external/bsd/bind/dist/lib/dns/nsec3.c
author martin <martin@NetBSD.org>
Sun, 13 Mar 2016 08:00:24 +0000
branchnetbsd-7-0
changeset 275887 e6987d6aadcd
parent 254459 55ed515db7df
child 275950 be734cd1f4d8
permissions -rw-r--r--
Pull up following revision(s) (requested by snj in ticket #1140): distrib/sets/lists/base/ad.aarch64: patch distrib/sets/lists/base/ad.arm: patch distrib/sets/lists/base/ad.mips: patch distrib/sets/lists/base/ad.powerpc: patch distrib/sets/lists/base/md.amd64: patch distrib/sets/lists/base/md.sparc64: patch distrib/sets/lists/base/shl.mi: patch distrib/sets/lists/debug/ad.aarch64: patch distrib/sets/lists/debug/ad.arm: patch distrib/sets/lists/debug/ad.mips: patch distrib/sets/lists/debug/ad.powerpc: patch distrib/sets/lists/debug/md.amd64: patch distrib/sets/lists/debug/md.sparc64: patch distrib/sets/lists/debug/shl.mi: patch doc/3RDPARTY: patch external/bsd/bind/bind2netbsd: up to 1.3 external/bsd/bind/dist/CHANGES: up to 1.20 external/bsd/bind/dist/COPYRIGHT: up to 1.1.1.10 external/bsd/bind/dist/README: up to 1.8 external/bsd/bind/dist/bin/check/check-tool.c: up to 1.8 external/bsd/bind/dist/bin/check/named-checkconf.c: up to 1.12 external/bsd/bind/dist/bin/check/named-checkzone.c: up to 1.8 external/bsd/bind/dist/bin/confgen/keygen.c: up to 1.7 external/bsd/bind/dist/bin/confgen/util.c: up to 1.5 external/bsd/bind/dist/bin/dig/dig.1: up to 1.11 external/bsd/bind/dist/bin/dig/dig.c: up to 1.11 external/bsd/bind/dist/bin/dig/dig.docbook: up to 1.1.1.12 external/bsd/bind/dist/bin/dig/dig.html: up to 1.1.1.12 external/bsd/bind/dist/bin/dig/dighost.c: up to 1.17 external/bsd/bind/dist/bin/dig/include/dig/dig.h: up to 1.12 external/bsd/bind/dist/bin/dig/nslookup.c: up to 1.12 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8: up to 1.8 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c: up to 1.12 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.docbook: up to 1.1.1.9 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.html: up to 1.1.1.10 external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c: up to 1.17 external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c: up to 1.9 external/bsd/bind/dist/bin/dnssec/dnssec-settime.c: up to 1.13 external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c: up to 1.16 external/bsd/bind/dist/bin/named/bind9.xsl: up to 1.1.1.8 external/bsd/bind/dist/bin/named/bind9.xsl.h: up to 1.9 external/bsd/bind/dist/bin/named/client.c: up to 1.15 external/bsd/bind/dist/bin/named/config.c: up to 1.12 external/bsd/bind/dist/bin/named/control.c: up to 1.10 external/bsd/bind/dist/bin/named/controlconf.c: up to 1.11 external/bsd/bind/dist/bin/named/include/named/lwdclient.h: up to 1.5 external/bsd/bind/dist/bin/named/include/named/main.h: up to 1.6 external/bsd/bind/dist/bin/named/include/named/server.h: up to 1.10 external/bsd/bind/dist/bin/named/interfacemgr.c: up to 1.11 external/bsd/bind/dist/bin/named/logconf.c: up to 1.8 external/bsd/bind/dist/bin/named/lwdclient.c: up to 1.5 external/bsd/bind/dist/bin/named/lwresd.c: up to 1.7 external/bsd/bind/dist/bin/named/main.c: up to 1.19 external/bsd/bind/dist/bin/named/named.8: up to 1.8 external/bsd/bind/dist/bin/named/named.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/named/named.html: up to 1.1.1.9 external/bsd/bind/dist/bin/named/query.c: up to 1.21 external/bsd/bind/dist/bin/named/server.c: up to 1.20 external/bsd/bind/dist/bin/named/statschannel.c: up to 1.11 external/bsd/bind/dist/bin/named/update.c: up to 1.12 external/bsd/bind/dist/bin/named/win32/named.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/named.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/named.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/ntservice.c: up to 1.7 external/bsd/bind/dist/bin/named/win32/os.c: up to 1.9 external/bsd/bind/dist/bin/named/xfrout.c: up to 1.10 external/bsd/bind/dist/bin/nsupdate/nsupdate.1: up to 1.7 external/bsd/bind/dist/bin/nsupdate/nsupdate.c: up to 1.14 external/bsd/bind/dist/bin/nsupdate/nsupdate.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/nsupdate/nsupdate.html: up to 1.1.1.10 external/bsd/bind/dist/bin/pkcs11/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8zc-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8ze-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0o-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0q-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1j-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1l-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-list.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.c: up to 1.1.1.5 external/bsd/bind/dist/bin/python/dnssec-coverage.py.in: up to 1.1.1.6 external/bsd/bind/dist/bin/rndc/rndc.8: up to 1.8 external/bsd/bind/dist/bin/rndc/rndc.c: up to 1.14 external/bsd/bind/dist/bin/rndc/rndc.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/rndc/rndc.html: up to 1.1.1.9 external/bsd/bind/dist/bin/rndc/util.c: up to 1.5 external/bsd/bind/dist/bin/tests/Makefile.in: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/adb_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/backtrace_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/byaddr_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/byname_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/cfg_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/compress_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/db/t_db.c: up to 1.8 external/bsd/bind/dist/bin/tests/db_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/dst/dst_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/entropy2_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/entropy_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/fromhex.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/fsaccess_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/gxba_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/gxbn_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/hash_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/inter_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/keyboard_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lex_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lfsr_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/log_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lwres_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lwresconf_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/makejournal.c: up to 1.4 external/bsd/bind/dist/bin/tests/master_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/name_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/names/t_names.c: up to 1.10 external/bsd/bind/dist/bin/tests/net/driver.c: up to 1.7 external/bsd/bind/dist/bin/tests/net/netaddr_multicast.c: up to 1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/find.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/genrsa.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/login.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/random.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/session.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sha1.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sign.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/verify.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-hmacmd5.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-md5sum.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/printmsg.c: delete external/bsd/bind/dist/bin/tests/printmsg.h: delete external/bsd/bind/dist/bin/tests/ratelimiter_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/rbt/t_rbt.c: up to 1.8 external/bsd/bind/dist/bin/tests/rbt_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/rdata_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/serial_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/sig0_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/sock_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/sym_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/README: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/addzone/tests.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/builtin/Makefile.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/builtin/gethostname.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/builtin/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/checkconf/good-class.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-caa-rr.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-empty.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-unspec.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-gc-msdcs.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-nsap.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/cleanall.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/conf.sh.in: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/ditch.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dlzexternal/driver.c: up to 1.4 external/bsd/bind/dist/bin/tests/system/dnssec/clean.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-update.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/named.conf: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/sign.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/dnssec/prereq.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/dnssec/tests.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/ednscompliance/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/root.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ans4/ans.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/fetchlimit.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/root.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/example.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named.args: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named1.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named2.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named3.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/root.hint: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/setup.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/filter-aaaa/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/inline/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/inline/ns3/named.conf: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/lwresd/lwtest.c: up to 1.8 external/bsd/bind/dist/bin/tests/system/masterfile/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/masterfile/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.good: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/masterfile/zone/nameservers.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/nsupdate/prereq.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/nsupdate/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/reclimit/ans2/ans.pl: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/reclimit/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/reclimit/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/resolver/ns4/named.conf: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/resolver/ns6/named.conf: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/resolver/tests.sh: up to 1.1.1.13 external/bsd/bind/dist/bin/tests/system/rndc/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/named.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test1.example.net.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test2.example.net.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard1: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2a: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2b: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard3: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/rrsetorder/ns4/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rrsetorder/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/rsabigexponent/Makefile.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/rsabigexponent/bigkey.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/sit/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/start.pl: up to 1.1.1.13 external/bsd/bind/dist/bin/tests/system/staticstub/clean.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/staticstub/ns2/named.conf.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/named.conf.in: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/sign.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/undelegated.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/staticstub/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/statistics/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statistics/clean.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/ns1/named.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/ns1/zone.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statistics/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/xmlstats.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/fetch.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/ns2/example.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/ns2/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/server-json.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/server-xml.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/stress/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/stress/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/tkey/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/tkey/keycreate.c: up to 1.8 external/bsd/bind/dist/bin/tests/system/tkey/keydelete.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/views/ns2/1.10.in-addr.arpa.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/views/ns2/named2.conf: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/xfer/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/zonechecks/bigserial.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/zonechecks/ns1/named.conf: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/zonechecks/setup.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/zonechecks/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/task_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/tasks/t_tasks.c: up to 1.8 external/bsd/bind/dist/bin/tests/timer_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/wire_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/zone_test.c: up to 1.9 external/bsd/bind/dist/bin/tools/arpaname.c: up to 1.5 external/bsd/bind/dist/bin/tools/isc-hmac-fixup.c: up to 1.8 external/bsd/bind/dist/bin/tools/named-journalprint.c: up to 1.7 external/bsd/bind/dist/bin/tools/named-rrchecker.c: up to 1.1.1.4 external/bsd/bind/dist/bin/win32/BINDInstall/BINDInstallDlg.cpp: up to 1.1.1.10 external/bsd/bind/dist/bin/win32/BINDInstall/VersionInfo.cpp: up to 1.1.1.2 external/bsd/bind/dist/config.h.in: up to 1.12 external/bsd/bind/dist/config.h.win32: up to 1.1.1.12 external/bsd/bind/dist/configure: up to 1.5 external/bsd/bind/dist/configure.in: up to 1.8 external/bsd/bind/dist/contrib/README: up to 1.1.1.3 external/bsd/bind/dist/contrib/scripts/dnssec-keyset.sh: up to 1.1.1.1 external/bsd/bind/dist/doc/arm/Bv9ARM-book.xml: up to 1.1.1.19 external/bsd/bind/dist/doc/arm/Bv9ARM.ch01.html: up to 1.1.1.18 external/bsd/bind/dist/doc/arm/Bv9ARM.ch02.html: up to 1.1.1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch03.html: up to 1.1.1.20 external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch05.html: up to 1.1.1.21 external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch10.html: up to 1.1.1.17 external/bsd/bind/dist/doc/arm/Bv9ARM.ch11.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.ch12.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.ch13.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.pdf: up to 1.14 external/bsd/bind/dist/doc/arm/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/doc/arm/html-fixup.pl: up to 1.1.1.1 external/bsd/bind/dist/doc/arm/latex-fixup.pl: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/man.arpaname.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.ddns-confgen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.delv.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dig.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-settime.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-verify.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.genrandom.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.host.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-checkconf.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-checkzone.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-journalprint.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-rrchecker.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.nsec3hash.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.nsupdate.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc-confgen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc.conf.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc.html: up to 1.8 external/bsd/bind/dist/doc/arm/notes.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/notes.pdf: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/notes.xml: up to 1.1.1.6 external/bsd/bind/dist/doc/misc/rfc-compliance: up to 1.1.1.4 external/bsd/bind/dist/isc-config.sh.in: up to 1.1.1.6 external/bsd/bind/dist/lib/bind9/api: up to 1.1.1.17 external/bsd/bind/dist/lib/bind9/check.c: up to 1.13 external/bsd/bind/dist/lib/dns/adb.c: up to 1.12 external/bsd/bind/dist/lib/dns/api: up to 1.8 external/bsd/bind/dist/lib/dns/cache.c: up to 1.9 external/bsd/bind/dist/lib/dns/callbacks.c: up to 1.6 external/bsd/bind/dist/lib/dns/client.c: up to 1.11 external/bsd/bind/dist/lib/dns/diff.c: up to 1.10 external/bsd/bind/dist/lib/dns/dispatch.c: up to 1.11 external/bsd/bind/dist/lib/dns/dlz.c: up to 1.8 external/bsd/bind/dist/lib/dns/dnssec.c: up to 1.12 external/bsd/bind/dist/lib/dns/dst_api.c: up to 1.12 external/bsd/bind/dist/lib/dns/dst_openssl.h: up to 1.8 external/bsd/bind/dist/lib/dns/dst_parse.c: up to 1.9 external/bsd/bind/dist/lib/dns/geoip.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/gssapi_link.c: up to 1.9 external/bsd/bind/dist/lib/dns/gssapictx.c: up to 1.9 external/bsd/bind/dist/lib/dns/hmac_link.c: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/adb.h: up to 1.7 external/bsd/bind/dist/lib/dns/include/dns/log.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/message.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/name.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/resolver.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/result.h: up to 1.7 external/bsd/bind/dist/lib/dns/include/dns/rrl.h: up to 1.4 external/bsd/bind/dist/lib/dns/include/dns/stats.h: up to 1.8 external/bsd/bind/dist/lib/dns/include/dns/types.h: up to 1.8 external/bsd/bind/dist/lib/dns/include/dns/update.h: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/include/dns/zone.h: up to 1.17 external/bsd/bind/dist/lib/dns/include/dst/dst.h: up to 1.11 external/bsd/bind/dist/lib/dns/journal.c: up to 1.10 external/bsd/bind/dist/lib/dns/keytable.c: up to 1.11 external/bsd/bind/dist/lib/dns/log.c: up to 1.9 external/bsd/bind/dist/lib/dns/master.c: up to 1.15 external/bsd/bind/dist/lib/dns/message.c: up to 1.18 external/bsd/bind/dist/lib/dns/name.c: up to 1.12 external/bsd/bind/dist/lib/dns/ncache.c: up to 1.11 external/bsd/bind/dist/lib/dns/nsec.c: up to 1.10 external/bsd/bind/dist/lib/dns/nsec3.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssl_link.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssldh_link.c: up to 1.10 external/bsd/bind/dist/lib/dns/openssldsa_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/opensslecdsa_link.c: up to 1.10 external/bsd/bind/dist/lib/dns/opensslgost_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/opensslrsa_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/order.c: up to 1.5 external/bsd/bind/dist/lib/dns/pkcs11dh_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11dsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11ecdsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11gost_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11rsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/private.c: up to 1.8 external/bsd/bind/dist/lib/dns/rbt.c: up to 1.11 external/bsd/bind/dist/lib/dns/rbtdb.c: up to 1.21 external/bsd/bind/dist/lib/dns/rcode.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata.c: up to 1.13 external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/ch_3/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/afsdb_18.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/caa_257.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/rdata/generic/cdnskey_60.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/cds_59.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/cname_5.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/dname_39.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/eui48_108.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/eui64_109.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/gpos_27.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/hinfo_13.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/hip_55.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/isdn_20.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/l32_105.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/l64_106.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/loc_29.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/lp_107.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/rdata/generic/mb_7.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/md_3.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mf_4.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mg_8.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/minfo_14.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mr_9.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mx_15.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/naptr_35.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/rdata/generic/nid_104.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/ns_2.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/nsec3param_51.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nsec_47.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/null_10.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nxt_30.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/openpgpkey_61.c: up to 1.1.1.3 external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/proforma.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/ptr_12.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/rp_17.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/rt_21.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/spf_99.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/tlsa_52.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/txt_16.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/unspec_103.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/uri_256.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/rdata/generic/x25_19.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/hs_4/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/a6_38.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/aaaa_28.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/apl_42.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/kx_36.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/nsap_22.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/px_26.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/srv_33.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/wks_11.c: up to 1.7 external/bsd/bind/dist/lib/dns/request.c: up to 1.10 external/bsd/bind/dist/lib/dns/resolver.c: up to 1.25 external/bsd/bind/dist/lib/dns/result.c: up to 1.7 external/bsd/bind/dist/lib/dns/rootns.c: up to 1.10 external/bsd/bind/dist/lib/dns/rpz.c: up to 1.10 external/bsd/bind/dist/lib/dns/rrl.c: up to 1.5 external/bsd/bind/dist/lib/dns/sdb.c: up to 1.10 external/bsd/bind/dist/lib/dns/sdlz.c: up to 1.10 external/bsd/bind/dist/lib/dns/spnego.c: up to 1.9 external/bsd/bind/dist/lib/dns/tcpmsg.c: up to 1.5 external/bsd/bind/dist/lib/dns/tests/geoip_test.c: up to 1.4 external/bsd/bind/dist/lib/dns/tests/gost_test.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/tests/master_test.c: up to 1.7 external/bsd/bind/dist/lib/dns/tests/rbt_serialize_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/tests/rbt_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/tests/rdatasetstats_test.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/tkey.c: up to 1.10 external/bsd/bind/dist/lib/dns/tsig.c: up to 1.9 external/bsd/bind/dist/lib/dns/update.c: up to 1.5 external/bsd/bind/dist/lib/dns/view.c: up to 1.11 external/bsd/bind/dist/lib/dns/win32/libdns.def.in: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/xfrin.c: up to 1.12 external/bsd/bind/dist/lib/dns/zone.c: up to 1.15 external/bsd/bind/dist/lib/irs/api: up to 1.1.1.9 external/bsd/bind/dist/lib/irs/getaddrinfo.c: up to 1.8 external/bsd/bind/dist/lib/isc/api: up to 1.1.1.19 external/bsd/bind/dist/lib/isc/app_api.c: up to 1.8 external/bsd/bind/dist/lib/isc/assertions.c: up to 1.7 external/bsd/bind/dist/lib/isc/backtrace.c: up to 1.8 external/bsd/bind/dist/lib/isc/commandline.c: up to 1.6 external/bsd/bind/dist/lib/isc/entropy.c: up to 1.6 external/bsd/bind/dist/lib/isc/error.c: up to 1.5 external/bsd/bind/dist/lib/isc/heap.c: up to 1.8 external/bsd/bind/dist/lib/isc/hmacmd5.c: up to 1.9 external/bsd/bind/dist/lib/isc/hmacsha.c: up to 1.10 external/bsd/bind/dist/lib/isc/httpd.c: up to 1.9 external/bsd/bind/dist/lib/isc/include/isc/app.h: up to 1.9 external/bsd/bind/dist/lib/isc/include/isc/json.h: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/include/isc/mem.h: up to 1.14 external/bsd/bind/dist/lib/isc/include/isc/platform.h.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isc/include/isc/print.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/safe.h: up to 1.4 external/bsd/bind/dist/lib/isc/include/isc/util.h: up to 1.11 external/bsd/bind/dist/lib/isc/lex.c: up to 1.7 external/bsd/bind/dist/lib/isc/lib.c: up to 1.8 external/bsd/bind/dist/lib/isc/mem.c: up to 1.13 external/bsd/bind/dist/lib/isc/netaddr.c: up to 1.7 external/bsd/bind/dist/lib/isc/nothreads/include/isc/mutex.h: up to 1.5 external/bsd/bind/dist/lib/isc/pk11.c: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/pool.c: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/print.c: up to 1.6 external/bsd/bind/dist/lib/isc/pthreads/mutex.c: up to 1.7 external/bsd/bind/dist/lib/isc/regex.c: up to 1.4 external/bsd/bind/dist/lib/isc/rwlock.c: up to 1.9 external/bsd/bind/dist/lib/isc/safe.c: up to 1.4 external/bsd/bind/dist/lib/isc/socket_api.c: up to 1.11 external/bsd/bind/dist/lib/isc/stats.c: up to 1.6 external/bsd/bind/dist/lib/isc/task.c: up to 1.12 external/bsd/bind/dist/lib/isc/tests/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isc/tests/hash_test.c: up to 1.1.1.8 external/bsd/bind/dist/lib/isc/tests/mem_test.c: up to 1.1.1.2 external/bsd/bind/dist/lib/isc/tests/print_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/isc/tests/regex_test.c: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/tests/safe_test.c: up to 1.4 external/bsd/bind/dist/lib/isc/tests/socket_test.c: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/timer.c: up to 1.11 external/bsd/bind/dist/lib/isc/unix/app.c: up to 1.14 external/bsd/bind/dist/lib/isc/unix/file.c: up to 1.10 external/bsd/bind/dist/lib/isc/unix/ifiter_ioctl.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/ifiter_sysctl.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/include/isc/offset.h: up to 1.5 external/bsd/bind/dist/lib/isc/unix/net.c: up to 1.9 external/bsd/bind/dist/lib/isc/unix/socket.c: up to 1.18 external/bsd/bind/dist/lib/isc/win32/interfaceiter.c: up to 1.7 external/bsd/bind/dist/lib/isc/win32/libisc.def.exclude: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/win32/libisc.def.in: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/win32/libisc.vcxproj.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/win32/net.c: up to 1.9 external/bsd/bind/dist/lib/isc/win32/win32os.c: up to 1.7 external/bsd/bind/dist/lib/isccc/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isccc/alist.c: up to 1.5 external/bsd/bind/dist/lib/isccc/api: up to 1.1.1.11 external/bsd/bind/dist/lib/isccc/cc.c: up to 1.10 external/bsd/bind/dist/lib/isccc/sexpr.c: up to 1.6 external/bsd/bind/dist/lib/isccfg/api: up to 1.1.1.17 external/bsd/bind/dist/lib/isccfg/include/isccfg/cfg.h: up to 1.7 external/bsd/bind/dist/lib/isccfg/include/isccfg/grammar.h: up to 1.6 external/bsd/bind/dist/lib/isccfg/namedconf.c: up to 1.12 external/bsd/bind/dist/lib/isccfg/parser.c: up to 1.10 external/bsd/bind/dist/lib/isccfg/win32/libisccfg.def: up to 1.1.1.8 external/bsd/bind/dist/lib/lwres/api: up to 1.1.1.14 external/bsd/bind/dist/lib/lwres/herror.c: up to 1.7 external/bsd/bind/dist/lib/lwres/print.c: up to 1.7 external/bsd/bind/dist/lib/lwres/win32/socket.c: up to 1.5 external/bsd/bind/dist/lib/samples/nsprobe.c: up to 1.1.1.6 external/bsd/bind/dist/lib/samples/resolve.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-async.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-gai.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-request.c: up to 1.1.1.6 external/bsd/bind/dist/lib/samples/sample-update.c: up to 1.1.1.6 external/bsd/bind/dist/srcid: up to 1.14 external/bsd/bind/dist/version: up to 1.18 external/bsd/bind/dist/win32utils/Configure: up to 1.1.1.5 external/bsd/bind/dist/win32utils/index.html: up to 1.1.1.7 external/bsd/bind/dist/win32utils/legacy/BuildSetup.bat.in: up to 1.1.1.5 external/bsd/bind/include/config.h: up to 1.18 external/bsd/bind/include/dns/enumclass.h: up to 1.8 external/bsd/bind/include/dns/enumtype.h: up to 1.11 external/bsd/bind/include/dns/rdatastruct.h: up to 1.11 external/bsd/bind/include/isc/platform.h: up to 1.21 external/bsd/bind/include/lwres/platform.h: up to 1.7 external/bsd/bind/lib/libbind9/shlib_version: up to 1.16 external/bsd/bind/lib/libdns/shlib_version: up to 1.18 external/bsd/bind/lib/libirs/shlib_version: up to 1.5 external/bsd/bind/lib/libisc/shlib_version: up to 1.18 external/bsd/bind/lib/libisccc/shlib_version: up to 1.16 external/bsd/bind/lib/libisccfg/shlib_version: up to 1.16 external/bsd/bind/lib/liblwres/shlib_version: up to 1.16 Update BIND to 9.10.3-P4.

/*	$NetBSD: nsec3.c,v 1.9.4.2.2.1 2016/03/13 08:00:35 martin Exp $	*/

/*
 * Copyright (C) 2006, 2008-2015  Internet Systems Consortium, Inc. ("ISC")
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 * PERFORMANCE OF THIS SOFTWARE.
 */

/* Id */

#include <config.h>

#include <isc/base32.h>
#include <isc/buffer.h>
#include <isc/hex.h>
#include <isc/iterated_hash.h>
#include <isc/log.h>
#include <isc/string.h>
#include <isc/util.h>
#include <isc/safe.h>

#include <dst/dst.h>

#include <dns/db.h>
#include <dns/zone.h>
#include <dns/compress.h>
#include <dns/dbiterator.h>
#include <dns/diff.h>
#include <dns/fixedname.h>
#include <dns/nsec.h>
#include <dns/nsec3.h>
#include <dns/rdata.h>
#include <dns/rdatalist.h>
#include <dns/rdataset.h>
#include <dns/rdatasetiter.h>
#include <dns/rdatastruct.h>
#include <dns/result.h>

#define CHECK(x) do { \
	result = (x); \
	if (result != ISC_R_SUCCESS) \
		goto failure; \
	} while (/*CONSTCOND*/0)

#define OPTOUT(x) (((x) & DNS_NSEC3FLAG_OPTOUT) != 0)
#define CREATE(x) (((x) & DNS_NSEC3FLAG_CREATE) != 0)
#define INITIAL(x) (((x) & DNS_NSEC3FLAG_INITIAL) != 0)
#define REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)

isc_result_t
dns_nsec3_buildrdata(dns_db_t *db, dns_dbversion_t *version,
		     dns_dbnode_t *node, unsigned int hashalg,
		     unsigned int flags, unsigned int iterations,
		     const unsigned char *salt, size_t salt_length,
		     const unsigned char *nexthash, size_t hash_length,
		     unsigned char *buffer, dns_rdata_t *rdata)
{
	isc_result_t result;
	dns_rdataset_t rdataset;
	isc_region_t r;
	unsigned int i;
	isc_boolean_t found;
	isc_boolean_t found_ns;
	isc_boolean_t need_rrsig;

	unsigned char *nsec_bits, *bm;
	unsigned int max_type;
	dns_rdatasetiter_t *rdsiter;
	unsigned char *p;

	REQUIRE(salt_length < 256U);
	REQUIRE(hash_length < 256U);
	REQUIRE(flags <= 0xffU);
	REQUIRE(hashalg <= 0xffU);
	REQUIRE(iterations <= 0xffffU);

	switch (hashalg) {
	case dns_hash_sha1:
		REQUIRE(hash_length == ISC_SHA1_DIGESTLENGTH);
		break;
	}

	memset(buffer, 0, DNS_NSEC3_BUFFERSIZE);

	p = buffer;

	*p++ = hashalg;
	*p++ = flags;

	*p++ = iterations >> 8;
	*p++ = iterations;

	*p++ = (unsigned char)salt_length;
	memmove(p, salt, salt_length);
	p += salt_length;

	*p++ = (unsigned char)hash_length;
	memmove(p, nexthash, hash_length);
	p += hash_length;

	r.length = (unsigned int)(p - buffer);
	r.base = buffer;

	/*
	 * Use the end of the space for a raw bitmap leaving enough
	 * space for the window identifiers and length octets.
	 */
	bm = r.base + r.length + 512;
	nsec_bits = r.base + r.length;
	max_type = 0;
	if (node == NULL)
		goto collapse_bitmap;
	dns_rdataset_init(&rdataset);
	rdsiter = NULL;
	result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
	if (result != ISC_R_SUCCESS)
		return (result);
	found = found_ns = need_rrsig = ISC_FALSE;
	for (result = dns_rdatasetiter_first(rdsiter);
	     result == ISC_R_SUCCESS;
	     result = dns_rdatasetiter_next(rdsiter))
	{
		dns_rdatasetiter_current(rdsiter, &rdataset);
		if (rdataset.type != dns_rdatatype_nsec &&
		    rdataset.type != dns_rdatatype_nsec3 &&
		    rdataset.type != dns_rdatatype_rrsig) {
			if (rdataset.type > max_type)
				max_type = rdataset.type;
			dns_nsec_setbit(bm, rdataset.type, 1);
			/*
			 * Work out if we need to set the RRSIG bit for
			 * this node.  We set the RRSIG bit if either of
			 * the following conditions are met:
			 * 1) We have a SOA or DS then we need to set
			 *    the RRSIG bit as both always will be signed.
			 * 2) We set the RRSIG bit if we don't have
			 *    a NS record but do have other data.
			 */
			if (rdataset.type == dns_rdatatype_soa ||
			    rdataset.type == dns_rdatatype_ds)
				need_rrsig = ISC_TRUE;
			else if (rdataset.type == dns_rdatatype_ns)
				found_ns = ISC_TRUE;
			else
				found = ISC_TRUE;
		}
		dns_rdataset_disassociate(&rdataset);
	}
	if ((found && !found_ns) || need_rrsig) {
		if (dns_rdatatype_rrsig > max_type)
			max_type = dns_rdatatype_rrsig;
		dns_nsec_setbit(bm, dns_rdatatype_rrsig, 1);
	}

	/*
	 * At zone cuts, deny the existence of glue in the parent zone.
	 */
	if (dns_nsec_isset(bm, dns_rdatatype_ns) &&
	    ! dns_nsec_isset(bm, dns_rdatatype_soa)) {
		for (i = 0; i <= max_type; i++) {
			if (dns_nsec_isset(bm, i) &&
			    ! dns_rdatatype_iszonecutauth((dns_rdatatype_t)i))
				dns_nsec_setbit(bm, i, 0);
		}
	}

	dns_rdatasetiter_destroy(&rdsiter);
	if (result != ISC_R_NOMORE)
		return (result);

 collapse_bitmap:
	nsec_bits += dns_nsec_compressbitmap(nsec_bits, bm, max_type);
	r.length = (unsigned int)(nsec_bits - r.base);
	INSIST(r.length <= DNS_NSEC3_BUFFERSIZE);
	dns_rdata_fromregion(rdata, dns_db_class(db), dns_rdatatype_nsec3, &r);

	return (ISC_R_SUCCESS);
}

isc_boolean_t
dns_nsec3_typepresent(dns_rdata_t *rdata, dns_rdatatype_t type) {
	dns_rdata_nsec3_t nsec3;
	isc_result_t result;
	isc_boolean_t present;
	unsigned int i, len, window;

	REQUIRE(rdata != NULL);
	REQUIRE(rdata->type == dns_rdatatype_nsec3);

	/* This should never fail */
	result = dns_rdata_tostruct(rdata, &nsec3, NULL);
	INSIST(result == ISC_R_SUCCESS);

	present = ISC_FALSE;
	for (i = 0; i < nsec3.len; i += len) {
		INSIST(i + 2 <= nsec3.len);
		window = nsec3.typebits[i];
		len = nsec3.typebits[i + 1];
		INSIST(len > 0 && len <= 32);
		i += 2;
		INSIST(i + len <= nsec3.len);
		if (window * 256 > type)
			break;
		if ((window + 1) * 256 <= type)
			continue;
		if (type < (window * 256) + len * 8)
			present = ISC_TF(dns_nsec_isset(&nsec3.typebits[i],
						   type % 256));
		break;
	}
	dns_rdata_freestruct(&nsec3);
	return (present);
}

isc_result_t
dns_nsec3_hashname(dns_fixedname_t *result,
		   unsigned char rethash[NSEC3_MAX_HASH_LENGTH],
		   size_t *hash_length, dns_name_t *name, dns_name_t *origin,
		   dns_hash_t hashalg, unsigned int iterations,
		   const unsigned char *salt, size_t saltlength)
{
	unsigned char hash[NSEC3_MAX_HASH_LENGTH];
	unsigned char nametext[DNS_NAME_FORMATSIZE];
	dns_fixedname_t fixed;
	dns_name_t *downcased;
	isc_buffer_t namebuffer;
	isc_region_t region;
	size_t len;

	if (rethash == NULL)
		rethash = hash;

	memset(rethash, 0, NSEC3_MAX_HASH_LENGTH);

	dns_fixedname_init(&fixed);
	downcased = dns_fixedname_name(&fixed);
	dns_name_downcase(name, downcased, NULL);

	/* hash the node name */
	len = isc_iterated_hash(rethash, hashalg, iterations,
				salt, (int)saltlength,
				downcased->ndata, downcased->length);
	if (len == 0U)
		return (DNS_R_BADALG);

	if (hash_length != NULL)
		*hash_length = len;

	/* convert the hash to base32hex non-padded */
	region.base = rethash;
	region.length = (unsigned int)len;
	isc_buffer_init(&namebuffer, nametext, sizeof nametext);
	isc_base32hexnp_totext(&region, 1, "", &namebuffer);

	/* convert the hex to a domain name */
	dns_fixedname_init(result);
	return (dns_name_fromtext(dns_fixedname_name(result), &namebuffer,
				  origin, 0, NULL));
}

unsigned int
dns_nsec3_hashlength(dns_hash_t hash) {

	switch (hash) {
	case dns_hash_sha1:
		return(ISC_SHA1_DIGESTLENGTH);
	}
	return (0);
}

isc_boolean_t
dns_nsec3_supportedhash(dns_hash_t hash) {
	switch (hash) {
	case dns_hash_sha1:
		return (ISC_TRUE);
	}
	return (ISC_FALSE);
}

/*%
 * Update a single RR in version 'ver' of 'db' and log the
 * update in 'diff'.
 *
 * Ensures:
 * \li  '*tuple' == NULL.  Either the tuple is freed, or its
 *      ownership has been transferred to the diff.
 */
static isc_result_t
do_one_tuple(dns_difftuple_t **tuple, dns_db_t *db, dns_dbversion_t *ver,
	     dns_diff_t *diff)
{
	dns_diff_t temp_diff;
	isc_result_t result;

	/*
	 * Create a singleton diff.
	 */
	dns_diff_init(diff->mctx, &temp_diff);
	ISC_LIST_APPEND(temp_diff.tuples, *tuple, link);

	/*
	 * Apply it to the database.
	 */
	result = dns_diff_apply(&temp_diff, db, ver);
	ISC_LIST_UNLINK(temp_diff.tuples, *tuple, link);
	if (result != ISC_R_SUCCESS) {
		dns_difftuple_free(tuple);
		return (result);
	}

	/*
	 * Merge it into the current pending journal entry.
	 */
	dns_diff_appendminimal(diff, tuple);

	/*
	 * Do not clear temp_diff.
	 */
	return (ISC_R_SUCCESS);
}

/*%
 * Set '*exists' to true iff the given name exists, to false otherwise.
 */
static isc_result_t
name_exists(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
	    isc_boolean_t *exists)
{
	isc_result_t result;
	dns_dbnode_t *node = NULL;
	dns_rdatasetiter_t *iter = NULL;

	result = dns_db_findnode(db, name, ISC_FALSE, &node);
	if (result == ISC_R_NOTFOUND) {
		*exists = ISC_FALSE;
		return (ISC_R_SUCCESS);
	}
	if (result != ISC_R_SUCCESS)
		return (result);

	result = dns_db_allrdatasets(db, node, version,
				     (isc_stdtime_t) 0, &iter);
	if (result != ISC_R_SUCCESS)
		goto cleanup_node;

	result = dns_rdatasetiter_first(iter);
	if (result == ISC_R_SUCCESS) {
		*exists = ISC_TRUE;
	} else if (result == ISC_R_NOMORE) {
		*exists = ISC_FALSE;
		result = ISC_R_SUCCESS;
	} else
		*exists = ISC_FALSE;
	dns_rdatasetiter_destroy(&iter);

 cleanup_node:
	dns_db_detachnode(db, &node);
	return (result);
}

static isc_boolean_t
match_nsec3param(const dns_rdata_nsec3_t *nsec3,
		 const dns_rdata_nsec3param_t *nsec3param)
{
	if (nsec3->hash == nsec3param->hash &&
	    nsec3->iterations == nsec3param->iterations &&
	    nsec3->salt_length == nsec3param->salt_length &&
	    !memcmp(nsec3->salt, nsec3param->salt, nsec3->salt_length))
		return (ISC_TRUE);
	return (ISC_FALSE);
}

/*%
 * Delete NSEC3 records at "name" which match "param", recording the
 * change in "diff".
 */
static isc_result_t
delete(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
       const dns_rdata_nsec3param_t *nsec3param, dns_diff_t *diff)
{
	dns_dbnode_t *node = NULL ;
	dns_difftuple_t *tuple = NULL;
	dns_rdata_nsec3_t nsec3;
	dns_rdataset_t rdataset;
	isc_result_t result;

	result = dns_db_findnsec3node(db, name, ISC_FALSE, &node);
	if (result == ISC_R_NOTFOUND)
		return (ISC_R_SUCCESS);
	if (result != ISC_R_SUCCESS)
		return (result);

	dns_rdataset_init(&rdataset);
	result = dns_db_findrdataset(db, node, version, dns_rdatatype_nsec3, 0,
				     (isc_stdtime_t) 0, &rdataset, NULL);

	if (result == ISC_R_NOTFOUND) {
		result = ISC_R_SUCCESS;
		goto cleanup_node;
	}
	if (result != ISC_R_SUCCESS)
		goto cleanup_node;

	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset))
	{
		dns_rdata_t rdata = DNS_RDATA_INIT;
		dns_rdataset_current(&rdataset, &rdata);
		CHECK(dns_rdata_tostruct(&rdata, &nsec3, NULL));

		if (!match_nsec3param(&nsec3, nsec3param))
			continue;

		result = dns_difftuple_create(diff->mctx, DNS_DIFFOP_DEL, name,
					      rdataset.ttl, &rdata, &tuple);
		if (result != ISC_R_SUCCESS)
			goto failure;
		result = do_one_tuple(&tuple, db, version, diff);
		if (result != ISC_R_SUCCESS)
			goto failure;
	}
	if (result != ISC_R_NOMORE)
		goto failure;
	result = ISC_R_SUCCESS;

 failure:
	dns_rdataset_disassociate(&rdataset);
 cleanup_node:
	dns_db_detachnode(db, &node);

	return (result);
}

static isc_boolean_t
better_param(dns_rdataset_t *nsec3paramset, dns_rdata_t *param) {
	dns_rdataset_t rdataset;
	isc_result_t result;

	if (REMOVE(param->data[1]))
		return (ISC_TRUE);

	dns_rdataset_init(&rdataset);
	dns_rdataset_clone(nsec3paramset, &rdataset);
	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata =  DNS_RDATA_INIT;
		unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];

		if (rdataset.type != dns_rdatatype_nsec3param) {
			dns_rdata_t tmprdata =  DNS_RDATA_INIT;
			dns_rdataset_current(&rdataset, &tmprdata);
			if (!dns_nsec3param_fromprivate(&tmprdata, &rdata,
							buf, sizeof(buf)))
				continue;
		} else
			dns_rdataset_current(&rdataset, &rdata);

		if (rdata.length != param->length)
			continue;
		if (rdata.data[0] != param->data[0] ||
		    REMOVE(rdata.data[1]) ||
		    rdata.data[2] != param->data[2] ||
		    rdata.data[3] != param->data[3] ||
		    rdata.data[4] != param->data[4] ||
		    memcmp(&rdata.data[5], &param->data[5], param->data[4]))
			continue;
		if (CREATE(rdata.data[1]) && !CREATE(param->data[1])) {
			dns_rdataset_disassociate(&rdataset);
			return (ISC_TRUE);
		}
	}
	dns_rdataset_disassociate(&rdataset);
	return (ISC_FALSE);
}

static isc_result_t
find_nsec3(dns_rdata_nsec3_t *nsec3, dns_rdataset_t *rdataset,
	   const dns_rdata_nsec3param_t *nsec3param)
{
	isc_result_t result;
	for (result = dns_rdataset_first(rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(rdataset)) {
		dns_rdata_t rdata = DNS_RDATA_INIT;

		dns_rdataset_current(rdataset, &rdata);
		CHECK(dns_rdata_tostruct(&rdata, nsec3, NULL));
		dns_rdata_reset(&rdata);
		if (match_nsec3param(nsec3, nsec3param))
			break;
	}
 failure:
	return (result);
}

isc_result_t
dns_nsec3_addnsec3(dns_db_t *db, dns_dbversion_t *version,
		   dns_name_t *name, const dns_rdata_nsec3param_t *nsec3param,
		   dns_ttl_t nsecttl, isc_boolean_t unsecure, dns_diff_t *diff)
{
	dns_dbiterator_t *dbit = NULL;
	dns_dbnode_t *node = NULL;
	dns_dbnode_t *newnode = NULL;
	dns_difftuple_t *tuple = NULL;
	dns_fixedname_t fixed;
	dns_fixedname_t fprev;
	dns_hash_t hash;
	dns_name_t *hashname;
	dns_name_t *origin;
	dns_name_t *prev;
	dns_name_t empty;
	dns_rdata_nsec3_t nsec3;
	dns_rdata_t rdata = DNS_RDATA_INIT;
	dns_rdataset_t rdataset;
	int pass;
	isc_boolean_t exists = ISC_FALSE;
	isc_boolean_t maybe_remove_unsecure = ISC_FALSE;
	isc_uint8_t flags;
	isc_buffer_t buffer;
	isc_result_t result;
	unsigned char *old_next;
	unsigned char *salt;
	unsigned char nexthash[NSEC3_MAX_HASH_LENGTH];
	unsigned char nsec3buf[DNS_NSEC3_BUFFERSIZE];
	unsigned int iterations;
	unsigned int labels;
	size_t next_length;
	unsigned int old_length;
	unsigned int salt_length;

	dns_fixedname_init(&fixed);
	hashname = dns_fixedname_name(&fixed);
	dns_fixedname_init(&fprev);
	prev = dns_fixedname_name(&fprev);

	dns_rdataset_init(&rdataset);

	origin = dns_db_origin(db);

	/*
	 * Chain parameters.
	 */
	hash = nsec3param->hash;
	iterations = nsec3param->iterations;
	salt_length = nsec3param->salt_length;
	salt = nsec3param->salt;

	/*
	 * Default flags for a new chain.
	 */
	flags = nsec3param->flags & DNS_NSEC3FLAG_OPTOUT;

	/*
	 * If this is the first NSEC3 in the chain nexthash will
	 * remain pointing to itself.
	 */
	next_length = sizeof(nexthash);
	CHECK(dns_nsec3_hashname(&fixed, nexthash, &next_length,
				 name, origin, hash, iterations,
				 salt, salt_length));
	INSIST(next_length <= sizeof(nexthash));

	/*
	 * Create the node if it doesn't exist and hold
	 * a reference to it until we have added the NSEC3.
	 */
	CHECK(dns_db_findnsec3node(db, hashname, ISC_TRUE, &newnode));

	/*
	 * Seek the iterator to the 'newnode'.
	 */
	CHECK(dns_db_createiterator(db, DNS_DB_NSEC3ONLY, &dbit));
	CHECK(dns_dbiterator_seek(dbit, hashname));
	CHECK(dns_dbiterator_pause(dbit));
	result = dns_db_findrdataset(db, newnode, version, dns_rdatatype_nsec3,
				     0, (isc_stdtime_t) 0, &rdataset, NULL);
	/*
	 * If we updating a existing NSEC3 then find its
	 * next field.
	 */
	if (result == ISC_R_SUCCESS) {
		result = find_nsec3(&nsec3, &rdataset, nsec3param);
		if (result == ISC_R_SUCCESS) {
			if (!CREATE(nsec3param->flags))
				flags = nsec3.flags;
			next_length = nsec3.next_length;
			INSIST(next_length <= sizeof(nexthash));
			memmove(nexthash, nsec3.next, next_length);
			dns_rdataset_disassociate(&rdataset);
			/*
			 * If the NSEC3 is not for a unsecure delegation then
			 * we are just updating it.  If it is for a unsecure
			 * delegation then we need find out if we need to
			 * remove the NSEC3 record or not by examining the
			 * previous NSEC3 record.
			 */
			if (!unsecure)
				goto addnsec3;
			else if (CREATE(nsec3param->flags) && OPTOUT(flags)) {
				result = dns_nsec3_delnsec3(db, version, name,
							    nsec3param, diff);
				goto failure;
			} else
				maybe_remove_unsecure = ISC_TRUE;
		} else {
			dns_rdataset_disassociate(&rdataset);
			if (result != ISC_R_NOMORE)
				goto failure;
		}
	}

	/*
	 * Find the previous NSEC3 (if any) and update it if required.
	 */
	pass = 0;
	do {
		result = dns_dbiterator_prev(dbit);
		if (result == ISC_R_NOMORE) {
			pass++;
			CHECK(dns_dbiterator_last(dbit));
		}
		CHECK(dns_dbiterator_current(dbit, &node, prev));
		CHECK(dns_dbiterator_pause(dbit));
		result = dns_db_findrdataset(db, node, version,
					     dns_rdatatype_nsec3, 0,
					     (isc_stdtime_t) 0, &rdataset,
					     NULL);
		dns_db_detachnode(db, &node);
		if (result != ISC_R_SUCCESS)
			continue;

		result = find_nsec3(&nsec3, &rdataset, nsec3param);
		if (result == ISC_R_NOMORE) {
			dns_rdataset_disassociate(&rdataset);
			continue;
		}
		if (result != ISC_R_SUCCESS)
			goto failure;

		if (maybe_remove_unsecure) {
			dns_rdataset_disassociate(&rdataset);
			/*
			 * If we have OPTOUT set in the previous NSEC3 record
			 * we actually need to delete the NSEC3 record.
			 * Otherwise we just need to replace the NSEC3 record.
			 */
			if (OPTOUT(nsec3.flags)) {
				result = dns_nsec3_delnsec3(db, version, name,
							    nsec3param, diff);
				goto failure;
			}
			goto addnsec3;
		} else {
			/*
			 * Is this is a unsecure delegation we are adding?
			 * If so no change is required.
			 */
			if (OPTOUT(nsec3.flags) && unsecure) {
				dns_rdataset_disassociate(&rdataset);
				goto failure;
			}
		}

		old_next = nsec3.next;
		old_length = nsec3.next_length;

		/*
		 * Delete the old previous NSEC3.
		 */
		CHECK(delete(db, version, prev, nsec3param, diff));

		/*
		 * Fixup the previous NSEC3.
		 */
		nsec3.next = nexthash;
		nsec3.next_length = (unsigned char)next_length;
		isc_buffer_init(&buffer, nsec3buf, sizeof(nsec3buf));
		CHECK(dns_rdata_fromstruct(&rdata, rdataset.rdclass,
					   dns_rdatatype_nsec3, &nsec3,
					   &buffer));
		CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, prev,
					   rdataset.ttl, &rdata, &tuple));
		CHECK(do_one_tuple(&tuple, db, version, diff));
		INSIST(old_length <= sizeof(nexthash));
		memmove(nexthash, old_next, old_length);
		if (!CREATE(nsec3param->flags))
			flags = nsec3.flags;
		dns_rdata_reset(&rdata);
		dns_rdataset_disassociate(&rdataset);
		break;
	} while (pass < 2);

 addnsec3:
	/*
	 * Create the NSEC3 RDATA.
	 */
	CHECK(dns_db_findnode(db, name, ISC_FALSE, &node));
	CHECK(dns_nsec3_buildrdata(db, version, node, hash, flags, iterations,
				   salt, salt_length, nexthash, next_length,
				   nsec3buf, &rdata));
	dns_db_detachnode(db, &node);

	/*
	 * Delete the old NSEC3 and record the change.
	 */
	CHECK(delete(db, version, hashname, nsec3param, diff));
	/*
	 * Add the new NSEC3 and record the change.
	 */
	CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
				   hashname, nsecttl, &rdata, &tuple));
	CHECK(do_one_tuple(&tuple, db, version, diff));
	INSIST(tuple == NULL);
	dns_rdata_reset(&rdata);
	dns_db_detachnode(db, &newnode);

	/*
	 * Add missing NSEC3 records for empty nodes
	 */
	dns_name_init(&empty, NULL);
	dns_name_clone(name, &empty);
	do {
		labels = dns_name_countlabels(&empty) - 1;
		if (labels <= dns_name_countlabels(origin))
			break;
		dns_name_getlabelsequence(&empty, 1, labels, &empty);
		CHECK(name_exists(db, version, &empty, &exists));
		if (exists)
			break;
		CHECK(dns_nsec3_hashname(&fixed, nexthash, &next_length,
					 &empty, origin, hash, iterations,
					 salt, salt_length));

		/*
		 * Create the node if it doesn't exist and hold
		 * a reference to it until we have added the NSEC3
		 * or we discover we don't need to add make a change.
		 */
		CHECK(dns_db_findnsec3node(db, hashname, ISC_TRUE, &newnode));
		result = dns_db_findrdataset(db, newnode, version,
					     dns_rdatatype_nsec3, 0,
					     (isc_stdtime_t) 0, &rdataset,
					     NULL);
		if (result == ISC_R_SUCCESS) {
			result = find_nsec3(&nsec3, &rdataset, nsec3param);
			dns_rdataset_disassociate(&rdataset);
			if (result == ISC_R_SUCCESS) {
				dns_db_detachnode(db, &newnode);
				break;
			}
			if (result != ISC_R_NOMORE)
				goto failure;
		}

		/*
		 * Find the previous NSEC3 and update it.
		 */
		CHECK(dns_dbiterator_seek(dbit, hashname));
		pass = 0;
		do {
			result = dns_dbiterator_prev(dbit);
			if (result == ISC_R_NOMORE) {
				pass++;
				CHECK(dns_dbiterator_last(dbit));
			}
			CHECK(dns_dbiterator_current(dbit, &node, prev));
			CHECK(dns_dbiterator_pause(dbit));
			result = dns_db_findrdataset(db, node, version,
						     dns_rdatatype_nsec3, 0,
						     (isc_stdtime_t) 0,
						     &rdataset, NULL);
			dns_db_detachnode(db, &node);
			if (result != ISC_R_SUCCESS)
				continue;
			result = find_nsec3(&nsec3, &rdataset, nsec3param);
			if (result == ISC_R_NOMORE) {
				dns_rdataset_disassociate(&rdataset);
				continue;
			}
			if (result != ISC_R_SUCCESS)
				goto failure;

			old_next = nsec3.next;
			old_length = nsec3.next_length;

			/*
			 * Delete the old previous NSEC3.
			 */
			CHECK(delete(db, version, prev, nsec3param, diff));

			/*
			 * Fixup the previous NSEC3.
			 */
			nsec3.next = nexthash;
			nsec3.next_length = (unsigned char)next_length;
			isc_buffer_init(&buffer, nsec3buf,
					sizeof(nsec3buf));
			CHECK(dns_rdata_fromstruct(&rdata, rdataset.rdclass,
						   dns_rdatatype_nsec3, &nsec3,
						   &buffer));
			CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
						   prev, rdataset.ttl, &rdata,
						   &tuple));
			CHECK(do_one_tuple(&tuple, db, version, diff));
			INSIST(old_length <= sizeof(nexthash));
			memmove(nexthash, old_next, old_length);
			if (!CREATE(nsec3param->flags))
				flags = nsec3.flags;
			dns_rdata_reset(&rdata);
			dns_rdataset_disassociate(&rdataset);
			break;
		} while (pass < 2);

		INSIST(pass < 2);

		/*
		 * Create the NSEC3 RDATA for the empty node.
		 */
		CHECK(dns_nsec3_buildrdata(db, version, NULL, hash, flags,
					   iterations, salt, salt_length,
					   nexthash, next_length, nsec3buf,
					   &rdata));
		/*
		 * Delete the old NSEC3 and record the change.
		 */
		CHECK(delete(db, version, hashname, nsec3param, diff));

		/*
		 * Add the new NSEC3 and record the change.
		 */
		CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
					   hashname, nsecttl, &rdata, &tuple));
		CHECK(do_one_tuple(&tuple, db, version, diff));
		INSIST(tuple == NULL);
		dns_rdata_reset(&rdata);
		dns_db_detachnode(db, &newnode);
	} while (1);

	/* result cannot be ISC_R_NOMORE here */
	INSIST(result != ISC_R_NOMORE);

 failure:
	if (dbit != NULL)
		dns_dbiterator_destroy(&dbit);
	if (dns_rdataset_isassociated(&rdataset))
		dns_rdataset_disassociate(&rdataset);
	if (node != NULL)
		dns_db_detachnode(db, &node);
	if (newnode != NULL)
		dns_db_detachnode(db, &newnode);
	return (result);
}

/*%
 * Add NSEC3 records for "name", recording the change in "diff".
 * The existing NSEC3 records are removed.
 */
isc_result_t
dns_nsec3_addnsec3s(dns_db_t *db, dns_dbversion_t *version,
		    dns_name_t *name, dns_ttl_t nsecttl,
		    isc_boolean_t unsecure, dns_diff_t *diff)
{
	dns_dbnode_t *node = NULL;
	dns_rdata_nsec3param_t nsec3param;
	dns_rdataset_t rdataset;
	isc_result_t result;

	dns_rdataset_init(&rdataset);

	/*
	 * Find the NSEC3 parameters for this zone.
	 */
	result = dns_db_getoriginnode(db, &node);
	if (result != ISC_R_SUCCESS)
		return (result);

	result = dns_db_findrdataset(db, node, version,
				     dns_rdatatype_nsec3param, 0, 0,
				     &rdataset, NULL);
	dns_db_detachnode(db, &node);
	if (result == ISC_R_NOTFOUND)
		return (ISC_R_SUCCESS);
	if (result != ISC_R_SUCCESS)
		return (result);

	/*
	 * Update each active NSEC3 chain.
	 */
	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata = DNS_RDATA_INIT;

		dns_rdataset_current(&rdataset, &rdata);
		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));

		if (nsec3param.flags != 0)
			continue;
		/*
		 * We have a active chain.  Update it.
		 */
		CHECK(dns_nsec3_addnsec3(db, version, name, &nsec3param,
					 nsecttl, unsecure, diff));
	}
	if (result == ISC_R_NOMORE)
		result = ISC_R_SUCCESS;

 failure:
	if (dns_rdataset_isassociated(&rdataset))
		dns_rdataset_disassociate(&rdataset);
	if (node != NULL)
		dns_db_detachnode(db, &node);

	return (result);
}

isc_boolean_t
dns_nsec3param_fromprivate(dns_rdata_t *src, dns_rdata_t *target,
			   unsigned char *buf, size_t buflen)
{
	dns_decompress_t dctx;
	isc_result_t result;
	isc_buffer_t buf1;
	isc_buffer_t buf2;

	/*
	 * Algorithm 0 (reserved by RFC 4034) is used to identify
	 * NSEC3PARAM records from DNSKEY pointers.
	 */
	if (src->length < 1 || src->data[0] != 0)
		return (ISC_FALSE);

	isc_buffer_init(&buf1, src->data + 1, src->length - 1);
	isc_buffer_add(&buf1, src->length - 1);
	isc_buffer_setactive(&buf1, src->length - 1);
	isc_buffer_init(&buf2, buf, (unsigned int)buflen);
	dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE);
	result = dns_rdata_fromwire(target, src->rdclass,
				    dns_rdatatype_nsec3param,
				    &buf1, &dctx, 0, &buf2);
	dns_decompress_invalidate(&dctx);

	return (ISC_TF(result == ISC_R_SUCCESS));
}

void
dns_nsec3param_toprivate(dns_rdata_t *src, dns_rdata_t *target,
			 dns_rdatatype_t privatetype,
			 unsigned char *buf, size_t buflen)
{
	REQUIRE(buflen >= src->length + 1);

	REQUIRE(DNS_RDATA_INITIALIZED(target));

	memmove(buf + 1, src->data, src->length);
	buf[0] = 0;
	target->data = buf;
	target->length = src->length + 1;
	target->type = privatetype;
	target->rdclass = src->rdclass;
	target->flags = 0;
	ISC_LINK_INIT(target, link);
}

static isc_result_t
rr_exists(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
	  const dns_rdata_t *rdata, isc_boolean_t *flag)
{
	dns_rdataset_t rdataset;
	dns_dbnode_t *node = NULL;
	isc_result_t result;

	dns_rdataset_init(&rdataset);
	if (rdata->type == dns_rdatatype_nsec3)
		CHECK(dns_db_findnsec3node(db, name, ISC_FALSE, &node));
	else
		CHECK(dns_db_findnode(db, name, ISC_FALSE, &node));
	result = dns_db_findrdataset(db, node, ver, rdata->type, 0,
				     (isc_stdtime_t) 0, &rdataset, NULL);
	if (result == ISC_R_NOTFOUND) {
		*flag = ISC_FALSE;
		result = ISC_R_SUCCESS;
		goto failure;
	}

	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t myrdata = DNS_RDATA_INIT;
		dns_rdataset_current(&rdataset, &myrdata);
		if (!dns_rdata_casecompare(&myrdata, rdata))
			break;
	}
	dns_rdataset_disassociate(&rdataset);
	if (result == ISC_R_SUCCESS) {
		*flag = ISC_TRUE;
	} else if (result == ISC_R_NOMORE) {
		*flag = ISC_FALSE;
		result = ISC_R_SUCCESS;
	}

 failure:
	if (node != NULL)
		dns_db_detachnode(db, &node);
	return (result);
}

isc_result_t
dns_nsec3param_deletechains(dns_db_t *db, dns_dbversion_t *ver,
			    dns_zone_t *zone, isc_boolean_t nonsec,
			    dns_diff_t *diff)
{
	dns_dbnode_t *node = NULL;
	dns_difftuple_t *tuple = NULL;
	dns_name_t next;
	dns_rdata_t rdata = DNS_RDATA_INIT;
	dns_rdataset_t rdataset;
	isc_boolean_t flag;
	isc_result_t result = ISC_R_SUCCESS;
	unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE + 1];
	dns_name_t *origin = dns_zone_getorigin(zone);
	dns_rdatatype_t privatetype = dns_zone_getprivatetype(zone);

	dns_name_init(&next, NULL);
	dns_rdataset_init(&rdataset);

	result = dns_db_getoriginnode(db, &node);
	if (result != ISC_R_SUCCESS)
		return (result);

	/*
	 * Cause all NSEC3 chains to be deleted.
	 */
	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3param,
				     0, (isc_stdtime_t) 0, &rdataset, NULL);
	if (result == ISC_R_NOTFOUND)
		goto try_private;
	if (result != ISC_R_SUCCESS)
		goto failure;

	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t private = DNS_RDATA_INIT;

		dns_rdataset_current(&rdataset, &rdata);

		CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_DEL, origin,
					   rdataset.ttl, &rdata, &tuple));
		CHECK(do_one_tuple(&tuple, db, ver, diff));
		INSIST(tuple == NULL);

		dns_nsec3param_toprivate(&rdata, &private, privatetype,
					 buf, sizeof(buf));
		buf[2] = DNS_NSEC3FLAG_REMOVE;
		if (nonsec)
			buf[2] |= DNS_NSEC3FLAG_NONSEC;

		CHECK(rr_exists(db, ver, origin, &private, &flag));

		if (!flag) {
			CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
						   origin, 0, &private,
						   &tuple));
			CHECK(do_one_tuple(&tuple, db, ver, diff));
			INSIST(tuple == NULL);
		}
		dns_rdata_reset(&rdata);
	}
	if (result != ISC_R_NOMORE)
		goto failure;

	dns_rdataset_disassociate(&rdataset);

 try_private:
	if (privatetype == 0)
		goto success;
	result = dns_db_findrdataset(db, node, ver, privatetype, 0,
				     (isc_stdtime_t) 0, &rdataset, NULL);
	if (result == ISC_R_NOTFOUND)
		goto success;
	if (result != ISC_R_SUCCESS)
		goto failure;

	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_reset(&rdata);
		dns_rdataset_current(&rdataset, &rdata);
		INSIST(rdata.length <= sizeof(buf));
		memmove(buf, rdata.data, rdata.length);

		/*
		 * Private NSEC3 record length >= 6.
		 * <0(1), hash(1), flags(1), iterations(2), saltlen(1)>
		 */
		if (rdata.length < 6 || buf[0] != 0 ||
		    (buf[2] & DNS_NSEC3FLAG_REMOVE) != 0 ||
		    (nonsec && (buf[2] & DNS_NSEC3FLAG_NONSEC) != 0))
			continue;

		CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_DEL, origin,
					   0, &rdata, &tuple));
		CHECK(do_one_tuple(&tuple, db, ver, diff));
		INSIST(tuple == NULL);

		rdata.data = buf;
		buf[2] = DNS_NSEC3FLAG_REMOVE;
		if (nonsec)
			buf[2] |= DNS_NSEC3FLAG_NONSEC;

		CHECK(rr_exists(db, ver, origin, &rdata, &flag));

		if (!flag) {
			CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
						   origin, 0, &rdata, &tuple));
			CHECK(do_one_tuple(&tuple, db, ver, diff));
			INSIST(tuple == NULL);
		}
	}
	if (result != ISC_R_NOMORE)
		goto failure;
 success:
	result = ISC_R_SUCCESS;

 failure:
	if (dns_rdataset_isassociated(&rdataset))
		dns_rdataset_disassociate(&rdataset);
	dns_db_detachnode(db, &node);
	return (result);
}

isc_result_t
dns_nsec3_addnsec3sx(dns_db_t *db, dns_dbversion_t *version,
		     dns_name_t *name, dns_ttl_t nsecttl,
		     isc_boolean_t unsecure, dns_rdatatype_t type,
		     dns_diff_t *diff)
{
	dns_dbnode_t *node = NULL;
	dns_rdata_nsec3param_t nsec3param;
	dns_rdataset_t rdataset;
	dns_rdataset_t prdataset;
	isc_result_t result;

	dns_rdataset_init(&rdataset);
	dns_rdataset_init(&prdataset);

	/*
	 * Find the NSEC3 parameters for this zone.
	 */
	result = dns_db_getoriginnode(db, &node);
	if (result != ISC_R_SUCCESS)
		return (result);

	result = dns_db_findrdataset(db, node, version, type, 0, 0,
				     &prdataset, NULL);
	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND)
		goto failure;

	result = dns_db_findrdataset(db, node, version,
				     dns_rdatatype_nsec3param, 0, 0,
				     &rdataset, NULL);
	if (result == ISC_R_NOTFOUND)
		goto try_private;
	if (result != ISC_R_SUCCESS)
		goto failure;

	/*
	 * Update each active NSEC3 chain.
	 */
	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata = DNS_RDATA_INIT;

		dns_rdataset_current(&rdataset, &rdata);
		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));

		if (nsec3param.flags != 0)
			continue;

		/*
		 * We have a active chain.  Update it.
		 */
		CHECK(dns_nsec3_addnsec3(db, version, name, &nsec3param,
					 nsecttl, unsecure, diff));
	}
	if (result != ISC_R_NOMORE)
		goto failure;

	dns_rdataset_disassociate(&rdataset);

 try_private:
	if (!dns_rdataset_isassociated(&prdataset))
		goto success;
	/*
	 * Update each active NSEC3 chain.
	 */
	for (result = dns_rdataset_first(&prdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&prdataset)) {
		dns_rdata_t rdata1 = DNS_RDATA_INIT;
		dns_rdata_t rdata2 = DNS_RDATA_INIT;
		unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];

		dns_rdataset_current(&prdataset, &rdata1);
		if (!dns_nsec3param_fromprivate(&rdata1, &rdata2,
						buf, sizeof(buf)))
			continue;
		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param, NULL));

		if ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0)
			continue;
		if (better_param(&prdataset, &rdata2))
			continue;

		/*
		 * We have a active chain.  Update it.
		 */
		CHECK(dns_nsec3_addnsec3(db, version, name, &nsec3param,
					 nsecttl, unsecure, diff));
	}
	if (result == ISC_R_NOMORE)
 success:
		result = ISC_R_SUCCESS;
 failure:
	if (dns_rdataset_isassociated(&rdataset))
		dns_rdataset_disassociate(&rdataset);
	if (dns_rdataset_isassociated(&prdataset))
		dns_rdataset_disassociate(&prdataset);
	if (node != NULL)
		dns_db_detachnode(db, &node);

	return (result);
}

/*%
 * Determine whether any NSEC3 records that were associated with
 * 'name' should be deleted or if they should continue to exist.
 * ISC_TRUE indicates they should be deleted.
 * ISC_FALSE indicates they should be retained.
 */
static isc_result_t
deleteit(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
	 isc_boolean_t *yesno)
{
	isc_result_t result;
	dns_fixedname_t foundname;
	dns_fixedname_init(&foundname);

	result = dns_db_find(db, name, ver, dns_rdatatype_any,
			     DNS_DBFIND_GLUEOK | DNS_DBFIND_NOWILD,
			     (isc_stdtime_t) 0, NULL,
			     dns_fixedname_name(&foundname),
			     NULL, NULL);
	if (result == DNS_R_EMPTYNAME || result == ISC_R_SUCCESS ||
	    result ==  DNS_R_ZONECUT) {
		*yesno = ISC_FALSE;
		return (ISC_R_SUCCESS);
	}
	if (result == DNS_R_GLUE || result == DNS_R_DNAME ||
	    result == DNS_R_DELEGATION || result == DNS_R_NXDOMAIN) {
		*yesno = ISC_TRUE;
		return (ISC_R_SUCCESS);
	}
	/*
	 * Silence compiler.
	 */
	*yesno = ISC_TRUE;
	return (result);
}

isc_result_t
dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
		   const dns_rdata_nsec3param_t *nsec3param, dns_diff_t *diff)
{
	dns_dbiterator_t *dbit = NULL;
	dns_dbnode_t *node = NULL;
	dns_difftuple_t *tuple = NULL;
	dns_fixedname_t fixed;
	dns_fixedname_t fprev;
	dns_hash_t hash;
	dns_name_t *hashname;
	dns_name_t *origin;
	dns_name_t *prev;
	dns_name_t empty;
	dns_rdata_nsec3_t nsec3;
	dns_rdata_t rdata = DNS_RDATA_INIT;
	dns_rdataset_t rdataset;
	int pass;
	isc_boolean_t yesno;
	isc_buffer_t buffer;
	isc_result_t result;
	unsigned char *salt;
	unsigned char nexthash[NSEC3_MAX_HASH_LENGTH];
	unsigned char nsec3buf[DNS_NSEC3_BUFFERSIZE];
	unsigned int iterations;
	unsigned int labels;
	size_t next_length;
	unsigned int salt_length;

	dns_fixedname_init(&fixed);
	hashname = dns_fixedname_name(&fixed);
	dns_fixedname_init(&fprev);
	prev = dns_fixedname_name(&fprev);

	dns_rdataset_init(&rdataset);

	origin = dns_db_origin(db);

	/*
	 * Chain parameters.
	 */
	hash = nsec3param->hash;
	iterations = nsec3param->iterations;
	salt_length = nsec3param->salt_length;
	salt = nsec3param->salt;

	/*
	 * If this is the first NSEC3 in the chain nexthash will
	 * remain pointing to itself.
	 */
	next_length = sizeof(nexthash);
	CHECK(dns_nsec3_hashname(&fixed, nexthash, &next_length,
				 name, origin, hash, iterations,
				 salt, salt_length));

	CHECK(dns_db_createiterator(db, DNS_DB_NSEC3ONLY, &dbit));

	result = dns_dbiterator_seek(dbit, hashname);
	if (result == ISC_R_NOTFOUND)
		goto success;
	if (result != ISC_R_SUCCESS)
		goto failure;

	CHECK(dns_dbiterator_current(dbit, &node, NULL));
	CHECK(dns_dbiterator_pause(dbit));
	result = dns_db_findrdataset(db, node, version, dns_rdatatype_nsec3,
				     0, (isc_stdtime_t) 0, &rdataset, NULL);
	dns_db_detachnode(db, &node);
	if (result == ISC_R_NOTFOUND)
		goto success;
	if (result != ISC_R_SUCCESS)
		goto failure;

	/*
	 * If we find a existing NSEC3 for this chain then save the
	 * next field.
	 */
	result = find_nsec3(&nsec3, &rdataset, nsec3param);
	if (result == ISC_R_SUCCESS) {
		next_length = nsec3.next_length;
		INSIST(next_length <= sizeof(nexthash));
		memmove(nexthash, nsec3.next, next_length);
	}
	dns_rdataset_disassociate(&rdataset);
	if (result == ISC_R_NOMORE)
		goto success;
	if (result != ISC_R_SUCCESS)
		goto failure;

	/*
	 * Find the previous NSEC3 and update it.
	 */
	pass = 0;
	do {
		result = dns_dbiterator_prev(dbit);
		if (result == ISC_R_NOMORE) {
			pass++;
			CHECK(dns_dbiterator_last(dbit));
		}
		CHECK(dns_dbiterator_current(dbit, &node, prev));
		CHECK(dns_dbiterator_pause(dbit));
		result = dns_db_findrdataset(db, node, version,
					     dns_rdatatype_nsec3, 0,
					     (isc_stdtime_t) 0, &rdataset,
					     NULL);
		dns_db_detachnode(db, &node);
		if (result != ISC_R_SUCCESS)
			continue;
		result = find_nsec3(&nsec3, &rdataset, nsec3param);
		if (result == ISC_R_NOMORE) {
			dns_rdataset_disassociate(&rdataset);
			continue;
		}
		if (result != ISC_R_SUCCESS)
			goto failure;

		/*
		 * Delete the old previous NSEC3.
		 */
		CHECK(delete(db, version, prev, nsec3param, diff));

		/*
		 * Fixup the previous NSEC3.
		 */
		nsec3.next = nexthash;
		nsec3.next_length = (unsigned char)next_length;
		if (CREATE(nsec3param->flags))
			nsec3.flags = nsec3param->flags & DNS_NSEC3FLAG_OPTOUT;
		isc_buffer_init(&buffer, nsec3buf, sizeof(nsec3buf));
		CHECK(dns_rdata_fromstruct(&rdata, rdataset.rdclass,
					   dns_rdatatype_nsec3, &nsec3,
					   &buffer));
		CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD, prev,
					   rdataset.ttl, &rdata, &tuple));
		CHECK(do_one_tuple(&tuple, db, version, diff));
		dns_rdata_reset(&rdata);
		dns_rdataset_disassociate(&rdataset);
		break;
	} while (pass < 2);

	/*
	 * Delete the old NSEC3 and record the change.
	 */
	CHECK(delete(db, version, hashname, nsec3param, diff));

	/*
	 *  Delete NSEC3 records for now non active nodes.
	 */
	dns_name_init(&empty, NULL);
	dns_name_clone(name, &empty);
	do {
		labels = dns_name_countlabels(&empty) - 1;
		if (labels <= dns_name_countlabels(origin))
			break;
		dns_name_getlabelsequence(&empty, 1, labels, &empty);
		CHECK(deleteit(db, version, &empty, &yesno));
		if (!yesno)
			break;

		CHECK(dns_nsec3_hashname(&fixed, nexthash, &next_length,
					 &empty, origin, hash, iterations,
					 salt, salt_length));
		result = dns_dbiterator_seek(dbit, hashname);
		if (result == ISC_R_NOTFOUND)
			goto success;
		if (result != ISC_R_SUCCESS)
			goto failure;

		CHECK(dns_dbiterator_current(dbit, &node, NULL));
		CHECK(dns_dbiterator_pause(dbit));
		result = dns_db_findrdataset(db, node, version,
					     dns_rdatatype_nsec3, 0,
					     (isc_stdtime_t) 0, &rdataset,
					     NULL);
		dns_db_detachnode(db, &node);
		if (result == ISC_R_NOTFOUND)
			goto success;
		if (result != ISC_R_SUCCESS)
			goto failure;

		result = find_nsec3(&nsec3, &rdataset, nsec3param);
		if (result == ISC_R_SUCCESS) {
			next_length = nsec3.next_length;
			INSIST(next_length <= sizeof(nexthash));
			memmove(nexthash, nsec3.next, next_length);
		}
		dns_rdataset_disassociate(&rdataset);
		if (result == ISC_R_NOMORE)
			goto success;
		if (result != ISC_R_SUCCESS)
			goto failure;

		pass = 0;
		do {
			result = dns_dbiterator_prev(dbit);
			if (result == ISC_R_NOMORE) {
				pass++;
				CHECK(dns_dbiterator_last(dbit));
			}
			CHECK(dns_dbiterator_current(dbit, &node, prev));
			CHECK(dns_dbiterator_pause(dbit));
			result = dns_db_findrdataset(db, node, version,
						     dns_rdatatype_nsec3, 0,
						     (isc_stdtime_t) 0,
						     &rdataset, NULL);
			dns_db_detachnode(db, &node);
			if (result != ISC_R_SUCCESS)
				continue;
			result = find_nsec3(&nsec3, &rdataset, nsec3param);
			if (result == ISC_R_NOMORE) {
				dns_rdataset_disassociate(&rdataset);
				continue;
			}
			if (result != ISC_R_SUCCESS)
				goto failure;

			/*
			 * Delete the old previous NSEC3.
			 */
			CHECK(delete(db, version, prev, nsec3param, diff));

			/*
			 * Fixup the previous NSEC3.
			 */
			nsec3.next = nexthash;
			nsec3.next_length = (unsigned char)next_length;
			isc_buffer_init(&buffer, nsec3buf,
					sizeof(nsec3buf));
			CHECK(dns_rdata_fromstruct(&rdata, rdataset.rdclass,
						   dns_rdatatype_nsec3, &nsec3,
						   &buffer));
			CHECK(dns_difftuple_create(diff->mctx, DNS_DIFFOP_ADD,
						   prev, rdataset.ttl, &rdata,
						   &tuple));
			CHECK(do_one_tuple(&tuple, db, version, diff));
			dns_rdata_reset(&rdata);
			dns_rdataset_disassociate(&rdataset);
			break;
		} while (pass < 2);

		INSIST(pass < 2);

		/*
		 * Delete the old NSEC3 and record the change.
		 */
		CHECK(delete(db, version, hashname, nsec3param, diff));
	} while (1);

 success:
	result = ISC_R_SUCCESS;

 failure:
	if (dbit != NULL)
		dns_dbiterator_destroy(&dbit);
	if (dns_rdataset_isassociated(&rdataset))
		dns_rdataset_disassociate(&rdataset);
	if (node != NULL)
		dns_db_detachnode(db, &node);
	return (result);
}

isc_result_t
dns_nsec3_delnsec3s(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
		    dns_diff_t *diff)
{
	return (dns_nsec3_delnsec3sx(db, version, name, 0, diff));
}

isc_result_t
dns_nsec3_delnsec3sx(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
		     dns_rdatatype_t privatetype, dns_diff_t *diff)
{
	dns_dbnode_t *node = NULL;
	dns_rdata_nsec3param_t nsec3param;
	dns_rdataset_t rdataset;
	isc_result_t result;

	dns_rdataset_init(&rdataset);

	/*
	 * Find the NSEC3 parameters for this zone.
	 */
	result = dns_db_getoriginnode(db, &node);
	if (result != ISC_R_SUCCESS)
		return (result);

	result = dns_db_findrdataset(db, node, version,
				     dns_rdatatype_nsec3param, 0, 0,
				     &rdataset, NULL);
	if (result == ISC_R_NOTFOUND)
		goto try_private;
	if (result != ISC_R_SUCCESS)
		goto failure;

	/*
	 * Update each active NSEC3 chain.
	 */
	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata = DNS_RDATA_INIT;

		dns_rdataset_current(&rdataset, &rdata);
		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));

		if (nsec3param.flags != 0)
			continue;
		/*
		 * We have a active chain.  Update it.
		 */
		CHECK(dns_nsec3_delnsec3(db, version, name, &nsec3param, diff));
	}
	dns_rdataset_disassociate(&rdataset);

 try_private:
	if (privatetype == 0)
		goto success;
	result = dns_db_findrdataset(db, node, version, privatetype, 0, 0,
				     &rdataset, NULL);
	if (result == ISC_R_NOTFOUND)
		goto success;
	if (result != ISC_R_SUCCESS)
		goto failure;

	/*
	 * Update each NSEC3 chain being built.
	 */
	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata1 = DNS_RDATA_INIT;
		dns_rdata_t rdata2 = DNS_RDATA_INIT;
		unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];

		dns_rdataset_current(&rdataset, &rdata1);
		if (!dns_nsec3param_fromprivate(&rdata1,  &rdata2,
						buf, sizeof(buf)))
			continue;
		CHECK(dns_rdata_tostruct(&rdata2, &nsec3param, NULL));

		if ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0)
			continue;
		if (better_param(&rdataset, &rdata2))
			continue;

		/*
		 * We have a active chain.  Update it.
		 */
		CHECK(dns_nsec3_delnsec3(db, version, name, &nsec3param, diff));
	}
	if (result == ISC_R_NOMORE)
 success:
		result = ISC_R_SUCCESS;

 failure:
	if (dns_rdataset_isassociated(&rdataset))
		dns_rdataset_disassociate(&rdataset);
	if (node != NULL)
		dns_db_detachnode(db, &node);

	return (result);
}

isc_result_t
dns_nsec3_active(dns_db_t *db, dns_dbversion_t *version,
		 isc_boolean_t complete, isc_boolean_t *answer)
{
	return (dns_nsec3_activex(db, version, complete, 0, answer));
}

isc_result_t
dns_nsec3_activex(dns_db_t *db, dns_dbversion_t *version,
		  isc_boolean_t complete, dns_rdatatype_t privatetype,
		  isc_boolean_t *answer)
{
	dns_dbnode_t *node = NULL;
	dns_rdataset_t rdataset;
	dns_rdata_nsec3param_t nsec3param;
	isc_result_t result;

	REQUIRE(answer != NULL);

	dns_rdataset_init(&rdataset);

	result = dns_db_getoriginnode(db, &node);
	if (result != ISC_R_SUCCESS)
		return (result);

	result = dns_db_findrdataset(db, node, version,
				     dns_rdatatype_nsec3param, 0, 0,
				     &rdataset, NULL);

	if (result == ISC_R_NOTFOUND)
		goto try_private;

	if (result != ISC_R_SUCCESS) {
		dns_db_detachnode(db, &node);
		return (result);
	}
	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata = DNS_RDATA_INIT;

		dns_rdataset_current(&rdataset, &rdata);
		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
		RUNTIME_CHECK(result == ISC_R_SUCCESS);

		if (nsec3param.flags == 0)
			break;
	}
	dns_rdataset_disassociate(&rdataset);
	if (result == ISC_R_SUCCESS) {
		dns_db_detachnode(db, &node);
		*answer = ISC_TRUE;
		return (ISC_R_SUCCESS);
	}
	if (result == ISC_R_NOMORE)
		*answer = ISC_FALSE;

 try_private:
	if (privatetype == 0 || complete) {
		*answer = ISC_FALSE;
		return (ISC_R_SUCCESS);
	}
	result = dns_db_findrdataset(db, node, version, privatetype, 0, 0,
				     &rdataset, NULL);

	dns_db_detachnode(db, &node);
	if (result == ISC_R_NOTFOUND) {
		*answer = ISC_FALSE;
		return (ISC_R_SUCCESS);
	}
	if (result != ISC_R_SUCCESS)
		return (result);

	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata1 = DNS_RDATA_INIT;
		dns_rdata_t rdata2 = DNS_RDATA_INIT;
		unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];

		dns_rdataset_current(&rdataset, &rdata1);
		if (!dns_nsec3param_fromprivate(&rdata1, &rdata2,
						buf, sizeof(buf)))
			continue;
		result = dns_rdata_tostruct(&rdata2, &nsec3param, NULL);
		RUNTIME_CHECK(result == ISC_R_SUCCESS);

		if (!complete && CREATE(nsec3param.flags))
			break;
	}
	dns_rdataset_disassociate(&rdataset);
	if (result == ISC_R_SUCCESS) {
		*answer = ISC_TRUE;
		result = ISC_R_SUCCESS;
	}
	if (result == ISC_R_NOMORE) {
		*answer = ISC_FALSE;
		result = ISC_R_SUCCESS;
	}

	return (result);
}

isc_result_t
dns_nsec3_maxiterations(dns_db_t *db, dns_dbversion_t *version,
			isc_mem_t *mctx, unsigned int *iterationsp)
{
	dns_dbnode_t *node = NULL;
	dns_rdataset_t rdataset;
	dst_key_t *key = NULL;
	isc_buffer_t buffer;
	isc_result_t result;
	unsigned int bits, minbits = 4096;

	result = dns_db_getoriginnode(db, &node);
	if (result != ISC_R_SUCCESS)
		return (result);

	dns_rdataset_init(&rdataset);
	result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
				     0, 0, &rdataset, NULL);
	dns_db_detachnode(db, &node);
	if (result == ISC_R_NOTFOUND) {
		*iterationsp = 0;
		return (ISC_R_SUCCESS);
	}
	if (result != ISC_R_SUCCESS)
		goto failure;

	for (result = dns_rdataset_first(&rdataset);
	     result == ISC_R_SUCCESS;
	     result = dns_rdataset_next(&rdataset)) {
		dns_rdata_t rdata = DNS_RDATA_INIT;

		dns_rdataset_current(&rdataset, &rdata);
		isc_buffer_init(&buffer, rdata.data, rdata.length);
		isc_buffer_add(&buffer, rdata.length);
		CHECK(dst_key_fromdns(dns_db_origin(db), rdataset.rdclass,
				      &buffer, mctx, &key));
		bits = dst_key_size(key);
		dst_key_free(&key);
		if (minbits > bits)
			minbits = bits;
	}
	if (result != ISC_R_NOMORE)
		goto failure;

	if (minbits <= 1024)
		*iterationsp = 150;
	else if (minbits <= 2048)
		*iterationsp = 500;
	else
		*iterationsp = 2500;
	result = ISC_R_SUCCESS;

 failure:
	if (dns_rdataset_isassociated(&rdataset))
		dns_rdataset_disassociate(&rdataset);
	return (result);
}

isc_result_t
dns_nsec3_noexistnodata(dns_rdatatype_t type, dns_name_t* name,
			dns_name_t *nsec3name, dns_rdataset_t *nsec3set,
			dns_name_t *zonename, isc_boolean_t *exists,
			isc_boolean_t *data, isc_boolean_t *optout,
			isc_boolean_t *unknown, isc_boolean_t *setclosest,
			isc_boolean_t *setnearest, dns_name_t *closest,
			dns_name_t *nearest, dns_nseclog_t logit, void *arg)
{
	char namebuf[DNS_NAME_FORMATSIZE];
	dns_fixedname_t fzone;
	dns_fixedname_t qfixed;
	dns_label_t hashlabel;
	dns_name_t *qname;
	dns_name_t *zone;
	dns_rdata_nsec3_t nsec3;
	dns_rdata_t rdata = DNS_RDATA_INIT;
	int order;
	int scope;
	isc_boolean_t atparent;
	isc_boolean_t first;
	isc_boolean_t ns;
	isc_boolean_t soa;
	isc_buffer_t buffer;
	isc_result_t answer = ISC_R_IGNORE;
	isc_result_t result;
	unsigned char hash[NSEC3_MAX_HASH_LENGTH];
	unsigned char owner[NSEC3_MAX_HASH_LENGTH];
	unsigned int length;
	unsigned int qlabels;
	unsigned int zlabels;

	REQUIRE((exists == NULL && data == NULL) ||
		(exists != NULL && data != NULL));
	REQUIRE(nsec3set != NULL && nsec3set->type == dns_rdatatype_nsec3);
	REQUIRE((setclosest == NULL && closest == NULL) ||
		(setclosest != NULL && closest != NULL));
	REQUIRE((setnearest == NULL && nearest == NULL) ||
		(setnearest != NULL && nearest != NULL));

	result = dns_rdataset_first(nsec3set);
	if (result != ISC_R_SUCCESS) {
		(*logit)(arg, ISC_LOG_DEBUG(3), "failure processing NSEC3 set");
		return (result);
	}

	dns_rdataset_current(nsec3set, &rdata);

	result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
	if (result != ISC_R_SUCCESS)
		return (result);

	(*logit)(arg, ISC_LOG_DEBUG(3), "looking for relevant NSEC3");

	dns_fixedname_init(&fzone);
	zone = dns_fixedname_name(&fzone);
	zlabels = dns_name_countlabels(nsec3name);

	/*
	 * NSEC3 records must have two or more labels to be valid.
	 */
	if (zlabels < 2)
		return (ISC_R_IGNORE);

	/*
	 * Strip off the NSEC3 hash to get the zone.
	 */
	zlabels--;
	dns_name_split(nsec3name, zlabels, NULL, zone);

	/*
	 * If not below the zone name we can ignore this record.
	 */
	if (!dns_name_issubdomain(name, zone))
		return (ISC_R_IGNORE);

	/*
	 * Is this zone the same or deeper than the current zone?
	 */
	if (dns_name_countlabels(zonename) == 0 ||
	    dns_name_issubdomain(zone, zonename))
		dns_name_copy(zone, zonename, NULL);

	if (!dns_name_equal(zone, zonename))
		return (ISC_R_IGNORE);

	/*
	 * Are we only looking for the most enclosing zone?
	 */
	if (exists == NULL || data == NULL)
		return (ISC_R_SUCCESS);

	/*
	 * Only set unknown once we are sure that this NSEC3 is from
	 * the deepest covering zone.
	 */
	if (!dns_nsec3_supportedhash(nsec3.hash)) {
		if (unknown != NULL)
			*unknown = ISC_TRUE;
		return (ISC_R_IGNORE);
	}

	/*
	 * Recover the hash from the first label.
	 */
	dns_name_getlabel(nsec3name, 0, &hashlabel);
	isc_region_consume(&hashlabel, 1);
	isc_buffer_init(&buffer, owner, sizeof(owner));
	result = isc_base32hex_decoderegion(&hashlabel, &buffer);
	if (result != ISC_R_SUCCESS)
		return (result);

	/*
	 * The hash lengths should match.  If not ignore the record.
	 */
	if (isc_buffer_usedlength(&buffer) != nsec3.next_length)
		return (ISC_R_IGNORE);

	/*
	 * Work out what this NSEC3 covers.
	 * Inside (<0) or outside (>=0).
	 */
	scope = isc_safe_memcompare(owner, nsec3.next, nsec3.next_length);

	/*
	 * Prepare to compute all the hashes.
	 */
	dns_fixedname_init(&qfixed);
	qname = dns_fixedname_name(&qfixed);
	dns_name_downcase(name, qname, NULL);
	qlabels = dns_name_countlabels(qname);
	first = ISC_TRUE;

	while (qlabels >= zlabels) {
		length = isc_iterated_hash(hash, nsec3.hash, nsec3.iterations,
					   nsec3.salt, nsec3.salt_length,
					   qname->ndata, qname->length);
		/*
		 * The computed hash length should match.
		 */
		if (length != nsec3.next_length) {
			(*logit)(arg, ISC_LOG_DEBUG(3),
				 "ignoring NSEC bad length %u vs %u",
				 length, nsec3.next_length);
			return (ISC_R_IGNORE);
		}

		order = isc_safe_memcompare(hash, owner, length);
		if (first && order == 0) {
			/*
			 * The hashes are the same.
			 */
			atparent = dns_rdatatype_atparent(type);
			ns = dns_nsec3_typepresent(&rdata, dns_rdatatype_ns);
			soa = dns_nsec3_typepresent(&rdata, dns_rdatatype_soa);
			if (ns && !soa) {
				if (!atparent) {
					/*
					 * This NSEC3 record is from somewhere
					 * higher in the DNS, and at the
					 * parent of a delegation. It can not
					 * be legitimately used here.
					 */
					(*logit)(arg, ISC_LOG_DEBUG(3),
						 "ignoring parent NSEC3");
					return (ISC_R_IGNORE);
				}
			} else if (atparent && ns && soa) {
				/*
				 * This NSEC3 record is from the child.
				 * It can not be legitimately used here.
				 */
				(*logit)(arg, ISC_LOG_DEBUG(3),
					 "ignoring child NSEC3");
				return (ISC_R_IGNORE);
			}
			if (type == dns_rdatatype_cname ||
			    type == dns_rdatatype_nxt ||
			    type == dns_rdatatype_nsec ||
			    type == dns_rdatatype_key ||
			    !dns_nsec3_typepresent(&rdata, dns_rdatatype_cname)) {
				*exists = ISC_TRUE;
				*data = dns_nsec3_typepresent(&rdata, type);
				(*logit)(arg, ISC_LOG_DEBUG(3),
					 "NSEC3 proves name exists (owner) "
					 "data=%d", *data);
				return (ISC_R_SUCCESS);
			}
			(*logit)(arg, ISC_LOG_DEBUG(3),
				 "NSEC3 proves CNAME exists");
			return (ISC_R_IGNORE);
		}

		if (order == 0 &&
		    dns_nsec3_typepresent(&rdata, dns_rdatatype_ns) &&
		    !dns_nsec3_typepresent(&rdata, dns_rdatatype_soa))
		{
			/*
			 * This NSEC3 record is from somewhere higher in
			 * the DNS, and at the parent of a delegation.
			 * It can not be legitimately used here.
			 */
			(*logit)(arg, ISC_LOG_DEBUG(3),
				 "ignoring parent NSEC3");
			return (ISC_R_IGNORE);
		}

		/*
		 * Potential closest encloser.
		 */
		if (order == 0) {
			if (closest != NULL &&
			    (dns_name_countlabels(closest) == 0 ||
			     dns_name_issubdomain(qname, closest)) &&
			    !dns_nsec3_typepresent(&rdata, dns_rdatatype_ds) &&
			    !dns_nsec3_typepresent(&rdata, dns_rdatatype_dname) &&
			    (dns_nsec3_typepresent(&rdata, dns_rdatatype_soa) ||
			     !dns_nsec3_typepresent(&rdata, dns_rdatatype_ns)))
			{

				dns_name_format(qname, namebuf,
						sizeof(namebuf));
				(*logit)(arg, ISC_LOG_DEBUG(3),
					 "NSEC3 indicates potential closest "
					 "encloser: '%s'", namebuf);
				dns_name_copy(qname, closest, NULL);
				*setclosest = ISC_TRUE;
			}
			dns_name_format(qname, namebuf, sizeof(namebuf));
			(*logit)(arg, ISC_LOG_DEBUG(3),
				 "NSEC3 at super-domain %s", namebuf);
			return (answer);
		}

		/*
		 * Find if the name does not exist.
		 *
		 * We continue as we need to find the name closest to the
		 * closest encloser that doesn't exist.
		 *
		 * We also need to continue to ensure that we are not
		 * proving the non-existence of a record in a sub-zone.
		 * If that would be the case we will return ISC_R_IGNORE
		 * above.
		 */
		if ((scope < 0 && order > 0 &&
		     memcmp(hash, nsec3.next, length) < 0) ||
		    (scope >= 0 && (order > 0 ||
				    memcmp(hash, nsec3.next, length) < 0)))
		{
			dns_name_format(qname, namebuf, sizeof(namebuf));
			(*logit)(arg, ISC_LOG_DEBUG(3), "NSEC3 proves "
				 "name does not exist: '%s'", namebuf);
			if (nearest != NULL &&
			    (dns_name_countlabels(nearest) == 0 ||
			     dns_name_issubdomain(nearest, qname))) {
				dns_name_copy(qname, nearest, NULL);
				*setnearest = ISC_TRUE;
			}

			*exists = ISC_FALSE;
			*data = ISC_FALSE;
			if (optout != NULL) {
				if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0)
					(*logit)(arg, ISC_LOG_DEBUG(3),
						 "NSEC3 indicates optout");
				else
					(*logit)(arg, ISC_LOG_DEBUG(3),
						 "NSEC3 indicates secure range");
				*optout =
				    ISC_TF(nsec3.flags & DNS_NSEC3FLAG_OPTOUT);
			}
			answer = ISC_R_SUCCESS;
		}

		qlabels--;
		if (qlabels > 0)
			dns_name_split(qname, qlabels, NULL, qname);
		first = ISC_FALSE;
	}
	return (answer);
}