && keynamesp != NULL);
+
+	count = *countp;
+	addrs = *addrsp;
+	keynames = *keynamesp;
+
+	if (addrs != NULL) {
+		isc_mem_put(mctx, addrs, count * sizeof(isc_sockaddr_t));
+		addrs = *addrsp = NULL;
+	}
+
+	if (keynames != NULL) {
+		unsigned int i;
+		for (i = 0; i < count; i++) {
+			if (keynames[i] != NULL) {
+				dns_name_free(keynames[i], mctx);
+				isc_mem_put(mctx, keynames[i],
+					    sizeof(dns_name_t));
+				keynames[i] = NULL;
+			}
+		}
+		isc_mem_put(mctx, keynames, count * sizeof(dns_name_t *));
+		keynames = *keynamesp = NULL;
+	}
+
+	count = *countp = 0;
+}
+
+static isc_result_t
+set_addrkeylist(unsigned int count,
+		const isc_sockaddr_t *addrs, isc_sockaddr_t **newaddrsp,
+		dns_name_t **names, dns_name_t ***newnamesp,
+		isc_mem_t *mctx)
+{
+	isc_result_t result;
+	isc_sockaddr_t *newaddrs = NULL;
+	dns_name_t **newnames = NULL;
+	unsigned int i;
+
+	REQUIRE(newaddrsp != NULL && *newaddrsp == NULL);
+	REQUIRE(newnamesp != NULL && *newnamesp == NULL);
+
+	newaddrs = isc_mem_get(mctx, count * sizeof(*newaddrs));
+	if (newaddrs == NULL)
+		return (ISC_R_NOMEMORY);
+	memcpy(newaddrs, addrs, count * sizeof(*newaddrs));
+
+	newnames = NULL;
+	if (names != NULL) {
+		newnames = isc_mem_get(mctx, count * sizeof(*newnames));
+		if (newnames == NULL) {
+			isc_mem_put(mctx, newaddrs, count * sizeof(*newaddrs));
+			return (ISC_R_NOMEMORY);
+		}
+		for (i = 0; i < count; i++)
+			newnames[i] = NULL;
+		for (i = 0; i < count; i++) {
+			if (names[i] != NULL) {
+				newnames[i] = isc_mem_get(mctx,
+							 sizeof(dns_name_t));
+				if (newnames[i] == NULL)
+					goto allocfail;
+				dns_name_init(newnames[i], NULL);
+				result = dns_name_dup(names[i], mctx,
+						      newnames[i]);
+				if (result != ISC_R_SUCCESS) {
+				allocfail:
+					for (i = 0; i < count; i++)
+						if (newnames[i] != NULL)
+							dns_name_free(
+							       newnames[i],
+							       mctx);
+					isc_mem_put(mctx, newaddrs,
+						    count * sizeof(*newaddrs));
+					isc_mem_put(mctx, newnames,
+						    count * sizeof(*newnames));
+					return (ISC_R_NOMEMORY);
+				}
+			}
+		}
+	}
+
+	*newaddrsp = newaddrs;
+	*newnamesp = newnames;
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
+		       isc_uint32_t count)
+{
+	return (dns_zone_setalsonotifywithkeys(zone, notify, NULL, count));
+}
+
+isc_result_t
+dns_zone_setalsonotifywithkeys(dns_zone_t *zone, const isc_sockaddr_t *notify,
+			       dns_name_t **keynames, isc_uint32_t count)
+{
+	isc_result_t result;
+	isc_sockaddr_t *newaddrs = NULL;
+	dns_name_t **newnames = NULL;
+
+	REQUIRE(DNS_ZONE_VALID(zone));
+	REQUIRE(count == 0 || notify != NULL);
+	if (keynames != NULL)
+		REQUIRE(count != 0);
+
+	LOCK_ZONE(zone);
+
+	if (count == zone->notifycnt &&
+	    same_addrs(zone->notify, notify, count) &&
+	    same_keynames(zone->notifykeynames, keynames, count))
+		goto unlock;
+
+	clear_addresskeylist(&zone->notify, &zone->notifykeynames,
+			     &zone->notifycnt, zone->mctx);
+
+	if (count == 0)
+		goto unlock;
+
+	/*
+	 * Set up the notify and notifykey lists
+	 */
+	result = set_addrkeylist(count, notify, &newaddrs,
+				 keynames, &newnames, zone->mctx);
+	if (result != ISC_R_SUCCESS)
+		goto unlock;
+
+	/*
+	 * Everything is ok so attach to the zone.
+	 */
+	zone->notify = newaddrs;
+	zone->notifykeynames = newnames;
+	zone->notifycnt = count;
+ unlock:
+	UNLOCK_ZONE(zone);
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters,
+		    isc_uint32_t count)
+{
+	isc_result_t result;
+
+	result = dns_zone_setmasterswithkeys(zone, masters, NULL, count);
+	return (result);
+}
+
 isc_result_t
 dns_zone_setmasterswithkeys(dns_zone_t *zone,
 			    const isc_sockaddr_t *masters,
 			    dns_name_t **keynames,
 			    isc_uint32_t count)
 {
-	isc_sockaddr_t *new;
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_name_t **newname;
+	isc_sockaddr_t *newaddrs = NULL;
+	dns_name_t **newnames = NULL;
 	isc_boolean_t *newok;
 	unsigned int i;
 
@@ -4309,38 +4522,24 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
 	 * unlock and exit.
 	 */
 	if (count != zone->masterscnt ||
-	    !same_masters(zone->masters, masters, count) ||
+	    !same_addrs(zone->masters, masters, count) ||
 	    !same_keynames(zone->masterkeynames, keynames, count)) {
 		if (zone->request != NULL)
 			dns_request_cancel(zone->request);
 	} else
 		goto unlock;
-	if (zone->masters != NULL) {
-		isc_mem_put(zone->mctx, zone->masters,
-			    zone->masterscnt * sizeof(*new));
-		zone->masters = NULL;
-	}
-	if (zone->masterkeynames != NULL) {
-		for (i = 0; i < zone->masterscnt; i++) {
-			if (zone->masterkeynames[i] != NULL) {
-				dns_name_free(zone->masterkeynames[i],
-					      zone->mctx);
-				isc_mem_put(zone->mctx,
-					    zone->masterkeynames[i],
-					    sizeof(dns_name_t));
-				zone->masterkeynames[i] = NULL;
-			}
-		}
-		isc_mem_put(zone->mctx, zone->masterkeynames,
-			    zone->masterscnt * sizeof(dns_name_t *));
-		zone->masterkeynames = NULL;
-	}
+
+	/*
+	 * This needs to happen before clear_addresskeylist() sets
+	 * zone->masterscnt to 0:
+	 */
 	if (zone->mastersok != NULL) {
 		isc_mem_put(zone->mctx, zone->mastersok,
 			    zone->masterscnt * sizeof(isc_boolean_t));
 		zone->mastersok = NULL;
 	}
-	zone->masterscnt = 0;
+	clear_addresskeylist(&zone->masters, &zone->masterkeynames,
+			     &zone->masterscnt, zone->mctx);
 	/*
 	 * If count == 0, don't allocate any space for masters, mastersok or
 	 * keynames so internally, those pointers are NULL if count == 0
@@ -4349,75 +4548,33 @@ dns_zone_setmasterswithkeys(dns_zone_t *zone,
 		goto unlock;
 
 	/*
-	 * masters must contain count elements!
-	 */
-	new = isc_mem_get(zone->mctx, count * sizeof(*new));
-	if (new == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto unlock;
-	}
-	memcpy(new, masters, count * sizeof(*new));
-
-	/*
-	 * Similarly for mastersok.
+	 * mastersok must contain count elements
 	 */
 	newok = isc_mem_get(zone->mctx, count * sizeof(*newok));
 	if (newok == NULL) {
 		result = ISC_R_NOMEMORY;
-		isc_mem_put(zone->mctx, new, count * sizeof(*new));
+		isc_mem_put(zone->mctx, newaddrs, count * sizeof(*newaddrs));
 		goto unlock;
 	};
 	for (i = 0; i < count; i++)
 		newok[i] = ISC_FALSE;
 
 	/*
-	 * if keynames is non-NULL, it must contain count elements!
+	 * Now set up the masters and masterkey lists
 	 */
-	newname = NULL;
-	if (keynames != NULL) {
-		newname = isc_mem_get(zone->mctx, count * sizeof(*newname));
-		if (newname == NULL) {
-			result = ISC_R_NOMEMORY;
-			isc_mem_put(zone->mctx, new, count * sizeof(*new));
-			isc_mem_put(zone->mctx, newok, count * sizeof(*newok));
-			goto unlock;
-		}
-		for (i = 0; i < count; i++)
-			newname[i] = NULL;
-		for (i = 0; i < count; i++) {
-			if (keynames[i] != NULL) {
-				newname[i] = isc_mem_get(zone->mctx,
-							 sizeof(dns_name_t));
-				if (newname[i] == NULL)
-					goto allocfail;
-				dns_name_init(newname[i], NULL);
-				result = dns_name_dup(keynames[i], zone->mctx,
-						      newname[i]);
-				if (result != ISC_R_SUCCESS) {
-				allocfail:
-					for (i = 0; i < count; i++)
-						if (newname[i] != NULL)
-							dns_name_free(
-							       newname[i],
-							       zone->mctx);
-					isc_mem_put(zone->mctx, new,
-						    count * sizeof(*new));
-					isc_mem_put(zone->mctx, newok,
-						    count * sizeof(*newok));
-					isc_mem_put(zone->mctx, newname,
-						    count * sizeof(*newname));
-					goto unlock;
-				}
-			}
-		}
+	result = set_addrkeylist(count, masters, &newaddrs,
+				 keynames, &newnames, zone->mctx);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(zone->mctx, newok, count * sizeof(*newok));
+		goto unlock;
 	}
 
 	/*
 	 * Everything is ok so attach to the zone.
 	 */
-	zone->masters = new;
 	zone->mastersok = newok;
-	zone->masterkeynames = newname;
+	zone->masters = newaddrs;
+	zone->masterkeynames = newnames;
 	zone->masterscnt = count;
 	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOMASTERS);
 
@@ -4883,10 +5040,14 @@ zone_resigninc(dns_zone_t *zone) {
 	dns_diff_init(zone->mctx, &sig_diff);
 	sig_diff.resign = zone->sigresigninginterval;
 
+
 	/*
-	 * Updates are disabled.  Pause for 5 minutes.
+	 * Zone is frozen or automatic resigning is disabled.
+	 * Pause for 5 minutes.
 	 */
-	if (zone->update_disabled) {
+	if (zone->update_disabled ||
+	    DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN))
+	{
 		result = ISC_R_FAILURE;
 		goto failure;
 	}
@@ -5000,10 +5161,11 @@ zone_resigninc(dns_zone_t *zone) {
 		goto failure;
 
 	/* Increment SOA serial if we have made changes */
-	result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
+	result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+				   zone->updatemethod);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
-			     "zone_resigninc:increment_soa_serial -> %s\n",
+			     "zone_resigninc:update_soa_serial -> %s\n",
 			     dns_result_totext(result));
 		goto failure;
 	}
@@ -5431,6 +5593,7 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 	isc_buffer_t buffer;
 	unsigned char parambuf[DNS_NSEC3PARAM_BUFFERSIZE];
 	dns_ttl_t ttl = 0;
+	isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
 
 	dns_rdataset_init(&rdataset);
 
@@ -5481,6 +5644,10 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 
 	if (active)
 		goto add;
+
+	result = dns_nsec_nseconly(db, ver, &nseconly);
+	nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
+
 	/*
 	 * Delete all private records which match that in nsec3chain.
 	 */
@@ -5503,7 +5670,9 @@ fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
 			continue;
 		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
 
-		if (nsec3param.hash != chain->nsec3param.hash ||
+		if ((!nsec3ok &&
+		     (nsec3param.flags & DNS_NSEC3FLAG_INITIAL) != 0) ||
+		    nsec3param.hash != chain->nsec3param.hash ||
 		    nsec3param.iterations != chain->nsec3param.iterations ||
 		    nsec3param.salt_length != chain->nsec3param.salt_length ||
 		    memcmp(nsec3param.salt, chain->nsec3param.salt,
@@ -6071,7 +6240,8 @@ zone_nsec3chain(dns_zone_t *zone) {
 		 * of removing this NSEC3 chain.
 		 */
 		if (first && !updatensec &&
-		    (nsec3chain->nsec3param.flags & DNS_NSEC3FLAG_NONSEC) == 0) {
+		    (nsec3chain->nsec3param.flags & DNS_NSEC3FLAG_NONSEC) == 0)
+		{
 			result = need_nsec_chain(db, version,
 						 &nsec3chain->nsec3param,
 						 &buildnsecchain);
@@ -6372,10 +6542,11 @@ zone_nsec3chain(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
+	result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+				   zone->updatemethod);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR, "zone_nsec3chain:"
-			     "increment_soa_serial -> %s\n",
+			     "update_soa_serial -> %s\n",
 			     dns_result_totext(result));
 		goto failure;
 	}
@@ -6934,10 +7105,11 @@ zone_sign(dns_zone_t *zone) {
 		goto failure;
 	}
 
-	result = increment_soa_serial(db, version, &sig_diff, zone->mctx);
+	result = update_soa_serial(db, version, &sig_diff, zone->mctx,
+				   zone->updatemethod);
 	if (result != ISC_R_SUCCESS) {
 		dns_zone_log(zone, ISC_LOG_ERROR,
-			     "zone_sign:increment_soa_serial -> %s\n",
+			     "zone_sign:update_soa_serial -> %s\n",
 			     dns_result_totext(result));
 		goto failure;
 	}
@@ -7714,7 +7886,8 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 
 	if (!ISC_LIST_EMPTY(diff.tuples)) {
 		/* Write changes to journal file. */
-		CHECK(increment_soa_serial(kfetch->db, ver, &diff, mctx));
+		CHECK(update_soa_serial(kfetch->db, ver, &diff, mctx,
+					zone->updatemethod));
 		CHECK(zone_journal(zone, &diff, "keyfetch_done"));
 		commit = ISC_TRUE;
 
@@ -7871,7 +8044,8 @@ zone_refreshkeys(dns_zone_t *zone) {
 					 &kfetch->fetch);
 	}
 	if (!ISC_LIST_EMPTY(diff.tuples)) {
-		CHECK(increment_soa_serial(db, ver, &diff, zone->mctx));
+		CHECK(update_soa_serial(db, ver, &diff, zone->mctx,
+					zone->updatemethod));
 		CHECK(zone_journal(zone, &diff, "sync_keyzone"));
 		commit = ISC_TRUE;
 		DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
@@ -7915,6 +8089,9 @@ zone_maintenance(dns_zone_t *zone) {
 	 * Expire check.
 	 */
 	switch (zone->type) {
+	case dns_zone_redirect:
+		if (zone->masters == NULL)
+			break;
 	case dns_zone_slave:
 	case dns_zone_stub:
 		LOCK_ZONE(zone);
@@ -7933,6 +8110,9 @@ zone_maintenance(dns_zone_t *zone) {
 	 * Up to date check.
 	 */
 	switch (zone->type) {
+	case dns_zone_redirect:
+		if (zone->masters == NULL)
+			break;
 	case dns_zone_slave:
 	case dns_zone_stub:
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH) &&
@@ -7950,6 +8130,7 @@ zone_maintenance(dns_zone_t *zone) {
 	case dns_zone_master:
 	case dns_zone_slave:
 	case dns_zone_key:
+	case dns_zone_redirect:
 		LOCK_ZONE(zone);
 		if (zone->masterfile != NULL &&
 		    isc_time_compare(&now, &zone->dumptime) >= 0 &&
@@ -8571,6 +8752,8 @@ notify_destroy(dns_notify_t *notify, isc_boolean_t locked) {
 		dns_request_destroy(&notify->request);
 	if (dns_name_dynamic(&notify->ns))
 		dns_name_free(&notify->ns, notify->mctx);
+	if (notify->key != NULL)
+		dns_tsigkey_detach(&notify->key);
 	mctx = notify->mctx;
 	isc_mem_put(notify->mctx, notify, sizeof(*notify));
 	isc_mem_detach(&mctx);
@@ -8592,6 +8775,7 @@ notify_create(isc_mem_t *mctx, unsigned int flags, dns_notify_t **notifyp) {
 	notify->zone = NULL;
 	notify->find = NULL;
 	notify->request = NULL;
+	notify->key = NULL;
 	isc_sockaddr_any(&notify->dst);
 	dns_name_init(&notify->ns, NULL);
 	ISC_LINK_INIT(notify, link);
@@ -8736,15 +8920,23 @@ notify_send_toaddr(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
-	isc_netaddr_fromsockaddr(&dstip, &notify->dst);
-	isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
-	result = dns_view_getpeertsig(notify->zone->view, &dstip, &key);
-	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
-		notify_log(notify->zone, ISC_LOG_ERROR, "NOTIFY to %s not "
-			   "sent. Peer TSIG key lookup failure.", addrbuf);
-		goto cleanup_message;
+	if (notify->key != NULL) {
+		/* Transfer ownership of key */
+		key = notify->key;
+		notify->key = NULL;
+	} else {
+		isc_netaddr_fromsockaddr(&dstip, &notify->dst);
+		isc_sockaddr_format(&notify->dst, addrbuf, sizeof(addrbuf));
+		result = dns_view_getpeertsig(notify->zone->view, &dstip, &key);
+		if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
+			notify_log(notify->zone, ISC_LOG_ERROR,
+				   "NOTIFY to %s not sent. "
+				   "Peer TSIG key lookup failure.", addrbuf);
+			goto cleanup_message;
+		}
 	}
 
+	/* XXX: should we log the tsig key too? */
 	notify_log(notify->zone, ISC_LOG_DEBUG(3), "sending notify to %s",
 		   addrbuf);
 	if (notify->zone->view->peers != NULL) {
@@ -8946,14 +9138,30 @@ zone_notify(dns_zone_t *zone, isc_time_t *now) {
 	 */
 	LOCK_ZONE(zone);
 	for (i = 0; i < zone->notifycnt; i++) {
+		dns_tsigkey_t *key = NULL;
+
 		dst = zone->notify[i];
 		if (notify_isqueued(zone, NULL, &dst))
 			continue;
+
 		result = notify_create(zone->mctx, flags, &notify);
 		if (result != ISC_R_SUCCESS)
 			continue;
+
 		zone_iattach(zone, &notify->zone);
 		notify->dst = dst;
+
+		if ((zone->notifykeynames != NULL) &&
+		    (zone->notifykeynames[i] != NULL)) {
+			dns_view_t *view = dns_zone_getview(zone);
+			dns_name_t *keyname = zone->notifykeynames[i];
+			result = dns_view_gettsig(view, keyname, &key);
+			if (result == ISC_R_SUCCESS) {
+				notify->key = key;
+				key = NULL;
+			}
+		}
+
 		ISC_LIST_APPEND(zone->notifies, notify, link);
 		result = notify_send_queue(notify);
 		if (result != ISC_R_SUCCESS)
@@ -9441,7 +9649,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 				     "master %s exceeded (source %s)",
 				     master, source);
 			/* Try with slave with TCP. */
-			if (zone->type == dns_zone_slave &&
+			if ((zone->type == dns_zone_slave ||
+			     zone->type == dns_zone_redirect) &&
 			    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_TRYTCPREFRESH)) {
 				if (!dns_zonemgr_unreachable(zone->zmgr,
 							     &zone->masteraddr,
@@ -9510,7 +9719,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 		 * Perhaps AXFR/IXFR is allowed even if SOA queries aren't.
 		 */
 		if (msg->rcode == dns_rcode_refused &&
-		    zone->type == dns_zone_slave)
+		    (zone->type == dns_zone_slave ||
+		     zone->type == dns_zone_redirect))
 			goto tcp_transfer;
 		goto next_master;
 	}
@@ -9519,7 +9729,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 	 * If truncated punt to zone transfer which will query again.
 	 */
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
-		if (zone->type == dns_zone_slave) {
+		if (zone->type == dns_zone_slave ||
+		    zone->type == dns_zone_redirect) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refresh: truncated UDP answer, "
 				     "initiating TCP zone xfer "
@@ -9644,7 +9855,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 			dns_zone_log(zone, ISC_LOG_INFO,
 				     "refresh: skipping %s as master %s "
 				     "(source %s) is unreachable (cached)",
-				     zone->type == dns_zone_slave ?
+				     (zone->type == dns_zone_slave ||
+				      zone->type == dns_zone_redirect) ?
 				     "zone transfer" : "NS query",
 				     master, source);
 			goto next_master;
@@ -9654,7 +9866,8 @@ refresh_callback(isc_task_t *task, isc_event_t *event) {
 		LOCK_ZONE(zone);
 		dns_request_destroy(&zone->request);
 		UNLOCK_ZONE(zone);
-		if (zone->type == dns_zone_slave) {
+		if (zone->type == dns_zone_slave ||
+		    zone->type == dns_zone_redirect) {
 			queue_xfrin(zone);
 		} else {
 			INSIST(zone->type == dns_zone_stub);
@@ -10452,6 +10665,11 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 	isc_time_settoepoch(&next);
 
 	switch (zone->type) {
+	case dns_zone_redirect:
+		if (zone->masters != NULL)
+			goto treat_as_slave;
+		/* FALLTHROUGH */
+
 	case dns_zone_master:
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY))
 			next = zone->notifytime;
@@ -10462,6 +10680,8 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 			    isc_time_compare(&zone->dumptime, &next) < 0)
 				next = zone->dumptime;
 		}
+		if (zone->type == dns_zone_redirect)
+			break;
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESHING) &&
 		    !isc_time_isepoch(&zone->refreshkeytime)) {
 			if (isc_time_isepoch(&next) ||
@@ -10491,9 +10711,10 @@ zone_settimer(dns_zone_t *zone, isc_time_t *now) {
 		break;
 
 	case dns_zone_slave:
+	treat_as_slave:
 		if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_NEEDNOTIFY))
 			next = zone->notifytime;
-		/*FALLTHROUGH*/
+		/* FALLTHROUGH */
 
 	case dns_zone_stub:
 		if (!DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESH) &&
@@ -11155,15 +11376,17 @@ zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length) {
 	 * Leave space for terminating '\0'.
 	 */
 	isc_buffer_init(&buffer, buf, length - 1);
-	if (dns_name_dynamic(&zone->origin))
-		result = dns_name_totext(&zone->origin, ISC_TRUE, &buffer);
-	if (result != ISC_R_SUCCESS &&
-	    isc_buffer_availablelength(&buffer) >= (sizeof("<UNKNOWN>") - 1))
-		isc_buffer_putstr(&buffer, "<UNKNOWN>");
+	if (zone->type != dns_zone_redirect && zone->type != dns_zone_key) {
+		if (dns_name_dynamic(&zone->origin))
+			result = dns_name_totext(&zone->origin, ISC_TRUE, &buffer);
+		if (result != ISC_R_SUCCESS &&
+		    isc_buffer_availablelength(&buffer) >= (sizeof("<UNKNOWN>") - 1))
+			isc_buffer_putstr(&buffer, "<UNKNOWN>");
 
-	if (isc_buffer_availablelength(&buffer) > 0)
-		isc_buffer_putstr(&buffer, "/");
-	(void)dns_rdataclass_totext(zone->rdclass, &buffer);
+		if (isc_buffer_availablelength(&buffer) > 0)
+			isc_buffer_putstr(&buffer, "/");
+		(void)dns_rdataclass_totext(zone->rdclass, &buffer);
+	}
 
 	if (zone->view != NULL && strcmp(zone->view->name, "_bind") != 0 &&
 	    strcmp(zone->view->name, "_default") != 0 &&
@@ -11272,8 +11495,9 @@ dns_zone_logc(dns_zone_t *zone, isc_logcategory_t *category,
 	vsnprintf(message, sizeof(message), fmt, ap);
 	va_end(ap);
 	isc_log_write(dns_lctx, category, DNS_LOGMODULE_ZONE,
-		      level, "%s %s: %s", (zone->type == dns_zone_key) ?
-		      "managed-keys-zone" : "zone", zone->strnamerd, message);
+		      level, "%s%s: %s", (zone->type == dns_zone_key) ?
+		      "managed-keys-zone" : (zone->type == dns_zone_redirect) ?
+		      "redirect-zone" : "zone ", zone->strnamerd, message);
 }
 
 void
@@ -11288,8 +11512,9 @@ dns_zone_log(dns_zone_t *zone, int level, const char *fmt, ...) {
 	vsnprintf(message, sizeof(message), fmt, ap);
 	va_end(ap);
 	isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_ZONE,
-		      level, "%s %s: %s", (zone->type == dns_zone_key) ?
-		      "managed-keys-zone" : "zone", zone->strnamerd, message);
+		      level, "%s%s: %s", (zone->type == dns_zone_key) ?
+		      "managed-keys-zone" : (zone->type == dns_zone_redirect) ?
+		      "redirect-zone" : "zone ", zone->strnamerd, message);
 }
 
 static void
@@ -11567,8 +11792,10 @@ zone_replacedb(dns_zone_t *zone, dns_db_t *db, isc_boolean_t dump) {
 					  &oldserial, NULL, NULL, NULL, NULL,
 					  NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
-		if (zone->type == dns_zone_slave &&
-		    !isc_serial_gt(serial, oldserial)) {
+		if ((zone->type == dns_zone_slave ||
+		     (zone->type == dns_zone_redirect &&
+		      zone->masters != NULL))
+		    && !isc_serial_gt(serial, oldserial)) {
 			isc_uint32_t serialmin, serialmax;
 			serialmin = (oldserial + 1) & 0xffffffffU;
 			serialmax = (oldserial + 0x7fffffffU) & 0xffffffffU;
@@ -13198,7 +13425,8 @@ void
 dns_zone_forcereload(dns_zone_t *zone) {
 	REQUIRE(DNS_ZONE_VALID(zone));
 
-	if (zone->type == dns_zone_master)
+	if (zone->type == dns_zone_master ||
+	    (zone->type == dns_zone_redirect && zone->masters == NULL))
 		return;
 
 	LOCK_ZONE(zone);
@@ -13290,7 +13518,7 @@ dns_zone_dialup(dns_zone_t *zone) {
 
 	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALNOTIFY))
 		dns_zone_notify(zone);
-	if (zone->type != dns_zone_master &&
+	if (zone->type != dns_zone_master && zone->masters != NULL &&
 	    DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DIALREFRESH))
 		dns_zone_refresh(zone);
 }
@@ -13906,8 +14134,12 @@ dnskey_sane(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
 	}
 
 	/* Check existing DB for NSEC-only DNSKEY */
-	if (!nseconly)
-		CHECK(dns_nsec_nseconly(db, ver, &nseconly));
+	if (!nseconly) {
+		result = dns_nsec_nseconly(db, ver, &nseconly);
+		if (result == ISC_R_NOTFOUND)
+			result = ISC_R_SUCCESS;
+		CHECK(result);
+	}
 
 	/* Check existing DB for NSEC3 */
 	if (!nsec3)
@@ -14056,14 +14288,11 @@ zone_rekey(dns_zone_t *zone) {
 				     dns_rdatatype_none, 0, &keyset, &keysigs);
 	if (result == ISC_R_SUCCESS) {
 		ttl = keyset.ttl;
-		result = dns_dnssec_keylistfromrdataset(&zone->origin, dir,
-							mctx, &keyset,
-							&keysigs, &soasigs,
-							ISC_FALSE, ISC_FALSE,
-							&dnskeys);
-		/* Can't get keys for some reason; try again later. */
-		if (result != ISC_R_SUCCESS)
-			goto trylater;
+		CHECK(dns_dnssec_keylistfromrdataset(&zone->origin, dir,
+						     mctx, &keyset,
+						     &keysigs, &soasigs,
+						     ISC_FALSE, ISC_FALSE,
+						     &dnskeys));
 	} else if (result != ISC_R_NOTFOUND)
 		goto failure;
 
@@ -14089,7 +14318,7 @@ zone_rekey(dns_zone_t *zone) {
 			dns_zone_log(zone, ISC_LOG_ERROR, "zone_rekey:"
 				     "couldn't update zone keys: %s",
 				     isc_result_totext(result));
-			goto trylater;
+			goto failure;
 		}
 
 		/* See if any pre-existing keys have newly become active;
@@ -14131,7 +14360,8 @@ zone_rekey(dns_zone_t *zone) {
 			CHECK(add_signing_records(db, zone->privatetype,
 						  ver, &diff,
 						  ISC_TF(newalg || fullsign)));
-			CHECK(increment_soa_serial(db, ver, &diff, mctx));
+			CHECK(update_soa_serial(db, ver, &diff, mctx,
+						zone->updatemethod));
 			CHECK(add_chains(zone, db, ver, &diff));
 			CHECK(sign_apex(zone, db, ver, &diff, &sig_diff));
 			CHECK(zone_journal(zone, &sig_diff, "zone_rekey"));
@@ -14254,6 +14484,13 @@ zone_rekey(dns_zone_t *zone) {
 		}
 
 		/*
+		 * Activate any NSEC3 chain updates that may have
+		 * been scheduled before this rekey.
+		 */
+		if (fullsign || newalg)
+			resume_addnsec3chain(zone);
+
+		/*
 		 * Schedule the next resigning event
 		 */
 		set_resigntime(zone);
@@ -14271,15 +14508,16 @@ zone_rekey(dns_zone_t *zone) {
 
 	/*
 	 * If we're doing key maintenance, set the key refresh timer to
-	 * the next scheduled key event or to one hour in the future,
-	 * whichever is sooner.
+	 * the next scheduled key event or to 'dnssec-loadkeys-interval'
+	 * seconds in the future, whichever is sooner.
 	 */
 	if (DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN)) {
 		isc_time_t timethen;
 		isc_stdtime_t then;
 
 		LOCK_ZONE(zone);
-		DNS_ZONE_TIME_ADD(&timenow, HOUR, &timethen);
+		DNS_ZONE_TIME_ADD(&timenow, zone->refreshkeyinterval,
+				  &timethen);
 		zone->refreshkeytime = timethen;
 		UNLOCK_ZONE(zone);
 
@@ -14306,7 +14544,7 @@ zone_rekey(dns_zone_t *zone) {
 		dns_zone_log(zone, ISC_LOG_INFO, "next key event: %s", timebuf);
 	}
 
- failure:
+ done:
 	dns_diff_clear(&diff);
 	dns_diff_clear(&sig_diff);
 
@@ -14328,10 +14566,14 @@ zone_rekey(dns_zone_t *zone) {
 		dns_db_detach(&db);
 	return;
 
- trylater:
-	isc_interval_set(&ival, HOUR, 0);
+ failure:
+	/*
+	 * Something went wrong; try again in ten minutes or
+	 * after a key refresh interval, whichever is shorter.
+	 */
+	isc_interval_set(&ival, ISC_MIN(zone->refreshkeyinterval, 600), 0);
 	isc_time_nowplusinterval(&zone->refreshkeytime, &ival);
-	goto failure;
+	goto done;
 }
 
 void
@@ -14397,3 +14639,28 @@ dns_zone_dlzpostload(dns_zone_t *zone, dns_db_t *db)
 	UNLOCK_ZONE(zone);
 	return result;
 }
+
+isc_result_t
+dns_zone_setrefreshkeyinterval(dns_zone_t *zone, isc_uint32_t interval) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	if (interval == 0)
+		return (ISC_R_RANGE);
+	/* Maximum value: 24 hours (3600 minutes) */
+	if (interval > (24 * 60))
+		interval = (24 * 60);
+	/* Multiply by 60 for seconds */
+	zone->refreshkeyinterval = interval * 60;
+	return (ISC_R_SUCCESS);
+}
+
+void
+dns_zone_setserialupdatemethod(dns_zone_t *zone, dns_updatemethod_t method) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	zone->updatemethod = method;
+}
+
+dns_updatemethod_t
+dns_zone_getserialupdatemethod(dns_zone_t *zone) {
+	REQUIRE(DNS_ZONE_VALID(zone));
+	return(zone->updatemethod);
+}
diff --git a/lib/dns/zt.c b/lib/dns/zt.c
index 23b3e833..49f6c487 100644
--- a/lib/dns/zt.c
+++ b/lib/dns/zt.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zt.c,v 1.47.814.3 2011-03-19 23:47:24 tbox Exp $ */
+/* $Id: zt.c,v 1.50 2011-03-21 23:47:21 tbox Exp $ */
 
 /*! \file */
 
@@ -292,13 +292,14 @@ freezezones(dns_zone_t *zone, void *uap) {
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
 	char zonename[DNS_NAME_FORMATSIZE];
 	dns_view_t *view;
-	char *journal;
 	const char *vname;
 	const char *sep;
 	int level;
 
 	if (dns_zone_gettype(zone) != dns_zone_master)
 		return (ISC_R_SUCCESS);
+	if (!dns_zone_isdynamic(zone, ISC_TRUE))
+		return (ISC_R_SUCCESS);
 
 	frozen = dns_zone_getupdatedisabled(zone);
 	if (freeze) {
@@ -306,11 +307,6 @@ freezezones(dns_zone_t *zone, void *uap) {
 			result = DNS_R_FROZEN;
 		if (result == ISC_R_SUCCESS)
 			result = dns_zone_flush(zone);
-		if (result == ISC_R_SUCCESS) {
-			journal = dns_zone_getjournal(zone);
-			if (journal != NULL)
-				(void)isc_file_remove(journal);
-		}
 	} else {
 		if (frozen) {
 			result = dns_zone_load(zone);
diff --git a/lib/export/dns/Makefile.in b/lib/export/dns/Makefile.in
index 1a2b4d55..7867d4a8 100644
--- a/lib/export/dns/Makefile.in
+++ b/lib/export/dns/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.8.14.2 2011-05-16 23:47:16 tbox Exp $
+# $Id: Makefile.in,v 1.10 2011-05-16 23:47:40 tbox Exp $
 
 top_srcdir =	@top_srcdir@
 srcdir =	@top_srcdir@/lib/dns
diff --git a/lib/export/irs/Makefile.in b/lib/export/irs/Makefile.in
index 8d6b24b2..c0c32f45 100644
--- a/lib/export/irs/Makefile.in
+++ b/lib/export/irs/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.244.2 2011-05-16 23:47:16 tbox Exp $
+# $Id: Makefile.in,v 1.6 2011-05-16 23:47:40 tbox Exp $
 
 top_srcdir =	@top_srcdir@
 srcdir =	@top_srcdir@/lib/irs
diff --git a/lib/export/isccfg/Makefile.in b/lib/export/isccfg/Makefile.in
index cb22b372..5a424da4 100644
--- a/lib/export/isccfg/Makefile.in
+++ b/lib/export/isccfg/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.4.244.2 2011-05-16 23:47:17 tbox Exp $
+# $Id: Makefile.in,v 1.6 2011-05-16 23:47:41 tbox Exp $
 
 top_srcdir =	@top_srcdir@
 srcdir =	@top_srcdir@/lib/isccfg
diff --git a/lib/export/samples/nsprobe.c b/lib/export/samples/nsprobe.c
index 4999b615..dda448c1 100644
--- a/lib/export/samples/nsprobe.c
+++ b/lib/export/samples/nsprobe.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsprobe.c,v 1.7.180.3 2011-04-05 06:35:00 marka Exp $ */
+/* $Id: nsprobe.c,v 1.10 2011-04-05 06:33:50 marka Exp $ */
 
 #include <config.h>
 
diff --git a/lib/irs/api b/lib/irs/api
index 78dd0b40..3d2fa6ef 100644
--- a/lib/irs/api
+++ b/lib/irs/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 80
-LIBREVISION = 1
+LIBINTERFACE = 90
+LIBREVISION = 0
 LIBAGE = 0
diff --git a/lib/irs/getnameinfo.c b/lib/irs/getnameinfo.c
index 00809d94..c6ae2803 100644
--- a/lib/irs/getnameinfo.c
+++ b/lib/irs/getnameinfo.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: getnameinfo.c,v 1.4.346.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: getnameinfo.c,v 1.6 2011-03-12 04:59:48 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/irs/resconf.c b/lib/irs/resconf.c
index 28077bb7..f0903391 100644
--- a/lib/irs/resconf.c
+++ b/lib/irs/resconf.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resconf.c,v 1.3.346.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: resconf.c,v 1.5 2011-03-12 04:59:48 tbox Exp $ */
 
 /*! \file resconf.c */
 
diff --git a/lib/isc/Makefile.in b/lib/isc/Makefile.in
index fa25690d..f2ae2631 100644
--- a/lib/isc/Makefile.in
+++ b/lib/isc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.109.108.2 2011-07-08 23:47:16 tbox Exp $
+# $Id: Makefile.in,v 1.111 2011-07-07 23:47:49 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/lib/isc/api b/lib/isc/api
index ec820d9e..3d2fa6ef 100644
--- a/lib/isc/api
+++ b/lib/isc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 83
-LIBREVISION = 1
+LIBINTERFACE = 90
+LIBREVISION = 0
 LIBAGE = 0
diff --git a/lib/isc/heap.c b/lib/isc/heap.c
index eeef7f7b..670a76b9 100644
--- a/lib/isc/heap.c
+++ b/lib/isc/heap.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: heap.c,v 1.39.150.2 2011-03-03 23:47:09 tbox Exp $ */
+/* $Id: heap.c,v 1.41 2011-03-03 23:47:32 tbox Exp $ */
 
 /*! \file
  * Heap implementation of priority queues adapted from the following:
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index 44026470..5a890ccb 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: httpd.c,v 1.20.40.3 2011-03-11 06:47:07 marka Exp $ */
+/* $Id: httpd.c,v 1.23 2011-03-11 06:11:25 marka Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/include/isc/file.h b/lib/isc/include/isc/file.h
index 9087990e..42760c2c 100644
--- a/lib/isc/include/isc/file.h
+++ b/lib/isc/include/isc/file.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: file.h,v 1.39.10.2 2011-03-04 23:47:28 tbox Exp $ */
+/* $Id: file.h,v 1.41 2011-03-04 23:47:47 tbox Exp $ */
 
 #ifndef ISC_FILE_H
 #define ISC_FILE_H 1
diff --git a/lib/isc/include/isc/mem.h b/lib/isc/include/isc/mem.h
index e0a7fe53..921c6d81 100644
--- a/lib/isc/include/isc/mem.h
+++ b/lib/isc/include/isc/mem.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1997-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: mem.h,v 1.89 2010-08-11 22:54:58 jinmei Exp $ */
+/* $Id: mem.h,v 1.91 2011-08-09 23:46:39 tbox Exp $ */
 
 #ifndef ISC_MEM_H
 #define ISC_MEM_H 1
@@ -334,7 +334,7 @@ isc_mem_createx2(size_t max_size, size_t target_size,
  * ISC_MEMFLAG_INTERNAL is not set, 'target_size' is ignored.
  *
  * 'max_size' is also used to size the statistics arrays and the array
- * used to record active memory when ISC_MEM_DEBUGRECORD is set.  Settin
+ * used to record active memory when ISC_MEM_DEBUGRECORD is set.  Setting
  * 'max_size' too low can have detrimental effects on performance.
  *
  * A memory context created using isc_mem_createx() will obtain
diff --git a/lib/isc/include/isc/namespace.h b/lib/isc/include/isc/namespace.h
index 05a8b2c9..11f25285 100644
--- a/lib/isc/include/isc/namespace.h
+++ b/lib/isc/include/isc/namespace.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009, 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namespace.h,v 1.9 2010-12-04 13:25:59 marka Exp $ */
+/* $Id: namespace.h,v 1.12 2011-08-23 17:02:53 each Exp $ */
 
 #ifndef ISCAPI_NAMESPACE_H
 #define ISCAPI_NAMESPACE_H 1
@@ -88,6 +88,7 @@
 #define isc_mempool_getfillcount isc__mempool_getfillcount
 
 #define isc_socket_create isc__socket_create
+#define isc_socket_dup isc__socket_dup
 #define isc_socket_attach isc__socket_attach
 #define isc_socket_detach isc__socket_detach
 #define isc_socketmgr_create isc__socketmgr_create
@@ -110,6 +111,7 @@
 #define isc_socket_listen isc__socket_listen
 #define isc_socket_accept isc__socket_accept
 #define isc_socket_connect isc__socket_connect
+#define isc_socket_getfd isc__socket_getfd
 #define isc_socket_getname isc__socket_getname
 #define isc_socket_gettag isc__socket_gettag
 #define isc_socket_getpeername isc__socket_getpeername
diff --git a/lib/isc/include/isc/socket.h b/lib/isc/include/isc/socket.h
index 0aa71daa..f83dd087 100644
--- a/lib/isc/include/isc/socket.h
+++ b/lib/isc/include/isc/socket.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1998-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.h,v 1.94 2009-10-01 01:30:01 sar Exp $ */
+/* $Id: socket.h,v 1.98 2011-08-24 23:17:52 marka Exp $ */
 
 #ifndef ISC_SOCKET_H
 #define ISC_SOCKET_H 1
@@ -296,6 +296,9 @@ typedef struct isc_socketmethods {
 	isc_sockettype_t (*gettype)(isc_socket_t *sock);
 	void		(*ipv6only)(isc_socket_t *sock, isc_boolean_t yes);
 	isc_result_t    (*fdwatchpoke)(isc_socket_t *sock, int flags);
+	isc_result_t		(*dup)(isc_socket_t *socket,
+				  isc_socket_t **socketp);
+	int 		(*getfd)(isc_socket_t *socket);
 } isc_socketmethods_t;
 
 /*%
@@ -449,6 +452,12 @@ isc_socket_create(isc_socketmgr_t *manager,
  *\li	#ISC_R_UNEXPECTED
  */
 
+isc_result_t
+isc_socket_dup(isc_socket_t *sock0, isc_socket_t **socketp);
+/*%<
+ * Duplicate an existing socket, reusing its file descriptor.
+ */
+
 void
 isc_socket_cancel(isc_socket_t *sock, isc_task_t *task,
 		  unsigned int how);
@@ -1102,6 +1111,11 @@ void *isc_socket_gettag(isc_socket_t *socket);
  * Get the tag associated with a socket, if any.
  */
 
+int isc_socket_getfd(isc_socket_t *socket);
+/*%<
+ * Get the file descriptor associated with a socket
+ */
+
 void
 isc__socketmgr_setreserved(isc_socketmgr_t *mgr, isc_uint32_t);
 /*%<
diff --git a/lib/isc/include/isc/task.h b/lib/isc/include/isc/task.h
index b3cdbb62..64e531c0 100644
--- a/lib/isc/include/isc/task.h
+++ b/lib/isc/include/isc/task.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: task.h,v 1.69.14.2 2011-02-28 01:20:04 tbox Exp $ */
+/* $Id: task.h,v 1.71 2011-02-03 12:18:12 tbox Exp $ */
 
 #ifndef ISC_TASK_H
 #define ISC_TASK_H 1
diff --git a/lib/isc/include/isc/taskpool.h b/lib/isc/include/isc/taskpool.h
index 5825afb0..ec3ebbcb 100644
--- a/lib/isc/include/isc/taskpool.h
+++ b/lib/isc/include/isc/taskpool.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: taskpool.h,v 1.15.814.2 2011-07-08 23:47:16 tbox Exp $ */
+/* $Id: taskpool.h,v 1.17 2011-07-07 23:47:50 tbox Exp $ */
 
 #ifndef ISC_TASKPOOL_H
 #define ISC_TASKPOOL_H 1
diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
index 6e7da3a5..8bb334ed 100644
--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: util.h,v 1.32.170.2 2011-03-12 04:59:19 tbox Exp $ */
+/* $Id: util.h,v 1.34 2011-03-12 04:59:49 tbox Exp $ */
 
 #ifndef ISC_UTIL_H
 #define ISC_UTIL_H 1
diff --git a/lib/isc/log.c b/lib/isc/log.c
index ee71deb8..9ae9130a 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: log.c,v 1.99.404.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: log.c,v 1.101 2011-03-12 04:59:48 tbox Exp $ */
 
 /*! \file
  * \author  Principal Authors: DCL */
diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c
index 690141b2..5ba4d223 100644
--- a/lib/isc/netaddr.c
+++ b/lib/isc/netaddr.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: netaddr.c,v 1.41.38.3 2011-03-11 06:47:07 marka Exp $ */
+/* $Id: netaddr.c,v 1.44 2011-03-11 06:11:26 marka Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/powerpc/include/isc/atomic.h b/lib/isc/powerpc/include/isc/atomic.h
index 4404bede..2dcd847e 100644
--- a/lib/isc/powerpc/include/isc/atomic.h
+++ b/lib/isc/powerpc/include/isc/atomic.h
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: atomic.h,v 1.8.284.3 2011-03-08 00:52:21 marka Exp $ */
+/* $Id: atomic.h,v 1.11 2011-03-08 00:52:42 marka Exp $ */
 
 #ifndef ISC_ATOMIC_H
 #define ISC_ATOMIC_H 1
diff --git a/lib/isc/radix.c b/lib/isc/radix.c
index 641620cf..cc1c2536 100644
--- a/lib/isc/radix.c
+++ b/lib/isc/radix.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: radix.c,v 1.23.426.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: radix.c,v 1.25 2011-03-12 04:59:48 tbox Exp $ */
 
 /*
  * This source was adapted from MRT's RCS Ids:
diff --git a/lib/isc/rwlock.c b/lib/isc/rwlock.c
index 5b37f9ca..61ade5c2 100644
--- a/lib/isc/rwlock.c
+++ b/lib/isc/rwlock.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rwlock.c,v 1.46.426.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: rwlock.c,v 1.48 2011-03-12 04:59:49 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/sha1.c b/lib/isc/sha1.c
index 72e6b0a1..faef2f9f 100644
--- a/lib/isc/sha1.c
+++ b/lib/isc/sha1.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sha1.c,v 1.20.408.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: sha1.c,v 1.22 2011-03-12 04:59:49 tbox Exp $ */
 
 /*	$NetBSD: sha1.c,v 1.5 2000/01/22 22:19:14 mycroft Exp $	*/
 /*	$OpenBSD: sha1.c,v 1.9 1997/07/23 21:12:32 kstailey Exp $	*/
diff --git a/lib/isc/sha2.c b/lib/isc/sha2.c
index 2c9fe335..59be8287 100644
--- a/lib/isc/sha2.c
+++ b/lib/isc/sha2.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sha2.c,v 1.18.280.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: sha2.c,v 1.20 2011-03-12 04:59:49 tbox Exp $ */
 
 /*	$FreeBSD: src/sys/crypto/sha2/sha2.c,v 1.2.2.2 2002/03/05 08:36:47 ume Exp $	*/
 /*	$KAME: sha2.c,v 1.8 2001/11/08 01:07:52 itojun Exp $	*/
diff --git a/lib/isc/sockaddr.c b/lib/isc/sockaddr.c
index fe270664..7b9f90e5 100644
--- a/lib/isc/sockaddr.c
+++ b/lib/isc/sockaddr.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sockaddr.c,v 1.73.38.2 2011-02-28 01:20:03 tbox Exp $ */
+/* $Id: sockaddr.c,v 1.75 2011-02-21 23:47:45 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/socket_api.c b/lib/isc/socket_api.c
index c1e5fd4c..94ab5e80 100644
--- a/lib/isc/socket_api.c
+++ b/lib/isc/socket_api.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket_api.c,v 1.5 2009-10-01 01:30:01 sar Exp $ */
+/* $Id: socket_api.c,v 1.8 2011-08-24 23:17:52 marka Exp $ */
 
 #include <config.h>
 
@@ -214,3 +214,18 @@ isc_socket_fdwatchpoke(isc_socket_t *sock, int flags)
 
 	return(sock->methods->fdwatchpoke(sock, flags));
 }
+
+isc_result_t
+isc_socket_dup(isc_socket_t *sock, isc_socket_t **socketp) {
+	REQUIRE(ISCAPI_SOCKET_VALID(sock));
+	REQUIRE(socketp != NULL && *socketp == NULL);
+
+	return(sock->methods->dup(sock, socketp));
+}
+
+int
+isc_socket_getfd(isc_socket_t *sock) {
+	REQUIRE(ISCAPI_SOCKET_VALID(sock));
+
+	return(sock->methods->getfd(sock));
+}
diff --git a/lib/isc/string.c b/lib/isc/string.c
index 0cad5c70..bdab2edb 100644
--- a/lib/isc/string.c
+++ b/lib/isc/string.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: string.c,v 1.20.814.2 2011-03-12 04:59:18 tbox Exp $ */
+/* $Id: string.c,v 1.22 2011-03-12 04:59:49 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/task.c b/lib/isc/task.c
index 913e707a..ffe57afb 100644
--- a/lib/isc/task.c
+++ b/lib/isc/task.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: task.c,v 1.115.14.2 2011-02-28 01:20:03 tbox Exp $ */
+/* $Id: task.c,v 1.117 2011-02-03 12:18:12 tbox Exp $ */
 
 /*! \file
  * \author Principal Author: Bob Halley
diff --git a/lib/isc/taskpool.c b/lib/isc/taskpool.c
index afd132b1..f8991a97 100644
--- a/lib/isc/taskpool.c
+++ b/lib/isc/taskpool.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: taskpool.c,v 1.18.814.2 2011-07-08 23:47:16 tbox Exp $ */
+/* $Id: taskpool.c,v 1.20 2011-07-07 23:47:49 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/tests/Makefile.in b/lib/isc/tests/Makefile.in
index fd387841..5db6e437 100644
--- a/lib/isc/tests/Makefile.in
+++ b/lib/isc/tests/Makefile.in
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.2.8.2 2011-07-09 01:57:05 each Exp $
+# $Id: Makefile.in,v 1.6 2011-08-23 01:29:38 each Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
@@ -35,10 +35,10 @@ ISCDEPLIBS =	../libisc.@A@
 LIBS =		@LIBS@ @ATFLIBS@
 
 OBJS =		isctest.@O@
-SRCS =		isctest.c taskpool_test.c
+SRCS =		isctest.c taskpool_test.c socket_test.c hash_test.c
 
 SUBDIRS =
-TARGETS =	taskpool_test@EXEEXT@
+TARGETS =	taskpool_test@EXEEXT@ socket_test@EXEEXT@ hash_test@EXEEXT@
 
 @BIND9_MAKE_RULES@
 
@@ -46,5 +46,17 @@ taskpool_test@EXEEXT@: taskpool_test.@O@ isctest.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 			taskpool_test.@O@ isctest.@O@ ${ISCLIBS} ${LIBS}
 
+socket_test@EXEEXT@: socket_test.@O@ isctest.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			socket_test.@O@ isctest.@O@ ${ISCLIBS} ${LIBS}
+
+hash_test@EXEEXT@: hash_test.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			hash_test.@O@ ${ISCLIBS} ${LIBS}
+
+unit::
+	sh ${top_srcdir}/unit/unittest.sh
+
 clean distclean::
 	rm -f ${TARGETS}
+	rm -f atf.out
diff --git a/lib/isc/tests/hash_test.c b/lib/isc/tests/hash_test.c
new file mode 100644
index 00000000..07f32c26
--- /dev/null
+++ b/lib/isc/tests/hash_test.c
@@ -0,0 +1,1805 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: hash_test.c,v 1.3 2011-07-29 23:47:52 tbox Exp $ */
+
+/* ! \file */
+
+#include <config.h>
+
+#include <atf-c.h>
+
+#include <stdio.h>
+#include <string.h>
+
+#include <isc/hmacmd5.h>
+#include <isc/hmacsha.h>
+#include <isc/md5.h>
+#include <isc/sha1.h>
+#include <isc/util.h>
+#include <isc/string.h>
+
+/*
+ * Test data from RFC6234
+ */
+
+unsigned char digest[ISC_SHA512_DIGESTLENGTH];
+unsigned char buffer[1024];
+const char *s;
+char str[ISC_SHA512_DIGESTLENGTH];
+unsigned char key[20];
+int i = 0;
+
+isc_result_t
+tohexstr(unsigned char *d, unsigned int len, char *out);
+/*
+ * Precondition: a hexadecimal number in *d, the length of that number in len,
+ *   and a pointer to a character array to put the output (*out).
+ * Postcondition: A String representation of the given hexadecimal number is
+ *   placed into the array *out
+ *
+ * 'out' MUST point to an array of at least len / 2 + 1
+ *
+ * Return values: ISC_R_SUCCESS if the operation is sucessful
+ */
+
+isc_result_t
+tohexstr(unsigned char *d, unsigned int len, char *out) {
+
+	out[0]='\0';
+	char c_ret[] = "AA";
+	unsigned int i;
+	strcat(out, "0x");
+	for (i = 0; i < len; i++) {
+		sprintf(c_ret, "%02X", d[i]);
+		strcat(out, c_ret);
+	}
+	strcat(out, "\0");
+	return (ISC_R_SUCCESS);
+}
+
+
+#define TEST_INPUT(x) (x), sizeof(x)-1
+
+typedef struct hash_testcase {
+	const char *input;
+	size_t input_len;
+	const char *result;
+	int repeats;
+} hash_testcase_t;
+
+typedef struct hash_test_key {
+	const char *key;
+	const int len;
+} hash_test_key_t;
+
+/* non-hmac tests */
+
+ATF_TC(isc_sha1);
+ATF_TC_HEAD(isc_sha1, tc) {
+	atf_tc_set_md_var(tc, "descr", "sha1 examples from RFC4634");
+}
+ATF_TC_BODY(isc_sha1, tc) {
+	isc_sha1_t sha1;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("abc"),
+			"0xA9993E364706816ABA3E25717850C26C9CD0D89D",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("abcdbcdecdefdefgefghfghighijhijkijk"
+				   "ljklmklmnlmnomnopnopq"),
+			"0x84983E441C3BD26EBAAE4AA1F95129E5E54670F1",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("a") /* times 1000000 */,
+			"0x34AA973CD4C4DAA4F61EEB2BDBAD27316534016F",
+			1000000
+		},
+		/* Test 4 -- exact multiple of 512 bits */
+		{
+			TEST_INPUT("01234567012345670123456701234567"),
+			"0xDEA356A2CDDD90C7A7ECEDC5EBB563934F460452",
+			20 /* 20 times */
+		},
+#if 0
+		/* Test 5 -- optional feature, not implemented */
+		{
+			TEST_INPUT(""),
+			/* "extrabits": 0x98 , "numberextrabits": 5 */
+			"0x29826B003B906E660EFF4027CE98AF3531AC75BA",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("\x5e"),
+			"0x5E6F80A34A9798CAFC6A5DB96CC57BA4C4DB59C2",
+			1
+		},
+#if 0
+		/* Test 7 -- optional feature, not implemented */
+		{
+			TEST_INPUT("\x49\xb2\xae\xc2\x59\x4b\xbe\x3a"
+				   "\x3b\x11\x75\x42\xd9\x4a\xc8"),
+			/* "extrabits": 0x80, "numberextrabits": 3 */
+		  "0x6239781E03729919C01955B3FFA8ACB60B988340", 1 },
+#endif
+		/* Test 8 */
+		{
+			TEST_INPUT("\x9a\x7d\xfd\xf1\xec\xea\xd0\x6e\xd6\x46"
+				   "\xaa\x55\xfe\x75\x71\x46"),
+			"0x82ABFF6605DBE1C17DEF12A394FA22A82B544A35",
+			1
+		},
+#if 0
+		/* Test 9 -- optional feature, not implemented */
+		{
+			TEST_INPUT("\x65\xf9\x32\x99\x5b\xa4\xce\x2c\xb1\xb4"
+				   "\xa2\xe7\x1a\xe7\x02\x20\xaa\xce\xc8\x96"
+				   "\x2d\xd4\x49\x9c\xbd\x7c\x88\x7a\x94\xea"
+				   "\xaa\x10\x1e\xa5\xaa\xbc\x52\x9b\x4e\x7e"
+				   "\x43\x66\x5a\x5a\xf2\xcd\x03\xfe\x67\x8e"
+				   "\xa6\xa5\x00\x5b\xba\x3b\x08\x22\x04\xc2"
+				   "\x8b\x91\x09\xf4\x69\xda\xc9\x2a\xaa\xb3"
+				   "\xaa\x7c\x11\xa1\xb3\x2a"),
+			/* "extrabits": 0xE0 , "numberextrabits": 3 */
+			"0x8C5B2A5DDAE5A97FC7F9D85661C672ADBF7933D4",
+			1
+		},
+#endif
+		/* Test 10 */
+		{
+			TEST_INPUT("\xf7\x8f\x92\x14\x1b\xcd\x17\x0a\xe8\x9b"
+				   "\x4f\xba\x15\xa1\xd5\x9f\x3f\xd8\x4d\x22"
+				   "\x3c\x92\x51\xbd\xac\xbb\xae\x61\xd0\x5e"
+				   "\xd1\x15\xa0\x6a\x7c\xe1\x17\xb7\xbe\xea"
+				   "\xd2\x44\x21\xde\xd9\xc3\x25\x92\xbd\x57"
+				   "\xed\xea\xe3\x9c\x39\xfa\x1f\xe8\x94\x6a"
+				   "\x84\xd0\xcf\x1f\x7b\xee\xad\x17\x13\xe2"
+				   "\xe0\x95\x98\x97\x34\x7f\x67\xc8\x0b\x04"
+				   "\x00\xc2\x09\x81\x5d\x6b\x10\xa6\x83\x83"
+				   "\x6f\xd5\x56\x2a\x56\xca\xb1\xa2\x8e\x81"
+				   "\xb6\x57\x66\x54\x63\x1c\xf1\x65\x66\xb8"
+				   "\x6e\x3b\x33\xa1\x08\xb0\x53\x07\xc0\x0a"
+				   "\xff\x14\xa7\x68\xed\x73\x50\x60\x6a\x0f"
+				   "\x85\xe6\xa9\x1d\x39\x6f\x5b\x5c\xbe\x57"
+				   "\x7f\x9b\x38\x80\x7c\x7d\x52\x3d\x6d\x79"
+				   "\x2f\x6e\xbc\x24\xa4\xec\xf2\xb3\xa4\x27"
+				   "\xcd\xbb\xfb"),
+			"0xCB0082C8F197D260991BA6A460E76E202BAD27B3",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		isc_sha1_init(&sha1);
+		for(i = 0; i < testcase->repeats; i++) {
+			isc_sha1_update(&sha1,
+					(const isc_uint8_t *) testcase->input,
+					testcase->input_len);
+		}
+		isc_sha1_final(&sha1, digest);
+		tohexstr(digest, ISC_SHA1_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+	}
+}
+
+
+ATF_TC(isc_sha224);
+ATF_TC_HEAD(isc_sha224, tc) {
+	atf_tc_set_md_var(tc, "descr", "sha224 examples from RFC4634");
+}
+ATF_TC_BODY(isc_sha224, tc) {
+	isc_sha224_t sha224;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("abc"),
+			"0x23097D223405D8228642A477BDA255B32AADBCE4BDA0B3F7"
+				"E36C9DA7",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("abcdbcdecdefdefgefghfghighijhijkijklj"
+				   "klmklmnlmnomnopnopq"),
+			"0x75388B16512776CC5DBA5DA1FD890150B0C6455CB4F58B"
+				"1952522525",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("a"),
+			"0x20794655980C91D8BBB4C1EA97618A4BF03F42581948B2"
+				"EE4EE7AD67",
+			1000000
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("01234567012345670123456701234567"),
+			"0x567F69F168CD7844E65259CE658FE7AADFA25216E68ECA"
+				"0EB7AB8262",
+			20
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("\x07"),
+			"0x00ECD5F138422B8AD74C9799FD826C531BAD2FCABC7450"
+				"BEE2AA8C2A",
+			1
+		},
+#if 0
+		/* Test 7 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 8 */
+		{
+			TEST_INPUT("\x18\x80\x40\x05\xdd\x4f\xbd\x15\x56\x29"
+				   "\x9d\x6f\x9d\x93\xdf\x62"),
+			"0xDF90D78AA78821C99B40BA4C966921ACCD8FFB1E98AC38"
+				"8E56191DB1",
+			1
+		},
+#if 0
+		/* Test 9 */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 10 */
+		{
+			TEST_INPUT("\x55\xb2\x10\x07\x9c\x61\xb5\x3a\xdd\x52"
+				   "\x06\x22\xd1\xac\x97\xd5\xcd\xbe\x8c\xb3"
+				   "\x3a\xa0\xae\x34\x45\x17\xbe\xe4\xd7\xba"
+				   "\x09\xab\xc8\x53\x3c\x52\x50\x88\x7a\x43"
+				   "\xbe\xbb\xac\x90\x6c\x2e\x18\x37\xf2\x6b"
+				   "\x36\xa5\x9a\xe3\xbe\x78\x14\xd5\x06\x89"
+				   "\x6b\x71\x8b\x2a\x38\x3e\xcd\xac\x16\xb9"
+				   "\x61\x25\x55\x3f\x41\x6f\xf3\x2c\x66\x74"
+				   "\xc7\x45\x99\xa9\x00\x53\x86\xd9\xce\x11"
+				   "\x12\x24\x5f\x48\xee\x47\x0d\x39\x6c\x1e"
+				   "\xd6\x3b\x92\x67\x0c\xa5\x6e\xc8\x4d\xee"
+				   "\xa8\x14\xb6\x13\x5e\xca\x54\x39\x2b\xde"
+				   "\xdb\x94\x89\xbc\x9b\x87\x5a\x8b\xaf\x0d"
+				   "\xc1\xae\x78\x57\x36\x91\x4a\xb7\xda\xa2"
+				   "\x64\xbc\x07\x9d\x26\x9f\x2c\x0d\x7e\xdd"
+				   "\xd8\x10\xa4\x26\x14\x5a\x07\x76\xf6\x7c"
+				   "\x87\x82\x73"),
+			"0x0B31894EC8937AD9B91BDFBCBA294D9ADEFAA18E09305E"
+				"9F20D5C3A4",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		isc_sha224_init(&sha224);
+		for(i = 0; i < testcase->repeats; i++) {
+			isc_sha224_update(&sha224,
+					  (const isc_uint8_t *) testcase->input,
+					  testcase->input_len);
+		}
+		isc_sha224_final(digest, &sha224);
+		/*
+		*API inconsistency BUG HERE
+		* in order to be consistant with the other isc_hash_final
+		* functions the call should be
+		* isc_sha224_final(&sha224, digest);
+		 */
+		tohexstr(digest, ISC_SHA224_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+	}
+
+}
+
+ATF_TC(isc_sha256);
+ATF_TC_HEAD(isc_sha256, tc) {
+	atf_tc_set_md_var(tc, "descr", "sha224 examples from RFC4634");
+}
+ATF_TC_BODY(isc_sha256, tc) {
+	isc_sha256_t sha256;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("abc"),
+			"0xBA7816BF8F01CFEA414140DE5DAE2223B00361A396177A"
+				"9CB410FF61F20015AD",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("abcdbcdecdefdefgefghfghighijhijkijkljk"
+				   "lmklmnlmnomnopnopq"),
+			"0x248D6A61D20638B8E5C026930C3E6039A33CE45964FF21"
+				"67F6ECEDD419DB06C1",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("a"),
+			"0xCDC76E5C9914FB9281A1C7E284D73E67F1809A48A49720"
+				"0E046D39CCC7112CD0",
+			1000000 },
+		/* Test 4 */
+		{
+			TEST_INPUT("01234567012345670123456701234567"),
+			"0x594847328451BDFA85056225462CC1D867D877FB388DF0"
+				"CE35F25AB5562BFBB5",
+			20
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("\x19"),
+			"0x68AA2E2EE5DFF96E3355E6C7EE373E3D6A4E17F75F9518"
+				"D843709C0C9BC3E3D4",
+			1
+		},
+#if 0
+		/* Test 7 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 8 */
+		{
+			TEST_INPUT("\xe3\xd7\x25\x70\xdc\xdd\x78\x7c\xe3"
+				   "\x88\x7a\xb2\xcd\x68\x46\x52"),
+			"0x175EE69B02BA9B58E2B0A5FD13819CEA573F3940A94F82"
+				"5128CF4209BEABB4E8",
+			1
+		},
+#if 0
+		/* Test 9 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 10 */
+		{
+			TEST_INPUT("\x83\x26\x75\x4e\x22\x77\x37\x2f\x4f\xc1"
+				   "\x2b\x20\x52\x7a\xfe\xf0\x4d\x8a\x05\x69"
+				   "\x71\xb1\x1a\xd5\x71\x23\xa7\xc1\x37\x76"
+				   "\x00\x00\xd7\xbe\xf6\xf3\xc1\xf7\xa9\x08"
+				   "\x3a\xa3\x9d\x81\x0d\xb3\x10\x77\x7d\xab"
+				   "\x8b\x1e\x7f\x02\xb8\x4a\x26\xc7\x73\x32"
+				   "\x5f\x8b\x23\x74\xde\x7a\x4b\x5a\x58\xcb"
+				   "\x5c\x5c\xf3\x5b\xce\xe6\xfb\x94\x6e\x5b"
+				   "\xd6\x94\xfa\x59\x3a\x8b\xeb\x3f\x9d\x65"
+				   "\x92\xec\xed\xaa\x66\xca\x82\xa2\x9d\x0c"
+				   "\x51\xbc\xf9\x33\x62\x30\xe5\xd7\x84\xe4"
+				   "\xc0\xa4\x3f\x8d\x79\xa3\x0a\x16\x5c\xba"
+				   "\xbe\x45\x2b\x77\x4b\x9c\x71\x09\xa9\x7d"
+				   "\x13\x8f\x12\x92\x28\x96\x6f\x6c\x0a\xdc"
+				   "\x10\x6a\xad\x5a\x9f\xdd\x30\x82\x57\x69"
+				   "\xb2\xc6\x71\xaf\x67\x59\xdf\x28\xeb\x39"
+				   "\x3d\x54\xd6"),
+			"0x97DBCA7DF46D62C8A422C941DD7E835B8AD3361763F7E9"
+				"B2D95F4F0DA6E1CCBC",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		isc_sha256_init(&sha256);
+		for(i = 0; i < testcase->repeats; i++) {
+			isc_sha256_update(&sha256,
+					  (const isc_uint8_t *) testcase->input,
+					  testcase->input_len);
+		}
+		isc_sha256_final(digest, &sha256);
+		/*
+		*API inconsistency BUG HERE
+		* in order to be consistant with the other isc_hash_final
+		* functions the call should be
+		* isc_sha224_final(&sha224, digest);
+		 */
+		tohexstr(digest, ISC_SHA256_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+	}
+
+}
+
+ATF_TC(isc_sha384);
+ATF_TC_HEAD(isc_sha384, tc) {
+	atf_tc_set_md_var(tc, "descr", "sha224 examples from RFC4634");
+}
+ATF_TC_BODY(isc_sha384, tc) {
+	isc_sha384_t sha384;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("abc"),
+			"0xCB00753F45A35E8BB5A03D699AC65007272C32AB0EDED1"
+				"631A8B605A43FF5BED8086072BA1E7CC2358BAEC"
+				"A134C825A7",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("abcdefghbcdefghicdefghijdefghijkefghijkl"
+				   "fghijklmghijklmnhijklmnoijklmnopjklmnopq"
+				   "klmnopqrlmnopqrsmnopqrstnopqrstu"),
+			"0x09330C33F71147E83D192FC782CD1B4753111B173B3B05"
+				"D22FA08086E3B0F712FCC7C71A557E2DB966C3E9"
+				"FA91746039",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("a"),
+			"0x9D0E1809716474CB086E834E310A4A1CED149E9C00F248"
+				"527972CEC5704C2A5B07B8B3DC38ECC4EBAE97DD"
+				"D87F3D8985",
+			1000000
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("01234567012345670123456701234567"),
+			"0x2FC64A4F500DDB6828F6A3430B8DD72A368EB7F3A8322A"
+				"70BC84275B9C0B3AB00D27A5CC3C2D224AA6B61A"
+				"0D79FB4596",
+			20
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 6 */
+		{ TEST_INPUT("\xb9"),
+			"0xBC8089A19007C0B14195F4ECC74094FEC64F01F9092928"
+				"2C2FB392881578208AD466828B1C6C283D2722CF"
+				"0AD1AB6938",
+			1
+		},
+#if 0
+		/* Test 7 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 8 */
+		{
+			TEST_INPUT("\xa4\x1c\x49\x77\x79\xc0\x37\x5f\xf1"
+				   "\x0a\x7f\x4e\x08\x59\x17\x39"),
+			"0xC9A68443A005812256B8EC76B00516F0DBB74FAB26D665"
+				"913F194B6FFB0E91EA9967566B58109CBC675CC2"
+				"08E4C823F7",
+			1
+		},
+#if 0
+		/* Test 9 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 10 */
+		{
+			TEST_INPUT("\x39\x96\x69\xe2\x8f\x6b\x9c\x6d\xbc\xbb"
+				   "\x69\x12\xec\x10\xff\xcf\x74\x79\x03\x49"
+				   "\xb7\xdc\x8f\xbe\x4a\x8e\x7b\x3b\x56\x21"
+				   "\xdb\x0f\x3e\x7d\xc8\x7f\x82\x32\x64\xbb"
+				   "\xe4\x0d\x18\x11\xc9\xea\x20\x61\xe1\xc8"
+				   "\x4a\xd1\x0a\x23\xfa\xc1\x72\x7e\x72\x02"
+				   "\xfc\x3f\x50\x42\xe6\xbf\x58\xcb\xa8\xa2"
+				   "\x74\x6e\x1f\x64\xf9\xb9\xea\x35\x2c\x71"
+				   "\x15\x07\x05\x3c\xf4\xe5\x33\x9d\x52\x86"
+				   "\x5f\x25\xcc\x22\xb5\xe8\x77\x84\xa1\x2f"
+				   "\xc9\x61\xd6\x6c\xb6\xe8\x95\x73\x19\x9a"
+				   "\x2c\xe6\x56\x5c\xbd\xf1\x3d\xca\x40\x38"
+				   "\x32\xcf\xcb\x0e\x8b\x72\x11\xe8\x3a\xf3"
+				   "\x2a\x11\xac\x17\x92\x9f\xf1\xc0\x73\xa5"
+				   "\x1c\xc0\x27\xaa\xed\xef\xf8\x5a\xad\x7c"
+				   "\x2b\x7c\x5a\x80\x3e\x24\x04\xd9\x6d\x2a"
+				   "\x77\x35\x7b\xda\x1a\x6d\xae\xed\x17\x15"
+				   "\x1c\xb9\xbc\x51\x25\xa4\x22\xe9\x41\xde"
+				   "\x0c\xa0\xfc\x50\x11\xc2\x3e\xcf\xfe\xfd"
+				   "\xd0\x96\x76\x71\x1c\xf3\xdb\x0a\x34\x40"
+				   "\x72\x0e\x16\x15\xc1\xf2\x2f\xbc\x3c\x72"
+				   "\x1d\xe5\x21\xe1\xb9\x9b\xa1\xbd\x55\x77"
+				   "\x40\x86\x42\x14\x7e\xd0\x96"),
+			"0x4F440DB1E6EDD2899FA335F09515AA025EE177A79F4B4A"
+				"AF38E42B5C4DE660F5DE8FB2A5B2FBD2A3CBFFD2"
+				"0CFF1288C0",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		isc_sha384_init(&sha384);
+		for(i = 0; i < testcase->repeats; i++) {
+			isc_sha384_update(&sha384,
+					  (const isc_uint8_t *) testcase->input,
+					  testcase->input_len);
+		}
+		isc_sha384_final(digest, &sha384);
+		/*
+		*API inconsistency BUG HERE
+		* in order to be consistant with the other isc_hash_final
+		* functions the call should be
+		* isc_sha224_final(&sha224, digest);
+		 */
+		tohexstr(digest, ISC_SHA384_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+	}
+
+}
+
+ATF_TC(isc_sha512);
+ATF_TC_HEAD(isc_sha512, tc) {
+	atf_tc_set_md_var(tc, "descr", "sha224 examples from RFC4634");
+}
+ATF_TC_BODY(isc_sha512, tc) {
+	isc_sha512_t sha512;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("abc"),
+			"0xDDAF35A193617ABACC417349AE20413112E6FA4E89A97E"
+				"A20A9EEEE64B55D39A2192992A274FC1A836BA3C"
+				"23A3FEEBBD454D4423643CE80E2A9AC94FA54CA49F",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("abcdefghbcdefghicdefghijdefghijkefghijkl"
+				   "fghijklmghijklmnhijklmnoijklmnopjklmnopq"
+				   "klmnopqrlmnopqrsmnopqrstnopqrstu"),
+			"0x8E959B75DAE313DA8CF4F72814FC143F8F7779C6EB9F7F"
+				"A17299AEADB6889018501D289E4900F7E4331B99"
+				"DEC4B5433AC7D329EEB6DD26545E96E55B874BE909",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("a"),
+			"0xE718483D0CE769644E2E42C7BC15B4638E1F98B13B2044"
+				"285632A803AFA973EBDE0FF244877EA60A4CB043"
+				"2CE577C31BEB009C5C2C49AA2E4EADB217AD8CC09B",
+			1000000
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("01234567012345670123456701234567"),
+			"0x89D05BA632C699C31231DED4FFC127D5A894DAD412C0E0"
+				"24DB872D1ABD2BA8141A0F85072A9BE1E2AA04CF"
+				"33C765CB510813A39CD5A84C4ACAA64D3F3FB7BAE9",
+			20
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("\xD0"),
+			"0x9992202938E882E73E20F6B69E68A0A7149090423D93C8"
+				"1BAB3F21678D4ACEEEE50E4E8CAFADA4C85A54EA"
+				"8306826C4AD6E74CECE9631BFA8A549B4AB3FBBA15",
+			1
+		},
+#if 0
+		/* Test 7 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 8 */
+		{
+			TEST_INPUT("\x8d\x4e\x3c\x0e\x38\x89\x19\x14\x91\x81"
+				   "\x6e\x9d\x98\xbf\xf0\xa0"),
+			"0xCB0B67A4B8712CD73C9AABC0B199E9269B20844AFB75AC"
+				"BDD1C153C9828924C3DDEDAAFE669C5FDD0BC66F"
+				"630F6773988213EB1B16F517AD0DE4B2F0C95C90F8",
+			1
+		},
+#if 0
+		/* Test 9 -- unimplemented optional functionality */
+		{
+			TEST_INPUT(""),
+			"0xXXX",
+			1
+		},
+#endif
+		/* Test 10 */
+		{
+			TEST_INPUT("\xa5\x5f\x20\xc4\x11\xaa\xd1\x32\x80\x7a"
+				   "\x50\x2d\x65\x82\x4e\x31\xa2\x30\x54\x32"
+				   "\xaa\x3d\x06\xd3\xe2\x82\xa8\xd8\x4e\x0d"
+				   "\xe1\xde\x69\x74\xbf\x49\x54\x69\xfc\x7f"
+				   "\x33\x8f\x80\x54\xd5\x8c\x26\xc4\x93\x60"
+				   "\xc3\xe8\x7a\xf5\x65\x23\xac\xf6\xd8\x9d"
+				   "\x03\xe5\x6f\xf2\xf8\x68\x00\x2b\xc3\xe4"
+				   "\x31\xed\xc4\x4d\xf2\xf0\x22\x3d\x4b\xb3"
+				   "\xb2\x43\x58\x6e\x1a\x7d\x92\x49\x36\x69"
+				   "\x4f\xcb\xba\xf8\x8d\x95\x19\xe4\xeb\x50"
+				   "\xa6\x44\xf8\xe4\xf9\x5e\xb0\xea\x95\xbc"
+				   "\x44\x65\xc8\x82\x1a\xac\xd2\xfe\x15\xab"
+				   "\x49\x81\x16\x4b\xbb\x6d\xc3\x2f\x96\x90"
+				   "\x87\xa1\x45\xb0\xd9\xcc\x9c\x67\xc2\x2b"
+				   "\x76\x32\x99\x41\x9c\xc4\x12\x8b\xe9\xa0"
+				   "\x77\xb3\xac\xe6\x34\x06\x4e\x6d\x99\x28"
+				   "\x35\x13\xdc\x06\xe7\x51\x5d\x0d\x73\x13"
+				   "\x2e\x9a\x0d\xc6\xd3\xb1\xf8\xb2\x46\xf1"
+				   "\xa9\x8a\x3f\xc7\x29\x41\xb1\xe3\xbb\x20"
+				   "\x98\xe8\xbf\x16\xf2\x68\xd6\x4f\x0b\x0f"
+				   "\x47\x07\xfe\x1e\xa1\xa1\x79\x1b\xa2\xf3"
+				   "\xc0\xc7\x58\xe5\xf5\x51\x86\x3a\x96\xc9"
+				   "\x49\xad\x47\xd7\xfb\x40\xd2"),
+		  "0xC665BEFB36DA189D78822D10528CBF3B12B3EEF7260399"
+			  "09C1A16A270D48719377966B957A878E72058477"
+			  "9A62825C18DA26415E49A7176A894E7510FD1451F5",
+		  1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		isc_sha512_init(&sha512);
+		for(i = 0; i < testcase->repeats; i++) {
+			isc_sha512_update(&sha512,
+					  (const isc_uint8_t *) testcase->input,
+					  testcase->input_len);
+		}
+		isc_sha512_final(digest, &sha512);
+		/*
+		*API inconsistency BUG HERE
+		* in order to be consistant with the other isc_hash_final
+		* functions the call should be
+		* isc_sha224_final(&sha224, digest);
+		 */
+		tohexstr(digest, ISC_SHA512_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+	}
+
+}
+
+ATF_TC(isc_md5);
+ATF_TC_HEAD(isc_md5, tc) {
+	atf_tc_set_md_var(tc, "descr", "md5 example from RFC1321");
+}
+ATF_TC_BODY(isc_md5, tc) {
+	isc_md5_t md5;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		{
+			TEST_INPUT(""),
+			"0xD41D8CD98F00B204E9800998ECF8427E",
+			1
+		},
+		{
+			TEST_INPUT("a"),
+			"0x0CC175B9C0F1B6A831C399E269772661",
+			1
+		},
+		{
+			TEST_INPUT("abc"),
+			"0x900150983CD24FB0D6963F7D28E17F72",
+			1
+		},
+		{
+			TEST_INPUT("message digest"),
+			"0xF96B697D7CB7938D525A2F31AAF161D0",
+			1
+		},
+		{
+			TEST_INPUT("abcdefghijklmnopqrstuvwxyz"),
+			"0xC3FCD3D76192E4007DFB496CCA67E13B",
+			1
+		},
+		{
+			TEST_INPUT("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklm"
+				   "nopqrstuvwxyz0123456789"),
+			"0xD174AB98D277D9F5A5611C2C9F419D9F",
+			1
+		},
+		{
+			TEST_INPUT("123456789012345678901234567890123456789"
+				   "01234567890123456789012345678901234567890"),
+			"0x57EDF4A22BE3C955AC49DA2E2107B67A",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		isc_md5_init(&md5);
+		for(i = 0; i < testcase->repeats; i++) {
+			isc_md5_update(&md5,
+				       (const isc_uint8_t *) testcase->input,
+				       testcase->input_len);
+		}
+		isc_md5_final(&md5, digest);
+		tohexstr(digest, ISC_MD5_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+	}
+}
+
+/* HMAC-SHA1 test */
+ATF_TC(isc_hmacsha1);
+ATF_TC_HEAD(isc_hmacsha1, tc) {
+	atf_tc_set_md_var(tc, "descr", "HMAC-SHA1 examples from RFC2104");
+}
+ATF_TC_BODY(isc_hmacsha1, tc) {
+	isc_hmacsha1_t hmacsha1;
+
+	UNUSED(tc);
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("\x48\x69\x20\x54\x68\x65\x72\x65"),
+			"0xB617318655057264E28BC0B6FB378C8EF146BE00",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61"
+				   "\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20"
+				   "\x6e\x6f\x74\x68\x69\x6e\x67\x3f"),
+			"0xEFFCDF6AE5EB2FA2D27416D5F184DF9C259A7C79",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"),
+			"0x125D7342B9AC11CD91A39AF48AA17B4F63F175D3",
+			1
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"),
+			"0x4C9007F4026250C6BC8414F9BF50C86C2D7235DA",
+			1
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test With Truncation"),
+			"0x4C1A03424B55E07FE7F27BE1",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key - "
+				   "Hash Key First"),
+			"0xAA4AE5E15272D00E95705637CE8A3B55ED402112", 1 },
+		/* Test 7 */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key and "
+				   "Larger Than One Block-Size Data"),
+			"0xE8E99D0F45237D786D6BBAA7965C7808BBFF1A91",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	hash_test_key_t test_keys[] = {
+		/* Key 1 */
+		{ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+		  "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", 20 },
+		/* Key 2 */
+		{ "Jefe", 4 },
+		/* Key 3 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 20 },
+		/* Key 4 */
+		{ "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a"
+		  "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
+		  "\x15\x16\x17\x18\x19", 25 },
+#if 0
+		/* Key 5 */
+		{ "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c"
+		  "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c", 20 },
+#endif
+		/* Key 6 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 80 },
+		/* Key 7 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 80 },
+		{ "", 0 }
+	};
+
+	hash_test_key_t *test_key = test_keys;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		memcpy(buffer, test_key->key, test_key->len);
+		isc_hmacsha1_init(&hmacsha1, buffer, test_key->len);
+		isc_hmacsha1_update(&hmacsha1,
+				    (const isc_uint8_t *) testcase->input,
+				    testcase->input_len);
+		isc_hmacsha1_sign(&hmacsha1, digest, ISC_SHA1_DIGESTLENGTH);
+		tohexstr(digest, ISC_SHA1_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+		test_key++;
+	}
+}
+
+/* HMAC-SHA224 test */
+ATF_TC(isc_hmacsha224);
+ATF_TC_HEAD(isc_hmacsha224, tc) {
+	atf_tc_set_md_var(tc, "descr", "HMAC-SHA224 examples from RFC4634");
+}
+ATF_TC_BODY(isc_hmacsha224, tc) {
+	isc_hmacsha224_t hmacsha224;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("\x48\x69\x20\x54\x68\x65\x72\x65"),
+			"0x896FB1128ABBDF196832107CD49DF33F47B4B1169912BA"
+				"4F53684B22",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61"
+				   "\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20"
+				   "\x6e\x6f\x74\x68\x69\x6e\x67\x3f"),
+			"0xA30E01098BC6DBBF45690F3A7E9E6D0F8BBEA2A39E61480"
+				"08FD05E44",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"),
+			"0x7FB3CB3588C6C1F6FFA9694D7D6AD2649365B0C1F65D69"
+				"D1EC8333EA",
+			1
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"),
+			"0x6C11506874013CAC6A2ABC1BB382627CEC6A90D86EFC01"
+				"2DE7AFEC5A",
+			1
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test With Truncation"),
+			"0x4C1A03424B55E07FE7F27BE1",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key - "
+				   "Hash Key First"),
+			"0x95E9A0DB962095ADAEBE9B2D6F0DBCE2D499F112F2D2B7"
+				"273FA6870E",
+			1
+		},
+		/* Test 7 */
+		{
+			TEST_INPUT("\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20"
+				   "\x74\x65\x73\x74\x20\x75\x73\x69\x6e\x67"
+				   "\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20"
+				   "\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b"
+				   "\x2d\x73\x69\x7a\x65\x20\x6b\x65\x79\x20"
+				   "\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67"
+				   "\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c"
+				   "\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x64"
+				   "\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b"
+				   "\x65\x79\x20\x6e\x65\x65\x64\x73\x20\x74"
+				   "\x6f\x20\x62\x65\x20\x68\x61\x73\x68\x65"
+				   "\x64\x20\x62\x65\x66\x6f\x72\x65\x20\x62"
+				   "\x65\x69\x6e\x67\x20\x75\x73\x65\x64\x20"
+				   "\x62\x79\x20\x74\x68\x65\x20\x48\x4d\x41"
+				   "\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68"
+				   "\x6d\x2e"),
+			"0x3A854166AC5D9F023F54D517D0B39DBD946770DB9C2B95"
+				"C9F6F565D1",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	hash_test_key_t test_keys[] = {
+		/* Key 1 */
+		{ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+		  "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", 20 },
+		/* Key 2 */
+		{ "Jefe", 4 },
+		/* Key 3 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 20 },
+		/* Key 4 */
+		{ "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a"
+		  "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
+		  "\x15\x16\x17\x18\x19", 25 },
+#if 0
+		/* Key 5 */
+		{ "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c"
+		  "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c", 20 },
+#endif
+		/* Key 6 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		/* Key 7 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		{ "", 0 }
+	};
+
+	hash_test_key_t *test_key = test_keys;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		memcpy(buffer, test_key->key, test_key->len);
+		isc_hmacsha224_init(&hmacsha224, buffer, test_key->len);
+		isc_hmacsha224_update(&hmacsha224,
+				      (const isc_uint8_t *) testcase->input,
+				      testcase->input_len);
+		isc_hmacsha224_sign(&hmacsha224, digest, ISC_SHA224_DIGESTLENGTH);
+		tohexstr(digest, ISC_SHA224_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+		test_key++;
+	}
+}
+
+/* HMAC-SHA256 test */
+ATF_TC(isc_hmacsha256);
+ATF_TC_HEAD(isc_hmacsha256, tc) {
+	atf_tc_set_md_var(tc, "descr", "HMAC-SHA256 examples from RFC4634");
+}
+ATF_TC_BODY(isc_hmacsha256, tc) {
+	isc_hmacsha256_t hmacsha256;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("\x48\x69\x20\x54\x68\x65\x72\x65"),
+			"0xB0344C61D8DB38535CA8AFCEAF0BF12B881DC200C9833D"
+				"A726E9376C2E32CFF7",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61"
+				   "\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20"
+				   "\x6e\x6f\x74\x68\x69\x6e\x67\x3f"),
+			"0x5BDCC146BF60754E6A042426089575C75A003F089D2739"
+				"839DEC58B964EC3843",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"),
+			"0x773EA91E36800E46854DB8EBD09181A72959098B3EF8C1"
+				"22D9635514CED565FE",
+			1
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"),
+			"0x82558A389A443C0EA4CC819899F2083A85F0FAA3E578F8"
+				"077A2E3FF46729665B",
+			1
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test With Truncation"),
+			"0x4C1A03424B55E07FE7F27BE1",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key - "
+				   "Hash Key First"),
+			"0x60E431591EE0B67F0D8A26AACBF5B77F8E0BC6213728C5"
+				"140546040F0EE37F54",
+			1
+		},
+		/* Test 7 */
+		{
+			TEST_INPUT("\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20"
+				   "\x74\x65\x73\x74\x20\x75\x73\x69\x6e\x67"
+				   "\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20"
+				   "\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b"
+				   "\x2d\x73\x69\x7a\x65\x20\x6b\x65\x79\x20"
+				   "\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67"
+				   "\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c"
+				   "\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x64"
+				   "\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b"
+				   "\x65\x79\x20\x6e\x65\x65\x64\x73\x20\x74"
+				   "\x6f\x20\x62\x65\x20\x68\x61\x73\x68\x65"
+				   "\x64\x20\x62\x65\x66\x6f\x72\x65\x20\x62"
+				   "\x65\x69\x6e\x67\x20\x75\x73\x65\x64\x20"
+				   "\x62\x79\x20\x74\x68\x65\x20\x48\x4d\x41"
+				   "\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68"
+				   "\x6d\x2e"),
+			"0x9B09FFA71B942FCB27635FBCD5B0E944BFDC63644F0713"
+				"938A7F51535C3A35E2",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	hash_test_key_t test_keys[] = {
+		/* Key 1 */
+		{ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+		  "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", 20 },
+		/* Key 2 */
+		{ "Jefe", 4 },
+		/* Key 3 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 20 },
+		/* Key 4 */
+		{ "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a"
+		  "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
+		  "\x15\x16\x17\x18\x19", 25 },
+#if 0
+		/* Key 5 */
+		{ "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c"
+		  "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c", 20 },
+#endif
+		/* Key 6 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		/* Key 7 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		{ "", 0 }
+	};
+
+	hash_test_key_t *test_key = test_keys;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		memcpy(buffer, test_key->key, test_key->len);
+		isc_hmacsha256_init(&hmacsha256, buffer, test_key->len);
+		isc_hmacsha256_update(&hmacsha256,
+				      (const isc_uint8_t *) testcase->input,
+				      testcase->input_len);
+		isc_hmacsha256_sign(&hmacsha256, digest, ISC_SHA256_DIGESTLENGTH);
+		tohexstr(digest, ISC_SHA256_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+		test_key++;
+	}
+}
+
+/* HMAC-SHA384 test */
+ATF_TC(isc_hmacsha384);
+ATF_TC_HEAD(isc_hmacsha384, tc) {
+	atf_tc_set_md_var(tc, "descr", "HMAC-SHA384 examples from RFC4634");
+}
+ATF_TC_BODY(isc_hmacsha384, tc) {
+	isc_hmacsha384_t hmacsha384;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("\x48\x69\x20\x54\x68\x65\x72\x65"),
+			"0xAFD03944D84895626B0825F4AB46907F15F9DADBE4101E"
+				"C682AA034C7CEBC59CFAEA9EA9076EDE7F4AF152"
+				"E8B2FA9CB6",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61"
+				   "\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20"
+				   "\x6e\x6f\x74\x68\x69\x6e\x67\x3f"),
+			"0xAF45D2E376484031617F78D2B58A6B1B9C7EF464F5A01B"
+				"47E42EC3736322445E8E2240CA5E69E2C78B3239"
+				"ECFAB21649",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"),
+			"0x88062608D3E6AD8A0AA2ACE014C8A86F0AA635D947AC9F"
+				"EBE83EF4E55966144B2A5AB39DC13814B94E3AB6"
+				"E101A34F27",
+			1
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"),
+			"0x3E8A69B7783C25851933AB6290AF6CA77A998148085000"
+				"9CC5577C6E1F573B4E6801DD23C4A7D679CCF8A3"
+				"86C674CFFB",
+			1
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test With Truncation"),
+			"0x4C1A03424B55E07FE7F27BE1",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key - "
+				   "Hash Key First"),
+			"0x4ECE084485813E9088D2C63A041BC5B44F9EF1012A2B58"
+				"8F3CD11F05033AC4C60C2EF6AB4030FE8296248D"
+				"F163F44952",
+			1
+		},
+		/* Test 7 */
+		{
+			TEST_INPUT("\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20"
+				   "\x74\x65\x73\x74\x20\x75\x73\x69\x6e\x67"
+				   "\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20"
+				   "\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b"
+				   "\x2d\x73\x69\x7a\x65\x20\x6b\x65\x79\x20"
+				   "\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67"
+				   "\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c"
+				   "\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x64"
+				   "\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b"
+				   "\x65\x79\x20\x6e\x65\x65\x64\x73\x20\x74"
+				   "\x6f\x20\x62\x65\x20\x68\x61\x73\x68\x65"
+				   "\x64\x20\x62\x65\x66\x6f\x72\x65\x20\x62"
+				   "\x65\x69\x6e\x67\x20\x75\x73\x65\x64\x20"
+				   "\x62\x79\x20\x74\x68\x65\x20\x48\x4d\x41"
+				   "\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68"
+				   "\x6d\x2e"),
+			"0x6617178E941F020D351E2F254E8FD32C602420FEB0B8FB"
+				"9ADCCEBB82461E99C5A678CC31E799176D3860E6"
+				"110C46523E",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	hash_test_key_t test_keys[] = {
+		/* Key 1 */
+		{ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+		  "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", 20 },
+		/* Key 2 */
+		{ "Jefe", 4 },
+		/* Key 3 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 20 },
+		/* Key 4 */
+		{ "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a"
+		  "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
+		  "\x15\x16\x17\x18\x19", 25 },
+#if 0
+		/* Key 5 */
+		{ "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c"
+		  "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c", 20 },
+#endif
+		/* Key 6 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		/* Key 7 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		{ "", 0 }
+	};
+
+	hash_test_key_t *test_key = test_keys;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		memcpy(buffer, test_key->key, test_key->len);
+		isc_hmacsha384_init(&hmacsha384, buffer, test_key->len);
+		isc_hmacsha384_update(&hmacsha384,
+				      (const isc_uint8_t *) testcase->input,
+				      testcase->input_len);
+		isc_hmacsha384_sign(&hmacsha384, digest, ISC_SHA384_DIGESTLENGTH);
+		tohexstr(digest, ISC_SHA384_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+		test_key++;
+	}
+}
+
+/* HMAC-SHA512 test */
+ATF_TC(isc_hmacsha512);
+ATF_TC_HEAD(isc_hmacsha512, tc) {
+	atf_tc_set_md_var(tc, "descr", "HMAC-SHA512 examples from RFC4634");
+}
+ATF_TC_BODY(isc_hmacsha512, tc) {
+	isc_hmacsha512_t hmacsha512;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("\x48\x69\x20\x54\x68\x65\x72\x65"),
+			"0x87AA7CDEA5EF619D4FF0B4241A1D6CB02379F4E2CE4EC2"
+				"787AD0B30545E17CDEDAA833B7D6B8A702038B27"
+				"4EAEA3F4E4BE9D914EEB61F1702E696C203A126854",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("\x77\x68\x61\x74\x20\x64\x6f\x20\x79\x61"
+				   "\x20\x77\x61\x6e\x74\x20\x66\x6f\x72\x20"
+				   "\x6e\x6f\x74\x68\x69\x6e\x67\x3f"),
+			"0x164B7A7BFCF819E2E395FBE73B56E0A387BD64222E831F"
+				"D610270CD7EA2505549758BF75C05A994A6D034F"
+				"65F8F0E6FDCAEAB1A34D4A6B4B636E070A38BCE737",
+			1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"),
+			"0xFA73B0089D56A284EFB0F0756C890BE9B1B5DBDD8EE81A"
+				"3655F83E33B2279D39BF3E848279A722C806B485"
+				"A47E67C807B946A337BEE8942674278859E13292FB",
+			1
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"),
+			"0xB0BA465637458C6990E5A8C5F61D4AF7E576D97FF94B87"
+				"2DE76F8050361EE3DBA91CA5C11AA25EB4D67927"
+				"5CC5788063A5F19741120C4F2DE2ADEBEB10A298DD",
+			1
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test With Truncation"),
+			"0x4C1A03424B55E07FE7F27BE1",
+			1
+		},
+#endif
+		/* Test 6 */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key - "
+				   "Hash Key First"),
+			"0x80B24263C7C1A3EBB71493C1DD7BE8B49B46D1F41B4AEE"
+				"C1121B013783F8F3526B56D037E05F2598BD0FD2"
+				"215D6A1E5295E64F73F63F0AEC8B915A985D786598",
+			1
+		},
+		/* Test 7 */
+		{
+			TEST_INPUT("\x54\x68\x69\x73\x20\x69\x73\x20\x61\x20"
+				   "\x74\x65\x73\x74\x20\x75\x73\x69\x6e\x67"
+				   "\x20\x61\x20\x6c\x61\x72\x67\x65\x72\x20"
+				   "\x74\x68\x61\x6e\x20\x62\x6c\x6f\x63\x6b"
+				   "\x2d\x73\x69\x7a\x65\x20\x6b\x65\x79\x20"
+				   "\x61\x6e\x64\x20\x61\x20\x6c\x61\x72\x67"
+				   "\x65\x72\x20\x74\x68\x61\x6e\x20\x62\x6c"
+				   "\x6f\x63\x6b\x2d\x73\x69\x7a\x65\x20\x64"
+				   "\x61\x74\x61\x2e\x20\x54\x68\x65\x20\x6b"
+				   "\x65\x79\x20\x6e\x65\x65\x64\x73\x20\x74"
+				   "\x6f\x20\x62\x65\x20\x68\x61\x73\x68\x65"
+				   "\x64\x20\x62\x65\x66\x6f\x72\x65\x20\x62"
+				   "\x65\x69\x6e\x67\x20\x75\x73\x65\x64\x20"
+				   "\x62\x79\x20\x74\x68\x65\x20\x48\x4d\x41"
+				   "\x43\x20\x61\x6c\x67\x6f\x72\x69\x74\x68"
+				   "\x6d\x2e"),
+			"0xE37B6A775DC87DBAA4DFA9F96E5E3FFDDEBD71F8867289"
+				"865DF5A32D20CDC944B6022CAC3C4982B10D5EEB"
+				"55C3E4DE15134676FB6DE0446065C97440FA8C6A58",
+			1
+		},
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	hash_test_key_t test_keys[] = {
+		/* Key 1 */
+		{ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+		  "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b", 20 },
+		/* Key 2 */
+		{ "Jefe", 4 },
+		/* Key 3 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 20 },
+		/* Key 4 */
+		{ "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a"
+		  "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
+		  "\x15\x16\x17\x18\x19", 25 },
+#if 0
+		/* Key 5 */
+		{ "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c"
+		  "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c", 20 },
+#endif
+		/* Key 6 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		/* Key 7 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		{ "", 0 }
+	};
+
+	hash_test_key_t *test_key = test_keys;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		memcpy(buffer, test_key->key, test_key->len);
+		isc_hmacsha512_init(&hmacsha512, buffer, test_key->len);
+		isc_hmacsha512_update(&hmacsha512,
+				      (const isc_uint8_t *) testcase->input,
+				      testcase->input_len);
+		isc_hmacsha512_sign(&hmacsha512, digest, ISC_SHA512_DIGESTLENGTH);
+		tohexstr(digest, ISC_SHA512_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+		test_key++;
+	}
+}
+
+
+/* HMAC-MD5 Test */
+ATF_TC(isc_hmacmd5);
+ATF_TC_HEAD(isc_hmacmd5, tc) {
+	atf_tc_set_md_var(tc, "descr", "HMAC-MD5 examples from RFC2104");
+}
+ATF_TC_BODY(isc_hmacmd5, tc) {
+	isc_hmacmd5_t hmacmd5;
+
+	UNUSED(tc);
+
+	/*
+	 * These are the various test vectors.  All of these are passed
+	 * through the hash function and the results are compared to the
+	 * result specified here.
+	 */
+	hash_testcase_t testcases[] = {
+		/* Test 1 */
+		{
+			TEST_INPUT("\x48\x69\x20\x54\x68\x65\x72\x65"),
+			"0x9294727A3638BB1C13F48EF8158BFC9D",
+			1
+		},
+		/* Test 2 */
+		{
+			TEST_INPUT("\x77\x68\x61\x74\x20\x64\x6f\x20\x79"
+				   "\x61\x20\x77\x61\x6e\x74\x20\x66\x6f"
+				   "\x72\x20\x6e\x6f\x74\x68\x69\x6e\x67\x3f"),
+			"0x750C783E6AB0B503EAA86E310A5DB738", 1
+		},
+		/* Test 3 */
+		{
+			TEST_INPUT("\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"
+				   "\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD\xDD"),
+			"0x56BE34521D144C88DBB8C733F0E8B3F6",
+			1
+		},
+		/* Test 4 */
+		{
+			TEST_INPUT("\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+				   "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"),
+			"0x697EAF0ACA3A3AEA3A75164746FFAA79",
+			1
+		},
+#if 0
+		/* Test 5 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test With Truncation"),
+			"0x4C1A03424B55E07FE7F27BE1",
+			1
+		},
+		/* Test 6 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key - "
+				   "Hash Key First"),
+			"0xAA4AE5E15272D00E95705637CE8A3B55ED402112",
+			1
+		 },
+		/* Test 7 -- unimplemented optional functionality */
+		{
+			TEST_INPUT("Test Using Larger Than Block-Size Key and "
+				   "Larger Than One Block-Size Data"),
+			"0xE8E99D0F45237D786D6BBAA7965C7808BBFF1A91",
+			1
+		},
+#endif
+		{ NULL, 0, NULL, 1 }
+	};
+
+	hash_testcase_t *testcase = testcases;
+
+	hash_test_key_t test_keys[] = {
+		/* Key 1 */
+		{ "\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+		  "\x0b\x0b\x0b\x0b\x0b\x0b", 16 },
+		/* Key 2 */
+		{ "Jefe", 4 },
+		/* Key 3 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa", 16 },
+		/* Key 4 */
+		{ "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a"
+		  "\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14"
+		  "\x15\x16\x17\x18\x19", 25 },
+#if 0
+		/* Key 5 */
+		{ "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c"
+		  "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c", 20 },
+		/* Key 6 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+		/* Key 7 */
+		{ "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+		  "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa", 131 },
+#endif
+		{ "", 0 }
+	};
+
+	hash_test_key_t *test_key = test_keys;
+
+	while (testcase->input != NULL && testcase->result != NULL) {
+		memcpy(buffer, test_key->key, test_key->len);
+		isc_hmacmd5_init(&hmacmd5, buffer, test_key->len);
+		isc_hmacmd5_update(&hmacmd5,
+				   (const isc_uint8_t *) testcase->input,
+				   testcase->input_len);
+		isc_hmacmd5_sign(&hmacmd5, digest);
+		tohexstr(digest, ISC_MD5_DIGESTLENGTH, str);
+		ATF_CHECK_STREQ(str, testcase->result);
+
+		testcase++;
+		test_key++;
+	}
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, isc_hmacmd5);
+	ATF_TP_ADD_TC(tp, isc_hmacsha1);
+	ATF_TP_ADD_TC(tp, isc_hmacsha224);
+	ATF_TP_ADD_TC(tp, isc_hmacsha256);
+	ATF_TP_ADD_TC(tp, isc_hmacsha384);
+	ATF_TP_ADD_TC(tp, isc_hmacsha512);
+	ATF_TP_ADD_TC(tp, isc_md5);
+	ATF_TP_ADD_TC(tp, isc_sha1);
+	ATF_TP_ADD_TC(tp, isc_sha224);
+	ATF_TP_ADD_TC(tp, isc_sha256);
+	ATF_TP_ADD_TC(tp, isc_sha384);
+	ATF_TP_ADD_TC(tp, isc_sha512);
+	return (atf_no_error());
+}
+
diff --git a/lib/isc/tests/isctest.c b/lib/isc/tests/isctest.c
index 311987ef..b512492b 100644
--- a/lib/isc/tests/isctest.c
+++ b/lib/isc/tests/isctest.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: isctest.c,v 1.2.8.2 2011-07-09 01:57:05 each Exp $ */
+/* $Id: isctest.c,v 1.3 2011-07-28 04:04:37 each Exp $ */
 
 /*! \file */
 
@@ -26,7 +26,10 @@
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/os.h>
+#include <isc/socket.h>
 #include <isc/string.h>
+#include <isc/task.h>
+#include <isc/timer.h>
 #include <isc/util.h>
 
 #include "isctest.h"
@@ -35,6 +38,8 @@ isc_mem_t *mctx = NULL;
 isc_entropy_t *ectx = NULL;
 isc_log_t *lctx = NULL;
 isc_taskmgr_t *taskmgr = NULL;
+isc_timermgr_t *timermgr = NULL;
+isc_socketmgr_t *socketmgr = NULL;
 int ncpus;
 
 static isc_boolean_t hash_active = ISC_FALSE;
@@ -54,8 +59,37 @@ static isc_logcategory_t categories[] = {
 		{ NULL,              0 }
 };
 
+static void
+cleanup_managers() {
+	if (socketmgr != NULL)
+		isc_socketmgr_destroy(&socketmgr);
+	if (taskmgr != NULL)
+		isc_taskmgr_destroy(&taskmgr);
+	if (timermgr != NULL)
+		isc_timermgr_destroy(&timermgr);
+}
+
+static isc_result_t
+create_managers() {
+	isc_result_t result;
+#ifdef ISC_PLATFORM_USETHREADS
+	ncpus = isc_os_ncpus();
+#else
+	ncpus = 1;
+#endif
+
+	CHECK(isc_taskmgr_create(mctx, ncpus, 0, &taskmgr));
+	CHECK(isc_timermgr_create(mctx, &timermgr));
+	CHECK(isc_socketmgr_create(mctx, &socketmgr));
+	return (ISC_R_SUCCESS);
+
+  cleanup:
+	cleanup_managers();
+	return (result);
+}
+
 isc_result_t
-isc_test_begin(FILE *logfile) {
+isc_test_begin(FILE *logfile, isc_boolean_t start_managers) {
 	isc_result_t result;
 
 	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
@@ -90,7 +124,8 @@ isc_test_begin(FILE *logfile) {
 	ncpus = 1;
 #endif
 
-	CHECK(isc_taskmgr_create(mctx, ncpus, 0, &taskmgr));
+	if (start_managers)
+		CHECK(create_managers());
 
 	return (ISC_R_SUCCESS);
 
@@ -111,6 +146,9 @@ isc_test_end() {
 	}
 	if (ectx != NULL)
 		isc_entropy_detach(&ectx);
+
+	cleanup_managers();
+
 	if (mctx != NULL)
 		isc_mem_destroy(&mctx);
 }
diff --git a/lib/isc/tests/isctest.h b/lib/isc/tests/isctest.h
index 5ff6b044..1d6d9645 100644
--- a/lib/isc/tests/isctest.h
+++ b/lib/isc/tests/isctest.h
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: isctest.h,v 1.2.8.2 2011-07-09 01:57:06 each Exp $ */
+/* $Id: isctest.h,v 1.3 2011-07-28 04:04:37 each Exp $ */
 
 /*! \file */
 
@@ -42,10 +42,12 @@ extern isc_mem_t *mctx;
 extern isc_entropy_t *ectx;
 extern isc_log_t *lctx;
 extern isc_taskmgr_t *taskmgr;
+isc_timermgr_t *timermgr;
+isc_socketmgr_t *socketmgr;
 extern int ncpus;
 
 isc_result_t
-isc_test_begin(FILE *logfile);
+isc_test_begin(FILE *logfile, isc_boolean_t start_managers);
 
 void
 isc_test_end(void);
diff --git a/lib/isc/tests/socket_test.c b/lib/isc/tests/socket_test.c
new file mode 100644
index 00000000..c6f8d4b1
--- /dev/null
+++ b/lib/isc/tests/socket_test.c
@@ -0,0 +1,274 @@
+/*
+ * Copyright (C) 2011  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id: socket_test.c,v 1.3 2011-07-28 23:47:59 tbox Exp $ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <atf-c.h>
+
+#include <unistd.h>
+#include <time.h>
+
+#include <isc/socket.h>
+
+#include "../task_p.h"
+#include "isctest.h"
+
+/*
+ * Helper functions
+ */
+typedef struct {
+	isc_boolean_t done;
+	isc_result_t result;
+} completion_t;
+
+static void
+completion_init(completion_t *completion) {
+	completion->done = ISC_FALSE;
+}
+
+static void
+event_done(isc_task_t *task, isc_event_t *event) {
+	isc_socketevent_t *dev;
+	completion_t *completion = event->ev_arg;
+
+	UNUSED(task);
+
+	dev = (isc_socketevent_t *) event;
+	completion->result = dev->result;
+	completion->done = ISC_TRUE;
+	isc_event_free(&event);
+}
+
+static void
+nap(isc_uint32_t usec) {
+#ifdef HAVE_NANOSLEEP
+	struct timespec ts;
+
+	ts.tv_sec = usec / 1000000;
+	ts.tv_nsec = (usec % 1000000) * 1000;
+	nanosleep(&ts, NULL);
+#elif HAVE_USLEEP
+	usleep(usec);
+#else
+	/* Round up to the nearest second and sleep, instead */
+	sleep((usec / 1000000) + 1);
+#endif
+}
+
+static isc_result_t
+waitfor(completion_t *completion) {
+	int i = 0;
+	while (!completion->done && i++ < 5000) {
+#ifndef ISC_PLATFORM_USETHREADS
+		while (isc__taskmgr_ready(taskmgr))
+			isc__taskmgr_dispatch(taskmgr);
+#endif
+		nap(1000);
+	}
+	if (completion->done)
+		return (ISC_R_SUCCESS);
+	return (ISC_R_FAILURE);
+}
+
+/*
+ * Individual unit tests
+ */
+
+/* Test UDP sendto/recv (IPv4) */
+ATF_TC(udp_sendto);
+ATF_TC_HEAD(udp_sendto, tc) {
+	atf_tc_set_md_var(tc, "descr", "UDP sendto/recv");
+}
+ATF_TC_BODY(udp_sendto, tc) {
+	isc_result_t result;
+	isc_sockaddr_t addr1, addr2;
+	struct in_addr in;
+	isc_socket_t *s1 = NULL, *s2 = NULL;
+	isc_task_t *task = NULL;
+	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
+	completion_t completion;
+	isc_region_t r;
+
+	UNUSED(tc);
+
+	result = isc_test_begin(NULL, ISC_TRUE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	/*
+	 * Create two sockets: 127.0.0.1/5444 and 127.0.0.1/5445, talking to
+	 * each other.
+	 */
+	in.s_addr = inet_addr("127.0.0.1");
+	isc_sockaddr_fromin(&addr1, &in, 5444);
+	isc_sockaddr_fromin(&addr2, &in, 5445);
+
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	result = isc_socket_bind(s1, &addr1, ISC_SOCKET_REUSEADDRESS);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	result = isc_socket_bind(s2, &addr2, ISC_SOCKET_REUSEADDRESS);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = isc_task_create(taskmgr, 0, &task);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	strcpy(sendbuf, "Hello");
+	r.base = (void *) sendbuf;
+	r.length = strlen(sendbuf) + 1;
+
+	completion_init(&completion);
+	result = isc_socket_sendto(s1, &r, task, event_done, &completion,
+				   &addr2, NULL);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	waitfor(&completion);
+	ATF_CHECK(completion.done);
+	ATF_CHECK_EQ(completion.result, ISC_R_SUCCESS);
+
+	r.base = (void *) recvbuf;
+	r.length = BUFSIZ;
+	completion_init(&completion);
+	result = isc_socket_recv(s2, &r, 1, task, event_done, &completion);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	waitfor(&completion);
+	ATF_CHECK(completion.done);
+	ATF_CHECK_EQ(completion.result, ISC_R_SUCCESS);
+	ATF_CHECK_STREQ(recvbuf, "Hello");
+
+	isc_task_detach(&task);
+
+	isc_socket_detach(&s1);
+	isc_socket_detach(&s2);
+
+	isc_test_end();
+}
+
+/* Test UDP sendto/recv with duplicated socket */
+ATF_TC(udp_dup);
+ATF_TC_HEAD(udp_dup, tc) {
+	atf_tc_set_md_var(tc, "descr", "duplicated socket sendto/recv");
+}
+ATF_TC_BODY(udp_dup, tc) {
+	isc_result_t result;
+	isc_sockaddr_t addr1, addr2;
+	struct in_addr in;
+	isc_socket_t *s1 = NULL, *s2 = NULL, *s3 = NULL;
+	isc_task_t *task = NULL;
+	char sendbuf[BUFSIZ], recvbuf[BUFSIZ];
+	completion_t completion;
+	isc_region_t r;
+
+	UNUSED(tc);
+
+	result = isc_test_begin(NULL, ISC_TRUE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	/*
+	 * Create two sockets: 127.0.0.1/5444 and 127.0.0.1/5445, talking to
+	 * each other.
+	 */
+	in.s_addr = inet_addr("127.0.0.1");
+	isc_sockaddr_fromin(&addr1, &in, 5444);
+	isc_sockaddr_fromin(&addr2, &in, 5445);
+
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s1);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	result = isc_socket_bind(s1, &addr1, ISC_SOCKET_REUSEADDRESS);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = isc_socket_create(socketmgr, PF_INET, isc_sockettype_udp, &s2);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	result = isc_socket_dup(s2, &s3);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = isc_socket_bind(s2, &addr2, ISC_SOCKET_REUSEADDRESS);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+	result = isc_socket_bind(s3, &addr2, ISC_SOCKET_REUSEADDRESS);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = isc_task_create(taskmgr, 0, &task);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	strcpy(sendbuf, "Hello");
+	r.base = (void *) sendbuf;
+	r.length = strlen(sendbuf) + 1;
+
+	completion_init(&completion);
+	result = isc_socket_sendto(s1, &r, task, event_done, &completion,
+				   &addr2, NULL);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	waitfor(&completion);
+	ATF_CHECK(completion.done);
+	ATF_CHECK_EQ(completion.result, ISC_R_SUCCESS);
+
+	strcpy(sendbuf, "World");
+	r.base = (void *) sendbuf;
+	r.length = strlen(sendbuf) + 1;
+
+	completion_init(&completion);
+	result = isc_socket_sendto(s1, &r, task, event_done, &completion,
+				   &addr2, NULL);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	waitfor(&completion);
+	ATF_CHECK(completion.done);
+	ATF_CHECK_EQ(completion.result, ISC_R_SUCCESS);
+
+	r.base = (void *) recvbuf;
+	r.length = BUFSIZ;
+	completion_init(&completion);
+	result = isc_socket_recv(s2, &r, 1, task, event_done, &completion);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	waitfor(&completion);
+	ATF_CHECK(completion.done);
+	ATF_CHECK_EQ(completion.result, ISC_R_SUCCESS);
+	ATF_CHECK_STREQ(recvbuf, "Hello");
+
+	r.base = (void *) recvbuf;
+	r.length = BUFSIZ;
+	completion_init(&completion);
+	result = isc_socket_recv(s3, &r, 1, task, event_done, &completion);
+	ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	waitfor(&completion);
+	ATF_CHECK(completion.done);
+	ATF_CHECK_EQ(completion.result, ISC_R_SUCCESS);
+	ATF_CHECK_STREQ(recvbuf, "World");
+
+	isc_task_detach(&task);
+
+	isc_socket_detach(&s1);
+	isc_socket_detach(&s2);
+	isc_socket_detach(&s3);
+
+	isc_test_end();
+}
+
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, udp_sendto);
+	ATF_TP_ADD_TC(tp, udp_dup);
+
+	return (atf_no_error());
+}
+
diff --git a/lib/isc/tests/taskpool_test.c b/lib/isc/tests/taskpool_test.c
index a269b7e5..a582afdf 100644
--- a/lib/isc/tests/taskpool_test.c
+++ b/lib/isc/tests/taskpool_test.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: taskpool_test.c,v 1.2.8.2 2011-07-09 01:57:06 each Exp $ */
+/* $Id: taskpool_test.c,v 1.3 2011-07-28 04:04:37 each Exp $ */
 
 /*! \file */
 
@@ -44,7 +44,7 @@ ATF_TC_BODY(create_pool, tc) {
 
 	UNUSED(tc);
 
-	result = isc_test_begin(NULL);
+	result = isc_test_begin(NULL, ISC_TRUE);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_taskpool_create(taskmgr, mctx, 8, 2, &pool);
@@ -68,7 +68,7 @@ ATF_TC_BODY(expand_pool, tc) {
 
 	UNUSED(tc);
 
-	result = isc_test_begin(NULL);
+	result = isc_test_begin(NULL, ISC_TRUE);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_taskpool_create(taskmgr, mctx, 10, 2, &pool1);
@@ -121,7 +121,7 @@ ATF_TC_BODY(get_tasks, tc) {
 
 	UNUSED(tc);
 
-	result = isc_test_begin(NULL);
+	result = isc_test_begin(NULL, ISC_TRUE);
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_taskpool_create(taskmgr, mctx, 2, 2, &pool);
diff --git a/lib/isc/timer.c b/lib/isc/timer.c
index 71473fb9..22a00e1f 100644
--- a/lib/isc/timer.c
+++ b/lib/isc/timer.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: timer.c,v 1.95.302.3 2011-03-11 06:47:08 marka Exp $ */
+/* $Id: timer.c,v 1.98 2011-03-11 06:11:26 marka Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/unix/dir.c b/lib/isc/unix/dir.c
index e670f03e..d8958594 100644
--- a/lib/isc/unix/dir.c
+++ b/lib/isc/unix/dir.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dir.c,v 1.29.404.2 2011-03-12 04:59:19 tbox Exp $ */
+/* $Id: dir.c,v 1.31 2011-03-12 04:59:49 tbox Exp $ */
 
 /*! \file
  * \author  Principal Authors: DCL */
diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index 3e4d3e01..aed3642b 100644
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -48,7 +48,7 @@
  * SUCH DAMAGE.
  */
 
-/* $Id: file.c,v 1.57.10.1 2011-03-04 14:10:13 smann Exp $ */
+/* $Id: file.c,v 1.58 2011-03-04 14:07:03 smann Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/unix/include/isc/stdtime.h b/lib/isc/unix/include/isc/stdtime.h
index cadb3820..e24f942c 100644
--- a/lib/isc/unix/include/isc/stdtime.h
+++ b/lib/isc/unix/include/isc/stdtime.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdtime.h,v 1.14.814.2 2011-03-18 23:47:15 tbox Exp $ */
+/* $Id: stdtime.h,v 1.16 2011-03-18 23:47:36 tbox Exp $ */
 
 #ifndef ISC_STDTIME_H
 #define ISC_STDTIME_H 1
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index c9aa454d..54a6d256 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.333.14.9 2011-07-29 02:19:20 marka Exp $ */
+/* $Id: socket.c,v 1.346 2011-08-24 23:17:52 marka Exp $ */
 
 /*! \file */
 
@@ -334,7 +334,8 @@ struct isc__socket {
 				listener : 1, /* listener socket */
 				connected : 1,
 				connecting : 1, /* connect pending */
-				bound : 1; /* bound to local addr */
+				bound : 1, /* bound to local addr */
+				dupped : 1;
 
 #ifdef ISC_NET_RECVOVERFLOW
 	unsigned char		overflow; /* used for MSG_TRUNC fake */
@@ -428,6 +429,10 @@ static isc__socketmgr_t *socketmgr = NULL;
 # define MAXSCATTERGATHER_RECV	(ISC_SOCKET_MAXSCATTERGATHER)
 #endif
 
+static isc_result_t socket_create(isc_socketmgr_t *manager0, int pf,
+				  isc_sockettype_t type,
+				  isc_socket_t **socketp,
+				  isc_socket_t *dup_socket);
 static void send_recvdone_event(isc__socket_t *, isc_socketevent_t **);
 static void send_senddone_event(isc__socket_t *, isc_socketevent_t **);
 static void free_socket(isc__socket_t **);
@@ -546,6 +551,10 @@ isc__socket_fdwatchcreate(isc_socketmgr_t *manager, int fd, int flags,
 			  isc_task_t *task, isc_socket_t **socketp);
 ISC_SOCKETFUNC_SCOPE isc_result_t
 isc__socket_fdwatchpoke(isc_socket_t *sock, int flags);
+ISC_SOCKETFUNC_SCOPE isc_result_t
+isc__socket_dup(isc_socket_t *sock, isc_socket_t **socketp);
+ISC_SOCKETFUNC_SCOPE int
+isc__socket_getfd(isc_socket_t *sock);
 
 static struct {
 	isc_socketmethods_t methods;
@@ -569,7 +578,9 @@ static struct {
 		isc__socket_getsockname,
 		isc__socket_gettype,
 		isc__socket_ipv6only,
-		isc__socket_fdwatchpoke
+		isc__socket_fdwatchpoke,
+		isc__socket_dup,
+		isc__socket_getfd
 	}
 #ifndef BIND9
 	,
@@ -2046,6 +2057,7 @@ allocate_socket(isc__socketmgr_t *manager, isc_sockettype_t type,
 	sock->manager = manager;
 	sock->type = type;
 	sock->fd = -1;
+	sock->dupped = 0;
 	sock->statsindex = NULL;
 
 	ISC_LINK_INIT(sock, link);
@@ -2222,7 +2234,8 @@ clear_bsdcompat(void) {
 #endif
 
 static isc_result_t
-opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
+opensocket(isc__socketmgr_t *manager, isc__socket_t *sock,
+	   isc__socket_t *dup_socket) {
 	char strbuf[ISC_STRERRORSIZE];
 	const char *err = "socket";
 	int tries = 0;
@@ -2235,22 +2248,28 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
 #endif
 
  again:
-	switch (sock->type) {
-	case isc_sockettype_udp:
-		sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP);
-		break;
-	case isc_sockettype_tcp:
-		sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP);
-		break;
-	case isc_sockettype_unix:
-		sock->fd = socket(sock->pf, SOCK_STREAM, 0);
-		break;
-	case isc_sockettype_fdwatch:
-		/*
-		 * We should not be called for isc_sockettype_fdwatch sockets.
-		 */
-		INSIST(0);
-		break;
+	if (dup_socket == NULL) {
+		switch (sock->type) {
+		case isc_sockettype_udp:
+			sock->fd = socket(sock->pf, SOCK_DGRAM, IPPROTO_UDP);
+			break;
+		case isc_sockettype_tcp:
+			sock->fd = socket(sock->pf, SOCK_STREAM, IPPROTO_TCP);
+			break;
+		case isc_sockettype_unix:
+			sock->fd = socket(sock->pf, SOCK_STREAM, 0);
+			break;
+		case isc_sockettype_fdwatch:
+			/*
+			 * We should not be called for isc_sockettype_fdwatch
+			 * sockets.
+			 */
+			INSIST(0);
+			break;
+		}
+	} else {
+		sock->fd = dup(dup_socket->fd);
+		sock->dupped = 1;
 	}
 	if (sock->fd == -1 && errno == EINTR && tries++ < 42)
 		goto again;
@@ -2327,6 +2346,9 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
 		}
 	}
 
+	if (dup_socket != NULL)
+		goto setup_done;
+
 	if (make_nonblock(sock->fd) != ISC_R_SUCCESS) {
 		(void)close(sock->fd);
 		return (ISC_R_UNEXPECTED);
@@ -2511,20 +2533,21 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock) {
 	}
 #endif /* defined(USE_CMSG) || defined(SO_RCVBUF) */
 
+setup_done:
 	inc_stats(manager->stats, sock->statsindex[STATID_OPEN]);
 
 	return (ISC_R_SUCCESS);
 }
 
-/*%
- * Create a new 'type' socket managed by 'manager'.  Events
- * will be posted to 'task' and when dispatched 'action' will be
- * called with 'arg' as the arg value.  The new socket is returned
- * in 'socketp'.
+/*
+ * Create a 'type' socket or duplicate an existing socket, managed
+ * by 'manager'.  Events will be posted to 'task' and when dispatched
+ * 'action' will be called with 'arg' as the arg value.  The new
+ * socket is returned in 'socketp'.
  */
-ISC_SOCKETFUNC_SCOPE isc_result_t
-isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
-		   isc_socket_t **socketp)
+static isc_result_t
+socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
+	      isc_socket_t **socketp, isc_socket_t *dup_socket)
 {
 	isc__socket_t *sock = NULL;
 	isc__socketmgr_t *manager = (isc__socketmgr_t *)manager0;
@@ -2556,7 +2579,8 @@ isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
 	}
 
 	sock->pf = pf;
-	result = opensocket(manager, sock);
+
+	result = opensocket(manager, sock, (isc__socket_t *)dup_socket);
 	if (result != ISC_R_SUCCESS) {
 		inc_stats(manager->stats, sock->statsindex[STATID_OPENFAIL]);
 		free_socket(&sock);
@@ -2591,11 +2615,40 @@ isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
 	UNLOCK(&manager->lock);
 
 	socket_log(sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET,
-		   ISC_MSG_CREATED, "created");
+		   ISC_MSG_CREATED, dup_socket == NULL ? "dupped" : "created");
 
 	return (ISC_R_SUCCESS);
 }
 
+/*%
+ * Create a new 'type' socket managed by 'manager'.  Events
+ * will be posted to 'task' and when dispatched 'action' will be
+ * called with 'arg' as the arg value.  The new socket is returned
+ * in 'socketp'.
+ */
+ISC_SOCKETFUNC_SCOPE isc_result_t
+isc__socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
+		   isc_socket_t **socketp)
+{
+	return (socket_create(manager0, pf, type, socketp, NULL));
+}
+
+/*%
+ * Duplicate an existing socket.  The new socket is returned
+ * in 'socketp'.
+ */
+ISC_SOCKETFUNC_SCOPE isc_result_t
+isc__socket_dup(isc_socket_t *sock0, isc_socket_t **socketp) {
+	isc__socket_t *sock = (isc__socket_t *)sock0;
+
+	REQUIRE(VALID_SOCKET(sock));
+	REQUIRE(socketp != NULL && *socketp == NULL);
+
+	return (socket_create((isc_socketmgr_t *) sock->manager,
+			      sock->pf, sock->type, socketp,
+			      sock0));
+}
+
 #ifdef BIND9
 ISC_SOCKETFUNC_SCOPE isc_result_t
 isc__socket_open(isc_socket_t *sock0) {
@@ -2614,7 +2667,7 @@ isc__socket_open(isc_socket_t *sock0) {
 	 */
 	REQUIRE(sock->fd == -1);
 
-	result = opensocket(sock->manager, sock);
+	result = opensocket(sock->manager, sock, NULL);
 	if (result != ISC_R_SUCCESS)
 		sock->fd = -1;
 
@@ -2794,6 +2847,7 @@ isc__socket_close(isc_socket_t *sock0) {
 	int fd;
 	isc__socketmgr_t *manager;
 
+	fflush(stdout);
 	REQUIRE(VALID_SOCKET(sock));
 
 	LOCK(&sock->lock);
@@ -2814,6 +2868,7 @@ isc__socket_close(isc_socket_t *sock0) {
 	manager = sock->manager;
 	fd = sock->fd;
 	sock->fd = -1;
+	sock->dupped = 0;
 	memset(sock->name, 0, sizeof(sock->name));
 	sock->tag = NULL;
 	sock->listener = 0;
@@ -4976,48 +5031,49 @@ isc__socket_bind(isc_socket_t *sock0, isc_sockaddr_t *sockaddr,
 		UNLOCK(&sock->lock);
 		return (ISC_R_FAMILYMISMATCH);
 	}
-	/*
-	 * Only set SO_REUSEADDR when we want a specific port.
-	 */
+	if (!sock->dupped) {
+		/*
+		 * Only set SO_REUSEADDR when we want a specific port.
+		 */
 #ifdef AF_UNIX
-	if (sock->pf == AF_UNIX)
-		goto bind_socket;
+		if (sock->pf == AF_UNIX)
+			goto bind_socket;
 #endif
-	if ((options & ISC_SOCKET_REUSEADDRESS) != 0 &&
-	    isc_sockaddr_getport(sockaddr) != (in_port_t)0 &&
-	    setsockopt(sock->fd, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
-		       sizeof(on)) < 0) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "setsockopt(%d) %s", sock->fd,
-				 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
-						ISC_MSG_FAILED, "failed"));
-		/* Press on... */
-	}
+		if ((options & ISC_SOCKET_REUSEADDRESS) != 0 &&
+		    isc_sockaddr_getport(sockaddr) != (in_port_t)0 &&
+		    setsockopt(sock->fd, SOL_SOCKET, SO_REUSEADDR, (void *)&on,
+			       sizeof(on)) < 0) {
+			UNEXPECTED_ERROR(__FILE__, __LINE__,
+					 "setsockopt(%d) %s", sock->fd,
+					 isc_msgcat_get(isc_msgcat, ISC_MSGSET_GENERAL,
+							ISC_MSG_FAILED, "failed"));
+			/* Press on... */
+		}
 #ifdef AF_UNIX
- bind_socket:
+	 bind_socket:
 #endif
-	if (bind(sock->fd, &sockaddr->type.sa, sockaddr->length) < 0) {
-		inc_stats(sock->manager->stats,
-			  sock->statsindex[STATID_BINDFAIL]);
+		if (bind(sock->fd, &sockaddr->type.sa, sockaddr->length) < 0) {
+			inc_stats(sock->manager->stats,
+				  sock->statsindex[STATID_BINDFAIL]);
 
-		UNLOCK(&sock->lock);
-		switch (errno) {
-		case EACCES:
-			return (ISC_R_NOPERM);
-		case EADDRNOTAVAIL:
-			return (ISC_R_ADDRNOTAVAIL);
-		case EADDRINUSE:
-			return (ISC_R_ADDRINUSE);
-		case EINVAL:
-			return (ISC_R_BOUND);
-		default:
-			isc__strerror(errno, strbuf, sizeof(strbuf));
-			UNEXPECTED_ERROR(__FILE__, __LINE__, "bind: %s",
-					 strbuf);
-			return (ISC_R_UNEXPECTED);
+			UNLOCK(&sock->lock);
+			switch (errno) {
+			case EACCES:
+				return (ISC_R_NOPERM);
+			case EADDRNOTAVAIL:
+				return (ISC_R_ADDRNOTAVAIL);
+			case EADDRINUSE:
+				return (ISC_R_ADDRINUSE);
+			case EINVAL:
+				return (ISC_R_BOUND);
+			default:
+				isc__strerror(errno, strbuf, sizeof(strbuf));
+				UNEXPECTED_ERROR(__FILE__, __LINE__, "bind: %s",
+						 strbuf);
+				return (ISC_R_UNEXPECTED);
+			}
 		}
 	}
-
 	socket_log(sock, sockaddr, TRACE,
 		   isc_msgcat, ISC_MSGSET_SOCKET, ISC_MSG_BOUND, "bound");
 	sock->bound = 1;
@@ -5826,6 +5882,13 @@ isc__socket_register() {
 }
 #endif
 
+ISC_SOCKETFUNC_SCOPE int
+isc__socket_getfd(isc_socket_t *socket0) {
+	isc__socket_t *socket = (isc__socket_t *)socket0;
+
+	return ((short) socket->fd);
+}
+
 #if defined(HAVE_LIBXML2) && defined(BIND9)
 
 static const char *
diff --git a/lib/isc/unix/stdio.c b/lib/isc/unix/stdio.c
index 9221d2a0..c7aa5f42 100644
--- a/lib/isc/unix/stdio.c
+++ b/lib/isc/unix/stdio.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdio.c,v 1.8.814.2 2011-03-05 23:52:09 tbox Exp $ */
+/* $Id: stdio.c,v 1.10 2011-03-05 23:52:31 tbox Exp $ */
 
 #include <config.h>
 
diff --git a/lib/isc/unix/time.c b/lib/isc/unix/time.c
index 8d1d9fa2..32e6e1d5 100644
--- a/lib/isc/unix/time.c
+++ b/lib/isc/unix/time.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: time.c,v 1.56.608.2 2011-03-12 04:59:19 tbox Exp $ */
+/* $Id: time.c,v 1.58 2011-03-12 04:59:49 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/isc/win32/dir.c b/lib/isc/win32/dir.c
index a9fb424a..57e77b94 100644
--- a/lib/isc/win32/dir.c
+++ b/lib/isc/win32/dir.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dir.c,v 1.18.424.2 2011-03-12 04:59:19 tbox Exp $ */
+/* $Id: dir.c,v 1.20 2011-03-12 04:59:49 tbox Exp $ */
 
 /* Principal Authors: DCL */
 
diff --git a/lib/isc/win32/file.c b/lib/isc/win32/file.c
index 344a34d6..5e7506de 100644
--- a/lib/isc/win32/file.c
+++ b/lib/isc/win32/file.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: file.c,v 1.39.8.1 2011-03-04 14:10:13 smann Exp $ */
+/* $Id: file.c,v 1.40 2011-03-04 14:07:03 smann Exp $ */
 
 #include <config.h>
 
diff --git a/lib/isc/win32/include/isc/ipv6.h b/lib/isc/win32/include/isc/ipv6.h
index 5172020d..58c54e08 100644
--- a/lib/isc/win32/include/isc/ipv6.h
+++ b/lib/isc/win32/include/isc/ipv6.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: ipv6.h,v 1.19.814.2 2011-02-28 01:20:04 tbox Exp $ */
+/* $Id: ipv6.h,v 1.21 2011-02-03 12:18:12 tbox Exp $ */
 
 #ifndef ISC_IPV6_H
 #define ISC_IPV6_H 1
diff --git a/lib/isc/win32/include/isc/stdtime.h b/lib/isc/win32/include/isc/stdtime.h
index 0d7482c7..6b87ef9b 100644
--- a/lib/isc/win32/include/isc/stdtime.h
+++ b/lib/isc/win32/include/isc/stdtime.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: stdtime.h,v 1.12.814.2 2011-03-18 23:47:15 tbox Exp $ */
+/* $Id: stdtime.h,v 1.14 2011-03-18 23:47:36 tbox Exp $ */
 
 #ifndef ISC_STDTIME_H
 #define ISC_STDTIME_H 1
diff --git a/lib/isc/win32/libisc.def b/lib/isc/win32/libisc.def
index 740f3cef..226e0142 100644
--- a/lib/isc/win32/libisc.def
+++ b/lib/isc/win32/libisc.def
@@ -88,7 +88,9 @@ isc__socket_close
 isc__socket_connect
 isc__socket_create
 isc__socket_detach
+isc__socket_dup
 isc__socket_filter
+isc__socket_getfd
 isc__socket_getname
 isc__socket_getpeername
 isc__socket_getsockname
diff --git a/lib/isc/win32/socket.c b/lib/isc/win32/socket.c
index 05564975..1484d3e4 100644
--- a/lib/isc/win32/socket.c
+++ b/lib/isc/win32/socket.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.87.22.2 2011-07-28 23:47:16 tbox Exp $ */
+/* $Id: socket.c,v 1.92 2011-08-23 18:24:33 each Exp $ */
 
 /* This code uses functions which are only available on Server 2003 and
  * higher, and Windows XP and higher.
@@ -265,7 +265,8 @@ struct isc_socket {
 	unsigned int		listener : 1,	/* listener socket */
 				connected : 1,
 				pending_connect : 1, /* connect pending */
-				bound : 1;	/* bound to local addr */
+				bound : 1,	/* bound to local addr */
+				dupped : 1;     /* created by isc_socket_dup() */
 	unsigned int		pending_iocp;	/* Should equal the counters below. Debug. */
 	unsigned int		pending_recv;  /* Number of outstanding recv() calls. */
 	unsigned int		pending_send;  /* Number of outstanding send() calls. */
@@ -351,6 +352,10 @@ enum {
 #define MAXSCATTERGATHER_SEND	(ISC_SOCKET_MAXSCATTERGATHER)
 #define MAXSCATTERGATHER_RECV	(ISC_SOCKET_MAXSCATTERGATHER)
 
+static isc_result_t socket_create(isc_socketmgr_t *manager0, int pf,
+				  isc_sockettype_t type,
+				  isc_socket_t **socketp,
+				  isc_socket_t *dup_socket);
 static isc_threadresult_t WINAPI SocketIoThread(LPVOID ThreadContext);
 static void maybe_free_socket(isc_socket_t **, int);
 static void free_socket(isc_socket_t **, int);
@@ -1461,6 +1466,7 @@ allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
 	sock->connected = 0;
 	sock->pending_connect = 0;
 	sock->bound = 0;
+	sock->dupped = 0;
 	memset(sock->name, 0, sizeof(sock->name));	// zero the name field
 	_set_state(sock, SOCK_INITIALIZED);
 
@@ -1623,9 +1629,10 @@ free_socket(isc_socket_t **sockp, int lineno) {
  * called with 'arg' as the arg value.  The new socket is returned
  * in 'socketp'.
  */
-isc_result_t
-isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
-		  isc_socket_t **socketp) {
+static isc_result_t
+socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
+	      isc_socket_t **socketp, isc_socket_t *dup_socket)
+{
 	isc_socket_t *sock = NULL;
 	isc_result_t result;
 #if defined(USE_CMSG)
@@ -1647,27 +1654,40 @@ isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 		return (result);
 
 	sock->pf = pf;
-	switch (type) {
-	case isc_sockettype_udp:
-		sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP);
-		if (sock->fd != INVALID_SOCKET) {
-			result = connection_reset_fix(sock->fd);
-			if (result != ISC_R_SUCCESS) {
-				socket_log(__LINE__, sock, NULL, EVENT, NULL, 0, 0,
-					"closed %d %d %d con_reset_fix_failed",
-					sock->pending_recv, sock->pending_send,
-					sock->references);
-				closesocket(sock->fd);
-				_set_state(sock, SOCK_CLOSED);
-				sock->fd = INVALID_SOCKET;
-				free_socket(&sock, __LINE__);
-				return (result);
+	if (dup_socket == NULL) {
+		switch (type) {
+		case isc_sockettype_udp:
+			sock->fd = socket(pf, SOCK_DGRAM, IPPROTO_UDP);
+			if (sock->fd != INVALID_SOCKET) {
+				result = connection_reset_fix(sock->fd);
+				if (result != ISC_R_SUCCESS) {
+					socket_log(__LINE__, sock,
+						NULL, EVENT, NULL, 0, 0,
+						"closed %d %d %d "
+						"con_reset_fix_failed",
+						sock->pending_recv,
+						sock->pending_send,
+						sock->references);
+					closesocket(sock->fd);
+					_set_state(sock, SOCK_CLOSED);
+					sock->fd = INVALID_SOCKET;
+					free_socket(&sock, __LINE__);
+					return (result);
+				}
 			}
+			break;
+		case isc_sockettype_tcp:
+			sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP);
+			break;
 		}
-		break;
-	case isc_sockettype_tcp:
-		sock->fd = socket(pf, SOCK_STREAM, IPPROTO_TCP);
-		break;
+	} else {
+		/*
+		 * XXX: dup() is deprecated in windows, use _dup()
+		 * instead.  In future we may want to investigate
+		 * WSADuplicateSocket().
+		 */
+		sock->fd = _dup(dup_socket->fd);
+		sock->dupped = 1;
 	}
 
 	if (sock->fd == INVALID_SOCKET) {
@@ -1786,13 +1806,30 @@ isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
 	InterlockedIncrement(&manager->totalSockets);
 	UNLOCK(&manager->lock);
 
-	socket_log(__LINE__, sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET,
-		   ISC_MSG_CREATED, "created %u type %u", sock->fd, type);
+	socket_log(__LINE__, sock, NULL, CREATION, isc_msgcat,
+		   ISC_MSGSET_SOCKET, ISC_MSG_CREATED,
+		   "created %u type %u", sock->fd, type);
 
 	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
+isc__socket_create(isc_socketmgr_t *manager, int pf, isc_sockettype_t type,
+		   isc_socket_t **socketp)
+{
+	return (socket_create(manager, pf, type, socketp, NULL));
+}
+
+isc_result_t
+isc__socket_dup(isc_socket_t *sock, isc_socket_t **socketp) {
+	REQUIRE(VALID_SOCKET(sock));
+	REQUIRE(socketp != NULL && *socketp == NULL);
+
+	return (socket_create(sock->manager, sock->pf, sock->type,
+			      socketp, sock));
+}
+
+isc_result_t
 isc_socket_open(isc_socket_t *sock) {
 	REQUIRE(VALID_SOCKET(sock));
 	REQUIRE(sock->type != isc_sockettype_fdwatch);
@@ -3789,6 +3826,11 @@ isc__socket_gettag(isc_socket_t *socket) {
 	return (socket->tag);
 }
 
+int
+isc__socket_getfd(isc_socket_t *socket) {
+	return ((short) socket->fd);
+}
+
 void
 isc__socketmgr_setreserved(isc_socketmgr_t *manager, isc_uint32_t reserved) {
 	UNUSED(manager);
diff --git a/lib/isccc/Makefile.in b/lib/isccc/Makefile.in
index de92bd30..6f0605b2 100644
--- a/lib/isccc/Makefile.in
+++ b/lib/isccc/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.12.244.2 2011-02-28 01:20:04 tbox Exp $
+# $Id: Makefile.in,v 1.14 2011-02-19 23:47:38 tbox Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/lib/isccc/api b/lib/isccc/api
index 94575eb4..3d2fa6ef 100644
--- a/lib/isccc/api
+++ b/lib/isccc/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 80
+LIBINTERFACE = 90
 LIBREVISION = 0
 LIBAGE = 0
diff --git a/lib/isccfg/Makefile.in b/lib/isccfg/Makefile.in
index 73d8499b..053d192e 100644
--- a/lib/isccfg/Makefile.in
+++ b/lib/isccfg/Makefile.in
@@ -13,7 +13,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: Makefile.in,v 1.21.244.3 2011-03-10 04:29:18 each Exp $
+# $Id: Makefile.in,v 1.24 2011-03-10 04:36:16 each Exp $
 
 srcdir =	@srcdir@
 VPATH =		@srcdir@
diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index 34a54a37..33090c77 100644
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: aclconf.c,v 1.29.72.2 2011-06-17 23:47:11 tbox Exp $ */
+/* $Id: aclconf.c,v 1.31 2011-06-17 23:47:49 tbox Exp $ */
 
 #include <config.h>
 
diff --git a/lib/isccfg/api b/lib/isccfg/api
index 750ed97a..3d2fa6ef 100644
--- a/lib/isccfg/api
+++ b/lib/isccfg/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 82
+LIBINTERFACE = 90
 LIBREVISION = 0
 LIBAGE = 0
diff --git a/lib/isccfg/include/isccfg/aclconf.h b/lib/isccfg/include/isccfg/aclconf.h
index 2b5ff239..210f76fa 100644
--- a/lib/isccfg/include/isccfg/aclconf.h
+++ b/lib/isccfg/include/isccfg/aclconf.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: aclconf.h,v 1.12.72.2 2011-06-17 23:47:12 tbox Exp $ */
+/* $Id: aclconf.h,v 1.14 2011-06-17 23:47:49 tbox Exp $ */
 
 #ifndef ISCCFG_ACLCONF_H
 #define ISCCFG_ACLCONF_H 1
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 46afd168..52f1d8a1 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: namedconf.c,v 1.131.8.4 2011-05-23 20:56:11 each Exp $ */
+/* $Id: namedconf.c,v 1.139 2011-07-01 02:25:48 marka Exp $ */
 
 /*! \file */
 
@@ -228,9 +228,8 @@ static cfg_type_t cfg_type_namesockaddrkeylist = {
 };
 
 /*%
- * A list of socket addresses with an optional default port,
- * as used in the also-notify option.  E.g.,
- * "port 1234 { 10.0.0.1; 1::2 port 69; }"
+ * A list of socket addresses with an optional default port, as used
+ * in the lwresd 'listen-on' option.  E.g., "{ 10.0.0.1; 1::2 port 69; }"
  */
 static cfg_tuplefielddef_t portiplist_fields[] = {
 	{ "port", &cfg_type_optional_port, 0 },
@@ -238,8 +237,8 @@ static cfg_tuplefielddef_t portiplist_fields[] = {
 	{ NULL, NULL, 0 }
 };
 static cfg_type_t cfg_type_portiplist = {
-	"portiplist", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple, &cfg_rep_tuple,
-	portiplist_fields
+	"portiplist", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
+	&cfg_rep_tuple, portiplist_fields
 };
 
 /*%
@@ -548,6 +547,18 @@ static cfg_type_t cfg_type_autodnssec = {
 	&cfg_rep_string, &autodnssec_enums
 };
 
+static const char *dnssecupdatemode_enums[] = { "maintain", "no-resign", NULL };
+static cfg_type_t cfg_type_dnssecupdatemode = {
+	"dnssecupdatemode", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+	&cfg_rep_string, &dnssecupdatemode_enums
+};
+
+static const char *updatemethods_enums[] = { "increment", "unixtime", NULL };
+static cfg_type_t cfg_type_updatemethod = {
+	"updatemethod", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
+	&cfg_rep_string, &updatemethods_enums
+};
+
 static cfg_type_t cfg_type_rrsetorder = {
 	"rrsetorder", cfg_parse_bracketed_list, cfg_print_bracketed_list, cfg_doc_bracketed_list,
 	&cfg_rep_list, &cfg_type_rrsetorderingelement
@@ -593,7 +604,7 @@ static cfg_type_t cfg_type_forwardtype = {
 
 static const char *zonetype_enums[] = {
 	"master", "slave", "stub", "static-stub", "hint", "forward",
-	"delegation-only", NULL };
+	"delegation-only", "redirect", NULL };
 static cfg_type_t cfg_type_zonetype = {
 	"zonetype", cfg_parse_enum, cfg_print_ustring, cfg_doc_enum,
 	&cfg_rep_string, &zonetype_enums
@@ -1346,7 +1357,7 @@ zone_clauses[] = {
 	{ "allow-transfer", &cfg_type_bracketed_aml, 0 },
 	{ "allow-update", &cfg_type_bracketed_aml, 0 },
 	{ "allow-update-forwarding", &cfg_type_bracketed_aml, 0 },
-	{ "also-notify", &cfg_type_portiplist, 0 },
+	{ "also-notify", &cfg_type_namesockaddrkeylist, 0 },
 	{ "alt-transfer-source", &cfg_type_sockaddr4wild, 0 },
 	{ "alt-transfer-source-v6", &cfg_type_sockaddr6wild, 0 },
 	{ "check-dup-records", &cfg_type_checkmode, 0 },
@@ -1358,7 +1369,9 @@ zone_clauses[] = {
 	{ "check-wildcard", &cfg_type_boolean, 0 },
 	{ "dialup", &cfg_type_dialuptype, 0 },
 	{ "dnssec-dnskey-kskonly", &cfg_type_boolean, 0 },
+	{ "dnssec-loadkeys-interval", &cfg_type_uint32, 0 },
 	{ "dnssec-secure-to-insecure", &cfg_type_boolean, 0 },
+	{ "dnssec-update-mode", &cfg_type_dnssecupdatemode, 0 },
 	{ "forward", &cfg_type_forwardtype, 0 },
 	{ "forwarders", &cfg_type_portiplist, 0 },
 	{ "key-directory", &cfg_type_qstring, 0 },
@@ -1381,6 +1394,7 @@ zone_clauses[] = {
 	{ "notify-source-v6", &cfg_type_sockaddr6wild, 0 },
 	{ "notify-to-soa", &cfg_type_boolean, 0 },
 	{ "nsec3-test-zone", &cfg_type_boolean, CFG_CLAUSEFLAG_TESTONLY },
+	{ "serial-update-method", &cfg_type_updatemethod, 0 },
 	{ "sig-signing-nodes", &cfg_type_uint32, 0 },
 	{ "sig-signing-signatures", &cfg_type_uint32, 0 },
 	{ "sig-signing-type", &cfg_type_uint32, 0 },
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index f561ab8e..ce4aeaf0 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: parser.c,v 1.139.14.2 2011-03-11 06:47:09 marka Exp $ */
+/* $Id: parser.c,v 1.141 2011-03-11 06:11:27 marka Exp $ */
 
 /*! \file */
 
diff --git a/lib/lwres/api b/lib/lwres/api
index 78dd0b40..3d2fa6ef 100644
--- a/lib/lwres/api
+++ b/lib/lwres/api
@@ -1,3 +1,3 @@
-LIBINTERFACE = 80
-LIBREVISION = 1
+LIBINTERFACE = 90
+LIBREVISION = 0
 LIBAGE = 0
diff --git a/lib/lwres/assert_p.h b/lib/lwres/assert_p.h
index afe5099c..a87f63f8 100644
--- a/lib/lwres/assert_p.h
+++ b/lib/lwres/assert_p.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: assert_p.h,v 1.14.814.2 2011-03-12 04:59:19 tbox Exp $ */
+/* $Id: assert_p.h,v 1.16 2011-03-12 04:59:49 tbox Exp $ */
 
 #ifndef LWRES_ASSERT_P_H
 #define LWRES_ASSERT_P_H 1
diff --git a/lib/lwres/herror.c b/lib/lwres/herror.c
index ec834e62..856461df 100644
--- a/lib/lwres/herror.c
+++ b/lib/lwres/herror.c
@@ -72,7 +72,7 @@
 #if defined(LIBC_SCCS) && !defined(lint)
 static const char sccsid[] = "@(#)herror.c	8.1 (Berkeley) 6/4/93";
 static const char rcsid[] =
-	"$Id: herror.c,v 1.17.814.2 2011-03-12 04:59:19 tbox Exp $";
+	"$Id: herror.c,v 1.19 2011-03-12 04:59:49 tbox Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <config.h>
diff --git a/lib/lwres/lwconfig.c b/lib/lwres/lwconfig.c
index 6df09d1a..47803935 100644
--- a/lib/lwres/lwconfig.c
+++ b/lib/lwres/lwconfig.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: lwconfig.c,v 1.48.436.2 2011-03-12 04:59:19 tbox Exp $ */
+/* $Id: lwconfig.c,v 1.50 2011-03-12 04:59:49 tbox Exp $ */
 
 /*! \file */
 
diff --git a/lib/lwres/print.c b/lib/lwres/print.c
index d4e15d72..221161ff 100644
--- a/lib/lwres/print.c
+++ b/lib/lwres/print.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: print.c,v 1.10.814.2 2011-03-12 04:59:19 tbox Exp $ */
+/* $Id: print.c,v 1.12 2011-03-12 04:59:49 tbox Exp $ */
 
 #include <config.h>
author	Internet Software Consortium, Inc <@isc.org>	2011-11-01 14:44:10 -0600
committer	Internet Software Consortium, Inc <@isc.org>	2011-11-01 14:44:10 -0600
commit	0985d8a79623e77e4d2c801a661d1b1180f41285 (patch)
tree	d72acdc49feea21a0f2bccbe043f325b566fdbd5 /lib
parent	00d5712510aa66b262594f8846d3666c0de2a204 (diff)
download	bind9-0985d8a79623e77e4d2c801a661d1b1180f41285.tar.gz