From 15a885dfc6358c674a41e3de12a806b3fb4321c0 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Sat, 16 Aug 2014 08:50:36 +1000
Subject: [PATCH 01/23] remove duplicate request-ixfr rt36878

(cherry picked from commit 0a484c39fc85752925bb3231b1b566420437a1e3)
---
 doc/misc/options       | 2 --
 lib/isccfg/namedconf.c | 1 -
 2 files changed, 3 deletions(-)

diff --git a/doc/misc/options b/doc/misc/options
index 04ceed137e..70e4a06a3f 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -239,7 +239,6 @@ options {
         recursive-clients <integer>;
         request-expire <boolean>;
         request-ixfr <boolean>;
-        request-ixfr <boolean>;
         request-nsid <boolean>;
         request-sit <boolean>; // not configured
         reserved-sockets <integer>;
@@ -496,7 +495,6 @@ view <string> <optional_class> {
         recursion <boolean>;
         request-expire <boolean>;
         request-ixfr <boolean>;
-        request-ixfr <boolean>;
         request-nsid <boolean>;
         request-sit <boolean>; // not configured
         resolver-query-timeout <integer>;
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index b1370d94fb..6f3ff4e7a5 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -1561,7 +1561,6 @@ view_clauses[] = {
 	{ "queryport-pool-updateinterval", &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_OBSOLETE },
 	{ "recursion", &cfg_type_boolean, 0 },
-	{ "request-ixfr", &cfg_type_boolean, 0 },
 #ifdef ISC_PLATFORM_USESIT
 	{ "request-sit", &cfg_type_boolean, 0 },
 #else

From 3a26bfc09c833a8dc4d4c12b7cd271ed6d0843cb Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Fri, 15 Aug 2014 23:30:03 +0000
Subject: [PATCH 02/23] newcopyrights

---
 util/copyrights | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/util/copyrights b/util/copyrights
index ed99d8e02d..d39c327f43 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -1298,7 +1298,7 @@
 ./bin/tests/system/geoip/data/GeoIPRegion.dat	X	2013
 ./bin/tests/system/geoip/data/GeoIPv6.csv	X	2013
 ./bin/tests/system/geoip/data/GeoIPv6.dat	X	2013
-./bin/tests/system/geoip/data/README		TXT.BRIEF	2013
+./bin/tests/system/geoip/data/README		TXT.BRIEF	2013,2014
 ./bin/tests/system/geoip/geoip.c		C	2013
 ./bin/tests/system/geoip/ns2/example.db.in	ZONE	2013
 ./bin/tests/system/geoip/ns2/named1.conf	CONF-C	2013
@@ -2760,12 +2760,12 @@
 ./doc/arm/Bv9ARM.pdf				X	2007,2008,2009,2010,2011,2012,2013,2014
 ./doc/arm/Makefile.in				MAKE	2001,2002,2004,2005,2006,2007,2009,2012
 ./doc/arm/README-SGML				TXT.BRIEF	2000,2001,2004
-./doc/arm/dlz.xml				SGML	2012,2013
+./doc/arm/dlz.xml				SGML	2012,2013,2014
 ./doc/arm/dnssec.xml				SGML	2010,2011
 ./doc/arm/isc-logo.eps				X	2005,2010
 ./doc/arm/isc-logo.pdf				X	2005,2010
 ./doc/arm/latex-fixup.pl			PERL	2005,2007,2012
-./doc/arm/libdns.xml				SGML	2010
+./doc/arm/libdns.xml				SGML	2010,2014
 ./doc/arm/man.arpaname.html			X	2009,2010,2011,2012,2013,2014
 ./doc/arm/man.ddns-confgen.html			X	2009,2010,2011,2012,2013,2014
 ./doc/arm/man.delv.html				X	2014

From aebd0e85bfd8c7b4108efcbf0adc503ee6c64f52 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Fri, 15 Aug 2014 23:45:20 +0000
Subject: [PATCH 03/23] update copyright notice

---
 bin/tests/system/geoip/data/README | 2 +-
 doc/arm/dlz.xml                    | 2 +-
 doc/arm/libdns.xml                 | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bin/tests/system/geoip/data/README b/bin/tests/system/geoip/data/README
index 11f51e9a8e..47a6858f59 100644
--- a/bin/tests/system/geoip/data/README
+++ b/bin/tests/system/geoip/data/README
@@ -1,4 +1,4 @@
-Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
 See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
 
 The data data files in this directory are sample GeoIP databases,
diff --git a/doc/arm/dlz.xml b/doc/arm/dlz.xml
index 74a9f2a500..d98bc698f9 100644
--- a/doc/arm/dlz.xml
+++ b/doc/arm/dlz.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
- - Copyright (C) 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012-2014  Internet Systems Consortium, Inc. ("ISC")
  -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
diff --git a/doc/arm/libdns.xml b/doc/arm/libdns.xml
index cf7b94350e..6b5e81739d 100644
--- a/doc/arm/libdns.xml
+++ b/doc/arm/libdns.xml
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!--
- - Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2010, 2014  Internet Systems Consortium, Inc. ("ISC")
  -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above

From a24330c4805a224191ab687d0291963062fe3355 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Sat, 16 Aug 2014 01:06:20 +0000
Subject: [PATCH 04/23] regen master

---
 bin/dig/dig.1                    |  4 +--
 bin/dig/dig.html                 |  4 +--
 bin/python/dnssec-coverage.8     |  4 +--
 bin/python/dnssec-coverage.html  |  4 +--
 bin/rndc/rndc.8                  |  6 ++---
 bin/rndc/rndc.html               |  8 +++---
 doc/arm/Bv9ARM.ch04.html         |  4 +--
 doc/arm/Bv9ARM.ch06.html         | 19 +++++++--------
 doc/arm/Bv9ARM.ch09.html         | 42 ++++++++++++++++----------------
 doc/arm/Bv9ARM.html              | 14 +++++------
 doc/arm/man.arpaname.html        |  6 ++---
 doc/arm/man.ddns-confgen.html    |  8 +++---
 doc/arm/man.dig.html             |  6 ++---
 doc/arm/man.dnssec-coverage.html |  4 +--
 doc/arm/man.genrandom.html       |  8 +++---
 doc/arm/man.isc-hmac-fixup.html  |  8 +++---
 doc/arm/man.nsec3hash.html       |  8 +++---
 doc/arm/man.rndc-confgen.html    | 10 ++++----
 doc/arm/man.rndc.conf.html       | 10 ++++----
 doc/arm/man.rndc.html            | 14 +++++------
 lib/lwres/man/lwres.3            |  2 +-
 lib/lwres/man/lwres.html         |  2 +-
 lib/lwres/man/lwres_gabn.3       |  2 +-
 lib/lwres/man/lwres_gabn.html    |  2 +-
 lib/lwres/man/lwres_noop.3       |  2 +-
 lib/lwres/man/lwres_noop.html    |  2 +-
 lib/lwres/man/lwres_resutil.3    |  2 +-
 lib/lwres/man/lwres_resutil.html |  2 +-
 28 files changed, 103 insertions(+), 104 deletions(-)

diff --git a/bin/dig/dig.1 b/bin/dig/dig.1
index b25760e7a6..0e5e27502c 100644
--- a/bin/dig/dig.1
+++ b/bin/dig/dig.1
@@ -346,7 +346,7 @@ option were given.
 .PP
 \fB+dscp=value\fR
 .RS 4
-Set the DSCP code point to be used when sending the query. Valid DSCP code points are in the range [0..63]. By default no code point is explictly set.
+Set the DSCP code point to be used when sending the query. Valid DSCP code points are in the range [0..63]. By default no code point is explicitly set.
 .RE
 .PP
 \fB+[no]edns[=#]\fR
@@ -516,7 +516,7 @@ This query option toggles the printing of statistics: when the query was made, t
 .PP
 \fB+[no]subnet=addr/prefix\fR
 .RS 4
-Send an EDNS Client Subnet option with the speciifed IP address or network prefix.
+Send an EDNS Client Subnet option with the specified IP address or network prefix.
 .RE
 .PP
 \fB+[no]tcp\fR
diff --git a/bin/dig/dig.html b/bin/dig/dig.html
index 0a5a85ee29..0e11541dbc 100644
--- a/bin/dig/dig.html
+++ b/bin/dig/dig.html
@@ -374,7 +374,7 @@
 <dd><p>
 	      Set the DSCP code point to be used when sending the
 	      query.  Valid DSCP code points are in the range
-	      [0..63].  By default no code point is explictly set.
+	      [0..63].  By default no code point is explicitly set.
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]edns[=#]</code></span></dt>
 <dd><p>
@@ -545,7 +545,7 @@
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]subnet=addr/prefix</code></span></dt>
 <dd><p>
-	      Send an EDNS Client Subnet option with the speciifed
+	      Send an EDNS Client Subnet option with the specified
 	      IP address or network prefix.
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
diff --git a/bin/python/dnssec-coverage.8 b/bin/python/dnssec-coverage.8
index c8969f0a65..7fe9a57781 100644
--- a/bin/python/dnssec-coverage.8
+++ b/bin/python/dnssec-coverage.8
@@ -84,7 +84,7 @@ This option is mandatory unless the
 \fB\-f\fR
 has been used to specify a zone file. (If
 \fB\-f\fR
-has been specified, this option may still be used; it will overrde the value found in the file.)
+has been specified, this option may still be used; it will override the value found in the file.)
 .RE
 .PP
 \-d \fIDNSKEY TTL\fR
@@ -98,7 +98,7 @@ This option is mandatory unless the
 has been used to specify a zone file, or a default key TTL was set with the
 \fB\-L\fR
 to
-\fBdnssec\-keygen\fR. (If either of those is true, this option may still be used; it will overrde the value found in the zone or key file.)
+\fBdnssec\-keygen\fR. (If either of those is true, this option may still be used; it will override the value found in the zone or key file.)
 .RE
 .PP
 \-r \fIresign interval\fR
diff --git a/bin/python/dnssec-coverage.html b/bin/python/dnssec-coverage.html
index dbbb6ab050..632e288724 100644
--- a/bin/python/dnssec-coverage.html
+++ b/bin/python/dnssec-coverage.html
@@ -108,7 +108,7 @@
 <p>
             This option is mandatory unless the <code class="option">-f</code> has
             been used to specify a zone file.  (If <code class="option">-f</code> has
-            been specified, this option may still be used; it will overrde
+            been specified, this option may still be used; it will override
             the value found in the file.)
           </p>
 </dd>
@@ -134,7 +134,7 @@
             been used to specify a zone file, or a default key TTL was
             set with the <code class="option">-L</code> to
             <span><strong class="command">dnssec-keygen</strong></span>.  (If either of those is true,
-            this option may still be used; it will overrde the value found
+            this option may still be used; it will override the value found
             in the zone or key file.)
           </p>
 </dd>
diff --git a/bin/rndc/rndc.8 b/bin/rndc/rndc.8
index fd1b2e0bdf..8758edd908 100644
--- a/bin/rndc/rndc.8
+++ b/bin/rndc/rndc.8
@@ -20,11 +20,11 @@
 .\"     Title: rndc
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.71.1 <http://docbook.sf.net/>
-.\"      Date: February 07, 2014
+.\"      Date: August 15, 2014
 .\"    Manual: BIND9
 .\"    Source: BIND9
 .\"
-.TH "RNDC" "8" "February 07, 2014" "BIND9" "BIND9"
+.TH "RNDC" "8" "August 15, 2014" "BIND9" "BIND9"
 .\" disable hyphenation
 .nh
 .\" disable justification (adjust text to left margin only)
@@ -300,7 +300,7 @@ Flushes the server's cache.
 Flushes the given name from the server's DNS cache and, if applicable, from the server's nameserver address database or bad\-server cache.
 .RE
 .PP
-\fBflushtree\fR [\-all] \fIname\fR [\fIview\fR]
+\fBflushtree\fR \fIname\fR [\fIview\fR]
 .RS 4
 Flushes the given name, and all of its subdomains, from the server's DNS cache, the address database, and the bad server cache.
 .RE
diff --git a/bin/rndc/rndc.html b/bin/rndc/rndc.html
index f9c85434ec..263b4063cb 100644
--- a/bin/rndc/rndc.html
+++ b/bin/rndc/rndc.html
@@ -357,7 +357,7 @@
             and, if applicable, from the server's nameserver address
             database or bad-server cache.
           </p></dd>
-<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> [<span class="optional">-all</span>] <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
+<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
 <dd><p>
             Flushes the given name, and all of its subdomains,
             from the server's DNS cache, the address database,
@@ -581,7 +581,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545241"></a><h2>LIMITATIONS</h2>
+<a name="id2545238"></a><h2>LIMITATIONS</h2>
 <p>
       There is currently no way to provide the shared secret for a
       <code class="option">key_id</code> without using the configuration file.
@@ -591,7 +591,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2542119"></a><h2>SEE ALSO</h2>
+<a name="id2542116"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -601,7 +601,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2542174"></a><h2>AUTHOR</h2>
+<a name="id2542171"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html
index 10cd0e4cf0..2af4d98d8e 100644
--- a/doc/arm/Bv9ARM.ch04.html
+++ b/doc/arm/Bv9ARM.ch04.html
@@ -1532,7 +1532,7 @@ $ <strong class="userinput"><code>./configure --enable-native-pkcs11 \
 </ul></div>
 <p>
       The modified OpenSSL code is included in the BIND 9 release,
-      in the form of a context diff against the latest verions of
+      in the form of a context diff against the latest versions of
       OpenSSL.  OpenSSL 0.9.8, 1.0.0, and 1.0.1 are supported; there are
       separate diffs for each version.  In the examples to follow,
       we use OpenSSL 0.9.8, but the same methods work with OpenSSL
@@ -2020,7 +2020,7 @@ $ <strong class="userinput"><code>dnssec-signzone -E '' -S example.net</code></s
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
 <a name="dlz-info"></a>DLZ (Dynamically Loadable Zones)</h2></div></div></div>
 <p>
-    DLZ (Dynamically Loadable Zones) is an extention to BIND 9 that allows
+    DLZ (Dynamically Loadable Zones) is an extension to BIND 9 that allows
     zone data to be retrieved directly from an external database.  There is
     no required format or schema.  DLZ drivers exist for several different
     database backends including PostgreSQL, MySQL, and LDAP and can be
diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html
index ec241708ec..5115b571ac 100644
--- a/doc/arm/Bv9ARM.ch06.html
+++ b/doc/arm/Bv9ARM.ch06.html
@@ -437,7 +437,7 @@
                   In most cases, setting a value to 0 does not
                   literally mean zero; it means "undefined" or
                   "as big as possible", depending on the context.
-                  See the expalantions of particular parameters
+                  See the explanations of particular parameters
                   that use <code class="varname">size_spec</code>
                   for details on how they interpret its use. 
                 </p>
@@ -3082,7 +3082,7 @@ options {
                   restarted (NTA's do not persist across restarts).
                 </p>
 <p>
-                  For convienience, TTL-style time unit suffixes can be
+                  For convenience, TTL-style time unit suffixes can be
                   used to specify the NTA lifetime in seconds, minutes
                   or hours.  <code class="option">nta-lifetime</code> defaults to
                   one hour.  It cannot exceed one day.
@@ -3107,13 +3107,13 @@ options {
                   the negative trust anchor is allowed to expire early.
                 </p>
 <p>
-                  Validity checks can be disabled for an indivdiual
+                  Validity checks can be disabled for an individual
                   NTA by using <span><strong class="command">rndc nta -f</strong></span>, or
                   for all NTA's by setting <code class="option">nta-recheck</code>
                   to zero.
                 </p>
 <p>
-                  For convienience, TTL-style time unit suffixes can be
+                  For convenience, TTL-style time unit suffixes can be
                   used to specify the NTA recheck interval in seconds,
                   minutes or hours.  The default is five minutes.
                 </p>
@@ -4406,7 +4406,7 @@ options {
                   than matching the case of the records entered in
                   the zone file.  This allows responses to exactly
                   match the query, which is required by some clients
-                  due to incorrect use of case-sensitive comparisions.
+                  due to incorrect use of case-sensitive comparisons.
                 </p>
 <p>
                   Case-insensitive compression is <span class="emphasis"><em>always</em></span>
@@ -4414,12 +4414,12 @@ options {
                   the client matches this ACL.
                 </p>
 <p>
-                  There are circusmstances in which <span><strong class="command">named</strong></span>
+                  There are circumstances in which <span><strong class="command">named</strong></span>
                   will not preserve the case of owner names of records:
                   if a zone file defines records of different types with
                   the same name, but the capitalization of the name is
                   different (e.g., "www.example.com/A" and
-                  "WWW.EXAMPLE.COM/AAAA"), then all resposnes for that
+                  "WWW.EXAMPLE.COM/AAAA"), then all responses for that
                   name will use the <span class="emphasis"><em>first</em></span> version
                   of the name that was used in the zone file.  This
                   limitation may be addressed in a future release.  However,
@@ -6772,7 +6772,7 @@ rate-limit {
             is over 1000 <span class="emphasis"><em>and</em></span> the ratio is over 10),
             the one that appears last in the configuration file is the
             one chosen.  To eliminate any ambiguity, it is recommended
-            that under normal circumstnaces, rate limiting bands should
+            that under normal circumstances, rate limiting bands should
             be configured using either <span><strong class="command">size</strong></span> or
             <span><strong class="command">ratio</strong></span> parameters, but not both.
           </p>
@@ -10316,8 +10316,7 @@ view external {
                     <p>
                       Each RR can have a TTL as the second
                       field in the RR, which will control how long other
-                      servers can cache
-                      the it.
+                      servers can cache it.
                     </p>
                   </td>
 </tr>
diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html
index 086e266214..6d3e33fa49 100644
--- a/doc/arm/Bv9ARM.ch09.html
+++ b/doc/arm/Bv9ARM.ch09.html
@@ -57,13 +57,13 @@
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612307">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612316">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612341">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612372">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612449">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612475">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613448">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612170">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612180">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612204">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612235">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612312">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612339">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613312">Library References</a></span></dt>
 </dl></dd>
 </dl>
 </div>
@@ -648,7 +648,7 @@
 </ul></div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612307"></a>Prerequisite</h3></div></div></div>
+<a name="id2612170"></a>Prerequisite</h3></div></div></div>
 <p>GNU make is required to build the export libraries (other
   part of BIND 9 can still be built with other types of make). In
   the reminder of this document, "make" means GNU make. Note that
@@ -657,7 +657,7 @@
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612316"></a>Compilation</h3></div></div></div>
+<a name="id2612180"></a>Compilation</h3></div></div></div>
 <pre class="screen">
 $ <strong class="userinput"><code>./configure --enable-exportlib <em class="replaceable"><code>[other flags]</code></em></code></strong>
 $ <strong class="userinput"><code>make</code></strong>
@@ -672,7 +672,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612341"></a>Installation</h3></div></div></div>
+<a name="id2612204"></a>Installation</h3></div></div></div>
 <pre class="screen">
 $ <strong class="userinput"><code>cd lib/export</code></strong>
 $ <strong class="userinput"><code>make install</code></strong>
@@ -694,7 +694,7 @@ $ <strong class="userinput"><code>make install</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612372"></a>Known Defects/Restrictions</h3></div></div></div>
+<a name="id2612235"></a>Known Defects/Restrictions</h3></div></div></div>
 <div class="itemizedlist"><ul type="disc">
 <li><p>Currently, win32 is not supported for the export
       library. (Normal BIND 9 application can be built as
@@ -734,7 +734,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612449"></a>The dns.conf File</h3></div></div></div>
+<a name="id2612312"></a>The dns.conf File</h3></div></div></div>
 <p>The IRS library supports an "advanced" configuration file
   related to the DNS library for configuration parameters that
   would be beyond the capability of the
@@ -752,14 +752,14 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2612475"></a>Sample Applications</h3></div></div></div>
+<a name="id2612339"></a>Sample Applications</h3></div></div></div>
 <p>Some sample application programs using this API are
   provided for reference. The following is a brief description of
   these applications.
   </p>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612484"></a>sample: a simple stub resolver utility</h4></div></div></div>
+<a name="id2612347"></a>sample: a simple stub resolver utility</h4></div></div></div>
 <p>
   It sends a query of a given name (of a given optional RR type) to a
   specified recursive server, and prints the result as a list of
@@ -823,7 +823,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612574"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
+<a name="id2612438"></a>sample-async: a simple stub resolver, working asynchronously</h4></div></div></div>
 <p>
   Similar to "sample", but accepts a list
   of (query) domain names as a separate file and resolves the names
@@ -856,7 +856,7 @@ $ <strong class="userinput"><code>make</code></strong>
   consists of a single domain name. Example:
   <div class="literallayout"><p><br>
   www.example.com<br>
-  mx.examle.net<br>
+  mx.example.net<br>
   ns.xxx.example<br>
 </p></div>
 </dd>
@@ -864,7 +864,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612628"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
+<a name="id2612491"></a>sample-request: a simple DNS transaction client</h4></div></div></div>
 <p>
   It sends a query to a specified server, and
   prints the response with minimal processing. It doesn't act as a
@@ -905,7 +905,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2612692"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
+<a name="id2612555"></a>sample-gai: getaddrinfo() and getnameinfo() test code</h4></div></div></div>
 <p>
   This is a test program
   to check getaddrinfo() and getnameinfo() behavior. It takes a
@@ -922,7 +922,7 @@ $ <strong class="userinput"><code>make</code></strong>
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2613185"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
+<a name="id2612638"></a>sample-update: a simple dynamic update client program</h4></div></div></div>
 <p>
   It accepts a single update command as a
   command-line argument, sends an update request message to the
@@ -1017,7 +1017,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </div>
 <div class="sect3" lang="en">
 <div class="titlepage"><div><div><h4 class="title">
-<a name="id2613384"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
+<a name="id2613248"></a>nsprobe: domain/name server checker in terms of RFC 4074</h4></div></div></div>
 <p>
   It checks a set
   of domains to see the name servers of the domains behave
@@ -1074,7 +1074,7 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </div>
 <div class="sect2" lang="en">
 <div class="titlepage"><div><div><h3 class="title">
-<a name="id2613448"></a>Library References</h3></div></div></div>
+<a name="id2613312"></a>Library References</h3></div></div></div>
 <p>As of this writing, there is no formal "manual" of the
   libraries, except this document, header files (some of them
   provide pretty detailed explanations), and sample application
diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html
index f010db7c88..ad13583dfa 100644
--- a/doc/arm/Bv9ARM.html
+++ b/doc/arm/Bv9ARM.html
@@ -251,13 +251,13 @@
 </dl></dd>
 <dt><span class="sect1"><a href="Bv9ARM.ch09.html#bind9.library">BIND 9 DNS Library Support</a></span></dt>
 <dd><dl>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612307">Prerequisite</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612316">Compilation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612341">Installation</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612372">Known Defects/Restrictions</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612449">The dns.conf File</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612475">Sample Applications</a></span></dt>
-<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613448">Library References</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612170">Prerequisite</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612180">Compilation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612204">Installation</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612235">Known Defects/Restrictions</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612312">The dns.conf File</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2612339">Sample Applications</a></span></dt>
+<dt><span class="sect2"><a href="Bv9ARM.ch09.html#id2613312">Library References</a></span></dt>
 </dl></dd>
 </dl></dd>
 <dt><span class="reference"><a href="Bv9ARM.ch10.html">I. Manual pages</a></span></dt>
diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html
index 80250b3264..19af0c9d78 100644
--- a/doc/arm/man.arpaname.html
+++ b/doc/arm/man.arpaname.html
@@ -50,20 +50,20 @@
 <div class="cmdsynopsis"><p><code class="command">arpaname</code>  {<em class="replaceable"><code>ipaddress </code></em>...}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623645"></a><h2>DESCRIPTION</h2>
+<a name="id2623642"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">arpaname</strong></span> translates IP addresses (IPv4 and
       IPv6) to the corresponding IN-ADDR.ARPA or IP6.ARPA names.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623660"></a><h2>SEE ALSO</h2>
+<a name="id2623657"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2623674"></a><h2>AUTHOR</h2>
+<a name="id2623671"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html
index f41cd01b80..8be73c57ff 100644
--- a/doc/arm/man.ddns-confgen.html
+++ b/doc/arm/man.ddns-confgen.html
@@ -51,7 +51,7 @@
 <div class="cmdsynopsis"><p><code class="command">ddns-confgen</code>  [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-q</code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [ -s <em class="replaceable"><code>name</code></em>  |   -z <em class="replaceable"><code>zone</code></em> ]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2663033"></a><h2>DESCRIPTION</h2>
+<a name="id2663030"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">tsig-keygen</strong></span> and <span><strong class="command">ddns-confgen</strong></span>
       are invocation methods for a utility that generates keys for use
@@ -87,7 +87,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2663137"></a><h2>OPTIONS</h2>
+<a name="id2663133"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd><p>
@@ -159,7 +159,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664377"></a><h2>SEE ALSO</h2>
+<a name="id2664374"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">nsupdate</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -167,7 +167,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2664552"></a><h2>AUTHOR</h2>
+<a name="id2664549"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html
index 566a838572..66783cec33 100644
--- a/doc/arm/man.dig.html
+++ b/doc/arm/man.dig.html
@@ -52,7 +52,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2613133"></a><h2>DESCRIPTION</h2>
+<a name="id2613065"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -392,7 +392,7 @@
 <dd><p>
 	      Set the DSCP code point to be used when sending the
 	      query.  Valid DSCP code points are in the range
-	      [0..63].  By default no code point is explictly set.
+	      [0..63].  By default no code point is explicitly set.
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]edns[=#]</code></span></dt>
 <dd><p>
@@ -563,7 +563,7 @@
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]subnet=addr/prefix</code></span></dt>
 <dd><p>
-	      Send an EDNS Client Subnet option with the speciifed
+	      Send an EDNS Client Subnet option with the specified
 	      IP address or network prefix.
 	    </p></dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html
index 71bdbee4f4..aebe0dcac0 100644
--- a/doc/arm/man.dnssec-coverage.html
+++ b/doc/arm/man.dnssec-coverage.html
@@ -126,7 +126,7 @@
 <p>
             This option is mandatory unless the <code class="option">-f</code> has
             been used to specify a zone file.  (If <code class="option">-f</code> has
-            been specified, this option may still be used; it will overrde
+            been specified, this option may still be used; it will override
             the value found in the file.)
           </p>
 </dd>
@@ -152,7 +152,7 @@
             been used to specify a zone file, or a default key TTL was
             set with the <code class="option">-L</code> to
             <span><strong class="command">dnssec-keygen</strong></span>.  (If either of those is true,
-            this option may still be used; it will overrde the value found
+            this option may still be used; it will override the value found
             in the zone or key file.)
           </p>
 </dd>
diff --git a/doc/arm/man.genrandom.html b/doc/arm/man.genrandom.html
index d0187ae6ea..263ae5ef8e 100644
--- a/doc/arm/man.genrandom.html
+++ b/doc/arm/man.genrandom.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">genrandom</code>  [<code class="option">-n <em class="replaceable"><code>number</code></em></code>] {<em class="replaceable"><code>size</code></em>} {<em class="replaceable"><code>filename</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665209"></a><h2>DESCRIPTION</h2>
+<a name="id2664592"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">genrandom</strong></span>
       generates a file or a set of files containing a specified quantity
@@ -59,7 +59,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665224"></a><h2>ARGUMENTS</h2>
+<a name="id2664606"></a><h2>ARGUMENTS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-n <em class="replaceable"><code>number</code></em></span></dt>
 <dd><p>
@@ -77,14 +77,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665285"></a><h2>SEE ALSO</h2>
+<a name="id2664667"></a><h2>SEE ALSO</h2>
 <p>
       <span class="citerefentry"><span class="refentrytitle">rand</span>(3)</span>,
       <span class="citerefentry"><span class="refentrytitle">arc4random</span>(3)</span>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665312"></a><h2>AUTHOR</h2>
+<a name="id2664694"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.isc-hmac-fixup.html b/doc/arm/man.isc-hmac-fixup.html
index 964c689962..c678e25dad 100644
--- a/doc/arm/man.isc-hmac-fixup.html
+++ b/doc/arm/man.isc-hmac-fixup.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">isc-hmac-fixup</code>  {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>secret</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2624272"></a><h2>DESCRIPTION</h2>
+<a name="id2624200"></a><h2>DESCRIPTION</h2>
 <p>
       Versions of BIND 9 up to and including BIND 9.6 had a bug causing
       HMAC-SHA* TSIG keys which were longer than the digest length of the
@@ -76,7 +76,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2624299"></a><h2>SECURITY CONSIDERATIONS</h2>
+<a name="id2624228"></a><h2>SECURITY CONSIDERATIONS</h2>
 <p>
       Secrets that have been converted by <span><strong class="command">isc-hmac-fixup</strong></span>
       are shortened, but as this is how the HMAC protocol works in
@@ -87,14 +87,14 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665344"></a><h2>SEE ALSO</h2>
+<a name="id2665204"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 2104</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665361"></a><h2>AUTHOR</h2>
+<a name="id2665221"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html
index fdca850f2a..0ca8b3dac4 100644
--- a/doc/arm/man.nsec3hash.html
+++ b/doc/arm/man.nsec3hash.html
@@ -48,7 +48,7 @@
 <div class="cmdsynopsis"><p><code class="command">nsec3hash</code>  {<em class="replaceable"><code>salt</code></em>} {<em class="replaceable"><code>algorithm</code></em>} {<em class="replaceable"><code>iterations</code></em>} {<em class="replaceable"><code>domain</code></em>}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665474"></a><h2>DESCRIPTION</h2>
+<a name="id2623964"></a><h2>DESCRIPTION</h2>
 <p>
       <span><strong class="command">nsec3hash</strong></span> generates an NSEC3 hash based on
       a set of NSEC3 parameters.  This can be used to check the validity
@@ -56,7 +56,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665489"></a><h2>ARGUMENTS</h2>
+<a name="id2665349"></a><h2>ARGUMENTS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">salt</span></dt>
 <dd><p>
@@ -80,14 +80,14 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665550"></a><h2>SEE ALSO</h2>
+<a name="id2665411"></a><h2>SEE ALSO</h2>
 <p>
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
       <em class="citetitle">RFC 5155</em>.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665568"></a><h2>AUTHOR</h2>
+<a name="id2665428"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html
index 64a11b2b0f..b5d8c92d19 100644
--- a/doc/arm/man.rndc-confgen.html
+++ b/doc/arm/man.rndc-confgen.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc-confgen</code>  [<code class="option">-a</code>] [<code class="option">-A <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-b <em class="replaceable"><code>keysize</code></em></code>] [<code class="option">-c <em class="replaceable"><code>keyfile</code></em></code>] [<code class="option">-h</code>] [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>] [<code class="option">-s <em class="replaceable"><code>address</code></em></code>] [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>] [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2657961"></a><h2>DESCRIPTION</h2>
+<a name="id2657958"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc-confgen</strong></span>
       generates configuration files
       for <span><strong class="command">rndc</strong></span>.  It can be used as a
@@ -66,7 +66,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2661441"></a><h2>OPTIONS</h2>
+<a name="id2661437"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-a</span></dt>
 <dd>
@@ -180,7 +180,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2661844"></a><h2>EXAMPLES</h2>
+<a name="id2661841"></a><h2>EXAMPLES</h2>
 <p>
       To allow <span><strong class="command">rndc</strong></span> to be used with
       no manual configuration, run
@@ -197,7 +197,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665109"></a><h2>SEE ALSO</h2>
+<a name="id2665106"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -205,7 +205,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2665147"></a><h2>AUTHOR</h2>
+<a name="id2665144"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html
index 706fa9e255..bdf924038d 100644
--- a/doc/arm/man.rndc.conf.html
+++ b/doc/arm/man.rndc.conf.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc.conf</code> </p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2653875"></a><h2>DESCRIPTION</h2>
+<a name="id2653872"></a><h2>DESCRIPTION</h2>
 <p><code class="filename">rndc.conf</code> is the configuration file
       for <span><strong class="command">rndc</strong></span>, the BIND 9 name server control
       utility.  This file has a similar structure and syntax to
@@ -136,7 +136,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2654046"></a><h2>EXAMPLE</h2>
+<a name="id2654043"></a><h2>EXAMPLE</h2>
 <pre class="programlisting">
       options {
         default-server  localhost;
@@ -210,7 +210,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2654305"></a><h2>NAME SERVER CONFIGURATION</h2>
+<a name="id2654301"></a><h2>NAME SERVER CONFIGURATION</h2>
 <p>
       The name server must be configured to accept rndc connections and
       to recognize the key specified in the <code class="filename">rndc.conf</code>
@@ -220,7 +220,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2654330"></a><h2>SEE ALSO</h2>
+<a name="id2654327"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">mmencode</span>(1)</span>,
@@ -228,7 +228,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2654369"></a><h2>AUTHOR</h2>
+<a name="id2654365"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html
index 09f91247b1..f44a773c48 100644
--- a/doc/arm/man.rndc.html
+++ b/doc/arm/man.rndc.html
@@ -50,7 +50,7 @@
 <div class="cmdsynopsis"><p><code class="command">rndc</code>  [<code class="option">-b <em class="replaceable"><code>source-address</code></em></code>] [<code class="option">-c <em class="replaceable"><code>config-file</code></em></code>] [<code class="option">-k <em class="replaceable"><code>key-file</code></em></code>] [<code class="option">-s <em class="replaceable"><code>server</code></em></code>] [<code class="option">-p <em class="replaceable"><code>port</code></em></code>] [<code class="option">-q</code>] [<code class="option">-V</code>] [<code class="option">-y <em class="replaceable"><code>key_id</code></em></code>] {command}</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2653712"></a><h2>DESCRIPTION</h2>
+<a name="id2653777"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">rndc</strong></span>
       controls the operation of a name
       server.  It supersedes the <span><strong class="command">ndc</strong></span> utility
@@ -81,7 +81,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2653762"></a><h2>OPTIONS</h2>
+<a name="id2660790"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-b <em class="replaceable"><code>source-address</code></em></span></dt>
 <dd><p>
@@ -152,7 +152,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2661015"></a><h2>COMMANDS</h2>
+<a name="id2661080"></a><h2>COMMANDS</h2>
 <p>
       A list of commands supported by <span><strong class="command">rndc</strong></span> can
       be seen by running <span><strong class="command">rndc</strong></span> without arguments.
@@ -375,7 +375,7 @@
             and, if applicable, from the server's nameserver address
             database or bad-server cache.
           </p></dd>
-<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> [<span class="optional">-all</span>] <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
+<dt><span class="term"><strong class="userinput"><code>flushtree</code></strong> <em class="replaceable"><code>name</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>] </span></dt>
 <dd><p>
             Flushes the given name, and all of its subdomains,
             from the server's DNS cache, the address database,
@@ -599,7 +599,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687302"></a><h2>LIMITATIONS</h2>
+<a name="id2687364"></a><h2>LIMITATIONS</h2>
 <p>
       There is currently no way to provide the shared secret for a
       <code class="option">key_id</code> without using the configuration file.
@@ -609,7 +609,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687320"></a><h2>SEE ALSO</h2>
+<a name="id2687382"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">rndc.conf</span>(5)</span>,
       <span class="citerefentry"><span class="refentrytitle">rndc-confgen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
@@ -619,7 +619,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2687376"></a><h2>AUTHOR</h2>
+<a name="id2687437"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
diff --git a/lib/lwres/man/lwres.3 b/lib/lwres/man/lwres.3
index 32338b780d..2c03e3ae9f 100644
--- a/lib/lwres/man/lwres.3
+++ b/lib/lwres/man/lwres.3
@@ -39,7 +39,7 @@ lwres \- introduction to the lightweight resolver library
 .PP
 The BIND 9 lightweight resolver library is a simple, name service independent stub resolver library. It provides hostname\-to\-address and address\-to\-hostname lookup services to applications by transmitting lookup requests to a resolver daemon
 \fBlwresd\fR
-running on the local host. The resover daemon performs the lookup using the DNS or possibly other name service protocols, and returns the results to the application through the library. The library and resolver daemon communicate using a simple UDP\-based protocol.
+running on the local host. The resolver daemon performs the lookup using the DNS or possibly other name service protocols, and returns the results to the application through the library. The library and resolver daemon communicate using a simple UDP\-based protocol.
 .SH "OVERVIEW"
 .PP
 The lwresd library implements multiple name service APIs. The standard
diff --git a/lib/lwres/man/lwres.html b/lib/lwres/man/lwres.html
index 27ddd7efa5..da5ab517dc 100644
--- a/lib/lwres/man/lwres.html
+++ b/lib/lwres/man/lwres.html
@@ -39,7 +39,7 @@
       and address-to-hostname lookup services to applications by
       transmitting lookup requests to a resolver daemon
       <span><strong class="command">lwresd</strong></span>
-      running on the local host. The resover daemon performs the
+      running on the local host. The resolver daemon performs the
       lookup using the DNS or possibly other name service protocols,
       and returns the results to the application through the library.
       The library and resolver daemon communicate using a simple
diff --git a/lib/lwres/man/lwres_gabn.3 b/lib/lwres/man/lwres_gabn.3
index cb1e93fc4c..f67126eb54 100644
--- a/lib/lwres/man/lwres_gabn.3
+++ b/lib/lwres/man/lwres_gabn.3
@@ -53,7 +53,7 @@ These are low\-level routines for creating and parsing lightweight resolver name
 .PP
 There are four main functions for the getaddrbyname opcode. One render function converts a getaddrbyname request structure \(em
 \fBlwres_gabnrequest_t\fR
-\(em to the lighweight resolver's canonical format. It is complemented by a parse function that converts a packet in this canonical format to a getaddrbyname request structure. Another render function converts the getaddrbyname response structure \(em
+\(em to the lightweight resolver's canonical format. It is complemented by a parse function that converts a packet in this canonical format to a getaddrbyname request structure. Another render function converts the getaddrbyname response structure \(em
 \fBlwres_gabnresponse_t\fR
 \(em to the canonical format. This is complemented by a parse function which converts a packet in canonical format to a getaddrbyname response structure.
 .PP
diff --git a/lib/lwres/man/lwres_gabn.html b/lib/lwres/man/lwres_gabn.html
index afff8a3c08..ef40b67b8b 100644
--- a/lib/lwres/man/lwres_gabn.html
+++ b/lib/lwres/man/lwres_gabn.html
@@ -188,7 +188,7 @@ void
       There are four main functions for the getaddrbyname opcode.
       One render function converts a getaddrbyname request structure &#8212;
       <span class="type">lwres_gabnrequest_t</span> &#8212;
-      to the lighweight resolver's canonical format.
+      to the lightweight resolver's canonical format.
       It is complemented by a parse function that converts a packet in this
       canonical format to a getaddrbyname request structure.
       Another render function converts the getaddrbyname response structure
diff --git a/lib/lwres/man/lwres_noop.3 b/lib/lwres/man/lwres_noop.3
index 6dffc53b95..cacbd4b6a4 100644
--- a/lib/lwres/man/lwres_noop.3
+++ b/lib/lwres/man/lwres_noop.3
@@ -57,7 +57,7 @@ packet: a packet is sent to the resolver daemon and is simply echoed back. The o
 .PP
 There are four main functions for the no\-op opcode. One render function converts a no\-op request structure \(em
 \fBlwres_nooprequest_t\fR
-\(em to the lighweight resolver's canonical format. It is complemented by a parse function that converts a packet in this canonical format to a no\-op request structure. Another render function converts the no\-op response structure \(em
+\(em to the lightweight resolver's canonical format. It is complemented by a parse function that converts a packet in this canonical format to a no\-op request structure. Another render function converts the no\-op response structure \(em
 \fBlwres_noopresponse_t\fR
 to the canonical format. This is complemented by a parse function which converts a packet in canonical format to a no\-op response structure.
 .PP
diff --git a/lib/lwres/man/lwres_noop.html b/lib/lwres/man/lwres_noop.html
index cad87024d7..39a1a20915 100644
--- a/lib/lwres/man/lwres_noop.html
+++ b/lib/lwres/man/lwres_noop.html
@@ -195,7 +195,7 @@ void
       There are four main functions for the no-op opcode.
       One render function converts a no-op request structure &#8212;
       <span class="type">lwres_nooprequest_t</span> &#8212;
-      to the lighweight resolver's canonical format.
+      to the lightweight resolver's canonical format.
       It is complemented by a parse function that converts a packet in this
       canonical format to a no-op request structure.
       Another render function converts the no-op response structure &#8212;
diff --git a/lib/lwres/man/lwres_resutil.3 b/lib/lwres/man/lwres_resutil.3
index c80fd70f1c..0125c788d1 100644
--- a/lib/lwres/man/lwres_resutil.3
+++ b/lib/lwres/man/lwres_resutil.3
@@ -97,7 +97,7 @@ functions.
 .PP
 The lightweight resolver uses
 \fBlwres_getaddrsbyname()\fR
-to perform foward lookups. Hostname
+to perform forward lookups. Hostname
 \fIname\fR
 is looked up using the resolver context
 \fIctx\fR
diff --git a/lib/lwres/man/lwres_resutil.html b/lib/lwres/man/lwres_resutil.html
index 1a45a5705a..5f9a3d972f 100644
--- a/lib/lwres/man/lwres_resutil.html
+++ b/lib/lwres/man/lwres_resutil.html
@@ -186,7 +186,7 @@ typedef struct {
 <p>
       The lightweight resolver uses
       <code class="function">lwres_getaddrsbyname()</code> to perform
-      foward lookups.
+      forward lookups.
       Hostname <em class="parameter"><code>name</code></em> is looked up using the
       resolver
       context <em class="parameter"><code>ctx</code></em> for memory allocation.

From 5244e505adc08719e1387392c6eb85c453729256 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Mon, 18 Aug 2014 13:16:28 +1000
Subject: [PATCH 05/23] 3915    [bug]           Address a assertion if a route
 event arrived while                         shutting down. [RT #36887]

---
 CHANGES                                |  3 +++
 bin/named/include/named/interfacemgr.h |  2 +-
 bin/named/include/named/server.h       |  2 +-
 bin/named/interfacemgr.c               | 14 ++++----------
 bin/named/server.c                     | 22 ++++++++++------------
 5 files changed, 19 insertions(+), 24 deletions(-)

diff --git a/CHANGES b/CHANGES
index 4df3e1fc81..5455c26b69 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3915	[bug]		Address a assertion if a route event arrived while
+			shutting down. [RT #36887]
+
 3914.	[bug]		Allow the URI target and CAA value fields to
 			be zero length. [RT #36737]
 
diff --git a/bin/named/include/named/interfacemgr.h b/bin/named/include/named/interfacemgr.h
index dbb4a89645..9645a354cf 100644
--- a/bin/named/include/named/interfacemgr.h
+++ b/bin/named/include/named/interfacemgr.h
@@ -97,7 +97,7 @@ isc_result_t
 ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 		       isc_socketmgr_t *socketmgr,
 		       dns_dispatchmgr_t *dispatchmgr,
-		       ns_interfacemgr_t **mgrp);
+		       isc_task_t *task, ns_interfacemgr_t **mgrp);
 /*%
  * Create a new interface manager.
  *
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index fd6818dca3..6cbaa9139d 100644
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -37,7 +37,6 @@
 #define NS_EVENTCLASS		ISC_EVENTCLASS(0x4E43)
 #define NS_EVENT_RELOAD		(NS_EVENTCLASS + 0)
 #define NS_EVENT_CLIENTCONTROL	(NS_EVENTCLASS + 1)
-#define NS_EVENT_IFSCAN		(NS_EVENTCLASS + 2)
 
 /*%
  * Name server state.  Better here than in lots of separate global variables.
@@ -225,6 +224,7 @@ void
 ns_server_scan_interfaces(ns_server_t *server);
 /*%<
  * Trigger a interface scan.
+ * Must only be called when running under server->task.
  */
 
 void
diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
index 342408876f..a0c0eda085 100644
--- a/bin/named/interfacemgr.c
+++ b/bin/named/interfacemgr.c
@@ -140,7 +140,7 @@ route_event(isc_task_t *task, isc_event_t *event) {
 	switch (rtm->MSGTYPE) {
 	case RTM_NEWADDR:
 	case RTM_DELADDR:
-		if (ns_g_server->interface_auto)
+		if (mgr->route != NULL && ns_g_server->interface_auto)
 			ns_server_scan_interfaces(ns_g_server);
 		break;
 	default:
@@ -172,7 +172,7 @@ isc_result_t
 ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 		       isc_socketmgr_t *socketmgr,
 		       dns_dispatchmgr_t *dispatchmgr,
-		       ns_interfacemgr_t **mgrp)
+		       isc_task_t *task, ns_interfacemgr_t **mgrp)
 {
 	isc_result_t result;
 	ns_interfacemgr_t *mgr;
@@ -232,11 +232,8 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	}
 
 	mgr->task = NULL;
-	if (mgr->route != NULL) {
-		result = isc_task_create(taskmgr, 0, &mgr->task);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup_route;
-	}
+	if (mgr->route != NULL)
+		isc_task_attach(task, &mgr->task);
 	mgr->references = (mgr->route != NULL) ? 2 : 1;
 #else
 	mgr->references = 1;
@@ -260,9 +257,6 @@ ns_interfacemgr_create(isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
 	return (ISC_R_SUCCESS);
 
 #ifdef USE_ROUTE_SOCKET
- cleanup_route:
-	if (mgr->route != NULL)
-		isc_socket_detach(&mgr->route);
  cleanup_aclenv:
 	dns_aclenv_destroy(&mgr->aclenv);
 #endif
diff --git a/bin/named/server.c b/bin/named/server.c
index ecb64b91d5..0f69be92c4 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -4845,11 +4845,6 @@ interface_timer_tick(isc_task_t *task, isc_event_t *event) {
 	INSIST(task == server->task);
 	UNUSED(task);
 
-	if (event->ev_type == NS_EVENT_IFSCAN)
-		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
-			      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
-			      "automatic interface rescan");
-
 	isc_event_free(&event);
 
 	/*
@@ -6514,7 +6509,7 @@ run_server(isc_task_t *task, isc_event_t *event) {
 
 	CHECKFATAL(ns_interfacemgr_create(ns_g_mctx, ns_g_taskmgr,
 					  ns_g_socketmgr, ns_g_dispatchmgr,
-					  &server->interfacemgr),
+					  server->task, &server->interfacemgr),
 		   "creating interface manager");
 
 	CHECKFATAL(isc_timer_create(ns_g_timermgr, isc_timertype_inactive,
@@ -7061,13 +7056,16 @@ ns_server_reloadwanted(ns_server_t *server) {
 
 void
 ns_server_scan_interfaces(ns_server_t *server) {
-	isc_event_t *event;
+	isc_result_t result;
 
-	event = isc_event_allocate(ns_g_mctx, server, NS_EVENT_IFSCAN,
-				   interface_timer_tick, server,
-				   sizeof(isc_event_t));
-	if (event != NULL)
-		isc_task_send(server->task, &event);
+	isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
+		      NS_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
+		      "automatic interface rescan");
+
+	result = isc_task_beginexclusive(server->task);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	scan_interfaces(server, ISC_TRUE);
+	isc_task_endexclusive(server->task);
 }
 
 static char *

From a7d4d528749aa403397b3e2260abf2046a0cfa7b Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Mon, 18 Aug 2014 19:38:43 +1000
Subject: [PATCH 06/23] quiet mode is -q

---
 bin/pkcs11/pkcs11-keygen.docbook | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/pkcs11/pkcs11-keygen.docbook b/bin/pkcs11/pkcs11-keygen.docbook
index 440df1300b..dd1e32c75a 100644
--- a/bin/pkcs11/pkcs11-keygen.docbook
+++ b/bin/pkcs11/pkcs11-keygen.docbook
@@ -149,7 +149,7 @@
       </varlistentry>
 
       <varlistentry>
-        <term>-e</term>
+        <term>-q</term>
         <listitem>
           <para>
             Quiet mode: suppress unnecessary output.

From 4151211e6649332f7b5a55870cbe37128bcc7b29 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Mon, 18 Aug 2014 23:30:03 +0000
Subject: [PATCH 07/23] newcopyrights

---
 util/copyrights | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/copyrights b/util/copyrights
index d39c327f43..e97a4f629b 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -233,7 +233,7 @@
 ./bin/named/include/named/control.h		C	2001,2002,2003,2004,2005,2006,2007,2009,2010,2011,2012,2014
 ./bin/named/include/named/geoip.h		C	2013
 ./bin/named/include/named/globals.h		C	1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014
-./bin/named/include/named/interfacemgr.h	C	1999,2000,2001,2002,2004,2005,2007,2011,2013
+./bin/named/include/named/interfacemgr.h	C	1999,2000,2001,2002,2004,2005,2007,2011,2013,2014
 ./bin/named/include/named/listenlist.h		C	2000,2001,2004,2005,2007,2013
 ./bin/named/include/named/log.h			C	1999,2000,2001,2002,2004,2005,2007,2009
 ./bin/named/include/named/logconf.h		C	1999,2000,2001,2004,2005,2006,2007

From e2eaaf8015f3e680c3a03b48b657e16226cb75c8 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Mon, 18 Aug 2014 23:45:21 +0000
Subject: [PATCH 08/23] update copyright notice

---
 bin/named/include/named/interfacemgr.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/named/include/named/interfacemgr.h b/bin/named/include/named/interfacemgr.h
index 9645a354cf..e8f560adba 100644
--- a/bin/named/include/named/interfacemgr.h
+++ b/bin/named/include/named/interfacemgr.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any

From 58f1ac8dadf2c1f215343a0b2d1df2df954c4b19 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Wed, 20 Aug 2014 23:14:03 +1000
Subject: [PATCH 09/23] 3916.   [contrib]       zone2sqlite checked wrong
 result code.  Address                         compiler warnings. [RT #36931]

---
 CHANGES                          | 5 ++++-
 contrib/sdb/bdb/bdb.c            | 3 ++-
 contrib/sdb/dir/dirdb.c          | 3 ++-
 contrib/sdb/ldap/ldapdb.c        | 5 ++++-
 contrib/sdb/pgsql/pgsqldb.c      | 3 ++-
 contrib/sdb/pgsql/zonetodb.c     | 8 ++++----
 contrib/sdb/sqlite/sqlitedb.c    | 3 ++-
 contrib/sdb/sqlite/zone2sqlite.c | 2 +-
 contrib/sdb/tcl/tcldb.c          | 3 ++-
 contrib/sdb/time/timedb.c        | 3 ++-
 10 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/CHANGES b/CHANGES
index 5455c26b69..b4ad105701 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,7 @@
-3915	[bug]		Address a assertion if a route event arrived while
+3916.	[contrib]	zone2sqlite checked wrong result code.  Address
+			compiler warnings. [RT #36931]
+
+3915.	[bug]		Address a assertion if a route event arrived while
 			shutting down. [RT #36887]
 
 3914.	[bug]		Allow the URI target and CAA value fields to
diff --git a/contrib/sdb/bdb/bdb.c b/contrib/sdb/bdb/bdb.c
index e4393bc52c..23594bbe3c 100644
--- a/contrib/sdb/bdb/bdb.c
+++ b/contrib/sdb/bdb/bdb.c
@@ -229,7 +229,8 @@ bdb_init(void)
 		NULL,
 		bdb_allnodes,
 		bdb_create,
-		bdb_destroy
+		bdb_destroy,
+		NULL /* lookup2 */
 	};
 
 	return dns_sdb_register(DRIVERNAME, &bdb_methods, NULL, 0, ns_g_mctx,
diff --git a/contrib/sdb/dir/dirdb.c b/contrib/sdb/dir/dirdb.c
index efaf892c27..babdf7ace4 100644
--- a/contrib/sdb/dir/dirdb.c
+++ b/contrib/sdb/dir/dirdb.c
@@ -179,7 +179,8 @@ static dns_sdbmethods_t dirdb_methods = {
 	dirdb_authority,
 	NULL, /* allnodes */
 	dirdb_create,
-	dirdb_destroy
+	dirdb_destroy,
+	NULL /* lookup2 */
 };
 
 /*
diff --git a/contrib/sdb/ldap/ldapdb.c b/contrib/sdb/ldap/ldapdb.c
index 08d8df4539..caade37c80 100644
--- a/contrib/sdb/ldap/ldapdb.c
+++ b/contrib/sdb/ldap/ldapdb.c
@@ -386,6 +386,8 @@ ldapdb_lookup(const char *zone, const char *name, void *dbdata,
 	      dns_sdblookup_t *lookup, dns_clientinfomethods_t *methods,
 	      dns_clientinfo_t *clientinfo)
 {
+	UNUSED(methods);
+	UNUSED(clientinfo);
 	return (ldapdb_search(zone, name, dbdata, lookup, NULL, NULL));
 }
 #else
@@ -661,7 +663,8 @@ static dns_sdbmethods_t ldapdb_methods = {
 	NULL, /* authority */
 	ldapdb_allnodes,
 	ldapdb_create,
-	ldapdb_destroy
+	ldapdb_destroy,
+	NULL /* lookup2 */
 };
 
 /* Wrapper around dns_sdb_register() */
diff --git a/contrib/sdb/pgsql/pgsqldb.c b/contrib/sdb/pgsql/pgsqldb.c
index fa3d453d81..7eaef371f5 100644
--- a/contrib/sdb/pgsql/pgsqldb.c
+++ b/contrib/sdb/pgsql/pgsqldb.c
@@ -335,7 +335,8 @@ static dns_sdbmethods_t pgsqldb_methods = {
 	NULL, /* authority */
 	pgsqldb_allnodes,
 	pgsqldb_create,
-	pgsqldb_destroy
+	pgsqldb_destroy,
+	NULL /* lookup2 */
 };
 
 /*
diff --git a/contrib/sdb/pgsql/zonetodb.c b/contrib/sdb/pgsql/zonetodb.c
index a26d72d4b3..7855c816c5 100644
--- a/contrib/sdb/pgsql/zonetodb.c
+++ b/contrib/sdb/pgsql/zonetodb.c
@@ -74,7 +74,7 @@ check_result(isc_result_t result, const char *message) {
  * "dest" must be an array of at least size 2*strlen(source) + 1.
  */
 static void
-quotestring(const char *source, char *dest) {
+quotestring(const unsigned char *source, unsigned char *dest) {
 	while (*source != 0) {
 		if (*source == '\'')
 			*dest++ = '\'';
@@ -101,19 +101,19 @@ addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata) {
 	result = dns_name_totext(name, ISC_TRUE, &b);
 	check_result(result, "dns_name_totext");
 	namearray[isc_buffer_usedlength(&b)] = 0;
-	quotestring(namearray, canonnamearray);
+	quotestring((const unsigned char *)namearray, canonnamearray);
 
 	isc_buffer_init(&b, typearray, sizeof(typearray) - 1);
 	result = dns_rdatatype_totext(rdata->type, &b);
 	check_result(result, "dns_rdatatype_totext");
 	typearray[isc_buffer_usedlength(&b)] = 0;
-	quotestring(typearray, canontypearray);
+	quotestring((const unsigned char *)typearray, canontypearray);
 
 	isc_buffer_init(&b, dataarray, sizeof(dataarray) - 1);
 	result = dns_rdata_totext(rdata, NULL, &b);
 	check_result(result, "dns_rdata_totext");
 	dataarray[isc_buffer_usedlength(&b)] = 0;
-	quotestring(dataarray, canondataarray);
+	quotestring((const unsigned char *)dataarray, canondataarray);
 
 	snprintf(str, sizeof(str),
 		 "INSERT INTO %s (NAME, TTL, RDTYPE, RDATA)"
diff --git a/contrib/sdb/sqlite/sqlitedb.c b/contrib/sdb/sqlite/sqlitedb.c
index 8491aa8a5a..57fe16db16 100644
--- a/contrib/sdb/sqlite/sqlitedb.c
+++ b/contrib/sdb/sqlite/sqlitedb.c
@@ -306,7 +306,8 @@ static dns_sdbmethods_t sqlitedb_methods = {
     NULL, /* authority */
     sqlitedb_allnodes,
     sqlitedb_create,
-    sqlitedb_destroy
+    sqlitedb_destroy,
+    NULL /* lookup2 */
 };
 
 
diff --git a/contrib/sdb/sqlite/zone2sqlite.c b/contrib/sdb/sqlite/zone2sqlite.c
index 7b9260a250..7bcb6f0368 100644
--- a/contrib/sdb/sqlite/zone2sqlite.c
+++ b/contrib/sdb/sqlite/zone2sqlite.c
@@ -137,7 +137,7 @@ addrdata(dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata)
     res = sqlite3_exec(dbi.db, sql, add_rdata_cb, NULL, &errmsg);
     sqlite3_free(sql);
 
-    if (result != SQLITE_OK) {
+    if (res != SQLITE_OK) {
 	fprintf(stderr, "INSERT failed: %s\n", errmsg);
 	closeandexit(1);
     }
diff --git a/contrib/sdb/tcl/tcldb.c b/contrib/sdb/tcl/tcldb.c
index 9035600e72..8bd8b470e2 100644
--- a/contrib/sdb/tcl/tcldb.c
+++ b/contrib/sdb/tcl/tcldb.c
@@ -213,7 +213,8 @@ static dns_sdbmethods_t tcldb_methods = {
 	NULL, /* authority */
 	NULL, /* allnodes */
 	tcldb_create,
-	NULL /* destroy */
+	NULL, /* destroy */
+	NULL /* lookup2 */
 };
 
 /*
diff --git a/contrib/sdb/time/timedb.c b/contrib/sdb/time/timedb.c
index 704014f13e..f621726a3e 100644
--- a/contrib/sdb/time/timedb.c
+++ b/contrib/sdb/time/timedb.c
@@ -130,7 +130,8 @@ static dns_sdbmethods_t timedb_methods = {
 	timedb_authority,
 	NULL,	/* allnodes */
 	NULL,	/* create */
-	NULL	/* destroy */
+	NULL,	/* destroy */
+	NULL	/* lookup2 */
 };
 
 /*

From 9a9ca3c4f120971b7091b28a5530e5eaf362f7e6 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Wed, 20 Aug 2014 23:30:03 +0000
Subject: [PATCH 10/23] newcopyrights

---
 util/copyrights | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/util/copyrights b/util/copyrights
index e97a4f629b..0760bc0c1b 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -2505,29 +2505,29 @@
 ./contrib/scripts/nanny.pl			PERL	2000,2001,2004,2007,2012,2014
 ./contrib/scripts/zone-edit.sh.in		SH	2010,2012,2014
 ./contrib/sdb/bdb/README			X	2002
-./contrib/sdb/bdb/bdb.c				X	2002,2011
+./contrib/sdb/bdb/bdb.c				X	2002,2011,2014
 ./contrib/sdb/bdb/bdb.h				X	2002
 ./contrib/sdb/bdb/zone2bdb.c			X	2002,2008,2009
-./contrib/sdb/dir/dirdb.c			C	2000,2001,2004,2007,2011
+./contrib/sdb/dir/dirdb.c			C	2000,2001,2004,2007,2011,2014
 ./contrib/sdb/dir/dirdb.h			C	2000,2001,2004,2007
 ./contrib/sdb/ldap/INSTALL.ldap			X	2001,2002,2004
 ./contrib/sdb/ldap/README.ldap			X	2001,2002,2004
 ./contrib/sdb/ldap/README.zone2ldap		X	2001
-./contrib/sdb/ldap/ldapdb.c			X	2001,2002,2003,2004,2011
+./contrib/sdb/ldap/ldapdb.c			X	2001,2002,2003,2004,2011,2014
 ./contrib/sdb/ldap/ldapdb.h			X	2001
 ./contrib/sdb/ldap/zone2ldap.1			X	2001
 ./contrib/sdb/ldap/zone2ldap.c			X	2001,2005,2008,2009,2011
-./contrib/sdb/pgsql/pgsqldb.c			C	2000,2001,2004,2007,2011
+./contrib/sdb/pgsql/pgsqldb.c			C	2000,2001,2004,2007,2011,2014
 ./contrib/sdb/pgsql/pgsqldb.h			C	2000,2001,2004,2007
-./contrib/sdb/pgsql/zonetodb.c			C	2000,2001,2002,2004,2005,2007,2008,2009
+./contrib/sdb/pgsql/zonetodb.c			C	2000,2001,2002,2004,2005,2007,2008,2009,2014
 ./contrib/sdb/sqlite/README.sdb_sqlite		X	2007
-./contrib/sdb/sqlite/sqlitedb.c			X	2007,2011
+./contrib/sdb/sqlite/sqlitedb.c			X	2007,2011,2014
 ./contrib/sdb/sqlite/sqlitedb.h			X	2007
-./contrib/sdb/sqlite/zone2sqlite.c		X	2007,2008,2009,2010,2013
+./contrib/sdb/sqlite/zone2sqlite.c		X	2007,2008,2009,2010,2013,2014
 ./contrib/sdb/tcl/lookup.tcl			TCL	2000,2001,2004,2007,2012
-./contrib/sdb/tcl/tcldb.c			C	2000,2001,2004,2007,2011
+./contrib/sdb/tcl/tcldb.c			C	2000,2001,2004,2007,2011,2014
 ./contrib/sdb/tcl/tcldb.h			C	2000,2001,2004,2007
-./contrib/sdb/time/timedb.c			C	2000,2001,2004,2007,2011
+./contrib/sdb/time/timedb.c			C	2000,2001,2004,2007,2011,2014
 ./contrib/sdb/time/timedb.h			C	2000,2001,2004,2007
 ./contrib/zkt-1.1.2/.gitignore			X	2014
 ./contrib/zkt-1.1.2/CHANGELOG			X	2008,2009,2010,2014

From 80d13a0d458afeb6bdac7ae97fa4604fa50d4b90 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Wed, 20 Aug 2014 23:45:19 +0000
Subject: [PATCH 11/23] update copyright notice

---
 contrib/sdb/dir/dirdb.c      | 2 +-
 contrib/sdb/pgsql/pgsqldb.c  | 2 +-
 contrib/sdb/pgsql/zonetodb.c | 2 +-
 contrib/sdb/tcl/tcldb.c      | 2 +-
 contrib/sdb/time/timedb.c    | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/contrib/sdb/dir/dirdb.c b/contrib/sdb/dir/dirdb.c
index babdf7ace4..188f885558 100644
--- a/contrib/sdb/dir/dirdb.c
+++ b/contrib/sdb/dir/dirdb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/contrib/sdb/pgsql/pgsqldb.c b/contrib/sdb/pgsql/pgsqldb.c
index 7eaef371f5..50d3cba3c1 100644
--- a/contrib/sdb/pgsql/pgsqldb.c
+++ b/contrib/sdb/pgsql/pgsqldb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/contrib/sdb/pgsql/zonetodb.c b/contrib/sdb/pgsql/zonetodb.c
index 7855c816c5..b8f5912b23 100644
--- a/contrib/sdb/pgsql/zonetodb.c
+++ b/contrib/sdb/pgsql/zonetodb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2007-2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/contrib/sdb/tcl/tcldb.c b/contrib/sdb/tcl/tcldb.c
index 8bd8b470e2..8c1e77a638 100644
--- a/contrib/sdb/tcl/tcldb.c
+++ b/contrib/sdb/tcl/tcldb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
diff --git a/contrib/sdb/time/timedb.c b/contrib/sdb/time/timedb.c
index f621726a3e..a5201f5e71 100644
--- a/contrib/sdb/time/timedb.c
+++ b/contrib/sdb/time/timedb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2007, 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007, 2011, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any

From f5695ad0e1a6cc8e19bfec7b71476e138de6cb6c Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 21 Aug 2014 18:05:55 +1000
Subject: [PATCH 12/23] 3917.   [bug]           dig, nslookup and host now
 continue on names that are                         too long after applying a
 search list elements.                         [RT #36892]

---
 CHANGES                                  |  4 ++
 bin/dig/dighost.c                        | 81 +++++++++++++++---------
 bin/dig/include/dig/dig.h                |  2 +-
 bin/tests/system/conf.sh.in              |  7 +-
 bin/tests/system/nslookup/clean.sh       |  2 +
 bin/tests/system/nslookup/ns1/named.conf | 33 ++++++++++
 bin/tests/system/nslookup/setup.sh       | 20 ++++++
 bin/tests/system/nslookup/tests.sh       | 36 +++++++++++
 8 files changed, 152 insertions(+), 33 deletions(-)
 create mode 100644 bin/tests/system/nslookup/clean.sh
 create mode 100644 bin/tests/system/nslookup/ns1/named.conf
 create mode 100644 bin/tests/system/nslookup/setup.sh
 create mode 100644 bin/tests/system/nslookup/tests.sh

diff --git a/CHANGES b/CHANGES
index b4ad105701..141ca61443 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3917.	[bug]		dig, nslookup and host now continue on names that are
+			too long after applying a search list elements.
+			[RT #36892]
+
 3916.	[contrib]	zone2sqlite checked wrong result code.  Address
 			compiler warnings. [RT #36931]
 
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 85ca6e4158..1a0202b9d6 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -369,6 +369,11 @@ connect_timeout(isc_task_t *task, isc_event_t *event);
 static void
 launch_next_query(dig_query_t *query, isc_boolean_t include_question);
 
+static void
+check_next_lookup(dig_lookup_t *lookup);
+
+static isc_boolean_t
+next_origin(dig_lookup_t *oldlookup);
 
 static void *
 mem_alloc(void *arg, size_t size) {
@@ -1819,8 +1824,10 @@ start_lookup(void) {
 		}
 	novalidation:
 #endif
-		setup_lookup(current_lookup);
-		do_lookup(current_lookup);
+		if (setup_lookup(current_lookup))
+			do_lookup(current_lookup);
+		else if (next_origin(current_lookup))
+			check_next_lookup(current_lookup);
 	} else {
 		check_if_done();
 	}
@@ -2021,8 +2028,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
  * Return ISC_TRUE iff there was another searchlist entry.
  */
 static isc_boolean_t
-next_origin(dig_query_t *query) {
-	dig_lookup_t *lookup;
+next_origin(dig_lookup_t *oldlookup) {
+	dig_lookup_t *newlookup;
 	dig_searchlist_t *search;
 	dns_fixedname_t fixed;
 	dns_name_t *name;
@@ -2031,7 +2038,7 @@ next_origin(dig_query_t *query) {
 	INSIST(!free_now);
 
 	debug("next_origin()");
-	debug("following up %s", query->lookup->textname);
+	debug("following up %s", oldlookup->textname);
 
 	if (!usesearch)
 		/*
@@ -2045,30 +2052,30 @@ next_origin(dig_query_t *query) {
 	 */
 	dns_fixedname_init(&fixed);
 	name = dns_fixedname_name(&fixed);
-	result = dns_name_fromstring2(name, query->lookup->textname, NULL,
+	result = dns_name_fromstring2(name, oldlookup->textname, NULL,
 				      0, NULL);
 	if (result == ISC_R_SUCCESS &&
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
 		return (ISC_FALSE);
 
-	if (query->lookup->origin == NULL && !query->lookup->need_search)
+	if (oldlookup->origin == NULL && !oldlookup->need_search)
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
 		return (ISC_FALSE);
-	if (query->lookup->origin == NULL && query->lookup->need_search) {
-		lookup = requeue_lookup(query->lookup, ISC_TRUE);
-		lookup->origin = ISC_LIST_HEAD(search_list);
-		lookup->need_search = ISC_FALSE;
+	if (oldlookup->origin == NULL && oldlookup->need_search) {
+		newlookup = requeue_lookup(oldlookup, ISC_TRUE);
+		newlookup->origin = ISC_LIST_HEAD(search_list);
+		newlookup->need_search = ISC_FALSE;
 	} else {
-		search = ISC_LIST_NEXT(query->lookup->origin, link);
-		if (search == NULL && query->lookup->done_as_is)
+		search = ISC_LIST_NEXT(oldlookup->origin, link);
+		if (search == NULL && oldlookup->done_as_is)
 			return (ISC_FALSE);
-		lookup = requeue_lookup(query->lookup, ISC_TRUE);
-		lookup->origin = search;
+		newlookup = requeue_lookup(oldlookup, ISC_TRUE);
+		newlookup->origin = search;
 	}
-	cancel_lookup(query->lookup);
+	cancel_lookup(oldlookup);
 	return (ISC_TRUE);
 }
 
@@ -2153,7 +2160,7 @@ compute_cookie(unsigned char *cookie, size_t len) {
  * well as the query structures and buffer space for the replies.  If the
  * server list is empty, clone it from the system default list.
  */
-void
+isc_boolean_t
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
 	isc_uint32_t id;
@@ -2283,20 +2290,35 @@ setup_lookup(dig_lookup_t *lookup) {
 		if (lookup->trace && lookup->trace_root) {
 			dns_name_clone(dns_rootname, lookup->name);
 		} else {
+			dns_fixedname_t fixed;
+			dns_name_t *name;
+
+			dns_fixedname_init(&fixed);
+			name = dns_fixedname_name(&fixed);
 			len = strlen(lookup->textname);
 			isc_buffer_init(&b, lookup->textname, len);
 			isc_buffer_add(&b, len);
-			result = dns_name_fromtext(lookup->name, &b,
-						   lookup->oname, 0,
-						   &lookup->namebuf);
-		}
-		if (result != ISC_R_SUCCESS) {
-			dns_message_puttempname(lookup->sendmsg,
-						&lookup->name);
-			dns_message_puttempname(lookup->sendmsg,
-						&lookup->oname);
-			fatal("'%s' is not in legal name syntax (%s)",
-			      lookup->textname, isc_result_totext(result));
+			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
+			if (result == ISC_R_SUCCESS &&
+			    !dns_name_isabsolute(name))
+				result = dns_name_concatenate(name,
+							      lookup->oname,
+							      lookup->name,
+							      &lookup->namebuf);
+			else if (result == ISC_R_SUCCESS)
+				result = dns_name_copy(name, lookup->name,
+						       &lookup->namebuf);
+			if (result != ISC_R_SUCCESS) {
+				dns_message_puttempname(lookup->sendmsg,
+							&lookup->name);
+				dns_message_puttempname(lookup->sendmsg,
+							&lookup->oname);
+				if (result == DNS_R_NAMETOOLONG)
+					return (ISC_FALSE);
+				fatal("'%s' is not in legal name syntax (%s)",
+				      lookup->textname,
+				      isc_result_totext(result));
+			}
 		}
 		dns_message_puttempname(lookup->sendmsg, &lookup->oname);
 	} else
@@ -2591,6 +2613,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			printf(";; QUERY SIZE: %u\n\n",
 			       isc_buffer_usedlength(&lookup->renderbuf));
 	}
+	return (ISC_TRUE);
 }
 
 /*%
@@ -3794,7 +3817,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
-			if (!next_origin(query) || showsearch) {
+			if (!next_origin(query->lookup) || showsearch) {
 				printmessage(query, msg, ISC_TRUE);
 				received(b->used, &sevent->address, query);
 			}
diff --git a/bin/dig/include/dig/dig.h b/bin/dig/include/dig/dig.h
index 8c2c9dbea5..ba99428bf5 100644
--- a/bin/dig/include/dig/dig.h
+++ b/bin/dig/include/dig/dig.h
@@ -323,7 +323,7 @@ debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 void
 check_result(isc_result_t result, const char *msg);
 
-void
+isc_boolean_t
 setup_lookup(dig_lookup_t *lookup);
 
 void
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index a0c6f8826b..37786696a0 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -57,6 +57,7 @@ ARPANAME=$TOP/bin/tools/arpaname
 RESOLVE=$TOP/lib/samples/resolve
 RRCHECKER=$TOP/bin/tools/named-rrchecker
 GENRANDOM=$TOP/bin/tools/genrandom
+NSLOOKUP=$TOP/bin/dig/nslookup
 
 RANDFILE=$TOP/bin/tests/system/random.data
 
@@ -68,8 +69,8 @@ SUBDIRS="acl additional allow_query addzone autosign builtin
 	 @COVERAGE@ database dlv dlvauto dlz dlzexternal
 	 dname dns64 dnssec dsdigest dscp ecdsa emptyzones filter-aaaa
 	 formerr forward geoip glue gost ixfr inline limits logfileconfig
-	 lwresd masterfile masterformat metadata notify nsupdate pending
-	 @PKCS11_TEST@ redirect resolver rndc rpz rrl rrchecker
+	 lwresd masterfile masterformat metadata notify nslookup nsupdate
+	 pending @PKCS11_TEST@ redirect resolver rndc rpz rrl rrchecker
 	 rrsetorder rsabigexponent sit smartsign sortlist spf staticstub
 	 statistics stub tkey tsig tsiggss unknown upforwd verify
 	 views wildcard xfer xferquota zero zonechecks"
@@ -93,4 +94,4 @@ fi
 
 export NAMED LWRESD DIG NSUPDATE KEYGEN KEYFRLAB SIGNER KEYSIGNER KEYSETTOOL \
        PERL SUBDIRS RNDC CHECKZONE PK11GEN PK11LIST PK11DEL TESTSOCK6 \
-       JOURNALPRINT ARPANAME RESOLVE RRCHECKER
+       JOURNALPRINT ARPANAME RESOLVE RRCHECKER NSLOOKUP
diff --git a/bin/tests/system/nslookup/clean.sh b/bin/tests/system/nslookup/clean.sh
new file mode 100644
index 0000000000..c43d9b86c8
--- /dev/null
+++ b/bin/tests/system/nslookup/clean.sh
@@ -0,0 +1,2 @@
+rm -f ns1/example.db
+rm -f nslookup.out*
diff --git a/bin/tests/system/nslookup/ns1/named.conf b/bin/tests/system/nslookup/ns1/named.conf
new file mode 100644
index 0000000000..fc1fb510ff
--- /dev/null
+++ b/bin/tests/system/nslookup/ns1/named.conf
@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+controls { /* empty */ };
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port 5300;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+};
+
+zone "example" {
+	type master;
+	file "example.db";
+};
diff --git a/bin/tests/system/nslookup/setup.sh b/bin/tests/system/nslookup/setup.sh
new file mode 100644
index 0000000000..092e5800c8
--- /dev/null
+++ b/bin/tests/system/nslookup/setup.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+#
+# Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+$SHELL ../genzone.sh 1 >ns1/example.db
diff --git a/bin/tests/system/nslookup/tests.sh b/bin/tests/system/nslookup/tests.sh
new file mode 100644
index 0000000000..d77afd9fec
--- /dev/null
+++ b/bin/tests/system/nslookup/tests.sh
@@ -0,0 +1,36 @@
+#!/bin/sh
+#
+# Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+status=0
+n=0
+
+n=`expr $n + 1`
+echo "Check that domain names that are too big when applying a search list entry are handled cleanly ($n)"
+ret=0
+l=012345678901234567890123456789012345678901234567890123456789012
+t=0123456789012345678901234567890123456789012345678901234567890
+d=$l.$l.$l.$t
+$NSLOOKUP -port=5300 -domain=$d -type=soa example 10.53.0.1 > nslookup.out${n} || ret=1
+grep "origin = ns1.example" nslookup.out${n} > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:exit status: $status"
+exit $status
+

From ac2ad7b4e4e41e7e788dbe103c581f1605209d3b Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 21 Aug 2014 23:30:09 +0000
Subject: [PATCH 13/23] newcopyrights

---
 util/copyrights | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/util/copyrights b/util/copyrights
index 0760bc0c1b..05fc75b314 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -1449,6 +1449,10 @@
 ./bin/tests/system/notify/ns3/named.conf	CONF-C	2000,2001,2004,2007
 ./bin/tests/system/notify/setup.sh		SH	2000,2001,2004,2007,2012
 ./bin/tests/system/notify/tests.sh		SH	2000,2001,2004,2007,2011,2012,2013
+./bin/tests/system/nslookup/clean.sh		SH	2014
+./bin/tests/system/nslookup/ns1/named.conf	CONF-C	2014
+./bin/tests/system/nslookup/setup.sh		SH	2014
+./bin/tests/system/nslookup/tests.sh		SH	2014
 ./bin/tests/system/nsupdate/clean.sh		SH	2000,2001,2004,2007,2009,2010,2011,2012,2014
 ./bin/tests/system/nsupdate/commandlist		X	2012
 ./bin/tests/system/nsupdate/knowngood.ns1.after	X	2000,2001,2003,2004,2009

From 5165c59007b3f7e2948a9161b116367e5488df26 Mon Sep 17 00:00:00 2001
From: Tinderbox User <tbox@isc.org>
Date: Thu, 21 Aug 2014 23:45:22 +0000
Subject: [PATCH 14/23] update copyright notice

---
 bin/tests/system/nslookup/clean.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/bin/tests/system/nslookup/clean.sh b/bin/tests/system/nslookup/clean.sh
index c43d9b86c8..7deb83a3bb 100644
--- a/bin/tests/system/nslookup/clean.sh
+++ b/bin/tests/system/nslookup/clean.sh
@@ -1,2 +1,16 @@
+# Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+#
+# Permission to use, copy, modify, and/or distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+# AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+# PERFORMANCE OF THIS SOFTWARE.
+
 rm -f ns1/example.db
 rm -f nslookup.out*

From d90344224afc80459778e4c3412fd1f9463e24d4 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Aug 2014 11:49:58 +1000
Subject: [PATCH 15/23] 3918.   [doc]           Update check-spf documentation.
 [RT #36910]

---
 CHANGES                 |  2 ++
 doc/arm/Bv9ARM-book.xml | 25 ++++++++++++++-----------
 2 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/CHANGES b/CHANGES
index 141ca61443..c80996d52f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3918.	[doc]		Update check-spf documentation. [RT #36910]
+
 3917.	[bug]		dig, nslookup and host now continue on names that are
 			too long after applying a search list elements.
 			[RT #36892]
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index c2cd9db416..cd061d5364 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -4840,7 +4840,7 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     <optional> check-mx-cname ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional>
     <optional> check-srv-cname ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional>
     <optional> check-sibling <replaceable>yes_or_no</replaceable>; </optional>
-    <optional> check-spf ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional>
+    <optional> check-spf ( <replaceable>warn</replaceable> | <replaceable>ignore</replaceable> ); </optional>
     <optional> allow-new-zones { <replaceable>yes_or_no</replaceable> }; </optional>
     <optional> allow-notify { <replaceable>address_match_list</replaceable> }; </optional>
     <optional> allow-query { <replaceable>address_match_list</replaceable> }; </optional>
@@ -6877,10 +6877,13 @@ options {
 		  The default is <command>yes</command>.
 		</para>
 		<para>
-		  Check that the two forms of Sender Policy Framework
-		  records (TXT records starting with "v=spf1" and SPF) either
-		  both exist or both don't exist.  Warnings are
-		  emitted it they don't and be suppressed with
+		  The use of the SPF record for publishing Sender
+		  Policy Framework is deprecated as the migration
+		  from using TXT records to SPF records was abandoned.
+		  Enabling this option also checks that a TXT Sender
+		  Policy Framework record exists (starts with "v=spf1")
+		  if there is an SPF record. Warnings are emitted if the
+		  TXT record does not exist and can be suppressed with
 		  <command>check-spf</command>.
 		</para>
 	      </listitem>
@@ -6922,11 +6925,11 @@ options {
 	      <term><command>check-spf</command></term>
 	      <listitem>
 		<para>
-		  When performing integrity checks, check that the
-		  two forms of Sender Policy Framwork records (TXT
-		  records starting with "v=spf1" and SPF) both exist
-		  or both don't exist and issue a warning if not
-		  met.  The default is <command>warn</command>.
+		  If <command>check-integrity</command> is set then
+		  check that there is a TXT Sender Policy Framework
+		  record present (starts with "v=spf1") if there is an
+		  SPF record present. The default is
+		  <command>warn</command>.
 		</para>
 	      </listitem>
 	    </varlistentry>
@@ -11140,7 +11143,7 @@ view "external" {
     <optional> check-names (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional>
     <optional> check-mx (<constant>warn</constant>|<constant>fail</constant>|<constant>ignore</constant>) ; </optional>
     <optional> check-wildcard <replaceable>yes_or_no</replaceable>; </optional>
-    <optional> check-spf ( <replaceable>warn</replaceable> | <replaceable>fail</replaceable> | <replaceable>ignore</replaceable> ); </optional>
+    <optional> check-spf ( <replaceable>warn</replaceable> | <replaceable>ignore</replaceable> ); </optional>
     <optional> check-integrity <replaceable>yes_or_no</replaceable> ; </optional>
     <optional> dialup <replaceable>dialup_option</replaceable> ; </optional>
     <optional> file <replaceable>string</replaceable> ; </optional>

From e0421bf2c57e3bb8cee8fa33470bfcf450305867 Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Thu, 21 Aug 2014 22:15:36 -0700
Subject: [PATCH 16/23] [master] doc masterfile-style

3919.	[doc]		Added doc for masterfile-style. [RT #36823]
---
 CHANGES                 |  2 ++
 doc/arm/Bv9ARM-book.xml | 30 +++++++++++++++++++++++++++++-
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index c80996d52f..c5fbeea3b7 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3919.	[doc]		Added doc for masterfile-style. [RT #36823]
+
 3918.	[doc]		Update check-spf documentation. [RT #36910]
 
 3917.	[bug]		dig, nslookup and host now continue on names that are
diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index cd061d5364..30122b6bdf 100644
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -4979,6 +4979,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
     <optional> max-clients-per-query <replaceable>number</replaceable> ; </optional>
     <optional> masterfile-format
 	    (<constant>text</constant>|<constant>raw</constant>|<constant>map</constant>) ; </optional>
+    <optional> masterfile-style
+	    (<constant>relative</constant>|<constant>full</constant>) ; </optional>
     <optional> empty-server <replaceable>name</replaceable> ; </optional>
     <optional> empty-contact <replaceable>name</replaceable> ; </optional>
     <optional> empty-zones-enable <replaceable>yes_or_no</replaceable> ; </optional>
@@ -8993,6 +8995,31 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      </listitem>
 	    </varlistentry>
 
+	    <varlistentry>
+	      <term><command>masterfile-style</command></term>
+	      <listitem>
+                <para>
+                  Specifies the formatting of zone files during dump
+                  when the <option>masterfile-format</option> is
+                  <constant>text</constant>. (This option is ignored
+                  with any other <option>masterfile-format</option>.)
+                </para>
+                <para>
+                  When set to <constant>relative</constant>,
+                  records are printed in a multi-line format with owner
+                  names expressed relative to a shared origin.  When set
+                  to <constant>full</constant>, records are printed in
+                  a single-line format with absolute owner names.
+                  The <constant>full</constant> format is most suitable
+                  when a zone file needs to be processed automatically
+                  by a script.  The <constant>relative</constant> format
+                  is more human-readable, and is thus suitable when a
+                  zone is to be edited by hand.  The default is
+                  <constant>relative</constant>.
+		</para>
+	      </listitem>
+	    </varlistentry>
+
 	    <varlistentry id="clients-per-query">
 	      <term><command>clients-per-query</command></term>
 	      <term><command>max-clients-per-query</command></term>
@@ -9001,7 +9028,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 		  initial value (minimum) and maximum number of recursive
 		  simultaneous clients for any given query
 		  (&lt;qname,qtype,qclass&gt;) that the server will accept
-		  before dropping additional clients.  <command>named</command> will attempt to
+                  before dropping additional clients.
+                  <command>named</command> will attempt to
 		  self tune this value and changes will be logged.  The
 		  default values are 10 and 100.
 		</para>

From 3d66a979b531b8549b412d9b592a6906fbb40143 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Aug 2014 15:40:43 +1000
Subject: [PATCH 17/23] 3919.   [bug]           dig: continue to next line if a
 address lookup fails                         in batch mode. [RT #36755]

---
 CHANGES       |  5 ++++-
 bin/dig/dig.c | 22 ++++++++++++++++++++--
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index c5fbeea3b7..e919c52efd 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,8 @@
-3919.	[doc]		Added doc for masterfile-style. [RT #36823]
+3920.	[doc]		Added doc for masterfile-style. [RT #36823]
 
+3919.	[bug]		dig: continue to next line if a address lookup fails
+			in batch mode. [RT #36755]
+			
 3918.	[doc]		Update check-spf documentation. [RT #36910]
 
 3917.	[bug]		dig, nslookup and host now continue on names that are
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 7e72c4f09b..d27bb90552 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -1677,7 +1677,8 @@ preparse_args(int argc, char **argv) {
 
 static void
 parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
-	   int argc, char **argv) {
+	   int argc, char **argv)
+{
 	isc_result_t result;
 	isc_textregion_t tr;
 	isc_boolean_t firstarg = ISC_TRUE;
@@ -1771,7 +1772,24 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		if (strncmp(rv[0], "%", 1) == 0)
 			break;
 		if (rv[0][0] == '@') {
-			addresscount = getaddresses(lookup, &rv[0][1], NULL);
+			
+			if (is_batchfile && !config_only) {
+				addresscount = getaddresses(lookup, &rv[0][1],
+							     &result);
+				if (result != ISC_R_SUCCESS) {
+					fprintf(stderr, "couldn't get address "
+						"for '%s': %s: skipping "
+						"lookup\n", &rv[0][1],
+					        isc_result_totext(result));
+					if (ISC_LINK_LINKED(lookup, link))
+						ISC_LIST_DEQUEUE(lookup_list,
+								 lookup, link);
+					destroy_lookup(lookup);
+					return;
+				}
+			} else 
+				addresscount = getaddresses(lookup, &rv[0][1],
+							    NULL);
 		} else if (rv[0][0] == '+') {
 			plus_option(&rv[0][1], is_batchfile,
 				    lookup);

From cef76ee5bd845a80e06da934edce4225bdba22a1 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Aug 2014 15:45:40 +1000
Subject: [PATCH 18/23] 3921.   [bug]           AD was inappopriately set on
 RPZ responses. [RT #36833]

---
 CHANGES                       | 2 ++
 bin/named/query.c             | 5 +++--
 bin/tests/system/rpz/tests.sh | 5 +++++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index e919c52efd..d5a8d1c825 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3921.	[bug]		AD was inappopriately set on RPZ responses. [RT #36833]
+
 3920.	[doc]		Added doc for masterfile-style. [RT #36823]
 
 3919.	[bug]		dig: continue to next line if a address lookup fails
diff --git a/bin/named/query.c b/bin/named/query.c
index ec56030dcd..a79a930fd3 100644
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -5450,7 +5450,7 @@ rpz_add_cname(ns_client_t *client, dns_rpz_st_t *st,
 	 * response policy zone cannot verify.
 	 */
 	client->attributes &= ~(NS_CLIENTATTR_WANTDNSSEC |
-				DNS_MESSAGEFLAG_AD);
+				NS_CLIENTATTR_WANTAD);
 	return (ISC_R_SUCCESS);
 }
 
@@ -6679,7 +6679,8 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
 			 * response policy zone cannot verify.
 			 */
 			client->attributes &= ~(NS_CLIENTATTR_WANTDNSSEC |
-						DNS_MESSAGEFLAG_AD);
+						NS_CLIENTATTR_WANTAD);
+			client->message->flags &= ~DNS_MESSAGEFLAG_AD;
 			query_putrdataset(client, &sigrdataset);
 			rpz_st->q.is_zone = is_zone;
 			is_zone = ISC_TRUE;
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index aea61c90b8..4d4978a229 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -209,6 +209,11 @@ clean_result () {
 # $1=dig args $2=other dig output file
 ckresult () {
     #ckalive "$1" "I:server crashed by 'dig $1'" || return 1
+    if grep "flags:.* aa .*ad;" $DIGNM; then
+	setret "I:'dig $1' AA and AD set;"
+    elif grep "flags:.* aa .*ad;" $DIGNM; then
+	setret "I:'dig $1' AD set;"
+    fi
     if $PERL $SYSTEMTESTTOP/digcomp.pl $DIGNM $2 >/dev/null; then
 	NEED_TCP=`echo "$1" | sed -n -e 's/[Tt][Cc][Pp].*/TCP/p'`
 	RESULT_TCP=`sed -n -e 's/.*Truncated, retrying in TCP.*/TCP/p' $DIGNM`

From eeb13c7cd2ddde29b8605b9444451ea6e235e06a Mon Sep 17 00:00:00 2001
From: Evan Hunt <each@isc.org>
Date: Thu, 21 Aug 2014 22:56:12 -0700
Subject: [PATCH 19/23] [master] don't clear signatures from zone cuts

3922.	[bug]		When resigning, dnssec-signzone was removing
			all signatures from delegation nodes. It now
			retains	DS and (if applicable) NSEC signatures.
			[RT #36946]
---
 CHANGES                      |  5 +++++
 bin/dnssec/dnssec-signzone.c | 39 ++++++++++++++++++++++++------------
 2 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/CHANGES b/CHANGES
index d5a8d1c825..35ca5d2f08 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+3922.	[bug]		When resigning, dnssec-signzone was removing
+			all signatures from delegation nodes. It now
+			retains	DS and (if applicable) NSEC signatures.
+			[RT #36946]
+
 3921.	[bug]		AD was inappopriately set on RPZ responses. [RT #36833]
 
 3920.	[doc]		Added doc for masterfile-style. [RT #36823]
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 8ae13d8174..e440664796 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -506,6 +506,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	result = dns_db_findrdataset(gdb, node, gversion, dns_rdatatype_rrsig,
 				     set->type, 0, &sigset, NULL);
 	if (result == ISC_R_NOTFOUND) {
+		vbprintf(2, "no existing signatures for %s/%s\n",
+			 namestr, typestr);
 		result = ISC_R_SUCCESS;
 		nosigs = ISC_TRUE;
 	}
@@ -1664,10 +1666,14 @@ remove_records(dns_dbnode_t *node, dns_rdatatype_t which,
 }
 
 /*
- * Remove signatures covering the given type (0 == all signatures).
+ * Remove signatures covering the given type.  If type == 0,
+ * then remove all signatures, unless this is a delegation, in
+ * which case remove all signatures except for DS or nsec_datatype
  */
 static void
-remove_sigs(dns_dbnode_t *node, dns_rdatatype_t which) {
+remove_sigs(dns_dbnode_t *node, isc_boolean_t delegation,
+	    dns_rdatatype_t which)
+{
 	isc_result_t result;
 	dns_rdatatype_t type, covers;
 	dns_rdatasetiter_t *rdsiter = NULL;
@@ -1684,14 +1690,21 @@ remove_sigs(dns_dbnode_t *node, dns_rdatatype_t which) {
 		covers = rdataset.covers;
 		dns_rdataset_disassociate(&rdataset);
 
-		if (type == dns_rdatatype_rrsig &&
-		    (covers == which || which == 0))
-		{
-			result = dns_db_deleterdataset(gdb, node, gversion,
-						       type, covers);
-			check_result(result, "dns_db_deleterdataset()");
+		if (type != dns_rdatatype_rrsig)
 			continue;
-		}
+
+		if (which == 0 && delegation &&
+		    (dns_rdatatype_atparent(covers) ||
+		     (nsec_datatype == dns_rdatatype_nsec &&
+		      covers == nsec_datatype)))
+			continue;
+
+		if (which != 0 && covers != which)
+			continue;
+
+		result = dns_db_deleterdataset(gdb, node, gversion,
+					       type, covers);
+		check_result(result, "dns_db_deleterdataset()");
 	}
 	dns_rdatasetiter_destroy(&rdsiter);
 }
@@ -1778,7 +1791,7 @@ nsecify(void) {
 		if (is_delegation(gdb, gversion, gorigin, name, node, &nsttl)) {
 			zonecut = dns_fixedname_name(&fzonecut);
 			dns_name_copy(name, zonecut, NULL);
-			remove_sigs(node, 0);
+			remove_sigs(node, ISC_TRUE, 0);
 			if (generateds)
 				add_ds(name, node, nsttl);
 		}
@@ -1800,7 +1813,7 @@ nsecify(void) {
 			    (zonecut != NULL &&
 			     dns_name_issubdomain(nextname, zonecut)))
 			{
-				remove_sigs(nextnode, 0);
+				remove_sigs(nextnode, ISC_FALSE, 0);
 				remove_records(nextnode, dns_rdatatype_nsec,
 					       ISC_FALSE);
 				dns_db_detachnode(gdb, &nextnode);
@@ -2240,7 +2253,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (!dns_name_issubdomain(nextname, gorigin) ||
 			    (zonecut != NULL &&
 			     dns_name_issubdomain(nextname, zonecut))) {
-				remove_sigs(nextnode, 0);
+				remove_sigs(nextnode, ISC_FALSE, 0);
 				dns_db_detachnode(gdb, &nextnode);
 				result = dns_dbiterator_next(dbiter);
 				continue;
@@ -2250,7 +2263,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			{
 				zonecut = dns_fixedname_name(&fzonecut);
 				dns_name_copy(nextname, zonecut, NULL);
-				remove_sigs(nextnode, 0);
+				remove_sigs(nextnode, ISC_TRUE, 0);
 				if (generateds)
 					add_ds(nextname, nextnode, nsttl);
 				if (OPTOUT(nsec3flags) &&

From 53f91cbd80dc353ecb7e8914dae84a6cd85c67c6 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Aug 2014 16:10:43 +1000
Subject: [PATCH 20/23] 3923.   [bug]           Sanity check the xml2-config
 output. [RT #22246]

---
 CHANGES      |  2 ++
 configure    | 24 ++++++++++++++++++++++--
 configure.in |  8 +++++++-
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/CHANGES b/CHANGES
index 35ca5d2f08..b6e7547040 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3923.	[bug]		Sanity check the xml2-config output. [RT #22246]
+
 3922.	[bug]		When resigning, dnssec-signzone was removing
 			all signatures from delegation nodes. It now
 			retains	DS and (if applicable) NSEC signatures.
diff --git a/configure b/configure
index 0abefed7e5..926962c506 100755
--- a/configure
+++ b/configure
@@ -16458,10 +16458,30 @@ esac
 
 if test "X$libxml2_libs" != "X"
 then
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
 	CFLAGS="$CFLAGS $libxml2_cflags"
 	LIBS="$LIBS $libxml2_libs"
+	#
+	# Sanity check xml2-config output.
+	#
+	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+#include <libxml/xmlwriter.h>
+int
+main ()
+{
+return(xmlTextWriterStartElement(NULL, NULL));
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  as_fn_error $? "xml2-config returns badness" "$LINENO" 5
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
 
 $as_echo "#define HAVE_LIBXML2 1" >>confdefs.h
 
diff --git a/configure.in b/configure.in
index 539d11e4e7..6c2580a89b 100644
--- a/configure.in
+++ b/configure.in
@@ -2085,9 +2085,15 @@ esac
 
 if test "X$libxml2_libs" != "X"
 then
-	AC_MSG_RESULT(yes)
 	CFLAGS="$CFLAGS $libxml2_cflags"
 	LIBS="$LIBS $libxml2_libs"
+	#
+	# Sanity check xml2-config output.
+	#
+	AC_TRY_LINK([#include <libxml/xmlwriter.h>],
+		    [return(xmlTextWriterStartElement(NULL, NULL));],
+		    AC_MSG_RESULT(yes),
+		    AC_MSG_ERROR(xml2-config returns badness))
 	AC_DEFINE(HAVE_LIBXML2, 1, [Define if libxml2 was found])
 else
 	AC_MSG_RESULT(no)

From d4859b0b2a0510d8c4f3c48c606a5568a3b0c1d8 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Aug 2014 16:18:49 +1000
Subject: [PATCH 21/23] 3924.   [bug]           Improve 'rndc addzone' error
 reporting. RT #35187

---
 CHANGES                          |   2 +
 bin/named/control.c              |   2 +-
 bin/named/include/named/server.h |   2 +-
 bin/named/server.c               | 100 +++++++++++++++++++++----------
 4 files changed, 72 insertions(+), 34 deletions(-)

diff --git a/CHANGES b/CHANGES
index b6e7547040..c2c2cc3ab1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3924.	[bug]		Improve 'rndc addzone' error reporting. RT #35187]
+
 3923.	[bug]		Sanity check the xml2-config output. [RT #22246]
 
 3922.	[bug]		When resigning, dnssec-signzone was removing
diff --git a/bin/named/control.c b/bin/named/control.c
index 7f49eb3c89..5def85fb5b 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -206,7 +206,7 @@ ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 		   command_compare(command, NS_COMMAND_LOADKEYS)) {
 		result = ns_server_rekey(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_ADDZONE)) {
-		result = ns_server_add_zone(ns_g_server, command);
+		result = ns_server_add_zone(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_DELZONE)) {
 		result = ns_server_del_zone(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_SIGNING)) {
diff --git a/bin/named/include/named/server.h b/bin/named/include/named/server.h
index 6cbaa9139d..e1d1db275b 100644
--- a/bin/named/include/named/server.h
+++ b/bin/named/include/named/server.h
@@ -372,7 +372,7 @@ ns_server_validation(ns_server_t *server, char *args, isc_buffer_t *text);
  * Add a zone to a running process
  */
 isc_result_t
-ns_server_add_zone(ns_server_t *server, char *args);
+ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text);
 
 /*%
  * Deletes a zone from a running process
diff --git a/bin/named/server.c b/bin/named/server.c
index 0f69be92c4..d0dfff9a4b 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -153,6 +153,14 @@
 	       if (result != ISC_R_SUCCESS) goto cleanup;	 \
 	} while (0)
 
+#define TCHECK(op) \
+	do { tresult = (op);					 \
+		if (tresult != ISC_R_SUCCESS) {			 \
+			isc_buffer_clear(text);			 \
+			goto cleanup;	 			 \
+		}						 \
+	} while (0)
+
 #define CHECKM(op, msg) \
 	do { result = (op);					  \
 	       if (result != ISC_R_SUCCESS) {			  \
@@ -413,6 +421,9 @@ newzone_cfgctx_destroy(void **cfgp);
 static isc_result_t
 putstr(isc_buffer_t *b, const char *str);
 
+static isc_result_t
+putnull(isc_buffer_t *b);
+
 isc_result_t
 add_comment(FILE *fp, const char *viewname);
 
@@ -7182,9 +7193,8 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 		isc_result_t tresult;
 
 		tresult = putstr(text, problem);
-		if (tresult == ISC_R_SUCCESS &&
-		    isc_buffer_availablelength(text) > 0U)
-			isc_buffer_putuint8(text, 0);
+		if (tresult == ISC_R_SUCCESS)
+			putnull(text);
 	}
 
  cleanup:
@@ -8837,8 +8847,8 @@ add_comment(FILE *fp, const char *viewname) {
  * Act on an "addzone" command from the command channel.
  */
 isc_result_t
-ns_server_add_zone(ns_server_t *server, char *args) {
-	isc_result_t	     result;
+ns_server_add_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
+	isc_result_t	     result, tresult;
 	isc_buffer_t	     argbuf;
 	size_t		     arglen;
 	cfg_parser_t	    *parser = NULL;
@@ -8853,7 +8863,7 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	const char	    *argp;
 	const char	    *viewname = NULL;
 	dns_rdataclass_t     rdclass;
-	dns_view_t	    *view = 0;
+	dns_view_t	    *view = NULL;
 	isc_buffer_t	     buf;
 	dns_fixedname_t	     fname;
 	dns_name_t	    *dnsname;
@@ -8934,7 +8944,14 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	}
 
 	/* Open save file for write configuration */
-	CHECK(isc_stdio_open(view->new_zone_file, "a", &fp));
+	result = isc_stdio_open(view->new_zone_file, "a", &fp);
+	if (result != ISC_R_SUCCESS) {
+		TCHECK(putstr(text, "unable to open '"));
+		TCHECK(putstr(text, view->new_zone_file));
+		TCHECK(putstr(text, "': "));
+		TCHECK(putstr(text, isc_result_totext(result)));
+		goto cleanup;
+	}
 	CHECK(isc_stdio_tell(fp, &offset));
 	if (offset == 0)
 		CHECK(add_comment(fp, view->name));
@@ -8948,8 +8965,11 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 				ISC_FALSE, ISC_FALSE);
 	dns_view_freeze(view);
 	isc_task_endexclusive(server->task);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		TCHECK(putstr(text, "configure_zone failed: "));
+		TCHECK(putstr(text, isc_result_totext(result)));
 		goto cleanup;
+	}
 
 	/* Is it there yet? */
 	CHECK(dns_zt_find(view->zonetable, dnsname, 0, NULL, &zone));
@@ -8962,6 +8982,9 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;
 
+		TCHECK(putstr(text, "dns_zone_loadnew failed: "));
+		TCHECK(putstr(text, isc_result_totext(result)));
+
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
 			      NS_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "addzone failed; reverting.");
@@ -8983,7 +9006,7 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	/* Emit the zone name, quoted and escaped */
 	isc_buffer_init(&buf, namebuf, sizeof(namebuf));
 	CHECK(dns_name_totext(dnsname, ISC_TRUE, &buf));
-	isc_buffer_putuint8(&buf, 0);
+	putnull(&buf);
 	CHECK(isc_stdio_write("zone \"", 6, 1, fp, NULL));
 	CHECK(isc_stdio_write(namebuf, strlen(namebuf), 1, fp, NULL));
 	CHECK(isc_stdio_write("\" ", 2, 1, fp, NULL));
@@ -9022,6 +9045,8 @@ ns_server_add_zone(ns_server_t *server, char *args) {
 	result = ISC_R_SUCCESS;
 
  cleanup:
+	if (isc_buffer_usedlength(text) > 0)
+		putnull(text);
 	if (fp != NULL)
 		isc_stdio_close(fp);
 	if (parser != NULL) {
@@ -9046,10 +9071,10 @@ inuse(const char* file, isc_boolean_t first, isc_buffer_t *text) {
 	    strlen(file) + (first ? sizeof(INUSEMSG) : sizeof("\n")))
 	{
 		if (first)
-			isc_buffer_putstr(text, INUSEMSG);
+			putstr(text, INUSEMSG);
 		else
-			isc_buffer_putstr(text, "\n");
-		isc_buffer_putstr(text, file);
+			putstr(text, "\n");
+		putstr(text, file);
 		return (ISC_FALSE);
 	}
 	return (first);
@@ -9229,6 +9254,8 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 	dns_zone_getraw(zone, &raw);
 	mayberaw = (raw != NULL) ? raw : zone;
 	if (cleanup) {
+		isc_result_t tresult;
+
 		file = dns_zone_getfile(mayberaw);
 		if (isc_file_exists(file))
 			isc_file_remove(file);
@@ -9246,10 +9273,10 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 			if (isc_file_exists(file))
 				isc_file_remove(file);
 		}
-		isc_buffer_putstr(text, "zone ");
-		isc_buffer_putstr(text, zonename);
-		isc_buffer_putstr(text, " and associated files deleted");
-		isc_buffer_putuint8(text, 0);
+		TCHECK(putstr(text, "zone "));
+		TCHECK(putstr(text, zonename));
+		TCHECK(putstr(text, " and associated files deleted"));
+		TCHECK(putnull(text));
 	} else if (dns_zone_gettype(mayberaw) == dns_zone_slave ||
 		   dns_zone_gettype(mayberaw) == dns_zone_stub)
 	{
@@ -9268,8 +9295,7 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 			file = dns_zone_getjournal(zone);
 			(void)inuse(file, first, text);
 		}
-		if (isc_buffer_availablelength(text) > 0)
-			isc_buffer_putuint8(text, 0);
+		putnull(text);
 	}
 
 	CHECK(dns_zt_unmount(view->zonetable, zone));
@@ -9284,6 +9310,8 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 	result = ISC_R_SUCCESS;
 
  cleanup:
+	if (isc_buffer_usedlength(text) > 0)
+		putnull(text);
 	if (exclusive)
 		isc_task_endexclusive(server->task);
 	if (ifp != NULL)
@@ -9462,15 +9490,15 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 
 	if (clear) {
 		CHECK(dns_zone_keydone(zone, keystr));
-		isc_buffer_putstr(text, "request queued");
-		isc_buffer_putuint8(text, 0);
+		putstr(text, "request queued");
+		putnull(text);
 	} else if (chain) {
 		CHECK(dns_zone_setnsec3param(zone, (isc_uint8_t)hash,
 					     (isc_uint8_t)flags, iter,
 					     (isc_uint8_t)saltlen, salt,
 					     ISC_TRUE));
-		isc_buffer_putstr(text, "request queued");
-		isc_buffer_putuint8(text, 0);
+		putstr(text, "request queued");
+		putnull(text);
 	} else if (list) {
 		privatetype = dns_zone_getprivatetype(zone);
 		origin = dns_zone_getorigin(zone);
@@ -9482,8 +9510,8 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 					     dns_rdatatype_none, 0,
 					     &privset, NULL);
 		if (result == ISC_R_NOTFOUND) {
-			isc_buffer_putstr(text, "No signing records found");
-			isc_buffer_putuint8(text, 0);
+			putstr(text, "No signing records found");
+			putnull(text);
 			result = ISC_R_SUCCESS;
 			goto cleanup;
 		}
@@ -9502,7 +9530,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 			CHECK(dns_private_totext(&priv, &buf));
 
 			if (!first)
-				isc_buffer_putstr(text, "\n");
+				putstr(text, "\n");
 			first = ISC_FALSE;
 
 			n = snprintf((char *)isc_buffer_used(text),
@@ -9513,8 +9541,8 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) {
 
 			isc_buffer_add(text, (unsigned int)n);
 		}
-		if (!first && isc_buffer_availablelength(text) > 0)
-			isc_buffer_putuint8(text, 0);
+		if (!first)
+			putnull(text);
 
 		if (result == ISC_R_NOMORE)
 			result = ISC_R_SUCCESS;
@@ -9549,6 +9577,15 @@ putstr(isc_buffer_t *b, const char *str) {
 	return (ISC_R_SUCCESS);
 }
 
+static isc_result_t
+putnull(isc_buffer_t *b) {
+	if (isc_buffer_availablelength(b) == 0)
+		return (ISC_R_NOSPACE);
+
+	isc_buffer_putuint8(b, 0);
+	return (ISC_R_SUCCESS);
+}
+
 isc_result_t
 ns_server_zonestatus(ns_server_t *server, char *args, isc_buffer_t *text) {
 	isc_result_t result = ISC_R_SUCCESS;
@@ -9781,11 +9818,10 @@ ns_server_zonestatus(ns_server_t *server, char *args, isc_buffer_t *text) {
 
  cleanup:
 	/* Indicate truncated output if possible. */
-	if (result == ISC_R_NOSPACE && isc_buffer_availablelength(text) > 4U)
-		isc_buffer_putstr(text, "\n...");
-	if ((result == ISC_R_SUCCESS || result == ISC_R_NOSPACE) &&
-	    isc_buffer_availablelength(text) > 0)
-		isc_buffer_putuint8(text, 0);
+	if (result == ISC_R_NOSPACE)
+		putstr(text, "\n...");
+	if ((result == ISC_R_SUCCESS || result == ISC_R_NOSPACE))
+		putnull(text);
 
 	if (db != NULL)
 		dns_db_detach(&db);

From 251be6e99493754700f868e0021c48b82d1c670c Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Aug 2014 16:29:03 +1000
Subject: [PATCH 22/23] add [

---
 CHANGES | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index c2c2cc3ab1..f17a470e93 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,4 @@
-3924.	[bug]		Improve 'rndc addzone' error reporting. RT #35187]
+3924.	[bug]		Improve 'rndc addzone' error reporting. [RT #35187]
 
 3923.	[bug]		Sanity check the xml2-config output. [RT #22246]
 

From 840d6a4614f6a561fc076d0797d144e9f28e06bc Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 22 Aug 2014 16:32:19 +1000
Subject: [PATCH 23/23] 3925.   [bug]           DS lookup of RFC 1918 empty
 zones failed. [RT #36917

---
 CHANGES                                        |  2 ++
 bin/tests/system/dnssec/clean.sh               |  1 +
 bin/tests/system/dnssec/ns1/root.db.in         |  1 +
 bin/tests/system/dnssec/ns1/sign.sh            |  2 ++
 bin/tests/system/dnssec/ns2/in-addr.arpa.db.in |  8 ++++++++
 bin/tests/system/dnssec/ns2/named.conf         |  5 +++++
 bin/tests/system/dnssec/ns2/sign.sh            | 12 ++++++++++++
 bin/tests/system/dnssec/tests.sh               | 10 ++++++++++
 lib/dns/view.c                                 | 10 +++++++---
 9 files changed, 48 insertions(+), 3 deletions(-)
 create mode 100644 bin/tests/system/dnssec/ns2/in-addr.arpa.db.in

diff --git a/CHANGES b/CHANGES
index f17a470e93..518332d120 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3925.	[bug]		DS lookup of RFC 1918 empty zones failed. [RT #36917]
+
 3924.	[bug]		Improve 'rndc addzone' error reporting. [RT #35187]
 
 3923.	[bug]		Sanity check the xml2-config output. [RT #22246]
diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index c83e4fd56c..2e20d835d4 100644
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -27,6 +27,7 @@ rm -f ns2/private.secure.example.db
 rm -f ns2/badparam.db ns2/badparam.db.bad
 rm -f ns2/single-nsec3.db
 rm -f ns2/nsec3chain-test.db
+rm -f ns2/in-addr.arpa.db
 rm -f */example.bk
 rm -f dig.out.*
 rm -f rndc.out.*
diff --git a/bin/tests/system/dnssec/ns1/root.db.in b/bin/tests/system/dnssec/ns1/root.db.in
index a00b69f409..6efbef1674 100644
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -34,3 +34,4 @@ algroll			NS	ns2.algroll
 ns2.algroll.		A	10.53.0.2
 optout-tld		NS	ns6.optout-tld.
 ns6.optout-tld.		A	10.53.0.6
+in-addr.arpa.		NS	ns2.example.
diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index 88e6e87181..8e9005b803 100644
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -28,6 +28,8 @@ zonefile=root.db
 
 cp ../ns2/dsset-example. .
 cp ../ns2/dsset-dlv. .
+cp ../ns2/dsset-in-addr.arpa. .
+
 grep "8 [12] " ../ns2/dsset-algroll. > dsset-algroll.
 cp ../ns6/dsset-optout-tld. .
 
diff --git a/bin/tests/system/dnssec/ns2/in-addr.arpa.db.in b/bin/tests/system/dnssec/ns2/in-addr.arpa.db.in
new file mode 100644
index 0000000000..d60b717ef1
--- /dev/null
+++ b/bin/tests/system/dnssec/ns2/in-addr.arpa.db.in
@@ -0,0 +1,8 @@
+$TTL 3600
+@	SOA	ns2.example. . 1 3600 1200 86400 1200
+@	NS	ns2.example.
+;
+;	As we are testing empty zone behaviour ns3 doesn't need to be
+;	configured to serve 10.in-addr.arpa.
+;
+10	NS	ns3.example.
diff --git a/bin/tests/system/dnssec/ns2/named.conf b/bin/tests/system/dnssec/ns2/named.conf
index 40a71503af..a6f9aafca4 100644
--- a/bin/tests/system/dnssec/ns2/named.conf
+++ b/bin/tests/system/dnssec/ns2/named.conf
@@ -102,4 +102,9 @@ zone "nsec3chain-test" {
 	allow-update {any;};
 };
 
+zone "in-addr.arpa" {
+	type master;
+	file "in-addr.arpa.db.signed";
+};
+
 include "trusted.conf";
diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index f302d79b00..1a4c73221e 100644
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -87,6 +87,18 @@ tolower($1) == "bad-dname.example." && $4 == "RRSIG" && $5 == "DNAME" {
 
 { print; }' > $zonefile.signed++ && mv $zonefile.signed++ $zonefile.signed
 
+#
+# signed in-addr.arpa w/ a delegation for 10.in-addr.arpa which is unsigned.
+#
+zone=in-addr.arpa.
+infile=in-addr.arpa.db.in
+zonefile=in-addr.arpa.db
+
+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
+
+cat $infile $keyname1.key $keyname2.key >$zonefile
+$SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
 
 # Sign the privately secure file
 
diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index b719d4487c..bd742663af 100644
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -1854,6 +1854,16 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking that DS at a RFC 1918 empty zone lookup succeeds ($n)"
+ret=0
+$DIG $DIGOPTS +noauth 10.in-addr.arpa ds @10.53.0.2 >dig.out.ns2.test$n || ret=1
+$DIG $DIGOPTS +noauth 10.in-addr.arpa ds @10.53.0.6 >dig.out.ns6.test$n || ret=1
+$PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns6.test$n || ret=1
+grep "status: NOERROR" dig.out.ns6.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:checking expired signatures remain with "'"allow-update { none; };"'" and no keys available ($n)"
 ret=0
 $DIG $DIGOPTS +noauth expired.example. +dnssec @10.53.0.3 soa > dig.out.ns3.test$n || ret=1
diff --git a/lib/dns/view.c b/lib/dns/view.c
index d16e3bd62b..7f41b31e07 100644
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1207,6 +1207,7 @@ dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 	dns_name_t *zfname;
 	dns_rdataset_t zrdataset, zsigrdataset;
 	dns_fixedname_t zfixedname;
+	unsigned int ztoptions = 0;
 
 	REQUIRE(DNS_VIEW_VALID(view));
 	REQUIRE(view->frozen);
@@ -1228,9 +1229,12 @@ dns_view_findzonecut2(dns_view_t *view, dns_name_t *name, dns_name_t *fname,
 	 */
 	zone = NULL;
 	LOCK(&view->lock);
-	if (view->zonetable != NULL)
-		result = dns_zt_find(view->zonetable, name, 0, NULL, &zone);
-	else
+	if (view->zonetable != NULL) {
+		if ((options & DNS_DBFIND_NOEXACT) != 0)
+			ztoptions |= DNS_ZTFIND_NOEXACT;
+		result = dns_zt_find(view->zonetable, name, ztoptions,
+				     NULL, &zone);
+	} else
 		result = ISC_R_NOTFOUND;
 	UNLOCK(&view->lock);
 	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH)