resolve conflicts; undo many local changes that have been done upstream trunk
authorchristos <christos@NetBSD.org>
Sat, 01 Mar 2014 03:24:32 +0000
branchtrunk
changeset 225017 8c6d5e59d121
parent 225016 d57ae16b73ff
child 225018 05df410dda42
resolve conflicts; undo many local changes that have been done upstream differently.
external/bsd/bind/dist/CHANGES
external/bsd/bind/dist/acconfig.h
external/bsd/bind/dist/bin/check/check-tool.c
external/bsd/bind/dist/bin/check/check-tool.h
external/bsd/bind/dist/bin/check/named-checkconf.8
external/bsd/bind/dist/bin/check/named-checkconf.c
external/bsd/bind/dist/bin/check/named-checkzone.8
external/bsd/bind/dist/bin/check/named-checkzone.c
external/bsd/bind/dist/bin/confgen/ddns-confgen.c
external/bsd/bind/dist/bin/confgen/rndc-confgen.8
external/bsd/bind/dist/bin/confgen/rndc-confgen.c
external/bsd/bind/dist/bin/dig/dig.1
external/bsd/bind/dist/bin/dig/dig.c
external/bsd/bind/dist/bin/dig/dighost.c
external/bsd/bind/dist/bin/dig/host.c
external/bsd/bind/dist/bin/dig/include/dig/dig.h
external/bsd/bind/dist/bin/dig/nslookup.1
external/bsd/bind/dist/bin/dig/nslookup.c
external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c
external/bsd/bind/dist/bin/dnssec/dnssec-importkey.c
external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8
external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c
external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8
external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c
external/bsd/bind/dist/bin/dnssec/dnssec-revoke.8
external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c
external/bsd/bind/dist/bin/dnssec/dnssec-settime.8
external/bsd/bind/dist/bin/dnssec/dnssec-settime.c
external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8
external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c
external/bsd/bind/dist/bin/dnssec/dnssec-verify.8
external/bsd/bind/dist/bin/dnssec/dnssec-verify.c
external/bsd/bind/dist/bin/dnssec/dnssectool.c
external/bsd/bind/dist/bin/dnssec/dnssectool.h
external/bsd/bind/dist/bin/named/bind.keys.h
external/bsd/bind/dist/bin/named/bind9.ver3.xsl
external/bsd/bind/dist/bin/named/bind9.ver3.xsl.h
external/bsd/bind/dist/bin/named/bind9.xsl.h
external/bsd/bind/dist/bin/named/bindkeys.pl
external/bsd/bind/dist/bin/named/builtin.c
external/bsd/bind/dist/bin/named/client.c
external/bsd/bind/dist/bin/named/config.c
external/bsd/bind/dist/bin/named/control.c
external/bsd/bind/dist/bin/named/controlconf.c
external/bsd/bind/dist/bin/named/include/named/client.h
external/bsd/bind/dist/bin/named/include/named/config.h
external/bsd/bind/dist/bin/named/include/named/control.h
external/bsd/bind/dist/bin/named/include/named/globals.h
external/bsd/bind/dist/bin/named/include/named/interfacemgr.h
external/bsd/bind/dist/bin/named/include/named/listenlist.h
external/bsd/bind/dist/bin/named/include/named/query.h
external/bsd/bind/dist/bin/named/include/named/server.h
external/bsd/bind/dist/bin/named/interfacemgr.c
external/bsd/bind/dist/bin/named/listenlist.c
external/bsd/bind/dist/bin/named/lwaddr.c
external/bsd/bind/dist/bin/named/lwdgnba.c
external/bsd/bind/dist/bin/named/lwdgrbn.c
external/bsd/bind/dist/bin/named/lwresd.c
external/bsd/bind/dist/bin/named/main.c
external/bsd/bind/dist/bin/named/named.8
external/bsd/bind/dist/bin/named/named.conf.5
external/bsd/bind/dist/bin/named/named.conf.docbook
external/bsd/bind/dist/bin/named/named.conf.html
external/bsd/bind/dist/bin/named/query.c
external/bsd/bind/dist/bin/named/server.c
external/bsd/bind/dist/bin/named/statschannel.c
external/bsd/bind/dist/bin/named/tkeyconf.c
external/bsd/bind/dist/bin/named/unix/dlz_dlopen_driver.c
external/bsd/bind/dist/bin/named/unix/os.c
external/bsd/bind/dist/bin/named/update.c
external/bsd/bind/dist/bin/named/win32/os.c
external/bsd/bind/dist/bin/named/xfrout.c
external/bsd/bind/dist/bin/named/zoneconf.c
external/bsd/bind/dist/bin/nsupdate/nsupdate.1
external/bsd/bind/dist/bin/nsupdate/nsupdate.c
external/bsd/bind/dist/bin/pkcs11/include/pkcs11.h
external/bsd/bind/dist/bin/pkcs11/include/pkcs11f.h
external/bsd/bind/dist/bin/pkcs11/include/pkcs11t.h
external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0k-patch
external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1e-patch
external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.8
external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.c
external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.8
external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.c
external/bsd/bind/dist/bin/pkcs11/pkcs11-list.c
external/bsd/bind/dist/bin/pkcs11/unix/cryptoki.h
external/bsd/bind/dist/bin/pkcs11/unix/unix.c
external/bsd/bind/dist/bin/pkcs11/win32/cryptoki.h
external/bsd/bind/dist/bin/pkcs11/win32/win32.c
external/bsd/bind/dist/bin/rndc/rndc.8
external/bsd/bind/dist/bin/rndc/rndc.c
external/bsd/bind/dist/bin/rndc/rndc.conf.5
external/bsd/bind/dist/bin/tests/adb_test.c
external/bsd/bind/dist/bin/tests/backtrace_test.c
external/bsd/bind/dist/bin/tests/byaddr_test.c
external/bsd/bind/dist/bin/tests/byname_test.c
external/bsd/bind/dist/bin/tests/cfg_test.c
external/bsd/bind/dist/bin/tests/compress_test.c
external/bsd/bind/dist/bin/tests/db_test.c
external/bsd/bind/dist/bin/tests/dst/dst_test.c
external/bsd/bind/dist/bin/tests/dst/gsstest.c
external/bsd/bind/dist/bin/tests/dst/t_dst.c
external/bsd/bind/dist/bin/tests/entropy2_test.c
external/bsd/bind/dist/bin/tests/entropy_test.c
external/bsd/bind/dist/bin/tests/fsaccess_test.c
external/bsd/bind/dist/bin/tests/gxba_test.c
external/bsd/bind/dist/bin/tests/gxbn_test.c
external/bsd/bind/dist/bin/tests/hash_test.c
external/bsd/bind/dist/bin/tests/inter_test.c
external/bsd/bind/dist/bin/tests/keyboard_test.c
external/bsd/bind/dist/bin/tests/lex_test.c
external/bsd/bind/dist/bin/tests/lfsr_test.c
external/bsd/bind/dist/bin/tests/log_test.c
external/bsd/bind/dist/bin/tests/lwres_test.c
external/bsd/bind/dist/bin/tests/lwresconf_test.c
external/bsd/bind/dist/bin/tests/master_test.c
external/bsd/bind/dist/bin/tests/mempool_test.c
external/bsd/bind/dist/bin/tests/name_test.c
external/bsd/bind/dist/bin/tests/names/t_names.c
external/bsd/bind/dist/bin/tests/net/driver.c
external/bsd/bind/dist/bin/tests/nsecify.c
external/bsd/bind/dist/bin/tests/ratelimiter_test.c
external/bsd/bind/dist/bin/tests/rbt_test.c
external/bsd/bind/dist/bin/tests/rdata_test.c
external/bsd/bind/dist/bin/tests/resolver/t_resolver.c
external/bsd/bind/dist/bin/tests/rwlock_test.c
external/bsd/bind/dist/bin/tests/serial_test.c
external/bsd/bind/dist/bin/tests/shutdown_test.c
external/bsd/bind/dist/bin/tests/sig0_test.c
external/bsd/bind/dist/bin/tests/sock_test.c
external/bsd/bind/dist/bin/tests/sym_test.c
external/bsd/bind/dist/bin/tests/system/ecdsa/prereq.sh.in
external/bsd/bind/dist/bin/tests/system/filter-aaaa/filter-aaaa.c
external/bsd/bind/dist/bin/tests/system/filter-aaaa/ns1/named.conf
external/bsd/bind/dist/bin/tests/system/filter-aaaa/ns2/named.conf
external/bsd/bind/dist/bin/tests/system/filter-aaaa/ns3/named.conf
external/bsd/bind/dist/bin/tests/system/filter-aaaa/ns4/named.conf
external/bsd/bind/dist/bin/tests/system/gost/prereq.sh.in
external/bsd/bind/dist/bin/tests/system/lwresd/lwtest.c
external/bsd/bind/dist/bin/tests/system/resolver/ns7/named.conf
external/bsd/bind/dist/bin/tests/system/rrl/Makefile.in
external/bsd/bind/dist/bin/tests/system/rrl/prereq.sh
external/bsd/bind/dist/bin/tests/system/rrl/rrl.c
external/bsd/bind/dist/bin/tests/system/rsabigexponent/bigkey.c
external/bsd/bind/dist/bin/tests/system/stub/tests.sh
external/bsd/bind/dist/bin/tests/system/tkey/keycreate.c
external/bsd/bind/dist/bin/tests/system/tkey/keydelete.c
external/bsd/bind/dist/bin/tests/task_test.c
external/bsd/bind/dist/bin/tests/timer_test.c
external/bsd/bind/dist/bin/tests/wire_test.c
external/bsd/bind/dist/bin/tests/zone_test.c
external/bsd/bind/dist/bin/tools/genrandom.c
external/bsd/bind/dist/bin/tools/isc-hmac-fixup.c
external/bsd/bind/dist/config.h.in
external/bsd/bind/dist/configure.in
external/bsd/bind/dist/contrib/check-secure-delegation.pl.in
external/bsd/bind/dist/contrib/check5011.pl
external/bsd/bind/dist/contrib/dlz/drivers/dlz_bdb_driver.c
external/bsd/bind/dist/contrib/dlz/drivers/dlz_bdbhpt_driver.c
external/bsd/bind/dist/contrib/dlz/drivers/dlz_filesystem_driver.c
external/bsd/bind/dist/contrib/dlz/drivers/dlz_ldap_driver.c
external/bsd/bind/dist/contrib/dlz/drivers/dlz_mysql_driver.c
external/bsd/bind/dist/contrib/dlz/drivers/dlz_odbc_driver.c
external/bsd/bind/dist/contrib/dlz/drivers/dlz_postgres_driver.c
external/bsd/bind/dist/contrib/dlz/drivers/dlz_stub_driver.c
external/bsd/bind/dist/contrib/dlz/example/dlz_example.c
external/bsd/bind/dist/contrib/dlz/modules/dlz_minimal.h
external/bsd/bind/dist/contrib/linux/coredump-patch
external/bsd/bind/dist/contrib/named-bootconf/named-bootconf.sh
external/bsd/bind/dist/contrib/nanny/nanny.pl
external/bsd/bind/dist/contrib/nslint-2.1a3/CHANGES
external/bsd/bind/dist/contrib/nslint-2.1a3/FILES
external/bsd/bind/dist/contrib/nslint-2.1a3/INSTALL
external/bsd/bind/dist/contrib/nslint-2.1a3/Makefile.in
external/bsd/bind/dist/contrib/nslint-2.1a3/README
external/bsd/bind/dist/contrib/nslint-2.1a3/VERSION
external/bsd/bind/dist/contrib/nslint-2.1a3/aclocal.m4
external/bsd/bind/dist/contrib/nslint-2.1a3/config.guess
external/bsd/bind/dist/contrib/nslint-2.1a3/config.sub
external/bsd/bind/dist/contrib/nslint-2.1a3/configure
external/bsd/bind/dist/contrib/nslint-2.1a3/configure.in
external/bsd/bind/dist/contrib/nslint-2.1a3/install-sh
external/bsd/bind/dist/contrib/nslint-2.1a3/lbl/gnuc.h
external/bsd/bind/dist/contrib/nslint-2.1a3/lbl/os-irix5.h
external/bsd/bind/dist/contrib/nslint-2.1a3/lbl/os-osf3.h
external/bsd/bind/dist/contrib/nslint-2.1a3/lbl/os-solaris2.h
external/bsd/bind/dist/contrib/nslint-2.1a3/lbl/os-sunos4.h
external/bsd/bind/dist/contrib/nslint-2.1a3/lbl/os-ultrix4.h
external/bsd/bind/dist/contrib/nslint-2.1a3/mkdep
external/bsd/bind/dist/contrib/nslint-2.1a3/nslint.8
external/bsd/bind/dist/contrib/nslint-2.1a3/nslint.c
external/bsd/bind/dist/contrib/nslint-2.1a3/savestr.c
external/bsd/bind/dist/contrib/nslint-2.1a3/savestr.h
external/bsd/bind/dist/contrib/nslint-2.1a3/strerror.c
external/bsd/bind/dist/contrib/pkcs11-keygen/README
external/bsd/bind/dist/contrib/query-loc-0.4.0/loc_ntoa.c
external/bsd/bind/dist/contrib/queryperf/queryperf.c
external/bsd/bind/dist/contrib/zkt/CHANGELOG
external/bsd/bind/dist/contrib/zkt/LICENSE
external/bsd/bind/dist/contrib/zkt/Makefile.in
external/bsd/bind/dist/contrib/zkt/README
external/bsd/bind/dist/contrib/zkt/README.logging
external/bsd/bind/dist/contrib/zkt/TODO
external/bsd/bind/dist/contrib/zkt/config.h.in
external/bsd/bind/dist/contrib/zkt/config_zkt.h
external/bsd/bind/dist/contrib/zkt/configure
external/bsd/bind/dist/contrib/zkt/configure.ac
external/bsd/bind/dist/contrib/zkt/debug.h
external/bsd/bind/dist/contrib/zkt/dki.c
external/bsd/bind/dist/contrib/zkt/dki.h
external/bsd/bind/dist/contrib/zkt/dnssec-zkt.c
external/bsd/bind/dist/contrib/zkt/doc/KeyRollover.ms
external/bsd/bind/dist/contrib/zkt/domaincmp.c
external/bsd/bind/dist/contrib/zkt/domaincmp.h
external/bsd/bind/dist/contrib/zkt/examples/dnssec.conf
external/bsd/bind/dist/contrib/zkt/examples/flat/dyn.example.net/Kdyn.example.net.+007+30323.key
external/bsd/bind/dist/contrib/zkt/examples/flat/dyn.example.net/Kdyn.example.net.+007+30323.private
external/bsd/bind/dist/contrib/zkt/examples/flat/dyn.example.net/Kdyn.example.net.+007+52935.key
external/bsd/bind/dist/contrib/zkt/examples/flat/dyn.example.net/Kdyn.example.net.+007+52935.private
external/bsd/bind/dist/contrib/zkt/examples/flat/dyn.example.net/zktlog-dyn.example.net.
external/bsd/bind/dist/contrib/zkt/examples/flat/example.net/Kexample.net.+008+08406.key
external/bsd/bind/dist/contrib/zkt/examples/flat/example.net/Kexample.net.+008+08406.private
external/bsd/bind/dist/contrib/zkt/examples/flat/example.net/Kexample.net.+008+36257.key
external/bsd/bind/dist/contrib/zkt/examples/flat/example.net/Kexample.net.+008+36257.private
external/bsd/bind/dist/contrib/zkt/examples/flat/example.net/dnssec.conf
external/bsd/bind/dist/contrib/zkt/examples/flat/example.net/z.db
external/bsd/bind/dist/contrib/zkt/examples/flat/example.net/zktlog-example.net.
external/bsd/bind/dist/contrib/zkt/examples/flat/sub.example.net/Ksub.example.net.+007+02048.key
external/bsd/bind/dist/contrib/zkt/examples/flat/sub.example.net/Ksub.example.net.+007+02048.published
external/bsd/bind/dist/contrib/zkt/examples/flat/sub.example.net/Ksub.example.net.+007+41747.key
external/bsd/bind/dist/contrib/zkt/examples/flat/sub.example.net/Ksub.example.net.+007+41747.private
external/bsd/bind/dist/contrib/zkt/examples/flat/sub.example.net/Ksub.example.net.+007+42834.key
external/bsd/bind/dist/contrib/zkt/examples/flat/sub.example.net/Ksub.example.net.+007+42834.private
external/bsd/bind/dist/contrib/zkt/examples/flat/sub.example.net/zktlog-sub.example.net.
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/Kexample.de.+005+09743.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/Kexample.de.+005+09743.published
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/Kexample.de.+005+39599.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/Kexample.de.+005+39599.private
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+07295.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+07295.private
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+08544.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+08544.private
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+27861.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+27861.private
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+40559.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+40559.published
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+42639.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+42639.private
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+63530.depreciated
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/de/example.de/sub.example.de/Ksub.example.de.+005+63530.key
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/log/zktlog-example.de.
external/bsd/bind/dist/contrib/zkt/examples/hierarchical/log/zktlog-sub.example.de.
external/bsd/bind/dist/contrib/zkt/examples/zkt-ls.sh
external/bsd/bind/dist/contrib/zkt/examples/zkt-signer.sh
external/bsd/bind/dist/contrib/zkt/log.c
external/bsd/bind/dist/contrib/zkt/log.h
external/bsd/bind/dist/contrib/zkt/man/dnssec-zkt.8
external/bsd/bind/dist/contrib/zkt/man/dnssec-zkt.8.pdf
external/bsd/bind/dist/contrib/zkt/man/zkt-conf.8
external/bsd/bind/dist/contrib/zkt/man/zkt-conf.8.html
external/bsd/bind/dist/contrib/zkt/man/zkt-conf.8.org
external/bsd/bind/dist/contrib/zkt/man/zkt-conf.8.pdf
external/bsd/bind/dist/contrib/zkt/man/zkt-keyman.8
external/bsd/bind/dist/contrib/zkt/man/zkt-keyman.8.html
external/bsd/bind/dist/contrib/zkt/man/zkt-keyman.8.pdf
external/bsd/bind/dist/contrib/zkt/man/zkt-ls.8
external/bsd/bind/dist/contrib/zkt/man/zkt-ls.8.html
external/bsd/bind/dist/contrib/zkt/man/zkt-ls.8.pdf
external/bsd/bind/dist/contrib/zkt/man/zkt-signer.8
external/bsd/bind/dist/contrib/zkt/man/zkt-signer.8.html
external/bsd/bind/dist/contrib/zkt/man/zkt-signer.8.pdf
external/bsd/bind/dist/contrib/zkt/misc.c
external/bsd/bind/dist/contrib/zkt/misc.h
external/bsd/bind/dist/contrib/zkt/ncparse.c
external/bsd/bind/dist/contrib/zkt/ncparse.h
external/bsd/bind/dist/contrib/zkt/nscomm.c
external/bsd/bind/dist/contrib/zkt/nscomm.h
external/bsd/bind/dist/contrib/zkt/rollover.c
external/bsd/bind/dist/contrib/zkt/rollover.h
external/bsd/bind/dist/contrib/zkt/soaserial.c
external/bsd/bind/dist/contrib/zkt/soaserial.h
external/bsd/bind/dist/contrib/zkt/strlist.c
external/bsd/bind/dist/contrib/zkt/strlist.h
external/bsd/bind/dist/contrib/zkt/tcap.c
external/bsd/bind/dist/contrib/zkt/tcap.h
external/bsd/bind/dist/contrib/zkt/zconf.c
external/bsd/bind/dist/contrib/zkt/zconf.h
external/bsd/bind/dist/contrib/zkt/zfparse.c
external/bsd/bind/dist/contrib/zkt/zfparse.h
external/bsd/bind/dist/contrib/zkt/zkt-conf.c
external/bsd/bind/dist/contrib/zkt/zkt-keyman.c
external/bsd/bind/dist/contrib/zkt/zkt-ls.c
external/bsd/bind/dist/contrib/zkt/zkt-signer.c
external/bsd/bind/dist/contrib/zkt/zkt-soaserial.c
external/bsd/bind/dist/contrib/zkt/zkt.c
external/bsd/bind/dist/contrib/zkt/zkt.h
external/bsd/bind/dist/contrib/zkt/zone.c
external/bsd/bind/dist/contrib/zkt/zone.h
external/bsd/bind/dist/contrib/zone-edit.sh.in
external/bsd/bind/dist/doc/arm/Bv9ARM.pdf
external/bsd/bind/dist/doc/misc/options
external/bsd/bind/dist/lib/bind9/check.c
external/bsd/bind/dist/lib/bind9/getaddresses.c
external/bsd/bind/dist/lib/dns/acl.c
external/bsd/bind/dist/lib/dns/adb.c
external/bsd/bind/dist/lib/dns/byaddr.c
external/bsd/bind/dist/lib/dns/cache.c
external/bsd/bind/dist/lib/dns/callbacks.c
external/bsd/bind/dist/lib/dns/client.c
external/bsd/bind/dist/lib/dns/db.c
external/bsd/bind/dist/lib/dns/diff.c
external/bsd/bind/dist/lib/dns/dispatch.c
external/bsd/bind/dist/lib/dns/dlz.c
external/bsd/bind/dist/lib/dns/dns64.c
external/bsd/bind/dist/lib/dns/dnssec.c
external/bsd/bind/dist/lib/dns/ds.c
external/bsd/bind/dist/lib/dns/dst_api.c
external/bsd/bind/dist/lib/dns/dst_internal.h
external/bsd/bind/dist/lib/dns/dst_parse.c
external/bsd/bind/dist/lib/dns/dst_parse.h
external/bsd/bind/dist/lib/dns/dst_result.c
external/bsd/bind/dist/lib/dns/ecdb.c
external/bsd/bind/dist/lib/dns/forward.c
external/bsd/bind/dist/lib/dns/gen-win32.h
external/bsd/bind/dist/lib/dns/gssapi_link.c
external/bsd/bind/dist/lib/dns/hmac_link.c
external/bsd/bind/dist/lib/dns/include/dns/acl.h
external/bsd/bind/dist/lib/dns/include/dns/adb.h
external/bsd/bind/dist/lib/dns/include/dns/cache.h
external/bsd/bind/dist/lib/dns/include/dns/callbacks.h
external/bsd/bind/dist/lib/dns/include/dns/client.h
external/bsd/bind/dist/lib/dns/include/dns/db.h
external/bsd/bind/dist/lib/dns/include/dns/diff.h
external/bsd/bind/dist/lib/dns/include/dns/dispatch.h
external/bsd/bind/dist/lib/dns/include/dns/dlz.h
external/bsd/bind/dist/lib/dns/include/dns/ds.h
external/bsd/bind/dist/lib/dns/include/dns/forward.h
external/bsd/bind/dist/lib/dns/include/dns/journal.h
external/bsd/bind/dist/lib/dns/include/dns/log.h
external/bsd/bind/dist/lib/dns/include/dns/master.h
external/bsd/bind/dist/lib/dns/include/dns/masterdump.h
external/bsd/bind/dist/lib/dns/include/dns/message.h
external/bsd/bind/dist/lib/dns/include/dns/name.h
external/bsd/bind/dist/lib/dns/include/dns/peer.h
external/bsd/bind/dist/lib/dns/include/dns/rbt.h
external/bsd/bind/dist/lib/dns/include/dns/rdataset.h
external/bsd/bind/dist/lib/dns/include/dns/request.h
external/bsd/bind/dist/lib/dns/include/dns/resolver.h
external/bsd/bind/dist/lib/dns/include/dns/rpz.h
external/bsd/bind/dist/lib/dns/include/dns/sdlz.h
external/bsd/bind/dist/lib/dns/include/dns/stats.h
external/bsd/bind/dist/lib/dns/include/dns/types.h
external/bsd/bind/dist/lib/dns/include/dns/validator.h
external/bsd/bind/dist/lib/dns/include/dns/version.h
external/bsd/bind/dist/lib/dns/include/dns/view.h
external/bsd/bind/dist/lib/dns/include/dns/xfrin.h
external/bsd/bind/dist/lib/dns/include/dns/zone.h
external/bsd/bind/dist/lib/dns/include/dst/dst.h
external/bsd/bind/dist/lib/dns/include/dst/result.h
external/bsd/bind/dist/lib/dns/journal.c
external/bsd/bind/dist/lib/dns/keydata.c
external/bsd/bind/dist/lib/dns/lib.c
external/bsd/bind/dist/lib/dns/log.c
external/bsd/bind/dist/lib/dns/master.c
external/bsd/bind/dist/lib/dns/masterdump.c
external/bsd/bind/dist/lib/dns/message.c
external/bsd/bind/dist/lib/dns/name.c
external/bsd/bind/dist/lib/dns/nsec.c
external/bsd/bind/dist/lib/dns/nsec3.c
external/bsd/bind/dist/lib/dns/openssldh_link.c
external/bsd/bind/dist/lib/dns/openssldsa_link.c
external/bsd/bind/dist/lib/dns/opensslecdsa_link.c
external/bsd/bind/dist/lib/dns/opensslgost_link.c
external/bsd/bind/dist/lib/dns/opensslrsa_link.c
external/bsd/bind/dist/lib/dns/peer.c
external/bsd/bind/dist/lib/dns/portlist.c
external/bsd/bind/dist/lib/dns/rbt.c
external/bsd/bind/dist/lib/dns/rbtdb.c
external/bsd/bind/dist/lib/dns/rcode.c
external/bsd/bind/dist/lib/dns/rdata.c
external/bsd/bind/dist/lib/dns/rdata/ch_3/a_1.c
external/bsd/bind/dist/lib/dns/rdata/generic/afsdb_18.c
external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c
external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c
external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c
external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c
external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c
external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c
external/bsd/bind/dist/lib/dns/rdata/generic/rt_21.c
external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c
external/bsd/bind/dist/lib/dns/rdata/generic/spf_99.c
external/bsd/bind/dist/lib/dns/rdata/generic/txt_16.c
external/bsd/bind/dist/lib/dns/rdata/hs_4/a_1.c
external/bsd/bind/dist/lib/dns/rdata/in_1/a6_38.c
external/bsd/bind/dist/lib/dns/rdata/in_1/a_1.c
external/bsd/bind/dist/lib/dns/rdata/in_1/aaaa_28.c
external/bsd/bind/dist/lib/dns/rdata/in_1/apl_42.c
external/bsd/bind/dist/lib/dns/rdata/in_1/wks_11.c
external/bsd/bind/dist/lib/dns/rdataslab.c
external/bsd/bind/dist/lib/dns/request.c
external/bsd/bind/dist/lib/dns/resolver.c
external/bsd/bind/dist/lib/dns/rootns.c
external/bsd/bind/dist/lib/dns/rpz.c
external/bsd/bind/dist/lib/dns/rrl.c
external/bsd/bind/dist/lib/dns/sdb.c
external/bsd/bind/dist/lib/dns/sdlz.c
external/bsd/bind/dist/lib/dns/spnego.c
external/bsd/bind/dist/lib/dns/ssu.c
external/bsd/bind/dist/lib/dns/stats.c
external/bsd/bind/dist/lib/dns/tests/Makefile.in
external/bsd/bind/dist/lib/dns/tests/master_test.c
external/bsd/bind/dist/lib/dns/time.c
external/bsd/bind/dist/lib/dns/tkey.c
external/bsd/bind/dist/lib/dns/tsig.c
external/bsd/bind/dist/lib/dns/ttl.c
external/bsd/bind/dist/lib/dns/validator.c
external/bsd/bind/dist/lib/dns/version.c
external/bsd/bind/dist/lib/dns/view.c
external/bsd/bind/dist/lib/dns/win32/version.c
external/bsd/bind/dist/lib/dns/xfrin.c
external/bsd/bind/dist/lib/dns/zone.c
external/bsd/bind/dist/lib/dns/zt.c
external/bsd/bind/dist/lib/export/Makefile.in
external/bsd/bind/dist/lib/export/dns/Makefile.in
external/bsd/bind/dist/lib/export/dns/include/Makefile.in
external/bsd/bind/dist/lib/export/dns/include/dns/Makefile.in
external/bsd/bind/dist/lib/export/dns/include/dst/Makefile.in
external/bsd/bind/dist/lib/export/irs/Makefile.in
external/bsd/bind/dist/lib/export/irs/include/Makefile.in
external/bsd/bind/dist/lib/export/irs/include/irs/Makefile.in
external/bsd/bind/dist/lib/export/isc/Makefile.in
external/bsd/bind/dist/lib/export/isc/include/Makefile.in
external/bsd/bind/dist/lib/export/isc/include/isc/Makefile.in
external/bsd/bind/dist/lib/export/isc/include/isc/bind9.h
external/bsd/bind/dist/lib/export/isc/nls/Makefile.in
external/bsd/bind/dist/lib/export/isc/nothreads/Makefile.in
external/bsd/bind/dist/lib/export/isc/nothreads/include/Makefile.in
external/bsd/bind/dist/lib/export/isc/nothreads/include/isc/Makefile.in
external/bsd/bind/dist/lib/export/isc/pthreads/Makefile.in
external/bsd/bind/dist/lib/export/isc/pthreads/include/Makefile.in
external/bsd/bind/dist/lib/export/isc/pthreads/include/isc/Makefile.in
external/bsd/bind/dist/lib/export/isc/unix/Makefile.in
external/bsd/bind/dist/lib/export/isc/unix/include/Makefile.in
external/bsd/bind/dist/lib/export/isc/unix/include/isc/Makefile.in
external/bsd/bind/dist/lib/export/isccfg/Makefile.in
external/bsd/bind/dist/lib/export/isccfg/include/Makefile.in
external/bsd/bind/dist/lib/export/isccfg/include/isccfg/Makefile.in
external/bsd/bind/dist/lib/export/samples/Makefile-postinstall.in
external/bsd/bind/dist/lib/export/samples/Makefile.in
external/bsd/bind/dist/lib/export/samples/nsprobe.c
external/bsd/bind/dist/lib/export/samples/sample-async.c
external/bsd/bind/dist/lib/export/samples/sample-gai.c
external/bsd/bind/dist/lib/export/samples/sample-request.c
external/bsd/bind/dist/lib/export/samples/sample-update.c
external/bsd/bind/dist/lib/export/samples/sample.c
external/bsd/bind/dist/lib/irs/getaddrinfo.c
external/bsd/bind/dist/lib/irs/include/irs/resconf.h
external/bsd/bind/dist/lib/irs/resconf.c
external/bsd/bind/dist/lib/isc/app_api.c
external/bsd/bind/dist/lib/isc/base32.c
external/bsd/bind/dist/lib/isc/base64.c
external/bsd/bind/dist/lib/isc/bitstring.c
external/bsd/bind/dist/lib/isc/buffer.c
external/bsd/bind/dist/lib/isc/commandline.c
external/bsd/bind/dist/lib/isc/entropy.c
external/bsd/bind/dist/lib/isc/hash.c
external/bsd/bind/dist/lib/isc/heap.c
external/bsd/bind/dist/lib/isc/hex.c
external/bsd/bind/dist/lib/isc/hmacmd5.c
external/bsd/bind/dist/lib/isc/hmacsha.c
external/bsd/bind/dist/lib/isc/httpd.c
external/bsd/bind/dist/lib/isc/include/isc/app.h
external/bsd/bind/dist/lib/isc/include/isc/bind9.h
external/bsd/bind/dist/lib/isc/include/isc/bitstring.h
external/bsd/bind/dist/lib/isc/include/isc/buffer.h
external/bsd/bind/dist/lib/isc/include/isc/file.h
external/bsd/bind/dist/lib/isc/include/isc/hmacmd5.h
external/bsd/bind/dist/lib/isc/include/isc/hmacsha.h
external/bsd/bind/dist/lib/isc/include/isc/httpd.h
external/bsd/bind/dist/lib/isc/include/isc/log.h
external/bsd/bind/dist/lib/isc/include/isc/md5.h
external/bsd/bind/dist/lib/isc/include/isc/mem.h
external/bsd/bind/dist/lib/isc/include/isc/namespace.h
external/bsd/bind/dist/lib/isc/include/isc/radix.h
external/bsd/bind/dist/lib/isc/include/isc/sha1.h
external/bsd/bind/dist/lib/isc/include/isc/sha2.h
external/bsd/bind/dist/lib/isc/include/isc/socket.h
external/bsd/bind/dist/lib/isc/include/isc/stats.h
external/bsd/bind/dist/lib/isc/include/isc/string.h
external/bsd/bind/dist/lib/isc/include/isc/symtab.h
external/bsd/bind/dist/lib/isc/include/isc/task.h
external/bsd/bind/dist/lib/isc/include/isc/timer.h
external/bsd/bind/dist/lib/isc/include/isc/types.h
external/bsd/bind/dist/lib/isc/inet_aton.c
external/bsd/bind/dist/lib/isc/inet_pton.c
external/bsd/bind/dist/lib/isc/lex.c
external/bsd/bind/dist/lib/isc/lib.c
external/bsd/bind/dist/lib/isc/log.c
external/bsd/bind/dist/lib/isc/md5.c
external/bsd/bind/dist/lib/isc/mem.c
external/bsd/bind/dist/lib/isc/mem_api.c
external/bsd/bind/dist/lib/isc/netaddr.c
external/bsd/bind/dist/lib/isc/radix.c
external/bsd/bind/dist/lib/isc/sha1.c
external/bsd/bind/dist/lib/isc/sha2.c
external/bsd/bind/dist/lib/isc/sockaddr.c
external/bsd/bind/dist/lib/isc/socket_api.c
external/bsd/bind/dist/lib/isc/stats.c
external/bsd/bind/dist/lib/isc/string.c
external/bsd/bind/dist/lib/isc/strtoul.c
external/bsd/bind/dist/lib/isc/symtab.c
external/bsd/bind/dist/lib/isc/task.c
external/bsd/bind/dist/lib/isc/task_api.c
external/bsd/bind/dist/lib/isc/task_p.h
external/bsd/bind/dist/lib/isc/timer.c
external/bsd/bind/dist/lib/isc/timer_api.c
external/bsd/bind/dist/lib/isc/unix/app.c
external/bsd/bind/dist/lib/isc/unix/errno2result.c
external/bsd/bind/dist/lib/isc/unix/file.c
external/bsd/bind/dist/lib/isc/unix/ifiter_getifaddrs.c
external/bsd/bind/dist/lib/isc/unix/ifiter_ioctl.c
external/bsd/bind/dist/lib/isc/unix/ifiter_sysctl.c
external/bsd/bind/dist/lib/isc/unix/include/isc/net.h
external/bsd/bind/dist/lib/isc/unix/include/isc/time.h
external/bsd/bind/dist/lib/isc/unix/interfaceiter.c
external/bsd/bind/dist/lib/isc/unix/net.c
external/bsd/bind/dist/lib/isc/unix/socket.c
external/bsd/bind/dist/lib/isc/unix/time.c
external/bsd/bind/dist/lib/isc/win32/app.c
external/bsd/bind/dist/lib/isc/win32/errno2result.c
external/bsd/bind/dist/lib/isc/win32/file.c
external/bsd/bind/dist/lib/isc/win32/include/isc/net.h
external/bsd/bind/dist/lib/isc/win32/include/isc/thread.h
external/bsd/bind/dist/lib/isc/win32/include/isc/time.h
external/bsd/bind/dist/lib/isc/win32/interfaceiter.c
external/bsd/bind/dist/lib/isc/win32/net.c
external/bsd/bind/dist/lib/isc/win32/socket.c
external/bsd/bind/dist/lib/isc/win32/time.c
external/bsd/bind/dist/lib/isccc/cc.c
external/bsd/bind/dist/lib/isccc/include/isccc/cc.h
external/bsd/bind/dist/lib/isccc/include/isccc/util.h
external/bsd/bind/dist/lib/isccc/sexpr.c
external/bsd/bind/dist/lib/isccfg/aclconf.c
external/bsd/bind/dist/lib/isccfg/include/isccfg/aclconf.h
external/bsd/bind/dist/lib/isccfg/include/isccfg/cfg.h
external/bsd/bind/dist/lib/isccfg/include/isccfg/grammar.h
external/bsd/bind/dist/lib/isccfg/namedconf.c
external/bsd/bind/dist/lib/isccfg/parser.c
external/bsd/bind/dist/lib/lwres/context.c
external/bsd/bind/dist/lib/lwres/getaddrinfo.c
external/bsd/bind/dist/lib/lwres/gethost.c
external/bsd/bind/dist/lib/lwres/getipnode.c
external/bsd/bind/dist/lib/lwres/getrrset.c
external/bsd/bind/dist/lib/lwres/herror.c
external/bsd/bind/dist/lib/lwres/lwbuffer.c
external/bsd/bind/dist/lib/lwres/lwconfig.c
external/bsd/bind/dist/lib/lwres/lwinetaton.c
external/bsd/bind/dist/lib/lwres/lwinetpton.c
external/bsd/bind/dist/lib/lwres/lwresutil.c
external/bsd/bind/dist/lib/lwres/strtoul.c
external/bsd/bind/dist/lib/tests/include/tests/t_api.h
external/bsd/bind/dist/lib/tests/t_api.c
external/bsd/bind/dist/m4/libtool.m4
external/bsd/bind/dist/m4/ltoptions.m4
external/bsd/bind/dist/m4/ltsugar.m4
external/bsd/bind/dist/m4/ltversion.m4
external/bsd/bind/dist/m4/lt~obsolete.m4
external/bsd/bind/dist/make/rules.in
external/bsd/bind/dist/srcid
external/bsd/bind/dist/version
external/bsd/bind/dist/win32utils/legacy/BINDBuild.dsw.in
external/bsd/bind/include/config.h
external/bsd/bind/include/dns/code.h
external/bsd/bind/include/dns/enumclass.h
external/bsd/bind/include/dns/enumtype.h
external/bsd/bind/include/dns/rdatastruct.h
external/bsd/bind/include/isc/platform.h
external/bsd/bind/include/lwres/netdb.h
external/bsd/bind/include/lwres/platform.h
external/bsd/bind/lib/libbind9/shlib_version
external/bsd/bind/lib/libdns/Makefile
external/bsd/bind/lib/libdns/shlib_version
external/bsd/bind/lib/libisc/Makefile
external/bsd/bind/lib/libisc/shlib_version
external/bsd/bind/lib/libisccc/shlib_version
external/bsd/bind/lib/libisccfg/shlib_version
external/bsd/bind/lib/liblwres/shlib_version
--- a/external/bsd/bind/dist/CHANGES	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/CHANGES	Sat Mar 01 03:24:32 2014 +0000
@@ -1,4 +1,308 @@
-	--- 9.9.5b1 released ---
+	--- 9.10.0b1 released ---
+
+3755.	[func]		Add stats counters for known EDNS options + others.
+			[RT #35447]
+
+3754.	[cleanup]	win32: Installer now places files in the
+			Program Files area rather than system services.
+			[RT #35361]
+
+3753.	[bug]		allow-notify was ignoring keys. [RT #35425]
+
+3752.	[bug]		Address potential REQUIRE failure if
+			DNS_STYLEFLAG_COMMENTDATA is set when printing out
+			a rdataset.
+
+3751.	[tuning]	The default setting for the -U option (setting
+			the number of UDP listeners per interface) has
+			been adjusted to improve performance. [RT #35417]
+
+3750.	[experimental]	Partially implement EDNS EXPIRE option as described
+			in draft-andrews-dnsext-expire-00.  Retrieval of
+			the remaining time until expiry for slave zones
+			is supported.
+
+			EXPIRE uses an experimental option code (65002),
+			which is subject to change. [RT #35416]
+
+3749.	[func]		"dig +subnet" sends an EDNS client subnet option
+			containing the specified address/prefix when
+			querying. (Thanks to Wilmer van der Gaast.)
+			[RT #35415]
+
+3748.	[test]		Use delve to test dns_client interfaces. [RT #35383]
+
+3747.	[bug]		A race condition could lead to a core dump when
+			destroying a resolver fetch object. [RT #35385]
+
+3746.	[func]		New "max-zone-ttl" option enforces maximum
+			TTLs for zones. If loading a zone containing a
+			higher TTL, the load fails. DDNS updates with
+			higher TTLs are accepted but the TTL is truncated.
+			(Note: Currently supported for master zones only;
+			inline-signing slaves will be added.) [RT #38405]
+
+3745.	[func]		"configure --with-tuning=large" adjusts various
+			compiled-in constants and default settings to
+			values suited to large servers with abundant
+			memory. [RT #29538]
+
+3744.	[experimental]	SIT: send and process Source Identity Tokens
+			(similar to DNS Cookies by Donald Eastlake 3rd),
+			which are designed to help clients detect off-path
+			spoofed responses and for servers to identify
+			legitimate clients.
+
+			SIT uses an experimental EDNS option code (65001),
+			which will be changed to an IANA-assigned value
+			if the experiment is deemed a success.
+
+			SIT can be enabled via "configure --enable-sit" (or
+			--enable-developer). It is enabled by default in
+			Windows.
+
+			Servers can be configured to send smaller responses
+			to clients that have not identified themselves via
+			SIT.  RRL processing has also been updated;
+			legitimate clients are not subject to rate
+			limiting. [RT #35389]
+
+3743.	[bug]		delegation-only flag wasn't working in forward zone
+			declarations despite being documented.  This is
+			needed to support turning off forwarding and turning
+			on delegation only at the same name.  [RT #35392]
+
+3742.	[port]		linux: libcap support: declare curval at start of
+			block. [RT #35387]
+
+3741.	[func]		"delve" (domain entity lookup and validation engine):
+			A new tool with dig-like semantics for performing DNS
+			lookups, with internal DNSSEC validation, using the
+			same resolver and validator logic as named. This
+			allows easy validation of DNSSEC data in environments
+			with untrustworthy resolvers, and assists with
+			troubleshooting of DNSSEC problems. (Note: not yet
+			available on win32.) [RT #32406]
+
+3740.	[contrib]	Minor fixes to configure --with-dlz-bdb,
+			--with-dlz-postgres and --with-dlz-odbc. [RT #35340]
+
+3739.	[func]		Added per-zone stats counters to track TCP and
+			UDP queries. [RT #35375]
+
+3738.	[bug]		--enable-openssl-hash failed to build. [RT #35343]
+
+3737.	[bug]		'rndc retransfer' could trigger a assertion failure
+			with inline zones. [RT #35353]
+
+3736.	[bug]		nsupdate: When specifying a server by name,
+			fall back to alternate addresses if the first
+			address for that name is not reachable. [RT #25784]
+
+3735.	[cleanup]	Merged the libiscpk11 library into libisc
+			to simplify dependencies. [RT #35205]
+
+3734.	[bug]		Improve building with libtool. [RT #35314]
+
+3733.	[func]		Improve interface scanning support.  Interface
+			information will be automatically updated if the
+			OS supports routing sockets (MacOS, *BSD, Linux).
+			Use "automatic-interface-scan no;" to disable.
+
+			Add "rndc scan" to trigger a scan. [RT #23027]
+
+3732.	[contrib]	Fixed a type mismatch causing the ODBC DLZ
+			driver to dump core on 64-bit systems. [RT #35324]
+
+3731.	[func]		Added a "no-case-compress" ACL, which causes
+			named to use case-insensitive compression
+			(disabling change #3645) for specified
+			clients. (This is useful when dealing
+			with broken client implementations that
+			use case-sensitive name comparisons,
+			rejecting responses that fail to match the
+			capitalization of the query that was sent.)
+			[RT #35300]
+
+3730.	[cleanup]	Added "never" as a synonym for "none" when
+			configuring key event dates in the dnssec tools.
+			[RT #35277]
+
+3729.	[bug]		dnssec-keygen could set the publication date
+			incorrectly when only the activation date was
+			specified on the command line. [RT #35278]
+
+3728.	[doc]		Expanded native-PKCS#11 documentation,
+			specifically pkcs11: URI labels. [RT #35287]
+
+3727.	[func]		The isc_bitstring API is no longer used and
+			has been removed from libisc. [RT #35284]
+
+3726.	[cleanup]	Clarified the error message when attempting
+			to configure more than 32 response-policy zones.
+			[RT #35283]
+
+3725.	[contrib]	Updated zkt and nslint to newest versions,
+			cleaned up and rearranged the contrib
+			directory, and added a README.
+
+	--- 9.10.0a2 released ---
+
+3724.	[bug]		win32: Fixed a bug that prevented dig and
+			host from exiting properly after completing
+			a UDP query. [RT #35288]
+
+3723.	[cleanup]	Imported keys are now handled the same way
+			regardless of DNSSEC algorithm. [RT #35215]
+
+3722.	[bug]		Using geoip ACLs in a blackhole statement
+			could cause a segfault. [RT #35272]
+
+3721.	[doc]		Improved documentation of the EDNS processing
+			enhancements introduced in change #3593. [RT #35275]
+
+3720.	[bug]		Address compiler warnings. [RT #35261]
+
+3719.	[bug]		Address memory leak in in peer.c. [RT #35255]
+
+3718.	[bug]		A missing ISC_LINK_INIT in log.c. [RT #35260]
+
+3717.	[port]		hpux: Treat EOPNOTSUPP as a expected error code when
+			probing to see if it is possible to set dscp values
+			on a per packet basis. [RT #35252]
+
+3716.	[bug]		The dns_request code was setting dcsp values when not
+			requested.  [RT #35252]
+
+3715.	[bug]		The region and city databases could fail to
+			initialize when using some versions of libGeoIP,
+			causing assertion failures when named was
+			configured to use them. [RT #35427]
+
+3714.	[test]		System tests that need to test for cryptography
+			support before running can now use a common
+			"testcrypto.sh" script to do so. [RT #35213]
+
+3713.	[bug]		Save memory by not storing "also-notify" addresses
+			in zone objects that are configured not to send
+			notify requests. [RT #35195]
+
+3712.	[placeholder]
+
+3711.	[placeholder]
+
+3710.	[bug]		Address double dns_zone_detach when switching to
+			using automatic empty zones from regular zones.
+			[RT #35177]
+
+3709.	[port]		Use built-in versions of strptime() and timegm()
+			on all platforms to avoid portability issues.
+			[RT #35183]
+
+3708.	[bug]		Address a portentry locking issue in dispatch.c.
+			[RT #35128]
+
+3707.	[bug]		irs_resconf_load now returns ISC_R_FILENOTFOUND
+			on a missing resolv.conf file and initializes the
+			structure as if it had been configured with:
+
+				nameserver ::1
+				nameserver 127.0.0.1
+
+			Note: Callers will need to be updated to treat
+			ISC_R_FILENOTFOUND as a qualified success or else
+			they will leak memory. The following code fragment
+			will work with both old and new versions without
+			changing the behaviour of the existing code.
+
+			resconf = NULL;
+			result = irs_resconf_load(mctx, "/etc/resolv.conf",
+						  &resconf);
+			if (result != ISC_SUCCESS) {
+				if (resconf != NULL)
+					irs_resconf_destroy(&resconf);
+				....
+			}
+
+			[RT #35194]
+
+3706.	[contrib]	queryperf: Fixed a possible integer overflow when
+			printing results. [RT #35182]
+
+3705.	[func]		"configure --enable-native-pkcs11" enables BIND
+			to use the PKCS#11 API for all cryptographic
+			functions, so that it can drive a hardware service
+			module directly without the need to use a modified
+			OpenSSL as intermediary (so long as the HSM's vendor
+			provides a complete-enough implementation of the
+			PKCS#11 interface). This has been tested successfully
+			with the Thales nShield HSM and with SoftHSMv2 from
+			the OpenDNSSEC project. [RT #29031]
+
+3704.	[protocol]	Accept integer timestamps in RRSIG records. [RT #35185]
+
+3703.	[func]		To improve recursive resolver performance, cache
+			records which are still being requested by clients
+			can now be automatically refreshed from the
+			authoritative server before they expire, reducing
+			or eliminating the time window in which no answer
+			is available in the cache. See the "prefetch" option
+			for more details. [RT #35041]
+
+3702.	[func]		'dnssec-coverage -l' option specifies a length
+			of time to check for coverage; events further into
+			the future are ignored.  'dnssec-coverage -z'
+			checks only ZSK events, and 'dnssec-coverage -k'
+			checks only KSK events.  (Thanks to Peter Palfrader.)
+			[RT #35168]
+
+3701.	[func]		named-checkconf can now obscure shared secrets
+			when printing by specifying '-x'. [RT #34465]
+
+3700.	[func]		Allow access to subgroups of XML statistics via
+			special URLs http://<server>:<port>/xml/v3/server,
+			/zones, /net, /tasks, /mem, and /status.  [RT #35115]
+
+3699.	[bug]		Improvements to statistics channel XSL stylesheet:
+			the stylesheet can now be cached by the browser;
+			section headers are omitted from the stats display
+			when there is no data in those sections to be
+			displayed; counters are now right-justified for
+			easier readability. [RT #35117]
+
+3698.	[cleanup]	Replaced all uses of memcpy() with memmove().
+			[RT #35120]
+
+3697.	[bug]		Handle "." as a search list element when IDN support
+			is enabled. [RT #35133]
+
+3696.	[bug]		dig failed to handle AXFR style IXFR responses which
+			span multiple messages. [RT #35137]
+
+3695.	[bug]		Address a possible race in dispatch.c. [RT #35107]
+
+3694.	[bug]		Warn when a key-directory is configured for a zone,
+			but does not exist or is not a directory. [RT #35108]
+
+3693.	[security]	memcpy was incorrectly called with overlapping
+			ranges resulting in malformed names being generated
+			on some platforms.  This could cause INSIST failures
+			when serving NSEC3 signed zones (CVE-2014-0591).
+			[RT #35120]
+
+3692.	[bug]		Two calls to dns_db_getoriginnode were fatal if there
+			was no data at the node. [RT #35080]
+
+3691.	[contrib]	Address null pointer dereference in LDAP and
+			MySQL DLZ modules.
+
+3690.	[bug]		Iterative responses could be missed when the source
+			port for an upstream query was the same as the
+			listener port (53). [RT #34925]
+
+3689.	[bug]		Fixed a bug causing an insecure delegation from one
+			static-stub zone to another to fail with a broken
+			trust chain. [RT #35081]
 
 3688.	[bug]		loadnode could return a freed node on out of memory.
 			[RT #35106]
@@ -13,6 +317,9 @@
 3685.	[bug]		"rndc refresh" didn't work correctly with slave
 			zones using inline-signing. [RT #35105]
 
+3684.	[bug]		The list of included files would grow on reload.
+			[RT 35090]
+
 3683.	[cleanup]	Add a more detailed "not found" message to rndc
 			commands which specify a zone name. [RT #35059]
 
@@ -24,6 +331,9 @@
 			selection and WIN64 builds.  This is a work in
 			progress. [RT #34160]
 
+3680.	[bug]		Ensure buffer space is available in "rndc zonestatus".
+			[RT #35084]
+
 3679.	[bug]		dig could fail to clean up TCP sockets still
 			waiting on connect(). [RT #35074]
 
@@ -39,8 +349,13 @@
 			information for their extensions in the version
 			file by setting the EXTENSIONS variable.
 
+	--- 9.10.0a1 released ---
+
 3674.	[bug]		RPZ zeroed ttls if the query type was '*'. [RT #35026]
 
+3673.	[func]		New "in-view" zone option allows direct sharing
+			of zones between views. [RT #32968]
+
 3672.	[func]		Local address can now be specified when using
 			dns_client API. [RT #34811]
 
@@ -58,6 +373,12 @@
 3667.	[test]		dig: add support to keep the TCP socket open between
 			successive queries (+[no]keepopen).  [RT #34918]
 
+3666.	[func]		Add a tool, named-rrchecker, for checking the syntax
+			of individual resource records.  This tool is intended
+			to be called by provisioning systems so that the front
+			end does not need to be upgraded to support new DNS
+			record types. [RT #34778]
+
 3665.	[bug]		Failure to release lock on error in receive_secure_db.
 			[RT #34944]
 
@@ -75,7 +396,7 @@
 3660.	[cleanup]	Changed the name of "isc-config.sh" to "bind9-config".
 			[RT #23825]
 
-3659.	[port]		solaris: don't add explict dependancies/rules for
+3659.	[port]		solaris: don't add explict dependencies/rules for
 			python programs as make won't use the implicit rules.
 			[RT #34835]
 
@@ -85,8 +406,10 @@
 3657.	[port]		Some readline clones don't accept NULL pointers when
 			calling add_history. [RT #34842]
 
-3656.	[bug]		Treat an all zero netmask as invalid when generating
-			the localnets acl. [RT #34687]
+3656.	[security]	Treat an all zero netmask as invalid when generating
+			the localnets acl. (The prior behavior could
+			allow unexpected matches when using some versions
+			of Winsock: CVE-2013-6320.) [RT #34687]
 
 3655.	[cleanup]	Simplify TCP message processing when requesting a
 			zone transfer.  [RT #34825]
@@ -97,6 +420,8 @@
 3653.	[func]		Create delegations for all "children" of empty zones
 			except "forward first". [RT #34826]
 
+3652.	[bug]		Address bug with rpz-drop policy. [RT #34816]
+
 3651.	[tuning]	Adjust when a master server is deemed unreachable.
 			[RT #27075]
 
@@ -121,6 +446,8 @@
 3644.	[protocol]	Check that EDNS subnet client options are well formed.
 			[RT #34718]
 
+3643.	[doc]		Clarify RRL "slip" documentation.
+
 3642.	[func]		Allow externally generated DNSKEY to be imported
 			into the DNSKEY management framework.  A new tool
 			dnssec-importkey is used to do this. [RT #34698]
@@ -135,15 +462,9 @@
 3639.	[bug]		Treat type 65533 (KEYDATA) as opaque except when used
 			in a key zone. [RT #34238]
 
-	--- 9.9.4 released ---
-
-3643.	[doc]		Clarify RRL "slip" documentation.
-
 3638.	[cleanup]	Add the ability to handle ENOPROTOOPT in case it is
 			encountered. [RT #34668]
 
-	--- 9.9.4rc2 released ---
-
 3637.	[bug]		'allow-query-on' was checking the source address
 			rather than the destination address. [RT #34590]
 
@@ -167,20 +488,45 @@
 
 3630.	[bug]		Ensure correct ID computation for MD5 keys. [RT #33033]
 
+3629.	[func]		Allow the printing of cryptographic fields in DNSSEC
+			records by dig to be suppressed (dig +nocrypto).
+			[RT #34534]
+
+3628.	[func]		Report DNSKEY key id's when dumping the cache.
+			[RT #34533]
+
 3627.	[bug]		RPZ changes were not effective on slaves. [RT #34450]
 
+3626.	[func]		dig: NSID output now easier to read. [RT #21160]
+
 3625.	[bug]		Don't send notify messages to machines outside of the
 			test setup.
 
-3623.	[bug]		zone-statistics was only effective in new statistics.
-			[RT #34466]
-
-	--- 9.9.4rc1 released ---
+3624.	[bug]		Look for 'json_object_new_int64' when looking for a
+			the json library. [RT #34449]
+
+3623.	[placeholder]
+
+3622.	[tuning]	Eliminate an unnecessary lock when incrementing
+			cache statistics. [RT #34339]
 
 3621.	[security]	Incorrect bounds checking on private type 'keydata'
 			can lead to a remotely triggerable REQUIRE failure
 			(CVE-2013-4854). [RT #34238]
 
+3620.	[func]		Added "rpz-client-ip" policy triggers, enabling
+			RPZ responses to be configured on the basis of
+			the client IP address; this can be used, for
+			example, to blacklist misbehaving recursive
+			or stub resolvers. [RT #33605]
+
+3619.	[bug]		Fixed a bug in RPZ with "recursive-only no;"
+			[RT #33776]
+
+3618.	[func]		"rndc reload" now checks modification times of
+			include files as well as master files to determine
+			whether to skip reloading a zone. [RT #33936]
+
 3617.	[bug]		Named was failing to answer queries during
 			"rndc reload" [RT #34098]
 
@@ -196,12 +542,17 @@
 3613.	[bug]		named could crash when deleting inline-signing
 			zones with "rndc delzone". [RT #34066]
 
+3612.	[port]		Check whether to use -ljson or -ljson-c. [RT #34115]
+
 3611.	[bug]		Improved resistance to a theoretical authentication
 			attack based on differential timing.  [RT #33939]
 
 3610.	[cleanup]	win32: Some executables had been omitted from the
 			installer. [RT #34116]
 
+3609.	[bug]		Corrected a possible deadlock in applications using
+			the export version of the isc_app API. [RT #33967]
+
 3608.	[port]		win32: added todos.pl script to ensure all text files
 			the win32 build depends on are converted to DOS
 			newline format. [RT #22067]
@@ -209,13 +560,23 @@
 3607.	[bug]		dnssec-keygen had broken 'Invalid keyfile' error
 			message. [RT #34045]
 
-	--- 9.9.4b1 released ---
+3606.	[func]		"rndc flushtree" now flushes matching
+			records in the address database and bad cache
+			as well as the DNS cache. (Previously only the
+			DNS cache was flushed.) [RT #33970]
 
 3605.	[port]		win32: Addressed several compatibility issues
 			with newer versions of Visual Studio. [RT #33916]
 
+3604.	[bug]		Fixed a compile-time error when building with
+			JSON but not XML. [RT #33959]
+
 3603.	[bug]		Install <isc/stat.h>. [RT #33956]
 
+3602.	[contrib]	Added DLZ Perl module, allowing Perl scripts to
+			integrate with named and serve DNS data.
+			(Contributed by John Eaglesham of Yahoo.)
+
 3601.	[bug]		Added to PKCS#11 openssl patches a value len
 			attribute in DH derive key. [RT #33928]
 
@@ -225,19 +586,37 @@
 3599.	[tuning]	Check for pointer equivalence in name comparisons.
 			[RT #18125]
 
+3598.	[cleanup]	Improved portability of map file code. [RT #33820]
+
+3597.	[bug]		Ensure automatic-resigning heaps are reconstructed
+			when loading zones in map format. [RT #33381]
+
 3596.	[port]		Updated win32 build documentation, added
 			dnssec-verify. [RT #22067]
 
+3595.	[port]		win32: Fix build problems introduced by change #3550.
+			[RT #33807]
+
 3594.	[maint]		Update config.guess and config.sub. [RT #33816]
 
+3593.	[func]		Update EDNS processing to better track remote server
+			capabilities. [RT #30655]
+
 3592.	[doc]		Moved documentation of rndc command options to the
 			rndc man page. [RT #33506]
 
+3591.	[func]		Use CRC-64 to detect map file corruption at load
+			time. [RT #33746]
+
 3590.	[bug]		When using RRL on recursive servers, defer
 			rate-limiting until after recursion is complete;
 			also, use correct rcode for slipped NXDOMAIN
 			responses.  [RT #33604]
 
+3589.	[func]		Report serial numbers in when starting zone transfers.
+			Report accepted NOTIFY requests including serial.
+			[RT# 33037]
+
 3588.	[bug]		dig: addressed a memory leak in the sigchase code
 			that could cause a shutdown crash.  [RT #33733]
 
@@ -246,6 +625,9 @@
 
 3586.	[bug]		Handle errors in xmlDocDumpFormatMemoryEnc. [RT #33706]
 
+3585.	[func]		"rndc delzone -clean" option removes zone files
+			when deleting a zone. [RT #33570]
+
 3584.	[security]	Caching data from an incompletely signed zone could
 			trigger an assertion failure in resolver.c
 			(CVE-2013-3919). [RT #33690]
@@ -279,42 +661,38 @@
 			zone names containing punctuation marks and other
 			nonstandard characters. [RT #33419]
 
+3572.	[func]		Threads are now enabled by default on most
+			operating systems. [RT #25483]
+
 3571.	[bug]		Address race condition in dns_client_startresolve().
 			[RT #33234]
 
-3566.	[func]		Log when forwarding updates to master. [RT #33240]
-
-3554.	[bug]		RRL failed to correctly rate-limit upward
-			referrals and failed to count dropped error
-			responses in the statistics. [RT #33225]
-
-3545.	[bug]		RRL slip behavior was incorrect when set to 1.
-			[RT #33111]
-
-3518.	[bug]		Increase the size of dns_rrl_key.s.rtype by one bit
-			so that all dns_rrl_rtype_t enum values fit regardless
-			of whether it is teated as signed or unsigned by
-			the compiler. [RT #32792]
-
-3494.	[func]		DNS RRL: Blunt the impact of DNS reflection and
-			amplification attacks by rate-limiting substantially-
-			identical responses. To enable, use "configure
-			--enable-rrl". [RT #28130]
-
-	--- 9.9.3 released ---
+3570.	[bug]		Check internal pointers are valid when loading map
+			files. [RT #33403]
+
+3569.	[contrib]	Ported mysql DLZ driver to dynamically-loadable
+			module, and added multithread support. [RT #33394]
 
 3568.	[cleanup]	Add a product description line to the version file,
 			to be reported by named -v/-V. [RT #33366]
 
 3567.	[bug]		Silence clang static analyzer warnings. [RT #33365]
 
+3566.	[func]		Log when forwarding updates to master. [RT #33240]
+
+3565.	[placeholder]
+
+3564.	[bug]		Improved handling of corrupted map files. [RT #33380]
+
 3563.	[contrib]	zone2sqlite failed with some table names. [RT #33375]
 
+3562.	[func]		Update map file header format to include a SHA-1 hash
+			of the database content, so that corrupted map files
+			can be rejected at load time. [RT #32459]
+
 3561.	[bug]		dig: issue a warning if an EDNS query returns FORMERR
 			or NOTIMP.  Adjust usage message. [RT #33363]
 
-	--- 9.9.3rc2 released ---
-
 3560.	[bug]		isc-config.sh did not honor includedir and libdir
 			when set via configure. [RT #33345]
 
@@ -330,11 +708,21 @@
 3555.	[bug]		Address theoretical race conditions in acache.c
 			(change #3553 was incomplete). [RT #33252]
 
+3554.	[bug]		RRL failed to correctly rate-limit upward
+			referrals and failed to count dropped error
+			responses in the statistics. [RT #33225]
+
 3553.	[bug]		Address suspected double free in acache. [RT #33252]
 
 3552.	[bug]		Wrong getopt option string for 'nsupdate -r'.
 			[RT #33280]
 
+3551.	[bug]		resolver.querydscp[46] were uninitialized.  [RT #32686]
+
+3550.	[func]		Unified the internal and export versions of the
+			BIND libraries, allowing external clients to use
+			the same libraries as BIND. [RT #33131]
+
 3549.	[doc]		Documentation for "request-nsid" was missing.
 			[RT #33153]
 
@@ -345,10 +733,11 @@
 3547.	[bug]		Some malformed unknown rdata records were not properly
 			detected and rejected. [RT #33129]
 
-	--- 9.9.3rc1 released ---
-
 3546.	[func]		Add EUI48 and EUI64 types. [RT #33082]
 
+3545.	[bug]		RRL slip behavior was incorrect when set to 1.
+			[RT #33111]
+
 3544.	[contrib]	check5011.pl: Script to report the status of
 			managed keys as recorded in managed-keys.bind.
 			Contributed by Tony Finch <dot@dotat.at>
@@ -356,6 +745,8 @@
 3543.	[bug]		Update socket structure before attaching to socket
 			manager after accept. [RT #33084]
 
+3542.	[placeholder]
+
 3541.	[bug]		Parts of libdns were not properly initialized when
 			built in libexport mode. [RT #33028]
 
@@ -370,6 +761,15 @@
 			to peers before being dumped to disk rather than
 			after. [RT #27242]
 
+3536.	[func]		Add support for setting Differentiated Services Code
+			Point (DSCP) values in named.  Most configuration
+			options which take a "port" option (e.g.,
+			listen-on, forwarders, also-notify, masters,
+			notify-source, etc) can now also take a "dscp"
+			option specifying a code point for use with
+			outgoing traffic, if supported by the underlying
+			OS. [RT #27596]
+
 3535.	[bug]		Minor win32 cleanups. [RT #32962]
 
 3534.	[bug]		Extra text after an embedded NULL was ignored when
@@ -384,6 +784,11 @@
 
 3530.	[contrib]	Better RTT tracking in queryperf. [RT #30128]
 
+3529.	[func]		Named now listens on both IPv4 and IPv6 interfaces
+			by default.  Named previously only listened on IPv4
+			interfaces by default unless named was running in
+			IPv6 only mode.  [RT #32945]
+
 3528.	[func]		New "dnssec-coverage" command scans the timing
 			metadata for a set of DNSSEC keys and reports if a
 			lapse in signing coverage has been scheduled
@@ -398,15 +803,43 @@
 3526.	[cleanup]	Set up dependencies for unit tests correctly during
 			build. [RT #32803]
 
+3525.	[func]		Support for additional signing algorithms in rndc:
+			hmac-sha1, -sha224, -sha256, -sha384, and -sha512.
+			The -A option to rndc-confgen can be used to
+			select the algorithm for the generated key.
+			(The default is still hmac-md5; this may
+			change in a future release.) [RT #20363]
+
+3524.	[func]		Added an alternate statistics channel in JSON format,
+			when the server is built with the json-c library:
+			http://[address]:[port]/json. [RT #32630]
+
+3523.	[contrib]	Ported filesystem and ldap DLZ drivers to
+			dynamically-loadable modules, and added the
+			"wildcard" module based on a contribution from
+			Vadim Goncharov <vgoncharov@nic.ru>. [RT #23569]
+
+3522.	[bug]		DLZ lookups could fail to return SERVFAIL when
+			they ought to. [RT #32685]
+
 3521.	[bug]		Address memory leak in opensslecdsa_link.c. [RT #32249]
 
 3520.	[bug]		'mctx' was not being referenced counted in some places
 			where it should have been.  [RT #32794]
 
-	--- 9.9.3b2 released ---
+3519.	[func]		Full replay protection via four-way handshake is
+			now mandatory for rndc clients. Very old versions
+			of rndc will no longer work. [RT #32798]
+
+3518.	[bug]		Increase the size of dns_rrl_key.s.rtype by one bit
+			so that all dns_rrl_rtype_t enum values fit regardless
+			of whether it is teated as signed or unsigned by
+			the compiler. [RT #32792]
 
 3517.	[bug]		Reorder destruction to avoid shutdown race. [RT #32777]
 
+3516.	[placeholder]
+
 3515.	[port]		'%T' is not portable in strftime(). [RT #32763]
 
 3514.	[bug]		The ranges for valid key sizes in ddns-confgen and
@@ -415,8 +848,17 @@
 			to 1024 bits for hmac-sha384 and hmac-sha512.
 			[RT #32753]
 
+3513.	[func]		"dig -u" prints times in microseconds rather than
+			milliseconds. [RT #32704]
+
+3512.	[func]		"rndc validation check" reports the current status
+			of DNSSEC validation. [RT #21397]
+
 3511.	[doc]		Improve documentation of redirect zones. [RT #32756]
 
+3510.	[func]		"rndc status" and XML statistics channel now report
+			server start and reconfiguration times. [RT #21048]
+
 3509.	[cleanup]	Added a product line to version file to allow for
 			easy naming of different products (BIND
 			vs BIND ESV, for example). [RT #32755]
@@ -424,11 +866,15 @@
 3508.	[contrib]	queryperf was incorrectly rejecting the -T option.
 			[RT #32338]
 
-3507.	[bug]		Statistics channel XSL (when built with
-			--enable-newstats) had a glitch when attempting
+3507.	[bug]		Statistics channel XSL had a glitch when attempting
 			to chart query data before any queries had been
 			received. [RT #32620]
 
+3506.	[func]		When setting "max-cache-size" and "max-acache-size",
+			the keyword "unlimited" is no longer defined as equal
+			to 4 gigabytes (except on 32-bit platforms); it
+			means literally unlimited. [RT #32358]
+
 3505.	[bug]		When setting "max-cache-size" and "max-acache-size",
 			larger values than 4 gigabytes could not be set
 			explicitly, though larger sizes were available
@@ -436,8 +882,16 @@
 			corrected; the full range is now available.
 			[RT #32358]
 
+3504.	[func]		Add support for ACLs based on geographic location,
+			using MaxMind GeoIP databases. Based on code
+			contributed by Ken Brownfield <kb@slide.com>.
+			[RT #30681]
+
 3503.	[doc]		Clarify size_spec syntax. [RT #32449]
 
+3502.	[func]		zone-statistics: "no" is now a synonym for "none",
+			instead of "terse". [RT #29165]
+
 3501.	[func]		zone-statistics now takes three options: full,
 			terse, and none. "yes" and "no" are retained as
 			synonyms for full and terse, respectively. [RT #29165]
@@ -454,13 +908,24 @@
 			empty zone could have their zone-statistics setting
 			overridden.
 
-3496.	[func]		Improvements to RPZ performance. The "response-policy"
+3497.	[func]		When deleting a slave/stub zone using 'rndc delzone'
+			report the files that were being used so they can
+			be cleaned up if desired. [RT #27899]
+
+3496.	[placeholder]
+
+3495.	[func]		Support multiple response-policy zones (up to 32),
+			while improving RPZ performance.  "response-policy"
 			syntax now includes a "min-ns-dots" clause, with
 			default 1, to exclude top-level domains from
 			NSIP and NSDNAME checking. --enable-rpz-nsip and
 			--enable-rpz-nsdname are now the default. [RT #32251]
 
-3493.	[contrib]	Added BDBHPT dynamically-lodable DLZ module,
+3494.	[func]		DNS RRL: Blunt the impact of DNS reflection and
+			amplification attacks by rate-limiting substantially-
+			identical responses. [RT #28130]
+
+3493.	[contrib]	Added BDBHPT dynamically-loadable DLZ module,
 			contributed by Mark Goldfinch. [RT #32549]
 
 3492.	[bug]		Fixed a regression in zone loading performance
@@ -469,9 +934,13 @@
 3491.	[bug]		Slave zones using inline-signing must specify a
 			file name. [RT #31946]
 
+3490.	[bug]		When logging RDATA during update, truncate if it's
+			too long. [RT #32365]
+
 3489.	[bug]		--enable-developer now turns on ISC_LIST_CHECKINIT.
-			When cloning a rdataset do not copy the link contents.
-			[RT #32651]
+			dns_dlzcreate() failed to properly initialize
+			dlzdb.link.  When cloning a rdataset do not copy
+			the link contents.  [RT #32651]
 
 3488.	[bug]		Use after free error with DH generated keys. [RT #32649]
 
@@ -484,9 +953,15 @@
 
 3485.	[cleanup]	Only compile openssl_gostlink.c if we support GOST.
 
-3483.	[bug]		Corrected XSL code in use with --enable-newstats.
+3484.	[bug]		Some statistics were incorrectly rendered in XML.
 			[RT #32587]
 
+3483.	[placeholder]
+
+3482.	[func]		dig +nssearch now prints name servers that don't
+			have address records (missing AAAA or A, or the name
+			doesn't exist). [RT #29348]
+
 3481.	[cleanup]	Removed use of const const in atf.
 
 3480.	[bug]		Silence logging noise when setting up zone
@@ -498,6 +973,15 @@
 3478.	[port]		Fix a build failure in strict C99 environments
 			[RT #32475]
 
+3477.	[func]		Expand logging when adding records via DDNS update
+			[RT #32365]
+
+3476.	[bug]		"rndc zonestatus" could report a spurious "not
+			found" error on inline-signing zones. [RT #29226]
+
+3475.	[cleanup]	Changed name of 'map' zone file format (previously
+			'fast'). [RT #32458]
+
 3474.	[bug]		nsupdate could assert when the local and remote
 			address families didn't match. [RT #22897]
 
@@ -505,6 +989,9 @@
 			an error condition due to an empty node above an
 			opt-out delegation lacking an NSEC3. [RT #32072]
 
+3472.	[bug]		The active-connections counter in the socket
+			statistics could underflow. [RT #31747]
+
 3471.	[bug]		The number of UDP dispatches now defaults to
 			the number of CPUs even if -n has been set to
 			a higher value. [RT #30964]
@@ -512,7 +999,9 @@
 3470.	[bug]		Slave zones could fail to dump when successfully
 			refreshing after an initial failure. [RT #31276]
 
-	--- 9.9.3b1 released ---
+3469.	[bug]		Handle DLZ lookup failures more gracefully. Improve
+			backward compatibility between versions of DLZ dlopen
+			API. [RT #32275]
 
 3468.	[security]	RPZ rules to generate A records (but not AAAA records)
 			could trigger an assertion failure when used in
@@ -539,6 +1028,9 @@
 
 3460.	[bug]		Only link against readline where needed. [RT #29810]
 
+3459.	[func]		Added -J option to named-checkzone/named-compilezone
+			to specify the path to the journal file. [RT #30958]
+
 3458.	[bug]		Return FORMERR when presented with a overly long
 			domain named in a request. [RT #29682]
 
@@ -590,7 +1082,7 @@
 3440.	[bug]		Reorder get_key_struct to not trigger a assertion when
 			cleaning up due to out of memory error. [RT #32131]
 
-3439.	[bug]		contrib/dlz error checking fixes. [RT #32102]
+3439.	[placeholder]
 
 3438.	[bug]		Don't accept unknown data escape in quotes. [RT #32031]
 
@@ -602,6 +1094,24 @@
 3435.	[bug]		Cross compilation support in configure was broken.
 			[RT #32078]
 
+3434.	[bug]		Pass client info to the DLZ findzone() entry
+			point in addition to lookup().  This makes it
+			possible for a database to answer differently
+			whether it's authoritative for a name depending
+			on the address of the client.  [RT #31775]
+
+3433.	[bug]		dlz_findzone() did not correctly handle
+			ISC_R_NOMORE. [RT #31172]
+
+3432.	[func]		Multiple DLZ databases can now be configured.
+			DLZ databases are searched in the order configured,
+			unless set to "search no", in which case a
+			zone can be configured to be retrieved from a
+			particular DLZ database by using a "dlz <name>"
+			option in the zone statement.  DLZ databases can
+			support type "master" and "redirect" zones.
+			[RT #27597]
+
 3431.	[bug]		ddns-confgen: Some valid key algorithms were
 			not accepted. [RT #31927]
 
@@ -639,13 +1149,15 @@
 
 3419.	[bug]		Memory leak on validation cancel. [RT #31869]
 
-3417.	[func]		Optional new XML schema (version 3.0) for the
-			statistics channel adds query type statistics at the
-			zone level, and flattens the XML tree and uses
-			compressed format to optimize parsing. Includes new XSL
-			that permits charting via the Google Charts API on
-			browsers that support javascript in XSL.  To enable,
-			build with "configure --enable-newstats". [RT #30023]
+3418.	[func]		New XML schema (version 3.0) for the statistics channel
+			adds query type statistics at the zone level, and
+			flattens the XML tree and uses compressed format to
+			optimize parsing. Includes new XSL that permits
+			charting via the Google Charts API on browsers that
+			support javascript in XSL.  The old XML schema has been
+			deprecated. [RT #30023]
+
+3417.	[placeholder]
 
 3416.	[bug]		Named could die on shutdown if running with 128 UDP
 			dispatches per interface. [RT #31743]
@@ -655,6 +1167,9 @@
 
 3414.	[bug]		Address locking issues found by Coverity. [RT #31626]
 
+3413.	[func]		Record the number of DNS64 AAAA RRsets that have been
+			synthesized. [RT #27636]
+
 3412.	[bug]		Copy timeval structure from control message data.
 			[RT #31548]
 
@@ -673,6 +1188,8 @@
 			are now legal in slave zones as long as
 			inline-signing is in use. [RT #31078]
 
+3407.	[placeholder]
+
 3406.	[bug]		mem.c: Fix compilation errors when building with
 			ISC_MEM_TRACKLINES or ISC_MEMPOOL_NAMES disabled.
 			Also, ISC_MEM_DEBUG is no longer optional. [RT #31559]
@@ -716,6 +1233,8 @@
 3393.	[bug]		'host -C' could core dump if REFUSED was received.
 			[RT #31381]
 
+3392.	[func]		Keep statistics on REFUSED responses. [RT #31412]
+
 3391.	[bug]		A DNSKEY lookup that encountered a CNAME failed.
 			[RT #31262]
 
@@ -730,6 +1249,9 @@
 			die on specific queries with dns64 enabled.
 			[RT #30996]
 
+3387.	[func]		DS digest can be disabled at runtime with
+			disable-ds-digests. [RT #21581]
+
 3386.	[bug]		Address locking violation when generating new NSEC /
 			NSEC3 chains. [RT #31224]
 
@@ -738,6 +1260,10 @@
 
 3384.	[bug]		Improved logging of crypto errors. [RT #30963]
 
+3383.	[security]	A certain combination of records in the RBT could
+			cause named to hang while populating the additional
+			section of a response. [RT #31090]
+
 3382.	[bug]		SOA query from slave used use-v6-udp-ports range,
 			if set, regardless of the address family in use.
 			[RT #24173]
@@ -760,12 +1286,13 @@
 3376.	[bug]		Lack of EDNS support was being recorded without a
 			successful response. [RT #30811]
 
-3375.	[func]		Check that 'rndc dumpdb' works on a empty cache.
-			[RT #30808]
+3375.	[bug]		'rndc dumpdb' failed on empty caches. [RT #30808]
 
 3374.	[bug]		isc_parse_uint32 failed to return a range error on
 			systems with 64 bit longs. [RT #30232]
 
+3373.	[bug]		win32: open raw files in binary mode. [RT #30944]
+
 3372.	[bug]		Silence spurious "deleted from unreachable cache"
 			messages.  [RT #30501]
 
@@ -773,27 +1300,6 @@
 			add NS RRsets to the additional section or not.
 			[RT #30479]
 
-3316.	[tuning]	Improved locking performance when recursing.
-			[RT #28836]
-
-3315.	[tuning]	Use multiple dispatch objects for sending upstream
-			queries; this can improve performance on busy
-			multiprocessor systems by reducing lock contention.
-			[RT #28605]
-
-	--- 9.9.2 released ---
-
-3383.	[security]	A certain combination of records in the RBT could
-			cause named to hang while populating the additional
-			section of a response. [RT #31090]
-
-3373.	[bug]		win32: open raw files in binary mode. [RT #30944]
-
-3364.	[security]	Named could die on specially crafted record.
-			[RT #30416]
-
-	--- 9.9.2rc1 released ---
-
 3370.	[bug]		Address use after free while shutting down. [RT #30241]
 
 3369.	[bug]		nsupdate terminated unexpectedly in interactive mode
@@ -811,6 +1317,9 @@
 3365.	[bug]		Removed spurious newlines from log messages in
 			zone.c [RT #30675]
 
+3364.	[security]	Named could die on specially crafted record.
+			[RT #30416]
+
 3363.	[bug]		Need to allow "forward" and "fowarders" options
 			in static-stub zones; this had been overlooked.
 			[RT #30482]
@@ -827,6 +1336,8 @@
 3359.	[bug]		An improperly-formed TSIG secret could cause a
 			memory leak. [RT #30607]
 
+3358.	[placeholder]
+
 3357.	[port]		Add support for libxml2-2.8.x [RT #30440]
 
 3356.	[bug]		Cap the TTL of signed RRsets when RRSIGs are
@@ -837,8 +1348,6 @@
 
 3354.	[func]		Improve OpenSSL error logging. [RT #29932]
 
-	--- 9.9.2b1 released ---
-
 3353.	[bug]		Use a single task for task exclusive operations.
 			[RT #29872]
 
@@ -881,6 +1390,8 @@
 			systems that do not have a python interpreter.)
 			[RT #28099]
 
+3343.	[placeholder]
+
 3342.	[bug]		Change #3314 broke saving of stub zones to disk
 			resulting in excessive cpu usage in some cases.
 			[RT #29952]
@@ -889,6 +1400,14 @@
 			to ensure correctness of signatures and of NSEC/NSEC3
 			chains. [RT #23673]
 
+3340.	[func]		Added new 'map' zone file format, which is an image
+			of a zone database that can be loaded directly into
+			memory via mmap(), allowing much faster zone loading.
+			(Note: Because of pointer sizes and other
+			considerations, this file format is platform-dependent;
+			'map' zone files cannot always be transferred from one
+			server to another.) [RT #25419]
+
 3339.	[func]		Allow the maximum supported rsa exponent size to be
 			specified: "max-rsa-exponent-size <value>;" [RT #29228]
 
@@ -898,6 +1417,9 @@
 3337.	[bug]		Change #3294 broke support for the multiple keys
 			in controls. [RT #29694]
 
+3336.	[func]		Maintain statistics for RRsets tagged as "stale".
+			[RT #29514]
+
 3335.	[func]		nslookup: return a nonzero exit code when unable
 			to get an answer. [RT #29492]
 
@@ -937,14 +1459,51 @@
 3328.	[bug]		Fixed inconsistent data checking in dst_parse.c.
 			[RT #29401]
 
-3317.	[func]		Add ECDSA support (RFC 6605). [RT #21918]
-
-	--- 9.9.1 released ---
+3327.	[func]		Added 'filter-aaaa-on-v6' option; this is similar
+			to 'filter-aaaa-on-v4' but applies to IPv6
+			connections.  (Use "configure --enable-filter-aaaa"
+			to enable this option.)  [RT #27308]
+
+3326.	[func]		Added task list statistics: task model, worker
+			threads, quantum, tasks running, tasks ready.
+			[RT #27678]
+
+3325.	[func]		Report cache statistics: memory use, number of
+			nodes, number of hash buckets, hit and miss counts.
+			[RT #27056]
+
+3324.	[test]		Add better tests for ADB stats [RT #27057]
+
+3323.	[func]		Report the number of buckets the resolver is using.
+			[RT #27020]
+
+3322.	[func]		Monitor the number of active TCP and UDP dispatches.
+			[RT #27055]
+
+3321.	[func]		Monitor the number of recursive fetches and the
+			number of open sockets, and report these values in
+			the statistics channel. [RT #27054]
+
+3320.	[func]		Added support for monitoring of recursing client
+			count. [RT #27009]
+
+3319.	[func]		Added support for monitoring of ADB entry count and
+			hash size. [RT #27057]
 
 3318.	[tuning]	Reduce the amount of work performed while holding a
 			bucket lock when finished with a fetch context.
 			[RT #29239]
 
+3317.	[func]		Add ECDSA support (RFC 6605). [RT #21918]
+
+3316.	[tuning]	Improved locking performance when recursing.
+			[RT #28836]
+
+3315.	[tuning]	Use multiple dispatch objects for sending upstream
+			queries; this can improve performance on busy
+			multiprocessor systems by reducing lock contention.
+			[RT #28605]
+
 3314.	[bug]		The masters list could be updated while stub_callback
 			or refresh_callback were using it. [RT #26732]
 
@@ -961,6 +1520,8 @@
 3309.	[bug]		resolver.c:fctx_finddone() was not thread safe.
 			[RT #27995]
 
+3308.	[placeholder]
+
 3307.	[bug]		Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS.
 			[RT #28956]
 
@@ -1001,19 +1562,16 @@
 3294.	[bug]		isccc/cc.c:table_fromwire failed to free alist on
 			error. [RT #28265]
 
+3293.	[func]		nsupdate: list supported type. [RT #28261]
+
+3292.	[func]		Log messages in the axfr stream at debug 10.
+			[RT #28040]
+
 3291.	[port]		Fixed a build error on systems without ENOTSUP.
 			[RT #28200]
 
 3290.	[bug]		<isc/hmacsha.h> was not being installed. [RT #28169]
 
-3273.	[bug]		AAAA responses could be returned in the additional
-			section even when filter-aaaa-on-v4 was in use.
-			[RT #27292]
-
-	--- 9.9.0 released ---
-
-	--- 9.9.0rc4 released ---
-
 3289.	[bug]		'rndc retransfer' failed for inline zones. [RT #28036]
 
 3288.	[bug]		dlz_destroy() function wasn't correctly registered
@@ -1024,8 +1582,6 @@
 3286.	[bug]		Managed key maintenance timer could fail to start
 			after 'rndc reconfig'. [RT #26786]
 
-	--- 9.9.0rc3 released ---
-
 3285.	[bug]		val-frdataset was incorrectly disassociated in
 			proveunsecure after calling startfinddlvsep.
 			[RT #27928]
@@ -1064,6 +1620,15 @@
 			option had been misspelled as '-clear'.  (To avoid
 			future confusion, both options now work.) [RT #27173]
 
+3274.	[placeholder]
+
+3273.	[bug]		AAAA responses could be returned in the additional
+			section even when filter-aaaa-on-v4 was in use.
+			[RT #27292]
+
+3272.	[func]		New "rndc zonestatus" command prints information
+			about the specified zone. [RT #21671]
+
 3271.	[port]		darwin: mksymtbl is not always stable, loop several
 			times before giving up.  mksymtbl was using non
 			portable perl to covert 64 bit hex strings. [RT #27653]
@@ -1633,7 +2198,7 @@
 			as a zone's masters clause.  This means it is
 			now possible to specify a TSIG key to use when
 			sending notifies to a given server, or to include
-			an explicit named masters list in an also-notfiy
+			an explicit named masters list in an also-notify
 			statement.  [RT #23508]
 
 3108.	[cleanup]	dnssec-signzone: Clarified some error and
@@ -4650,7 +5215,7 @@
 
 2205.	[bug]		libbind: change #2119 broke thread support. [RT #16982]
 
-2204.	[bug]		"rndc flushanme name unknown-view" caused named
+2204.	[bug]		"rndc flushname name unknown-view" caused named
 			to crash. [RT #16984]
 
 2203.	[security]	Query id generation was cryptographically weak.
--- a/external/bsd/bind/dist/acconfig.h	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/acconfig.h	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: acconfig.h,v 1.6 2012/12/04 23:38:37 spz Exp $	*/
+/*	$NetBSD: acconfig.h,v 1.7 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004, 2005, 2007, 2008, 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2008, 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -134,14 +134,11 @@
 /** define if you have strerror in the C library. */
 #undef HAVE_STRERROR
 
-/** Define if you are running under Compaq TruCluster. */
-#undef HAVE_TRUCLUSTER
-
 /* Define if OpenSSL includes DSA support */
 #undef HAVE_OPENSSL_DSA
 
-/* Define if OpenSSL includes ECDSA support */
-#undef HAVE_OPENSSL_ECDSA
+/* Define if you have getpassphrase in the C library. */
+#undef HAVE_GETPASSPHRASE
 
 /* Define to the length type used by the socket API (socklen_t, size_t, int). */
 #undef ISC_SOCKADDR_LEN_T
--- a/external/bsd/bind/dist/bin/check/check-tool.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/check/check-tool.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: check-tool.c,v 1.5 2013/07/27 19:23:09 christos Exp $	*/
+/*	$NetBSD: check-tool.c,v 1.6 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -42,12 +42,17 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
+#include <dns/db.h>
+#include <dns/dbiterator.h>
 #include <dns/fixedname.h>
 #include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
 #include <dns/rdataset.h>
+#include <dns/rdatasetiter.h>
+#include <dns/rdatatype.h>
+#include <dns/result.h>
 #include <dns/types.h>
 #include <dns/zone.h>
 
@@ -88,6 +93,7 @@
 static const char *dbtype[] = { "rbt" };
 
 int debug = 0;
+const char *journal = NULL;
 isc_boolean_t nomerge = ISC_TRUE;
 #if CHECK_LOCAL
 isc_boolean_t docheckmx = ISC_TRUE;
@@ -109,6 +115,7 @@
 			    DNS_ZONEOPT_CHECKWILDCARD |
 			    DNS_ZONEOPT_WARNMXCNAME |
 			    DNS_ZONEOPT_WARNSRVCNAME;
+unsigned int zone_options2 = 0;
 
 /*
  * This needs to match the list in bin/named/log.c.
@@ -578,11 +585,93 @@
 	return (ISC_R_SUCCESS);
 }
 
+/*% scan the zone for oversize TTLs */
+static isc_result_t
+check_ttls(dns_zone_t *zone, dns_ttl_t maxttl) {
+	isc_result_t result;
+	dns_db_t *db = NULL;
+	dns_dbversion_t *version = NULL;
+	dns_dbnode_t *node = NULL;
+	dns_dbiterator_t *dbiter = NULL;
+	dns_rdatasetiter_t *rdsiter = NULL;
+	dns_rdataset_t rdataset;
+	dns_fixedname_t fname;
+	dns_name_t *name;
+	dns_fixedname_init(&fname);
+	name = dns_fixedname_name(&fname);
+	dns_rdataset_init(&rdataset);
+
+	CHECK(dns_zone_getdb(zone, &db));
+	INSIST(db != NULL);
+
+	CHECK(dns_db_newversion(db, &version));
+	CHECK(dns_db_createiterator(db, 0, &dbiter));
+
+	for (result = dns_dbiterator_first(dbiter);
+	     result == ISC_R_SUCCESS;
+	     result = dns_dbiterator_next(dbiter)) {
+		result = dns_dbiterator_current(dbiter, &node, name);
+		if (result == DNS_R_NEWORIGIN)
+			result = ISC_R_SUCCESS;
+		CHECK(result);
+
+		CHECK(dns_db_allrdatasets(db, node, version, 0, &rdsiter));
+		for (result = dns_rdatasetiter_first(rdsiter);
+		     result == ISC_R_SUCCESS;
+		     result = dns_rdatasetiter_next(rdsiter)) {
+			dns_rdatasetiter_current(rdsiter, &rdataset);
+			if (rdataset.ttl > maxttl) {
+				char nbuf[DNS_NAME_FORMATSIZE];
+				char tbuf[255];
+				isc_buffer_t b;
+				isc_region_t r;
+
+				dns_name_format(name, nbuf, sizeof(nbuf));
+				isc_buffer_init(&b, tbuf, sizeof(tbuf) - 1);
+				CHECK(dns_rdatatype_totext(rdataset.type, &b));
+				isc_buffer_usedregion(&b, &r);
+				r.base[r.length] = 0;
+
+				dns_zone_log(zone, ISC_LOG_ERROR,
+					     "%s/%s TTL %d exceeds "
+					     "maximum TTL %d",
+					     nbuf, tbuf, rdataset.ttl, maxttl);
+				dns_rdataset_disassociate(&rdataset);
+				CHECK(ISC_R_RANGE);
+			}
+			dns_rdataset_disassociate(&rdataset);
+		}
+		if (result == ISC_R_NOMORE)
+			result = ISC_R_SUCCESS;
+		CHECK(result);
+
+		dns_rdatasetiter_destroy(&rdsiter);
+		dns_db_detachnode(db, &node);
+	}
+
+	if (result == ISC_R_NOMORE)
+		result = ISC_R_SUCCESS;
+
+ cleanup:
+	if (node != NULL)
+		dns_db_detachnode(db, &node);
+	if (rdsiter != NULL)
+		dns_rdatasetiter_destroy(&rdsiter);
+	if (dbiter != NULL)
+		dns_dbiterator_destroy(&dbiter);
+	if (version != NULL)
+		dns_db_closeversion(db, &version, ISC_FALSE);
+	if (db != NULL)
+		dns_db_detach(&db);
+
+	return (result);
+}
+
 /*% load the zone */
 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	  dns_masterformat_t fileformat, const char *classname,
-	  dns_zone_t **zonep)
+	  dns_ttl_t maxttl, dns_zone_t **zonep)
 {
 	isc_result_t result;
 	dns_rdataclass_t rdclass;
@@ -610,6 +699,8 @@
 	CHECK(dns_zone_setorigin(zone, origin));
 	CHECK(dns_zone_setdbtype(zone, 1, (const char * const *) dbtype));
 	CHECK(dns_zone_setfile2(zone, filename, fileformat));
+	if (journal != NULL)
+		CHECK(dns_zone_setjournal(zone, journal));
 
 	DE_CONST(classname, region.base);
 	region.length = strlen(classname);
@@ -617,7 +708,11 @@
 
 	dns_zone_setclass(zone, rdclass);
 	dns_zone_setoption(zone, zone_options, ISC_TRUE);
+	dns_zone_setoption2(zone, zone_options2, ISC_TRUE);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge);
+
+	dns_zone_setmaxttl(zone, maxttl);
+
 	if (docheckmx)
 		dns_zone_setcheckmx(zone, checkmx);
 	if (docheckns)
@@ -626,6 +721,15 @@
 		dns_zone_setchecksrv(zone, checksrv);
 
 	CHECK(dns_zone_load(zone));
+
+	/*
+	 * When loading map files we can't catch oversize TTLs during
+	 * load, so we check for them here.
+	 */
+	if (fileformat == dns_masterformat_map && maxttl != 0) {
+		CHECK(check_ttls(zone, maxttl));
+	}
+
 	if (zonep != NULL) {
 		*zonep = zone;
 		zone = NULL;
--- a/external/bsd/bind/dist/bin/check/check-tool.h	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/check/check-tool.h	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: check-tool.h,v 1.3 2012/06/05 00:38:48 christos Exp $	*/
+/*	$NetBSD: check-tool.h,v 1.4 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004, 2005, 2007, 2010, 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2010, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -39,7 +39,7 @@
 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	  dns_masterformat_t fileformat, const char *classname,
-	  dns_zone_t **zonep);
+	  dns_ttl_t maxttl, dns_zone_t **zonep);
 
 isc_result_t
 dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
@@ -52,11 +52,13 @@
 #endif
 
 extern int debug;
+extern const char *journal;
 extern isc_boolean_t nomerge;
 extern isc_boolean_t docheckmx;
 extern isc_boolean_t docheckns;
 extern isc_boolean_t dochecksrv;
 extern unsigned int zone_options;
+extern unsigned int zone_options2;
 
 ISC_LANG_ENDDECLS
 
--- a/external/bsd/bind/dist/bin/check/named-checkconf.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/check/named-checkconf.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: named-checkconf.8,v 1.3 2012/06/05 00:38:48 christos Exp $
+.\"	$NetBSD: named-checkconf.8,v 1.4 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -35,7 +35,7 @@
 named\-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP 16
-\fBnamed\-checkconf\fR [\fB\-h\fR] [\fB\-v\fR] [\fB\-j\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename} [\fB\-p\fR] [\fB\-z\fR]
+\fBnamed\-checkconf\fR [\fB\-h\fR] [\fB\-v\fR] [\fB\-j\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename} [\fB\-p\fR] [\fB\-x\fR] [\fB\-z\fR]
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -86,6 +86,14 @@
 and included files in canonical form if no errors were detected.
 .RE
 .PP
+\-x
+.RS 4
+When printing the configuration files in canonical form, obscure shared secrets by replacing them with strings of question marks ('?'). This allows the contents of
+\fInamed.conf\fR
+and related files to be shared \(em for example, when submitting bug reports \(em without compromising private data. This option cannot be used without
+\fB\-p\fR.
+.RE
+.PP
 \-z
 .RS 4
 Perform a test load of all master zones found in
@@ -115,7 +123,7 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2009, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
--- a/external/bsd/bind/dist/bin/check/named-checkconf.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/check/named-checkconf.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: named-checkconf.c,v 1.7 2013/12/31 20:24:38 christos Exp $	*/
+/*	$NetBSD: named-checkconf.c,v 1.8 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004-2007, 2009-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -200,6 +200,7 @@
 	const cfg_obj_t *obj = NULL;
 	const cfg_obj_t *fmtobj = NULL;
 	dns_masterformat_t masterformat;
+	dns_ttl_t maxttl = 0;
 
 	zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_MANYERRORS;
 
@@ -375,11 +376,20 @@
 			masterformat = dns_masterformat_text;
 		else if (strcasecmp(masterformatstr, "raw") == 0)
 			masterformat = dns_masterformat_raw;
+		else if (strcasecmp(masterformatstr, "map") == 0)
+			masterformat = dns_masterformat_map;
 		else
 			INSIST(0);
 	}
 
-	result = load_zone(mctx, zname, zfile, masterformat, zclass, NULL);
+	obj = NULL;
+	if (get_maps(maps, "max-zone-ttl", &obj)) {
+		maxttl = cfg_obj_asuint32(obj);
+		zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
+	}
+
+	result = load_zone(mctx, zname, zfile, masterformat,
+			   zclass, maxttl, NULL);
 	if (result != ISC_R_SUCCESS)
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			dns_result_totext(result));
@@ -484,11 +494,12 @@
 	isc_entropy_t *ectx = NULL;
 	isc_boolean_t load_zones = ISC_FALSE;
 	isc_boolean_t print = ISC_FALSE;
+	unsigned int flags = 0;
 
 	isc__mem_register();
 	isc_commandline_errprint = ISC_FALSE;
 
-	while ((c = isc_commandline_parse(argc, argv, "dhjt:pvz")) != EOF) {
+	while ((c = isc_commandline_parse(argc, argv, "dhjt:pvxz")) != EOF) {
 		switch (c) {
 		case 'd':
 			debug++;
@@ -515,6 +526,10 @@
 			printf(VERSION "\n");
 			exit(0);
 
+		case 'x':
+			flags |= CFG_PRINTER_XKEY;
+			break;
+
 		case 'z':
 			load_zones = ISC_TRUE;
 			docheckmx = ISC_FALSE;
@@ -537,6 +552,11 @@
 		}
 	}
 
+	if (((flags & CFG_PRINTER_XKEY) != 0) && !print) {
+		fprintf(stderr, "%s: -x cannot be used without -p\n", program);
+		exit(1);
+	}
+
 	if (isc_commandline_index + 1 < argc)
 		usage();
 	if (argv[isc_commandline_index] != NULL)
@@ -577,7 +597,7 @@
 	}
 
 	if (print && exit_status == 0)
-		cfg_print(config, output, NULL);
+		cfg_printx(config, flags, output, NULL);
 	cfg_obj_destroy(parser, &config);
 
 	cfg_parser_destroy(&parser);
--- a/external/bsd/bind/dist/bin/check/named-checkzone.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/check/named-checkzone.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: named-checkzone.8,v 1.4 2013/07/27 19:23:09 christos Exp $
+.\"	$NetBSD: named-checkzone.8,v 1.5 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2004-2007, 2009-2011, 2013 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2009-2014 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2002 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -35,9 +35,9 @@
 named\-checkzone, named\-compilezone \- zone file validity checking or converting tool
 .SH "SYNOPSIS"
 .HP 16
-\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-h\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
+\fBnamed\-checkzone\fR [\fB\-d\fR] [\fB\-h\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-J\ \fR\fB\fIfilename\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-M\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-l\ \fR\fB\fIttl\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-o\ \fR\fB\fIfilename\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-S\ \fR\fB\fImode\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {zonename} {filename}
 .HP 18
-\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {\fB\-o\ \fR\fB\fIfilename\fR\fR} {zonename} {filename}
+\fBnamed\-compilezone\fR [\fB\-d\fR] [\fB\-j\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-C\ \fR\fB\fImode\fR\fR] [\fB\-f\ \fR\fB\fIformat\fR\fR] [\fB\-F\ \fR\fB\fIformat\fR\fR] [\fB\-J\ \fR\fB\fIfilename\fR\fR] [\fB\-i\ \fR\fB\fImode\fR\fR] [\fB\-k\ \fR\fB\fImode\fR\fR] [\fB\-m\ \fR\fB\fImode\fR\fR] [\fB\-n\ \fR\fB\fImode\fR\fR] [\fB\-l\ \fR\fB\fIttl\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-r\ \fR\fB\fImode\fR\fR] [\fB\-s\ \fR\fB\fIstyle\fR\fR] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] [\fB\-T\ \fR\fB\fImode\fR\fR] [\fB\-w\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-W\ \fR\fB\fImode\fR\fR] {\fB\-o\ \fR\fB\fIfilename\fR\fR} {zonename} {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkzone\fR
@@ -79,7 +79,13 @@
 .PP
 \-j
 .RS 4
-When loading the zone file read the journal if it exists.
+When loading a zone file, read the journal if it exists. The journal file name is assumed to be the zone file name appended with the string
+\fI.jnl\fR.
+.RE
+.PP
+\-J \fIfilename\fR
+.RS 4
+When loading the zone file read the journal from the given file, if it exists. (Implies \-j.)
 .RE
 .PP
 \-c \fIclass\fR
@@ -135,8 +141,9 @@
 .RS 4
 Specify the format of the zone file. Possible formats are
 \fB"text"\fR
-(default) and
-\fB"raw"\fR.
+(default),
+\fB"raw"\fR, and
+\fB"map"\fR.
 .RE
 .PP
 \-F \fIformat\fR
@@ -146,14 +153,14 @@
 .sp
 Possible formats are
 \fB"text"\fR
-(default) and
-\fB"raw"\fR
-or
+(default), which is the standard textual representation of the zone, and
+\fB"map"\fR,
+\fB"raw"\fR, and
 \fB"raw=N"\fR, which store the zone in a binary format for rapid loading by
 \fBnamed\fR.
 \fB"raw=N"\fR
 specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of
-\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1.
+\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher; the default is 1.
 .RE
 .PP
 \-k \fImode\fR
@@ -170,9 +177,17 @@
 \fB"ignore"\fR.
 .RE
 .PP
+\-l \fIttl\fR
+.RS 4
+Sets a maximum permissible TTL for the input file. Any record with a TTL higher than this value will cause the zone to be rejected. This is similar to using the
+\fBmax\-zone\-ttl\fR
+option in
+\fInamed.conf\fR.
+.RE
+.PP
 \-L \fIserial\fR
 .RS 4
-When compiling a zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)
+When compiling a zone to "raw" or "map" format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)
 .RE
 .PP
 \-m \fImode\fR
@@ -304,7 +319,7 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007, 2009\-2011, 2013 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007, 2009\-2014 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2002 Internet Software Consortium.
 .br
--- a/external/bsd/bind/dist/bin/check/named-checkzone.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/check/named-checkzone.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: named-checkzone.c,v 1.5 2013/07/27 19:23:09 christos Exp $	*/
+/*	$NetBSD: named-checkzone.c,v 1.6 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -17,7 +17,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* Id: named-checkzone.c,v 1.65 2011/12/22 17:29:22 each Exp  */
+/* Id: named-checkzone.c,v 1.65.32.2 2012/02/07 02:45:21 each Exp  */
 
 /*! \file */
 
@@ -80,7 +80,7 @@
 usage(void) {
 	fprintf(stderr,
 		"usage: %s [-djqvD] [-c class] "
-		"[-f inputformat] [-F outputformat] "
+		"[-f inputformat] [-F outputformat] [-J filename] "
 		"[-t directory] [-w directory] [-k (ignore|warn|fail)] "
 		"[-n (ignore|warn|fail)] [-m (ignore|warn|fail)] "
 		"[-r (ignore|warn|fail)] "
@@ -117,15 +117,17 @@
 	dns_masterformat_t outputformat = dns_masterformat_text;
 	dns_masterrawheader_t header;
 	isc_uint32_t rawversion = 1, serialnum = 0;
+	dns_ttl_t maxttl = 0;
 	isc_boolean_t snset = ISC_FALSE;
 	isc_boolean_t logdump = ISC_FALSE;
 	FILE *errout = stdout;
 	char *endp;
 
-	isc__mem_register();
-	isc__task_register();
-	isc__timer_register();
-	isc__socket_register();
+	/*
+	 * Uncomment the following line if memory debugging is needed:
+	 * isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
+	 */
+
 	outputstyle = &dns_master_style_full;
 
 	prog_name = strrchr(argv[0], '/');
@@ -170,7 +172,7 @@
 	isc_commandline_errprint = ISC_FALSE;
 
 	while ((c = isc_commandline_parse(argc, argv,
-			       "c:df:hi:jk:L:m:n:qr:s:t:o:vw:DF:M:S:T:W:"))
+			       "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:M:S:T:W:"))
 	       != EOF) {
 		switch (c) {
 		case 'c':
@@ -231,6 +233,11 @@
 			nomerge = ISC_FALSE;
 			break;
 
+		case 'J':
+			journal = isc_commandline_argument;
+			nomerge = ISC_FALSE;
+			break;
+
 		case 'k':
 			if (ARGCMP("warn")) {
 				zone_options |= DNS_ZONEOPT_CHECKNAMES;
@@ -259,6 +266,18 @@
 			}
 			break;
 
+		case 'l':
+			zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
+			endp = NULL;
+			maxttl = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0') {
+				fprintf(stderr, "maximum TTL "
+						"must be numeric");
+				exit(1);
+			}
+			break;
+
+
 		case 'n':
 			if (ARGCMP("ignore")) {
 				zone_options &= ~(DNS_ZONEOPT_CHECKNS|
@@ -439,6 +458,8 @@
 			inputformat = dns_masterformat_raw;
 			fprintf(stderr,
 				"WARNING: input format raw, version ignored\n");
+		} else if (strcasecmp(inputformatstr, "map") == 0) {
+			inputformat = dns_masterformat_map;
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 			    inputformatstr);
@@ -462,6 +483,8 @@
 					"unknown raw format version\n");
 				exit(1);
 			}
+		} else if (strcasecmp(outputformatstr, "map") == 0) {
+			outputformat = dns_masterformat_map;
 		} else {
 			fprintf(stderr, "unknown file format: %s\n",
 				outputformatstr);
@@ -515,7 +538,7 @@
 	origin = argv[isc_commandline_index++];
 	filename = argv[isc_commandline_index++];
 	result = load_zone(mctx, origin, filename, inputformat, classname,
-			   &zone);
+			   maxttl, &zone);
 
 	if (snset) {
 		dns_master_initrawheader(&header);
--- a/external/bsd/bind/dist/bin/confgen/ddns-confgen.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/confgen/ddns-confgen.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: ddns-confgen.c,v 1.5 2013/03/24 18:44:37 christos Exp $	*/
+/*	$NetBSD: ddns-confgen.c,v 1.6 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2009, 2011  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2011, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -101,10 +101,9 @@
 	int len = 0;
 	int ch;
 
-	isc__mem_register();
 	result = isc_file_progname(*argv, program, sizeof(program));
 	if (result != ISC_R_SUCCESS)
-		memcpy(program, "ddns-confgen", 13);
+		memmove(program, "ddns-confgen", 13);
 	progname = program;
 
 	isc_commandline_errprint = ISC_FALSE;
--- a/external/bsd/bind/dist/bin/confgen/rndc-confgen.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/confgen/rndc-confgen.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: rndc-confgen.8,v 1.3 2012/06/05 00:38:51 christos Exp $
+.\"	$NetBSD: rndc-confgen.8,v 1.4 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007, 2009, 2013 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2001, 2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -35,7 +35,7 @@
 rndc\-confgen \- rndc key generation tool
 .SH "SYNOPSIS"
 .HP 13
-\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
+\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBrndc\-confgen\fR
@@ -105,9 +105,14 @@
 as directed.
 .RE
 .PP
+\-A \fIalgorithm\fR
+.RS 4
+Specifies the algorithm to use for the TSIG key. Available choices are: hmac\-md5, hmac\-sha1, hmac\-sha224, hmac\-sha256, hmac\-sha384 and hmac\-sha512. The default is hmac\-md5.
+.RE
+.PP
 \-b \fIkeysize\fR
 .RS 4
-Specifies the size of the authentication key in bits. Must be between 1 and 512 bits; the default is 128.
+Specifies the size of the authentication key in bits. Must be between 1 and 512 bits; the default is the hash size.
 .RE
 .PP
 \-c \fIkeyfile\fR
@@ -207,7 +212,7 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007, 2009 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007, 2009, 2013 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2001, 2003 Internet Software Consortium.
 .br
--- a/external/bsd/bind/dist/bin/confgen/rndc-confgen.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/confgen/rndc-confgen.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: rndc-confgen.c,v 1.6 2013/07/27 19:23:09 christos Exp $	*/
+/*	$NetBSD: rndc-confgen.c,v 1.7 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004, 2005, 2007-2009, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007-2009, 2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -59,7 +59,6 @@
 #include "util.h"
 #include "keygen.h"
 
-#define DEFAULT_KEYLENGTH	128		/*% Bits. */
 #define DEFAULT_KEYNAME		"rndc-key"
 #define DEFAULT_SERVER		"127.0.0.1"
 #define DEFAULT_PORT		953
@@ -82,7 +81,8 @@
  %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
 [-s addr] [-t chrootdir] [-u user]\n\
   -a:		 generate just the key clause and write it to keyfile (%s)\n\
-  -b bits:	 from 1 through 512, default %d; total length of the secret\n\
+  -A alg:	 algorithm (default hmac-md5)\n\
+  -b bits:	 from 1 through 512, default 256; total length of the secret\n\
   -c keyfile:	 specify an alternate key file (requires -a)\n\
   -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
   -p port:	 the port named will listen on and rndc will connect to\n\
@@ -90,7 +90,7 @@
   -s addr:	 the address to which rndc should connect\n\
   -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
   -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
-		 progname, keydef, DEFAULT_KEYLENGTH);
+		 progname, keydef);
 
 	exit (status);
 }
@@ -105,12 +105,12 @@
 	const char *keyname = NULL;
 	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
-	dns_secalg_t alg = DST_ALG_HMACMD5;
-	const char *algname = alg_totext(alg);
+	dns_secalg_t alg;
+	const char *algname;
 	char *p;
 	int ch;
 	int port;
-	int keysize;
+	int keysize = -1;
 	struct in_addr addr4_dummy;
 	struct in6_addr addr6_dummy;
 	char *chrootdir = NULL;
@@ -118,27 +118,33 @@
 	isc_boolean_t keyonly = ISC_FALSE;
 	int len;
 
-	isc__mem_register();
 	keydef = keyfile = RNDC_KEYFILE;
 
 	result = isc_file_progname(*argv, program, sizeof(program));
 	if (result != ISC_R_SUCCESS)
-		memcpy(program, "rndc-confgen", 13);
+		memmove(program, "rndc-confgen", 13);
 	progname = program;
 
 	keyname = DEFAULT_KEYNAME;
-	keysize = DEFAULT_KEYLENGTH;
+	alg = DST_ALG_HMACMD5;
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;
 
 	isc_commandline_errprint = ISC_FALSE;
 
 	while ((ch = isc_commandline_parse(argc, argv,
-					   "ab:c:hk:Mmp:r:s:t:u:Vy")) != -1) {
+					   "aA:b:c:hk:Mmp:r:s:t:u:Vy")) != -1)
+	{
 		switch (ch) {
 		case 'a':
 			keyonly = ISC_TRUE;
 			break;
+		case 'A':
+			algname = isc_commandline_argument;
+			alg = alg_fromtext(algname);
+			if (alg == DST_ALG_UNKNOWN)
+				fatal("Unsupported algorithm '%s'", algname);
+			break;
 		case 'b':
 			keysize = strtol(isc_commandline_argument, &p, 10);
 			if (*p != '\0' || keysize < 0)
@@ -206,6 +212,10 @@
 	if (argc > 0)
 		usage(1);
 
+	if (keysize < 0)
+		keysize = alg_bits(alg);
+	algname = alg_totext(alg);
+
 	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));
 
--- a/external/bsd/bind/dist/bin/dig/dig.1	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dig/dig.1	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dig.1,v 1.6 2013/12/31 20:24:38 christos Exp $
+.\"	$NetBSD: dig.1,v 1.7 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2004-2011, 2013 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -72,7 +72,7 @@
 via
 \fI${HOME}/.digrc\fR. This file is read and any options in it are applied before the command line arguments.
 .PP
-The IN and CH class names overlap with the IN and CH top level domains names. Either use the
+The IN and CH class names overlap with the IN and CH top level domain names. Either use the
 \fB\-t\fR
 and
 \fB\-c\fR
@@ -188,7 +188,7 @@
 The
 \fB\-q\fR
 option sets the query name to
-\fIname\fR. This useful do distinguish the
+\fIname\fR. This is useful to distinguish the
 \fIname\fR
 from other arguments.
 .PP
@@ -377,6 +377,11 @@
 Toggle the display of per\-record comments in the output (for example, human\-readable key information about DNSKEY records). The default is not to print record comments unless multiline mode is active.
 .RE
 .PP
+\fB+[no]crypto\fR
+.RS 4
+Toggle the display of cryptographic fields in DNSSEC records. The contents of these field are unnecessary to debug most DNSSEC validation failures and removing them makes it easier to see the common failures. The default is to display the fields. When omitted they are replaced by the string "[omitted]" or in the DNSKEY case the key id is displayed as the replacement, e.g. "[ key id = value ]".
+.RE
+.PP
 \fB+split=W\fR
 .RS 4
 Split long hex\- or base64\-formatted fields in resource records into chunks of
@@ -543,6 +548,22 @@
 Keep the TCP socket open between queries and reuse it rather than creating a new TCP socket for each lookup. The default is
 \fB+nokeepopen\fR.
 .RE
+.PP
+\fB+[no]sit\fR\fB[=####]\fR
+.RS 4
+Send a Source Identity Token EDNS option, with optional value. Replaying a SIT from a previous response will allow the server to identify a previous client. The default is
+\fB+nosit\fR. Currently using experimental value 65001 for the option code.
+.RE
+.PP
+\fB+[no]subnet=addr/prefix\fR
+.RS 4
+Send an EDNS Client Subnet option with the speciifed IP address or network prefix.
+.RE
+.PP
+\fB+[no]expire\fR
+.RS 4
+Send an EDNS Expire option. Currently using experimental value 65002 for the option code.
+.RE
 .SH "MULTIPLE QUERIES"
 .PP
 The BIND 9 implementation of
@@ -605,7 +626,7 @@
 .PP
 There are probably too many query options.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2011, 2013 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
--- a/external/bsd/bind/dist/bin/dig/dig.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dig/dig.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dig.c,v 1.7 2013/12/31 20:24:38 christos Exp $	*/
+/*	$NetBSD: dig.c,v 1.8 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -66,11 +66,15 @@
 static int addresscount = 0;
 
 static char domainopt[DNS_NAME_MAXTEXT];
+#ifdef ISC_PLATFORM_USESIT
+static char sitvalue[256];
+#endif
 
 static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
 	ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
 	multiline = ISC_FALSE, nottl = ISC_FALSE, noclass = ISC_FALSE,
-	onesoa = ISC_FALSE, rrcomments = ISC_FALSE;
+	onesoa = ISC_FALSE, rrcomments = ISC_FALSE, use_usec = ISC_FALSE,
+	nocrypto = ISC_FALSE;
 static isc_uint32_t splitwidth = 0xffffffff;
 
 /*% opcode text */
@@ -176,6 +180,7 @@
 "                 -q name             (specify query name)\n"
 "                 -t type             (specify query type)\n"
 "                 -c class            (specify query class)\n"
+"                 -u                  (display times in usec instead of msec)\n"
 "                 -k keyfile          (specify tsig key file)\n"
 "                 -y [hmac:]name:key  (specify named base64 tsig key)\n"
 "                 -4                  (use IPv4 query transport only)\n"
@@ -190,6 +195,7 @@
 "                 +domain=###         (Set default domainname)\n"
 "                 +bufsize=###        (Set EDNS0 Max UDP packet size)\n"
 "                 +ndots=###          (Set NDOTS value)\n"
+"                 +subnet=addr        (Set edns-client-subnet option)\n"
 "                 +[no]edns[=###]     (Set EDNS version) [0]\n"
 "                 +[no]search         (Set whether to use searchlist)\n"
 "                 +[no]showsearch     (Search with intermediate results)\n"
@@ -207,6 +213,8 @@
 "                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]rrcomments     (Control display of per-record "
 				       "comments)\n"
+"                 +[no]crypto         (Control display of cryptographic "
+				       "fields in records)\n"
 "                 +[no]question       (Control display of question)\n"
 "                 +[no]answer         (Control display of answer)\n"
 "                 +[no]authority      (Control display of authority)\n"
@@ -221,7 +229,11 @@
 "                 +[no]identify       (ID responders in short answers)\n"
 "                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
 "                 +[no]dnssec         (Request DNSSEC records)\n"
+"                 +[no]expire         (Request time to expire)\n"
 "                 +[no]nsid           (Request Name Server ID)\n"
+#ifdef ISC_PLATFORM_USESIT
+"                 +[no]sit            (Request a Source Identity Token)\n"
+#endif
 #ifdef DIG_SIGCHASE
 "                 +[no]sigchase       (Chase DNSSEC signatures)\n"
 "                 +trusted-key=####   (Trusted Key when chasing DNSSEC sigs)\n"
@@ -258,7 +270,10 @@
 
 	if (query->lookup->stats && !short_form) {
 		diff = isc_time_microdiff(&now, &query->time_sent);
-		printf(";; Query time: %ld msec\n", (long int)diff/1000);
+		if (use_usec)
+			printf(";; Query time: %ld usec\n", (long) diff);
+		else
+			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
 		tmnow  = *localtime(&tnow);
@@ -284,12 +299,20 @@
 		puts("");
 	} else if (query->lookup->identify && !short_form) {
 		diff = isc_time_microdiff(&now, &query->time_sent);
-		printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
-		       "from %s(%s) in %d ms\n\n",
-		       query->lookup->doing_xfr ?
-				query->byte_count : (isc_uint64_t)bytes,
-		       fromtext, query->userarg,
-		       (int)diff/1000);
+		if (use_usec)
+			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
+			       "from %s(%s) in %ld us\n\n",
+			       query->lookup->doing_xfr
+				 ? query->byte_count
+				 : (isc_uint64_t)bytes,
+			       fromtext, query->userarg, (long) diff);
+		else
+			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
+			       "from %s(%s) in %ld ms\n\n",
+			       query->lookup->doing_xfr
+				 ?  query->byte_count
+				 : (isc_uint64_t)bytes,
+			       fromtext, query->userarg, (long) diff / 1000);
 	}
 }
 
@@ -313,6 +336,7 @@
 	isc_uint64_t diff;
 	isc_time_t now;
 	char store[sizeof("12345678901234567890")];
+	unsigned int styleflags = 0;
 
 	if (query->lookup->trace || query->lookup->ns_search_only) {
 		result = dns_rdatatype_totext(rdata->type, buf);
@@ -320,7 +344,10 @@
 			return (result);
 		ADD_STRING(buf, " ");
 	}
-	result = dns_rdata_totext(rdata, NULL, buf);
+
+	if (nocrypto)
+		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
+	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, 60, " ", buf);
 	if (result == ISC_R_NOSPACE)
 		return (result);
 	check_result(result, "dns_rdata_totext");
@@ -329,7 +356,10 @@
 		diff = isc_time_microdiff(&now, &query->time_sent);
 		ADD_STRING(buf, " from server ");
 		ADD_STRING(buf, query->servname);
-		snprintf(store, 19, " in %d ms.", (int)diff/1000);
+		if (use_usec)
+			snprintf(store, 19, " in %ld us.", (long) diff);
+		else
+			snprintf(store, 19, " in %ld ms.", (long) diff / 1000);
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
@@ -405,6 +435,8 @@
 		styleflags |= DNS_STYLEFLAG_NO_CLASS;
 	if (rrcomments)
 		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
+	if (nocrypto)
+		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
 	if (multiline) {
 		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -460,6 +492,8 @@
 		styleflags |= DNS_STYLEFLAG_NO_TTL;
 	if (noclass)
 		styleflags |= DNS_STYLEFLAG_NO_CLASS;
+	if (nocrypto)
+		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
 	if (multiline) {
 		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -853,6 +887,10 @@
 			if (lookup == default_lookup)
 				pluscomm = state;
 			break;
+		case 'r':
+			FULLCHECK("crypto");
+			nocrypto = ISC_TF(!state);
+			break;
 		default:
 			goto invalid_option;
 		}
@@ -885,19 +923,29 @@
 		}
 		break;
 	case 'e':
-		FULLCHECK("edns");
-		if (!state) {
-			lookup->edns = -1;
+		switch (cmd[1]) {
+		case 'd':
+			FULLCHECK("edns");
+			if (!state) {
+				lookup->edns = -1;
+				break;
+			}
+			if (value == NULL) {
+				lookup->edns = 0;
+				break;
+			}
+			result = parse_uint(&num, value, 255, "edns");
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse edns");
+			lookup->edns = num;
 			break;
+		case 'x':
+			FULLCHECK("expire");
+			lookup->expire = state;
+			break;
+		default:
+			goto invalid_option;
 		}
-		if (value == NULL) {
-			lookup->edns = 0;
-			break;
-		}
-		result = parse_uint(&num, value, 255, "edns");
-		if (result != ISC_R_SUCCESS)
-			fatal("Couldn't parse edns");
-		lookup->edns = num;
 		break;
 	case 'f': /* fail */
 		FULLCHECK("fail");
@@ -1059,12 +1107,34 @@
 				goto invalid_option;
 			}
 			break;
+#if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT)
+		case 'i':
+			switch (cmd[2]) {
 #ifdef DIG_SIGCHASE
-		case 'i': /* sigchase */
-			FULLCHECK("sigchase");
-			lookup->sigchase = state;
-			if (lookup->sigchase)
-				lookup->dnssec = ISC_TRUE;
+			case 'g': /* sigchase */
+				FULLCHECK("sigchase");
+				lookup->sigchase = state;
+				if (lookup->sigchase)
+					lookup->dnssec = ISC_TRUE;
+				break;
+#endif
+#ifdef ISC_PLATFORM_USESIT
+			case 't': /* sit */
+				FULLCHECK("sit");
+				if (state && lookup->edns == -1)
+					lookup->edns = 0;
+				lookup->sit = state;
+				if (value != NULL) {
+					strncpy(sitvalue, value,
+						sizeof(sitvalue));
+					lookup->sitvalue = sitvalue;
+				} else
+					lookup->sitvalue = NULL;
+				break;
+#endif
+			default:
+				goto invalid_option;
+			}
 			break;
 #endif
 		case 'p': /* split */
@@ -1095,12 +1165,29 @@
 			if (splitwidth)
 				splitwidth += 3;
 			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse retries");
+				fatal("Couldn't parse split");
 			break;
 		case 't': /* stats */
 			FULLCHECK("stats");
 			lookup->stats = state;
 			break;
+		case 'u': /* subnet */
+			FULLCHECK("subnet");
+			if (state && value == NULL)
+				goto need_value;
+			if (!state) {
+				if (lookup->ecs_addr != NULL) {
+					isc_mem_free(mctx, lookup->ecs_addr);
+					lookup->ecs_addr = NULL;
+				}
+				break;
+			}
+			if (lookup->edns == -1)
+				lookup->edns = 0;
+			result = parse_netprefix(&lookup->ecs_addr, value);
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse client");
+			break;
 		default:
 			goto invalid_option;
 		}
@@ -1206,7 +1293,7 @@
 /*%
  * #ISC_TRUE returned if value was used
  */
-static const char *single_dash_opts = "46dhimnv";
+static const char *single_dash_opts = "46dhimnuv";
 static const char *dash_opts = "46bcdfhikmnptvyx";
 static isc_boolean_t
 dash_option(char *option, char *next, dig_lookup_t **lookup,
@@ -1229,7 +1316,7 @@
 
 	while (strpbrk(option, single_dash_opts) == &option[0]) {
 		/*
-		 * Since the -[46dhimnv] options do not take an argument,
+		 * Since the -[46dhimnuv] options do not take an argument,
 		 * account for them (in any number and/or combination)
 		 * if they appear as the first character(s) of a q-opt.
 		 */
@@ -1278,6 +1365,9 @@
 		case 'n':
 			/* deprecated */
 			break;
+		case 'u':
+			use_usec = ISC_TRUE;
+			break;
 		case 'v':
 			version();
 			exit(0);
@@ -1607,7 +1697,7 @@
 		debug("main parsing %s", rv[0]);
 		if (strncmp(rv[0], "%", 1) == 0)
 			break;
-		if (strncmp(rv[0], "@", 1) == 0) {
+		if (rv[0][0] == '@') {
 			addresscount = getaddresses(lookup, &rv[0][1], NULL);
 		} else if (rv[0][0] == '+') {
 			plus_option(&rv[0][1], is_batchfile,
@@ -1842,10 +1932,6 @@
 main(int argc, char **argv) {
 	isc_result_t result;
 
-	isc__mem_register();
-	isc__task_register();
-	isc__timer_register();
-	isc__socket_register();
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
--- a/external/bsd/bind/dist/bin/dig/dighost.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dig/dighost.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dighost.c,v 1.11 2013/12/31 20:24:38 christos Exp $	*/
+/*	$NetBSD: dighost.c,v 1.12 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -76,17 +76,17 @@
 #include <isc/base64.h>
 #include <isc/entropy.h>
 #include <isc/file.h>
+#include <isc/hex.h>
 #include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/netaddr.h>
-#ifdef DIG_SIGCHASE
 #include <isc/netdb.h>
-#endif
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
 #include <isc/serial.h>
+#include <isc/sockaddr.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/timer.h>
@@ -178,6 +178,8 @@
 char keynametext[MXNAME];
 char keyfile[MXNAME] = "";
 char keysecret[MXNAME] = "";
+unsigned char cookie_secret[33];
+unsigned char cookie[8];
 dns_name_t *hmacname = NULL;
 unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
@@ -450,7 +452,7 @@
 append(const char *text, int len, char **p, char *end) {
 	if (len > end - *p)
 		return (ISC_R_NOSPACE);
-	memcpy(*p, text, len);
+	memmove(*p, text, len);
 	*p += len;
 	return (ISC_R_SUCCESS);
 }
@@ -767,7 +769,11 @@
 	looknew->servfail_stops = ISC_TRUE;
 	looknew->besteffort = ISC_TRUE;
 	looknew->dnssec = ISC_FALSE;
+	looknew->expire = ISC_FALSE;
 	looknew->nsid = ISC_FALSE;
+#ifdef ISC_PLATFORM_USESIT
+	looknew->sit = ISC_FALSE;
+#endif
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = ISC_FALSE;
 #if DIG_SIGCHASE_TD
@@ -803,6 +809,10 @@
 	looknew->new_search = ISC_FALSE;
 	looknew->done_as_is = ISC_FALSE;
 	looknew->need_search = ISC_FALSE;
+	looknew->ecs_addr = NULL;
+#ifdef ISC_PLATFORM_USESIT
+	looknew->sitvalue = NULL;
+#endif
 	ISC_LINK_INIT(looknew, link);
 	ISC_LIST_INIT(looknew->q);
 	ISC_LIST_INIT(looknew->connecting);
@@ -848,7 +858,12 @@
 	looknew->servfail_stops = lookold->servfail_stops;
 	looknew->besteffort = lookold->besteffort;
 	looknew->dnssec = lookold->dnssec;
+	looknew->expire = lookold->expire;
 	looknew->nsid = lookold->nsid;
+#ifdef ISC_PLATFORM_USESIT
+	looknew->sit = lookold->sit;
+	looknew->sitvalue = lookold->sitvalue;
+#endif
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = lookold->sigchase;
 #if DIG_SIGCHASE_TD
@@ -880,6 +895,12 @@
 	looknew->need_search = lookold->need_search;
 	looknew->done_as_is = lookold->done_as_is;
 
+	if (lookold->ecs_addr != NULL) {
+		size_t len = sizeof(isc_sockaddr_t);
+		looknew->ecs_addr = isc_mem_allocate(mctx, len);
+		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
+	}
+
 	if (servers)
 		clone_server_list(lookold->my_server_list,
 				  &looknew->my_server_list);
@@ -994,6 +1015,65 @@
 	return (tmp);
 }
 
+isc_result_t
+parse_netprefix(isc_sockaddr_t **sap, const char *value) {
+	isc_result_t result = ISC_R_SUCCESS;
+	isc_sockaddr_t *sa = NULL;
+	struct in_addr in4;
+	struct in6_addr in6;
+	isc_uint32_t netmask = 0;
+	char *slash = NULL;
+	isc_boolean_t parsed = ISC_FALSE;
+
+	if ((slash = strchr(value, '/'))) {
+		*slash = '\0';
+		result = isc_parse_uint32(&netmask, slash + 1, 10);
+		if (result != ISC_R_SUCCESS) {
+			*slash = '/';
+			fatal("invalid prefix length '%s': %s\n",
+			      value, isc_result_totext(result));
+		}
+	}
+
+	sa = isc_mem_allocate(mctx, sizeof(*sa));
+	if (inet_pton(AF_INET6, value, &in6) == 1) {
+		isc_sockaddr_fromin6(sa, &in6, 0);
+		parsed = ISC_TRUE;
+		if (netmask == 0 || netmask > 128)
+			netmask = 128;
+	} else if (inet_pton(AF_INET, value, &in4) == 1) {
+		parsed = ISC_TRUE;
+		isc_sockaddr_fromin(sa, &in4, 0);
+		if (netmask == 0 || netmask > 32)
+			netmask = 32;
+	} else if (netmask != 0) {
+		char buf[64];
+		int i;
+
+		strlcpy(buf, value, sizeof(buf));
+		for (i = 0; i < 3; i++) {
+			strlcat(buf, ".0", sizeof(buf));
+			if (inet_pton(AF_INET, buf, &in4) == 1) {
+				parsed = ISC_TRUE;
+				isc_sockaddr_fromin(sa, &in4, 0);
+				break;
+			}
+		}
+
+	}
+
+	if (slash != NULL)
+		*slash = '/';
+
+	if (!parsed)
+		fatal("invalid address '%s'", value);
+
+	sa->length = netmask;
+	*sap = sa;
+
+	return (ISC_R_SUCCESS);
+}
+
 
 /*
  * Parse HMAC algorithm specification
@@ -1212,6 +1292,7 @@
 	dig_searchlist_t *domain = NULL;
 	lwres_result_t lwresult;
 	unsigned int lwresflags;
+	isc_result_t result;
 
 	debug("setup_system()");
 
@@ -1290,7 +1371,10 @@
 #endif
 
 #endif
-
+	result = isc_entropy_getdata(entp, cookie_secret,
+				     sizeof(cookie_secret), NULL, 0);
+	if (result != ISC_R_SUCCESS)
+		fatal("unable to generate cookie secret");
 }
 
 /*%
@@ -1379,50 +1463,23 @@
 
 /*%
  * Add EDNS0 option record to a message.  Currently, the only supported
- * options are UDP buffer size, the DO bit, and NSID request.
+ * options are UDP buffer size, the DO bit, and EDNS options
+ * (e.g., NSID, SIT, client-subnet)
  */
 static void
 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
-	isc_boolean_t dnssec, isc_boolean_t nsid)
+	isc_boolean_t dnssec, dns_ednsopt_t *ednsopts, size_t count)
 {
 	dns_rdataset_t *rdataset = NULL;
-	dns_rdatalist_t *rdatalist = NULL;
-	dns_rdata_t *rdata = NULL;
 	isc_result_t result;
+	unsigned int flags = 0;
 
 	debug("add_opt()");
-	result = dns_message_gettemprdataset(msg, &rdataset);
-	check_result(result, "dns_message_gettemprdataset");
-	dns_rdataset_init(rdataset);
-	result = dns_message_gettemprdatalist(msg, &rdatalist);
-	check_result(result, "dns_message_gettemprdatalist");
-	result = dns_message_gettemprdata(msg, &rdata);
-	check_result(result, "dns_message_gettemprdata");
-
-	debug("setting udp size of %d", udpsize);
-	rdatalist->type = dns_rdatatype_opt;
-	rdatalist->covers = 0;
-	rdatalist->rdclass = udpsize;
-	rdatalist->ttl = edns << 16;
 	if (dnssec)
-		rdatalist->ttl |= DNS_MESSAGEEXTFLAG_DO;
-	if (nsid) {
-		isc_buffer_t *b = NULL;
-
-		result = isc_buffer_allocate(mctx, &b, 4);
-		check_result(result, "isc_buffer_allocate");
-		isc_buffer_putuint16(b, DNS_OPT_NSID);
-		isc_buffer_putuint16(b, 0);
-		rdata->data = isc_buffer_base(b);
-		rdata->length = isc_buffer_usedlength(b);
-		dns_message_takebuffer(msg, &b);
-	} else {
-		rdata->data = NULL;
-		rdata->length = 0;
-	}
-	ISC_LIST_INIT(rdatalist->rdata);
-	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
-	dns_rdatalist_tordataset(rdatalist, rdataset);
+		flags |= DNS_MESSAGEEXTFLAG_DO;
+	result = dns_message_buildopt(msg, &rdataset, edns, udpsize, flags,
+				      ednsopts, count);
+	check_result(result, "dns_message_buildopt");
 	result = dns_message_setopt(msg, rdataset);
 	check_result(result, "dns_message_setopt");
 }
@@ -1581,6 +1638,9 @@
 	if (lookup->tsigctx != NULL)
 		dst_context_destroy(&lookup->tsigctx);
 
+	if (lookup->ecs_addr != NULL)
+		isc_mem_free(mctx, lookup->ecs_addr);
+
 	isc_mem_free(mctx, lookup);
 }
 
@@ -1832,8 +1892,8 @@
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
 			if (lresult != ISC_R_SUCCESS) {
-				debug("couldn't get address for '%s': %s",
-				      namestr, isc_result_totext(lresult));
+				printf("couldn't get address for '%s': %s\n",
+				       namestr, isc_result_totext(lresult));
 				if (addresses_result == ISC_R_SUCCESS) {
 					addresses_result = lresult;
 					strcpy(bad_namestr, namestr);
@@ -2010,6 +2070,15 @@
 	dns_message_addname(lookup->sendmsg, soaname, DNS_SECTION_AUTHORITY);
 }
 
+#ifdef ISC_PLATFORM_USESIT
+static void
+compute_cookie(unsigned char *cookie, size_t len) {
+	/* XXXMPA need to fix, should be per server. */
+	INSIST(len >= 8U);
+	memmove(cookie, cookie_secret, 8);
+}
+#endif
+
 /*%
  * Setup the supplied lookup structure, making it ready to start sending
  * queries to servers.  Create and initialize the message to be sent as
@@ -2026,6 +2095,10 @@
 	isc_buffer_t b;
 	dns_compress_t cctx;
 	char store[MXNAME];
+	char ecsbuf[20];
+#ifdef ISC_PLATFORM_USESIT
+	char sitbuf[256];
+#endif
 #ifdef WITH_IDN
 	idn_result_t mr;
 	char utf8_textname[MXNAME], utf8_origin[MXNAME], idn_textname[MXNAME];
@@ -2277,13 +2350,98 @@
 	result = dns_message_renderbegin(lookup->sendmsg, &cctx,
 					 &lookup->renderbuf);
 	check_result(result, "dns_message_renderbegin");
-	if (lookup->udpsize > 0 || lookup->dnssec || lookup->edns > -1) {
+	if (lookup->udpsize > 0 || lookup->dnssec ||
+	    lookup->edns > -1 || lookup->ecs_addr != NULL)
+	{
+		dns_ednsopt_t opts[DNS_EDNSOPTIONS];
+		int i = 0;
+
 		if (lookup->udpsize == 0)
 			lookup->udpsize = 4096;
 		if (lookup->edns < 0)
 			lookup->edns = 0;
+
+		if (lookup->nsid) {
+			INSIST(i < DNS_EDNSOPTIONS);
+			opts[i].code = DNS_OPT_NSID;
+			opts[i].length = 0;
+			opts[i].value = NULL;
+			i++;
+		}
+
+		if (lookup->ecs_addr != NULL) {
+			isc_uint32_t prefixlen;
+			struct sockaddr *sa;
+			struct sockaddr_in *sin;
+			struct sockaddr_in6 *sin6;
+			size_t addrl;
+			isc_buffer_t b;
+
+			sa = &lookup->ecs_addr->type.sa;
+			prefixlen = lookup->ecs_addr->length;
+
+			/* Round up prefix len to a multiple of 8 */
+			addrl = (prefixlen + 7) / 8;
+
+			INSIST(i < DNS_EDNSOPTIONS);
+			opts[i].code = DNS_OPT_CLIENT_SUBNET;
+			opts[i].length = (isc_uint16_t) addrl + 4;
+			check_result(result, "isc_buffer_allocate");
+			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
+			if (sa->sa_family == AF_INET) {
+				sin = (struct sockaddr_in *) sa;
+				isc_buffer_putuint16(&b, 1);
+				isc_buffer_putuint8(&b, prefixlen);
+				isc_buffer_putuint8(&b, 0);
+				isc_buffer_putmem(&b,
+					  (isc_uint8_t *) &sin->sin_addr,
+					  (unsigned int) addrl);
+			} else {
+				sin6 = (struct sockaddr_in6 *) sa;
+				isc_buffer_putuint16(&b, 2);
+				isc_buffer_putuint8(&b, prefixlen);
+				isc_buffer_putuint8(&b, 0);
+				isc_buffer_putmem(&b,
+					  (isc_uint8_t *) &sin6->sin6_addr,
+					  (unsigned int) addrl);
+			}
+
+			opts[i].value = (isc_uint8_t *) ecsbuf;
+			i++;
+		}
+
+#ifdef ISC_PLATFORM_USESIT
+		if (lookup->sit) {
+			INSIST(i < DNS_EDNSOPTIONS);
+			opts[i].code = DNS_OPT_SIT;
+			if (lookup->sitvalue != NULL) {
+				isc_buffer_t b;
+
+				isc_buffer_init(&b, sitbuf, sizeof(sitbuf));
+				result = isc_hex_decodestring(lookup->sitvalue,
+							      &b);
+				check_result(result, "isc_hex_decodestring");
+				opts[i].value = isc_buffer_base(&b);
+				opts[i].length = isc_buffer_usedlength(&b);
+			} else {
+				compute_cookie(cookie, sizeof(cookie));
+				opts[i].length = 8;
+				opts[i].value = cookie;
+			}
+			i++;
+		}
+#endif
+
+		if (lookup->expire) {
+			INSIST(i < DNS_EDNSOPTIONS);
+			opts[i].code = DNS_OPT_EXPIRE;
+			opts[i].length = 0;
+			opts[i].value = NULL;
+			i++;
+		}
+
 		add_opt(lookup->sendmsg, lookup->udpsize,
-			lookup->edns, lookup->dnssec, lookup->nsid);
+			lookup->edns, lookup->dnssec, opts, i);
 	}
 
 	result = dns_message_rendersection(lookup->sendmsg,
@@ -2332,6 +2490,7 @@
 		query->rr_count = 0;
 		query->msg_count = 0;
 		query->byte_count = 0;
+		query->ixfr_axfr = ISC_FALSE;
 		ISC_LIST_INIT(query->recvlist);
 		ISC_LIST_INIT(query->lengthlist);
 		query->sock = NULL;
@@ -2348,6 +2507,7 @@
 		ISC_LINK_INIT(query, link);
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}
+
 	/* XXX qrflag, print_query, etc... */
 	if (!ISC_LIST_EMPTY(lookup->q) && qr) {
 		extrabytes = 0;
@@ -2984,6 +3144,9 @@
 	isc_boolean_t ixfr = query->lookup->rdtype == dns_rdatatype_ixfr;
 	isc_boolean_t axfr = query->lookup->rdtype == dns_rdatatype_axfr;
 
+	if (ixfr)
+		axfr = query->ixfr_axfr;
+
 	debug("check_for_more_data()");
 
 	/*
@@ -3032,7 +3195,7 @@
 					query->second_rr_rcvd = ISC_TRUE;
 					query->second_rr_serial = 0;
 					debug("got the second rr as nonsoa");
-					axfr = ISC_TRUE;
+					axfr = query->ixfr_axfr = ISC_TRUE;
 					goto next_rdata;
 				}
 
@@ -3107,6 +3270,74 @@
 	return (ISC_TRUE);
 }
 
+#ifdef ISC_PLATFORM_USESIT
+static void
+process_sit(dig_lookup_t *l, dns_message_t *msg,
+	    isc_buffer_t *optbuf, size_t optlen)
+{
+	char bb[256];
+	isc_buffer_t hexbuf;
+	size_t len;
+	const unsigned char *sit;
+	isc_result_t result;
+
+	if (l->sitvalue != NULL) {
+		isc_buffer_init(&hexbuf, bb, sizeof(bb));
+		result = isc_hex_decodestring(l->sitvalue, &hexbuf);
+		check_result(result, "isc_hex_decodestring");
+		sit = isc_buffer_base(&hexbuf);
+		len = isc_buffer_usedlength(&hexbuf);
+	} else {
+		sit = cookie;
+		len = sizeof(cookie);
+	}
+
+	INSIST(msg->sitok == 0 && msg->sitbad == 0);
+	if (optlen >= len && optlen >= 8U) {
+		if (memcmp(isc_buffer_current(optbuf), sit, 8) == 0) {
+			msg->sitok = 1;
+		} else {
+			printf(";; Warning: SIT client cookie mismatch\n");
+			msg->sitbad = 1;
+		}
+	} else {
+		printf(";; Warning: SIT bad token (too short)\n");
+		msg->sitbad = 1;
+	}
+	isc_buffer_forward(optbuf, (unsigned int)optlen);
+}
+
+static void
+process_opt(dig_lookup_t *l, dns_message_t *msg) {
+	dns_rdata_t rdata;
+	isc_result_t result;
+	isc_buffer_t optbuf;
+	isc_uint16_t optcode, optlen;
+	dns_rdataset_t *opt = msg->opt;
+
+	result = dns_rdataset_first(opt);
+	if (result == ISC_R_SUCCESS) {
+		dns_rdata_init(&rdata);
+		dns_rdataset_current(opt, &rdata);
+		isc_buffer_init(&optbuf, rdata.data, rdata.length);
+		isc_buffer_add(&optbuf, rdata.length);
+		while (isc_buffer_remaininglength(&optbuf) >= 4) {
+			optcode = isc_buffer_getuint16(&optbuf);
+			optlen = isc_buffer_getuint16(&optbuf);
+			switch (optcode) {
+			case DNS_OPT_SIT:
+				process_sit(l, msg, &optbuf, optlen);
+				break;
+			default:
+				isc_buffer_forward(&optbuf, optlen);
+				break;
+			}
+		}
+	}
+}
+#endif
+
+
 /*%
  * Event handler for recv complete.  Perform whatever actions are necessary,
  * based on the specifics of the user's request.
@@ -3367,7 +3598,8 @@
 	}
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
 	    !l->ignore && !l->tcp_mode) {
-		printf(";; Truncated, retrying in TCP mode.\n");
+		if (l->comments)
+			printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, ISC_TRUE);
 		n->tcp_mode = ISC_TRUE;
 		n->origin = query->lookup->origin;
@@ -3399,7 +3631,7 @@
 		 */
 		if ((ISC_LIST_HEAD(l->q) != query) ||
 		    (ISC_LIST_NEXT(query, link) != NULL)) {
-			if( l->comments == ISC_TRUE )
+			if (l->comments)
 				printf(";; Got %s from %s, "
 				       "trying next server\n",
 				       msg->rcode == dns_rcode_servfail ?
@@ -3467,6 +3699,16 @@
 		}
 	}
 
+#ifdef ISC_PLATFORM_USESIT
+	if (l->sitvalue != NULL) {
+		if (msg->opt == NULL)
+			printf(";; expected opt record in response\n");
+		else
+			process_opt(l, msg);
+	} else if (l->sit && msg->opt != NULL)
+		process_opt(l, msg);
+#endif
+
 	if (!l->doing_xfr || l->xfr_q == query) {
 		if (msg->rcode == dns_rcode_nxdomain &&
 		    (l->origin != NULL || l->need_search)) {
@@ -3943,7 +4185,7 @@
 	fromlen = isc_buffer_usedlength(buffer) - used_org;
 	if (fromlen >= MAXDLEN)
 		return (ISC_R_SUCCESS);
-	memcpy(tmp1, (char *)isc_buffer_base(buffer) + used_org, fromlen);
+	memmove(tmp1, (char *)isc_buffer_base(buffer) + used_org, fromlen);
 	end_with_dot = (tmp1[fromlen - 1] == '.') ? ISC_TRUE : ISC_FALSE;
 	if (absolute && !end_with_dot) {
 		fromlen++;
@@ -3972,7 +4214,7 @@
 		return (ISC_R_NOSPACE);
 
 	isc_buffer_subtract(buffer, isc_buffer_usedlength(buffer) - used_org);
-	memcpy(isc_buffer_used(buffer), tmp1, tolen);
+	memmove(isc_buffer_used(buffer), tmp1, tolen);
 	isc_buffer_add(buffer, (unsigned int)tolen);
 
 	return (ISC_R_SUCCESS);
@@ -3992,7 +4234,8 @@
 	if (namelen + 1 + originlen >= namesize)
 		return idn_buffer_overflow;
 
-	name[namelen++] = '.';
+	if (*origin != '.')
+		name[namelen++] = '.';
 	(void)strcpy(name + namelen, origin);
 	return idn_success;
 }
--- a/external/bsd/bind/dist/bin/dig/host.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dig/host.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: host.c,v 1.7 2013/12/31 20:24:38 christos Exp $	*/
+/*	$NetBSD: host.c,v 1.8 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
  * Copyright (C) 2004-2007, 2009-2013  Internet Systems Consortium, Inc. ("ISC")
@@ -870,10 +870,6 @@
 
 	tries = 2;
 
-	isc__mem_register();
-	isc__task_register();
-	isc__timer_register();
-	isc__socket_register();
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
--- a/external/bsd/bind/dist/bin/dig/include/dig/dig.h	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dig/include/dig/dig.h	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dig.h,v 1.8 2013/12/31 20:24:38 christos Exp $	*/
+/*	$NetBSD: dig.h,v 1.9 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004-2009, 2011-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2009, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -132,6 +132,10 @@
 		done_as_is,
 		besteffort,
 		dnssec,
+		expire,
+#ifdef ISC_PLATFORM_USESIT
+		sit,
+#endif
 		nsid;   /*% Name Server ID (RFC 5001) */
 #ifdef DIG_SIGCHASE
 isc_boolean_t	sigchase;
@@ -186,6 +190,10 @@
 	isc_buffer_t *querysig;
 	isc_uint32_t msgcounter;
 	dns_fixedname_t fdomain;
+	isc_sockaddr_t *ecs_addr;
+#ifdef ISC_PLATFORM_USESIT
+	char *sitvalue;
+#endif
 };
 
 /*% The dig_query structure */
@@ -204,6 +212,7 @@
 	isc_uint32_t second_rr_serial;
 	isc_uint32_t msg_count;
 	isc_uint32_t rr_count;
+	isc_boolean_t ixfr_axfr;
 	char *servname;
 	char *userarg;
 	isc_bufferlist_t sendlist,
@@ -338,6 +347,9 @@
 parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc);
 
+isc_result_t
+parse_netprefix(isc_sockaddr_t **sap, const char *value);
+
 void
 parse_hmac(const char *hmacstr);
 
--- a/external/bsd/bind/dist/bin/dig/nslookup.1	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dig/nslookup.1	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: nslookup.1,v 1.4 2013/12/31 20:24:38 christos Exp $
+.\"	$NetBSD: nslookup.1,v 1.5 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2004-2007, 2010, 2013 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -261,5 +261,5 @@
 .PP
 Andrew Cherenson
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2007, 2010, 2013 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2007, 2010, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
--- a/external/bsd/bind/dist/bin/dig/nslookup.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dig/nslookup.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: nslookup.c,v 1.7 2013/12/31 20:24:38 christos Exp $	*/
+/*	$NetBSD: nslookup.c,v 1.8 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
  * Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
@@ -893,10 +893,6 @@
 
 	interactive = ISC_TF(isatty(0));
 
-	isc__mem_register();
-	isc__task_register();
-	isc__timer_register();
-	isc__socket_register();
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-dsfromkey.c,v 1.7 2013/07/27 19:23:09 christos Exp $	*/
+/*	$NetBSD: dnssec-dsfromkey.c,v 1.8 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2008-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2008-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* Id: dnssec-dsfromkey.c,v 1.24 2011/10/25 01:54:18 marka Exp  */
+/* Id: dnssec-dsfromkey.c,v 1.24.114.1 2012/02/07 00:44:12 each Exp  */
 
 /*! \file */
 
@@ -86,7 +86,7 @@
 	dns_rdatacallbacks_t callbacks;
 
 	dns_rdatacallbacks_init(&callbacks);
-	result = dns_db_beginload(db, &callbacks.add, &callbacks.add_private);
+	result = dns_db_beginload(db, &callbacks);
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_db_beginload failed: %s", isc_result_totext(result));
 
@@ -95,7 +95,7 @@
 	if (result != ISC_R_SUCCESS)
 		fatal("can't load from input: %s", isc_result_totext(result));
 
-	result = dns_db_endload(db, &callbacks.add_private);
+	result = dns_db_endload(db, &callbacks);
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_db_endload failed: %s", isc_result_totext(result));
 }
@@ -363,7 +363,6 @@
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;
 
-	isc__mem_register();
 	dns_rdata_init(&rdata);
 
 	if (argc == 1)
@@ -451,7 +450,7 @@
 		else if (strcasecmp(algname, "SHA256") == 0 ||
 			 strcasecmp(algname, "SHA-256") == 0)
 			dtype = DNS_DSDIGEST_SHA256;
-#ifdef HAVE_OPENSSL_GOST
+#if defined(HAVE_OPENSSL_GOST) || defined(HAVE_PKCS11_GOST)
 		else if (strcasecmp(algname, "GOST") == 0)
 			dtype = DNS_DSDIGEST_GOST;
 #endif
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-importkey.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-importkey.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-importkey.c,v 1.2 2013/12/31 20:24:39 christos Exp $	*/
+/*	$NetBSD: dnssec-importkey.c,v 1.3 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -87,7 +87,7 @@
 	dns_rdatacallbacks_t callbacks;
 
 	dns_rdatacallbacks_init(&callbacks);
-	result = dns_db_beginload(db, &callbacks.add, &callbacks.add_private);
+	result = dns_db_beginload(db, &callbacks);
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_db_beginload failed: %s", isc_result_totext(result));
 
@@ -96,7 +96,7 @@
 	if (result != ISC_R_SUCCESS)
 		fatal("can't load from input: %s", isc_result_totext(result));
 
-	result = dns_db_endload(db, &callbacks.add_private);
+	result = dns_db_endload(db, &callbacks);
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_db_endload failed: %s", isc_result_totext(result));
 }
@@ -315,8 +315,8 @@
 			if (setdel)
 				fatal("-D specified more than once");
 
-			setdel = ISC_TRUE;
-			del = strtotime(isc_commandline_argument, now, now);
+			del = strtotime(isc_commandline_argument,
+					now, now, &setdel);
 			break;
 		case 'K':
 			dir = isc_commandline_argument;
@@ -324,17 +324,15 @@
 				fatal("directory must be non-empty string");
 			break;
 		case 'L':
-			if (strcmp(isc_commandline_argument, "none") == 0)
-				ttl = 0;
-			else
-				ttl = strtottl(isc_commandline_argument);
+			ttl = strtottl(isc_commandline_argument);
 			setttl = ISC_TRUE;
 			break;
 		case 'P':
 			if (setpub)
 				fatal("-P specified more than once");
-			setpub = ISC_TRUE;
-			pub = strtotime(isc_commandline_argument, now, now);
+
+			pub = strtotime(isc_commandline_argument,
+					now, now, &setpub);
 			break;
 		case 'f':
 			filename = isc_commandline_argument;
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dnssec-keyfromlabel.8,v 1.6 2012/12/04 23:38:38 spz Exp $
+.\"	$NetBSD: dnssec-keyfromlabel.8,v 1.7 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2008-2012 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -69,12 +69,26 @@
 .PP
 \-E \fIengine\fR
 .RS 4
-Specifies the name of the crypto hardware (OpenSSL engine). When compiled with PKCS#11 support it defaults to "pkcs11".
+Specifies the cryptographic hardware to use.
+.sp
+When BIND is built with OpenSSL PKCS#11 support, this defaults to the string "pkcs11", which identifies an OpenSSL engine that can drive a cryptographic accelerator or hardware service module. When BIND is built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it defaults to the path of the PKCS#11 provider library specified via "\-\-with\-pkcs11".
 .RE
 .PP
 \-l \fIlabel\fR
 .RS 4
-Specifies the label of the key pair in the crypto hardware. The label may be preceded by an optional OpenSSL engine name, separated by a colon, as in "pkcs11:keylabel".
+Specifies the label for a key pair in the crypto hardware.
+.sp
+When
+BIND
+9 is built with OpenSSL\-based PKCS#11 support, the label is an arbitrary string that identifies a particular key. It may be preceded by an optional OpenSSL engine name, followed by a colon, as in "pkcs11:\fIkeylabel\fR".
+.sp
+When
+BIND
+9 is built with native PKCS#11 support, the label is a PKCS#11 URI string in the format "pkcs11:\fBkeyword\fR=\fIvalue\fR[;\fBkeyword\fR=\fIvalue\fR;...]" Keywords include "token", which identifies the HSM; "object", which identifies the key; and "pin\-source", which identifies a file from which the HSM's PIN code can be obtained. The label will be stored in the on\-disk "private" file.
+.sp
+If the label contains a
+\fBpin\-source\fR
+field, tools using the generated key files will be able to use the HSM for signing and other operations without any need for an operator to manually enter a PIN. Note: Making the HSM's PIN accessible in this manner may reduce the security advantage of using an HSM; be sure this is what you want to do before making use of this feature.
 .RE
 .PP
 \-n \fInametype\fR
@@ -156,7 +170,7 @@
 .RE
 .SH "TIMING OPTIONS"
 .PP
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds.
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.
 .PP
 \-P \fIdate/offset\fR
 .RS 4
@@ -221,10 +235,11 @@
 \fBdnssec\-keygen\fR(8),
 \fBdnssec\-signzone\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 4034.
+RFC 4034,
+The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13).
 .SH "AUTHOR"
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2008\-2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008\-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keyfromlabel.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-keyfromlabel.c,v 1.10 2013/07/27 19:23:09 christos Exp $	*/
+/*	$NetBSD: dnssec-keyfromlabel.c,v 1.11 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2007-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2007-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -78,10 +78,15 @@
 			       "NSEC3RSASHA1 if using -3)\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
-#ifdef USE_PKCS11
-	fprintf(stderr, "    -E enginename (default: pkcs11)\n");
+	fprintf(stderr, "    -E <engine>:\n");
+#if defined(PKCS11CRYPTO)
+	fprintf(stderr, "        path to PKCS#11 provider library "
+				"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
+	fprintf(stderr, "        name of an OpenSSL engine to use "
+				"(default is \"pkcs11\")\n");
 #else
-	fprintf(stderr, "    -E enginename\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 #endif
 	fprintf(stderr, "    -f keyflag: KSK | REVOKE\n");
 	fprintf(stderr, "    -K directory: directory in which to place "
@@ -118,7 +123,7 @@
 	char		*nametype = NULL, *type = NULL;
 	const char	*directory = NULL;
 #ifdef USE_PKCS11
-	const char	*engine = "pkcs11";
+	const char	*engine = PKCS11_ENGINE;
 #else
 	const char	*engine = NULL;
 #endif
@@ -161,7 +166,6 @@
 	if (argc == 1)
 		usage();
 
-	isc__mem_register();
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 
 	dns_result_register();
@@ -210,10 +214,7 @@
 			options |= DST_TYPE_KEY;
 			break;
 		case 'L':
-			if (strcmp(isc_commandline_argument, "none") == 0)
-				ttl = 0;
-			else
-				ttl = strtottl(isc_commandline_argument);
+			ttl = strtottl(isc_commandline_argument);
 			setttl = ISC_TRUE;
 			break;
 		case 'l':
@@ -246,61 +247,41 @@
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setpub = ISC_TRUE;
-				publish = strtotime(isc_commandline_argument,
-						    now, now);
-			} else {
-				unsetpub = ISC_TRUE;
-			}
+			publish = strtotime(isc_commandline_argument,
+					    now, now, &setpub);
+			unsetpub = !setpub;
 			break;
 		case 'A':
 			if (setact || unsetact)
 				fatal("-A specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setact = ISC_TRUE;
-				activate = strtotime(isc_commandline_argument,
-						     now, now);
-			} else {
-				unsetact = ISC_TRUE;
-			}
+			activate = strtotime(isc_commandline_argument,
+					     now, now, &setact);
+			unsetact = !setact;
 			break;
 		case 'R':
 			if (setrev || unsetrev)
 				fatal("-R specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setrev = ISC_TRUE;
-				revoke = strtotime(isc_commandline_argument,
-						   now, now);
-			} else {
-				unsetrev = ISC_TRUE;
-			}
+			revoke = strtotime(isc_commandline_argument,
+					   now, now, &setrev);
+			unsetrev = !setrev;
 			break;
 		case 'I':
 			if (setinact || unsetinact)
 				fatal("-I specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setinact = ISC_TRUE;
-				inactive = strtotime(isc_commandline_argument,
-						     now, now);
-			} else {
-				unsetinact = ISC_TRUE;
-			}
+			inactive = strtotime(isc_commandline_argument,
+					     now, now, &setinact);
+			unsetinact = !setinact;
 			break;
 		case 'D':
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setdel = ISC_TRUE;
-				delete = strtotime(isc_commandline_argument,
-						   now, now);
-			} else {
-				unsetdel = ISC_TRUE;
-			}
+			delete = strtotime(isc_commandline_argument,
+					   now, now, &setdel);
+			unsetdel = !setdel;
 			break;
 		case 'F':
 			/* Reserved for FIPS mode */
@@ -337,16 +318,15 @@
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");
 
-	if (strchr(label, ':') == NULL &&
-	    engine != NULL && strlen(engine) != 0U) {
+	if (strchr(label, ':') == NULL) {
 		char *l;
 		int len;
 
-		len = strlen(label) + strlen(engine) + 2;
+		len = strlen(label) + 8;
 		l = isc_mem_allocate(mctx, len);
 		if (l == NULL)
 			fatal("cannot allocate memory");
-		snprintf(l, len, "%s:%s", engine, label);
+		snprintf(l, len, "pkcs11:%s", label);
 		isc_mem_free(mctx, label);
 		label = l;
 	}
@@ -463,7 +443,7 @@
 
 	/* associate the key */
 	ret = dst_key_fromlabel(name, alg, flags, protocol,
-				rdclass, engine, label, NULL, mctx, &key);
+				rdclass, "pkcs11", label, NULL, mctx, &key);
 	isc_entropy_stopcallbacksources(ectx);
 
 	if (ret != ISC_R_SUCCESS) {
@@ -471,7 +451,7 @@
 		char algstr[DNS_SECALG_FORMATSIZE];
 		dns_name_format(name, namestr, sizeof(namestr));
 		dns_secalg_format(alg, algstr, sizeof(algstr));
-		fatal("failed to get key %s/%s: %s\n",
+		fatal("failed to get key %s/%s: %s",
 		      namestr, algstr, isc_result_totext(ret));
 		/* NOTREACHED */
 		exit(-1);
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dnssec-keygen.8,v 1.5 2012/12/04 23:38:38 spz Exp $
+.\"	$NetBSD: dnssec-keygen.8,v 1.6 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2004, 2005, 2007-2012 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004, 2005, 2007-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -102,7 +102,9 @@
 .PP
 \-E \fIengine\fR
 .RS 4
-Uses a crypto hardware (OpenSSL engine) for random number and, when supported, key generation. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine.
+Specifies the cryptographic hardware to use, when applicable.
+.sp
+When BIND is built with OpenSSL PKCS#11 support, this defaults to the string "pkcs11", which identifies an OpenSSL engine that can drive a cryptographic accelerator or hardware service module. When BIND is built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it defaults to the path of the PKCS#11 provider library specified via "\-\-with\-pkcs11".
 .RE
 .PP
 \-f \fIflag\fR
@@ -201,7 +203,7 @@
 .RE
 .SH "TIMING OPTIONS"
 .PP
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds.
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To explicitly prevent a date from being set, use 'none' or 'never'.
 .PP
 \-P \fIdate/offset\fR
 .RS 4
@@ -210,7 +212,7 @@
 .PP
 \-A \fIdate/offset\fR
 .RS 4
-Sets the date on which the key is to be activated. After that date, the key will be included in the zone and used to sign it. If not set, and if the \-G option has not been used, the default is "now".
+Sets the date on which the key is to be activated. After that date, the key will be included in the zone and used to sign it. If not set, and if the \-G option has not been used, the default is "now". If set, if and \-P is not set, then the publication date will be set to the activation date minus the prepublication interval.
 .RE
 .PP
 \-R \fIdate/offset\fR
@@ -304,7 +306,7 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004, 2005, 2007\-2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004, 2005, 2007\-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-keygen.c,v 1.12 2013/12/31 20:24:39 christos Exp $	*/
+/*	$NetBSD: dnssec-keygen.c,v 1.13 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Portions Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -121,10 +121,15 @@
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
-#ifdef USE_PKCS11
-	fprintf(stderr, "    -E <engine name> (default \"pkcs11\")\n");
+	fprintf(stderr, "    -E <engine>:\n");
+#if defined(PKCS11CRYPTO)
+	fprintf(stderr, "        path to PKCS#11 provider library "
+				"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
+	fprintf(stderr, "        name of an OpenSSL engine to use "
+				"(default is \"pkcs11\")\n");
 #else
-	fprintf(stderr, "    -E <engine name>\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 #endif
 	fprintf(stderr, "    -f <keyflag>: KSK | REVOKE\n");
 	fprintf(stderr, "    -g <generator>: use specified generator "
@@ -136,7 +141,6 @@
 			"records with (default: 0)\n");
 	fprintf(stderr, "    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; "
 			"use KEY for SIG(0))\n");
-	fprintf(stderr, "        ECCGOST:\tignored\n");
 	fprintf(stderr, "    -t <type>: "
 			"AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF "
 			"(default: AUTHCONF)\n");
@@ -225,7 +229,7 @@
 	isc_log_t	*log = NULL;
 	isc_entropy_t	*ectx = NULL;
 #ifdef USE_PKCS11
-	const char	*engine = "pkcs11";
+	const char	*engine = PKCS11_ENGINE;
 #else
 	const char	*engine = NULL;
 #endif
@@ -249,7 +253,6 @@
 	isc_boolean_t	show_progress = ISC_FALSE;
 	unsigned char	c;
 
-	isc__mem_register();
 	if (argc == 1)
 		usage();
 
@@ -346,10 +349,7 @@
 			      "To generate a key with TYPE=KEY, use -T KEY.\n");
 			break;
 		case 'L':
-			if (strcmp(isc_commandline_argument, "none") == 0)
-				ttl = 0;
-			else
-				ttl = strtottl(isc_commandline_argument);
+			ttl = strtottl(isc_commandline_argument);
 			setttl = ISC_TRUE;
 			break;
 		case 'n':
@@ -406,61 +406,41 @@
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setpub = ISC_TRUE;
-				publish = strtotime(isc_commandline_argument,
-						    now, now);
-			} else {
-				unsetpub = ISC_TRUE;
-			}
+			publish = strtotime(isc_commandline_argument,
+					    now, now, &setpub);
+			unsetpub = !setpub;
 			break;
 		case 'A':
 			if (setact || unsetact)
 				fatal("-A specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setact = ISC_TRUE;
-				activate = strtotime(isc_commandline_argument,
-						     now, now);
-			} else {
-				unsetact = ISC_TRUE;
-			}
+			activate = strtotime(isc_commandline_argument,
+					     now, now, &setact);
+			unsetact = !setact;
 			break;
 		case 'R':
 			if (setrev || unsetrev)
 				fatal("-R specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setrev = ISC_TRUE;
-				revoke = strtotime(isc_commandline_argument,
-						   now, now);
-			} else {
-				unsetrev = ISC_TRUE;
-			}
+			revoke = strtotime(isc_commandline_argument,
+					   now, now, &setrev);
+			unsetrev = !setrev;
 			break;
 		case 'I':
 			if (setinact || unsetinact)
 				fatal("-I specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setinact = ISC_TRUE;
-				inactive = strtotime(isc_commandline_argument,
-						     now, now);
-			} else {
-				unsetinact = ISC_TRUE;
-			}
+			inactive = strtotime(isc_commandline_argument,
+					     now, now, &setinact);
+			unsetinact = !setinact;
 			break;
 		case 'D':
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
-			if (strcasecmp(isc_commandline_argument, "none")) {
-				setdel = ISC_TRUE;
-				delete = strtotime(isc_commandline_argument,
-						   now, now);
-			} else {
-				unsetdel = ISC_TRUE;
-			}
+			delete = strtotime(isc_commandline_argument,
+					   now, now, &setdel);
+			unsetdel = !setdel;
 			break;
 		case 'S':
 			predecessor = isc_commandline_argument;
@@ -596,8 +576,8 @@
 					size = 1024;
 				if (verbose > 0)
 					fprintf(stderr, "key size not "
-							"specified; defaulting "
-							"to %d\n", size);
+							"specified; defaulting"
+							" to %d\n", size);
 			} else if (alg != DST_ALG_ECCGOST &&
 				   alg != DST_ALG_ECDSA256 &&
 				   alg != DST_ALG_ECDSA384)
@@ -939,9 +919,9 @@
 
 			if (setpub)
 				dst_key_settime(key, DST_TIME_PUBLISH, publish);
-			else if (setact)
+			else if (setact && !unsetpub)
 				dst_key_settime(key, DST_TIME_PUBLISH,
-						activate);
+						activate - prepub);
 			else if (!genonly && !unsetpub)
 				dst_key_settime(key, DST_TIME_PUBLISH, now);
 
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-revoke.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-revoke.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dnssec-revoke.8,v 1.3 2012/06/05 00:38:56 christos Exp $
+.\"	$NetBSD: dnssec-revoke.8,v 1.4 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -63,7 +63,9 @@
 .PP
 \-E \fIengine\fR
 .RS 4
-Use the given OpenSSL engine. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine.
+Specifies the cryptographic hardware to use, when applicable.
+.sp
+When BIND is built with OpenSSL PKCS#11 support, this defaults to the string "pkcs11", which identifies an OpenSSL engine that can drive a cryptographic accelerator or hardware service module. When BIND is built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it defaults to the path of the PKCS#11 provider library specified via "\-\-with\-pkcs11".
 .RE
 .PP
 \-f
@@ -86,5 +88,5 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2009, 2011 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-revoke.c,v 1.5 2013/07/27 19:23:09 christos Exp $	*/
+/*	$NetBSD: dnssec-revoke.c,v 1.6 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2009-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -55,7 +55,10 @@
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-#ifdef USE_PKCS11
+#if defined(PKCS11CRYPTO)
+	fprintf(stderr, "    -E engine:    specify PKCS#11 provider "
+					"(default: %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
 	fprintf(stderr, "    -E engine:    specify OpenSSL engine "
 					   "(default \"pkcs11\")\n");
 #else
@@ -78,7 +81,7 @@
 main(int argc, char **argv) {
 	isc_result_t result;
 #ifdef USE_PKCS11
-	const char *engine = "pkcs11";
+	const char *engine = PKCS11_ENGINE;
 #else
 	const char *engine = NULL;
 #endif
@@ -98,7 +101,6 @@
 	if (argc == 1)
 		usage();
 
-	isc__mem_register();
 	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-settime.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-settime.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dnssec-settime.8,v 1.4 2012/06/05 00:38:56 christos Exp $
+.\"	$NetBSD: dnssec-settime.8,v 1.5 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2009-2011 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -90,11 +90,13 @@
 .PP
 \-E \fIengine\fR
 .RS 4
-Use the given OpenSSL engine. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine.
+Specifies the cryptographic hardware to use, when applicable.
+.sp
+When BIND is built with OpenSSL PKCS#11 support, this defaults to the string "pkcs11", which identifies an OpenSSL engine that can drive a cryptographic accelerator or hardware service module. When BIND is built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it defaults to the path of the PKCS#11 provider library specified via "\-\-with\-pkcs11".
 .RE
 .SH "TIMING OPTIONS"
 .PP
-Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To unset a date, use 'none'.
+Dates can be expressed in the format YYYYMMDD or YYYYMMDDHHMMSS. If the argument begins with a '+' or '\-', it is interpreted as an offset from the present time. For convenience, if such an offset is followed by one of the suffixes 'y', 'mo', 'w', 'd', 'h', or 'mi', then the offset is computed in years (defined as 365 24\-hour days, ignoring leap years), months (defined as 30 24\-hour days), weeks, days, hours, or minutes, respectively. Without a suffix, the offset is computed in seconds. To unset a date, use 'none' or 'never'.
 .PP
 \-P \fIdate/offset\fR
 .RS 4
@@ -173,5 +175,5 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2009\-2011 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009\-2011, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-settime.c,v 1.8 2013/12/31 20:24:39 christos Exp $	*/
+/*	$NetBSD: dnssec-settime.c,v 1.9 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2009-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -59,9 +59,12 @@
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "General options:\n");
-#ifdef USE_PKCS11
+#if defined(PKCS11CRYPTO)
+	fprintf(stderr, "    -E engine:          specify PKCS#11 provider "
+					"(default: %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
 	fprintf(stderr, "    -E engine:          specify OpenSSL engine "
-						 "(default \"pkcs11\")\n");
+					   "(default \"pkcs11\")\n");
 #else
 	fprintf(stderr, "    -E engine:          specify OpenSSL engine\n");
 #endif
@@ -121,7 +124,7 @@
 main(int argc, char **argv) {
 	isc_result_t	result;
 #ifdef USE_PKCS11
-	const char	*engine = "pkcs11";
+	const char	*engine = PKCS11_ENGINE;
 #else
 	const char	*engine = NULL;
 #endif
@@ -158,7 +161,6 @@
 	isc_boolean_t   changed = ISC_FALSE;
 	isc_log_t       *log = NULL;
 
-	isc__mem_register();
 	if (argc == 1)
 		usage();
 
@@ -239,10 +241,7 @@
 			}
 			break;
 		case 'L':
-			if (strcmp(isc_commandline_argument, "none") == 0)
-				ttl = 0;
-			else
-				ttl = strtottl(isc_commandline_argument);
+			ttl = strtottl(isc_commandline_argument);
 			setttl = ISC_TRUE;
 			break;
 		case 'v':
@@ -255,65 +254,45 @@
 				fatal("-P specified more than once");
 
 			changed = ISC_TRUE;
-			if (!strcasecmp(isc_commandline_argument, "none")) {
-				unsetpub = ISC_TRUE;
-			} else {
-				setpub = ISC_TRUE;
-				pub = strtotime(isc_commandline_argument,
-						now, now);
-			}
+			pub = strtotime(isc_commandline_argument,
+					now, now, &setpub);
+			unsetpub = !setpub;
 			break;
 		case 'A':
 			if (setact || unsetact)
 				fatal("-A specified more than once");
 
 			changed = ISC_TRUE;
-			if (!strcasecmp(isc_commandline_argument, "none")) {
-				unsetact = ISC_TRUE;
-			} else {
-				setact = ISC_TRUE;
-				act = strtotime(isc_commandline_argument,
-						now, now);
-			}
+			act = strtotime(isc_commandline_argument,
+					now, now, &setact);
+			unsetact = !setact;
 			break;
 		case 'R':
 			if (setrev || unsetrev)
 				fatal("-R specified more than once");
 
 			changed = ISC_TRUE;
-			if (!strcasecmp(isc_commandline_argument, "none")) {
-				unsetrev = ISC_TRUE;
-			} else {
-				setrev = ISC_TRUE;
-				rev = strtotime(isc_commandline_argument,
-						now, now);
-			}
+			rev = strtotime(isc_commandline_argument,
+					now, now, &setrev);
+			unsetrev = !setrev;
 			break;
 		case 'I':
 			if (setinact || unsetinact)
 				fatal("-I specified more than once");
 
 			changed = ISC_TRUE;
-			if (!strcasecmp(isc_commandline_argument, "none")) {
-				unsetinact = ISC_TRUE;
-			} else {
-				setinact = ISC_TRUE;
-				inact = strtotime(isc_commandline_argument,
-						now, now);
-			}
+			inact = strtotime(isc_commandline_argument,
+					now, now, &setinact);
+			unsetinact = !setinact;
 			break;
 		case 'D':
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");
 
 			changed = ISC_TRUE;
-			if (!strcasecmp(isc_commandline_argument, "none")) {
-				unsetdel = ISC_TRUE;
-			} else {
-				setdel = ISC_TRUE;
-				del = strtotime(isc_commandline_argument,
-						now, now);
-			}
+			del = strtotime(isc_commandline_argument,
+					now, now, &setdel);
+			unsetdel = !setdel;
 			break;
 		case 'S':
 			predecessor = isc_commandline_argument;
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dnssec-signzone.8,v 1.5 2013/12/31 20:24:39 christos Exp $
+.\"	$NetBSD: dnssec-signzone.8,v 1.6 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2004-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2009, 2011-2014 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -35,7 +35,7 @@
 dnssec\-signzone \- DNSSEC zone signing tool
 .SH "SYNOPSIS"
 .HP 16
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fIdomain\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-signzone\fR
@@ -79,13 +79,15 @@
 Output only those record types automatically managed by
 \fBdnssec\-signzone\fR, i.e. RRSIG, NSEC, NSEC3 and NSEC3PARAM records. If smart signing (\fB\-S\fR) is used, DNSKEY records are also included. The resulting file can be included in the original zone file with
 \fB$INCLUDE\fR. This option cannot be combined with
-\fB\-O raw\fR
-or serial number updating.
+\fB\-O raw\fR,
+\fB\-O map\fR, or serial number updating.
 .RE
 .PP
 \-E \fIengine\fR
 .RS 4
-Uses a crypto hardware (OpenSSL engine) for the crypto operations it supports, for instance signing with private keys from a secure key store. When compiled with PKCS#11 support it defaults to pkcs11; the empty name resets it to no engine.
+When applicable, specifies the hardware to use for cryptographic operations, such as a secure key store used for signing.
+.sp
+When BIND is built with OpenSSL PKCS#11 support, this defaults to the string "pkcs11", which identifies an OpenSSL engine that can drive a cryptographic accelerator or hardware service module. When BIND is built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it defaults to the path of the PKCS#11 provider library specified via "\-\-with\-pkcs11".
 .RE
 .PP
 \-g
@@ -112,6 +114,19 @@
 Generate a DLV set in addition to the key (DNSKEY) and DS sets. The domain is appended to the name of the records.
 .RE
 .PP
+\-M \fImaxttl\fR
+.RS 4
+Sets the maximum TTL for the signed zone. Any TTL higher than
+\fImaxttl\fR
+in the input zone will be reduced to
+\fImaxttl\fR
+in the output. This provides certainty as to the largest possible TTL in the signed zone, which is useful to know when rolling keys because it is the longest possible time before signatures that have been retrieved by resolvers will expire from resolver caches. Zones that are signed with this option should be configured to use a matching
+\fBmax\-zone\-ttl\fR
+in
+\fInamed.conf\fR. (Note: This option is incompatible with
+\fB\-D\fR, because it modifies non\-DNSSEC data in the output zone.)
+.RE
+.PP
 \-s \fIstart\-time\fR
 .RS 4
 Specify the date and time when the generated RRSIG records become valid. This can be either an absolute or relative time. An absolute start time is indicated by a number in YYYYMMDDHHMMSS notation; 20000530144500 denotes 14:45:00 UTC on May 30th, 2000. A relative start time is indicated by +N, which is N seconds from the current time. If no
@@ -180,8 +195,9 @@
 .RS 4
 The format of the input zone file. Possible formats are
 \fB"text"\fR
-(default) and
-\fB"raw"\fR. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be signed directly. The use of this option does not make much sense for non\-dynamic zones.
+(default),
+\fB"raw"\fR, and
+\fB"map"\fR. This option is primarily intended to be used for dynamic signed zones so that the dumped zone file in a non\-text format containing updates can be signed directly. The use of this option does not make much sense for non\-dynamic zones.
 .RE
 .PP
 \-j \fIjitter\fR
@@ -195,7 +211,7 @@
 .PP
 \-L \fIserial\fR
 .RS 4
-When writing a signed zone to 'raw' format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)
+When writing a signed zone to "raw" or "map" format, set the "source serial" value in the header to the specified serial number. (This is expected to be used primarily for testing purposes.)
 .RE
 .PP
 \-n \fIncpus\fR
@@ -239,15 +255,15 @@
 .RS 4
 The format of the output file containing the signed zone. Possible formats are
 \fB"text"\fR
-(default)
-\fB"full"\fR, which is text output in a format suitable for processing by external scripts, and
-\fB"raw"\fR
-or
-\fB"raw=N"\fR, which store the zone in a binary format for rapid loading by
+(default), which is the standard textual representation of the zone;
+\fB"full"\fR, which is text output in a format suitable for processing by external scripts; and
+\fB"map"\fR,
+\fB"raw"\fR, and
+\fB"raw=N"\fR, which store the zone in binary formats for rapid loading by
 \fBnamed\fR.
 \fB"raw=N"\fR
 specifies the format version of the raw zone file: if N is 0, the raw file can be read by any version of
-\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher. The default is 1.
+\fBnamed\fR; if N is 1, the file can be read by release 9.9.0 or higher; the default is 1.
 .RE
 .PP
 \-p
@@ -441,7 +457,7 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2009, 2011, 2013 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2009, 2011\-2014 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-signzone.c,v 1.10 2013/12/31 20:24:39 christos Exp $	*/
+/*	$NetBSD: dnssec-signzone.c,v 1.11 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Portions Copyright (C) 2004-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Portions Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
  * Portions Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -31,7 +31,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* Id: dnssec-signzone.c,v 1.285 2011/12/22 07:32:39 each Exp  */
+/* Id: dnssec-signzone.c,v 1.285.32.1 2012/02/07 00:44:12 each Exp  */
 
 /*! \file */
 
@@ -181,6 +181,8 @@
 static isc_boolean_t remove_inactkeysigs = ISC_FALSE;
 static isc_boolean_t output_dnssec_only = ISC_FALSE;
 static isc_boolean_t output_stdout = ISC_FALSE;
+isc_boolean_t set_maxttl = ISC_FALSE;
+static dns_ttl_t maxttl = 0;
 
 #define INCSTAT(counter)		\
 	if (printstats) {		\
@@ -309,8 +311,8 @@
 	}
 
 	tuple = NULL;
-	result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, name, ttl, &trdata,
-				      &tuple);
+	result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
+				      name, ttl, &trdata, &tuple);
 	check_result(result, "dns_difftuple_create");
 	dns_diff_append(add, &tuple);
 }
@@ -610,24 +612,23 @@
 				vbprintf(2, "\tfixing ttl %s\n", sigstr);
 				tuple = NULL;
 				result = dns_difftuple_create(mctx,
-							      DNS_DIFFOP_DEL,
-							      name, sigset.ttl,
-							      &sigrdata,
-							      &tuple);
+						      DNS_DIFFOP_DELRESIGN,
+						      name, sigset.ttl,
+						      &sigrdata, &tuple);
 				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
 				result = dns_difftuple_create(mctx,
-							      DNS_DIFFOP_ADD,
-							      name, ttl,
-							      &sigrdata,
-							      &tuple);
+						      DNS_DIFFOP_ADDRESIGN,
+						      name, ttl,
+						      &sigrdata, &tuple);
 				check_result(result, "dns_difftuple_create");
 				dns_diff_append(add, &tuple);
 			}
 		} else {
 			tuple = NULL;
 			vbprintf(2, "removing signature by %s\n", sigstr);
-			result = dns_difftuple_create(mctx, DNS_DIFFOP_DEL,
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_DELRESIGN,
 						      name, sigset.ttl,
 						      &sigrdata, &tuple);
 			check_result(result, "dns_difftuple_create");
@@ -732,7 +733,7 @@
 			fatal("unable to grow hashlist: out of memory");
 	}
 	memset(l->hashbuf + l->entries * l->length, 0, l->length);
-	memcpy(l->hashbuf + l->entries * l->length, hash, len);
+	memmove(l->hashbuf + l->entries * l->length, hash, len);
 	l->entries++;
 }
 
@@ -972,7 +973,7 @@
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");
 
-		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, name,
+		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
 					      ttl, &ds, &tuple);
 		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
@@ -982,7 +983,7 @@
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");
 
-		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD, name,
+		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
 					      ttl, &ds, &tuple);
 		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
@@ -1235,6 +1236,10 @@
 	dns_rdataset_current(&soaset, &rdata);
 	zone_soa_min_ttl = dns_soa_getminimum(&rdata);
 	soa_ttl = soaset.ttl;
+	if (set_maxttl) {
+		zone_soa_min_ttl = ISC_MIN(zone_soa_min_ttl, maxttl);
+		soa_ttl = ISC_MIN(soa_ttl, maxttl);
+	}
 	dns_rdataset_disassociate(&soaset);
 }
 
@@ -2010,7 +2015,8 @@
 		rdatalist.rdclass = rdata.rdclass;
 		rdatalist.type = rdata.type;
 		rdatalist.covers = 0;
-		rdatalist.ttl = rdataset.ttl;
+		if (set_maxttl)
+			rdatalist.ttl = ISC_MIN(rdataset.ttl, maxttl);
 		ISC_LIST_INIT(rdatalist.rdata);
 		dns_rdata_init(&delrdata);
 		dns_rdata_clone(&rdata, &delrdata);
@@ -2041,13 +2047,17 @@
 }
 
 static void
-rrset_remove_duplicates(dns_name_t *name, dns_rdataset_t *rdataset,
-			dns_diff_t *diff)
+rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset,
+	      dns_diff_t *add, dns_diff_t *del)
 {
-	dns_difftuple_t *tuple = NULL;
 	isc_result_t result;
 	unsigned int count1 = 0;
 	dns_rdataset_t tmprdataset;
+	char namestr[DNS_NAME_FORMATSIZE];
+	char typestr[TYPE_FORMATSIZE];
+
+	dns_name_format(name, namestr, sizeof(namestr));
+	type_format(rdataset->type, typestr, sizeof(typestr));
 
 	dns_rdataset_init(&tmprdataset);
 	for (result = dns_rdataset_first(rdataset);
@@ -2063,18 +2073,38 @@
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdataset_next(&tmprdataset)) {
 			dns_rdata_t rdata2 = DNS_RDATA_INIT;
+			dns_difftuple_t *tuple = NULL;
 			count2++;
-			if (count1 >= count2)
-				continue;
 			dns_rdataset_current(&tmprdataset, &rdata2);
-			if (dns_rdata_casecompare(&rdata1, &rdata2) == 0) {
+			if (count1 < count2 &&
+			    dns_rdata_casecompare(&rdata1, &rdata2) == 0)
+			{
+				vbprintf(2, "removing duplicate at %s/%s\n",
+					    namestr, typestr);
 				result = dns_difftuple_create(mctx,
-							      DNS_DIFFOP_DEL,
-							      name,
-							      rdataset->ttl,
-							      &rdata2, &tuple);
+						      DNS_DIFFOP_DELRESIGN,
+						      name, rdataset->ttl,
+						      &rdata2, &tuple);
 				check_result(result, "dns_difftuple_create");
-				dns_diff_append(diff, &tuple);
+				dns_diff_append(del, &tuple);
+			} else if (set_maxttl && rdataset->ttl > maxttl) {
+				vbprintf(2, "reducing ttl of %s/%s "
+					    "from %d to %d\n",
+					    namestr, typestr,
+					    rdataset->ttl, maxttl);
+				result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_DELRESIGN,
+						      name, rdataset->ttl,
+						      &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
+				dns_diff_append(del, &tuple);
+				tuple = NULL;
+				result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
+						      name, maxttl,
+						      &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
+				dns_diff_append(add, &tuple);
 			}
 		}
 		dns_rdataset_disassociate(&tmprdataset);
@@ -2082,17 +2112,18 @@
 }
 
 static void
-remove_duplicates(void) {
+cleanup_zone(void) {
 	isc_result_t result;
 	dns_dbiterator_t *dbiter = NULL;
 	dns_rdatasetiter_t *rdsiter = NULL;
-	dns_diff_t diff;
+	dns_diff_t add, del;
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t rdataset;
 	dns_fixedname_t fname;
 	dns_name_t *name;
 
-	dns_diff_init(mctx, &diff);
+	dns_diff_init(mctx, &add);
+	dns_diff_init(mctx, &del);
 	dns_fixedname_init(&fname);
 	name = dns_fixedname_name(&fname);
 	dns_rdataset_init(&rdataset);
@@ -2112,7 +2143,7 @@
 		     result == ISC_R_SUCCESS;
 		     result = dns_rdatasetiter_next(rdsiter)) {
 			dns_rdatasetiter_current(rdsiter, &rdataset);
-			rrset_remove_duplicates(name, &rdataset, &diff);
+			rrset_cleanup(name, &rdataset, &add, &del);
 			dns_rdataset_disassociate(&rdataset);
 		}
 		if (result != ISC_R_NOMORE)
@@ -2123,11 +2154,14 @@
 	if (result != ISC_R_NOMORE)
 		fatal("zone iteration failed.");
 
-	if (!ISC_LIST_EMPTY(diff.tuples)) {
-		result = dns_diff_applysilently(&diff, gdb, gversion);
-		check_result(result, "dns_diff_applysilently");
-	}
-	dns_diff_clear(&diff);
+	result = dns_diff_applysilently(&del, gdb, gversion);
+	check_result(result, "dns_diff_applysilently");
+
+	result = dns_diff_applysilently(&add, gdb, gversion);
+	check_result(result, "dns_diff_applysilently");
+
+	dns_diff_clear(&del);
+	dns_diff_clear(&add);
 	dns_dbiterator_destroy(&dbiter);
 }
 
@@ -2452,11 +2486,11 @@
 		goto cleanup;
 
 	if (set_keyttl && keyttl != rdataset.ttl) {
-		fprintf(stderr, "User-specified TTL (%d) conflicts "
+		fprintf(stderr, "User-specified TTL %d conflicts "
 				"with existing DNSKEY RRset TTL.\n",
 				keyttl);
 		fprintf(stderr, "Imported keys will use the RRSet "
-				"TTL (%d) instead.\n",
+				"TTL %d instead.\n",
 				rdataset.ttl);
 	}
 	keyttl = rdataset.ttl;
@@ -2670,7 +2704,7 @@
 			      "Use -u to update it.");
 	} else if (!set_salt) {
 		salt_length = orig_saltlen;
-		memcpy(saltbuf, orig_salt, orig_saltlen);
+		memmove(saltbuf, orig_salt, orig_saltlen);
 		salt = saltbuf;
 	}
 
@@ -2826,7 +2860,8 @@
 			check_result(result, "dns_ds_buildrdata");
 			if (type == dns_rdatatype_dlv)
 				ds.type = dns_rdatatype_dlv;
-			result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD,
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
 						      name, 0, &ds, &tuple);
 			check_result(result, "dns_difftuple_create");
 			dns_diff_append(&diff, &tuple);
@@ -2838,11 +2873,13 @@
 			check_result(result, "dns_ds_buildrdata");
 			if (type == dns_rdatatype_dlv)
 				ds.type = dns_rdatatype_dlv;
-			result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD,
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
 						      name, 0, &ds, &tuple);
 
 		} else
-			result = dns_difftuple_create(mctx, DNS_DIFFOP_ADD,
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
 						      gorigin, zone_soa_min_ttl,
 						      &rdata, &tuple);
 		check_result(result, "dns_difftuple_create");
@@ -2947,7 +2984,10 @@
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#ifdef USE_PKCS11
+#if defined(PKCS11CRYPTO)
+	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
+		"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use "
 				"(default is \"pkcs11\")\n");
 #else
@@ -3045,7 +3085,7 @@
 	isc_log_t *log = NULL;
 	isc_boolean_t pseudorandom = ISC_FALSE;
 #ifdef USE_PKCS11
-	const char *engine = "pkcs11";
+	const char *engine = PKCS11_ENGINE;
 #else
 	const char *engine = NULL;
 #endif
@@ -3063,11 +3103,9 @@
 	isc_boolean_t set_iter = ISC_FALSE;
 	isc_boolean_t nonsecify = ISC_FALSE;
 
-	isc__mem_register();
-	isc__task_register();
-	/* Unused letters: Bb G J M q Yy (and F is reserved). */
+	/* Unused letters: Bb G J q Yy (and F is reserved). */
 #define CMDLINE_FLAGS \
-	"3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:n:N:o:O:PpQRr:s:ST:tuUv:X:xzZ:"
+	"3:AaCc:Dd:E:e:f:FghH:i:I:j:K:k:L:l:m:M:n:N:o:O:PpQRr:s:ST:tuUv:X:xzZ:"
 
 	/*
 	 * Process memory debugging argument first.
@@ -3240,6 +3278,17 @@
 			check_result(result, "dns_name_fromtext(dlv)");
 			break;
 
+		case 'M':
+			endp = NULL;
+			set_maxttl = ISC_TRUE;
+			maxttl = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0') {
+				fprintf(stderr, "maximum TTL "
+						"must be numeric");
+				exit(1);
+			}
+			break;
+
 		case 'm':
 			break;
 
@@ -3365,17 +3414,18 @@
 	isc_stdtime_get(&now);
 
 	if (startstr != NULL) {
-		starttime = strtotime(startstr, now, now);
+		starttime = strtotime(startstr, now, now, NULL);
 	} else
 		starttime = now - 3600;  /* Allow for some clock skew. */
 
 	if (endstr != NULL)
-		endtime = strtotime(endstr, now, starttime);
+		endtime = strtotime(endstr, now, starttime, NULL);
 	else
 		endtime = starttime + (30 * 24 * 60 * 60);
 
 	if (dnskey_endstr != NULL) {
-		dnskey_endtime = strtotime(dnskey_endstr, now, starttime);
+		dnskey_endtime = strtotime(dnskey_endstr, now, starttime,
+					   NULL);
 		if (endstr != NULL && dnskey_endtime == endtime)
 			fprintf(stderr, "WARNING: -e and -X were both set, "
 					"but have identical values.\n");
@@ -3422,6 +3472,8 @@
 	if (inputformatstr != NULL) {
 		if (strcasecmp(inputformatstr, "text") == 0)
 			inputformat = dns_masterformat_text;
+		else if (strcasecmp(inputformatstr, "map") == 0)
+			inputformat = dns_masterformat_map;
 		else if (strcasecmp(inputformatstr, "raw") == 0)
 			inputformat = dns_masterformat_raw;
 		else if (strncasecmp(inputformatstr, "raw=", 4) == 0) {
@@ -3439,6 +3491,8 @@
 		} else if (strcasecmp(outputformatstr, "full") == 0) {
 			outputformat = dns_masterformat_text;
 			masterstyle = &dns_master_style_full;
+		} else if (strcasecmp(outputformatstr, "map") == 0) {
+			outputformat = dns_masterformat_map;
 		} else if (strcasecmp(outputformatstr, "raw") == 0) {
 			outputformat = dns_masterformat_raw;
 		} else if (strncasecmp(outputformatstr, "raw=", 4) == 0) {
@@ -3454,7 +3508,7 @@
 				exit(1);
 			}
 		} else
-			fatal("unknown file format: %s\n", outputformatstr);
+			fatal("unknown file format: %s", outputformatstr);
 	}
 
 	if (serialformatstr != NULL) {
@@ -3466,15 +3520,18 @@
 		else if (strcasecmp(serialformatstr, "unixtime") == 0)
 			serialformat = SOA_SERIAL_UNIXTIME;
 		else
-			fatal("unknown soa serial format: %s\n",
+			fatal("unknown soa serial format: %s",
 			      serialformatstr);
 	}
 
 	if (output_dnssec_only && outputformat != dns_masterformat_text)
-		fatal("option -D can only be used with \"-O text\"\n");
+		fatal("option -D can only be used with \"-O text\"");
 
 	if (output_dnssec_only && serialformat != SOA_SERIAL_KEEP)
-		fatal("option -D can only be used with \"-N keep\"\n");
+		fatal("option -D can only be used with \"-N keep\"");
+
+	if (output_dnssec_only && set_maxttl)
+		fatal("option -D cannot be used with -M");
 
 	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
 					0, 24, 0, 0, 0, 8, mctx);
@@ -3487,6 +3544,13 @@
 	gclass = dns_db_class(gdb);
 	get_soa_ttls();
 
+	if (set_maxttl && set_keyttl && keyttl > maxttl) {
+		fprintf(stderr, "%s: warning: Specified key TTL %d "
+			"exceeds maximum zone TTL; reducing to %d\n",
+			program, keyttl, maxttl);
+		keyttl = maxttl;
+	}
+
 	if (!set_keyttl)
 		keyttl = soa_ttl;
 
@@ -3591,7 +3655,8 @@
 			break;
 	}
 
-	remove_duplicates();
+	/* Remove duplicates and cap TTLs at maxttl */
+	cleanup_zone();
 
 	if (!nonsecify) {
 	if (IS_NSEC3)
@@ -3720,7 +3785,7 @@
 
 		result = isc_file_rename(tempfile, output);
 		if (result != ISC_R_SUCCESS)
-			fatal("failed to rename temp file to %s: %s\n",
+			fatal("failed to rename temp file to %s: %s",
 			      output, isc_result_totext(result));
 
 		printf("%s\n", output);
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-verify.8	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-verify.8	Sat Mar 01 03:24:32 2014 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dnssec-verify.8,v 1.2 2012/12/04 23:38:38 spz Exp $
+.\"	$NetBSD: dnssec-verify.8,v 1.3 2014/03/01 03:24:32 christos Exp $
 .\"
-.\" Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
 .\"
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -46,6 +46,13 @@
 Specifies the DNS class of the zone.
 .RE
 .PP
+\-E \fIengine\fR
+.RS 4
+Specifies the cryptographic hardware to use, when applicable.
+.sp
+When BIND is built with OpenSSL PKCS#11 support, this defaults to the string "pkcs11", which identifies an OpenSSL engine that can drive a cryptographic accelerator or hardware service module. When BIND is built with native PKCS#11 cryptography (\-\-enable\-native\-pkcs11), it defaults to the path of the PKCS#11 provider library specified via "\-\-with\-pkcs11".
+.RE
+.PP
 \-I \fIinput\-format\fR
 .RS 4
 The format of the input zone file. Possible formats are
@@ -95,5 +102,5 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2012 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014 Internet Systems Consortium, Inc. ("ISC")
 .br
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-verify.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-verify.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-verify.c,v 1.5 2013/07/27 19:23:09 christos Exp $	*/
+/*	$NetBSD: dnssec-verify.c,v 1.6 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -139,7 +139,10 @@
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#ifdef USE_PKCS11
+#if defined(PKCS11CRYPTO)
+	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
+		"(default is %s)\n", PK11_LIB_LOCATION);
+#elif defined(USE_PKCS11)
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use "
 				"(default is \"pkcs11\")\n");
 #else
@@ -158,7 +161,7 @@
 	isc_result_t result;
 	isc_log_t *log = NULL;
 #ifdef USE_PKCS11
-	const char *engine = "pkcs11";
+	const char *engine = PKCS11_ENGINE;
 #else
 	const char *engine = NULL;
 #endif
@@ -167,7 +170,6 @@
 	int ch;
 	char *endp;
 
-	isc__mem_register();
 #define CMDLINE_FLAGS \
 	"m:o:I:c:E:v:xz"
 
--- a/external/bsd/bind/dist/bin/dnssec/dnssectool.c	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssectool.c	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssectool.c,v 1.6 2013/12/31 20:24:39 christos Exp $	*/
+/*	$NetBSD: dnssectool.c,v 1.7 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004, 2005, 2007, 2009-2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009-2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -302,12 +302,21 @@
 	return(0); /* silence compiler warning */
 }
 
+static inline isc_boolean_t
+isnone(const char *str) {
+	return (ISC_TF((strcasecmp(str, "none") == 0) ||
+		       (strcasecmp(str, "never") == 0)));
+}
+
 dns_ttl_t
 strtottl(const char *str) {
 	const char *orig = str;
 	dns_ttl_t ttl;
 	char *endp;
 
+	if (isnone(str))
+		return ((dns_ttl_t) 0);
+
 	ttl = strtol(str, &endp, 0);
 	if (ttl == 0 && endp == str)
 		fatal("TTL must be numeric");
@@ -316,12 +325,23 @@
 }
 
 isc_stdtime_t
-strtotime(const char *str, isc_int64_t now, isc_int64_t base) {
+strtotime(const char *str, isc_int64_t now, isc_int64_t base,
+	  isc_boolean_t *setp)
+{
 	isc_int64_t val, offset;
 	isc_result_t result;
 	const char *orig = str;
 	char *endp;
-	int n;
+	size_t n;
+
+	if (isnone(str)) {
+		if (setp != NULL)
+			*setp = ISC_FALSE;
+		return ((isc_stdtime_t) 0);
+	}
+
+	if (setp != NULL)
+		*setp = ISC_TRUE;
 
 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0')
 		return ((isc_stdtime_t) 0);
@@ -334,14 +354,14 @@
 	 *   [+-]offset
 	 */
 	n = strspn(str, "0123456789");
-	if ((n == 8 || n == 14) &&
+	if ((n == 8u || n == 14u) &&
 	    (str[n] == '\0' || str[n] == '-' || str[n] == '+'))
 	{
 		char timestr[15];
 
 		strlcpy(timestr, str, sizeof(timestr));
 		timestr[n] = 0;
-		if (n == 8)
+		if (n == 8u)
 			strlcat(timestr, "000000", sizeof(timestr));
 		result = dns_time64_fromtext(timestr, &val);
 		if (result != ISC_R_SUCCESS)
@@ -727,11 +747,11 @@
 	element->next_length = nsec3->next_length;
 	element->iterations = nsec3->iterations;
 	cp = (unsigned char *)(element + 1);
-	memcpy(cp, nsec3->salt, nsec3->salt_length);
+	memmove(cp, nsec3->salt, nsec3->salt_length);
 	cp += nsec3->salt_length;
-	memcpy(cp, rawhash, nsec3->next_length);
+	memmove(cp, rawhash, nsec3->next_length);
 	cp += nsec3->next_length;
-	memcpy(cp, nsec3->next, nsec3->next_length);
+	memmove(cp, nsec3->next, nsec3->next_length);
 	result = isc_heap_insert(chains, element);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "isc_heap_insert failed: %s\n",
--- a/external/bsd/bind/dist/bin/dnssec/dnssectool.h	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssectool.h	Sat Mar 01 03:24:32 2014 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssectool.h,v 1.4 2012/12/04 23:38:38 spz Exp $	*/
+/*	$NetBSD: dnssectool.h,v 1.5 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
- * Copyright (C) 2004, 2007-2012  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001, 2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -70,7 +70,8 @@
 dns_ttl_t strtottl(const char *str);
 
 isc_stdtime_t
-strtotime(const char *str, isc_int64_t now, isc_int64_t base);
+strtotime(const char *str, isc_int64_t now, isc_int64_t base,
+	  isc_boolean_t *setp);
 
 dns_rdataclass_t
 strtoclass(const char *str);
--- a/external/bsd/bind/dist/bin/named/bind.keys.h	Sat Mar 01 01:53:36 2014 +0000
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,101 +0,0 @@
-/*	$NetBSD: bind.keys.h,v 1.4 2012/06/05 00:38:58 christos Exp $	*/
-
-/*
- * Generated by bindkeys.pl 1.7 2011/01/04 23:47:13 tbox Exp  
- * From bind.keys 1.7 2011/01/03 23:45:07 each Exp  
- */
-#define TRUSTED_KEYS "\
-# The bind.keys file is used to override the built-in DNSSEC trust anchors\n\
-# which are included as part of BIND 9.  As of the current release, the only\n\
-# trust anchors it contains are those for the DNS root zone (\".\"), and for\n\
-# the ISC DNSSEC Lookaside Validation zone (\"dlv.isc.org\").  Trust anchors\n\
-# for any other zones MUST be configured elsewhere; if they are configured\n\
-# here, they will not be recognized or used by named.\n\
-#\n\
-# The built-in trust anchors are provided for convenience of configuration.\n\
-# They are not activated within named.conf unless specifically switched on.\n\
-# To use the built-in root key, set \"dnssec-validation auto;\" in\n\
-# named.conf options.  To use the built-in DLV key, set\n\
-# \"dnssec-lookaside auto;\".  Without these options being set,\n\
-# the keys in this file are ignored.\n\
-#\n\
-# This file is NOT expected to be user-configured.\n\
-#\n\
-# These keys are current as of January 2011.  If any key fails to\n\
-# initialize correctly, it may have expired.  In that event you should\n\
-# replace this file with a current version.  The latest version of\n\
-# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\
-\n\
-trusted-keys {\n\
-	# ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\
-        # NOTE: This key is activated by setting \"dnssec-lookaside auto;\"\n\
-        # in named.conf.\n\
-	dlv.isc.org. 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\
-		brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\
-		1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\
-		ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\
-		Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\
-		QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\
-		TDN0YUuWrBNh\";\n\
-\n\
-	# ROOT KEY: See https://data.iana.org/root-anchors/root-anchors.xml\n\
-	# for current trust anchor information.\n\
-        # NOTE: This key is activated by setting \"dnssec-validation auto;\"\n\
-        # in named.conf.\n\
-	. 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
-		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
-		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
-		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
-		W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
-		Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
-		QxA+Uk1ihz0=\";\n\
-};\n\
-"
-
-#define MANAGED_KEYS "\
-# The bind.keys file is used to override the built-in DNSSEC trust anchors\n\
-# which are included as part of BIND 9.  As of the current release, the only\n\
-# trust anchors it contains are those for the DNS root zone (\".\"), and for\n\
-# the ISC DNSSEC Lookaside Validation zone (\"dlv.isc.org\").  Trust anchors\n\
-# for any other zones MUST be configured elsewhere; if they are configured\n\
-# here, they will not be recognized or used by named.\n\
-#\n\
-# The built-in trust anchors are provided for convenience of configuration.\n\
-# They are not activated within named.conf unless specifically switched on.\n\
-# To use the built-in root key, set \"dnssec-validation auto;\" in\n\
-# named.conf options.  To use the built-in DLV key, set\n\
-# \"dnssec-lookaside auto;\".  Without these options being set,\n\
-# the keys in this file are ignored.\n\
-#\n\
-# This file is NOT expected to be user-configured.\n\
-#\n\
-# These keys are current as of January 2011.  If any key fails to\n\
-# initialize correctly, it may have expired.  In that event you should\n\
-# replace this file with a current version.  The latest version of\n\
-# bind.keys can always be obtained from ISC at https://www.isc.org/bind-keys.\n\
-\n\
-managed-keys {\n\
-	# ISC DLV: See https://www.isc.org/solutions/dlv for details.\n\
-        # NOTE: This key is activated by setting \"dnssec-lookaside auto;\"\n\
-        # in named.conf.\n\
-	dlv.isc.org. initial-key 257 3 5 \"BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2\n\
-		brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+\n\
-		1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5\n\
-		ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URk\n\
-		Y62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboM\n\
-		QKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VSt\n\
-		TDN0YUuWrBNh\";\n\
-\n\
-	# ROOT KEY: See https://data.iana.org/root-anchors/root-anchors.xml\n\
-	# for current trust anchor information.\n\
-        # NOTE: This key is activated by setting \"dnssec-validation auto;\"\n\
-        # in named.conf.\n\
-	. initial-key 257 3 8 \"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF\n\
-		FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX\n\
-		bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD\n\
-		X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz\n\
-		W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS\n\
-		Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq\n\
-		QxA+Uk1ihz0=\";\n\
-};\n\
-"
--- a/external/bsd/bind/dist/bin/named/bind9.ver3.xsl	Sat Mar 01 01:53:36 2014 +0000
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,738 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
- - Copyright (C) 2012, 2013  Internet Systems Consortium, Inc. ("ISC")
- -
- - Permission to use, copy, modify, and/or distribute this software for any
- - purpose with or without fee is hereby granted, provided that the above
- - copyright notice and this permission notice appear in all copies.
- -
- - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
- - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
- - AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
- - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
- - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
- - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
- - PERFORMANCE OF THIS SOFTWARE.
--->
-
-<!-- Id -->
-
-<!-- %Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp % -->
-<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
-  <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.0&quot;]">
-    <html>
-      <head>
-        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-          <!-- Non Mozilla specific markup -->
-          <script type="text/javascript" src="https://www.google.com/jsapi"/>
-          <script type="text/javascript">
-        
-        google.load("visualization", "1", {packages:["corechart"]});
-        google.setOnLoadCallback(loadGraphs);
-
-        var graphs=[];
-        
-        function drawChart(chart_title,target,data) {
-          var data = google.visualization.arrayToDataTable(data);
-
-          var options = {
-            title: chart_title
-          };
-          
-          var chart = new google.visualization.BarChart(document.getElementById(target));
-          chart.draw(data, options);
-        }
-        
-        function loadGraphs(){
-          //alert("here we are!");
-          var g;
-            
-          // Server Incoming query Types
-          while(g = graphs.shift()){
-            // alert("going for: " + g.target);
-            if(g.data.length > 1){
-              drawChart(g.title,g.target,g.data);
-            }
-          }
-        }
-        
-            // Server Incoming Queries Types         
-           graphs.push({
-                        'title' : "Server Incoming Query Types",
-                        'target': 'chart_incoming_qtypes',
-                        'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;qtype&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                        });
-
-
-           // Server Incoming Requests         
-           graphs.push({
-                        'title' : "Server Incoming Requests",
-                        'target': 'chart_incoming_requests',
-                        'data': [['Requests','Counter'],<xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]});
-        
-        
-        
-        
-      </script>
-        </xsl:if>
-        <style type="text/css">
-     body {
-      font-family: sans-serif;
-      background-color: #ffffff;
-      color: #000000;
-      font-size: 10pt;
-     }
-     
-     .odd{
-      background-color: #f0f0f0;
-     }
-     
-     .even{
-      background-color: #ffffff;
-     }
-     
-     p.footer{
-      font-style:italic;
-      color: grey;
-     }
-
-     table {
-      border-collapse: collapse;
-      border: 1px solid grey;
-     }
-
-     table.counters{
-      border: 1px solid grey;
-      width: 500px;
-     }
-     
-     table.counters th {
-      text-align: center;
-      border: 1px solid grey;
-      width: 120px;
-     }
-    table.counters td{
-      text-align:center;
-      
-    }
-    
-    table.counters tr:hover{
-      background-color: #99ddff;
-    }
- 
-     .totals {
-      background-color: rgb(1,169,206);
-      color: #ffffff;
-     }
-
-     td, th {
-      padding-right: 5px;
-      padding-left: 5px;
-      border: 1px solid grey;
-     }
-
-     .header h1 {
-      color: rgb(1,169,206);
-      padding: 0px;
-     }
-
-     .content {
-      background-color: #ffffff;
-      color: #000000;
-      padding: 4px;
-     }
-
-     .item {
-      padding: 4px;
-      text-align: right;
-     }
-
-     .value {
-      padding: 4px;
-      font-weight: bold;
-     }
-
-
-     h2 {
-       color: grey;
-       font-size: 14pt;
-       width:500px;
-       text-align:center;
-     }
-     
-     h3 {
-       color: #444444;
-       font-size: 12pt;
-       width:500px;
-       text-align:center;
-       
-     }
-     h4 {
-        color:  rgb(1,169,206);
-        font-size: 10pt;
-       width:500px;
-       text-align:center;
-        
-     }
-
-     .pie {
-      width:500px;
-      height: 500px;
-     }
-
-      </style>
-        <title>ISC BIND 9 Statistics</title>
-      </head>
-      <body>
-        <div class="header">
-          <h1>ISC Bind 9 Configuration and Statistics</h1>
-        </div>
-        <hr/>
-        <h2>Server Times</h2>
-        <table class="counters">
-          <tr>
-            <th>Boot time:</th>
-            <td>
-              <xsl:value-of select="server/boot-time"/>
-            </td>
-          </tr>
-          <tr>
-            <th>Sample time:</th>
-            <td>
-              <xsl:value-of select="server/current-time"/>
-            </td>
-          </tr>
-        </table>
-        <br/>
-        <h2>Incoming Requests</h2>
-        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-          <!-- Non Mozilla specific markup -->
-          <div class="pie" id="chart_incoming_requests">[no incoming requests]</div>
-        </xsl:if>
-        <table class="counters">
-          <xsl:for-each select="server/counters[@type=&quot;opcode&quot;]/counter">
-            <xsl:sort select="." data-type="number" order="descending"/>
-            <tr>
-              <th>
-                <xsl:value-of select="@name"/>
-              </th>
-              <td>
-                <xsl:value-of select="."/>
-              </td>
-            </tr>
-          </xsl:for-each>
-          <tr>
-            <th class="totals">Total:</th>
-            <td class="totals">
-              <xsl:value-of select="sum(server/counters[@type=&quot;opcode&quot;]/counter)"/>
-            </td>
-          </tr>
-        </table>
-        <br/>
-        <h3>Incoming Queries by Type</h3>
-        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-          <!-- Non Mozilla specific markup -->
-          <div class="pie" id="chart_incoming_qtypes">[no incoming queries]</div>
-        </xsl:if>
-        <table class="counters">
-          <xsl:for-each select="server/counters[@type=&quot;qtype&quot;]/counter">
-            <xsl:sort select="." data-type="number" order="descending"/>
-            <xsl:variable name="css-class">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class}">
-              <th>
-                <xsl:value-of select="@name"/>
-              </th>
-              <td>
-                <xsl:value-of select="."/>
-              </td>
-            </tr>
-          </xsl:for-each>
-          <tr>
-            <th class="totals">Total:</th>
-            <td class="totals">
-              <xsl:value-of select="sum(server/counters[@type=&quot;qtype&quot;]/counter)"/>
-            </td>
-          </tr>
-        </table>
-        <br/>
-        <h2>Outgoing Queries per view</h2>
-        <xsl:for-each select="views/view[count(counters[@type=&quot;resqtype&quot;]/counter) &gt; 0]">
-          <h3>View <xsl:value-of select="@name"/></h3>
-          <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-            <!-- Non Mozilla specific markup -->
-          <script type="text/javascript">
-                graphs.push({
-                              'title': "Outgoing queries for view: <xsl:value-of select="@name"/>",
-                              'target': 'chart_outgoing_queries_view_<xsl:value-of select="@name"/>',
-                              'data': [['Type','Counter'],<xsl:for-each select="counters[@type=&quot;resqtype&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                              });
-                              
-            </script>
-          <xsl:variable name="target">
-            <xsl:value-of select="@name"/>
-          </xsl:variable>
-            <div class="pie" id="chart_outgoing_queries_view_{$target}"/>
-          </xsl:if>
-          <table class="counters">
-            <xsl:for-each select="counters[@type=&quot;resqtype&quot;]/counter">
-              <xsl:sort select="." data-type="number" order="descending"/>
-              <xsl:variable name="css-class1">
-                <xsl:choose>
-                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                  <xsl:otherwise>odd</xsl:otherwise>
-                </xsl:choose>
-              </xsl:variable>
-              <tr class="{$css-class1}">
-                <th>
-                  <xsl:value-of select="@name"/>
-                </th>
-                <td>
-                  <xsl:value-of select="."/>
-                </td>
-              </tr>
-            </xsl:for-each>
-          </table>
-          <br/>
-        </xsl:for-each>
-        <h2>Server Statistics</h2>
-        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-          <!-- Non Mozilla specific markup -->
-        <script type="text/javascript">
-                graphs.push({
-                              'title' : "Server Counters",
-                              'target': 'chart_server_nsstat_restype',
-                              'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;nsstat&quot;]/counter[.&gt;0]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                              });
-                              
-            </script>
-          <div class="pie" id="chart_server_nsstat_restype"/>
-        </xsl:if>
-        <table class="counters">
-          <xsl:for-each select="server/counters[@type=&quot;nsstat&quot;]/counter[.&gt;0]">
-            <xsl:sort select="." data-type="number" order="descending"/>
-            <xsl:variable name="css-class2">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class2}">
-              <th>
-                <xsl:value-of select="@name"/>
-              </th>
-              <td>
-                <xsl:value-of select="."/>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <br/>
-        <h2>Zone Maintenance Statistics</h2>
-        <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-        <script type="text/javascript">
-                      graphs.push({
-                                    'title' : "Zone Maintenance Stats",
-                                    'target': 'chart_server_zone_maint',
-                                    'data': [['Type','Counter'],<xsl:for-each select="server/counters[@type=&quot;zonestat&quot;]/counter">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                                    });
-
-                  </script>
-          <!-- Non Mozilla specific markup -->
-          <div class="pie" id="chart_server_zone_maint"/>
-        </xsl:if>
-        <table class="counters">
-          <xsl:for-each select="server/counters[@type=&quot;zonestat&quot;]/counter">
-            <xsl:sort select="." data-type="number" order="descending"/>
-            <xsl:variable name="css-class3">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class3}">
-              <th>
-                <xsl:value-of select="@name"/>
-              </th>
-              <td>
-                <xsl:value-of select="."/>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <h2>Resolver Statistics (Common)</h2>
-        <table class="counters">
-          <xsl:for-each select="server/counters[@type=&quot;restat&quot;]/counter">
-            <xsl:sort select="." data-type="number" order="descending"/>
-            <xsl:variable name="css-class4">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class4}">
-              <th>
-                <xsl:value-of select="@name"/>
-              </th>
-              <td>
-                <xsl:value-of select="."/>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <xsl:for-each select="views/view">
-          <h3>Resolver Statistics for View <xsl:value-of select="@name"/></h3>
-          <table class="counters">
-            <xsl:for-each select="counters[@type=&quot;resstats&quot;]/counter[.&gt;0]">
-              <xsl:sort select="." data-type="number" order="descending"/>
-              <xsl:variable name="css-class5">
-                <xsl:choose>
-                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                  <xsl:otherwise>odd</xsl:otherwise>
-                </xsl:choose>
-              </xsl:variable>
-              <tr class="{$css-class5}">
-                <th>
-                  <xsl:value-of select="@name"/>
-                </th>
-                <td>
-                  <xsl:value-of select="."/>
-                </td>
-              </tr>
-            </xsl:for-each>
-          </table>
-        </xsl:for-each>
-        <h3>Cache DB RRsets for View <xsl:value-of select="@name"/></h3>
-        <xsl:for-each select="views/view">
-          <table class="counters">
-            <xsl:for-each select="cache/rrset">
-              <xsl:variable name="css-class6">
-                <xsl:choose>
-                  <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                  <xsl:otherwise>odd</xsl:otherwise>
-                </xsl:choose>
-              </xsl:variable>
-              <tr class="{$css-class6}">
-                <th>
-                  <xsl:value-of select="name"/>
-                </th>
-                <td>
-                  <xsl:value-of select="counter"/>
-                </td>
-              </tr>
-            </xsl:for-each>
-          </table>
-          <br/>
-        </xsl:for-each>
-        <h2>Socket I/O Statistics</h2>
-        <table class="counters">
-          <xsl:for-each select="server/counters[@type=&quot;sockstat&quot;]/counter[.&gt;0]">
-            <xsl:variable name="css-class7">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class7}">
-              <th>
-                <xsl:value-of select="@name"/>
-              </th>
-              <td>
-                <xsl:value-of select="."/>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <br/>
-        <br/>
-        <h2>Response Codes per view/zone</h2>
-        <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;rcode&quot;]/counter &gt;0]">
-          <h3>View <xsl:value-of select="@name"/></h3>
-          <xsl:variable name="thisview">
-            <xsl:value-of select="@name"/>
-          </xsl:variable>
-          <xsl:for-each select="zones/zone">
-            <xsl:if test="counters[@type=&quot;rcode&quot;]/counter[. &gt; 0]">
-              <h4>Zone <xsl:value-of select="@name"/></h4>
-              <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-                <!-- Non Mozilla specific markup -->
-              <script type="text/javascript">
-                      graphs.push({
-                                    'title': "Response Codes for zone <xsl:value-of select="@name"/>",
-                                    'target': 'chart_rescode_<xsl:value-of select="../../@name"/>_<xsl:value-of select="@name"/>',
-                                    'data': [['Type','Counter'],<xsl:for-each select="counters[@type=&quot;rcode&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                                    });
-
-                  </script>
-              <xsl:variable name="target">
-                <xsl:value-of select="@name"/>
-              </xsl:variable>
-                <div class="pie" id="chart_rescode_{$thisview}_{$target}"/>
-              </xsl:if>
-              <table class="counters">
-                <xsl:for-each select="counters[@type=&quot;rcode&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]">
-                  <xsl:sort select="."/>
-                  <xsl:variable name="css-class10">
-                    <xsl:choose>
-                      <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                      <xsl:otherwise>odd</xsl:otherwise>
-                    </xsl:choose>
-                  </xsl:variable>
-                  <tr class="{$css-class10}">
-                    <th>
-                      <xsl:value-of select="@name"/>
-                    </th>
-                    <td>
-                      <xsl:value-of select="."/>
-                    </td>
-                  </tr>
-                </xsl:for-each>
-              </table>
-            </xsl:if>
-          </xsl:for-each>
-        </xsl:for-each>
-        <h2>Received QTYPES per view/zone</h2>
-        <xsl:for-each select="views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]">
-          <h3>View <xsl:value-of select="@name"/></h3>
-          <xsl:variable name="thisview2">
-            <xsl:value-of select="@name"/>
-          </xsl:variable>
-          <xsl:for-each select="zones/zone">
-            <xsl:if test="counters[@type=&quot;qtype&quot;]/counter[count(.) &gt; 0]">
-              <h4>Zone <xsl:value-of select="@name"/></h4>
-              <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
-                <!-- Non Mozilla specific markup -->
-              <script type="text/javascript">
-                      graphs.push({
-                                    'title': "Query Types for zone <xsl:value-of select="@name"/>",
-                                    'target': 'chart_qtype_<xsl:value-of select="../../@name"/>_<xsl:value-of select="@name"/>',
-                                    'data': [['Type','Counter'],<xsl:for-each select="counters[@type=&quot;qtype&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]">['<xsl:value-of select="@name"/>',<xsl:value-of select="."/>],</xsl:for-each>]
-                                    });
-
-                  </script>
-              <xsl:variable name="target">
-                <xsl:value-of select="@name"/>
-              </xsl:variable>
-                <div class="pie" id="chart_qtype_{$thisview2}_{$target}"/>
-              </xsl:if>
-              <table class="counters">
-                <xsl:for-each select="counters[@type=&quot;qtype&quot;]/counter">
-                  <xsl:sort select="."/>
-                  <xsl:variable name="css-class11">
-                    <xsl:choose>
-                      <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                      <xsl:otherwise>odd</xsl:otherwise>
-                    </xsl:choose>
-                  </xsl:variable>
-                  <tr class="{$css-class11}">
-                    <th>
-                      <xsl:value-of select="@name"/>
-                    </th>
-                    <td>
-                      <xsl:value-of select="."/>
-                    </td>
-                  </tr>
-                </xsl:for-each>
-              </table>
-            </xsl:if>
-          </xsl:for-each>
-        </xsl:for-each>
-        <h2>Network Status</h2>
-        <table class="counters">
-          <tr>
-            <th>ID</th>
-            <th>Name</th>
-            <th>Type</th>
-            <th>References</th>
-            <th>LocalAddress</th>
-            <th>PeerAddress</th>
-            <th>State</th>
-          </tr>
-          <xsl:for-each select="socketmgr/sockets/socket">
-            <xsl:sort select="id"/>
-            <xsl:variable name="css-class12">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class12}">
-              <td>
-                <xsl:value-of select="id"/>
-              </td>
-              <td>
-                <xsl:value-of select="name"/>
-              </td>
-              <td>
-                <xsl:value-of select="type"/>
-              </td>
-              <td>
-                <xsl:value-of select="references"/>
-              </td>
-              <td>
-                <xsl:value-of select="local-address"/>
-              </td>
-              <td>
-                <xsl:value-of select="peer-address"/>
-              </td>
-              <td>
-                <xsl:for-each select="states">
-                  <xsl:value-of select="."/>
-                </xsl:for-each>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <br/>
-        <h2>Task Manager Configuration</h2>
-        <table class="counters">
-          <tr>
-            <th class="even">Thread-Model</th>
-            <td>
-              <xsl:value-of select="taskmgr/thread-model/type"/>
-            </td>
-          </tr>
-          <tr class="odd">
-            <th>Worker Threads</th>
-            <td>
-              <xsl:value-of select="taskmgr/thread-model/worker-threads"/>
-            </td>
-          </tr>
-          <tr class="even">
-            <th>Default Quantum</th>
-            <td>
-              <xsl:value-of select="taskmgr/thread-model/default-quantum"/>
-            </td>
-          </tr>
-          <tr class="odd">
-            <th>Tasks Running</th>
-            <td>
-              <xsl:value-of select="taskmgr/thread-model/tasks-running"/>
-            </td>
-          </tr>
-        </table>
-        <br/>
-        <h2>Tasks</h2>
-        <table class="counters">
-          <tr>
-            <th>ID</th>
-            <th>Name</th>
-            <th>References</th>
-            <th>State</th>
-            <th>Quantum</th>
-          </tr>
-          <xsl:for-each select="taskmgr/tasks/task">
-            <xsl:sort select="name"/>
-            <xsl:variable name="css-class14">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class14}">
-              <td>
-                <xsl:value-of select="id"/>
-              </td>
-              <td>
-                <xsl:value-of select="name"/>
-              </td>
-              <td>
-                <xsl:value-of select="references"/>
-              </td>
-              <td>
-                <xsl:value-of select="state"/>
-              </td>
-              <td>
-                <xsl:value-of select="quantum"/>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <br/>
-        <h2>Memory Usage Summary</h2>
-        <table class="counters">
-          <xsl:for-each select="memory/summary/*">
-            <xsl:variable name="css-class13">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class13}">
-              <th>
-                <xsl:value-of select="name()"/>
-              </th>
-              <td>
-                <xsl:value-of select="."/>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <br/>
-        <h2>Memory Contexts</h2>
-        <table class="counters">
-          <tr>
-            <th>ID</th>
-            <th>Name</th>
-            <th>References</th>
-            <th>TotalUse</th>
-            <th>InUse</th>
-            <th>MaxUse</th>
-            <th>BlockSize</th>
-            <th>Pools</th>
-            <th>HiWater</th>
-            <th>LoWater</th>
-          </tr>
-          <xsl:for-each select="memory/contexts/context">
-            <xsl:sort select="total" data-type="number" order="descending"/>
-            <xsl:variable name="css-class14">
-              <xsl:choose>
-                <xsl:when test="position() mod 2 = 0">even</xsl:when>
-                <xsl:otherwise>odd</xsl:otherwise>
-              </xsl:choose>
-            </xsl:variable>
-            <tr class="{$css-class14}">
-              <td>
-                <xsl:value-of select="id"/>
-              </td>
-              <td>
-                <xsl:value-of select="name"/>
-              </td>
-              <td>
-                <xsl:value-of select="references"/>
-              </td>
-              <td>
-                <xsl:value-of select="total"/>
-              </td>
-              <td>
-                <xsl:value-of select="inuse"/>
-              </td>
-              <td>
-                <xsl:value-of select="maxinuse"/>
-              </td>
-              <td>
-                <xsl:value-of select="blocksize"/>
-              </td>
-              <td>
-                <xsl:value-of select="pools"/>
-              </td>
-              <td>
-                <xsl:value-of select="hiwater"/>
-              </td>
-              <td>
-                <xsl:value-of select="lowater"/>
-              </td>
-            </tr>
-          </xsl:for-each>
-        </table>
-        <hr/>
-        <p class="footer">Internet Systems Consortium Inc.<br/><a href="http://www.isc.org">http://www.isc.org</a></p>
-      </body>
-    </html>
-  </xsl:template>
-</xsl:stylesheet>
--- a/external/bsd/bind/dist/bin/named/bind9.ver3.xsl.h	Sat Mar 01 01:53:36 2014 +0000
+++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
@@ -1,742 +0,0 @@
-/*	$NetBSD: bind9.ver3.xsl.h,v 1.1.1.1 2013/07/27 15:22:44 christos Exp $	*/
-
-/*
- * Generated by convertxsl.pl 1.14 2008/07/17 23:43:26 jinmei Exp  
- * From <!-- %Id: bind9.xsl 1.21 2009/01/27 23:47:54 tbox Exp %
- */
-static char xslmsg[] =
-	"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
-	"<!--\n"
-	" - Copyright (C) 2006-2009 Internet Systems Consortium, Inc. (\"ISC\")\n"
-	" -\n"
-	" - Permission to use, copy, modify, and/or distribute this software for any\n"
-	" - purpose with or without fee is hereby granted, provided that the above\n"
-	" - copyright notice and this permission notice appear in all copies.\n"
-	" -\n"
-	" - THE SOFTWARE IS PROVIDED \"AS IS\" AND ISC DISCLAIMS ALL WARRANTIES WITH\n"
-	" - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY\n"
-	" - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,\n"
-	" - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM\n"
-	" - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE\n"
-	" - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR\n"
-	" - PERFORMANCE OF THIS SOFTWARE.\n"
-	"-->\n"
-	"<!-- \045Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp \045 -->\n"
-	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
-	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.0&quot;]\">\n"
-	" <html>\n"
-	" <head>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"/>\n"
-	" <script type=\"text/javascript\">\n"
-	" \n"
-	" google.load(\"visualization\", \"1\", {packages:[\"corechart\"]});\n"
-	" google.setOnLoadCallback(loadGraphs);\n"
-	"\n"
-	" var graphs=[];\n"
-	" \n"
-	" function drawChart(chart_title,target,data) {\n"
-	" var data = google.visualization.arrayToDataTable(data);\n"
-	"\n"
-	" var options = {\n"
-	" title: chart_title\n"
-	" };\n"
-	" \n"
-	" var chart = new google.visualization.BarChart(document.getElementById(target));\n"
-	" chart.draw(data, options);\n"
-	" }\n"
-	" \n"
-	" function loadGraphs(){\n"
-	" //alert(\"here we are!\");\n"
-	" var g;\n"
-	" \n"
-	" // Server Incoming query Types\n"
-	" while(g = graphs.shift()){\n"
-	" // alert(\"going for: \" + g.target);\n"
-	" if(g.data.length > 1){\n"
-	" drawChart(g.title,g.target,g.data);\n"
-	" }\n"
-	" }\n"
-	" }\n"
-	" \n"
-	" // Server Incoming Queries Types \n"
-	" graphs.push({\n"
-	" 'title' : \"Server Incoming Query Types\",\n"
-	" 'target': 'chart_incoming_qtypes',\n"
-	" 'data': [['Type','Counter'],<xsl:for-each select=\"server/counters[@type=&quot;qtype&quot;]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n"
-	" });\n"
-	"\n"
-	"\n"
-	" // Server Incoming Requests \n"
-	" graphs.push({\n"
-	" 'title' : \"Server Incoming Requests\",\n"
-	" 'target': 'chart_incoming_requests',\n"
-	" 'data': [['Requests','Counter'],<xsl:for-each select=\"server/counters[@type=&quot;opcode&quot;]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]});\n"
-	" \n"
-	" \n"
-	" \n"
-	" \n"
-	" </script>\n"
-	" </xsl:if>\n"
-	" <style type=\"text/css\">\n"
-	" body {\n"
-	" font-family: sans-serif;\n"
-	" background-color: #ffffff;\n"
-	" color: #000000;\n"
-	" font-size: 10pt;\n"
-	" }\n"
-	" \n"
-	" .odd{\n"
-	" background-color: #f0f0f0;\n"
-	" }\n"
-	" \n"
-	" .even{\n"
-	" background-color: #ffffff;\n"
-	" }\n"
-	" \n"
-	" p.footer{\n"
-	" font-style:italic;\n"
-	" color: grey;\n"
-	" }\n"
-	"\n"
-	" table {\n"
-	" border-collapse: collapse;\n"
-	" border: 1px solid grey;\n"
-	" }\n"
-	"\n"
-	" table.counters{\n"
-	" border: 1px solid grey;\n"
-	" width: 500px;\n"
-	" }\n"
-	" \n"
-	" table.counters th {\n"
-	" text-align: center;\n"
-	" border: 1px solid grey;\n"
-	" width: 120px;\n"
-	" }\n"
-	" table.counters td{\n"
-	" text-align:center;\n"
-	" \n"
-	" }\n"
-	" \n"
-	" table.counters tr:hover{\n"
-	" background-color: #99ddff;\n"
-	" }\n"
-	" \n"
-	" .totals {\n"
-	" background-color: rgb(1,169,206);\n"
-	" color: #ffffff;\n"
-	" }\n"
-	"\n"
-	" td, th {\n"
-	" padding-right: 5px;\n"
-	" padding-left: 5px;\n"
-	" border: 1px solid grey;\n"
-	" }\n"
-	"\n"
-	" .header h1 {\n"
-	" color: rgb(1,169,206);\n"
-	" padding: 0px;\n"
-	" }\n"
-	"\n"
-	" .content {\n"
-	" background-color: #ffffff;\n"
-	" color: #000000;\n"
-	" padding: 4px;\n"
-	" }\n"
-	"\n"
-	" .item {\n"
-	" padding: 4px;\n"
-	" text-align: right;\n"
-	" }\n"
-	"\n"
-	" .value {\n"
-	" padding: 4px;\n"
-	" font-weight: bold;\n"
-	" }\n"
-	"\n"
-	"\n"
-	" h2 {\n"
-	" color: grey;\n"
-	" font-size: 14pt;\n"
-	" width:500px;\n"
-	" text-align:center;\n"
-	" }\n"
-	" \n"
-	" h3 {\n"
-	" color: #444444;\n"
-	" font-size: 12pt;\n"
-	" width:500px;\n"
-	" text-align:center;\n"
-	" \n"
-	" }\n"
-	" h4 {\n"
-	" color: rgb(1,169,206);\n"
-	" font-size: 10pt;\n"
-	" width:500px;\n"
-	" text-align:center;\n"
-	" \n"
-	" }\n"
-	"\n"
-	" .pie {\n"
-	" width:500px;\n"
-	" height: 500px;\n"
-	" }\n"
-	"\n"
-	" </style>\n"
-	" <title>ISC BIND 9 Statistics</title>\n"
-	" </head>\n"
-	" <body>\n"
-	" <div class=\"header\">\n"
-	" <h1>ISC Bind 9 Configuration and Statistics</h1>\n"
-	" </div>\n"
-	" <hr/>\n"
-	" <h2>Server Times</h2>\n"
-	" <table class=\"counters\">\n"
-	" <tr>\n"
-	" <th>Boot time:</th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"server/boot-time\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" <tr>\n"
-	" <th>Sample time:</th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"server/current-time\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h2>Incoming Requests</h2>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <div class=\"pie\" id=\"chart_incoming_requests\">[graph incoming requests]</div>\n"
-	" </xsl:if>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"server/counters[@type=&quot;opcode&quot;]/counter\">\n"
-	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <tr>\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" <tr>\n"
-	" <th class=\"totals\">Total:</th>\n"
-	" <td class=\"totals\">\n"
-	" <xsl:value-of select=\"sum(server/counters[@type=&quot;opcode&quot;]/counter)\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h3>Incoming Queries by Type</h3>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <div class=\"pie\" id=\"chart_incoming_qtypes\">[graph incoming qtypes]</div>\n"
-	" </xsl:if>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"server/counters[@type=&quot;qtype&quot;]/counter\">\n"
-	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" <tr>\n"
-	" <th class=\"totals\">Total:</th>\n"
-	" <td class=\"totals\">\n"
-	" <xsl:value-of select=\"sum(server/counters[@type=&quot;qtype&quot;]/counter)\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h2>Outgoing Queries per view</h2>\n"
-	" <xsl:for-each select=\"views/view[count(counters[@type=&quot;resqtype&quot;]/counter) &gt; 0]\">\n"
-	" <h3>View <xsl:value-of select=\"@name\"/></h3>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <script type=\"text/javascript\">\n"
-	" graphs.push({\n"
-	" 'title': \"Outgoing queries for view: <xsl:value-of select=\"@name\"/>\",\n"
-	" 'target': 'chart_outgoing_queries_view_<xsl:value-of select=\"@name\"/>',\n"
-	" 'data': [['Type','Counter'],<xsl:for-each select=\"counters[@type=&quot;resqtype&quot;]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n"
-	" });\n"
-	" \n"
-	" </script>\n"
-	" <xsl:variable name=\"target\">\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </xsl:variable>\n"
-	" <div class=\"pie\" id=\"chart_outgoing_queries_view_{$target}\"/>\n"
-	" </xsl:if>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"counters[@type=&quot;resqtype&quot;]/counter\">\n"
-	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class1\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class1}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <br/>\n"
-	" </xsl:for-each>\n"
-	" <h2>Server Statistics</h2>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <script type=\"text/javascript\">\n"
-	" graphs.push({\n"
-	" 'title' : \"Server Response Types\",\n"
-	" 'target': 'chart_server_nsstat_restype',\n"
-	" 'data': [['Type','Counter'],<xsl:for-each select=\"server/counters[@type=&quot;nsstat&quot;]/counter[.&gt;0]\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n"
-	" });\n"
-	" \n"
-	" </script>\n"
-	" <div class=\"pie\" id=\"chart_server_nsstat_restype\"/>\n"
-	" </xsl:if>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"server/counters[@type=&quot;nsstat&quot;]/counter[.&gt;0]\">\n"
-	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class2\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class2}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h2>Zone Maintenance Statistics</h2>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <script type=\"text/javascript\">\n"
-	" graphs.push({\n"
-	" 'title' : \"Zone Maintenance Stats\",\n"
-	" 'target': 'chart_server_zone_maint',\n"
-	" 'data': [['Type','Counter'],<xsl:for-each select=\"server/counters[@type=&quot;zonestat&quot;]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n"
-	" });\n"
-	"\n"
-	" </script>\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <div class=\"pie\" id=\"chart_server_zone_maint\"/>\n"
-	" </xsl:if>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"server/counters[@type=&quot;zonestat&quot;]/counter\">\n"
-	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class3\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class3}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <h2>Resolver Statistics (Common)</h2>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"server/counters[@type=&quot;restat&quot;]/counter\">\n"
-	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class4\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class4}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <xsl:for-each select=\"views/view\">\n"
-	" <h3>Resolver Statistics for View <xsl:value-of select=\"@name\"/></h3>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"counters[@type=&quot;resstats&quot;]/counter[.&gt;0]\">\n"
-	" <xsl:sort select=\".\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class5\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class5}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" </xsl:for-each>\n"
-	" <h3>Cache DB RRsets for View <xsl:value-of select=\"@name\"/></h3>\n"
-	" <xsl:for-each select=\"views/view\">\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"cache/rrset\">\n"
-	" <xsl:variable name=\"css-class6\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class6}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"counter\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <br/>\n"
-	" </xsl:for-each>\n"
-	" <h2>Socket I/O Statistics</h2>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"server/counters[@type=&quot;sockstat&quot;]/counter[.&gt;0]\">\n"
-	" <xsl:variable name=\"css-class7\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class7}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <br/>\n"
-	" <h2>Response Codes per view/zone</h2>\n"
-	" <xsl:for-each select=\"views/view[zones/zone/counters[@type=&quot;rcode&quot;]/counter &gt;0]\">\n"
-	" <h3>View <xsl:value-of select=\"@name\"/></h3>\n"
-	" <xsl:variable name=\"thisview\">\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </xsl:variable>\n"
-	" <xsl:for-each select=\"zones/zone\">\n"
-	" <xsl:if test=\"counters[@type=&quot;rcode&quot;]/counter[. &gt; 0]\">\n"
-	" <h4>Zone <xsl:value-of select=\"@name\"/></h4>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <script type=\"text/javascript\">\n"
-	" graphs.push({\n"
-	" 'title': \"Response Codes for zone <xsl:value-of select=\"@name\"/>\",\n"
-	" 'target': 'chart_rescode_<xsl:value-of select=\"../../@name\"/>_<xsl:value-of select=\"@name\"/>',\n"
-	" 'data': [['Type','Counter'],<xsl:for-each select=\"counters[@type=&quot;rcode&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n"
-	" });\n"
-	"\n"
-	" </script>\n"
-	" <xsl:variable name=\"target\">\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </xsl:variable>\n"
-	" <div class=\"pie\" id=\"chart_rescode_{$thisview}_{$target}\"/>\n"
-	" </xsl:if>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"counters[@type=&quot;rcode&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]\">\n"
-	" <xsl:sort select=\".\"/>\n"
-	" <xsl:variable name=\"css-class10\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class10}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" </xsl:if>\n"
-	" </xsl:for-each>\n"
-	" </xsl:for-each>\n"
-	" <h2>Received QTYPES per view/zone</h2>\n"
-	" <xsl:for-each select=\"views/view[zones/zone/counters[@type=&quot;qtype&quot;]/counter &gt;0]\">\n"
-	" <h3>View <xsl:value-of select=\"@name\"/></h3>\n"
-	" <xsl:variable name=\"thisview2\">\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </xsl:variable>\n"
-	" <xsl:for-each select=\"zones/zone\">\n"
-	" <xsl:if test=\"counters[@type=&quot;qtype&quot;]/counter[count(.) &gt; 0]\">\n"
-	" <h4>Zone <xsl:value-of select=\"@name\"/></h4>\n"
-	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
-	" <!-- Non Mozilla specific markup -->\n"
-	" <script type=\"text/javascript\">\n"
-	" graphs.push({\n"
-	" 'title': \"Query Types for zone <xsl:value-of select=\"@name\"/>\",\n"
-	" 'target': 'chart_qtype_<xsl:value-of select=\"../../@name\"/>_<xsl:value-of select=\"@name\"/>',\n"
-	" 'data': [['Type','Counter'],<xsl:for-each select=\"counters[@type=&quot;qtype&quot;]/counter[.&gt;0 and @name != &quot;QryAuthAns&quot;]\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n"
-	" });\n"
-	"\n"
-	" </script>\n"
-	" <xsl:variable name=\"target\">\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </xsl:variable>\n"
-	" <div class=\"pie\" id=\"chart_qtype_{$thisview2}_{$target}\"/>\n"
-	" </xsl:if>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"counters[@type=&quot;qtype&quot;]/counter\">\n"
-	" <xsl:sort select=\".\"/>\n"
-	" <xsl:variable name=\"css-class11\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class11}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"@name\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" </xsl:if>\n"
-	" </xsl:for-each>\n"
-	" </xsl:for-each>\n"
-	" <h2>Network Status</h2>\n"
-	" <table class=\"counters\">\n"
-	" <tr>\n"
-	" <th>ID</th>\n"
-	" <th>Name</th>\n"
-	" <th>Type</th>\n"
-	" <th>References</th>\n"
-	" <th>LocalAddress</th>\n"
-	" <th>PeerAddress</th>\n"
-	" <th>State</th>\n"
-	" </tr>\n"
-	" <xsl:for-each select=\"socketmgr/sockets/socket\">\n"
-	" <xsl:sort select=\"id\"/>\n"
-	" <xsl:variable name=\"css-class12\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class12}\">\n"
-	" <td>\n"
-	" <xsl:value-of select=\"id\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"name\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"type\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"references\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"local-address\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"peer-address\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:for-each select=\"states\">\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </xsl:for-each>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h2>Task Manager Configuration</h2>\n"
-	" <table class=\"counters\">\n"
-	" <tr>\n"
-	" <th class=\"even\">Thread-Model</th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"taskmgr/thread-model/type\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" <tr class=\"odd\">\n"
-	" <th>Worker Threads</th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"taskmgr/thread-model/worker-threads\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" <tr class=\"even\">\n"
-	" <th>Default Quantum</th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"taskmgr/thread-model/default-quantum\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" <tr class=\"odd\">\n"
-	" <th>Tasks Running</th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"taskmgr/thread-model/tasks-running\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h2>Tasks</h2>\n"
-	" <table class=\"counters\">\n"
-	" <tr>\n"
-	" <th>ID</th>\n"
-	" <th>Name</th>\n"
-	" <th>References</th>\n"
-	" <th>State</th>\n"
-	" <th>Quantum</th>\n"
-	" </tr>\n"
-	" <xsl:for-each select=\"taskmgr/tasks/task\">\n"
-	" <xsl:sort select=\"name\"/>\n"
-	" <xsl:variable name=\"css-class14\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class14}\">\n"
-	" <td>\n"
-	" <xsl:value-of select=\"id\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"name\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"references\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"state\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"quantum\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h2>Memory Usage Summary</h2>\n"
-	" <table class=\"counters\">\n"
-	" <xsl:for-each select=\"memory/summary/*\">\n"
-	" <xsl:variable name=\"css-class13\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class13}\">\n"
-	" <th>\n"
-	" <xsl:value-of select=\"name()\"/>\n"
-	" </th>\n"
-	" <td>\n"
-	" <xsl:value-of select=\".\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <br/>\n"
-	" <h2>Memory Contexts</h2>\n"
-	" <table class=\"counters\">\n"
-	" <tr>\n"
-	" <th>ID</th>\n"
-	" <th>Name</th>\n"
-	" <th>References</th>\n"
-	" <th>TotalUse</th>\n"
-	" <th>InUse</th>\n"
-	" <th>MaxUse</th>\n"
-	" <th>BlockSize</th>\n"
-	" <th>Pools</th>\n"
-	" <th>HiWater</th>\n"
-	" <th>LoWater</th>\n"
-	" </tr>\n"
-	" <xsl:for-each select=\"memory/contexts/context\">\n"
-	" <xsl:sort select=\"total\" data-type=\"number\" order=\"descending\"/>\n"
-	" <xsl:variable name=\"css-class14\">\n"
-	" <xsl:choose>\n"
-	" <xsl:when test=\"position() mod 2 = 0\">even</xsl:when>\n"
-	" <xsl:otherwise>odd</xsl:otherwise>\n"
-	" </xsl:choose>\n"
-	" </xsl:variable>\n"
-	" <tr class=\"{$css-class14}\">\n"
-	" <td>\n"
-	" <xsl:value-of select=\"id\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"name\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"references\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"total\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"inuse\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"maxinuse\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"blocksize\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"pools\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"hiwater\"/>\n"
-	" </td>\n"
-	" <td>\n"
-	" <xsl:value-of select=\"lowater\"/>\n"
-	" </td>\n"
-	" </tr>\n"
-	" </xsl:for-each>\n"
-	" </table>\n"
-	" <hr/>\n"
-	" <p class=\"footer\">Internet Systems Consortium Inc.<br/><a href=\"http://www.isc.org\">http://www.isc.org</a></p>\n"
-	" </body>\n"
-	" </html>\n"
-	" </xsl:template>\n"
-	"</xsl:stylesheet>\n";
--- a/external/bsd/bind/dist/bin/named/bind9.xsl.h	Sat Mar 01 01:53:36 2014 +0000
+++ b/external/bsd/bind/dist/bin/named/bind9.xsl.h	Sat Mar 01 03:24:32 2014 +0000
@@ -1,13 +1,13 @@
-/*	$NetBSD: bind9.xsl.h,v 1.4 2012/06/05 00:38:58 christos Exp $	*/
+/*	$NetBSD: bind9.xsl.h,v 1.5 2014/03/01 03:24:32 christos Exp $	*/
 
 /*
  * Generated by convertxsl.pl 1.14 2008/07/17 23:43:26 jinmei Exp  
- * From bind9.xsl 1.21 2009/01/27 23:47:54 tbox Exp 
+ * From <!-- %Id: bind9.xsl 1.21 2009/01/27 23:47:54 tbox Exp %
  */
 static char xslmsg[] =
 	"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
 	"<!--\n"
-	" - Copyright (C) 2006-2009 Internet Systems Consortium, Inc. (\"ISC\")\n"
+	" - Copyright (C) 2006-2009, 2012-2014 Internet Systems Consortium, Inc. (\"ISC\")\n"
 	" -\n"
 	" - Permission to use, copy, modify, and/or distribute this software for any\n"
 	" - purpose with or without fee is hereby granted, provided that the above\n"
@@ -22,314 +22,704 @@
 	" - PERFORMANCE OF THIS SOFTWARE.\n"
 	"-->\n"
 	"\n"
-	"<!-- \045Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp \045 -->\n"
+	"<!-- Id -->\n"
 	"\n"
-	"<xsl:stylesheet version=\"1.0\"\n"
-	" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\"\n"
-	" xmlns=\"http://www.w3.org/1999/xhtml\">\n"
-	" <xsl:template match=\"isc/bind/statistics\">\n"
+	"<!-- \045Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp \045 -->\n"
+	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
+	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
+	" <xsl:template match=\"statistics[@version=&quot;3.5&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
+	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
+	" <!-- Non Mozilla specific markup -->\n"
+	" <script type=\"text/javascript\" src=\"https://www.google.com/jsapi\"/>\n"
+	" <script type=\"text/javascript\">\n"
+	"\n"
+	" google.load(\"visualization\", \"1\", {packages:[\"corechart\"]});\n"
+	" google.setOnLoadCallback(loadGraphs);\n"
+	"\n"
+	" var graphs=[];\n"
+	"\n"
+	" function drawChart(chart_title,target,style,data) {\n"
+	" var data = google.visualization.arrayToDataTable(data);\n"
+	"\n"
+	" var options = {\n"
+	" title: chart_title\n"
+	" };\n"
+	"\n"
+	" var chart;\n"
+	" if (style == \"barchart\") {\n"
+	" chart = new google.visualization.BarChart(document.getElementById(target));\n"
+	" chart.draw(data, options);\n"
+	" } else if (style == \"piechart\") {\n"
+	" chart = new google.visualization.PieChart(document.getElementById(target));\n"
+	" chart.draw(data, options);\n"
+	" }\n"
+	" }\n"
+	"\n"
+	" function loadGraphs(){\n"
+	" var g;\n"
+	"\n"
+	" while(g = graphs.shift()){\n"
+	" // alert(\"going for: \" + g.target);\n"
+	" if(g.data.length > 1){\n"
+	" drawChart(g.title,g.target,g.style,g.data);\n"
+	" }\n"
+	" }\n"
+	" }\n"
+	"\n"
+	" <xsl:if test=\"server/counters[@type=&quot;qtype&quot;]/counter\">\n"
+	" // Server Incoming Query Types\n"
+	" graphs.push({\n"
+	" 'title' : \"Server Incoming Query Types\",\n"
+	" 'target': 'chart_incoming_qtypes',\n"
+	" 'style': 'barchart',\n"
+	" 'data': [['Type','Counter'],<xsl:for-each select=\"server/counters[@type=&quot;qtype&quot;]/counter\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]\n"
+	" });\n"
+	" </xsl:if>\n"
+	"\n"
+	" <xsl:if test=\"server/counters[@type=&quot;opcode&quot;]/counter\">\n"
+	" // Server Incoming Requests by opcode\n"
+	" graphs.push({\n"
+	" 'title' : \"Server Incoming Requests by DNS Opcode\",\n"
+	" 'target': 'chart_incoming_opcodes',\n"
+	" 'style': 'barchart',\n"
+	" 'data': [['Opcode','Counter'],<xsl:for-each select=\"server/counters[@type=&quot;opcode&quot;]/counter[. &gt; 0 or substring(@name,1,3) != 'RES']\">['<xsl:value-of select=\"@name\"/>',<xsl:value-of select=\".\"/>],</xsl:for-each>]});\n"
+	" </xsl:if>\n"
+	" </script>\n"
+	" </xsl:if>\n"
 	" <style type=\"text/css\">\n"
-	"body {\n"
+	" body {\n"
 	" font-family: sans-serif;\n"
 	" background-color: #ffffff;\n"
 	" color: #000000;\n"
-	"}\n"
+	" font-size: 10pt;\n"
+	" }\n"
+	"\n"
+	" .odd{\n"
+	" background-color: #f0f0f0;\n"
+	" }\n"
 	"\n"
-	"table {\n"
+	" .even{\n"
+	" background-color: #ffffff;\n"
+	" }\n"
+	"\n"
+	" p.footer{\n"
+	" font-style:italic;\n"
+	" color: grey;\n"
+	" }\n"
+	"\n"
+	" table {\n"
 	" border-collapse: collapse;\n"
-	"}\n"
+	" border: 1px solid grey;\n"
+	" }\n"
 	"\n"
-	"tr.rowh {\n"
+	" table.counters{\n"
+	" border: 1px solid grey;\n"
+	" width: 500px;\n"
+	" }\n"
+	" table.counters th {\n"
+	" text-align: right;\n"
+	" border: 1px solid grey;\n"
+	" width: 150px;\n"
+	" }\n"
+	" table.counters td {\n"
+	" text-align: right;\n"
+	" font-family: monospace;\n"
+	" }\n"
+	" table.counters tr:hover{\n"
+	" background-color: #99ddff;\n"
+	" }\n"
+	"\n"
+	" table.info {\n"
+	" border: 1px solid grey;\n"
+	" width: 500px;\n"
+	" }\n"
+	" table.info th {\n"
 	" text-align: center;\n"
-	" border: 1px solid #000000;\n"
-	" background-color: #8080ff;\n"
-	" color: #ffffff;\n"
-	"}\n"
+	" border: 1px solid grey;\n"
+	" width: 150px;\n"
+	" }\n"
+	" table.info td {\n"
+	" text-align: center;\n"
+	" }\n"
+	" table.info tr:hover{\n"
+	" background-color: #99ddff;\n"
+	" }\n"
 	"\n"
-	"tr.row {\n"
+	" table.tasks {\n"
+	" border: 1px solid grey;\n"
+	" width: 500px;\n"
+	" }\n"
+	" table.tasks th {\n"
+	" text-align: center;\n"
+	" border: 1px solid grey;\n"
+	" width: 150px;\n"
+	" }\n"
+	" table.tasks td {\n"
 	" text-align: right;\n"
-	" border: 1px solid #000000;\n"
-	" background-color: teal;\n"
-	" color: #ffffff;\n"
-	"}\n"
+	" font-family: monospace;\n"
+	" }\n"
+	" table.tasks td:nth-child(2) {\n"
+	" text-align: center;\n"
+	" }\n"
+	" table.tasks td:nth-child(4) {\n"
+	" text-align: center;\n"
+	" }\n"
+	" table.tasks tr:hover{\n"
+	" background-color: #99ddff;\n"
+	" }\n"
 	"\n"
-	"tr.lrow {\n"
+	" table.netstat {\n"
+	" border: 1px solid grey;\n"
+	" width: 500px;\n"
+	" }\n"
+	" table.netstat th {\n"
+	" text-align: center;\n"
+	" border: 1px solid grey;\n"
+	" width: 150px;\n"