13 files changed, 401 insertions, 223 deletions

diff --git a/contrib/bind9/bin/named/control.c b/contrib/bind9/bin/named/control.c
index 8bd8f6ce361f..ac1ec4217dad 100644
--- a/contrib/bind9/bin/named/control.c
+++ b/contrib/bind9/bin/named/control.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004-2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: control.c,v 1.33 2007/09/13 04:45:18 each Exp $ */
+/* $Id: control.c,v 1.33.266.2 2009/07/11 23:47:17 tbox Exp $ */
 
 /*! \file */
 
@@ -56,7 +56,7 @@ command_compare(const char *text, const char *command) {
 
 /*%
  * This function is called to process the incoming command
- * when a control channel message is received.  
+ * when a control channel message is received.
  */
 isc_result_t
 ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
@@ -170,10 +170,12 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 	} else if (command_compare(command, NS_COMMAND_TSIGDELETE)) {
 		result = ns_server_tsigdelete(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_FREEZE)) {
-		result = ns_server_freeze(ns_g_server, ISC_TRUE, command);
+		result = ns_server_freeze(ns_g_server, ISC_TRUE, command,
+					  text);
 	} else if (command_compare(command, NS_COMMAND_UNFREEZE) ||
 		   command_compare(command, NS_COMMAND_THAW)) {
-		result = ns_server_freeze(ns_g_server, ISC_FALSE, command);
+		result = ns_server_freeze(ns_g_server, ISC_FALSE, command,
+					  text);
 	} else if (command_compare(command, NS_COMMAND_RECURSING)) {
 		result = ns_server_dumprecursing(ns_g_server);
 	} else if (command_compare(command, NS_COMMAND_TIMERPOKE)) {
diff --git a/contrib/bind9/bin/named/include/named/server.h b/contrib/bind9/bin/named/include/named/server.h
index 43eccc4a63d4..1a3f746f3fb4 100644
--- a/contrib/bind9/bin/named/include/named/server.h
+++ b/contrib/bind9/bin/named/include/named/server.h
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.h,v 1.93.120.2 2009/01/29 23:47:44 tbox Exp $ */
+/* $Id: server.h,v 1.93.120.3 2009/07/11 04:23:53 marka Exp $ */
 
 #ifndef NAMED_SERVER_H
 #define NAMED_SERVER_H 1
@@ -276,7 +276,8 @@ ns_server_tsigdelete(ns_server_t *server, char *command, isc_buffer_t *text);
  * Enable or disable updates for a zone.
  */
 isc_result_t
-ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args);
+ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
+		 isc_buffer_t *text);
 
 /*%
  * Dump the current recursive queries.
diff --git a/contrib/bind9/bin/named/lwresd.8 b/contrib/bind9/bin/named/lwresd.8
index c0862aae1f49..56d272b23ad1 100644
--- a/contrib/bind9/bin/named/lwresd.8
+++ b/contrib/bind9/bin/named/lwresd.8
@@ -1,7 +1,7 @@
 .\" Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001 Internet Software Consortium.
 .\" 
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
 .\" copyright notice and this permission notice appear in all copies.
 .\" 
@@ -13,7 +13,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: lwresd.8,v 1.29.14.1 2009/01/23 01:53:33 tbox Exp $
+.\" $Id: lwresd.8,v 1.29.14.2 2009/07/11 01:55:21 tbox Exp $
 .\"
 .hy 0
 .ad l
diff --git a/contrib/bind9/bin/named/lwresd.html b/contrib/bind9/bin/named/lwresd.html
index 4c2b059fcfc6..728acc8a8164 100644
--- a/contrib/bind9/bin/named/lwresd.html
+++ b/contrib/bind9/bin/named/lwresd.html
@@ -2,7 +2,7 @@
  - Copyright (C) 2004, 2005, 2007-2009 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001 Internet Software Consortium.
  - 
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  - 
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: lwresd.html,v 1.25.14.1 2009/01/23 01:53:33 tbox Exp $ -->
+<!-- $Id: lwresd.html,v 1.25.14.2 2009/07/11 01:55:21 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
diff --git a/contrib/bind9/bin/named/named.8 b/contrib/bind9/bin/named/named.8
index 340840360fa6..287427274cbf 100644
--- a/contrib/bind9/bin/named/named.8
+++ b/contrib/bind9/bin/named/named.8
@@ -1,7 +1,7 @@
-.\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
 .\" 
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
 .\" copyright notice and this permission notice appear in all copies.
 .\" 
@@ -13,18 +13,18 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.8,v 1.38 2008/11/07 01:11:19 tbox Exp $
+.\" $Id: named.8,v 1.38.14.2 2009/12/03 05:06:38 tbox Exp $
 .\"
 .hy 0
 .ad l
 .\"     Title: named
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
-.\"      Date: June 30, 2000
+.\"      Date: May 21, 2009
 .\"    Manual: BIND9
 .\"    Source: BIND9
 .\"
-.TH "NAMED" "8" "June 30, 2000" "BIND9" "BIND9"
+.TH "NAMED" "8" "May 21, 2009" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -224,6 +224,16 @@ The
 \fBnamed\fR
 configuration file is too complex to describe in detail here. A complete description is provided in the
 BIND 9 Administrator Reference Manual.
+.PP
+\fBnamed\fR
+inherits the
+\fBumask\fR
+(file creation mode mask) from the parent process. If files created by
+\fBnamed\fR, such as journal files, need to have custom permissions, the
+\fBumask\fR
+should be set explicitly in the script used to start the
+\fBnamed\fR
+process.
 .SH "FILES"
 .PP
 \fI/etc/named.conf\fR
@@ -250,7 +260,7 @@ BIND 9 Administrator Reference Manual.
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2008 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000, 2001, 2003 Internet Software Consortium.
 .br
diff --git a/contrib/bind9/bin/named/named.conf.5 b/contrib/bind9/bin/named/named.conf.5
index 039c7954dfd8..3206f5d6bbcb 100644
--- a/contrib/bind9/bin/named/named.conf.5
+++ b/contrib/bind9/bin/named/named.conf.5
@@ -1,6 +1,6 @@
 .\" Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
 .\" 
-.\" Permission to use, copy, modify, and distribute this software for any
+.\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
 .\" copyright notice and this permission notice appear in all copies.
 .\" 
@@ -12,7 +12,7 @@
 .\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 .\" PERFORMANCE OF THIS SOFTWARE.
 .\"
-.\" $Id: named.conf.5,v 1.36 2008/09/25 04:45:04 tbox Exp $
+.\" $Id: named.conf.5,v 1.36.48.1 2009/07/11 01:55:21 tbox Exp $
 .\"
 .hy 0
 .ad l
diff --git a/contrib/bind9/bin/named/named.conf.html b/contrib/bind9/bin/named/named.conf.html
index 7bbbd0acbcbf..190f0c1b8886 100644
--- a/contrib/bind9/bin/named/named.conf.html
+++ b/contrib/bind9/bin/named/named.conf.html
@@ -1,7 +1,7 @@
 <!--
  - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
  - 
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  - 
@@ -13,7 +13,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.conf.html,v 1.45 2008/09/25 04:45:04 tbox Exp $ -->
+<!-- $Id: named.conf.html,v 1.45.48.1 2009/07/11 01:55:21 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
diff --git a/contrib/bind9/bin/named/named.docbook b/contrib/bind9/bin/named/named.docbook
index f47eae1e6b4b..246c4f5d399e 100644
--- a/contrib/bind9/bin/named/named.docbook
+++ b/contrib/bind9/bin/named/named.docbook
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2008  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -18,10 +18,10 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- $Id: named.docbook,v 1.23 2008/11/06 05:30:24 marka Exp $ -->
+<!-- $Id: named.docbook,v 1.23.14.2 2009/12/03 04:49:32 tbox Exp $ -->
 <refentry id="man.named">
   <refentryinfo>
-    <date>June 30, 2000</date>
+    <date>May 21, 2009</date>
   </refentryinfo>
 
   <refmeta>
@@ -42,6 +42,7 @@
       <year>2006</year>
       <year>2007</year>
       <year>2008</year>
+      <year>2009</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -374,6 +375,16 @@
       in the
       <citetitle>BIND 9 Administrator Reference Manual</citetitle>.
     </para>
+
+    <para>
+      <command>named</command> inherits the <function>umask</function>
+      (file creation mode mask) from the parent process. If files
+      created by <command>named</command>, such as journal files,
+      need to have custom permissions, the <function>umask</function>
+      should be set explicitly in the script used to start the
+      <command>named</command> process.
+    </para>
+
   </refsect1>
 
   <refsect1>
diff --git a/contrib/bind9/bin/named/named.html b/contrib/bind9/bin/named/named.html
index 23c9a7c32bc5..35224759ee71 100644
--- a/contrib/bind9/bin/named/named.html
+++ b/contrib/bind9/bin/named/named.html
@@ -1,8 +1,8 @@
 <!--
- - Copyright (C) 2004-2008 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000, 2001, 2003 Internet Software Consortium.
  - 
- - Permission to use, copy, modify, and distribute this software for any
+ - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
  - copyright notice and this permission notice appear in all copies.
  - 
@@ -14,7 +14,7 @@
  - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  - PERFORMANCE OF THIS SOFTWARE.
 -->
-<!-- $Id: named.html,v 1.30 2008/11/07 01:11:19 tbox Exp $ -->
+<!-- $Id: named.html,v 1.30.14.2 2009/12/03 05:06:38 tbox Exp $ -->
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
@@ -32,7 +32,7 @@
 <div class="cmdsynopsis"><p><code class="command">named</code>  [<code class="option">-4</code>] [<code class="option">-6</code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-d <em class="replaceable"><code>debug-level</code></em></code>] [<code class="option">-f</code>] [<code class="option">-g</code>] [<code class="option">-m <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-n <em class="replaceable"><code>#cpus</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-s</code>] [<code class="option">-S <em class="replaceable"><code>#max-socks</code></em></code>] [<code class="option">-t <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>] [<code class="option">-v</code>] [<code class="option">-V</code>] [<code class="option">-x <em class="replaceable"><code>cache-file</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543468"></a><h2>DESCRIPTION</h2>
+<a name="id2543472"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">named</strong></span>
       is a Domain Name System (DNS) server,
       part of the BIND 9 distribution from ISC.  For more
@@ -47,7 +47,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543493"></a><h2>OPTIONS</h2>
+<a name="id2543496"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-4</span></dt>
 <dd><p>
@@ -220,7 +220,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543928"></a><h2>SIGNALS</h2>
+<a name="id2543931"></a><h2>SIGNALS</h2>
 <p>
       In routine operation, signals should not be used to control
       the nameserver; <span><strong class="command">rndc</strong></span> should be used
@@ -241,16 +241,24 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543976"></a><h2>CONFIGURATION</h2>
+<a name="id2543979"></a><h2>CONFIGURATION</h2>
 <p>
       The <span><strong class="command">named</strong></span> configuration file is too complex
       to describe in detail here.  A complete description is provided
       in the
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
+<p>
+      <span><strong class="command">named</strong></span> inherits the <code class="function">umask</code>
+      (file creation mode mask) from the parent process. If files
+      created by <span><strong class="command">named</strong></span>, such as journal files,
+      need to have custom permissions, the <code class="function">umask</code>
+      should be set explicitly in the script used to start the
+      <span><strong class="command">named</strong></span> process.
+    </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543993"></a><h2>FILES</h2>
+<a name="id2544016"></a><h2>FILES</h2>
 <div class="variablelist"><dl>
 <dt><span class="term"><code class="filename">/etc/named.conf</code></span></dt>
 <dd><p>
@@ -263,7 +271,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544033"></a><h2>SEE ALSO</h2>
+<a name="id2544123"></a><h2>SEE ALSO</h2>
 <p><em class="citetitle">RFC 1033</em>,
       <em class="citetitle">RFC 1034</em>,
       <em class="citetitle">RFC 1035</em>,
@@ -276,7 +284,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544171"></a><h2>AUTHOR</h2>
+<a name="id2544194"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/contrib/bind9/bin/named/query.c b/contrib/bind9/bin/named/query.c
index a56d2e646f7f..cef6d7f7c3a8 100644
--- a/contrib/bind9/bin/named/query.c
+++ b/contrib/bind9/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.313.20.7.12.4 2009/12/31 22:53:03 each Exp $ */
+/* $Id: query.c,v 1.313.20.16 2009/12/30 08:34:29 jinmei Exp $ */
 
 /*! \file */
 
@@ -2244,7 +2244,8 @@ query_addns(ns_client_t *client, dns_db_t *db, dns_dbversion_t *version) {
 
 static inline isc_result_t
 query_addcnamelike(ns_client_t *client, dns_name_t *qname, dns_name_t *tname,
-		   dns_trust_t trust, dns_name_t **anamep, dns_rdatatype_t type)
+		   dns_rdataset_t *dname, dns_name_t **anamep,
+		   dns_rdatatype_t type)
 {
 	dns_rdataset_t *rdataset;
 	dns_rdatalist_t *rdatalist;
@@ -2280,7 +2281,7 @@ query_addcnamelike(ns_client_t *client, dns_name_t *qname, dns_name_t *tname,
 	rdatalist->type = type;
 	rdatalist->covers = 0;
 	rdatalist->rdclass = client->message->rdclass;
-	rdatalist->ttl = 0;
+	rdatalist->ttl = dname->ttl;
 
 	dns_name_toregion(tname, &r);
 	rdata->data = r.base;
@@ -2292,7 +2293,7 @@ query_addcnamelike(ns_client_t *client, dns_name_t *qname, dns_name_t *tname,
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	RUNTIME_CHECK(dns_rdatalist_tordataset(rdatalist, rdataset)
 		      == ISC_R_SUCCESS);
-	rdataset->trust = trust;
+	rdataset->trust = dname->trust;
 
 	query_addrrset(client, anamep, &rdataset, NULL, NULL,
 		       DNS_SECTION_ANSWER);
@@ -2735,7 +2736,7 @@ query_addds(ns_client_t *client, dns_db_t *db, dns_dbnode_t *node,
 	return;
 
    addnsec3:
-	if (dns_db_iscache(db))
+	if (!dns_db_iszone(db))
 		goto cleanup;
 	/*
 	 * Add the NSEC3 which proves the DS does not exist.
@@ -3317,6 +3318,14 @@ do { \
 	line = __LINE__; \
 } while (0)
 
+#define RECURSE_ERROR(r) \
+do { \
+	if ((r) == DNS_R_DUPLICATE || (r) == DNS_R_DROP) \
+		QUERY_ERROR(r); \
+	else \
+		QUERY_ERROR(DNS_R_SERVFAIL); \
+} while (0)
+
 /*
  * Extract a network address from the RDATA of an A or AAAA
  * record.
@@ -3604,7 +3613,7 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 		       dns_name_t *found)
 {
 	unsigned char salt[256];
-	size_t salt_length = sizeof(salt);
+	size_t salt_length;
 	isc_uint16_t iterations;
 	isc_result_t result;
 	unsigned int dboptions;
@@ -3999,14 +4008,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
-				else if (result == DNS_R_DUPLICATE ||
-					 result == DNS_R_DROP) {
-					/* Duplicate query. */
-					QUERY_ERROR(result);
-				} else {
-					/* Unable to recurse. */
-					QUERY_ERROR(DNS_R_SERVFAIL);
-				}
+				else
+					RECURSE_ERROR(result);
 				goto cleanup;
 			} else {
 				/* Unable to give root server referral. */
@@ -4185,11 +4188,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 				if (result == ISC_R_SUCCESS)
 					client->query.attributes |=
 						NS_QUERYATTR_RECURSING;
-				else if (result == DNS_R_DUPLICATE ||
-					 result == DNS_R_DROP)
-					QUERY_ERROR(result);
 				else
-					QUERY_ERROR(DNS_R_SERVFAIL);
+					RECURSE_ERROR(result);
 			} else {
 				dns_fixedname_t fixed;
 
@@ -4603,7 +4603,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 		 */
 		dns_name_init(tname, NULL);
 		(void)query_addcnamelike(client, client->query.qname, fname,
-					 trdataset->trust, &tname,
+					 trdataset, &tname,
 					 dns_rdatatype_cname);
 		if (tname != NULL)
 			dns_message_puttempname(client->message, &tname);
@@ -4729,7 +4729,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 						    client->query.attributes |=
 							NS_QUERYATTR_RECURSING;
 						else
-						    QUERY_ERROR(DNS_R_SERVFAIL);					}
+						    RECURSE_ERROR(result);
+					}
 					goto addauth;
 				}
 				/*
@@ -5123,9 +5124,17 @@ ns_query_start(ns_client_t *client) {
 	}
 
 	/*
-	 * Turn on minimal response for DNSKEY queries.
+	 * Turn on minimal response for DNSKEY and DS queries.
+	 */
+	if (qtype == dns_rdatatype_dnskey || qtype == dns_rdatatype_ds)
+		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
+					     NS_QUERYATTR_NOADDITIONAL);
+
+	/*
+	 * Turn on minimal responses for EDNS/UDP bufsize 512 queries.
 	 */
-	if (qtype == dns_rdatatype_dnskey)
+	if (client->opt != NULL && client->udpsize <= 512U &&
+	    (client->attributes & NS_CLIENTATTR_TCP) == 0)
 		client->query.attributes |= (NS_QUERYATTR_NOAUTHORITY |
 					     NS_QUERYATTR_NOADDITIONAL);
 
diff --git a/contrib/bind9/bin/named/server.c b/contrib/bind9/bin/named/server.c
index e685e18dc336..b9259c71a7c1 100644
--- a/contrib/bind9/bin/named/server.c
+++ b/contrib/bind9/bin/named/server.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: server.c,v 1.520.12.7 2009/01/30 03:53:38 marka Exp $ */
+/* $Id: server.c,v 1.520.12.11 2009/12/24 00:17:47 each Exp $ */
 
 /*! \file */
 
@@ -2826,7 +2826,7 @@ set_limit(const cfg_obj_t **maps, const char *configname,
 	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_SERVER,
 		      result == ISC_R_SUCCESS ?
 			ISC_LOG_DEBUG(3) : ISC_LOG_WARNING,
-		      "set maximum %s to %" ISC_PRINT_QUADFORMAT "d: %s",
+		      "set maximum %s to %" ISC_PRINT_QUADFORMAT "u: %s",
 		      description, value, isc_result_totext(result));
 }
 
@@ -4337,6 +4337,8 @@ zone_from_args(ns_server_t *server, char *args, dns_zone_t **zonep) {
 	/* Partial match? */
 	if (result != ISC_R_SUCCESS && *zonep != NULL)
 		dns_zone_detach(zonep);
+	if (result == DNS_R_PARTIALMATCH)
+		result = ISC_R_NOTFOUND;
  fail1:
 	return (result);
 }
@@ -5401,7 +5403,9 @@ ns_server_tsiglist(ns_server_t *server, isc_buffer_t *text) {
  * Act on a "freeze" or "thaw" command from the command channel.
  */
 isc_result_t
-ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
+ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args,
+		 isc_buffer_t *text)
+{
 	isc_result_t result, tresult;
 	dns_zone_t *zone = NULL;
 	dns_zonetype_t type;
@@ -5411,6 +5415,7 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
 	char *journal;
 	const char *vname, *sep;
 	isc_boolean_t frozen;
+	const char *msg = NULL;
 
 	result = zone_from_args(server, args, &zone);
 	if (result != ISC_R_SUCCESS)
@@ -5441,27 +5446,52 @@ ns_server_freeze(ns_server_t *server, isc_boolean_t freeze, char *args) {
 		return (ISC_R_NOTFOUND);
 	}
 
+	result = isc_task_beginexclusive(server->task);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	frozen = dns_zone_getupdatedisabled(zone);
 	if (freeze) {
-		if (frozen)
+		if (frozen) {
+			msg = "WARNING: The zone was already frozen.\n"
+			      "Someone else may be editing it or "
+			      "it may still be re-loading.";
 			result = DNS_R_FROZEN;
-		if (result == ISC_R_SUCCESS)
+		}
+		if (result == ISC_R_SUCCESS) {
 			result = dns_zone_flush(zone);
+			if (result != ISC_R_SUCCESS)
+				msg = "Flushing the zone updates to "
+				      "disk failed.";
+		}
 		if (result == ISC_R_SUCCESS) {
 			journal = dns_zone_getjournal(zone);
 			if (journal != NULL)
 				(void)isc_file_remove(journal);
 		}
+		if (result == ISC_R_SUCCESS)
+			dns_zone_setupdatedisabled(zone, freeze);
 	} else {
 		if (frozen) {
-			result = dns_zone_load(zone);
-			if (result == DNS_R_CONTINUE ||
-			    result == DNS_R_UPTODATE)
+			result = dns_zone_loadandthaw(zone);
+			switch (result) {
+			case ISC_R_SUCCESS:
+			case DNS_R_UPTODATE:
+				msg = "The zone reload and thaw was "
+				      "successful.";
 				result = ISC_R_SUCCESS;
+				break;
+			case DNS_R_CONTINUE:
+				msg = "A zone reload and thaw was started.\n"
+				      "Check the logs to see the result.";
+				result = ISC_R_SUCCESS;
+				break;
+			}
 		}
 	}
-	if (result == ISC_R_SUCCESS)
-		dns_zone_setupdatedisabled(zone, freeze);
+	isc_task_endexclusive(server->task);
+
+	if (msg != NULL && strlen(msg) < isc_buffer_availablelength(text))
+		isc_buffer_putmem(text, (const unsigned char *)msg,
+				  strlen(msg) + 1);
 
 	view = dns_zone_getview(zone);
 	if (strcmp(view->name, "_bind") == 0 ||
diff --git a/contrib/bind9/bin/named/statschannel.c b/contrib/bind9/bin/named/statschannel.c
index 81f40bb2d15a..4773ec6dcad5 100644
--- a/contrib/bind9/bin/named/statschannel.c
+++ b/contrib/bind9/bin/named/statschannel.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2010  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: statschannel.c,v 1.14.64.6 2009/02/17 03:43:07 marka Exp $ */
+/* $Id: statschannel.c,v 1.14.64.11 2010/02/04 23:47:46 tbox Exp $ */
 
 /*! \file */
 
@@ -70,6 +70,7 @@ stats_dumparg {
 	int		ncounters;	/* used for general statistics */
 	int		*counterindices; /* used for general statistics */
 	isc_uint64_t	*countervalues;	 /* used for general statistics */
+	isc_result_t	result;
 } stats_dumparg_t;
 
 static isc_once_t once = ISC_ONCE_INIT;
@@ -95,6 +96,8 @@ static const char *sockstats_xmldesc[isc_sockstatscounter_max];
 #define sockstats_xmldesc NULL
 #endif	/* HAVE_LIBXML2 */
 
+#define TRY0(a) do { xmlrc = (a); if (xmlrc < 0) goto error; } while(0)
+
 /*%
  * Mapping arrays to represent statistics counters in the order of our
  * preference, regardless of the order of counter indices.  For example,
@@ -129,11 +132,11 @@ init_desc(void) {
 	int i;
 
 	/* Initialize name server statistics */
-	memset((void *)nsstats_desc, 0,
-	       dns_nsstatscounter_max * sizeof(nsstats_desc[0]));
+	for (i = 0; i < dns_nsstatscounter_max; i++)
+		nsstats_desc[i] = NULL;
 #ifdef HAVE_LIBXML2
-	memset((void *)nsstats_xmldesc, 0,
-	       dns_nsstatscounter_max * sizeof(nsstats_xmldesc[0]));
+	for (i = 0; i < dns_nsstatscounter_max; i++)
+		nsstats_xmldesc[i] = NULL;
 #endif
 
 #define SET_NSSTATDESC(counterid, desc, xmldesc) \
@@ -197,11 +200,11 @@ init_desc(void) {
 	INSIST(i == dns_nsstatscounter_max);
 
 	/* Initialize resolver statistics */
-	memset((void *)resstats_desc, 0,
-	       dns_resstatscounter_max * sizeof(resstats_desc[0]));
+	for (i = 0; i < dns_resstatscounter_max; i++)
+		resstats_desc[i] = NULL;
 #ifdef  HAVE_LIBXML2
-	memset((void *)resstats_xmldesc, 0,
-	       dns_resstatscounter_max * sizeof(resstats_xmldesc[0]));
+	for (i = 0; i < dns_resstatscounter_max; i++)
+		resstats_xmldesc[i] = NULL;
 #endif
 
 #define SET_RESSTATDESC(counterid, desc, xmldesc) \
@@ -267,11 +270,11 @@ init_desc(void) {
 	INSIST(i == dns_resstatscounter_max);
 
 	/* Initialize zone statistics */
-	memset((void *)zonestats_desc, 0,
-	       dns_zonestatscounter_max * sizeof(zonestats_desc[0]));
+	for (i = 0; i < dns_zonestatscounter_max; i++)
+		zonestats_desc[i] = NULL;
 #ifdef  HAVE_LIBXML2
-	memset((void *)zonestats_xmldesc, 0,
-	       dns_zonestatscounter_max * sizeof(zonestats_xmldesc[0]));
+	for (i = 0; i < dns_zonestatscounter_max; i++)
+		zonestats_xmldesc[i] = NULL;
 #endif
 
 #define SET_ZONESTATDESC(counterid, desc, xmldesc) \
@@ -299,11 +302,11 @@ init_desc(void) {
 	INSIST(i == dns_zonestatscounter_max);
 
 	/* Initialize socket statistics */
-	memset((void *)sockstats_desc, 0,
-	       isc_sockstatscounter_max * sizeof(sockstats_desc[0]));
+	for (i = 0; i < isc_sockstatscounter_max; i++)
+		sockstats_desc[i] = NULL;
 #ifdef  HAVE_LIBXML2
-	memset((void *)sockstats_xmldesc, 0,
-	       isc_sockstatscounter_max * sizeof(sockstats_xmldesc[0]));
+	for (i = 0; i < isc_sockstatscounter_max; i++)
+		sockstats_xmldesc[i] = NULL;
 #endif
 
 #define SET_SOCKSTATDESC(counterid, desc, xmldesc) \
@@ -437,7 +440,7 @@ generalstat_dump(isc_statscounter_t counter, isc_uint64_t val, void *arg) {
 	dumparg->countervalues[counter] = val;
 }
 
-static void
+static isc_result_t
 dump_counters(isc_stats_t *stats, statsformat_t type, void *arg,
 	      const char *category, const char **desc, int ncounters,
 	      int *indices, isc_uint64_t *values, int options)
@@ -448,6 +451,7 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg,
 	FILE *fp;
 #ifdef HAVE_LIBXML2
 	xmlTextWriterPtr writer;
+	int xmlrc;
 #endif
 
 #ifndef HAVE_LIBXML2
@@ -480,31 +484,41 @@ dump_counters(isc_stats_t *stats, statsformat_t type, void *arg,
 			writer = arg;
 
 			if (category != NULL) {
-				xmlTextWriterStartElement(writer,
-							  ISC_XMLCHAR
-							  category);
-				xmlTextWriterStartElement(writer,
-							  ISC_XMLCHAR "name");
-				xmlTextWriterWriteString(writer, ISC_XMLCHAR
-							desc[index]);
-				xmlTextWriterEndElement(writer); /* name */
+				TRY0(xmlTextWriterStartElement(writer,
+							       ISC_XMLCHAR
+							       category));
+				TRY0(xmlTextWriterStartElement(writer,
+							       ISC_XMLCHAR
+							       "name"));
+				TRY0(xmlTextWriterWriteString(writer,
+							      ISC_XMLCHAR
+							      desc[index]));
+				TRY0(xmlTextWriterEndElement(writer)); /* name */
 
-				xmlTextWriterStartElement(writer, ISC_XMLCHAR
-							  "counter");
+				TRY0(xmlTextWriterStartElement(writer,
+							       ISC_XMLCHAR
+							       "counter"));
 			} else {
-				xmlTextWriterStartElement(writer, ISC_XMLCHAR
-							  desc[index]);
+				TRY0(xmlTextWriterStartElement(writer,
+							       ISC_XMLCHAR
+							       desc[index]));
 			}
-			xmlTextWriterWriteFormatString(writer,
-						       "%" ISC_PRINT_QUADFORMAT
-						       "u", value);
-			xmlTextWriterEndElement(writer); /* counter */
+			TRY0(xmlTextWriterWriteFormatString(writer,
+							    "%"
+							    ISC_PRINT_QUADFORMAT
+							    "u", value));
+			TRY0(xmlTextWriterEndElement(writer)); /* counter */
 			if (category != NULL)
-				xmlTextWriterEndElement(writer); /* category */
+				TRY0(xmlTextWriterEndElement(writer)); /* category */
 #endif
 			break;
 		}
 	}
+	return (ISC_R_SUCCESS);
+#ifdef HAVE_LIBXML2
+ error:
+	return (ISC_R_FAILURE);
+#endif
 }
 
 static void
@@ -515,6 +529,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
 	FILE *fp;
 #ifdef HAVE_LIBXML2
 	xmlTextWriterPtr writer;
+	int xmlrc;
 #endif
 
 	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_OTHERTYPE)
@@ -534,22 +549,28 @@ rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
 #ifdef HAVE_LIBXML2
 		writer = dumparg->arg;
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdtype");
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdtype"));
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteString(writer, ISC_XMLCHAR typestr);
-		xmlTextWriterEndElement(writer); /* name */
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR typestr));
+		TRY0(xmlTextWriterEndElement(writer)); /* name */
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
-		xmlTextWriterWriteFormatString(writer,
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
+		TRY0(xmlTextWriterWriteFormatString(writer,
 					       "%" ISC_PRINT_QUADFORMAT "u",
-					       val);
-		xmlTextWriterEndElement(writer); /* counter */
+					       val));
+		TRY0(xmlTextWriterEndElement(writer)); /* counter */
 
-		xmlTextWriterEndElement(writer); /* rdtype */
+		TRY0(xmlTextWriterEndElement(writer)); /* rdtype */
 #endif
 		break;
 	}
+	return;
+#ifdef HAVE_LIBXML2
+ error:
+	dumparg->result = ISC_R_FAILURE;
+	return;
+#endif
 }
 
 static void
@@ -561,6 +582,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
 	isc_boolean_t nxrrset = ISC_FALSE;
 #ifdef HAVE_LIBXML2
 	xmlTextWriterPtr writer;
+	int xmlrc;
 #endif
 
 	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_NXDOMAIN)
@@ -589,22 +611,28 @@ rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
 #ifdef HAVE_LIBXML2
 		writer = dumparg->arg;
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset");
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteFormatString(writer, "%s%s",
-					       nxrrset ? "!" : "", typestr);
-		xmlTextWriterEndElement(writer); /* name */
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rrset"));
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+		TRY0(xmlTextWriterWriteFormatString(writer, "%s%s",
+					       nxrrset ? "!" : "", typestr));
+		TRY0(xmlTextWriterEndElement(writer)); /* name */
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
-		xmlTextWriterWriteFormatString(writer,
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
+		TRY0(xmlTextWriterWriteFormatString(writer,
 					       "%" ISC_PRINT_QUADFORMAT "u",
-					       val);
-		xmlTextWriterEndElement(writer); /* counter */
+					       val));
+		TRY0(xmlTextWriterEndElement(writer)); /* counter */
 
-		xmlTextWriterEndElement(writer); /* rrset */
+		TRY0(xmlTextWriterEndElement(writer)); /* rrset */
 #endif
 		break;
 	}
+	return;
+#ifdef HAVE_LIBXML2
+ error:
+	dumparg->result = ISC_R_FAILURE;
+#endif
+
 }
 
 static void
@@ -615,6 +643,7 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
 	stats_dumparg_t *dumparg = arg;
 #ifdef HAVE_LIBXML2
 	xmlTextWriterPtr writer;
+	int xmlrc;
 #endif
 
 	isc_buffer_init(&b, codebuf, sizeof(codebuf) - 1);
@@ -630,30 +659,35 @@ opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
 #ifdef HAVE_LIBXML2
 		writer = dumparg->arg;
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "opcode");
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "opcode"));
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteString(writer, ISC_XMLCHAR codebuf);
-		xmlTextWriterEndElement(writer); /* name */
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR codebuf));
+		TRY0(xmlTextWriterEndElement(writer)); /* name */
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter");
-		xmlTextWriterWriteFormatString(writer,
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
+		TRY0(xmlTextWriterWriteFormatString(writer,
 					       "%" ISC_PRINT_QUADFORMAT "u",
-					       val);
-		xmlTextWriterEndElement(writer); /* counter */
+					       val));
+		TRY0(xmlTextWriterEndElement(writer)); /* counter */
 
-		xmlTextWriterEndElement(writer); /* opcode */
+		TRY0(xmlTextWriterEndElement(writer)); /* opcode */
 #endif
 		break;
 	}
+	return;
+
+#ifdef HAVE_LIBXML2
+ error:
+	dumparg->result = ISC_R_FAILURE;
+	return;
+#endif
 }
 
 #ifdef HAVE_LIBXML2
 
 /* XXXMLG below here sucks. */
 
-#define TRY(a) do { result = (a); INSIST(result == ISC_R_SUCCESS); } while(0);
-#define TRY0(a) do { xmlrc = (a); INSIST(xmlrc >= 0); } while(0);
 
 static isc_result_t
 zone_xmlrender(dns_zone_t *zone, void *arg) {
@@ -663,47 +697,55 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	xmlTextWriterPtr writer = arg;
 	isc_stats_t *zonestats;
 	isc_uint64_t nsstat_values[dns_nsstatscounter_max];
+	int xmlrc;
+	isc_result_t result;
 
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone");
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zone"));
 
 	dns_zone_name(zone, buf, sizeof(buf));
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-	xmlTextWriterWriteString(writer, ISC_XMLCHAR buf);
-	xmlTextWriterEndElement(writer);
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf));
+	TRY0(xmlTextWriterEndElement(writer));
 
 	rdclass = dns_zone_getclass(zone);
 	dns_rdataclass_format(rdclass, buf, sizeof(buf));
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdataclass");
-	xmlTextWriterWriteString(writer, ISC_XMLCHAR buf);
-	xmlTextWriterEndElement(writer);
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rdataclass"));
+	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR buf));
+	TRY0(xmlTextWriterEndElement(writer));
 
-	serial = dns_zone_getserial(zone);
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial");
-	xmlTextWriterWriteFormatString(writer, "%u", serial);
-	xmlTextWriterEndElement(writer);
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"));
+	if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS)
+		TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial));
+	else
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
+	TRY0(xmlTextWriterEndElement(writer));
 
 	zonestats = dns_zone_getrequeststats(zone);
 	if (zonestats != NULL) {
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters");
-		dump_counters(zonestats, statsformat_xml, writer, NULL,
-			      nsstats_xmldesc, dns_nsstatscounter_max,
-			      nsstats_index, nsstat_values,
-			      ISC_STATSDUMP_VERBOSE);
-		xmlTextWriterEndElement(writer); /* counters */
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counters"));
+		result = dump_counters(zonestats, statsformat_xml, writer, NULL,
+				      nsstats_xmldesc, dns_nsstatscounter_max,
+				      nsstats_index, nsstat_values,
+				      ISC_STATSDUMP_VERBOSE);
+		if (result != ISC_R_SUCCESS)
+			goto error;
+		TRY0(xmlTextWriterEndElement(writer)); /* counters */
 	}
 
-	xmlTextWriterEndElement(writer); /* zone */
+	TRY0(xmlTextWriterEndElement(writer)); /* zone */
 
 	return (ISC_R_SUCCESS);
+ error:
+	return (ISC_R_FAILURE);
 }
 
-static void
+static isc_result_t
 generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	char boottime[sizeof "yyyy-mm-ddThh:mm:ssZ"];
 	char nowstr[sizeof "yyyy-mm-ddThh:mm:ssZ"];
 	isc_time_t now;
-	xmlTextWriterPtr writer;
-	xmlDocPtr doc;
+	xmlTextWriterPtr writer = NULL;
+	xmlDocPtr doc = NULL;
 	int xmlrc;
 	dns_view_t *view;
 	stats_dumparg_t dumparg;
@@ -712,12 +754,15 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	isc_uint64_t resstat_values[dns_resstatscounter_max];
 	isc_uint64_t zonestat_values[dns_zonestatscounter_max];
 	isc_uint64_t sockstat_values[isc_sockstatscounter_max];
+	isc_result_t result;
 
 	isc_time_now(&now);
 	isc_time_formatISO8601(&ns_g_boottime, boottime, sizeof boottime);
 	isc_time_formatISO8601(&now, nowstr, sizeof nowstr);
 
 	writer = xmlNewTextWriterDoc(&doc, 0);
+	if (writer == NULL)
+		goto error;
 	TRY0(xmlTextWriterStartDocument(writer, NULL, "UTF-8", NULL));
 	TRY0(xmlTextWriterWritePI(writer, ISC_XMLCHAR "xml-stylesheet",
 			ISC_XMLCHAR "type=\"text/xsl\" href=\"/bind9.xsl\""));
@@ -728,7 +773,7 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "bind"));
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "statistics"));
 	TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "version",
-					 ISC_XMLCHAR "2.0"));
+					 ISC_XMLCHAR "2.2"));
 
 	/* Set common fields for statistics dump */
 	dumparg.type = statsformat_xml;
@@ -741,39 +786,55 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	view = ISC_LIST_HEAD(server->viewlist);
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "views"));
 	while (view != NULL) {
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "view");
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "view"));
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "name");
-		xmlTextWriterWriteString(writer, ISC_XMLCHAR view->name);
-		xmlTextWriterEndElement(writer);
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "name"));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR view->name));
+		TRY0(xmlTextWriterEndElement(writer));
 
-		xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones");
-		dns_zt_apply(view->zonetable, ISC_FALSE, zone_xmlrender,
-			     writer);
-		xmlTextWriterEndElement(writer);
+		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "zones"));
+		result = dns_zt_apply(view->zonetable, ISC_TRUE, zone_xmlrender,
+				      writer);
+		if (result != ISC_R_SUCCESS)
+			goto error;
+		TRY0(xmlTextWriterEndElement(writer));
 
 		if (view->resquerystats != NULL) {
+			dumparg.result = ISC_R_SUCCESS;
 			dns_rdatatypestats_dump(view->resquerystats,
 						rdtypestat_dump, &dumparg, 0);
+			if (dumparg.result != ISC_R_SUCCESS)
+				goto error;
 		}
 
 		if (view->resstats != NULL) {
-			dump_counters(view->resstats, statsformat_xml, writer,
-				      "resstat", resstats_xmldesc,
-				      dns_resstatscounter_max, resstats_index,
-				      resstat_values, ISC_STATSDUMP_VERBOSE);
+			result = dump_counters(view->resstats, statsformat_xml,
+					       writer, "resstat",
+					       resstats_xmldesc,
+					       dns_resstatscounter_max,
+					       resstats_index, resstat_values,
+					       ISC_STATSDUMP_VERBOSE);
+			if (result != ISC_R_SUCCESS)
+				goto error;
 		}
 
 		cachestats = dns_db_getrrsetstats(view->cachedb);
 		if (cachestats != NULL) {
-			xmlTextWriterStartElement(writer,
-						  ISC_XMLCHAR "cache");
+			TRY0(xmlTextWriterStartElement(writer,
+						       ISC_XMLCHAR "cache"));
+			TRY0(xmlTextWriterWriteAttribute(writer,
+							 ISC_XMLCHAR "name",
+							 ISC_XMLCHAR
+							 view->name));
+			dumparg.result = ISC_R_SUCCESS;
 			dns_rdatasetstats_dump(cachestats, rdatasetstats_dump,
 					       &dumparg, 0);
-			xmlTextWriterEndElement(writer); /* cache */
+			if (dumparg.result != ISC_R_SUCCESS)
+				goto error;
+			TRY0(xmlTextWriterEndElement(writer)); /* cache */
 		}
 
-		xmlTextWriterEndElement(writer); /* view */
+		TRY0(xmlTextWriterEndElement(writer)); /* view */
 
 		view = ISC_LIST_NEXT(view, link);
 	}
@@ -788,44 +849,63 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 	TRY0(xmlTextWriterEndElement(writer)); /* taskmgr */
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "server"));
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "boot-time");
-	xmlTextWriterWriteString(writer, ISC_XMLCHAR boottime);
-	xmlTextWriterEndElement(writer);
-	xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time");
-	xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr);
-	xmlTextWriterEndElement(writer);
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "boot-time"));
+	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR boottime));
+	TRY0(xmlTextWriterEndElement(writer));
+	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "current-time"));
+	TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR nowstr));
+	TRY0(xmlTextWriterEndElement(writer));
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "requests"));
+	dumparg.result = ISC_R_SUCCESS;
 	dns_opcodestats_dump(server->opcodestats, opcodestat_dump, &dumparg,
 			     0);
-	xmlTextWriterEndElement(writer); /* requests */
+	if (dumparg.result != ISC_R_SUCCESS)
+		goto error;
+	TRY0(xmlTextWriterEndElement(writer)); /* requests */
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "queries-in"));
+	dumparg.result = ISC_R_SUCCESS;
 	dns_rdatatypestats_dump(server->rcvquerystats, rdtypestat_dump,
 				&dumparg, 0);
-	xmlTextWriterEndElement(writer); /* queries-in */
+	if (dumparg.result != ISC_R_SUCCESS)
+		goto error;
+	TRY0(xmlTextWriterEndElement(writer)); /* queries-in */
 
-	dump_counters(server->nsstats, statsformat_xml, writer,
-		      "nsstat", nsstats_xmldesc, dns_nsstatscounter_max,
-		      nsstats_index, nsstat_values, ISC_STATSDUMP_VERBOSE);
+	result = dump_counters(server->nsstats, statsformat_xml, writer,
+			       "nsstat", nsstats_xmldesc,
+				dns_nsstatscounter_max,
+				nsstats_index, nsstat_values,
+				ISC_STATSDUMP_VERBOSE);
+	if (result != ISC_R_SUCCESS)
+		goto error;
 
-	dump_counters(server->zonestats, statsformat_xml, writer, "zonestat",
-		      zonestats_xmldesc, dns_zonestatscounter_max,
-		      zonestats_index, zonestat_values, ISC_STATSDUMP_VERBOSE);
+	result = dump_counters(server->zonestats, statsformat_xml, writer,
+			       "zonestat", zonestats_xmldesc,
+			       dns_zonestatscounter_max, zonestats_index,
+			       zonestat_values, ISC_STATSDUMP_VERBOSE);
+	if (result != ISC_R_SUCCESS)
+		goto error;
 
 	/*
 	 * Most of the common resolver statistics entries are 0, so we don't
 	 * use the verbose dump here.
 	 */
-	dump_counters(server->resolverstats, statsformat_xml, writer, "resstat",
-		      resstats_xmldesc, dns_resstatscounter_max, resstats_index,
-		      resstat_values, 0);
+	result = dump_counters(server->resolverstats, statsformat_xml, writer,
+			       "resstat", resstats_xmldesc,
+			       dns_resstatscounter_max, resstats_index,
+			       resstat_values, 0);
+	if (result != ISC_R_SUCCESS)
+		goto error;
 
-	dump_counters(server->sockstats, statsformat_xml, writer, "sockstat",
-		      sockstats_xmldesc, isc_sockstatscounter_max,
-		      sockstats_index, sockstat_values, ISC_STATSDUMP_VERBOSE);
+	result = dump_counters(server->sockstats, statsformat_xml, writer,
+			       "sockstat", sockstats_xmldesc,
+			       isc_sockstatscounter_max, sockstats_index,
+			       sockstat_values, ISC_STATSDUMP_VERBOSE);
+	if (result != ISC_R_SUCCESS)
+		goto error;
 
-	xmlTextWriterEndElement(writer); /* server */
+	TRY0(xmlTextWriterEndElement(writer)); /* server */
 
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "memory"));
 	isc_mem_renderxml(writer);
@@ -841,6 +921,14 @@ generatexml(ns_server_t *server, int *buflen, xmlChar **buf) {
 
 	xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 1);
 	xmlFreeDoc(doc);
+	return (ISC_R_SUCCESS);
+
+ error:
+	if (writer != NULL)
+		xmlFreeTextWriter(writer);
+	if (doc != NULL)
+		xmlFreeDoc(doc);
+	return (ISC_R_FAILURE);
 }
 
 static void
@@ -859,21 +947,24 @@ render_index(const char *url, const char *querystring, void *arg,
 	unsigned char *msg;
 	int msglen;
 	ns_server_t *server = arg;
+	isc_result_t result;
 
 	UNUSED(url);
 	UNUSED(querystring);
 
-	generatexml(server, &msglen, &msg);
+	result = generatexml(server, &msglen, &msg);
 
-	*retcode = 200;
-	*retmsg = "OK";
-	*mimetype = "text/xml";
-	isc_buffer_reinit(b, msg, msglen);
-	isc_buffer_add(b, msglen);
-	*freecb = wrap_xmlfree;
-	*freecb_args = NULL;
+	if (result == ISC_R_SUCCESS) {
+		*retcode = 200;
+		*retmsg = "OK";
+		*mimetype = "text/xml";
+		isc_buffer_reinit(b, msg, msglen);
+		isc_buffer_add(b, msglen);
+		*freecb = wrap_xmlfree;
+		*freecb_args = NULL;
+	}
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 #endif	/* HAVE_LIBXML2 */
@@ -1274,20 +1365,20 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
 	}
 
 	fprintf(fp, "++ Name Server Statistics ++\n");
-	dump_counters(server->nsstats, statsformat_file, fp, NULL,
-		      nsstats_desc, dns_nsstatscounter_max, nsstats_index,
-		      nsstat_values, 0);
+	(void) dump_counters(server->nsstats, statsformat_file, fp, NULL,
+			     nsstats_desc, dns_nsstatscounter_max,
+			     nsstats_index, nsstat_values, 0);
 
 	fprintf(fp, "++ Zone Maintenance Statistics ++\n");
-	dump_counters(server->zonestats, statsformat_file, fp, NULL,
-		      zonestats_desc, dns_zonestatscounter_max,
-		      zonestats_index, zonestat_values, 0);
+	(void) dump_counters(server->zonestats, statsformat_file, fp, NULL,
+			     zonestats_desc, dns_zonestatscounter_max,
+			     zonestats_index, zonestat_values, 0);
 
 	fprintf(fp, "++ Resolver Statistics ++\n");
 	fprintf(fp, "[Common]\n");
-	dump_counters(server->resolverstats, statsformat_file, fp, NULL,
-		      resstats_desc, dns_resstatscounter_max, resstats_index,
-		      resstat_values, 0);
+	(void) dump_counters(server->resolverstats, statsformat_file, fp, NULL,
+			     resstats_desc, dns_resstatscounter_max,
+			     resstats_index, resstat_values, 0);
 	for (view = ISC_LIST_HEAD(server->viewlist);
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link)) {
@@ -1297,9 +1388,9 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
 			fprintf(fp, "[View: default]\n");
 		else
 			fprintf(fp, "[View: %s]\n", view->name);
-		dump_counters(view->resstats, statsformat_file, fp, NULL,
-			      resstats_desc, dns_resstatscounter_max,
-			      resstats_index, resstat_values, 0);
+		(void) dump_counters(view->resstats, statsformat_file, fp, NULL,
+				     resstats_desc, dns_resstatscounter_max,
+				     resstats_index, resstat_values, 0);
 	}
 
 	fprintf(fp, "++ Cache DB RRsets ++\n");
@@ -1320,9 +1411,9 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
 	}
 
 	fprintf(fp, "++ Socket I/O Statistics ++\n");
-	dump_counters(server->sockstats, statsformat_file, fp, NULL,
-		      sockstats_desc, isc_sockstatscounter_max, sockstats_index,
-		      sockstat_values, 0);
+	(void) dump_counters(server->sockstats, statsformat_file, fp, NULL,
+			     sockstats_desc, isc_sockstatscounter_max,
+			     sockstats_index, sockstat_values, 0);
 
 	fprintf(fp, "++ Per Zone Query Statistics ++\n");
 	zone = NULL;
@@ -1343,9 +1434,10 @@ ns_stats_dump(ns_server_t *server, FILE *fp) {
 				fprintf(fp, " (view: %s)", view->name);
 			fprintf(fp, "]\n");
 
-			dump_counters(zonestats, statsformat_file, fp, NULL,
-				      nsstats_desc, dns_nsstatscounter_max,
-				      nsstats_index, nsstat_values, 0);
+			(void) dump_counters(zonestats, statsformat_file, fp,
+					     NULL, nsstats_desc,
+					     dns_nsstatscounter_max,
+					     nsstats_index, nsstat_values, 0);
 		}
 	}
 
diff --git a/contrib/bind9/bin/named/update.c b/contrib/bind9/bin/named/update.c
index b0a556d5cc41..74a192ad07b0 100644
--- a/contrib/bind9/bin/named/update.c
+++ b/contrib/bind9/bin/named/update.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: update.c,v 1.151.12.5.12.1 2009/07/28 14:18:08 marka Exp $ */
+/* $Id: update.c,v 1.151.12.9 2009/12/30 04:02:56 marka Exp $ */
 
 #include <config.h>
 
@@ -3031,7 +3031,7 @@ check_dnssec(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	} else {
 		CHECK(get_iterations(db, ver, &iterations));
 		CHECK(dns_nsec3_maxiterations(db, ver, client->mctx, &max));
-		if (iterations > max) {
+		if (max != 0 && iterations > max) {
 			flag = ISC_TRUE;
 			update_log(client, zone, ISC_LOG_WARNING,
 				   "too many NSEC3 iterations (%u) for "
@@ -3157,6 +3157,24 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 							   &newtuple));
 				CHECK(do_one_tuple(&newtuple, db, ver, diff));
 			}
+
+			/*
+			 * Remove any existing CREATE request to add an
+			 * otherwise indentical chain with a reversed
+			 * OPTOUT state.
+			 */
+			buf[1] ^= DNS_NSEC3FLAG_OPTOUT;
+			CHECK(rr_exists(db, ver, name, &rdata, &flag));
+
+			if (flag) {
+				CHECK(dns_difftuple_create(diff->mctx,
+							   DNS_DIFFOP_DEL,
+							   name, tuple->ttl,
+							   &rdata,
+							   &newtuple));
+				CHECK(do_one_tuple(&newtuple, db, ver, diff));
+			}
+
 			/*
 			 * Remove the temporary add record.
 			 */
@@ -4140,9 +4158,6 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	goto common;
 
  failure:
-	if (result == DNS_R_REFUSED)
-		inc_stats(zone, dns_nsstatscounter_updaterej);
-
 	/*
 	 * The reason for failure should have been logged at this point.
 	 */