--- bind9-9.9.5.dfsg.orig/CVE-2015-5722.patch
+++ bind9-9.9.5.dfsg/CVE-2015-5722.patch
@@ -0,0 +1,482 @@
+diff --git a/lib/dns/hmac_link.c b/lib/dns/hmac_link.c
+index d99c5fb..7baf241 100644
+--- a/lib/dns/hmac_link.c
++++ b/lib/dns/hmac_link.c
+@@ -76,7 +76,7 @@ hmacmd5_createctx(dst_key_t *key, dst_context_t *dctx) {
+ 	hmacmd5ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacmd5_t));
+ 	if (hmacmd5ctx == NULL)
+ 		return (ISC_R_NOMEMORY);
+-	isc_hmacmd5_init(hmacmd5ctx, hkey->key, ISC_SHA1_BLOCK_LENGTH);
++	isc_hmacmd5_init(hmacmd5ctx, hkey->key, ISC_MD5_BLOCK_LENGTH);
+ 	dctx->ctxdata.hmacmd5ctx = hmacmd5ctx;
+ 	return (ISC_R_SUCCESS);
+ }
+@@ -139,7 +139,7 @@ hmacmd5_compare(const dst_key_t *key1, const dst_key_t *key2) {
+ 	else if (hkey1 == NULL || hkey2 == NULL)
+ 		return (ISC_FALSE);
+ 
+-	if (isc_safe_memcmp(hkey1->key, hkey2->key, ISC_SHA1_BLOCK_LENGTH))
++	if (isc_safe_memcmp(hkey1->key, hkey2->key, ISC_MD5_BLOCK_LENGTH))
+ 		return (ISC_TRUE);
+ 	else
+ 		return (ISC_FALSE);
+@@ -150,17 +150,17 @@ hmacmd5_generate(dst_key_t *key, int pseudorandom_ok, void (*callback)(int)) {
+ 	isc_buffer_t b;
+ 	isc_result_t ret;
+ 	unsigned int bytes;
+-	unsigned char data[ISC_SHA1_BLOCK_LENGTH];
++	unsigned char data[ISC_MD5_BLOCK_LENGTH];
+ 
+ 	UNUSED(callback);
+ 
+ 	bytes = (key->key_size + 7) / 8;
+-	if (bytes > ISC_SHA1_BLOCK_LENGTH) {
+-		bytes = ISC_SHA1_BLOCK_LENGTH;
+-		key->key_size = ISC_SHA1_BLOCK_LENGTH * 8;
++	if (bytes > ISC_MD5_BLOCK_LENGTH) {
++		bytes = ISC_MD5_BLOCK_LENGTH;
++		key->key_size = ISC_MD5_BLOCK_LENGTH * 8;
+ 	}
+ 
+-	memset(data, 0, ISC_SHA1_BLOCK_LENGTH);
++	memset(data, 0, ISC_MD5_BLOCK_LENGTH);
+ 	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
+ 
+ 	if (ret != ISC_R_SUCCESS)
+@@ -169,7 +169,7 @@ hmacmd5_generate(dst_key_t *key, int pseudorandom_ok, void (*callback)(int)) {
+ 	isc_buffer_init(&b, data, bytes);
+ 	isc_buffer_add(&b, bytes);
+ 	ret = hmacmd5_fromdns(key, &b);
+-	memset(data, 0, ISC_SHA1_BLOCK_LENGTH);
++	memset(data, 0, ISC_MD5_BLOCK_LENGTH);
+ 
+ 	return (ret);
+ }
+@@ -223,7 +223,7 @@ hmacmd5_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 
+ 	memset(hkey->key, 0, sizeof(hkey->key));
+ 
+-	if (r.length > ISC_SHA1_BLOCK_LENGTH) {
++	if (r.length > ISC_MD5_BLOCK_LENGTH) {
+ 		isc_md5_init(&md5ctx);
+ 		isc_md5_update(&md5ctx, r.base, r.length);
+ 		isc_md5_final(&md5ctx, hkey->key);
+@@ -236,6 +236,8 @@ hmacmd5_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	key->key_size = keylen * 8;
+ 	key->keydata.hmacmd5 = hkey;
+ 
++	isc_buffer_forward(data, r.length);
++
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+@@ -512,6 +514,8 @@ hmacsha1_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	key->key_size = keylen * 8;
+ 	key->keydata.hmacsha1 = hkey;
+ 
++	isc_buffer_forward(data, r.length);
++
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+@@ -790,6 +794,8 @@ hmacsha224_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	key->key_size = keylen * 8;
+ 	key->keydata.hmacsha224 = hkey;
+ 
++	isc_buffer_forward(data, r.length);
++
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+@@ -1068,6 +1074,8 @@ hmacsha256_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	key->key_size = keylen * 8;
+ 	key->keydata.hmacsha256 = hkey;
+ 
++	isc_buffer_forward(data, r.length);
++
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+@@ -1346,6 +1354,8 @@ hmacsha384_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	key->key_size = keylen * 8;
+ 	key->keydata.hmacsha384 = hkey;
+ 
++	isc_buffer_forward(data, r.length);
++
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+@@ -1624,6 +1634,8 @@ hmacsha512_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	key->key_size = keylen * 8;
+ 	key->keydata.hmacsha512 = hkey;
+ 
++	isc_buffer_forward(data, r.length);
++
+ 	return (ISC_R_SUCCESS);
+ }
+ 
+diff --git a/lib/dns/include/dst/dst.h b/lib/dns/include/dst/dst.h
+index 1fdce4c..eecea21 100644
+--- a/lib/dns/include/dst/dst.h
++++ b/lib/dns/include/dst/dst.h
+@@ -69,6 +69,7 @@ typedef struct dst_context 	dst_context_t;
+ #define DST_ALG_HMACSHA256	163	/* XXXMPA */
+ #define DST_ALG_HMACSHA384	164	/* XXXMPA */
+ #define DST_ALG_HMACSHA512	165	/* XXXMPA */
++#define DST_ALG_INDIRECT	252
+ #define DST_ALG_PRIVATE		254
+ #define DST_ALG_EXPAND		255
+ #define DST_MAX_ALGS		255
+diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c
+index bcb3d05..3114954 100644
+--- a/lib/dns/ncache.c
++++ b/lib/dns/ncache.c
+@@ -614,13 +614,11 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
+ 		dns_name_fromregion(&tname, &remaining);
+ 		INSIST(remaining.length >= tname.length);
+ 		isc_buffer_forward(&source, tname.length);
+-		remaining.length -= tname.length;
+-		remaining.base += tname.length;
++		isc_region_consume(&remaining, tname.length);
+ 
+ 		INSIST(remaining.length >= 2);
+ 		type = isc_buffer_getuint16(&source);
+-		remaining.length -= 2;
+-		remaining.base += 2;
++		isc_region_consume(&remaining, 2);
+ 
+ 		if (type != dns_rdatatype_rrsig ||
+ 		    !dns_name_equal(&tname, name)) {
+@@ -632,8 +630,7 @@ dns_ncache_getsigrdataset(dns_rdataset_t *ncacherdataset, dns_name_t *name,
+ 		INSIST(remaining.length >= 1);
+ 		trust = isc_buffer_getuint8(&source);
+ 		INSIST(trust <= dns_trust_ultimate);
+-		remaining.length -= 1;
+-		remaining.base += 1;
++		isc_region_consume(&remaining, 1);
+ 
+ 		raw = remaining.base;
+ 		count = raw[0] * 256 + raw[1];
+diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
+index 953e8fd..884c9ae 100644
+--- a/lib/dns/openssldh_link.c
++++ b/lib/dns/openssldh_link.c
+@@ -266,8 +266,10 @@ openssldh_destroy(dst_key_t *key) {
+ 
+ static void
+ uint16_toregion(isc_uint16_t val, isc_region_t *region) {
+-	*region->base++ = (val & 0xff00) >> 8;
+-	*region->base++ = (val & 0x00ff);
++	*region->base = (val & 0xff00) >> 8;
++	isc_region_consume(region, 1);
++	*region->base = (val & 0x00ff);
++	isc_region_consume(region, 1);
+ }
+ 
+ static isc_uint16_t
+@@ -278,7 +280,8 @@ uint16_fromregion(isc_region_t *region) {
+ 	val = ((unsigned int)(cp[0])) << 8;
+ 	val |= ((unsigned int)(cp[1]));
+ 
+-	region->base += 2;
++	isc_region_consume(region, 2);
++
+ 	return (val);
+ }
+ 
+@@ -319,16 +322,16 @@ openssldh_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	}
+ 	else
+ 		BN_bn2bin(dh->p, r.base);
+-	r.base += plen;
++	isc_region_consume(&r, plen);
+ 
+ 	uint16_toregion(glen, &r);
+ 	if (glen > 0)
+ 		BN_bn2bin(dh->g, r.base);
+-	r.base += glen;
++	isc_region_consume(&r, glen);
+ 
+ 	uint16_toregion(publen, &r);
+ 	BN_bn2bin(dh->pub_key, r.base);
+-	r.base += publen;
++	isc_region_consume(&r, publen);
+ 
+ 	isc_buffer_add(data, dnslen);
+ 
+@@ -369,10 +372,12 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		return (DST_R_INVALIDPUBLICKEY);
+ 	}
+ 	if (plen == 1 || plen == 2) {
+-		if (plen == 1)
+-			special = *r.base++;
+-		else
++		if (plen == 1) {
++			special = *r.base;
++			isc_region_consume(&r, 1);
++		} else {
+ 			special = uint16_fromregion(&r);
++		}
+ 		switch (special) {
+ 			case 1:
+ 				dh->p = &bn768;
+@@ -387,10 +392,9 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 				DH_free(dh);
+ 				return (DST_R_INVALIDPUBLICKEY);
+ 		}
+-	}
+-	else {
++	} else {
+ 		dh->p = BN_bin2bn(r.base, plen, NULL);
+-		r.base += plen;
++		isc_region_consume(&r, plen);
+ 	}
+ 
+ 	/*
+@@ -421,15 +425,14 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 				return (DST_R_INVALIDPUBLICKEY);
+ 			}
+ 		}
+-	}
+-	else {
++	} else {
+ 		if (glen == 0) {
+ 			DH_free(dh);
+ 			return (DST_R_INVALIDPUBLICKEY);
+ 		}
+ 		dh->g = BN_bin2bn(r.base, glen, NULL);
+ 	}
+-	r.base += glen;
++	isc_region_consume(&r, glen);
+ 
+ 	if (r.length < 2) {
+ 		DH_free(dh);
+@@ -441,7 +444,7 @@ openssldh_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		return (DST_R_INVALIDPUBLICKEY);
+ 	}
+ 	dh->pub_key = BN_bin2bn(r.base, publen, NULL);
+-	r.base += publen;
++	isc_region_consume(&r, publen);
+ 
+ 	key->key_size = BN_num_bits(dh->p);
+ 
+diff --git a/lib/dns/openssldsa_link.c b/lib/dns/openssldsa_link.c
+index 61e64db..d534770 100644
+--- a/lib/dns/openssldsa_link.c
++++ b/lib/dns/openssldsa_link.c
+@@ -29,8 +29,6 @@
+  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
+-/* $Id$ */
+-
+ #ifdef OPENSSL
+ #ifndef USE_EVP
+ #define USE_EVP 1
+@@ -137,6 +135,7 @@ openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+ 	DSA *dsa = key->keydata.dsa;
+ 	isc_region_t r;
+ 	DSA_SIG *dsasig;
++	unsigned int klen;
+ #if USE_EVP
+ 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
+ 	EVP_PKEY *pkey;
+@@ -188,6 +187,7 @@ openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+ 					       ISC_R_FAILURE));
+ 	}
+ 	free(sigbuf);
++
+ #elif 0
+ 	/* Only use EVP for the Digest */
+ 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &siglen)) {
+@@ -209,11 +209,17 @@ openssldsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+ 					       "DSA_do_sign",
+ 					       DST_R_SIGNFAILURE));
+ #endif
+-	*r.base++ = (key->key_size - 512)/64;
++
++	klen = (key->key_size - 512)/64;
++	if (klen > 255)
++		return (ISC_R_FAILURE);
++	*r.base = klen;
++	isc_region_consume(&r, 1);
++
+ 	BN_bn2bin_fixed(dsasig->r, r.base, ISC_SHA1_DIGESTLENGTH);
+-	r.base += ISC_SHA1_DIGESTLENGTH;
++	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
+ 	BN_bn2bin_fixed(dsasig->s, r.base, ISC_SHA1_DIGESTLENGTH);
+-	r.base += ISC_SHA1_DIGESTLENGTH;
++	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
+ 	DSA_SIG_free(dsasig);
+ 	isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH * 2 + 1);
+ 
+@@ -446,15 +452,16 @@ openssldsa_todns(const dst_key_t *key, isc_buffer_t *data) {
+ 	if (r.length < (unsigned int) dnslen)
+ 		return (ISC_R_NOSPACE);
+ 
+-	*r.base++ = t;
++	*r.base = t;
++	isc_region_consume(&r, 1);
+ 	BN_bn2bin_fixed(dsa->q, r.base, ISC_SHA1_DIGESTLENGTH);
+-	r.base += ISC_SHA1_DIGESTLENGTH;
++	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
+ 	BN_bn2bin_fixed(dsa->p, r.base, key->key_size/8);
+-	r.base += p_bytes;
++	isc_region_consume(&r, p_bytes);
+ 	BN_bn2bin_fixed(dsa->g, r.base, key->key_size/8);
+-	r.base += p_bytes;
++	isc_region_consume(&r, p_bytes);
+ 	BN_bn2bin_fixed(dsa->pub_key, r.base, key->key_size/8);
+-	r.base += p_bytes;
++	isc_region_consume(&r, p_bytes);
+ 
+ 	isc_buffer_add(data, dnslen);
+ 
+@@ -479,29 +486,30 @@ openssldsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		return (ISC_R_NOMEMORY);
+ 	dsa->flags &= ~DSA_FLAG_CACHE_MONT_P;
+ 
+-	t = (unsigned int) *r.base++;
++	t = (unsigned int) *r.base;
++	isc_region_consume(&r, 1);
+ 	if (t > 8) {
+ 		DSA_free(dsa);
+ 		return (DST_R_INVALIDPUBLICKEY);
+ 	}
+ 	p_bytes = 64 + 8 * t;
+ 
+-	if (r.length < 1 + ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
++	if (r.length < ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
+ 		DSA_free(dsa);
+ 		return (DST_R_INVALIDPUBLICKEY);
+ 	}
+ 
+ 	dsa->q = BN_bin2bn(r.base, ISC_SHA1_DIGESTLENGTH, NULL);
+-	r.base += ISC_SHA1_DIGESTLENGTH;
++	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
+ 
+ 	dsa->p = BN_bin2bn(r.base, p_bytes, NULL);
+-	r.base += p_bytes;
++	isc_region_consume(&r, p_bytes);
+ 
+ 	dsa->g = BN_bin2bn(r.base, p_bytes, NULL);
+-	r.base += p_bytes;
++	isc_region_consume(&r, p_bytes);
+ 
+ 	dsa->pub_key = BN_bin2bn(r.base, p_bytes, NULL);
+-	r.base += p_bytes;
++	isc_region_consume(&r, p_bytes);
+ 
+ 	key->key_size = p_bytes * 8;
+ 
+diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c
+index 34f8ba0..78e6e55 100644
+--- a/lib/dns/opensslecdsa_link.c
++++ b/lib/dns/opensslecdsa_link.c
+@@ -14,8 +14,6 @@
+  * PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
+-/* $Id$ */
+-
+ #include <config.h>
+ 
+ #ifdef HAVE_OPENSSL_ECDSA
+@@ -159,9 +157,9 @@ opensslecdsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
+ 					       "ECDSA_do_sign",
+ 					       DST_R_SIGNFAILURE));
+ 	BN_bn2bin_fixed(ecdsasig->r, r.base, siglen / 2);
+-	r.base += siglen / 2;
++	isc_region_consume(&r, siglen / 2);
+ 	BN_bn2bin_fixed(ecdsasig->s, r.base, siglen / 2);
+-	r.base += siglen / 2;
++	isc_region_consume(&r, siglen / 2);
+ 	ECDSA_SIG_free(ecdsasig);
+ 	isc_buffer_add(sig, siglen);
+ 	ret = ISC_R_SUCCESS;
+diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
+index 8421c64..71f7100 100644
+--- a/lib/dns/opensslrsa_link.c
++++ b/lib/dns/opensslrsa_link.c
+@@ -965,6 +965,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	RSA *rsa;
+ 	isc_region_t r;
+ 	unsigned int e_bytes;
++	unsigned int length;
+ #if USE_EVP
+ 	EVP_PKEY *pkey;
+ #endif
+@@ -972,6 +973,7 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 	isc_buffer_remainingregion(data, &r);
+ 	if (r.length == 0)
+ 		return (ISC_R_SUCCESS);
++	length = r.length;
+ 
+ 	rsa = RSA_new();
+ 	if (rsa == NULL)
+@@ -982,17 +984,18 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		RSA_free(rsa);
+ 		return (DST_R_INVALIDPUBLICKEY);
+ 	}
+-	e_bytes = *r.base++;
+-	r.length--;
++	e_bytes = *r.base;
++	isc_region_consume(&r, 1);
+ 
+ 	if (e_bytes == 0) {
+ 		if (r.length < 2) {
+ 			RSA_free(rsa);
+ 			return (DST_R_INVALIDPUBLICKEY);
+ 		}
+-		e_bytes = ((*r.base++) << 8);
+-		e_bytes += *r.base++;
+-		r.length -= 2;
++		e_bytes = (*r.base) << 8;
++		isc_region_consume(&r, 1);
++		e_bytes += *r.base;
++		isc_region_consume(&r, 1);
+ 	}
+ 
+ 	if (r.length < e_bytes) {
+@@ -1000,14 +1003,13 @@ opensslrsa_fromdns(dst_key_t *key, isc_buffer_t *data) {
+ 		return (DST_R_INVALIDPUBLICKEY);
+ 	}
+ 	rsa->e = BN_bin2bn(r.base, e_bytes, NULL);
+-	r.base += e_bytes;
+-	r.length -= e_bytes;
++	isc_region_consume(&r, e_bytes);
+ 
+ 	rsa->n = BN_bin2bn(r.base, r.length, NULL);
+ 
+ 	key->key_size = BN_num_bits(rsa->n);
+ 
+-	isc_buffer_forward(data, r.length);
++	isc_buffer_forward(data, length);
+ 
+ #if USE_EVP
+ 	pkey = EVP_PKEY_new();
+diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
+index d33c43e..5bb7ceb 100644
+--- a/lib/dns/resolver.c
++++ b/lib/dns/resolver.c
+@@ -9058,6 +9058,12 @@ dns_resolver_algorithm_supported(dns_resolver_t *resolver, dns_name_t *name,
+ 
+ 	REQUIRE(VALID_RESOLVER(resolver));
+ 
++	/*
++	 * DH is unsupported for DNSKEYs, see RFC 4034 sec. A.1.
++	 */
++	if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT))
++		return (ISC_FALSE);
++
+ #if USE_ALGLOCK
+ 	RWLOCK(&resolver->alglock, isc_rwlocktype_read);
+ #endif
+@@ -9077,6 +9083,7 @@ dns_resolver_algorithm_supported(dns_resolver_t *resolver, dns_name_t *name,
+ #endif
+ 	if (found)
+ 		return (ISC_FALSE);
++
+ 	return (dst_algorithm_supported(alg));
+ }
+ 
--- bind9-9.9.5.dfsg.orig/aclocal.m4
+++ bind9-9.9.5.dfsg/aclocal.m4
@@ -1,5 +1,19 @@
-sinclude(libtool.m4/libtool.m4)dnl
-sinclude(libtool.m4/ltoptions.m4)dnl
-sinclude(libtool.m4/ltsugar.m4)dnl
-sinclude(libtool.m4/ltversion.m4)dnl
-sinclude(libtool.m4/lt~obsolete.m4)dnl
+# generated automatically by aclocal 1.14.1 -*- Autoconf -*-
+
+# Copyright (C) 1996-2013 Free Software Foundation, Inc.
+
+# This file is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
+m4_include([libtool.m4/libtool.m4])
+m4_include([libtool.m4/ltoptions.m4])
+m4_include([libtool.m4/ltsugar.m4])
+m4_include([libtool.m4/ltversion.m4])
+m4_include([libtool.m4/lt~obsolete.m4])
--- bind9-9.9.5.dfsg.orig/bin/named/config.c
+++ bind9-9.9.5.dfsg/bin/named/config.c
@@ -144,6 +144,8 @@
 	lame-ttl 600;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-cache-ttl 604800; /* 1 week */\n\
+	min-ncache-ttl 0; /* 0 hours */\n\
+	min-cache-ttl 0; /* 0 seconds */\n\
 	transfer-format many-answers;\n\
 	max-cache-size 0;\n\
 	check-names master fail;\n\
@@ -160,6 +162,8 @@
 	dnssec-accept-expired no;\n\
 	clients-per-query 10;\n\
 	max-clients-per-query 100;\n\
+	max-recursion-depth 7;\n\
+	max-recursion-queries 50;\n\
 	zero-no-soa-ttl-cache no;\n\
 	nsec3-test-zone no;\n\
 	allow-new-zones no;\n\
--- bind9-9.9.5.dfsg.orig/bin/named/control.c
+++ bind9-9.9.5.dfsg/bin/named/control.c
@@ -69,7 +69,7 @@
 #endif
 
 	data = isccc_alist_lookup(message, "_data");
-	if (data == NULL) {
+	if (!isccc_alist_alistp(data)) {
 		/*
 		 * No data section.
 		 */
--- bind9-9.9.5.dfsg.orig/bin/named/controlconf.c
+++ bind9-9.9.5.dfsg/bin/named/controlconf.c
@@ -396,7 +396,7 @@
 	 * Limit exposure to replay attacks.
 	 */
 	_ctrl = isccc_alist_lookup(request, "_ctrl");
-	if (_ctrl == NULL) {
+	if (!isccc_alist_alistp(_ctrl)) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup_request;
 	}
--- bind9-9.9.5.dfsg.orig/bin/named/lwdgrbn.c
+++ bind9-9.9.5.dfsg/bin/named/lwdgrbn.c
@@ -403,14 +403,18 @@
 	INSIST(client->lookup == NULL);
 
 	dns_fixedname_init(&absname);
-	result = ns_lwsearchctx_current(&client->searchctx,
-					dns_fixedname_name(&absname));
+
 	/*
-	 * This will return failure if relative name + suffix is too long.
-	 * In this case, just go on to the next entry in the search path.
+	 * Perform search across all search domains until success
+	 * is returned. Return in case of failure.
 	 */
-	if (result != ISC_R_SUCCESS)
-		start_lookup(client);
+	while (ns_lwsearchctx_current(&client->searchctx,
+			dns_fixedname_name(&absname)) != ISC_R_SUCCESS) {
+		if (ns_lwsearchctx_next(&client->searchctx) != ISC_R_SUCCESS) {
+			ns_lwdclient_errorpktsend(client, LWRES_R_FAILURE);
+			return;
+		}
+	}
 
 	result = dns_lookup_create(cm->mctx,
 				   dns_fixedname_name(&absname),
--- bind9-9.9.5.dfsg.orig/bin/named/main.c
+++ bind9-9.9.5.dfsg/bin/named/main.c
@@ -45,6 +45,7 @@
 #include <isccc/result.h>
 
 #include <dns/dispatch.h>
+#include <dns/dynamic_db.h>
 #include <dns/name.h>
 #include <dns/result.h>
 #include <dns/view.h>
@@ -661,14 +662,6 @@
 			      ISC_LOG_INFO, "using up to %u sockets", socks);
 	}
 
-	result = isc_entropy_create(ns_g_mctx, &ns_g_entropy);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_entropy_create() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
-
 	result = isc_hash_create(ns_g_mctx, ns_g_entropy, DNS_NAME_MAXWIRE);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
@@ -684,10 +677,6 @@
 destroy_managers(void) {
 	ns_lwresd_shutdown();
 
-	isc_entropy_detach(&ns_g_entropy);
-	if (ns_g_fallbackentropy != NULL)
-		isc_entropy_detach(&ns_g_fallbackentropy);
-
 	/*
 	 * isc_taskmgr_destroy() will block until all tasks have exited,
 	 */
@@ -788,6 +777,21 @@
 	}
 #endif
 
+	result = isc_entropy_create(ns_g_mctx, &ns_g_entropy);
+	if (result != ISC_R_SUCCESS)
+		ns_main_earlyfatal("isc_entropy_create() failed: %s",
+				   isc_result_totext(result));
+
+	/*
+	 * DST may load additional libraries, which must be done before
+	 * chroot
+	 */
+	result = dst_lib_init2(ns_g_mctx, ns_g_entropy,
+			       ns_g_engine, ISC_ENTROPY_GOODONLY);
+	if (result != ISC_R_SUCCESS)
+		ns_main_earlyfatal("dst_lib_init2() failed: %s",
+				   isc_result_totext(result));
+
 #ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before ns_os_chroot().
@@ -954,6 +958,12 @@
 
 	ns_builtin_deinit();
 
+	dst_lib_destroy();
+
+	isc_entropy_detach(&ns_g_entropy);
+	if (ns_g_fallbackentropy != NULL)
+		isc_entropy_detach(&ns_g_fallbackentropy);
+
 	/*
 	 * Add calls to unregister sdb drivers here.
 	 */
--- bind9-9.9.5.dfsg.orig/bin/named/query.c
+++ bind9-9.9.5.dfsg/bin/named/query.c
@@ -3872,12 +3872,11 @@
 		peeraddr = &client->peeraddr;
 	else
 		peeraddr = NULL;
-	result = dns_resolver_createfetch2(client->view->resolver,
+	result = dns_resolver_createfetch3(client->view->resolver,
 					   qname, qtype, qdomain, nameservers,
 					   NULL, peeraddr, client->message->id,
-					   client->query.fetchoptions,
-					   client->task,
-					   query_resume, client,
+					   client->query.fetchoptions, 0, NULL,
+					   client->task, query_resume, client,
 					   rdataset, sigrdataset,
 					   &client->query.fetch);
 
@@ -5593,9 +5592,10 @@
 	dns_rpz_st_t *rpz_st;
 	isc_boolean_t resuming;
 	int line = -1;
-	isc_boolean_t dns64_exclude, dns64;
+	isc_boolean_t dns64_exclude, dns64, rpz;
 	dns_clientinfomethods_t cm;
 	dns_clientinfo_t ci;
+	dns_name_t *rpzqname;
 
 	CTRACE("query_find");
 
@@ -5621,7 +5621,7 @@
 	zone = NULL;
 	need_wildcardproof = ISC_FALSE;
 	empty_wild = ISC_FALSE;
-	dns64_exclude = dns64 = ISC_FALSE;
+	dns64_exclude = dns64 = rpz = ISC_FALSE;
 	options = 0;
 	resuming = ISC_FALSE;
 	is_zone = ISC_FALSE;
@@ -5738,6 +5738,7 @@
 	authoritative = ISC_FALSE;
 	version = NULL;
 	need_wildcardproof = ISC_FALSE;
+	rpz = ISC_FALSE;
 
 	if (client->view->checknames &&
 	    !dns_rdata_checkowner(client->query.qname,
@@ -5862,11 +5863,29 @@
 	}
 
 	/*
-	 * Now look for an answer in the database.
+	 * Now look for an answer in the database.  If this is a dns64
+	 * AAAA lookup on a rpz database adjust the qname.
 	 */
-	result = dns_db_findext(db, client->query.qname, version, type,
+	if (dns64 && rpz)
+		rpzqname = client->query.rpz_st->qname;
+	else
+		rpzqname = client->query.qname;
+
+	result = dns_db_findext(db, rpzqname, version, type,
 				client->query.dboptions, client->now,
 				&node, fname, &cm, &ci, rdataset, sigrdataset);
+	/*
+	 * Fixup fname and sigrdataset.
+	 */
+	if (dns64 && rpz) {
+		isc_result_t rresult;
+
+		rresult = dns_name_copy(client->query.qname, fname, NULL);
+		RUNTIME_CHECK(rresult == ISC_R_SUCCESS);
+		if (sigrdataset != NULL &&
+		    dns_rdataset_isassociated(sigrdataset))
+			dns_rdataset_disassociate(sigrdataset);
+	}
 
  resume:
 	CTRACE("query_find: resume");
@@ -6069,9 +6088,11 @@
 			switch (rpz_st->m.policy) {
 			case DNS_RPZ_POLICY_NXDOMAIN:
 				result = DNS_R_NXDOMAIN;
+				rpz = ISC_TRUE;
 				break;
 			case DNS_RPZ_POLICY_NODATA:
 				result = DNS_R_NXRRSET;
+				rpz = ISC_TRUE;
 				break;
 			case DNS_RPZ_POLICY_RECORD:
 				result = rpz_st->m.result;
@@ -6091,6 +6112,7 @@
 					rdataset->ttl = ISC_MIN(rdataset->ttl,
 							    rpz_st->m.ttl);
 				}
+				rpz = ISC_TRUE;
 				break;
 			case DNS_RPZ_POLICY_WILDCNAME:
 				result = dns_rdataset_first(rdataset);
@@ -6132,7 +6154,6 @@
 			client->attributes &= ~(NS_CLIENTATTR_WANTDNSSEC |
 						DNS_MESSAGEFLAG_AD);
 			query_putrdataset(client, &sigrdataset);
-			rpz_st->q.is_zone = is_zone;
 			is_zone = ISC_TRUE;
 			rpz_log_rewrite(client, ISC_FALSE, rpz_st->m.policy,
 					rpz_st->m.type, zone, rpz_st->qname);
@@ -6511,15 +6532,6 @@
 			rdataset = NULL;
 			sigrdataset = NULL;
 			type = qtype = dns_rdatatype_a;
-			rpz_st = client->query.rpz_st;
-			if (rpz_st != NULL) {
-				/*
-				 * Arrange for RPZ rewriting of any A records.
-				 */
-				if ((rpz_st->state & DNS_RPZ_REWRITTEN) != 0)
-					is_zone = rpz_st->q.is_zone;
-				rpz_st_clear(client);
-			}
 			dns64 = ISC_TRUE;
 			goto db_find;
 		}
@@ -6788,15 +6800,6 @@
 			sigrdataset = NULL;
 			fname = NULL;
 			type = qtype = dns_rdatatype_a;
-			rpz_st = client->query.rpz_st;
-			if (rpz_st != NULL) {
-				/*
-				 * Arrange for RPZ rewriting of any A records.
-				 */
-				if ((rpz_st->state & DNS_RPZ_REWRITTEN) != 0)
-					is_zone = rpz_st->q.is_zone;
-				rpz_st_clear(client);
-			}
 			dns64 = ISC_TRUE;
 			goto db_find;
 		}
@@ -7298,15 +7301,6 @@
 			rdataset = NULL;
 			sigrdataset = NULL;
 			type = qtype = dns_rdatatype_a;
-			rpz_st = client->query.rpz_st;
-			if (rpz_st != NULL) {
-				/*
-				 * Arrange for RPZ rewriting of any A records.
-				 */
-				if ((rpz_st->state & DNS_RPZ_REWRITTEN) != 0)
-					is_zone = rpz_st->q.is_zone;
-				rpz_st_clear(client);
-			}
 			dns64_exclude = dns64 = ISC_TRUE;
 			goto db_find;
 		}
@@ -7331,6 +7325,7 @@
 			result = query_dns64(client, &fname, rdataset,
 					     sigrdataset, dbuf,
 					     DNS_SECTION_ANSWER);
+			noqname = NULL;
 			dns_rdataset_disassociate(rdataset);
 			dns_message_puttemprdataset(client->message, &rdataset);
 			if (result == ISC_R_NOMORE) {
--- bind9-9.9.5.dfsg.orig/bin/named/server.c
+++ bind9-9.9.5.dfsg/bin/named/server.c
@@ -63,6 +63,7 @@
 #include <dns/db.h>
 #include <dns/dispatch.h>
 #include <dns/dlz.h>
+#include <dns/dynamic_db.h>
 #include <dns/dns64.h>
 #include <dns/forward.h>
 #include <dns/journal.h>
@@ -1090,6 +1091,8 @@
 		mode = DNS_RDATASETATTR_FIXEDORDER;
 	else if (!strcasecmp(str, "random"))
 		mode = DNS_RDATASETATTR_RANDOMIZE;
+	else if (!strcasecmp(str, "random_1"))
+		mode = DNS_RDATASETATTR_RANDOMIZE|DNS_RDATASETATTR_SINGLE;
 	else if (!strcasecmp(str, "cyclic"))
 		mode = 0;
 	else
@@ -1249,6 +1252,72 @@
 }
 
 static isc_result_t
+configure_dynamic_db(const cfg_obj_t *dynamic_db, isc_mem_t *mctx,
+		     const dns_dyndb_arguments_t *dyndb_args)
+{
+	isc_result_t result;
+	const cfg_obj_t *obj;
+	const cfg_obj_t *options;
+	const cfg_listelt_t *element;
+	const char *name;
+	const char *libname;
+	const char **argv = NULL;
+	unsigned int i;
+	unsigned int len;
+
+	/* Get the name of the database. */
+	obj = cfg_tuple_get(dynamic_db, "name");
+	name = cfg_obj_asstring(obj);
+
+	/* Get options. */
+	options = cfg_tuple_get(dynamic_db, "options");
+
+	/* Get library name. */
+	obj = NULL;
+	CHECK(cfg_map_get(options, "library", &obj));
+	libname = cfg_obj_asstring(obj);
+
+	/* Create a list of arguments. */
+	obj = NULL;
+	result = cfg_map_get(options, "arg", &obj);
+	if (result == ISC_R_NOTFOUND)
+		len = 0;
+	else if (result == ISC_R_SUCCESS)
+		len = cfg_list_length(obj, isc_boolean_false);
+	else
+		goto cleanup;
+
+	/* Account for the last terminating NULL. */
+	len++;
+
+	argv = isc_mem_allocate(mctx, len * sizeof(const char *));
+	if (argv == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
+	for (element = cfg_list_first(obj), i = 0;
+	     element != NULL;
+	     element = cfg_list_next(element), i++)
+	{
+		REQUIRE(i < len);
+
+		obj = cfg_listelt_value(element);
+		argv[i] = cfg_obj_asstring(obj);
+	}
+	REQUIRE(i < len);
+	argv[i] = NULL;
+
+	CHECK(dns_dynamic_db_load(libname, name, mctx, argv, dyndb_args));
+
+cleanup:
+	if (argv != NULL)
+		isc_mem_free(mctx, argv);
+
+	return result;
+}
+
+
+static isc_result_t
 disable_algorithms(const cfg_obj_t *disabled, dns_resolver_t *resolver) {
 	isc_result_t result;
 	const cfg_obj_t *algorithms;
@@ -2071,6 +2140,7 @@
 	const cfg_obj_t *dlz;
 	unsigned int dlzargc;
 	char **dlzargv;
+	const cfg_obj_t *dynamic_db_list;
 	const cfg_obj_t *disabled;
 	const cfg_obj_t *obj;
 	const cfg_listelt_t *element;
@@ -2541,6 +2611,18 @@
 	if (view->maxncachettl > 7 * 24 * 3600)
 		view->maxncachettl = 7 * 24 * 3600;
 
+	obj = NULL;
+	result = ns_config_get(maps, "min-cache-ttl", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->mincachettl = cfg_obj_asuint32(obj);
+
+	obj = NULL;
+	result = ns_config_get(maps, "min-ncache-ttl", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->minncachettl = cfg_obj_asuint32(obj);
+	if (view->minncachettl > 7 * 24 * 3600)
+		view->minncachettl = 7 * 24 * 3600;
+
 	/*
 	 * Configure the view's cache.
 	 *
@@ -3141,6 +3223,16 @@
 					cfg_obj_asuint32(obj),
 					max_clients_per_query);
 
+	obj = NULL;
+	result = ns_config_get(maps, "max-recursion-depth", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_resolver_setmaxdepth(view->resolver, cfg_obj_asuint32(obj));
+
+	obj = NULL;
+	result = ns_config_get(maps, "max-recursion-queries", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	dns_resolver_setmaxqueries(view->resolver, cfg_obj_asuint32(obj));
+
 #ifdef ALLOW_FILTER_AAAA_ON_V4
 	obj = NULL;
 	result = ns_config_get(maps, "filter-aaaa-on-v4", &obj);
@@ -3264,6 +3356,37 @@
 		dns_view_setrootdelonly(view, ISC_FALSE);
 
 	/*
+	 * Configure dynamic databases.
+	 */
+	dynamic_db_list = NULL;
+	if (voptions != NULL)
+		(void)cfg_map_get(voptions, "dynamic-db", &dynamic_db_list);
+	else
+		(void)cfg_map_get(config, "dynamic-db", &dynamic_db_list);
+	element = cfg_list_first(dynamic_db_list);
+	if (element != NULL) {
+		dns_dyndb_arguments_t *args;
+
+		args = dns_dyndb_arguments_create(mctx);
+		if (args == NULL) {
+			result = ISC_R_NOMEMORY;
+			goto cleanup;
+		}
+		dns_dyndb_set_view(args, view);
+		dns_dyndb_set_zonemgr(args, ns_g_server->zonemgr);
+		dns_dyndb_set_task(args, ns_g_server->task);
+		dns_dyndb_set_timermgr(args, ns_g_timermgr);
+		while (element != NULL) {
+			obj = cfg_listelt_value(element);
+			CHECK(configure_dynamic_db(obj, mctx, args));
+		
+			element = cfg_list_next(element);
+		}
+
+		dns_dyndb_arguments_destroy(mctx, args);
+	}
+
+	/*
 	 * Setup automatic empty zones.  If recursion is off then
 	 * they are disabled by default.
 	 */
@@ -4917,6 +5040,7 @@
 		cfg_aclconfctx_detach(&ns_g_aclconfctx);
 	CHECK(cfg_aclconfctx_create(ns_g_mctx, &ns_g_aclconfctx));
 
+	dns_dynamic_db_cleanup(ISC_FALSE);
 	/*
 	 * Parse the global default pseudo-config file.
 	 */
@@ -6046,6 +6170,8 @@
 			dns_view_detach(&view);
 	}
 
+	dns_dynamic_db_cleanup(ISC_TRUE);
+
 	while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
 		ISC_LIST_UNLINK(server->cachelist, nsc, link);
 		dns_cache_detach(&nsc->cache);
@@ -6126,10 +6252,6 @@
 		   ISC_R_NOMEMORY : ISC_R_SUCCESS,
 		   "allocating reload event");
 
-	CHECKFATAL(dst_lib_init2(ns_g_mctx, ns_g_entropy,
-				 ns_g_engine, ISC_ENTROPY_GOODONLY),
-		   "initializing DST");
-
 	server->tkeyctx = NULL;
 	CHECKFATAL(dns_tkeyctx_create(ns_g_mctx, ns_g_entropy,
 				      &server->tkeyctx),
@@ -6276,8 +6398,6 @@
 	if (server->tkeyctx != NULL)
 		dns_tkeyctx_destroy(&server->tkeyctx);
 
-	dst_lib_destroy();
-
 	isc_event_free(&server->reload_event);
 
 	INSIST(ISC_LIST_EMPTY(server->viewlist));
--- bind9-9.9.5.dfsg.orig/bin/rndc/rndc.c
+++ bind9-9.9.5.dfsg/bin/rndc/rndc.c
@@ -252,8 +252,8 @@
 	DO("parse message", isccc_cc_fromwire(&source, &response, &secret));
 
 	data = isccc_alist_lookup(response, "_data");
-	if (data == NULL)
-		fatal("no data section in response");
+	if (!isccc_alist_alistp(data))
+		fatal("bad or missing data section in response");
 	result = isccc_cc_lookupstring(data, "err", &errormsg);
 	if (result == ISC_R_SUCCESS) {
 		failed = ISC_TRUE;
@@ -316,8 +316,8 @@
 	DO("parse message", isccc_cc_fromwire(&source, &response, &secret));
 
 	_ctrl = isccc_alist_lookup(response, "_ctrl");
-	if (_ctrl == NULL)
-		fatal("_ctrl section missing");
+	if (!isccc_alist_alistp(_ctrl))
+		fatal("bad or missing ctrl section in response");
 	nonce = 0;
 	if (isccc_cc_lookupuint32(_ctrl, "_nonce", &nonce) != ISC_R_SUCCESS)
 		nonce = 0;
--- bind9-9.9.5.dfsg.orig/bin/tests/named.conf
+++ bind9-9.9.5.dfsg/bin/tests/named.conf
@@ -54,6 +54,7 @@
 	memstatistics-file "named.memstats";	// _PATH_MEMSTATS
 
 	max-cache-ttl 999;
+	min-cache-ttl 666;
 	auth-nxdomain yes;		// always set AA on NXDOMAIN.
 					// don't set this to 'no' unless
 					// you know what you're doing -- older
@@ -155,6 +156,7 @@
 	min-refresh-time 777;
  
 	max-ncache-ttl 333;
+	min-ncache-ttl 222;
 	min-roots 15;
 	serial-queries 34;
 
--- bind9-9.9.5.dfsg.orig/bin/tests/system/dname/ns2/example.db
+++ bind9-9.9.5.dfsg/bin/tests/system/dname/ns2/example.db
@@ -29,4 +29,7 @@
 short-dname		DNAME	short
 a.longlonglonglonglonglonglonglonglonglonglonglonglong	A 10.0.0.2
 long-dname		DNAME	longlonglonglonglonglonglonglonglonglonglonglonglong
-;
+toolong-dname		DNAME	longlonglonglonglonglonglonglonglonglonglonglonglong
+cname			CNAME	a.cnamedname
+cnamedname		DNAME	target
+a.target		A	10.0.0.3
--- bind9-9.9.5.dfsg.orig/bin/tests/system/dname/tests.sh
+++ bind9-9.9.5.dfsg/bin/tests/system/dname/tests.sh
@@ -56,10 +56,37 @@
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
-echo "I:checking (too) long dname from recursive"
+echo "I:checking (too) long dname from recursive with cached DNAME"
+ret=0 
+$DIG 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.long-dname.example @10.53.0.4 a -p 5300 > dig.out.ns4.cachedtoolong || ret=1
+grep "status: YXDOMAIN" dig.out.ns4.cachedtoolong > /dev/null || ret=1
+grep '^long-dname\.example\..*DNAME.*long' dig.out.ns4.cachedtoolong > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking (too) long dname from recursive without cached DNAME"
+ret=0
+$DIG 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglong.toolong-dname.example @10.53.0.4 a -p 5300 > dig.out.ns4.uncachedtoolong || ret=1
+grep "status: YXDOMAIN" dig.out.ns4.uncachedtoolong > /dev/null || ret=1
+grep '^toolong-dname\.example\..*DNAME.*long' dig.out.ns4.uncachedtoolong > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking cname to dname from authoritative"
+ret=0
+$DIG cname.example @10.53.0.2 a -p 5300 > dig.out.ns2.cname
+grep "status: NOERROR" dig.out.ns2.cname > /dev/null || ret=1
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking cname to dname from recursive"
 ret=0
-$DIG 01234567890123456789012345678901234567890123456789.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.longlonglonglonglonglonglonglonglonglonglonglonglonglonglong.long-dname.example @10.53.0.4 a -p 5300 > dig.out.ns4.toolong || ret=1
-grep "status: YXDOMAIN" dig.out.ns4.toolong > /dev/null || ret=1
+$DIG cname.example @10.53.0.4 a -p 5300 > dig.out.ns4.cname
+grep "status: NOERROR" dig.out.ns4.cname > /dev/null || ret=1
+grep '^cname.example.' dig.out.ns4.cname > /dev/null || ret=1
+grep '^cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
+grep '^a.cnamedname.example.' dig.out.ns4.cname > /dev/null || ret=1
+grep '^a.target.example.' dig.out.ns4.cname > /dev/null || ret=1
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
--- bind9-9.9.5.dfsg.orig/bin/tests/system/lwresd/lwtest.c
+++ bind9-9.9.5.dfsg/bin/tests/system/lwresd/lwtest.c
@@ -767,6 +767,14 @@
 	test_getrrsetbyname("e.example1.", 1, 46, 2, 0, 1);
 	test_getrrsetbyname("", 1, 1, 0, 0, 0);
 
+	test_getrrsetbyname("123456789.123456789.123456789.123456789."
+			    "123456789.123456789.123456789.123456789."
+			    "123456789.123456789.123456789.123456789."
+			    "123456789.123456789.123456789.123456789."
+			    "123456789.123456789.123456789.123456789."
+			    "123456789.123456789.123456789.123456789."
+			    "123456789", 1, 1, 0, 0, 0);
+
 	if (fails == 0)
 		printf("I:ok\n");
 	return (fails);
--- bind9-9.9.5.dfsg.orig/bin/tests/system/rndc/tests.sh
+++ bind9-9.9.5.dfsg/bin/tests/system/rndc/tests.sh
@@ -245,5 +245,13 @@
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I:check 'rndc \"\"' is handled ($n)"
+ret=0
+$RNDCCMD "" > rndc.out.test$n 2>&1 && ret=1
+grep "rndc: '' failed: failure" rndc.out.test$n > /dev/null
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status
--- bind9-9.9.5.dfsg.orig/bind9-resolvconf.service
+++ bind9-9.9.5.dfsg/bind9-resolvconf.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=local BIND via resolvconf
+Documentation=man:named(8) man:resolvconf(8)
+Requires=bind9.service
+After=bind9.service
+ConditionFileIsExecutable=/sbin/resolvconf
+
+[Service]
+ExecStart=/bin/sh -c 'echo nameserver 127.0.0.1 | /sbin/resolvconf -a lo.named'
+ExecStop=/sbin/resolvconf -d lo.named
+
+[Install]
+WantedBy=bind9.service
--- bind9-9.9.5.dfsg.orig/bind9.service
+++ bind9-9.9.5.dfsg/bind9.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=BIND Domain Name Server
+Documentation=man:named(8)
+After=network.target
+
+[Service]
+ExecStart=/usr/sbin/named -f -u bind
+ExecReload=/usr/sbin/rndc reload
+ExecStop=/usr/sbin/rndc stop
+
+[Install]
+WantedBy=multi-user.target
--- bind9-9.9.5.dfsg.orig/bind9.tmpfile
+++ bind9-9.9.5.dfsg/bind9.tmpfile
@@ -0,0 +1 @@
+d /run/named 0775 root bind - -
--- bind9-9.9.5.dfsg.orig/config.h.in
+++ bind9-9.9.5.dfsg/config.h.in
@@ -184,6 +184,9 @@
    MSVC and with C++ compilers. */
 #undef FLEXIBLE_ARRAY_MEMBER
 
+/* Defined if GeoIP supports IPv6 lookups */
+#undef GEOIP_V6
+
 /* Define to 1 if you have the `chroot' function. */
 #undef HAVE_CHROOT
 
@@ -439,6 +442,9 @@
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
+/* Define if you want GeoIP support. */
+#undef SUPPORT_GEOIP
+
 /* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
 #undef TIME_WITH_SYS_TIME
 
--- bind9-9.9.5.dfsg.orig/configure
+++ bind9-9.9.5.dfsg/configure
@@ -824,6 +824,7 @@
 OPENSSLGOSTLINKOBJS
 DST_OPENSSL_INC
 USE_OPENSSL
+GEOIP_LIBS
 LWRES_PLATFORM_NEEDSYSSELECTH
 ISC_PLATFORM_NEEDSYSSELECTH
 ISC_PLATFORM_HAVEDEVPOLL
@@ -961,6 +962,7 @@
 enable_openssl_version_check
 with_ecdsa
 with_gost
+with_geoip
 enable_openssl_hash
 with_pkcs11
 with_gssapi
@@ -1675,6 +1677,7 @@
 			  (Required for DNSSEC)
   --with-ecdsa            OpenSSL ECDSA
   --with-gost             OpenSSL GOST
+  --with-geoip=PATH   Specify path for system-supplied GeoIP
   --with-pkcs11=PATH      Build with PKCS11 support yes|no|path
                           (PATH is for the PKCS11 provider)
   --with-gssapi=PATH      Specify path for system-supplied GSSAPI [default=yes]
@@ -4494,7 +4497,8 @@
     ;;
   *)
     lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null`
-    if test -n "$lt_cv_sys_max_cmd_len"; then
+    if test -n "$lt_cv_sys_max_cmd_len" && \
+	test undefined != "$lt_cv_sys_max_cmd_len"; then
       lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4`
       lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3`
     else
@@ -4895,10 +4899,6 @@
   fi
   ;;
 
-gnu*)
-  lt_cv_deplibs_check_method=pass_all
-  ;;
-
 haiku*)
   lt_cv_deplibs_check_method=pass_all
   ;;
@@ -4937,11 +4937,11 @@
   ;;
 
 # This must be glibc/ELF.
-linux* | k*bsd*-gnu | kopensolaris*-gnu)
+linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd*)
+netbsd* | netbsdelf*-gnu)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|_pic\.a)$'
   else
@@ -6061,7 +6061,7 @@
   rm -rf conftest*
   ;;
 
-x86_64-*kfreebsd*-gnu|x86_64-*linux*|ppc*-*linux*|powerpc*-*linux*| \
+x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \
 s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
   # Find out which ABI we are using.
   echo 'int i;' > conftest.$ac_ext
@@ -6077,9 +6077,19 @@
 	    LD="${LD-ld} -m elf_i386_fbsd"
 	    ;;
 	  x86_64-*linux*)
-	    LD="${LD-ld} -m elf_i386"
+	    case `/usr/bin/file conftest.o` in
+	      *x86-64*)
+		LD="${LD-ld} -m elf32_x86_64"
+		;;
+	      *)
+		LD="${LD-ld} -m elf_i386"
+		;;
+	    esac
+	    ;;
+	  powerpc64le-*)
+	    LD="${LD-ld} -m elf32lppclinux"
 	    ;;
-	  ppc64-*linux*|powerpc64-*linux*)
+	  powerpc64-*)
 	    LD="${LD-ld} -m elf32ppclinux"
 	    ;;
 	  s390x-*linux*)
@@ -6098,7 +6108,10 @@
 	  x86_64-*linux*)
 	    LD="${LD-ld} -m elf_x86_64"
 	    ;;
-	  ppc*-*linux*|powerpc*-*linux*)
+	  powerpcle-*)
+	    LD="${LD-ld} -m elf64lppc"
+	    ;;
+	  powerpc-*)
 	    LD="${LD-ld} -m elf64ppc"
 	    ;;
 	  s390*-*linux*|s390*-*tpf*)
@@ -7906,7 +7919,7 @@
       lt_prog_compiler_static='-non_shared'
       ;;
 
-    linux* | k*bsd*-gnu | kopensolaris*-gnu)
+    linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
       case $cc_basename in
       # old Intel for x86_64 which still supported -KPIC.
       ecc*)
@@ -8384,6 +8397,9 @@
   openbsd*)
     with_gnu_ld=no
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    link_all_deplibs=no
+    ;;
   esac
 
   ld_shlibs=yes
@@ -8605,7 +8621,7 @@
       fi
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -8782,6 +8798,7 @@
 	if test "$aix_use_runtimelinking" = yes; then
 	  shared_flag="$shared_flag "'${wl}-G'
 	fi
+	link_all_deplibs=no
       else
 	# not using gcc
 	if test "$host_cpu" = ia64; then
@@ -9235,7 +9252,7 @@
       link_all_deplibs=yes
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	archive_cmds='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -10072,17 +10089,6 @@
   esac
   ;;
 
-gnu*)
-  version_type=linux # correct to gnu/linux during the next big refactor
-  need_lib_prefix=no
-  need_version=no
-  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}${major} ${libname}${shared_ext}'
-  soname_spec='${libname}${release}${shared_ext}$major'
-  shlibpath_var=LD_LIBRARY_PATH
-  shlibpath_overrides_runpath=no
-  hardcode_into_libs=yes
-  ;;
-
 haiku*)
   version_type=linux # correct to gnu/linux during the next big refactor
   need_lib_prefix=no
@@ -10199,7 +10205,7 @@
   ;;
 
 # This must be glibc/ELF.
-linux* | k*bsd*-gnu | kopensolaris*-gnu)
+linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   version_type=linux # correct to gnu/linux during the next big refactor
   need_lib_prefix=no
   need_version=no
@@ -10263,6 +10269,18 @@
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -12420,7 +12438,7 @@
 	# as it breaks how the two halves (Basic and Advanced) of the IPv6
 	# Socket API were designed to be used but we have to live with it.
 	# Define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
-	*-linux* | *-kfreebsd*-gnu)
+	*-linux*|*-gnu*)
 		STD_CDEFINES="$STD_CDEFINES -D_GNU_SOURCE"
 		CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
 		;;
@@ -13927,6 +13945,147 @@
 esac
 
 #
+# Check for GeoIP - if yes enable it
+#
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for GeoIP library" >&5
+$as_echo_n "checking for GeoIP library... " >&6; }
+
+# Check whether --with-geoip was given.
+if test "${with_geoip+set}" = set; then :
+  withval=$with_geoip; use_geoip="$withval"
+else
+  use_geoip="no"
+fi
+
+
+#geoipdirs="/usr/local /usr/pkg /usr/kerberos /usr"
+#
+#if test "$use_geoip" = "yes"
+#then
+#	for d in $geoipdirs
+#	do
+#		if test -f $d/include/include/GeoIP.h -o -f $d/include/GeoIP.h
+#		then
+#			use_geoip=$d
+#			break
+#		fi
+#	done
+#fi
+
+
+$as_echo "#define GEOIP_V6 1" >>confdefs.h
+
+case "$use_geoip" in
+	no)
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled" >&5
+$as_echo "disabled" >&6; }
+		USE_GEOIP=''
+		;;
+#	yes)
+#		AC_MSG_ERROR([--with-geoip must specify a path])
+#		;;
+	*)
+		ac_fn_c_check_header_mongrel "$LINENO" "GeoIP.h" "ac_cv_header_GeoIP_h" "$ac_includes_default"
+if test "x$ac_cv_header_GeoIP_h" = xyes; then :
+
+else
+  as_fn_error $? "GeoIP library header files not found" "$LINENO" 5
+
+fi
+
+
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for GeoIP_open in -lGeoIP" >&5
+$as_echo_n "checking for GeoIP_open in -lGeoIP... " >&6; }
+if ${ac_cv_lib_GeoIP_GeoIP_open+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_check_lib_save_LIBS=$LIBS
+LIBS="-lGeoIP  $LIBS"
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char GeoIP_open ();
+int
+main ()
+{
+return GeoIP_open ();
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_lib_GeoIP_GeoIP_open=yes
+else
+  ac_cv_lib_GeoIP_GeoIP_open=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+LIBS=$ac_check_lib_save_LIBS
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_GeoIP_GeoIP_open" >&5
+$as_echo "$ac_cv_lib_GeoIP_GeoIP_open" >&6; }
+if test "x$ac_cv_lib_GeoIP_GeoIP_open" = xyes; then :
+
+
+$as_echo "#define SUPPORT_GEOIP 1" >>confdefs.h
+
+
+else
+
+				as_fn_error $? "GeoIP library header files were found but the library was not found" "$LINENO" 5
+
+fi
+
+		GEOIP_LIBS="-lGeoIP"
+                { $as_echo "$as_me:${as_lineno-$LINENO}: checking for for GeoIP IPv6 support" >&5
+$as_echo_n "checking for for GeoIP IPv6 support... " >&6; }
+                cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+#include <GeoIP.h>
+#include <netinet/in.h>
+
+int
+main ()
+{
+
+
+extern const struct in6_addr in6addr_loopback;
+static GeoIP *geoip = NULL;
+
+const char* value = value = GeoIP_country_name_by_ipnum_v6(geoip, (geoipv6_t)in6addr_loopback);
+
+
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+		GEOIP_V6="#define GEOIP_V6 1"
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+		GEOIP_V6="#undef GEOIP_V6"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+$as_echo "#define GEOIP_V6 1" >>confdefs.h
+
+		;;
+esac
+
+
+
+#
 # This would include the system openssl path (and linker options to use
 # it as needed) if it is found.
 #
@@ -15275,7 +15434,7 @@
 		# LinuxThreads requires some changes to the way we
 		# deal with signals.
 		#
-		*-linux*)
+		*-linux*|*-kfreebsd*-gnu)
 			$as_echo "#define HAVE_LINUXTHREADS 1" >>confdefs.h
 
 			;;
@@ -19334,7 +19493,7 @@
 
 if test "$dlopen" = "yes"; then
 	case $host in
-		*-linux*)
+		*-linux*|*-gnu)
 			SO_CFLAGS="-fPIC"
 			if test "$have_dl" = "yes"
 			then
--- bind9-9.9.5.dfsg.orig/configure.in
+++ bind9-9.9.5.dfsg/configure.in
@@ -352,7 +352,7 @@
 	# as it breaks how the two halves (Basic and Advanced) of the IPv6
 	# Socket API were designed to be used but we have to live with it.
 	# Define _GNU_SOURCE to pull in the IPv6 Advanced Socket API.
-	*-linux* | *-kfreebsd*-gnu)
+	*-linux*|*-gnu*)
 		STD_CDEFINES="$STD_CDEFINES -D_GNU_SOURCE"
 		CPPFLAGS="$CPPFLAGS -D_GNU_SOURCE"
 		;;
@@ -934,6 +934,74 @@
 esac
 
 #
+# Check for GeoIP - if yes enable it
+#
+
+AC_MSG_CHECKING(for GeoIP library)
+AC_ARG_WITH(geoip,
+[  --with-geoip=PATH   Specify path for system-supplied GeoIP],
+    use_geoip="$withval", use_geoip="no")
+
+#geoipdirs="/usr/local /usr/pkg /usr/kerberos /usr"
+#
+#if test "$use_geoip" = "yes"
+#then
+#	for d in $geoipdirs
+#	do
+#		if test -f $d/include/include/GeoIP.h -o -f $d/include/GeoIP.h
+#		then
+#			use_geoip=$d
+#			break
+#		fi
+#	done
+#fi
+
+AC_DEFINE([GEOIP_V6], [1], [Defined if GeoIP supports IPv6 lookups])
+case "$use_geoip" in
+	no)
+		AC_MSG_RESULT(disabled)
+		USE_GEOIP=''
+		;;
+#	yes)
+#		AC_MSG_ERROR([--with-geoip must specify a path])
+#		;;
+	*)
+		AC_CHECK_HEADER(GeoIP.h,,
+					[AC_MSG_ERROR([GeoIP library header files not found])]
+				)
+		AC_CHECK_LIB(GeoIP, GeoIP_open,
+			[
+				AC_DEFINE(SUPPORT_GEOIP, 1, Define if you want GeoIP support.)
+			],
+			[
+				AC_MSG_ERROR([GeoIP library header files were found but the library was not found])
+			])
+		GEOIP_LIBS="-lGeoIP"
+                AC_MSG_CHECKING(for for GeoIP IPv6 support)
+                AC_TRY_COMPILE([
+#include <GeoIP.h>
+#include <netinet/in.h>
+],
+[
+
+extern const struct in6_addr in6addr_loopback;
+static GeoIP *geoip = NULL;
+
+const char* value = value = GeoIP_country_name_by_ipnum_v6(geoip, (geoipv6_t)in6addr_loopback);
+
+]
+,
+	[AC_MSG_RESULT(yes)
+		GEOIP_V6="#define GEOIP_V6 1"],
+	[AC_MSG_RESULT(no)
+		GEOIP_V6="#undef GEOIP_V6"])
+AC_DEFINE(GEOIP_V6)
+		;;
+esac
+
+AC_SUBST(GEOIP_LIBS)
+
+#
 # This would include the system openssl path (and linker options to use
 # it as needed) if it is found.
 #
@@ -1365,7 +1433,7 @@
 		# LinuxThreads requires some changes to the way we
 		# deal with signals.
 		#
-		*-linux*)
+		*-linux*|*-kfreebsd*-gnu)
 			AC_DEFINE(HAVE_LINUXTHREADS)
 			;;
 		#
@@ -1587,7 +1655,6 @@
 		;;
 	*)
 		AC_CHECK_LIB(socket, socket)
-		AC_CHECK_LIB(nsl, inet_addr)
 		;;
 esac
 
@@ -3500,7 +3567,7 @@
 
 if test "$dlopen" = "yes"; then
 	case $host in
-		*-linux*)
+		*-linux*|*-gnu*)
 			SO_CFLAGS="-fPIC"
 			if test "$have_dl" = "yes"
 			then
--- bind9-9.9.5.dfsg.orig/contrib/idn/idnkit-1.0-src/config.guess
+++ bind9-9.9.5.dfsg/contrib/idn/idnkit-1.0-src/config.guess
@@ -1,13 +1,12 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-#   Free Software Foundation, Inc.
+#   Copyright 1992-2013 Free Software Foundation, Inc.
 
-timestamp='2001-09-04'
+timestamp='2013-11-29'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
+# the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
 # This program is distributed in the hope that it will be useful, but
@@ -16,23 +15,22 @@
 # General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
 #
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
-
-# Written by Per Bothner <bothner@cygnus.com>.
-# Please send patches to <config-patches@gnu.org>.
+# the same distribution terms that you use for the rest of that
+# program.  This Exception is an additional permission under section 7
+# of the GNU General Public License, version 3 ("GPLv3").
+#
+# Originally written by Per Bothner.
 #
-# This script attempts to guess a canonical system name similar to
-# config.sub.  If it succeeds, it prints the system name on stdout, and
-# exits with 0.  Otherwise, it exits with 1.
+# You can get the latest version of this script from:
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
 #
-# The plan is that this can be called by configure scripts if you
-# don't specify an explicit build system type.
+# Please send patches with a ChangeLog entry to config-patches@gnu.org.
+
 
 me=`echo "$0" | sed -e 's,.*/,,'`
 
@@ -52,8 +50,7 @@
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -65,11 +62,11 @@
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - )	# Use stdin as input.
@@ -87,30 +84,42 @@
   exit 1
 fi
 
+trap 'exit 1' 1 2 15
 
-dummy=dummy-$$
-trap 'rm -f $dummy.c $dummy.o $dummy.rel $dummy; exit 1' 1 2 15
+# CC_FOR_BUILD -- compiler used by this script. Note that the use of a
+# compiler to aid in system detection is discouraged as it requires
+# temporary files to be created and, as you can see below, it is a
+# headache to deal with in a portable fashion.
 
-# CC_FOR_BUILD -- compiler used by this script.
 # Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still
 # use `HOST_CC' if defined, but it is deprecated.
 
-set_cc_for_build='case $CC_FOR_BUILD,$HOST_CC,$CC in
- ,,)    echo "int dummy(){}" > $dummy.c ;
-	for c in cc gcc c89 ; do
-	  ($c $dummy.c -c -o $dummy.o) >/dev/null 2>&1 ;
-	  if test $? = 0 ; then
+# Portable tmp directory creation inspired by the Autoconf team.
+
+set_cc_for_build='
+trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null) && exit \$exitcode" 0 ;
+trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 2 13 15 ;
+: ${TMPDIR=/tmp} ;
+ { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && test -n "$tmp" && test -d "$tmp" ; } ||
+ { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && mkdir $tmp) ; } ||
+ { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: creating insecure temp directory" >&2 ; } ||
+ { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; exit 1 ; } ;
+dummy=$tmp/dummy ;
+tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ;
+case $CC_FOR_BUILD,$HOST_CC,$CC in
+ ,,)    echo "int x;" > $dummy.c ;
+	for c in cc gcc c89 c99 ; do
+	  if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then
 	     CC_FOR_BUILD="$c"; break ;
 	  fi ;
 	done ;
-	rm -f $dummy.c $dummy.o $dummy.rel ;
 	if test x"$CC_FOR_BUILD" = x ; then
 	  CC_FOR_BUILD=no_compiler_found ;
 	fi
 	;;
  ,,*)   CC_FOR_BUILD=$CC ;;
  ,*,*)  CC_FOR_BUILD=$HOST_CC ;;
-esac'
+esac ; set_cc_for_build= ;'
 
 # This is needed to find uname on a Pyramid OSx when run in the BSD universe.
 # (ghazi@noc.rutgers.edu 1994-08-24)
@@ -123,36 +132,59 @@
 UNAME_SYSTEM=`(uname -s) 2>/dev/null`  || UNAME_SYSTEM=unknown
 UNAME_VERSION=`(uname -v) 2>/dev/null` || UNAME_VERSION=unknown
 
+case "${UNAME_SYSTEM}" in
+Linux|GNU|GNU/*)
+	# If the system lacks a compiler, then just pick glibc.
+	# We could probably try harder.
+	LIBC=gnu
+
+	eval $set_cc_for_build
+	cat <<-EOF > $dummy.c
+	#include <features.h>
+	#if defined(__UCLIBC__)
+	LIBC=uclibc
+	#elif defined(__dietlibc__)
+	LIBC=dietlibc
+	#else
+	LIBC=gnu
+	#endif
+	EOF
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+	;;
+esac
+
 # Note: order is significant - the case branches are not exclusive.
 
 case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     *:NetBSD:*:*)
-	# Netbsd (nbsd) targets should (where applicable) match one or
-	# more of the tupples: *-*-netbsdelf*, *-*-netbsdaout*,
+	# NetBSD (nbsd) targets should (where applicable) match one or
+	# more of the tuples: *-*-netbsdelf*, *-*-netbsdaout*,
 	# *-*-netbsdecoff* and *-*-netbsd*.  For targets that recently
 	# switched to ELF, *-*-netbsd* would select the old
 	# object file format.  This provides both forward
 	# compatibility and a consistent mechanism for selecting the
 	# object file format.
-	# Determine the machine/vendor (is the vendor relevant).
-	case "${UNAME_MACHINE}" in
-	    amiga) machine=m68k-unknown ;;
-	    arm32) machine=arm-unknown ;;
-	    atari*) machine=m68k-atari ;;
-	    sun3*) machine=m68k-sun ;;
-	    mac68k) machine=m68k-apple ;;
-	    macppc) machine=powerpc-apple ;;
-	    hp3[0-9][05]) machine=m68k-hp ;;
-	    ibmrt|romp-ibm) machine=romp-ibm ;;
-	    *) machine=${UNAME_MACHINE}-unknown ;;
+	#
+	# Note: NetBSD doesn't particularly care about the vendor
+	# portion of the name.  We always set it to "unknown".
+	sysctl="sysctl -n hw.machine_arch"
+	UNAME_MACHINE_ARCH=`(/sbin/$sysctl 2>/dev/null || \
+	    /usr/sbin/$sysctl 2>/dev/null || echo unknown)`
+	case "${UNAME_MACHINE_ARCH}" in
+	    armeb) machine=armeb-unknown ;;
+	    arm*) machine=arm-unknown ;;
+	    sh3el) machine=shl-unknown ;;
+	    sh3eb) machine=sh-unknown ;;
+	    sh5el) machine=sh5le-unknown ;;
+	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
 	# to ELF recently, or will in the future.
-	case "${UNAME_MACHINE}" in
-	    i386|sparc|amiga|arm*|hp300|mvme68k|vax|atari|luna68k|mac68k|news68k|next68k|pc532|sun3*|x68k)
+	case "${UNAME_MACHINE_ARCH}" in
+	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
 		eval $set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
-			| grep __ELF__ >/dev/null
+			| grep -q __ELF__
 		then
 		    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
 		    # Return netbsd for either.  FIX?
@@ -162,124 +194,139 @@
 		fi
 		;;
 	    *)
-	        os=netbsd
+		os=netbsd
 		;;
 	esac
 	# The OS release
-	release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+	# Debian GNU/NetBSD machines have a different userland, and
+	# thus, need a distinct triplet. However, they do not need
+	# kernel version information, so it can be replaced with a
+	# suitable tag, in the style of linux-gnu.
+	case "${UNAME_VERSION}" in
+	    Debian*)
+		release='-gnu'
+		;;
+	    *)
+		release=`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
+		;;
+	esac
 	# Since CPU_TYPE-MANUFACTURER-KERNEL-OPERATING_SYSTEM:
 	# contains redundant information, the shorter form:
 	# CPU_TYPE-MANUFACTURER-OPERATING_SYSTEM is used.
 	echo "${machine}-${os}${release}"
-	exit 0 ;;
+	exit ;;
+    *:Bitrig:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/Bitrig.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-bitrig${UNAME_RELEASE}
+	exit ;;
+    *:OpenBSD:*:*)
+	UNAME_MACHINE_ARCH=`arch | sed 's/OpenBSD.//'`
+	echo ${UNAME_MACHINE_ARCH}-unknown-openbsd${UNAME_RELEASE}
+	exit ;;
+    *:ekkoBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-ekkobsd${UNAME_RELEASE}
+	exit ;;
+    *:SolidBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-solidbsd${UNAME_RELEASE}
+	exit ;;
+    macppc:MirBSD:*:*)
+	echo powerpc-unknown-mirbsd${UNAME_RELEASE}
+	exit ;;
+    *:MirBSD:*:*)
+	echo ${UNAME_MACHINE}-unknown-mirbsd${UNAME_RELEASE}
+	exit ;;
     alpha:OSF1:*:*)
-	if test $UNAME_RELEASE = "V4.0"; then
+	case $UNAME_RELEASE in
+	*4.0)
 		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $3}'`
-	fi
+		;;
+	*5.*)
+		UNAME_RELEASE=`/usr/sbin/sizer -v | awk '{print $4}'`
+		;;
+	esac
+	# According to Compaq, /usr/sbin/psrinfo has been available on
+	# OSF/1 and Tru64 systems produced since 1995.  I hope that
+	# covers most systems running today.  This code pipes the CPU
+	# types through head -n 1, so we only detect the type of CPU 0.
+	ALPHA_CPU_TYPE=`/usr/sbin/psrinfo -v | sed -n -e 's/^  The alpha \(.*\) processor.*$/\1/p' | head -n 1`
+	case "$ALPHA_CPU_TYPE" in
+	    "EV4 (21064)")
+		UNAME_MACHINE="alpha" ;;
+	    "EV4.5 (21064)")
+		UNAME_MACHINE="alpha" ;;
+	    "LCA4 (21066/21068)")
+		UNAME_MACHINE="alpha" ;;
+	    "EV5 (21164)")
+		UNAME_MACHINE="alphaev5" ;;
+	    "EV5.6 (21164A)")
+		UNAME_MACHINE="alphaev56" ;;
+	    "EV5.6 (21164PC)")
+		UNAME_MACHINE="alphapca56" ;;
+	    "EV5.7 (21164PC)")
+		UNAME_MACHINE="alphapca57" ;;
+	    "EV6 (21264)")
+		UNAME_MACHINE="alphaev6" ;;
+	    "EV6.7 (21264A)")
+		UNAME_MACHINE="alphaev67" ;;
+	    "EV6.8CB (21264C)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.8AL (21264B)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.8CX (21264D)")
+		UNAME_MACHINE="alphaev68" ;;
+	    "EV6.9A (21264/EV69A)")
+		UNAME_MACHINE="alphaev69" ;;
+	    "EV7 (21364)")
+		UNAME_MACHINE="alphaev7" ;;
+	    "EV7.9 (21364A)")
+		UNAME_MACHINE="alphaev79" ;;
+	esac
+	# A Pn.n version is a patched version.
 	# A Vn.n version is a released version.
 	# A Tn.n version is a released field test version.
 	# A Xn.n version is an unreleased experimental baselevel.
 	# 1.2 uses "1.2" for uname -r.
-	cat <<EOF >$dummy.s
-	.data
-\$Lformat:
-	.byte 37,100,45,37,120,10,0	# "%d-%x\n"
-
-	.text
-	.globl main
-	.align 4
-	.ent main
-main:
-	.frame \$30,16,\$26,0
-	ldgp \$29,0(\$27)
-	.prologue 1
-	.long 0x47e03d80 # implver \$0
-	lda \$2,-1
-	.long 0x47e20c21 # amask \$2,\$1
-	lda \$16,\$Lformat
-	mov \$0,\$17
-	not \$1,\$18
-	jsr \$26,printf
-	ldgp \$29,0(\$26)
-	mov 0,\$16
-	jsr \$26,exit
-	.end main
-EOF
-	eval $set_cc_for_build
-	$CC_FOR_BUILD $dummy.s -o $dummy 2>/dev/null
-	if test "$?" = 0 ; then
-		case `./$dummy` in
-			0-0)
-				UNAME_MACHINE="alpha"
-				;;
-			1-0)
-				UNAME_MACHINE="alphaev5"
-				;;
-			1-1)
-				UNAME_MACHINE="alphaev56"
-				;;
-			1-101)
-				UNAME_MACHINE="alphapca56"
-				;;
-			2-303)
-				UNAME_MACHINE="alphaev6"
-				;;
-			2-307)
-				UNAME_MACHINE="alphaev67"
-				;;
-			2-1307)
-				UNAME_MACHINE="alphaev68"
-				;;
-		esac
-	fi
-	rm -f $dummy.s $dummy
-	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[VTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-dec-osf`echo ${UNAME_RELEASE} | sed -e 's/^[PVTX]//' | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
+	# Reset EXIT trap before exiting to avoid spurious non-zero exit code.
+	exitcode=$?
+	trap '' 0
+	exit $exitcode ;;
     Alpha\ *:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# Should we change UNAME_MACHINE based on the output of uname instead
 	# of the specific Alpha model?
 	echo alpha-pc-interix
-	exit 0 ;;
+	exit ;;
     21064:Windows_NT:50:3)
 	echo alpha-dec-winnt3.5
-	exit 0 ;;
+	exit ;;
     Amiga*:UNIX_System_V:4.0:*)
 	echo m68k-unknown-sysv4
-	exit 0;;
-    amiga:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:[Aa]miga[Oo][Ss]:*:*)
 	echo ${UNAME_MACHINE}-unknown-amigaos
-	exit 0 ;;
-    arc64:OpenBSD:*:*)
-	echo mips64el-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    arc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    hkmips:OpenBSD:*:*)
-	echo mips-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    pmax:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    sgi:OpenBSD:*:*)
-	echo mips-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    wgrisc:OpenBSD:*:*)
-	echo mipsel-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
+    *:[Mm]orph[Oo][Ss]:*:*)
+	echo ${UNAME_MACHINE}-unknown-morphos
+	exit ;;
     *:OS/390:*:*)
 	echo i370-ibm-openedition
-	exit 0 ;;
+	exit ;;
+    *:z/VM:*:*)
+	echo s390-ibm-zvmoe
+	exit ;;
+    *:OS400:*:*)
+	echo powerpc-ibm-os400
+	exit ;;
     arm:RISC*:1.[012]*:*|arm:riscix:1.[012]*:*)
 	echo arm-acorn-riscix${UNAME_RELEASE}
-	exit 0;;
+	exit ;;
+    arm*:riscos:*:*|arm*:RISCOS:*:*)
+	echo arm-unknown-riscos
+	exit ;;
     SR2?01:HI-UX/MPP:*:* | SR8000:HI-UX/MPP:*:*)
 	echo hppa1.1-hitachi-hiuxmpp
-	exit 0;;
+	exit ;;
     Pyramid*:OSx*:*:* | MIS*:OSx*:*:* | MIS*:SMP_DC-OSx*:*:*)
 	# akee@wpdis03.wpafb.af.mil (Earle F. Ake) contributed MIS and NILE.
 	if test "`(/bin/universe) 2>/dev/null`" = att ; then
@@ -287,25 +334,51 @@
 	else
 		echo pyramid-pyramid-bsd
 	fi
-	exit 0 ;;
+	exit ;;
     NILE*:*:*:dcosx)
 	echo pyramid-pyramid-svr4
-	exit 0 ;;
+	exit ;;
+    DRS?6000:unix:4.0:6*)
+	echo sparc-icl-nx6
+	exit ;;
+    DRS?6000:UNIX_SV:4.2*:7* | DRS?6000:isis:4.2*:7*)
+	case `/usr/bin/uname -p` in
+	    sparc) echo sparc-icl-nx7; exit ;;
+	esac ;;
+    s390x:SunOS:*:*)
+	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+	exit ;;
     sun4H:SunOS:5.*:*)
 	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
-    i86pc:SunOS:5.*:*)
-	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
+    i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
+	echo i386-pc-auroraux${UNAME_RELEASE}
+	exit ;;
+    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
+	eval $set_cc_for_build
+	SUN_ARCH="i386"
+	# If there is a compiler, see if it is configured for 64-bit objects.
+	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
+	# This test works for both compilers.
+	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
+		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		grep IS_64BIT_ARCH >/dev/null
+	    then
+		SUN_ARCH="x86_64"
+	    fi
+	fi
+	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+	exit ;;
     sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
 	# SunOS6.  Hard to guess exactly what SunOS6 will be like, but
 	# it's likely to be more like Solaris than SunOS4.
 	echo sparc-sun-solaris3`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     sun4*:SunOS:*:*)
 	case "`/usr/bin/arch -k`" in
 	    Series*|S4*)
@@ -314,12 +387,12 @@
 	esac
 	# Japanese Language versions have a version number like `4.1.3-JL'.
 	echo sparc-sun-sunos`echo ${UNAME_RELEASE}|sed -e 's/-/_/'`
-	exit 0 ;;
+	exit ;;
     sun3*:SunOS:*:*)
 	echo m68k-sun-sunos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     sun*:*:4.2BSD:*)
-	UNAME_RELEASE=`(head -1 /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
+	UNAME_RELEASE=`(sed 1q /etc/motd | awk '{print substr($5,1,3)}') 2>/dev/null`
 	test "x${UNAME_RELEASE}" = "x" && UNAME_RELEASE=3
 	case "`/bin/arch`" in
 	    sun3)
@@ -329,16 +402,10 @@
 		echo sparc-sun-sunos${UNAME_RELEASE}
 		;;
 	esac
-	exit 0 ;;
+	exit ;;
     aushp:SunOS:*:*)
 	echo sparc-auspex-sunos${UNAME_RELEASE}
-	exit 0 ;;
-    sparc*:NetBSD:*)
-	echo `uname -p`-unknown-netbsd${UNAME_RELEASE}
-	exit 0 ;;
-    atari*:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     # The situation for MiNT is a little confusing.  The machine name
     # can be virtually everything (everything which is not
     # "atarist" or "atariste" at least should have a processor
@@ -348,50 +415,41 @@
     # MiNT.  But MiNT is downward compatible to TOS, so this should
     # be no problem.
     atarist[e]:*MiNT:*:* | atarist[e]:*mint:*:* | atarist[e]:*TOS:*:*)
-        echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
+	echo m68k-atari-mint${UNAME_RELEASE}
+	exit ;;
     atari*:*MiNT:*:* | atari*:*mint:*:* | atarist[e]:*TOS:*:*)
 	echo m68k-atari-mint${UNAME_RELEASE}
-        exit 0 ;;
+	exit ;;
     *falcon*:*MiNT:*:* | *falcon*:*mint:*:* | *falcon*:*TOS:*:*)
-        echo m68k-atari-mint${UNAME_RELEASE}
-	exit 0 ;;
+	echo m68k-atari-mint${UNAME_RELEASE}
+	exit ;;
     milan*:*MiNT:*:* | milan*:*mint:*:* | *milan*:*TOS:*:*)
-        echo m68k-milan-mint${UNAME_RELEASE}
-        exit 0 ;;
+	echo m68k-milan-mint${UNAME_RELEASE}
+	exit ;;
     hades*:*MiNT:*:* | hades*:*mint:*:* | *hades*:*TOS:*:*)
-        echo m68k-hades-mint${UNAME_RELEASE}
-        exit 0 ;;
+	echo m68k-hades-mint${UNAME_RELEASE}
+	exit ;;
     *:*MiNT:*:* | *:*mint:*:* | *:*TOS:*:*)
-        echo m68k-unknown-mint${UNAME_RELEASE}
-        exit 0 ;;
-    sun3*:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mac68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme68k:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
-    mvme88k:OpenBSD:*:*)
-	echo m88k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	echo m68k-unknown-mint${UNAME_RELEASE}
+	exit ;;
+    m68k:machten:*:*)
+	echo m68k-apple-machten${UNAME_RELEASE}
+	exit ;;
     powerpc:machten:*:*)
 	echo powerpc-apple-machten${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     RISC*:Mach:*:*)
 	echo mips-dec-mach_bsd4.3
-	exit 0 ;;
+	exit ;;
     RISC*:ULTRIX:*:*)
 	echo mips-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     VAX*:ULTRIX*:*:*)
 	echo vax-dec-ultrix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     2020:CLIX:*:* | 2430:CLIX:*:*)
 	echo clipper-intergraph-clix${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     mips:*:*:UMIPS | mips:*:*:RISCos)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
@@ -415,30 +473,36 @@
 	  exit (-1);
 	}
 EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy \
-	  && ./$dummy `echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` \
-	  && rm -f $dummy.c $dummy && exit 0
-	rm -f $dummy.c $dummy
+	$CC_FOR_BUILD -o $dummy $dummy.c &&
+	  dummyarg=`echo "${UNAME_RELEASE}" | sed -n 's/\([0-9]*\).*/\1/p'` &&
+	  SYSTEM_NAME=`$dummy $dummyarg` &&
+	    { echo "$SYSTEM_NAME"; exit; }
 	echo mips-mips-riscos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     Motorola:PowerMAX_OS:*:*)
 	echo powerpc-motorola-powermax
-	exit 0 ;;
+	exit ;;
+    Motorola:*:4.3:PL8-*)
+	echo powerpc-harris-powermax
+	exit ;;
+    Night_Hawk:*:*:PowerMAX_OS | Synergy:PowerMAX_OS:*:*)
+	echo powerpc-harris-powermax
+	exit ;;
     Night_Hawk:Power_UNIX:*:*)
 	echo powerpc-harris-powerunix
-	exit 0 ;;
+	exit ;;
     m88k:CX/UX:7*:*)
 	echo m88k-harris-cxux7
-	exit 0 ;;
+	exit ;;
     m88k:*:4*:R4*)
 	echo m88k-motorola-sysv4
-	exit 0 ;;
+	exit ;;
     m88k:*:3*:R3*)
 	echo m88k-motorola-sysv3
-	exit 0 ;;
+	exit ;;
     AViiON:dgux:*:*)
-        # DG/UX returns AViiON for all architectures
-        UNAME_PROCESSOR=`/usr/bin/uname -p`
+	# DG/UX returns AViiON for all architectures
+	UNAME_PROCESSOR=`/usr/bin/uname -p`
 	if [ $UNAME_PROCESSOR = mc88100 ] || [ $UNAME_PROCESSOR = mc88110 ]
 	then
 	    if [ ${TARGET_BINARY_INTERFACE}x = m88kdguxelfx ] || \
@@ -451,29 +515,29 @@
 	else
 	    echo i586-dg-dgux${UNAME_RELEASE}
 	fi
- 	exit 0 ;;
+	exit ;;
     M88*:DolphinOS:*:*)	# DolphinOS (SVR3)
 	echo m88k-dolphin-sysv3
-	exit 0 ;;
+	exit ;;
     M88*:*:R3*:*)
 	# Delta 88k system running SVR3
 	echo m88k-motorola-sysv3
-	exit 0 ;;
+	exit ;;
     XD88*:*:*:*) # Tektronix XD88 system running UTekV (SVR3)
 	echo m88k-tektronix-sysv3
-	exit 0 ;;
+	exit ;;
     Tek43[0-9][0-9]:UTek:*:*) # Tektronix 4300 system running UTek (BSD)
 	echo m68k-tektronix-bsd
-	exit 0 ;;
+	exit ;;
     *:IRIX*:*:*)
 	echo mips-sgi-irix`echo ${UNAME_RELEASE}|sed -e 's/-/_/g'`
-	exit 0 ;;
+	exit ;;
     ????????:AIX?:[12].1:2)   # AIX 2.2.1 or AIX 2.1.1 is RT/PC AIX.
-	echo romp-ibm-aix      # uname -m gives an 8 hex-code CPU id
-	exit 0 ;;              # Note that: echo "'`uname -s`'" gives 'AIX '
+	echo romp-ibm-aix     # uname -m gives an 8 hex-code CPU id
+	exit ;;               # Note that: echo "'`uname -s`'" gives 'AIX '
     i*86:AIX:*:*)
 	echo i386-ibm-aix
-	exit 0 ;;
+	exit ;;
     ia64:AIX:*:*)
 	if [ -x /usr/bin/oslevel ] ; then
 		IBM_REV=`/usr/bin/oslevel`
@@ -481,7 +545,7 @@
 		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
 	echo ${UNAME_MACHINE}-ibm-aix${IBM_REV}
-	exit 0 ;;
+	exit ;;
     *:AIX:2:3)
 	if grep bos325 /usr/include/stdio.h >/dev/null 2>&1; then
 		eval $set_cc_for_build
@@ -496,17 +560,20 @@
 			exit(0);
 			}
 EOF
-		$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
-		rm -f $dummy.c $dummy
-		echo rs6000-ibm-aix3.2.5
+		if $CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy`
+		then
+			echo "$SYSTEM_NAME"
+		else
+			echo rs6000-ibm-aix3.2.5
+		fi
 	elif grep bos324 /usr/include/stdio.h >/dev/null 2>&1; then
 		echo rs6000-ibm-aix3.2.4
 	else
 		echo rs6000-ibm-aix3.2
 	fi
-	exit 0 ;;
-    *:AIX:*:[45])
-	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | head -1 | awk '{ print $1 }'`
+	exit ;;
+    *:AIX:*:[4567])
+	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
 	else
@@ -518,96 +585,114 @@
 		IBM_REV=${UNAME_VERSION}.${UNAME_RELEASE}
 	fi
 	echo ${IBM_ARCH}-ibm-aix${IBM_REV}
-	exit 0 ;;
+	exit ;;
     *:AIX:*:*)
 	echo rs6000-ibm-aix
-	exit 0 ;;
+	exit ;;
     ibmrt:4.4BSD:*|romp-ibm:BSD:*)
 	echo romp-ibm-bsd4.4
-	exit 0 ;;
+	exit ;;
     ibmrt:*BSD:*|romp-ibm:BSD:*)            # covers RT/PC BSD and
 	echo romp-ibm-bsd${UNAME_RELEASE}   # 4.3 with uname added to
-	exit 0 ;;                           # report: romp-ibm BSD 4.3
+	exit ;;                             # report: romp-ibm BSD 4.3
     *:BOSX:*:*)
 	echo rs6000-bull-bosx
-	exit 0 ;;
+	exit ;;
     DPX/2?00:B.O.S.:*:*)
 	echo m68k-bull-sysv3
-	exit 0 ;;
+	exit ;;
     9000/[34]??:4.3bsd:1.*:*)
 	echo m68k-hp-bsd
-	exit 0 ;;
+	exit ;;
     hp300:4.4BSD:*:* | 9000/[34]??:4.3bsd:2.*:*)
 	echo m68k-hp-bsd4.4
-	exit 0 ;;
+	exit ;;
     9000/[34678]??:HP-UX:*:*)
 	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	case "${UNAME_MACHINE}" in
 	    9000/31? )            HP_ARCH=m68000 ;;
 	    9000/[34]?? )         HP_ARCH=m68k ;;
 	    9000/[678][0-9][0-9])
-              case "${HPUX_REV}" in
-                11.[0-9][0-9])
-                  if [ -x /usr/bin/getconf ]; then
-                    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
-                    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
-                    case "${sc_cpu_version}" in
-                      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
-                      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
-                      532)                      # CPU_PA_RISC2_0
-                        case "${sc_kernel_bits}" in
-                          32) HP_ARCH="hppa2.0n" ;;
-                          64) HP_ARCH="hppa2.0w" ;;
-                        esac ;;
-                    esac
-                  fi ;;
-              esac
-              if [ "${HP_ARCH}" = "" ]; then
-	      eval $set_cc_for_build
-              sed 's/^              //' << EOF >$dummy.c
-
-              #define _HPUX_SOURCE
-              #include <stdlib.h>
-              #include <unistd.h>
-
-              int main ()
-              {
-              #if defined(_SC_KERNEL_BITS)
-                  long bits = sysconf(_SC_KERNEL_BITS);
-              #endif
-                  long cpu  = sysconf (_SC_CPU_VERSION);
-
-                  switch (cpu)
-              	{
-              	case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
-              	case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
-              	case CPU_PA_RISC2_0:
-              #if defined(_SC_KERNEL_BITS)
-              	    switch (bits)
-              		{
-              		case 64: puts ("hppa2.0w"); break;
-              		case 32: puts ("hppa2.0n"); break;
-              		default: puts ("hppa2.0"); break;
-              		} break;
-              #else  /* !defined(_SC_KERNEL_BITS) */
-              	    puts ("hppa2.0"); break;
-              #endif
-              	default: puts ("hppa1.0"); break;
-              	}
-                  exit (0);
-              }
+		if [ -x /usr/bin/getconf ]; then
+		    sc_cpu_version=`/usr/bin/getconf SC_CPU_VERSION 2>/dev/null`
+		    sc_kernel_bits=`/usr/bin/getconf SC_KERNEL_BITS 2>/dev/null`
+		    case "${sc_cpu_version}" in
+		      523) HP_ARCH="hppa1.0" ;; # CPU_PA_RISC1_0
+		      528) HP_ARCH="hppa1.1" ;; # CPU_PA_RISC1_1
+		      532)                      # CPU_PA_RISC2_0
+			case "${sc_kernel_bits}" in
+			  32) HP_ARCH="hppa2.0n" ;;
+			  64) HP_ARCH="hppa2.0w" ;;
+			  '') HP_ARCH="hppa2.0" ;;   # HP-UX 10.20
+			esac ;;
+		    esac
+		fi
+		if [ "${HP_ARCH}" = "" ]; then
+		    eval $set_cc_for_build
+		    sed 's/^		//' << EOF >$dummy.c
+
+		#define _HPUX_SOURCE
+		#include <stdlib.h>
+		#include <unistd.h>
+
+		int main ()
+		{
+		#if defined(_SC_KERNEL_BITS)
+		    long bits = sysconf(_SC_KERNEL_BITS);
+		#endif
+		    long cpu  = sysconf (_SC_CPU_VERSION);
+
+		    switch (cpu)
+			{
+			case CPU_PA_RISC1_0: puts ("hppa1.0"); break;
+			case CPU_PA_RISC1_1: puts ("hppa1.1"); break;
+			case CPU_PA_RISC2_0:
+		#if defined(_SC_KERNEL_BITS)
+			    switch (bits)
+				{
+				case 64: puts ("hppa2.0w"); break;
+				case 32: puts ("hppa2.0n"); break;
+				default: puts ("hppa2.0"); break;
+				} break;
+		#else  /* !defined(_SC_KERNEL_BITS) */
+			    puts ("hppa2.0"); break;
+		#endif
+			default: puts ("hppa1.0"); break;
+			}
+		    exit (0);
+		}
 EOF
-	    (CCOPTS= $CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null ) && HP_ARCH=`./$dummy`
-	    if test -z "$HP_ARCH"; then HP_ARCH=hppa; fi
-	    rm -f $dummy.c $dummy
-	fi ;;
+		    (CCOPTS= $CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null) && HP_ARCH=`$dummy`
+		    test -z "$HP_ARCH" && HP_ARCH=hppa
+		fi ;;
 	esac
+	if [ ${HP_ARCH} = "hppa2.0w" ]
+	then
+	    eval $set_cc_for_build
+
+	    # hppa2.0w-hp-hpux* has a 64-bit kernel and a compiler generating
+	    # 32-bit code.  hppa64-hp-hpux* has the same kernel and a compiler
+	    # generating 64-bit code.  GNU and HP use different nomenclature:
+	    #
+	    # $ CC_FOR_BUILD=cc ./config.guess
+	    # => hppa2.0w-hp-hpux11.23
+	    # $ CC_FOR_BUILD="cc +DA2.0w" ./config.guess
+	    # => hppa64-hp-hpux11.23
+
+	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
+		grep -q __LP64__
+	    then
+		HP_ARCH="hppa2.0w"
+	    else
+		HP_ARCH="hppa64"
+	    fi
+	fi
 	echo ${HP_ARCH}-hp-hpux${HPUX_REV}
-	exit 0 ;;
+	exit ;;
     ia64:HP-UX:*:*)
 	HPUX_REV=`echo ${UNAME_RELEASE}|sed -e 's/[^.]*.[0B]*//'`
 	echo ia64-hp-hpux${HPUX_REV}
-	exit 0 ;;
+	exit ;;
     3050*:HI-UX:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
@@ -635,158 +720,176 @@
 	  exit (0);
 	}
 EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy && ./$dummy && rm -f $dummy.c $dummy && exit 0
-	rm -f $dummy.c $dummy
+	$CC_FOR_BUILD -o $dummy $dummy.c && SYSTEM_NAME=`$dummy` &&
+		{ echo "$SYSTEM_NAME"; exit; }
 	echo unknown-hitachi-hiuxwe2
-	exit 0 ;;
+	exit ;;
     9000/7??:4.3bsd:*:* | 9000/8?[79]:4.3bsd:*:* )
 	echo hppa1.1-hp-bsd
-	exit 0 ;;
+	exit ;;
     9000/8??:4.3bsd:*:*)
 	echo hppa1.0-hp-bsd
-	exit 0 ;;
+	exit ;;
     *9??*:MPE/iX:*:* | *3000*:MPE/iX:*:*)
 	echo hppa1.0-hp-mpeix
-	exit 0 ;;
+	exit ;;
     hp7??:OSF1:*:* | hp8?[79]:OSF1:*:* )
 	echo hppa1.1-hp-osf
-	exit 0 ;;
+	exit ;;
     hp8??:OSF1:*:*)
 	echo hppa1.0-hp-osf
-	exit 0 ;;
+	exit ;;
     i*86:OSF1:*:*)
 	if [ -x /usr/sbin/sysversion ] ; then
 	    echo ${UNAME_MACHINE}-unknown-osf1mk
 	else
 	    echo ${UNAME_MACHINE}-unknown-osf1
 	fi
-	exit 0 ;;
+	exit ;;
     parisc*:Lites*:*:*)
 	echo hppa1.1-hp-lites
-	exit 0 ;;
-    hppa*:OpenBSD:*:*)
-	echo hppa-unknown-openbsd
-	exit 0 ;;
+	exit ;;
     C1*:ConvexOS:*:* | convex:ConvexOS:C1*:*)
 	echo c1-convex-bsd
-        exit 0 ;;
+	exit ;;
     C2*:ConvexOS:*:* | convex:ConvexOS:C2*:*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
 	else echo c2-convex-bsd
 	fi
-        exit 0 ;;
+	exit ;;
     C34*:ConvexOS:*:* | convex:ConvexOS:C34*:*)
 	echo c34-convex-bsd
-        exit 0 ;;
+	exit ;;
     C38*:ConvexOS:*:* | convex:ConvexOS:C38*:*)
 	echo c38-convex-bsd
-        exit 0 ;;
+	exit ;;
     C4*:ConvexOS:*:* | convex:ConvexOS:C4*:*)
 	echo c4-convex-bsd
-        exit 0 ;;
-    CRAY*X-MP:*:*:*)
-	echo xmp-cray-unicos
-        exit 0 ;;
+	exit ;;
     CRAY*Y-MP:*:*:*)
 	echo ymp-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*[A-Z]90:*:*:*)
 	echo ${UNAME_MACHINE}-cray-unicos${UNAME_RELEASE} \
 	| sed -e 's/CRAY.*\([A-Z]90\)/\1/' \
 	      -e y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/ \
 	      -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*TS:*:*:*)
 	echo t90-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY*T3D:*:*:*)
-	echo alpha-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*T3E:*:*:*)
 	echo alphaev5-cray-unicosmk${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
+	exit ;;
     CRAY*SV1:*:*:*)
 	echo sv1-cray-unicos${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
-	exit 0 ;;
-    CRAY-2:*:*:*)
-	echo cray2-cray-unicos
-        exit 0 ;;
+	exit ;;
+    *:UNICOS/mp:*:*)
+	echo craynv-cray-unicosmp${UNAME_RELEASE} | sed -e 's/\.[^.]*$/.X/'
+	exit ;;
     F30[01]:UNIX_System_V:*:* | F700:UNIX_System_V:*:*)
 	FUJITSU_PROC=`uname -m | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz'`
-        FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
-        FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
-        echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
-        exit 0 ;;
-    hp300:OpenBSD:*:*)
-	echo m68k-unknown-openbsd${UNAME_RELEASE}
-	exit 0 ;;
+	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | sed -e 's/ /_/'`
+	echo "${FUJITSU_PROC}-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+	exit ;;
+    5000:UNIX_System_V:4.*:*)
+	FUJITSU_SYS=`uname -p | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/\///'`
+	FUJITSU_REL=`echo ${UNAME_RELEASE} | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ' 'abcdefghijklmnopqrstuvwxyz' | sed -e 's/ /_/'`
+	echo "sparc-fujitsu-${FUJITSU_SYS}${FUJITSU_REL}"
+	exit ;;
     i*86:BSD/386:*:* | i*86:BSD/OS:*:* | *:Ascend\ Embedded/OS:*:*)
 	echo ${UNAME_MACHINE}-pc-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     sparc*:BSD/OS:*:*)
 	echo sparc-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:BSD/OS:*:*)
 	echo ${UNAME_MACHINE}-unknown-bsdi${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:FreeBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
-	exit 0 ;;
-    *:OpenBSD:*:*)
-	echo ${UNAME_MACHINE}-unknown-openbsd`echo ${UNAME_RELEASE}|sed -e 's/[-_].*/\./'`
-	exit 0 ;;
+	UNAME_PROCESSOR=`/usr/bin/uname -p`
+	case ${UNAME_PROCESSOR} in
+	    amd64)
+		echo x86_64-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	    *)
+		echo ${UNAME_PROCESSOR}-unknown-freebsd`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'` ;;
+	esac
+	exit ;;
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
-	exit 0 ;;
-    i*:MINGW*:*)
+	exit ;;
+    *:MINGW64*:*)
+	echo ${UNAME_MACHINE}-pc-mingw64
+	exit ;;
+    *:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
-	exit 0 ;;
+	exit ;;
+    i*:MSYS*:*)
+	echo ${UNAME_MACHINE}-pc-msys
+	exit ;;
+    i*:windows32*:*)
+	# uname -m includes "-pc" on this system.
+	echo ${UNAME_MACHINE}-mingw32
+	exit ;;
     i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
-	exit 0 ;;
+	exit ;;
+    *:Interix*:*)
+	case ${UNAME_MACHINE} in
+	    x86)
+		echo i586-pc-interix${UNAME_RELEASE}
+		exit ;;
+	    authenticamd | genuineintel | EM64T)
+		echo x86_64-unknown-interix${UNAME_RELEASE}
+		exit ;;
+	    IA64)
+		echo ia64-unknown-interix${UNAME_RELEASE}
+		exit ;;
+	esac ;;
+    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
+	echo i${UNAME_MACHINE}-pc-mks
+	exit ;;
+    8664:Windows_NT:*)
+	echo x86_64-pc-mks
+	exit ;;
     i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
 	# UNAME_MACHINE based on the output of uname instead of i386?
-	echo i386-pc-interix
-	exit 0 ;;
+	echo i586-pc-interix
+	exit ;;
     i*:UWIN*:*)
 	echo ${UNAME_MACHINE}-pc-uwin
-	exit 0 ;;
+	exit ;;
+    amd64:CYGWIN*:*:* | x86_64:CYGWIN*:*:*)
+	echo x86_64-unknown-cygwin
+	exit ;;
     p*:CYGWIN*:*)
 	echo powerpcle-unknown-cygwin
-	exit 0 ;;
+	exit ;;
     prep*:SunOS:5.*:*)
 	echo powerpcle-unknown-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
-	exit 0 ;;
+	exit ;;
     *:GNU:*:*)
-	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-gnu`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
-	exit 0 ;;
+	# the GNU system
+	echo `echo ${UNAME_MACHINE}|sed -e 's,[-/].*$,,'`-unknown-${LIBC}`echo ${UNAME_RELEASE}|sed -e 's,/.*$,,'`
+	exit ;;
+    *:GNU/*:*:*)
+	# other systems with GNU libc and userland
+	echo ${UNAME_MACHINE}-unknown-`echo ${UNAME_SYSTEM} | sed 's,^[^/]*/,,' | tr '[A-Z]' '[a-z]'``echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`-${LIBC}
+	exit ;;
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
-	exit 0 ;;
-    arm*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
-    ia64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux
-	exit 0 ;;
-    m68*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
-    mips:Linux:*:*)
-	case `sed -n '/^byte/s/^.*: \(.*\) endian/\1/p' < /proc/cpuinfo` in
-	  big)    echo mips-unknown-linux-gnu && exit 0 ;;
-	  little) echo mipsel-unknown-linux-gnu && exit 0 ;;
-	esac
-	;;
-    ppc:Linux:*:*)
-	echo powerpc-unknown-linux-gnu
-	exit 0 ;;
-    ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    aarch64:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    aarch64_be:Linux:*:*)
+	UNAME_MACHINE=aarch64_be
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     alpha:Linux:*:*)
 	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
 	  EV5)   UNAME_MACHINE=alphaev5 ;;
@@ -796,104 +899,166 @@
 	  EV6)   UNAME_MACHINE=alphaev6 ;;
 	  EV67)  UNAME_MACHINE=alphaev67 ;;
 	  EV68*) UNAME_MACHINE=alphaev68 ;;
-        esac
-	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
-	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-	exit 0 ;;
+	esac
+	objdump --private-headers /bin/sh | grep -q ld.so.1
+	if test "$?" = 0 ; then LIBC="gnulibc1" ; fi
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    arc:Linux:*:* | arceb:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    arm*:Linux:*:*)
+	eval $set_cc_for_build
+	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
+	    | grep -q __ARM_EABI__
+	then
+	    echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	else
+	    if echo __ARM_PCS_VFP | $CC_FOR_BUILD -E - 2>/dev/null \
+		| grep -q __ARM_PCS_VFP
+	    then
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabi
+	    else
+		echo ${UNAME_MACHINE}-unknown-linux-${LIBC}eabihf
+	    fi
+	fi
+	exit ;;
+    avr32*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    cris:Linux:*:*)
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
+	exit ;;
+    crisv32:Linux:*:*)
+	echo ${UNAME_MACHINE}-axis-linux-${LIBC}
+	exit ;;
+    frv:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    hexagon:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    i*86:Linux:*:*)
+	echo ${UNAME_MACHINE}-pc-linux-${LIBC}
+	exit ;;
+    ia64:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    m32r*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    m68*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    mips:Linux:*:* | mips64:Linux:*:*)
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
+	#undef CPU
+	#undef ${UNAME_MACHINE}
+	#undef ${UNAME_MACHINE}el
+	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
+	CPU=${UNAME_MACHINE}el
+	#else
+	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
+	CPU=${UNAME_MACHINE}
+	#else
+	CPU=
+	#endif
+	#endif
+EOF
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
+	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-${LIBC}"; exit; }
+	;;
+    or1k:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    or32:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    padre:Linux:*:*)
+	echo sparc-unknown-linux-${LIBC}
+	exit ;;
+    parisc64:Linux:*:* | hppa64:Linux:*:*)
+	echo hppa64-unknown-linux-${LIBC}
+	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
-	  PA7*) echo hppa1.1-unknown-linux-gnu ;;
-	  PA8*) echo hppa2.0-unknown-linux-gnu ;;
-	  *)    echo hppa-unknown-linux-gnu ;;
+	  PA7*) echo hppa1.1-unknown-linux-${LIBC} ;;
+	  PA8*) echo hppa2.0-unknown-linux-${LIBC} ;;
+	  *)    echo hppa-unknown-linux-${LIBC} ;;
 	esac
-	exit 0 ;;
-    parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-gnu
-	exit 0 ;;
+	exit ;;
+    ppc64:Linux:*:*)
+	echo powerpc64-unknown-linux-${LIBC}
+	exit ;;
+    ppc:Linux:*:*)
+	echo powerpc-unknown-linux-${LIBC}
+	exit ;;
+    ppc64le:Linux:*:*)
+	echo powerpc64le-unknown-linux-${LIBC}
+	exit ;;
+    ppcle:Linux:*:*)
+	echo powerpcle-unknown-linux-${LIBC}
+	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
-	echo ${UNAME_MACHINE}-ibm-linux
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-ibm-linux-${LIBC}
+	exit ;;
+    sh64*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     sh*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     sparc:Linux:*:* | sparc64:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
-	exit 0 ;;
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    tile*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    vax:Linux:*:*)
+	echo ${UNAME_MACHINE}-dec-linux-${LIBC}
+	exit ;;
     x86_64:Linux:*:*)
-	echo x86_64-unknown-linux-gnu
-	exit 0 ;;
-    i*86:Linux:*:*)
-	# The BFD linker knows what the default object file format is, so
-	# first see if it will tell us. cd to the root directory to prevent
-	# problems with other programs or directories called `ld' in the path.
-	ld_supported_targets=`cd /; ld --help 2>&1 \
-			 | sed -ne '/supported targets:/!d
-				    s/[ 	][ 	]*/ /g
-				    s/.*supported targets: *//
-				    s/ .*//
-				    p'`
-        case "$ld_supported_targets" in
-	  elf32-i386)
-		TENTATIVE="${UNAME_MACHINE}-pc-linux-gnu"
-		;;
-	  a.out-i386-linux)
-		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-		exit 0 ;;		
-	  coff-i386)
-		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-		exit 0 ;;
-	  "")
-		# Either a pre-BFD a.out linker (linux-gnuoldld) or
-		# one that does not give us useful --help.
-		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
-		exit 0 ;;
-	esac
-	# Determine whether the default compiler is a.out or elf
-	eval $set_cc_for_build
-	cat >$dummy.c <<EOF
-#include <features.h>
-#ifdef __cplusplus
-#include <stdio.h>  /* for printf() prototype */
-	int main (int argc, char *argv[]) {
-#else
-	int main (argc, argv) int argc; char *argv[]; {
-#endif
-#ifdef __ELF__
-# ifdef __GLIBC__
-#  if __GLIBC__ >= 2
-    printf ("%s-pc-linux-gnu\n", argv[1]);
-#  else
-    printf ("%s-pc-linux-gnulibc1\n", argv[1]);
-#  endif
-# else
-   printf ("%s-pc-linux-gnulibc1\n", argv[1]);
-# endif
-#else
-  printf ("%s-pc-linux-gnuaout\n", argv[1]);
-#endif
-  return 0;
-}
-EOF
-	$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy "${UNAME_MACHINE}" && rm -f $dummy.c $dummy && exit 0
-	rm -f $dummy.c $dummy
-	test x"${TENTATIVE}" != x && echo "${TENTATIVE}" && exit 0
-	;;
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
+    xtensa*:Linux:*:*)
+	echo ${UNAME_MACHINE}-unknown-linux-${LIBC}
+	exit ;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
 	# sysname and nodename.
 	echo i386-sequent-sysv4
-	exit 0 ;;
+	exit ;;
     i*86:UNIX_SV:4.2MP:2.*)
-        # Unixware is an offshoot of SVR4, but it has its own version
-        # number series starting with 2...
-        # I am not positive that other SVR4 systems won't match this,
+	# Unixware is an offshoot of SVR4, but it has its own version
+	# number series starting with 2...
+	# I am not positive that other SVR4 systems won't match this,
 	# I just have to hope.  -- rms.
-        # Use sysv4.2uw... so that sysv4* matches it.
+	# Use sysv4.2uw... so that sysv4* matches it.
 	echo ${UNAME_MACHINE}-pc-sysv4.2uw${UNAME_VERSION}
-	exit 0 ;;
+	exit ;;
+    i*86:OS/2:*:*)
+	# If we were able to find `uname', then EMX Unix compatibility
+	# is probably installed.
+	echo ${UNAME_MACHINE}-pc-os2-emx
+	exit ;;
+    i*86:XTS-300:*:STOP)
+	echo ${UNAME_MACHINE}-unknown-stop
+	exit ;;
+    i*86:atheos:*:*)
+	echo ${UNAME_MACHINE}-unknown-atheos
+	exit ;;
+    i*86:syllable:*:*)
+	echo ${UNAME_MACHINE}-pc-syllable
+	exit ;;
+    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*)
+	echo i386-unknown-lynxos${UNAME_RELEASE}
+	exit ;;
+    i*86:*DOS:*:*)
+	echo ${UNAME_MACHINE}-pc-msdosdjgpp
+	exit ;;
     i*86:*:4.*:* | i*86:SYSTEM_V:4.*:*)
 	UNAME_REL=`echo ${UNAME_RELEASE} | sed 's/\/MP$//'`
 	if grep Novell /usr/include/link.h >/dev/null 2>/dev/null; then
@@ -901,99 +1066,113 @@
 	else
 		echo ${UNAME_MACHINE}-pc-sysv${UNAME_REL}
 	fi
-	exit 0 ;;
-    i*86:*:5:[78]*)
+	exit ;;
+    i*86:*:5:[678]*)
+	# UnixWare 7.x, OpenUNIX and OpenServer 6.
 	case `/bin/uname -X | grep "^Machine"` in
 	    *486*)	     UNAME_MACHINE=i486 ;;
 	    *Pentium)	     UNAME_MACHINE=i586 ;;
 	    *Pent*|*Celeron) UNAME_MACHINE=i686 ;;
 	esac
 	echo ${UNAME_MACHINE}-unknown-sysv${UNAME_RELEASE}${UNAME_SYSTEM}${UNAME_VERSION}
-	exit 0 ;;
+	exit ;;
     i*86:*:3.2:*)
 	if test -f /usr/options/cb.name; then
 		UNAME_REL=`sed -n 's/.*Version //p' </usr/options/cb.name`
 		echo ${UNAME_MACHINE}-pc-isc$UNAME_REL
 	elif /bin/uname -X 2>/dev/null >/dev/null ; then
-		UNAME_REL=`(/bin/uname -X|egrep Release|sed -e 's/.*= //')`
-		(/bin/uname -X|egrep i80486 >/dev/null) && UNAME_MACHINE=i486
-		(/bin/uname -X|egrep '^Machine.*Pentium' >/dev/null) \
+		UNAME_REL=`(/bin/uname -X|grep Release|sed -e 's/.*= //')`
+		(/bin/uname -X|grep i80486 >/dev/null) && UNAME_MACHINE=i486
+		(/bin/uname -X|grep '^Machine.*Pentium' >/dev/null) \
 			&& UNAME_MACHINE=i586
-		(/bin/uname -X|egrep '^Machine.*Pent ?II' >/dev/null) \
+		(/bin/uname -X|grep '^Machine.*Pent *II' >/dev/null) \
 			&& UNAME_MACHINE=i686
-		(/bin/uname -X|egrep '^Machine.*Pentium Pro' >/dev/null) \
+		(/bin/uname -X|grep '^Machine.*Pentium Pro' >/dev/null) \
 			&& UNAME_MACHINE=i686
 		echo ${UNAME_MACHINE}-pc-sco$UNAME_REL
 	else
 		echo ${UNAME_MACHINE}-pc-sysv32
 	fi
-	exit 0 ;;
-    i*86:*DOS:*:*)
-	echo ${UNAME_MACHINE}-pc-msdosdjgpp
-	exit 0 ;;
+	exit ;;
     pc:*:*:*)
 	# Left here for compatibility:
-        # uname -m prints for DJGPP always 'pc', but it prints nothing about
-        # the processor, so we play safe by assuming i386.
-	echo i386-pc-msdosdjgpp
-        exit 0 ;;
+	# uname -m prints for DJGPP always 'pc', but it prints nothing about
+	# the processor, so we play safe by assuming i586.
+	# Note: whatever this is, it MUST be the same as what config.sub
+	# prints for the "djgpp" host, or else GDB configury will decide that
+	# this is a cross-build.
+	echo i586-pc-msdosdjgpp
+	exit ;;
     Intel:Mach:3*:*)
 	echo i386-pc-mach3
-	exit 0 ;;
+	exit ;;
     paragon:*:*:*)
 	echo i860-intel-osf1
-	exit 0 ;;
+	exit ;;
     i860:*:4.*:*) # i860-SVR4
 	if grep Stardent /usr/include/sys/uadmin.h >/dev/null 2>&1 ; then
 	  echo i860-stardent-sysv${UNAME_RELEASE} # Stardent Vistra i860-SVR4
 	else # Add other i860-SVR4 vendors below as they are discovered.
 	  echo i860-unknown-sysv${UNAME_RELEASE}  # Unknown i860-SVR4
 	fi
-	exit 0 ;;
+	exit ;;
     mini*:CTIX:SYS*5:*)
 	# "miniframe"
 	echo m68010-convergent-sysv
-	exit 0 ;;
-    M68*:*:R3V[567]*:*)
-	test -r /sysV68 && echo 'm68k-motorola-sysv' && exit 0 ;;
-    3[34]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 4850:*:4.0:3.0)
+	exit ;;
+    mc68k:UNIX:SYSTEM5:3.51m)
+	echo m68k-convergent-sysv
+	exit ;;
+    M680?0:D-NIX:5.3:*)
+	echo m68k-diab-dnix
+	exit ;;
+    M68*:*:R3V[5678]*:*)
+	test -r /sysV68 && { echo 'm68k-motorola-sysv'; exit; } ;;
+    3[345]??:*:4.0:3.0 | 3[34]??A:*:4.0:3.0 | 3[34]??,*:*:4.0:3.0 | 3[34]??/*:*:4.0:3.0 | 4400:*:4.0:3.0 | 4850:*:4.0:3.0 | SKA40:*:4.0:3.0 | SDS2:*:4.0:3.0 | SHG2:*:4.0:3.0 | S7501*:*:4.0:3.0)
 	OS_REL=''
 	test -r /etc/.relid \
 	&& OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
 	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-	  && echo i486-ncr-sysv4.3${OS_REL} && exit 0
+	  && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
 	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
-	  && echo i586-ncr-sysv4.3${OS_REL} && exit 0 ;;
+	  && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
-        /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
-          && echo i486-ncr-sysv4 && exit 0 ;;
+	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
+	  && { echo i486-ncr-sysv4; exit; } ;;
+    NCR*:*:4.2:* | MPRAS*:*:4.2:*)
+	OS_REL='.3'
+	test -r /etc/.relid \
+	    && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
+	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
+	    && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
+	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; }
+	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
 	echo m68k-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     mc68030:UNIX_System_V:4.*:*)
 	echo m68k-atari-sysv4
-	exit 0 ;;
-    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
-	echo i386-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     TSUNAMI:LynxOS:2.*:*)
 	echo sparc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     rs6000:LynxOS:2.*:*)
 	echo rs6000-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
-    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
+	exit ;;
+    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*)
 	echo powerpc-unknown-lynxos${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     SM[BE]S:UNIX_SV:*:*)
 	echo mips-dde-sysv${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     RM*:ReliantUNIX-*:*:*)
 	echo mips-sni-sysv4
-	exit 0 ;;
+	exit ;;
     RM*:SINIX-*:*:*)
 	echo mips-sni-sysv4
-	exit 0 ;;
+	exit ;;
     *:SINIX-*:*:*)
 	if uname -p 2>/dev/null >/dev/null ; then
 		UNAME_MACHINE=`(uname -p) 2>/dev/null`
@@ -1001,82 +1180,138 @@
 	else
 		echo ns32k-sni-sysv
 	fi
-	exit 0 ;;
-    PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort
-                      # says <Richard.M.Bartel@ccMail.Census.GOV>
-        echo i586-unisys-sysv4
-        exit 0 ;;
+	exit ;;
+    PENTIUM:*:4.0*:*)	# Unisys `ClearPath HMP IX 4000' SVR4/MP effort
+			# says <Richard.M.Bartel@ccMail.Census.GOV>
+	echo i586-unisys-sysv4
+	exit ;;
     *:UNIX_System_V:4*:FTX*)
 	# From Gerald Hewes <hewes@openmarket.com>.
 	# How about differentiating between stratus architectures? -djm
 	echo hppa1.1-stratus-sysv4
-	exit 0 ;;
+	exit ;;
     *:*:*:FTX*)
 	# From seanf@swdc.stratus.com.
 	echo i860-stratus-sysv4
-	exit 0 ;;
+	exit ;;
+    i*86:VOS:*:*)
+	# From Paul.Green@stratus.com.
+	echo ${UNAME_MACHINE}-stratus-vos
+	exit ;;
     *:VOS:*:*)
 	# From Paul.Green@stratus.com.
 	echo hppa1.1-stratus-vos
-	exit 0 ;;
+	exit ;;
     mc68*:A/UX:*:*)
 	echo m68k-apple-aux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     news*:NEWS-OS:6*:*)
 	echo mips-sony-newsos6
-	exit 0 ;;
+	exit ;;
     R[34]000:*System_V*:*:* | R4000:UNIX_SYSV:*:* | R*000:UNIX_SV:*:*)
 	if [ -d /usr/nec ]; then
-	        echo mips-nec-sysv${UNAME_RELEASE}
+		echo mips-nec-sysv${UNAME_RELEASE}
 	else
-	        echo mips-unknown-sysv${UNAME_RELEASE}
+		echo mips-unknown-sysv${UNAME_RELEASE}
 	fi
-        exit 0 ;;
+	exit ;;
     BeBox:BeOS:*:*)	# BeOS running on hardware made by Be, PPC only.
 	echo powerpc-be-beos
-	exit 0 ;;
+	exit ;;
     BeMac:BeOS:*:*)	# BeOS running on Mac or Mac clone, PPC only.
 	echo powerpc-apple-beos
-	exit 0 ;;
+	exit ;;
     BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
 	echo i586-pc-beos
-	exit 0 ;;
+	exit ;;
+    BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
+	echo i586-pc-haiku
+	exit ;;
+    x86_64:Haiku:*:*)
+	echo x86_64-unknown-haiku
+	exit ;;
     SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     SX-5:SUPER-UX:*:*)
 	echo sx5-nec-superux${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
+    SX-6:SUPER-UX:*:*)
+	echo sx6-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-7:SUPER-UX:*:*)
+	echo sx7-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8:SUPER-UX:*:*)
+	echo sx8-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8R:SUPER-UX:*:*)
+	echo sx8r-nec-superux${UNAME_RELEASE}
+	exit ;;
     Power*:Rhapsody:*:*)
 	echo powerpc-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Rhapsody:*:*)
 	echo ${UNAME_MACHINE}-apple-rhapsody${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Darwin:*:*)
-	echo `uname -p`-apple-darwin${UNAME_RELEASE}
-	exit 0 ;;
+	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
+	eval $set_cc_for_build
+	if test "$UNAME_PROCESSOR" = unknown ; then
+	    UNAME_PROCESSOR=powerpc
+	fi
+	if test `echo "$UNAME_RELEASE" | sed -e 's/\..*//'` -le 10 ; then
+	    if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+		if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+		    (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		    grep IS_64BIT_ARCH >/dev/null
+		then
+		    case $UNAME_PROCESSOR in
+			i386) UNAME_PROCESSOR=x86_64 ;;
+			powerpc) UNAME_PROCESSOR=powerpc64 ;;
+		    esac
+		fi
+	    fi
+	elif test "$UNAME_PROCESSOR" = i386 ; then
+	    # Avoid executing cc on OS X 10.9, as it ships with a stub
+	    # that puts up a graphical alert prompting to install
+	    # developer tools.  Any system running Mac OS X 10.7 or
+	    # later (Darwin 11 and later) is required to have a 64-bit
+	    # processor. This is not true of the ARM version of Darwin
+	    # that Apple uses in portable devices.
+	    UNAME_PROCESSOR=x86_64
+	fi
+	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
+	exit ;;
     *:procnto*:*:* | *:QNX:[0123456789]*:*)
-	if test "${UNAME_MACHINE}" = "x86pc"; then
+	UNAME_PROCESSOR=`uname -p`
+	if test "$UNAME_PROCESSOR" = "x86"; then
+		UNAME_PROCESSOR=i386
 		UNAME_MACHINE=pc
 	fi
-	echo `uname -p`-${UNAME_MACHINE}-nto-qnx
-	exit 0 ;;
+	echo ${UNAME_PROCESSOR}-${UNAME_MACHINE}-nto-qnx${UNAME_RELEASE}
+	exit ;;
     *:QNX:*:4*)
 	echo i386-pc-qnx
-	exit 0 ;;
-    NSR-[KW]:NONSTOP_KERNEL:*:*)
+	exit ;;
+    NEO-?:NONSTOP_KERNEL:*:*)
+	echo neo-tandem-nsk${UNAME_RELEASE}
+	exit ;;
+    NSE-*:NONSTOP_KERNEL:*:*)
+	echo nse-tandem-nsk${UNAME_RELEASE}
+	exit ;;
+    NSR-?:NONSTOP_KERNEL:*:*)
 	echo nsr-tandem-nsk${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:NonStop-UX:*:*)
 	echo mips-compaq-nonstopux
-	exit 0 ;;
+	exit ;;
     BS2000:POSIX*:*:*)
 	echo bs2000-siemens-sysv
-	exit 0 ;;
+	exit ;;
     DS/*:UNIX_System_V:*:*)
 	echo ${UNAME_MACHINE}-${UNAME_SYSTEM}-${UNAME_RELEASE}
-	exit 0 ;;
+	exit ;;
     *:Plan9:*:*)
 	# "uname -m" is not consistent, so use $cputype instead. 386
 	# is converted to i386 for consistency with other x86
@@ -1087,41 +1322,55 @@
 	    UNAME_MACHINE="$cputype"
 	fi
 	echo ${UNAME_MACHINE}-unknown-plan9
-	exit 0 ;;
-    i*86:OS/2:*:*)
-	# If we were able to find `uname', then EMX Unix compatibility
-	# is probably installed.
-	echo ${UNAME_MACHINE}-pc-os2-emx
-	exit 0 ;;
+	exit ;;
     *:TOPS-10:*:*)
 	echo pdp10-unknown-tops10
-	exit 0 ;;
+	exit ;;
     *:TENEX:*:*)
 	echo pdp10-unknown-tenex
-	exit 0 ;;
+	exit ;;
     KS10:TOPS-20:*:* | KL10:TOPS-20:*:* | TYPE4:TOPS-20:*:*)
 	echo pdp10-dec-tops20
-	exit 0 ;;
+	exit ;;
     XKL-1:TOPS-20:*:* | TYPE5:TOPS-20:*:*)
 	echo pdp10-xkl-tops20
-	exit 0 ;;
+	exit ;;
     *:TOPS-20:*:*)
 	echo pdp10-unknown-tops20
-	exit 0 ;;
+	exit ;;
     *:ITS:*:*)
 	echo pdp10-unknown-its
-	exit 0 ;;
-    i*86:XTS-300:*:STOP)
-	echo ${UNAME_MACHINE}-unknown-stop
-	exit 0 ;;
-    i*86:atheos:*:*)
-	echo ${UNAME_MACHINE}-unknown-atheos
-	exit 0 ;;
+	exit ;;
+    SEI:*:*:SEIUX)
+	echo mips-sei-seiux${UNAME_RELEASE}
+	exit ;;
+    *:DragonFly:*:*)
+	echo ${UNAME_MACHINE}-unknown-dragonfly`echo ${UNAME_RELEASE}|sed -e 's/[-(].*//'`
+	exit ;;
+    *:*VMS:*:*)
+	UNAME_MACHINE=`(uname -p) 2>/dev/null`
+	case "${UNAME_MACHINE}" in
+	    A*) echo alpha-dec-vms ; exit ;;
+	    I*) echo ia64-dec-vms ; exit ;;
+	    V*) echo vax-dec-vms ; exit ;;
+	esac ;;
+    *:XENIX:*:SysV)
+	echo i386-pc-xenix
+	exit ;;
+    i*86:skyos:*:*)
+	echo ${UNAME_MACHINE}-pc-skyos`echo ${UNAME_RELEASE}` | sed -e 's/ .*$//'
+	exit ;;
+    i*86:rdos:*:*)
+	echo ${UNAME_MACHINE}-pc-rdos
+	exit ;;
+    i*86:AROS:*:*)
+	echo ${UNAME_MACHINE}-pc-aros
+	exit ;;
+    x86_64:VMkernel:*:*)
+	echo ${UNAME_MACHINE}-unknown-esx
+	exit ;;
 esac
 
-#echo '(No uname command or uname output not recognized.)' 1>&2
-#echo "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" 1>&2
-
 eval $set_cc_for_build
 cat >$dummy.c <<EOF
 #ifdef _SEQUENT_
@@ -1139,16 +1388,16 @@
 #include <sys/param.h>
   printf ("m68k-sony-newsos%s\n",
 #ifdef NEWSOS4
-          "4"
+	"4"
 #else
-	  ""
+	""
 #endif
-         ); exit (0);
+	); exit (0);
 #endif
 #endif
 
 #if defined (__arm) && defined (__acorn) && defined (__unix)
-  printf ("arm-acorn-riscix"); exit (0);
+  printf ("arm-acorn-riscix\n"); exit (0);
 #endif
 
 #if defined (hp300) && !defined (hpux)
@@ -1237,12 +1486,12 @@
 }
 EOF
 
-$CC_FOR_BUILD $dummy.c -o $dummy 2>/dev/null && ./$dummy && rm -f $dummy.c $dummy && exit 0
-rm -f $dummy.c $dummy
+$CC_FOR_BUILD -o $dummy $dummy.c 2>/dev/null && SYSTEM_NAME=`$dummy` &&
+	{ echo "$SYSTEM_NAME"; exit; }
 
 # Apollos put the system type in the environment.
 
-test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit 0; }
+test -d /usr/apollo && { echo ${ISP}-apollo-${SYSTYPE}; exit; }
 
 # Convex versions that predate uname can use getsysinfo(1)
 
@@ -1251,22 +1500,22 @@
     case `getsysinfo -f cpu_type` in
     c1*)
 	echo c1-convex-bsd
-	exit 0 ;;
+	exit ;;
     c2*)
 	if getsysinfo -f scalar_acc
 	then echo c32-convex-bsd
 	else echo c2-convex-bsd
 	fi
-	exit 0 ;;
+	exit ;;
     c34*)
 	echo c34-convex-bsd
-	exit 0 ;;
+	exit ;;
     c38*)
 	echo c38-convex-bsd
-	exit 0 ;;
+	exit ;;
     c4*)
 	echo c4-convex-bsd
-	exit 0 ;;
+	exit ;;
     esac
 fi
 
@@ -1277,7 +1526,9 @@
 the operating system you are using. It is advised that you
 download the most up to date version of the config scripts from
 
-    ftp://ftp.gnu.org/pub/gnu/config/
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+and
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
 
 If the version you run ($0) is already up to date, please
 send the following data and any information you think might be
--- bind9-9.9.5.dfsg.orig/contrib/idn/idnkit-1.0-src/config.sub
+++ bind9-9.9.5.dfsg/contrib/idn/idnkit-1.0-src/config.sub
@@ -1,41 +1,40 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-#   Free Software Foundation, Inc.
+#   Copyright 1992-2013 Free Software Foundation, Inc.
 
-timestamp='2001-09-07'
+timestamp='2013-10-01'
 
-# This file is (in principle) common to ALL GNU software.
-# The presence of a machine in this file suggests that SOME GNU software
-# can handle that machine.  It does not imply ALL GNU software can.
-#
-# This file is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
+# This file is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
 # (at your option) any later version.
 #
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place - Suite 330,
-# Boston, MA 02111-1307, USA.
-
+# along with this program; if not, see <http://www.gnu.org/licenses/>.
+#
 # As a special exception to the GNU General Public License, if you
 # distribute this file as part of a program that contains a
 # configuration script generated by Autoconf, you may include it under
-# the same distribution terms that you use for the rest of that program.
+# the same distribution terms that you use for the rest of that
+# program.  This Exception is an additional permission under section 7
+# of the GNU General Public License, version 3 ("GPLv3").
 
-# Please send patches to <config-patches@gnu.org>.
+
+# Please send patches with a ChangeLog entry to config-patches@gnu.org.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
 # If it is invalid, we print an error message on stderr and exit with code 1.
 # Otherwise, we print the canonical config type on stdout and succeed.
 
+# You can get the latest version of this script from:
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
 # that are meaningful with *any* GNU software.
@@ -69,8 +68,7 @@
 version="\
 GNU config.sub ($timestamp)
 
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001
-Free Software Foundation, Inc.
+Copyright 1992-2013 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -82,11 +80,11 @@
 while test $# -gt 0 ; do
   case $1 in
     --time-stamp | --time* | -t )
-       echo "$timestamp" ; exit 0 ;;
+       echo "$timestamp" ; exit ;;
     --version | -v )
-       echo "$version" ; exit 0 ;;
+       echo "$version" ; exit ;;
     --help | --h* | -h )
-       echo "$usage"; exit 0 ;;
+       echo "$usage"; exit ;;
     -- )     # Stop option processing
        shift; break ;;
     - )	# Use stdin as input.
@@ -98,7 +96,7 @@
     *local*)
        # First pass through any local machine types.
        echo $1
-       exit 0;;
+       exit ;;
 
     * )
        break ;;
@@ -117,10 +115,18 @@
 # Here we must recognize all the valid KERNEL-OS combinations.
 maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
-  nto-qnx* | linux-gnu* | storm-chaos* | os2-emx* | windows32-*)
+  nto-qnx* | linux-gnu* | linux-android* | linux-dietlibc | linux-newlib* | \
+  linux-musl* | linux-uclibc* | uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | \
+  knetbsd*-gnu* | netbsd*-gnu* | \
+  kopensolaris*-gnu* | \
+  storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
     ;;
+  android-linux)
+    os=-linux-android
+    basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`-unknown
+    ;;
   *)
     basic_machine=`echo $1 | sed 's/-[^-]*$//'`
     if [ $basic_machine != $1 ]
@@ -143,10 +149,13 @@
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis)
+	-apple | -axis | -knuth | -cray | -microblaze*)
 		os=
 		basic_machine=$1
 		;;
+	-bluegene*)
+		os=-cnk
+		;;
 	-sim | -cisco | -oki | -wec | -winbond)
 		os=
 		basic_machine=$1
@@ -161,13 +170,17 @@
 		os=-chorusos
 		basic_machine=$1
 		;;
- 	-chorusrdb)
- 		os=-chorusrdb
+	-chorusrdb)
+		os=-chorusrdb
 		basic_machine=$1
- 		;;
+		;;
 	-hiux*)
 		os=-hiuxwe2
 		;;
+	-sco6)
+		os=-sco5v6
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		;;
 	-sco5)
 		os=-sco3.2v5
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
@@ -184,6 +197,10 @@
 		# Don't forget version if it is 3.2v4 or newer.
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
+	-sco5v6*)
+		# Don't forget version if it is 3.2v4 or newer.
+		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
+		;;
 	-sco*)
 		os=-sco3.2v2
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
@@ -201,6 +218,12 @@
 	-isc*)
 		basic_machine=`echo $1 | sed -e 's/86-.*/86-pc/'`
 		;;
+	-lynx*178)
+		os=-lynxos178
+		;;
+	-lynx*5)
+		os=-lynxos5
+		;;
 	-lynx*)
 		os=-lynxos
 		;;
@@ -225,43 +248,107 @@
 	# Some are omitted here because they have special meanings below.
 	1750a | 580 \
 	| a29k \
+	| aarch64 | aarch64_be \
 	| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] | alphapca5[67] \
-	| arc | arm | arm[bl]e | arme[lb] | armv[2345] | armv[345][lb] | avr \
-	| c4x | clipper \
-	| d10v | d30v | dsp16xx \
-	| fr30 \
+	| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] | alpha64pca5[67] \
+	| am33_2.0 \
+	| arc | arceb \
+	| arm | arm[bl]e | arme[lb] | armv[2-8] | armv[3-8][lb] | armv7[arm] \
+	| avr | avr32 \
+	| be32 | be64 \
+	| bfin \
+	| c4x | c8051 | clipper \
+	| d10v | d30v | dlx | dsp16xx \
+	| epiphany \
+	| fido | fr30 | frv \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
+	| hexagon \
 	| i370 | i860 | i960 | ia64 \
-	| m32r | m68000 | m68k | m88k | mcore \
-	| mips16 | mips64 | mips64el | mips64orion | mips64orionel \
-	| mips64vr4100 | mips64vr4100el | mips64vr4300 \
-	| mips64vr4300el | mips64vr5000 | mips64vr5000el \
-	| mipsbe | mipseb | mipsel | mipsle | mipstx39 | mipstx39el \
-	| mipsisa32 \
+	| ip2k | iq2000 \
+	| k1om \
+	| le32 | le64 \
+	| lm32 \
+	| m32c | m32r | m32rle | m68000 | m68k | m88k \
+	| maxq | mb | microblaze | microblazeel | mcore | mep | metag \
+	| mips | mipsbe | mipseb | mipsel | mipsle \
+	| mips16 \
+	| mips64 | mips64el \
+	| mips64octeon | mips64octeonel \
+	| mips64orion | mips64orionel \
+	| mips64r5900 | mips64r5900el \
+	| mips64vr | mips64vrel \
+	| mips64vr4100 | mips64vr4100el \
+	| mips64vr4300 | mips64vr4300el \
+	| mips64vr5000 | mips64vr5000el \
+	| mips64vr5900 | mips64vr5900el \
+	| mipsisa32 | mipsisa32el \
+	| mipsisa32r2 | mipsisa32r2el \
+	| mipsisa64 | mipsisa64el \
+	| mipsisa64r2 | mipsisa64r2el \
+	| mipsisa64sb1 | mipsisa64sb1el \
+	| mipsisa64sr71k | mipsisa64sr71kel \
+	| mipsr5900 | mipsr5900el \
+	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
+	| moxie \
+	| mt \
+	| msp430 \
+	| nds32 | nds32le | nds32be \
+	| nios | nios2 | nios2eb | nios2el \
 	| ns16k | ns32k \
-	| openrisc \
+	| open8 \
+	| or1k | or32 \
 	| pdp10 | pdp11 | pj | pjl \
-	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
+	| powerpc | powerpc64 | powerpc64le | powerpcle \
 	| pyramid \
-	| s390 | s390x \
-	| sh | sh[34] | sh[34]eb | shbe | shle \
-	| sparc | sparc64 | sparclet | sparclite | sparcv9 | sparcv9b \
-	| stormy16 | strongarm \
-	| tahoe | thumb | tic80 | tron \
-	| v850 \
+	| rl78 | rx \
+	| score \
+	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh64 | sh64le \
+	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
+	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
+	| spu \
+	| tahoe | tic4x | tic54x | tic55x | tic6x | tic80 | tron \
+	| ubicom32 \
+	| v850 | v850e | v850e1 | v850e2 | v850es | v850e2v3 \
 	| we32k \
-	| x86 | xscale \
-	| z8k)
+	| x86 | xc16x | xstormy16 | xtensa \
+	| z8k | z80)
 		basic_machine=$basic_machine-unknown
 		;;
-	m6811 | m68hc11 | m6812 | m68hc12)
-		# Motorola 68HC11/12.
+	c54x)
+		basic_machine=tic54x-unknown
+		;;
+	c55x)
+		basic_machine=tic55x-unknown
+		;;
+	c6x)
+		basic_machine=tic6x-unknown
+		;;
+	m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x | nvptx | picochip)
 		basic_machine=$basic_machine-unknown
 		os=-none
 		;;
 	m88110 | m680[12346]0 | m683?2 | m68360 | m5200 | v70 | w65 | z8k)
 		;;
+	ms1)
+		basic_machine=mt-unknown
+		;;
+
+	strongarm | thumb | xscale)
+		basic_machine=arm-unknown
+		;;
+	xgate)
+		basic_machine=$basic_machine-unknown
+		os=-none
+		;;
+	xscaleeb)
+		basic_machine=armeb-unknown
+		;;
+
+	xscaleel)
+		basic_machine=armel-unknown
+		;;
 
 	# We use `pc' rather than `unknown'
 	# because (1) that's what they normally are, and
@@ -277,41 +364,83 @@
 	# Recognize the basic CPU types with company name.
 	580-* \
 	| a29k-* \
+	| aarch64-* | aarch64_be-* \
 	| alpha-* | alphaev[4-8]-* | alphaev56-* | alphaev6[78]-* \
-	| alphapca5[67]-* | arc-* \
-	| arm-*  | armbe-* | armle-* | armv*-* \
-	| bs2000-* \
-	| c[123]* | c30-* | [cjt]90-* | c54x-* \
-	| clipper-* | cray2-* | cydra-* \
-	| d10v-* | d30v-* \
+	| alpha64-* | alpha64ev[4-8]-* | alpha64ev56-* | alpha64ev6[78]-* \
+	| alphapca5[67]-* | alpha64pca5[67]-* | arc-* | arceb-* \
+	| arm-*  | armbe-* | armle-* | armeb-* | armv*-* \
+	| avr-* | avr32-* \
+	| be32-* | be64-* \
+	| bfin-* | bs2000-* \
+	| c[123]* | c30-* | [cjt]90-* | c4x-* \
+	| c8051-* | clipper-* | craynv-* | cydra-* \
+	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
-	| f30[01]-* | f700-* | fr30-* | fx80-* \
+	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
+	| hexagon-* \
 	| i*86-* | i860-* | i960-* | ia64-* \
-	| m32r-* \
-	| m68000-* | m680[01234]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | mcore-* \
-	| mips-* | mips16-* | mips64-* | mips64el-* | mips64orion-* \
-	| mips64orionel-* | mips64vr4100-* | mips64vr4100el-* \
-	| mips64vr4300-* | mips64vr4300el-* | mipsbe-* | mipseb-* \
-	| mipsle-* | mipsel-* | mipstx39-* | mipstx39el-* \
+	| ip2k-* | iq2000-* \
+	| k1om-* \
+	| le32-* | le64-* \
+	| lm32-* \
+	| m32c-* | m32r-* | m32rle-* \
+	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
+	| microblaze-* | microblazeel-* \
+	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
+	| mips16-* \
+	| mips64-* | mips64el-* \
+	| mips64octeon-* | mips64octeonel-* \
+	| mips64orion-* | mips64orionel-* \
+	| mips64r5900-* | mips64r5900el-* \
+	| mips64vr-* | mips64vrel-* \
+	| mips64vr4100-* | mips64vr4100el-* \
+	| mips64vr4300-* | mips64vr4300el-* \
+	| mips64vr5000-* | mips64vr5000el-* \
+	| mips64vr5900-* | mips64vr5900el-* \
+	| mipsisa32-* | mipsisa32el-* \
+	| mipsisa32r2-* | mipsisa32r2el-* \
+	| mipsisa64-* | mipsisa64el-* \
+	| mipsisa64r2-* | mipsisa64r2el-* \
+	| mipsisa64sb1-* | mipsisa64sb1el-* \
+	| mipsisa64sr71k-* | mipsisa64sr71kel-* \
+	| mipsr5900-* | mipsr5900el-* \
+	| mipstx39-* | mipstx39el-* \
+	| mmix-* \
+	| mt-* \
+	| msp430-* \
+	| nds32-* | nds32le-* | nds32be-* \
+	| nios-* | nios2-* | nios2eb-* | nios2el-* \
 	| none-* | np1-* | ns16k-* | ns32k-* \
+	| open8-* \
 	| orion-* \
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
-	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
+	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* \
 	| pyramid-* \
-	| romp-* | rs6000-* \
-	| s390-* | s390x-* \
-	| sh-* | sh[34]-* | sh[34]eb-* | shbe-* | shle-* \
-	| sparc-* | sparc64-* | sparc86x-* | sparclite-* \
-	| sparcv9-* | sparcv9b-* | stormy16-* | strongarm-* | sv1-* \
-	| t3e-* | tahoe-* | thumb-* | tic30-* | tic54x-* | tic80-* | tron-* \
-	| v850-* | vax-* \
+	| rl78-* | romp-* | rs6000-* | rx-* \
+	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
+	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
+	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
+	| sparclite-* \
+	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | sv1-* | sx?-* \
+	| tahoe-* \
+	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
+	| tile*-* \
+	| tron-* \
+	| ubicom32-* \
+	| v850-* | v850e-* | v850e1-* | v850es-* | v850e2-* | v850e2v3-* \
+	| vax-* \
 	| we32k-* \
-	| x86-* | x86_64-* | xmp-* | xps100-* | xscale-* \
+	| x86-* | x86_64-* | xc16x-* | xps100-* \
+	| xstormy16-* | xtensa*-* \
 	| ymp-* \
-	| z8k-*)
+	| z8k-* | z80-*)
+		;;
+	# Recognize the basic CPU types without company name, with glob match.
+	xtensa*)
+		basic_machine=$basic_machine-unknown
 		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
@@ -329,6 +458,9 @@
 		basic_machine=a29k-amd
 		os=-udi
 		;;
+	abacus)
+		basic_machine=abacus-unknown
+		;;
 	adobe68k)
 		basic_machine=m68010-adobe
 		os=-scout
@@ -343,6 +475,12 @@
 		basic_machine=a29k-none
 		os=-bsd
 		;;
+	amd64)
+		basic_machine=x86_64-pc
+		;;
+	amd64-*)
+		basic_machine=x86_64-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	amdahl)
 		basic_machine=580-amdahl
 		os=-sysv
@@ -366,6 +504,10 @@
 		basic_machine=m68k-apollo
 		os=-bsd
 		;;
+	aros)
+		basic_machine=i386-pc
+		os=-aros
+		;;
 	aux)
 		basic_machine=m68k-apple
 		os=-aux
@@ -374,6 +516,35 @@
 		basic_machine=ns32k-sequent
 		os=-dynix
 		;;
+	blackfin)
+		basic_machine=bfin-unknown
+		os=-linux
+		;;
+	blackfin-*)
+		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
+	bluegene*)
+		basic_machine=powerpc-ibm
+		os=-cnk
+		;;
+	c54x-*)
+		basic_machine=tic54x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
+	c55x-*)
+		basic_machine=tic55x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
+	c6x-*)
+		basic_machine=tic6x-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
+	c90)
+		basic_machine=c90-cray
+		os=-unicos
+		;;
+	cegcc)
+		basic_machine=arm-unknown
+		os=-cegcc
+		;;
 	convex-c1)
 		basic_machine=c1-convex
 		os=-bsd
@@ -394,30 +565,45 @@
 		basic_machine=c38-convex
 		os=-bsd
 		;;
-	cray | ymp)
-		basic_machine=ymp-cray
+	cray | j90)
+		basic_machine=j90-cray
 		os=-unicos
 		;;
-	cray2)
-		basic_machine=cray2-cray
-		os=-unicos
+	craynv)
+		basic_machine=craynv-cray
+		os=-unicosmp
 		;;
-	[cjt]90)
-		basic_machine=${basic_machine}-cray
-		os=-unicos
+	cr16 | cr16-*)
+		basic_machine=cr16-unknown
+		os=-elf
 		;;
 	crds | unos)
 		basic_machine=m68k-crds
 		;;
+	crisv32 | crisv32-* | etraxfs*)
+		basic_machine=crisv32-axis
+		;;
 	cris | cris-* | etrax*)
 		basic_machine=cris-axis
 		;;
+	crx)
+		basic_machine=crx-unknown
+		os=-elf
+		;;
 	da30 | da30-*)
 		basic_machine=m68k-da30
 		;;
 	decstation | decstation-3100 | pmax | pmax-* | pmin | dec3100 | decstatn)
 		basic_machine=mips-dec
 		;;
+	decsystem10* | dec10*)
+		basic_machine=pdp10-dec
+		os=-tops10
+		;;
+	decsystem20* | dec20*)
+		basic_machine=pdp10-dec
+		os=-tops20
+		;;
 	delta | 3300 | motorola-3300 | motorola-delta \
 	      | 3300-motorola | delta-motorola)
 		basic_machine=m68k-motorola
@@ -426,6 +612,14 @@
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
+	dicos)
+		basic_machine=i686-pc
+		os=-dicos
+		;;
+	djgpp)
+		basic_machine=i586-pc
+		os=-msdosdjgpp
+		;;
 	dpx20 | dpx20-*)
 		basic_machine=rs6000-bull
 		os=-bosx
@@ -537,7 +731,6 @@
 	i370-ibm* | ibm*)
 		basic_machine=i370-ibm
 		;;
-# I'm not sure what "Sysv32" means.  Should this be sysv3.2?
 	i*86v32)
 		basic_machine=`echo $1 | sed -e 's/86.*/86-pc/'`
 		os=-sysv32
@@ -576,6 +769,14 @@
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
+	m68knommu)
+		basic_machine=m68k-unknown
+		os=-linux
+		;;
+	m68knommu-*)
+		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
 	m88k-omron*)
 		basic_machine=m88k-omron
 		;;
@@ -587,10 +788,21 @@
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
+	microblaze*)
+		basic_machine=microblaze-xilinx
+		;;
+	mingw64)
+		basic_machine=x86_64-pc
+		os=-mingw64
+		;;
 	mingw32)
-		basic_machine=i386-pc
+		basic_machine=i686-pc
 		os=-mingw32
 		;;
+	mingw32ce)
+		basic_machine=arm-unknown
+		os=-mingw32ce
+		;;
 	miniframe)
 		basic_machine=m68000-convergent
 		;;
@@ -598,36 +810,39 @@
 		basic_machine=m68k-atari
 		os=-mint
 		;;
-	mipsel*-linux*)
-		basic_machine=mipsel-unknown
-		os=-linux-gnu
-		;;
-	mips*-linux*)
-		basic_machine=mips-unknown
-		os=-linux-gnu
-		;;
 	mips3*-*)
 		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`
 		;;
 	mips3*)
 		basic_machine=`echo $basic_machine | sed -e 's/mips3/mips64/'`-unknown
 		;;
-	mmix*)
-		basic_machine=mmix-knuth
-		os=-mmixware
-		;;
 	monitor)
 		basic_machine=m68k-rom68k
 		os=-coff
 		;;
+	morphos)
+		basic_machine=powerpc-unknown
+		os=-morphos
+		;;
 	msdos)
 		basic_machine=i386-pc
 		os=-msdos
 		;;
+	ms1-*)
+		basic_machine=`echo $basic_machine | sed -e 's/ms1-/mt-/'`
+		;;
+	msys)
+		basic_machine=i686-pc
+		os=-msys
+		;;
 	mvs)
 		basic_machine=i370-ibm
 		os=-mvs
 		;;
+	nacl)
+		basic_machine=le32-unknown
+		os=-nacl
+		;;
 	ncr3000)
 		basic_machine=i486-ncr
 		os=-sysv4
@@ -692,6 +907,12 @@
 	np1)
 		basic_machine=np1-gould
 		;;
+	neo-tandem)
+		basic_machine=neo-tandem
+		;;
+	nse-tandem)
+		basic_machine=nse-tandem
+		;;
 	nsr-tandem)
 		basic_machine=nsr-tandem
 		;;
@@ -699,6 +920,13 @@
 		basic_machine=hppa1.1-oki
 		os=-proelf
 		;;
+	openrisc | openrisc-*)
+		basic_machine=or32-unknown
+		;;
+	os400)
+		basic_machine=powerpc-ibm
+		os=-os400
+		;;
 	OSE68000 | ose68000)
 		basic_machine=m68000-ericsson
 		os=-ose
@@ -715,55 +943,76 @@
 		basic_machine=i860-intel
 		os=-osf
 		;;
+	parisc)
+		basic_machine=hppa-unknown
+		os=-linux
+		;;
+	parisc-*)
+		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
 	pbd)
 		basic_machine=sparc-tti
 		;;
 	pbb)
 		basic_machine=m68k-tti
 		;;
-        pc532 | pc532-*)
+	pc532 | pc532-*)
 		basic_machine=ns32k-pc532
 		;;
-	pentium | p5 | k5 | k6 | nexgen)
+	pc98)
+		basic_machine=i386-pc
+		;;
+	pc98-*)
+		basic_machine=i386-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
+	pentium | p5 | k5 | k6 | nexgen | viac3)
 		basic_machine=i586-pc
 		;;
-	pentiumpro | p6 | 6x86 | athlon)
+	pentiumpro | p6 | 6x86 | athlon | athlon_*)
 		basic_machine=i686-pc
 		;;
-	pentiumii | pentium2)
+	pentiumii | pentium2 | pentiumiii | pentium3)
 		basic_machine=i686-pc
 		;;
-	pentium-* | p5-* | k5-* | k6-* | nexgen-*)
+	pentium4)
+		basic_machine=i786-pc
+		;;
+	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
 		basic_machine=i586-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	pentiumpro-* | p6-* | 6x86-* | athlon-*)
 		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
-	pentiumii-* | pentium2-*)
+	pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*)
 		basic_machine=i686-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
+	pentium4-*)
+		basic_machine=i786-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	pn)
 		basic_machine=pn-gould
 		;;
 	power)	basic_machine=power-ibm
 		;;
-	ppc)	basic_machine=powerpc-unknown
-	        ;;
-	ppc-*)	basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
+	ppc | ppcbe)	basic_machine=powerpc-unknown
+		;;
+	ppc-* | ppcbe-*)
+		basic_machine=powerpc-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppcle | powerpclittle | ppc-le | powerpc-little)
 		basic_machine=powerpcle-unknown
-	        ;;
+		;;
 	ppcle-* | powerpclittle-*)
 		basic_machine=powerpcle-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64)	basic_machine=powerpc64-unknown
-	        ;;
+		;;
 	ppc64-*) basic_machine=powerpc64-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
 	ppc64le | powerpc64little | ppc64-le | powerpc64-little)
 		basic_machine=powerpc64le-unknown
-	        ;;
+		;;
 	ppc64le-* | powerpc64little-*)
 		basic_machine=powerpc64le-`echo $basic_machine | sed 's/^[^-]*-//'`
 		;;
@@ -774,6 +1023,14 @@
 		basic_machine=i586-unknown
 		os=-pw32
 		;;
+	rdos | rdos64)
+		basic_machine=x86_64-pc
+		os=-rdos
+		;;
+	rdos32)
+		basic_machine=i386-pc
+		os=-rdos
+		;;
 	rom68k)
 		basic_machine=m68k-rom68k
 		os=-coff
@@ -784,10 +1041,30 @@
 	rtpc | rtpc-*)
 		basic_machine=romp-ibm
 		;;
+	s390 | s390-*)
+		basic_machine=s390-ibm
+		;;
+	s390x | s390x-*)
+		basic_machine=s390x-ibm
+		;;
 	sa29200)
 		basic_machine=a29k-amd
 		os=-udi
 		;;
+	sb1)
+		basic_machine=mipsisa64sb1-unknown
+		;;
+	sb1el)
+		basic_machine=mipsisa64sb1el-unknown
+		;;
+	sde)
+		basic_machine=mipsisa32-sde
+		os=-elf
+		;;
+	sei)
+		basic_machine=mips-sei
+		os=-seiux
+		;;
 	sequent)
 		basic_machine=i386-sequent
 		;;
@@ -795,7 +1072,13 @@
 		basic_machine=sh-hitachi
 		os=-hms
 		;;
-	sparclite-wrs)
+	sh5el)
+		basic_machine=sh5le-unknown
+		;;
+	sh64)
+		basic_machine=sh64-unknown
+		;;
+	sparclite-wrs | simso-wrs)
 		basic_machine=sparclite-wrs
 		os=-vxworks
 		;;
@@ -813,6 +1096,9 @@
 		basic_machine=i860-stratus
 		os=-sysv4
 		;;
+	strongarm-* | thumb-*)
+		basic_machine=arm-`echo $basic_machine | sed 's/^[^-]*-//'`
+		;;
 	sun2)
 		basic_machine=m68000-sun
 		;;
@@ -862,12 +1148,16 @@
 		os=-dynix
 		;;
 	t3e)
-		basic_machine=t3e-cray
+		basic_machine=alphaev5-cray
 		os=-unicos
 		;;
-	tic54x | c54x*)
-		basic_machine=tic54x-unknown
-		os=-coff
+	t90)
+		basic_machine=t90-cray
+		os=-unicos
+		;;
+	tile*)
+		basic_machine=$basic_machine-unknown
+		os=-linux-gnu
 		;;
 	tx39)
 		basic_machine=mipstx39-unknown
@@ -875,9 +1165,17 @@
 	tx39el)
 		basic_machine=mipstx39el-unknown
 		;;
+	toad1)
+		basic_machine=pdp10-xkl
+		os=-tops20
+		;;
 	tower | tower-32)
 		basic_machine=m68k-ncr
 		;;
+	tpf)
+		basic_machine=s390x-ibm
+		os=-tpf
+		;;
 	udi29k)
 		basic_machine=a29k-amd
 		os=-udi
@@ -899,8 +1197,8 @@
 		os=-vms
 		;;
 	vpp*|vx|vx-*)
-               basic_machine=f301-fujitsu
-               ;;
+		basic_machine=f301-fujitsu
+		;;
 	vxworks960)
 		basic_machine=i960-wrs
 		os=-vxworks
@@ -921,21 +1219,28 @@
 		basic_machine=hppa1.1-winbond
 		os=-proelf
 		;;
-	windows32)
-		basic_machine=i386-pc
-		os=-windows32-msvcrt
-		;;
-	xmp)
-		basic_machine=xmp-cray
-		os=-unicos
+	xbox)
+		basic_machine=i686-pc
+		os=-mingw32
 		;;
-        xps | xps100)
+	xps | xps100)
 		basic_machine=xps100-honeywell
 		;;
+	xscale-* | xscalee[bl]-*)
+		basic_machine=`echo $basic_machine | sed 's/^xscale/arm/'`
+		;;
+	ymp)
+		basic_machine=ymp-cray
+		os=-unicos
+		;;
 	z8k-*-coff)
 		basic_machine=z8k-unknown
 		os=-sim
 		;;
+	z80-*-coff)
+		basic_machine=z80-unknown
+		os=-sim
+		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -952,16 +1257,12 @@
 	op60c)
 		basic_machine=hppa1.1-oki
 		;;
-	mips)
-		if [ x$os = x-linux-gnu ]; then
-			basic_machine=mips-unknown
-		else
-			basic_machine=mips-mips
-		fi
-		;;
 	romp)
 		basic_machine=romp-ibm
 		;;
+	mmix)
+		basic_machine=mmix-knuth
+		;;
 	rs6000)
 		basic_machine=rs6000-ibm
 		;;
@@ -978,13 +1279,13 @@
 	we32k)
 		basic_machine=we32k-att
 		;;
-	sh3 | sh4 | sh3eb | sh4eb)
+	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
-	sparc | sparcv9 | sparcv9b)
+	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
 		basic_machine=sparc-sun
 		;;
-        cydra)
+	cydra)
 		basic_machine=cydra-cydrome
 		;;
 	orion)
@@ -999,10 +1300,6 @@
 	pmac | pmac-mpw)
 		basic_machine=powerpc-apple
 		;;
-	c4x*)
-		basic_machine=c4x-none
-		os=-coff
-		;;
 	*-unknown)
 		# Make sure to match an already-canonicalized machine name.
 		;;
@@ -1029,9 +1326,12 @@
 if [ x"$os" != x"" ]
 then
 case $os in
-        # First match some system type aliases
-        # that might get confused with valid system types.
+	# First match some system type aliases
+	# that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
+	-auroraux)
+		os=-auroraux
+		;;
 	-solaris1 | -solaris1.*)
 		os=`echo $os | sed -e 's|solaris1|sunos4|'`
 		;;
@@ -1052,23 +1352,31 @@
 	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
-	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
+	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
+	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
+	      | -sym* | -kopensolaris* | -plan9* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* \
+	      | -aos* | -aros* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
-	      | -hiux* | -386bsd* | -netbsd* | -openbsd* | -freebsd* | -riscix* \
-	      | -lynxos* | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
+	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \
+	      | -bitrig* | -openbsd* | -solidbsd* \
+	      | -ekkobsd* | -kfreebsd* | -freebsd* | -riscix* | -lynxos* \
+	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* \
-	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
-	      | -mingw32* | -linux-gnu* | -uxpv* | -beos* | -mpeix* | -udk* \
-	      | -interix* | -uwin* | -rhapsody* | -darwin* | -opened* \
+	      | -chorusos* | -chorusrdb* | -cegcc* \
+	      | -cygwin* | -msys* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
+	      | -mingw32* | -mingw64* | -linux-gnu* | -linux-android* \
+	      | -linux-newlib* | -linux-musl* | -linux-uclibc* \
+	      | -uxpv* | -beos* | -mpeix* | -udk* \
+	      | -interix* | -uwin* | -mks* | -rhapsody* | -darwin* | -opened* \
 	      | -openstep* | -oskit* | -conix* | -pw32* | -nonstopux* \
 	      | -storm-chaos* | -tops10* | -tenex* | -tops20* | -its* \
-	      | -os2* | -vos*)
+	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
+	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
+	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1080,16 +1388,21 @@
 			;;
 		esac
 		;;
+	-nto-qnx*)
+		;;
 	-nto*)
-		os=-nto-qnx
+		os=`echo $os | sed -e 's|nto|nto-qnx|'`
 		;;
 	-sim | -es1800* | -hms* | -xray | -os68k* | -none* | -v88r* \
-	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* \
+	      | -windows* | -osx | -abug | -netware* | -os9* | -beos* | -haiku* \
 	      | -macos* | -mpw* | -magic* | -mmixware* | -mon960* | -lnews*)
 		;;
 	-mac*)
 		os=`echo $os | sed -e 's|mac|macos|'`
 		;;
+	-linux-dietlibc)
+		os=-linux-dietlibc
+		;;
 	-linux*)
 		os=`echo $os | sed -e 's|linux|linux-gnu|'`
 		;;
@@ -1102,6 +1415,9 @@
 	-opened*)
 		os=-openedition
 		;;
+	-os400*)
+		os=-os400
+		;;
 	-wince*)
 		os=-wince
 		;;
@@ -1120,14 +1436,23 @@
 	-acis*)
 		os=-aos
 		;;
+	-atheos*)
+		os=-atheos
+		;;
+	-syllable*)
+		os=-syllable
+		;;
 	-386bsd)
 		os=-bsd
 		;;
 	-ctix* | -uts*)
 		os=-sysv
 		;;
+	-nova*)
+		os=-rtmk-nova
+		;;
 	-ns2 )
-	        os=-nextstep2
+		os=-nextstep2
 		;;
 	-nsk*)
 		os=-nsk
@@ -1139,6 +1464,9 @@
 	-sinix*)
 		os=-sysv4
 		;;
+	-tpf*)
+		os=-tpf
+		;;
 	-triton*)
 		os=-sysv3
 		;;
@@ -1166,8 +1494,19 @@
 	-xenix)
 		os=-xenix
 		;;
-        -*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
-	        os=-mint
+	-*mint | -mint[0-9]* | -*MiNT | -MiNT[0-9]*)
+		os=-mint
+		;;
+	-aros*)
+		os=-aros
+		;;
+	-zvmoe)
+		os=-zvmoe
+		;;
+	-dicos*)
+		os=-dicos
+		;;
+	-nacl*)
 		;;
 	-none)
 		;;
@@ -1191,6 +1530,12 @@
 # system, and we'll never get to this point.
 
 case $basic_machine in
+	score-*)
+		os=-elf
+		;;
+	spu-*)
+		os=-elf
+		;;
 	*-acorn)
 		os=-riscix1.2
 		;;
@@ -1200,10 +1545,29 @@
 	arm*-semi)
 		os=-aout
 		;;
+	c4x-* | tic4x-*)
+		os=-coff
+		;;
+	c8051-*)
+		os=-elf
+		;;
+	hexagon-*)
+		os=-elf
+		;;
+	tic54x-*)
+		os=-coff
+		;;
+	tic55x-*)
+		os=-coff
+		;;
+	tic6x-*)
+		os=-coff
+		;;
+	# This must come before the *-dec entry.
 	pdp10-*)
 		os=-tops20
 		;;
-        pdp11-*)
+	pdp11-*)
 		os=-none
 		;;
 	*-dec | vax-*)
@@ -1217,19 +1581,25 @@
 		;;
 	m68000-sun)
 		os=-sunos3
-		# This also exists in the configure program, but was not the
-		# default.
-		# os=-sunos4
 		;;
 	m68*-cisco)
 		os=-aout
 		;;
+	mep-*)
+		os=-elf
+		;;
 	mips*-cisco)
 		os=-elf
 		;;
 	mips*-*)
 		os=-elf
 		;;
+	or1k-*)
+		os=-elf
+		;;
+	or32-*)
+		os=-coff
+		;;
 	*-tti)	# must be before sparc entry or we get the wrong os.
 		os=-sysv3
 		;;
@@ -1239,9 +1609,15 @@
 	*-be)
 		os=-beos
 		;;
+	*-haiku)
+		os=-haiku
+		;;
 	*-ibm)
 		os=-aix
 		;;
+	*-knuth)
+		os=-mmixware
+		;;
 	*-wec)
 		os=-proelf
 		;;
@@ -1293,19 +1669,19 @@
 	*-next)
 		os=-nextstep3
 		;;
-        *-gould)
+	*-gould)
 		os=-sysv
 		;;
-        *-highlevel)
+	*-highlevel)
 		os=-bsd
 		;;
 	*-encore)
 		os=-bsd
 		;;
-        *-sgi)
+	*-sgi)
 		os=-irix
 		;;
-        *-siemens)
+	*-siemens)
 		os=-sysv4
 		;;
 	*-masscomp)
@@ -1344,7 +1720,7 @@
 			-sunos*)
 				vendor=sun
 				;;
-			-aix*)
+			-cnk*|-aix*)
 				vendor=ibm
 				;;
 			-beos*)
@@ -1374,10 +1750,16 @@
 			-mvs* | -opened*)
 				vendor=ibm
 				;;
+			-os400*)
+				vendor=ibm
+				;;
 			-ptx*)
 				vendor=sequent
 				;;
-			-vxsim* | -vxworks*)
+			-tpf*)
+				vendor=ibm
+				;;
+			-vxsim* | -vxworks* | -windiss*)
 				vendor=wrs
 				;;
 			-aux*)
@@ -1401,7 +1783,7 @@
 esac
 
 echo $basic_machine$os
-exit 0
+exit
 
 # Local variables:
 # eval: (add-hook 'write-file-hooks 'time-stamp)
--- bind9-9.9.5.dfsg.orig/debian/README.Debian
+++ bind9-9.9.5.dfsg/debian/README.Debian
@@ -0,0 +1,178 @@
+DNSSEC validation turned on by default as of BIND 9.8.1
+-------------------------------------------------------
+As of version 9.8.1.dfsg-1, BIND ships with DNSSEC validation turned on
+by default.  As the keys get changed over time, this means that a fresh
+install of BIND will require that the admin manually upgrade bind.keys
+to account for the change, before BIND will be able to resolve hosts in
+DNSSEC validated zones.
+
+
+Upgrading from BIND 8.X:
+-----------------------
+
+If you are upgrading an authoritative server from BIND 8.X, please install
+the bind9-doc package and read /usr/share/doc/bind9-doc/misc/migration.gz,
+which contains a set of notes from the BIND maintainers on what changed
+that is likely to need your attention during an upgrade.
+
+
+Upgrading from earlier bind9 packages:
+-------------------------------------
+
+If you installed an early version of the Debian bind9 packages, prior to 
+version 1:9.2.0-2 to be more precise, you may have an /etc/bind/rndc.conf 
+configuration file still on your system.  There's nothing wrong with that,
+and if you've explicitly configured keys for using rndc you may well want to
+leave things exactly as they are!
+
+However, since 9.2.0 BIND 9.X has supported an rndc.key file that both named
+and rndc will read to obtain a shared key for rndc use against a daemon on 
+the same host.  The rndc-confgen program will easily create a suitable key
+file.  To take advantage of this mechanism, you may want to:
+
+	remove the /etc/bind/rndc.conf file
+	remove the rndc key specification in the /etc/bind/named.conf file
+
+	rndc-confgen -r /dev/urandom -a
+
+Alternatively, you can 'purge' the bind9 packages and reinstall them and you
+will end up with the new behavior since it is now the default.
+
+This is more secure than using a static key that isn't generated on a per-host
+basis, and is an easy alternative to more complex key schemes if you only need
+to use rndc to talk to named on the same host.
+
+
+Known Issues:
+------------
+
+I've had a report that lwresd, at least, fails to work with some recent 2.5
+kernels.  If you see something in your logs like 
+
+	loading configuration from '/etc/bind/lwresd.conf'
+	none:0: open: /etc/bind/lwresd.conf: permission denied
+
+Try rebuilding with --disable-linux-caps added to the configure call in the 
+rules file.  I'm hoping this is a temporary problem in the 2.5 kernel series,
+but we'll see.
+
+
+Configuration Schema:
+--------------------
+
+The Debian BIND package ships with a config that will work for the majority 
+of leaf servers with no user input required.
+
+The named configuration file named.conf is located in /etc/bind, so that all 
+static configuration files relating to bind are in one place.  If you really 
+really don't want named.conf in /etc/bind, then the best way to handle it is 
+probably to replace /etc/bind/named.conf with a symlink to the location you 
+want to use.  You could also use an option to named in the init.d script,
+but that only works for named, not for things like ndc.
+
+Zone data files for the root servers, and the forward and reverse localhost
+zones are also provided in /etc/bind.
+
+The working directory for named is now /var/cache/bind.  Thus, any transient
+files generated by named, such as database files for zones the daemon is
+secondary for, will be written to the /var filesystem, where they belong.
+
+To make this work, the named.conf provided uses explicitly fully-qualified
+pathnames to reference the files in /etc/bind. 
+
+Unlike previous BIND packages for Debian, the named.conf and provided db.*
+files are tagged as conffiles.  Thus, if you just want a "caching mostly"
+server configuration for a server that does not need to be authoritative for
+anything else, you can run the provided configuration as-is.  If you want to
+hack on named.conf, or even the init.d fragment, you can feel free to.  Future
+package upgrades will treat your configuration changes sanely, as all Debian
+packages should.
+
+While you are free to craft whatever structure you wish for servers which need
+to be authoritative for additional zones, what we suggest is that you put the
+db files for any zones you are master for in /etc/bind (perhaps even in a
+subdirectory structure depending on complexity), using full pathnames in the
+named.conf file.  Any zones you are secondary for should be configured in
+named.conf with simple filenames (relative to /var/cache/bind), so the data
+files will be stored in BIND's working directory (defaults to /var/cache/bind).
+Zones subject to automatic updates (such as via DHCP and/or nsupdate) should be
+stored in /var/lib/bind, and specified with full pathnames.
+
+
+Running Chroot'ed:
+-----------------
+
+Several users have asked for Debian BIND to run in a "chroot jail".  There are
+various issues associated with making this the default configuration for the
+package in Debian.  In the meantime, reasonable instructions on how to do
+this yourself are available on the web from:
+
+	http://www.tldp.org/HOWTO/Chroot-BIND-HOWTO.html
+
+
+Running Non-Root:
+-----------------
+
+Recent versions of named can be invoked with options that specify a non-root
+user and/or group for named.  Read the named man page for more information.
+Note that when running named as a user other than root, it will not be able
+to find new interfaces that appear dynamically, such as during a PCMCIA card
+insertion, or if you're running some flavors of IPSEC and/or IP over IP
+tunnels.  If you cannot live with those limitations, feel free to edit the
+/etc/init.d/bind9 script to change the invocation of named.
+
+The default is now to run as the user 'bind' (which is automatically created
+in the group 'bind', if it doesn't exist), unless named.conf has been changed.
+To change this, edit /etc/default/bind9
+
+Please note that 'ndc restart' doesn't honor all the original command line
+options to named, so we explicitly don't use it in the init.d script provided
+with the package, and you should be careful about using it if you decide to
+run named non-root.
+
+
+PPP Control Script:
+-----------------
+
+Unfortunately, 'ndc reload' will not honor any command line options that were 
+fed to named on the initial invocation.  If you can live with that, and
+want to wiggle your DNS configuration when your PPP link goes up or down, the
+following script fragment from Francesco Potorti` <pot@gnu.org> may be helpful
+to you:
+   
+   I suggest adding this as bot /etc/ppp/ip-up.d/bind and
+   /etc/ppp/ip-down.d/bind:
+   
+   ================================================================
+   #!/bin/sh
+   if [ -x /usr/sbin/ndc -a -x /usr/sbin/named ]
+   then
+           /usr/sbin/ndc reload > /dev/null
+   fi
+   ================================================================
+   
+   This should cause no harm in any case, and should be helpful in these
+   cases:
+   - you configure bind as a forwarder.  When ppp is down, it cannot access
+     the network.  As soon as ppp is up, it is forced by the script to try
+     again, and it succeeds.
+   - someone writes a clever script that, coupled with the `usepeerdns'
+     command of pppd, makes a forwarding-only bind use the right servers by
+     rewriting the configuration file after ppp goes up.  Then the script
+     above makes bind reload the configuration.
+   
+   Now, someone should write that clever script :-)
+   
+   By the way, this is a  badly wanted feature, that should help setting up
+   a ppp connection automatically.   Currently, setting up a ppp connection
+   is much easier on a windows system than on linux, and there is really no
+   reason why it should be so, given that all the tools are there.
+
+
+Apparmor Profile
+----------------
+If your system uses apparmor, please note that the shipped enforcing profile
+works with the default installation, and changes in your configuration may
+require changes to the installed apparmor profile. Please see
+https://wiki.ubuntu.com/DebuggingApparmor before filing a bug against this
+software.
--- bind9-9.9.5.dfsg.orig/debian/apparmor-profile
+++ bind9-9.9.5.dfsg/debian/apparmor-profile
@@ -0,0 +1,53 @@
+# vim:syntax=apparmor
+# Last Modified: Fri Jun  1 16:43:22 2007
+#include <tunables/global>
+
+/usr/sbin/named {
+  #include <abstractions/base>
+  #include <abstractions/nameservice>
+
+  capability net_bind_service,
+  capability setgid,
+  capability setuid,
+  capability sys_chroot,
+  capability sys_resource,
+
+  # /etc/bind should be read-only for bind
+  # /var/lib/bind is for dynamically updated zone (and journal) files.
+  # /var/cache/bind is for slave/stub data, since we're not the origin of it.
+  # See /usr/share/doc/bind9/README.Debian.gz
+  /etc/bind/** r,
+  /var/lib/bind/** rw,
+  /var/lib/bind/ rw,
+  /var/cache/bind/** lrw,
+  /var/cache/bind/ rw,
+
+  # gssapi
+  /etc/krb5.keytab kr,
+  /etc/bind/krb5.keytab kr,
+
+  # ssl
+  /etc/ssl/openssl.cnf r,
+
+  # GeoIP data files for GeoIP ACLs
+  /usr/share/GeoIP/** r,
+
+  # dnscvsutil package
+  /var/lib/dnscvsutil/compiled/** rw,
+
+  /proc/net/if_inet6 r,
+  /proc/*/net/if_inet6 r,
+  /usr/sbin/named mr,
+  /{,var/}run/named/named.pid w,
+  /{,var/}run/named/session.key w,
+  # support for resolvconf
+  /{,var/}run/named/named.options r,
+
+  # some people like to put logs in /var/log/named/ instead of having
+  # syslog do the heavy lifting.
+  /var/log/named/** rw,
+  /var/log/named/ rw,
+
+  # Site-specific additions and overrides. See local/README for details.
+  #include <local/usr.sbin.named>
+}
--- bind9-9.9.5.dfsg.orig/debian/apparmor-profile.local
+++ bind9-9.9.5.dfsg/debian/apparmor-profile.local
@@ -0,0 +1,2 @@
+# Site-specific additions and overrides for usr.sbin.named.
+# For more details, please see /etc/apparmor.d/local/README.
--- bind9-9.9.5.dfsg.orig/debian/bind9-doc.dirs
+++ bind9-9.9.5.dfsg/debian/bind9-doc.dirs
@@ -0,0 +1 @@
+usr/share/doc/bind9-doc/arm
--- bind9-9.9.5.dfsg.orig/debian/bind9-doc.docs
+++ bind9-9.9.5.dfsg/debian/bind9-doc.docs
@@ -0,0 +1 @@
+doc/misc
--- bind9-9.9.5.dfsg.orig/debian/bind9-host.dirs
+++ bind9-9.9.5.dfsg/debian/bind9-host.dirs
@@ -0,0 +1,2 @@
+usr/bin
+usr/share/man/man1
--- bind9-9.9.5.dfsg.orig/debian/bind9-host.install
+++ bind9-9.9.5.dfsg/debian/bind9-host.install
@@ -0,0 +1,2 @@
+usr/bin/host
+usr/share/man/man1/host.1*
--- bind9-9.9.5.dfsg.orig/debian/bind9-resolvconf.service
+++ bind9-9.9.5.dfsg/debian/bind9-resolvconf.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=local BIND via resolvconf
+Documentation=man:named(8) man:resolvconf(8)
+Requires=bind9.service
+After=bind9.service
+ConditionFileIsExecutable=/sbin/resolvconf
+
+[Service]
+ExecStart=/bin/sh -c 'echo nameserver 127.0.0.1 | /sbin/resolvconf -a lo.named'
+ExecStop=/sbin/resolvconf -d lo.named
+
+[Install]
+WantedBy=bind9.service
--- bind9-9.9.5.dfsg.orig/debian/bind9.NEWS
+++ bind9-9.9.5.dfsg/debian/bind9.NEWS
@@ -0,0 +1,14 @@
+bind9 (1:9.4.0-1) experimental; urgency=low
+
+  As of bind 9.4, allow-query-cache and allow-recursion default to the
+  builtin acls 'localnets' and 'localhost'.  If you are setting up a
+  name server for a network, you will almost certainly need to change
+  this.
+
+  The change in default has been done to make caching servers less
+  attractive as reflective amplifying targets for spoofed traffic.
+  This still leaves authoritative servers exposed.
+
+  The best fix is for full BCP 38 deployment to remove spoofed traffic.
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 03 Oct 2007 00:52:44 -0600
--- bind9-9.9.5.dfsg.orig/debian/bind9.apport
+++ bind9-9.9.5.dfsg/debian/bind9.apport
@@ -0,0 +1,36 @@
+#!/usr/bin/python
+
+'''apport hook for bind9
+
+(c) 2010 Andres Rodriguez.
+Author: Andres Rodriguez <andreserl@ubuntu.com>
+
+This program is free software; you can redistribute it and/or modify it
+under the terms of the GNU General Public License as published by the
+Free Software Foundation; either version 2 of the License, or (at your
+option) any later version.  See http://www.gnu.org/copyleft/gpl.html for
+the full text of the license.
+'''
+
+from apport.hookutils import *
+import re
+
+def add_info(report, ui):
+    response = ui.yesno("The contents of your /etc/bind/named.conf file "
+                        "may help developers diagnose your bug more "
+                        "quickly.  However, it may contain sensitive "
+                        "information.  Do you want to include it in your "
+                        "bug report?")
+
+    if response == None: # user cancelled
+        raise StopIteration
+    elif response == True:
+        attach_conffiles(report,'bind9')
+
+    # getting syslog stuff
+    report['SyslogBind9'] = recent_syslog(re.compile(r'named\['))
+
+    # Attaching related packages info
+    attach_related_packages(report, ['bind9utils', 'apparmor'])
+
+    attach_mac_events(report, '/usr/sbin/named')
--- bind9-9.9.5.dfsg.orig/debian/bind9.config
+++ bind9-9.9.5.dfsg/debian/bind9.config
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+set -e 
+
+. /usr/share/debconf/confmodule
+
+db_input low bind9/start-as-user || true
+db_go
+
+db_input low bind9/different-configuration-file || true
+db_go
+
+db_input low bind9/run-resolvconf || true
+db_go
--- bind9-9.9.5.dfsg.orig/debian/bind9.dirs
+++ bind9-9.9.5.dfsg/debian/bind9.dirs
@@ -0,0 +1,13 @@
+etc/ufw/applications.d
+etc/apparmor.d/force-complain
+etc/apparmor.d/local
+etc/bind
+usr/bin
+usr/sbin
+var/cache/bind
+var/run/named
+usr/share/bind9
+etc/ppp/ip-up.d
+etc/ppp/ip-down.d
+etc/network/if-up.d
+etc/network/if-down.d
--- bind9-9.9.5.dfsg.orig/debian/bind9.docs
+++ bind9-9.9.5.dfsg/debian/bind9.docs
@@ -0,0 +1,2 @@
+FAQ
+README
--- bind9-9.9.5.dfsg.orig/debian/bind9.init
+++ bind9-9.9.5.dfsg/debian/bind9.init
@@ -0,0 +1,145 @@
+#!/bin/sh -e
+
+### BEGIN INIT INFO
+# Provides:          bind9
+# Required-Start:    $remote_fs
+# Required-Stop:     $remote_fs
+# Should-Start:      $network $syslog
+# Should-Stop:       $network $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start and stop bind9
+# Description:       bind9 is a Domain Name Server (DNS)
+#        which translates ip addresses to and from internet names
+### END INIT INFO
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+
+# for a chrooted server: "-u bind -t /var/lib/named"
+# Don't modify this line, change or create /etc/default/bind9.
+OPTIONS=""
+RESOLVCONF=no
+
+test -f /etc/default/bind9 && . /etc/default/bind9
+
+test -x /usr/sbin/rndc || exit 0
+
+. /lib/lsb/init-functions
+PIDFILE=/var/run/named/named.pid
+
+check_network() {
+    if [ -x /usr/bin/uname ] && [ "X$(/usr/bin/uname -o)" = XSolaris ]; then
+	IFCONFIG_OPTS="-au"
+    else
+	IFCONFIG_OPTS=""
+    fi
+    if [ -z "$(/sbin/ifconfig $IFCONFIG_OPTS)" ]; then
+       #log_action_msg "No networks configured."
+       return 1
+    fi
+    return 0
+}
+
+case "$1" in
+    start)
+	log_daemon_msg "Starting domain name service..." "bind9"
+
+	modprobe capability >/dev/null 2>&1 || true
+
+	# dirs under /var/run can go away on reboots.
+	mkdir -p /var/run/named
+	chmod 775 /var/run/named
+	chown root:bind /var/run/named >/dev/null 2>&1 || true
+
+	if [ ! -x /usr/sbin/named ]; then
+	    log_action_msg "named binary missing - not starting"
+	    log_end_msg 1
+	fi
+
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    log_end_msg 1
+	fi
+
+	if start-stop-daemon --start --oknodo --quiet --exec /usr/sbin/named \
+		--pidfile ${PIDFILE} -- $OPTIONS; then
+	    if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then
+		echo "nameserver 127.0.0.1" | /sbin/resolvconf -a lo.named
+	    fi
+	    log_end_msg 0
+	else
+	    log_end_msg 1
+	fi
+    ;;
+
+    stop)
+	log_daemon_msg "Stopping domain name service..." "bind9"
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    log_end_msg 1
+	fi
+
+	if [ "X$RESOLVCONF" != "Xno" ] && [ -x /sbin/resolvconf ] ; then
+	    /sbin/resolvconf -d lo.named
+	fi
+	pid=$(/usr/sbin/rndc stop -p | awk '/^pid:/ {print $2}') || true
+	if [ -z "$pid" ]; then		# no pid found, so either not running, or error
+	    pid=$(pgrep -f ^/usr/sbin/named) || true
+	    start-stop-daemon --stop --oknodo --quiet --exec /usr/sbin/named \
+		    --pidfile ${PIDFILE} -- $OPTIONS
+	fi
+	if [ -n "$pid" ]; then
+	    sig=0
+	    n=1
+	    while kill -$sig $pid 2>/dev/null; do
+		if [ $n -eq 1 ]; then
+		    echo "waiting for pid $pid to die"
+		fi
+		if [ $n -eq 11 ]; then
+		    echo "giving up on pid $pid with kill -0; trying -9"
+		    sig=9
+		fi
+		if [ $n -gt 20 ]; then
+		    echo "giving up on pid $pid"
+		    break
+		fi
+		n=$(($n+1))
+		sleep 1
+	    done
+	fi
+	log_end_msg 0
+    ;;
+
+    reload|force-reload)
+	log_daemon_msg "Reloading domain name service..." "bind9"
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    log_end_msg 1
+	fi
+
+	/usr/sbin/rndc reload >/dev/null && log_end_msg 0 || log_end_msg 1
+    ;;
+
+    restart)
+	if ! check_network; then
+	    log_action_msg "no networks configured"
+	    exit 1
+	fi
+
+	$0 stop
+	$0 start
+    ;;
+    
+    status)
+    	ret=0
+	status_of_proc -p ${PIDFILE} /usr/sbin/named bind9 2>/dev/null || ret=$?
+	exit $ret
+	;;
+
+    *)
+	log_action_msg "Usage: /etc/init.d/bind9 {start|stop|reload|restart|force-reload|status}"
+	exit 1
+    ;;
+esac
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/bind9.postinst
+++ bind9-9.9.5.dfsg/debian/bind9.postinst
@@ -0,0 +1,169 @@
+#!/bin/sh
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+if [ "$1" = configure ]; then
+    lastversion="$2";
+
+    # lets give them a bind user/group in all cases.
+    getent group bind >/dev/null 2>&1 || addgroup --system bind
+    getent passwd bind >/dev/null 2>&1 ||
+	adduser --system --home /var/cache/bind --no-create-home \
+		--disabled-password --ingroup bind bind
+
+    if [ -z "$lastversion" ] || dpkg --compare-versions "$lastversion" lt 1:9.4.2-2 ; then
+	mkdir -p /var/lib/bind
+	chown root:bind /var/lib/bind
+	chmod 775 /var/lib/bind
+    fi
+
+    if [ ! -s /etc/bind/rndc.key ] && [ ! -s /etc/bind/rndc.conf ]; then
+	rndc-confgen -r /dev/urandom -a
+    fi
+
+    # no sumfile means you get the default
+    [ -f /var/lib/bind/bind9-default.md5sum ] || 
+        echo "2cfcfb7bf1b99c7930fd475907e38be7  /etc/default/bind9" > /var/lib/bind/bind9-default.md5sum
+
+    if [ -f /etc/default/bind9 ] && \
+       [ "$(cat /var/lib/bind/bind9-default.md5sum)" = "$(md5sum /etc/default/bind9)" ]; then
+        config="/etc/default/bind9"
+    elif [ ! -e /etc/default/bind9 ]; then
+        config="/etc/default/bind9"
+    else 
+        config="/etc/default/bind9.dpkg-dist"
+    fi
+
+    
+    # On a fresh install, or if we are upgrading from pre-9.8, think about dnssec
+    if [ -z "$lastversion" ] || dpkg --compare-versions "$lastversion" lt 1:9.8.1.dfsg-1 ; then
+	UPDATE_OPTS="n"
+	if [ -f /etc/bind/named.conf.options ]; then
+	    case $(md5sum /etc/bind/named.conf.options | sed 's/ .*$//') in
+		d6b678ac90fd6ab163d74dfe5d68c2c9)	UPDATE_OPTS=y;;	 # 9.4.2ish
+		0367900f381d5c83cf34009440f3d211)	UPDATE_OPTS=y;;	 # 9.6 and later
+		56919cbc0d819c9a303a8bdeb306b5f1)	UPDATE_OPTS=ok;; # 9.8
+	    esac
+	    case $UPDATE_OPTS in
+		y)
+		    echo Updating named.conf.options to include DNSSEC enablement
+		    cp /usr/share/bind9/named.conf.options /etc/bind/named.conf.options
+		    chmod 644 /etc/bind/named.conf.options
+		    ;;
+		n)
+		    echo NOT updating named.conf.options to include DNSSEC enablement
+		    ;;
+	    esac
+	else
+	    cp /usr/share/bind9/named.conf.options /etc/bind/named.conf.options
+	    chmod 644 /etc/bind/named.conf.options
+	fi
+    fi
+
+    localconf=""
+    if [ ! -f $config ]; then
+	CONF=/etc/bind/named.conf
+	for file in ${CONF} ${CONF}.local ${CONF}.default-zones; do
+	    if [ -f ${file} ]; then
+		theirs=$(md5sum $file | sed 's/ .*$//')
+		mine=$(dpkg --status bind9 | grep "^ $file " | sed -n 's/.* //p')
+		if [ "$mine" != "$theirs" ]; then
+		    localconf="y"
+		fi
+	    else
+		localconf="y"
+	    fi
+	done
+	if [ -n "$localconf" ]; then
+                db_reset bind9/start-as-user
+	else
+                db_set bind9/start-as-user bind || true
+	fi
+   
+        echo '#' 
+        echo '# run resolvconf?' >> $config
+        db_get bind9/run-resolvconf
+        if [ ! -z "$RET" ] && [ "$RET" = "true" ]; then
+                echo "RESOLVCONF=yes" >> $config
+        else
+                echo "RESOLVCONF=no" >> $config
+        fi
+
+        db_get bind9/start-as-user
+        USER=$RET
+        db_get bind9/different-configuration-file
+        CONFFILE=$RET
+        
+        echo '' >> $config
+        echo '# startup options for the server' >> $config
+        if [ ! -z "$USER" ] && [ ! -z "$CONFFILE" ]; then
+                echo "OPTIONS=\"-u $USER -c $CONFFILE\"" >> $config
+        elif [ ! -z "$USER" ]; then
+                echo "OPTIONS=\"-u $USER\"" >> $config
+        elif [ ! -z "$CONFFILE" ]; then
+                echo "OPTIONS=\"-c $CONFFILE\"" >> $config
+        else
+                echo "OPTIONS=\"\"" >> $config
+        fi
+    else
+        db_get bind9/run-resolvconf
+         if [ ! -z "$RET" ] && [ "$RET" = "true" ]; then
+	        sed -e "s#^\([[:space:]]*\)\(RESOLVCONF=[[:space:]]*\)[^ ]*#\1\2yes#g" -i $config
+        else
+	        sed -e "s#^\([[:space:]]*\)\(RESOLVCONF=[[:space:]]*\)[^ ]*#\1\2no#g" -i $config
+        fi
+        db_get bind9/start-as-user
+        if [ ! -z "$RET" ]; then
+            if [ ! -z "`grep OPTIONS $config`" ]; then
+                if [ ! -z "`grep OPTIONS $config | grep '\-u'`" ]; then
+                        sed -e "s#\([[:space:]]*OPTIONS[[:space:]]*\)=\"\([^\"]*\)-u[[:space:]]*[^\" ]*\([^\"]*\)\"#\1=\"\2-u $RET\3\"#g" -i $config
+                else 
+                        sed -e "s#\([[:space:]]*OPTIONS[[:space:]]*\)=\"\([^\"]*\)\"#\1=\"\2 -u $RET\"#g" -i $config
+                fi
+            else
+                echo "OPTIONS=\"-u $RET\""
+            fi
+        fi
+        db_get bind9/different-configuration-file
+        if [ ! -z "$RET" ]; then
+            if [ ! -z "`grep OPTIONS $config | grep '\-c'`" ]; then
+                sed -e "s#\([[:space:]]*OPTIONS[[:space:]]*\)=\"\([^\"]*\)-c[[:space:]]*[^\" ]*\([^\"]*\)\"#\1=\"\2-c $RET\3\"#g" -i $config
+            else 
+                sed -e "s#\([[:space:]]*OPTIONS[[:space:]]*\)=\"\([^\"]*\)\"#\1=\"\2 -c $RET\"#g" -i $config
+            fi
+        fi
+    fi
+
+    if [ "$config" = "/etc/default/bind9" ]; then
+        md5sum /etc/default/bind9 > /var/lib/bind/bind9-default.md5sum
+    fi
+
+    uid=$(ls -ln /etc/bind/rndc.key | awk '{print $3}')
+    if [ "$uid" = "0" ]; then
+	[ -n "$localconf" ] || chown bind /etc/bind/rndc.key
+	chgrp bind /etc/bind
+	chmod g+s /etc/bind
+	chgrp bind /etc/bind/rndc.key /var/cache/bind
+	chgrp bind /etc/bind/named.conf* || true
+	chmod g+r /etc/bind/rndc.key /etc/bind/named.conf* || true
+	chmod g+rwx /var/cache/bind
+    fi
+
+    # Reload AppArmor profile
+    APP_PROFILE="/etc/apparmor.d/usr.sbin.named"
+    if [ -f "$APP_PROFILE" ] && aa-status --enabled 2>/dev/null; then
+        apparmor_parser -r "$APP_PROFILE" || true
+    fi
+
+    if pidof /usr/sbin/named >/dev/null 2>&1; then
+	invoke-rc.d bind9 restart
+    else
+    	invoke-rc.d bind9 start
+    fi
+fi
+
+db_stop
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/bind9.postrm
+++ bind9-9.9.5.dfsg/debian/bind9.postrm
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+#DEBHELPER#
+
+if [ "$1" = "purge" ]; then
+	rm -f /etc/bind/rndc.key /etc/bind/named.conf.options /etc/default/bind9
+	rmdir /etc/bind >/dev/null 2>&1 || true
+	rm -f /etc/apparmor.d/force-complain/usr.sbin.named >/dev/null 2>&1 || true
+	rm -f /var/lib/bind/bind9-default.md5sum
+	rmdir /var/lib/bind
+	# delete bind daemon user, if it exists
+	if getent passwd bind > /dev/null ; then
+	    echo "Deleting bind user"
+	    deluser  --quiet bind > /dev/null || true
+	fi
+fi
--- bind9-9.9.5.dfsg.orig/debian/bind9.preinst
+++ bind9-9.9.5.dfsg/debian/bind9.preinst
@@ -0,0 +1,44 @@
+#!/bin/sh
+# pre install script for the Debian bind9 package
+
+set -e
+
+# Check if we are upgrading while running a kernel before 2.2.18. If so abort
+# immediately since we don't support those kernels anymore.
+if [ "$1" = "upgrade" ] && dpkg --compare-versions "`uname -r`" lt 2.2.18 ; then
+        cat <<EOF
+ERROR: you are running a pre-2.2.18 kernel on this machine. Recent
+versions of bind9 no longer support those kernels.
+To prevent breaking nameservices on this system bind9 upgrade will abort.
+EOF
+        exit 1
+fi
+
+APP_PROFILE="usr.sbin.named"
+APP_CONFFILE="/etc/apparmor.d/$APP_PROFILE"
+APP_COMPLAIN="/etc/apparmor.d/force-complain/$APP_PROFILE"
+if [ "$1" = "upgrade" ]; then
+    mkdir -p `dirname $APP_COMPLAIN` 2>/dev/null || true
+    if dpkg --compare-versions $2 lt 1:9.3.4-2ubuntu2 ; then
+        # force-complain for pre-apparmor upgrades
+        ln -sf $APP_CONFFILE $APP_COMPLAIN
+    elif dpkg --compare-versions $2 lt 1:9.4.2-3ubuntu1 ; then
+        if [ -e "$APP_CONFFILE" ]; then
+            md5sum="`md5sum \"$APP_CONFFILE\" | sed -e \"s/ .*//\"`"
+            pkg_md5sum="`sed -n -e \"/^Conffiles:/,/^[^ ]/{\\\\' $APP_CONFFILE'{s/.* //;p}}\" /var/lib/dpkg/status`"
+            if [ "$md5sum" = "$pkg_md5sum" ]; then
+		# force-complain when upgrade from pre-shipped profile and an existing
+                # profile is same as in conffiles
+                ln -sf $APP_CONFFILE $APP_COMPLAIN
+            fi
+        else
+            # force-complain on upgrade from pre-shipped profile and
+            # there is no existing profile
+            ln -sf $APP_CONFFILE $APP_COMPLAIN
+        fi
+    fi
+fi
+
+
+#DEBHELPER#
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/bind9.prerm
+++ bind9-9.9.5.dfsg/debian/bind9.prerm
@@ -0,0 +1,30 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    remove)
+	# if bind is running, stop it before removing
+	if pidof named >/dev/null 2>&1; then
+		# test if invoke-rc.d command is present on this system
+		if command -v invoke-rc.d >/dev/null 2>&1; then
+		    invoke-rc.d bind9 stop
+		# if really not, use initscript
+		else
+		    /etc/init.d/bind9 stop
+		fi
+	fi
+    ;;
+
+    upgrade)
+	# leave bind running during the upgrade
+    ;;
+
+    *)
+	echo "prerm called with unknown argument \`$1'" >&2
+	exit 1
+    ;;
+esac
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/bind9.service
+++ bind9-9.9.5.dfsg/debian/bind9.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=BIND Domain Name Server
+Documentation=man:named(8)
+After=network.target
+
+[Service]
+ExecStart=/usr/sbin/named -f -u bind
+ExecReload=/usr/sbin/rndc reload
+ExecStop=/usr/sbin/rndc stop
+
+[Install]
+WantedBy=multi-user.target
--- bind9-9.9.5.dfsg.orig/debian/bind9.tmpfile
+++ bind9-9.9.5.dfsg/debian/bind9.tmpfile
@@ -0,0 +1 @@
+d /run/named 0775 root bind - -
--- bind9-9.9.5.dfsg.orig/debian/bind9.ufw.profile
+++ bind9-9.9.5.dfsg/debian/bind9.ufw.profile
@@ -0,0 +1,5 @@
+[Bind9]
+title=Internet Domain Name Server
+description=The Berkeley Internet Name Domain (BIND) implements an Internet domain name server.
+ports=53
+
--- bind9-9.9.5.dfsg.orig/debian/bind9utils.dirs
+++ bind9-9.9.5.dfsg/debian/bind9utils.dirs
@@ -0,0 +1,3 @@
+usr
+usr/sbin
+usr/share/man/man8
--- bind9-9.9.5.dfsg.orig/debian/bind9utils.install
+++ bind9-9.9.5.dfsg/debian/bind9utils.install
@@ -0,0 +1,27 @@
+usr/sbin/dnssec-checkds
+usr/sbin/dnssec-coverage
+usr/sbin/dnssec-dsfromkey
+usr/sbin/dnssec-keyfromlabel
+usr/sbin/dnssec-keygen
+usr/sbin/dnssec-revoke
+usr/sbin/dnssec-settime
+usr/sbin/dnssec-signzone
+usr/sbin/dnssec-verify
+usr/sbin/named-checkconf
+usr/sbin/named-checkzone
+usr/sbin/named-compilezone
+usr/sbin/rndc
+usr/sbin/rndc-confgen
+usr/share/man/man8/dnssec-checkds.8
+usr/share/man/man8/dnssec-dsfromkey.8
+usr/share/man/man8/dnssec-keyfromlabel.8
+usr/share/man/man8/dnssec-keygen.8
+usr/share/man/man8/dnssec-revoke.8
+usr/share/man/man8/dnssec-settime.8
+usr/share/man/man8/dnssec-signzone.8
+usr/share/man/man8/dnssec-verify.8
+usr/share/man/man8/named-checkconf.8
+usr/share/man/man8/named-checkzone.8
+usr/share/man/man8/named-compilezone.8
+usr/share/man/man8/rndc-confgen.8
+usr/share/man/man8/rndc.8
--- bind9-9.9.5.dfsg.orig/debian/changelog
+++ bind9-9.9.5.dfsg/debian/changelog
@@ -0,0 +1,2264 @@
+bind9 (1:9.9.5.dfsg-9+deb8u12) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Add patch to fix CVE-2017-3042 and CVE-2017-3043
+    CVE-2017-3042: error in TSIG authentication can permit unauthorized zone
+    transfers. An attacker may be able to circumvent TSIG authentication of
+    AXFR and Notify requests.
+    CVE-2017-3043: error in TSIG authentication can permit unauthorized
+    dynamic updates. An attacker may be able to forge a valid TSIG or SIG(0)
+    signature for a dynamic update.
+
+ -- Yves-Alexis Perez <corsac@debian.org>  Fri, 30 Jun 2017 18:10:30 +0200
+
+bind9 (1:9.9.5.dfsg-9+deb8u11) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Dns64 with "break-dnssec yes;" can result in a assertion failure.
+    (CVE-2017-3136) (Closes: #860224)
+  * Prerequisite for CVE-2017-3137 cherry-picked from upstream change #4190.
+    If not cherry-picking this change the fix for CVE-2017-3137 can cause an
+    assertion failure to appear in name.c.
+  * Some chaining (CNAME or DNAME) responses to upstream queries could trigger
+    assertion failures (CVE-2017-3137) (Closes: #860225)
+  * Reimplement: Some chaining (CNAME or DNAME) responses to upstream queries
+    could trigger assertion failures. (CVE-2017-3137)
+  * Fix regression introduced when handling CNAME to referral below the
+    current domain
+  * 'rndc ""' could trigger a assertion failure in named. (CVE-2017-3138)
+    (Closes: #860226)
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Thu, 11 May 2017 08:39:19 +0200
+
+bind9 (1:9.9.5.dfsg-9+deb8u10) jessie-security; urgency=medium
+
+  * Fix regression caused by the fix for CVE-2016-8864 (closes: #855540).
+  * Fix CVE-2017-3135: a malicously crafted query can cause named to crash if
+    both DNS64 and RPZ are being used (closes: #855520).
+
+ -- Michael Gilbert <mgilbert@debian.org>  Sun, 26 Feb 2017 00:03:04 +0000
+
+bind9 (1:9.9.5.dfsg-9+deb8u9) jessie-security; urgency=medium
+
+  * Apply patches from ISC.
+  * CVE-2016-9131: Assertion failure related to caching of TKEY records
+    in upstream DNS responses.
+  * CVE-2016-9147: Processing of RRSIG records in upstream DNS response
+    without corresponding signed data could lead to an assertion failure.
+  * CVE-2016-9444: Missing RRSIG records in the authority section of
+    upstream responses could lead to an assertion failure.
+  * RT #43779: Fix handling of CNAME/DNAME responses.  (Regression due
+    to the CVE-2016-8864 fix.)
+
+ -- Florian Weimer <fw@deneb.enyo.de>  Wed, 11 Jan 2017 11:50:31 +0100
+
+bind9 (1:9.9.5.dfsg-9+deb8u8) jessie-security; urgency=medium
+
+  * CVE-2016-8864: Fix assertion failure in DNAME processing with patch
+    provided by ISC.
+
+ -- Florian Weimer <fw@deneb.enyo.de>  Tue, 01 Nov 2016 17:51:22 +0100
+
+bind9 (1:9.9.5.dfsg-9+deb8u7) jessie-security; urgency=high
+
+  * CVE-2016-2775: lwresd crash with long query name.
+    Backport of upstream commit 38cc2d14e218e536e0102fa70deef99461354232.
+    Closes: #831796.
+  * CVE-2016-2776: assertion failure due to unspecified crafted query.
+    Fix based on 43139-9-9.patch from ISC.  Closes: #839010.
+
+ -- Florian Weimer <fw@deneb.enyo.de>  Tue, 27 Sep 2016 19:46:00 +0200
+
+bind9 (1:9.9.5.dfsg-9+deb8u6) jessie-security; urgency=high
+
+  * Fix CVE-2016-1285: error parsing control channel input.
+  * Fix CVE-2016-1286: error parsing DNAME resource records.
+
+ -- Michael Gilbert <mgilbert@debian.org>  Tue, 08 Mar 2016 00:40:53 +0000
+
+bind9 (1:9.9.5.dfsg-9+deb8u5) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * CVE-2015-8704: Specific APL data could trigger an INSIST in apl_42.c.
+    A buffer size check used to guard against overflow could cause named to
+    exit with an INSIST failure In apl_42.c.
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 16 Jan 2016 10:51:37 +0100
+
+bind9 (1:9.9.5.dfsg-9+deb8u4) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Add patch to fix CVE-2015-8000.
+    CVE-2015-8000: Insufficient testing when parsing a message allowed
+    records with an incorrect class to be be accepted, triggering a REQUIRE
+    failure when those records were subsequently cached.
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 14 Dec 2015 20:02:04 +0100
+
+bind9 (1:9.9.5.dfsg-9+deb8u3) jessie-security; urgency=medium
+
+  * CVE-2015-5722
+
+ -- Moritz Muehlenhoff <jmm@debian.org>  Wed, 02 Sep 2015 13:11:02 +0000
+
+bind9 (1:9.9.5.dfsg-9+deb8u2) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * CVE-2015-5477: A failure to reset a value to NULL in tkey.c could
+    result in an assertion failure.
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Mon, 27 Jul 2015 21:06:05 +0200
+
+bind9 (1:9.9.5.dfsg-9+deb8u1) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * CVE-2015-4620: Specially constructed zone data can cause a resolver to
+    crash when validating.
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 30 Jun 2015 17:21:49 +0200
+
+bind9 (1:9.9.5.dfsg-9) unstable; urgency=high
+
+  * Fix CVE-2015-1349: named crash due to managed key rollover, primarily only
+    affecting setups using DNSSEC (closes: #778733).
+
+ -- Michael Gilbert <mgilbert@debian.org>  Thu, 19 Feb 2015 03:42:21 +0000
+
+bind9 (1:9.9.5.dfsg-8) unstable; urgency=medium
+
+  * Launch rndc command in the background in networking scripts to avoid a
+    hang in named from bringing down the entire network (closes: #760555).
+
+ -- Michael Gilbert <mgilbert@debian.org>  Thu, 01 Jan 2015 17:51:52 +0000
+
+bind9 (1:9.9.5.dfsg-7) unstable; urgency=medium
+
+  * Fix CVE-2014-8500: limit recursion in order to avoid memory consuption
+    issues that can lead to denial-of-service (closes: #772610).
+
+ -- Michael Gilbert <mgilbert@debian.org>  Sun, 14 Dec 2014 05:05:48 +0000
+
+bind9 (1:9.9.5.dfsg-6) unstable; urgency=medium
+
+  * Include dlz_dlopen.h in libbind-dev (closes: #769117).
+
+ -- Michael Gilbert <mgilbert@debian.org>  Sun, 30 Nov 2014 22:53:50 +0000
+
+bind9 (1:9.9.5.dfsg-5) unstable; urgency=medium
+
+  * Avoid libnsl dependency on non-linux architectures.  Closes: #766430
+  * Install export libraries to /lib instead of /usr/lib.  Closes: #766544
+  * Add myself to the maintainer team with approval from LaMont and Bdale.
+
+ -- Michael Gilbert <mgilbert@debian.org>  Thu, 30 Oct 2014 02:42:17 +0000
+
+bind9 (1:9.9.5.dfsg-4.3) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Mark critical section as not parallel in the makefile.  Closes: #762766
+
+ -- Michael Gilbert <mgilbert@debian.org>  Mon, 13 Oct 2014 04:37:55 +0000
+
+bind9 (1:9.9.5.dfsg-4.2) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Fix intermittent parallel build failure.  Closes: #762766
+  * Set -fno-delete-null-pointer-checks.  Closes: #750760
+  * Use separate packages for the udebs.  Closes: #762762
+  * Don't install configuration files to /usr.  Closes: #762948
+
+ -- Michael Gilbert <mgilbert@debian.org>  Mon, 06 Oct 2014 01:23:57 +0000
+
+bind9 (1:9.9.5.dfsg-4.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Add support for hurd.  Closes: #746540
+  * Provide shared libraries for isc-dhcp.  Closes: #656150
+
+ -- Michael Gilbert <mgilbert@debian.org>  Sun, 14 Sep 2014 00:58:06 +0000
+
+bind9 (1:9.9.5.dfsg-4) unstable; urgency=low
+
+  [Julien Cristau]
+
+  * FTBFS on kfreebsd.  Closes: #741285
+
+  [LaMont Jones]
+
+  * revert aclocal.m4 expansion from earlier merge
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 29 Apr 2014 14:48:50 -0600
+
+bind9 (1:9.9.5.dfsg-3) unstable; urgency=low
+
+  * Re-enable rrl (now a configure option).  Closes: #741059 LP: #1288823
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 24 Mar 2014 06:55:55 -0600
+
+bind9 (1:9.9.5.dfsg-2) unstable; urgency=low
+
+  * merge in ubuntu 1:9.9.3.dfsg.P2-4ubuntu3
+  * move dnssec-coverage to bind9utils.  Closes: #739994
+  * dnssec-{checkds,verify} manpages in wrong package.  Closes: #739995
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 26 Feb 2014 09:30:31 -0700
+
+bind9 (1:9.9.5.dfsg-1) experimental; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * New upstream version: 9.9.5  Closes: #735190
+
+  [Martin Nagy]
+
+  * dynamic loading of database backends. See:
+    http://pkgs.fedoraproject.org/cgit/bind.git/tree/bind-96-dyndb.patch. 
+    Closes: #722669
+
+  [LaMont Jones]
+
+  * fix sonames
+  * merge ubuntu changes
+  * Deliver dns/rrl.h.  Closes: #724844
+  * rules tweak to make backports to pre-dh-systemd releases easier
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 11 Feb 2014 09:16:05 -0700
+
+bind9 (1:9.9.4.dfsg-0.3) experimental; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * Upstream version 9.9.4
+
+  [LaMont Jones]
+
+  * fix sonames
+  * merge ubuntu change
+  * Deliver dns/rrl.h.  Closes: #724844
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 06 Nov 2013 13:27:37 -0700
+
+bind9 (1:9.9.3.dfsg.P2-4ubuntu3) trusty; urgency=low
+
+  * SECURITY UPDATE: denial of service when processing NSEC3-signed zone
+    queries
+    - debian/patches/CVE-2014-0591.patch: don't call memcpy with
+      overlapping ranges in bin/named/query.c.
+    - patch backported from 9.9.4-P2.
+    - CVE-2014-0591
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 10 Jan 2014 09:36:55 -0500
+
+bind9 (1:9.9.3.dfsg.P2-4ubuntu2) trusty; urgency=medium
+
+  * Use dh-autoreconf to update libtool and configure for new ports.
+
+ -- Adam Conrad <adconrad@ubuntu.com>  Wed, 18 Dec 2013 04:42:22 -0700
+
+bind9 (1:9.9.3.dfsg.P2-4ubuntu1) saucy; urgency=low
+
+  * Use dh_autotools-dev to update config.{sub,guess} for new ports.
+
+ -- Adam Conrad <adconrad@ubuntu.com>  Mon, 07 Oct 2013 23:09:45 -0600
+
+bind9 (1:9.9.3.dfsg.P2-4) unstable; urgency=low
+
+  [Peter Marschall]
+
+  * If rndc.conf exists, skip creation of rndc.key.  Closes: #620394
+
+  [Al Tarakanoff]
+
+  * properly quote check of pid in bind9 init.d.  LP: #1092243
+
+  [LaMont Jones]
+
+  * include distro and package version in version string
+  * apparmor: allow GeoIP data file access.  LP: #834901
+  * enable filter-aaaa.  Closes: #701704  LP: #1115168
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 29 Aug 2013 16:22:29 -0600
+
+bind9 (1:9.9.3.dfsg.P2-3) unstable; urgency=low
+
+  [Michael Stapelberg]
+
+  * add systemd service file.  Closes: #718212
+
+  [LaMont Jones]
+
+  * deliver more dnssec-* tools in bind9utils.  Closes: #713026
+  * support parallel=N DEB_BUILD_OPTIONS, fix -j build. Closes: #713025
+  * deliver rrl.h and stat.h Closes: #692483, #720813
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 27 Aug 2013 10:06:37 -0600
+
+bind9 (1:9.9.3.dfsg.P2-2build1) saucy; urgency=low
+
+  [Marc Deslauriers]
+
+  * 9.9.2.dfsg.P1-2ubuntu1: fixed in 9.9.3b1
+  * 9.9.2.dfsg.P1-2ubuntu3: fixed in 9.9.3-P2
+
+  [Robie Basak]
+
+  * 9.9.2.dfsg.P1-2ubuntu2: fixed in 9.9.3b1
+
+  [LaMont Jones]
+
+  * Merge ubuntu changes, except: autoconf files are generated as part
+    of the source packagee creation, not on the build host.  NAK
+  * deliver more dnssec-* tools in bind9utils.  Closes: #713026
+  * support parallel=N DEB_BUILD_OPTIONS, fix -j build
+
+  [Michael Stapelberg]
+
+  * add systemd service file.  Closes: #718212
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 22 Aug 2013 10:57:17 -0600
+
+bind9 (1:9.9.3.dfsg.P2-2) unstable; urgency=low
+
+  * ack NMUs of 9.8.4
+    - upstream 9.9.3-P2 fixes: CVE-2013-4854, CVE-2012-5689,
+      CVE-2013-2266
+    - deliver rrl.h
+
+  [LaMont Jones]
+
+  * Use ISC's bin/tests
+  * Diff cleanup and rationalization to 9.9.3 upstream
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 17 Aug 2013 07:09:54 -0600
+
+bind9 (1:9.9.3.dfsg.P2-1) unstable; urgency=low
+
+
+  [Internet Software Consortium, Inc]
+
+  * 9.9.3-P2
+
+  [Ben Hutchings]
+
+  * Initialise OpenSSL before calling chroot().  Closes: #696661
+
+  [LaMont Jones]
+
+  * soname changes
+
+  [Paul Vixie]
+
+  * Reapply rpz/rrl patches from http://www.redbarn.org/dns/ratelimits
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 14 Aug 2013 10:38:59 -0600
+
+bind9 (1:9.9.2.dfsg.P1-3) experimental; urgency=low
+
+  [LaMont Jones]
+  
+  * Merge 1:9.8.4.dfsg.P1-6
+
+  [Ben Hutchings]
+
+  * Initialise OpenSSL before calling chroot().  Closes: #696661
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 04 Mar 2013 09:30:50 -0700
+
+bind9 (1:9.9.2.dfsg.P1-2ubuntu3) saucy; urgency=low
+
+  * SECURITY UPDATE: denial of service via incorrect bounds checking on
+    private type 'keydata'
+    - lib/dns/rdata/generic/keydata_65533.c: check for correct length.
+    - Patch backported from 9.9.3-P2
+    - CVE-2013-4854
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sun, 28 Jul 2013 10:13:06 -0400
+
+bind9 (1:9.9.2.dfsg.P1-2ubuntu2) raring; urgency=low
+
+  * configure.in: detect libxml 2.9 as well as 2.[678] (LP: #1164475). 
+  * debian/control: add Build-Depends on dh-autoreconf.
+  * debian/rules: use dh_autoreconf and dh_autoreconf_clean.
+
+ -- Robie Basak <robie.basak@canonical.com>  Wed, 10 Apr 2013 16:50:28 +0000
+
+bind9 (1:9.9.2.dfsg.P1-2ubuntu1) raring; urgency=low
+
+  * SECURITY UPDATE: denial of service via regex syntax checking
+    - configure,configure.in,config.h.in: remove check for regex.h to
+      disable regex syntax checking.
+    - CVE-2013-2266
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 28 Mar 2013 15:04:57 -0400
+
+bind9 (1:9.9.2.dfsg.P1-2) experimental; urgency=low
+
+  [Michael Gilbert]
+
+  * Use /var/lib/bind for state file.  Closes: #689332
+
+  [LaMont Jones]
+
+  * zone transfers now involve link(), update the apparmor profile
+  * Update db.root with new IP for D.root-servers.net.  Closes: #697352
+  * re-drop dlzexternal test
+  * Reduce log level for "sucessfully validated after lower casing" dnssec
+    based on mail from Mark Andrews.  Closes: #697681
+  * remove /var/lib/bind/bind9-default.md5sum in postrm
+  * remove /etc/bind/named.conf.options on purge.  Closes: #668801
+
+  [Sebastian Wiesinger]
+
+  * Build and deliver dnssec-checkds and dnssec-verify in bind9utils
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 09 Jan 2013 10:09:40 -0700
+
+bind9 (1:9.8.4.dfsg.P1-6+nmu3) unstable; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * CVE-2013-4854: A specially crafted query that includes malformed rdata can
+    cause named to terminate with an assertion failure while rejecting the
+    malformed query. (Closes: #717936).
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 27 Jul 2013 10:24:07 +0200
+
+bind9 (1:9.8.4.dfsg.P1-6+nmu2) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Install /usr/include/dns/rrl.h (closes: #699834).
+
+ -- Michael Gilbert <mgilbert@debian.org>  Tue, 16 Apr 2013 01:59:05 +0000
+
+bind9 (1:9.8.4.dfsg.P1-6+nmu1) unstable; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Fix cve-2012-5689: issue in nameservers using DNS64 to perform a AAAA
+    lookup for a record with an A record overwrite rule in a Response Policy
+    Zone (closes: #699145).
+  * Fix cve-2013-2266: issues in regular expression handling (closes: #704174).
+
+ -- Michael Gilbert <mgilbert@debian.org>  Fri, 29 Mar 2013 00:47:25 +0000
+
+bind9 (1:9.8.4.dfsg.P1-6) unstable; urgency=low
+
+  [Ben Hutchings]
+
+  * Initialise OpenSSL before calling chroot().  Closes: #696661
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 01 Mar 2013 08:23:27 -0700
+
+bind9 (1:9.8.4.dfsg.P1-5) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * Properly acknowledge 1:9.8.1.dfsg.P1-4.4: [Philipp Kern]
+    - Fix CVE-2012-4244. Thanks to Moritz Mühlenhoff for providing the patch.
+
+  [Paul Vixie]
+
+  * Include rpz/rrl patches from http://www.redbarn.org/dns/ratelimits. 
+    Closes: #698641
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 30 Jan 2013 14:04:35 -0700
+
+bind9 (1:9.8.4.dfsg.P1-4) unstable; urgency=high
+
+  * The rest of the dnssec validation logspam removal.  Closes: #697681
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 21 Jan 2013 13:18:53 -0700
+
+bind9 (1:9.8.4.dfsg.P1-3) unstable; urgency=low
+
+  [Marc Deslauriers]
+
+  * debian/bind9.apport: Add AppArmor info and logs to apport hook.
+
+  [LaMont Jones]
+
+  * Reduce log level for "sucessfully validated after lower casing" dnssec
+    based on mail from Mark Andrews.  Closes: #697681
+  * remove /var/lib/bind/bind9-default.md5sum in postrm
+  * remove /etc/bind/named.conf.options on purge.  Closes: #668801
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 09 Jan 2013 09:47:24 -0700
+
+bind9 (1:9.9.2.dfsg.P1-1) experimental; urgency=low
+
+  * Named could die on specific queries with dns64 enabled.
+    [Addressed in change #3388 for BIND 9.8.5 and 9.9.3.]
+    CVE-2012-5688  Closes: #695192
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 05 Dec 2012 05:27:18 -0700
+
+bind9 (1:9.8.4.dfsg.P1-2) unstable; urgency=low
+
+  [Michael Gilbert]
+
+  * Use /var/lib/bind for state file.  Closes: #689332
+
+  [LaMont Jones]
+
+  * Re-enable dlopen, do not build the test that fails.  Closes: #692416
+  * Update db.root with new IP for D.root-servers.net.  Closes: #697352
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 07 Jan 2013 06:50:25 -0700
+
+bind9 (1:9.8.4.dfsg.P1-1) unstable; urgency=low
+
+  * Named could die on specific queries with dns64 enabled.
+    [Addressed in change #3388 for BIND 9.8.5 and 9.9.3.]
+    CVE-2012-5688  Closes: #695192
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 05 Dec 2012 05:22:06 -0700
+
+bind9 (1:9.9.2.dfsg-1) experimental; urgency=low
+
+  [Matthew Grant]
+
+  * Turn off dlopen as it was causing test compile failures.
+  * Add missing library .postrm files for debhelper
+
+  [LaMont Jones]
+
+  * New upstream version 9.9.2
+  * soname fixes
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 01 Nov 2012 08:59:57 -0600
+
+bind9 (1:9.9.1.dfsg.P1-1) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * New upstream 9.9.1-P1
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 13 Jun 2012 08:22:15 -0600
+
+bind9 (1:9.9.0.dfsg-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.9.0 release
+
+  [Christoph Egger]
+
+  * define _GNU_SOURCE on kfreebsd et al.  Closes: #658201
+
+  [LaMont Jones]
+
+  * chmod typo in postinst.  LP: #980798
+  * Correctly order debhelper bits in postrm.  Closes: #661040
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 23 Apr 2012 09:52:51 -0600
+
+bind9 (1:9.9.0.dfsg~rc4-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * New upstream release
+
+  [LaMont Jones]
+
+  * soname changes for new release
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 17 Feb 2012 17:51:39 -0700
+
+bind9 (1:9.8.4.dfsg-1ubuntu2) raring; urgency=low
+
+  * SECURITY UPDATE: denial of service via DNS64 and crafted query
+    - bin/named/query.c: init rdataset before cleanup.
+    - Patch backported from 9.8.4-P1
+    - CVE-2012-5688
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 05 Dec 2012 15:42:08 -0500
+
+bind9 (1:9.8.4.dfsg-1ubuntu1) raring; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/bind9.apport: Add AppArmor info and logs to apport hook.
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 23 Nov 2012 08:13:50 -0500
+
+bind9 (1:9.8.4.dfsg-1) unstable; urgency=low
+
+  [Matthew Grant]
+
+  * Turn off dlopen as it was causing test compile failures.
+  * Add missing library .postrm files for debhelper
+
+  [LaMont Jones]
+
+  * New upstream version
+  * soname fixup
+  * Ack NMUs
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 29 Oct 2012 08:37:49 -0600
+
+bind9 (1:9.8.1.dfsg.P1-4.4) testing-proposed-updates; urgency=low
+
+  * Non-maintainer upload.
+  * Fix CVE-2012-4244. Thanks to Moritz Mühlenhoff for providing
+    the patch.
+
+ -- Philipp Kern <pkern@debian.org>  Sat, 03 Nov 2012 20:43:43 +0100
+
+bind9 (1:9.8.1.dfsg.P1-4.3) unstable; urgency=medium
+
+  [ Philipp Kern ]
+  * Non-maintainer upload.
+
+  [ Marc Deslauriers ]
+  * SECURITY UPDATE: denial of service via specific combinations of RDATA
+    - bin/named/query.c: fix logic
+    - Patch backported from 9.8.3-P4
+    - CVE-2012-5166
+
+ -- Philipp Kern <pkern@debian.org>  Sun, 28 Oct 2012 20:28:11 +0100
+
+bind9 (1:9.8.1.dfsg.P1-4.2) unstable; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Fix denial of service vulnerability triggered
+    through an assert because of using bad cache
+    (CVE-2012-3817; Closes: #683259).
+
+ -- Nico Golde <nion@debian.org>  Mon, 30 Jul 2012 20:56:10 +0200
+
+bind9 (1:9.8.1.dfsg.P1-4.1) unstable; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * SECURITY UPDATE: ghost domain names attack
+    - lib/dns/rbtdb.c: Restrict the TTL of NS RRset to no more than that
+      of the old NS RRset when replacing it.
+    - Patch backported from 9.8.2.
+    - CVE-2012-1033
+  * SECURITY UPDATE: denial of service via zero length rdata handling
+    - lib/dns/rdata.c,lib/dns/rdataslab.c: use sentinel pointer for
+      duplicate rdata.
+    - Patch backported from 9.8.3-P1.
+    - CVE-2012-1667
+
+ -- Luk Claes <luk@debian.org>  Wed, 20 Jun 2012 15:26:09 -0400
+
+bind9 (1:9.8.1.dfsg.P1-4) unstable; urgency=low
+
+  [Christoph Egger]
+
+  * define _GNU_SOURCE on kfreebsd et al.  Closes: #658201
+
+  [LaMont Jones]
+
+  * chmod typo in postinst.  LP: #980798
+  * Correctly order debhelper bits in postrm.  Closes: #661040
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 13 Apr 2012 12:09:24 -0600
+
+bind9 (1:9.8.1.dfsg.P1-3) unstable; urgency=low
+
+  [Zlatan Todoric]
+
+  * fixed Serbian latin translation of debconf template.  Closes: #634951
+
+  [Peter Eisentraut]
+
+  * Add support for "status" action to lwresd init script.  Closes: #651540
+
+  [Bjørn Steensrud]
+
+  * NB Translations.  Closes: #654454
+
+  [LaMont Jones]
+
+  * Default to run_resolvconf=false.  LP: #933723
+  * Deliver named.conf.options on fresh install.  Closes: #657042  LP: #920202
+  * Do not deliver /usr/share/bind9/bind9-default.md5sum in the bind9 deb. 
+    Closes: #620007  LP: #681536
+  * Deliver and use /etc/apparmor.d/local/usr.sbin.named for local overrides.
+    LP: #929563
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 17 Feb 2012 14:40:29 -0800
+
+bind9 (1:9.8.1.dfsg.P1-2) unstable; urgency=low
+
+  * Deliver named.conf.options on fresh install.  Closes: #657042  LP: #920202
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 25 Jan 2012 03:55:21 -0700
+
+bind9 (1:9.8.1.dfsg.P1-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.8.1-P1
+    -  Cache lookup could return RRSIG data associated with nonexistent
+       records, leading to an assertion failure.
+
+  [LaMont Jones]
+
+  * add a readme entry for DNSSEC-by-default
+  * Failed to install due to chgrp on non-existant directory.  Closes: #647598
+  * ack NMU: l10n issues
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 18 Jan 2012 10:44:14 -0700
+
+bind9 (1:9.8.1.dfsg-1.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Fix pending l10n issues. Debconf translations:
+    - Danish (Joe Hansen).  Closes: #619302
+    - Korean (강민지).  Closes: #632006, #632016
+    - Serbian (FULL NAME).  Closes: #634886
+
+ -- Christian Perrier <bubulle@debian.org>  Sat, 03 Dec 2011 17:22:12 +0100
+
+bind9 (1:9.8.1.dfsg-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * New upstream release
+
+  [LaMont Jones]
+
+  * cleanup the messages around killing named
+  * enable dnssec validation: deliver named.conf.options outside of
+    conffiledom, and update if able, complain and do not update if not
+    Closes: #516979
+  * typo in min-ncache-ttl processing
+  * disable dlz until we get a patch to make it build again
+
+  [Jay Ford]
+
+  * Fix "waiting for pid $pid to die" loop to not be infinite.  Closes: #570852
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 01 Nov 2011 16:39:19 -0600
+
+bind9 (1:9.8.0.dfsg.P1-0) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.8.0-P1
+
+  [LaMont Jones]
+
+  * soname changes
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 13 May 2011 03:46:22 -0600
+
+bind9 (1:9.7.4.dfsg-0) unstable; urgency=low
+
+  * New upstream
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 21 Aug 2011 04:43:16 -0600
+
+bind9 (1:9.7.3.dfsg-1ubuntu4) oneiric; urgency=low
+
+  * debian/apparmor-profile: Allow /var/run and /run. (LP: #810270)
+
+ -- Martin Pitt <martin.pitt@ubuntu.com>  Thu, 14 Jul 2011 15:15:45 +0200
+
+bind9 (1:9.7.3.dfsg-1ubuntu3) oneiric; urgency=low
+
+  * SECURITY UPDATE: denial of service via specially crafted packet
+    - lib/dns/include/dns/rdataset.h, lib/dns/{masterdump,message,ncache,
+      nsec3,rbtdb,rdataset,resolver,validator}.c: Use an rdataset attribute
+      flag to indicate negative-cache records rather than using rrtype 0.
+    - Patch backported from 9.7.3-P3.
+    - CVE-2011-2464
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 05 Jul 2011 08:33:30 -0400
+
+bind9 (1:9.7.3.dfsg-1ubuntu2.1) natty-security; urgency=low
+
+  * SECURITY UPDATE: denial of service via off-by-one
+    - lib/dns/ncache.c: correctly validate length.
+    - Patch backported from 9.7.3-P1.
+    - CVE-2011-1910
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 27 May 2011 12:50:40 -0400
+
+bind9 (1:9.7.3.dfsg-1ubuntu2) natty; urgency=low
+
+  * debian/rules, configure, contrib/dlz/config.dlz.in: use
+    DEB_HOST_MULTIARCH so we can find multiarch libraries and fix FTBFS.
+    (LP: #745642)
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 30 Mar 2011 10:19:37 -0400
+
+bind9 (1:9.7.3.dfsg-1ubuntu1) natty; urgency=low
+
+  * debian/bind9-default.md5sum:
+    - updated to reflect the default md5sum in maverick and natty, this
+      avoids a bogus /etc/default/bind9.dpkg-dist file
+      (LP: #556332)
+
+ -- Michael Vogt <michael.vogt@ubuntu.com>  Tue, 29 Mar 2011 10:13:11 +0200
+
+bind9 (1:9.7.3.dfsg-1) unstable; urgency=low
+
+  [Peter Palfrader]
+
+  * Add db-4.6 to bdb_libnames in dlz/config.dlz.in so that it finds the right
+    db.
+
+  [Internet Systems Consortium, Inc]
+
+  * 9.7.3 - Closes: #612287
+
+  [Mahyuddin Susanto]
+
+  * Updated Indonesian debconf templates.  Closes: #608559
+
+  [LaMont Jones]
+
+  * soname changes
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 23 Feb 2011 09:14:36 -0700
+
+bind9 (1:9.7.3.dfsg~rc1-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * New upstream
+
+  [Peter Palfrader]
+
+  * Add db-4.6 to bdb_libnames in dlz/config.dlz.in so that it finds the right
+    db.
+
+  [Mahyuddin Susanto]
+
+  * Updated Indonesian debconf templates.  Closes: #608559
+
+  [LaMont Jones]
+
+  * soname changes for new upstream
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 04 Feb 2011 21:20:05 -0700
+
+bind9 (1:9.7.2.dfsg.P3-1) unstable; urgency=high
+
+  [ISC]
+  * Fix denial of service via ncache entry and a rrsig for the
+    same type (CVE-2010-3613)
+  * answers were incorrectly marked as insecure during key algorithm
+    rollover (CVE-2010-3614)
+  * Using "allow-query" in the "options" or "view" statements to
+    restrict access to authoritative zones had no effect.
+    (CVE-2010-3615)
+
+  [LaMont Jones]
+
+  * Adjust indentation for dpkg change.  Closes: #597171
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 01 Dec 2010 16:32:48 -0700
+
+bind9 (1:9.7.2.dfsg.P2-3) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * Adjust indentation for dpkg change.  Closes: #597171
+  * acknowledge and incorporate ubuntu change.
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 26 Nov 2010 05:18:43 -0700
+
+bind9 (1:9.7.2.dfsg.P2-2ubuntu1) natty; urgency=low
+
+  [ Andres Rodriguez ]
+  * Add apport hook (LP: #533601):
+    - debian/bind9.apport: Added.
+
+  [ Martin Pitt ]
+  * debian/rules: Install Apport hook when building on Ubuntu.
+
+ -- Martin Pitt <martin.pitt@ubuntu.com>  Fri, 26 Nov 2010 10:50:17 +0100
+
+bind9 (1:9.7.2.dfsg.P2-2) unstable; urgency=low
+
+  [Roy Jamison]
+
+  * lib/isc/unix/resource.c was missing inttypes.h include.  LP: #674199
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 12 Nov 2010 10:52:32 -0700
+
+bind9 (1:9.7.2.dfsg.P2-1) unstable; urgency=low
+
+  [Joe Dalton]
+
+  * Add Danish translation of debconf templates.  Closes: #599431
+
+  [Internet Software Consortium, Inc]
+
+  * v9.7.2-P2
+
+  [José Figueiredo]
+
+  * Add Brazilian Portuguese debconf templates translation.  Closes: #597616
+
+  [LaMont Jones]
+
+  * drop this v3 (quilt) source format idea.  Closes: #589916
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 10 Oct 2010 19:01:57 -0600
+
+bind9 (1:9.7.1.dfsg.P2-2) unstable; urgency=low
+
+  * Correct conflicts for bind9-host
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 16 Jul 2010 05:24:38 -0600
+
+bind9 (1:9.7.1.dfsg.P2-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * Temporarily and partially disable change 2864 because it would cause
+    inifinite attempts of RRSIG queries.  This is an urgent care fix; we'll
+    revisit the issue and complete the fix later.  [RT #21710]
+  * Temporarially rollback change 2748. [RT #21594]
+  * Named failed to accept uncachable negative responses from insecure zones.
+    [RT# 21555]
+
+  [LaMont Jones]
+
+  * freshen copyright file
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 15 Jul 2010 15:07:54 -0600
+
+bind9 (1:9.7.1.dfsg.0-1) unstable; urgency=low
+
+  * Repack to drop zkt/doc/{draft,rfc}*  Closes: #588055
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 05 Jul 2010 07:21:34 -0600
+
+bind9 (1:9.7.1.dfsg-2) unstable; urgency=low
+
+  [Regid Ichira]
+
+  * explicitly add nsupdate to dynamic updates in README.Debian. 
+    Closes: #577398
+
+  [LaMont Jones]
+
+  * Cleanup bind9-host description.  Closes: #579421
+  * switch to 3.0 (quilt) source format, but not to quilt.  Closes: #578210
+
+  [Stephen Gran]
+
+  * updated geoip patch for ipv6, based on work by John 'Warthog9' Hawley
+    <warthog9@eaglescrag.net>.  Closes: #584603
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 02 Jul 2010 08:19:29 -0600
+
+bind9 (1:9.7.1.dfsg-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.7.1
+
+  [LaMont Jones]
+
+  * Add freebsd support.  Closes: #578447
+  * soname changes
+  * freshen root cache.  LP: #596363
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 21 Jun 2010 09:53:30 -0600
+
+bind9 (1:9.7.0.dfsg.P1-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.7.0-P1
+    - 2852. [bug] Handle broken DNSSEC trust chains better. [RT #15619]
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 17 Mar 2010 08:06:42 -0600
+
+bind9 (1:9.7.0.dfsg.1-1) unstable; urgency=low
+
+  [Niko Tyni]
+
+  * fix mips/mipsel startup.  Closes: #516616
+
+  [LaMont Jones]
+
+  * ignore failures due to a lack of /etc/bind/named.conf*.  LP: #422968
+  * ldap API changed regarding % sign.  LP: #227344
+  * Drop more rfc and draft files.  Closes: #572606
+  * update config.guess, config.sub.  Closes: #572528
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 12 Mar 2010 14:56:08 -0700
+
+bind9 (1:9.7.0.dfsg-2) unstable; urgency=low
+
+  [Aurelien Jarno]
+
+  * kfreebsd has linux threads.  Closes: #470500
+
+  [LaMont Jones]
+
+  * do not error out on initial install.  Closes: #572443
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 04 Mar 2010 09:32:13 -0700
+
+bind9 (1:9.7.0.dfsg-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 17 Feb 2010 14:53:36 -0700
+
+bind9 (1:9.7.0.dfsg~rc2-1) experimental; urgency=low
+
+  * New upstream release
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 28 Jan 2010 05:46:50 -0700
+
+bind9 (1:9.7.0.dfsg~b3-2) experimental; urgency=low
+
+  * merge changes from 9.6.1.dfsg.P2-1
+  * meta: drop verisoned depends from library packages, for less upgrade pain
+  * apparmor: allow named to create /var/run/named/session.key
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 06 Dec 2009 11:46:17 -0700
+
+bind9 (1:9.7.0.dfsg~b3-1) experimental; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.7.0b3
+
+  [LaMont Jones]
+
+  * Merge remote branch 'origin/master'
+  * soname changes
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 30 Nov 2009 21:07:58 -0700
+
+bind9 (1:9.6.1.dfsg.P2-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.6.1-P2
+    - When validating, track whether pending data was from the
+      additional section or not and only return it if validates
+      as secure. [RT #20438] CVE-2009-4022
+
+  [LaMont Jones]
+
+  * prerm: do not stop named on upgrade.  Closes: #542888
+  * Drop some RFCs that crept into the diff.
+  * meta: add ${misc:Depends}
+  * lintian: update config.guess, config.sub in idnkit-1.0 tree
+  * dnsutils: remove pre-sarge dpkg-divert calls in postinst
+  * meta: soname changes
+  * l10n: missing newline in pofile.
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 27 Nov 2009 10:07:10 -0700
+
+bind9 (1:9.7.0.dfsg~b2-2) experimental; urgency=low
+
+  * dnsutils: remove pre-sarge dpkg-divert calls in postinst
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 17 Nov 2009 22:42:40 -0600
+
+bind9 (1:9.7.0.dfsg~b2-1) experimental; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.7.0b2
+
+  [LaMont Jones]
+
+  * /etc/bind/bind.keys need not be executable.
+  * bind9: drop old stale code from postinst
+  * prerm: do not stop named on upgrade.  Closes: #542888
+  * Drop some RFCs that crept into the diff.
+  * meta: add ${misc:Depends}
+  * lintian: update config.guess, config.sub in idnkit-1.0 tree
+  * l10n: missing newline in pofile.
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 16 Nov 2009 18:53:24 -0700
+
+bind9 (1:9.7.0~a1.dfsg-0) experimental; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.7.0a1
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 24 Jun 2009 15:10:08 -0600
+
+bind9 (1:9.6.1.dfsg.P1-3) unstable; urgency=low
+
+  * Build-Depend on the fixed libgeoip-dev.  Closes: #540973
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 17 Aug 2009 06:53:11 -0600
+
+bind9 (1:9.6.1.dfsg.P1-2) unstable; urgency=low
+
+  [Jamie Strandboge]
+
+  * reload individual named profile, not all of apparmor.  LP: #412751
+
+  [Guillaume Delacour]
+
+  * bind9 did not purge cleanly.  Closes: #497959
+
+  [LaMont Jones]
+
+  * postinst: do not append a blank line to /etc/default/bind9. 
+    Closes: #541469
+  * init.d stop needs to not error out.  LP: #398033
+  * meta: fix build-depends.  Closes: #539230
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 14 Aug 2009 17:03:31 -0600
+
+bind9 (1:9.6.1.dfsg.P1-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * A specially crafted update packet will cause named to exit. 
+    CVE-2009-0696, CERT VU#725188.  Closes: #538975
+
+  [InterNIC]
+
+  * Update db.root hints file.
+
+  [LaMont Jones]
+
+  * Move default zone definitions from named.conf to named.conf.default-zones.
+     Closes: #492308
+  * use start-stop-daemon if rndc stop fails.  Closes: #536487
+  * lwresd: pidfile name was wrong in init script.  Closes: #527137
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 28 Jul 2009 22:03:14 -0600
+
+bind9 (1:9.6.1.dfsg-2) unstable; urgency=low
+
+  * ia64: fix atomic.h
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 23 Jun 2009 01:56:35 -0600
+
+bind9 (1:9.6.1.dfsg-1) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.6.1
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 22 Jun 2009 14:33:20 -0600
+
+bind9 (1:9.6.0.dfsg.P1-3) unstable; urgency=low
+
+  [Martin Zobel-Helas]
+
+  * GEO-IP Patch from
+    git://git.kernel.org/pub/scm/network/bind/bind-geodns.git.  Closes: #395191
+
+  [LaMont Jones]
+
+  * Remove /var/lib/bind on purge.  Closes: #527613
+  * Build-Depend: libdb-dev (>4.6).  Closes: #527877, #528772
+  * init.d: detect rndc errors better.  LP: #380962
+  * init.d: clean up exit status.  Closes: #523454
+  * Enable pkcs11 support, and then Revert - causes assertion failures
+    c.f.: #516552
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 22 Jun 2009 13:58:32 -0600
+
+bind9 (1:9.6.0.dfsg.P1-2) unstable; urgency=low
+
+  * random_1 broke memory usage assertions.
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 23 Apr 2009 05:15:45 -0600
+
+bind9 (1:9.6.0.dfsg.P1-1) experimental; urgency=low
+
+  [Michael Milligan]
+
+  * Add min-cache-ttl and min-ncache-ttl keywords
+
+  [LaMont Jones]
+  
+  * Fix merge errors from 9.6.0.dfsg.P1-0
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 20 Mar 2009 15:50:50 -0600
+
+bind9 (1:9.6.0.dfsg.P1-0) experimental; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.6.0-P1
+
+  [LaMont Jones]
+
+  * meta: fix override disparity
+  * meta: soname package fixups for 9.6.0
+  * meta: update Standards-Version: 3.7.3.0
+  * upstream now uses a bind subdir.  Closes: #212659
+
+  [Sven Joachim]
+
+  * meta: pass host and build into configure for hybrid build machines. 
+    Closes: #515110
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 20 Mar 2009 11:54:55 -0600
+
+bind9 (1:9.5.1.dfsg.P1-3) unstable; urgency=low
+
+  * package -2 for unstable
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 18 Mar 2009 09:40:18 -0600
+
+bind9 (1:9.5.1.dfsg.P1-2) stable; urgency=low
+
+  [Juhana Helovuo]
+
+  * fix atomic operations on alpha.  Closes: #512285
+
+  [Dann Frazier]
+
+  * fix atomic operations on ia64.  Closes: #520179
+
+  [LaMont Jones]
+
+  * build-conflict: libdb4.2-dev.  Closes: #515074, #507013
+
+  [localization folks]
+
+  * l10n: Basque debconf template.  Closes: #516549 (Piarres Beobide)
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 18 Mar 2009 05:30:22 -0600
+
+bind9 (1:9.5.1.dfsg.P1-1) unstable; urgency=low
+
+  * New upstream patch release
+    - supportable version of fix from 9.5.0.dfsg.P2-5.1
+    - CVE-2009-0025:  Closes: #511936
+    - 2475: Overly agressive cache entry removal.  Closes: #511768
+    - other bug fixes worthy of patch-release inclusion
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 26 Jan 2009 10:33:42 -0700
+
+bind9 (1:9.5.0.dfsg.P2-5.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Apply upstream ACL fixes from 9.5.1 to fix RC bug. Patch was provided
+    by Evan Hunt (upstream bind9 developer) after Emmanuel Bouthenot
+    contacted him. Closes: #496954, #501800.
+  * Remove obsolete dh_installmanpages invocation which was adding
+    unwanted manual pages to bind9. Closes: #486196.
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Fri, 02 Jan 2009 16:51:42 +0000
+
+bind9 (1:9.5.0.dfsg.P2-5) unstable; urgency=low
+
+  [ISC]
+
+  * 2463: IPv6 Advanced Socket API broken on linux.  LP: #249824
+
+  [Jamie Strandboge]
+
+  * apparmor: add capability sys_resource
+  * apparmor: add krb keytab access.  LP: #277370
+
+  [LaMont Jones]
+
+  * apparmor: allow proc/*/net/if_inet6 read access too.  LP: #289060
+  * apparmor: add /var/log/named/* entries.  LP: #294935
+
+  [Ben Hutchings]
+
+  * meta: Add dependency of bind9 on net-tools (ifconfig used in init script)
+  * meta: Fix bind9utils Depends.
+  * meta: fix typo in package description
+
+  [localization folks]
+
+  * l10n: add polish debconf translations.  Closes: #506856 (L)
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 07 Dec 2008 21:03:29 -0700
+
+bind9 (1:9.5.0.dfsg.P2-4) unstable; urgency=low
+
+  * meta: fix typo in Depends: lsb-base.  Closes: #501365
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 07 Oct 2008 17:20:11 -0600
+
+bind9 (1:9.5.0.dfsg.P2-3) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * enable largefile support.  Closes: #497040
+
+  [localization folks]
+
+  * l10n: Dutch translation.  Closes: #499977 (Paul Gevers)
+  * l10n: simplified chinese debconf template.  Closes: #501103 (LI Daobing)
+  * l10n: Update spanish template.  Closes: #493775 (Ignacio Mondino)
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 05 Oct 2008 20:20:00 -0600
+
+bind9 (1:9.5.0.dfsg.P2-2) unstable; urgency=low
+
+  [Kees Cook]
+
+  * debian/{control,rules}: enable PIE hardening (from -1ubuntu1)
+
+  [Nicolas Valcárcel]
+
+  * Add ufw integration (from -1ubuntu2)
+
+  [Dustin Kirkland]
+
+  * use pid file in init.d/bind9 status.  LP: #247084
+
+  [LaMont Jones]
+
+  * dig: add -DDIG_SIGCHASE to compile options.  LP: #257682
+  * apparmor profile: add /var/log/named
+
+  [Nikita Ofitserov]
+
+  * ipv6 support requires _GNU_SOURCE definition.  LP: #249824
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 28 Aug 2008 23:08:36 -0600
+
+bind9 (1:9.5.0.dfsg.P2-1) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * default to using resolvconf if it is installed
+  * fix sonames and dependencies.  Closes: #149259, #492418
+  * Do not build-depend libcap2-dev on non-linux.  Closes: #493392
+  * drop unused query-loc manpage.  Closes: #492564
+  * lwresd: Deliver /etc/bind directory.  Closes: #490027
+  * fix query-source comment in default install
+
+  [Internet Software Consortium, Inc]
+
+  * 9.5.0-P2.  Closes: #492949
+
+  [localization folks]
+
+  * l10n: Spanish debconf translation.  Closes: #492425 (Ignacio Mondino)
+  * l10n: Swedish debconf templates.  Closes: #491369 (Martin Ågren)
+  * l10n: Japanese debconf translations.  Closes: #492048 (Hideki Yamane
+    (Debian-JP))
+  * l10n: Finnish translation.  Closes: #490630 (Esko Arajärvi)
+  * l10n: Italian debconf translations.  Closes: #492587 (Alessandro Vietta)
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 02 Aug 2008 14:20:20 -0600
+
+bind9 (1:9.5.0.dfsg.P1-2) unstable; urgency=low
+
+  * Revert "meta: merge the mess of single-lib packages back into one large
+    one." - That way lies madness and pain.
+  * init.d/bind9: implement status function.  LP: #203169
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 08 Jul 2008 21:56:58 -0600
+
+bind9 (1:9.5.0.dfsg.P1-1) unstable; urgency=low
+
+  * Repackage 9.5.0.dfsg-5 with the -P1 tarball.
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 08 Jul 2008 15:06:07 -0600
+
+bind9 (1:9.5.0.dfsg-5) unstable; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * Randomize UDP query source ports to improve forgery resilience.
+    (CVE-2008-1447)                                                                              
+
+  [LaMont Jones]
+
+  * add build-depends: texlive-latex-base, xsltproc, remove Bv9ARM.pdf in clean
+  * fix sonames
+  * drop unneeded build-deps, since we do not actually deliver B9vARM.pdf
+  * meta: cleanup libbind9-41 Provides/Conflicts
+  * build: fix sonames for new libraries
+  * postinst: really restart bind/lwresd in postinst
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 06 Jul 2008 21:34:18 -0600
+
+bind9 (1:9.5.0.dfsg-4) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * control: fix dnsutils description to avoid list reformatting. 
+    Closes: #480317
+  * lwresd: restart in postinst.  Closes: #486481
+  * meta: merge the mess of single-lib packages back into one large one.
+  * apparmor: allow bind to create files in /var/{lib,cache}/bind
+  * build: drop .la files.  Closes: #486969
+  * build: drop the extra lib path from the library-package merge
+  * meta: liblwres40 does not conflict with the libbind9-40-provided libbind0
+
+  [localization folks]
+
+  * l10n: German debconf translation.  Closes: #486547 (Helge Kreutzmann)
+  * l10n: Indonesian debconf translations.  Closes: #486503 (Arief S Fitrianto)
+  * l10n: Slovak po-debconf translation Closes: #488905 (helix84)
+  * l10n: Turkish debconf template.  Closes: #486479 (Mert Dirik)
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 30 Jun 2008 11:22:05 -0600
+
+bind9 (1:9.4.2-12) unstable; urgency=low
+
+  * apparmor: allow bind to create files in /var/{lib,cache}/bind
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 30 Jun 2008 11:17:53 -0600
+
+bind9 (1:9.4.2-11) unstable; urgency=low
+
+  * apparmor: add dnscvsutil package files
+  * lwresd Depends: adduser
+  * control: fix dnsutils description to avoid list reformatting. 
+    Closes: #480317
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 17 Jun 2008 21:30:12 -0600
+
+bind9 (1:9.5.0.dfsg-3) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * bind9utils Depends: libbind9-40.  Closes: #486194
+  * bind9 should not deliver manpages for nonexistant binaries. 
+    Closes: #486196
+
+  [localization folks]
+
+  * l10n: Vietnamese debconf templates translation update.  Closes: #486185
+    (Clytie Siddall)
+  * l10n: Russian debconf templates translation.  Closes: #486191 (Yuri Kozlov)
+  * l10n: Galician debconf template.  Closes: #486215 (Jacobo Tarrio)
+  * l10n: French debconf templates.  Closes: #486325 (CALARESU Luc)
+  * l10n: Czech debconf translation.  Closes: #486337 (Miroslav Kure)
+  * l10n: Updated Portuguese translation.  Closes: #486267 (Traduz -
+    Portuguese Translation Team)
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 15 Jun 2008 18:25:02 -0600
+
+bind9 (1:9.5.0.dfsg-2) unstable; urgency=low
+
+  [Tim Spriggs]
+
+  * init.d: Nexenta has different ifconfig arguments
+
+  [LaMont Jones]
+
+  * templates rework from debian-l10n-english
+  * reload named when an interface goes up or down.  LP: #226495
+  * build: need to create the directories for interface restart triggering
+  * Build-Depends: libcap2-dev.  Closes: #485747
+  * Leave named running during update.  Closes: #453765
+  * Fix path to uname, cleaning up the nexenta checks.
+  * l10n: avoid double-question in templates.
+
+  [localization folks]
+
+  * l10n: Vietnamese debconf translations.  Closes: #483911 (Clytie Siddall)
+  * l10n: Portuguese debconf translations.  Closes: #483872 (Traduz -
+    Portuguese Translation Team)
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 13 Jun 2008 16:54:42 -0600
+
+bind9 (1:9.5.0.dfsg-1) unstable; urgency=low
+
+  [LaMont Jones]
+
+  * manpages: fix references that should say /etc/bind
+  * meta: build-depend libxml2-dev for statistics support
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 31 May 2008 12:17:21 -0600
+
+bind9 (1:9.5.0.dfsg-0) experimental; urgency=low
+
+  [Internet Software Consortium, Inc]
+
+  * 9.5.0 release
+
+  [LaMont Jones]
+
+  * Only use capabilities if they are present: reprise.  Closes: #360339, #212226
+  * control: fix dnsutils description to avoid list reformatting.  Closes: #480317
+  * build: use the correct directories in dh_shlibdeps invocation
+  * build: turn on dlz.  No pgsql or mysql support yet.  LP: #227344
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 29 May 2008 22:05:19 -0600
+
+bind9 (1:9.5.0~rc1-2~0ubuntu2) intrepid; urgency=low
+
+  * build: use the correct directories in dh_shlibdeps invocation
+  * build: turn on dlz.  LP: #227344
+
+ -- LaMont Jones <lamont@ubuntu.com>  Tue, 27 May 2008 21:43:06 -0600
+
+bind9 (1:9.5.0~rc1-2~0ubuntu1) intrepid; urgency=low
+
+  * Upload what will become (maybe an ancestor of) -2 to intrepid.
+    - Only use capabilities if they are present: reprise.  Closes: #360339, #212226
+    - control: fix dnsutils description to avoid list reformatting.  Closes: #480317
+
+ -- LaMont Jones <lamont@ubuntu.com>  Mon, 26 May 2008 11:46:27 -0600
+
+bind9 (1:9.5.0~rc1-1) experimental; urgency=low
+
+  [Patrick Winnertz]
+
+  * postinst: make add debconf support.  Closes: #473460
+
+  [Jamie Strandboge]
+
+  * debian/bind9.preinst: Apparmor force-complain on upgrade without
+    existing profile.  LP: #204658
+
+  [LaMont Jones]
+
+  * bind9utils: fix typos in .install
+  * host: manpage inaccurately describes default query.  LP: #203087
+  * apparmor: add dnscvsutil package files
+  * Revert "Only use capabilities if they are present." for merge of 9.5.0rc1.
+  * soname: libdns41 -> 42
+  * fix typos in debconf patch, #473460
+  * cleanup more files in clean target
+  * lwresd Depends: adduser
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 15 May 2008 17:59:54 -0600
+
+bind9 (1:9.5.0~b2-2) experimental; urgency=low
+
+  * meta: add bind9utils binary package, with various useful utilities.  Closes: #151957, #130445, #160483
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 03 Apr 2008 07:01:42 -0600
+
+bind9 (1:9.4.2-10) unstable; urgency=low
+
+  [Jamie Strandboge]
+
+  * debian/bind9.preinst: AA force-complain on upgrade without existing
+    profile.  LP: #204658
+
+  [LaMont Jones]
+
+  * host: manpage inaccurately describes default query.  LP: #203087
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 08 Apr 2008 22:45:57 -0600
+
+bind9 (1:9.4.2-9) unstable; urgency=low
+
+  * apparmor: allow subdirs in {/etc,/var/cache,/var/lib}/bind
+  * apparmor: make profile match README.Debian
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 01 Apr 2008 21:13:05 -0600
+
+bind9 (1:9.4.2-8) unstable; urgency=low
+
+  [ISC]
+
+  * CVE-2008-0122: off by one error in (unused) inet_network function.
+    Closes: #462783  LP: #203476
+
+  [Michael Milligan]
+
+  * Fix min-cache-ttl and min-ncache-ttl keywords
+
+  [Jamie Strandboge]
+
+  * apparmor: force complain-mode for apparmor on certain upgrades.  LP: #203528
+  * debian/bind9.postrm: purge /etc/apparmor.d/force-complain/usr.sbin.named
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 18 Mar 2008 18:35:15 -0600
+
+bind9 (1:9.4.2-7) unstable; urgency=low
+
+  [Jamie Strandboge]
+
+  * Allow rw access to /var/lib/bind/* in apparmor-profile.  LP: #201954
+
+  [LaMont Jones]
+
+  * Drop root-delegation comments from named.conf.  Closes: #217829, #297219
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 15 Mar 2008 09:48:10 -0600
+
+bind9 (1:9.4.2-6) unstable; urgency=low
+
+  * Correct apparmor profile filename.  LP: #200739
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 10 Mar 2008 14:28:01 -0600
+
+bind9 (1:9.4.2-5) unstable; urgency=low
+
+  * add "order random_1" support (return one random RR)
+  * Fix doc pathnames in README.Debian.  Closes: #266891
+  * Add AAAA ::1 entry to db.local.  Closes: #230088
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 10 Mar 2008 13:51:28 -0600
+
+bind9 (1:9.5.0~b2-1) experimental; urgency=low
+
+  [Thiemo Seufer]
+
+  * mips:atomic.h: improve implementation of atomic ops, fix mips{el,64}
+
+  [LaMont Jones]
+
+  * manpages: call it /etc/bind/named.conf throughout, and typos.  Closes: #419750
+  * named.conf.5: correct filename.  Closes: #428015
+  * manpages: fix typo errors.  Closes: #395834
+  * Makefile.in: be explicit about library paths
+  * build: Turn on GSS-TSIG support.  LP: #158197
+  * build: soname changes
+  * db.root: include AAAA RRs.  Closes: #464111
+  * soname: lib{dns,isc}40 -> 41
+  * meta: use binary:Version instead of Source-Version
+
+  [Andreas John]
+
+  * Only use capabilities if they are present.  Closes: #360339, #212226
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 23 Feb 2008 08:06:17 -0700
+
+bind9 (1:9.4.2-4) unstable; urgency=low
+
+  * incorporate ubuntu apparmor change from Jamie Strandboge,
+    with changes:
+    - Add apparmor profile, reload apparmor profile on config
+    - Add a note about apparmor to README.Debian
+    - conflicts/replaces old apparmor versions
+  * db.root: include AAAA RRs.  Closes: #464111
+  * Don't die when /var/lib/bind already exists.  LP: #191685
+  * build: turn on optimization.  Closes: #435194
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 22 Feb 2008 22:05:25 -0700
+
+bind9 (1:9.4.2-3ubuntu1) hardy; urgency=low
+
+  * add AppArmor profile
+    + debian/apparmor-profile
+    + debian/bind9.postinst: Reload AA profile on configuration
+  * updated debian/README.Debian for note on AppArmor
+  * debian/control: Replaces apparmor-profiles << 2.1+1075-0ubuntu4 as we
+    should now take control
+  * debian/control: Conflicts with apparmor-profiles << 2.1+1075-0ubuntu4
+    to make sure that if earlier version of apparmor-profiles gets installed
+    it won't overwrite our profile
+  * Modify Maintainer value to match the DebianMaintainerField
+    specification.
+
+ -- Jamie Strandboge <jamie@ubuntu.com>  Wed, 13 Feb 2008 17:30:45 +0000
+
+bind9 (1:9.4.2-3) unstable; urgency=low
+
+  * don't run rndc-confgen when it's not there.  Closes: #459551
+  * control: drop use of ${Source-Version}
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 07 Jan 2008 10:16:06 -0700
+
+bind9 (1:9.4.2-2) unstable; urgency=low
+
+  * init.d: add --oknodo to start-stop-daemon.  Closes: #411881
+  * init: LSB dependency info.  Closes: #459421, #448006
+  * meta: bind9 Suggests: resolvconf.  Closes: #252285
+  * bind9: deliver /var/lib/bind directory, and document.
+    Closes: #248771, #200253, #202981, #209022
+  * lwresd: create bind user/group and rndc key if needed, at install.
+    Closes: #190742
+  * dnsutils: update long description.  Closes: #236901
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 06 Jan 2008 12:25:31 -0700
+
+bind9 (1:9.4.2-1) unstable; urgency=low
+
+  [Mike O'Connor]
+
+  * bind9.init: LSB compliance.  Closes: #448006
+
+  [Internet Software Consortium, Inc]
+
+  * New release: 9.4.2
+
+  [LaMont Jones]
+
+  * soname shifts for new release
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 17 Nov 2007 10:50:07 -0700
+
+bind9 (1:9.4.2~rc2-1) experimental; urgency=low
+
+  * New upstream release
+
+ -- LaMont Jones <lamont@debian.org>  Fri, 12 Oct 2007 18:33:57 -0600
+
+bind9 (1:9.4.1-P1-4) unstable; urgency=low
+
+  [Thomas Antepoth]
+
+  * unix/socket.c: don't send to a socket with pending_send.  Closes: #430065
+
+  [LaMont Jones]
+
+  * document git repositories
+  * db.root: l.root-servers.net changed IP address.  Closes: #449148  LP: #160176
+  * init.d: if there are no networks configured, error out quickly
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 08 Nov 2007 21:31:55 -0700
+
+bind9 (1:9.4.1-P1-3) unstable; urgency=low
+
+  * Only deliver upstream changes with bind9-doc
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 04 Oct 2007 08:30:55 -0600
+
+bind9 (1:9.4.1-P1-2) unstable; urgency=low
+
+  * manpages: fix typo errors.  Closes: #395834
+  * manpages: call it /etc/bind/named.conf throughout, and typos.  Closes: #419750
+  * named.conf.5: correct filename.  Closes: #428015
+  * bind9.NEWS: update version for ACL change doc.  Closes: #435225
+  * build: don't have dnsutils deliver man pages that it shouldn't.  LP: #82178
+  * nslookup.1: some of the manpage was not visible.  LP: #131415
+  * document git repositories
+  * unix/socket.c: don't send to a socket with pending_send.  Closes: #430065
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 03 Oct 2007 01:10:59 -0600
+
+bind9 (1:9.4.1-P1-1) unstable; urgency=high
+
+  * New upstream version, addresses CVE-2007-2926 and CVE-2007-2925 
+
+ -- Bdale Garbee <bdale@gag.com>  Thu, 26 Jul 2007 16:41:50 -0600
+
+bind9 (1:9.4.1-1) unstable; urgency=low
+
+  * New upstream version
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 30 Apr 2007 16:59:05 -0600
+
+bind9 (1:9.4.0-2) unstable; urgency=low
+
+  * upload to unstable
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 10 Apr 2007 11:12:16 -0600
+
+bind9 (1:9.4.0-1) experimental; urgency=low
+
+  * New upstream version
+  * more mipsel patch.  Closes: #406409
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 25 Feb 2007 11:44:11 -0700
+
+bind9 (1:9.4.0~rc2-1) experimental; urgency=low
+
+  * New upstream version.  Addresses CVE-2007-0493 CVE-2007-0494
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 25 Jan 2007 14:26:12 -0700
+
+bind9 (1:9.4.0~rc1.0-3) experimental; urgency=low
+
+  * add NEWS file talking about the change in defaults:
+    As of bind 9.4, allow-query-cache and allow-recursion default to the
+    builtin acls 'localnets' and 'localhost'.  If you are setting up a
+    name server for a network, you will almost certainly need to change
+    this.
+
+    The change in default has been done to make caching servers less
+    attractive as reflective amplifying targets for spoofed traffic.
+    This still leaves authoritative servers exposed.
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 24 Jan 2007 09:35:06 -0700
+
+bind9 (1:9.4.0~rc1.0-2) experimental; urgency=low
+
+  * Fix mips64.  Closes: #406409
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 21 Jan 2007 15:32:27 -0700
+
+bind9 (1:9.4.0~rc1.0-1) experimental; urgency=low
+
+  * Broken orig.tar.gz.
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 28 Dec 2006 23:04:05 -0700
+
+bind9 (1:9.4.0~rc1-1) experimental; urgency=low
+
+  * New upstream
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 28 Dec 2006 19:00:37 -0700
+
+bind9 (1:9.3.4-2etch2) stable-proposed-updates; urgency=low
+
+  [Thomas Antepoth]
+
+  * unix/socket.c: don't send to a socket with pending_send.  Closes: #430065
+
+  [LaMont Jones]
+
+  * document git repositories
+  * db.root: l.root-servers.net changed IP address.  Closes: #449148
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 05 Nov 2007 19:48:23 -0700
+
+bind9 (1:9.3.4-2etch1) stable-security; urgency=high
+
+  * Fix DNS cache poisoning through predictable query IDs. (CVE-2007-2926)
+
+ -- Moritz Muehlenhoff <jmm@debian.org>  Tue, 24 Jul 2007 22:09:35 +0000
+
+bind9 (1:9.3.4-2) unstable; urgency=high
+
+  * Actually really do the merge of 9.3.4.  Sigh.  Closes: #408925
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 29 Jan 2007 06:09:03 -0700
+
+bind9 (1:9.3.4-1) unstable; urgency=high
+
+  * New upstream version.  Addresses CVE-2007-0493 CVE-2007-0494
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 25 Jan 2007 14:31:09 -0700
+
+bind9 (1:9.3.3-1) unstable; urgency=low
+
+  * New upstream version
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 12 Dec 2006 23:31:51 -0700
+
+bind9 (1:9.3.2-P1.0-1) unstable; urgency=low
+
+  * Fix README.Debian to point to the URL.  Closes: #387437
+  * Strip rfc's from orig.tar.gz.  Closes: #393359
+
+ -- LaMont Jones <lamont@mmjgroup.com>  Mon, 16 Oct 2006 06:38:22 -0600
+
+bind9 (1:9.3.2-P1-2) unstable; urgency=low
+
+  * Fix init script output.  Closes: #354192
+    Thanks to Joey Hess for the patch.
+  * Default install should listen on ipv6 interfaces.  Closes: #382438
+
+ -- LaMont Jones <lamont@debian.org>  Sat,  9 Sep 2006 19:01:53 -0600
+
+bind9 (1:9.3.2-P1-1) unstable; urgency=high
+
+  * New upstream, fixes CVE-2006-4095 and CVE-2006-4096.
+    Closes: #386237, #386245
+  * Drop gcc-3.4 [powerpc] dependency.  Closes: #342957, #372203
+  * Add -fno-strict-aliasing for type-punned pointer aliasing issues
+    Closes: #386224
+  * Use getent in postinst instead of chown/chgrp.  Closes: #386091, #239665
+  * Drop redundant update-rc.d calls.  Closes: #356914
+
+ -- LaMont Jones <lamont@debian.org>  Wed,  6 Sep 2006 08:07:13 -0600
+
+bind9 (1:9.3.2-2) unstable; urgency=low
+
+  * correct force-reload.  Closes: #333841
+  * Fix init.d's usage message.  Closes: #331090
+  * resolvconf tweaks.  Closes: #252232, #275412
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 16 Jan 2006 15:17:04 -0700
+
+bind9 (1:9.3.2-1) unstable; urgency=low
+
+  * New upstream
+  * use lsb-base for start/stop messages in init.d.
+  * switch to debhelper 4
+
+ -- LaMont Jones <lamont@debian.org>  Thu,  5 Jan 2006 12:29:28 -0700
+
+bind9 (1:9.3.1-2) unstable; urgency=low
+
+  * Getting good reports from experimental, uploading to sid.
+    Release team, please consider this package for sarge.  Thanks.
+  * correct pidfile name in init.d/lwresd.  Closes: #298100
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 19 Mar 2005 17:46:31 -0700
+
+bind9 (1:9.3.1-1) experimental; urgency=low
+
+  * Build with gcc-3.4 on powerpc, to work around #292958.
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 19 Mar 2005 11:40:06 -0700
+
+bind9 (1:9.3.1-0) experimental; urgency=low
+
+  * New upstream version.
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 13 Mar 2005 21:44:57 -0700
+
+bind9 (1:9.3.0+9.3.1beta2-1) experimental; urgency=low
+
+  * new upstream version
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 25 Jan 2005 14:21:51 -0700
+
+bind9 (1:9.3.0-1) experimental; urgency=low
+
+  * New upstream version
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 25 Sep 2004 21:35:46 -0600
+
+bind9 (1:9.2.4-1) unstable; urgency=high
+
+  * New upstream version.  Closes: #269157 and others.
+  * Version debhelper build-dep.  Closes: #262720
+
+ -- LaMont Jones <lamont@mmjgroup.com>  Thu, 23 Sep 2004 09:11:37 -0600
+
+bind9 (1:9.2.3+9.2.4-rc7-1) unstable; urgency=low
+
+  * New upstream
+
+ -- LaMont Jones <lamont@mmjgroup.com>  Wed,  1 Sep 2004 00:04:55 -0600
+
+bind9 (1:9.2.3+9.2.4-rc6-1) unstable; urgency=low
+
+  * New upstream.
+  * Comment out delegation-only directives in named.conf
+
+ -- LaMont Jones <lamont@debian.org>  Mon,  2 Aug 2004 10:00:38 -0600
+
+bind9 (1:9.2.3+9.2.4-rc5-1) unstable; urgency=low
+
+  * New upstream release candidate
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 17 Jun 2004 19:50:37 -0600
+
+bind9 (1:9.2.3+9.2.4-rc2-1) unstable; urgency=low
+
+  * New upstream release candidate
+  * Remove shared library symlinks in clean.  Closes: #243109
+  * Deal with capset being a module.  Closes: #245043, #240874, #241605
+  * deliver /var/run/bind/run in lwresd as well.  Closes: #186569
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 22 Apr 2004 12:20:05 -0600
+
+bind9 (1:9.2.3-3) unstable; urgency=low
+
+  * new IP for b.root-servers.net.  Closes: #234278
+  * Fix RC linkages to match bind8.  Closes: #218007
+
+ -- LaMont Jones <lamont@debian.org>  Mon,  1 Mar 2004 15:00:44 -0700
+
+bind9 (1:9.2.3-2) unstable; urgency=low
+
+  * Rebuild autoconf files for mips.  Closes: #221419
+
+ -- LaMont Jones <lamont@debian.org>  Tue, 18 Nov 2003 06:33:34 -0700
+
+bind9 (1:9.2.3-1) unstable; urgency=low
+
+  * New upstream.
+  * cleanup zones.rfc1918/db.empty stuff.
+  * Fix Makefiles to work even if the build environment is unclean.
+    Closes: #211503
+  * Add comments about root-delegation-only to named.conf.  Closes: #212243
+  * Add resolvconf support.  Closes: #199255
+  * more SO_BSDCOMPAT hacks for linux.  Closes: #220735, #214460
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 17 Nov 2003 21:30:33 -0700
+
+bind9 (1:9.2.2+9.2.3rc4-1) unstable; urgency=low
+
+  * Yet another new upstream release.
+
+ -- LaMont Jones <lamont@debian.org>  Mon, 22 Sep 2003 09:39:50 -0600
+
+bind9 (1:9.2.2+9.2.3rc3-1) unstable; urgency=low
+
+  * New upstream.  Closes: #211752. #211503. #211496, #211520
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 20 Sep 2003 12:22:59 -0600
+
+bind9 (1:9.2.2+9.2.3rc2-4) unstable; urgency=low
+
+  * Really fix versioned depends.  Closes: #211590
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 18 Sep 2003 17:29:47 -0600
+
+bind9 (1:9.2.2+9.2.3rc2-3) unstable; urgency=low
+
+  * Version depends for all the libraries. sigh.  Closes: #211412,#210293
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 17 Sep 2003 10:56:36 -0600
+
+bind9 (1:9.2.2+9.2.3rc2-2) unstable; urgency=low
+
+  * Need a versioned depend. sigh.
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 17 Sep 2003 10:25:35 -0600
+
+bind9 (1:9.2.2+9.2.3rc2-1) unstable; urgency=low
+
+  * New upstream release.  Closes: #211373
+  * Remove RFC's from package, per policy.
+  * Make com and net zones delegation-only by default.
+
+ -- LaMont Jones <lamont@debian.org>  Wed, 17 Sep 2003 07:15:37 -0600
+
+bind9 (1:9.2.2+9.2.3rc1-3) unstable; urgency=low
+
+  * A bit more cleanup of descriptions.
+  * fix package sections
+  * Fix b0rkage with dependencies.
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 14 Sep 2003 09:05:10 -0600
+
+bind9 (1:9.2.2+9.2.3rc1-2) unstable; urgency=low
+
+  * Explicitly link libraries.  Closes: #210653
+  * Fix descriptions.  Closes: #209563, #209853, #210063
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 13 Sep 2003 19:29:05 -0600
+
+bind9 (1:9.2.2+9.2.3rc1-1) unstable; urgency=low
+
+  * New upstream release candidate.
+  * Quit using SO_BSDCOMPAT (why is it still in the header files??) so
+    that the kernel will shut up about it's advertised, obsolete option.
+    Closes: #201293, #204282, #205590
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 28 Aug 2003 14:44:28 -0600
+
+bind9 (1:9.2.2-2) unstable; urgency=low
+
+  * Fix libtool.m4. Closes: #183791
+  * move lib packages into Section: libs.  Closes: #184788
+  * make sure it's libssl0.9.7.  Closes: #182363
+  * Add /etc/default/lwresd.  Closes: #169727
+  * Add fakeroot dir to dh_shlibdeps.  Closes: #169622
+  * Fix rndc manpage.  Closes: #179353
+  * Deliver /usr/bin/isc-config.sh (in libbind-dev).  Closes: #178186
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 15 Mar 2003 16:34:15 -0700
+
+bind9 (1:9.2.2-1) unstable; urgency=low
+
+  * New upstream version
+  * Document /etc/default/bind9 in init.d script.  Closes: #170267
+
+ -- LaMont Jones <lamont@debian.org>  Tue,  4 Mar 2003 22:43:58 -0700
+
+bind9 (1:9.2.1-7) unstable; urgency=low
+
+  * One more overrides disparity.
+  * Fix bashism in postinst.  Closes: #169531
+
+ -- LaMont Jones <lamont@debian.org>  Sun, 17 Nov 2002 19:22:58 -0700
+
+bind9 (1:9.2.1-6) unstable; urgency=low
+
+  * The "I give up for now" release.
+  *   Only convert to running as bind if named.conf hasn't been modified.
+  *   Closes: #163552, #164352
+  * Fix overrides
+  * Cleanup README.Debian wrt non-root-by-default.
+  * Make sure that /var/run/bind/run exists in init.d script.  Closes: #168912
+  * New IP for j.root-servers.net.  Closes: #167818
+  * Check for 2.2.18 kernel in preinst.  Closes: #164349
+  * Move local options to /etc/default/bind9.  Closes: #169132, #163073
+  * Cleanup old bugs (fixed in -5, really).  Closes: #165864
+  * Add /etc/bind/named.conf.local, included from named.conf.  Closes: #129576
+  * Do options definitions in /etc/bind/named.conf.options, makes life
+    easier in the face of named.conf changes from upstream.
+  * Add missing Depends: adduser
+
+ -- LaMont Jones <lamont@debian.org>  Sat, 16 Nov 2002 17:05:45 -0700
+
+bind9 (1:9.2.1-5) unstable; urgency=low
+
+  * Run named a non-privileged user by default.  Closes: #149059
+
+ -- LaMont Jones <lamont@debian.org>  Thu, 12 Sep 2002 16:57:37 -0600
+
+bind9 (1:9.2.1-4) unstable; urgency=low
+
+  * swap maintainer/uploader status so LaMont is primary and Bdale is backup
+  * Deal with bind/bind9 collisions better.  Closes: #149580
+  * Fix some documentation.  Closes: #151579
+
+ -- LaMont Jones <lamont@debian.org>  Wed,  4 Sep 2002 23:25:33 -0600
+
+bind9 (1:9.2.1-3) unstable; urgency=high
+
+  * fold in lib/bind/resolv from 8.3.3 to resolve buffer overlow issue in
+    resolver library, closes: #151342, #151431
+
+ -- Bdale Garbee <bdale@gag.com>  Mon,  1 Jul 2002 00:16:31 -0600
+
+bind9 (1:9.2.1-1.woody.1) testing-security woody-proposed-updates; urgency=high
+
+  * backport to woody (simple rebuild) since 9.2.1 resolves a security issue
+
+ -- Bdale Garbee <bdale@gag.com>  Tue,  4 Jun 2002 10:30:57 -0600
+
+bind9 (1:9.2.1-2) unstable; urgency=low
+
+  * don't include nslint man page, closes: #148695
+  * fix typo in rndc.8, closes: #139602
+  * add a section to README.Debian explaining the rndc key mode that has been
+    our default since 9.2.0-2, closes: #129849
+  * fix paths for named.conf in named.8 to reflect our default, closes: #143443
+  * upstream fixed the nsupdate man page at some point, closes: #121108
+
+ -- Bdale Garbee <bdale@gag.com>  Mon,  3 Jun 2002 15:44:37 -0600
+
+bind9 (1:9.2.1-1) unstable; urgency=medium
+
+  * new upstream version
+  * have bind9-host provide host, closes: #140174
+  * move bind9-host to priority standard since dnsutils depends on it or host,
+    and we prefer bind9-host over host.
+  * move libdns5 and libisc4 to priority standard since dnsutils depends on
+    them and is priority standard
+
+ -- Bdale Garbee <bdale@gag.com>  Thu, 30 May 2002 10:38:39 -0600
+
+bind9 (1:9.2.0-6) unstable; urgency=low
+
+  * move to US main!  Yippee!  Closes: #123969
+  * add info to README.Debian about 2.5 kernels vs --disable-linux-caps
+
+ -- Bdale Garbee <bdale@gag.com>  Sat, 23 Mar 2002 00:18:05 -0700
+
+bind9 (1:9.2.0-5) unstable; urgency=medium
+
+  * clean up various issues in the rules file
+  * make bind9-host conflict/replace old dnsutils as host does, otherwise we
+    can have problems upgrading from potato to woody, closes: #136686
+  * use /dev/urandom for rndc-confgen in postinst, it should be good enough for
+    this purpose, and will keep the postinst from blocking arbitrarily.
+    closes: #130372
+  * add fresh pointers to chroot howto to README.Debian, closes: #135774
+
+ -- Bdale Garbee <bdale@gag.com>  Sun,  3 Mar 2002 16:47:12 -0700
+
+bind9 (1:9.2.0-4) unstable; urgency=low
+
+  * bind9-host needs to conflict with host, closes: #127395
+
+ -- Bdale Garbee <bdale@gag.com>  Tue,  1 Jan 2002 20:12:14 -0700
+
+bind9 (1:9.2.0-3) unstable; urgency=low
+
+  * force removal of old diverted files, closes: #126236
+  * change priority of liblwres1 from optional to standard per ftp admins
+  * add a bind9-host package so that the 'host' provided with the BIND 9.X
+    source tree can be an alternative to the aging NIKHEF version packaged
+    separately.  Update dnsutils dependencies to depend on one of the two,
+    with preference to this one since it has fewer bugs (but fewer features,
+    too).
+
+ -- Bdale Garbee <bdale@gag.com>  Sun, 23 Dec 2001 00:59:15 -0700
+
+bind9 (1:9.2.0-2) unstable; urgency=medium
+
+  * change rc.d links to ensure daemon starts before and stops after other
+    daemons that may fail if name service is not working (bug was filed 
+    against 8.X bind packages, but is just as relevant here!)
+  * use rndc for daemon shutdown instead of start-stop-daemon, closes: #111935
+  * add a postinst to dnsutils to remove any lingering diversions from old 
+    dnsutils packages, closes: #122227
+  * not much point in delivering zone2ldap.1 since we aren't delivering 
+    zone2ldap right now (though we might someday?), closes: #124058
+  * be more verbose with shared library descriptions, closes: #123426, #123428
+  * 9.2.0 added a new rndc.key file that both named and rndc will read to 
+    obtain a shared key, and rndc-confgen will easily create this file with 
+    a unique-per-system key.  Modify named.conf and remove rndc.conf
+    to take advantage of this mechanism and stop delivering a pre-determined 
+    static key to all Debian systems (which has been a mild security risk).  
+    Create the key in postinst if the key file doesn't already exist, and 
+    remove the file in postrm if purging.
+    Closes: #86718, #87208
+
+ -- Bdale Garbee <bdale@gag.com>  Fri, 21 Dec 2001 04:04:30 -0700
+
+bind9 (1:9.2.0-1) unstable; urgency=low
+
+  * new upstream version, closes: #108243, #112266, #114250, #119506, #120657
+  * /etc/bind/rndc.conf is now a conffile
+  * minor hacks to the README.Debian since the chroot instructions it points
+    to are 8.X specific, part of addressing bug 111868.
+  * libomapi is gone, replaced by libisccc and libisccfg
+  * a few lintian-motivated cosmetic cleanups
+  * lose task-dns-server meta package, since tasksel doesn't need it now
+  * dig problem not reproducible in this version, closes: #89526
+  * named-checkconf now uses $sysconfdir, closes: #107835
+  * no longer deliver man pages for contributed binaries we're not including
+    in dnsutils, closes: #108220
+  * fix section in nslookup man page, though that's the least of the man
+    page's problems...  glitch reported is unreproducible
+    closes: #103630, #120946
+  * update libbind-dev README.Debian, closes: #121050
+
+ -- Bdale Garbee <bdale@gag.com>  Tue, 27 Nov 2001 01:41:00 -0700
+
+bind9 (1:9.1.3-1) unstable; urgency=low
+
+  * new upstream version, closes: #96483, #99824, #100647, #101568, #103429
+  * update config.sub/guess for hppa/ia64 support
+  * small init.d patch from Marco d'Itri to ease adding options on invocation
+  * stop having bind9-doc conflict/replace bind-doc since they don't really
+    conflict and there's no reason to prevent having both installed at the
+    same time, closes: #90994
+  * the CHANGES file documents fixes since 9.1.1 that probably cured the
+    reported assertion failure.  If it turns out that I'm wrong, the bug can
+    be re-opened or a new one filed.  I can't see any way to reproduce the bug 
+    in a test case here.  Closes: #99352
+  * have libbind-dev depend on the runtime library packages it delivers 
+    compile-time symlinks for, closes: #100898, #103855
+  * fix lwres man pages to source man3/* instead of * so all the page content
+    can actually be found, closes: #85450, #103865
+
+ -- Bdale Garbee <bdale@gag.com>  Mon,  9 Jul 2001 11:30:39 -0600
+
+bind9 (1:9.1.1-1) unstable; urgency=low
+
+  * new upstream release
+  * update build-depends for libssl-dev
+  * add build-depends on bison, closes: #90150, #90752, #90159
+  * split up libbind0 since libdns is changing so numbers
+  * downgrade rblcheck from a depends to a suggests, closes: #90783
+  * bind9 mkdep creates files in the current working directory, closes: #58353
+
+ -- Bdale Garbee <bdale@gag.com>  Wed, 25 Apr 2001 22:53:21 -0600
+
+bind9 (1:9.1.0-3) unstable; urgency=low
+
+  * merge patch from Zack Weinberg that solves compilation problem, and 
+    reduces the memory footprint of applications by making configure.in
+    smarter.  Closes: #86776, #86910
+  * the bind-doc package includes all relevant documentation from the bind9
+    source tree, including HTML content in /usr/share/doc/bind9-doc/arm,
+    closes: #85718
+  * default named.conf and rndc.conf to not world-readable.  This is an
+    interim step towards addressing the concerns about security raised by 
+    bugs 86718 and closes: #86836  A better long-term solution would be for
+    rndc.conf to allow includes, so that both named.conf and rndc.conf could
+    include a key file built on the fly during installation while themselves
+    retaining conffile status.  The required functionality has been requested
+    of the bind9 upstream, this will limit vulnerability in the meantime.
+  * add replaces logic to the dnsutils package to avoid complaints about the
+    delivery of nsupdate.8.gz, closes: #86759
+  * move a couple of man pages back from dnsutils to bind9 that really belong
+    there.  sigh.
+
+ -- Bdale Garbee <bdale@gag.com>  Thu, 22 Feb 2001 16:39:02 -0700
+
+bind9 (1:9.1.0-2) unstable; urgency=low
+
+  * merge patch from Luca Filipozzi <lfilipoz@debian.org> - thanks!
+    + bind9:  ships with a working rndc.conf file, closes: #84572
+    + bind9:  init.d calls rndc rather than ndc on reload, closes: #85481
+    + bind9:  named.conf ships with 'key' and 'control' sections
+    + bind9:  correctly creates /var/cache/bind, closes: #85457
+    + lwresd: lwresd is split off into its own package, closes: #85627
+  * nsupdate is delivered by the dnsutils package, but the (wrong) man page 
+    was accidentally also included in the bind9 package, closes: #85717
+  * freshen config.sub and config.guess for ia64 and hppa support
+
+ -- Bdale Garbee <bdale@gag.com>  Mon, 12 Feb 2001 23:43:55 -0700
+
+bind9 (1:9.1.0-1) unstable; urgency=low
+
+  * Initial packaging of BIND 9.1.0.  Must use epoch so that meta packages 
+    retain their sequencing from the bind 8 package version stream.
+  * snarf a couple of man pages from the 8.X tree for now
+
+ -- Bdale Garbee <bdale@gag.com>  Thu,  1 Feb 2001 16:30:35 -0700
+
--- bind9-9.9.5.dfsg.orig/debian/compat
+++ bind9-9.9.5.dfsg/debian/compat
@@ -0,0 +1 @@
+5
--- bind9-9.9.5.dfsg.orig/debian/control
+++ bind9-9.9.5.dfsg/debian/control
@@ -0,0 +1,251 @@
+Source: bind9
+Section: net
+Priority: optional
+Maintainer: LaMont Jones <lamont@debian.org>
+Uploaders: Michael Gilbert <mgilbert@debian.org>
+Build-Depends: libkrb5-dev, debhelper (>= 5), libssl-dev, libtool, bison, libdb-dev (>>4.6), libldap2-dev, libxml2-dev, libcap2-dev [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], hardening-wrapper, libgeoip-dev (>= 1.4.6.dfsg-5), dpkg-dev (>= 1.15.5), python, python-argparse, dh-systemd, autotools-dev, dh-autoreconf
+Build-Conflicts: libdb4.2-dev
+Standards-Version: 3.7.3.0
+XS-Vcs-Browser: http://git.debian.org/?p=users/lamont/bind9.git
+XS-Vcs-Git: git://git.debian.org/~lamont/bind9.git
+
+Package: bind9
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, debconf | debconf-2.0, netbase, adduser, libdns100 (=${binary:Version}), libisccfg90 (=${binary:Version}), libisc95 (=${binary:Version}), libisccc90 (=${binary:Version}), lsb-base (>= 3.2-14), bind9utils (=${binary:Version}), liblwres90 (=${binary:Version}), libbind9-90 (=${binary:Version}), net-tools
+Conflicts: bind, apparmor-profiles (<< 2.1+1075-0ubuntu4)
+Replaces: bind, dnsutils (<< 1:9.1.0-3), apparmor-profiles (<< 2.1+1075-0ubuntu4), bind9utils (<< 1:9.9.3.dfsg.P2-3)
+Suggests: dnsutils, bind9-doc, resolvconf, ufw
+Description: Internet Domain Name Server
+ ${Description}
+ .
+ This package provides the server and related configuration files.
+
+Package: bind9utils
+Architecture: any
+Replaces: bind9 (<= 1:9.9.5.dfsg-1)
+Depends: ${shlibs:Depends}, ${misc:Depends}, python, python-argparse
+Description: Utilities for BIND
+ This package provides various utilities that are useful for maintaining a
+ working BIND installation.
+
+Package: bind9-doc
+Architecture: all
+Section: doc
+Depends: ${misc:Depends}
+Description: Documentation for BIND
+ This package provides various documents that are useful for maintaining a
+ working BIND installation.
+
+Package: host
+Priority: standard
+Architecture: all
+Depends: ${misc:Depends}, bind9-host
+Description: Transitional package
+ This dummy package is provided for a smooth transition from the previous
+ host package.  It may safely be removed after installation.
+
+Package: bind9-host
+Priority: standard
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, libdns100 (=${binary:Version}), libisccfg90 (=${binary:Version}), libisc95 (=${binary:Version}), liblwres90 (=${binary:Version}), libbind9-90 (=${binary:Version})
+Conflicts: host (<<1:9.7.0), dnsutils (<< 1:9.0.0)
+Replaces: dnsutils (<< 1:9.0.0), host (<< 1:9.7.0)
+Provides: host
+Description: Version of 'host' bundled with BIND 9.X
+ This package provides the 'host' program in the form that is bundled with
+ the BIND 9.X sources.
+
+Package: libbind-dev
+Section: libdevel
+Architecture: any
+Conflicts: bind-dev
+Replaces: bind-dev
+Depends: ${misc:Depends}, libdns100 (=${binary:Version}), libisccfg90 (=${binary:Version}), libisc95 (=${binary:Version}), liblwres90 (=${binary:Version}), libbind9-90 (=${binary:Version})
+Description: Static Libraries and Headers used by BIND
+ This package delivers archive-style libraries, header files, and API man
+ pages for libbind, libdns, libisc, and liblwres.  These are only needed 
+ if you want to compile other packages that need more nameserver API than the 
+ resolver code provided in libc.
+
+Package: libbind9-90
+Section: libs
+Priority: standard
+Architecture: any
+Conflicts: libbind0, libbind9-41
+Replaces: libbind0
+Depends: ${shlibs:Depends}, ${misc:Depends}, libdns100, libisccfg90, libisc95
+Description: BIND9 Shared Library used by BIND
+ ${Description}
+ .
+ This package delivers the libbind9 shared library used by BIND's daemons and
+ clients.
+
+Package: libdns100
+Section: libs
+Priority: standard
+Architecture: any
+Conflicts: libbind0, libbind9-41
+Replaces: libbind0
+Depends: ${shlibs:Depends}, ${misc:Depends}, libisc95
+Description: DNS Shared Library used by BIND
+ ${Description}
+ .
+ This package delivers the libdns shared library used by BIND's daemons and
+ clients.
+
+Package: libisc95
+Section: libs
+Priority: standard
+Architecture: any
+Conflicts: libbind0, libbind9-41
+Replaces: libbind0
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: ISC Shared Library used by BIND
+ ${Description}
+ .
+ This package delivers the libisc shared library used by BIND's daemons and
+ clients.
+
+Package: liblwres90
+Section: libs
+Priority: standard
+Architecture: any
+Replaces: libbind0
+Conflicts: libbind0
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Lightweight Resolver Library used by BIND
+ ${Description}
+ .
+ This package delivers the liblwres shared library used by BIND's daemons
+ and clients.
+
+Package: libisccc90
+Section: libs
+Architecture: any
+Conflicts: libbind0, libbind9-41
+Replaces: libbind0
+Depends: ${shlibs:Depends}, ${misc:Depends}, libisc95
+Description: Command Channel Library used by BIND
+ ${Description}
+ .
+ This package delivers the libisccc shared library used by BIND's daemons
+ and clients, particularly rndc.
+
+Package: libisccfg90
+Section: libs
+Architecture: any
+Conflicts: libbind0, libbind9-41
+Replaces: libbind0
+Depends: ${shlibs:Depends}, ${misc:Depends}, libdns100, libisccc90, libisc95
+Description: Config File Handling Library used by BIND
+ ${Description}
+ .
+ This package delivers the libisccfg shared library used by BIND's daemons
+ and clients to read and write ISC-style configuration files like named.conf
+ and rndc.conf.
+
+Package: dnsutils
+Priority: standard
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, bind9-host | host, libdns100 (=${binary:Version}), libisccfg90 (=${binary:Version}), libisc95 (=${binary:Version}), liblwres90 (=${binary:Version}), libbind9-90 (=${binary:Version})
+Suggests: rblcheck
+Conflicts: netstd (<< 2.00)
+Replaces: bind, bind9 (<< 1:9.1.0-3)
+Description: Clients provided with BIND
+ ${Description}
+ .
+ This package delivers various client programs related to DNS that are 
+ derived from the BIND source tree.
+ .
+  - dig - query the DNS in various ways
+  - nslookup - the older way to do it
+  - nsupdate - perform dynamic updates (See RFC2136)
+
+Package: lwresd
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, adduser, libdns100 (=${binary:Version}), libisccfg90 (=${binary:Version}), libisccc90 (=${binary:Version}), libisc95 (=${binary:Version}), liblwres90 (=${binary:Version}), libbind9-90 (=${binary:Version})
+Recommends: libnss-lwres
+Suggests: bind9utils
+Description: Lightweight Resolver Daemon
+ lwresd is the daemon providing name lookup services to clients that use
+ the BIND 9 lightweight resolver library.  It is essentially a stripped-
+ down, caching-only name server that answers queries using the BIND 9
+ lightweight resolver protocol rather than the DNS protocol.
+
+Package: libbind-export-dev
+Section: libdevel
+Architecture: any
+Conflicts: libbind-dev
+Depends: ${misc:Depends}, libdns-export100 (=${binary:Version}), libisccfg-export90 (=${binary:Version}), libisc-export95 (=${binary:Version}), libirs-export91 (=${binary:Version})
+Description: Development files for the exported BIND libraries
+ ${Description}
+ .
+ This package delivers development files for the exported BIND libraries.
+
+Package: libdns-export100
+Section: libs
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Exported DNS Shared Library
+ ${Description}
+ .
+ This package delivers the exported libdns shared library.
+
+Package: libdns-export100-udeb
+Section: debian-installer
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Package-Type: udeb
+Description: Exported DNS library for debian-installer
+
+Package: libisc-export95
+Section: libs
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Exported ISC Shared Library 
+ ${Description}
+ .
+ This package delivers the exported libisc shared library.
+
+Package: libisc-export95-udeb
+Section: debian-installer
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Package-Type: udeb
+Description: Exported ISC library for debian-installer
+
+Package: libisccfg-export90
+Section: libs
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Exported ISC CFG Shared Library
+ ${Description}
+ .
+ This package delivers the exported libisccfg shared library.
+
+Package: libisccfg-export90-udeb
+Section: debian-installer
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Package-Type: udeb
+Description: Exported ISC CFG library for debian-installer
+
+Package: libirs-export91
+Section: libs
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: Exported IRS Shared Library
+ ${Description}
+ .
+ This package delivers the exported libirs shared library.
+
+Package: libirs-export91-udeb
+Section: debian-installer
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Package-Type: udeb
+Description: Exported IRS library for debian-installer
--- bind9-9.9.5.dfsg.orig/debian/copyright
+++ bind9-9.9.5.dfsg/debian/copyright
@@ -0,0 +1,121 @@
+This package was debianized by Bdale Garbee <bdale@gag.com> on
+Tue, 12 Dec 2000 02:42:56 -0700.
+
+It was downloaded from http://www.isc.org/products/BIND/ and can be fetched
+from git with:
+    git clone git://git.debian.org/users/lamont/bind9.git
+ISC releases can be cloned from git with:
+    git clone git://git.debian.org/users/lamont/bind9-isc.git
+
+Upstream Author: Internet Systems Consortium, Inc. ("ISC")
+
+Copyright:
+
+Copyright (C) 2004-2010  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2003  Internet Software Consortium.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+
+Portions Copyright (C) 1996-2001  Nominum, Inc.
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NOMINUM DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL NOMINUM BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+Portions Copyright (c) 2000 Japan Network Information Center.  All rights reserved.
+ 
+By using this file, you agree to the terms and conditions set forth bellow.
+
+			LICENSE TERMS AND CONDITIONS 
+
+The following License Terms and Conditions apply, unless a different
+license is obtained from Japan Network Information Center ("JPNIC"),
+a Japanese association, Kokusai-Kougyou-Kanda Bldg 6F, 2-3-4 Uchi-Kanda,
+Chiyoda-ku, Tokyo 101-0047, Japan.
+
+1. Use, Modification and Redistribution (including distribution of any
+   modified or derived work) in source and/or binary forms is permitted
+   under this License Terms and Conditions.
+
+2. Redistribution of source code must retain the copyright notices as they
+   appear in each source code file, this License Terms and Conditions.
+
+3. Redistribution in binary form must reproduce the Copyright Notice,
+   this License Terms and Conditions, in the documentation and/or other
+   materials provided with the distribution.  For the purposes of binary
+   distribution the "Copyright Notice" refers to the following language:
+   "Copyright (c) 2000-2002 Japan Network Information Center.  All rights reserved."
+
+4. The name of JPNIC may not be used to endorse or promote products
+   derived from this Software without specific prior written approval of
+   JPNIC.
+
+5. Disclaimer/Limitation of Liability: THIS SOFTWARE IS PROVIDED BY JPNIC
+   "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+   LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+   PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL JPNIC BE LIABLE
+   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+   CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+   SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+   BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+   WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+   OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+   ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+Portions Copyright (c) 2005 - 2008, Holger Zuleger HZnet. All rights reserved.
+
+This software is open source.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+Redistributions of source code must retain the above copyright notice,
+this list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+Neither the name of Holger Zuleger HZnet nor the names of its contributors may
+be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+Portions Copyright(C) Jason Vas Dias, Red Hat Inc., 2005
+Modified by Adam Tkac, Red Hat Inc., 2007
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation at 
+         http://www.fsf.org/licensing/licenses/gpl.txt
+and found in /usr/share/common-licenses.
--- bind9-9.9.5.dfsg.orig/debian/db.0
+++ bind9-9.9.5.dfsg/debian/db.0
@@ -0,0 +1,12 @@
+;
+; BIND reverse data file for broadcast zone
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
--- bind9-9.9.5.dfsg.orig/debian/db.127
+++ bind9-9.9.5.dfsg/debian/db.127
@@ -0,0 +1,13 @@
+;
+; BIND reverse data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+1.0.0	IN	PTR	localhost.
--- bind9-9.9.5.dfsg.orig/debian/db.empty
+++ bind9-9.9.5.dfsg/debian/db.empty
@@ -0,0 +1,14 @@
+; BIND reverse data file for empty rfc1918 zone
+;
+; DO NOT EDIT THIS FILE - it is used for multiple zones.
+; Instead, copy it, edit named.conf, and use that copy.
+;
+$TTL	86400
+@	IN	SOA	localhost. root.localhost. (
+			      1		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			  86400 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
--- bind9-9.9.5.dfsg.orig/debian/db.local
+++ bind9-9.9.5.dfsg/debian/db.local
@@ -0,0 +1,14 @@
+;
+; BIND data file for local loopback interface
+;
+$TTL	604800
+@	IN	SOA	localhost. root.localhost. (
+			      2		; Serial
+			 604800		; Refresh
+			  86400		; Retry
+			2419200		; Expire
+			 604800 )	; Negative Cache TTL
+;
+@	IN	NS	localhost.
+@	IN	A	127.0.0.1
+@	IN	AAAA	::1
--- bind9-9.9.5.dfsg.orig/debian/db.root
+++ bind9-9.9.5.dfsg/debian/db.root
@@ -0,0 +1,88 @@
+;       This file holds the information on root name servers needed to
+;       initialize cache of Internet domain name servers
+;       (e.g. reference this file in the "cache  .  <file>"
+;       configuration file of BIND domain name servers).
+;
+;       This file is made available by InterNIC 
+;       under anonymous FTP as
+;           file                /domain/named.cache
+;           on server           FTP.INTERNIC.NET
+;       -OR-                    RS.INTERNIC.NET
+;
+;       last update:    Jan 3, 2013
+;       related version of root zone:   2013010300
+;
+; formerly NS.INTERNIC.NET
+;
+.                        3600000  IN  NS    A.ROOT-SERVERS.NET.
+A.ROOT-SERVERS.NET.      3600000      A     198.41.0.4
+A.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:BA3E::2:30
+;
+; FORMERLY NS1.ISI.EDU
+;
+.                        3600000      NS    B.ROOT-SERVERS.NET.
+B.ROOT-SERVERS.NET.      3600000      A     192.228.79.201
+;
+; FORMERLY C.PSI.NET
+;
+.                        3600000      NS    C.ROOT-SERVERS.NET.
+C.ROOT-SERVERS.NET.      3600000      A     192.33.4.12
+;
+; FORMERLY TERP.UMD.EDU
+;
+.                        3600000      NS    D.ROOT-SERVERS.NET.
+D.ROOT-SERVERS.NET.      3600000      A     199.7.91.13
+D.ROOT-SERVERS.NET.	 3600000      AAAA  2001:500:2D::D
+;
+; FORMERLY NS.NASA.GOV
+;
+.                        3600000      NS    E.ROOT-SERVERS.NET.
+E.ROOT-SERVERS.NET.      3600000      A     192.203.230.10
+;
+; FORMERLY NS.ISC.ORG
+;
+.                        3600000      NS    F.ROOT-SERVERS.NET.
+F.ROOT-SERVERS.NET.      3600000      A     192.5.5.241
+F.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:2F::F
+;
+; FORMERLY NS.NIC.DDN.MIL
+;
+.                        3600000      NS    G.ROOT-SERVERS.NET.
+G.ROOT-SERVERS.NET.      3600000      A     192.112.36.4
+;
+; FORMERLY AOS.ARL.ARMY.MIL
+;
+.                        3600000      NS    H.ROOT-SERVERS.NET.
+H.ROOT-SERVERS.NET.      3600000      A     128.63.2.53
+H.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:1::803F:235
+;
+; FORMERLY NIC.NORDU.NET
+;
+.                        3600000      NS    I.ROOT-SERVERS.NET.
+I.ROOT-SERVERS.NET.      3600000      A     192.36.148.17
+I.ROOT-SERVERS.NET.      3600000      AAAA  2001:7FE::53
+;
+; OPERATED BY VERISIGN, INC.
+;
+.                        3600000      NS    J.ROOT-SERVERS.NET.
+J.ROOT-SERVERS.NET.      3600000      A     192.58.128.30
+J.ROOT-SERVERS.NET.      3600000      AAAA  2001:503:C27::2:30
+;
+; OPERATED BY RIPE NCC
+;
+.                        3600000      NS    K.ROOT-SERVERS.NET.
+K.ROOT-SERVERS.NET.      3600000      A     193.0.14.129
+K.ROOT-SERVERS.NET.      3600000      AAAA  2001:7FD::1
+;
+; OPERATED BY ICANN
+;
+.                        3600000      NS    L.ROOT-SERVERS.NET.
+L.ROOT-SERVERS.NET.      3600000      A     199.7.83.42
+L.ROOT-SERVERS.NET.      3600000      AAAA  2001:500:3::42
+;
+; OPERATED BY WIDE
+;
+.                        3600000      NS    M.ROOT-SERVERS.NET.
+M.ROOT-SERVERS.NET.      3600000      A     202.12.27.33
+M.ROOT-SERVERS.NET.      3600000      AAAA  2001:DC3::35
+; End of File
--- bind9-9.9.5.dfsg.orig/debian/dnsutils.dirs
+++ bind9-9.9.5.dfsg/debian/dnsutils.dirs
@@ -0,0 +1,3 @@
+usr/bin
+usr/share/doc/dnsutils
+usr/share/man/man1
--- bind9-9.9.5.dfsg.orig/debian/dnsutils.install
+++ bind9-9.9.5.dfsg/debian/dnsutils.install
@@ -0,0 +1,6 @@
+usr/bin/dig
+usr/bin/nslookup
+usr/bin/nsupdate
+usr/share/man/man1/dig.1*
+usr/share/man/man1/nslookup.1*
+usr/share/man/man1/nsupdate.1*
--- bind9-9.9.5.dfsg.orig/debian/dnsutils.postinst
+++ bind9-9.9.5.dfsg/debian/dnsutils.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/ip-down.d
+++ bind9-9.9.5.dfsg/debian/ip-down.d
@@ -0,0 +1,15 @@
+#!/bin/sh -e
+# Called when an interface disconnects
+# Written by LaMont Jones <lamont@debian.org>
+
+# kick named as needed
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/sbin ]; then
+	exit 0
+fi
+
+# if named is running, reconfig it.
+rndc reconfig >/dev/null 2>&1 &
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/ip-up.d
+++ bind9-9.9.5.dfsg/debian/ip-up.d
@@ -0,0 +1,15 @@
+#!/bin/sh -e
+# Called when a new interface comes up
+# Written by LaMont Jones <lamont@debian.org>
+
+# kick named as needed
+
+# If /usr isn't mounted yet, silently bail.
+if [ ! -d /usr/sbin ]; then
+	exit 0
+fi
+
+# if named is running, reconfig it.
+rndc reconfig >/dev/null 2>&1 &
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/libbind-dev.README.Debian
+++ bind9-9.9.5.dfsg/debian/libbind-dev.README.Debian
@@ -0,0 +1,9 @@
+The include files for BIND are in /usr/include/{isc,dns,dst,lwres}.  If 
+you're compiling something that uses them, use something like 
+
+	'-I/usr/include/isc' 
+
+and so on in the call to the compiler to pick up the BIND versions before 
+the normal system versions for files that have conflicting filenames.
+
+
--- bind9-9.9.5.dfsg.orig/debian/libbind-dev.dirs
+++ bind9-9.9.5.dfsg/debian/libbind-dev.dirs
@@ -0,0 +1,2 @@
+usr/include
+usr/lib
--- bind9-9.9.5.dfsg.orig/debian/libbind-dev.install
+++ bind9-9.9.5.dfsg/debian/libbind-dev.install
@@ -0,0 +1,17 @@
+usr/include
+../../lib/dns/include/dns/dlz_dlopen.h usr/include/dns
+
+usr/lib/libbind9.a
+usr/lib/libbind9.so
+usr/lib/libdns.a
+usr/lib/libdns.so
+usr/lib/libisc.a
+usr/lib/libisc.so
+usr/lib/liblwres.a
+usr/lib/liblwres.so
+usr/lib/libisccc.a
+usr/lib/libisccc.so
+usr/lib/libisccfg.a
+usr/lib/libisccfg.so
+usr/share/man/man3
+usr/bin/isc-config.sh
--- bind9-9.9.5.dfsg.orig/debian/libbind-export-dev.install
+++ bind9-9.9.5.dfsg/debian/libbind-export-dev.install
@@ -0,0 +1,3 @@
+usr/lib/*/*.a
+usr/lib/*/*.so
+usr/include/bind-export
--- bind9-9.9.5.dfsg.orig/debian/libbind9-90.install
+++ bind9-9.9.5.dfsg/debian/libbind9-90.install
@@ -0,0 +1 @@
+usr/lib/libbind9.so.90*
--- bind9-9.9.5.dfsg.orig/debian/libbind9-90.postinst
+++ bind9-9.9.5.dfsg/debian/libbind9-90.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/libbind9-90.postrm
+++ bind9-9.9.5.dfsg/debian/libbind9-90.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+# postrm script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/libdns-export100-udeb.install
+++ bind9-9.9.5.dfsg/debian/libdns-export100-udeb.install
@@ -0,0 +1 @@
+lib/*/libdns-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libdns-export100.install
+++ bind9-9.9.5.dfsg/debian/libdns-export100.install
@@ -0,0 +1 @@
+lib/*/libdns-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libdns100.install
+++ bind9-9.9.5.dfsg/debian/libdns100.install
@@ -0,0 +1 @@
+usr/lib/libdns.so.100*
--- bind9-9.9.5.dfsg.orig/debian/libdns100.postinst
+++ bind9-9.9.5.dfsg/debian/libdns100.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/libdns100.postrm
+++ bind9-9.9.5.dfsg/debian/libdns100.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+# postrm script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/libirs-export91-udeb.install
+++ bind9-9.9.5.dfsg/debian/libirs-export91-udeb.install
@@ -0,0 +1 @@
+lib/*/libirs-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libirs-export91.install
+++ bind9-9.9.5.dfsg/debian/libirs-export91.install
@@ -0,0 +1 @@
+lib/*/libirs-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libirs91.install
+++ bind9-9.9.5.dfsg/debian/libirs91.install
@@ -0,0 +1 @@
+usr/lib/libirs.so.91*
--- bind9-9.9.5.dfsg.orig/debian/libirs91.postinst
+++ bind9-9.9.5.dfsg/debian/libirs91.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/libirs91.postrm
+++ bind9-9.9.5.dfsg/debian/libirs91.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+# postrm script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/libisc-export95-udeb.install
+++ bind9-9.9.5.dfsg/debian/libisc-export95-udeb.install
@@ -0,0 +1 @@
+lib/*/libisc-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libisc-export95.install
+++ bind9-9.9.5.dfsg/debian/libisc-export95.install
@@ -0,0 +1 @@
+lib/*/libisc-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libisc95.install
+++ bind9-9.9.5.dfsg/debian/libisc95.install
@@ -0,0 +1 @@
+usr/lib/libisc.so.95*
--- bind9-9.9.5.dfsg.orig/debian/libisc95.postinst
+++ bind9-9.9.5.dfsg/debian/libisc95.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/libisc95.postrm
+++ bind9-9.9.5.dfsg/debian/libisc95.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+# postrm script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/libisccc90.install
+++ bind9-9.9.5.dfsg/debian/libisccc90.install
@@ -0,0 +1 @@
+usr/lib/libisccc.so.90*
--- bind9-9.9.5.dfsg.orig/debian/libisccc90.postinst
+++ bind9-9.9.5.dfsg/debian/libisccc90.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/libisccc90.postrm
+++ bind9-9.9.5.dfsg/debian/libisccc90.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+# postrm script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/libisccfg-export90-udeb.install
+++ bind9-9.9.5.dfsg/debian/libisccfg-export90-udeb.install
@@ -0,0 +1 @@
+lib/*/libisccfg-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libisccfg-export90.install
+++ bind9-9.9.5.dfsg/debian/libisccfg-export90.install
@@ -0,0 +1 @@
+lib/*/libisccfg-export.so.*
--- bind9-9.9.5.dfsg.orig/debian/libisccfg90.install
+++ bind9-9.9.5.dfsg/debian/libisccfg90.install
@@ -0,0 +1 @@
+usr/lib/libisccfg.so.90*
--- bind9-9.9.5.dfsg.orig/debian/libisccfg90.postinst
+++ bind9-9.9.5.dfsg/debian/libisccfg90.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/libisccfg90.postrm
+++ bind9-9.9.5.dfsg/debian/libisccfg90.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+# postrm script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/liblwres90.install
+++ bind9-9.9.5.dfsg/debian/liblwres90.install
@@ -0,0 +1 @@
+usr/lib/liblwres.so.90*
--- bind9-9.9.5.dfsg.orig/debian/liblwres90.postinst
+++ bind9-9.9.5.dfsg/debian/liblwres90.postinst
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+#DEBHELPER#
--- bind9-9.9.5.dfsg.orig/debian/libwres90.postrm
+++ bind9-9.9.5.dfsg/debian/libwres90.postrm
@@ -0,0 +1,10 @@
+#!/bin/sh
+# postrm script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+#DEBHELPER#
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/lwresd.dirs
+++ bind9-9.9.5.dfsg/debian/lwresd.dirs
@@ -0,0 +1,5 @@
+etc/bind
+usr/sbin
+usr/share/man/man8
+usr/share/doc/lwresd
+var/run/named
--- bind9-9.9.5.dfsg.orig/debian/lwresd.init
+++ bind9-9.9.5.dfsg/debian/lwresd.init
@@ -0,0 +1,72 @@
+#!/bin/sh
+
+### BEGIN INIT INFO
+# Provides:          lwresd
+# Required-Start:    $remote_fs
+# Should-Start:	     $syslog $network
+# Required-Stop:     $remote_fs
+# Should-Stop:	     $syslog $network
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Start and stop the Lightweight Resolver Daemon.
+### END INIT INFO
+
+. /lib/lsb/init-functions
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin
+NAME=lwresd
+DAEMON=/usr/sbin/lwresd
+PIDFILE=/var/run/lwresd/lwresd.pid
+
+# Don't modify this line, change or create /etc/default/lwresd.
+OPTIONS=""
+
+test -f /etc/default/lwresd && . /etc/default/lwresd
+
+test -x $DAEMON || exit 0
+
+case "$1" in
+    start)
+	modprobe capability >/dev/null 2>&1 || true
+
+	# dirs under /var/run can go away on reboots.
+	mkdir -p ${PIDFILE%/*}
+	chmod 775 ${PIDFILE%/*}
+	chown root:bind ${PIDFILE%/*} >/dev/null 2>&1 || true
+
+	log_daemon_msg "Starting domain name service" $NAME
+	if start-stop-daemon --start --quiet --exec $DAEMON  -- $OPTIONS; then
+	    log_end_msg 0
+	else
+	    log_end_msg 1
+	fi
+    ;;
+
+    stop)
+	log_daemon_msg "Stopping domain name service" $NAME
+	if start-stop-daemon --stop --quiet  \
+	    --pidfile ${PIDFILE} --exec $DAEMON; then
+	    log_end_msg 0
+	else
+	    log_end_msg 1
+	fi
+    ;;
+
+    status)
+	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+    ;;
+
+
+    restart|force-reload)
+	$0 stop
+	sleep 2
+	$0 start
+    ;;
+    
+    *)
+	log_action_msg "Usage: /etc/init.d/$NAME {start|stop|restart|force-reload}"
+	exit 1
+    ;;
+esac
+
+exit 0
--- bind9-9.9.5.dfsg.orig/debian/lwresd.install
+++ bind9-9.9.5.dfsg/debian/lwresd.install
@@ -0,0 +1,2 @@
+usr/sbin/lwresd
+usr/share/man/man8/lwresd.8*
--- bind9-9.9.5.dfsg.orig/debian/lwresd.postinst
+++ bind9-9.9.5.dfsg/debian/lwresd.postinst
@@ -0,0 +1,40 @@
+#!/bin/sh
+set -e
+
+#DEBHELPER#
+
+case "$1" in
+    configure)
+	OLDVERSION="$2"
+	# see below
+	;;
+
+    abort-upgrade)
+	exit 0
+	;;
+
+    abort-remove|abort-deconfigure)
+	exit 0
+	;;
+
+    *)
+	echo "postinst called with unknown argument \`$1'" >&2
+	exit 1
+	;;
+esac
+
+# lets give them a bind user/group in all cases.
+getent group bind >/dev/null 2>&1 || addgroup --system bind
+getent passwd bind >/dev/null 2>&1 ||
+    adduser --system --home /var/cache/bind --no-create-home \
+	    --disabled-password --ingroup bind bind
+
+if [ ! -s /etc/bind/rndc.key ] && [ -x /usr/sbin/rndc-confgen ]; then
+    rndc-confgen -r /dev/urandom -a
+fi
+
+if pidof /usr/sbin/lwresd >/dev/null 2>&1; then
+    invoke-rc.d lwresd restart
+else
+    invoke-rc.d lwresd start
+fi
--- bind9-9.9.5.dfsg.orig/debian/lwresd.service
+++ bind9-9.9.5.dfsg/debian/lwresd.service
@@ -0,0 +1,10 @@
+[Unit]
+Description=Lightweight Resolver Daemon
+Documentation=man:lwresd(8)
+After=network.target
+
+[Service]
+ExecStart=/usr/sbin/lwresd -f
+
+[Install]
+WantedBy=multi-user.target
--- bind9-9.9.5.dfsg.orig/debian/lwresd.tmpfile
+++ bind9-9.9.5.dfsg/debian/lwresd.tmpfile
@@ -0,0 +1 @@
+d /run/lwresd 0775 root bind - -
--- bind9-9.9.5.dfsg.orig/debian/named.conf
+++ bind9-9.9.5.dfsg/debian/named.conf
@@ -0,0 +1,11 @@
+// This is the primary configuration file for the BIND DNS server named.
+//
+// Please read /usr/share/doc/bind9/README.Debian.gz for information on the 
+// structure of BIND configuration files in Debian, *BEFORE* you customize 
+// this configuration file.
+//
+// If you are just adding zones, please do that in /etc/bind/named.conf.local
+
+include "/etc/bind/named.conf.options";
+include "/etc/bind/named.conf.local";
+include "/etc/bind/named.conf.default-zones";
--- bind9-9.9.5.dfsg.orig/debian/named.conf.default-zones
+++ bind9-9.9.5.dfsg/debian/named.conf.default-zones
@@ -0,0 +1,30 @@
+// prime the server with knowledge of the root servers
+zone "." {
+	type hint;
+	file "/etc/bind/db.root";
+};
+
+// be authoritative for the localhost forward and reverse zones, and for
+// broadcast zones as per RFC 1912
+
+zone "localhost" {
+	type master;
+	file "/etc/bind/db.local";
+};
+
+zone "127.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.127";
+};
+
+zone "0.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.0";
+};
+
+zone "255.in-addr.arpa" {
+	type master;
+	file "/etc/bind/db.255";
+};
+
+
--- bind9-9.9.5.dfsg.orig/debian/named.conf.local
+++ bind9-9.9.5.dfsg/debian/named.conf.local
@@ -0,0 +1,8 @@
+//
+// Do any local configuration here
+//
+
+// Consider adding the 1918 zones here, if they are not used in your
+// organization
+//include "/etc/bind/zones.rfc1918";
+
--- bind9-9.9.5.dfsg.orig/debian/named.conf.options
+++ bind9-9.9.5.dfsg/debian/named.conf.options
@@ -0,0 +1,26 @@
+options {
+	directory "/var/cache/bind";
+
+	// If there is a firewall between you and nameservers you want
+	// to talk to, you may need to fix the firewall to allow multiple
+	// ports to talk.  See http://www.kb.cert.org/vuls/id/800113
+
+	// If your ISP provided one or more IP addresses for stable 
+	// nameservers, you probably want to use them as forwarders.  
+	// Uncomment the following block, and insert the addresses replacing 
+	// the all-0's placeholder.
+
+	// forwarders {
+	// 	0.0.0.0;
+	// };
+
+	//========================================================================
+	// If BIND logs error messages about the root key being expired,
+	// you will need to update your keys.  See https://www.isc.org/bind-keys
+	//========================================================================
+	dnssec-validation auto;
+
+	auth-nxdomain no;    # conform to RFC1035
+	listen-on-v6 { any; };
+};
+
--- bind9-9.9.5.dfsg.orig/debian/nslookup.1
+++ bind9-9.9.5.dfsg/debian/nslookup.1
@@ -0,0 +1,536 @@
+.\"
+.\" ++Copyright++ 1985, 1989
+.\" -
+.\" Copyright (c) 1985, 1989
+.\"    The Regents of the University of California.  All rights reserved.
+.\" 
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. All advertising materials mentioning features or use of this software
+.\"    must display the following acknowledgement:
+.\" 	This product includes software developed by the University of
+.\" 	California, Berkeley and its contributors.
+.\" 4. Neither the name of the University nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\" 
+.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\" -
+.\" Portions Copyright (c) 1993 by Digital Equipment Corporation.
+.\" 
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies, and that
+.\" the name of Digital Equipment Corporation not be used in advertising or
+.\" publicity pertaining to distribution of the document or software without
+.\" specific, written prior permission.
+.\" 
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+.\" WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+.\" CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+.\" DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+.\" PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+.\" ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+.\" SOFTWARE.
+.\" -
+.\" --Copyright--
+.\"
+.\"	@(#)nslookup.8	5.3 (Berkeley) 6/24/90
+.\"
+.Dd June 24, 1990
+.Dt NSLOOKUP 1
+.Os BSD 4
+.Sh NAME
+.Nm nslookup 
+.Nd query Internet name servers interactively
+.Sh SYNOPSIS
+.Nm nslookup
+.Op Fl option Ar ...
+.Op Ar host-to-find | Fl Op Ar server
+.Sh DESCRIPTION
+.Ic Nslookup
+is a program to query Internet domain name servers. 
+.Ic Nslookup 
+has two modes: interactive and non-interactive.
+Interactive mode allows the user to query name servers for
+information about various hosts and domains or to print a list of hosts 
+in a domain. 
+Non-interactive mode is used to print just the name and requested information
+for a host or domain.
+.Sh ARGUMENTS
+Interactive mode is entered in the following cases:
+.Bl -tag -width "a)  " 
+.It a)
+when no arguments are given (the default name server will be used),
+.It b)
+when the first argument is a hyphen (-) and the second argument
+is the host name or Internet address of a name server.
+.El
+.Pp
+Non-interactive mode is used when the name or Internet address 
+of the host to be looked up
+is given as the first argument. The optional second argument specifies
+the host name or address of a name server.
+.Pp
+The options listed under the 
+.Dq Li set 
+command below can be specified in
+the 
+.Pa .nslookuprc 
+file in the user's home directory if they are listed 
+one per line.  Options can also be specified
+on the command line if they precede the arguments and are prefixed with
+a hyphen.  For example, to change the default query type to host information,
+and the initial timeout to 10 seconds, type:
+.Bd -literal -offset indent
+	nslookup -query=hinfo  -timeout=10
+.Ed
+.Sh INTERACTIVE COMMANDS
+Commands may be interrupted at any time by typing a control-C.
+To exit, type a control-D 
+.Pq Dv EOF 
+or type 
+.Li exit .
+The command line length must be less than 256 characters.
+To treat a built-in command as a host name, 
+precede it with an escape character 
+.Pq .&\\ . 
+.Sy N.B.:  An unrecognized command will be interpreted as a host name.
+.Bl -tag -width "lserver" 
+.It Ar host Op Ar server
+Look up information for 
+.Ar host 
+using the current default server or using 
+.Ar server , 
+if specified.
+If 
+.Ar host 
+is an Internet address and the query type is 
+.Dv A 
+or 
+.Dv PTR , 
+the name of the host is returned.
+If 
+.Ar host 
+is a name and does not have a trailing period, the default 
+domain name is appended to the name.  (This behavior depends on the state of the
+.Ic set
+options 
+.Ic domain , srchlist , defname , 
+and 
+.Ic search . )
+.Pp
+To look up a host not in the current domain, append a period to 
+the name.
+.It Ic server Ar domain
+.It Ic lserver Ar domain
+Change the default server to 
+.Ar domain ; 
+.Ic lserver 
+uses the initial server to look up information about 
+.Ar domain ,
+while 
+.Ic server
+uses the current default server. 
+If an authoritative answer can't be found, the names of servers
+that might have the answer are returned.
+.It Ic root
+Changes the default server to the server for the root of the domain name space.
+Currently, the host 
+.Li ns.internic.net 
+is used.
+(This command is a synonym for 
+.Dq Ic lserver ns.internic.net . )
+The name of the root server can be changed with the 
+.Dq Ic set root 
+command.
+.It Xo Ic finger Op Ar name 
+.Op Ic > Ar filename
+.Xc
+.It Xo Ic finger Op Ar name 
+.Op Ic >> Ar filename
+.Xc
+Connects with the finger server on the current host. 
+The current host is defined when a previous lookup for a host
+was successful and returned address information (see the 
+.Dq Ic set querytype=A 
+command).
+The 
+.Ar name 
+is optional. 
+.Ic > 
+and 
+.Ic >> 
+can be used to redirect output in the usual manner.
+.It Xo Ic ls Op Ar option 
+.Ar domain Op Ic > Ar filename
+.Xc
+.It Xo Ic ls Op Ar option 
+.Ar domain Op Ic >> Ar filename
+.Xc
+List the information available for 
+.Ar domain , 
+optionally creating or appending to 
+.Ar filename .
+The default output contains host names and their Internet addresses. 
+.Ar Option 
+can be one of the following:
+.Bl -tag -width "-a  "
+.It Fl t Ar querytype
+lists all records of the specified type (see 
+.Ar querytype 
+below).
+.It Fl a
+lists aliases of hosts in the domain;
+synonym for 
+.Dq Fl t Dv CNAME .
+.It Fl d
+lists all records for the domain;
+synonym for 
+.Dq Fl t Dv ANY .
+.It Fl h
+lists CPU and operating system information for the domain;
+synonym for 
+.Dq Fl t Dv HINFO .
+.It Fl s
+lists well-known services of hosts in the domain;
+synonym for 
+.Dq Fl t Dv WKS .
+.El
+.Pp
+When output is directed to a file, hash marks are printed for every
+50 records received from the server.
+.It Ic view Ar filename
+Sorts and lists the output of previous 
+.Ic ls 
+command(s) with 
+.Xr more @CMD_EXT@ .
+.It Ic help
+.It Ic ?
+Prints a brief summary of commands.
+.It Ic exit
+Exits the program.
+.It Xo Ic set Ar keyword 
+.Ns Op = Ns Ar value
+.Xc
+This command is used to change state information that affects the lookups.
+Valid keywords are:
+.Bl -tag -width "class=v"
+.It Ic all
+Prints the current values of the frequently-used options to 
+.Ic set .
+Information about the  current default server and host is also printed.
+.It Ic class= Ns Ar value
+Change the query class to one of:
+.Bl -tag -width "HESIOD  "
+.It Dv IN
+the Internet class
+.It Dv CHAOS
+the Chaos class
+.It Dv HESIOD
+the MIT Athena Hesiod class
+.It Dv ANY
+wildcard (any of the above)
+.El
+.Pp
+The class specifies the protocol group of the information.
+.Pp
+(Default = 
+.Dv IN ; 
+abbreviation = 
+.Ic cl )
+.It Xo Op Ic no 
+.Ns Ic debug
+.Xc
+Turn debugging mode on.  A lot more information is printed about the
+packet sent to the server and the resulting answer.
+.Pp
+(Default = 
+.Ic nodebug ; 
+abbreviation = 
+.Xo Op Ic no
+.Ns Ic deb )
+.Xc
+.It Xo Op Ic no 
+.Ns Ic d2
+.Xc
+Turn exhaustive debugging mode on.
+Essentially all fields of every packet are printed.
+.Pp
+(Default = 
+.Ic nod2 )
+.It Ic domain= Ns Ar name
+Change the default domain name to 
+.Ar name . 
+The default domain name is appended to a lookup request depending on the
+state of the 
+.Ic defname 
+and 
+.Ic search 
+options.
+The domain search list contains the parents of the default domain if it has 
+at least two components in its name. 
+For example, if the default domain
+is CC.Berkeley.EDU, the search list is CC.Berkeley.EDU and Berkeley.EDU.
+Use the 
+.Dq Ic set srchlist 
+command to specify a different list.
+Use the 
+.Dq Ic set all 
+command to display the list.
+.Pp
+(Default = value from 
+.Xr hostname @CMD_EXT@ , 
+.Pa /etc/resolv.conf ,
+or 
+.Ev LOCALDOMAIN;
+abbreviation = 
+.Ic do )
+.It Ic srchlist= Ns Ar name1/name2/...
+Change the default domain name to 
+.Ar name1 
+and the domain search list
+to 
+.Ar name1 , name2 , 
+etc.  A maximum of 6 names separated by slashes (/)
+can be specified.
+For example,
+.Bd -literal -offset indent
+set srchlist=lcs.MIT.EDU/ai.MIT.EDU/MIT.EDU
+.Ed
+.Pp
+sets the domain to lcs.MIT.EDU and the search list to the three names.
+This command overrides the
+default domain name and search list of the 
+.Dq Ic set domain 
+command.
+Use the 
+.Dq Ic set all 
+command to display the list.
+.Pp
+(Default = value based on 
+.Xr hostname @CMD_EXT@ , 
+.Pa /etc/resolv.conf ,
+or 
+.Ev LOCALDOMAIN;
+abbreviation = 
+.Ic srchl )
+.It Xo Op Ic no
+.Ns Ic defname
+.Xc
+If set, append the default domain name to a single-component lookup request 
+(i.e., one that does not contain a period).
+.Pp
+(Default = 
+.Ic defname ; 
+abbreviation = 
+.Xo Op Ic no
+.Ns Ic defname )
+.Xc
+.It Xo Op Ic no 
+.Ns Ic search
+.Xc
+If the lookup request contains at least one period but 
+.Em doesn't 
+end with a trailing period, append the domain names in the domain search list
+to the request until an answer is received.
+.Pp
+(Default = 
+.Ic search ; 
+abbreviation = 
+.Xo Op Ic no 
+.Ns Ic sea )
+.Xc
+.It Ic port= Ns Ar value
+Change the default TCP/UDP name server port to 
+.Ar value .
+.Pp
+(Default = 53; 
+abbreviation = 
+.Ic \&po )
+.It Ic querytype= Ns Ar value
+.It Ic type= Ns Ar value
+Change the type of information query to one of:
+.Bl -tag -width "HINFO   "
+.It Dv A
+the host's Internet address.
+.It Dv CNAME
+the canonical name for an alias.
+.It Dv HINFO
+the host CPU and operating system type.
+.It Dv MINFO
+the mailbox or mail list information.
+.It Dv MX
+the mail exchanger.
+.It Dv NS
+the name server for the named zone.
+.It Dv PTR
+the host name if the query is an Internet address;
+otherwise, the pointer to other information.
+.It Dv SOA
+the domain's 
+.Dq start-of-authority 
+information.
+.It Dv TXT
+the text information.
+.It Dv UINFO
+the user information.
+.It Dv WKS
+the supported well-known services.
+.El
+.Pp
+Other types 
+.Pq Dv ANY, AXFR, MB, MD, MF, NULL 
+are described in the RFC-1035 document.
+.Pp
+(Default = 
+.Dv A ; 
+abbreviations = 
+.Ic q , ty )
+.It Xo Op Ic no
+.Ns Ic recurse
+.Xc
+Tell the name server to query other servers if it does not have the
+information.
+.Pp
+(Default = 
+.Ic recurse ; 
+abbreviation =
+.Xo Op Ic no
+.Ns Ic rec )
+.Xc
+.It Ic retry= Ns Ar number
+Set the number of retries to 
+.Ar number .
+When a reply to a request is not received within a certain 
+amount of time (changed with 
+.Dq Ic set timeout ) , 
+the timeout period is doubled and the request is resent. 
+The retry value controls how many times a request is resent before giving up.
+.Pp
+(Default = 4, abbreviation = 
+.Ic ret )
+.It Ic root= Ns Ar host
+Change the name of the root server to 
+.Ar host . 
+This affects the 
+.Dq Ic root 
+command. 
+.Pp
+(Default = 
+.Ic ns.internic.net. ;
+abbreviation = 
+.Ic ro )
+.It Ic timeout= Ns Ar number
+Change the initial timeout interval for waiting for a reply to 
+.Ar number 
+seconds. Each retry doubles the timeout period.
+.Pp
+(Default = 5 seconds; abbreviation = 
+.Ic ti )
+.It Xo Op Ic no
+.Ns Ic vc
+.Xc
+Always use a virtual circuit when sending requests to the server.
+.Pp
+(Default = 
+.Ic novc ; 
+abbreviation = 
+.Xo Op Ic no
+.Ns Ic v )
+.Xc
+.It Xo Op Ic no
+.Ns Ic ignoretc
+.Xc 
+Ignore packet truncation errors.
+.Pp
+(Default = 
+.Ic noignoretc ; 
+abbreviation = 
+.Xo Op Ic no
+.Ns Ic ig )
+.Xc 
+.El
+.El
+.Sh DIAGNOSTICS
+If the lookup request was not successful, an error message is printed.
+Possible errors are:
+.Bl -tag -width "Timed"
+.It Li Timed out
+The server did not respond to a request after a certain amount of
+time (changed with 
+.Dq Ic set timeout= Ns Ar value ) 
+and a certain number of retries (changed with 
+.Dq Ic set retry= Ns Ar value ) .
+.It Li \&No response from server
+No name server is running on the server machine.
+.It Li \&No records
+The server does not have resource records of the current query type for the
+host, although the host name is valid.
+The query type is specified with the 
+.Dq Ic set querytype 
+command.
+.It Li Non-existent domain
+The host or domain name does not exist.
+.It Li Connection refused
+.It Li Network is unreachable
+The connection to the name or finger server could not be made 
+at the current time.
+This error commonly occurs with 
+.Ic ls 
+and 
+.Ic finger 
+requests. 
+.It Li Server failure
+The name server found an internal inconsistency in its database
+and could not return a valid answer.
+.It Li Refused
+The name server refused to service the request.
+.It Li Format error
+The name server found that the request packet was not in the proper format.
+It may indicate an error in 
+.Nm nslookup .
+.El
+.Sh FILES
+.Bl -tag -width "/usr/share/misc/nslookup.helpXXX" -compact
+.It Pa /etc/resolv.conf
+initial domain name and name server addresses
+.It Pa $HOME/.nslookuprc
+user's initial options
+.It Pa /usr/share/misc/nslookup.help
+summary of commands
+.El
+.Sh ENVIRONMENT
+.Bl -tag -width "HOSTALIASESXXXX" -compact
+.It Ev HOSTALIASES
+file containing host aliases
+.It Ev LOCALDOMAIN
+overrides default domain
+.El
+.Sh SEE ALSO
+.Xr @INDOT@named @SYS_OPS_EXT@ ,
+.Xr resolver @LIB_NETWORK_EXT@ , 
+.Xr resolver @FORMAT_EXT@ ;
+RFC-1034,
+.Dq Domain Names - Concepts and Facilities ;
+RFC-1035,
+.Dq Domain Names - Implementation and Specification .
+.Sh AUTHOR
+Andrew Cherenson
--- bind9-9.9.5.dfsg.orig/debian/po/POTFILES.in
+++ bind9-9.9.5.dfsg/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] templates
--- bind9-9.9.5.dfsg.orig/debian/po/cs.po
+++ bind9-9.9.5.dfsg/debian/po/cs.po
@@ -0,0 +1,67 @@
+# Czech translation of bind9 debconf messages.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the bind9 package.
+# Miroslav Kure <kurem@debian.cz>, 2008
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-15 14:38+0200\n"
+"Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
+"Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
+"Language: cs\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Uživatelský účet pro běh daemona BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Ve výchozím nastavení se daemon BINDu9 (named) spouští pod účtem uživatele "
+"„bind“. Pro použití jiného účtu zadejte jeho jméno."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Další spouštěcí parametry pro named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Zadejte prosím případné další parametry (mimo uživatelského účtu), které se "
+"mají předat daemonu BINDu9 (named) při každém spuštění."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Má se přepsat nastavení v resolv.conf?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Rozhodněte se, zda se má přepsat nastavení resolveru tak, aby vždy používal "
+"lokální daemon BINDu9 (named) namísto serveru, který doporučí aktuální "
+"připojení."
--- bind9-9.9.5.dfsg.orig/debian/po/da.po
+++ bind9-9.9.5.dfsg/debian/po/da.po
@@ -0,0 +1,67 @@
+# Danish translation bind9.
+# Copyright (C) 2010 bind9 & Joe Hansen.
+# This file is distributed under the same license as the bind9 package.
+# Joe Hansen <joedalton2@yahoo.dk>, 2010.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2010-10-07 17:30+01:00\n"
+"Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
+"Language-Team: Danish <debian-l10n-danish@lists.debian.org> \n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Brugerkonto til kørsel af BIND9-dæmonen:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Standarden er at køre BIND9-dæmonen (navngivet) under brugerkontoen »bind«. "
+"For at bruge en anden konto, så indtast venligst et passende brugernavn."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Andre opstartsindstillinger for navngivet:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Angiv venligst eventuelle yderligere indstillinger (udover brugernavnet) som "
+"skal videresendes til BIND9-dæmonen (navngivet) ved opstart."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Skal opsætningen af resolv.conf overskrives?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Vælg venligst hvorvidt opløseren skal tvinges til at bruge den lokale BIND9-"
+"dæmon (navngivet), frem for hvad den aktuelle forbindelse anbefaler, når "
+"denne maskine flytter rundt."
--- bind9-9.9.5.dfsg.orig/debian/po/de.po
+++ bind9-9.9.5.dfsg/debian/po/de.po
@@ -0,0 +1,84 @@
+# Translation of bind9 debconf templates to German
+# (C) Helge Kreutzmann <debian@helgefjell.de>, 2008.
+# This file is distributed under the same license as the bind9 package.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9 1:9.5.0.dfsg-2\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-16 20:22+0200\n"
+"Last-Translator: Helge Kreutzmann <debian@helgefjell.de>\n"
+"Language-Team: de <debian-l10n-german@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=iso-8859-15\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Benutzerkonto, unter dessen Kennung der BIND9-Daemon laufen soll:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Standardm��ig wird der BIND9-Daemon (Named) unter der Kennung des Benutzers "
+"�bind� betrieben. Um ein anderes Benutzerkonto auszuw�hlen, geben Sie bitte "
+"den entsprechenden Benutzernamen ein."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Weitere Optionen f�r den Start des Named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Bitte geben Sie hier die zus�tzlichen Optionen (au�er dem Benutzernamen) "
+"ein, die dem Bind9-Daemon (Named) beim Starten �bergeben werden sollen."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Sollen die Einstellungen in resolv.conf ignoriert werden?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Bitte w�hlen Sie aus, ob der Namensaufl�ser (Resolver) dazu gezwungen werden "
+"soll, den lokalen BIND9-Daemon (Named) zu verwenden, statt den aktuellen "
+"Verbindungsempfehlungen zu folgen, wenn diese Maschine bewegt wird."
+
+#~ msgid "Options that should be passed at startup to bind9"
+#~ msgstr "Optionen, die beim Starten an Bind9 weitergegeben werden sollen"
+
+#~ msgid "which user should bind9 run as?"
+#~ msgstr "Unter welcher Benutzerkennung soll Bind9 laufen?"
+
+#~ msgid ""
+#~ "The default is to start bind9 as bind user, if you would  like to change "
+#~ "that, please give here the username as which  bind9 should start as."
+#~ msgstr ""
+#~ "Standardm��ig startet Bind9 unter der Benutzerkennung �bind�. Falls Sie "
+#~ "dies �ndern m�chten geben Sie hier bitte den Benutzernamen ein, unter "
+#~ "dessen Kennung Bind9 starten soll."
+
+#~ msgid "Should resolvconf run when bind9 starts up?"
+#~ msgstr "Soll Resolvconf laufen, wenn Bind9 startet?"
--- bind9-9.9.5.dfsg.orig/debian/po/es.po
+++ bind9-9.9.5.dfsg/debian/po/es.po
@@ -0,0 +1,86 @@
+# bind9 translation to spanish
+# Copyright (C) 2008 Software in the Public Interest
+# This file is distributed under the same license as the bind9 package.
+# Changes:
+# - Initial translation
+# Ignacio Mondino <ignacio.mondino@gmail.com>, 2008
+# Traductores, si no conoce el formato PO, merece la pena leer la 
+# documentación de gettext, especialmente las secciones dedicadas a este
+# formato, por ejemplo ejecutando:
+# info -n '(gettext)PO Files'
+# info -n '(gettext)Header Entry'
+# Equipo de traducción al español, por favor lean antes de traducir
+# los siguientes documentos:
+# - El proyecto de traducción de Debian al español
+# http://www.debian.org/intl/spanish
+# especialmente las notas de traducción en
+# http://www.debian.org/intl/spanish/notas
+# - La guía de traducción de po's de debconf:
+# /usr/share/doc/po-debconf/README-trans
+# o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9_1:9.5.0.dfsg-3\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-07-08 20:18-0300\n"
+"Last-Translator: Ignacio Mondino <ignacio.mondino@gmail.com>\n"
+"Language-Team: Debian Spanish team <debian-l10n-spanish@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Cuenta de usuario que ejecuta el demonio BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"La cuenta de usuario por omisión que ejecuta el demonio BIND9 («named») es "
+"«bind». Para usar una cuenta diferente, por favor ingrese el nombre de "
+"usuario apropiado."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Otras opciones de inicio para «named»:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Ingrese cualquier opción adicional (además del nombre de usuario) que "
+"debiera pasarse como parámetro al demonio BIND9 («named») al inicio del "
+"sistema."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "¿Debería sobreescribirse el archivo «resolv.conf»?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Indique si se debería forzar al cliente a utilizar el demonio BIND9 "
+"(«named») local en lugar de lo que la conexión actual recomiende, cuando "
+"este equipo este en movimiento."
--- bind9-9.9.5.dfsg.orig/debian/po/eu.po
+++ bind9-9.9.5.dfsg/debian/po/eu.po
@@ -0,0 +1,68 @@
+# translation of eu.po to Euskara
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Piarres Beobide <pi@beobide.net>, 2009.
+msgid ""
+msgstr ""
+"Project-Id-Version: eu\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2009-02-22 10:36+0100\n"
+"Last-Translator: Piarres Beobide <pi@beobide.net>\n"
+"Language-Team: Euskara <debian-l10n-basque@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "BIND9 exekutatuko duen erabiltzaile kontua:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Lehenetsia BIND9 deabrua (named) 'bind' erabiltzaile kontuarekin exekutatzea "
+"da. Beste kontu bat erabiltzeko, idatzi dagokion erabiltzaile-izena"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Beste abio aukera batzuek named-rentzat:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Mesedez zehaztu BIND9 deabruari abioan pasa behar zaizkion beste aukera "
+"gehigarriak (erabiltzaile-izenaz beste)."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "resolv.conf ezarpenak gainidatzi behar al dira?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Mesedez hautatu ebazlea nola behartu behar den BIND9 deabru kopia lokala "
+"erabiltzeko ekipo hau mugitzen ari denean konexioak gomendatzen dionaren "
+"ordez."
--- bind9-9.9.5.dfsg.orig/debian/po/fi.po
+++ bind9-9.9.5.dfsg/debian/po/fi.po
@@ -0,0 +1,64 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-07-13 08:08-0000\n"
+"Last-Translator: Esko Arajärvi <edu@iki.fi>\n"
+"Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n"
+"Language: fi\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Finnish\n"
+"X-Poedit-Country: FINLAND\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Käyttäjätunnus, jolla BIND9-taustaohjelmaa ajetaan:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Oletuksena BIND9-taustaohjelmaa (named) ajetaan käyttäjätunnuksella ”bind”. "
+"Jos halutaan käyttää jotain muuta tunnusta, syötä se tähän."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Ohjelman named muut käynnistysvalitsimet:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Anna mahdolliset muut valitsimet (muut kuin käyttäjätunnus), jotka BIND9-"
+"taustaohjelmalle (named) tulisi antaa käynnistyksessä."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Tulisiko tiedoston resolv.conf asetukset jättää huomioitta?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Valitse tulisiko selvittäjä pakottaa käyttämään paikallista BIND9-"
+"taustaohjelmaa (named) sen sijaan mitä nykyinen yhteys suosittelee, kun "
+"konetta siirrellään eri paikkoihin."
--- bind9-9.9.5.dfsg.orig/debian/po/fr.po
+++ bind9-9.9.5.dfsg/debian/po/fr.po
@@ -0,0 +1,69 @@
+# Translation of bind9 debconf templates to French
+# Copyright (C) 2008 CALARESU Luc <luc.calaresu@gmail.com>
+# This file is distributed under the same license as the bind9 package.
+# CALARESU Luc <luc.calaresu@gmail.com>, 2008.
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-14 14:26+0200\n"
+"Last-Translator: CALARESU Luc <luc.calaresu@gmail.com>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"Language: fr\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Identifiant pour l'exécution du démon de BIND9 :"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Par défaut, le démon de BIND9 est lancé avec les privilèges de l'identifiant "
+"« bind ». Si vous souhaitez utiliser un autre identifiant, veuillez "
+"l'indiquer ici."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Autres options à transmettre pour « named » :"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Veuillez indiquer toute option supplémentaire (autre que l'identifiant) qui "
+"doit être transmise au démarrage du démon de BIND9 (« named »)."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Faut-il écraser les paramètres de resolv.conf ?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Veuillez choisir si la résolution de noms doit utiliser le démon BIND9 local "
+"(« named ») plutôt que les paramètres recommandés pour la connexion "
+"actuelle, lorsque cette machine est déplacée."
--- bind9-9.9.5.dfsg.orig/debian/po/gl.po
+++ bind9-9.9.5.dfsg/debian/po/gl.po
@@ -0,0 +1,66 @@
+# Galician translation of bind9's debconf templates
+# This file is distributed under the same license as the bind9 package.
+# Jacobo Tarrio <jtarrio@debian.org>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-14 11:36+0100\n"
+"Last-Translator: Jacobo Tarrio <jtarrio@debian.org>\n"
+"Language-Team: Galician <proxecto@trasno.net>\n"
+"Language: gl\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Conta de usuario que executa o servizo de BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"A elección por defecto é executar o servizo de BIND9 (named) baixo a conta "
+"de usuario \"bind\". Para empregar unha conta diferente, introduza o nome."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Outras opcións de inicio para named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Forneza as opcións adicionais (que non sexan o nome de usuario) que se deban "
+"pasar ao servizo de BIND9 (named) no inicio."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "¿Quere substituír a configuración de resolv.conf?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Indique se quere forzar o resolvedor a que empregue o servizo de BIND9 local "
+"(named) no canto do que recomenda a conexión actual, cando esta máquina "
+"estea en movemento."
--- bind9-9.9.5.dfsg.orig/debian/po/id.po
+++ bind9-9.9.5.dfsg/debian/po/id.po
@@ -0,0 +1,51 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: \n"
+"Last-Translator: Mahyuddin Susanto <udienz@gmail.com>\n"
+"Language-Team: Debian Indonesia Translator <debian-l10n-indonesian@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Indonesian\n"
+"X-Poedit-Country: INDONESIA\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Akun pengguna untuk menjalankan daemon BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "The default is to run the BIND9 daemon (named) under the 'bind' user account. To use a different account, please enter the appropriate username."
+msgstr "Bawaan dari daemon BIND9 adalah menjalankan dengan user akun 'bind'. Untuk menggunakan akun berbeda, silakan masukkan nama pengguna yang sesuai."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Opsi lain startup untuk named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Please provide any additional options (other than username) that should be passed to the BIND9 daemon (named) on startup."
+msgstr "Harap menyediakan opsi tambahan (selain nama pengguna) yang digunakan daemon BIND9 untuk startup"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "haruskah resolv.conf ditimpa?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Please choose whether the resolver should be forced to use the local BIND9 daemon (named) rather than what the current connection recommends, when this machine moves around."
+msgstr "Silakan tentukan resolver mana yang akan digunakan untuk daemon lokal BIND9 (named) dari koneksi sekarang yang digunakan, ketika mesin ini berjalan"
+
--- bind9-9.9.5.dfsg.orig/debian/po/it.po
+++ bind9-9.9.5.dfsg/debian/po/it.po
@@ -0,0 +1,69 @@
+# translation of bind9_1:9.5.0.dfsg.P1-2_templates.po to Italian
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Alex <animainvendita@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9_1:9.5.0.dfsg.P1-2_templates\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-07-27 16:10+0200\n"
+"Last-Translator: Alex <animainvendita@gmail.com>\n"
+"Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
+"Language: it\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Account utente con cui eseguire il demone BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"L'opzione predefinita prevede l'esecuzione del demone BIND9 (named) "
+"utilizzando l'utente 'bind'. Se si desidera utilizzare un differente account "
+"utente, inserire il nome corrispondente."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Altre opzioni di avvio per named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Inserire qualsiasi opzione addizionale (differente dal nome utente) che "
+"dovrebbe essere inviata al demone BIND9 (named) durante l'avvio."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Si desidera non tener conto delle impostazioni in resolv.conf?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Scegliere se si desidera forzare la risoluzione di tutte le query DNS con il "
+"demone BIND9 locale (named) non utilizzando i server raccomandati dalla "
+"connessione attiva."
--- bind9-9.9.5.dfsg.orig/debian/po/ja.po
+++ bind9-9.9.5.dfsg/debian/po/ja.po
@@ -0,0 +1,66 @@
+# Copyright (C) 2008 LaMont Jones <lamont@debian.org>
+# This file is distributed under the same license as the bind9 package.
+# Hideki Yamane <henrich@debian.or.jp>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9 1:9.5.0.dfsg.P1-2\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-07-22 00:03+0900\n"
+"Last-Translator: Hideki Yamane (Debian-JP) <henrich@debian.or.jp>\n"
+"Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
+"Language: ja\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "BIND9 デーモンの動作に使うユーザアカウント:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"デフォルトでは BIND9 デーモン (named) は「bind」ユーザアカウントで動作しま"
+"す。異なるアカウントを使いたい場合は、適切なユーザ名を入力してください。"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "起動時に named に指定するオプション:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"BIND9 デーモン (named) の起動時に指定したい (ユーザ名以外の) 追加オプションを"
+"入力してください。"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "resolv.conf の設定を上書きしますか?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"このマシンを移動した際、リゾルバがローカルの BIND9 デーモン (named) を使うよ"
+"うにするか、現在の接続先で推奨されるネームサーバを使うようにするかを選んでく"
+"ださい。"
--- bind9-9.9.5.dfsg.orig/debian/po/ko.po
+++ bind9-9.9.5.dfsg/debian/po/ko.po
@@ -0,0 +1,69 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: debconf template\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2011-06-24 18:37+0900\n"
+"Last-Translator: 강민지 <justminji@gmail.com>\n"
+"Language-Team: opensource <justminji@gmail.com>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Korean\n"
+"X-Poedit-Country: KOREA, REPUBLIC OF\n"
+"X-Poedit-SourceCharset: utf-8\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "BIND9 데몬을 실행하기 위한 사용자 계정:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"기본값은 '바인드' 사용자 계정에서 BIND9 데몬(지정된 이름)을 실행합니다. 다른 "
+"계정을 사용하려면 해당 사용자 이름을 입력하세요."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "지명된 다른 시작 옵션:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"BIND9 데몬(지정된 이름)이 실행으로 전달되기 위해서 추가옵션(사용자 이름 이외)"
+"을 입력하세요."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "resolv.conf 설정은 재정의 되어야하는가?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"이 기계가 근처로 이동될 때 해결자는 현재의 연결을 권장하는 것보다 로컬 BIND9 "
+"데몬(지정된 이름)을 사용하도록 강요해야하는지 여부를 선택하세요."
--- bind9-9.9.5.dfsg.orig/debian/po/nb.po
+++ bind9-9.9.5.dfsg/debian/po/nb.po
@@ -0,0 +1,69 @@
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Bjørn Steensrud <bjornst@skogkatt.homelinux.org>, 2012.
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2012-01-03 21:33+0100\n"
+"Last-Translator: Bjørn Steensrud <bjornst@skogkatt.homelinux.org>\n"
+"Language-Team: Norwegian Bokmål <i18n-nb@lister.ping.uio.no>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: nb\n"
+"X-Generator: Lokalize 1.2\n"
+"Plural-Forms: nplurals=2; plural=n != 1;\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Brukerkonto for å kjøre BIND9-daemonen:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Standard er å kjøre BIND8-daemonen (named) under brukerkontoen «bind». Skriv "
+"inn et passende navn for å bruke en annen konto."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Andre oppstartsvalg for named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Skriv inn flere valg (annet enn brukernavn) som skal sendes over til "
+"BIND9-daemonen (named) ved oppstart."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Skal innstillingene i resolv.conf oveerstyres?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Velg om adresseløseren skal tvinges til å bruke den lokale BIND9-daemonen "
+"(named) i stedet for det den gjeldende tilkoblingen anbefaler, når denne "
+"maskinen flyttes omkring."
+
--- bind9-9.9.5.dfsg.orig/debian/po/nl.po
+++ bind9-9.9.5.dfsg/debian/po/nl.po
@@ -0,0 +1,72 @@
+# translation of bind9_1:9.5.0.dfsg.P2-1_nl.po to Dutch
+# translation of bind9 debconf template to Dutch
+# Copyright (C) 2008 THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the bind9 package.
+#
+# Paul Gevers <paul@climbing.nl>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9_1:9.5.0.dfsg.P2-1_nl\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-09-17 21:15-0500\n"
+"Last-Translator: Paul Gevers <paul@climbing.nl>\n"
+"Language-Team: Dutch <debian-l10n-dutch@lists.debian.org>\n"
+"Language: nl\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=2; plural=(n != 1);\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr ""
+"Gebruikersaccount waaronder de BIND9 achtergronddienst dient te draaien:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Standaard wordt 'named', de BIND9-achtergronddienst, uitgevoerd onder de "
+"'bind' gebruikersaccount. Als u een andere account wilt gebruiken kunt hier "
+"de geschikte gebruikersnaam invullen."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Andere opstartopties voor 'named':"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Welke aanvullende opties (anders dan de gebruikersnaam) wilt u bij het "
+"opstarten meegeven aan 'named', de BIND9 achtergronddienst?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Wilt u dat de 'resolv.conf' instellingen omzeild worden?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Wilt u afdwingen dat de 'resolver' gebruik maakt van de lokale BIND9 "
+"achtergronddienst (named), in plaats van de aanbevelingen van de huidige "
+"connectie. Bijvoorbeeld, wanneer deze computer veel verplaatst wordt."
--- bind9-9.9.5.dfsg.orig/debian/po/pl.po
+++ bind9-9.9.5.dfsg/debian/po/pl.po
@@ -0,0 +1,68 @@
+# debconf templates for bind9 package
+# Polish translation
+# Copyright (C) 2008
+# This file is distributed under the same license as the bind9 package.
+# Łukasz Paździora <lukpaz@gmail.com>, 2008
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9 9.5.0.dfsg.P2-4\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-11-24 18:30+0100\n"
+"Last-Translator: Łukasz Paździora <lukpaz@gmail.com>\n"
+"Language-Team: Polish <debian-l10n-polish@lists.debian.org>\n"
+"Language: pl\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Konto użytkownika, jako który powinien działać BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Domyślnie demon BIND9 (named) działa jako użytkownik 'bind'. Aby użyć innego "
+"konta podaj inną nazwę użytkownika."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Inne opcje startowe dla named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Proszę podać dodatkowe opcje (inne niż nazwa użytkownika), które powinny "
+"zostać podane demonowi BIND9 (named) przy starcie."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Czy ustawienia resolv.conf mają zostać nadpisane?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Proszę wybrać czy do rozwiązywania nazw powinna być używana lokalna usługa "
+"BIND9 (named), kiedy maszyna zmienia miejsce, czy też powinien korzystać z "
+"zalecanych ustawień aktualnego połączenia."
--- bind9-9.9.5.dfsg.orig/debian/po/pt.po
+++ bind9-9.9.5.dfsg/debian/po/pt.po
@@ -0,0 +1,69 @@
+# translation of bind9_1:9.5.0.dfsg-2_pt debconf to Portuguese
+# Copyright (C) 2008 Américo Monteiro
+# This file is distributed under the same license as the bind9 package.
+#
+# Américo Monteiro <a_monteiro@netcabo.pt>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9_1:9.5.0.dfsg-2_pt\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-14 11:55+0100\n"
+"Last-Translator: Américo Monteiro <a_monteiro@netcabo.pt>\n"
+"Language-Team: Portuguese <traduz@debianpt.org>\n"
+"Language: pt\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Conta de utilizador para correr o deamon BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"A pré-definição é correr o deamon BIND9 (named) sob a conta de utilizador "
+"'bind'. Para usar uma conta diferente, por favor indique o nome de "
+"utilizador apropriado."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Outras opções de arranque para o named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Por favor forneça quaisquer opções adicionais (além do nome de utilizador) "
+"que deverão ser enviadas ao deamon BIND9 (named) durante o arranque. "
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Devem as configurações de resolv.conf ser substituidas?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Por favor escolha se a resolução de nomes deverá ser forçada a usar o deamon "
+"local BIND9 (named) em vez do que a corrente ligação recomenda, quando esta "
+"máquina está ligada."
--- bind9-9.9.5.dfsg.orig/debian/po/pt_BR.po
+++ bind9-9.9.5.dfsg/debian/po/pt_BR.po
@@ -0,0 +1,71 @@
+# bind9 Brazilian Portuguese translation
+# Copyright (C) 2009 bind9's COPYRIGHT HOLDER
+# This file is distributed under the same license as the bind9 package.
+# Luís Gustavo Pessoa Sales <vatsu@gmx.net>, 2009.
+# José Figueiredo <deb.gnulinux@gmail.com>, 2010.
+#
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2010-09-10 22:37-0300\n"
+"Last-Translator: José de Figueiredo <deb.gnulinux@gmail.com>\n"
+"Language-Team: Brazilian Portuguese <debian-l10n-portuguese@lists.debian."
+"org>\n"
+"Language: pt_BR\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"pt_BR utf-8\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Conta de usuário para execução do daemon do BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"O padrão é executar o daemon do BIND9 (named) com a conta de usuário 'bind'. "
+"Para usar uma conta diferente, por favor informe o nome do usuário."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Outras opções de inicialização para o named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Por favor, forneça outras opções adicionais (além de nome de usuário), que "
+"devam ser passadas ao daemon do BIND9 (named) na inicialização."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "As configurações do resolv.conf devem ser sobrescritas?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Por favor, escolha se o resolvedor de nomes deve ser forçado a usar o daemon "
+"do BIND9 local (named) em vez daquele que a conexão atual recomendar, quando "
+"esta máquina for movida."
--- bind9-9.9.5.dfsg.orig/debian/po/ru.po
+++ bind9-9.9.5.dfsg/debian/po/ru.po
@@ -0,0 +1,70 @@
+# translation of ru.po to Russian
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Yuri Kozlov <kozlov.y@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9 1:9.5.0.dfsg-2\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-14 11:08+0400\n"
+"Last-Translator: Yuri Kozlov <kozlov.y@gmail.com>\n"
+"Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
+"Language: ru\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
+"%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Учётная запись для запуска службы BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"По умолчанию, служба BIND9 (файл named) запускается с правами учётной записи "
+"'bind'. Если вы хотите использовать другую учётную запись, то введите это "
+"имя здесь."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Другие параметры запуска named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Укажите любые дополнительные параметры (кроме имени учётной записи), которые "
+"нужно передать службе BIND9 (файлу named) при запуске."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Переписать настройки resolv.conf?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Укажите, хотите ли вы, чтобы определитель имён машины использовал локальную "
+"службу BIND9 (named), а не настройки имеющегося подключения."
--- bind9-9.9.5.dfsg.orig/debian/po/sk.po
+++ bind9-9.9.5.dfsg/debian/po/sk.po
@@ -0,0 +1,67 @@
+# Slovak translation of bind9
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the bind9 package.
+# Ivan Masár <helix84@centrum.sk>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: \n"
+"Last-Translator: Ivan Masár <helix84@centrum.sk>\n"
+"Language-Team: \n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Používateľský účet démona BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Štandardne sa démon BIND9 (named) spúšťa s používateľským účtom „bind”. Ak "
+"chcete použiť iný účet, prosím zadajte príslušný názov účtu."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Ďalšie spúšťacie voľby pre named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Zadajte ďalšie voľby (okrem používateľského mena), ktoré sa majú odovzdať "
+"démonovi BIND9 (named) pri spustení."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Má sa nastaviť priorita pred resolv.conf?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Zvoľte, či má sa má vynútiť, aby prekladač adries používal lokálneho démona "
+"BIND9 (named) namiesto toho, čo odporúča aktuálne pripojenie, keď sa "
+"umiestnenie tohto počítača mení."
--- bind9-9.9.5.dfsg.orig/debian/po/sr.po
+++ bind9-9.9.5.dfsg/debian/po/sr.po
@@ -0,0 +1,66 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: Zlatan Todoric <zlatan.todoric@gmail.com>\n"
+"Language-Team: Serbian <debian-l10n-serbian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Кориснички налог за покретање BIND9 процеса у позадини:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Подразумијевано је да се BIND9 процес у позадини (Named) покреће под 'bind'"
+"корисничким налогом. Да бисте користили другачији налог, унесите адекватно корисничко име."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Друге опције приликом покретања за (Named):"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Молимо вас обезбједите додатне опције (осим корисничког имена) који би требали"
+"бити прослијеђени BIND9 процесу у позадини (Named) приликом покретања."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Желите ли поништити постојећа resolv.conf подешавања?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Одаберите желите ли да аутоматски помагач (Resolver) буде присиљен користити "
+"локални BIND9 процес у позадини (Named) умјесто препорука тренутне мреже, када "
+"ова машина буде помјерана."
--- bind9-9.9.5.dfsg.orig/debian/po/sr@latin.po
+++ bind9-9.9.5.dfsg/debian/po/sr@latin.po
@@ -0,0 +1,66 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) 2011
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <zlatan.todoric@gmail.com>, 2011.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: Zlatan Todorić <zlatan.todoric@gmail.com>\n"
+"Language-Team: Serbian <debian-l10n-serbian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Korisnički nalog za pokretanje BIND9 procesa u pozadini:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Podrazumijevano je da se BIND9 proces u pozadini (Named) pokreće pod 'bind'"
+"korisničkim nalogom. Da biste koristili drugačiji nalog, unesite adekvatno korisničko ime."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Druge opcije prilikom pokretanja za (Named):"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Molimo vas obezbjedite dodatne opcije (osim korisničkog imena) koji bi trebali"
+"biti proslijeđeni BIND9 procesu u pozadini (Named) prilikom pokretanja."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Želite li poništiti postojeća resolv.conf podešavanja?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Odaberite želite li da automatski pomagač (Resolver) bude prisiljen koristiti"
+"lokalni BIND9 proces u pozadini umjesto preporuka trenutne mreže, kada ova"
+"mašina bude pomjerana."
--- bind9-9.9.5.dfsg.orig/debian/po/sv.po
+++ bind9-9.9.5.dfsg/debian/po/sv.po
@@ -0,0 +1,69 @@
+# translation of bind9_1:9.5.0.dfsg.P1-2_sv.po to Swedish
+# Copyright (C) 2008
+# This file is distributed under the same license as the bind9 package.
+#
+# Martin Ågren <martin.agren@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9_1:9.5.0.dfsg.P1-2_sv\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-07-18 19:24+0200\n"
+"Last-Translator: Martin Ågren <martin.agren@gmail.com>\n"
+"Language-Team: Swedish <debian-l10n-swedish@lists.debian.org>\n"
+"Language: sv\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=2; plural=(n != 1);\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Användarkonto att köra BIND9-demonen under:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Standardvalet är att köra BIND9-demonen (named) under användarkontot 'bind'. "
+"För att använda ett annat konto, var vänlig ange användarnamnet."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Övriga uppstartsval för named:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Var vänlig ange eventuella ytterligare val (förutom användarnamn) som ska "
+"skickas till BIND9-demonen (named) vid uppstart."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Ska resolv.conf-inställningar hoppas över?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Var vänlig välj huruvida uppslagaren ska tvingas använda den lokala BIND9-"
+"demonen (named) snarare än vad den aktuella uppkopplingen rekommenderar när "
+"den här maskinen flyttar runt."
--- bind9-9.9.5.dfsg.orig/debian/po/templates.pot
+++ bind9-9.9.5.dfsg/debian/po/templates.pot
@@ -0,0 +1,60 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
--- bind9-9.9.5.dfsg.orig/debian/po/tr.po
+++ bind9-9.9.5.dfsg/debian/po/tr.po
@@ -0,0 +1,70 @@
+# turkish translation of bind9 debconf template
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# Mert Dirik <mertdirik@gmail.com>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-15 23:31+0200\n"
+"Last-Translator: Mert Dirik <mertdirik@gmail.com>\n"
+"Language-Team: Debian L10n Turkish <debian-l10n-turkish@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Poedit-Language: Turkish\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "BIND9 bekletici programının (named) kullanacağı kullanıcı hesabı:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Öntanımlı olarak BIND9 bekletici (daemon) programı 'bind' kullanıcı "
+"hesabıyla çalışır. Farklı bir hesap kullanmak için kullanmak istediğiniz "
+"hesabın adını girin."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "'named'in kullanacağı diğer başlatma seçenekleri:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Lütfen BIND9 bekletici programına (named) geçilmesini istediğiniz, kullanıcı "
+"adı dışındaki ek seçenekleri yazın."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "'resolv.conf' ayarları ezilmeli mi (override)?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Lütfen bu makine gezerken; çözümleyicinin o anda kullanılan bağlantının "
+"önerdiği sunucu yerine yerel BIND9 bekletici programını (named) kullanmaya "
+"zorlanması gerekip gerekmediğini seçin."
--- bind9-9.9.5.dfsg.orig/debian/po/vi.po
+++ bind9-9.9.5.dfsg/debian/po/vi.po
@@ -0,0 +1,67 @@
+# Vietnamese translation for Bind 9.
+# Copyright © 2008 Free Software Foundation, Inc.
+# Clytie Siddall <clytie@riverland.net.au>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind9 1:9.5.0.dfsg-2\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-06-14 15:35+0930\n"
+"Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
+"Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
+"Language: vi\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: LocFactoryEditor 1.7b3\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "Tài khoản người dùng để chạy trình nền BIND9:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"Mặc định là chạy trình nền BIND9 (đặt tên) dưới tài khoản người dùng « bind "
+"». Để sử dụng tài khoản khác, hãy nhập tên người dùng thích hợp."
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "Tùy chọn khởi chạy khác cần đặt tên:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr ""
+"Hãy nhập vào đây bất kỳ tùy chọn bổ sung (khác với tên người dùng) nên gửi "
+"cho trình nền BIND9 vào lúc khởi chạy."
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "Co nên ghi đè lên thiết lập « resolv.conf » không?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"Hãy chọn có nên ép buộc trình giải quyết sử dụng trình nền BIND9 cục bộ (đặt "
+"tên) hơn là kết nối hiện thời đề nghị gì khi máy này ở nơi khác."
--- bind9-9.9.5.dfsg.orig/debian/po/zh_CN.po
+++ bind9-9.9.5.dfsg/debian/po/zh_CN.po
@@ -0,0 +1,64 @@
+# Chinese translations for bind package.
+# Copyright (C) 2008 THE bind'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the bind package.
+# LI Daobing <lidaobing@gmail.com>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: bind 9-9.5.0.dfsg.P2\n"
+"Report-Msgid-Bugs-To: Source: bind9@packages.debian.org\n"
+"POT-Creation-Date: 2008-06-13 16:56-0600\n"
+"PO-Revision-Date: 2008-10-04 14:36+0800\n"
+"Last-Translator: LI Daobing <lidaobing@gmail.com>\n"
+"Language-Team: Chinese (simplified)\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid "User account for running the BIND9 daemon:"
+msgstr "运行 BIND9 服务的用户账号:"
+
+#. Type: string
+#. Description
+#: ../templates:1001
+msgid ""
+"The default is to run the BIND9 daemon (named) under the 'bind' user "
+"account. To use a different account, please enter the appropriate username."
+msgstr ""
+"缺省使用 'bind' 用户来运行 BIND9 服务(named)。 想使用其他的账号, 请输入合适的"
+"用户名。"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid "Other startup options for named:"
+msgstr "named 的其他启动选项:"
+
+#. Type: string
+#. Description
+#: ../templates:2001
+msgid ""
+"Please provide any additional options (other than username) that should be "
+"passed to the BIND9 daemon (named) on startup."
+msgstr "请提供需要传给 BIND9 服务(named)的启动选项(用户名除外)。"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid "Should resolv.conf settings be overridden?"
+msgstr "是否覆盖 resolv.conf 的设置?"
+
+#. Type: boolean
+#. Description
+#: ../templates:3001
+msgid ""
+"Please choose whether the resolver should be forced to use the local BIND9 "
+"daemon (named) rather than what the current connection recommends, when this "
+"machine moves around."
+msgstr ""
+"请选择是否强制使用本地 BIND9 服务(named)来做域名解析, 而不是使用当前连接所推"
+"荐的域名解析服务器, 特别是当机器需要移动时。"
--- bind9-9.9.5.dfsg.orig/debian/rules
+++ bind9-9.9.5.dfsg/debian/rules
@@ -0,0 +1,223 @@
+#!/usr/bin/make -f
+# Sample debian/rules that uses debhelper.
+# GNU copyright 1997 to 1999 by Joey Hess.
+
+export DEB_BUILD_HARDENING=1
+# Uncomment this to turn on verbose mode.
+#export DH_VERBOSE=1
+
+ifndef DEB_HOST_ARCH
+DEB_BUILD_ARCH := $(shell dpkg --print-architecture)
+endif
+export arch = $(DEB_HOST_ARCH)
+
+DEB_HOST_MULTIARCH := $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
+
+ifneq (,$(findstring debug,$(DEB_BUILD_OPTIONS)))
+DEBUG = -g
+endif
+
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
+OPT = 
+else
+OPT = -O2
+endif
+
+ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
+NUMJOBS = $(patsubst parallel=%,%,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
+export MAKEFLAGS += -j$(NUMJOBS)
+endif
+
+export CFLAGS=-fno-strict-aliasing -fno-delete-null-pointer-checks -DDIG_SIGCHASE $(DEBUG) $(OPT)
+
+ifeq ($(DEB_HOST_ARCH_OS),kfreebsd)
+EXTRA_FEATURES=--disable-linux-caps --disable-threads
+endif
+
+configure: configure-stamp
+configure-stamp:
+	dh_testdir
+	dh_autotools-dev_updateconfig
+	dh_autoreconf
+	test -e export || mkdir export && cp -r * export || true
+	cd export && ./configure \
+		--prefix=/usr \
+		--disable-epoll \
+		--disable-kqueue \
+		--disable-devpoll \
+		--disable-threads \
+		--disable-linux-caps \
+		--without-openssl \
+		--without-libxml2 \
+		--enable-ipv6 \
+		--enable-shared \
+		--enable-exportlib \
+		--with-libtool \
+		--with-gssapi=no \
+		--with-export-libdir=\$${prefix}/lib/$(DEB_HOST_MULTIARCH) \
+		--with-export-includedir=\$${prefix}/include/bind-export
+	./configure --prefix=/usr \
+		--mandir=\$${prefix}/share/man \
+		--infodir=\$${prefix}/share/info \
+		--sysconfdir=/etc/bind \
+		--localstatedir=/var \
+		--enable-threads \
+		--enable-largefile \
+		--with-libtool \
+		--enable-shared \
+		--enable-static \
+		--with-openssl=/usr \
+		--with-gssapi=/usr \
+		--with-gnu-ld \
+		--with-geoip=/usr \
+		--with-atf=no \
+		--enable-ipv6 \
+		--enable-rrl \
+		--enable-filter-aaaa \
+		$(EXTRA_FEATURES)
+
+	touch $@
+
+build: build-stamp
+build-stamp: configure-stamp
+	dh_testdir
+	$(MAKE) -C export
+	LD_LIBRARY_PATH=$$(pwd)/lib/isc/.libs:$$(pwd)/lib/isccc/.libs:$$(pwd)/isccfg/.libs:$${LD_LIBRARY_PATH} $(MAKE)
+	touch $@
+
+autofiles:
+	libtoolize --automake --copy --force
+	aclocal
+	#automake
+	autoheader
+	autoconf
+	rm -rf autom4te.cache
+	cp config.guess config.sub contrib/idn/idnkit-1.0-src/
+
+clean:
+	dh_testdir
+	dh_testroot
+	-$(MAKE) distclean
+	find . -name \*.o -exec rm {} \;
+	rm -f build-stamp configure-stamp
+	rm -f debian/substvars lib/bind/include/isc/platform.h
+	rm -f contrib/dlz/bin/dlzbdb/Makefile contrib/dlz/drivers/rules
+	rm -f doc/arm/Bv9ARM.pdf
+	rm -rf export
+	dh_autoreconf_clean
+	dh_autotools-dev_restoreconfig
+	dh_clean
+
+newtemplate:
+	debconf-updatepo
+
+msgstats:
+	@cd debian/po && for i in *.po; do x=$$(msgfmt --statistics $$i 2>&1); echo $$i $$x; done; rm -f messages.mo *.po~
+
+msg-email:
+	@podebconf-report-po
+
+ETCBIND=debian/bind9/etc/bind
+ETCAPP=debian/bind9/etc/apparmor.d
+install: build
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+	$(MAKE) -C export install DESTDIR=`pwd`/debian/bind9
+	$(MAKE) install DESTDIR=`pwd`/debian/bind9
+	rm -rf debian/bind9/usr/etc
+	find debian/bind9 -name \*.la -execdir rm -f {} \;
+	mkdir -p debian/bind9/lib/$(DEB_HOST_MULTIARCH)
+	mv debian/bind9/usr/lib/$(DEB_HOST_MULTIARCH)/*-export.so.* debian/bind9/lib/$(DEB_HOST_MULTIARCH)
+	cd debian/bind9/usr/lib/$(DEB_HOST_MULTIARCH) && for link in *.so; do \
+	    file=$$(readlink $$link); \
+	    ln -sf ../../../lib/$(DEB_HOST_MULTIARCH)/$$file $$link; \
+	    done
+	install -c -o bin -g bin -m 444 debian/db.0 ${ETCBIND}/db.0
+	install -c -o bin -g bin -m 444 debian/db.0 ${ETCBIND}/db.255
+	install -c -o bin -g bin -m 444 debian/db.empty ${ETCBIND}
+	install -c -o bin -g bin -m 444 debian/zones.rfc1918 ${ETCBIND}
+	install -c -o bin -g bin -m 444 debian/db.127 ${ETCBIND}
+	install -c -o bin -g bin -m 444 debian/db.local ${ETCBIND}
+	install -c -o bin -g bin -m 444 debian/db.root ${ETCBIND}
+	install -c -o bin -g bin -m 440 debian/named.conf ${ETCBIND}
+	install -c -o bin -g bin -m 440 debian/named.conf.local ${ETCBIND}
+	install -c -o bin -g bin -m 440 debian/named.conf.default-zones ${ETCBIND}
+	install -c -o bin -g bin -m 440 bind.keys ${ETCBIND}
+	install -c -o bin -g bin -m 440 debian/named.conf.options debian/bind9/usr/share/bind9/
+	cp doc/arm/*.html debian/bind9-doc/usr/share/doc/bind9-doc/arm
+	install -m 644 -o root -g root debian/apparmor-profile ${ETCAPP}/usr.sbin.named
+	install -m 644 -o root -g root debian/apparmor-profile.local ${ETCAPP}/local/usr.sbin.named
+	rmdir debian/bind9/var/run/named debian/lwresd/var/run/named || true
+
+	install debian/ip-up.d debian/bind9/etc/ppp/ip-up.d/bind9
+	install debian/ip-down.d debian/bind9/etc/ppp/ip-down.d/bind9
+	install debian/ip-up.d debian/bind9/etc/network/if-up.d/bind9
+	install debian/ip-down.d debian/bind9/etc/network/if-down.d/bind9
+	install -m644 debian/bind9.ufw.profile debian/bind9/etc/ufw/applications.d/bind9
+
+# Build architecture-independent files here.
+binary-indep: build install
+	dh_testdir -i
+	dh_testroot -i
+	dh_installdocs -i
+	dh_installexamples -i
+	dh_installmenu -i
+	dh_installcron -i
+	dh_installinfo -i
+	dh_installchangelogs -i # CHANGES # upstream changelog only in bind9-doc
+	dh_installchangelogs -pbind9-doc CHANGES
+	dh_link -i
+	dh_compress -i
+	dh_fixperms -i
+	dh_installdeb -i
+	for i in $$(sed -n '/^Package:/s/^.* //p' debian/control); do cat debian/vars.in >> debian/$$i.substvars; done
+	cat debian/vars.in >> debian/substvars
+	dh_gencontrol -i
+	dh_md5sums -i
+	dh_builddeb -i
+
+# Build architecture-dependent files here.
+binary-arch: build install
+	dh_testdir -a
+	dh_testroot -a
+	dh_installdocs -a
+	dh_installexamples -a
+	dh_installmenu -a
+	dh_systemd_enable -pbind9 --no-enable bind9-resolvconf.service
+	dh_systemd_enable -pbind9 bind9.service
+	dh_systemd_enable -plwresd lwresd.service
+	dh_installinit -a --no-start -- defaults 15 85
+	# Ship the extra service file for resolvconf integration manually.
+	if [ -d debian/bind9/lib/systemd/system ]; then cp debian/bind9-resolvconf.service debian/bind9/lib/systemd/system; fi
+	dh_installcron -a
+	dh_installdebconf -pbind9
+	dh_installinfo -a
+	dh_installchangelogs -a # CHANGES # upstream changelog only in bind9-doc
+	dh_install --sourcedir=debian/bind9 -a
+	(cd debian/bind9/ && rm -rf $$(cat ../*.install) )
+	rm -f debian/bind9/usr/share/man/man1/query-loc.1
+	# install apport hook on Ubuntu
+	if dpkg-vendor --is ubuntu; then \
+	    install -m 644 -D debian/bind9.apport debian/bind9/usr/share/apport/package-hooks/bind9.py; \
+	fi
+	dh_link -a
+	dh_strip -a
+	dh_compress -a
+	dh_fixperms -a
+	dh_makeshlibs -a
+	dh_makeshlibs -plibirs-export91 --add-udeb=libirs-export91-udeb
+	dh_makeshlibs -plibisc-export95 --add-udeb=libisc-export95-udeb
+	dh_makeshlibs -plibdns-export100 --add-udeb=libdns-export100-udeb
+	dh_makeshlibs -plibisccfg-export90 --add-udeb=libisccfg-export90-udeb
+	dh_installdeb -a
+	dh_shlibdeps -a
+	for i in $$(sed -n '/^Package:/s/^.* //p' debian/control); do cat debian/vars.in >> debian/$$i.substvars; done
+	cat debian/vars.in >> debian/substvars
+	dh_gencontrol -a
+	dh_md5sums -a
+	dh_builddeb -a
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary install configure
--- bind9-9.9.5.dfsg.orig/debian/source/format
+++ bind9-9.9.5.dfsg/debian/source/format
@@ -0,0 +1 @@
+1.0
--- bind9-9.9.5.dfsg.orig/debian/templates
+++ bind9-9.9.5.dfsg/debian/templates
@@ -0,0 +1,21 @@
+Template: bind9/start-as-user
+Type: string
+Default: bind
+_Description: User account for running the BIND9 daemon:
+ The default is to run the BIND9 daemon (named) under the 'bind'
+ user account. To use a different account, please enter the
+ appropriate username.
+
+Template: bind9/different-configuration-file
+Type: string
+_Description: Other startup options for named:
+ Please provide any additional options (other than username) that should
+ be passed to the BIND9 daemon (named) on startup.
+
+Template: bind9/run-resolvconf
+Type: boolean
+Default: false
+_Description: Should resolv.conf settings be overridden?
+ Please choose whether the resolver should be forced to use the
+ local BIND9 daemon (named) rather than what the current connection
+ recommends, when this machine moves around.
--- bind9-9.9.5.dfsg.orig/debian/vars.in
+++ bind9-9.9.5.dfsg/debian/vars.in
@@ -0,0 +1 @@
+Description=The Berkeley Internet Name Domain (BIND) implements an Internet domain${Newline}name server.  BIND is the most widely-used name server software on the${Newline}Internet, and is supported by the Internet Software Consortium, www.isc.org.
--- bind9-9.9.5.dfsg.orig/debian/zones.rfc1918
+++ bind9-9.9.5.dfsg/debian/zones.rfc1918
@@ -0,0 +1,20 @@
+zone "10.in-addr.arpa"      { type master; file "/etc/bind/db.empty"; };
+ 
+zone "16.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "17.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "18.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "19.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "20.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "21.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "22.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "23.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "24.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "25.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "26.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "27.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "28.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "29.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "30.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+zone "31.172.in-addr.arpa"  { type master; file "/etc/bind/db.empty"; };
+
+zone "168.192.in-addr.arpa" { type master; file "/etc/bind/db.empty"; };
--- bind9-9.9.5.dfsg.orig/doc/arm/Bv9ARM-book.xml
+++ bind9-9.9.5.dfsg/doc/arm/Bv9ARM-book.xml
@@ -4845,6 +4845,8 @@
     <optional> max-acache-size <replaceable>size_spec</replaceable> ; </optional>
     <optional> clients-per-query <replaceable>number</replaceable> ; </optional>
     <optional> max-clients-per-query <replaceable>number</replaceable> ; </optional>
+    <optional> max-recursion-depth <replaceable>number</replaceable> ; </optional>
+    <optional> max-recursion-queries <replaceable>number</replaceable> ; </optional>
     <optional> masterfile-format (<constant>text</constant>|<constant>raw</constant>) ; </optional>
     <optional> empty-server <replaceable>name</replaceable> ; </optional>
     <optional> empty-contact <replaceable>name</replaceable> ; </optional>
@@ -8524,6 +8526,35 @@
 		</para>
 	      </listitem>
 	    </varlistentry>
+
+	    <varlistentry id="max-recursion-depth">
+	      <term><command>max-recursion-depth</command></term>
+	      <listitem>
+		<para>
+		  Sets the maximum number of levels of recursion
+		  that are permitted at any one time while servicing
+		  a recursive query. Resolving a name may require
+		  looking up a name server address, which in turn
+		  requires resolving another name, etc; if the number
+		  of indirections exceeds this value, the recursive
+		  query is terminated and returns SERVFAIL.  The
+		  default is 7.
+		</para>
+	      </listitem>
+	    </varlistentry>
+
+	    <varlistentry id="max-recursion-queries">
+	      <term><command>max-recursion-queries</command></term>
+	      <listitem>
+		<para>
+		  Sets the maximum number of iterative queries that
+		  may be sent while servicing a recursive query.
+		  If more queries are sent, the recursive query
+		  is terminated and returns SERVFAIL. The default
+		  is 50.
+		</para>
+	      </listitem>
+	    </varlistentry>
 
 	    <varlistentry>
 	      <term><command>masterfile-format</command></term>
--- bind9-9.9.5.dfsg.orig/lib/bind9/check.c
+++ bind9-9.9.5.dfsg/lib/bind9/check.c
@@ -132,6 +132,7 @@
 			    "compilation time");
 #endif
 	} else if (strcasecmp(cfg_obj_asstring(obj), "random") != 0 &&
+		   strcasecmp(cfg_obj_asstring(obj), "random_1") != 0 &&
 		   strcasecmp(cfg_obj_asstring(obj), "cyclic") != 0) {
 		cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
 			    "rrset-order: invalid order '%s'",
--- bind9-9.9.5.dfsg.orig/lib/dns/Makefile.in
+++ bind9-9.9.5.dfsg/lib/dns/Makefile.in
@@ -42,7 +42,7 @@
 
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 
-LIBS =		@LIBS@
+LIBS =		@LIBS@ -L../../lib/isc -lcrypto @GEOIP_LIBS@
 
 # Alphabetically
 
@@ -62,7 +62,7 @@
 		cache.@O@ callbacks.@O@ clientinfo.@O@ compress.@O@ \
 		db.@O@ dbiterator.@O@ dbtable.@O@ diff.@O@ dispatch.@O@ \
 		dlz.@O@ dns64.@O@ dnssec.@O@ ds.@O@ forward.@O@ iptable.@O@ \
-		journal.@O@ keydata.@O@ keytable.@O@ \
+		dynamic_db.@O@ journal.@O@ keydata.@O@ keytable.@O@ \
 		lib.@O@ log.@O@ lookup.@O@ \
 		master.@O@ masterdump.@O@ message.@O@ \
 		name.@O@ ncache.@O@ nsec.@O@ nsec3.@O@ order.@O@ peer.@O@ \
@@ -92,7 +92,7 @@
 		cache.c callbacks.c clientinfo.c compress.c \
 		db.c dbiterator.c dbtable.c diff.c dispatch.c \
 		dlz.c dns64.c dnssec.c ds.c forward.c iptable.c journal.c \
-		keydata.c keytable.c lib.c log.c lookup.c \
+		dynamic_db.c keydata.c keytable.c lib.c log.c lookup.c \
 		master.c masterdump.c message.c \
 		name.c ncache.c nsec.c nsec3.c order.c peer.c portlist.c \
 		rbt.c rbtdb.c rbtdb64.c rcode.c rdata.c rdatalist.c \
@@ -125,6 +125,11 @@
 		-DLIBAGE=${LIBAGE} \
 		-c ${srcdir}/version.c
 
+dynamic_db.@O@: dynamic_db.c
+	${LIBTOOL_MODE_COMPILE} ${CC} ${ALL_CFLAGS} \
+	-DDYNDB_LIBDIR=\"@libdir@/bind/\" \
+	-c ${srcdir}/dynamic_db.c
+
 libdns.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
@@ -134,6 +139,7 @@
 		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
+	ln -sf .libs/libdns.so .
 
 timestamp: libdns.@A@
 	touch timestamp
@@ -148,6 +154,7 @@
 	rm -f libdns.@A@ timestamp
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
 	rm -f include/dns/rdatastruct.h
+	rm -f libdns.so
 
 newrr::
 	rm -f code.h include/dns/enumtype.h include/dns/enumclass.h
--- bind9-9.9.5.dfsg.orig/lib/dns/acl.c
+++ bind9-9.9.5.dfsg/lib/dns/acl.c
@@ -21,10 +21,15 @@
 
 #include <config.h>
 
+#ifdef SUPPORT_GEOIP
+#include <GeoIP.h>
+#endif
+
 #include <isc/mem.h>
 #include <isc/once.h>
 #include <isc/string.h>
 #include <isc/util.h>
+#include <dns/log.h>
 
 #include <dns/acl.h>
 #include <dns/iptable.h>
@@ -320,6 +325,13 @@
 		dest->elements[nelem + i].node_num =
 			source->elements[i].node_num + dest->node_count;
 
+#ifdef SUPPORT_GEOIP
+		/* Country */
+		if (source->elements[i].type == dns_aclelementtype_ipcountry &&
+		   source->elements[i].country != NULL) {
+			strncpy(dest->elements[nelem + i].country, source->elements[i].country, 3);
+		}
+#endif
 		/* Duplicate nested acl. */
 		if (source->elements[i].type == dns_aclelementtype_nestedacl &&
 		   source->elements[i].nestedacl != NULL)
@@ -379,7 +391,68 @@
 	int indirectmatch;
 	isc_result_t result;
 
+	#ifdef SUPPORT_GEOIP
+	static GeoIP *geoip = NULL;
+	static isc_boolean_t geoip_init_tried = ISC_FALSE;
+	#ifdef GEOIP_V6
+	static GeoIP *geoip6 = NULL;
+	static isc_boolean_t geoip6_init_tried = ISC_FALSE;
+	#endif
+	#endif
+
 	switch (e->type) {
+#ifdef SUPPORT_GEOIP
+	case dns_aclelementtype_ipcountry:
+		/* Country match */
+		if (NULL == geoip && !geoip_init_tried) {
+			geoip_init_tried = ISC_TRUE;
+			if (GeoIP_db_avail(GEOIP_COUNTRY_EDITION)) {
+				geoip = GeoIP_open_type(GEOIP_COUNTRY_EDITION, GEOIP_MEMORY_CACHE);
+				if (NULL == geoip)
+					isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+						      DNS_LOGMODULE_ACL, ISC_LOG_NOTICE,
+						      "Failed to open geoip database for ipv4");
+			} else {
+				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+					      DNS_LOGMODULE_ACL, ISC_LOG_NOTICE,
+					      "geoip database for ipv4 is not available");
+			}
+		}
+#ifdef GEOIP_V6
+		if (NULL == geoip6 && !geoip6_init_tried) {
+			geoip6_init_tried = ISC_TRUE;
+			if (GeoIP_db_avail(GEOIP_COUNTRY_EDITION_V6)) {
+				geoip6 = GeoIP_open_type(GEOIP_COUNTRY_EDITION_V6, GEOIP_MEMORY_CACHE);
+				if (NULL == geoip6)
+					isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+						      DNS_LOGMODULE_ACL, ISC_LOG_NOTICE,
+						      "Failed to open geoip database for ipv6");
+			} else {
+				isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
+					      DNS_LOGMODULE_ACL, ISC_LOG_NOTICE,
+					      "geoip database for ipv6 is not available");
+			}
+		}
+#endif
+
+                const char *value = NULL;
+
+		if (reqaddr->family == AF_INET && geoip) {
+			value = GeoIP_country_code_by_addr(geoip,inet_ntoa(reqaddr->type.in));
+#ifdef GEOIP_V6
+		} else if (reqaddr->family == AF_INET6 && geoip6) {
+			value = GeoIP_country_code_by_ipnum_v6(geoip6, (geoipv6_t)reqaddr->type.in6);
+#endif
+		}
+                
+		if ((NULL != value) && (2 == strlen(value))) {
+			if ((e->country[0] == value[0]) && (e->country[1] == value[1])) {
+				return (ISC_TRUE);
+			}
+		}
+		return (ISC_FALSE);
+#endif
+
 	case dns_aclelementtype_keyname:
 		if (reqsigner != NULL &&
 		    dns_name_equal(reqsigner, &e->keyname)) {
--- bind9-9.9.5.dfsg.orig/lib/dns/adb.c
+++ bind9-9.9.5.dfsg/lib/dns/adb.c
@@ -201,6 +201,7 @@
 	unsigned int                    magic;
 	dns_fetch_t                    *fetch;
 	dns_rdataset_t                  rdataset;
+	unsigned int			depth;
 };
 
 /*%
@@ -300,8 +301,7 @@
 static inline void violate_locking_hierarchy(isc_mutex_t *, isc_mutex_t *);
 static isc_boolean_t clean_namehooks(dns_adb_t *, dns_adbnamehooklist_t *);
 static void clean_target(dns_adb_t *, dns_name_t *);
-static void clean_finds_at_name(dns_adbname_t *, isc_eventtype_t,
-				unsigned int);
+static void clean_finds_at_name(dns_adbname_t *, isc_eventtype_t, unsigned int);
 static isc_boolean_t check_expire_namehooks(dns_adbname_t *, isc_stdtime_t);
 static isc_boolean_t check_expire_entry(dns_adb_t *, dns_adbentry_t **,
 					isc_stdtime_t);
@@ -309,6 +309,7 @@
 static isc_result_t dbfind_name(dns_adbname_t *, isc_stdtime_t,
 				dns_rdatatype_t);
 static isc_result_t fetch_name(dns_adbname_t *, isc_boolean_t,
+			       unsigned int, isc_counter_t *qc,
 			       dns_rdatatype_t);
 static inline void check_exit(dns_adb_t *);
 static void destroy(dns_adb_t *);
@@ -2770,6 +2771,19 @@
 		   isc_stdtime_t now, dns_name_t *target,
 		   in_port_t port, dns_adbfind_t **findp)
 {
+	return (dns_adb_createfind2(adb, task, action, arg, name,
+				    qname, qtype, options, now,
+				    target, port, 0, NULL, findp));
+}
+
+isc_result_t
+dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
+		    void *arg, dns_name_t *name, dns_name_t *qname,
+		    dns_rdatatype_t qtype, unsigned int options,
+		    isc_stdtime_t now, dns_name_t *target,
+		    in_port_t port, unsigned int depth, isc_counter_t *qc,
+		    dns_adbfind_t **findp)
+{
 	dns_adbfind_t *find;
 	dns_adbname_t *adbname;
 	int bucket;
@@ -3000,7 +3014,7 @@
 		 * Start V4.
 		 */
 		if (WANT_INET(wanted_fetches) &&
-		    fetch_name(adbname, start_at_zone,
+		    fetch_name(adbname, start_at_zone, depth, qc,
 			       dns_rdatatype_a) == ISC_R_SUCCESS) {
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: started A fetch for name %p",
@@ -3011,7 +3025,7 @@
 		 * Start V6.
 		 */
 		if (WANT_INET6(wanted_fetches) &&
-		    fetch_name(adbname, start_at_zone,
+		    fetch_name(adbname, start_at_zone, depth, qc,
 			       dns_rdatatype_aaaa) == ISC_R_SUCCESS) {
 			DP(DEF_LEVEL,
 			   "dns_adb_createfind: "
@@ -3754,6 +3768,12 @@
 		DP(DEF_LEVEL, "adb: fetch of '%s' %s failed: %s",
 		   buf, address_type == DNS_ADBFIND_INET ? "A" : "AAAA",
 		   dns_result_totext(dev->result));
+		/*
+		 * Don't record a failure unless this is the initial
+		 * fetch of a chain.
+		 */
+		if (fetch->depth > 1)
+			goto out;
 		/* XXXMLG Don't pound on bad servers. */
 		if (address_type == DNS_ADBFIND_INET) {
 			name->expire_v4 = ISC_MIN(name->expire_v4, now + 300);
@@ -3791,9 +3811,8 @@
 }
 
 static isc_result_t
-fetch_name(dns_adbname_t *adbname,
-	   isc_boolean_t start_at_zone,
-	   dns_rdatatype_t type)
+fetch_name(dns_adbname_t *adbname, isc_boolean_t start_at_zone,
+	   unsigned int depth, isc_counter_t *qc, dns_rdatatype_t type)
 {
 	isc_result_t result;
 	dns_adbfetch_t *fetch = NULL;
@@ -3838,12 +3857,14 @@
 		result = ISC_R_NOMEMORY;
 		goto cleanup;
 	}
+	fetch->depth = depth;
 
-	result = dns_resolver_createfetch(adb->view->resolver, &adbname->name,
-					  type, name, nameservers, NULL,
-					  options, adb->task, fetch_callback,
-					  adbname, &fetch->rdataset, NULL,
-					  &fetch->fetch);
+	result = dns_resolver_createfetch3(adb->view->resolver, &adbname->name,
+					   type, name, nameservers, NULL,
+					   NULL, 0, options, depth, qc,
+					   adb->task, fetch_callback, adbname,
+					   &fetch->rdataset, NULL,
+					   &fetch->fetch);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 
--- bind9-9.9.5.dfsg.orig/lib/dns/dnssec.c
+++ bind9-9.9.5.dfsg/lib/dns/dnssec.c
@@ -979,6 +979,8 @@
 	mctx = msg->mctx;
 
 	msg->verify_attempted = 1;
+	msg->verified_sig = 0;
+	msg->sig0status = dns_tsigerror_badsig;
 
 	if (is_response(msg)) {
 		if (msg->query.base == NULL)
@@ -1072,6 +1074,7 @@
 	}
 
 	msg->verified_sig = 1;
+	msg->sig0status = dns_rcode_noerror;
 
 	dst_context_destroy(&ctx);
 	dns_rdata_freestruct(&sig);
--- bind9-9.9.5.dfsg.orig/lib/dns/dynamic_db.c
+++ bind9-9.9.5.dfsg/lib/dns/dynamic_db.c
@@ -0,0 +1,366 @@
+/*
+ * Copyright (C) 2008-2011  Red Hat, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND Red Hat DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL Red Hat BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#include <config.h>
+
+#include <isc/buffer.h>
+#include <isc/mem.h>
+#include <isc/mutex.h>
+#include <isc/once.h>
+#include <isc/result.h>
+#include <isc/region.h>
+#include <isc/task.h>
+#include <isc/types.h>
+#include <isc/util.h>
+
+#include <dns/dynamic_db.h>
+#include <dns/log.h>
+#include <dns/types.h>
+#include <dns/view.h>
+#include <dns/zone.h>
+
+#include <string.h>
+
+#if HAVE_DLFCN_H
+#include <dlfcn.h>
+#endif
+
+#ifndef DYNDB_LIBDIR
+#define DYNDB_LIBDIR ""
+#endif
+
+#define CHECK(op)						\
+	do { result = (op);					\
+		if (result != ISC_R_SUCCESS) goto cleanup;	\
+	} while (0)
+
+
+typedef isc_result_t (*register_func_t)(isc_mem_t *mctx, const char *name,
+		const char * const *argv,
+		const dns_dyndb_arguments_t *dyndb_args);
+typedef void (*destroy_func_t)(void);
+
+typedef struct dyndb_implementation dyndb_implementation_t;
+
+struct dyndb_implementation {
+	isc_mem_t			*mctx;
+	void				*handle;
+	register_func_t			register_function;
+	destroy_func_t			destroy_function;
+	LINK(dyndb_implementation_t)	link;
+};
+
+struct dns_dyndb_arguments {
+	dns_view_t	*view;
+	dns_zonemgr_t	*zmgr;
+	isc_task_t	*task;
+	isc_timermgr_t	*timermgr;
+};
+
+/* List of implementations. Locked by dyndb_lock. */
+static LIST(dyndb_implementation_t) dyndb_implementations;
+/* Locks dyndb_implementations. */
+static isc_mutex_t dyndb_lock;
+static isc_once_t once = ISC_ONCE_INIT;
+
+static void
+dyndb_initialize(void) {
+	RUNTIME_CHECK(isc_mutex_init(&dyndb_lock) == ISC_R_SUCCESS);
+	INIT_LIST(dyndb_implementations);
+}
+
+
+#if HAVE_DLFCN_H
+static isc_result_t
+load_symbol(void *handle, const char *symbol_name, void **symbolp)
+{
+	const char *errmsg;
+	void *symbol;
+
+	REQUIRE(handle != NULL);
+	REQUIRE(symbolp != NULL && *symbolp == NULL);
+
+	symbol = dlsym(handle, symbol_name);
+	if (symbol == NULL) {
+		errmsg = dlerror();
+		if (errmsg == NULL)
+			errmsg = "returned function pointer is NULL";
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DYNDB, ISC_LOG_ERROR,
+			      "failed to lookup symbol %s: %s",
+			      symbol_name, errmsg);
+		return ISC_R_FAILURE;
+	}
+	dlerror();
+
+	*symbolp = symbol;
+
+	return ISC_R_SUCCESS;
+}
+
+static isc_result_t
+load_library(isc_mem_t *mctx, const char *filename, dyndb_implementation_t **impp)
+{
+	isc_result_t result;
+	size_t module_size;
+	isc_buffer_t *module_buf = NULL;
+	isc_region_t module_region;
+	void *handle = NULL;
+	dyndb_implementation_t *imp;
+	register_func_t register_function = NULL;
+	destroy_func_t destroy_function = NULL;
+
+	REQUIRE(impp != NULL && *impp == NULL);
+
+	/* Build up the full path. */
+	module_size = strlen(DYNDB_LIBDIR) + strlen(filename) + 1;
+	CHECK(isc_buffer_allocate(mctx, &module_buf, module_size));
+	isc_buffer_putstr(module_buf, DYNDB_LIBDIR);
+	isc_buffer_putstr(module_buf, filename);
+	isc_buffer_putuint8(module_buf, 0);
+	isc_buffer_region(module_buf, &module_region);
+
+	handle = dlopen((char *)module_region.base, RTLD_LAZY);
+	if (handle == NULL) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
+			      DNS_LOGMODULE_DYNDB, ISC_LOG_ERROR,
+			      "failed to dynamically load driver '%s': %s",
+			      filename, dlerror());
+		result = ISC_R_FAILURE;
+		goto cleanup;
+	}
+	dlerror();
+
+	CHECK(load_symbol(handle, "dynamic_driver_init",
+			  (void **)&register_function));
+	CHECK(load_symbol(handle, "dynamic_driver_destroy",
+			  (void **)&destroy_function));
+
+	imp = isc_mem_get(mctx, sizeof(dyndb_implementation_t));
+	if (imp == NULL) {
+		result = ISC_R_NOMEMORY;
+		goto cleanup;
+	}
+
+	imp->mctx = NULL;
+	isc_mem_attach(mctx, &imp->mctx);
+	imp->handle = handle;
+	imp->register_function = register_function;
+	imp->destroy_function = destroy_function;
+	INIT_LINK(imp, link);
+
+	*impp = imp;
+
+cleanup:
+	if (result != ISC_R_SUCCESS && handle != NULL)
+		dlclose(handle);
+	if (module_buf != NULL)
+		isc_buffer_free(&module_buf);
+
+	return result;
+}
+
+static void
+unload_library(dyndb_implementation_t **impp)
+{
+	dyndb_implementation_t *imp;
+
+	REQUIRE(impp != NULL && *impp != NULL);
+
+	imp = *impp;
+
+	isc_mem_putanddetach(&imp->mctx, imp, sizeof(dyndb_implementation_t));
+
+	*impp = NULL;
+}
+
+#else	/* HAVE_DLFCN_H */
+static isc_result_t
+load_library(isc_mem_t *mctx, const char *filename, dyndb_implementation_t **impp)
+{
+	UNUSED(mctx);
+	UNUSED(filename);
+	UNUSED(impp);
+
+	isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DYNDB,
+		      ISC_LOG_ERROR,
+		      "dynamic database support is not implemented")
+
+	return ISC_R_NOTIMPLEMENTED;
+}
+
+static void
+unload_library(dyndb_implementation_t **impp)
+{
+	dyndb_implementation_t *imp;
+
+	REQUIRE(impp != NULL && *impp != NULL);
+
+	imp = *impp;
+
+	isc_mem_putanddetach(&imp->mctx, imp, sizeof(dyndb_implementation_t));
+
+	*impp = NULL;
+}
+#endif	/* HAVE_DLFCN_H */
+
+isc_result_t
+dns_dynamic_db_load(const char *libname, const char *name, isc_mem_t *mctx,
+		    const char * const *argv,
+		    const dns_dyndb_arguments_t *dyndb_args)
+{
+	isc_result_t result;
+	dyndb_implementation_t *implementation = NULL;
+
+	RUNTIME_CHECK(isc_once_do(&once, dyndb_initialize) == ISC_R_SUCCESS);
+
+	CHECK(load_library(mctx, libname, &implementation));
+	CHECK(implementation->register_function(mctx, name, argv, dyndb_args));
+
+	LOCK(&dyndb_lock);
+	APPEND(dyndb_implementations, implementation, link);
+	UNLOCK(&dyndb_lock);
+
+	return ISC_R_SUCCESS;
+
+cleanup:
+	if (implementation != NULL)
+		unload_library(&implementation);
+
+	return result;
+}
+
+void
+dns_dynamic_db_cleanup(isc_boolean_t exiting)
+{
+	dyndb_implementation_t *elem;
+	dyndb_implementation_t *prev;
+
+	RUNTIME_CHECK(isc_once_do(&once, dyndb_initialize) == ISC_R_SUCCESS);
+
+	LOCK(&dyndb_lock);
+	elem = TAIL(dyndb_implementations);
+	while (elem != NULL) {
+		prev = PREV(elem, link);
+		UNLINK(dyndb_implementations, elem, link);
+		elem->destroy_function();
+		unload_library(&elem);
+		elem = prev;
+	}
+	UNLOCK(&dyndb_lock);
+
+	if (exiting == ISC_TRUE)
+		isc_mutex_destroy(&dyndb_lock);
+}
+
+dns_dyndb_arguments_t *
+dns_dyndb_arguments_create(isc_mem_t *mctx)
+{
+	dns_dyndb_arguments_t *args;
+
+	args = isc_mem_get(mctx, sizeof(*args));
+	if (args != NULL)
+		memset(args, 0, sizeof(*args));
+
+	return args;
+}
+
+void
+dns_dyndb_arguments_destroy(isc_mem_t *mctx, dns_dyndb_arguments_t *args)
+{
+	REQUIRE(args != NULL);
+
+	dns_dyndb_set_view(args, NULL);
+	dns_dyndb_set_zonemgr(args, NULL);
+	dns_dyndb_set_task(args, NULL);
+	dns_dyndb_set_timermgr(args, NULL);
+
+	isc_mem_put(mctx, args, sizeof(*args));
+}
+
+void
+dns_dyndb_set_view(dns_dyndb_arguments_t *args, dns_view_t *view)
+{
+	REQUIRE(args != NULL);
+
+	if (args->view != NULL)
+		dns_view_detach(&args->view);
+	if (view != NULL)
+		dns_view_attach(view, &args->view);
+}
+
+dns_view_t *
+dns_dyndb_get_view(dns_dyndb_arguments_t *args)
+{
+	REQUIRE(args != NULL);
+
+	return args->view;
+}
+
+void
+dns_dyndb_set_zonemgr(dns_dyndb_arguments_t *args, dns_zonemgr_t *zmgr)
+{
+	REQUIRE(args != NULL);
+
+	if (args->zmgr != NULL)
+		dns_zonemgr_detach(&args->zmgr);
+	if (zmgr != NULL)
+		dns_zonemgr_attach(zmgr, &args->zmgr);
+}
+
+dns_zonemgr_t *
+dns_dyndb_get_zonemgr(dns_dyndb_arguments_t *args)
+{
+	REQUIRE(args != NULL);
+
+	return args->zmgr;
+}
+
+void
+dns_dyndb_set_task(dns_dyndb_arguments_t *args, isc_task_t *task)
+{
+	REQUIRE(args != NULL);
+
+	if (args->task != NULL)
+		isc_task_detach(&args->task);
+	if (task != NULL)
+		isc_task_attach(task, &args->task);
+}
+
+isc_task_t *
+dns_dyndb_get_task(dns_dyndb_arguments_t *args)
+{
+	REQUIRE(args != NULL);
+
+	return args->task;
+}
+
+void
+dns_dyndb_set_timermgr(dns_dyndb_arguments_t *args, isc_timermgr_t *timermgr)
+{
+	REQUIRE(args != NULL);
+
+	args->timermgr = timermgr;
+}
+
+isc_timermgr_t *
+dns_dyndb_get_timermgr(dns_dyndb_arguments_t *args)
+{
+	REQUIRE(args != NULL);
+
+	return args->timermgr;
+}
--- bind9-9.9.5.dfsg.orig/lib/dns/hmac_link.c
+++ bind9-9.9.5.dfsg/lib/dns/hmac_link.c
@@ -76,7 +76,7 @@
 	hmacmd5ctx = isc_mem_get(dctx->mctx, sizeof(isc_hmacmd5_t));
 	if (hmacmd5ctx == NULL)
 		return (ISC_R_NOMEMORY);
-	isc_hmacmd5_init(hmacmd5ctx, hkey->key, ISC_SHA1_BLOCK_LENGTH);
+	isc_hmacmd5_init(hmacmd5ctx, hkey->key, ISC_MD5_BLOCK_LENGTH);
 	dctx->ctxdata.hmacmd5ctx = hmacmd5ctx;
 	return (ISC_R_SUCCESS);
 }
@@ -139,7 +139,7 @@
 	else if (hkey1 == NULL || hkey2 == NULL)
 		return (ISC_FALSE);
 
-	if (isc_safe_memcmp(hkey1->key, hkey2->key, ISC_SHA1_BLOCK_LENGTH))
+	if (isc_safe_memcmp(hkey1->key, hkey2->key, ISC_MD5_BLOCK_LENGTH))
 		return (ISC_TRUE);
 	else
 		return (ISC_FALSE);
@@ -150,17 +150,17 @@
 	isc_buffer_t b;
 	isc_result_t ret;
 	unsigned int bytes;
-	unsigned char data[ISC_SHA1_BLOCK_LENGTH];
+	unsigned char data[ISC_MD5_BLOCK_LENGTH];
 
 	UNUSED(callback);
 
 	bytes = (key->key_size + 7) / 8;
-	if (bytes > ISC_SHA1_BLOCK_LENGTH) {
-		bytes = ISC_SHA1_BLOCK_LENGTH;
-		key->key_size = ISC_SHA1_BLOCK_LENGTH * 8;
+	if (bytes > ISC_MD5_BLOCK_LENGTH) {
+		bytes = ISC_MD5_BLOCK_LENGTH;
+		key->key_size = ISC_MD5_BLOCK_LENGTH * 8;
 	}
 
-	memset(data, 0, ISC_SHA1_BLOCK_LENGTH);
+	memset(data, 0, ISC_MD5_BLOCK_LENGTH);
 	ret = dst__entropy_getdata(data, bytes, ISC_TF(pseudorandom_ok != 0));
 
 	if (ret != ISC_R_SUCCESS)
@@ -169,7 +169,7 @@
 	isc_buffer_init(&b, data, bytes);
 	isc_buffer_add(&b, bytes);
 	ret = hmacmd5_fromdns(key, &b);
-	memset(data, 0, ISC_SHA1_BLOCK_LENGTH);
+	memset(data, 0, ISC_MD5_BLOCK_LENGTH);
 
 	return (ret);
 }
@@ -223,7 +223,7 @@
 
 	memset(hkey->key, 0, sizeof(hkey->key));
 
-	if (r.length > ISC_SHA1_BLOCK_LENGTH) {
+	if (r.length > ISC_MD5_BLOCK_LENGTH) {
 		isc_md5_init(&md5ctx);
 		isc_md5_update(&md5ctx, r.base, r.length);
 		isc_md5_final(&md5ctx, hkey->key);
@@ -236,6 +236,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacmd5 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -512,6 +514,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha1 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -790,6 +794,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha224 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1068,6 +1074,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha256 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1346,6 +1354,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha384 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
@@ -1624,6 +1634,8 @@
 	key->key_size = keylen * 8;
 	key->keydata.hmacsha512 = hkey;
 
+	isc_buffer_forward(data, r.length);
+
 	return (ISC_R_SUCCESS);
 }
 
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/Makefile.in
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/Makefile.in
@@ -24,12 +24,14 @@
 HEADERS =	acl.h adb.h byaddr.h cache.h callbacks.h cert.h compress.h \
 		client.h clientinfo.h compress.h \
 		db.h dbiterator.h dbtable.h diff.h dispatch.h \
+		dynamic_db.h \
 		dlz.h dnssec.h ds.h events.h fixedname.h iptable.h journal.h \
 		keyflags.h keytable.h keyvalues.h lib.h log.h \
 		master.h masterdump.h message.h name.h ncache.h nsec.h \
 		peer.h portlist.h private.h rbt.h rcode.h \
 		rdata.h rdataclass.h rdatalist.h rdataset.h rdatasetiter.h \
 		rdataslab.h rdatatype.h request.h resolver.h result.h \
+		rrl.h  tsec.h \
 		rootns.h rpz.h sdb.h sdlz.h secalg.h secproto.h soa.h ssu.h \
 		tcpmsg.h time.h tkey.h tsec.h tsig.h ttl.h types.h \
 		validator.h version.h view.h xfrin.h zone.h zonekey.h zt.h
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/acl.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/acl.h
@@ -53,8 +53,16 @@
 	dns_aclelementtype_localhost,
 	dns_aclelementtype_localnets,
 	dns_aclelementtype_any
+#ifdef SUPPORT_GEOIP
+          ,
+	dns_aclelementtype_ipcountry
+#endif
 } dns_aclelemettype_t;
 
+#ifdef SUPPORT_GEOIP
+typedef char dns_aclipcountry[3];
+#endif
+
 typedef struct dns_aclipprefix dns_aclipprefix_t;
 
 struct dns_aclipprefix {
@@ -68,6 +76,9 @@
 	dns_name_t		keyname;
 	dns_acl_t		*nestedacl;
 	int			node_num;
+#ifdef SUPPORT_GEOIP
+	dns_aclipcountry        country;
+#endif
 };
 
 struct dns_acl {
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/adb.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/adb.h
@@ -334,6 +334,13 @@
 		   dns_rdatatype_t qtype, unsigned int options,
 		   isc_stdtime_t now, dns_name_t *target,
 		   in_port_t port, dns_adbfind_t **find);
+isc_result_t
+dns_adb_createfind2(dns_adb_t *adb, isc_task_t *task, isc_taskaction_t action,
+		    void *arg, dns_name_t *name, dns_name_t *qname,
+		    dns_rdatatype_t qtype, unsigned int options,
+		    isc_stdtime_t now, dns_name_t *target, in_port_t port,
+		    unsigned int depth, isc_counter_t *qc,
+		    dns_adbfind_t **find);
 /*%<
  * Main interface for clients. The adb will look up the name given in
  * "name" and will build up a list of found addresses, and perhaps start
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/dynamic_db.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/dynamic_db.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2008-2011  Red Hat, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND Red Hat DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL Red Hat BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef DYNAMIC_DB_H
+#define DYNAMIC_DB_H
+
+#include <isc/types.h>
+
+#include <dns/types.h>
+
+/*
+ * TODO:
+ * Reformat the prototypes.
+ * Add annotated comments.
+ */
+
+isc_result_t dns_dynamic_db_load(const char *libname, const char *name,
+				 isc_mem_t *mctx, const char * const *argv,
+				 const dns_dyndb_arguments_t *dyndb_args);
+
+void dns_dynamic_db_cleanup(isc_boolean_t exiting);
+
+dns_dyndb_arguments_t *dns_dyndb_arguments_create(isc_mem_t *mctx);
+void dns_dyndb_arguments_destroy(isc_mem_t *mctx, dns_dyndb_arguments_t *args);
+
+void dns_dyndb_set_view(dns_dyndb_arguments_t *args, dns_view_t *view);
+dns_view_t *dns_dyndb_get_view(dns_dyndb_arguments_t *args);
+void dns_dyndb_set_zonemgr(dns_dyndb_arguments_t *args, dns_zonemgr_t *zmgr);
+dns_zonemgr_t *dns_dyndb_get_zonemgr(dns_dyndb_arguments_t *args);
+void dns_dyndb_set_task(dns_dyndb_arguments_t *args, isc_task_t *task);
+isc_task_t *dns_dyndb_get_task(dns_dyndb_arguments_t *args);
+void dns_dyndb_set_timermgr(dns_dyndb_arguments_t *args,
+			    isc_timermgr_t *timermgr);
+isc_timermgr_t *dns_dyndb_get_timermgr(dns_dyndb_arguments_t *args);
+
+#endif
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/log.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/log.h
@@ -77,6 +77,7 @@
 #define DNS_LOGMODULE_DLZ		(&dns_modules[26])
 #define DNS_LOGMODULE_DNSSEC		(&dns_modules[27])
 #define DNS_LOGMODULE_CRYPTO		(&dns_modules[28])
+#define DNS_LOGMODULE_DYNDB		(&dns_modules[29])
 
 ISC_LANG_BEGINDECLS
 
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/message.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/message.h
@@ -211,6 +211,8 @@
 	unsigned int			verify_attempted : 1;
 	unsigned int			free_query : 1;
 	unsigned int			free_saved : 1;
+	unsigned int			tkey : 1;
+	unsigned int			rdclass_set : 1;
 
 	unsigned int			opt_reserved;
 	unsigned int			sig_reserved;
@@ -1375,6 +1377,15 @@
  * \li	 other.
  */
 
+void
+dns_message_setclass(dns_message_t *msg, dns_rdataclass_t rdclass);
+/*%<
+ * Set the expected class of records in the response.
+ *
+ * Requires:
+ * \li   msg be a valid message with parsing intent.
+ */
+
 ISC_LANG_ENDDECLS
 
 #endif /* DNS_MESSAGE_H */
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/ncache.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/ncache.h
@@ -61,12 +61,12 @@
 
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
 	       dns_rdataset_t *addedrdataset);
 isc_result_t
 dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
 		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t maxttl,
+		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
 		     isc_boolean_t optout, dns_rdataset_t *addedrdataset);
 /*%<
  * Convert the authority data from 'message' into a negative cache
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/rdataset.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/rdataset.h
@@ -206,6 +206,8 @@
 #define DNS_RDATASETATTR_OPTOUT		0x00100000	/*%< OPTOUT proof */
 #define DNS_RDATASETATTR_NEGATIVE	0x00200000
 
+#define DNS_RDATASETATTR_SINGLE		0x10000000	/* Only return 1 answer */
+
 /*%
  * _OMITDNSSEC:
  * 	Omit DNSSEC records when rendering ncache records.
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/resolver.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/resolver.h
@@ -274,6 +274,18 @@
 			  dns_rdataset_t *rdataset,
 			  dns_rdataset_t *sigrdataset,
 			  dns_fetch_t **fetchp);
+isc_result_t
+dns_resolver_createfetch3(dns_resolver_t *res, dns_name_t *name,
+			  dns_rdatatype_t type,
+			  dns_name_t *domain, dns_rdataset_t *nameservers,
+			  dns_forwarders_t *forwarders,
+			  isc_sockaddr_t *client, isc_uint16_t id,
+			  unsigned int options, unsigned int depth,
+			  isc_counter_t *qc, isc_task_t *task,
+			  isc_taskaction_t action, void *arg,
+			  dns_rdataset_t *rdataset,
+			  dns_rdataset_t *sigrdataset,
+			  dns_fetch_t **fetchp);
 /*%<
  * Recurse to answer a question.
  *
@@ -573,6 +585,30 @@
  *
  * Requires:
  * \li	resolver to be valid.
+ */
+
+void
+dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth);
+unsigned int
+dns_resolver_getmaxdepth(dns_resolver_t *resolver);
+/*%
+ * Get and set how many NS indirections will be followed when looking for
+ * nameserver addresses.
+ *
+ * Requires:
+ * \li	resolver to be valid.
+ */
+
+void
+dns_resolver_setmaxqueries(dns_resolver_t *resolver, unsigned int queries);
+unsigned int
+dns_resolver_getmaxqueries(dns_resolver_t *resolver);
+/*%
+ * Get and set how many iterative queries will be allowed before
+ * terminating a recursive query.
+ *
+ * Requires:
+ * \li	resolver to be valid.
  */
 
 ISC_LANG_ENDDECLS
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/types.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/types.h
@@ -60,6 +60,7 @@
 typedef void					dns_dbversion_t;
 typedef struct dns_dlzimplementation		dns_dlzimplementation_t;
 typedef struct dns_dlzdb			dns_dlzdb_t;
+typedef struct dns_dyndb_arguments		dns_dyndb_arguments_t;
 typedef struct dns_sdlzimplementation		dns_sdlzimplementation_t;
 typedef struct dns_decompress			dns_decompress_t;
 typedef struct dns_dispatch			dns_dispatch_t;
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dns/view.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dns/view.h
@@ -148,6 +148,8 @@
 	isc_boolean_t			requestnsid;
 	dns_ttl_t			maxcachettl;
 	dns_ttl_t			maxncachettl;
+	dns_ttl_t			mincachettl;
+	dns_ttl_t			minncachettl;
 	in_port_t			dstport;
 	dns_aclenv_t			aclenv;
 	dns_rdatatype_t			preferred_glue;
--- bind9-9.9.5.dfsg.orig/lib/dns/include/dst/dst.h
+++ bind9-9.9.5.dfsg/lib/dns/include/dst/dst.h
@@ -69,6 +69,7 @@
 #define DST_ALG_HMACSHA256	163	/* XXXMPA */
 #define DST_ALG_HMACSHA384	164	/* XXXMPA */
 #define DST_ALG_HMACSHA512	165	/* XXXMPA */
+#define DST_ALG_INDIRECT	252
 #define DST_ALG_PRIVATE		254
 #define DST_ALG_EXPAND		255
 #define DST_MAX_ALGS		255
--- bind9-9.9.5.dfsg.orig/lib/dns/log.c
+++ bind9-9.9.5.dfsg/lib/dns/log.c
@@ -83,6 +83,7 @@
 	{ "dns/dlz",		0 },
 	{ "dns/dnssec",		0 },
 	{ "dns/crypto",		0 },
+	{ "dns/dynamic_db",	0 },
 	{ NULL, 		0 }
 };
 
--- bind9-9.9.5.dfsg.orig/lib/dns/message.c
+++ bind9-9.9.5.dfsg/lib/dns/message.c
@@ -436,6 +436,8 @@
 	m->saved.base = NULL;
 	m->saved.length = 0;
 	m->free_saved = 0;
+	m->tkey = 0;
+	m->rdclass_set = 0;
 	m->querytsig = NULL;
 }
 
@@ -1086,13 +1088,19 @@
 		 * If this class is different than the one we already read,
 		 * this is an error.
 		 */
-		if (msg->state == DNS_SECTION_ANY) {
-			msg->state = DNS_SECTION_QUESTION;
+		if (msg->rdclass_set == 0) {
 			msg->rdclass = rdclass;
+			msg->rdclass_set = 1;
 		} else if (msg->rdclass != rdclass)
 			DO_FORMERR;
 
 		/*
+		 * Is this a TKEY query?
+		 */
+		if (rdtype == dns_rdatatype_tkey)
+			msg->tkey = 1;
+
+		/*
 		 * Can't ask the same question twice.
 		 */
 		result = dns_message_find(name, rdclass, rdtype, 0, NULL);
@@ -1163,14 +1171,71 @@
 	return (ISC_FALSE);
 }
 
+/*
+ * Check to confirm that all DNSSEC records (DS, NSEC, NSEC3) have
+ * covering RRSIGs.
+ */
+static isc_boolean_t
+auth_signed(dns_namelist_t *section) {
+	dns_name_t *name;
+
+	for (name = ISC_LIST_HEAD(*section);
+	     name != NULL;
+	     name = ISC_LIST_NEXT(name, link))
+	{
+		int auth_dnssec = 0, auth_rrsig = 0;
+		dns_rdataset_t *rds;
+
+		for (rds = ISC_LIST_HEAD(name->list);
+		     rds != NULL;
+		     rds = ISC_LIST_NEXT(rds, link))
+		{
+			switch (rds->type) {
+			case dns_rdatatype_ds:
+				auth_dnssec |= 0x1;
+				break;
+			case dns_rdatatype_nsec:
+				auth_dnssec |= 0x2;
+				break;
+			case dns_rdatatype_nsec3:
+				auth_dnssec |= 0x4;
+				break;
+			case dns_rdatatype_rrsig:
+				break;
+			default:
+				continue;
+			}
+
+			switch (rds->covers) {
+			case dns_rdatatype_ds:
+				auth_rrsig |= 0x1;
+				break;
+			case dns_rdatatype_nsec:
+				auth_rrsig |= 0x2;
+				break;
+			case dns_rdatatype_nsec3:
+				auth_rrsig |= 0x4;
+				break;
+			default:
+				break;
+			}
+		}
+
+		if (auth_dnssec != auth_rrsig)
+			return (ISC_FALSE);
+	}
+
+	return (ISC_TRUE);
+}
+
 static isc_result_t
 getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	   dns_section_t sectionid, unsigned int options)
 {
 	isc_region_t r;
 	unsigned int count, rdatalen;
-	dns_name_t *name;
-	dns_name_t *name2;
+	dns_name_t *name = NULL;
+	dns_name_t *name2 = NULL;
 	dns_offsets_t *offsets;
 	dns_rdataset_t *rdataset;
 	dns_rdatalist_t *rdatalist;
@@ -1180,7 +1245,7 @@
 	dns_rdata_t *rdata;
 	dns_ttl_t ttl;
 	dns_namelist_t *section;
-	isc_boolean_t free_name, free_rdataset;
+	isc_boolean_t free_name = ISC_FALSE, free_rdataset = ISC_FALSE;
 	isc_boolean_t preserve_order, best_effort, seen_problem;
 	isc_boolean_t issigzero;
 
@@ -1188,12 +1253,12 @@
 	best_effort = ISC_TF(options & DNS_MESSAGEPARSE_BESTEFFORT);
 	seen_problem = ISC_FALSE;
 
+	section = &msg->sections[sectionid];
+
 	for (count = 0; count < msg->counts[sectionid]; count++) {
 		int recstart = source->current;
 		isc_boolean_t skip_name_search, skip_type_search;
 
-		section = &msg->sections[sectionid];
-
 		skip_name_search = ISC_FALSE;
 		skip_type_search = ISC_FALSE;
 		free_rdataset = ISC_FALSE;
@@ -1236,12 +1301,12 @@
 		 * If there was no question section, we may not yet have
 		 * established a class.  Do so now.
 		 */
-		if (msg->state == DNS_SECTION_ANY &&
+		if (msg->rdclass_set == 0 &&
 		    rdtype != dns_rdatatype_opt &&	/* class is UDP SIZE */
 		    rdtype != dns_rdatatype_tsig &&	/* class is ANY */
 		    rdtype != dns_rdatatype_tkey) {	/* class is undefined */
 			msg->rdclass = rdclass;
-			msg->state = DNS_SECTION_QUESTION;
+			msg->rdclass_set = 1;
 		}
 
 		/*
@@ -1251,7 +1316,7 @@
 		if (msg->opcode != dns_opcode_update
 		    && rdtype != dns_rdatatype_tsig
 		    && rdtype != dns_rdatatype_opt
-		    && rdtype != dns_rdatatype_dnskey /* in a TKEY query */
+		    && rdtype != dns_rdatatype_key /* in a TKEY query */
 		    && rdtype != dns_rdatatype_sig /* SIG(0) */
 		    && rdtype != dns_rdatatype_tkey /* Win2000 TKEY */
 		    && msg->rdclass != dns_rdataclass_any
@@ -1259,6 +1324,16 @@
 			DO_FORMERR;
 
 		/*
+		 * If this is not a TKEY query/response then the KEY
+		 * record's class needs to match.
+		 */
+		if (msg->opcode != dns_opcode_update && !msg->tkey &&
+		    rdtype == dns_rdatatype_key &&
+		    msg->rdclass != dns_rdataclass_any &&
+		    msg->rdclass != rdclass)
+			DO_FORMERR;
+
+		/*
 		 * Special type handling for TSIG, OPT, and TKEY.
 		 */
 		if (rdtype == dns_rdatatype_tsig) {
@@ -1356,7 +1431,7 @@
 			goto cleanup;
 		rdata->rdclass = rdclass;
 		issigzero = ISC_FALSE;
-		if (rdtype == dns_rdatatype_rrsig  &&
+		if (rdtype == dns_rdatatype_rrsig &&
 		    rdata->flags == 0) {
 			covers = dns_rdata_covers(rdata);
 			if (covers == 0)
@@ -1372,6 +1447,10 @@
 				skip_name_search = ISC_TRUE;
 				skip_type_search = ISC_TRUE;
 				issigzero = ISC_TRUE;
+			} else {
+				if (msg->rdclass != dns_rdataclass_any &&
+				    msg->rdclass != rdclass)
+					DO_FORMERR;
 			}
 		} else
 			covers = 0;
@@ -1557,6 +1636,19 @@
 		INSIST(free_rdataset == ISC_FALSE);
 	}
 
+	/*
+	 * If any of DS, NSEC or NSEC3 appeared in the
+	 * authority section of a query response without
+	 * a covering RRSIG, FORMERR
+	 */
+	if (sectionid == DNS_SECTION_AUTHORITY &&
+	    msg->opcode == dns_opcode_query &&
+	    ((msg->flags & DNS_MESSAGEFLAG_QR) != 0) &&
+	    ((msg->flags & DNS_MESSAGEFLAG_TC) == 0) &&
+	    !preserve_order &&
+	    !auth_signed(section)) 
+		DO_FORMERR;
+
 	if (seen_problem)
 		return (DNS_R_RECOVERABLE);
 	return (ISC_R_SUCCESS);
@@ -1610,6 +1702,7 @@
 	msg->counts[DNS_SECTION_ADDITIONAL] = isc_buffer_getuint16(source);
 
 	msg->header_ok = 1;
+	msg->state = DNS_SECTION_QUESTION;
 
 	/*
 	 * -1 means no EDNS.
@@ -1713,7 +1806,7 @@
 	if (r.length < DNS_MESSAGE_HEADERLEN)
 		return (ISC_R_NOSPACE);
 
-	if (r.length < msg->reserved)
+	if (r.length - DNS_MESSAGE_HEADERLEN < msg->reserved)
 		return (ISC_R_NOSPACE);
 
 	/*
@@ -1840,8 +1933,29 @@
 
 	return (ISC_TRUE);
 }
-
 #endif
+
+static isc_result_t
+renderset(dns_rdataset_t *rdataset, dns_name_t *owner_name,
+	  dns_compress_t *cctx, isc_buffer_t *target,
+	  unsigned int reserved, unsigned int options, unsigned int *countp)
+{
+	isc_result_t result;
+
+	/*
+	 * Shrink the space in the buffer by the reserved amount.
+	 */
+	if (target->length - target->used < reserved)
+		return (ISC_R_NOSPACE);
+
+	target->length -= reserved;
+	result = dns_rdataset_towire(rdataset, owner_name,
+				     cctx, target, options, countp);
+	target->length += reserved;
+
+	return (result);
+}
+
 isc_result_t
 dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 			  unsigned int options)
@@ -1884,6 +1998,8 @@
 	/*
 	 * Shrink the space in the buffer by the reserved amount.
 	 */
+	if (msg->buffer->length - msg->buffer->used < msg->reserved)
+		return (ISC_R_NOSPACE);
 	msg->buffer->length -= msg->reserved;
 
 	total = 0;
@@ -2160,9 +2276,8 @@
 		 * Render.
 		 */
 		count = 0;
-		result = dns_rdataset_towire(msg->opt, dns_rootname,
-					     msg->cctx, msg->buffer, 0,
-					     &count);
+		result = renderset(msg->opt, dns_rootname, msg->cctx,
+				   msg->buffer, msg->reserved, 0, &count);
 		msg->counts[DNS_SECTION_ADDITIONAL] += count;
 		if (result != ISC_R_SUCCESS)
 			return (result);
@@ -2178,9 +2293,8 @@
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		count = 0;
-		result = dns_rdataset_towire(msg->tsig, msg->tsigname,
-					     msg->cctx, msg->buffer, 0,
-					     &count);
+		result = renderset(msg->tsig, msg->tsigname, msg->cctx,
+				   msg->buffer, msg->reserved, 0, &count);
 		msg->counts[DNS_SECTION_ADDITIONAL] += count;
 		if (result != ISC_R_SUCCESS)
 			return (result);
@@ -2201,9 +2315,8 @@
 		 * the owner name of a SIG(0) is irrelevant, and will not
 		 * be set in a message being rendered.
 		 */
-		result = dns_rdataset_towire(msg->sig0, dns_rootname,
-					     msg->cctx, msg->buffer, 0,
-					     &count);
+		result = renderset(msg->sig0, dns_rootname, msg->cctx,
+				   msg->buffer, msg->reserved, 0, &count);
 		msg->counts[DNS_SECTION_ADDITIONAL] += count;
 		if (result != ISC_R_SUCCESS)
 			return (result);
@@ -2939,12 +3052,19 @@
 
 		result = dns_rdata_tostruct(&rdata, &tsig, NULL);
 		INSIST(result == ISC_R_SUCCESS);
-		if (msg->tsigstatus != dns_rcode_noerror)
+		if (msg->verified_sig &&
+		    msg->tsigstatus == dns_rcode_noerror &&
+		    tsig.error == dns_rcode_noerror)
+		{
+			result = ISC_R_SUCCESS;
+		} else if ((!msg->verified_sig) ||
+			   (msg->tsigstatus != dns_rcode_noerror))
+		{
 			result = DNS_R_TSIGVERIFYFAILURE;
-		else if (tsig.error != dns_rcode_noerror)
+		} else {
+			INSIST(tsig.error != dns_rcode_noerror);
 			result = DNS_R_TSIGERRORSET;
-		else
-			result = ISC_R_SUCCESS;
+		}
 		dns_rdata_freestruct(&tsig);
 
 		if (msg->tsigkey == NULL) {
@@ -3550,3 +3670,15 @@
 		dns_message_puttemprdatalist(message, &rdatalist);
 	return (result);
 }
+
+void
+dns_message_setclass(dns_message_t *msg, dns_rdataclass_t rdclass) {
+
+	REQUIRE(DNS_MESSAGE_VALID(msg));
+	REQUIRE(msg->from_to_wire == DNS_MESSAGE_INTENTPARSE);
+	REQUIRE(msg->state == DNS_SECTION_ANY);
+	REQUIRE(msg->rdclass_set == 0);
+
+	msg->rdclass = rdclass;
+	msg->rdclass_set = 1;
+}
--- bind9-9.9.5.dfsg.orig/lib/dns/name.c
+++ bind9-9.9.5.dfsg/lib/dns/name.c
@@ -2120,11 +2120,9 @@
 	REQUIRE(prefix != NULL || suffix != NULL);
 	REQUIRE(prefix == NULL ||
 		(VALID_NAME(prefix) &&
-		 prefix->buffer != NULL &&
 		 BINDABLE(prefix)));
 	REQUIRE(suffix == NULL ||
 		(VALID_NAME(suffix) &&
-		 suffix->buffer != NULL &&
 		 BINDABLE(suffix)));
 
 	splitlabel = name->labels - suffixlabels;
--- bind9-9.9.5.dfsg.orig/lib/dns/ncache.c
+++ bind9-9.9.5.dfsg/lib/dns/ncache.c
@@ -49,7 +49,7 @@
 
 static isc_result_t
 addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
 	  isc_boolean_t optout, isc_boolean_t secure,
 	  dns_rdataset_t *addedrdataset);
 
@@ -99,26 +99,26 @@
 
 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
 	       dns_rdataset_t *addedrdataset)
 {
-	return (addoptout(message, cache, node, covers, now, maxttl,
+	return (addoptout(message, cache, node, covers, now, minttl, maxttl,
 			  ISC_FALSE, ISC_FALSE, addedrdataset));
 }
 
 isc_result_t
 dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
 		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t maxttl,
+		     isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
 		     isc_boolean_t optout, dns_rdataset_t *addedrdataset)
 {
-	return (addoptout(message, cache, node, covers, now, maxttl,
+	return (addoptout(message, cache, node, covers, now, minttl, maxttl,
 			  optout, ISC_TRUE, addedrdataset));
 }
 
 static isc_result_t
 addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
 	  isc_boolean_t optout, isc_boolean_t secure,
 	  dns_rdataset_t *addedrdataset)
 {
@@ -187,6 +187,8 @@
 				    type == dns_rdatatype_nsec3) {
 					if (ttl > rdataset->ttl)
 						ttl = rdataset->ttl;
+					if (ttl < minttl)
+						ttl = minttl;
 					if (trust > rdataset->trust)
 						trust = rdataset->trust;
 					/*
@@ -614,13 +616,11 @@
 		dns_name_fromregion(&tname, &remaining);
 		INSIST(remaining.length >= tname.length);
 		isc_buffer_forward(&source, tname.length);
-		remaining.length -= tname.length;
-		remaining.base += tname.length;
+		isc_region_consume(&remaining, tname.length);
 
 		INSIST(remaining.length >= 2);
 		type = isc_buffer_getuint16(&source);
-		remaining.length -= 2;
-		remaining.base += 2;
+		isc_region_consume(&remaining, 2);
 
 		if (type != dns_rdatatype_rrsig ||
 		    !dns_name_equal(&tname, name)) {
@@ -632,8 +632,7 @@
 		INSIST(remaining.length >= 1);
 		trust = isc_buffer_getuint8(&source);
 		INSIST(trust <= dns_trust_ultimate);
-		remaining.length -= 1;
-		remaining.base += 1;
+		isc_region_consume(&remaining, 1);
 
 		raw = remaining.base;
 		count = raw[0] * 256 + raw[1];
--- bind9-9.9.5.dfsg.orig/lib/dns/openssldh_link.c
+++ bind9-9.9.5.dfsg/lib/dns/openssldh_link.c
@@ -266,8 +266,10 @@
 
 static void
 uint16_toregion(isc_uint16_t val, isc_region_t *region) {
-	*region->base++ = (val & 0xff00) >> 8;
-	*region->base++ = (val & 0x00ff);
+	*region->base = (val & 0xff00) >> 8;
+	isc_region_consume(region, 1);
+	*region->base = (val & 0x00ff);
+	isc_region_consume(region, 1);
 }
 
 static isc_uint16_t
@@ -278,7 +280,8 @@
 	val = ((unsigned int)(cp[0])) << 8;
 	val |= ((unsigned int)(cp[1]));
 
-	region->base += 2;
+	isc_region_consume(region, 2);
+
 	return (val);
 }
 
@@ -319,16 +322,16 @@
 	}
 	else
 		BN_bn2bin(dh->p, r.base);
-	r.base += plen;
+	isc_region_consume(&r, plen);
 
 	uint16_toregion(glen, &r);
 	if (glen > 0)
 		BN_bn2bin(dh->g, r.base);
-	r.base += glen;
+	isc_region_consume(&r, glen);
 
 	uint16_toregion(publen, &r);
 	BN_bn2bin(dh->pub_key, r.base);
-	r.base += publen;
+	isc_region_consume(&r, publen);
 
 	isc_buffer_add(data, dnslen);
 
@@ -369,10 +372,12 @@
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	if (plen == 1 || plen == 2) {
-		if (plen == 1)
-			special = *r.base++;
-		else
+		if (plen == 1) {
+			special = *r.base;
+			isc_region_consume(&r, 1);
+		} else {
 			special = uint16_fromregion(&r);
+		}
 		switch (special) {
 			case 1:
 				dh->p = &bn768;
@@ -387,10 +392,9 @@
 				DH_free(dh);
 				return (DST_R_INVALIDPUBLICKEY);
 		}
-	}
-	else {
+	} else {
 		dh->p = BN_bin2bn(r.base, plen, NULL);
-		r.base += plen;
+		isc_region_consume(&r, plen);
 	}
 
 	/*
@@ -421,15 +425,14 @@
 				return (DST_R_INVALIDPUBLICKEY);
 			}
 		}
-	}
-	else {
+	} else {
 		if (glen == 0) {
 			DH_free(dh);
 			return (DST_R_INVALIDPUBLICKEY);
 		}
 		dh->g = BN_bin2bn(r.base, glen, NULL);
 	}
-	r.base += glen;
+	isc_region_consume(&r, glen);
 
 	if (r.length < 2) {
 		DH_free(dh);
@@ -441,7 +444,7 @@
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	dh->pub_key = BN_bin2bn(r.base, publen, NULL);
-	r.base += publen;
+	isc_region_consume(&r, publen);
 
 	key->key_size = BN_num_bits(dh->p);
 
--- bind9-9.9.5.dfsg.orig/lib/dns/openssldsa_link.c
+++ bind9-9.9.5.dfsg/lib/dns/openssldsa_link.c
@@ -29,8 +29,6 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
-
 #ifdef OPENSSL
 #ifndef USE_EVP
 #define USE_EVP 1
@@ -137,6 +135,7 @@
 	DSA *dsa = key->keydata.dsa;
 	isc_region_t r;
 	DSA_SIG *dsasig;
+	unsigned int klen;
 #if USE_EVP
 	EVP_MD_CTX *evp_md_ctx = dctx->ctxdata.evp_md_ctx;
 	EVP_PKEY *pkey;
@@ -188,6 +187,7 @@
 					       ISC_R_FAILURE));
 	}
 	free(sigbuf);
+
 #elif 0
 	/* Only use EVP for the Digest */
 	if (!EVP_DigestFinal_ex(evp_md_ctx, digest, &siglen)) {
@@ -209,11 +209,17 @@
 					       "DSA_do_sign",
 					       DST_R_SIGNFAILURE));
 #endif
-	*r.base++ = (key->key_size - 512)/64;
+
+	klen = (key->key_size - 512)/64;
+	if (klen > 255)
+		return (ISC_R_FAILURE);
+	*r.base = klen;
+	isc_region_consume(&r, 1);
+
 	BN_bn2bin_fixed(dsasig->r, r.base, ISC_SHA1_DIGESTLENGTH);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 	BN_bn2bin_fixed(dsasig->s, r.base, ISC_SHA1_DIGESTLENGTH);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 	DSA_SIG_free(dsasig);
 	isc_buffer_add(sig, ISC_SHA1_DIGESTLENGTH * 2 + 1);
 
@@ -446,15 +452,16 @@
 	if (r.length < (unsigned int) dnslen)
 		return (ISC_R_NOSPACE);
 
-	*r.base++ = t;
+	*r.base = t;
+	isc_region_consume(&r, 1);
 	BN_bn2bin_fixed(dsa->q, r.base, ISC_SHA1_DIGESTLENGTH);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 	BN_bn2bin_fixed(dsa->p, r.base, key->key_size/8);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 	BN_bn2bin_fixed(dsa->g, r.base, key->key_size/8);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 	BN_bn2bin_fixed(dsa->pub_key, r.base, key->key_size/8);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	isc_buffer_add(data, dnslen);
 
@@ -479,29 +486,30 @@
 		return (ISC_R_NOMEMORY);
 	dsa->flags &= ~DSA_FLAG_CACHE_MONT_P;
 
-	t = (unsigned int) *r.base++;
+	t = (unsigned int) *r.base;
+	isc_region_consume(&r, 1);
 	if (t > 8) {
 		DSA_free(dsa);
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	p_bytes = 64 + 8 * t;
 
-	if (r.length < 1 + ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
+	if (r.length < ISC_SHA1_DIGESTLENGTH + 3 * p_bytes) {
 		DSA_free(dsa);
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 
 	dsa->q = BN_bin2bn(r.base, ISC_SHA1_DIGESTLENGTH, NULL);
-	r.base += ISC_SHA1_DIGESTLENGTH;
+	isc_region_consume(&r, ISC_SHA1_DIGESTLENGTH);
 
 	dsa->p = BN_bin2bn(r.base, p_bytes, NULL);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	dsa->g = BN_bin2bn(r.base, p_bytes, NULL);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	dsa->pub_key = BN_bin2bn(r.base, p_bytes, NULL);
-	r.base += p_bytes;
+	isc_region_consume(&r, p_bytes);
 
 	key->key_size = p_bytes * 8;
 
--- bind9-9.9.5.dfsg.orig/lib/dns/opensslecdsa_link.c
+++ bind9-9.9.5.dfsg/lib/dns/opensslecdsa_link.c
@@ -14,8 +14,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id$ */
-
 #include <config.h>
 
 #ifdef HAVE_OPENSSL_ECDSA
@@ -159,9 +157,9 @@
 					       "ECDSA_do_sign",
 					       DST_R_SIGNFAILURE));
 	BN_bn2bin_fixed(ecdsasig->r, r.base, siglen / 2);
-	r.base += siglen / 2;
+	isc_region_consume(&r, siglen / 2);
 	BN_bn2bin_fixed(ecdsasig->s, r.base, siglen / 2);
-	r.base += siglen / 2;
+	isc_region_consume(&r, siglen / 2);
 	ECDSA_SIG_free(ecdsasig);
 	isc_buffer_add(sig, siglen);
 	ret = ISC_R_SUCCESS;
--- bind9-9.9.5.dfsg.orig/lib/dns/opensslrsa_link.c
+++ bind9-9.9.5.dfsg/lib/dns/opensslrsa_link.c
@@ -965,6 +965,7 @@
 	RSA *rsa;
 	isc_region_t r;
 	unsigned int e_bytes;
+	unsigned int length;
 #if USE_EVP
 	EVP_PKEY *pkey;
 #endif
@@ -972,6 +973,7 @@
 	isc_buffer_remainingregion(data, &r);
 	if (r.length == 0)
 		return (ISC_R_SUCCESS);
+	length = r.length;
 
 	rsa = RSA_new();
 	if (rsa == NULL)
@@ -982,17 +984,18 @@
 		RSA_free(rsa);
 		return (DST_R_INVALIDPUBLICKEY);
 	}
-	e_bytes = *r.base++;
-	r.length--;
+	e_bytes = *r.base;
+	isc_region_consume(&r, 1);
 
 	if (e_bytes == 0) {
 		if (r.length < 2) {
 			RSA_free(rsa);
 			return (DST_R_INVALIDPUBLICKEY);
 		}
-		e_bytes = ((*r.base++) << 8);
-		e_bytes += *r.base++;
-		r.length -= 2;
+		e_bytes = (*r.base) << 8;
+		isc_region_consume(&r, 1);
+		e_bytes += *r.base;
+		isc_region_consume(&r, 1);
 	}
 
 	if (r.length < e_bytes) {
@@ -1000,14 +1003,13 @@
 		return (DST_R_INVALIDPUBLICKEY);
 	}
 	rsa->e = BN_bin2bn(r.base, e_bytes, NULL);
-	r.base += e_bytes;
-	r.length -= e_bytes;
+	isc_region_consume(&r, e_bytes);
 
 	rsa->n = BN_bin2bn(r.base, r.length, NULL);
 
 	key->key_size = BN_num_bits(rsa->n);
 
-	isc_buffer_forward(data, r.length);
+	isc_buffer_forward(data, length);
 
 #if USE_EVP
 	pkey = EVP_PKEY_new();
--- bind9-9.9.5.dfsg.orig/lib/dns/order.c
+++ bind9-9.9.5.dfsg/lib/dns/order.c
@@ -89,6 +89,7 @@
 	REQUIRE(DNS_ORDER_VALID(order));
 	REQUIRE(mode == DNS_RDATASETATTR_RANDOMIZE ||
 	        mode == DNS_RDATASETATTR_FIXEDORDER ||
+		mode == (DNS_RDATASETATTR_RANDOMIZE|DNS_RDATASETATTR_SINGLE) ||
 		mode == 0 /* DNS_RDATASETATTR_CYCLIC */ );
 
 	ent = isc_mem_get(order->mctx, sizeof(*ent));
--- bind9-9.9.5.dfsg.orig/lib/dns/rdata/in_1/apl_42.c
+++ bind9-9.9.5.dfsg/lib/dns/rdata/in_1/apl_42.c
@@ -116,7 +116,7 @@
 	isc_uint8_t len;
 	isc_boolean_t neg;
 	unsigned char buf[16];
-	char txt[sizeof(" !64000")];
+	char txt[sizeof(" !64000:")];
 	const char *sep = "";
 	int n;
 
@@ -140,7 +140,7 @@
 		isc_region_consume(&sr, 1);
 		INSIST(len <= sr.length);
 		n = snprintf(txt, sizeof(txt), "%s%s%u:", sep,
-			     neg ? "!": "", afi);
+			     neg ? "!" : "", afi);
 		INSIST(n < (int)sizeof(txt));
 		RETERR(str_totext(txt, target));
 		switch (afi) {
--- bind9-9.9.5.dfsg.orig/lib/dns/rdataset.c
+++ bind9-9.9.5.dfsg/lib/dns/rdataset.c
@@ -297,6 +297,7 @@
 #define MAX_SHUFFLE	32
 #define WANT_FIXED(r)	(((r)->attributes & DNS_RDATASETATTR_FIXEDORDER) != 0)
 #define WANT_RANDOM(r)	(((r)->attributes & DNS_RDATASETATTR_RANDOMIZE) != 0)
+#define WANT_SINGLE(r)	(((r)->attributes & DNS_RDATASETATTR_SINGLE) != 0)
 
 struct towire_sort {
 	int key;
@@ -321,6 +322,7 @@
 	isc_region_t r;
 	isc_result_t result;
 	unsigned int i, count = 0, added, choice;
+	unsigned int real_count;
 	isc_buffer_t savedbuffer, rdlen, rrbuffer;
 	unsigned int headlen;
 	isc_boolean_t question = ISC_FALSE;
@@ -336,6 +338,7 @@
 	 */
 
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
+	REQUIRE(rdataset->methods != NULL);
 	REQUIRE(countp != NULL);
 	REQUIRE((order == NULL) == (order_arg == NULL));
 	REQUIRE(cctx != NULL && cctx->mctx != NULL);
@@ -362,6 +365,7 @@
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
+	real_count = count;
 
 	/*
 	 * Do we want to shuffle this answer?
@@ -430,6 +434,9 @@
 					sorted[i].key = 0; /* Unused */
 				sorted[i].rdata = &shuffled[i];
 			}
+			if (count > 1 && WANT_SINGLE(rdataset)) {
+				count = 1;
+			}
 		} else {
 			/*
 			 * "Cyclic" order.
@@ -550,9 +557,9 @@
 
  cleanup:
 	if (sorted != NULL && sorted != sorted_fixed)
-		isc_mem_put(cctx->mctx, sorted, count * sizeof(*sorted));
+		isc_mem_put(cctx->mctx, sorted, real_count * sizeof(*sorted));
 	if (shuffled != NULL && shuffled != shuffled_fixed)
-		isc_mem_put(cctx->mctx, shuffled, count * sizeof(*shuffled));
+		isc_mem_put(cctx->mctx, shuffled, real_count * sizeof(*shuffled));
 	return (result);
 }
 
--- bind9-9.9.5.dfsg.orig/lib/dns/resolver.c
+++ bind9-9.9.5.dfsg/lib/dns/resolver.c
@@ -21,6 +21,7 @@
 
 #include <config.h>
 
+#include <isc/counter.h>
 #include <isc/log.h>
 #include <isc/platform.h>
 #include <isc/print.h>
@@ -131,6 +132,16 @@
 #define MAXIMUM_QUERY_TIMEOUT 30 /* The maximum time in seconds for the whole query to live. */
 #endif
 
+/* The default maximum number of recursions to follow before giving up. */
+#ifndef DEFAULT_RECURSION_DEPTH
+#define DEFAULT_RECURSION_DEPTH 7
+#endif
+
+/* The default maximum number of iterative queries to allow before giving up. */
+#ifndef DEFAULT_MAX_QUERIES
+#define DEFAULT_MAX_QUERIES 50
+#endif
+
 /*%
  * Maximum EDNS0 input packet size.
  */
@@ -234,12 +245,13 @@
 	isc_sockaddrlist_t		edns;
 	isc_sockaddrlist_t		edns512;
 	isc_sockaddrlist_t		bad_edns;
-	dns_validator_t			*validator;
+	dns_validator_t *		validator;
 	ISC_LIST(dns_validator_t)       validators;
 	dns_db_t *			cache;
 	dns_adb_t *			adb;
 	isc_boolean_t			ns_ttl_ok;
 	isc_uint32_t			ns_ttl;
+	isc_counter_t *			qc;
 
 	/*%
 	 * The number of events we're waiting for.
@@ -307,6 +319,7 @@
 	isc_boolean_t			timeout;
 	dns_adbaddrinfo_t 		*addrinfo;
 	isc_sockaddr_t			*client;
+	unsigned int			depth;
 };
 
 #define FCTX_MAGIC			ISC_MAGIC('F', '!', '!', '!')
@@ -418,6 +431,8 @@
 	isc_timer_t *			spillattimer;
 	isc_boolean_t			zero_no_soa_ttl;
 	unsigned int			query_timeout;
+	unsigned int			maxdepth;
+	unsigned int			maxqueries;
 
 	/* Locked by lock. */
 	unsigned int			references;
@@ -471,7 +486,9 @@
 static isc_result_t ncache_adderesult(dns_message_t *message,
 				      dns_db_t *cache, dns_dbnode_t *node,
 				      dns_rdatatype_t covers,
-				      isc_stdtime_t now, dns_ttl_t maxttl,
+				      isc_stdtime_t now,
+				      dns_ttl_t minttl,
+				      dns_ttl_t maxttl,
 				      isc_boolean_t optout,
 				      isc_boolean_t secure,
 				      dns_rdataset_t *ardataset,
@@ -511,7 +528,9 @@
 	valarg->addrinfo = addrinfo;
 
 	if (!ISC_LIST_EMPTY(fctx->validators))
-		INSIST((valoptions & DNS_VALIDATOR_DEFER) != 0);
+		valoptions |= DNS_VALIDATOR_DEFER;
+	else
+		valoptions &= ~DNS_VALIDATOR_DEFER;
 
 	result = dns_validator_create(fctx->res->view, name, type, rdataset,
 				      sigrdataset, fctx->rmessage,
@@ -1533,6 +1552,7 @@
 		if (result != ISC_R_SUCCESS)
 			goto cleanup_dispatch;
 	}
+
 	fctx->querysent++;
 
 	ISC_LIST_APPEND(fctx->queries, query, link);
@@ -2186,9 +2206,9 @@
 		 */
 		INSIST(!SHUTTINGDOWN(fctx));
 		fctx->attributes &= ~FCTX_ATTR_ADDRWAIT;
-		if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES)
+		if (event->ev_type == DNS_EVENT_ADBMOREADDRESSES) {
 			want_try = ISC_TRUE;
-		else {
+		} else {
 			fctx->findfail++;
 			if (fctx->pending == 0) {
 				/*
@@ -2217,7 +2237,7 @@
 	else if (want_done)
 		fctx_done(fctx, ISC_R_FAILURE, __LINE__);
 	else if (destroy) {
-			fctx_destroy(fctx);
+		fctx_destroy(fctx);
 		if (bucket_empty)
 			empty_bucket(res);
 	}
@@ -2471,12 +2491,13 @@
 	 * See what we know about this address.
 	 */
 	find = NULL;
-	result = dns_adb_createfind(fctx->adb,
-				    res->buckets[fctx->bucketnum].task,
-				    fctx_finddone, fctx, name,
-				    &fctx->name, fctx->type,
-				    options, now, NULL,
-				    res->view->dstport, &find);
+	result = dns_adb_createfind2(fctx->adb,
+				     res->buckets[fctx->bucketnum].task,
+				     fctx_finddone, fctx, name,
+				     &fctx->name, fctx->type,
+				     options, now, NULL,
+				     res->view->dstport,
+				     fctx->depth + 1, fctx->qc, &find);
 	if (result != ISC_R_SUCCESS) {
 		if (result == DNS_R_ALIAS) {
 			/*
@@ -2584,6 +2605,14 @@
 
 	res = fctx->res;
 
+	if (fctx->depth > res->maxdepth) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
+			      "too much NS indirection resolving '%s'",
+			      fctx->info);
+		return (DNS_R_SERVFAIL);
+	}
+
 	/*
 	 * Forwarders.
 	 */
@@ -3059,6 +3088,16 @@
 		}
 	}
 
+	result = isc_counter_increment(fctx->qc);
+	if (result != ISC_R_SUCCESS) {
+		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
+			      DNS_LOGMODULE_RESOLVER, ISC_LOG_DEBUG(3),
+			      "exceeded max queries resolving '%s'",
+			      fctx->info);
+		fctx_done(fctx, DNS_R_SERVFAIL, __LINE__);
+		return;
+	}
+
 	result = fctx_query(fctx, addrinfo, fctx->options);
 	if (result != ISC_R_SUCCESS)
 		fctx_done(fctx, result, __LINE__);
@@ -3157,6 +3196,7 @@
 		isc_mem_put(fctx->mctx, sa, sizeof(*sa));
 	}
 
+	isc_counter_detach(&fctx->qc);
 	isc_timer_detach(&fctx->timer);
 	dns_message_destroy(&fctx->rmessage);
 	dns_message_destroy(&fctx->qmessage);
@@ -3485,7 +3525,8 @@
 static isc_result_t
 fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
 	    dns_name_t *domain, dns_rdataset_t *nameservers,
-	    unsigned int options, unsigned int bucketnum, fetchctx_t **fctxp)
+	    unsigned int options, unsigned int bucketnum, unsigned int depth,
+	    isc_counter_t *qc, fetchctx_t **fctxp)
 {
 	fetchctx_t *fctx;
 	isc_result_t result;
@@ -3507,6 +3548,21 @@
 	fctx = isc_mem_get(mctx, sizeof(*fctx));
 	if (fctx == NULL)
 		return (ISC_R_NOMEMORY);
+
+	fctx->qc = NULL;
+	if (qc != NULL) {
+		isc_counter_attach(qc, &fctx->qc);
+	} else {
+		result = isc_counter_create(res->mctx,
+					    res->maxqueries, &fctx->qc);
+		if (result != ISC_R_SUCCESS)
+			goto cleanup_fetch;
+	}
+
+	/*
+	 * Make fctx->info point to a copy of a formatted string
+	 * "name/type".
+	 */
 	dns_name_format(name, buf, sizeof(buf));
 	dns_rdatatype_format(type, typebuf, sizeof(typebuf));
 	strcat(buf, "/");       /* checked */
@@ -3514,7 +3570,7 @@
 	fctx->info = isc_mem_strdup(mctx, buf);
 	if (fctx->info == NULL) {
 		result = ISC_R_NOMEMORY;
-		goto cleanup_fetch;
+		goto cleanup_counter;
 	}
 	FCTXTRACE("create");
 	dns_name_init(&fctx->name, NULL);
@@ -3537,6 +3593,7 @@
 	fctx->state = fetchstate_init;
 	fctx->want_shutdown = ISC_FALSE;
 	fctx->cloned = ISC_FALSE;
+	fctx->depth = depth;
 	ISC_LIST_INIT(fctx->queries);
 	ISC_LIST_INIT(fctx->finds);
 	ISC_LIST_INIT(fctx->altfinds);
@@ -3744,6 +3801,9 @@
  cleanup_info:
 	isc_mem_free(mctx, fctx->info);
 
+ cleanup_counter:
+	isc_counter_detach(&fctx->qc);
+
  cleanup_fetch:
 	isc_mem_put(mctx, fctx, sizeof(*fctx));
 
@@ -3761,6 +3821,7 @@
 	isc_result_t result;
 
 	if (message->rcode != dns_rcode_noerror &&
+	    message->rcode != dns_rcode_yxdomain &&
 	    message->rcode != dns_rcode_nxdomain)
 		return (ISC_FALSE);
 
@@ -4204,7 +4265,7 @@
 			ttl = 0;
 
 		result = ncache_adderesult(fctx->rmessage, fctx->cache, node,
-					   covers, now, ttl, vevent->optout,
+					   covers, now, fctx->res->view->minncachettl, ttl, vevent->optout,
 					   vevent->secure, ardataset, &eresult);
 		if (result != ISC_R_SUCCESS)
 			goto noanswer_response;
@@ -4659,6 +4720,12 @@
 		 */
 		if (rdataset->ttl > res->view->maxcachettl)
 			rdataset->ttl = res->view->maxcachettl;
+		
+		/*
+		 * Enforce configured minimum cache TTL.
+		 */
+		if (rdataset->ttl < res->view->mincachettl)
+			rdataset->ttl = res->view->mincachettl;
 
 		/*
 		 * Find the SIG for this rdataset, if we have it.
@@ -4733,13 +4800,9 @@
 							      rdataset->type,
 							      &noqname);
 					if (tresult == ISC_R_SUCCESS &&
-					    noqname != NULL) {
-						tresult =
-						     dns_rdataset_addnoqname(
+					    noqname != NULL)
+						(void) dns_rdataset_addnoqname(
 							    rdataset, noqname);
-						RUNTIME_CHECK(tresult ==
-							      ISC_R_SUCCESS);
-					}
 				}
 				addedrdataset = ardataset;
 				result = dns_db_addrdataset(fctx->cache, node,
@@ -4818,13 +4881,6 @@
 							   rdataset,
 							   sigrdataset,
 							   valoptions, task);
-					/*
-					 * Defer any further validations.
-					 * This prevents multiple validators
-					 * from manipulating fctx->rmessage
-					 * simultaneously.
-					 */
-					valoptions |= DNS_VALIDATOR_DEFER;
 				}
 			} else if (CHAINING(rdataset)) {
 				if (rdataset->type == dns_rdatatype_cname)
@@ -4876,11 +4932,9 @@
 				tresult = findnoqname(fctx, name,
 						      rdataset->type, &noqname);
 				if (tresult == ISC_R_SUCCESS &&
-				    noqname != NULL) {
-					tresult = dns_rdataset_addnoqname(
-							    rdataset, noqname);
-					RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
-				}
+				    noqname != NULL)
+					(void) dns_rdataset_addnoqname(
+						       rdataset, noqname);
 			}
 
 			/*
@@ -4930,6 +4984,11 @@
 				       eresult == DNS_R_NCACHENXRRSET);
 			}
 			event->result = eresult;
+			if (adbp != NULL && *adbp != NULL) {
+				if (anodep != NULL && *anodep != NULL)
+					dns_db_detachnode(*adbp, anodep);
+				dns_db_detach(adbp);
+			}
 			dns_db_attach(fctx->cache, adbp);
 			dns_db_transfernode(fctx->cache, &node, anodep);
 			clone_results(fctx);
@@ -4986,7 +5045,7 @@
  */
 static isc_result_t
 ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+		  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, dns_ttl_t maxttl,
 		  isc_boolean_t optout, isc_boolean_t secure,
 		  dns_rdataset_t *ardataset, isc_result_t *eresultp)
 {
@@ -4999,10 +5058,10 @@
 	}
 	if (secure)
 		result = dns_ncache_addoptout(message, cache, node, covers,
-					      now, maxttl, optout, ardataset);
+					      now, minttl, maxttl, optout, ardataset);
 	else
 		result = dns_ncache_add(message, cache, node, covers, now,
-					maxttl, ardataset);
+					minttl, maxttl, ardataset);
 	if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) {
 		/*
 		 * If the cache now contains a negative entry and we
@@ -5168,7 +5227,7 @@
 		ttl = 0;
 
 	result = ncache_adderesult(fctx->rmessage, fctx->cache, node,
-				   covers, now, ttl, ISC_FALSE,
+				   covers, now, fctx->res->view->minncachettl, ttl, ISC_FALSE,
 				   ISC_FALSE, ardataset, &eresult);
 	if (result != ISC_R_SUCCESS)
 		goto unlock;
@@ -5177,6 +5236,11 @@
 		fctx->attributes |= FCTX_ATTR_HAVEANSWER;
 		if (event != NULL) {
 			event->result = eresult;
+			if (adbp != NULL && *adbp != NULL) {
+				if (anodep != NULL && *anodep != NULL)
+					dns_db_detachnode(*adbp, anodep);
+				dns_db_detach(adbp);
+			}
 			dns_db_attach(fctx->cache, adbp);
 			dns_db_transfernode(fctx->cache, &node, anodep);
 			clone_results(fctx);
@@ -5333,74 +5397,6 @@
 		goto again;
 }
 
-static inline isc_result_t
-cname_target(dns_rdataset_t *rdataset, dns_name_t *tname) {
-	isc_result_t result;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdata_cname_t cname;
-
-	result = dns_rdataset_first(rdataset);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	dns_rdataset_current(rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &cname, NULL);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	dns_name_init(tname, NULL);
-	dns_name_clone(&cname.cname, tname);
-	dns_rdata_freestruct(&cname);
-
-	return (ISC_R_SUCCESS);
-}
-
-static inline isc_result_t
-dname_target(fetchctx_t *fctx, dns_rdataset_t *rdataset, dns_name_t *qname,
-	     dns_name_t *oname, dns_fixedname_t *fixeddname)
-{
-	isc_result_t result;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	unsigned int nlabels;
-	int order;
-	dns_namereln_t namereln;
-	dns_rdata_dname_t dname;
-	dns_fixedname_t prefix;
-
-	/*
-	 * Get the target name of the DNAME.
-	 */
-	result = dns_rdataset_first(rdataset);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-	dns_rdataset_current(rdataset, &rdata);
-	result = dns_rdata_tostruct(&rdata, &dname, NULL);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
-	/*
-	 * Get the prefix of qname.
-	 */
-	namereln = dns_name_fullcompare(qname, oname, &order, &nlabels);
-	if (namereln != dns_namereln_subdomain) {
-		char qbuf[DNS_NAME_FORMATSIZE];
-		char obuf[DNS_NAME_FORMATSIZE];
-
-		dns_rdata_freestruct(&dname);
-		dns_name_format(qname, qbuf, sizeof(qbuf));
-		dns_name_format(oname, obuf, sizeof(obuf));
-		log_formerr(fctx, "unrelated DNAME in answer: "
-				   "%s is not in %s", qbuf, obuf);
-		return (DNS_R_FORMERR);
-	}
-	dns_fixedname_init(&prefix);
-	dns_name_split(qname, nlabels, dns_fixedname_name(&prefix), NULL);
-	dns_fixedname_init(fixeddname);
-	result = dns_name_concatenate(dns_fixedname_name(&prefix),
-				      &dname.dname,
-				      dns_fixedname_name(fixeddname), NULL);
-	dns_rdata_freestruct(&dname);
-	return (result);
-}
-
 static isc_boolean_t
 is_answeraddress_allowed(dns_view_t *view, dns_name_t *name,
 			 dns_rdataset_t *rdataset)
@@ -5476,9 +5472,8 @@
 }
 
 static isc_boolean_t
-is_answertarget_allowed(dns_view_t *view, dns_name_t *name,
-			dns_rdatatype_t type, dns_name_t *tname,
-			dns_name_t *domain)
+is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
+			dns_rdataset_t *rdataset, isc_boolean_t *chainingp)
 {
 	isc_result_t result;
 	dns_rbtnode_t *node = NULL;
@@ -5486,8 +5481,57 @@
 	char tnamebuf[DNS_NAME_FORMATSIZE];
 	char classbuf[64];
 	char typebuf[64];
+	dns_name_t *tname = NULL;
+	dns_rdata_cname_t cname;
+	dns_rdata_dname_t dname;
+	dns_view_t *view = fctx->res->view;
+	dns_rdata_t rdata = DNS_RDATA_INIT;
+	unsigned int nlabels;
+	dns_fixedname_t fixed;
+	dns_name_t prefix;
+
+	REQUIRE(rdataset != NULL);
+	REQUIRE(rdataset->type == dns_rdatatype_cname ||
+		rdataset->type == dns_rdatatype_dname);
+
+	/*
+	 * By default, we allow any target name.
+	 * If newqname != NULL we also need to extract the newqname.
+	 */
+	if (chainingp == NULL && view->denyanswernames == NULL)
+		return (ISC_TRUE);
+
+	result = dns_rdataset_first(rdataset);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
+	dns_rdataset_current(rdataset, &rdata);
+	switch (rdataset->type) {
+	case dns_rdatatype_cname:
+		result = dns_rdata_tostruct(&rdata, &cname, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		tname = &cname.cname;
+		break;
+	case dns_rdatatype_dname:
+		result = dns_rdata_tostruct(&rdata, &dname, NULL);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		dns_name_init(&prefix, NULL);
+		dns_fixedname_init(&fixed);
+		tname = dns_fixedname_name(&fixed);
+		nlabels = dns_name_countlabels(qname) -
+			  dns_name_countlabels(rname);
+		dns_name_split(qname, nlabels, &prefix, NULL);
+		result = dns_name_concatenate(&prefix, &dname.dname, tname,
+					      NULL);
+		if (result == DNS_R_NAMETOOLONG)
+			return (ISC_TRUE);
+		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		break;
+	default:
+		INSIST(0);
+	}
+
+	if (chainingp != NULL)
+		*chainingp = ISC_TRUE;
 
-	/* By default, we allow any target name. */
 	if (view->denyanswernames == NULL)
 		return (ISC_TRUE);
 
@@ -5496,8 +5540,8 @@
 	 * or partially, allow it.
 	 */
 	if (view->answernames_exclude != NULL) {
-		result = dns_rbt_findnode(view->answernames_exclude, name, NULL,
-					  &node, NULL, 0, NULL, NULL);
+		result = dns_rbt_findnode(view->answernames_exclude, qname,
+					  NULL, &node, NULL, 0, NULL, NULL);
 		if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH)
 			return (ISC_TRUE);
 	}
@@ -5505,7 +5549,7 @@
 	/*
 	 * If the target name is a subdomain of the search domain, allow it.
 	 */
-	if (dns_name_issubdomain(tname, domain))
+	if (dns_name_issubdomain(tname, &fctx->domain))
 		return (ISC_TRUE);
 
 	/*
@@ -5514,9 +5558,9 @@
 	result = dns_rbt_findnode(view->denyanswernames, tname, NULL, &node,
 				  NULL, 0, NULL, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_PARTIALMATCH) {
-		dns_name_format(name, qnamebuf, sizeof(qnamebuf));
+		dns_name_format(qname, qnamebuf, sizeof(qnamebuf));
 		dns_name_format(tname, tnamebuf, sizeof(tnamebuf));
-		dns_rdatatype_format(type, typebuf, sizeof(typebuf));
+		dns_rdatatype_format(rdataset->type, typebuf, sizeof(typebuf));
 		dns_rdataclass_format(view->rdclass, classbuf,
 				      sizeof(classbuf));
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_RESOLVER,
@@ -5657,7 +5701,7 @@
 					char qbuf[DNS_NAME_FORMATSIZE];
 					char nbuf[DNS_NAME_FORMATSIZE];
 					char tbuf[DNS_RDATATYPE_FORMATSIZE];
-					dns_rdatatype_format(fctx->type, tbuf,
+					dns_rdatatype_format(type, tbuf,
 							     sizeof(tbuf));
 					dns_name_format(name, nbuf,
 							     sizeof(nbuf));
@@ -5666,7 +5710,7 @@
 					log_formerr(fctx,
 						    "unrelated %s %s in "
 						    "%s authority section",
-						    tbuf, qbuf, nbuf);
+						    tbuf, nbuf, qbuf);
 					return (DNS_R_FORMERR);
 				}
 				if (type == dns_rdatatype_ns) {
@@ -5999,372 +6043,301 @@
 	return (ISC_R_SUCCESS);
 }
 
+static isc_boolean_t
+validinanswer(dns_rdataset_t *rdataset, fetchctx_t *fctx) {
+	if (rdataset->type == dns_rdatatype_nsec3) {
+		/*
+		 * NSEC3 records are not allowed to
+		 * appear in the answer section.
+		 */
+		log_formerr(fctx, "NSEC3 in answer");
+		return (ISC_FALSE);
+	}
+	if (rdataset->type == dns_rdatatype_tkey) {
+		/*
+		 * TKEY is not a valid record in a
+		 * response to any query we can make.
+		 */
+		log_formerr(fctx, "TKEY in answer");
+		return (ISC_FALSE);
+	}
+	if (rdataset->rdclass != fctx->res->rdclass) {
+		log_formerr(fctx, "Mismatched class in answer");
+		return (ISC_FALSE);
+	}
+	return (ISC_TRUE);
+}
+
 static isc_result_t
 answer_response(fetchctx_t *fctx) {
 	isc_result_t result;
-	dns_message_t *message;
-	dns_name_t *name, *qname, tname, *ns_name;
-	dns_rdataset_t *rdataset, *ns_rdataset;
-	isc_boolean_t done, external, chaining, aa, found, want_chaining;
-	isc_boolean_t have_answer, found_cname, found_type, wanted_chaining;
-	unsigned int aflag;
+	dns_message_t *message = NULL;
+	dns_name_t *name = NULL, *qname = NULL, *ns_name = NULL;
+	dns_name_t *aname = NULL, *cname = NULL, *dname = NULL;
+	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
+	dns_rdataset_t *ardataset = NULL, *crdataset = NULL;
+	dns_rdataset_t *drdataset = NULL, *ns_rdataset = NULL;
+	isc_boolean_t done = ISC_FALSE, aa;
+	unsigned int dname_labels, domain_labels;
+	isc_boolean_t chaining = ISC_FALSE;
 	dns_rdatatype_t type;
-	dns_fixedname_t dname, fqname;
-	dns_view_t *view;
+	dns_view_t *view = NULL;
+	dns_trust_t trust;
+
+	REQUIRE(VALID_FCTX(fctx));
 
 	FCTXTRACE("answer_response");
 
 	message = fctx->rmessage;
+	qname = &fctx->name;
+	view = fctx->res->view;
+	type = fctx->type;
+
+	/*
+	 * There can be multiple RRSIG and SIG records at a name so
+	 * we treat these types as a subset of ANY.
+	 */
+	if (type == dns_rdatatype_rrsig || type == dns_rdatatype_sig) {
+		type = dns_rdatatype_any;
+	}
 
 	/*
-	 * Examine the answer section, marking those rdatasets which are
-	 * part of the answer and should be cached.
+	 * Bigger than any valid DNAME label count.
 	 */
+	dname_labels = dns_name_countlabels(qname);
+	domain_labels = dns_name_countlabels(&fctx->domain);
+
+	/*
+	 * Perform a single pass looking for the answer, cname or covering
+	 * dname.
+	 */
+	for (result = dns_message_firstname(message, DNS_SECTION_ANSWER);
+	     result == ISC_R_SUCCESS;
+	     result = dns_message_nextname(message, DNS_SECTION_ANSWER))
+	{
+		int order;
+		unsigned int nlabels;
+		dns_namereln_t namereln;
 
-	done = ISC_FALSE;
-	found_cname = ISC_FALSE;
-	found_type = ISC_FALSE;
-	chaining = ISC_FALSE;
-	have_answer = ISC_FALSE;
-	want_chaining = ISC_FALSE;
-	POST(want_chaining);
-	if ((message->flags & DNS_MESSAGEFLAG_AA) != 0)
-		aa = ISC_TRUE;
-	else
-		aa = ISC_FALSE;
-	qname = &fctx->name;
-	type = fctx->type;
-	view = fctx->res->view;
-	result = dns_message_firstname(message, DNS_SECTION_ANSWER);
-	while (!done && result == ISC_R_SUCCESS) {
 		name = NULL;
 		dns_message_currentname(message, DNS_SECTION_ANSWER, &name);
-		external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
-		if (dns_name_equal(name, qname)) {
-			wanted_chaining = ISC_FALSE;
+		namereln = dns_name_fullcompare(qname, name, &order, &nlabels);
+		switch (namereln) {
+		case dns_namereln_equal:
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link)) {
-				found = ISC_FALSE;
-				want_chaining = ISC_FALSE;
-				aflag = 0;
-				if (rdataset->type == dns_rdatatype_nsec3) {
-					/*
-					 * NSEC3 records are not allowed to
-					 * appear in the answer section.
-					 */
-					log_formerr(fctx, "NSEC3 in answer");
-					return (DNS_R_FORMERR);
-				}
-
-				/*
-				 * Apply filters, if given, on answers to reject
-				 * a malicious attempt of rebinding.
-				 */
-				if ((rdataset->type == dns_rdatatype_a ||
-				     rdataset->type == dns_rdatatype_aaaa) &&
-				    !is_answeraddress_allowed(view, name,
-							      rdataset)) {
-					return (DNS_R_SERVFAIL);
-				}
-
-				if (rdataset->type == type && !found_cname) {
-					/*
-					 * We've found an ordinary answer.
-					 */
-					found = ISC_TRUE;
-					found_type = ISC_TRUE;
-					done = ISC_TRUE;
-					aflag = DNS_RDATASETATTR_ANSWER;
-				} else if (type == dns_rdatatype_any) {
-					/*
-					 * We've found an answer matching
-					 * an ANY query.  There may be
-					 * more.
-					 */
-					found = ISC_TRUE;
-					aflag = DNS_RDATASETATTR_ANSWER;
-				} else if (rdataset->type == dns_rdatatype_rrsig
-					   && rdataset->covers == type
-					   && !found_cname) {
-					/*
-					 * We've found a signature that
-					 * covers the type we're looking for.
-					 */
-					found = ISC_TRUE;
-					found_type = ISC_TRUE;
-					aflag = DNS_RDATASETATTR_ANSWERSIG;
-				} else if (rdataset->type ==
-					   dns_rdatatype_cname
-					   && !found_type) {
-					/*
-					 * We're looking for something else,
-					 * but we found a CNAME.
-					 *
-					 * Getting a CNAME response for some
-					 * query types is an error, see
-					 * RFC 4035, Section 2.5.
-					 */
-					if (type == dns_rdatatype_rrsig ||
-					    type == dns_rdatatype_key ||
-					    type == dns_rdatatype_nsec) {
-						char buf[DNS_RDATATYPE_FORMATSIZE];
-						dns_rdatatype_format(fctx->type,
-							      buf, sizeof(buf));
-						log_formerr(fctx,
-							    "CNAME response "
-							    "for %s RR", buf);
-						return (DNS_R_FORMERR);
-					}
-					found = ISC_TRUE;
-					found_cname = ISC_TRUE;
-					want_chaining = ISC_TRUE;
-					aflag = DNS_RDATASETATTR_ANSWER;
-					result = cname_target(rdataset,
-							      &tname);
-					if (result != ISC_R_SUCCESS)
-						return (result);
-					/* Apply filters on the target name. */
-					if (!is_answertarget_allowed(view,
-							name,
-							rdataset->type,
-							&tname,
-							&fctx->domain)) {
-						return (DNS_R_SERVFAIL);
+			     rdataset = ISC_LIST_NEXT(rdataset, link))
+			{
+				if (rdataset->type == type ||
+				    type == dns_rdatatype_any)
+				{
+					aname = name;
+					if (type != dns_rdatatype_any) {
+						ardataset = rdataset;
 					}
-				} else if (rdataset->type == dns_rdatatype_rrsig
-					   && rdataset->covers ==
-					   dns_rdatatype_cname
-					   && !found_type) {
-					/*
-					 * We're looking for something else,
-					 * but we found a SIG CNAME.
-					 */
-					found = ISC_TRUE;
-					found_cname = ISC_TRUE;
-					aflag = DNS_RDATASETATTR_ANSWERSIG;
+					break;
 				}
-
-				if (found) {
-					/*
-					 * We've found an answer to our
-					 * question.
-					 */
-					name->attributes |=
-						DNS_NAMEATTR_CACHE;
-					rdataset->attributes |=
-						DNS_RDATASETATTR_CACHE;
-					rdataset->trust = dns_trust_answer;
-					if (!chaining) {
-						/*
-						 * This data is "the" answer
-						 * to our question only if
-						 * we're not chaining (i.e.
-						 * if we haven't followed
-						 * a CNAME or DNAME).
-						 */
-						INSIST(!external);
-						if (aflag ==
-						    DNS_RDATASETATTR_ANSWER)
-							have_answer = ISC_TRUE;
-						name->attributes |=
-							DNS_NAMEATTR_ANSWER;
-						rdataset->attributes |= aflag;
-						if (aa)
-							rdataset->trust =
-							  dns_trust_authanswer;
-					} else if (external) {
-						/*
-						 * This data is outside of
-						 * our query domain, and
-						 * may not be cached.
-						 */
-						rdataset->attributes |=
-						    DNS_RDATASETATTR_EXTERNAL;
-					}
-
-					/*
-					 * Mark any additional data related
-					 * to this rdataset.
-					 */
-					(void)dns_rdataset_additionaldata(
-							rdataset,
-							check_related,
-							fctx);
-
-					/*
-					 * CNAME chaining.
-					 */
-					if (want_chaining) {
-						wanted_chaining = ISC_TRUE;
-						name->attributes |=
-							DNS_NAMEATTR_CHAINING;
-						rdataset->attributes |=
-						    DNS_RDATASETATTR_CHAINING;
-						qname = &tname;
-					}
+				if (rdataset->type == dns_rdatatype_cname) {
+					cname = name;
+					crdataset = rdataset;
+					break;
 				}
-				/*
-				 * We could add an "else" clause here and
-				 * log that we're ignoring this rdataset.
-				 */
 			}
+			break;
+
+		case dns_namereln_subdomain:
 			/*
-			 * If wanted_chaining is true, we've done
-			 * some chaining as the result of processing
-			 * this node, and thus we need to set
-			 * chaining to true.
-			 *
-			 * We don't set chaining inside of the
-			 * rdataset loop because doing that would
-			 * cause us to ignore the signatures of
-			 * CNAMEs.
+			 * In-scope DNAME records must have at least
+			 * as many labels as the domain being queried.
+			 * They also must be less that qname's labels
+			 * and any previously found dname.
 			 */
-			if (wanted_chaining)
-				chaining = ISC_TRUE;
-		} else {
+			if (nlabels >= dname_labels || nlabels < domain_labels)
+			{
+				continue;
+			}
+
 			/*
-			 * Look for a DNAME (or its SIG).  Anything else is
-			 * ignored.
+			 * We are looking for the shortest DNAME if there
+			 * are multiple ones (which there shouldn't be).
 			 */
-			wanted_chaining = ISC_FALSE;
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link)) {
-				isc_boolean_t found_dname = ISC_FALSE;
-				dns_name_t *dname_name;
-
-				found = ISC_FALSE;
-				aflag = 0;
-				if (rdataset->type == dns_rdatatype_dname) {
-					/*
-					 * We're looking for something else,
-					 * but we found a DNAME.
-					 *
-					 * If we're not chaining, then the
-					 * DNAME should not be external.
-					 */
-					if (!chaining && external) {
-						log_formerr(fctx,
-							    "external DNAME");
-						return (DNS_R_FORMERR);
-					}
-					found = ISC_TRUE;
-					want_chaining = ISC_TRUE;
-					POST(want_chaining);
-					aflag = DNS_RDATASETATTR_ANSWER;
-					result = dname_target(fctx, rdataset,
-							      qname, name,
-							      &dname);
-					if (result == ISC_R_NOSPACE) {
-						/*
-						 * We can't construct the
-						 * DNAME target.  Do not
-						 * try to continue.
-						 */
-						want_chaining = ISC_FALSE;
-						POST(want_chaining);
-					} else if (result != ISC_R_SUCCESS)
-						return (result);
-					else
-						found_dname = ISC_TRUE;
-
-					dname_name = dns_fixedname_name(&dname);
-					if (!is_answertarget_allowed(view,
-							qname,
-							rdataset->type,
-							dname_name,
-							&fctx->domain)) {
-						return (DNS_R_SERVFAIL);
-					}
-				} else if (rdataset->type == dns_rdatatype_rrsig
-					   && rdataset->covers ==
-					   dns_rdatatype_dname) {
-					/*
-					 * We've found a signature that
-					 * covers the DNAME.
-					 */
-					found = ISC_TRUE;
-					aflag = DNS_RDATASETATTR_ANSWERSIG;
-				}
-
-				if (found) {
-					/*
-					 * We've found an answer to our
-					 * question.
-					 */
-					name->attributes |=
-						DNS_NAMEATTR_CACHE;
-					rdataset->attributes |=
-						DNS_RDATASETATTR_CACHE;
-					rdataset->trust = dns_trust_answer;
-					if (!chaining) {
-						/*
-						 * This data is "the" answer
-						 * to our question only if
-						 * we're not chaining.
-						 */
-						INSIST(!external);
-						if (aflag ==
-						    DNS_RDATASETATTR_ANSWER)
-							have_answer = ISC_TRUE;
-						name->attributes |=
-							DNS_NAMEATTR_ANSWER;
-						rdataset->attributes |= aflag;
-						if (aa)
-							rdataset->trust =
-							  dns_trust_authanswer;
-					} else if (external) {
-						rdataset->attributes |=
-						    DNS_RDATASETATTR_EXTERNAL;
-					}
-
-					/*
-					 * DNAME chaining.
-					 */
-					if (found_dname) {
-						/*
-						 * Copy the dname into the
-						 * qname fixed name.
-						 *
-						 * Although we check for
-						 * failure of the copy
-						 * operation, in practice it
-						 * should never fail since
-						 * we already know that the
-						 * result fits in a fixedname.
-						 */
-						dns_fixedname_init(&fqname);
-						result = dns_name_copy(
-						  dns_fixedname_name(&dname),
-						  dns_fixedname_name(&fqname),
-						  NULL);
-						if (result != ISC_R_SUCCESS)
-							return (result);
-						wanted_chaining = ISC_TRUE;
-						name->attributes |=
-							DNS_NAMEATTR_CHAINING;
-						rdataset->attributes |=
-						    DNS_RDATASETATTR_CHAINING;
-						qname = dns_fixedname_name(
-								   &fqname);
-					}
+			     rdataset = ISC_LIST_NEXT(rdataset, link))
+			{
+				if (rdataset->type != dns_rdatatype_dname) {
+					continue;
 				}
+				dname = name;
+				drdataset = rdataset;
+				dname_labels = nlabels;
+				break;
 			}
-			if (wanted_chaining)
-				chaining = ISC_TRUE;
+			break;
+		default:
+			break;
 		}
-		result = dns_message_nextname(message, DNS_SECTION_ANSWER);
 	}
-	if (result == ISC_R_NOMORE)
-		result = ISC_R_SUCCESS;
-	if (result != ISC_R_SUCCESS)
-		return (result);
 
-	/*
-	 * We should have found an answer.
-	 */
-	if (!have_answer) {
+	if (dname != NULL) {
+		aname = NULL;
+		ardataset = NULL;
+		cname = NULL;
+		crdataset = NULL;
+	} else if (aname != NULL) {
+		cname = NULL;
+		crdataset = NULL;
+	}
+
+	aa = ISC_TF((message->flags & DNS_MESSAGEFLAG_AA) != 0);
+	trust = aa ? dns_trust_authanswer : dns_trust_answer;
+
+	if (aname != NULL && type == dns_rdatatype_any) {
+		for (rdataset = ISC_LIST_HEAD(aname->list);
+		     rdataset != NULL;
+		     rdataset = ISC_LIST_NEXT(rdataset, link))
+		{
+			if (!validinanswer(rdataset, fctx)) {
+				return (DNS_R_FORMERR);
+			}
+			if ((fctx->type == dns_rdatatype_sig ||
+			     fctx->type == dns_rdatatype_rrsig) &&
+			     rdataset->type != fctx->type)
+			{
+				continue;
+			}
+			if ((rdataset->type == dns_rdatatype_a ||
+			     rdataset->type == dns_rdatatype_aaaa) &&
+			    !is_answeraddress_allowed(view, aname, rdataset))
+			{
+				return (DNS_R_SERVFAIL);
+			}
+			if ((rdataset->type == dns_rdatatype_cname ||
+			     rdataset->type == dns_rdatatype_dname) &&
+			     !is_answertarget_allowed(fctx, qname, aname,
+						      rdataset, NULL))
+			{
+				return (DNS_R_SERVFAIL);
+			}
+			aname->attributes |= DNS_NAMEATTR_CACHE;
+			aname->attributes |= DNS_NAMEATTR_ANSWER;
+			rdataset->attributes |= DNS_RDATASETATTR_ANSWER;
+			rdataset->attributes |= DNS_RDATASETATTR_CACHE;
+			rdataset->trust = trust;
+			(void)dns_rdataset_additionaldata(rdataset,
+							  check_related,
+							  fctx);
+		}
+	} else if (aname != NULL) {
+		if (!validinanswer(ardataset, fctx))
+			return (DNS_R_FORMERR);
+		if ((ardataset->type == dns_rdatatype_a ||
+		     ardataset->type == dns_rdatatype_aaaa) &&
+		    !is_answeraddress_allowed(view, aname, ardataset)) {
+			return (DNS_R_SERVFAIL);
+		}
+		if ((ardataset->type == dns_rdatatype_cname ||
+		     ardataset->type == dns_rdatatype_dname) &&
+		     !is_answertarget_allowed(fctx, qname, aname, ardataset,
+					      NULL))
+		{
+			return (DNS_R_SERVFAIL);
+		}
+		aname->attributes |= DNS_NAMEATTR_CACHE;
+		aname->attributes |= DNS_NAMEATTR_ANSWER;
+		ardataset->attributes |= DNS_RDATASETATTR_ANSWER;
+		ardataset->attributes |= DNS_RDATASETATTR_CACHE;
+		ardataset->trust = trust;
+		(void)dns_rdataset_additionaldata(ardataset, check_related,
+						  fctx);
+		for (sigrdataset = ISC_LIST_HEAD(aname->list);
+		     sigrdataset != NULL;
+		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link)) {
+			if (!validinanswer(sigrdataset, fctx))
+				return (DNS_R_FORMERR);
+			if (sigrdataset->type != dns_rdatatype_rrsig ||
+			    sigrdataset->covers != type)
+				continue;
+			sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
+			sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
+			sigrdataset->trust = trust;
+			break;
+		}
+	} else if (cname != NULL) {
+		if (!validinanswer(crdataset, fctx)) {
+			return (DNS_R_FORMERR);
+		}
+		if (type == dns_rdatatype_rrsig || type == dns_rdatatype_key ||
+		    type == dns_rdatatype_nsec)
+		{
+			char buf[DNS_RDATATYPE_FORMATSIZE];
+			dns_rdatatype_format(type, buf, sizeof(buf));
+			log_formerr(fctx, "CNAME response for %s RR", buf);
+			return (DNS_R_FORMERR);
+		}
+		if (!is_answertarget_allowed(fctx, qname, cname, crdataset,
+					     NULL))
+		{
+			return (DNS_R_SERVFAIL);
+		}
+		cname->attributes |= DNS_NAMEATTR_CACHE;
+		cname->attributes |= DNS_NAMEATTR_ANSWER;
+		cname->attributes |= DNS_NAMEATTR_CHAINING;
+		crdataset->attributes |= DNS_RDATASETATTR_ANSWER;
+		crdataset->attributes |= DNS_RDATASETATTR_CACHE;
+		crdataset->attributes |= DNS_RDATASETATTR_CHAINING;
+		crdataset->trust = trust;
+		for (sigrdataset = ISC_LIST_HEAD(cname->list);
+		     sigrdataset != NULL;
+		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
+		{
+			if (!validinanswer(sigrdataset, fctx)) {
+				return (DNS_R_FORMERR);
+			}
+			if (sigrdataset->type != dns_rdatatype_rrsig ||
+			    sigrdataset->covers != dns_rdatatype_cname)
+			{
+				continue;
+			}
+			sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
+			sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
+			sigrdataset->trust = trust;
+			break;
+		}
+		chaining = ISC_TRUE;
+	} else if (dname != NULL) {
+		if (!validinanswer(drdataset, fctx)) {
+			return (DNS_R_FORMERR);
+		}
+		if (!is_answertarget_allowed(fctx, qname, dname, drdataset,
+					     &chaining)) {
+			return (DNS_R_SERVFAIL);
+		}
+		dname->attributes |= DNS_NAMEATTR_CACHE;
+		dname->attributes |= DNS_NAMEATTR_ANSWER;
+		dname->attributes |= DNS_NAMEATTR_CHAINING;
+		drdataset->attributes |= DNS_RDATASETATTR_ANSWER;
+		drdataset->attributes |= DNS_RDATASETATTR_CACHE;
+		drdataset->attributes |= DNS_RDATASETATTR_CHAINING;
+		drdataset->trust = trust;
+		for (sigrdataset = ISC_LIST_HEAD(dname->list);
+		     sigrdataset != NULL;
+		     sigrdataset = ISC_LIST_NEXT(sigrdataset, link))
+		{
+			if (!validinanswer(sigrdataset, fctx)) {
+				return (DNS_R_FORMERR);
+			}
+			if (sigrdataset->type != dns_rdatatype_rrsig ||
+			    sigrdataset->covers != dns_rdatatype_dname)
+			{
+				continue;
+			}
+			sigrdataset->attributes |= DNS_RDATASETATTR_ANSWERSIG;
+			sigrdataset->attributes |= DNS_RDATASETATTR_CACHE;
+			sigrdataset->trust = trust;
+			break;
+		}
+	} else {
 		log_formerr(fctx, "reply has no answer");
 		return (DNS_R_FORMERR);
 	}
@@ -6378,13 +6351,7 @@
 	 * Did chaining end before we got the final answer?
 	 */
 	if (chaining) {
-		/*
-		 * Yes.  This may be a negative reply, so hand off
-		 * authority section processing to the noanswer code.
-		 * If it isn't a noanswer response, no harm will be
-		 * done.
-		 */
-		return (noanswer_response(fctx, qname, 0));
+		return (ISC_R_SUCCESS);
 	}
 
 	/*
@@ -6403,11 +6370,9 @@
 	 * We expect there to be only one owner name for all the rdatasets
 	 * in this section, and we expect that it is not external.
 	 */
-	done = ISC_FALSE;
-	ns_name = NULL;
-	ns_rdataset = NULL;
 	result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
 	while (!done && result == ISC_R_SUCCESS) {
+		isc_boolean_t external;
 		name = NULL;
 		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
 		external = ISC_TF(!dns_name_issubdomain(name, &fctx->domain));
@@ -6426,14 +6391,16 @@
 						DNS_NAMEATTR_CACHE;
 					rdataset->attributes |=
 						DNS_RDATASETATTR_CACHE;
-					if (aa && !chaining)
+					if (aa && !chaining) {
 						rdataset->trust =
 						    dns_trust_authauthority;
-					else
+					} else {
 						rdataset->trust =
 						    dns_trust_additional;
+					}
 
-					if (rdataset->type == dns_rdatatype_ns) {
+					if (rdataset->type == dns_rdatatype_ns)
+					{
 						ns_name = name;
 						ns_rdataset = rdataset;
 					}
@@ -6910,6 +6877,8 @@
 			goto done;
 	}
 
+    dns_message_setclass(message, fctx->res->rdclass);
+
 	result = dns_message_parse(message, &devent->buffer, 0);
 	if (result != ISC_R_SUCCESS) {
 		switch (result) {
@@ -6982,6 +6951,12 @@
 	 */
 	log_packet(message, ISC_LOG_DEBUG(10), fctx->res->mctx);
 
+	if (message->rdclass != fctx->res->rdclass) {
+		resend = ISC_TRUE;
+		FCTXTRACE("bad class");
+		goto done;
+	}
+
 	/*
 	 * Process receive opt record.
 	 */
@@ -7081,6 +7056,7 @@
 	 * Is the remote server broken, or does it dislike us?
 	 */
 	if (message->rcode != dns_rcode_noerror &&
+	    message->rcode != dns_rcode_yxdomain &&
 	    message->rcode != dns_rcode_nxdomain) {
 		if (((message->rcode == dns_rcode_formerr ||
 		      message->rcode == dns_rcode_notimp) ||
@@ -7125,13 +7101,6 @@
 				log_formerr(fctx, "server sent FORMERR");
 				result = DNS_R_FORMERR;
 			}
-		} else if (message->rcode == dns_rcode_yxdomain) {
-			/*
-			 * DNAME mapping failed because the new name
-			 * was too long.  There's no chance of success
-			 * for this fetch.
-			 */
-			result = DNS_R_YXDOMAIN;
 		} else if (message->rcode == dns_rcode_badvers) {
 			unsigned int flags, mask;
 			unsigned int version;
@@ -7236,6 +7205,7 @@
 	 */
 	if (message->counts[DNS_SECTION_ANSWER] > 0 &&
 	    (message->rcode == dns_rcode_noerror ||
+	     message->rcode == dns_rcode_yxdomain ||
 	     message->rcode == dns_rcode_nxdomain)) {
 		/*
 		 * [normal case]
@@ -7731,6 +7701,8 @@
 	res->spillattimer = NULL;
 	res->zero_no_soa_ttl = ISC_FALSE;
 	res->query_timeout = DEFAULT_QUERY_TIMEOUT;
+	res->maxdepth = DEFAULT_RECURSION_DEPTH;
+	res->maxqueries = DEFAULT_MAX_QUERIES;
 	res->nbuckets = ntasks;
 	res->activebuckets = ntasks;
 	res->buckets = isc_mem_get(view->mctx,
@@ -8169,9 +8141,9 @@
 			 dns_rdataset_t *sigrdataset,
 			 dns_fetch_t **fetchp)
 {
-	return (dns_resolver_createfetch2(res, name, type, domain,
+	return (dns_resolver_createfetch3(res, name, type, domain,
 					  nameservers, forwarders, NULL, 0,
-					  options, task, action, arg,
+					  options, 0, NULL, task, action, arg,
 					  rdataset, sigrdataset, fetchp));
 }
 
@@ -8187,6 +8159,25 @@
 			  dns_rdataset_t *sigrdataset,
 			  dns_fetch_t **fetchp)
 {
+	return (dns_resolver_createfetch3(res, name, type, domain,
+					  nameservers, forwarders, client, id,
+					  options, 0, NULL, task, action, arg,
+					  rdataset, sigrdataset, fetchp));
+}
+
+isc_result_t
+dns_resolver_createfetch3(dns_resolver_t *res, dns_name_t *name,
+			  dns_rdatatype_t type,
+			  dns_name_t *domain, dns_rdataset_t *nameservers,
+			  dns_forwarders_t *forwarders,
+			  isc_sockaddr_t *client, dns_messageid_t id,
+			  unsigned int options, unsigned int depth,
+			  isc_counter_t *qc, isc_task_t *task,
+			  isc_taskaction_t action, void *arg,
+			  dns_rdataset_t *rdataset,
+			  dns_rdataset_t *sigrdataset,
+			  dns_fetch_t **fetchp)
+{
 	dns_fetch_t *fetch;
 	fetchctx_t *fctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -8273,11 +8264,12 @@
 
 	if (fctx == NULL) {
 		result = fctx_create(res, name, type, domain, nameservers,
-				     options, bucketnum, &fctx);
+				     options, bucketnum, depth, qc, &fctx);
 		if (result != ISC_R_SUCCESS)
 			goto unlock;
 		new_fctx = ISC_TRUE;
-	}
+	} else if (fctx->depth > depth)
+		fctx->depth = depth;
 
 	result = fctx_join(fctx, task, client, id, action, arg,
 			   rdataset, sigrdataset, fetch);
@@ -8885,6 +8877,12 @@
 
 	REQUIRE(VALID_RESOLVER(resolver));
 
+	/*
+	 * DH is unsupported for DNSKEYs, see RFC 4034 sec. A.1.
+	 */
+	if ((alg == DST_ALG_DH) || (alg == DST_ALG_INDIRECT))
+		return (ISC_FALSE);
+
 #if USE_ALGLOCK
 	RWLOCK(&resolver->alglock, isc_rwlocktype_read);
 #endif
@@ -8904,6 +8902,7 @@
 #endif
 	if (found)
 		return (ISC_FALSE);
+
 	return (dst_algorithm_supported(alg));
 }
 
@@ -9049,3 +9048,27 @@
 
 	resolver->query_timeout = seconds;
 }
+
+void
+dns_resolver_setmaxdepth(dns_resolver_t *resolver, unsigned int maxdepth) {
+	REQUIRE(VALID_RESOLVER(resolver));
+	resolver->maxdepth = maxdepth;
+}
+
+unsigned int
+dns_resolver_getmaxdepth(dns_resolver_t *resolver) {
+	REQUIRE(VALID_RESOLVER(resolver));
+	return (resolver->maxdepth);
+}
+
+void
+dns_resolver_setmaxqueries(dns_resolver_t *resolver, unsigned int queries) {
+	REQUIRE(VALID_RESOLVER(resolver));
+	resolver->maxqueries = queries;
+}
+
+unsigned int
+dns_resolver_getmaxqueries(dns_resolver_t *resolver) {
+	REQUIRE(VALID_RESOLVER(resolver));
+	return (resolver->maxqueries);
+}
--- bind9-9.9.5.dfsg.orig/lib/dns/tkey.c
+++ bind9-9.9.5.dfsg/lib/dns/tkey.c
@@ -650,6 +650,7 @@
 		 * Try the answer section, since that's where Win2000
 		 * puts it.
 		 */
+		name = NULL;
 		if (dns_message_findname(msg, DNS_SECTION_ANSWER, qname,
 					 dns_rdatatype_tkey, 0, &name,
 					 &tkeyset) != ISC_R_SUCCESS) {
--- bind9-9.9.5.dfsg.orig/lib/dns/tsig.c
+++ bind9-9.9.5.dfsg/lib/dns/tsig.c
@@ -941,18 +941,27 @@
 		isc_buffer_putuint48(&otherbuf, tsig.timesigned);
 	}
 
-	if (key->key != NULL && tsig.error != dns_tsigerror_badsig) {
+	if ((key->key != NULL) &&
+	    (tsig.error != dns_tsigerror_badsig) &&
+	    (tsig.error != dns_tsigerror_badkey))
+	{
 		unsigned char header[DNS_MESSAGE_HEADERLEN];
 		isc_buffer_t headerbuf;
 		isc_uint16_t digestbits;
 
+		/*
+		 * If it is a response, we assume that the request MAC
+		 * has validated at this point. This is why we include a
+		 * MAC length > 0 in the reply.
+		 */
+
 		ret = dst_context_create2(key->key, mctx,
 					  DNS_LOGCATEGORY_DNSSEC, &ctx);
 		if (ret != ISC_R_SUCCESS)
 			return (ret);
 
 		/*
-		 * If this is a response, digest the query signature.
+		 * If this is a response, digest the request's MAC.
 		 */
 		if (response) {
 			dns_rdata_t querytsigrdata = DNS_RDATA_INIT;
@@ -1082,6 +1091,17 @@
 		dst_context_destroy(&ctx);
 		digestbits = dst_key_getbits(key->key);
 		if (digestbits != 0) {
+			/*
+			 * XXXRAY: Is this correct? What is the
+			 * expected behavior when digestbits is not an
+			 * integral multiple of 8? It looks like bytes
+			 * should either be (digestbits/8) or
+			 * (digestbits+7)/8.
+			 *
+			 * In any case, for current algorithms,
+			 * digestbits are an integral multiple of 8, so
+			 * it has the same effect as (digestbits/8).
+			 */
 			unsigned int bytes = (digestbits + 1) / 8;
 			if (response && bytes < querytsig.siglen)
 				bytes = querytsig.siglen;
@@ -1195,6 +1215,8 @@
 	REQUIRE(tsigkey == NULL || VALID_TSIG_KEY(tsigkey));
 
 	msg->verify_attempted = 1;
+	msg->verified_sig = 0;
+	msg->tsigstatus = dns_tsigerror_badsig;
 
 	if (msg->tcp_continuation) {
 		if (tsigkey == NULL || msg->querytsig == NULL)
@@ -1293,19 +1315,6 @@
 	key = tsigkey->key;
 
 	/*
-	 * Is the time ok?
-	 */
-	if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
-		msg->tsigstatus = dns_tsigerror_badtime;
-		tsig_log(msg->tsigkey, 2, "signature has expired");
-		return (DNS_R_CLOCKSKEW);
-	} else if (now + msg->timeadjust < tsig.timesigned - tsig.fudge) {
-		msg->tsigstatus = dns_tsigerror_badtime;
-		tsig_log(msg->tsigkey, 2, "signature is in the future");
-		return (DNS_R_CLOCKSKEW);
-	}
-
-	/*
 	 * Check digest length.
 	 */
 	alg = dst_key_alg(key);
@@ -1314,31 +1323,19 @@
 		return (ret);
 	if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
 	    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-	    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512) {
-		isc_uint16_t digestbits = dst_key_getbits(key);
+	    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+	{
 		if (tsig.siglen > siglen) {
 			tsig_log(msg->tsigkey, 2, "signature length to big");
 			return (DNS_R_FORMERR);
 		}
 		if (tsig.siglen > 0 &&
-		    (tsig.siglen < 10 || tsig.siglen < ((siglen + 1) / 2))) {
+		    (tsig.siglen < 10 || tsig.siglen < ((siglen + 1) / 2)))
+		{
 			tsig_log(msg->tsigkey, 2,
 				 "signature length below minimum");
 			return (DNS_R_FORMERR);
 		}
-		if (tsig.siglen > 0 && digestbits != 0 &&
-		    tsig.siglen < ((digestbits + 1) / 8)) {
-			msg->tsigstatus = dns_tsigerror_badtrunc;
-			tsig_log(msg->tsigkey, 2,
-				 "truncated signature length too small");
-			return (DNS_R_TSIGVERIFYFAILURE);
-		}
-		if (tsig.siglen > 0 && digestbits == 0 &&
-		    tsig.siglen < siglen) {
-			msg->tsigstatus = dns_tsigerror_badtrunc;
-			tsig_log(msg->tsigkey, 2, "signature length too small");
-			return (DNS_R_TSIGVERIFYFAILURE);
-		}
 	}
 
 	if (tsig.siglen > 0) {
@@ -1449,34 +1446,92 @@
 
 		ret = dst_context_verify(ctx, &sig_r);
 		if (ret == DST_R_VERIFYFAILURE) {
-			msg->tsigstatus = dns_tsigerror_badsig;
 			ret = DNS_R_TSIGVERIFYFAILURE;
 			tsig_log(msg->tsigkey, 2,
 				 "signature failed to verify(1)");
 			goto cleanup_context;
-		} else if (ret != ISC_R_SUCCESS)
+		} else if (ret != ISC_R_SUCCESS) {
 			goto cleanup_context;
-
-		dst_context_destroy(&ctx);
+		}
 	} else if (tsig.error != dns_tsigerror_badsig &&
 		   tsig.error != dns_tsigerror_badkey) {
-		msg->tsigstatus = dns_tsigerror_badsig;
 		tsig_log(msg->tsigkey, 2, "signature was empty");
 		return (DNS_R_TSIGVERIFYFAILURE);
 	}
 
-	msg->tsigstatus = dns_rcode_noerror;
+	/*
+	 * Here at this point, the MAC has been verified. Even if any of
+	 * the following code returns a TSIG error, the reply will be
+	 * signed and WILL always include the request MAC in the digest
+	 * computation.
+	 */
+
+	/*
+	 * Is the time ok?
+	 */
+	if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
+		msg->tsigstatus = dns_tsigerror_badtime;
+		tsig_log(msg->tsigkey, 2, "signature has expired");
+		ret = DNS_R_CLOCKSKEW;
+		goto cleanup_context;
+	} else if (now + msg->timeadjust < tsig.timesigned - tsig.fudge) {
+		msg->tsigstatus = dns_tsigerror_badtime;
+		tsig_log(msg->tsigkey, 2, "signature is in the future");
+		ret = DNS_R_CLOCKSKEW;
+		goto cleanup_context;
+	}
+
+	if (
+#ifndef PK11_MD5_DISABLE
+	    alg == DST_ALG_HMACMD5 ||
+#endif
+	    alg == DST_ALG_HMACSHA1 ||
+	    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
+	    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
+	{
+		isc_uint16_t digestbits = dst_key_getbits(key);
+
+		/*
+		 * XXXRAY: Is this correct? What is the expected
+		 * behavior when digestbits is not an integral multiple
+		 * of 8? It looks like bytes should either be
+		 * (digestbits/8) or (digestbits+7)/8.
+		 *
+		 * In any case, for current algorithms, digestbits are
+		 * an integral multiple of 8, so it has the same effect
+		 * as (digestbits/8).
+		 */
+		if (tsig.siglen > 0 && digestbits != 0 &&
+		    tsig.siglen < ((digestbits + 1) / 8))
+		{
+			msg->tsigstatus = dns_tsigerror_badtrunc;
+			tsig_log(msg->tsigkey, 2,
+				 "truncated signature length too small");
+			ret = DNS_R_TSIGVERIFYFAILURE;
+			goto cleanup_context;
+		}
+		if (tsig.siglen > 0 && digestbits == 0 &&
+		    tsig.siglen < siglen)
+		{
+			msg->tsigstatus = dns_tsigerror_badtrunc;
+			tsig_log(msg->tsigkey, 2, "signature length too small");
+			ret = DNS_R_TSIGVERIFYFAILURE;
+			goto cleanup_context;
+		}
+	}
 
 	if (tsig.error != dns_rcode_noerror) {
+		msg->tsigstatus = tsig.error;
 		if (tsig.error == dns_tsigerror_badtime)
-			return (DNS_R_CLOCKSKEW);
+			ret = DNS_R_CLOCKSKEW;
 		else
-			return (DNS_R_TSIGERRORSET);
+			ret = DNS_R_TSIGERRORSET;
+		goto cleanup_context;
 	}
 
+	msg->tsigstatus = dns_rcode_noerror;
 	msg->verified_sig = 1;
-
-	return (ISC_R_SUCCESS);
+	ret = ISC_R_SUCCESS;
 
 cleanup_context:
 	if (ctx != NULL)
@@ -1501,6 +1556,8 @@
 	isc_uint16_t addcount, id;
 	isc_boolean_t has_tsig = ISC_FALSE;
 	isc_mem_t *mctx;
+	unsigned int siglen;
+	unsigned int alg;
 
 	REQUIRE(source != NULL);
 	REQUIRE(msg != NULL);
@@ -1508,12 +1565,16 @@
 	REQUIRE(msg->tcp_continuation == 1);
 	REQUIRE(msg->querytsig != NULL);
 
+	msg->verified_sig = 0;
+	msg->tsigstatus = dns_tsigerror_badsig;
+
 	if (!is_response(msg))
 		return (DNS_R_EXPECTEDRESPONSE);
 
 	mctx = msg->mctx;
 
 	tsigkey = dns_message_gettsigkey(msg);
+	key = tsigkey->key;
 
 	/*
 	 * Extract and parse the previous TSIG
@@ -1546,7 +1607,8 @@
 		 * Do the key name and algorithm match that of the query?
 		 */
 		if (!dns_name_equal(keyname, &tsigkey->name) ||
-		    !dns_name_equal(&tsig.algorithm, &querytsig.algorithm)) {
+		    !dns_name_equal(&tsig.algorithm, &querytsig.algorithm))
+		{
 			msg->tsigstatus = dns_tsigerror_badkey;
 			ret = DNS_R_TSIGVERIFYFAILURE;
 			tsig_log(msg->tsigkey, 2,
@@ -1555,27 +1617,40 @@
 		}
 
 		/*
-		 * Is the time ok?
+		 * Check digest length.
 		 */
-		isc_stdtime_get(&now);
-
-		if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
-			msg->tsigstatus = dns_tsigerror_badtime;
-			tsig_log(msg->tsigkey, 2, "signature has expired");
-			ret = DNS_R_CLOCKSKEW;
-			goto cleanup_querystruct;
-		} else if (now + msg->timeadjust <
-			   tsig.timesigned - tsig.fudge) {
-			msg->tsigstatus = dns_tsigerror_badtime;
-			tsig_log(msg->tsigkey, 2,
-				 "signature is in the future");
-			ret = DNS_R_CLOCKSKEW;
+		alg = dst_key_alg(key);
+		ret = dst_key_sigsize(key, &siglen);
+		if (ret != ISC_R_SUCCESS)
 			goto cleanup_querystruct;
+		if (
+#ifndef PK11_MD5_DISABLE
+			alg == DST_ALG_HMACMD5 ||
+#endif
+			alg == DST_ALG_HMACSHA1 ||
+			alg == DST_ALG_HMACSHA224 ||
+			alg == DST_ALG_HMACSHA256 ||
+			alg == DST_ALG_HMACSHA384 ||
+			alg == DST_ALG_HMACSHA512)
+		{
+			if (tsig.siglen > siglen) {
+				tsig_log(tsigkey, 2,
+					 "signature length too big");
+				ret = DNS_R_FORMERR;
+				goto cleanup_querystruct;
+			}
+			if (tsig.siglen > 0 &&
+			    (tsig.siglen < 10 ||
+			     tsig.siglen < ((siglen + 1) / 2)))
+			{
+				tsig_log(tsigkey, 2,
+					 "signature length below minimum");
+				ret = DNS_R_FORMERR;
+				goto cleanup_querystruct;
+			}
 		}
 	}
 
-	key = tsigkey->key;
-
 	if (msg->tsigctx == NULL) {
 		ret = dst_context_create2(key, mctx,
 					  DNS_LOGCATEGORY_DNSSEC,
@@ -1668,10 +1743,12 @@
 		sig_r.length = tsig.siglen;
 		if (tsig.siglen == 0) {
 			if (tsig.error != dns_rcode_noerror) {
-				if (tsig.error == dns_tsigerror_badtime)
+				msg->tsigstatus = tsig.error;
+				if (tsig.error == dns_tsigerror_badtime) {
 					ret = DNS_R_CLOCKSKEW;
-				else
+				} else {
 					ret = DNS_R_TSIGERRORSET;
+				}
 			} else {
 				tsig_log(msg->tsigkey, 2,
 					 "signature is empty");
@@ -1682,29 +1759,111 @@
 
 		ret = dst_context_verify(msg->tsigctx, &sig_r);
 		if (ret == DST_R_VERIFYFAILURE) {
-			msg->tsigstatus = dns_tsigerror_badsig;
 			tsig_log(msg->tsigkey, 2,
 				 "signature failed to verify(2)");
 			ret = DNS_R_TSIGVERIFYFAILURE;
 			goto cleanup_context;
+		} else if (ret != ISC_R_SUCCESS) {
+			goto cleanup_context;
+		}
+
+		/*
+		 * Here at this point, the MAC has been verified. Even
+		 * if any of the following code returns a TSIG error,
+		 * the reply will be signed and WILL always include the
+		 * request MAC in the digest computation.
+		 */
+
+		/*
+		 * Is the time ok?
+		 */
+		isc_stdtime_get(&now);
+
+		if (now + msg->timeadjust > tsig.timesigned + tsig.fudge) {
+			msg->tsigstatus = dns_tsigerror_badtime;
+			tsig_log(msg->tsigkey, 2, "signature has expired");
+			ret = DNS_R_CLOCKSKEW;
+			goto cleanup_context;
+		} else if (now + msg->timeadjust <
+			   tsig.timesigned - tsig.fudge)
+		{
+			msg->tsigstatus = dns_tsigerror_badtime;
+			tsig_log(msg->tsigkey, 2,
+				 "signature is in the future");
+			ret = DNS_R_CLOCKSKEW;
+			goto cleanup_context;
 		}
-		else if (ret != ISC_R_SUCCESS)
+
+		alg = dst_key_alg(key);
+		ret = dst_key_sigsize(key, &siglen);
+		if (ret != ISC_R_SUCCESS)
 			goto cleanup_context;
+		if (
+#ifndef PK11_MD5_DISABLE
+			alg == DST_ALG_HMACMD5 ||
+#endif
+			alg == DST_ALG_HMACSHA1 ||
+			alg == DST_ALG_HMACSHA224 ||
+			alg == DST_ALG_HMACSHA256 ||
+			alg == DST_ALG_HMACSHA384 ||
+			alg == DST_ALG_HMACSHA512)
+		{
+			isc_uint16_t digestbits = dst_key_getbits(key);
 
-		dst_context_destroy(&msg->tsigctx);
+			/*
+			 * XXXRAY: Is this correct? What is the
+			 * expected behavior when digestbits is not an
+			 * integral multiple of 8? It looks like bytes
+			 * should either be (digestbits/8) or
+			 * (digestbits+7)/8.
+			 *
+			 * In any case, for current algorithms,
+			 * digestbits are an integral multiple of 8, so
+			 * it has the same effect as (digestbits/8).
+			 */
+			if (tsig.siglen > 0 && digestbits != 0 &&
+			    tsig.siglen < ((digestbits + 1) / 8))
+			{
+				msg->tsigstatus = dns_tsigerror_badtrunc;
+				tsig_log(msg->tsigkey, 2,
+					 "truncated signature length "
+					 "too small");
+				ret = DNS_R_TSIGVERIFYFAILURE;
+				goto cleanup_context;
+			}
+			if (tsig.siglen > 0 && digestbits == 0 &&
+			    tsig.siglen < siglen)
+			{
+				msg->tsigstatus = dns_tsigerror_badtrunc;
+				tsig_log(msg->tsigkey, 2,
+					 "signature length too small");
+				ret = DNS_R_TSIGVERIFYFAILURE;
+				goto cleanup_context;
+			}
+		}
+
+		if (tsig.error != dns_rcode_noerror) {
+			msg->tsigstatus = tsig.error;
+			if (tsig.error == dns_tsigerror_badtime)
+				ret = DNS_R_CLOCKSKEW;
+			else
+				ret = DNS_R_TSIGERRORSET;
+			goto cleanup_context;
+		}
 	}
 
 	msg->tsigstatus = dns_rcode_noerror;
-	return (ISC_R_SUCCESS);
+	msg->verified_sig = 1;
+	ret = ISC_R_SUCCESS;
 
  cleanup_context:
-	dst_context_destroy(&msg->tsigctx);
+	if (msg->tsigctx != NULL)
+		dst_context_destroy(&msg->tsigctx);
 
  cleanup_querystruct:
 	dns_rdata_freestruct(&querytsig);
 
 	return (ret);
-
 }
 
 isc_result_t
--- bind9-9.9.5.dfsg.orig/lib/dns/validator.c
+++ bind9-9.9.5.dfsg/lib/dns/validator.c
@@ -1406,7 +1406,6 @@
  */
 static isc_boolean_t
 isselfsigned(dns_validator_t *val) {
-	dns_fixedname_t fixed;
 	dns_rdataset_t *rdataset, *sigrdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_t sigrdata = DNS_RDATA_INIT;
@@ -1462,8 +1461,7 @@
 			result = dns_dnssec_verify3(name, rdataset, dstkey,
 						    ISC_TRUE,
 						    val->view->maxbits,
-						    mctx, &sigrdata,
-						    dns_fixedname_name(&fixed));
+						    mctx, &sigrdata, NULL);
 			dst_key_free(&dstkey);
 			if (result != ISC_R_SUCCESS)
 				continue;
--- bind9-9.9.5.dfsg.orig/lib/dns/xfrin.c
+++ bind9-9.9.5.dfsg/lib/dns/xfrin.c
@@ -1211,6 +1211,8 @@
 	msg->tsigctx = xfr->tsigctx;
 	xfr->tsigctx = NULL;
 
+	dns_message_setclass(msg, xfr->rdclass);
+
 	if (xfr->nmsg > 0)
 		msg->tcp_continuation = 1;
 
--- bind9-9.9.5.dfsg.orig/lib/dns/zone.c
+++ bind9-9.9.5.dfsg/lib/dns/zone.c
@@ -8496,6 +8496,12 @@
 					     namebuf, tag);
 				trustkey = ISC_TRUE;
 			}
+		} else {
+			/*
+			 * No previously known key, and the key is not
+			 * secure, so skip it.
+			 */
+			continue;
 		}
 
 		/* Delete old version */
@@ -8544,7 +8550,7 @@
 			trust_key(zone, keyname, &dnskey, mctx);
 		}
 
-		if (!deletekey)
+		if (secure && !deletekey)
 			set_refreshkeytimer(zone, &keydata, now);
 	}
 
--- bind9-9.9.5.dfsg.orig/lib/export/Makefile.in
+++ bind9-9.9.5.dfsg/lib/export/Makefile.in
@@ -21,7 +21,7 @@
 # Attempt to disable parallel processing.
 .NOTPARALLEL:
 .NO_PARALLEL:
-SUBDIRS =	isc dns isccfg irs samples
+SUBDIRS =	isc dns isccfg irs
 TARGETS =
 
 @BIND9_MAKE_RULES@
--- bind9-9.9.5.dfsg.orig/lib/export/dns/Makefile.in
+++ bind9-9.9.5.dfsg/lib/export/dns/Makefile.in
@@ -35,9 +35,9 @@
 
 CWARNINGS =
 
-ISCLIBS =	../isc/libisc.@A@
+ISCLIBS =	../isc/libisc-export.@A@
 
-ISCDEPLIBS =	../isc/libisc.@A@
+ISCDEPLIBS =	../isc/libisc-export.@A@
 
 LIBS =		@LIBS@
 
@@ -116,29 +116,29 @@
 		-DLIBAGE=${LIBAGE} \
 		-c ${srcdir}/version.c
 
-libdns.@SA@: ${OBJS}
+libdns-export.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
 
-libdns.la: ${OBJS}
+libdns-export.la: ${OBJS}
 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libdns-export.la \
 		-rpath ${export_libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} ${ISCLIBS} @DNS_CRYPTO_LIBS@ ${LIBS}
 
-timestamp: libdns.@A@
+timestamp: libdns-export.@A@
 	touch timestamp
 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
 
 install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libdns.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libdns-export.@A@ \
 	${DESTDIR}${export_libdir}/
 
 clean distclean::
-	rm -f libdns.@A@ timestamp
+	rm -f libdns-export.@A@ timestamp
 	rm -f gen code.h include/dns/enumtype.h include/dns/enumclass.h
 	rm -f include/dns/rdatastruct.h
 
--- bind9-9.9.5.dfsg.orig/lib/export/dns/include/dns/Makefile.in
+++ bind9-9.9.5.dfsg/lib/export/dns/include/dns/Makefile.in
@@ -31,7 +31,7 @@
 		peer.h portlist.h \
 		rbt.h rcode.h rdata.h rdataclass.h \
 		rdatalist.h rdataset.h rdatasetiter.h rdataslab.h rdatatype.h \
-		request.h resolver.h result.h \
+		request.h resolver.h result.h rrl.h \
 		secalg.h secproto.h soa.h stats.h \
 		tcpmsg.h time.h tsec.h tsig.h ttl.h types.h \
 		validator.h version.h view.h
--- bind9-9.9.5.dfsg.orig/lib/export/irs/Makefile.in
+++ bind9-9.9.5.dfsg/lib/export/irs/Makefile.in
@@ -43,9 +43,9 @@
 		gai_sterror.c getaddrinfo.c getnameinfo.c \
 		resconf.c
 
-ISCLIBS =	../isc/libisc.@A@
-DNSLIBS =	../dns/libdns.@A@
-ISCCFGLIBS =	../isccfg/libisccfg.@A@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@
+ISCCFGLIBS =	../isccfg/libisccfg-export.@A@
 
 LIBS =		@LIBS@
 
@@ -62,26 +62,26 @@
 		-DLIBAGE=${LIBAGE} \
 		-c ${srcdir}/version.c
 
-libirs.@SA@: ${OBJS} version.@O@
+libirs-export.@SA@: ${OBJS} version.@O@
 	${AR} ${ARFLAGS} $@ ${OBJS} version.@O@
 	${RANLIB} $@
 
-libirs.la: ${OBJS} version.@O@
+libirs-export.la: ${OBJS} version.@O@
 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libirs-export.la \
 		-rpath ${export_libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} version.@O@ ${LIBS} ${ISCCFGLIBS} ${DNSLIBS} ${ISCLIBS}
 
-timestamp: libirs.@A@
+timestamp: libirs-export.@A@
 	touch timestamp
 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
 
 install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libirs.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libirs-export.@A@ \
 	${DESTDIR}${export_libdir}/
 
 clean distclean::
-	rm -f libirs.@A@ libirs.la timestamp
+	rm -f libirs-export.@A@ libirs-export.la timestamp
--- bind9-9.9.5.dfsg.orig/lib/export/isc/Makefile.in
+++ bind9-9.9.5.dfsg/lib/export/isc/Makefile.in
@@ -63,7 +63,7 @@
 # Alphabetically
 OBJS =		@ISC_EXTRA_OBJS@ \
 		assertions.@O@ backtrace.@O@ backtrace-emptytbl.@O@ base32.@O@ \
-		base64.@O@ buffer.@O@ bufferlist.@O@ \
+		base64.@O@ buffer.@O@ bufferlist.@O@ counter.@O@ \
 		error.@O@ event.@O@ \
 		hash.@O@ hex.@O@ hmacmd5.@O@ hmacsha.@O@ \
 		inet_aton.@O@ iterated_hash.@O@ lex.@O@ lfsr.@O@ log.@O@ \
@@ -86,7 +86,7 @@
 
 SRCS =		@ISC_EXTRA_SRCS@ \
 		assertions.c backtrace.c backtrace-emptytbl.c base32.c \
-		base64.c buffer.c bufferlist.c \
+		base64.c buffer.c bufferlist.c counter.c \
 		error.c event.c \
 		hash.c hex.c hmacmd5.c hmacsha.c \
 		inet_aton.c iterated_hash.c lex.c log.c lfsr.c \
@@ -103,6 +103,10 @@
 
 LIBS =		@LIBS@
 
+# Note: the order of SUBDIRS is important.
+# Attempt to disable parallel processing.
+.NOTPARALLEL:
+.NO_PARALLEL:
 SUBDIRS =	include unix nls @ISC_THREAD_DIR@
 TARGETS =	timestamp
 
@@ -116,26 +120,26 @@
 		-DLIBAGE=${LIBAGE} \
 		-c ${srcdir}/version.c
 
-libisc.@SA@: ${OBJS}
+libisc-export.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
 
-libisc.la: ${OBJS}
+libisc-export.la: ${OBJS}
 	${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-export.la \
 		-rpath ${export_libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} ${LIBS}
 
-timestamp: libisc.@A@
+timestamp: libisc-export.@A@
 	touch timestamp
 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
 
 install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisc.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisc-export.@A@ \
 	${DESTDIR}${export_libdir}
 
 clean distclean::
-	rm -f libisc.@A@ libisc.la timestamp
+	rm -f libisc-export.@A@ libisc-export.la timestamp
--- bind9-9.9.5.dfsg.orig/lib/export/isc/include/isc/Makefile.in
+++ bind9-9.9.5.dfsg/lib/export/isc/include/isc/Makefile.in
@@ -37,7 +37,7 @@
 		print.h quota.h radix.h random.h ratelimiter.h \
 		refcount.h regex.h region.h resource.h \
 		result.h resultclass.h rwlock.h serial.h sha1.h sha2.h \
-		sockaddr.h socket.h stdio.h stdlib.h string.h \
+		sockaddr.h socket.h stat.h stdio.h stdlib.h string.h \
 		symtab.h \
 	        task.h taskpool.h timer.h types.h util.h version.h \
 		xml.h
--- bind9-9.9.5.dfsg.orig/lib/export/isccfg/Makefile.in
+++ bind9-9.9.5.dfsg/lib/export/isccfg/Makefile.in
@@ -30,11 +30,11 @@
 CDEFINES =
 CWARNINGS =
 
-ISCLIBS =	../isc/libisc.@A@
-DNSLIBS =	../dns/libdns.@A@ @DNS_CRYPTO_LIBS@
+ISCLIBS =	../isc/libisc-export.@A@
+DNSLIBS =	../dns/libdns-export.@A@ @DNS_CRYPTO_LIBS@
 
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
-ISCCFGDEPLIBS =	libisccfg.@A@
+ISCCFGDEPLIBS =	libisccfg-export.@A@
 
 LIBS =		@LIBS@
 
@@ -58,26 +58,26 @@
 		-DLIBAGE=${LIBAGE} \
 		-c ${srcdir}/version.c
 
-libisccfg.@SA@: ${OBJS}
+libisccfg-export.@SA@: ${OBJS}
 	${AR} ${ARFLAGS} $@ ${OBJS}
 	${RANLIB} $@
 
-libisccfg.la: ${OBJS}
+libisccfg-export.la: ${OBJS}
 	 ${LIBTOOL_MODE_LINK} \
-		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg.la \
+		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccfg-export.la \
 		-rpath ${export_libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
-		${OBJS} ${LIBS} ${DNSLIBS} ${ISCLIBS}
+		${OBJS} ${LIBS} ${ISCLIBS}
 
-timestamp: libisccfg.@A@
+timestamp: libisccfg-export.@A@
 	touch timestamp
 
 installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${export_libdir}
 
 install:: timestamp installdirs
-	${LIBTOOL_MODE_INSTALL} ${INSTALL_DATA} libisccfg.@A@ \
+	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} libisccfg-export.@A@ \
 	${DESTDIR}${export_libdir}/
 
 clean distclean::
-	rm -f libisccfg.@A@ timestamp
+	rm -f libisccfg-export.@A@ timestamp
--- bind9-9.9.5.dfsg.orig/lib/isc/Makefile.in
+++ bind9-9.9.5.dfsg/lib/isc/Makefile.in
@@ -13,8 +13,6 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id$
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -53,7 +51,7 @@
 OBJS =		@ISC_EXTRA_OBJS@ \
 		assertions.@O@ backtrace.@O@ base32.@O@ base64.@O@ \
 		bitstring.@O@ buffer.@O@ bufferlist.@O@ commandline.@O@ \
-		error.@O@ event.@O@ \
+		counter.@O@ error.@O@ event.@O@ \
 		hash.@O@ heap.@O@ hex.@O@ hmacmd5.@O@ hmacsha.@O@ \
 		httpd.@O@ inet_aton.@O@ iterated_hash.@O@ \
 		lex.@O@ lfsr.@O@ lib.@O@ log.@O@ \
@@ -71,8 +69,8 @@
 # Alphabetically
 SRCS =		@ISC_EXTRA_SRCS@ \
 		assertions.c backtrace.c base32.c base64.c bitstring.c \
-		buffer.c bufferlist.c commandline.c error.c event.c \
-		heap.c hex.c hmacmd5.c hmacsha.c \
+		buffer.c bufferlist.c commandline.c counter.c \
+		error.c event.c heap.c hex.c hmacmd5.c hmacsha.c \
 		httpd.c inet_aton.c iterated_hash.c \
 		lex.c lfsr.c lib.c log.c \
 		md5.c mem.c mutexblock.c \
@@ -120,12 +118,14 @@
 		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} ${SYMTBLOBJS} ${LIBS}
+	ln -sf .libs/libisc.so .
 
 libisc-nosymtbl.la: ${OBJS}
 	${LIBTOOL_MODE_LINK} \
 		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisc-nosymtbl.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} ${LIBS}
+	ln -sf .libs/libisc-nosymtbl.so .
 
 timestamp: libisc.@A@ libisc-nosymtbl.@A@
 	touch timestamp
@@ -139,3 +139,4 @@
 clean distclean::
 	rm -f libisc.@A@ libisc-nosymtbl.@A@ libisc.la \
 	libisc-nosymtbl.la timestamp
+	rm -f libisc.so libisc-nosymtbl.so
--- bind9-9.9.5.dfsg.orig/lib/isc/counter.c
+++ bind9-9.9.5.dfsg/lib/isc/counter.c
@@ -0,0 +1,138 @@
+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <stddef.h>
+
+#include <isc/counter.h>
+#include <isc/magic.h>
+#include <isc/mem.h>
+#include <isc/util.h>
+
+#define COUNTER_MAGIC			ISC_MAGIC('C', 'n', 't', 'r')
+#define VALID_COUNTER(r)		ISC_MAGIC_VALID(r, COUNTER_MAGIC)
+
+struct isc_counter {
+	unsigned int	magic;
+	isc_mem_t	*mctx;
+	isc_mutex_t	lock;
+	unsigned int	references;
+	unsigned int	limit;
+	unsigned int	used;
+};
+
+isc_result_t
+isc_counter_create(isc_mem_t *mctx, int limit, isc_counter_t **counterp) {
+	isc_result_t result;
+	isc_counter_t *counter;
+
+	REQUIRE(counterp != NULL && *counterp == NULL);
+
+	counter = isc_mem_get(mctx, sizeof(*counter));
+	if (counter == NULL)
+		return (ISC_R_NOMEMORY);
+
+	result = isc_mutex_init(&counter->lock);
+	if (result != ISC_R_SUCCESS) {
+		isc_mem_put(mctx, counter, sizeof(*counter));
+		return (result);
+	}
+
+	counter->mctx = NULL;
+	isc_mem_attach(mctx, &counter->mctx);
+
+	counter->references = 1;
+	counter->limit = limit;
+	counter->used = 0;
+
+	counter->magic = COUNTER_MAGIC;
+	*counterp = counter;
+	return (ISC_R_SUCCESS);
+}
+
+isc_result_t
+isc_counter_increment(isc_counter_t *counter) {
+	isc_result_t result = ISC_R_SUCCESS;
+
+	LOCK(&counter->lock);
+	counter->used++;
+	if (counter->limit != 0 && counter->used >= counter->limit)
+		result = ISC_R_QUOTA;
+	UNLOCK(&counter->lock);
+
+	return (result);
+}
+
+unsigned int
+isc_counter_used(isc_counter_t *counter) {
+	REQUIRE(VALID_COUNTER(counter));
+
+	return (counter->used);
+}
+
+void
+isc_counter_setlimit(isc_counter_t *counter, int limit) {
+	REQUIRE(VALID_COUNTER(counter));
+
+	LOCK(&counter->lock);
+	counter->limit = limit;
+	UNLOCK(&counter->lock);
+}
+
+void
+isc_counter_attach(isc_counter_t *source, isc_counter_t **targetp) {
+	REQUIRE(VALID_COUNTER(source));
+	REQUIRE(targetp != NULL && *targetp == NULL);
+
+	LOCK(&source->lock);
+	source->references++;
+	INSIST(source->references > 0);
+	UNLOCK(&source->lock);
+
+	*targetp = source;
+}
+
+static void
+destroy(isc_counter_t *counter) {
+	counter->magic = 0;
+	isc_mutex_destroy(&counter->lock);
+	isc_mem_putanddetach(&counter->mctx, counter, sizeof(*counter));
+}
+
+void
+isc_counter_detach(isc_counter_t **counterp) {
+	isc_counter_t *counter;
+	isc_boolean_t want_destroy = ISC_FALSE;
+
+	REQUIRE(counterp != NULL && *counterp != NULL);
+	counter = *counterp;
+	REQUIRE(VALID_COUNTER(counter));
+
+	*counterp = NULL;
+
+	LOCK(&counter->lock);
+	INSIST(counter->references > 0);
+	counter->references--;
+	if (counter->references == 0)
+		want_destroy = ISC_TRUE;
+	UNLOCK(&counter->lock);
+
+	if (want_destroy)
+		destroy(counter);
+}
--- bind9-9.9.5.dfsg.orig/lib/isc/include/isc/Makefile.in
+++ bind9-9.9.5.dfsg/lib/isc/include/isc/Makefile.in
@@ -13,8 +13,6 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id$
-
 srcdir =	@srcdir@
 VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
@@ -27,7 +25,7 @@
 # install target below.
 #
 HEADERS =	app.h assertions.h base64.h bind9.h bitstring.h boolean.h \
-		buffer.h bufferlist.h commandline.h entropy.h error.h event.h \
+		buffer.h bufferlist.h commandline.h counter.h entropy.h error.h event.h \
 		eventclass.h file.h formatcheck.h fsaccess.h \
 		hash.h heap.h hex.h hmacmd5.h hmacsha.h httpd.h \
 		interfaceiter.h @ISC_IPV6_H@ iterated_hash.h \
--- bind9-9.9.5.dfsg.orig/lib/isc/include/isc/counter.h
+++ bind9-9.9.5.dfsg/lib/isc/include/isc/counter.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef ISC_COUNTER_H
+#define ISC_COUNTER_H 1
+
+/*****
+ ***** Module Info
+ *****/
+
+/*! \file isc/counter.h
+ *
+ * \brief The isc_counter_t object is a simplified version of the
+ * isc_quota_t object; it tracks the consumption of limited
+ * resources, returning an error condition when the quota is
+ * exceeded.  However, unlike isc_quota_t, attaching and detaching
+ * from a counter object does not increment or decrement the counter.
+ */
+
+/***
+ *** Imports.
+ ***/
+
+#include <isc/lang.h>
+#include <isc/mutex.h>
+#include <isc/types.h>
+
+/*****
+ ***** Types.
+ *****/
+
+ISC_LANG_BEGINDECLS
+
+isc_result_t
+isc_counter_create(isc_mem_t *mctx, int limit, isc_counter_t **counterp);
+/*%<
+ * Allocate and initialize a counter object.
+ */
+
+isc_result_t
+isc_counter_increment(isc_counter_t *counter);
+/*%<
+ * Increment the counter.
+ *
+ * If the counter limit is nonzero and has been reached, then
+ * return ISC_R_QUOTA, otherwise ISC_R_SUCCESS. (The counter is
+ * incremented regardless of return value.)
+ */
+
+unsigned int
+isc_counter_used(isc_counter_t *counter);
+/*%<
+ * Return the current counter value.
+ */
+
+void
+isc_counter_setlimit(isc_counter_t *counter, int limit);
+/*%<
+ * Set the counter limit.
+ */
+
+void
+isc_counter_attach(isc_counter_t *source, isc_counter_t **targetp);
+/*%<
+ * Attach to a counter object, increasing its reference counter.
+ */
+
+void
+isc_counter_detach(isc_counter_t **counterp);
+/*%<
+ * Detach (and destroy if reference counter has dropped to zero)
+ * a counter object.
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif /* ISC_COUNTER_H */
--- bind9-9.9.5.dfsg.orig/lib/isc/include/isc/lex.h
+++ bind9-9.9.5.dfsg/lib/isc/include/isc/lex.h
@@ -152,8 +152,6 @@
  * Requires:
  *\li	'*lexp' is a valid lexer.
  *
- *\li	max_token > 0.
- *
  * Ensures:
  *\li	On success, *lexp is attached to the newly created lexer.
  *
--- bind9-9.9.5.dfsg.orig/lib/isc/include/isc/types.h
+++ bind9-9.9.5.dfsg/lib/isc/include/isc/types.h
@@ -50,6 +50,7 @@
 typedef ISC_LIST(isc_buffer_t)		isc_bufferlist_t;	/*%< Buffer List */
 typedef struct isc_constregion		isc_constregion_t;	/*%< Const region */
 typedef struct isc_consttextregion	isc_consttextregion_t;	/*%< Const Text Region */
+typedef struct isc_counter		isc_counter_t;		/*%< Counter */
 typedef struct isc_entropy		isc_entropy_t;		/*%< Entropy */
 typedef struct isc_entropysource	isc_entropysource_t;	/*%< Entropy Source */
 typedef struct isc_event		isc_event_t;		/*%< Event */
--- bind9-9.9.5.dfsg.orig/lib/isc/lex.c
+++ bind9-9.9.5.dfsg/lib/isc/lex.c
@@ -93,9 +93,10 @@
 	/*
 	 * Create a lexer.
 	 */
-
 	REQUIRE(lexp != NULL && *lexp == NULL);
-	REQUIRE(max_token > 0U);
+
+	if (max_token == 0U)
+		max_token = 1;
 
 	lex = isc_mem_get(mctx, sizeof(*lex));
 	if (lex == NULL)
--- bind9-9.9.5.dfsg.orig/lib/isc/mips/include/isc/atomic.h
+++ bind9-9.9.5.dfsg/lib/isc/mips/include/isc/atomic.h
@@ -31,18 +31,20 @@
 isc_atomic_xadd(isc_int32_t *p, int val) {
 	isc_int32_t orig;
 
-	/* add is a cheat, since MIPS has no mov instruction */
-	__asm__ volatile (
-	    "1:"
-	    "ll $3, %1\n"
-	    "add %0, $0, $3\n"
-	    "add $3, $3, %2\n"
-	    "sc $3, %1\n"
-	    "beq $3, 0, 1b"
-	    : "=&r"(orig)
-	    : "m"(*p), "r"(val)
-	    : "memory", "$3"
-		);
+	__asm__ __volatile__ (
+	"	.set	push		\n"
+	"	.set	mips2		\n"
+	"	.set	noreorder	\n"
+	"	.set	noat		\n"
+	"1:	ll	$1, %1		\n"
+	"	addu	%0, $1, %2	\n"
+	"	sc	%0, %1		\n"
+	"	beqz	%0, 1b		\n"
+	"	move	%0, $1		\n"
+	"	.set	pop		\n"
+	: "=&r" (orig), "+R" (*p)
+	: "r" (val)
+	: "memory");
 
 	return (orig);
 }
@@ -52,16 +54,7 @@
  */
 static inline void
 isc_atomic_store(isc_int32_t *p, isc_int32_t val) {
-	__asm__ volatile (
-	    "1:"
-	    "ll $3, %0\n"
-	    "add $3, $0, %1\n"
-	    "sc $3, %0\n"
-	    "beq $3, 0, 1b"
-	    :
-	    : "m"(*p), "r"(val)
-	    : "memory", "$3"
-		);
+	*p = val;
 }
 
 /*
@@ -72,20 +65,23 @@
 static inline isc_int32_t
 isc_atomic_cmpxchg(isc_int32_t *p, int cmpval, int val) {
 	isc_int32_t orig;
+	isc_int32_t tmp;
 
-	__asm__ volatile(
-	    "1:"
-	    "ll $3, %1\n"
-	    "add %0, $0, $3\n"
-	    "bne $3, %2, 2f\n"
-	    "add $3, $0, %3\n"
-	    "sc $3, %1\n"
-	    "beq $3, 0, 1b\n"
-	    "2:"
-	    : "=&r"(orig)
-	    : "m"(*p), "r"(cmpval), "r"(val)
-	    : "memory", "$3"
-		);
+	__asm__ __volatile__ (
+	"	.set	push		\n"
+	"	.set	mips2		\n"
+	"	.set	noreorder	\n"
+	"	.set	noat		\n"
+	"1:	ll	$1, %1		\n"
+	"	bne	$1, %3, 2f	\n"
+	"	move	%2, %4		\n"
+	"	sc	%2, %1		\n"
+	"	beqz	%2, 1b		\n"
+	"2:	move	%0, $1		\n"
+	"	.set	pop		\n"
+	: "=&r"(orig), "+R" (*p), "=r" (tmp)
+	: "r"(cmpval), "r"(val)
+	: "memory");
 
 	return (orig);
 }
--- bind9-9.9.5.dfsg.orig/lib/isc/tests/Makefile.in
+++ bind9-9.9.5.dfsg/lib/isc/tests/Makefile.in
@@ -39,7 +39,7 @@
 		lex_test.c \
 		sockaddr_test.c symtab_test.c task_test.c queue_test.c \
 		parse_test.c pool_test.c regex_test.c safe_test.c \
-		time_test.c
+		time_test.c counter_test.c
 
 SUBDIRS =
 TARGETS =	taskpool_test@EXEEXT@ socket_test@EXEEXT@ hash_test@EXEEXT@ \
@@ -47,7 +47,7 @@
 		sockaddr_test@EXEEXT@ symtab_test@EXEEXT@ task_test@EXEEXT@ \
 		queue_test@EXEEXT@ parse_test@EXEEXT@ pool_test@EXEEXT@ \
 		regex_test@EXEEXT@ safe_test@EXEEXT@ \
-		time_test@EXEEXT@
+		time_test@EXEEXT@ counter_test@EXEEXT@
 
 @BIND9_MAKE_RULES@
 
@@ -103,6 +103,10 @@
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 			time_test.@O@ ${ISCLIBS} ${LIBS}
 
+counter_test@EXEEXT@: counter_test.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			counter_test.@O@ isctest.@O@ ${ISCLIBS} ${LIBS}
+
 unit::
 	sh ${top_srcdir}/unit/unittest.sh
 
--- bind9-9.9.5.dfsg.orig/lib/isc/tests/counter_test.c
+++ bind9-9.9.5.dfsg/lib/isc/tests/counter_test.c
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2014  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <config.h>
+#include <stdlib.h>
+
+#include <atf-c.h>
+
+#include <isc/counter.h>
+#include <isc/result.h>
+
+#include "isctest.h"
+
+ATF_TC(isc_counter);
+ATF_TC_HEAD(isc_counter, tc) {
+	atf_tc_set_md_var(tc, "descr", "isc counter object");
+}
+ATF_TC_BODY(isc_counter, tc) {
+	isc_result_t result;
+	isc_counter_t *counter = NULL;
+	int i;
+
+	result = isc_test_begin(NULL, ISC_TRUE);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	result = isc_counter_create(mctx, 0, &counter);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	for (i = 0; i < 10; i++) {
+		result = isc_counter_increment(counter);
+		ATF_CHECK_EQ(result, ISC_R_SUCCESS);
+	}
+
+	ATF_CHECK_EQ(isc_counter_used(counter), 10);
+
+	isc_counter_setlimit(counter, 15);
+	for (i = 0; i < 10; i++) {
+		result = isc_counter_increment(counter);
+		if (result != ISC_R_SUCCESS)
+			break;
+	}
+
+	ATF_CHECK_EQ(isc_counter_used(counter), 15);
+
+	isc_counter_detach(&counter);
+	isc_test_end();
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, isc_counter);
+	return (atf_no_error());
+}
+
--- bind9-9.9.5.dfsg.orig/lib/isc/unix/resource.c
+++ bind9-9.9.5.dfsg/lib/isc/unix/resource.c
@@ -29,6 +29,7 @@
 #include <isc/util.h>
 
 #ifdef __linux__
+#include <inttypes.h>
 #include <linux/fs.h>	/* To get the large NR_OPEN. */
 #endif
 
--- bind9-9.9.5.dfsg.orig/lib/isccc/Makefile.in
+++ bind9-9.9.5.dfsg/lib/isccc/Makefile.in
@@ -36,7 +36,7 @@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCCDEPLIBS =	libisccc.@A@
 
-LIBS =		@LIBS@
+LIBS =		@LIBS@ -L../../lib/isc
 
 SUBDIRS =	include
 
@@ -72,6 +72,7 @@
 		${CC} ${ALL_CFLAGS} ${LDFLAGS} -o libisccc.la -rpath ${libdir} \
 		-version-info ${LIBINTERFACE}:${LIBREVISION}:${LIBAGE} \
 		${OBJS} ${ISCLIBS} ${LIBS}
+	ln -sf .libs/libisccc.so .
 
 timestamp: libisccc.@A@
 	touch timestamp
@@ -84,3 +85,4 @@
 
 clean distclean::
 	rm -f libisccc.@A@ timestamp
+	rm -f libisccc.so 
--- bind9-9.9.5.dfsg.orig/lib/isccc/cc.c
+++ bind9-9.9.5.dfsg/lib/isccc/cc.c
@@ -287,10 +287,10 @@
 	 * Extract digest.
 	 */
 	_auth = isccc_alist_lookup(alist, "_auth");
-	if (_auth == NULL)
+	if (!isccc_alist_alistp(_auth))
 		return (ISC_R_FAILURE);
 	hmd5 = isccc_alist_lookup(_auth, "hmd5");
-	if (hmd5 == NULL)
+	if (!isccc_sexpr_binaryp(hmd5))
 		return (ISC_R_FAILURE);
 	/*
 	 * Compute digest.
@@ -545,7 +545,7 @@
 	REQUIRE(ackp != NULL && *ackp == NULL);
 
 	_ctrl = isccc_alist_lookup(message, "_ctrl");
-	if (_ctrl == NULL ||
+	if (!isccc_alist_alistp(_ctrl) ||
 	    isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS ||
 	    isccc_cc_lookupuint32(_ctrl, "_tim", &t) != ISC_R_SUCCESS)
 		return (ISC_R_FAILURE);
@@ -590,7 +590,7 @@
 	isccc_sexpr_t *_ctrl;
 
 	_ctrl = isccc_alist_lookup(message, "_ctrl");
-	if (_ctrl == NULL)
+	if (!isccc_alist_alistp(_ctrl))
 		return (ISC_FALSE);
 	if (isccc_cc_lookupstring(_ctrl, "_ack", NULL) == ISC_R_SUCCESS)
 		return (ISC_TRUE);
@@ -603,7 +603,7 @@
 	isccc_sexpr_t *_ctrl;
 
 	_ctrl = isccc_alist_lookup(message, "_ctrl");
-	if (_ctrl == NULL)
+	if (!isccc_alist_alistp(_ctrl))
 		return (ISC_FALSE);
 	if (isccc_cc_lookupstring(_ctrl, "_rpl", NULL) == ISC_R_SUCCESS)
 		return (ISC_TRUE);
@@ -623,7 +623,7 @@
 
 	_ctrl = isccc_alist_lookup(message, "_ctrl");
 	_data = isccc_alist_lookup(message, "_data");
-	if (_ctrl == NULL || _data == NULL ||
+	if (!isccc_alist_alistp(_ctrl) || !isccc_alist_alistp(_data) ||
 	    isccc_cc_lookupuint32(_ctrl, "_ser", &serial) != ISC_R_SUCCESS ||
 	    isccc_cc_lookupstring(_data, "type", &type) != ISC_R_SUCCESS)
 		return (ISC_R_FAILURE);
@@ -812,7 +812,7 @@
 	isccc_sexpr_t *_ctrl;
 
 	_ctrl = isccc_alist_lookup(message, "_ctrl");
-	if (_ctrl == NULL ||
+	if (!isccc_alist_alistp(_ctrl) ||
 	    isccc_cc_lookupstring(_ctrl, "_ser", &_ser) != ISC_R_SUCCESS ||
 	    isccc_cc_lookupstring(_ctrl, "_tim", &_tim) != ISC_R_SUCCESS)
 		return (ISC_R_FAILURE);
--- bind9-9.9.5.dfsg.orig/lib/isccfg/Makefile.in
+++ bind9-9.9.5.dfsg/lib/isccfg/Makefile.in
@@ -38,7 +38,7 @@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
 ISCCFGDEPLIBS =	libisccfg.@A@
 
-LIBS =		@LIBS@
+LIBS =		@LIBS@ -L../dns -L../isc -L../isccc
 
 SUBDIRS =	include
 
--- bind9-9.9.5.dfsg.orig/lib/isccfg/aclconf.c
+++ bind9-9.9.5.dfsg/lib/isccfg/aclconf.c
@@ -247,6 +247,9 @@
 		} else if (cfg_obj_isstring(ce)) {
 			const char *name = cfg_obj_asstring(ce);
 			if (strcasecmp(name, "localhost") == 0 ||
+#ifdef SUPPORT_GEOIP
+			    strncasecmp(name, "country_", 8) == 0 ||
+#endif
 			    strcasecmp(name, "localnets") == 0) {
 				n++;
 			} else if (strcasecmp(name, "any") != 0 &&
@@ -441,6 +444,14 @@
 					de->negative = !neg;
 				} else
 					continue;
+#ifdef SUPPORT_GEOIP
+			} else if ((0 == (strncmp("country_", name, 8))) && (10 == strlen(name))) {
+				/* It is a country code */
+				de->type = dns_aclelementtype_ipcountry;
+				de->country[0] = name[8];
+				de->country[1] = name[9];
+				de->country[2] = '\0';
+#endif
 			} else if (strcasecmp(name, "localhost") == 0) {
 				de->type = dns_aclelementtype_localhost;
 				de->negative = neg;
--- bind9-9.9.5.dfsg.orig/lib/isccfg/namedconf.c
+++ bind9-9.9.5.dfsg/lib/isccfg/namedconf.c
@@ -92,6 +92,7 @@
 static cfg_type_t cfg_type_controls_sockaddr;
 static cfg_type_t cfg_type_destinationlist;
 static cfg_type_t cfg_type_dialuptype;
+static cfg_type_t cfg_type_dynamic_db;
 static cfg_type_t cfg_type_ixfrdifftype;
 static cfg_type_t cfg_type_key;
 static cfg_type_t cfg_type_logfile;
@@ -897,6 +898,7 @@
 	{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI },
 	/* only 1 DLZ per view allowed */
 	{ "dlz", &cfg_type_dynamically_loadable_zones, 0 },
+	{ "dynamic-db", &cfg_type_dynamic_db, CFG_CLAUSEFLAG_MULTI },
 	{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI },
 	{ "trusted-keys", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI },
 	{ "managed-keys", &cfg_type_managedkeys, CFG_CLAUSEFLAG_MULTI },
@@ -1419,7 +1421,11 @@
 	{ "max-cache-ttl", &cfg_type_uint32, 0 },
 	{ "max-clients-per-query", &cfg_type_uint32, 0 },
 	{ "max-ncache-ttl", &cfg_type_uint32, 0 },
+	{ "max-recursion-depth", &cfg_type_uint32, 0 },
+	{ "max-recursion-queries", &cfg_type_uint32, 0 },
 	{ "max-udp-size", &cfg_type_uint32, 0 },
+	{ "min-cache-ttl", &cfg_type_uint32, 0 },
+	{ "min-ncache-ttl", &cfg_type_uint32, 0 },
 	{ "min-roots", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTIMP },
 	{ "minimal-responses", &cfg_type_boolean, 0 },
 	{ "preferred-glue", &cfg_type_astring, 0 },
@@ -2045,6 +2051,40 @@
 	&cfg_rep_string, dialup_enums
 };
 
+/*
+ * Dynamic database clauses.
+ */
+
+static cfg_clausedef_t
+dynamic_db_clauses[] = {
+	{ "library", &cfg_type_qstring, 0 },
+	{ "arg", &cfg_type_qstring, CFG_CLAUSEFLAG_MULTI },
+	{ NULL, NULL, 0 }
+};
+
+static cfg_clausedef_t *
+dynamic_db_clausesets[] = {
+	dynamic_db_clauses,
+	NULL
+};
+
+static cfg_type_t cfg_type_dynamic_db_opts = {
+	"dynamically_loadable_zones_opts", cfg_parse_map,
+	cfg_print_map, cfg_doc_map, &cfg_rep_map,
+	dynamic_db_clausesets
+};
+
+static cfg_tuplefielddef_t dynamic_db_fields[] = {
+	{ "name", &cfg_type_astring, 0 },
+	{ "options", &cfg_type_dynamic_db_opts, 0 },
+	{ NULL, NULL, 0 }
+};
+
+static cfg_type_t cfg_type_dynamic_db = {
+	"dynamic_db", cfg_parse_tuple, cfg_print_tuple, cfg_doc_tuple,
+	&cfg_rep_tuple, dynamic_db_fields
+};
+
 static const char *notify_enums[] = { "explicit", "master-only", NULL };
 static isc_result_t
 parse_notify_type(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
--- bind9-9.9.5.dfsg.orig/libtool.m4/libtool.m4
+++ bind9-9.9.5.dfsg/libtool.m4/libtool.m4
@@ -1312,7 +1312,7 @@
   rm -rf conftest*
   ;;
 
-x86_64-*kfreebsd*-gnu|x86_64-*linux*|ppc*-*linux*|powerpc*-*linux*| \
+x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \
 s390*-*linux*|s390*-*tpf*|sparc*-*linux*)
   # Find out which ABI we are using.
   echo 'int i;' > conftest.$ac_ext
@@ -1324,9 +1324,19 @@
 	    LD="${LD-ld} -m elf_i386_fbsd"
 	    ;;
 	  x86_64-*linux*)
-	    LD="${LD-ld} -m elf_i386"
+	    case `/usr/bin/file conftest.o` in
+	      *x86-64*)
+		LD="${LD-ld} -m elf32_x86_64"
+		;;
+	      *)
+		LD="${LD-ld} -m elf_i386"
+		;;
+	    esac
+	    ;;
+	  powerpc64le-*)
+	    LD="${LD-ld} -m elf32lppclinux"
 	    ;;
-	  ppc64-*linux*|powerpc64-*linux*)
+	  powerpc64-*)
 	    LD="${LD-ld} -m elf32ppclinux"
 	    ;;
 	  s390x-*linux*)
@@ -1345,7 +1355,10 @@
 	  x86_64-*linux*)
 	    LD="${LD-ld} -m elf_x86_64"
 	    ;;
-	  ppc*-*linux*|powerpc*-*linux*)
+	  powerpcle-*)
+	    LD="${LD-ld} -m elf64lppc"
+	    ;;
+	  powerpc-*)
 	    LD="${LD-ld} -m elf64ppc"
 	    ;;
 	  s390*-*linux*|s390*-*tpf*)
@@ -1688,7 +1701,8 @@
     ;;
   *)
     lt_cv_sys_max_cmd_len=`(getconf ARG_MAX) 2> /dev/null`
-    if test -n "$lt_cv_sys_max_cmd_len"; then
+    if test -n "$lt_cv_sys_max_cmd_len" && \
+	test undefined != "$lt_cv_sys_max_cmd_len"; then
       lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \/ 4`
       lt_cv_sys_max_cmd_len=`expr $lt_cv_sys_max_cmd_len \* 3`
     else
@@ -2512,17 +2526,6 @@
   esac
   ;;
 
-gnu*)
-  version_type=linux # correct to gnu/linux during the next big refactor
-  need_lib_prefix=no
-  need_version=no
-  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}${major} ${libname}${shared_ext}'
-  soname_spec='${libname}${release}${shared_ext}$major'
-  shlibpath_var=LD_LIBRARY_PATH
-  shlibpath_overrides_runpath=no
-  hardcode_into_libs=yes
-  ;;
-
 haiku*)
   version_type=linux # correct to gnu/linux during the next big refactor
   need_lib_prefix=no
@@ -2639,7 +2642,7 @@
   ;;
 
 # This must be glibc/ELF.
-linux* | k*bsd*-gnu | kopensolaris*-gnu)
+linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   version_type=linux # correct to gnu/linux during the next big refactor
   need_lib_prefix=no
   need_version=no
@@ -2684,6 +2687,18 @@
   dynamic_linker='GNU/Linux ld.so'
   ;;
 
+netbsdelf*-gnu)
+  version_type=linux
+  need_lib_prefix=no
+  need_version=no
+  library_names_spec='${libname}${release}${shared_ext}$versuffix ${libname}${release}${shared_ext}$major ${libname}${shared_ext}'
+  soname_spec='${libname}${release}${shared_ext}$major'
+  shlibpath_var=LD_LIBRARY_PATH
+  shlibpath_overrides_runpath=no
+  hardcode_into_libs=yes
+  dynamic_linker='NetBSD ld.elf_so'
+  ;;
+
 netbsd*)
   version_type=sunos
   need_lib_prefix=no
@@ -3243,10 +3258,6 @@
   fi
   ;;
 
-gnu*)
-  lt_cv_deplibs_check_method=pass_all
-  ;;
-
 haiku*)
   lt_cv_deplibs_check_method=pass_all
   ;;
@@ -3285,11 +3296,11 @@
   ;;
 
 # This must be glibc/ELF.
-linux* | k*bsd*-gnu | kopensolaris*-gnu)
+linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
   lt_cv_deplibs_check_method=pass_all
   ;;
 
-netbsd*)
+netbsd* | netbsdelf*-gnu)
   if echo __ELF__ | $CC -E - | $GREP __ELF__ > /dev/null; then
     lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|_pic\.a)$'
   else
@@ -4037,7 +4048,7 @@
 	    ;;
 	esac
 	;;
-      linux* | k*bsd*-gnu | kopensolaris*-gnu)
+      linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
 	case $cc_basename in
 	  KCC*)
 	    # KAI C++ Compiler
@@ -4101,7 +4112,7 @@
 	    ;;
 	esac
 	;;
-      netbsd*)
+      netbsd* | netbsdelf*-gnu)
 	;;
       *qnx* | *nto*)
         # QNX uses GNU C++, but need to define -shared option too, otherwise
@@ -4336,7 +4347,7 @@
       _LT_TAGVAR(lt_prog_compiler_static, $1)='-non_shared'
       ;;
 
-    linux* | k*bsd*-gnu | kopensolaris*-gnu)
+    linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
       case $cc_basename in
       # old Intel for x86_64 which still supported -KPIC.
       ecc*)
@@ -4578,6 +4589,9 @@
       ;;
     esac
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
   *)
     _LT_TAGVAR(export_symbols_cmds, $1)='$NM $libobjs $convenience | $global_symbol_pipe | $SED '\''s/.* //'\'' | sort | uniq > $export_symbols'
     ;;
@@ -4640,6 +4654,9 @@
   openbsd*)
     with_gnu_ld=no
     ;;
+  linux* | k*bsd*-gnu | gnu*)
+    _LT_TAGVAR(link_all_deplibs, $1)=no
+    ;;
   esac
 
   _LT_TAGVAR(ld_shlibs, $1)=yes
@@ -4861,7 +4878,7 @@
       fi
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable $libobjs $deplibs $linker_flags -o $lib'
 	wlarc=
@@ -5038,6 +5055,7 @@
 	if test "$aix_use_runtimelinking" = yes; then
 	  shared_flag="$shared_flag "'${wl}-G'
 	fi
+	_LT_TAGVAR(link_all_deplibs, $1)=no
       else
 	# not using gcc
 	if test "$host_cpu" = ia64; then
@@ -5342,7 +5360,7 @@
       _LT_TAGVAR(link_all_deplibs, $1)=yes
       ;;
 
-    netbsd*)
+    netbsd* | netbsdelf*-gnu)
       if echo __ELF__ | $CC -E - | $GREP __ELF__ >/dev/null; then
 	_LT_TAGVAR(archive_cmds, $1)='$LD -Bshareable -o $lib $libobjs $deplibs $linker_flags'  # a.out
       else
@@ -6222,9 +6240,6 @@
         _LT_TAGVAR(ld_shlibs, $1)=yes
         ;;
 
-      gnu*)
-        ;;
-
       haiku*)
         _LT_TAGVAR(archive_cmds, $1)='$CC -shared $libobjs $deplibs $compiler_flags ${wl}-soname $wl$soname -o $lib'
         _LT_TAGVAR(link_all_deplibs, $1)=yes
@@ -6386,7 +6401,7 @@
         _LT_TAGVAR(inherit_rpath, $1)=yes
         ;;
 
-      linux* | k*bsd*-gnu | kopensolaris*-gnu)
+      linux* | k*bsd*-gnu | kopensolaris*-gnu | gnu*)
         case $cc_basename in
           KCC*)
 	    # Kuck and Associates, Inc. (KAI) C++ Compiler
--- bind9-9.9.5.dfsg.orig/ltmain.sh
+++ bind9-9.9.5.dfsg/ltmain.sh
@@ -70,7 +70,7 @@
 #         compiler:		$LTCC
 #         compiler flags:		$LTCFLAGS
 #         linker:		$LD (gnu? $with_gnu_ld)
-#         $progname:	(GNU libtool) 2.4.2
+#         $progname:	(GNU libtool) 2.4.2 Debian-2.4.2-1.7
 #         automake:	$automake_version
 #         autoconf:	$autoconf_version
 #
@@ -80,7 +80,7 @@
 
 PROGRAM=libtool
 PACKAGE=libtool
-VERSION=2.4.2
+VERSION="2.4.2 Debian-2.4.2-1.7"
 TIMESTAMP=""
 package_revision=1.3337
 
@@ -1375,21 +1375,6 @@
 func_infer_tag ()
 {
     $opt_debug
-
-    # FreeBSD-specific: where we install compilers with non-standard names
-    tag_compilers_CC="*cc cc* *gcc gcc* clang"
-    tag_compilers_CXX="*c++ c++* *g++ g++* clang++"
-    base_compiler=`set -- "$@"; echo $1`
-
-    # If $tagname isn't set, then try to infer if the default "CC" tag applies
-    if test -z "$tagname"; then
-      for zp in $tag_compilers_CC; do
-        case $base_compiler in
-	 $zp) tagname="CC"; break;;
-	esac
-      done
-    fi
-
     if test -n "$available_tags" && test -z "$tagname"; then
       CC_quoted=
       for arg in $CC; do
@@ -1426,22 +1411,7 @@
 	      break
 	      ;;
 	    esac
-
-	    # FreeBSD-specific: try compilers based on inferred tag
-	    if test -z "$tagname"; then
-	      eval "tag_compilers=\$tag_compilers_${z}"
-	      if test -n "$tag_compilers"; then
-		for zp in $tag_compilers; do
-		  case $base_compiler in   
-		    $zp) tagname=$z; break;;
-		  esac
-		done
-		if test -n "$tagname"; then
-		  break
-		fi
-	      fi
-            fi
-          fi
+	  fi
 	done
 	# If $tagname still isn't set, then no tagged configuration
 	# was found and let the user know that the "--tag" command
@@ -3547,9 +3517,6 @@
 	  ;;
 	esac
 	;;
-      *-*-freebsd*)
-	# FreeBSD doesn't need this...
-	;;
       *)
 	func_fatal_error "unknown suffix for \`$my_dlsyms'"
 	;;
@@ -5628,7 +5595,6 @@
 	  esac
 	  ;;
 	esac
-	deplibs="$deplibs $arg"
 	continue
 	;;
 
@@ -6158,7 +6124,10 @@
 	case $pass in
 	dlopen) libs="$dlfiles" ;;
 	dlpreopen) libs="$dlprefiles" ;;
-	link) libs="$deplibs %DEPLIBS% $dependency_libs" ;;
+	link)
+	  libs="$deplibs %DEPLIBS%"
+	  test "X$link_all_deplibs" != Xno && libs="$libs $dependency_libs"
+	  ;;
 	esac
       fi
       if test "$linkmode,$pass" = "lib,dlpreopen"; then
@@ -6201,30 +6170,13 @@
 	    finalize_deplibs="$deplib $finalize_deplibs"
 	  else
 	    func_append compiler_flags " $deplib"
-	  fi
-
-	  case $linkmode in
-	  lib)
-	    deplibs="$deplib $deplibs"
-	    test "$pass" = conv && continue
-	    newdependency_libs="$deplib $newdependency_libs"
-	    ;;
-	  prog)
-	    if test "$pass" = conv; then
-	      deplibs="$deplib $deplibs"
-	      continue
-	    fi
-	    if test "$pass" = scan; then
-	      deplibs="$deplib $deplibs"
-	    else
-	      compile_deplibs="$deplib $compile_deplibs"
-	      finalize_deplibs="$deplib $finalize_deplibs"
+	    if test "$linkmode" = lib ; then
+		case "$new_inherited_linker_flags " in
+		    *" $deplib "*) ;;
+		    * ) func_append new_inherited_linker_flags " $deplib" ;;
+		esac
 	    fi
-	    ;;
-	  *)
-	    ;;
-	  esac # linkmode
-
+	  fi
 	  continue
 	  ;;
 	-l*)
@@ -6495,19 +6447,19 @@
 	    # It is a libtool convenience library, so add in its objects.
 	    func_append convenience " $ladir/$objdir/$old_library"
 	    func_append old_convenience " $ladir/$objdir/$old_library"
+	    tmp_libs=
+	    for deplib in $dependency_libs; do
+	      deplibs="$deplib $deplibs"
+	      if $opt_preserve_dup_deps ; then
+		case "$tmp_libs " in
+		*" $deplib "*) func_append specialdeplibs " $deplib" ;;
+		esac
+	      fi
+	      func_append tmp_libs " $deplib"
+	    done
 	  elif test "$linkmode" != prog && test "$linkmode" != lib; then
 	    func_fatal_error "\`$lib' is not a convenience library"
 	  fi
-	  tmp_libs=
-	  for deplib in $dependency_libs; do
-	    deplibs="$deplib $deplibs"
-	    if $opt_preserve_dup_deps ; then
-	      case "$tmp_libs " in
-	      *" $deplib "*) func_append specialdeplibs " $deplib" ;;
-	      esac
-	    fi
-	    func_append tmp_libs " $deplib"
-	  done
 	  continue
 	fi # $pass = conv
 
@@ -7400,6 +7352,9 @@
 	    revision="$number_minor"
 	    lt_irix_increment=no
 	    ;;
+	  *)
+	    func_fatal_configuration "$modename: unknown library version type \`$version_type'"
+	    ;;
 	  esac
 	  ;;
 	no)
--- bind9-9.9.5.dfsg.orig/version
+++ bind9-9.9.5.dfsg/version
@@ -10,4 +10,4 @@
 PATCHVER=5
 RELEASETYPE=
 RELEASEVER=
-EXTENSIONS=
+EXTENSIONS="$(dpkg-parsechangelog | sed -n '/^Version/s/[^-]*//p')-$(dpkg-vendor --query Vendor)"
