Merge from vendor/bind9/dist as of the 9.4.3 import - src

diff options


context:
space:
mode:

author	Doug Barton <dougb@FreeBSD.org>	2008-12-23 22:47:56 +0000
committer	Doug Barton <dougb@FreeBSD.org>	2008-12-23 22:47:56 +0000
commit	514216e8d69b849989bb67362d17243e95696c91 (patch)
tree	6caf68c956b10fe118ac0bb9f368df80b7d0818e /contrib/bind9/bin/named
parent	74aed9855d18f91a1a2b22bd649f278bc4634acc (diff)
parent	7e21e833208362048bab5426bd4749d039b90494 (diff)

Notes

Diffstat (limited to 'contrib/bind9/bin/named')

-rw-r--r--

contrib/bind9/bin/named/client.c

-rw-r--r--

contrib/bind9/bin/named/config.c

-rw-r--r--

contrib/bind9/bin/named/controlconf.c

-rw-r--r--

contrib/bind9/bin/named/include/named/globals.h

-rw-r--r--

contrib/bind9/bin/named/interfacemgr.c

-rw-r--r--

contrib/bind9/bin/named/lwaddr.c

-rw-r--r--

contrib/bind9/bin/named/lwdgnba.c

-rw-r--r--

contrib/bind9/bin/named/lwdnoop.c

-rw-r--r--

contrib/bind9/bin/named/lwresd.8

-rw-r--r--

contrib/bind9/bin/named/lwresd.c

-rw-r--r--

contrib/bind9/bin/named/lwresd.docbook

-rw-r--r--

contrib/bind9/bin/named/lwresd.html

-rw-r--r--

contrib/bind9/bin/named/main.c

-rw-r--r--

contrib/bind9/bin/named/named.8

-rw-r--r--

contrib/bind9/bin/named/named.conf.5

-rw-r--r--

contrib/bind9/bin/named/named.conf.docbook

-rw-r--r--

contrib/bind9/bin/named/named.conf.html

-rw-r--r--

contrib/bind9/bin/named/named.docbook

-rw-r--r--

contrib/bind9/bin/named/named.html

-rw-r--r--

contrib/bind9/bin/named/query.c

-rw-r--r--

contrib/bind9/bin/named/server.c

338

-rw-r--r--

contrib/bind9/bin/named/unix/include/named/os.h

-rw-r--r--

contrib/bind9/bin/named/unix/os.c

-rw-r--r--

contrib/bind9/bin/named/update.c

24 files changed, 645 insertions, 366 deletions

diff --git a/contrib/bind9/bin/named/client.c b/contrib/bind9/bin/named/client.c
index 3b87d2648c0e..03cfdb6a714e 100644
--- a/contrib/bind9/bin/named/client.c
+++ b/contrib/bind9/bin/named/client.c

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: client.c,v 1.219.18.28.10.2 2008/07/23 07:28:54 tbox Exp $ */

+/* $Id: client.c,v 1.219.18.31 2008/05/22 23:46:03 tbox Exp $ */

#include <config.h>

@@ -132,7 +132,7 @@ struct ns_clientmgr {

#define MANAGER_MAGIC ISC_MAGIC('N', 'S', 'C', 'm')

#define VALID_MANAGER(m) ISC_MAGIC_VALID(m, MANAGER_MAGIC)

-/*!

+/*!

* Client object states. Ordering is significant: higher-numbered

* states are generally "more active", meaning that the client can

* have more dynamically allocated data, outstanding events, etc.

@@ -286,7 +286,7 @@ exit_check(ns_client_t *client) {

* Keep the view attached until any outstanding updates complete.

- if (client->nupdates == 0 &&

+ if (client->nupdates == 0 &&

client->newstate == NS_CLIENTSTATE_FREED && client->view != NULL)

dns_view_detach(&client->view);

@@ -817,7 +817,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {

isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);

if (ns_g_server->blackholeacl != NULL &&

dns_acl_match(&netaddr, NULL,

- ns_g_server->blackholeacl,

+ ns_g_server->blackholeacl,

&ns_g_server->aclenv,

&match, NULL) == ISC_R_SUCCESS &&

match > 0)

@@ -834,7 +834,7 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {

isc_buffer_usedregion(buffer, &r);

CTRACE("sendto");

result = isc_socket_sendto2(socket, &r, client->task,

address, pktinfo,

client->sendevent, sockflags);

@@ -1108,8 +1108,8 @@ ns_client_error(ns_client_t *client, isc_result_t result) {

* FORMERR loop avoidance: If we sent a FORMERR message

* with the same ID to the same client less than two

- * seconds ago, assume that we are in an infinite error

- * packet dialog with a server for some protocol whose

+ * seconds ago, assume that we are in an infinite error

+ * packet dialog with a server for some protocol whose

* error responses look enough like DNS queries to

* elicit a FORMERR response. Drop a packet to break

* the loop.

@@ -1534,7 +1534,7 @@ client_request(isc_task_t *task, isc_event_t *event) {

* For IPv6 UDP queries, we get this from the pktinfo structure (if

* supported).

* If all the attempts fail (this can happen due to memory shortage,

- * etc), we regard this as an error for safety.

+ * etc), we regard this as an error for safety.

if ((client->interface->flags & NS_INTERFACEFLAG_ANYADDR) == 0)

isc_netaddr_fromsockaddr(&destaddr, &client->interface->addr);

@@ -1595,7 +1595,7 @@ client_request(isc_task_t *task, isc_event_t *event) {

view);

if (sigresult == ISC_R_SUCCESS)

tsig = client->message->tsigname;

if (allowed(&netaddr, tsig, view->matchclients) &&

allowed(&destaddr, tsig, view->matchdestinations) &&

!((client->message->flags & DNS_MESSAGEFLAG_RD)

@@ -1726,7 +1726,7 @@ client_request(isc_task_t *task, isc_event_t *event) {

ns_client_log(client, DNS_LOGCATEGORY_SECURITY, NS_LOGMODULE_CLIENT,

ISC_LOG_DEBUG(3), ra ? "recursion available" :

- "recursion not available");

+ "recursion not available");

* Adjust maximum UDP response size for this client.

@@ -1820,10 +1820,10 @@ get_clientmctx(ns_clientmgr_t *manager, isc_mem_t **mctxp) {

return (result);

manager->mctxpool[manager->nextmctx] = clientmctx;

- manager->nextmctx++;

- if (manager->nextmctx == NMCTXS)

- manager->nextmctx = 0;

}

+ manager->nextmctx++;

+ if (manager->nextmctx == NMCTXS)

+ manager->nextmctx = 0;

#else

clientmctx = manager->mctx;

#endif

@@ -2093,7 +2093,7 @@ client_newconn(isc_task_t *task, isc_event_t *event) {

if (ns_g_server->blackholeacl != NULL &&

dns_acl_match(&netaddr, NULL,

- ns_g_server->blackholeacl,

+ ns_g_server->blackholeacl,

&ns_g_server->aclenv,

&match, NULL) == ISC_R_SUCCESS &&

match > 0)

@@ -2482,7 +2482,7 @@ ns_client_checkacl(ns_client_t *client,

isc_result_t result =

ns_client_checkaclsilent(client, acl, default_allow);

- if (result == ISC_R_SUCCESS)

+ if (result == ISC_R_SUCCESS)

ns_client_log(client, DNS_LOGCATEGORY_SECURITY,

NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(3),

"%s approved", opname);

@@ -2538,16 +2538,16 @@ ns_client_log(ns_client_t *client, isc_logcategory_t *category,

void

ns_client_aclmsg(const char *msg, dns_name_t *name, dns_rdatatype_t type,

- dns_rdataclass_t rdclass, char *buf, size_t len)

+ dns_rdataclass_t rdclass, char *buf, size_t len)

{

- char namebuf[DNS_NAME_FORMATSIZE];

- char typebuf[DNS_RDATATYPE_FORMATSIZE];

- char classbuf[DNS_RDATACLASS_FORMATSIZE];

+ char namebuf[DNS_NAME_FORMATSIZE];

+ char typebuf[DNS_RDATATYPE_FORMATSIZE];

+ char classbuf[DNS_RDATACLASS_FORMATSIZE];

- dns_name_format(name, namebuf, sizeof(namebuf));

- dns_rdatatype_format(type, typebuf, sizeof(typebuf));

- dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));

- (void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf,

+ dns_name_format(name, namebuf, sizeof(namebuf));

+ dns_rdatatype_format(type, typebuf, sizeof(typebuf));

+ dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));

+ (void)snprintf(buf, len, "%s '%s/%s/%s'", msg, namebuf, typebuf,

classbuf);

}

@@ -2575,7 +2575,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {

isc_mem_put(client->mctx, buf, len);

len += 1024;

} else if (result == ISC_R_SUCCESS)

- ns_client_log(client, NS_LOGCATEGORY_UNMATCHED,

+ ns_client_log(client, NS_LOGCATEGORY_UNMATCHED,

NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(1),

"%s\n%.*s", reason,

(int)isc_buffer_usedlength(&buffer),

@@ -2595,7 +2595,7 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {

const char *sep;

REQUIRE(VALID_MANAGER(manager));

LOCK(&manager->lock);

client = ISC_LIST_HEAD(manager->recursing);

while (client != NULL) {

diff --git a/contrib/bind9/bin/named/config.c b/contrib/bind9/bin/named/config.c
index 632960c15c37..233d9e097f26 100644
--- a/contrib/bind9/bin/named/config.c
+++ b/contrib/bind9/bin/named/config.c

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: config.c,v 1.47.18.32.10.3 2008/07/23 23:48:17 tbox Exp $ */

+/* $Id: config.c,v 1.47.18.35 2008/09/04 08:03:07 marka Exp $ */

/*! \file */

@@ -403,7 +403,7 @@ ns_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,

static isc_result_t

get_masters_def(const cfg_obj_t *cctx, const char *name,

- const cfg_obj_t **ret)

+ const cfg_obj_t **ret)

{

isc_result_t result;

const cfg_obj_t *masters = NULL;

@@ -521,7 +521,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,

tresult = get_masters_def(config, listname, &list);

if (tresult == ISC_R_NOTFOUND) {

cfg_obj_log(addr, ns_g_lctx, ISC_LOG_ERROR,

- "masters \"%s\" not found", listname);

+ "masters \"%s\" not found", listname);

result = tresult;

goto cleanup;

@@ -599,7 +599,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,

if (keys[i] == NULL)

goto cleanup;

dns_name_init(keys[i], NULL);

keystr = cfg_obj_asstring(key);

isc_buffer_init(&b, keystr, strlen(keystr));

isc_buffer_add(&b, strlen(keystr));

@@ -655,7 +655,7 @@ ns_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,

isc_mem_put(mctx, lists, listcount * sizeof(*lists));

if (stack != NULL)

isc_mem_put(mctx, stack, stackcount * sizeof(*stack));

INSIST(keycount == addrcount);

*addrsp = addrs;

diff --git a/contrib/bind9/bin/named/controlconf.c b/contrib/bind9/bin/named/controlconf.c
index f0703cb06505..e8e36f3e5e52 100644
--- a/contrib/bind9/bin/named/controlconf.c
+++ b/contrib/bind9/bin/named/controlconf.c

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: controlconf.c,v 1.40.18.10.40.3 2008/07/23 23:16:43 marka Exp $ */

+/* $Id: controlconf.c,v 1.40.18.14 2008/07/23 23:33:02 marka Exp $ */

/*! \file */

@@ -345,9 +345,9 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

listener = conn->listener;

secret.rstart = NULL;

- /* Is the server shutting down? */

- if (listener->controls->shuttingdown)

- goto cleanup;

+ /* Is the server shutting down? */

+ if (listener->controls->shuttingdown)

+ goto cleanup;

if (conn->ccmsg.result != ISC_R_SUCCESS) {

if (conn->ccmsg.result != ISC_R_CANCELED &&

@@ -364,9 +364,6 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

{

ccregion.rstart = isc_buffer_base(&conn->ccmsg.buffer);

ccregion.rend = isc_buffer_used(&conn->ccmsg.buffer);

- if (secret.rstart != NULL)

- isc_mem_put(listener->mctx, secret.rstart,

- REGION_SIZE(secret));

secret.rstart = isc_mem_get(listener->mctx, key->secret.length);

if (secret.rstart == NULL)

goto cleanup;

@@ -375,7 +372,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

result = isccc_cc_fromwire(&ccregion, &request, &secret);

if (result == ISC_R_SUCCESS)

break;

- else if (result == ISCCC_R_BADAUTH) {

+ isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));

+ if (result == ISCCC_R_BADAUTH) {

* For some reason, request is non-NULL when

* isccc_cc_fromwire returns ISCCC_R_BADAUTH.

@@ -396,7 +394,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

/* We shouldn't be getting a reply. */

if (isccc_cc_isreply(request)) {

log_invalid(&conn->ccmsg, ISC_R_FAILURE);

- goto cleanup;

+ goto cleanup_request;

}

isc_stdtime_get(&now);

@@ -407,17 +405,17 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

_ctrl = isccc_alist_lookup(request, "_ctrl");

if (_ctrl == NULL) {

log_invalid(&conn->ccmsg, ISC_R_FAILURE);

- goto cleanup;

+ goto cleanup_request;

}

if (isccc_cc_lookupuint32(_ctrl, "_tim", &sent) == ISC_R_SUCCESS) {

if ((sent + CLOCKSKEW) < now || (sent - CLOCKSKEW) > now) {

log_invalid(&conn->ccmsg, ISCCC_R_CLOCKSKEW);

- goto cleanup;

+ goto cleanup_request;

}

} else {

log_invalid(&conn->ccmsg, ISC_R_FAILURE);

- goto cleanup;

+ goto cleanup_request;

}

@@ -426,7 +424,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

if (isccc_cc_lookupuint32(_ctrl, "_exp", &exp) == ISC_R_SUCCESS &&

now > exp) {

log_invalid(&conn->ccmsg, ISCCC_R_EXPIRED);

- goto cleanup;

+ goto cleanup_request;

}

@@ -436,16 +434,16 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

result = isccc_cc_checkdup(listener->controls->symtab, request, now);

if (result != ISC_R_SUCCESS) {

if (result == ISC_R_EXISTS)

- result = ISCCC_R_DUPLICATE;

+ result = ISCCC_R_DUPLICATE;

log_invalid(&conn->ccmsg, result);

- goto cleanup;

+ goto cleanup_request;

}

if (conn->nonce != 0 &&

(isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS ||

conn->nonce != nonce)) {

log_invalid(&conn->ccmsg, ISCCC_R_BADAUTH);

- goto cleanup;

+ goto cleanup_request;

}

@@ -459,7 +457,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

result = isccc_cc_createresponse(request, now, now + 60, &response);

if (result != ISC_R_SUCCESS)

- goto cleanup;

+ goto cleanup_request;

if (eresult != ISC_R_SUCCESS) {

isccc_sexpr_t *data;

@@ -467,7 +465,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

if (data != NULL) {

const char *estr = isc_result_totext(eresult);

if (isccc_cc_definestring(data, "err", estr) == NULL)

- goto cleanup;

+ goto cleanup_response;

}

@@ -478,20 +476,20 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

if (data != NULL) {

char *str = (char *)isc_buffer_base(&text);

if (isccc_cc_definestring(data, "text", str) == NULL)

- goto cleanup;

+ goto cleanup_response;

}

_ctrl = isccc_alist_lookup(response, "_ctrl");

if (_ctrl == NULL ||

isccc_cc_defineuint32(_ctrl, "_nonce", conn->nonce) == NULL)

- goto cleanup;

+ goto cleanup_response;

ccregion.rstart = conn->buffer + 4;

ccregion.rend = conn->buffer + sizeof(conn->buffer);

result = isccc_cc_towire(response, &ccregion, &secret);

if (result != ISC_R_SUCCESS)

- goto cleanup;

+ goto cleanup_response;

isc_buffer_init(&b, conn->buffer, 4);

len = sizeof(conn->buffer) - REGION_SIZE(ccregion);

isc_buffer_putuint32(&b, len - 4);

@@ -500,31 +498,27 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

result = isc_socket_send(conn->sock, &r, task, control_senddone, conn);

if (result != ISC_R_SUCCESS)

- goto cleanup;

+ goto cleanup_response;

conn->sending = ISC_TRUE;

- if (secret.rstart != NULL)

- isc_mem_put(listener->mctx, secret.rstart,

- REGION_SIZE(secret));

- if (request != NULL)

- isccc_sexpr_free(&request);

- if (response != NULL)

- isccc_sexpr_free(&response);

+ isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));

+ isccc_sexpr_free(&request);

+ isccc_sexpr_free(&response);

return;

+ cleanup_response:

+ isccc_sexpr_free(&response);

+ cleanup_request:

+ isccc_sexpr_free(&request);

+ isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));

cleanup:

- if (secret.rstart != NULL)

- isc_mem_put(listener->mctx, secret.rstart,

- REGION_SIZE(secret));

isc_socket_detach(&conn->sock);

isccc_ccmsg_invalidate(&conn->ccmsg);

conn->ccmsg_valid = ISC_FALSE;

maybe_free_connection(conn);

maybe_free_listener(listener);

- if (request != NULL)

- isccc_sexpr_free(&request);

- if (response != NULL)

- isccc_sexpr_free(&response);

}

static void

@@ -548,7 +542,7 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) {

conn = isc_mem_get(listener->mctx, sizeof(*conn));

if (conn == NULL)

return (ISC_R_NOMEMORY);

conn->sock = sock;

isccc_ccmsg_init(listener->mctx, sock, &conn->ccmsg);

conn->ccmsg_valid = ISC_TRUE;

@@ -660,7 +654,7 @@ ns_controls_shutdown(ns_controls_t *controls) {

static isc_result_t

cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,

- const cfg_obj_t **objp)

+ const cfg_obj_t **objp)

{

const cfg_listelt_t *element;

const char *str;

@@ -808,7 +802,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,

if (result != ISC_R_SUCCESS) \

goto cleanup; \

} while (0)

static isc_result_t

get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

isc_result_t result;

@@ -828,14 +822,14 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

CHECK(cfg_map_get(config, "key", &key));

keyid = isc_mem_get(mctx, sizeof(*keyid));

- if (keyid == NULL)

+ if (keyid == NULL)

CHECK(ISC_R_NOMEMORY);

keyid->keyname = isc_mem_strdup(mctx,

cfg_obj_asstring(cfg_map_getname(key)));

keyid->secret.base = NULL;

keyid->secret.length = 0;

ISC_LINK_INIT(keyid, link);

- if (keyid->keyname == NULL)

+ if (keyid->keyname == NULL)

CHECK(ISC_R_NOMEMORY);

CHECK(bind9_check_key(key, ns_g_lctx));

@@ -891,7 +885,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

cfg_parser_destroy(&pctx);

return (result);

}

* Ensures that both '*global_keylistp' and '*control_keylistp' are

* valid or both are NULL.

@@ -925,7 +919,7 @@ static void

update_listener(ns_controls_t *cp, controllistener_t **listenerp,

const cfg_obj_t *control, const cfg_obj_t *config,

isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,

- const char *socktext, isc_sockettype_t type)

+ const char *socktext, isc_sockettype_t type)

{

controllistener_t *listener;

const cfg_obj_t *allow;

@@ -945,7 +939,7 @@ update_listener(ns_controls_t *cp, controllistener_t **listenerp,

*listenerp = NULL;

return;

}

* There is already a listener for this sockaddr.

* Update the access list and key information.

@@ -1339,7 +1333,7 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,

update_listener(cp, &listener, control, config,

&addr, aclconfctx,

- cfg_obj_asstring(path),

+ cfg_obj_asstring(path),

isc_sockettype_unix);

if (listener != NULL)

@@ -1385,10 +1379,10 @@ ns_controls_configure(ns_controls_t *cp, const cfg_obj_t *config,

isc_sockaddr_setport(&addr, NS_CONTROL_PORT);

isc_sockaddr_format(&addr, socktext, sizeof(socktext));

update_listener(cp, &listener, NULL, NULL,

&addr, NULL, socktext,

- isc_sockettype_tcp);

+ isc_sockettype_tcp);

if (listener != NULL)

diff --git a/contrib/bind9/bin/named/include/named/globals.h b/contrib/bind9/bin/named/include/named/globals.h
index 11f3989460e9..9c86afd46d5f 100644
--- a/contrib/bind9/bin/named/include/named/globals.h
+++ b/contrib/bind9/bin/named/include/named/globals.h

@@ -1,8 +1,8 @@

- * Permission to use, copy, modify, and distribute this software for any

+ * Permission to use, copy, modify, and/or distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: globals.h,v 1.64.18.4 2006/03/02 00:37:21 marka Exp $ */

+/* $Id: globals.h,v 1.64.18.6 2008/10/24 01:43:17 tbox Exp $ */

#ifndef NAMED_GLOBALS_H

#define NAMED_GLOBALS_H 1

@@ -48,6 +48,7 @@ EXTERN isc_taskmgr_t * ns_g_taskmgr INIT(NULL);

EXTERN dns_dispatchmgr_t * ns_g_dispatchmgr INIT(NULL);

EXTERN isc_entropy_t * ns_g_entropy INIT(NULL);

EXTERN isc_entropy_t * ns_g_fallbackentropy INIT(NULL);

+EXTERN unsigned int ns_g_cpus_detected INIT(1);

* XXXRTH We're going to want multiple timer managers eventually. One

diff --git a/contrib/bind9/bin/named/interfacemgr.c b/contrib/bind9/bin/named/interfacemgr.c
index 2a82c9874764..08d33d9912c5 100644
--- a/contrib/bind9/bin/named/interfacemgr.c
+++ b/contrib/bind9/bin/named/interfacemgr.c

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: interfacemgr.c,v 1.76.18.8.44.3 2008/07/23 23:16:43 marka Exp $ */

+/* $Id: interfacemgr.c,v 1.76.18.11 2008/07/23 23:33:02 marka Exp $ */

/*! \file */

@@ -90,7 +90,7 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,

mgr->generation = 1;

mgr->listenon4 = NULL;

mgr->listenon6 = NULL;

ISC_LIST_INIT(mgr->interfaces);

ISC_LIST_INIT(mgr->listenon);

@@ -323,7 +323,7 @@ ns_interface_accepttcp(ns_interface_t *ifp) {

goto tcp_listen_failure;

}

- /*

+ /*

* If/when there a multiple filters listen to the

* result.

@@ -510,7 +510,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {

unsigned int prefixlen;

family = interface->address.family;

elt.type = dns_aclelementtype_ipprefix;

elt.negative = ISC_FALSE;

elt.u.ip_prefix.address = interface->address;

@@ -550,7 +550,7 @@ setup_locals(ns_interfacemgr_t *mgr, isc_interface_t *interface) {

static void

setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,

in_port_t port)

isc_sockaddr_t *addr;

isc_sockaddr_t *old;

@@ -564,7 +564,7 @@ setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,

old != NULL;

old = ISC_LIST_NEXT(old, link))

if (isc_sockaddr_equal(addr, old))

- break;

+ break;

if (old != NULL)

isc_mem_put(mgr->mctx, addr, sizeof(*addr));

@@ -700,7 +700,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,

{

isc_interface_t interface;

ns_listenlist_t *ll;

- unsigned int family;

+ unsigned int family;

result = isc_interfaceiter_current(iter, &interface);

if (result != ISC_R_SUCCESS)

@@ -882,7 +882,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,

UNEXPECTED_ERROR(__FILE__, __LINE__,

"interface iteration failed: %s",

isc_result_totext(result));

- else

+ else

result = ISC_R_SUCCESS;

cleanup_iter:

isc_interfaceiter_destroy(&iter);

@@ -913,7 +913,7 @@ ns_interfacemgr_scan0(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,

* Warn if we are not listening on any interface, unless

- * we're in lwresd-only mode, in which case that is to

+ * we're in lwresd-only mode, in which case that is to

* be expected.

if (ext_listen == NULL &&

diff --git a/contrib/bind9/bin/named/lwaddr.c b/contrib/bind9/bin/named/lwaddr.c
index 78c2b0b85184..02e8f4de3be5 100644
--- a/contrib/bind9/bin/named/lwaddr.c
+++ b/contrib/bind9/bin/named/lwaddr.c

@@ -1,8 +1,8 @@

- * Permission to use, copy, modify, and distribute this software for any

+ * Permission to use, copy, modify, and/or distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: lwaddr.c,v 1.4.18.2 2005/04/29 00:15:23 marka Exp $ */

+/* $Id: lwaddr.c,v 1.4.18.4 2008/01/11 23:45:59 tbox Exp $ */

/*! \file */

@@ -81,7 +81,7 @@ lwaddr_lwresaddr_fromnetaddr(lwres_addr_t *la, isc_netaddr_t *na) {

} else {

la->family = LWRES_ADDRTYPE_V6;

la->length = 16;

- memcpy(la->address, &na->type.in, 16);

+ memcpy(la->address, &na->type.in6, 16);

}

return (ISC_R_SUCCESS);

}

diff --git a/contrib/bind9/bin/named/lwdgnba.c b/contrib/bind9/bin/named/lwdgnba.c
index a500d278896e..a54d44375124 100644
--- a/contrib/bind9/bin/named/lwdgnba.c
+++ b/contrib/bind9/bin/named/lwdgnba.c

@@ -1,8 +1,8 @@

- * Permission to use, copy, modify, and distribute this software for any

+ * Permission to use, copy, modify, and/or distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: lwdgnba.c,v 1.16.18.2 2005/04/29 00:15:24 marka Exp $ */

+/* $Id: lwdgnba.c,v 1.16.18.4 2008/01/14 23:45:59 tbox Exp $ */

/*! \file */

@@ -220,8 +220,6 @@ ns_lwdclient_processgnba(ns_lwdclient_t *client, lwres_buffer_t *b) {

b, &client->pkt, &req);

if (result != LWRES_R_SUCCESS)

goto out;

- if (req->addr.address == NULL)

- goto out;

client->options = 0;

if (req->addr.family == LWRES_ADDRTYPE_V4) {

diff --git a/contrib/bind9/bin/named/lwdnoop.c b/contrib/bind9/bin/named/lwdnoop.c
index fa591b41a245..69cc957e261c 100644
--- a/contrib/bind9/bin/named/lwdnoop.c
+++ b/contrib/bind9/bin/named/lwdnoop.c

@@ -1,8 +1,8 @@

- * Permission to use, copy, modify, and distribute this software for any

+ * Permission to use, copy, modify, and/or distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: lwdnoop.c,v 1.7.18.2 2005/04/29 00:15:25 marka Exp $ */

+/* $Id: lwdnoop.c,v 1.7.18.4 2008/01/22 23:27:05 tbox Exp $ */

/*! \file */

@@ -44,7 +44,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {

result = lwres_nooprequest_parse(client->clientmgr->lwctx,

b, &client->pkt, &req);

if (result != LWRES_R_SUCCESS)

- goto out;

+ goto send_error;

client->pkt.recvlength = LWRES_RECVLENGTH;

client->pkt.authtype = 0; /* XXXMLG */

@@ -57,7 +57,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {

lwres = lwres_noopresponse_render(client->clientmgr->lwctx, &resp,

&client->pkt, &lwb);

if (lwres != LWRES_R_SUCCESS)

- goto out;

+ goto cleanup_req;

r.base = lwb.base;

r.length = lwb.used;

@@ -65,7 +65,7 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {

client->sendlength = r.length;

result = ns_lwdclient_sendreply(client, &r);

if (result != ISC_R_SUCCESS)

- goto out;

+ goto cleanup_lwb;

* We can now destroy request.

@@ -76,13 +76,12 @@ ns_lwdclient_processnoop(ns_lwdclient_t *client, lwres_buffer_t *b) {

return;

- out:

- if (req != NULL)

- lwres_nooprequest_free(client->clientmgr->lwctx, &req);

+ cleanup_lwb:

+ lwres_context_freemem(client->clientmgr->lwctx, lwb.base, lwb.length);

- if (lwb.base != NULL)

- lwres_context_freemem(client->clientmgr->lwctx,

- lwb.base, lwb.length);

+ cleanup_req:

+ lwres_nooprequest_free(client->clientmgr->lwctx, &req);

+ send_error:

ns_lwdclient_errorpktsend(client, LWRES_R_FAILURE);

}

diff --git a/contrib/bind9/bin/named/lwresd.8 b/contrib/bind9/bin/named/lwresd.8
index 825645aa1eaa..827edcd65737 100644
--- a/contrib/bind9/bin/named/lwresd.8
+++ b/contrib/bind9/bin/named/lwresd.8

@@ -1,4 +1,4 @@

.\"

.\" Permission to use, copy, modify, and distribute this software for any

@@ -13,7 +13,7 @@

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

-.\" $Id: lwresd.8,v 1.15.18.12 2007/05/16 06:11:27 marka Exp $

+.\" $Id: lwresd.8,v 1.15.18.13 2008/10/17 01:29:23 tbox Exp $

.\"

.hy 0

.ad l

@@ -85,9 +85,9 @@ Use

\fIconfig\-file\fR

as the configuration file instead of the default,

\fI/etc/lwresd.conf\fR.

-<term>\-c</term>

+\fB\-c\fR

can not be used with

-<term>\-C</term>.

+\fB\-C\fR.

.RE

.PP

\-C \fIconfig\-file\fR

@@ -96,9 +96,9 @@ Use

\fIconfig\-file\fR

as the configuration file instead of the default,

\fI/etc/resolv.conf\fR.

-<term>\-C</term>

+\fB\-C\fR

can not be used with

-<term>\-c</term>.

+\fB\-c\fR.

.RE

.PP

\-d \fIdebug\-level\fR

@@ -217,7 +217,7 @@ The default process\-id file.

.PP

Internet Systems Consortium

.SH "COPYRIGHT"

-Copyright \(co 2004, 2005, 2007 Internet Systems Consortium, Inc. ("ISC")

+Copyright \(co 2004, 2005, 2007, 2008 Internet Systems Consortium, Inc. ("ISC")

.br

diff --git a/contrib/bind9/bin/named/lwresd.c b/contrib/bind9/bin/named/lwresd.c
index 1f7184e72dcc..8a89b1c764ce 100644
--- a/contrib/bind9/bin/named/lwresd.c
+++ b/contrib/bind9/bin/named/lwresd.c

@@ -15,9 +15,9 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: lwresd.c,v 1.46.18.7.52.3 2008/07/23 23:16:43 marka Exp $ */

+/* $Id: lwresd.c,v 1.46.18.10 2008/07/23 23:33:02 marka Exp $ */

-/*! \file

+/*! \file

* \brief

* Main program for the Lightweight Resolver Daemon.

@@ -224,7 +224,7 @@ ns_lwresd_parseeresolvconf(isc_mem_t *mctx, cfg_parser_t *pctx,

for (i = 0; i < lwc->searchnxt; i++) {

CHECK(buffer_putstr(&b, "\t\t\""));

CHECK(buffer_putstr(&b, lwc->search[i]));

- CHECK(buffer_putstr(&b, "\";\n"));

+ CHECK(buffer_putstr(&b, "\";\n"));

}

CHECK(buffer_putstr(&b, "\t};\n"));

}

diff --git a/contrib/bind9/bin/named/lwresd.docbook b/contrib/bind9/bin/named/lwresd.docbook
index 5b3143e6e5b4..6dd2c40adf61 100644
--- a/contrib/bind9/bin/named/lwresd.docbook
+++ b/contrib/bind9/bin/named/lwresd.docbook

@@ -2,7 +2,7 @@

"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

[<!ENTITY mdash "—">]>

<!--

- Permission to use, copy, modify, and/or distribute this software for any

@@ -18,7 +18,7 @@

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

@@ -40,6 +40,7 @@

+ <year>2008</year>

<holder>Internet Systems Consortium, Inc. ("ISC")</holder>

</copyright>

@@ -145,7 +146,7 @@

configuration file instead of the default,

<filename>/etc/lwresd.conf</filename>.

- <term>-c</term> can not be used with <term>-C</term>.

+ <option>-c</option> can not be used with <option>-C</option>.

</para>

</listitem>

</varlistentry>

@@ -157,7 +158,7 @@

Use <replaceable class="parameter">config-file</replaceable> as the

configuration file instead of the default,

<filename>/etc/resolv.conf</filename>.

- <term>-C</term> can not be used with <term>-c</term>.

+ <option>-C</option> can not be used with <option>-c</option>.

</para>

</listitem>

</varlistentry>

diff --git a/contrib/bind9/bin/named/lwresd.html b/contrib/bind9/bin/named/lwresd.html
index b59a7cc72581..463e6b0ee3cf 100644
--- a/contrib/bind9/bin/named/lwresd.html
+++ b/contrib/bind9/bin/named/lwresd.html

@@ -1,5 +1,5 @@

<!--

- Permission to use, copy, modify, and distribute this software for any

@@ -14,7 +14,7 @@

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

<html>

<head>

@@ -32,7 +32,7 @@

<div class="cmdsynopsis"><p><code class="command">lwresd</code> [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-C <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-i <em class="replaceable"><code>pid-file</code></em></code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-P <em class="replaceable"><code>port</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-4</code>] [<code class="option">-6</code>]</p></div>

</div>

-<a name="id2543461"></a><h2>DESCRIPTION</h2>

+<a name="id2543464"></a><h2>DESCRIPTION</h2>

<p><span><strong class="command">lwresd</strong></span>

is the daemon providing name lookup

services to clients that use the BIND 9 lightweight resolver

@@ -67,7 +67,7 @@

</p>

</div>

-<a name="id2543508"></a><h2>OPTIONS</h2>

+<a name="id2543511"></a><h2>OPTIONS</h2>

<dd><p>

@@ -87,14 +87,14 @@

configuration file instead of the default,

<code class="filename">/etc/lwresd.conf</code>.

- <font color="red"><term>-c</term></font> can not be used with <font color="red"><term>-C</term></font>.

+ <code class="option">-c</code> can not be used with <code class="option">-C</code>.

</p></dd>

<dt><span class="term">-C <em class="replaceable"><code>config-file</code></em></span></dt>

<dd><p>

Use <em class="replaceable"><code>config-file</code></em> as the

configuration file instead of the default,

<code class="filename">/etc/resolv.conf</code>.

- <font color="red"><term>-C</term></font> can not be used with <font color="red"><term>-c</term></font>.

+ <code class="option">-C</code> can not be used with <code class="option">-c</code>.

</p></dd>

<dt><span class="term">-d <em class="replaceable"><code>debug-level</code></em></span></dt>

<dd><p>

@@ -197,7 +197,7 @@

</dl></div>

</div>

-<a name="id2543925"></a><h2>FILES</h2>

+<a name="id2543928"></a><h2>FILES</h2>

<dt><span class="term"><code class="filename">/etc/resolv.conf</code></span></dt>

<dd><p>

@@ -210,14 +210,14 @@

</dl></div>

</div>

-<a name="id2543964"></a><h2>SEE ALSO</h2>

+<a name="id2543968"></a><h2>SEE ALSO</h2>

<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">lwres</span>(3)</span>,

<span class="citerefentry"><span class="refentrytitle">resolver</span>(5)</span>.

</p>

</div>

-<a name="id2543998"></a><h2>AUTHOR</h2>

+<a name="id2544002"></a><h2>AUTHOR</h2>

<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>

diff --git a/contrib/bind9/bin/named/main.c b/contrib/bind9/bin/named/main.c
index 6b9b67e13550..d8b0a3345138 100644
--- a/contrib/bind9/bin/named/main.c
+++ b/contrib/bind9/bin/named/main.c

@@ -1,8 +1,8 @@

- * Permission to use, copy, modify, and distribute this software for any

+ * Permission to use, copy, modify, and/or distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: main.c,v 1.136.18.17 2006/11/10 18:51:14 marka Exp $ */

+/* $Id: main.c,v 1.136.18.21 2008/10/24 01:28:08 marka Exp $ */

/*! \file */

@@ -33,6 +33,7 @@

#include <isc/hash.h>

#include <isc/os.h>

#include <isc/platform.h>

+#include <isc/print.h>

#include <isc/resource.h>

#include <isc/stdio.h>

#include <isc/string.h>

@@ -85,6 +86,7 @@ static char program_name[ISC_DIR_NAMEMAX] = "named";

static char absolute_conffile[ISC_DIR_PATHMAX];

static char saved_command_line[512];

static char version[512];

+static unsigned int maxsocks = 0;

void

ns_main_earlywarning(const char *format, ...) {

@@ -356,7 +358,8 @@ parse_command_line(int argc, char *argv[]) {

isc_commandline_errprint = ISC_FALSE;

while ((ch = isc_commandline_parse(argc, argv,

- "46c:C:d:fgi:lm:n:N:p:P:st:u:vx:")) != -1) {

+ "46c:C:d:fgi:lm:n:N:p:P:"

+ "sS:t:u:vx:")) != -1) {

switch (ch) {

case '4':

if (disable4)

@@ -435,6 +438,10 @@ parse_command_line(int argc, char *argv[]) {

/* XXXRTH temporary syntax */

want_stats = ISC_TRUE;

break;

+ case 'S':

+ maxsocks = parse_int(isc_commandline_argument,

+ "max number of sockets");

+ break;

case 't':

/* XXXJAB should we make a copy? */

ns_g_chrootdir = isc_commandline_argument;

@@ -466,17 +473,14 @@ parse_command_line(int argc, char *argv[]) {

static isc_result_t

create_managers(void) {

isc_result_t result;

-#ifdef ISC_PLATFORM_USETHREADS

- unsigned int cpus_detected;

-#endif

+ unsigned int socks;

#ifdef ISC_PLATFORM_USETHREADS

- cpus_detected = isc_os_ncpus();

if (ns_g_cpus == 0)

- ns_g_cpus = cpus_detected;

+ ns_g_cpus = ns_g_cpus_detected;

isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,

ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",

- cpus_detected, cpus_detected == 1 ? "" : "s",

+ ns_g_cpus_detected, ns_g_cpus_detected == 1 ? "" : "s",

ns_g_cpus, ns_g_cpus == 1 ? "" : "s");

#else

ns_g_cpus = 1;

@@ -497,13 +501,19 @@ create_managers(void) {

return (ISC_R_UNEXPECTED);

}

- result = isc_socketmgr_create(ns_g_mctx, &ns_g_socketmgr);

+ result = isc_socketmgr_create2(ns_g_mctx, &ns_g_socketmgr, maxsocks);

if (result != ISC_R_SUCCESS) {

UNEXPECTED_ERROR(__FILE__, __LINE__,

"isc_socketmgr_create() failed: %s",

isc_result_totext(result));

return (ISC_R_UNEXPECTED);

}

+ result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &socks);

+ if (result == ISC_R_SUCCESS) {

+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

+ NS_LOGMODULE_SERVER,

+ ISC_LOG_INFO, "using up to %u sockets", socks);

+ }

result = isc_entropy_create(ns_g_mctx, &ns_g_entropy);

if (result != ISC_R_SUCCESS) {

@@ -550,6 +560,7 @@ destroy_managers(void) {

static void

setup(void) {

isc_result_t result;

+ isc_resourcevalue_t old_openfiles;

#ifdef HAVE_LIBSCF

char *instance = NULL;

#endif

@@ -603,6 +614,13 @@ setup(void) {

}

#endif

+#ifdef ISC_PLATFORM_USETHREADS

+ /*

+ * Check for the number of cpu's before ns_os_chroot().

+ */

+ ns_g_cpus_detected = isc_os_ncpus();

+#endif

ns_os_chroot(ns_g_chrootdir);

@@ -656,6 +674,23 @@ setup(void) {

&ns_g_initopenfiles);

+ * System resources cannot effectively be tuned on some systems.

+ * Raise the limit in such cases for safety.

+ */

+ old_openfiles = ns_g_initopenfiles;

+ ns_os_adjustnofile();

+ (void)isc_resource_getlimit(isc_resource_openfiles,

+ &ns_g_initopenfiles);

+ if (old_openfiles != ns_g_initopenfiles) {

+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

+ NS_LOGMODULE_MAIN, ISC_LOG_NOTICE,

+ "adjusted limit on open files from "

+ "%" ISC_PRINT_QUADFORMAT "u to "

+ "%" ISC_PRINT_QUADFORMAT "u",

+ old_openfiles, ns_g_initopenfiles);

+ }

+ /*

* If the named configuration filename is relative, prepend the current

* directory's name before possibly changing to another directory.

@@ -665,7 +700,7 @@ setup(void) {

sizeof(absolute_conffile));

if (result != ISC_R_SUCCESS)

ns_main_earlyfatal("could not construct absolute path of "

- "configuration file: %s",

+ "configuration file: %s",

isc_result_totext(result));

ns_g_conffile = absolute_conffile;

}

@@ -757,7 +792,7 @@ ns_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {

if (debug)

UNEXPECTED_ERROR(__FILE__, __LINE__,

"scf_handle_create() failed: %s",

- scf_strerror(scf_error()));

+ scf_strerror(scf_error()));

return (ISC_R_FAILURE);

}

diff --git a/contrib/bind9/bin/named/named.8 b/contrib/bind9/bin/named/named.8
index f5e82303024d..9487dac2e178 100644
--- a/contrib/bind9/bin/named/named.8
+++ b/contrib/bind9/bin/named/named.8

@@ -1,4 +1,4 @@

.\"

.\" Permission to use, copy, modify, and distribute this software for any

@@ -13,7 +13,7 @@

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

-.\" $Id: named.8,v 1.20.18.15 2007/06/20 02:26:58 marka Exp $

+.\" $Id: named.8,v 1.20.18.16 2008/09/01 02:29:00 tbox Exp $

.\"

.hy 0

.ad l

@@ -33,7 +33,7 @@

named \- Internet domain name server

.SH "SYNOPSIS"

.HP 6

-\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]

+\fBnamed\fR [\fB\-4\fR] [\fB\-6\fR] [\fB\-c\ \fR\fB\fIconfig\-file\fR\fR] [\fB\-d\ \fR\fB\fIdebug\-level\fR\fR] [\fB\-f\fR] [\fB\-g\fR] [\fB\-m\ \fR\fB\fIflag\fR\fR] [\fB\-n\ \fR\fB\fI#cpus\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\fR] [\fB\-S\ \fR\fB\fI#max\-socks\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR] [\fB\-v\fR] [\fB\-x\ \fR\fB\fIcache\-file\fR\fR]

.SH "DESCRIPTION"

.PP

\fBnamed\fR

@@ -131,6 +131,21 @@ This option is mainly of interest to BIND 9 developers and may be removed or cha

.RE

.PP

+\-S \fI#max\-socks\fR

+.RS 4

+Allow

+\fBnamed\fR

+to use up to

+\fI#max\-socks\fR

+sockets.

+.RS

+.B "Warning:"

+This option should be unnecessary for the vast majority of users. The use of this option could even be harmful because the specified value may exceed the limitation of the underlying system API. It is therefore set only when the default configuration causes exhaustion of file descriptors and the operational environment is known to support the specified number of sockets. Note also that the actual maximum number is normally a little fewer than the specified value because

+\fBnamed\fR

+reserves some file descriptors for its internal use.

+.RE

+.PP

\-t \fIdirectory\fR

.RS 4

Chroot to

@@ -230,7 +245,7 @@ BIND 9 Administrator Reference Manual.

.PP

Internet Systems Consortium

.SH "COPYRIGHT"

-Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")

+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")

.br

diff --git a/contrib/bind9/bin/named/named.conf.5 b/contrib/bind9/bin/named/named.conf.5
index 00c92a69c13a..a2ccbe07fb33 100644
--- a/contrib/bind9/bin/named/named.conf.5
+++ b/contrib/bind9/bin/named/named.conf.5

@@ -1,4 +1,4 @@

.\"

.\" Permission to use, copy, modify, and distribute this software for any

.\" purpose with or without fee is hereby granted, provided that the above

@@ -12,7 +12,7 @@

.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

.\" PERFORMANCE OF THIS SOFTWARE.

.\"

-.\" $Id: named.conf.5,v 1.1.2.26 2007/08/19 23:26:13 marka Exp $

+.\" $Id: named.conf.5,v 1.1.2.27 2008/09/05 01:32:08 tbox Exp $

.\"

.hy 0

.ad l

@@ -174,6 +174,7 @@ options {

port \fIinteger\fR;

querylog \fIboolean\fR;

recursing\-file \fIquoted_string\fR;

+ reserved\-sockets \fIinteger\fR;

random\-device \fIquoted_string\fR;

recursive\-clients \fIinteger\fR;

serial\-query\-rate \fIinteger\fR;

@@ -516,5 +517,5 @@ zone \fIstring\fR \fIoptional_class\fR {

\fBrndc\fR(8),

BIND 9 Administrator Reference Manual.

.SH "COPYRIGHT"

-Copyright \(co 2004\-2007 Internet Systems Consortium, Inc. ("ISC")

+Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")

.br

diff --git a/contrib/bind9/bin/named/named.conf.docbook b/contrib/bind9/bin/named/named.conf.docbook
index 8635f9754fd6..32aa53742488 100644
--- a/contrib/bind9/bin/named/named.conf.docbook
+++ b/contrib/bind9/bin/named/named.conf.docbook

@@ -17,7 +17,7 @@

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

diff --git a/contrib/bind9/bin/named/named.conf.html b/contrib/bind9/bin/named/named.conf.html
index 09e71a324cdd..f729988d4da1 100644
--- a/contrib/bind9/bin/named/named.conf.html
+++ b/contrib/bind9/bin/named/named.conf.html

@@ -1,5 +1,5 @@

<!--

- Permission to use, copy, modify, and distribute this software for any

- purpose with or without fee is hereby granted, provided that the above

@@ -13,7 +13,7 @@

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

<html>

<head>

@@ -31,7 +31,7 @@

<div class="cmdsynopsis"><p><code class="command">named.conf</code> </p></div>

</div>

-<a name="id2542042"></a><h2>DESCRIPTION</h2>

+<a name="id2543342"></a><h2>DESCRIPTION</h2>

<p><code class="filename">named.conf</code> is the configuration file

for

<span><strong class="command">named</strong></span>. Statements are enclosed

@@ -50,14 +50,14 @@

</p>

</div>

-<a name="id2543367"></a><h2>ACL</h2>

+<a name="id2543370"></a><h2>ACL</h2>

acl�<em class="replaceable"><code>string</code></em>�{�<em class="replaceable"><code>address_match_element</code></em>;�...�};<br>

<br>

</p></div>

</div>

-<a name="id2543383"></a><h2>KEY</h2>

+<a name="id2543386"></a><h2>KEY</h2>

key�<em class="replaceable"><code>domain_name</code></em>�{<br>

algorithm�<em class="replaceable"><code>string</code></em>;<br>

@@ -66,7 +66,7 @@ key�<em class="replaceable"><code>domain_name</code></em>�{<br>

</p></div>

</div>

-<a name="id2543402"></a><h2>MASTERS</h2>

+<a name="id2543405"></a><h2>MASTERS</h2>

masters�<em class="replaceable"><code>string</code></em>�[<span class="optional">�port�<em class="replaceable"><code>integer</code></em>�</span>]�{<br>

(�<em class="replaceable"><code>masters</code></em>�|�<em class="replaceable"><code>ipv4_address</code></em>�[<span class="optional">port�<em class="replaceable"><code>integer</code></em></span>]�|<br>

@@ -75,7 +75,7 @@ masters�<em class="replaceable"><code>string</code></em>�[<span class="optional"

</p></div>

</div>

-<a name="id2543448"></a><h2>SERVER</h2>

+<a name="id2543451"></a><h2>SERVER</h2>

server�(�<em class="replaceable"><code>ipv4_address[<span class="optional">/prefixlen</span>]</code></em>�|�<em class="replaceable"><code>ipv6_address[<span class="optional">/prefixlen</span>]</code></em>�)�{<br>

bogus�<em class="replaceable"><code>boolean</code></em>;<br>

@@ -97,7 +97,7 @@ server�(�<em class="replaceable"><code>ipv4_address[<span class="optional">/pref

</p></div>

</div>

-<a name="id2543516"></a><h2>TRUSTED-KEYS</h2>

+<a name="id2543520"></a><h2>TRUSTED-KEYS</h2>

trusted-keys�{<br>

<em class="replaceable"><code>domain_name</code></em>�<em class="replaceable"><code>flags</code></em>�<em class="replaceable"><code>protocol</code></em>�<em class="replaceable"><code>algorithm</code></em>�<em class="replaceable"><code>key</code></em>;�...�<br>

@@ -105,7 +105,7 @@ trusted-keys�{<br>

</p></div>

</div>

-<a name="id2543542"></a><h2>CONTROLS</h2>

+<a name="id2543545"></a><h2>CONTROLS</h2>

controls�{<br>

inet�(�<em class="replaceable"><code>ipv4_address</code></em>�|�<em class="replaceable"><code>ipv6_address</code></em>�|�*�)<br>

@@ -117,7 +117,7 @@ controls�{<br>

</p></div>

</div>

-<a name="id2543577"></a><h2>LOGGING</h2>

+<a name="id2543580"></a><h2>LOGGING</h2>

logging�{<br>

channel�<em class="replaceable"><code>string</code></em>�{<br>

@@ -135,7 +135,7 @@ logging�{<br>

</p></div>

</div>

-<a name="id2543616"></a><h2>LWRES</h2>

+<a name="id2543619"></a><h2>LWRES</h2>

lwres�{<br>

listen-on�[<span class="optional">�port�<em class="replaceable"><code>integer</code></em>�</span>]�{<br>

@@ -148,7 +148,7 @@ lwres�{<br>

</p></div>

</div>

-<a name="id2543657"></a><h2>OPTIONS</h2>

+<a name="id2543660"></a><h2>OPTIONS</h2>

options�{<br>

avoid-v4-udp-ports�{�<em class="replaceable"><code>port</code></em>;�...�};<br>

@@ -172,6 +172,7 @@ options�{<br>

port�<em class="replaceable"><code>integer</code></em>;<br>

querylog�<em class="replaceable"><code>boolean</code></em>;<br>

recursing-file�<em class="replaceable"><code>quoted_string</code></em>;<br>

+ reserved-sockets�<em class="replaceable"><code>integer</code></em>;<br>

random-device�<em class="replaceable"><code>quoted_string</code></em>;<br>

recursive-clients�<em class="replaceable"><code>integer</code></em>;<br>

serial-query-rate�<em class="replaceable"><code>integer</code></em>;<br>

@@ -313,7 +314,7 @@ options�{<br>

</p></div>

</div>

-<a name="id2544401"></a><h2>VIEW</h2>

+<a name="id2544407"></a><h2>VIEW</h2>

view�<em class="replaceable"><code>string</code></em>�<em class="replaceable"><code>optional_class</code></em>�{<br>

match-clients�{�<em class="replaceable"><code>address_match_element</code></em>;�...�};<br>

@@ -453,7 +454,7 @@ view�<em class="replaceable"><code>string</code></em>�<em class="replaceable"><c

</p></div>

</div>

-<a name="id2544966"></a><h2>ZONE</h2>

+<a name="id2544972"></a><h2>ZONE</h2>

zone�<em class="replaceable"><code>string</code></em>�<em class="replaceable"><code>optional_class</code></em>�{<br>

type�(�master�|�slave�|�stub�|�hint�|<br>

@@ -538,12 +539,12 @@ zone�<em class="replaceable"><code>string</code></em>�<em class="replaceable"><c

</p></div>

</div>

-<a name="id2545319"></a><h2>FILES</h2>

+<a name="id2545325"></a><h2>FILES</h2>

<p><code class="filename">/etc/named.conf</code>

</p>

</div>

-<a name="id2545331"></a><h2>SEE ALSO</h2>

+<a name="id2545337"></a><h2>SEE ALSO</h2>

<p><span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">named-checkconf</span>(8)</span>,

<span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,

diff --git a/contrib/bind9/bin/named/named.docbook b/contrib/bind9/bin/named/named.docbook
index 74b41f5031b6..15d554c07f27 100644
--- a/contrib/bind9/bin/named/named.docbook
+++ b/contrib/bind9/bin/named/named.docbook

@@ -2,7 +2,7 @@

"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"

[<!ENTITY mdash "—">]>

<!--

- Permission to use, copy, modify, and/or distribute this software for any

@@ -18,7 +18,7 @@

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

@@ -41,6 +41,7 @@

+ <year>2008</year>

<holder>Internet Systems Consortium, Inc. ("ISC")</holder>

</copyright>

@@ -64,6 +65,7 @@

+ <arg><option>-S <replaceable class="parameter">#max-socks</replaceable></option></arg>

<arg><option>-t <replaceable class="parameter">directory</replaceable></option></arg>

@@ -215,6 +217,33 @@

</varlistentry>

+ <term>-S <replaceable class="parameter">#max-socks</replaceable></term>

+ <listitem>

+ <para>

+ Allow <command>named</command> to use up to

+ <replaceable class="parameter">#max-socks</replaceable> sockets.

+ </para>

+ <warning>

+ <para>

+ This option should be unnecessary for the vast majority

+ of users.

+ The use of this option could even be harmful because the

+ specified value may exceed the limitation of the

+ underlying system API.

+ It is therefore set only when the default configuration

+ causes exhaustion of file descriptors and the

+ operational environment is known to support the

+ specified number of sockets.

+ Note also that the actual maximum number is normally a little

+ fewer than the specified value because

+ <command>named</command> reserves some file descriptors

+ for its internal use.

+ </para>

+ </warning>

+ </listitem>

+ </varlistentry>

+ <varlistentry>

<term>-t <replaceable class="parameter">directory</replaceable></term>

<para>Chroot

diff --git a/contrib/bind9/bin/named/named.html b/contrib/bind9/bin/named/named.html
index 294ecce406a0..ed4f16a3e218 100644
--- a/contrib/bind9/bin/named/named.html
+++ b/contrib/bind9/bin/named/named.html

@@ -1,5 +1,5 @@

<!--

- Permission to use, copy, modify, and distribute this software for any

@@ -14,7 +14,7 @@

- OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR

- PERFORMANCE OF THIS SOFTWARE.

-->

-

+

<html>

<head>

@@ -29,10 +29,10 @@

</div>

<h2>Synopsis</h2>

-<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>

+<div class="cmdsynopsis"><p><code class="command">named</code> [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>

</div>

-<a name="id2543452"></a><h2>DESCRIPTION</h2>

+<a name="id2543464"></a><h2>DESCRIPTION</h2>

<p><span><strong class="command">named</strong></span>

is a Domain Name System (DNS) server,

part of the BIND 9 distribution from ISC. For more

@@ -47,7 +47,7 @@

</p>

</div>

-<a name="id2543477"></a><h2>OPTIONS</h2>

+<a name="id2543489"></a><h2>OPTIONS</h2>

<dd><p>

@@ -126,6 +126,31 @@

</p>

</div>

</dd>

+<dt><span class="term">-S <em class="replaceable"><code>#max-socks</code></em></span></dt>

+<dd>

+<p>

+ Allow <span><strong class="command">named</strong></span> to use up to

+ <em class="replaceable"><code>#max-socks</code></em> sockets.

+ </p>

+<div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;">

+<h3 class="title">Warning</h3>

+<p>

+ This option should be unnecessary for the vast majority

+ of users.

+ The use of this option could even be harmful because the

+ specified value may exceed the limitation of the

+ underlying system API.

+ It is therefore set only when the default configuration

+ causes exhaustion of file descriptors and the

+ operational environment is known to support the

+ specified number of sockets.

+ Note also that the actual maximum number is normally a little

+ fewer than the specified value because

+ <span><strong class="command">named</strong></span> reserves some file descriptors

+ for its internal use.

+ </p>

+</div>

+</dd>

<dt><span class="term">-t <em class="replaceable"><code>directory</code></em></span></dt>

<dd>

<p>Chroot

@@ -191,7 +216,7 @@

</dl></div>

</div>

-<a name="id2543864"></a><h2>SIGNALS</h2>

+<a name="id2543911"></a><h2>SIGNALS</h2>

<p>

In routine operation, signals should not be used to control

the nameserver; <span><strong class="command">rndc</strong></span> should be used

@@ -212,7 +237,7 @@

</p>

</div>

-<a name="id2543912"></a><h2>CONFIGURATION</h2>

+<a name="id2543959"></a><h2>CONFIGURATION</h2>

<p>

The <span><strong class="command">named</strong></span> configuration file is too complex

to describe in detail here. A complete description is provided

@@ -221,7 +246,7 @@

</p>

</div>

-<a name="id2543929"></a><h2>FILES</h2>

+<a name="id2543976"></a><h2>FILES</h2>

<dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>

<dd><p>

@@ -234,7 +259,7 @@

</dl></div>

</div>

-<a name="id2543969"></a><h2>SEE ALSO</h2>

+<a name="id2544016"></a><h2>SEE ALSO</h2>

<p><em class="citetitle">RFC 1033</em>,

<em class="citetitle">RFC 1034</em>,

<em class="citetitle">RFC 1035</em>,

@@ -247,7 +272,7 @@

</p>

</div>

-<a name="id2544039"></a><h2>AUTHOR</h2>

+<a name="id2544086"></a><h2>AUTHOR</h2>

<p><span class="corpauthor">Internet Systems Consortium</span>

</p>

</div>

diff --git a/contrib/bind9/bin/named/query.c b/contrib/bind9/bin/named/query.c
index 38eb9a13c15b..5cafbc9e45a8 100644
--- a/contrib/bind9/bin/named/query.c
+++ b/contrib/bind9/bin/named/query.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and/or distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: query.c,v 1.257.18.40 2007/09/26 03:08:14 each Exp $ */

+/* $Id: query.c,v 1.257.18.46 2008/10/15 22:33:01 marka Exp $ */

/*! \file */

@@ -2298,7 +2298,7 @@ mark_secure(ns_client_t *client, dns_db_t *db, dns_name_t *name,

static isc_boolean_t

get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,

dns_rdataset_t *keyrdataset, dst_key_t **keyp)

isc_result_t result;

dns_dbnode_t *node = NULL;

isc_boolean_t secure = ISC_FALSE;

@@ -2331,12 +2331,12 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,

isc_buffer_init(&b, rdata.data, rdata.length);

isc_buffer_add(&b, rdata.length);

result = dst_key_fromdns(&rrsig->signer, rdata.rdclass, &b,

- client->mctx, keyp);

+ client->mctx, keyp);

if (result != ISC_R_SUCCESS)

continue;

if (rrsig->algorithm == (dns_secalg_t)dst_key_alg(*keyp) &&

- rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&

- dst_key_iszonekey(*keyp)) {

+ rrsig->keyid == (dns_keytag_t)dst_key_id(*keyp) &&

+ dst_key_iszonekey(*keyp)) {

secure = ISC_TRUE;

break;

}

@@ -2354,7 +2354,7 @@ verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset,

isc_boolean_t ignore = ISC_FALSE;

dns_fixedname_init(&fixed);

again:

result = dns_dnssec_verify2(name, rdataset, key, ignore, mctx,

rdata, NULL);

@@ -2382,7 +2382,7 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,

if (sigrdataset == NULL || !dns_rdataset_isassociated(sigrdataset))

return (ISC_FALSE);

for (result = dns_rdataset_first(sigrdataset);

result == ISC_R_SUCCESS;

result = dns_rdataset_next(sigrdataset)) {

@@ -2757,6 +2757,13 @@ query_addwildcardproof(ns_client_t *client, dns_db_t *db,

&olabels);

(void)dns_name_fullcompare(name, &nsec.next, &order,

&nlabels);

+ /*

+ * Check for a pathological condition created when

+ * serving some malformed signed zones and bail out.

+ */

+ if (dns_name_countlabels(name) == nlabels)

+ goto cleanup;

if (olabels > nlabels)

dns_name_split(name, olabels, NULL, wname);

else

@@ -2924,13 +2931,14 @@ query_resume(isc_task_t *task, isc_event_t *event) {

static isc_result_t

query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qdomain,

- dns_rdataset_t *nameservers)

+ dns_rdataset_t *nameservers, isc_boolean_t resuming)

{

isc_result_t result;

dns_rdataset_t *rdataset, *sigrdataset;

isc_sockaddr_t *peeraddr;

- inc_stats(client, dns_statscounter_recursion);

+ if (!resuming)

+ inc_stats(client, dns_statscounter_recursion);

* We are about to recurse, which means that this client will

@@ -3162,11 +3170,11 @@ query_addnoqnameproof(ns_client_t *client, dns_rdataset_t *rdataset) {

cleanup:

if (nsec != NULL)

- query_putrdataset(client, &nsec);

- if (nsecsig != NULL)

- query_putrdataset(client, &nsecsig);

- if (fname != NULL)

- query_releasename(client, &fname);

+ query_putrdataset(client, &nsec);

+ if (nsecsig != NULL)

+ query_putrdataset(client, &nsecsig);

+ if (fname != NULL)

+ query_releasename(client, &fname);

}

static inline void

@@ -3269,12 +3277,12 @@ warn_rfc1918(ns_client_t *client, dns_name_t *fname, dns_rdataset_t *rdataset) {

dns_rdata_soa_t soa;

dns_rdataset_t found;

isc_result_t result;

for (i = 0; i < (sizeof(rfc1918names)/sizeof(*rfc1918names)); i++) {

if (dns_name_issubdomain(fname, &rfc1918names[i])) {

dns_rdataset_init(&found);

result = dns_ncache_getrdataset(rdataset,

- &rfc1918names[i],

+ &rfc1918names[i],

dns_rdatatype_soa,

&found);

if (result != ISC_R_SUCCESS)

@@ -3335,6 +3343,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

unsigned int options;

isc_boolean_t empty_wild;

dns_rdataset_t *noqname;

+ isc_boolean_t resuming;

CTRACE("query_find");

@@ -3360,6 +3369,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

need_wildcardproof = ISC_FALSE;

empty_wild = ISC_FALSE;

options = 0;

+ resuming = ISC_FALSE;

+ is_zone = ISC_FALSE;

if (event != NULL) {

@@ -3369,7 +3380,6 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

want_restart = ISC_FALSE;

authoritative = ISC_FALSE;

- is_zone = ISC_FALSE;

qtype = event->qtype;

if (qtype == dns_rdatatype_rrsig || qtype == dns_rdatatype_sig)

@@ -3402,6 +3412,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

}

result = event->result;

+ resuming = ISC_TRUE;

goto resume;

}

@@ -3602,7 +3613,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

if (RECURSIONOK(client)) {

result = query_recurse(client, qtype,

- NULL, NULL);

+ NULL, NULL, resuming);

if (result == ISC_R_SUCCESS)

client->query.attributes |=

NS_QUERYATTR_RECURSING;

@@ -3773,10 +3784,12 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

if (dns_rdatatype_atparent(type))

result = query_recurse(client, qtype,

- NULL, NULL);

+ NULL, NULL,

+ resuming);

else

result = query_recurse(client, qtype,

- fname, rdataset);

+ fname, rdataset,

+ resuming);

if (result == ISC_R_SUCCESS)

client->query.attributes |=

NS_QUERYATTR_RECURSING;

@@ -4220,7 +4233,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)

result = query_recurse(client,

qtype,

NULL,

- NULL);

+ NULL,

+ resuming);

if (result == ISC_R_SUCCESS)

client->query.attributes |=

NS_QUERYATTR_RECURSING;

@@ -4437,6 +4451,7 @@ ns_query_start(ns_client_t *client) {

dns_rdataset_t *rdataset;

ns_client_t *qclient;

dns_rdatatype_t qtype;

+ isc_boolean_t want_ad;

CTRACE("ns_query_start");

@@ -4576,6 +4591,15 @@ ns_query_start(ns_client_t *client) {

client->query.attributes &= ~NS_QUERYATTR_SECURE;

+ * Set 'want_ad' if the client has set AD in the query.

+ * This allows AD to be returned on queries without DO set.

+ */

+ if ((message->flags & DNS_MESSAGEFLAG_AD) != 0)

+ want_ad = ISC_TRUE;

+ else

+ want_ad = ISC_FALSE;

+ /*

* This is an ordinary query.

result = dns_message_reply(message, ISC_TRUE);

@@ -4594,7 +4618,7 @@ ns_query_start(ns_client_t *client) {

* Set AD. We must clear it if we add non-validated data to a

* response.

- if (WANTDNSSEC(client))

+ if (WANTDNSSEC(client) || want_ad)

message->flags |= DNS_MESSAGEFLAG_AD;

qclient = NULL;

diff --git a/contrib/bind9/bin/named/server.c b/contrib/bind9/bin/named/server.c
index 79bd125c5498..784ff94d3414 100644
--- a/contrib/bind9/bin/named/server.c
+++ b/contrib/bind9/bin/named/server.c

@@ -15,13 +15,14 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: server.c,v 1.419.18.57.10.3 2008/07/23 12:04:32 marka Exp $ */

+/* $Id: server.c,v 1.419.18.68 2008/09/04 23:46:08 tbox Exp $ */

/*! \file */

#include <config.h>

#include <stdlib.h>

+#include <unistd.h>

#include <isc/app.h>

#include <isc/base64.h>

@@ -31,8 +32,10 @@

#include <isc/hash.h>

#include <isc/lex.h>

#include <isc/parseint.h>

+#include <isc/portset.h>

#include <isc/print.h>

#include <isc/resource.h>

+#include <isc/socket.h>

#include <isc/stdio.h>

#include <isc/string.h>

#include <isc/task.h>

@@ -197,6 +200,7 @@ static const struct {

#endif

/* RFC 3330 */

+ { "0.IN-ADDR.ARPA", ISC_FALSE }, /* THIS NETWORK */

{ "127.IN-ADDR.ARPA", ISC_FALSE }, /* LOOPBACK */

{ "254.169.IN-ADDR.ARPA", ISC_FALSE }, /* LINK LOCAL */

{ "2.0.192.IN-ADDR.ARPA", ISC_FALSE }, /* TEST NET */

@@ -438,7 +442,7 @@ configure_view_dnsseckeys(const cfg_obj_t *vconfig, const cfg_obj_t *config,

*target = keytable; /* Transfer ownership. */

keytable = NULL;

result = ISC_R_SUCCESS;

cleanup:

return (result);

}

@@ -454,7 +458,7 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)

isc_boolean_t value;

isc_result_t result;

isc_buffer_t b;

dns_fixedname_init(&fixed);

name = dns_fixedname_name(&fixed);

for (element = cfg_list_first(mbs);

@@ -472,7 +476,7 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)

}

result = ISC_R_SUCCESS;

cleanup:

return (result);

}

@@ -482,13 +486,15 @@ mustbesecure(const cfg_obj_t *mbs, dns_resolver_t *resolver)

static isc_result_t

get_view_querysource_dispatch(const cfg_obj_t **maps,

- int af, dns_dispatch_t **dispatchp)

+ int af, dns_dispatch_t **dispatchp,

+ isc_boolean_t is_firstview)

{

isc_result_t result;

dns_dispatch_t *disp;

isc_sockaddr_t sa;

unsigned int attrs, attrmask;

const cfg_obj_t *obj = NULL;

+ unsigned int maxdispatchbuffers;

* Make compiler happy.

@@ -540,12 +546,18 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,

attrs |= DNS_DISPATCHATTR_IPV6;

break;

}

- if (isc_sockaddr_getport(&sa) != 0) {

+ if (isc_sockaddr_getport(&sa) == 0) {

+ attrs |= DNS_DISPATCHATTR_EXCLUSIVE;

+ maxdispatchbuffers = 4096;

+ } else {

INSIST(obj != NULL);

- cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,

- "using specific query-source port suppresses port "

- "randomization and can be insecure.");

+ if (is_firstview) {

+ cfg_obj_log(obj, ns_g_lctx, ISC_LOG_INFO,

+ "using specific query-source port "

+ "suppresses port randomization and can be "

+ "insecure.");

+ }

+ maxdispatchbuffers = 1000;

}

attrmask = 0;

@@ -557,7 +569,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps,

disp = NULL;

result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,

ns_g_taskmgr, &sa, 4096,

- 1024, 32768, 16411, 16433,

+ maxdispatchbuffers, 32768, 16411, 16433,

attrs, attrmask, &disp);

if (result != ISC_R_SUCCESS) {

isc_sockaddr_t any;

@@ -609,7 +621,7 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {

return (result);

obj = cfg_tuple_get(ent, "name");

- if (cfg_obj_isstring(obj))

+ if (cfg_obj_isstring(obj))

str = cfg_obj_asstring(obj);

else

str = "*";

@@ -662,7 +674,7 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {

cfg_obj_asnetprefix(cfg_map_getname(cpeer), &na, &prefixlen);

peer = NULL;

- result = dns_peer_new(mctx, &na, &peer);

+ result = dns_peer_newprefix(mctx, &na, prefixlen, &peer);

if (result != ISC_R_SUCCESS)

return (result);

@@ -840,7 +852,7 @@ on_disable_list(const cfg_obj_t *disablelist, dns_name_t *zonename) {

dns_fixedname_init(&fixed);

name = dns_fixedname_name(&fixed);

for (element = cfg_list_first(disablelist);

element != NULL;

element = cfg_list_next(element))

@@ -911,9 +923,9 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

const cfg_obj_t *alternates;

const cfg_obj_t *zonelist;

#ifdef DLZ

- const cfg_obj_t *dlz;

- unsigned int dlzargc;

- char **dlzargv;

+ const cfg_obj_t *dlz;

+ unsigned int dlzargc;

+ char **dlzargv;

#endif

const cfg_obj_t *disabled;

const cfg_obj_t *obj;

@@ -1064,7 +1076,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

result = ISC_R_NOMEMORY;

goto cleanup;

}

result = dns_dlzstrtoargv(mctx, s, &dlzargc, &dlzargv);

if (result != ISC_R_SUCCESS) {

isc_mem_free(mctx, s);

@@ -1183,8 +1195,12 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

* XXXRTH Hardwired number of tasks.

- CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4));

- CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6));

+ CHECK(get_view_querysource_dispatch(maps, AF_INET, &dispatch4,

+ ISC_TF(ISC_LIST_PREV(view, link)

+ == NULL)));

+ CHECK(get_view_querysource_dispatch(maps, AF_INET6, &dispatch6,

+ ISC_TF(ISC_LIST_PREV(view, link)

+ == NULL)));

if (dispatch4 == NULL && dispatch6 == NULL) {

UNEXPECTED_ERROR(__FILE__, __LINE__,

"unable to obtain neither an IPv4 nor"

@@ -1223,7 +1239,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

result = ns_config_get(maps, "zero-no-soa-ttl-cache", &obj);

INSIST(result == ISC_R_SUCCESS);

dns_resolver_setzeronosoattl(view->resolver, cfg_obj_asboolean(obj));

* Set the resolver's EDNS UDP size.

@@ -1236,7 +1252,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

if (udpsize > 4096)

udpsize = 4096;

dns_resolver_setudpsize(view->resolver, (isc_uint16_t)udpsize);

* Set the maximum UDP response size.

@@ -1273,7 +1289,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

(void)ns_config_get(maps, "forward", &forwardtype);

(void)ns_config_get(maps, "forwarders", &forwarders);

if (forwarders != NULL)

- CHECK(configure_forward(config, view, dns_rootname,

+ CHECK(configure_forward(config, view, dns_rootname,

forwarders, forwardtype));

@@ -1293,7 +1309,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

* If we still have no hints, this is a non-IN view with no

* "hints zone" configured. Issue a warning, except if this

- * is a root server. Root servers never need to consult

+ * is a root server. Root servers never need to consult

* their hints, so it's no point requiring users to configure

* them.

@@ -1416,7 +1432,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

view->transfer_format = dns_one_answer;

else

INSIST(0);

* Set sources where additional data and CNAME/DNAME

* targets for authoritative answers may be found.

@@ -1516,7 +1532,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

dns_resolver_setclientsperquery(view->resolver,

cfg_obj_asuint32(obj),

max_clients_per_query);

obj = NULL;

result = ns_config_get(maps, "dnssec-enable", &obj);

INSIST(result == ISC_R_SUCCESS);

@@ -1745,14 +1761,14 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

if (result == ISC_R_SUCCESS &&

forwarders->fwdpolicy == dns_fwdpolicy_only)

continue;

if (!rfc1918 && empty_zones[empty_zone].rfc1918) {

if (logit) {

isc_log_write(ns_g_lctx,

NS_LOGCATEGORY_GENERAL,

NS_LOGMODULE_SERVER,

ISC_LOG_WARNING,

- "Warning%s%s: "

+ "Warning%s%s: "

"'empty-zones-enable/"

"disable-empty-zone' "

"not set: disabling "

@@ -1794,7 +1810,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

dns_zone_setclass(zone, view->rdclass);

dns_zone_settype(zone, dns_zone_master);

CHECK(dns_zone_setdbtype(zone, empty_dbtypec,

- empty_dbtype));

+ empty_dbtype));

if (view->queryacl != NULL)

dns_zone_setqueryacl(zone, view->queryacl);

dns_zone_setdialup(zone, dns_dialuptype_no);

@@ -1809,7 +1825,7 @@ configure_view(dns_view_t *view, const cfg_obj_t *config,

dns_zone_detach(&zone);

}

result = ISC_R_SUCCESS;

cleanup:

@@ -2125,7 +2141,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,

"name"));

else

vname = "<default view>";

isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

NS_LOGMODULE_SERVER, ISC_LOG_ERROR,

"zone '%s': wrong class for view '%s'",

@@ -2499,7 +2515,7 @@ adjust_interfaces(ns_server_t *server, isc_mem_t *mctx) {

}

ns_interfacemgr_adjust(server->interfacemgr, list, ISC_TRUE);

clean:

ns_listenlist_detach(&list);

return;

@@ -2588,7 +2604,7 @@ setstring(ns_server_t *server, char **field, const char *value) {

*field = copy;

return (ISC_R_SUCCESS);

* Replace the current value of '*field', a dynamically allocated

@@ -2630,7 +2646,7 @@ set_limit(const cfg_obj_t **maps, const char *configname,

result = isc_resource_setlimit(resourceid, value);

isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,

result == ISC_R_SUCCESS ?

- ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,

+ ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,

"set maximum %s to %" ISC_PRINT_QUADFORMAT "d: %s",

description, value, isc_result_totext(result));

}

@@ -2647,31 +2663,48 @@ set_limits(const cfg_obj_t **maps) {

SETLIMIT("files", openfiles, "open files");

}

-static isc_result_t

-portlist_fromconf(dns_portlist_t *portlist, unsigned int family,

- const cfg_obj_t *ports)

+static void

+portset_fromconf(isc_portset_t *portset, const cfg_obj_t *ports,

+ isc_boolean_t positive)

{

const cfg_listelt_t *element;

- isc_result_t result = ISC_R_SUCCESS;

for (element = cfg_list_first(ports);

element != NULL;

element = cfg_list_next(element)) {

const cfg_obj_t *obj = cfg_listelt_value(element);

- in_port_t port = (in_port_t)cfg_obj_asuint32(obj);

- result = dns_portlist_add(portlist, family, port);

- if (result != ISC_R_SUCCESS)

- break;

+ if (cfg_obj_isuint32(obj)) {

+ in_port_t port = (in_port_t)cfg_obj_asuint32(obj);

+ if (positive)

+ isc_portset_add(portset, port);

+ else

+ isc_portset_remove(portset, port);

+ } else {

+ const cfg_obj_t *obj_loport, *obj_hiport;

+ in_port_t loport, hiport;

+ obj_loport = cfg_tuple_get(obj, "loport");

+ loport = (in_port_t)cfg_obj_asuint32(obj_loport);

+ obj_hiport = cfg_tuple_get(obj, "hiport");

+ hiport = (in_port_t)cfg_obj_asuint32(obj_hiport);

+ if (positive)

+ isc_portset_addrange(portset, loport, hiport);

+ else {

+ isc_portset_removerange(portset, loport,

+ hiport);

+ }

}

- return (result);

}

static isc_result_t

removed(dns_zone_t *zone, void *uap) {

const char *type;

- if (dns_zone_getview(zone) != uap)

+ if (dns_zone_getview(zone) != uap)

return (ISC_R_SUCCESS);

switch (dns_zone_gettype(zone)) {

@@ -2704,28 +2737,31 @@ load_configuration(const char *filename, ns_server_t *server,

const cfg_obj_t *maps[3];

const cfg_obj_t *obj;

const cfg_obj_t *options;

- const cfg_obj_t *v4ports, *v6ports;

+ const cfg_obj_t *usev4ports, *avoidv4ports, *usev6ports, *avoidv6ports;

const cfg_obj_t *views;

dns_view_t *view = NULL;

dns_view_t *view_next;

dns_viewlist_t tmpviewlist;

dns_viewlist_t viewlist;

- in_port_t listen_port;

+ in_port_t listen_port, udpport_low, udpport_high;

int i;

isc_interval_t interval;

- isc_resourcevalue_t files;

+ isc_portset_t *v4portset = NULL;

+ isc_portset_t *v6portset = NULL;

+ isc_resourcevalue_t nfiles;

isc_result_t result;

isc_uint32_t heartbeat_interval;

isc_uint32_t interface_interval;

isc_uint32_t reserved;

isc_uint32_t udpsize;

+ unsigned int maxsocks;

cfg_aclconfctx_init(&aclconfctx);

ISC_LIST_INIT(viewlist);

/* Ensure exclusive access to configuration data. */

result = isc_task_beginexclusive(server->task);

- RUNTIME_CHECK(result == ISC_R_SUCCESS);

+ RUNTIME_CHECK(result == ISC_R_SUCCESS);

* Parse the global default pseudo-config file.

@@ -2799,20 +2835,22 @@ load_configuration(const char *filename, ns_server_t *server,

set_limits(maps);

- * Sanity check on "files" limit.

+ * Check if max number of open sockets that the system allows is

+ * sufficiently large. Failing this condition is not necessarily fatal,

+ * but may cause subsequent runtime failures for a busy recursive

+ * server.

- result = isc_resource_curlimit(isc_resource_openfiles, &files);

- if (result == ISC_R_SUCCESS && files < FD_SETSIZE) {

+ result = isc_socketmgr_getmaxsockets(ns_g_socketmgr, &maxsocks);

+ if (result != ISC_R_SUCCESS)

+ maxsocks = 0;

+ result = isc_resource_getcurlimit(isc_resource_openfiles, &nfiles);

+ if (result == ISC_R_SUCCESS && (isc_resourcevalue_t)maxsocks > nfiles) {

isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

NS_LOGMODULE_SERVER, ISC_LOG_WARNING,

- "the 'files' limit (%" ISC_PRINT_QUADFORMAT "u) "

- "is less than FD_SETSIZE (%d), increase "

- "'files' in named.conf or recompile with a "

- "smaller FD_SETSIZE.", files, FD_SETSIZE);

- if (files > FD_SETSIZE)

- files = FD_SETSIZE;

- } else

- files = FD_SETSIZE;

+ "max open files (%" ISC_PRINT_QUADFORMAT "u)"

+ " is smaller than max sockets (%u)",

+ nfiles, maxsocks);

+ }

* Set the number of socket reserved for TCP, stdio etc.

@@ -2821,20 +2859,23 @@ load_configuration(const char *filename, ns_server_t *server,

result = ns_config_get(maps, "reserved-sockets", &obj);

INSIST(result == ISC_R_SUCCESS);

reserved = cfg_obj_asuint32(obj);

- if (files < 128U) /* Prevent underflow. */

- reserved = 0;

- else if (reserved > files - 128U) /* Mimimum UDP space. */

- reserved = files - 128;

- if (reserved < 128U) /* Mimimum TCP/stdio space. */

+ if (maxsocks != 0) {

+ if (maxsocks < 128U) /* Prevent underflow. */

+ reserved = 0;

+ else if (reserved > maxsocks - 128U) /* Minimum UDP space. */

+ reserved = maxsocks - 128;

+ }

+ /* Minimum TCP/stdio space. */

+ if (reserved < 128U)

reserved = 128;

- if (reserved + 128U > files) {

+ if (reserved + 128U > maxsocks && maxsocks != 0) {

isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

- NS_LOGMODULE_SERVER, ISC_LOG_WARNING,

+ NS_LOGMODULE_SERVER, ISC_LOG_WARNING,

"less than 128 UDP sockets available after "

- "applying 'reserved-sockets' and 'files'");

+ "applying 'reserved-sockets' and 'maxsockets'");

}

isc__socketmgr_setreserved(ns_g_socketmgr, reserved);

* Configure various server options.

@@ -2859,24 +2900,64 @@ load_configuration(const char *filename, ns_server_t *server,

INSIST(result == ISC_R_SUCCESS);

server->aclenv.match_mapped = cfg_obj_asboolean(obj);

- v4ports = NULL;

- v6ports = NULL;

- (void)ns_config_get(maps, "avoid-v4-udp-ports", &v4ports);

- (void)ns_config_get(maps, "avoid-v6-udp-ports", &v6ports);

- if (v4ports != NULL || v6ports != NULL) {

- dns_portlist_t *portlist = NULL;

- result = dns_portlist_create(ns_g_mctx, &portlist);

- if (result == ISC_R_SUCCESS && v4ports != NULL)

- result = portlist_fromconf(portlist, AF_INET, v4ports);

- if (result == ISC_R_SUCCESS && v6ports != NULL)

- portlist_fromconf(portlist, AF_INET6, v6ports);

- if (result == ISC_R_SUCCESS)

- dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, portlist);

- if (portlist != NULL)

- dns_portlist_detach(&portlist);

- CHECK(result);

- } else

- dns_dispatchmgr_setblackportlist(ns_g_dispatchmgr, NULL);

+ /*

+ * Configure sets of UDP query source ports.

+ */

+ CHECKM(isc_portset_create(ns_g_mctx, &v4portset),

+ "creating UDP port set");

+ CHECKM(isc_portset_create(ns_g_mctx, &v6portset),

+ "creating UDP port set");

+ usev4ports = NULL;

+ usev6ports = NULL;

+ avoidv4ports = NULL;

+ avoidv6ports = NULL;

+ (void)ns_config_get(maps, "use-v4-udp-ports", &usev4ports);

+ if (usev4ports != NULL)

+ portset_fromconf(v4portset, usev4ports, ISC_TRUE);

+ else {

+ CHECKM(isc_net_getudpportrange(AF_INET, &udpport_low,

+ &udpport_high),

+ "get the default UDP/IPv4 port range");

+ if (udpport_low == udpport_high)

+ isc_portset_add(v4portset, udpport_low);

+ else {

+ isc_portset_addrange(v4portset, udpport_low,

+ udpport_high);

+ }

+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

+ NS_LOGMODULE_SERVER, ISC_LOG_INFO,

+ "using default UDP/IPv4 port range: [%d, %d]",

+ udpport_low, udpport_high);

+ }

+ (void)ns_config_get(maps, "avoid-v4-udp-ports", &avoidv4ports);

+ if (avoidv4ports != NULL)

+ portset_fromconf(v4portset, avoidv4ports, ISC_FALSE);

+ (void)ns_config_get(maps, "use-v6-udp-ports", &usev6ports);

+ if (usev6ports != NULL)

+ portset_fromconf(v6portset, usev6ports, ISC_TRUE);

+ else {

+ CHECKM(isc_net_getudpportrange(AF_INET6, &udpport_low,

+ &udpport_high),

+ "get the default UDP/IPv6 port range");

+ if (udpport_low == udpport_high)

+ isc_portset_add(v6portset, udpport_low);

+ else {

+ isc_portset_addrange(v6portset, udpport_low,

+ udpport_high);

+ }

+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

+ NS_LOGMODULE_SERVER, ISC_LOG_INFO,

+ "using default UDP/IPv6 port range: [%d, %d]",

+ udpport_low, udpport_high);

+ }

+ (void)ns_config_get(maps, "avoid-v6-udp-ports", &avoidv6ports);

+ if (avoidv6ports != NULL)

+ portset_fromconf(v6portset, avoidv6ports, ISC_FALSE);

+ dns_dispatchmgr_setavailports(ns_g_dispatchmgr, v4portset, v6portset);

* Set the EDNS UDP size when we don't match a view.

@@ -3037,7 +3118,7 @@ load_configuration(const char *filename, ns_server_t *server,

NULL, &interval, ISC_FALSE));

}

server->heartbeat_interval = heartbeat_interval;

isc_interval_set(&interval, 1200, 0);

CHECK(isc_timer_reset(server->pps_timer, isc_timertype_ticker, NULL,

&interval, ISC_FALSE));

@@ -3185,6 +3266,15 @@ load_configuration(const char *filename, ns_server_t *server,

ns_os_changeuser();

+ * Check that the working directory is writable.

+ */

+ if (access(".", W_OK) != 0) {

+ isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

+ NS_LOGMODULE_SERVER, ISC_LOG_ERROR,

+ "the working directory is not writable");

+ }

+ /*

* Configure the logging system.

* Do this after changing UID to make sure that any log

@@ -3277,7 +3367,7 @@ load_configuration(const char *filename, ns_server_t *server,

ns_os_writepidfile(lwresd_g_defaultpidfile, first_time);

else

ns_os_writepidfile(ns_g_defaultpidfile, first_time);

obj = NULL;

if (options != NULL &&

cfg_map_get(options, "memstatistics-file", &obj) == ISC_R_SUCCESS)

@@ -3344,6 +3434,12 @@ load_configuration(const char *filename, ns_server_t *server,

result = ISC_R_SUCCESS;

cleanup:

+ if (v4portset != NULL)

+ isc_portset_destroy(ns_g_mctx, &v4portset);

+ if (v6portset != NULL)

+ isc_portset_destroy(ns_g_mctx, &v6portset);

cfg_aclconfctx_destroy(&aclconfctx);

if (parser != NULL) {

@@ -3414,7 +3510,7 @@ load_zones(ns_server_t *server, isc_boolean_t stop) {

CHECK(dns_zonemgr_forcemaint(server->zonemgr));

cleanup:

- isc_task_endexclusive(server->task);

+ isc_task_endexclusive(server->task);

return (result);

}

@@ -3442,7 +3538,7 @@ load_new_zones(ns_server_t *server, isc_boolean_t stop) {

dns_zonemgr_resumexfrs(server->zonemgr);

cleanup:

- isc_task_endexclusive(server->task);

+ isc_task_endexclusive(server->task);

return (result);

}

@@ -3501,7 +3597,7 @@ run_server(isc_task_t *task, isc_event_t *event) {

ISC_LOG_NOTICE, "running");

}

-void

+void

ns_server_flushonshutdown(ns_server_t *server, isc_boolean_t flush) {

REQUIRE(NS_SERVER_VALID(server));

@@ -3635,7 +3731,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {

server->interface_timer = NULL;

server->heartbeat_timer = NULL;

server->pps_timer = NULL;

server->interface_interval = 0;

server->heartbeat_interval = 0;

@@ -3658,7 +3754,7 @@ ns_server_create(isc_mem_t *mctx, ns_server_t **serverp) {

server->hostname_set = ISC_FALSE;

server->hostname = NULL;

- server->version_set = ISC_FALSE;

+ server->version_set = ISC_FALSE;

server->version = NULL;

server->server_usehostname = ISC_FALSE;

server->server_id = NULL;

@@ -3814,7 +3910,7 @@ ns_add_reserved_dispatch(ns_server_t *server, const isc_sockaddr_t *addr) {

result = dns_dispatch_getudp(ns_g_dispatchmgr, ns_g_socketmgr,

ns_g_taskmgr, &dispatch->addr, 4096,

1000, 32768, 16411, 16433,

- attrs, attrmask, &dispatch->dispatch);

+ attrs, attrmask, &dispatch->dispatch);

if (result != ISC_R_SUCCESS)

goto cleanup;

@@ -3917,7 +4013,7 @@ next_token(char **stringp, const char *delim) {

break;

} while (*res == '\0');

return (res);

* Find the zone specified in the control channel command 'args',

@@ -3975,14 +4071,14 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep) {

} else {

rdclass = dns_rdataclass_in;

}

if (viewtxt == NULL)

viewtxt = "_default";

result = dns_viewlist_find(&server->viewlist, viewtxt,

rdclass, &view);

if (result != ISC_R_SUCCESS)

goto fail1;

result = dns_zt_find(view->zonetable, dns_fixedname_name(&name),

0, NULL, zonep);

/* Partial match? */

@@ -4001,7 +4097,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args) {

isc_result_t result;

dns_zone_t *zone = NULL;

dns_zonetype_t type;

result = zone_from_args(server, args, &zone);

if (result != ISC_R_SUCCESS)

return (result);

@@ -4014,7 +4110,7 @@ ns_server_retransfercommand(ns_server_t *server, char *args) {

result = ISC_R_NOTFOUND;

dns_zone_detach(&zone);

return (result);

* Act on a "reload" command from the command channel.

@@ -4025,7 +4121,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {

dns_zone_t *zone = NULL;

dns_zonetype_t type;

const char *msg = NULL;

result = zone_from_args(server, args, &zone);

if (result != ISC_R_SUCCESS)

return (result);

@@ -4042,7 +4138,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {

} else {

result = dns_zone_load(zone);

dns_zone_detach(&zone);

- switch (result) {

+ switch (result) {

case ISC_R_SUCCESS:

msg = "zone reload successful";

break;

@@ -4064,7 +4160,7 @@ ns_server_reloadcommand(ns_server_t *server, char *args, isc_buffer_t *text) {

isc_buffer_putmem(text, (const unsigned char *)msg,

strlen(msg) + 1);

return (result);

* Act on a "reconfig" command from the command channel.

@@ -4091,14 +4187,14 @@ ns_server_notifycommand(ns_server_t *server, char *args, isc_buffer_t *text) {

return (result);

if (zone == NULL)

return (ISC_R_UNEXPECTEDEND);

dns_zone_notify(zone);

dns_zone_detach(&zone);

if (sizeof(msg) <= isc_buffer_availablelength(text))

isc_buffer_putmem(text, msg, sizeof(msg));

return (ISC_R_SUCCESS);

* Act on a "refresh" command from the command channel.

@@ -4125,17 +4221,17 @@ ns_server_refreshcommand(ns_server_t *server, char *args, isc_buffer_t *text) {

isc_buffer_putmem(text, msg1, sizeof(msg1));

return (ISC_R_SUCCESS);

}

dns_zone_detach(&zone);

if (sizeof(msg2) <= isc_buffer_availablelength(text))

isc_buffer_putmem(text, msg2, sizeof(msg2));

return (ISC_R_FAILURE);

isc_result_t

ns_server_togglequerylog(ns_server_t *server) {

server->log_queries = server->log_queries ? ISC_FALSE : ISC_TRUE;

isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,

NS_LOGMODULE_SERVER, ISC_LOG_INFO,

"query logging is now %s",

@@ -4239,15 +4335,15 @@ ns_server_dumpstats(ns_server_t *server) {

CHECKMF(isc_stdio_open(server->statsfile, "a", &fp),

"could not open statistics dump file", server->statsfile);

ncounters = DNS_STATS_NCOUNTERS;

fprintf(fp, "+++ Statistics Dump +++ (%lu)\n", (unsigned long)now);

for (i = 0; i < ncounters; i++)

fprintf(fp, "%s %" ISC_PRINT_QUADFORMAT "u\n",

dns_statscounter_names[i],

server->querystats[i]);

zone = NULL;

for (result = dns_zone_first(server->zonemgr, &zone);

result == ISC_R_SUCCESS;

@@ -4258,7 +4354,7 @@ ns_server_dumpstats(ns_server_t *server) {

char zonename[DNS_NAME_FORMATSIZE];

dns_view_t *view;

char *viewname;

dns_name_format(dns_zone_getorigin(zone),

zonename, sizeof(zonename));

view = dns_zone_getview(zone);

@@ -4278,7 +4374,7 @@ ns_server_dumpstats(ns_server_t *server) {

if (result == ISC_R_NOMORE)

result = ISC_R_SUCCESS;

CHECK(result);

fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);

cleanup:

@@ -4306,7 +4402,7 @@ static isc_result_t

add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {

struct viewlistentry *vle;

isc_result_t result = ISC_R_SUCCESS;

* Prevent duplicate views.

@@ -4369,7 +4465,7 @@ dumpdone(void *arg, isc_result_t result) {

struct dumpcontext *dctx = arg;

char buf[1024+32];

const dns_master_style_t *style;

if (result != ISC_R_SUCCESS)

goto cleanup;

if (dctx->mdctx != NULL)

@@ -4526,7 +4622,7 @@ ns_server_dumpdb(ns_server_t *server, char *args) {

dctx->dumpzones = ISC_TRUE;

dctx->dumpcache = ISC_FALSE;

ptr = next_token(&args, " \t");

- }

+ }

nextview:

for (view = ISC_LIST_HEAD(server->viewlist);

@@ -4646,7 +4742,7 @@ ns_server_validation(ns_server_t *server, char *args) {

else

result = ISC_R_FAILURE;

out:

- isc_task_endexclusive(server->task);

+ isc_task_endexclusive(server->task);

return (result);

}

@@ -4689,7 +4785,7 @@ ns_server_flushcache(ns_server_t *server, char *args) {

else

result = ISC_R_FAILURE;

}

- isc_task_endexclusive(server->task);

+ isc_task_endexclusive(server->task);

return (result);

}

@@ -4746,7 +4842,7 @@ ns_server_flushname(ns_server_t *server, char *args) {

result = ISC_R_NOTFOUND;

else

result = ISC_R_FAILURE;

- isc_task_endexclusive(server->task);

+ isc_task_endexclusive(server->task);

return (result);

}

@@ -4798,7 +4894,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {

char *journal;

const char *vname, *sep;

isc_boolean_t frozen;

result = zone_from_args(server, args, &zone);

if (result != ISC_R_SUCCESS)

return (result);

@@ -4806,7 +4902,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {

result = isc_task_beginexclusive(server->task);

RUNTIME_CHECK(result == ISC_R_SUCCESS);

tresult = ISC_R_SUCCESS;

- for (view = ISC_LIST_HEAD(server->viewlist);

+ for (view = ISC_LIST_HEAD(server->viewlist);

view != NULL;

view = ISC_LIST_NEXT(view, link)) {

result = dns_view_freezezones(view, freeze);

diff --git a/contrib/bind9/bin/named/unix/include/named/os.h b/contrib/bind9/bin/named/unix/include/named/os.h
index 24afdcbbcc4a..6c603dcc2a22 100644
--- a/contrib/bind9/bin/named/unix/include/named/os.h
+++ b/contrib/bind9/bin/named/unix/include/named/os.h

@@ -1,8 +1,8 @@

- * Permission to use, copy, modify, and distribute this software for any

+ * Permission to use, copy, modify, and/or distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: os.h,v 1.22.18.3 2005/04/29 00:15:39 marka Exp $ */

+/* $Id: os.h,v 1.22.18.5 2008/10/24 01:43:17 tbox Exp $ */

#ifndef NS_OS_H

#define NS_OS_H 1

@@ -46,11 +46,13 @@ void

ns_os_changeuser(void);

void

+ns_os_adjustnofile(void);

+void

ns_os_minprivs(void);

void

ns_os_writepidfile(const char *filename, isc_boolean_t first_time);

void

ns_os_shutdown(void);

diff --git a/contrib/bind9/bin/named/unix/os.c b/contrib/bind9/bin/named/unix/os.c
index 386461238fe5..ad26a8e9b0e9 100644
--- a/contrib/bind9/bin/named/unix/os.c
+++ b/contrib/bind9/bin/named/unix/os.c

@@ -1,8 +1,8 @@

- * Permission to use, copy, modify, and distribute this software for any

+ * Permission to use, copy, modify, and/or distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: os.c,v 1.66.18.11 2006/02/03 23:51:38 marka Exp $ */

+/* $Id: os.c,v 1.66.18.17 2008/10/24 01:43:17 tbox Exp $ */

/*! \file */

@@ -42,6 +42,7 @@

#include <isc/buffer.h>

#include <isc/file.h>

#include <isc/print.h>

+#include <isc/resource.h>

#include <isc/result.h>

#include <isc/strerror.h>

#include <isc/string.h>

@@ -116,6 +117,16 @@ static int dfd[2] = { -1, -1 };

static isc_boolean_t non_root = ISC_FALSE;

static isc_boolean_t non_root_caps = ISC_FALSE;

+#if defined(HAVE_CAPSET)

+#undef _POSIX_SOURCE

+#ifdef HAVE_SYS_CAPABILITY_H

+#include <sys/capability.h>

+#else

+#include <linux/capability.h>

+int capset(cap_user_header_t hdrp, const cap_user_data_t datap);

+#endif

+#include <sys/prctl.h>

+#else

/*%

* We define _LINUX_FS_H to prevent it from being included. We don't need

* anything from it, and the files it includes cause warnings with 2.2

@@ -148,6 +159,7 @@ static isc_boolean_t non_root_caps = ISC_FALSE;

#endif

#define SYS_capset __NR_capset

#endif

+#endif

static void

linux_setcaps(unsigned int caps) {

@@ -165,13 +177,23 @@ linux_setcaps(unsigned int caps) {

cap.effective = caps;

cap.permitted = caps;

cap.inheritable = 0;

- if (syscall(SYS_capset, &caphead, &cap) < 0) {

+#ifdef HAVE_CAPSET

+ if (capset(&caphead, &cap) < 0 ) {

isc__strerror(errno, strbuf, sizeof(strbuf));

ns_main_earlyfatal("capset failed: %s:"

" please ensure that the capset kernel"

" module is loaded. see insmod(8)",

strbuf);

}

+#else

+ if (syscall(SYS_capset, &caphead, &cap) < 0) {

+ isc__strerror(errno, strbuf, sizeof(strbuf));

+ ns_main_earlyfatal("syscall(capset) failed: %s:"

+ " please ensure that the capset kernel"

+ " module is loaded. see insmod(8)",

+ strbuf);

+ }

+#endif

}

static void

@@ -326,7 +348,7 @@ ns_os_daemonize(void) {

* Wait for the child to finish loading for the first time.

* This would be so much simpler if fork() worked once we

- * were multi-threaded.

+ * were multi-threaded.

(void)close(dfd[1]);

do {

@@ -496,15 +518,37 @@ ns_os_changeuser(void) {

ns_main_earlyfatal("setuid(): %s", strbuf);

}

-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)

- linux_minprivs();

-#endif

#if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)

* Restore the ability of named to drop core after the setuid()

* call has disabled it.

- prctl(PR_SET_DUMPABLE,1,0,0,0);

+ if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {

+ isc__strerror(errno, strbuf, sizeof(strbuf));

+ ns_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",

+ strbuf);

+ }

+#endif

+#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)

+ linux_minprivs();

+#endif

+void

+ns_os_adjustnofile() {

+#ifdef HAVE_LINUXTHREADS

+ isc_result_t result;

+ isc_resourcevalue_t newvalue;

+ /*

+ * Linux: max number of open files specified by one thread doesn't seem

+ * to apply to other threads on Linux.

+ */

+ newvalue = ISC_RESOURCE_UNLIMITED;

+ result = isc_resource_setlimit(isc_resource_openfiles, newvalue);

+ if (result != ISC_R_SUCCESS)

+ ns_main_earlywarning("couldn't adjust limit on open files");

#endif

}

@@ -665,7 +709,7 @@ ns_os_shutdownmsg(char *command, isc_buffer_t *text) {

ptr = next_token(&input, " \t");

if (ptr == NULL)

return;

if (strcmp(ptr, "-p") != 0)

return;

diff --git a/contrib/bind9/bin/named/update.c b/contrib/bind9/bin/named/update.c
index 98054f8b3ceb..fb6dec2f11e0 100644
--- a/contrib/bind9/bin/named/update.c
+++ b/contrib/bind9/bin/named/update.c

@@ -1,5 +1,5 @@

* Permission to use, copy, modify, and/or distribute this software for any

@@ -15,7 +15,7 @@

* PERFORMANCE OF THIS SOFTWARE.

-/* $Id: update.c,v 1.109.18.23 2007/08/28 07:20:01 tbox Exp $ */

+/* $Id: update.c,v 1.109.18.27 2008/02/07 03:16:08 marka Exp $ */

#include <config.h>

@@ -114,7 +114,7 @@

} \

update_log(client, zone, LOGLEVEL_PROTOCOL, \

"update %s: %s (%s)", _what, \

- msg, isc_result_totext(result)); \

+ msg, isc_result_totext(result)); \

if (result != ISC_R_SUCCESS) goto failure; \

} while (0)

@@ -403,7 +403,7 @@ foreach_node_rr_action(void *data, dns_rdataset_t *rdataset) {

result = dns_rdataset_next(rdataset))

{

rr_t rr = { 0, DNS_RDATA_INIT };

dns_rdataset_current(rdataset, &rr.rdata);

rr.ttl = rdataset->ttl;

result = (*ctx->rr_action)(ctx->rr_action_data, &rr);

@@ -843,10 +843,14 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,

/* A new unique name begins here. */

node = NULL;

result = dns_db_findnode(db, name, ISC_FALSE, &node);

- if (result == ISC_R_NOTFOUND)

+ if (result == ISC_R_NOTFOUND) {

+ dns_diff_clear(&trash);

return (DNS_R_NXRRSET);

- if (result != ISC_R_SUCCESS)

+ }

+ if (result != ISC_R_SUCCESS) {

+ dns_diff_clear(&trash);

return (result);

+ }

/* A new unique type begins here. */

while (t != NULL && dns_name_equal(&t->name, name)) {

@@ -854,7 +858,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,

dns_rdataset_t rdataset;

dns_diff_t d_rrs; /* Database RRs with

this name and type */

- dns_diff_t u_rrs; /* Update RRs with

+ dns_diff_t u_rrs; /* Update RRs with

this name and type */

*typep = type = t->rdata.type;

@@ -874,6 +878,7 @@ temp_check(isc_mem_t *mctx, dns_diff_t *temp, dns_db_t *db,

&rdataset, NULL);

if (result != ISC_R_SUCCESS) {

dns_db_detachnode(db, &node);

+ dns_diff_clear(&trash);

return (DNS_R_NXRRSET);

}

@@ -1119,7 +1124,7 @@ typedef struct {

static isc_result_t

add_rr_prepare_action(void *data, rr_t *rr) {

- isc_result_t result = ISC_R_SUCCESS;

+ isc_result_t result = ISC_R_SUCCESS;

add_rr_prepare_ctx_t *ctx = data;

dns_difftuple_t *tuple = NULL;

isc_boolean_t equal;

@@ -1647,10 +1652,11 @@ ksk_sanity(dns_db_t *db, dns_dbversion_t *ver) {

* Add RRSIG records for an RRset, recording the change in "diff".

static isc_result_t

-add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,

- dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,

- unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,

- isc_stdtime_t expire, isc_boolean_t check_ksk)

+add_sigs(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,

+ dns_dbversion_t *ver, dns_name_t *name, dns_rdatatype_t type,

+ dns_diff_t *diff, dst_key_t **keys, unsigned int nkeys,

+ isc_mem_t *mctx, isc_stdtime_t inception, isc_stdtime_t expire,

+ isc_boolean_t check_ksk)

{

isc_result_t result;

dns_dbnode_t *node = NULL;

@@ -1659,6 +1665,7 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,

isc_buffer_t buffer;

unsigned char data[1024]; /* XXX */

unsigned int i;

+ isc_boolean_t added_sig = ISC_FALSE;

dns_rdataset_init(&rdataset);

isc_buffer_init(&buffer, data, sizeof(data));

@@ -1671,14 +1678,14 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,

dns_db_detachnode(db, &node);

for (i = 0; i < nkeys; i++) {

if (check_ksk && type != dns_rdatatype_dnskey &&

(dst_key_flags(keys[i]) & DNS_KEYFLAG_KSK) != 0)

continue;

if (!dst_key_isprivate(keys[i]))

continue;

/* Calculate the signature, creating a RRSIG RDATA. */

CHECK(dns_dnssec_sign(name, &rdataset, keys[i],

&inception, &expire,

@@ -1689,6 +1696,13 @@ add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,

CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name,

rdataset.ttl, &sig_rdata));

dns_rdata_reset(&sig_rdata);

+ added_sig = ISC_TRUE;

+ }

+ if (!added_sig) {

+ update_log(client, zone, ISC_LOG_ERROR,

+ "found no private keys, "

+ "unable to generate any signatures");

+ result = ISC_R_NOTFOUND;

}

failure:

@@ -1770,7 +1784,7 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,

CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));

dns_rdataset_init(&rdataset);

CHECK(dns_db_findrdataset(db, node, newver, dns_rdatatype_soa, 0,

- (isc_stdtime_t) 0, &rdataset, NULL));

+ (isc_stdtime_t) 0, &rdataset, NULL));

CHECK(dns_rdataset_first(&rdataset));

dns_rdataset_current(&rdataset, &rdata);

CHECK(dns_rdata_tostruct(&rdata, &soa, NULL));

@@ -1820,9 +1834,9 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,

CHECK(rrset_exists(db, newver, name, type, 0, &flag));

if (flag) {

- CHECK(add_sigs(db, newver, name, type,

- &sig_diff, zone_keys, nkeys,

- client->mctx, inception,

+ CHECK(add_sigs(client, zone, db, newver, name,

+ type, &sig_diff, zone_keys,

+ nkeys, client->mctx, inception,

expire, check_ksk));

}

skip:

@@ -2006,10 +2020,10 @@ update_signatures(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,

dns_rdatatype_rrsig, dns_rdatatype_nsec,

NULL, &sig_diff));

} else if (t->op == DNS_DIFFOP_ADD) {

- CHECK(add_sigs(db, newver, &t->name, dns_rdatatype_nsec,

- &sig_diff, zone_keys, nkeys,

- client->mctx, inception, expire,

- check_ksk));

+ CHECK(add_sigs(client, zone, db, newver, &t->name,

+ dns_rdatatype_nsec, &sig_diff,

+ zone_keys, nkeys, client->mctx,

+ inception, expire, check_ksk));

} else {

INSIST(0);

}

@@ -2274,7 +2288,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone,

ownerbuf, namebuf,

dns_result_totext(DNS_R_MXISADDRESS));

}

* Check zone integrity checks.

@@ -2474,7 +2488,7 @@ update_action(isc_task_t *task, isc_event_t *event) {

else if (client->signer == NULL)

CHECK(checkupdateacl(client, NULL, "update", zonename,

ISC_FALSE));

if (dns_zone_getupdatedisabled(zone))

FAILC(DNS_R_REFUSED, "dynamic update temporarily disabled");

@@ -2881,7 +2895,7 @@ update_action(isc_task_t *task, isc_event_t *event) {

* The reason for failure should have been logged at this point.

if (ver != NULL) {

- update_log(client, zone, LOGLEVEL_DEBUG,

+ update_log(client, zone, LOGLEVEL_DEBUG,

"rolling back");

dns_db_closeversion(db, &ver, ISC_FALSE);

}

@@ -2933,7 +2947,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {

static void

forward_fail(isc_task_t *task, isc_event_t *event) {

- ns_client_t *client = (ns_client_t *)event->ev_arg;

+ ns_client_t *client = (ns_client_t *)event->ev_arg;

UNUSED(task);