zone.c

Go to the documentation of this file.

/*
 * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
 * Copyright (C) 1999-2003  Internet Software Consortium.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 * PERFORMANCE OF THIS SOFTWARE.
 */

/*! \file */

#include <config.h>
#include <errno.h>

#include <isc/file.h>
#include <isc/hex.h>
#include <isc/mutex.h>
#include <isc/pool.h>
#include <isc/print.h>
#include <isc/random.h>
#include <isc/ratelimiter.h>
#include <isc/refcount.h>
#include <isc/rwlock.h>
#include <isc/serial.h>
#include <isc/stats.h>
#include <isc/stdtime.h>
#include <isc/strerror.h>
#include <isc/string.h>
#include <isc/taskpool.h>
#include <isc/thread.h>
#include <isc/timer.h>
#include <isc/util.h>

#include <dns/acache.h>
#include <dns/acl.h>
#include <dns/adb.h>
#include <dns/callbacks.h>
#include <dns/db.h>
#include <dns/dbiterator.h>
#include <dns/dlz.h>
#include <dns/dnssec.h>
#include <dns/events.h>
#include <dns/journal.h>
#include <dns/keydata.h>
#include <dns/keytable.h>
#include <dns/keyvalues.h>
#include <dns/log.h>
#include <dns/master.h>
#include <dns/masterdump.h>
#include <dns/message.h>
#include <dns/name.h>
#include <dns/nsec.h>
#include <dns/nsec3.h>
#include <dns/peer.h>
#include <dns/private.h>
#include <dns/rbt.h>
#include <dns/rcode.h>
#include <dns/rdata.h>
#include <dns/rdataclass.h>
#include <dns/rdatalist.h>
#include <dns/rdataset.h>
#include <dns/rdatasetiter.h>
#include <dns/rdatastruct.h>
#include <dns/rdatatype.h>
#include <dns/request.h>
#include <dns/resolver.h>
#include <dns/result.h>
#include <dns/rriterator.h>
#include <dns/soa.h>
#include <dns/ssu.h>
#include <dns/stats.h>
#include <dns/time.h>
#include <dns/tsig.h>
#include <dns/update.h>
#include <dns/xfrin.h>
#include <dns/zone.h>
#include <dns/zt.h>

#include <dst/dst.h>

#define ZONE_MAGIC                      ISC_MAGIC('Z', 'O', 'N', 'E')
#define DNS_ZONE_VALID(zone)            ISC_MAGIC_VALID(zone, ZONE_MAGIC)

#define NOTIFY_MAGIC                    ISC_MAGIC('N', 't', 'f', 'y')
#define DNS_NOTIFY_VALID(notify)        ISC_MAGIC_VALID(notify, NOTIFY_MAGIC)

#define STUB_MAGIC                      ISC_MAGIC('S', 't', 'u', 'b')
#define DNS_STUB_VALID(stub)            ISC_MAGIC_VALID(stub, STUB_MAGIC)

#define ZONEMGR_MAGIC                   ISC_MAGIC('Z', 'm', 'g', 'r')
#define DNS_ZONEMGR_VALID(stub)         ISC_MAGIC_VALID(stub, ZONEMGR_MAGIC)

#define LOAD_MAGIC                      ISC_MAGIC('L', 'o', 'a', 'd')
#define DNS_LOAD_VALID(load)            ISC_MAGIC_VALID(load, LOAD_MAGIC)

#define FORWARD_MAGIC                   ISC_MAGIC('F', 'o', 'r', 'w')
#define DNS_FORWARD_VALID(load)         ISC_MAGIC_VALID(load, FORWARD_MAGIC)

#define IO_MAGIC                        ISC_MAGIC('Z', 'm', 'I', 'O')
#define DNS_IO_VALID(load)              ISC_MAGIC_VALID(load, IO_MAGIC)

/*%
 * Ensure 'a' is at least 'min' but not more than 'max'.
 */
#define RANGE(a, min, max) \
                (((a) < (min)) ? (min) : ((a) < (max) ? (a) : (max)))

#define NSEC3REMOVE(x) (((x) & DNS_NSEC3FLAG_REMOVE) != 0)

/*%
 * Key flags
 */
#define REVOKE(x) ((dst_key_flags(x) & DNS_KEYFLAG_REVOKE) != 0)
#define KSK(x) ((dst_key_flags(x) & DNS_KEYFLAG_KSK) != 0)
#define ALG(x) dst_key_alg(x)

/*
 * Default values.
 */
#define DNS_DEFAULT_IDLEIN 3600         /*%< 1 hour */
#define DNS_DEFAULT_IDLEOUT 3600        /*%< 1 hour */
#define MAX_XFER_TIME (2*3600)          /*%< Documented default is 2 hours */
#define RESIGN_DELAY 3600               /*%< 1 hour */

#ifndef DNS_MAX_EXPIRE
#define DNS_MAX_EXPIRE  14515200        /*%< 24 weeks */
#endif

#ifndef DNS_DUMP_DELAY
#define DNS_DUMP_DELAY 900              /*%< 15 minutes */
#endif

typedef struct dns_notify dns_notify_t;
typedef struct dns_stub dns_stub_t;
typedef struct dns_load dns_load_t;
typedef struct dns_forward dns_forward_t;
typedef ISC_LIST(dns_forward_t) dns_forwardlist_t;
typedef struct dns_io dns_io_t;
typedef ISC_LIST(dns_io_t) dns_iolist_t;
typedef struct dns_signing dns_signing_t;
typedef ISC_LIST(dns_signing_t) dns_signinglist_t;
typedef struct dns_nsec3chain dns_nsec3chain_t;
typedef ISC_LIST(dns_nsec3chain_t) dns_nsec3chainlist_t;
typedef struct dns_keyfetch dns_keyfetch_t;
typedef struct dns_asyncload dns_asyncload_t;
typedef struct dns_include dns_include_t;

#define DNS_ZONE_CHECKLOCK
#ifdef DNS_ZONE_CHECKLOCK
#define LOCK_ZONE(z) \
         do { LOCK(&(z)->lock); \
              INSIST((z)->locked == ISC_FALSE); \
             (z)->locked = ISC_TRUE; \
                } while (0)
#define UNLOCK_ZONE(z) \
        do { (z)->locked = ISC_FALSE; UNLOCK(&(z)->lock); } while (0)
#define LOCKED_ZONE(z) ((z)->locked)
#define TRYLOCK_ZONE(result, z) \
        do { \
              result = isc_mutex_trylock(&(z)->lock); \
              if (result == ISC_R_SUCCESS) {  \
                     INSIST((z)->locked == ISC_FALSE); \
                     (z)->locked = ISC_TRUE; \
              } \
        } while (0)
#else
#define LOCK_ZONE(z) LOCK(&(z)->lock)
#define UNLOCK_ZONE(z) UNLOCK(&(z)->lock)
#define LOCKED_ZONE(z) ISC_TRUE
#define TRYLOCK_ZONE(result, z) \
        do { result = isc_mutex_trylock(&(z)->lock); } while (0)
#endif

#ifdef ISC_RWLOCK_USEATOMIC
#define ZONEDB_INITLOCK(l)      isc_rwlock_init((l), 0, 0)
#define ZONEDB_DESTROYLOCK(l)   isc_rwlock_destroy(l)
#define ZONEDB_LOCK(l, t)       RWLOCK((l), (t))
#define ZONEDB_UNLOCK(l, t)     RWUNLOCK((l), (t))
#else
#define ZONEDB_INITLOCK(l)      isc_mutex_init(l)
#define ZONEDB_DESTROYLOCK(l)   DESTROYLOCK(l)
#define ZONEDB_LOCK(l, t)       LOCK(l)
#define ZONEDB_UNLOCK(l, t)     UNLOCK(l)
#endif

struct dns_zone {
        /* Unlocked */
        unsigned int            magic;
        isc_mutex_t             lock;
#ifdef DNS_ZONE_CHECKLOCK
        isc_boolean_t           locked;
#endif
        isc_mem_t               *mctx;
        isc_refcount_t          erefs;

#ifdef ISC_RWLOCK_USEATOMIC
        isc_rwlock_t            dblock;
#else
        isc_mutex_t             dblock;
#endif
        dns_db_t                *db;            /* Locked by dblock */

        /* Locked */
        dns_zonemgr_t           *zmgr;
        ISC_LINK(dns_zone_t)    link;           /* Used by zmgr. */
        isc_timer_t             *timer;
        unsigned int            irefs;
        dns_name_t              origin;
        char                    *masterfile;
        ISC_LIST(dns_include_t) includes;       /* Include files */
        ISC_LIST(dns_include_t) newincludes;    /* Loading */
        unsigned int            nincludes;
        dns_masterformat_t      masterformat;
        const dns_master_style_t *masterstyle;
        char                    *journal;
        isc_int32_t             journalsize;
        dns_rdataclass_t        rdclass;
        dns_zonetype_t          type;
        unsigned int            flags;
        unsigned int            options;
        unsigned int            options2;
        unsigned int            db_argc;
        char                    **db_argv;
        isc_time_t              expiretime;
        isc_time_t              refreshtime;
        isc_time_t              dumptime;
        isc_time_t              loadtime;
        isc_time_t              notifytime;
        isc_time_t              resigntime;
        isc_time_t              keywarntime;
        isc_time_t              signingtime;
        isc_time_t              nsec3chaintime;
        isc_time_t              refreshkeytime;
        isc_uint32_t            refreshkeyinterval;
        isc_uint32_t            refreshkeycount;
        isc_uint32_t            refresh;
        isc_uint32_t            retry;
        isc_uint32_t            expire;
        isc_uint32_t            minimum;
        isc_stdtime_t           key_expiry;
        isc_stdtime_t           log_key_expired_timer;
        char                    *keydirectory;

        isc_uint32_t            maxrefresh;
        isc_uint32_t            minrefresh;
        isc_uint32_t            maxretry;
        isc_uint32_t            minretry;

        isc_sockaddr_t          *masters;
        isc_dscp_t              *masterdscps;
        dns_name_t              **masterkeynames;
        isc_boolean_t           *mastersok;
        unsigned int            masterscnt;
        unsigned int            curmaster;
        isc_sockaddr_t          masteraddr;
        dns_notifytype_t        notifytype;
        isc_sockaddr_t          *notify;
        dns_name_t              **notifykeynames;
        isc_dscp_t              *notifydscp;
        unsigned int            notifycnt;
        isc_sockaddr_t          notifyfrom;
        isc_task_t              *task;
        isc_task_t              *loadtask;
        isc_sockaddr_t          notifysrc4;
        isc_sockaddr_t          notifysrc6;
        isc_sockaddr_t          xfrsource4;
        isc_sockaddr_t          xfrsource6;
        isc_sockaddr_t          altxfrsource4;
        isc_sockaddr_t          altxfrsource6;
        isc_sockaddr_t          sourceaddr;
        isc_dscp_t              notifysrc4dscp;
        isc_dscp_t              notifysrc6dscp;
        isc_dscp_t              xfrsource4dscp;
        isc_dscp_t              xfrsource6dscp;
        isc_dscp_t              altxfrsource4dscp;
        isc_dscp_t              altxfrsource6dscp;
        dns_xfrin_ctx_t         *xfr;           /* task locked */
        dns_tsigkey_t           *tsigkey;       /* key used for xfr */
        /* Access Control Lists */
        dns_acl_t               *update_acl;
        dns_acl_t               *forward_acl;
        dns_acl_t               *notify_acl;
        dns_acl_t               *query_acl;
        dns_acl_t               *queryon_acl;
        dns_acl_t               *xfr_acl;
        isc_boolean_t           update_disabled;
        isc_boolean_t           zero_no_soa_ttl;
        dns_severity_t          check_names;
        ISC_LIST(dns_notify_t)  notifies;
        dns_request_t           *request;
        dns_loadctx_t           *lctx;
        dns_io_t                *readio;
        dns_dumpctx_t           *dctx;
        dns_io_t                *writeio;
        isc_uint32_t            maxxfrin;
        isc_uint32_t            maxxfrout;
        isc_uint32_t            idlein;
        isc_uint32_t            idleout;
        isc_event_t             ctlevent;
        dns_ssutable_t          *ssutable;
        isc_uint32_t            sigvalidityinterval;
        isc_uint32_t            sigresigninginterval;
        dns_view_t              *view;
        dns_acache_t            *acache;
        dns_checkmxfunc_t       checkmx;
        dns_checksrvfunc_t      checksrv;
        dns_checknsfunc_t       checkns;
        /*%
         * Zones in certain states such as "waiting for zone transfer"
         * or "zone transfer in progress" are kept on per-state linked lists
         * in the zone manager using the 'statelink' field.  The 'statelist'
         * field points at the list the zone is currently on.  It the zone
         * is not on any such list, statelist is NULL.
         */
        ISC_LINK(dns_zone_t)    statelink;
        dns_zonelist_t          *statelist;
        /*%
         * Statistics counters about zone management.
         */
        isc_stats_t             *stats;
        /*%
         * Optional per-zone statistics counters.  Counted outside of this
         * module.
         */
        dns_zonestat_level_t    statlevel;
        isc_boolean_t           requeststats_on;
        isc_stats_t             *requeststats;
        dns_stats_t             *rcvquerystats;
        isc_uint32_t            notifydelay;
        dns_isselffunc_t        isself;
        void                    *isselfarg;

        char *                  strnamerd;
        char *                  strname;
        char *                  strrdclass;
        char *                  strviewname;

        /*%
         * Serial number for deferred journal compaction.
         */
        isc_uint32_t            compact_serial;
        /*%
         * Keys that are signing the zone for the first time.
         */
        dns_signinglist_t       signing;
        dns_nsec3chainlist_t    nsec3chain;
        /*%
         * Signing / re-signing quantum stopping parameters.
         */
        isc_uint32_t            signatures;
        isc_uint32_t            nodes;
        dns_rdatatype_t         privatetype;

        /*%
         * Autosigning/key-maintenance options
         */
        isc_uint32_t            keyopts;

        /*%
         * True if added by "rndc addzone"
         */
        isc_boolean_t           added;

        /*%
         * True if added by automatically by named.
         */
        isc_boolean_t           automatic;

        /*%
         * response policy data to be relayed to the database
         */
        dns_rpz_zones_t         *rpzs;
        dns_rpz_num_t           rpz_num;

        /*%
         * Serial number update method.
         */
        dns_updatemethod_t      updatemethod;

        /*%
         * whether ixfr is requested
         */
        isc_boolean_t           requestixfr;

        /*%
         * whether EDNS EXPIRE is requested
         */
        isc_boolean_t           requestexpire;

        /*%
         * Outstanding forwarded UPDATE requests.
         */
        dns_forwardlist_t       forwards;

        dns_zone_t              *raw;
        dns_zone_t              *secure;

        isc_boolean_t           sourceserialset;
        isc_uint32_t            sourceserial;

        /*%
         * maximum zone ttl
         */
        dns_ttl_t               maxttl;

        /*
         * Inline zone signing state.
         */
        dns_diff_t              rss_diff;
        isc_eventlist_t         rss_events;
        dns_dbversion_t         *rss_newver;
        dns_dbversion_t         *rss_oldver;
        dns_db_t                *rss_db;
        dns_zone_t              *rss_raw;
        isc_event_t             *rss_event;
        dns_update_state_t      *rss_state;
};

typedef struct {
        dns_diff_t      *diff;
        isc_boolean_t   offline;
} zonediff_t;

#define zonediff_init(z, d) \
        do { \
                zonediff_t *_z = (z); \
                (_z)->diff = (d); \
                (_z)->offline = ISC_FALSE; \
        } while (0)

#define DNS_ZONE_FLAG(z,f) (ISC_TF(((z)->flags & (f)) != 0))
#define DNS_ZONE_SETFLAG(z,f) do { \
                INSIST(LOCKED_ZONE(z)); \
                (z)->flags |= (f); \
                } while (0)
#define DNS_ZONE_CLRFLAG(z,f) do { \
                INSIST(LOCKED_ZONE(z)); \
                (z)->flags &= ~(f); \
                } while (0)
        /* XXX MPA these may need to go back into zone.h */
#define DNS_ZONEFLG_REFRESH     0x00000001U     /*%< refresh check in progress */
#define DNS_ZONEFLG_NEEDDUMP    0x00000002U     /*%< zone need consolidation */
#define DNS_ZONEFLG_USEVC       0x00000004U     /*%< use tcp for refresh query */
#define DNS_ZONEFLG_DUMPING     0x00000008U     /*%< a dump is in progress */
#define DNS_ZONEFLG_HASINCLUDE  0x00000010U     /*%< $INCLUDE in zone file */
#define DNS_ZONEFLG_LOADED      0x00000020U     /*%< database has loaded */
#define DNS_ZONEFLG_EXITING     0x00000040U     /*%< zone is being destroyed */
#define DNS_ZONEFLG_EXPIRED     0x00000080U     /*%< zone has expired */
#define DNS_ZONEFLG_NEEDREFRESH 0x00000100U     /*%< refresh check needed */
#define DNS_ZONEFLG_UPTODATE    0x00000200U     /*%< zone contents are
                                                 * uptodate */
#define DNS_ZONEFLG_NEEDNOTIFY  0x00000400U     /*%< need to send out notify
                                                 * messages */
#define DNS_ZONEFLG_DIFFONRELOAD 0x00000800U    /*%< generate a journal diff on
                                                 * reload */
#define DNS_ZONEFLG_NOMASTERS   0x00001000U     /*%< an attempt to refresh a
                                                 * zone with no masters
                                                 * occurred */
#define DNS_ZONEFLG_LOADING     0x00002000U     /*%< load from disk in progress*/
#define DNS_ZONEFLG_HAVETIMERS  0x00004000U     /*%< timer values have been set
                                                 * from SOA (if not set, we
                                                 * are still using
                                                 * default timer values) */
#define DNS_ZONEFLG_FORCEXFER   0x00008000U     /*%< Force a zone xfer */
#define DNS_ZONEFLG_NOREFRESH   0x00010000U
#define DNS_ZONEFLG_DIALNOTIFY  0x00020000U
#define DNS_ZONEFLG_DIALREFRESH 0x00040000U
#define DNS_ZONEFLG_SHUTDOWN    0x00080000U
#define DNS_ZONEFLAG_NOIXFR     0x00100000U     /*%< IXFR failed, force AXFR */
#define DNS_ZONEFLG_FLUSH       0x00200000U
#define DNS_ZONEFLG_NOEDNS      0x00400000U
#define DNS_ZONEFLG_USEALTXFRSRC 0x00800000U
#define DNS_ZONEFLG_SOABEFOREAXFR 0x01000000U
#define DNS_ZONEFLG_NEEDCOMPACT 0x02000000U
#define DNS_ZONEFLG_REFRESHING  0x04000000U     /*%< Refreshing keydata */
#define DNS_ZONEFLG_THAW        0x08000000U
#define DNS_ZONEFLG_LOADPENDING 0x10000000U     /*%< Loading scheduled */
#define DNS_ZONEFLG_NODELAY     0x20000000U
#define DNS_ZONEFLG_SENDSECURE  0x40000000U
#define DNS_ZONEFLG_NEEDSTARTUPNOTIFY 0x80000000U /*%< need to send out notify
                                                   *   due to the zone just
                                                   *   being loaded for the
                                                   *   first time.  */

#define DNS_ZONE_OPTION(z,o) (((z)->options & (o)) != 0)
#define DNS_ZONE_OPTION2(z,o) (((z)->options2 & (o)) != 0)
#define DNS_ZONEKEY_OPTION(z,o) (((z)->keyopts & (o)) != 0)

/* Flags for zone_load() */
#define DNS_ZONELOADFLAG_NOSTAT 0x00000001U     /* Do not stat() master files */
#define DNS_ZONELOADFLAG_THAW   0x00000002U     /* Thaw the zone on successful
                                                   load. */

#define UNREACH_CHACHE_SIZE     10U
#define UNREACH_HOLD_TIME       600     /* 10 minutes */

#define CHECK(op) \
        do { result = (op); \
                if (result != ISC_R_SUCCESS) goto failure; \
        } while (0)

struct dns_unreachable {
        isc_sockaddr_t  remote;
        isc_sockaddr_t  local;
        isc_uint32_t    expire;
        isc_uint32_t    last;
        isc_uint32_t    count;
};

struct dns_zonemgr {
        unsigned int            magic;
        isc_mem_t *             mctx;
        int                     refs;           /* Locked by rwlock */
        isc_taskmgr_t *         taskmgr;
        isc_timermgr_t *        timermgr;
        isc_socketmgr_t *       socketmgr;
        isc_taskpool_t *        zonetasks;
        isc_taskpool_t *        loadtasks;
        isc_task_t *            task;
        isc_pool_t *            mctxpool;
        isc_ratelimiter_t *     notifyrl;
        isc_ratelimiter_t *     refreshrl;
        isc_ratelimiter_t *     startupnotifyrl;
        isc_ratelimiter_t *     startuprefreshrl;
        isc_rwlock_t            rwlock;
        isc_mutex_t             iolock;
        isc_rwlock_t            urlock;

        /* Locked by rwlock. */
        dns_zonelist_t          zones;
        dns_zonelist_t          waiting_for_xfrin;
        dns_zonelist_t          xfrin_in_progress;

        /* Configuration data. */
        isc_uint32_t            transfersin;
        isc_uint32_t            transfersperns;
        unsigned int            notifyrate;
        unsigned int            startupnotifyrate;
        unsigned int            serialqueryrate;
        unsigned int            startupserialqueryrate;

        /* Locked by iolock */
        isc_uint32_t            iolimit;
        isc_uint32_t            ioactive;
        dns_iolist_t            high;
        dns_iolist_t            low;

        /* Locked by urlock. */
        /* LRU cache */
        struct dns_unreachable  unreachable[UNREACH_CHACHE_SIZE];
};

/*%
 * Hold notify state.
 */
struct dns_notify {
        unsigned int            magic;
        unsigned int            flags;
        isc_mem_t               *mctx;
        dns_zone_t              *zone;
        dns_adbfind_t           *find;
        dns_request_t           *request;
        dns_name_t              ns;
        isc_sockaddr_t          dst;
        dns_tsigkey_t           *key;
        isc_dscp_t              dscp;
        ISC_LINK(dns_notify_t)  link;
        isc_event_t             *event;
};

#define DNS_NOTIFY_NOSOA        0x0001U
#define DNS_NOTIFY_STARTUP      0x0002U

/*%
 *      dns_stub holds state while performing a 'stub' transfer.
 *      'db' is the zone's 'db' or a new one if this is the initial
 *      transfer.
 */

struct dns_stub {
        unsigned int            magic;
        isc_mem_t               *mctx;
        dns_zone_t              *zone;
        dns_db_t                *db;
        dns_dbversion_t         *version;
};

/*%
 *      Hold load state.
 */
struct dns_load {
        unsigned int            magic;
        isc_mem_t               *mctx;
        dns_zone_t              *zone;
        dns_db_t                *db;
        isc_time_t              loadtime;
        dns_rdatacallbacks_t    callbacks;
};

/*%
 *      Hold forward state.
 */
struct dns_forward {
        unsigned int            magic;
        isc_mem_t               *mctx;
        dns_zone_t              *zone;
        isc_buffer_t            *msgbuf;
        dns_request_t           *request;
        isc_uint32_t            which;
        isc_sockaddr_t          addr;
        dns_updatecallback_t    callback;
        void                    *callback_arg;
        unsigned int            options;
        ISC_LINK(dns_forward_t) link;
};

/*%
 *      Hold IO request state.
 */
struct dns_io {
        unsigned int    magic;
        dns_zonemgr_t   *zmgr;
        isc_boolean_t   high;
        isc_task_t      *task;
        ISC_LINK(dns_io_t) link;
        isc_event_t     *event;
};

/*%
 *      Hold state for when we are signing a zone with a new
 *      DNSKEY as result of an update.
 */
struct dns_signing {
        unsigned int            magic;
        dns_db_t                *db;
        dns_dbiterator_t        *dbiterator;
        dns_secalg_t            algorithm;
        isc_uint16_t            keyid;
        isc_boolean_t           delete;
        isc_boolean_t           done;
        ISC_LINK(dns_signing_t) link;
};

struct dns_nsec3chain {
        unsigned int                    magic;
        dns_db_t                        *db;
        dns_dbiterator_t                *dbiterator;
        dns_rdata_nsec3param_t          nsec3param;
        unsigned char                   salt[255];
        isc_boolean_t                   done;
        isc_boolean_t                   seen_nsec;
        isc_boolean_t                   delete_nsec;
        isc_boolean_t                   save_delete_nsec;
        ISC_LINK(dns_nsec3chain_t)      link;
};
/*%<
 * 'dbiterator' contains a iterator for the database.  If we are creating
 * a NSEC3 chain only the non-NSEC3 nodes will be iterated.  If we are
 * removing a NSEC3 chain then both NSEC3 and non-NSEC3 nodes will be
 * iterated.
 *
 * 'nsec3param' contains the parameters of the NSEC3 chain being created
 * or removed.
 *
 * 'salt' is buffer space and is referenced via 'nsec3param.salt'.
 *
 * 'seen_nsec' will be set to true if, while iterating the zone to create a
 * NSEC3 chain, a NSEC record is seen.
 *
 * 'delete_nsec' will be set to true if, at the completion of the creation
 * of a NSEC3 chain, 'seen_nsec' is true.  If 'delete_nsec' is true then we
 * are in the process of deleting the NSEC chain.
 *
 * 'save_delete_nsec' is used to store the initial state of 'delete_nsec'
 * so it can be recovered in the event of a error.
 */

struct dns_keyfetch {
        dns_fixedname_t name;
        dns_rdataset_t keydataset;
        dns_rdataset_t dnskeyset;
        dns_rdataset_t dnskeysigset;
        dns_zone_t *zone;
        dns_db_t *db;
        dns_fetch_t *fetch;
};

/*%
 * Hold state for an asynchronous load
 */
struct dns_asyncload {
        dns_zone_t *zone;
        dns_zt_zoneloaded_t loaded;
        void *loaded_arg;
};

/*%
 * Reference to an include file encountered during loading
 */
struct dns_include {
        char *name;
        isc_time_t filetime;
        ISC_LINK(dns_include_t) link;
};

/*
 * These can be overridden by the -T mkeytimers option on the command
 * line, so that we can test with shorter periods than specified in
 * RFC 5011.
 */
#define HOUR 3600
#define DAY (24*HOUR)
#define MONTH (30*DAY)
unsigned int dns_zone_mkey_hour = HOUR;
unsigned int dns_zone_mkey_day = DAY;
unsigned int dns_zone_mkey_month = MONTH;

#define SEND_BUFFER_SIZE 2048

static void zone_settimer(dns_zone_t *, isc_time_t *);
static void cancel_refresh(dns_zone_t *);
static void zone_debuglog(dns_zone_t *zone, const char *, int debuglevel,
                          const char *msg, ...) ISC_FORMAT_PRINTF(4, 5);
static void notify_log(dns_zone_t *zone, int level, const char *fmt, ...)
     ISC_FORMAT_PRINTF(3, 4);
static void queue_xfrin(dns_zone_t *zone);
static isc_result_t update_one_rr(dns_db_t *db, dns_dbversion_t *ver,
                                  dns_diff_t *diff, dns_diffop_t op,
                                  dns_name_t *name, dns_ttl_t ttl,
                                  dns_rdata_t *rdata);
static void zone_unload(dns_zone_t *zone);
static void zone_expire(dns_zone_t *zone);
static void zone_iattach(dns_zone_t *source, dns_zone_t **target);
static void zone_idetach(dns_zone_t **zonep);
static isc_result_t zone_replacedb(dns_zone_t *zone, dns_db_t *db,
                                   isc_boolean_t dump);
static inline void zone_attachdb(dns_zone_t *zone, dns_db_t *db);
static inline void zone_detachdb(dns_zone_t *zone);
static isc_result_t default_journal(dns_zone_t *zone);
static void zone_xfrdone(dns_zone_t *zone, isc_result_t result);
static isc_result_t zone_postload(dns_zone_t *zone, dns_db_t *db,
                                  isc_time_t loadtime, isc_result_t result);
static void zone_needdump(dns_zone_t *zone, unsigned int delay);
static void zone_shutdown(isc_task_t *, isc_event_t *);
static void zone_loaddone(void *arg, isc_result_t result);
static isc_result_t zone_startload(dns_db_t *db, dns_zone_t *zone,
                                   isc_time_t loadtime);
static void zone_namerd_tostr(dns_zone_t *zone, char *buf, size_t length);
static void zone_name_tostr(dns_zone_t *zone, char *buf, size_t length);
static void zone_rdclass_tostr(dns_zone_t *zone, char *buf, size_t length);
static void zone_viewname_tostr(dns_zone_t *zone, char *buf, size_t length);
static isc_result_t zone_send_secureserial(dns_zone_t *zone,
                                           isc_uint32_t serial);

#if 0
/* ondestroy example */
static void dns_zonemgr_dbdestroyed(isc_task_t *task, isc_event_t *event);
#endif

static void refresh_callback(isc_task_t *, isc_event_t *);
static void stub_callback(isc_task_t *, isc_event_t *);
static void queue_soa_query(dns_zone_t *zone);
static void soa_query(isc_task_t *, isc_event_t *);
static void ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset,
                     dns_stub_t *stub);
static int message_count(dns_message_t *msg, dns_section_t section,
                         dns_rdatatype_t type);
static void notify_cancel(dns_zone_t *zone);
static void notify_find_address(dns_notify_t *notify);
static void notify_send(dns_notify_t *notify);
static isc_result_t notify_createmessage(dns_zone_t *zone,
                                         unsigned int flags,
                                         dns_message_t **messagep);
static void notify_done(isc_task_t *task, isc_event_t *event);
static void notify_send_toaddr(isc_task_t *task, isc_event_t *event);
static isc_result_t zone_dump(dns_zone_t *, isc_boolean_t);
static void got_transfer_quota(isc_task_t *task, isc_event_t *event);
static isc_result_t zmgr_start_xfrin_ifquota(dns_zonemgr_t *zmgr,
                                             dns_zone_t *zone);
static void zmgr_resume_xfrs(dns_zonemgr_t *zmgr, isc_boolean_t multi);
static void zonemgr_free(dns_zonemgr_t *zmgr);
static isc_result_t zonemgr_getio(dns_zonemgr_t *zmgr, isc_boolean_t high,
                                  isc_task_t *task, isc_taskaction_t action,
                                  void *arg, dns_io_t **iop);
static void zonemgr_putio(dns_io_t **iop);
static void zonemgr_cancelio(dns_io_t *io);

static isc_result_t
zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,
                 unsigned int *soacount, isc_uint32_t *serial,
                 isc_uint32_t *refresh, isc_uint32_t *retry,
                 isc_uint32_t *expire, isc_uint32_t *minimum,
                 unsigned int *errors);

static void zone_freedbargs(dns_zone_t *zone);
static void forward_callback(isc_task_t *task, isc_event_t *event);
static void zone_saveunique(dns_zone_t *zone, const char *path,
                            const char *templat);
static void zone_maintenance(dns_zone_t *zone);
static void zone_notify(dns_zone_t *zone, isc_time_t *now);
static void dump_done(void *arg, isc_result_t result);
static isc_result_t zone_signwithkey(dns_zone_t *zone, dns_secalg_t algorithm,
                                     isc_uint16_t keyid, isc_boolean_t delete);
static isc_result_t delete_nsec(dns_db_t *db, dns_dbversion_t *ver,
                                dns_dbnode_t *node, dns_name_t *name,
                                dns_diff_t *diff);
static void zone_rekey(dns_zone_t *zone);
static isc_result_t zone_send_securedb(dns_zone_t *zone, dns_db_t *db);
static void setrl(isc_ratelimiter_t *rl, unsigned int *rate,
                  unsigned int value);

#define ENTER zone_debuglog(zone, me, 1, "enter")

static const unsigned int dbargc_default = 1;
static const char *dbargv_default[] = { "rbt" };

#define DNS_ZONE_JITTER_ADD(a, b, c) \
        do { \
                isc_interval_t _i; \
                isc_uint32_t _j; \
                _j = isc_random_jitter((b), (b)/4); \
                isc_interval_set(&_i, _j, 0); \
                if (isc_time_add((a), &_i, (c)) != ISC_R_SUCCESS) { \
                        dns_zone_log(zone, ISC_LOG_WARNING, \
                                     "epoch approaching: upgrade required: " \
                                     "now + %s failed", #b); \
                        isc_interval_set(&_i, _j/2, 0); \
                        (void)isc_time_add((a), &_i, (c)); \
                } \
        } while (0)

#define DNS_ZONE_TIME_ADD(a, b, c) \
        do { \
                isc_interval_t _i; \
                isc_interval_set(&_i, (b), 0); \
                if (isc_time_add((a), &_i, (c)) != ISC_R_SUCCESS) { \
                        dns_zone_log(zone, ISC_LOG_WARNING, \
                                     "epoch approaching: upgrade required: " \
                                     "now + %s failed", #b); \
                        isc_interval_set(&_i, (b)/2, 0); \
                        (void)isc_time_add((a), &_i, (c)); \
                } \
        } while (0)

typedef struct nsec3param nsec3param_t;
struct nsec3param {
        unsigned char data[DNS_NSEC3PARAM_BUFFERSIZE + 1];
        unsigned int length;
        isc_boolean_t nsec;
        isc_boolean_t replace;
        ISC_LINK(nsec3param_t)  link;
};
typedef ISC_LIST(nsec3param_t) nsec3paramlist_t;
struct np3event {
        isc_event_t event;
        nsec3param_t params;
};

struct ssevent {
        isc_event_t event;
        isc_uint32_t serial;
};

/*%
 * Increment resolver-related statistics counters.  Zone must be locked.
 */
static inline void
inc_stats(dns_zone_t *zone, isc_statscounter_t counter) {
        if (zone->stats != NULL)
                isc_stats_increment(zone->stats, counter);
}

/***
 ***    Public functions.
 ***/

isc_result_t
dns_zone_create(dns_zone_t **zonep, isc_mem_t *mctx) {
        isc_result_t result;
        dns_zone_t *zone;
        isc_time_t now;

        REQUIRE(zonep != NULL && *zonep == NULL);
        REQUIRE(mctx != NULL);

        TIME_NOW(&now);
        zone = isc_mem_get(mctx, sizeof(*zone));
        if (zone == NULL)
                return (ISC_R_NOMEMORY);

        zone->mctx = NULL;
        isc_mem_attach(mctx, &zone->mctx);

        result = isc_mutex_init(&zone->lock);
        if (result != ISC_R_SUCCESS)
                goto free_zone;

        result = ZONEDB_INITLOCK(&zone->dblock);
        if (result != ISC_R_SUCCESS)
                goto free_mutex;

        /* XXX MPA check that all elements are initialised */
#ifdef DNS_ZONE_CHECKLOCK
        zone->locked = ISC_FALSE;
#endif
        zone->db = NULL;
        zone->zmgr = NULL;
        ISC_LINK_INIT(zone, link);
        result = isc_refcount_init(&zone->erefs, 1);    /* Implicit attach. */
        if (result != ISC_R_SUCCESS)
                goto free_dblock;
        zone->irefs = 0;
        dns_name_init(&zone->origin, NULL);
        zone->strnamerd = NULL;
        zone->strname = NULL;
        zone->strrdclass = NULL;
        zone->strviewname = NULL;
        zone->masterfile = NULL;
        ISC_LIST_INIT(zone->includes);
        ISC_LIST_INIT(zone->newincludes);
        zone->nincludes = 0;
        zone->masterformat = dns_masterformat_none;
        zone->masterstyle = NULL;
        zone->keydirectory = NULL;
        zone->journalsize = -1;
        zone->journal = NULL;
        zone->rdclass = dns_rdataclass_none;
        zone->type = dns_zone_none;
        zone->flags = 0;
        zone->options = 0;
        zone->options2 = 0;
        zone->keyopts = 0;
        zone->db_argc = 0;
        zone->db_argv = NULL;
        isc_time_settoepoch(&zone->expiretime);
        isc_time_settoepoch(&zone->refreshtime);
        isc_time_settoepoch(&zone->dumptime);
        isc_time_settoepoch(&zone->loadtime);
        zone->notifytime = now;
        isc_time_settoepoch(&zone->resigntime);
        isc_time_settoepoch(&zone->keywarntime);
        isc_time_settoepoch(&zone->signingtime);
        isc_time_settoepoch(&zone->nsec3chaintime);
        isc_time_settoepoch(&zone->refreshkeytime);
        zone->refreshkeyinterval = 0;
        zone->refreshkeycount = 0;
        zone->refresh = DNS_ZONE_DEFAULTREFRESH;
        zone->retry = DNS_ZONE_DEFAULTRETRY;
        zone->expire = 0;
        zone->minimum = 0;
        zone->maxrefresh = DNS_ZONE_MAXREFRESH;
        zone->minrefresh = DNS_ZONE_MINREFRESH;
        zone->maxretry = DNS_ZONE_MAXRETRY;
        zone->minretry = DNS_ZONE_MINRETRY;
        zone->masters = NULL;
        zone->masterdscps = NULL;
        zone->masterkeynames = NULL;
        zone->mastersok = NULL;
        zone->masterscnt = 0;
        zone->curmaster = 0;
        zone->maxttl = 0;
        zone->notify = NULL;
        zone->notifykeynames = NULL;
        zone->notifydscp = NULL;
        zone->notifytype = dns_notifytype_yes;
        zone->notifycnt = 0;
        zone->task = NULL;
        zone->loadtask = NULL;
        zone->update_acl = NULL;
        zone->forward_acl = NULL;
        zone->notify_acl = NULL;
        zone->query_acl = NULL;
        zone->queryon_acl = NULL;
        zone->xfr_acl = NULL;
        zone->update_disabled = ISC_FALSE;
        zone->zero_no_soa_ttl = ISC_TRUE;
        zone->check_names = dns_severity_ignore;
        zone->request = NULL;
        zone->lctx = NULL;
        zone->readio = NULL;
        zone->dctx = NULL;
        zone->writeio = NULL;
        zone->timer = NULL;
        zone->idlein = DNS_DEFAULT_IDLEIN;
        zone->idleout = DNS_DEFAULT_IDLEOUT;
        zone->log_key_expired_timer = 0;
        ISC_LIST_INIT(zone->notifies);
        isc_sockaddr_any(&zone->notifysrc4);
        isc_sockaddr_any6(&zone->notifysrc6);
        isc_sockaddr_any(&zone->xfrsource4);
        isc_sockaddr_any6(&zone->xfrsource6);
        isc_sockaddr_any(&zone->altxfrsource4);
        isc_sockaddr_any6(&zone->altxfrsource6);
        zone->notifysrc4dscp = -1;
        zone->notifysrc6dscp = -1;
        zone->xfrsource4dscp = -1;
        zone->xfrsource6dscp = -1;
        zone->altxfrsource4dscp = -1;
        zone->altxfrsource6dscp = -1;
        zone->xfr = NULL;
        zone->tsigkey = NULL;
        zone->maxxfrin = MAX_XFER_TIME;
        zone->maxxfrout = MAX_XFER_TIME;
        zone->ssutable = NULL;
        zone->sigvalidityinterval = 30 * 24 * 3600;
        zone->sigresigninginterval = 7 * 24 * 3600;
        zone->view = NULL;
        zone->acache = NULL;
        zone->checkmx = NULL;
        zone->checksrv = NULL;
        zone->checkns = NULL;
        ISC_LINK_INIT(zone, statelink);
        zone->statelist = NULL;
        zone->stats = NULL;
        zone->requeststats_on = ISC_FALSE;
        zone->statlevel = dns_zonestat_none;
        zone->requeststats = NULL;
        zone->rcvquerystats = NULL;
        zone->notifydelay = 5;
        zone->isself = NULL;
        zone->isselfarg = NULL;
        ISC_LIST_INIT(zone->signing);
        ISC_LIST_INIT(zone->nsec3chain);
        zone->signatures = 10;
        zone->nodes = 100;
        zone->privatetype = (dns_rdatatype_t)0xffffU;
        zone->added = ISC_FALSE;
        zone->automatic = ISC_FALSE;
        zone->rpzs = NULL;
        zone->rpz_num = DNS_RPZ_INVALID_NUM;
        ISC_LIST_INIT(zone->forwards);
        zone->raw = NULL;
        zone->secure = NULL;
        zone->sourceserial = 0;
        zone->sourceserialset = ISC_FALSE;
        zone->requestixfr = ISC_TRUE;
        zone->requestexpire = ISC_TRUE;
        ISC_LIST_INIT(zone->rss_events);
        zone->rss_db = NULL;
        zone->rss_raw = NULL;
        zone->rss_newver = NULL;
        zone->rss_oldver = NULL;
        zone->rss_event = NULL;
        zone->rss_state = NULL;
        zone->updatemethod = dns_updatemethod_increment;

        zone->magic = ZONE_MAGIC;

        /* Must be after magic is set. */
        result = dns_zone_setdbtype(zone, dbargc_default, dbargv_default);
        if (result != ISC_R_SUCCESS)
                goto free_erefs;

        ISC_EVENT_INIT(&zone->ctlevent, sizeof(zone->ctlevent), 0, NULL,
                       DNS_EVENT_ZONECONTROL, zone_shutdown, zone, zone,
                       NULL, NULL);
        *zonep = zone;
        return (ISC_R_SUCCESS);

 free_erefs:
        isc_refcount_decrement(&zone->erefs, NULL);
        isc_refcount_destroy(&zone->erefs);

 free_dblock:
        ZONEDB_DESTROYLOCK(&zone->dblock);

 free_mutex:
        DESTROYLOCK(&zone->lock);

 free_zone:
        isc_mem_putanddetach(&zone->mctx, zone, sizeof(*zone));
        return (result);
}

/*
 * Free a zone.  Because we require that there be no more
 * outstanding events or references, no locking is necessary.
 */
static void
zone_free(dns_zone_t *zone) {
        isc_mem_t *mctx = NULL;
        dns_signing_t *signing;
        dns_nsec3chain_t *nsec3chain;
        dns_include_t *include;

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(isc_refcount_current(&zone->erefs) == 0);
        REQUIRE(zone->irefs == 0);
        REQUIRE(!LOCKED_ZONE(zone));
        REQUIRE(zone->timer == NULL);
        REQUIRE(zone->zmgr == NULL);

        /*
         * Managed objects.  Order is important.
         */
        if (zone->request != NULL)
                dns_request_destroy(&zone->request); /* XXXMPA */
        INSIST(zone->readio == NULL);
        INSIST(zone->statelist == NULL);
        INSIST(zone->writeio == NULL);

        if (zone->task != NULL)
                isc_task_detach(&zone->task);
        if (zone->loadtask != NULL)
                isc_task_detach(&zone->loadtask);

        /* Unmanaged objects */
        for (signing = ISC_LIST_HEAD(zone->signing);
             signing != NULL;
             signing = ISC_LIST_HEAD(zone->signing)) {
                ISC_LIST_UNLINK(zone->signing, signing, link);
                dns_db_detach(&signing->db);
                dns_dbiterator_destroy(&signing->dbiterator);
                isc_mem_put(zone->mctx, signing, sizeof *signing);
        }
        for (nsec3chain = ISC_LIST_HEAD(zone->nsec3chain);
             nsec3chain != NULL;
             nsec3chain = ISC_LIST_HEAD(zone->nsec3chain)) {
                ISC_LIST_UNLINK(zone->nsec3chain, nsec3chain, link);
                dns_db_detach(&nsec3chain->db);
                dns_dbiterator_destroy(&nsec3chain->dbiterator);
                isc_mem_put(zone->mctx, nsec3chain, sizeof *nsec3chain);
        }
        for (include = ISC_LIST_HEAD(zone->includes);
             include != NULL;
             include = ISC_LIST_HEAD(zone->includes)) {
                ISC_LIST_UNLINK(zone->includes, include, link);
                isc_mem_free(zone->mctx, include->name);
                isc_mem_put(zone->mctx, include, sizeof *include);
        }
        for (include = ISC_LIST_HEAD(zone->newincludes);
             include != NULL;
             include = ISC_LIST_HEAD(zone->newincludes)) {
                ISC_LIST_UNLINK(zone->newincludes, include, link);
                isc_mem_free(zone->mctx, include->name);
                isc_mem_put(zone->mctx, include, sizeof *include);
        }
        if (zone->masterfile != NULL)
                isc_mem_free(zone->mctx, zone->masterfile);
        zone->masterfile = NULL;
        if (zone->keydirectory != NULL)
                isc_mem_free(zone->mctx, zone->keydirectory);
        zone->keydirectory = NULL;
        zone->journalsize = -1;
        if (zone->journal != NULL)
                isc_mem_free(zone->mctx, zone->journal);
        zone->journal = NULL;
        if (zone->stats != NULL)
                isc_stats_detach(&zone->stats);
        if (zone->requeststats != NULL)
                isc_stats_detach(&zone->requeststats);
        if (zone->rcvquerystats != NULL)
                dns_stats_detach(&zone->rcvquerystats);
        if (zone->db != NULL)
                zone_detachdb(zone);
        if (zone->acache != NULL)
                dns_acache_detach(&zone->acache);
        if (zone->rpzs != NULL) {
                REQUIRE(zone->rpz_num < zone->rpzs->p.num_zones);
                dns_rpz_detach_rpzs(&zone->rpzs);
                zone->rpz_num = DNS_RPZ_INVALID_NUM;
        }
        zone_freedbargs(zone);
        RUNTIME_CHECK(dns_zone_setmasterswithkeys(zone, NULL, NULL, 0)
                      == ISC_R_SUCCESS);
        RUNTIME_CHECK(dns_zone_setalsonotify(zone, NULL, 0)
                      == ISC_R_SUCCESS);
        zone->check_names = dns_severity_ignore;
        if (zone->update_acl != NULL)
                dns_acl_detach(&zone->update_acl);
        if (zone->forward_acl != NULL)
                dns_acl_detach(&zone->forward_acl);
        if (zone->notify_acl != NULL)
                dns_acl_detach(&zone->notify_acl);
        if (zone->query_acl != NULL)
                dns_acl_detach(&zone->query_acl);
        if (zone->queryon_acl != NULL)
                dns_acl_detach(&zone->queryon_acl);
        if (zone->xfr_acl != NULL)
                dns_acl_detach(&zone->xfr_acl);
        if (dns_name_dynamic(&zone->origin))
                dns_name_free(&zone->origin, zone->mctx);
        if (zone->strnamerd != NULL)
                isc_mem_free(zone->mctx, zone->strnamerd);
        if (zone->strname != NULL)
                isc_mem_free(zone->mctx, zone->strname);
        if (zone->strrdclass != NULL)
                isc_mem_free(zone->mctx, zone->strrdclass);
        if (zone->strviewname != NULL)
                isc_mem_free(zone->mctx, zone->strviewname);
        if (zone->ssutable != NULL)
                dns_ssutable_detach(&zone->ssutable);

        /* last stuff */
        ZONEDB_DESTROYLOCK(&zone->dblock);
        DESTROYLOCK(&zone->lock);
        isc_refcount_destroy(&zone->erefs);
        zone->magic = 0;
        mctx = zone->mctx;
        isc_mem_put(mctx, zone, sizeof(*zone));
        isc_mem_detach(&mctx);
}

/*
 * Returns ISC_TRUE iff this the signed side of an inline-signing zone.
 * Caller should hold zone lock.
 */
static inline isc_boolean_t
inline_secure(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        if (zone->raw != NULL)
                return (ISC_TRUE);
        return (ISC_FALSE);
}

/*
 * Returns ISC_TRUE iff this the unsigned side of an inline-signing zone
 * Caller should hold zone lock.
 */
static inline isc_boolean_t
inline_raw(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        if (zone->secure != NULL)
                return (ISC_TRUE);
        return (ISC_FALSE);
}

/*
 *      Single shot.
 */
void
dns_zone_setclass(dns_zone_t *zone, dns_rdataclass_t rdclass) {
        char namebuf[1024];

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(rdclass != dns_rdataclass_none);

        /*
         * Test and set.
         */
        LOCK_ZONE(zone);
        INSIST(zone != zone->raw);
        REQUIRE(zone->rdclass == dns_rdataclass_none ||
                zone->rdclass == rdclass);
        zone->rdclass = rdclass;

        if (zone->strnamerd != NULL)
                isc_mem_free(zone->mctx, zone->strnamerd);
        if (zone->strrdclass != NULL)
                isc_mem_free(zone->mctx, zone->strrdclass);

        zone_namerd_tostr(zone, namebuf, sizeof namebuf);
        zone->strnamerd = isc_mem_strdup(zone->mctx, namebuf);
        zone_rdclass_tostr(zone, namebuf, sizeof namebuf);
        zone->strrdclass = isc_mem_strdup(zone->mctx, namebuf);

        if (inline_secure(zone))
                dns_zone_setclass(zone->raw, rdclass);
        UNLOCK_ZONE(zone);
}

dns_rdataclass_t
dns_zone_getclass(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->rdclass);
}

void
dns_zone_setnotifytype(dns_zone_t *zone, dns_notifytype_t notifytype) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->notifytype = notifytype;
        UNLOCK_ZONE(zone);
}

isc_result_t
dns_zone_getserial2(dns_zone_t *zone, isc_uint32_t *serialp) {
        isc_result_t result;
        unsigned int soacount;

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(serialp != NULL);

        LOCK_ZONE(zone);
        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db != NULL) {
                result = zone_get_from_db(zone, zone->db, NULL, &soacount,
                                          serialp, NULL, NULL, NULL, NULL,
                                          NULL);
                if (result == ISC_R_SUCCESS && soacount == 0)
                        result = ISC_R_FAILURE;
        } else
                result = DNS_R_NOTLOADED;
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
        UNLOCK_ZONE(zone);

        return (result);
}

isc_uint32_t
dns_zone_getserial(dns_zone_t *zone) {
        isc_result_t result;
        isc_uint32_t serial;

        result = dns_zone_getserial2(zone, &serial);
        if (result != ISC_R_SUCCESS)
                serial = 0; /* XXX: not really correct, but no other choice */

        return (serial);
}

/*
 *      Single shot.
 */
void
dns_zone_settype(dns_zone_t *zone, dns_zonetype_t type) {
        char namebuf[1024];

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(type != dns_zone_none);

        /*
         * Test and set.
         */
        LOCK_ZONE(zone);
        REQUIRE(zone->type == dns_zone_none || zone->type == type);
        zone->type = type;

        if (zone->strnamerd != NULL)
                isc_mem_free(zone->mctx, zone->strnamerd);

        zone_namerd_tostr(zone, namebuf, sizeof namebuf);
        zone->strnamerd = isc_mem_strdup(zone->mctx, namebuf);
        UNLOCK_ZONE(zone);
}

static void
zone_freedbargs(dns_zone_t *zone) {
        unsigned int i;

        /* Free the old database argument list. */
        if (zone->db_argv != NULL) {
                for (i = 0; i < zone->db_argc; i++)
                        isc_mem_free(zone->mctx, zone->db_argv[i]);
                isc_mem_put(zone->mctx, zone->db_argv,
                            zone->db_argc * sizeof(*zone->db_argv));
        }
        zone->db_argc = 0;
        zone->db_argv = NULL;
}

isc_result_t
dns_zone_getdbtype(dns_zone_t *zone, char ***argv, isc_mem_t *mctx) {
        size_t size = 0;
        unsigned int i;
        isc_result_t result = ISC_R_SUCCESS;
        void *mem;
        char **tmp, *tmp2;

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(argv != NULL && *argv == NULL);

        LOCK_ZONE(zone);
        size = (zone->db_argc + 1) * sizeof(char *);
        for (i = 0; i < zone->db_argc; i++)
                size += strlen(zone->db_argv[i]) + 1;
        mem = isc_mem_allocate(mctx, size);
        if (mem != NULL) {
                tmp = mem;
                tmp2 = mem;
                tmp2 += (zone->db_argc + 1) * sizeof(char *);
                for (i = 0; i < zone->db_argc; i++) {
                        *tmp++ = tmp2;
                        strcpy(tmp2, zone->db_argv[i]);
                        tmp2 += strlen(tmp2) + 1;
                }
                *tmp = NULL;
        } else
                result = ISC_R_NOMEMORY;
        UNLOCK_ZONE(zone);
        *argv = mem;
        return (result);
}

isc_result_t
dns_zone_setdbtype(dns_zone_t *zone,
                   unsigned int dbargc, const char * const *dbargv) {
        isc_result_t result = ISC_R_SUCCESS;
        char **new = NULL;
        unsigned int i;

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(dbargc >= 1);
        REQUIRE(dbargv != NULL);

        LOCK_ZONE(zone);

        /* Set up a new database argument list. */
        new = isc_mem_get(zone->mctx, dbargc * sizeof(*new));
        if (new == NULL)
                goto nomem;
        for (i = 0; i < dbargc; i++)
                new[i] = NULL;
        for (i = 0; i < dbargc; i++) {
                new[i] = isc_mem_strdup(zone->mctx, dbargv[i]);
                if (new[i] == NULL)
                        goto nomem;
        }

        /* Free the old list. */
        zone_freedbargs(zone);

        zone->db_argc = dbargc;
        zone->db_argv = new;
        result = ISC_R_SUCCESS;
        goto unlock;

 nomem:
        if (new != NULL) {
                for (i = 0; i < dbargc; i++)
                        if (new[i] != NULL)
                                isc_mem_free(zone->mctx, new[i]);
                isc_mem_put(zone->mctx, new, dbargc * sizeof(*new));
        }
        result = ISC_R_NOMEMORY;

 unlock:
        UNLOCK_ZONE(zone);
        return (result);
}

void
dns_zone_setview(dns_zone_t *zone, dns_view_t *view) {
        char namebuf[1024];
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        INSIST(zone != zone->raw);
        if (zone->view != NULL)
                dns_view_weakdetach(&zone->view);
        dns_view_weakattach(view, &zone->view);

        if (zone->strviewname != NULL)
                isc_mem_free(zone->mctx, zone->strviewname);
        if (zone->strnamerd != NULL)
                isc_mem_free(zone->mctx, zone->strnamerd);

        zone_namerd_tostr(zone, namebuf, sizeof namebuf);
        zone->strnamerd = isc_mem_strdup(zone->mctx, namebuf);
        zone_viewname_tostr(zone, namebuf, sizeof namebuf);
        zone->strviewname = isc_mem_strdup(zone->mctx, namebuf);

        if (inline_secure(zone))
                dns_zone_setview(zone->raw, view);

        UNLOCK_ZONE(zone);
}

dns_view_t *
dns_zone_getview(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->view);
}


isc_result_t
dns_zone_setorigin(dns_zone_t *zone, const dns_name_t *origin) {
        isc_result_t result;
        char namebuf[1024];

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(origin != NULL);

        LOCK_ZONE(zone);
        INSIST(zone != zone->raw);
        if (dns_name_dynamic(&zone->origin)) {
                dns_name_free(&zone->origin, zone->mctx);
                dns_name_init(&zone->origin, NULL);
        }
        result = dns_name_dup(origin, zone->mctx, &zone->origin);

        if (zone->strnamerd != NULL)
                isc_mem_free(zone->mctx, zone->strnamerd);
        if (zone->strname != NULL)
                isc_mem_free(zone->mctx, zone->strname);

        zone_namerd_tostr(zone, namebuf, sizeof namebuf);
        zone->strnamerd = isc_mem_strdup(zone->mctx, namebuf);
        zone_name_tostr(zone, namebuf, sizeof namebuf);
        zone->strname = isc_mem_strdup(zone->mctx, namebuf);

        if (result == ISC_R_SUCCESS && inline_secure(zone))
                result = dns_zone_setorigin(zone->raw, origin);
        UNLOCK_ZONE(zone);
        return (result);
}

void
dns_zone_setacache(dns_zone_t *zone, dns_acache_t *acache) {
        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(acache != NULL);

        LOCK_ZONE(zone);
        if (zone->acache != NULL)
                dns_acache_detach(&zone->acache);
        dns_acache_attach(acache, &zone->acache);
        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db != NULL) {
                isc_result_t result;

                /*
                 * If the zone reuses an existing DB, the DB needs to be
                 * set in the acache explicitly.  We can safely ignore the
                 * case where the DB is already set.  If other error happens,
                 * the acache will not work effectively.
                 */
                result = dns_acache_setdb(acache, zone->db);
                if (result != ISC_R_SUCCESS && result != ISC_R_EXISTS) {
                        UNEXPECTED_ERROR(__FILE__, __LINE__,
                                         "dns_acache_setdb() failed: %s",
                                         isc_result_totext(result));
                }
        }
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
        UNLOCK_ZONE(zone);
}

static isc_result_t
dns_zone_setstring(dns_zone_t *zone, char **field, const char *value) {
        char *copy;

        if (value != NULL) {
                copy = isc_mem_strdup(zone->mctx, value);
                if (copy == NULL)
                        return (ISC_R_NOMEMORY);
        } else {
                copy = NULL;
        }

        if (*field != NULL)
                isc_mem_free(zone->mctx, *field);

        *field = copy;
        return (ISC_R_SUCCESS);
}

isc_result_t
dns_zone_setfile(dns_zone_t *zone, const char *file) {
        return (dns_zone_setfile3(zone, file, dns_masterformat_text,
                                  &dns_master_style_default));
}

isc_result_t
dns_zone_setfile2(dns_zone_t *zone, const char *file,
                  dns_masterformat_t format)
{
        return (dns_zone_setfile3(zone, file, format,
                                  &dns_master_style_default));
}

isc_result_t
dns_zone_setfile3(dns_zone_t *zone, const char *file,
                  dns_masterformat_t format,
                  const dns_master_style_t *style)
{
        isc_result_t result = ISC_R_SUCCESS;

        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        result = dns_zone_setstring(zone, &zone->masterfile, file);
        if (result == ISC_R_SUCCESS) {
                zone->masterformat = format;
                if (format == dns_masterformat_text)
                        zone->masterstyle = style;
                result = default_journal(zone);
        }
        UNLOCK_ZONE(zone);

        return (result);
}

const char *
dns_zone_getfile(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->masterfile);
}

dns_ttl_t
dns_zone_getmaxttl(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->maxttl);
}

void
dns_zone_setmaxttl(dns_zone_t *zone, dns_ttl_t maxttl) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        if (maxttl != 0)
                zone->options2 |= DNS_ZONEOPT2_CHECKTTL;
        else
                zone->options2 &= ~DNS_ZONEOPT2_CHECKTTL;
        zone->maxttl = maxttl;
        UNLOCK_ZONE(zone);

        return;
}

static isc_result_t
default_journal(dns_zone_t *zone) {
        isc_result_t result;
        char *journal;

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(LOCKED_ZONE(zone));

        if (zone->masterfile != NULL) {
                /* Calculate string length including '\0'. */
                int len = strlen(zone->masterfile) + sizeof(".jnl");
                journal = isc_mem_allocate(zone->mctx, len);
                if (journal == NULL)
                        return (ISC_R_NOMEMORY);
                strcpy(journal, zone->masterfile);
                strcat(journal, ".jnl");
        } else {
                journal = NULL;
        }
        result = dns_zone_setstring(zone, &zone->journal, journal);
        if (journal != NULL)
                isc_mem_free(zone->mctx, journal);
        return (result);
}

isc_result_t
dns_zone_setjournal(dns_zone_t *zone, const char *myjournal) {
        isc_result_t result = ISC_R_SUCCESS;

        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        result = dns_zone_setstring(zone, &zone->journal, myjournal);
        UNLOCK_ZONE(zone);

        return (result);
}

char *
dns_zone_getjournal(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->journal);
}

/*
 * Return true iff the zone is "dynamic", in the sense that the zone's
 * master file (if any) is written by the server, rather than being
 * updated manually and read by the server.
 *
 * This is true for slave zones, stub zones, key zones, and zones that
 * allow dynamic updates either by having an update policy ("ssutable")
 * or an "allow-update" ACL with a value other than exactly "{ none; }".
 */
isc_boolean_t
dns_zone_isdynamic(dns_zone_t *zone, isc_boolean_t ignore_freeze) {
        REQUIRE(DNS_ZONE_VALID(zone));

        if (zone->type == dns_zone_slave || zone->type == dns_zone_stub ||
            zone->type == dns_zone_key ||
            (zone->type == dns_zone_redirect && zone->masters != NULL))
                return (ISC_TRUE);

        /* If !ignore_freeze, we need check whether updates are disabled.  */
        if (zone->type == dns_zone_master &&
            (!zone->update_disabled || ignore_freeze) &&
            ((zone->ssutable != NULL) ||
             (zone->update_acl != NULL && !dns_acl_isnone(zone->update_acl))))
                return (ISC_TRUE);

        return (ISC_FALSE);

}

/*
 * Set the response policy index and information for a zone.
 */
isc_result_t
dns_zone_rpz_enable(dns_zone_t *zone, dns_rpz_zones_t *rpzs,
                    dns_rpz_num_t rpz_num)
{
        /*
         * Only RBTDB zones can be used for response policy zones,
         * because only they have the code to load the create the summary data.
         * Only zones that are loaded instead of mmap()ed create the
         * summary data and so can be policy zones.
         */
        if (strcmp(zone->db_argv[0], "rbt") != 0 &&
            strcmp(zone->db_argv[0], "rbt64") != 0)
                return (ISC_R_NOTIMPLEMENTED);

        /*
         * This must happen only once or be redundant.
         */
        LOCK_ZONE(zone);
        if (zone->rpzs != NULL) {
                REQUIRE(zone->rpzs == rpzs && zone->rpz_num == rpz_num);
        } else {
                REQUIRE(zone->rpz_num == DNS_RPZ_INVALID_NUM);
                dns_rpz_attach_rpzs(rpzs, &zone->rpzs);
                zone->rpz_num = rpz_num;
        }
        rpzs->defined |= DNS_RPZ_ZBIT(rpz_num);
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

dns_rpz_num_t
dns_zone_get_rpz_num(dns_zone_t *zone) {
        return (zone->rpz_num);
}

/*
 * If a zone is a response policy zone, mark its new database.
 */
void
dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) {
        if (zone->rpz_num != DNS_RPZ_INVALID_NUM) {
                REQUIRE(zone->rpzs != NULL);
                dns_db_rpz_attach(db, zone->rpzs, zone->rpz_num);
        }
}

static isc_boolean_t
zone_touched(dns_zone_t *zone) {
        isc_result_t result;
        isc_time_t modtime;
        dns_include_t *include;

        REQUIRE(DNS_ZONE_VALID(zone));

        result = isc_file_getmodtime(zone->masterfile, &modtime);
        if (result != ISC_R_SUCCESS ||
            isc_time_compare(&modtime, &zone->loadtime) > 0)
        {
                zone->loadtime = modtime;
                return (ISC_TRUE);
        }

        for (include = ISC_LIST_HEAD(zone->includes);
             include != NULL;
             include = ISC_LIST_NEXT(include, link))
        {
                result = isc_file_getmodtime(include->name, &modtime);
                if (result != ISC_R_SUCCESS ||
                    isc_time_compare(&modtime, &include->filetime) > 0)
                        return (ISC_TRUE);
        }


        return (ISC_FALSE);
}

static isc_result_t
zone_load(dns_zone_t *zone, unsigned int flags, isc_boolean_t locked) {
        isc_result_t result;
        isc_time_t now;
        isc_time_t loadtime;
        dns_db_t *db = NULL;
        isc_boolean_t rbt, hasraw;

        REQUIRE(DNS_ZONE_VALID(zone));

        if (!locked)
                LOCK_ZONE(zone);

        INSIST(zone != zone->raw);
        hasraw = inline_secure(zone);
        if (hasraw) {
                result = zone_load(zone->raw, flags, ISC_FALSE);
                if (result != ISC_R_SUCCESS) {
                        if (!locked)
                                UNLOCK_ZONE(zone);
                        return(result);
                }
                LOCK_ZONE(zone->raw);
        }

        TIME_NOW(&now);

        INSIST(zone->type != dns_zone_none);

        if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADING)) {
                if ((flags & DNS_ZONELOADFLAG_THAW) != 0)
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_THAW);
                result = DNS_R_CONTINUE;
                goto cleanup;
        }

        INSIST(zone->db_argc >= 1);

        rbt = strcmp(zone->db_argv[0], "rbt") == 0 ||
              strcmp(zone->db_argv[0], "rbt64") == 0;

        if (zone->db != NULL && zone->masterfile == NULL && rbt) {
                /*
                 * The zone has no master file configured.
                 */
                result = ISC_R_SUCCESS;
                goto cleanup;
        }

        if (zone->db != NULL && dns_zone_isdynamic(zone, ISC_FALSE)) {
                /*
                 * This is a slave, stub, or dynamically updated
                 * zone being reloaded.  Do nothing - the database
                 * we already have is guaranteed to be up-to-date.
                 */
                if (zone->type == dns_zone_master)
                        result = DNS_R_DYNAMIC;
                else
                        result = ISC_R_SUCCESS;
                goto cleanup;
        }

        /*
         * Store the current time before the zone is loaded, so that if the
         * file changes between the time of the load and the time that
         * zone->loadtime is set, then the file will still be reloaded
         * the next time dns_zone_load is called.
         */
        TIME_NOW(&loadtime);

        /*
         * Don't do the load if the file that stores the zone is older
         * than the last time the zone was loaded.  If the zone has not
         * been loaded yet, zone->loadtime will be the epoch.
         */
        if (zone->masterfile != NULL) {
                /*
                 * The file is already loaded.  If we are just doing a
                 * "rndc reconfig", we are done.
                 */
                if (!isc_time_isepoch(&zone->loadtime) &&
                    (flags & DNS_ZONELOADFLAG_NOSTAT) != 0) {
                        result = ISC_R_SUCCESS;
                        goto cleanup;
                }

                if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED) &&
                    !zone_touched(zone))
                {
                        dns_zone_log(zone, ISC_LOG_DEBUG(1),
                                     "skipping load: master file "
                                     "older than last load");
                        result = DNS_R_UPTODATE;
                        goto cleanup;
                }
        }

        /*
         * Built in zones (with the exception of empty zones) don't need
         * to be reloaded.
         */
        if (zone->type == dns_zone_master &&
            strcmp(zone->db_argv[0], "_builtin") == 0 &&
            (zone->db_argc < 2 || strcmp(zone->db_argv[1], "empty") != 0) &&
            DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) {
                result = ISC_R_SUCCESS;
                goto cleanup;
        }

        /*
         * Zones associated with a DLZ don't need to be loaded either,
         * but we need to associate the database with the zone object.
         */
        if (strcmp(zone->db_argv[0], "dlz") == 0) {
                dns_dlzdb_t *dlzdb;
                dns_dlzfindzone_t findzone;

                for (dlzdb = ISC_LIST_HEAD(zone->view->dlz_unsearched);
                     dlzdb != NULL;
                     dlzdb = ISC_LIST_NEXT(dlzdb, link))
                {
                        INSIST(DNS_DLZ_VALID(dlzdb));
                        if (strcmp(zone->db_argv[1], dlzdb->dlzname) == 0)
                                break;
                }

                if (dlzdb == NULL) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "DLZ %s does not exist or is set "
                                     "to 'search yes;'", zone->db_argv[1]);
                        result = ISC_R_NOTFOUND;
                        goto cleanup;
                }

                ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
                /* ask SDLZ driver if the zone is supported */
                findzone = dlzdb->implementation->methods->findzone;
                result = (*findzone)(dlzdb->implementation->driverarg,
                                     dlzdb->dbdata, dlzdb->mctx,
                                     zone->view->rdclass, &zone->origin,
                                     NULL, NULL, &db);
                if (result != ISC_R_NOTFOUND) {
                        if (zone->db != NULL)
                                zone_detachdb(zone);
                        zone_attachdb(zone, db);
                        dns_db_detach(&db);
                        result = ISC_R_SUCCESS;
                }
                ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);

                if (result == ISC_R_SUCCESS) {
                        if (dlzdb->configure_callback == NULL)
                                goto cleanup;

                        result = (*dlzdb->configure_callback)(zone->view,
                                                              dlzdb, zone);
                        if (result != ISC_R_SUCCESS)
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "DLZ configuration callback: %s",
                                             isc_result_totext(result));
                }
                goto cleanup;
        }

        if ((zone->type == dns_zone_slave || zone->type == dns_zone_stub ||
             (zone->type == dns_zone_redirect && zone->masters != NULL)) &&
            rbt) {
                if (zone->masterfile == NULL ||
                    !isc_file_exists(zone->masterfile)) {
                        if (zone->masterfile != NULL) {
                                dns_zone_log(zone, ISC_LOG_DEBUG(1),
                                             "no master file");
                        }
                        zone->refreshtime = now;
                        if (zone->task != NULL)
                                zone_settimer(zone, &now);
                        result = ISC_R_SUCCESS;
                        goto cleanup;
                }
        }

        dns_zone_log(zone, ISC_LOG_DEBUG(1), "starting load");

        result = dns_db_create(zone->mctx, zone->db_argv[0],
                               &zone->origin, (zone->type == dns_zone_stub) ?
                               dns_dbtype_stub : dns_dbtype_zone,
                               zone->rdclass,
                               zone->db_argc - 1, zone->db_argv + 1,
                               &db);

        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "loading zone: creating database: %s",
                             isc_result_totext(result));
                goto cleanup;
        }
        dns_db_settask(db, zone->task);

        if (! dns_db_ispersistent(db)) {
                if (zone->masterfile != NULL) {
                        result = zone_startload(db, zone, loadtime);
                } else {
                        result = DNS_R_NOMASTERFILE;
                        if (zone->type == dns_zone_master ||
                            (zone->type == dns_zone_redirect &&
                             zone->masters == NULL)) {
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "loading zone: "
                                             "no master file configured");
                                goto cleanup;
                        }
                        dns_zone_log(zone, ISC_LOG_INFO, "loading zone: "
                                     "no master file configured: continuing");
                }
        }

        if (result == DNS_R_CONTINUE) {
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADING);
                if ((flags & DNS_ZONELOADFLAG_THAW) != 0)
                        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_THAW);
                goto cleanup;
        }

        result = zone_postload(zone, db, loadtime, result);

 cleanup:
        if (hasraw)
                UNLOCK_ZONE(zone->raw);
        if (!locked)
                UNLOCK_ZONE(zone);
        if (db != NULL)
                dns_db_detach(&db);
        return (result);
}

isc_result_t
dns_zone_load(dns_zone_t *zone) {
        return (zone_load(zone, 0, ISC_FALSE));
}

isc_result_t
dns_zone_loadnew(dns_zone_t *zone) {
        return (zone_load(zone, DNS_ZONELOADFLAG_NOSTAT, ISC_FALSE));
}

static void
zone_asyncload(isc_task_t *task, isc_event_t *event) {
        dns_asyncload_t *asl = event->ev_arg;
        dns_zone_t *zone = asl->zone;
        isc_result_t result = ISC_R_SUCCESS;
        isc_boolean_t load_pending;

        UNUSED(task);

        REQUIRE(DNS_ZONE_VALID(zone));

        if ((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0)
                result = ISC_R_CANCELED;
        isc_event_free(&event);

        if (result == ISC_R_CANCELED)
                goto cleanup;

        /* Make sure load is still pending */
        LOCK_ZONE(zone);
        load_pending = ISC_TF(DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING));

        if (!load_pending) {
                UNLOCK_ZONE(zone);
                goto cleanup;
        }

        zone_load(zone, 0, ISC_TRUE);

        DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_LOADPENDING);
        UNLOCK_ZONE(zone);

        /* Inform the zone table we've finished loading */
        if (asl->loaded != NULL)
                (asl->loaded)(asl->loaded_arg, zone, task);

 cleanup:
        isc_mem_put(zone->mctx, asl, sizeof (*asl));
        dns_zone_idetach(&zone);
}

isc_result_t
dns_zone_asyncload(dns_zone_t *zone, dns_zt_zoneloaded_t done, void *arg) {
        isc_event_t *e;
        dns_asyncload_t *asl = NULL;
        isc_result_t result = ISC_R_SUCCESS;

        REQUIRE(DNS_ZONE_VALID(zone));

        if (zone->zmgr == NULL)
                return (ISC_R_FAILURE);

        /* If we already have a load pending, stop now */
        if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING))
                return (ISC_R_ALREADYRUNNING);

        asl = isc_mem_get(zone->mctx, sizeof (*asl));
        if (asl == NULL)
                CHECK(ISC_R_NOMEMORY);

        asl->zone = NULL;
        asl->loaded = done;
        asl->loaded_arg = arg;

        e = isc_event_allocate(zone->zmgr->mctx, zone->zmgr,
                               DNS_EVENT_ZONELOAD,
                               zone_asyncload, asl,
                               sizeof(isc_event_t));
        if (e == NULL)
                CHECK(ISC_R_NOMEMORY);

        LOCK_ZONE(zone);
        zone_iattach(zone, &asl->zone);
        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADPENDING);
        isc_task_send(zone->loadtask, &e);
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);

  failure:
        if (asl != NULL)
                isc_mem_put(zone->mctx, asl, sizeof (*asl));
        return (result);
}

isc_boolean_t
dns__zone_loadpending(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (ISC_TF(DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADPENDING)));
}

isc_result_t
dns_zone_loadandthaw(dns_zone_t *zone) {
        isc_result_t result;

        if (inline_raw(zone))
                result = zone_load(zone->secure, DNS_ZONELOADFLAG_THAW,
                                   ISC_FALSE);
        else
                result = zone_load(zone, DNS_ZONELOADFLAG_THAW, ISC_FALSE);

        switch (result) {
        case DNS_R_CONTINUE:
                /* Deferred thaw. */
                break;
        case DNS_R_UPTODATE:
        case ISC_R_SUCCESS:
        case DNS_R_SEENINCLUDE:
                zone->update_disabled = ISC_FALSE;
                break;
        case DNS_R_NOMASTERFILE:
                zone->update_disabled = ISC_FALSE;
                break;
        default:
                /* Error, remain in disabled state. */
                break;
        }
        return (result);
}

static unsigned int
get_master_options(dns_zone_t *zone) {
        unsigned int options;

        options = DNS_MASTER_ZONE | DNS_MASTER_RESIGN;
        if (zone->type == dns_zone_slave ||
            (zone->type == dns_zone_redirect && zone->masters == NULL))
                options |= DNS_MASTER_SLAVE;
        if (zone->type == dns_zone_key)
                options |= DNS_MASTER_KEY;
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKNS))
                options |= DNS_MASTER_CHECKNS;
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_FATALNS))
                options |= DNS_MASTER_FATALNS;
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKNAMES))
                options |= DNS_MASTER_CHECKNAMES;
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKNAMESFAIL))
                options |= DNS_MASTER_CHECKNAMESFAIL;
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKMX))
                options |= DNS_MASTER_CHECKMX;
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKMXFAIL))
                options |= DNS_MASTER_CHECKMXFAIL;
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKWILDCARD))
                options |= DNS_MASTER_CHECKWILDCARD;
        if (DNS_ZONE_OPTION2(zone, DNS_ZONEOPT2_CHECKTTL))
                options |= DNS_MASTER_CHECKTTL;
        return (options);
}

static void
zone_registerinclude(const char *filename, void *arg) {
        isc_result_t result;
        dns_zone_t *zone = (dns_zone_t *) arg;
        dns_include_t *inc = NULL;

        REQUIRE(DNS_ZONE_VALID(zone));

        if (filename == NULL)
                return;

        /*
         * Suppress duplicates.
         */
        for (inc = ISC_LIST_HEAD(zone->newincludes);
             inc != NULL;
             inc = ISC_LIST_NEXT(inc, link))
                if (strcmp(filename, inc->name) == 0)
                        return;

        inc = isc_mem_get(zone->mctx, sizeof(dns_include_t));
        if (inc == NULL)
                return;
        inc->name = isc_mem_strdup(zone->mctx, filename);
        if (inc->name == NULL) {
                isc_mem_put(zone->mctx, inc, sizeof(dns_include_t));
                return;
        }
        ISC_LINK_INIT(inc, link);

        result = isc_file_getmodtime(filename, &inc->filetime);
        if (result != ISC_R_SUCCESS)
                isc_time_settoepoch(&inc->filetime);

        ISC_LIST_APPEND(zone->newincludes, inc, link);
}

static void
zone_gotreadhandle(isc_task_t *task, isc_event_t *event) {
        dns_load_t *load = event->ev_arg;
        isc_result_t result = ISC_R_SUCCESS;
        unsigned int options;

        REQUIRE(DNS_LOAD_VALID(load));

        if ((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0)
                result = ISC_R_CANCELED;
        isc_event_free(&event);
        if (result == ISC_R_CANCELED)
                goto fail;

        options = get_master_options(load->zone);

        result = dns_master_loadfileinc5(load->zone->masterfile,
                                         dns_db_origin(load->db),
                                         dns_db_origin(load->db),
                                         load->zone->rdclass, options, 0,
                                         &load->callbacks, task,
                                         zone_loaddone, load,
                                         &load->zone->lctx,
                                         zone_registerinclude,
                                         load->zone, load->zone->mctx,
                                         load->zone->masterformat,
                                         load->zone->maxttl);
        if (result != ISC_R_SUCCESS && result != DNS_R_CONTINUE &&
            result != DNS_R_SEENINCLUDE)
                goto fail;
        return;

 fail:
        zone_loaddone(load, result);
}

static void
get_raw_serial(dns_zone_t *raw, dns_masterrawheader_t *rawdata) {
        isc_result_t result;
        unsigned int soacount;

        LOCK(&raw->lock);
        if (raw->db != NULL) {
                result = zone_get_from_db(raw, raw->db, NULL, &soacount,
                                          &rawdata->sourceserial,
                                          NULL, NULL, NULL, NULL,
                                          NULL);
                if (result == ISC_R_SUCCESS && soacount > 0U)
                        rawdata->flags |= DNS_MASTERRAW_SOURCESERIALSET;
        }
        UNLOCK(&raw->lock);
}

static void
zone_gotwritehandle(isc_task_t *task, isc_event_t *event) {
        const char me[] = "zone_gotwritehandle";
        dns_zone_t *zone = event->ev_arg;
        isc_result_t result = ISC_R_SUCCESS;
        dns_dbversion_t *version = NULL;
        dns_masterrawheader_t rawdata;

        REQUIRE(DNS_ZONE_VALID(zone));
        INSIST(task == zone->task);
        ENTER;

        if ((event->ev_attributes & ISC_EVENTATTR_CANCELED) != 0)
                result = ISC_R_CANCELED;
        isc_event_free(&event);
        if (result == ISC_R_CANCELED)
                goto fail;

        LOCK_ZONE(zone);
        INSIST(zone != zone->raw);
        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db != NULL) {
                const dns_master_style_t *output_style;

                dns_db_currentversion(zone->db, &version);
                dns_master_initrawheader(&rawdata);
                if (inline_secure(zone))
                        get_raw_serial(zone->raw, &rawdata);
                if (zone->type == dns_zone_key)
                        output_style = &dns_master_style_keyzone;
                else if (zone->masterstyle != NULL)
                        output_style = zone->masterstyle;
                else
                        output_style = &dns_master_style_default;
                result = dns_master_dumpinc3(zone->mctx, zone->db, version,
                                             output_style, zone->masterfile,
                                             zone->task, dump_done, zone,                                                    &zone->dctx, zone->masterformat,
                                             &rawdata);
                dns_db_closeversion(zone->db, &version, ISC_FALSE);
        } else
                result = ISC_R_CANCELED;
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
        UNLOCK_ZONE(zone);
        if (result != DNS_R_CONTINUE)
                goto fail;
        return;

 fail:
        dump_done(zone, result);
}

/*
 * Save the raw serial number for inline-signing zones.
 * (XXX: Other information from the header will be used
 * for other purposes in the future, but for now this is
 * all we're interested in.)
 */
static void
zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) {
        if ((header->flags & DNS_MASTERRAW_SOURCESERIALSET) == 0)
                return;

        zone->sourceserial = header->sourceserial;
        zone->sourceserialset = ISC_TRUE;
}

void
dns_zone_setrawdata(dns_zone_t *zone, dns_masterrawheader_t *header) {
        if (zone == NULL)
                return;

        LOCK_ZONE(zone);
        zone_setrawdata(zone, header);
        UNLOCK_ZONE(zone);
}

static isc_result_t
zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) {
        dns_load_t *load;
        isc_result_t result;
        isc_result_t tresult;
        unsigned int options;

        dns_zone_rpz_enable_db(zone, db);
        options = get_master_options(zone);
        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS))
                options |= DNS_MASTER_MANYERRORS;

        if (zone->zmgr != NULL && zone->db != NULL && zone->loadtask != NULL) {
                load = isc_mem_get(zone->mctx, sizeof(*load));
                if (load == NULL)
                        return (ISC_R_NOMEMORY);

                load->mctx = NULL;
                load->zone = NULL;
                load->db = NULL;
                load->loadtime = loadtime;
                load->magic = LOAD_MAGIC;

                isc_mem_attach(zone->mctx, &load->mctx);
                zone_iattach(zone, &load->zone);
                dns_db_attach(db, &load->db);
                dns_rdatacallbacks_init(&load->callbacks);
                load->callbacks.rawdata = zone_setrawdata;
                zone_iattach(zone, &load->callbacks.zone);
                result = dns_db_beginload(db, &load->callbacks);
                if (result != ISC_R_SUCCESS)
                        goto cleanup;
                result = zonemgr_getio(zone->zmgr, ISC_TRUE, zone->loadtask,
                                       zone_gotreadhandle, load,
                                       &zone->readio);
                if (result != ISC_R_SUCCESS) {
                        /*
                         * We can't report multiple errors so ignore
                         * the result of dns_db_endload().
                         */
                        (void)dns_db_endload(load->db, &load->callbacks);
                        goto cleanup;
                } else
                        result = DNS_R_CONTINUE;
        } else {
                dns_rdatacallbacks_t callbacks;

                dns_rdatacallbacks_init(&callbacks);
                callbacks.rawdata = zone_setrawdata;
                zone_iattach(zone, &callbacks.zone);
                result = dns_db_beginload(db, &callbacks);
                if (result != ISC_R_SUCCESS) {
                        zone_idetach(&callbacks.zone);
                        return (result);
                }
                result = dns_master_loadfile5(zone->masterfile,
                                              &zone->origin, &zone->origin,
                                              zone->rdclass, options, 0,
                                              &callbacks,
                                              zone_registerinclude,
                                              zone, zone->mctx,
                                              zone->masterformat,
                                              zone->maxttl);
                tresult = dns_db_endload(db, &callbacks);
                if (result == ISC_R_SUCCESS)
                        result = tresult;
                zone_idetach(&callbacks.zone);
        }

        return (result);

 cleanup:
        load->magic = 0;
        dns_db_detach(&load->db);
        zone_idetach(&load->zone);
        zone_idetach(&load->callbacks.zone);
        isc_mem_detach(&load->mctx);
        isc_mem_put(zone->mctx, load, sizeof(*load));
        return (result);
}

static isc_boolean_t
zone_check_mx(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
              dns_name_t *owner)
{
        isc_result_t result;
        char ownerbuf[DNS_NAME_FORMATSIZE];
        char namebuf[DNS_NAME_FORMATSIZE];
        char altbuf[DNS_NAME_FORMATSIZE];
        dns_fixedname_t fixed;
        dns_name_t *foundname;
        int level;

        /*
         * "." means the services does not exist.
         */
        if (dns_name_equal(name, dns_rootname))
                return (ISC_TRUE);

        /*
         * Outside of zone.
         */
        if (!dns_name_issubdomain(name, &zone->origin)) {
                if (zone->checkmx != NULL)
                        return ((zone->checkmx)(zone, name, owner));
                return (ISC_TRUE);
        }

        if (zone->type == dns_zone_master)
                level = ISC_LOG_ERROR;
        else
                level = ISC_LOG_WARNING;

        dns_fixedname_init(&fixed);
        foundname = dns_fixedname_name(&fixed);

        result = dns_db_find(db, name, NULL, dns_rdatatype_a,
                             0, 0, NULL, foundname, NULL, NULL);
        if (result == ISC_R_SUCCESS)
                return (ISC_TRUE);

        if (result == DNS_R_NXRRSET) {
                result = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
                                     0, 0, NULL, foundname, NULL, NULL);
                if (result == ISC_R_SUCCESS)
                        return (ISC_TRUE);
        }

        dns_name_format(owner, ownerbuf, sizeof ownerbuf);
        dns_name_format(name, namebuf, sizeof namebuf);
        if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
            result == DNS_R_EMPTYNAME) {
                if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKMXFAIL))
                        level = ISC_LOG_WARNING;
                dns_zone_log(zone, level,
                             "%s/MX '%s' has no address records (A or AAAA)",
                             ownerbuf, namebuf);
                return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
        }

        if (result == DNS_R_CNAME) {
                if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNMXCNAME) ||
                    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME))
                        level = ISC_LOG_WARNING;
                if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME))
                        dns_zone_log(zone, level,
                                     "%s/MX '%s' is a CNAME (illegal)",
                                     ownerbuf, namebuf);
                return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
        }

        if (result == DNS_R_DNAME) {
                if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNMXCNAME) ||
                    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME))
                        level = ISC_LOG_WARNING;
                if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNOREMXCNAME)) {
                        dns_name_format(foundname, altbuf, sizeof altbuf);
                        dns_zone_log(zone, level, "%s/MX '%s' is below a DNAME"
                                     " '%s' (illegal)", ownerbuf, namebuf,
                                     altbuf);
                }
                return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
        }

        if (zone->checkmx != NULL && result == DNS_R_DELEGATION)
                return ((zone->checkmx)(zone, name, owner));

        return (ISC_TRUE);
}

static isc_boolean_t
zone_check_srv(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
               dns_name_t *owner)
{
        isc_result_t result;
        char ownerbuf[DNS_NAME_FORMATSIZE];
        char namebuf[DNS_NAME_FORMATSIZE];
        char altbuf[DNS_NAME_FORMATSIZE];
        dns_fixedname_t fixed;
        dns_name_t *foundname;
        int level;

        /*
         * "." means the services does not exist.
         */
        if (dns_name_equal(name, dns_rootname))
                return (ISC_TRUE);

        /*
         * Outside of zone.
         */
        if (!dns_name_issubdomain(name, &zone->origin)) {
                if (zone->checksrv != NULL)
                        return ((zone->checksrv)(zone, name, owner));
                return (ISC_TRUE);
        }

        if (zone->type == dns_zone_master)
                level = ISC_LOG_ERROR;
        else
                level = ISC_LOG_WARNING;

        dns_fixedname_init(&fixed);
        foundname = dns_fixedname_name(&fixed);

        result = dns_db_find(db, name, NULL, dns_rdatatype_a,
                             0, 0, NULL, foundname, NULL, NULL);
        if (result == ISC_R_SUCCESS)
                return (ISC_TRUE);

        if (result == DNS_R_NXRRSET) {
                result = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
                                     0, 0, NULL, foundname, NULL, NULL);
                if (result == ISC_R_SUCCESS)
                        return (ISC_TRUE);
        }

        dns_name_format(owner, ownerbuf, sizeof ownerbuf);
        dns_name_format(name, namebuf, sizeof namebuf);
        if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
            result == DNS_R_EMPTYNAME) {
                dns_zone_log(zone, level,
                             "%s/SRV '%s' has no address records (A or AAAA)",
                             ownerbuf, namebuf);
                /* XXX950 make fatal for 9.5.0. */
                return (ISC_TRUE);
        }

        if (result == DNS_R_CNAME) {
                if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNSRVCNAME) ||
                    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME))
                        level = ISC_LOG_WARNING;
                if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME))
                        dns_zone_log(zone, level,
                                     "%s/SRV '%s' is a CNAME (illegal)",
                                     ownerbuf, namebuf);
                return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
        }

        if (result == DNS_R_DNAME) {
                if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_WARNSRVCNAME) ||
                    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME))
                        level = ISC_LOG_WARNING;
                if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IGNORESRVCNAME)) {
                        dns_name_format(foundname, altbuf, sizeof altbuf);
                        dns_zone_log(zone, level, "%s/SRV '%s' is below a "
                                     "DNAME '%s' (illegal)", ownerbuf, namebuf,
                                     altbuf);
                }
                return ((level == ISC_LOG_WARNING) ? ISC_TRUE : ISC_FALSE);
        }

        if (zone->checksrv != NULL && result == DNS_R_DELEGATION)
                return ((zone->checksrv)(zone, name, owner));

        return (ISC_TRUE);
}

static isc_boolean_t
zone_check_glue(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
                dns_name_t *owner)
{
        isc_boolean_t answer = ISC_TRUE;
        isc_result_t result, tresult;
        char ownerbuf[DNS_NAME_FORMATSIZE];
        char namebuf[DNS_NAME_FORMATSIZE];
        char altbuf[DNS_NAME_FORMATSIZE];
        dns_fixedname_t fixed;
        dns_name_t *foundname;
        dns_rdataset_t a;
        dns_rdataset_t aaaa;
        int level;

        /*
         * Outside of zone.
         */
        if (!dns_name_issubdomain(name, &zone->origin)) {
                if (zone->checkns != NULL)
                        return ((zone->checkns)(zone, name, owner, NULL, NULL));
                return (ISC_TRUE);
        }

        if (zone->type == dns_zone_master)
                level = ISC_LOG_ERROR;
        else
                level = ISC_LOG_WARNING;

        dns_fixedname_init(&fixed);
        foundname = dns_fixedname_name(&fixed);
        dns_rdataset_init(&a);
        dns_rdataset_init(&aaaa);

        result = dns_db_find(db, name, NULL, dns_rdatatype_a,
                             DNS_DBFIND_GLUEOK, 0, NULL,
                             foundname, &a, NULL);

        if (result == ISC_R_SUCCESS) {
                dns_rdataset_disassociate(&a);
                return (ISC_TRUE);
        } else if (result == DNS_R_DELEGATION)
                dns_rdataset_disassociate(&a);

        if (result == DNS_R_NXRRSET || result == DNS_R_DELEGATION ||
            result == DNS_R_GLUE) {
                tresult = dns_db_find(db, name, NULL, dns_rdatatype_aaaa,
                                     DNS_DBFIND_GLUEOK, 0, NULL,
                                     foundname, &aaaa, NULL);
                if (tresult == ISC_R_SUCCESS) {
                        if (dns_rdataset_isassociated(&a))
                                dns_rdataset_disassociate(&a);
                        dns_rdataset_disassociate(&aaaa);
                        return (ISC_TRUE);
                }
                if (tresult == DNS_R_DELEGATION)
                        dns_rdataset_disassociate(&aaaa);
                if (result == DNS_R_GLUE || tresult == DNS_R_GLUE) {
                        /*
                         * Check glue against child zone.
                         */
                        if (zone->checkns != NULL)
                                answer = (zone->checkns)(zone, name, owner,
                                                         &a, &aaaa);
                        if (dns_rdataset_isassociated(&a))
                                dns_rdataset_disassociate(&a);
                        if (dns_rdataset_isassociated(&aaaa))
                                dns_rdataset_disassociate(&aaaa);
                        return (answer);
                }
        }

        dns_name_format(owner, ownerbuf, sizeof ownerbuf);
        dns_name_format(name, namebuf, sizeof namebuf);
        if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
            result == DNS_R_EMPTYNAME || result == DNS_R_DELEGATION) {
                const char *what;
                isc_boolean_t required = ISC_FALSE;
                if (dns_name_issubdomain(name, owner)) {
                        what = "REQUIRED GLUE ";
                        required = ISC_TRUE;
                 } else if (result == DNS_R_DELEGATION)
                        what = "SIBLING GLUE ";
                else
                        what = "";

                if (result != DNS_R_DELEGATION || required ||
                    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKSIBLING)) {
                        dns_zone_log(zone, level, "%s/NS '%s' has no %s"
                                     "address records (A or AAAA)",
                                     ownerbuf, namebuf, what);
                        /*
                         * Log missing address record.
                         */
                        if (result == DNS_R_DELEGATION && zone->checkns != NULL)
                                (void)(zone->checkns)(zone, name, owner,
                                                      &a, &aaaa);
                        /* XXX950 make fatal for 9.5.0. */
                        /* answer = ISC_FALSE; */
                }
        } else if (result == DNS_R_CNAME) {
                dns_zone_log(zone, level, "%s/NS '%s' is a CNAME (illegal)",
                             ownerbuf, namebuf);
                /* XXX950 make fatal for 9.5.0. */
                /* answer = ISC_FALSE; */
        } else if (result == DNS_R_DNAME) {
                dns_name_format(foundname, altbuf, sizeof altbuf);
                dns_zone_log(zone, level,
                             "%s/NS '%s' is below a DNAME '%s' (illegal)",
                             ownerbuf, namebuf, altbuf);
                /* XXX950 make fatal for 9.5.0. */
                /* answer = ISC_FALSE; */
        }

        if (dns_rdataset_isassociated(&a))
                dns_rdataset_disassociate(&a);
        if (dns_rdataset_isassociated(&aaaa))
                dns_rdataset_disassociate(&aaaa);
        return (answer);
}

static isc_boolean_t
zone_rrset_check_dup(dns_zone_t *zone, dns_name_t *owner,
                     dns_rdataset_t *rdataset)
{
        dns_rdataset_t tmprdataset;
        isc_result_t result;
        isc_boolean_t answer = ISC_TRUE;
        isc_boolean_t format = ISC_TRUE;
        int level = ISC_LOG_WARNING;
        char ownerbuf[DNS_NAME_FORMATSIZE];
        char typebuf[DNS_RDATATYPE_FORMATSIZE];
        unsigned int count1 = 0;

        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKDUPRRFAIL))
                level = ISC_LOG_ERROR;

        dns_rdataset_init(&tmprdataset);
        for (result = dns_rdataset_first(rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(rdataset)) {
                dns_rdata_t rdata1 = DNS_RDATA_INIT;
                unsigned int count2 = 0;

                count1++;
                dns_rdataset_current(rdataset, &rdata1);
                dns_rdataset_clone(rdataset, &tmprdataset);
                for (result = dns_rdataset_first(&tmprdataset);
                     result == ISC_R_SUCCESS;
                     result = dns_rdataset_next(&tmprdataset)) {
                        dns_rdata_t rdata2 = DNS_RDATA_INIT;
                        count2++;
                        if (count1 >= count2)
                                continue;
                        dns_rdataset_current(&tmprdataset, &rdata2);
                        if (dns_rdata_casecompare(&rdata1, &rdata2) == 0) {
                                if (format) {
                                        dns_name_format(owner, ownerbuf,
                                                        sizeof ownerbuf);
                                        dns_rdatatype_format(rdata1.type,
                                                             typebuf,
                                                             sizeof(typebuf));
                                        format = ISC_FALSE;
                                }
                                dns_zone_log(zone, level, "%s/%s has "
                                             "semantically identical records",
                                             ownerbuf, typebuf);
                                if (level == ISC_LOG_ERROR)
                                        answer = ISC_FALSE;
                                break;
                        }
                }
                dns_rdataset_disassociate(&tmprdataset);
                if (!format)
                        break;
        }
        return (answer);
}

static isc_boolean_t
zone_check_dup(dns_zone_t *zone, dns_db_t *db) {
        dns_dbiterator_t *dbiterator = NULL;
        dns_dbnode_t *node = NULL;
        dns_fixedname_t fixed;
        dns_name_t *name;
        dns_rdataset_t rdataset;
        dns_rdatasetiter_t *rdsit = NULL;
        isc_boolean_t ok = ISC_TRUE;
        isc_result_t result;

        dns_fixedname_init(&fixed);
        name = dns_fixedname_name(&fixed);
        dns_rdataset_init(&rdataset);

        result = dns_db_createiterator(db, 0, &dbiterator);
        if (result != ISC_R_SUCCESS)
                return (ISC_TRUE);

        for (result = dns_dbiterator_first(dbiterator);
             result == ISC_R_SUCCESS;
             result = dns_dbiterator_next(dbiterator)) {
                result = dns_dbiterator_current(dbiterator, &node, name);
                if (result != ISC_R_SUCCESS)
                        continue;

                result = dns_db_allrdatasets(db, node, NULL, 0, &rdsit);
                if (result != ISC_R_SUCCESS)
                        continue;

                for (result = dns_rdatasetiter_first(rdsit);
                     result == ISC_R_SUCCESS;
                     result = dns_rdatasetiter_next(rdsit)) {
                        dns_rdatasetiter_current(rdsit, &rdataset);
                        if (!zone_rrset_check_dup(zone, name, &rdataset))
                                ok = ISC_FALSE;
                        dns_rdataset_disassociate(&rdataset);
                }
                dns_rdatasetiter_destroy(&rdsit);
                dns_db_detachnode(db, &node);
        }

        if (node != NULL)
                dns_db_detachnode(db, &node);
        dns_dbiterator_destroy(&dbiterator);

        return (ok);
}

static isc_boolean_t
isspf(const dns_rdata_t *rdata) {
        char buf[1024];
        const unsigned char *data = rdata->data;
        unsigned int rdl = rdata->length, i = 0, tl, len;

        while (rdl > 0U) {
                len = tl = *data;
                ++data;
                --rdl;
                INSIST(tl <= rdl);
                if (len > sizeof(buf) - i - 1)
                        len = sizeof(buf) - i - 1;
                memmove(buf + i, data, len);
                i += len;
                data += tl;
                rdl -= tl;
        }

        if (i < 6U)
                return(ISC_FALSE);

        buf[i] = 0;
        if (strncmp(buf, "v=spf1", 6) == 0 && (buf[6] == 0 || buf[6] == ' '))
                return (ISC_TRUE);
        return (ISC_FALSE);
}

static isc_boolean_t
integrity_checks(dns_zone_t *zone, dns_db_t *db) {
        dns_dbiterator_t *dbiterator = NULL;
        dns_dbnode_t *node = NULL;
        dns_rdataset_t rdataset;
        dns_fixedname_t fixed;
        dns_fixedname_t fixedbottom;
        dns_rdata_mx_t mx;
        dns_rdata_ns_t ns;
        dns_rdata_in_srv_t srv;
        dns_rdata_t rdata;
        dns_name_t *name;
        dns_name_t *bottom;
        isc_result_t result;
        isc_boolean_t ok = ISC_TRUE, have_spf, have_txt;

        dns_fixedname_init(&fixed);
        name = dns_fixedname_name(&fixed);
        dns_fixedname_init(&fixedbottom);
        bottom = dns_fixedname_name(&fixedbottom);
        dns_rdataset_init(&rdataset);
        dns_rdata_init(&rdata);

        result = dns_db_createiterator(db, 0, &dbiterator);
        if (result != ISC_R_SUCCESS)
                return (ISC_TRUE);

        result = dns_dbiterator_first(dbiterator);
        while (result == ISC_R_SUCCESS) {
                result = dns_dbiterator_current(dbiterator, &node, name);
                if (result != ISC_R_SUCCESS)
                        goto cleanup;

                /*
                 * Is this name visible in the zone?
                 */
                if (!dns_name_issubdomain(name, &zone->origin) ||
                    (dns_name_countlabels(bottom) > 0 &&
                     dns_name_issubdomain(name, bottom)))
                        goto next;

                /*
                 * Don't check the NS records at the origin.
                 */
                if (dns_name_equal(name, &zone->origin))
                        goto checkmx;

                result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_ns,
                                             0, 0, &rdataset, NULL);
                if (result != ISC_R_SUCCESS)
                        goto checkmx;
                /*
                 * Remember bottom of zone.
                 */
                dns_name_copy(name, bottom, NULL);

                result = dns_rdataset_first(&rdataset);
                while (result == ISC_R_SUCCESS) {
                        dns_rdataset_current(&rdataset, &rdata);
                        result = dns_rdata_tostruct(&rdata, &ns, NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
                        if (!zone_check_glue(zone, db, &ns.name, name))
                                ok = ISC_FALSE;
                        dns_rdata_reset(&rdata);
                        result = dns_rdataset_next(&rdataset);
                }
                dns_rdataset_disassociate(&rdataset);
                goto next;

 checkmx:
                result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_mx,
                                             0, 0, &rdataset, NULL);
                if (result != ISC_R_SUCCESS)
                        goto checksrv;
                result = dns_rdataset_first(&rdataset);
                while (result == ISC_R_SUCCESS) {
                        dns_rdataset_current(&rdataset, &rdata);
                        result = dns_rdata_tostruct(&rdata, &mx, NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
                        if (!zone_check_mx(zone, db, &mx.mx, name))
                                ok = ISC_FALSE;
                        dns_rdata_reset(&rdata);
                        result = dns_rdataset_next(&rdataset);
                }
                dns_rdataset_disassociate(&rdataset);

 checksrv:
                if (zone->rdclass != dns_rdataclass_in)
                        goto next;
                result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_srv,
                                             0, 0, &rdataset, NULL);
                if (result != ISC_R_SUCCESS)
                        goto checkspf;
                result = dns_rdataset_first(&rdataset);
                while (result == ISC_R_SUCCESS) {
                        dns_rdataset_current(&rdataset, &rdata);
                        result = dns_rdata_tostruct(&rdata, &srv, NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
                        if (!zone_check_srv(zone, db, &srv.target, name))
                                ok = ISC_FALSE;
                        dns_rdata_reset(&rdata);
                        result = dns_rdataset_next(&rdataset);
                }
                dns_rdataset_disassociate(&rdataset);

 checkspf:
                /*
                 * Check if there is a type SPF record without an
                 * SPF-formatted type TXT record also being present.
                 */
                if (!DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKSPF))
                        goto next;
                if (zone->rdclass != dns_rdataclass_in)
                        goto next;
                have_spf = have_txt = ISC_FALSE;
                result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_spf,
                                             0, 0, &rdataset, NULL);
                if (result == ISC_R_SUCCESS) {
                        dns_rdataset_disassociate(&rdataset);
                        have_spf = ISC_TRUE;
                }
                result = dns_db_findrdataset(db, node, NULL, dns_rdatatype_txt,
                                             0, 0, &rdataset, NULL);
                if (result != ISC_R_SUCCESS)
                        goto notxt;
                result = dns_rdataset_first(&rdataset);
                while (result == ISC_R_SUCCESS) {
                        dns_rdataset_current(&rdataset, &rdata);
                        have_txt = isspf(&rdata);
                        dns_rdata_reset(&rdata);
                        if (have_txt)
                                break;
                        result = dns_rdataset_next(&rdataset);
                }
                dns_rdataset_disassociate(&rdataset);

 notxt:
                if (have_spf && !have_txt) {
                        char namebuf[DNS_NAME_FORMATSIZE];

                        dns_name_format(name, namebuf, sizeof(namebuf));
                        dns_zone_log(zone, ISC_LOG_WARNING, "'%s' found type "
                                     "SPF record but no SPF TXT record found, "
                                     "add matching type TXT record", namebuf);
                }

 next:
                dns_db_detachnode(db, &node);
                result = dns_dbiterator_next(dbiterator);
        }

 cleanup:
        if (node != NULL)
                dns_db_detachnode(db, &node);
        dns_dbiterator_destroy(&dbiterator);

        return (ok);
}

/*
 * OpenSSL verification of RSA keys with exponent 3 is known to be
 * broken prior OpenSSL 0.9.8c/0.9.7k.  Look for such keys and warn
 * if they are in use.
 */
static void
zone_check_dnskeys(dns_zone_t *zone, dns_db_t *db) {
        dns_dbnode_t *node = NULL;
        dns_dbversion_t *version = NULL;
        dns_rdata_dnskey_t dnskey;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdataset_t rdataset;
        isc_result_t result;
        isc_boolean_t logit, foundrsa = ISC_FALSE, foundmd5 = ISC_FALSE;
        const char *algorithm;

        result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
        if (result != ISC_R_SUCCESS)
                goto cleanup;

        dns_db_currentversion(db, &version);
        dns_rdataset_init(&rdataset);
        result = dns_db_findrdataset(db, node, version, dns_rdatatype_dnskey,
                                     dns_rdatatype_none, 0, &rdataset, NULL);
        if (result != ISC_R_SUCCESS)
                goto cleanup;

        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset))
        {
                dns_rdataset_current(&rdataset, &rdata);
                result = dns_rdata_tostruct(&rdata, &dnskey, NULL);
                INSIST(result == ISC_R_SUCCESS);

                if ((dnskey.algorithm == DST_ALG_RSASHA1 ||
                     dnskey.algorithm == DST_ALG_RSAMD5) &&
                     dnskey.datalen > 1 && dnskey.data[0] == 1 &&
                     dnskey.data[1] == 3)
                {
                        if (dnskey.algorithm == DST_ALG_RSASHA1) {
                                logit = !foundrsa;
                                foundrsa = ISC_TRUE;
                                algorithm = "RSASHA1";
                        } else {
                                logit = !foundmd5;
                                foundmd5 = ISC_TRUE;
                                algorithm = "RSAMD5";
                        }
                        if (logit)
                                dns_zone_log(zone, ISC_LOG_WARNING,
                                             "weak %s (%u) key found "
                                             "(exponent=3)", algorithm,
                                             dnskey.algorithm);
                        if (foundrsa && foundmd5)
                                break;
                }
                dns_rdata_reset(&rdata);
        }
        dns_rdataset_disassociate(&rdataset);

 cleanup:
        if (node != NULL)
                dns_db_detachnode(db, &node);
        if (version != NULL)
                dns_db_closeversion(db, &version, ISC_FALSE);
}

static void
resume_signingwithkey(dns_zone_t *zone) {
        dns_dbnode_t *node = NULL;
        dns_dbversion_t *version = NULL;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdataset_t rdataset;
        isc_result_t result;
        dns_db_t *db = NULL;

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db != NULL)
                dns_db_attach(zone->db, &db);
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
        if (db == NULL)
                goto cleanup;

        result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
        if (result != ISC_R_SUCCESS)
                goto cleanup;

        dns_db_currentversion(db, &version);
        dns_rdataset_init(&rdataset);
        result = dns_db_findrdataset(db, node, version,
                                     zone->privatetype,
                                     dns_rdatatype_none, 0,
                                     &rdataset, NULL);
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto cleanup;
        }

        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset))
        {
                dns_rdataset_current(&rdataset, &rdata);
                if (rdata.length != 5 ||
                    rdata.data[0] == 0 || rdata.data[4] != 0) {
                        dns_rdata_reset(&rdata);
                        continue;
                }

                result = zone_signwithkey(zone, rdata.data[0],
                                          (rdata.data[1] << 8) | rdata.data[2],
                                          ISC_TF(rdata.data[3]));
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "zone_signwithkey failed: %s",
                                     dns_result_totext(result));
                }
                dns_rdata_reset(&rdata);
        }
        dns_rdataset_disassociate(&rdataset);

 cleanup:
        if (db != NULL) {
                if (node != NULL)
                        dns_db_detachnode(db, &node);
                if (version != NULL)
                        dns_db_closeversion(db, &version, ISC_FALSE);
                dns_db_detach(&db);
        }
}

static isc_result_t
zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
        dns_nsec3chain_t *nsec3chain, *current;
        dns_dbversion_t *version = NULL;
        isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
        isc_result_t result;
        isc_time_t now;
        unsigned int options = 0;
        char saltbuf[255*2+1];
        char flags[sizeof("INITIAL|REMOVE|CREATE|NONSEC|OPTOUT")];
        dns_db_t *db = NULL;
        int i;

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db != NULL)
                dns_db_attach(zone->db, &db);
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);

        if (db == NULL) {
                result = ISC_R_SUCCESS;
                goto cleanup;
        }

        dns_db_currentversion(db, &version);
        result = dns_nsec_nseconly(db, version, &nseconly);
        nsec3ok = (result == ISC_R_SUCCESS && !nseconly);
        dns_db_closeversion(db, &version, ISC_FALSE);
        if (!nsec3ok && (nsec3param->flags & DNS_NSEC3FLAG_REMOVE) == 0) {
                result = ISC_R_SUCCESS;
                goto cleanup;
        }

        nsec3chain = isc_mem_get(zone->mctx, sizeof *nsec3chain);
        if (nsec3chain == NULL) {
                result = ISC_R_NOMEMORY;
                goto cleanup;
        }

        nsec3chain->magic = 0;
        nsec3chain->done = ISC_FALSE;
        nsec3chain->db = NULL;
        nsec3chain->dbiterator = NULL;
        nsec3chain->nsec3param.common.rdclass = nsec3param->common.rdclass;
        nsec3chain->nsec3param.common.rdtype = nsec3param->common.rdtype;
        nsec3chain->nsec3param.hash = nsec3param->hash;
        nsec3chain->nsec3param.iterations = nsec3param->iterations;
        nsec3chain->nsec3param.flags = nsec3param->flags;
        nsec3chain->nsec3param.salt_length = nsec3param->salt_length;
        memmove(nsec3chain->salt, nsec3param->salt, nsec3param->salt_length);
        nsec3chain->nsec3param.salt = nsec3chain->salt;
        nsec3chain->seen_nsec = ISC_FALSE;
        nsec3chain->delete_nsec = ISC_FALSE;
        nsec3chain->save_delete_nsec = ISC_FALSE;

        if (nsec3param->flags == 0)
                strlcpy(flags, "NONE", sizeof(flags));
        else {
                flags[0] = '\0';
                if (nsec3param->flags & DNS_NSEC3FLAG_REMOVE)
                        strlcat(flags, "REMOVE", sizeof(flags));
                if (nsec3param->flags & DNS_NSEC3FLAG_INITIAL) {
                        if (flags[0] == '\0')
                                strlcpy(flags, "INITIAL", sizeof(flags));
                        else
                                strlcat(flags, "|INITIAL", sizeof(flags));
                }
                if (nsec3param->flags & DNS_NSEC3FLAG_CREATE) {
                        if (flags[0] == '\0')
                                strlcpy(flags, "CREATE", sizeof(flags));
                        else
                                strlcat(flags, "|CREATE", sizeof(flags));
                }
                if (nsec3param->flags & DNS_NSEC3FLAG_NONSEC) {
                        if (flags[0] == '\0')
                                strlcpy(flags, "NONSEC", sizeof(flags));
                        else
                                strlcat(flags, "|NONSEC", sizeof(flags));
                }
                if (nsec3param->flags & DNS_NSEC3FLAG_OPTOUT) {
                        if (flags[0] == '\0')
                                strlcpy(flags, "OPTOUT", sizeof(flags));
                        else
                                strlcat(flags, "|OPTOUT", sizeof(flags));
                }
        }
        if (nsec3param->salt_length == 0)
                strlcpy(saltbuf, "-", sizeof(saltbuf));
        else
                for (i = 0; i < nsec3param->salt_length; i++)
                        sprintf(&saltbuf[i*2], "%02X", nsec3chain->salt[i]);
        dns_zone_log(zone, ISC_LOG_INFO,
                     "zone_addnsec3chain(%u,%s,%u,%s)",
                      nsec3param->hash, flags, nsec3param->iterations,
                      saltbuf);

        for (current = ISC_LIST_HEAD(zone->nsec3chain);
             current != NULL;
             current = ISC_LIST_NEXT(current, link)) {
                if (current->db == db &&
                    current->nsec3param.hash == nsec3param->hash &&
                    current->nsec3param.iterations == nsec3param->iterations &&
                    current->nsec3param.salt_length == nsec3param->salt_length
                    && !memcmp(current->nsec3param.salt, nsec3param->salt,
                               nsec3param->salt_length))
                        current->done = ISC_TRUE;
        }

        dns_db_attach(db, &nsec3chain->db);
        if ((nsec3chain->nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0)
                options = DNS_DB_NONSEC3;
        result = dns_db_createiterator(nsec3chain->db, options,
                                       &nsec3chain->dbiterator);
        if (result == ISC_R_SUCCESS)
                dns_dbiterator_first(nsec3chain->dbiterator);
        if (result == ISC_R_SUCCESS) {
                dns_dbiterator_pause(nsec3chain->dbiterator);
                ISC_LIST_INITANDAPPEND(zone->nsec3chain,
                                       nsec3chain, link);
                nsec3chain = NULL;
                if (isc_time_isepoch(&zone->nsec3chaintime)) {
                        TIME_NOW(&now);
                        zone->nsec3chaintime = now;
                        if (zone->task != NULL)
                                zone_settimer(zone, &now);
                }
        }

        if (nsec3chain != NULL) {
                if (nsec3chain->db != NULL)
                        dns_db_detach(&nsec3chain->db);
                if (nsec3chain->dbiterator != NULL)
                        dns_dbiterator_destroy(&nsec3chain->dbiterator);
                isc_mem_put(zone->mctx, nsec3chain, sizeof *nsec3chain);
        }

 cleanup:
        if (db != NULL)
                dns_db_detach(&db);
        return (result);
}

static void
resume_addnsec3chain(dns_zone_t *zone) {
        dns_dbnode_t *node = NULL;
        dns_dbversion_t *version = NULL;
        dns_rdataset_t rdataset;
        isc_result_t result;
        dns_rdata_nsec3param_t nsec3param;
        isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;
        dns_db_t *db = NULL;

        if (zone->privatetype == 0)
                return;

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db != NULL)
                dns_db_attach(zone->db, &db);
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
        if (db == NULL)
                goto cleanup;

        result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
        if (result != ISC_R_SUCCESS)
                goto cleanup;

        dns_db_currentversion(db, &version);

        result = dns_nsec_nseconly(db, version, &nseconly);
        nsec3ok = (result == ISC_R_SUCCESS && !nseconly);

        dns_rdataset_init(&rdataset);
        result = dns_db_findrdataset(db, node, version,
                                     zone->privatetype, dns_rdatatype_none,
                                     0, &rdataset, NULL);
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto cleanup;
        }

        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset))
        {
                unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];
                dns_rdata_t rdata = DNS_RDATA_INIT;
                dns_rdata_t private = DNS_RDATA_INIT;

                dns_rdataset_current(&rdataset, &private);
                if (!dns_nsec3param_fromprivate(&private, &rdata, buf,
                                                sizeof(buf)))
                        continue;
                result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
                if (((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) ||
                    ((nsec3param.flags & DNS_NSEC3FLAG_CREATE) != 0 && nsec3ok))
                {
                        result = zone_addnsec3chain(zone, &nsec3param);
                        if (result != ISC_R_SUCCESS) {
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "zone_addnsec3chain failed: %s",
                                             dns_result_totext(result));
                        }
                }
        }
        dns_rdataset_disassociate(&rdataset);
 cleanup:
        if (db != NULL) {
                if (node != NULL)
                        dns_db_detachnode(db, &node);
                if (version != NULL)
                        dns_db_closeversion(db, &version, ISC_FALSE);
                dns_db_detach(&db);
        }
}

static void
set_resigntime(dns_zone_t *zone) {
        dns_rdataset_t rdataset;
        dns_fixedname_t fixed;
        unsigned int resign;
        isc_result_t result;
        isc_uint32_t nanosecs;
        dns_db_t *db = NULL;

        /* We only re-sign zones that can be dynamically updated */
        if (zone->update_disabled)
                return;

        if (!inline_secure(zone) && (zone->type != dns_zone_master ||
            (zone->ssutable == NULL &&
             (zone->update_acl == NULL || dns_acl_isnone(zone->update_acl)))))
                return;

        dns_rdataset_init(&rdataset);
        dns_fixedname_init(&fixed);

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db != NULL)
                dns_db_attach(zone->db, &db);
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);
        if (db == NULL) {
                isc_time_settoepoch(&zone->resigntime);
                return;
        }

        result = dns_db_getsigningtime(db, &rdataset,
                                       dns_fixedname_name(&fixed));
        if (result != ISC_R_SUCCESS) {
                isc_time_settoepoch(&zone->resigntime);
                goto cleanup;
        }

        resign = rdataset.resign - zone->sigresigninginterval;
        dns_rdataset_disassociate(&rdataset);
        isc_random_get(&nanosecs);
        nanosecs %= 1000000000;
        isc_time_set(&zone->resigntime, resign, nanosecs);
 cleanup:
        dns_db_detach(&db);
        return;
}

static isc_result_t
check_nsec3param(dns_zone_t *zone, dns_db_t *db) {
        dns_dbnode_t *node = NULL;
        dns_rdataset_t rdataset;
        dns_dbversion_t *version = NULL;
        dns_rdata_nsec3param_t nsec3param;
        isc_boolean_t ok = ISC_FALSE;
        isc_result_t result;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        isc_boolean_t dynamic = (zone->type == dns_zone_master) ?
                                dns_zone_isdynamic(zone, ISC_FALSE) : ISC_FALSE;

        dns_rdataset_init(&rdataset);
        result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "nsec3param lookup failure: %s",
                             dns_result_totext(result));
                return (result);
        }
        dns_db_currentversion(db, &version);

        result = dns_db_findrdataset(db, node, version,
                                     dns_rdatatype_nsec3param,
                                     dns_rdatatype_none, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                result = ISC_R_SUCCESS;
                goto cleanup;
        }
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "nsec3param lookup failure: %s",
                             dns_result_totext(result));
                goto cleanup;
        }

        /*
         * For dynamic zones we must support every algorithm so we can
         * regenerate all the NSEC3 chains.
         * For non-dynamic zones we only need to find a supported algorithm.
         */
        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset))
        {
                dns_rdataset_current(&rdataset, &rdata);
                result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
                dns_rdata_reset(&rdata);
                INSIST(result == ISC_R_SUCCESS);
                if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NSEC3TESTZONE) &&
                    nsec3param.hash == DNS_NSEC3_UNKNOWNALG && !dynamic)
                {
                        dns_zone_log(zone, ISC_LOG_WARNING,
                             "nsec3 test \"unknown\" hash algorithm found: %u",
                                     nsec3param.hash);
                        ok = ISC_TRUE;
                } else if (!dns_nsec3_supportedhash(nsec3param.hash)) {
                        if (dynamic) {
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "unsupported nsec3 hash algorithm"
                                             " in dynamic zone: %u",
                                             nsec3param.hash);
                                result = DNS_R_BADZONE;
                                /* Stop second error message. */
                                ok = ISC_TRUE;
                                break;
                        } else
                                dns_zone_log(zone, ISC_LOG_WARNING,
                                     "unsupported nsec3 hash algorithm: %u",
                                             nsec3param.hash);
                } else
                        ok = ISC_TRUE;
        }
        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;

        if (!ok) {
                result = DNS_R_BADZONE;
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "no supported nsec3 hash algorithm");
        }

 cleanup:
        if (dns_rdataset_isassociated(&rdataset))
                dns_rdataset_disassociate(&rdataset);
        dns_db_closeversion(db, &version, ISC_FALSE);
        dns_db_detachnode(db, &node);
        return (result);
}

/*
 * Set the timer for refreshing the key zone to the soonest future time
 * of the set (current timer, keydata->refresh, keydata->addhd,
 * keydata->removehd).
 */
static void
set_refreshkeytimer(dns_zone_t *zone, dns_rdata_keydata_t *key,
                    isc_stdtime_t now, isc_boolean_t force)
{
        const char me[] = "set_refreshkeytimer";
        isc_stdtime_t then;
        isc_time_t timenow, timethen;
        char timebuf[80];

        ENTER;
        then = key->refresh;
        if (force)
                then = now;
        if (key->addhd > now && key->addhd < then)
                then = key->addhd;
        if (key->removehd > now && key->removehd < then)
                then = key->removehd;

        TIME_NOW(&timenow);
        if (then > now)
                DNS_ZONE_TIME_ADD(&timenow, then - now, &timethen);
        else
                timethen = timenow;
        if (isc_time_compare(&zone->refreshkeytime, &timenow) < 0 ||
            isc_time_compare(&timethen, &zone->refreshkeytime) < 0)
                zone->refreshkeytime = timethen;

        isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
        dns_zone_log(zone, ISC_LOG_DEBUG(1), "next key refresh: %s", timebuf);
        zone_settimer(zone, &timenow);
}

/*
 * Convert key(s) linked from 'keynode' to KEYDATA and add to the key zone.
 * If the key zone is changed, set '*changed' to ISC_TRUE.
 */
static isc_result_t
create_keydata(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
               dns_diff_t *diff, dns_keytable_t *keytable,
               dns_keynode_t **keynodep, isc_boolean_t *changed)
{
        const char me[] = "create_keydata";
        isc_result_t result = ISC_R_SUCCESS;
        isc_buffer_t keyb, dstb;
        unsigned char key_buf[4096], dst_buf[DST_KEY_MAXSIZE];
        dns_rdata_keydata_t keydata;
        dns_rdata_dnskey_t dnskey;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_keynode_t *keynode;
        isc_stdtime_t now;
        isc_region_t r;
        dst_key_t *key;

        REQUIRE(keynodep != NULL);
        keynode = *keynodep;

        ENTER;
        isc_stdtime_get(&now);

        /* Loop in case there's more than one key. */
        while (result == ISC_R_SUCCESS) {
                dns_keynode_t *nextnode = NULL;

                key = dns_keynode_key(keynode);
                if (key == NULL)
                        goto skip;

                isc_buffer_init(&dstb, dst_buf, sizeof(dst_buf));
                CHECK(dst_key_todns(key, &dstb));

                /* Convert DST key to DNSKEY. */
                dns_rdata_reset(&rdata);
                isc_buffer_usedregion(&dstb, &r);
                dns_rdata_fromregion(&rdata, dst_key_class(key),
                                     dns_rdatatype_dnskey, &r);

                /* DSTKEY to KEYDATA. */
                CHECK(dns_rdata_tostruct(&rdata, &dnskey, NULL));
                CHECK(dns_keydata_fromdnskey(&keydata, &dnskey, now, 0, 0,
                                             NULL));

                /* KEYDATA to rdata. */
                dns_rdata_reset(&rdata);
                isc_buffer_init(&keyb, key_buf, sizeof(key_buf));
                CHECK(dns_rdata_fromstruct(&rdata,
                                           zone->rdclass, dns_rdatatype_keydata,
                                           &keydata, &keyb));

                /* Add rdata to zone. */
                CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD,
                                    dst_key_name(key), 0, &rdata));
                *changed = ISC_TRUE;

                /* Refresh new keys from the zone apex as soon as possible. */
                set_refreshkeytimer(zone, &keydata, now, ISC_TRUE);

 skip:
                result = dns_keytable_nextkeynode(keytable, keynode, &nextnode);
                if (result != ISC_R_NOTFOUND) {
                        dns_keytable_detachkeynode(keytable, &keynode);
                        keynode = nextnode;
                }
        }

        if (keynode != NULL)
                dns_keytable_detachkeynode(keytable, &keynode);
        *keynodep = NULL;

        return (ISC_R_SUCCESS);

  failure:
        return (result);
}

/*
 * Remove from the key zone all the KEYDATA records found in rdataset.
 */
static isc_result_t
delete_keydata(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
               dns_name_t *name, dns_rdataset_t *rdataset)
{
        dns_rdata_t rdata = DNS_RDATA_INIT;
        isc_result_t result, uresult;

        for (result = dns_rdataset_first(rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(rdataset)) {
                dns_rdata_reset(&rdata);
                dns_rdataset_current(rdataset, &rdata);
                uresult = update_one_rr(db, ver, diff, DNS_DIFFOP_DEL,
                                        name, 0, &rdata);
                if (uresult != ISC_R_SUCCESS)
                        return (uresult);
        }
        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;
        return (result);
}

/*
 * Compute the DNSSEC key ID for a DNSKEY record.
 */
static isc_result_t
compute_tag(dns_name_t *name, dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx,
            dns_keytag_t *tag)
{
        isc_result_t result;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        unsigned char data[4096];
        isc_buffer_t buffer;
        dst_key_t *dstkey = NULL;

        isc_buffer_init(&buffer, data, sizeof(data));
        dns_rdata_fromstruct(&rdata, dnskey->common.rdclass,
                             dns_rdatatype_dnskey, dnskey, &buffer);

        result = dns_dnssec_keyfromrdata(name, &rdata, mctx, &dstkey);
        if (result == ISC_R_SUCCESS)
                *tag = dst_key_id(dstkey);
        dst_key_free(&dstkey);

        return (result);
}

/*
 * Add key to the security roots.
 */
static void
trust_key(dns_zone_t *zone, dns_name_t *keyname,
          dns_rdata_dnskey_t *dnskey, isc_mem_t *mctx) {
        isc_result_t result;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        unsigned char data[4096];
        isc_buffer_t buffer;
        dns_keytable_t *sr = NULL;
        dst_key_t *dstkey = NULL;

        /* Convert dnskey to DST key. */
        isc_buffer_init(&buffer, data, sizeof(data));
        dns_rdata_fromstruct(&rdata, dnskey->common.rdclass,
                             dns_rdatatype_dnskey, dnskey, &buffer);

        result = dns_view_getsecroots(zone->view, &sr);
        if (result != ISC_R_SUCCESS)
                goto failure;

        CHECK(dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &dstkey));
        CHECK(dns_keytable_add(sr, ISC_TRUE, &dstkey));
        dns_keytable_detach(&sr);

  failure:
        if (dstkey != NULL)
                dst_key_free(&dstkey);
        if (sr != NULL)
                dns_keytable_detach(&sr);
        return;
}

/*
 * Add a null key to the security roots for so that all queries
 * to the zone will fail.
 */
static void
fail_secure(dns_zone_t *zone, dns_name_t *keyname) {
        isc_result_t result;
        dns_keytable_t *sr = NULL;

        result = dns_view_getsecroots(zone->view, &sr);
        if (result == ISC_R_SUCCESS) {
                dns_keytable_marksecure(sr, keyname);
                dns_keytable_detach(&sr);
        }
}

/*
 * Scan a set of KEYDATA records from the key zone.  The ones that are
 * valid (i.e., the add holddown timer has expired) become trusted keys.
 */
static void
load_secroots(dns_zone_t *zone, dns_name_t *name, dns_rdataset_t *rdataset) {
        isc_result_t result;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdata_keydata_t keydata;
        dns_rdata_dnskey_t dnskey;
        isc_mem_t *mctx = zone->mctx;
        int trusted = 0, revoked = 0, pending = 0;
        isc_stdtime_t now;
        dns_keytable_t *sr = NULL;

        isc_stdtime_get(&now);

        result = dns_view_getsecroots(zone->view, &sr);
        if (result == ISC_R_SUCCESS) {
                dns_keytable_delete(sr, name);
                dns_keytable_detach(&sr);
        }

        /* Now insert all the accepted trust anchors from this keydata set. */
        for (result = dns_rdataset_first(rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(rdataset)) {
                dns_rdata_reset(&rdata);
                dns_rdataset_current(rdataset, &rdata);

                /* Convert rdata to keydata. */
                result = dns_rdata_tostruct(&rdata, &keydata, NULL);
                if (result == ISC_R_UNEXPECTEDEND)
                        continue;
                RUNTIME_CHECK(result == ISC_R_SUCCESS);

                /* Set the key refresh timer to force a fast refresh. */
                set_refreshkeytimer(zone, &keydata, now, ISC_TRUE);

                /* If the removal timer is nonzero, this key was revoked. */
                if (keydata.removehd != 0) {
                        revoked++;
                        continue;
                }

                /*
                 * If the add timer is still pending, this key is not
                 * trusted yet.
                 */
                if (now < keydata.addhd) {
                        pending++;
                        continue;
                }

                /* Convert keydata to dnskey. */
                dns_keydata_todnskey(&keydata, &dnskey, NULL);

                /* Add to keytables. */
                trusted++;
                trust_key(zone, name, &dnskey, mctx);
        }

        if (trusted == 0 && pending != 0) {
                char namebuf[DNS_NAME_FORMATSIZE];
                dns_name_format(name, namebuf, sizeof namebuf);
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "No valid trust anchors for '%s'!", namebuf);
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "%d key(s) revoked, %d still pending",
                             revoked, pending);
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "All queries to '%s' will fail", namebuf);
                fail_secure(zone, name);
        }
}

static isc_result_t
do_one_tuple(dns_difftuple_t **tuple, dns_db_t *db, dns_dbversion_t *ver,
             dns_diff_t *diff)
{
        dns_diff_t temp_diff;
        isc_result_t result;

        /*
         * Create a singleton diff.
         */
        dns_diff_init(diff->mctx, &temp_diff);
        ISC_LIST_APPEND(temp_diff.tuples, *tuple, link);

        /*
         * Apply it to the database.
         */
        result = dns_diff_apply(&temp_diff, db, ver);
        ISC_LIST_UNLINK(temp_diff.tuples, *tuple, link);
        if (result != ISC_R_SUCCESS) {
                dns_difftuple_free(tuple);
                return (result);
        }

        /*
         * Merge it into the current pending journal entry.
         */
        dns_diff_appendminimal(diff, tuple);

        /*
         * Do not clear temp_diff.
         */
        return (ISC_R_SUCCESS);
}

static isc_result_t
update_one_rr(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
              dns_diffop_t op, dns_name_t *name, dns_ttl_t ttl,
              dns_rdata_t *rdata)
{
        dns_difftuple_t *tuple = NULL;
        isc_result_t result;
        result = dns_difftuple_create(diff->mctx, op,
                                      name, ttl, rdata, &tuple);
        if (result != ISC_R_SUCCESS)
                return (result);
        return (do_one_tuple(&tuple, db, ver, diff));
}

static isc_result_t
update_soa_serial(dns_db_t *db, dns_dbversion_t *ver, dns_diff_t *diff,
                  isc_mem_t *mctx, dns_updatemethod_t method) {
        dns_difftuple_t *deltuple = NULL;
        dns_difftuple_t *addtuple = NULL;
        isc_uint32_t serial;
        isc_result_t result;

        INSIST(method != dns_updatemethod_none);

        CHECK(dns_db_createsoatuple(db, ver, mctx, DNS_DIFFOP_DEL, &deltuple));
        CHECK(dns_difftuple_copy(deltuple, &addtuple));
        addtuple->op = DNS_DIFFOP_ADD;

        serial = dns_soa_getserial(&addtuple->rdata);
        serial = dns_update_soaserial(serial, method);
        dns_soa_setserial(serial, &addtuple->rdata);
        CHECK(do_one_tuple(&deltuple, db, ver, diff));
        CHECK(do_one_tuple(&addtuple, db, ver, diff));
        result = ISC_R_SUCCESS;

        failure:
        if (addtuple != NULL)
                dns_difftuple_free(&addtuple);
        if (deltuple != NULL)
                dns_difftuple_free(&deltuple);
        return (result);
}

/*
 * Write all transactions in 'diff' to the zone journal file.
 */
static isc_result_t
zone_journal(dns_zone_t *zone, dns_diff_t *diff, isc_uint32_t *sourceserial,
             const char *caller)
{
        const char me[] = "zone_journal";
        const char *journalfile;
        isc_result_t result = ISC_R_SUCCESS;
        dns_journal_t *journal = NULL;
        unsigned int mode = DNS_JOURNAL_CREATE|DNS_JOURNAL_WRITE;

        ENTER;
        journalfile = dns_zone_getjournal(zone);
        if (journalfile != NULL) {
                result = dns_journal_open(zone->mctx, journalfile, mode,
                                          &journal);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "%s:dns_journal_open -> %s",
                                     caller, dns_result_totext(result));
                        return (result);
                }

                if (sourceserial != NULL)
                        dns_journal_set_sourceserial(journal, *sourceserial);

                result = dns_journal_write_transaction(journal, diff);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "%s:dns_journal_write_transaction -> %s",
                                     caller, dns_result_totext(result));
                }
                dns_journal_destroy(&journal);
        }

        return (result);
}

/*
 * Create an SOA record for a newly-created zone
 */
static isc_result_t
add_soa(dns_zone_t *zone, dns_db_t *db) {
        isc_result_t result;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        unsigned char buf[DNS_SOA_BUFFERSIZE];
        dns_dbversion_t *ver = NULL;
        dns_diff_t diff;

        dns_zone_log(zone, ISC_LOG_DEBUG(1), "creating SOA");

        dns_diff_init(zone->mctx, &diff);
        result = dns_db_newversion(db, &ver);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "add_soa:dns_db_newversion -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        /* Build SOA record */
        result = dns_soa_buildrdata(&zone->origin, dns_rootname, zone->rdclass,
                                    0, 0, 0, 0, 0, buf, &rdata);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "add_soa:dns_soa_buildrdata -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        result = update_one_rr(db, ver, &diff, DNS_DIFFOP_ADD,
                               &zone->origin, 0, &rdata);

failure:
        dns_diff_clear(&diff);
        if (ver != NULL)
                dns_db_closeversion(db, &ver, ISC_TF(result == ISC_R_SUCCESS));

        INSIST(ver == NULL);

        return (result);
}

/*
 * Synchronize the set of initializing keys found in managed-keys {}
 * statements with the set of trust anchors found in the managed-keys.bind
 * zone.  If a domain is no longer named in managed-keys, delete all keys
 * from that domain from the key zone.  If a domain is mentioned in in
 * managed-keys but there are no references to it in the key zone, load
 * the key zone with the initializing key(s) for that domain.
 */
static isc_result_t
sync_keyzone(dns_zone_t *zone, dns_db_t *db) {
        isc_result_t result = ISC_R_SUCCESS;
        isc_boolean_t changed = ISC_FALSE;
        isc_boolean_t commit = ISC_FALSE;
        dns_rbtnodechain_t chain;
        dns_fixedname_t fn;
        dns_name_t foundname, *origin;
        dns_keynode_t *keynode = NULL;
        dns_view_t *view = zone->view;
        dns_keytable_t *sr = NULL;
        dns_dbversion_t *ver = NULL;
        dns_diff_t diff;
        dns_rriterator_t rrit;

        dns_zone_log(zone, ISC_LOG_DEBUG(1), "synchronizing trusted keys");

        dns_name_init(&foundname, NULL);
        dns_fixedname_init(&fn);
        origin = dns_fixedname_name(&fn);

        dns_diff_init(zone->mctx, &diff);

        CHECK(dns_view_getsecroots(view, &sr));

        result = dns_db_newversion(db, &ver);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "sync_keyzone:dns_db_newversion -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        /*
         * Walk the zone DB.  If we find any keys whose names are no longer
         * in managed-keys (or *are* in trusted-keys, meaning they are
         * permanent and not RFC5011-maintained), delete them from the
         * zone.  Otherwise call load_secroots(), which loads keys into
         * secroots as appropriate.
         */
        dns_rriterator_init(&rrit, db, ver, 0);
        for (result = dns_rriterator_first(&rrit);
             result == ISC_R_SUCCESS;
             result = dns_rriterator_nextrrset(&rrit)) {
                dns_rdataset_t *rdataset = NULL;
                dns_name_t *rrname = NULL;
                isc_uint32_t ttl;

                dns_rriterator_current(&rrit, &rrname, &ttl,
                                       &rdataset, NULL);
                if (!dns_rdataset_isassociated(rdataset)) {
                        dns_rriterator_destroy(&rrit);
                        goto failure;
                }

                if (rdataset->type != dns_rdatatype_keydata)
                        continue;

                result = dns_keytable_find(sr, rrname, &keynode);
                if ((result != ISC_R_SUCCESS &&
                     result != DNS_R_PARTIALMATCH) ||
                    dns_keynode_managed(keynode) == ISC_FALSE)
                {
                        CHECK(delete_keydata(db, ver, &diff,
                                             rrname, rdataset));
                        changed = ISC_TRUE;
                } else {
                        load_secroots(zone, rrname, rdataset);
                }

                if (keynode != NULL)
                        dns_keytable_detachkeynode(sr, &keynode);
        }
        dns_rriterator_destroy(&rrit);

        /*
         * Now walk secroots to find any managed keys that aren't
         * in the zone.  If we find any, we add them to the zone.
         */
        RWLOCK(&sr->rwlock, isc_rwlocktype_write);
        dns_rbtnodechain_init(&chain, zone->mctx);
        result = dns_rbtnodechain_first(&chain, sr->table, &foundname, origin);
        if (result == ISC_R_NOTFOUND)
                result = ISC_R_NOMORE;
        while (result == DNS_R_NEWORIGIN || result == ISC_R_SUCCESS) {
                dns_rbtnode_t *rbtnode = NULL;

                dns_rbtnodechain_current(&chain, &foundname, origin, &rbtnode);
                if (rbtnode->data == NULL)
                        goto skip;

                dns_keytable_attachkeynode(sr, rbtnode->data, &keynode);
                if (dns_keynode_managed(keynode)) {
                        dns_fixedname_t fname;
                        dns_name_t *keyname;
                        dst_key_t *key;

                        key = dns_keynode_key(keynode);
                        dns_fixedname_init(&fname);

                        if (key == NULL)   /* fail_secure() was called. */
                                goto skip;

                        keyname = dst_key_name(key);
                        result = dns_db_find(db, keyname, ver,
                                             dns_rdatatype_keydata,
                                             DNS_DBFIND_NOWILD, 0, NULL,
                                             dns_fixedname_name(&fname),
                                             NULL, NULL);
                        if (result != ISC_R_SUCCESS)
                                result = create_keydata(zone, db, ver, &diff,
                                                        sr, &keynode, &changed);
                        if (result != ISC_R_SUCCESS)
                                break;
                }
  skip:
                result = dns_rbtnodechain_next(&chain, &foundname, origin);
                if (keynode != NULL)
                        dns_keytable_detachkeynode(sr, &keynode);
        }
        RWUNLOCK(&sr->rwlock, isc_rwlocktype_write);

        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;

        if (changed) {
                /* Write changes to journal file. */
                CHECK(update_soa_serial(db, ver, &diff, zone->mctx,
                                        zone->updatemethod));
                CHECK(zone_journal(zone, &diff, NULL, "sync_keyzone"));

                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_LOADED);
                zone_needdump(zone, 30);
                commit = ISC_TRUE;
        }

 failure:
        if (result != ISC_R_SUCCESS &&
            !DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED)) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "unable to synchronize managed keys: %s",
                             dns_result_totext(result));
                isc_time_settoepoch(&zone->refreshkeytime);
        }
        if (keynode != NULL)
                dns_keytable_detachkeynode(sr, &keynode);
        if (sr != NULL)
                dns_keytable_detach(&sr);
        if (ver != NULL)
                dns_db_closeversion(db, &ver, commit);
        dns_diff_clear(&diff);

        INSIST(ver == NULL);

        return (result);
}

isc_result_t
dns_zone_synckeyzone(dns_zone_t *zone) {
        isc_result_t result;
        dns_db_t *db = NULL;

        if (zone->type != dns_zone_key)
                return (DNS_R_BADZONE);

        CHECK(dns_zone_getdb(zone, &db));

        LOCK_ZONE(zone);
        result = sync_keyzone(zone, db);
        UNLOCK_ZONE(zone);

 failure:
        if (db != NULL)
                dns_db_detach(&db);
        return (result);
}

static void
maybe_send_secure(dns_zone_t *zone) {
        isc_result_t result;

        /*
         * We've finished loading, or else failed to load, an inline-signing
         * 'secure' zone.  We now need information about the status of the
         * 'raw' zone.  If we failed to load, then we need it to send a
         * copy of its database; if we succeeded, we need it to send its
         * serial number so that we can sync with it.  If it has not yet
         * loaded, we set a flag so that it will send the necessary
         * information when it has finished loading.
         */
        if (zone->raw->db != NULL) {
                if (zone->db != NULL) {
                        isc_uint32_t serial;
                        unsigned int soacount;

                        result = zone_get_from_db(zone->raw, zone->raw->db,
                                                  NULL, &soacount, &serial, NULL,
                                                  NULL, NULL, NULL, NULL);
                        if (result == ISC_R_SUCCESS && soacount > 0U)
                                zone_send_secureserial(zone->raw, serial);
                } else
                        zone_send_securedb(zone->raw, zone->raw->db);

        } else
                DNS_ZONE_SETFLAG(zone->raw, DNS_ZONEFLG_SENDSECURE);
}

static isc_boolean_t
zone_unchanged(dns_db_t *db1, dns_db_t *db2, isc_mem_t *mctx) {
        isc_result_t result;
        isc_boolean_t answer = ISC_FALSE;
        dns_diff_t diff;

        dns_diff_init(mctx, &diff);
        result = dns_db_diffx(&diff, db1, NULL, db2, NULL, NULL);
        if (result == ISC_R_SUCCESS && ISC_LIST_EMPTY(diff.tuples))
                answer = ISC_TRUE;
        dns_diff_clear(&diff);
        return (answer);
}

/*
 * The zone is presumed to be locked.
 * If this is a inline_raw zone the secure version is also locked.
 */
static isc_result_t
zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime,
              isc_result_t result)
{
        unsigned int soacount = 0;
        unsigned int nscount = 0;
        unsigned int errors = 0;
        isc_uint32_t serial, oldserial, refresh, retry, expire, minimum;
        isc_time_t now;
        isc_boolean_t needdump = ISC_FALSE;
        isc_boolean_t hasinclude = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_HASINCLUDE);
        isc_boolean_t nomaster = ISC_FALSE;
        unsigned int options;
        dns_include_t *inc;

        INSIST(LOCKED_ZONE(zone));
        if (inline_raw(zone))
                INSIST(LOCKED_ZONE(zone->secure));

        TIME_NOW(&now);

        /*
         * Initiate zone transfer?  We may need a error code that
         * indicates that the "permanent" form does not exist.
         * XXX better error feedback to log.
         */
        if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
                if (zone->type == dns_zone_slave ||
                    zone->type == dns_zone_stub ||
                    (zone->type == dns_zone_redirect &&
                     zone->masters == NULL)) {
                        if (result == ISC_R_FILENOTFOUND)
                                dns_zone_log(zone, ISC_LOG_DEBUG(1),
                                             "no master file");
                        else if (result != DNS_R_NOMASTERFILE)
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "loading from master file %s "
                                             "failed: %s",
                                             zone->masterfile,
                                             dns_result_totext(result));
                } else if (zone->type == dns_zone_master &&
                           inline_secure(zone) && result == ISC_R_FILENOTFOUND)
                {
                        dns_zone_log(zone, ISC_LOG_DEBUG(1),
                                     "no master file, requesting db");
                        maybe_send_secure(zone);
                } else {
                        int level = ISC_LOG_ERROR;
                        if (zone->type == dns_zone_key &&
                            result == ISC_R_FILENOTFOUND)
                                level = ISC_LOG_DEBUG(1);
                        dns_zone_log(zone, level,
                                     "loading from master file %s failed: %s",
                                     zone->masterfile,
                                     dns_result_totext(result));
                        nomaster = ISC_TRUE;
                }

                if (zone->type != dns_zone_key)
                        goto cleanup;
        }

        dns_zone_log(zone, ISC_LOG_DEBUG(2),
                     "number of nodes in database: %u",
                     dns_db_nodecount(db));

        if (result == DNS_R_SEENINCLUDE)
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HASINCLUDE);
        else
                DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_HASINCLUDE);

        /*
         * If there's no master file for a key zone, then the zone is new:
         * create an SOA record.  (We do this now, instead of later, so that
         * if there happens to be a journal file, we can roll forward from
         * a sane starting point.)
         */
        if (nomaster && zone->type == dns_zone_key) {
                result = add_soa(zone, db);
                if (result != ISC_R_SUCCESS)
                        goto cleanup;
        }

        /*
         * Apply update log, if any, on initial load.
         */
        if (zone->journal != NULL &&
            ! DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NOMERGE) &&
            ! DNS_ZONE_FLAG(zone, DNS_ZONEFLG_LOADED))
        {
                if (zone->type == dns_zone_master &&
                    (zone->update_acl != NULL || zone->ssutable != NULL))
                        options = DNS_JOURNALOPT_RESIGN;
                else
                        options = 0;
                result = dns_journal_rollforward(zone->mctx, db, options,
                                                 zone->journal);
                if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND &&
                    result != DNS_R_UPTODATE && result != DNS_R_NOJOURNAL &&
                    result != ISC_R_RANGE) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "journal rollforward failed: %s",
                                     dns_result_totext(result));
                        goto cleanup;


                }
                if (result == ISC_R_NOTFOUND || result == ISC_R_RANGE) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "journal rollforward failed: "
                                     "journal out of sync with zone");
                        goto cleanup;
                }
                dns_zone_log(zone, ISC_LOG_DEBUG(1),
                             "journal rollforward completed "
                             "successfully: %s",
                             dns_result_totext(result));
                if (result == ISC_R_SUCCESS)
                        needdump = ISC_TRUE;
        }

        /*
         * Obtain ns, soa and cname counts for top of zone.
         */
        INSIST(db != NULL);
        result = zone_get_from_db(zone, db, &nscount, &soacount, &serial,
                                  &refresh, &retry, &expire, &minimum,
                                  &errors);
        if (result != ISC_R_SUCCESS && zone->type != dns_zone_key) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "could not find NS and/or SOA records");
        }

        /*
         * Check to make sure the journal is up to date, and remove the
         * journal file if it isn't, as we wouldn't be able to apply
         * updates otherwise.
         */
        if (zone->journal != NULL && dns_zone_isdynamic(zone, ISC_TRUE) &&
            ! DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS)) {
                isc_uint32_t jserial;
                dns_journal_t *journal = NULL;

                result = dns_journal_open(zone->mctx, zone->journal,
                                          DNS_JOURNAL_READ, &journal);
                if (result == ISC_R_SUCCESS) {
                        jserial = dns_journal_last_serial(journal);
                        dns_journal_destroy(&journal);
                } else {
                        jserial = serial;
                        result = ISC_R_SUCCESS;
                }

                if (jserial != serial) {
                        dns_zone_log(zone, ISC_LOG_INFO,
                                     "journal file is out of date: "
                                     "removing journal file");
                        if (remove(zone->journal) < 0 && errno != ENOENT) {
                                char strbuf[ISC_STRERRORSIZE];
                                isc__strerror(errno, strbuf, sizeof(strbuf));
                                isc_log_write(dns_lctx,
                                              DNS_LOGCATEGORY_GENERAL,
                                              DNS_LOGMODULE_ZONE,
                                              ISC_LOG_WARNING,
                                              "unable to remove journal "
                                              "'%s': '%s'",
                                              zone->journal, strbuf);
                        }
                }
        }

        dns_zone_log(zone, ISC_LOG_DEBUG(1), "loaded; checking validity");

        /*
         * Master / Slave / Stub zones require both NS and SOA records at
         * the top of the zone.
         */

        switch (zone->type) {
        case dns_zone_dlz:
        case dns_zone_master:
        case dns_zone_slave:
        case dns_zone_stub:
        case dns_zone_redirect:
                if (soacount != 1) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "has %d SOA records", soacount);
                        result = DNS_R_BADZONE;
                }
                if (nscount == 0) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "has no NS records");
                        result = DNS_R_BADZONE;
                }
                if (result != ISC_R_SUCCESS)
                        goto cleanup;
                if (zone->type == dns_zone_master && errors != 0) {
                        result = DNS_R_BADZONE;
                        goto cleanup;
                }
                if (zone->type != dns_zone_stub &&
                    zone->type != dns_zone_redirect) {
                        result = check_nsec3param(zone, db);
                        if (result != ISC_R_SUCCESS)
                                goto cleanup;
                }
                if (zone->type == dns_zone_master &&
                    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKINTEGRITY) &&
                    !integrity_checks(zone, db)) {
                        result = DNS_R_BADZONE;
                        goto cleanup;
                }
                if (zone->type == dns_zone_master &&
                    DNS_ZONE_OPTION(zone, DNS_ZONEOPT_CHECKDUPRR) &&
                    !zone_check_dup(zone, db)) {
                        result = DNS_R_BADZONE;
                        goto cleanup;
                }

                if (zone->db != NULL) {
                        unsigned int oldsoacount;

                        /*
                         * This is checked in zone_replacedb() for slave zones
                         * as they don't reload from disk.
                         */
                        result = zone_get_from_db(zone, zone->db, NULL,
                                                  &oldsoacount, &oldserial,
                                                  NULL, NULL, NULL, NULL,
                                                  NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
                        RUNTIME_CHECK(soacount > 0U);
                        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS) &&
                            !isc_serial_gt(serial, oldserial)) {
                                isc_uint32_t serialmin, serialmax;

                                INSIST(zone->type == dns_zone_master);

                                if (serial == oldserial &&
                                    zone_unchanged(zone->db, db, zone->mctx)) {
                                        dns_zone_log(zone, ISC_LOG_INFO,
                                                     "ixfr-from-differences: "
                                                     "unchanged");
                                        return(ISC_R_SUCCESS);
                                }

                                serialmin = (oldserial + 1) & 0xffffffffU;
                                serialmax = (oldserial + 0x7fffffffU) &
                                             0xffffffffU;
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "ixfr-from-differences: "
                                             "new serial (%u) out of range "
                                             "[%u - %u]", serial, serialmin,
                                             serialmax);
                                result = DNS_R_BADZONE;
                                goto cleanup;
                        } else if (!isc_serial_ge(serial, oldserial))
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "zone serial (%u/%u) has gone "
                                             "backwards", serial, oldserial);
                        else if (serial == oldserial && !hasinclude &&
                                 strcmp(zone->db_argv[0], "_builtin") != 0)
                                dns_zone_log(zone, ISC_LOG_ERROR,
                                             "zone serial (%u) unchanged. "
                                             "zone may fail to transfer "
                                             "to slaves.", serial);
                }

                if (zone->type == dns_zone_master &&
                    (zone->update_acl != NULL || zone->ssutable != NULL) &&
                    zone->sigresigninginterval < (3 * refresh) &&
                    dns_db_issecure(db))
                {
                        dns_zone_log(zone, ISC_LOG_WARNING,
                                     "sig-re-signing-interval less than "
                                     "3 * refresh.");
                }

                zone->refresh = RANGE(refresh,
                                      zone->minrefresh, zone->maxrefresh);
                zone->retry = RANGE(retry,
                                    zone->minretry, zone->maxretry);
                zone->expire = RANGE(expire, zone->refresh + zone->retry,
                                     DNS_MAX_EXPIRE);
                zone->minimum = minimum;
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_HAVETIMERS);

                if (zone->type == dns_zone_slave ||
                    zone->type == dns_zone_stub ||
                    (zone->type == dns_zone_redirect &&
                     zone->masters != NULL)) {
                        isc_time_t t;
                        isc_uint32_t delay;

                        result = isc_file_getmodtime(zone->journal, &t);
                        if (result != ISC_R_SUCCESS)
                                result = isc_file_getmodtime(zone->masterfile,
                                                             &t);
                        if (result == ISC_R_SUCCESS)
                                DNS_ZONE_TIME_ADD(&t, zone->expire,
                                                  &zone->expiretime);
                        else
                                DNS_ZONE_TIME_ADD(&now, zone->retry,
                                                  &zone->expiretime);

                        delay = isc_random_jitter(zone->retry,
                                                  (zone->retry * 3) / 4);
                        DNS_ZONE_TIME_ADD(&now, delay, &zone->refreshtime);
                        if (isc_time_compare(&zone->refreshtime,
                                             &zone->expiretime) >= 0)
                                zone->refreshtime = now;
                }

                break;

        case dns_zone_key:
                result = sync_keyzone(zone, db);
                if (result != ISC_R_SUCCESS)
                        goto cleanup;
                break;

        default:
                UNEXPECTED_ERROR(__FILE__, __LINE__,
                                 "unexpected zone type %d", zone->type);
                result = ISC_R_UNEXPECTED;
                goto cleanup;
        }

        /*
         * Check for weak DNSKEY's.
         */
        if (zone->type == dns_zone_master)
                zone_check_dnskeys(zone, db);

        /*
         * Schedule DNSSEC key refresh.
         */
        if (zone->type == dns_zone_master &&
            DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_MAINTAIN))
                zone->refreshkeytime = now;

#if 0
        /* destroy notification example. */
        {
                isc_event_t *e = isc_event_allocate(zone->mctx, NULL,
                                                    DNS_EVENT_DBDESTROYED,
                                                    dns_zonemgr_dbdestroyed,
                                                    zone,
                                                    sizeof(isc_event_t));
                dns_db_ondestroy(db, zone->task, &e);
        }
#endif

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
        if (zone->db != NULL) {
                result = zone_replacedb(zone, db, ISC_FALSE);
                ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
                if (result != ISC_R_SUCCESS)
                        goto cleanup;
        } else {
                result = dns_db_rpz_ready(db);
                if (result != ISC_R_SUCCESS)
                        goto cleanup;
                zone_attachdb(zone, db);
                ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
                DNS_ZONE_SETFLAG(zone,
                                 DNS_ZONEFLG_LOADED|
                                 DNS_ZONEFLG_NEEDSTARTUPNOTIFY);
                if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SENDSECURE) &&
                    inline_raw(zone))
                {
                        if (zone->secure->db == NULL)
                                zone_send_securedb(zone, db);
                        else
                                zone_send_secureserial(zone, serial);
                }
        }

        /*
         * Finished loading inline-signing zone; need to get status
         * from the raw side now.
         */
        if (zone->type == dns_zone_master && inline_secure(zone))
                maybe_send_secure(zone);


        result = ISC_R_SUCCESS;

        if (needdump) {
                if (zone->type == dns_zone_key)
                        zone_needdump(zone, 30);
                else
                        zone_needdump(zone, DNS_DUMP_DELAY);
        }

        if (zone->task != NULL) {
                if (zone->type == dns_zone_master) {
                        set_resigntime(zone);
                        resume_signingwithkey(zone);
                        resume_addnsec3chain(zone);
                }

                if (zone->type == dns_zone_master &&
                    !DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN) &&
                    dns_zone_isdynamic(zone, ISC_FALSE) &&
                    dns_db_issecure(db)) {
                        dns_name_t *name;
                        dns_fixedname_t fixed;
                        dns_rdataset_t next;

                        dns_rdataset_init(&next);
                        dns_fixedname_init(&fixed);
                        name = dns_fixedname_name(&fixed);

                        result = dns_db_getsigningtime(db, &next, name);
                        if (result == ISC_R_SUCCESS) {
                                isc_stdtime_t timenow;
                                char namebuf[DNS_NAME_FORMATSIZE];
                                char typebuf[DNS_RDATATYPE_FORMATSIZE];

                                isc_stdtime_get(&timenow);
                                dns_name_format(name, namebuf, sizeof(namebuf));
                                dns_rdatatype_format(next.covers,
                                                     typebuf, sizeof(typebuf));
                                dns_zone_log(zone, ISC_LOG_DEBUG(3),
                                             "next resign: %s/%s in %d seconds",
                                             namebuf, typebuf,
                                             next.resign - timenow -
                                             zone->sigresigninginterval);
                                dns_rdataset_disassociate(&next);
                        } else
                                dns_zone_log(zone, ISC_LOG_WARNING,
                                             "signed dynamic zone has no "
                                             "resign event scheduled");
                }

                zone_settimer(zone, &now);
        }

        /*
         * Clear old include list.
         */
        for (inc = ISC_LIST_HEAD(zone->includes);
             inc != NULL;
             inc = ISC_LIST_HEAD(zone->includes)) {
                ISC_LIST_UNLINK(zone->includes, inc, link);
                isc_mem_free(zone->mctx, inc->name);
                isc_mem_put(zone->mctx, inc, sizeof(*inc));
        }
        zone->nincludes = 0;

        /*
         * Transfer new include list.
         */
        for (inc = ISC_LIST_HEAD(zone->newincludes);
             inc != NULL;
             inc = ISC_LIST_HEAD(zone->newincludes)) {
                ISC_LIST_UNLINK(zone->newincludes, inc, link);
                ISC_LIST_APPEND(zone->includes, inc, link);
                zone->nincludes++;
        }

        if (! dns_db_ispersistent(db))
                dns_zone_log(zone, ISC_LOG_INFO, "loaded serial %u%s", serial,
                             dns_db_issecure(db) ? " (DNSSEC signed)" : "");

        zone->loadtime = loadtime;
        DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_LOADPENDING);
        return (result);

 cleanup:
        for (inc = ISC_LIST_HEAD(zone->newincludes);
             inc != NULL;
             inc = ISC_LIST_HEAD(zone->newincludes)) {
                ISC_LIST_UNLINK(zone->newincludes, inc, link);
                isc_mem_free(zone->mctx, inc->name);
                isc_mem_put(zone->mctx, inc, sizeof(*inc));
        }
        if (zone->type == dns_zone_slave ||
            zone->type == dns_zone_stub ||
            zone->type == dns_zone_key ||
            (zone->type == dns_zone_redirect && zone->masters != NULL)) {
                if (zone->journal != NULL)
                        zone_saveunique(zone, zone->journal, "jn-XXXXXXXX");
                if (zone->masterfile != NULL)
                        zone_saveunique(zone, zone->masterfile, "db-XXXXXXXX");

                /* Mark the zone for immediate refresh. */
                zone->refreshtime = now;
                if (zone->task != NULL)
                        zone_settimer(zone, &now);
                result = ISC_R_SUCCESS;
        } else if (zone->type == dns_zone_master ||
                   zone->type == dns_zone_redirect) {
                if (!(inline_secure(zone) && result == ISC_R_FILENOTFOUND))
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "not loaded due to errors.");
                else if (zone->type == dns_zone_master)
                        result = ISC_R_SUCCESS;
        }

        return (result);
}

static isc_boolean_t
exit_check(dns_zone_t *zone) {
        REQUIRE(LOCKED_ZONE(zone));

        if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_SHUTDOWN) && zone->irefs == 0) {
                /*
                 * DNS_ZONEFLG_SHUTDOWN can only be set if erefs == 0.
                 */
                INSIST(isc_refcount_current(&zone->erefs) == 0);
                return (ISC_TRUE);
        }
        return (ISC_FALSE);
}

static isc_boolean_t
zone_check_ns(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version,
              dns_name_t *name, isc_boolean_t logit)
{
        isc_result_t result;
        char namebuf[DNS_NAME_FORMATSIZE];
        char altbuf[DNS_NAME_FORMATSIZE];
        dns_fixedname_t fixed;
        dns_name_t *foundname;
        int level;

        if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_NOCHECKNS))
                return (ISC_TRUE);

        if (zone->type == dns_zone_master)
                level = ISC_LOG_ERROR;
        else
                level = ISC_LOG_WARNING;

        dns_fixedname_init(&fixed);
        foundname = dns_fixedname_name(&fixed);

        result = dns_db_find(db, name, version, dns_rdatatype_a,
                             0, 0, NULL, foundname, NULL, NULL);
        if (result == ISC_R_SUCCESS)
                return (ISC_TRUE);

        if (result == DNS_R_NXRRSET) {
                result = dns_db_find(db, name, version, dns_rdatatype_aaaa,
                                     0, 0, NULL, foundname, NULL, NULL);
                if (result == ISC_R_SUCCESS)
                        return (ISC_TRUE);
        }

        if (result == DNS_R_NXRRSET || result == DNS_R_NXDOMAIN ||
            result == DNS_R_EMPTYNAME) {
                if (logit) {
                        dns_name_format(name, namebuf, sizeof namebuf);
                        dns_zone_log(zone, level, "NS '%s' has no address "
                                     "records (A or AAAA)", namebuf);
                }
                return (ISC_FALSE);
        }

        if (result == DNS_R_CNAME) {
                if (logit) {
                        dns_name_format(name, namebuf, sizeof namebuf);
                        dns_zone_log(zone, level, "NS '%s' is a CNAME "
                                     "(illegal)", namebuf);
                }
                return (ISC_FALSE);
        }

        if (result == DNS_R_DNAME) {
                if (logit) {
                        dns_name_format(name, namebuf, sizeof namebuf);
                        dns_name_format(foundname, altbuf, sizeof altbuf);
                        dns_zone_log(zone, level, "NS '%s' is below a DNAME "
                                     "'%s' (illegal)", namebuf, altbuf);
                }
                return (ISC_FALSE);
        }

        return (ISC_TRUE);
}

static isc_result_t
zone_count_ns_rr(dns_zone_t *zone, dns_db_t *db, dns_dbnode_t *node,
                 dns_dbversion_t *version, unsigned int *nscount,
                 unsigned int *errors, isc_boolean_t logit)
{
        isc_result_t result;
        unsigned int count = 0;
        unsigned int ecount = 0;
        dns_rdataset_t rdataset;
        dns_rdata_t rdata;
        dns_rdata_ns_t ns;

        dns_rdataset_init(&rdataset);
        result = dns_db_findrdataset(db, node, version, dns_rdatatype_ns,
                                     dns_rdatatype_none, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto success;
        }
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto invalidate_rdataset;
        }

        result = dns_rdataset_first(&rdataset);
        while (result == ISC_R_SUCCESS) {
                if (errors != NULL && zone->rdclass == dns_rdataclass_in &&
                    (zone->type == dns_zone_master ||
                     zone->type == dns_zone_slave)) {
                        dns_rdata_init(&rdata);
                        dns_rdataset_current(&rdataset, &rdata);
                        result = dns_rdata_tostruct(&rdata, &ns, NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
                        if (dns_name_issubdomain(&ns.name, &zone->origin) &&
                            !zone_check_ns(zone, db, version, &ns.name, logit))
                                ecount++;
                }
                count++;
                result = dns_rdataset_next(&rdataset);
        }
        dns_rdataset_disassociate(&rdataset);

 success:
        if (nscount != NULL)
                *nscount = count;
        if (errors != NULL)
                *errors = ecount;

        result = ISC_R_SUCCESS;

 invalidate_rdataset:
        dns_rdataset_invalidate(&rdataset);

        return (result);
}

static isc_result_t
zone_load_soa_rr(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
                 unsigned int *soacount,
                 isc_uint32_t *serial, isc_uint32_t *refresh,
                 isc_uint32_t *retry, isc_uint32_t *expire,
                 isc_uint32_t *minimum)
{
        isc_result_t result;
        unsigned int count;
        dns_rdataset_t rdataset;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdata_soa_t soa;

        dns_rdataset_init(&rdataset);
        result = dns_db_findrdataset(db, node, version, dns_rdatatype_soa,
                                     dns_rdatatype_none, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                if (soacount != NULL)
                        *soacount = 0;
                if (serial != NULL)
                        *serial = 0;
                if (refresh != NULL)
                        *refresh = 0;
                if (retry != NULL)
                        *retry = 0;
                if (expire != NULL)
                        *expire = 0;
                if (minimum != NULL)
                        *minimum = 0;
                result = ISC_R_SUCCESS;
                goto invalidate_rdataset;
        }
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto invalidate_rdataset;
        }

        count = 0;
        result = dns_rdataset_first(&rdataset);
        while (result == ISC_R_SUCCESS) {
                dns_rdata_init(&rdata);
                dns_rdataset_current(&rdataset, &rdata);
                count++;
                if (count == 1) {
                        result = dns_rdata_tostruct(&rdata, &soa, NULL);
                        RUNTIME_CHECK(result == ISC_R_SUCCESS);
                }

                result = dns_rdataset_next(&rdataset);
                dns_rdata_reset(&rdata);
        }
        dns_rdataset_disassociate(&rdataset);

        if (soacount != NULL)
                *soacount = count;

        if (count > 0) {
                if (serial != NULL)
                        *serial = soa.serial;
                if (refresh != NULL)
                        *refresh = soa.refresh;
                if (retry != NULL)
                        *retry = soa.retry;
                if (expire != NULL)
                        *expire = soa.expire;
                if (minimum != NULL)
                        *minimum = soa.minimum;
        } else {
                if (soacount != NULL)
                        *soacount = 0;
                if (serial != NULL)
                        *serial = 0;
                if (refresh != NULL)
                        *refresh = 0;
                if (retry != NULL)
                        *retry = 0;
                if (expire != NULL)
                        *expire = 0;
                if (minimum != NULL)
                        *minimum = 0;
        }

        result = ISC_R_SUCCESS;

 invalidate_rdataset:
        dns_rdataset_invalidate(&rdataset);

        return (result);
}

/*
 * zone must be locked.
 */
static isc_result_t
zone_get_from_db(dns_zone_t *zone, dns_db_t *db, unsigned int *nscount,
                 unsigned int *soacount, isc_uint32_t *serial,
                 isc_uint32_t *refresh, isc_uint32_t *retry,
                 isc_uint32_t *expire, isc_uint32_t *minimum,
                 unsigned int *errors)
{
        isc_result_t result;
        isc_result_t answer = ISC_R_SUCCESS;
        dns_dbversion_t *version = NULL;
        dns_dbnode_t *node;

        REQUIRE(db != NULL);
        REQUIRE(zone != NULL);

        dns_db_currentversion(db, &version);

        if (nscount != NULL)
                *nscount = 0;
        if (soacount != NULL)
                *soacount = 0;
        if (serial != NULL)
                *serial = 0;
        if (refresh != NULL)
                *refresh = 0;
        if (retry != NULL)
                *retry = 0;
        if (expire != NULL)
                *expire = 0;
        if (errors != NULL)
                *errors = 0;

        node = NULL;
        result = dns_db_findnode(db, &zone->origin, ISC_FALSE, &node);
        if (result != ISC_R_SUCCESS) {
                answer = result;
                goto closeversion;
        }

        if (nscount != NULL || errors != NULL) {
                result = zone_count_ns_rr(zone, db, node, version,
                                          nscount, errors, ISC_TRUE);
                if (result != ISC_R_SUCCESS)
                        answer = result;
        }

        if (soacount != NULL || serial != NULL || refresh != NULL
            || retry != NULL || expire != NULL || minimum != NULL) {
                result = zone_load_soa_rr(db, node, version, soacount,
                                          serial, refresh, retry, expire,
                                          minimum);
                if (result != ISC_R_SUCCESS)
                        answer = result;
        }

        dns_db_detachnode(db, &node);
 closeversion:
        dns_db_closeversion(db, &version, ISC_FALSE);

        return (answer);
}

void
dns_zone_attach(dns_zone_t *source, dns_zone_t **target) {
        REQUIRE(DNS_ZONE_VALID(source));
        REQUIRE(target != NULL && *target == NULL);
        isc_refcount_increment(&source->erefs, NULL);
        *target = source;
}

void
dns_zone_detach(dns_zone_t **zonep) {
        dns_zone_t *zone;
        dns_zone_t *raw = NULL;
        dns_zone_t *secure = NULL;
        unsigned int refs;
        isc_boolean_t free_now = ISC_FALSE;

        REQUIRE(zonep != NULL && DNS_ZONE_VALID(*zonep));

        zone = *zonep;

        isc_refcount_decrement(&zone->erefs, &refs);

        if (refs == 0) {
                LOCK_ZONE(zone);
                INSIST(zone != zone->raw);
                /*
                 * We just detached the last external reference.
                 */
                if (zone->task != NULL) {
                        /*
                         * This zone is being managed.  Post
                         * its control event and let it clean
                         * up synchronously in the context of
                         * its task.
                         */
                        isc_event_t *ev = &zone->ctlevent;
                        isc_task_send(zone->task, &ev);
                } else {
                        /*
                         * This zone is not being managed; it has
                         * no task and can have no outstanding
                         * events.  Free it immediately.
                         */
                        /*
                         * Unmanaged zones should not have non-null views;
                         * we have no way of detaching from the view here
                         * without causing deadlock because this code is called
                         * with the view already locked.
                         */
                        INSIST(zone->view == NULL);
                        free_now = ISC_TRUE;
                        raw = zone->raw;
                        zone->raw = NULL;
                        secure = zone->secure;
                        zone->secure = NULL;
                }
                UNLOCK_ZONE(zone);
        }
        *zonep = NULL;
        if (free_now) {
                if (raw != NULL)
                        dns_zone_detach(&raw);
                if (secure != NULL)
                        dns_zone_idetach(&secure);
                zone_free(zone);
        }
}

void
dns_zone_iattach(dns_zone_t *source, dns_zone_t **target) {
        REQUIRE(DNS_ZONE_VALID(source));
        REQUIRE(target != NULL && *target == NULL);
        LOCK_ZONE(source);
        zone_iattach(source, target);
        UNLOCK_ZONE(source);
}

static void
zone_iattach(dns_zone_t *source, dns_zone_t **target) {

        /*
         * 'source' locked by caller.
         */
        REQUIRE(LOCKED_ZONE(source));
        REQUIRE(DNS_ZONE_VALID(source));
        REQUIRE(target != NULL && *target == NULL);
        INSIST(source->irefs + isc_refcount_current(&source->erefs) > 0);
        source->irefs++;
        INSIST(source->irefs != 0);
        *target = source;
}

static void
zone_idetach(dns_zone_t **zonep) {
        dns_zone_t *zone;

        /*
         * 'zone' locked by caller.
         */
        REQUIRE(zonep != NULL && DNS_ZONE_VALID(*zonep));
        zone = *zonep;
        REQUIRE(LOCKED_ZONE(*zonep));
        *zonep = NULL;

        INSIST(zone->irefs > 0);
        zone->irefs--;
        INSIST(zone->irefs + isc_refcount_current(&zone->erefs) > 0);
}

void
dns_zone_idetach(dns_zone_t **zonep) {
        dns_zone_t *zone;
        isc_boolean_t free_needed;

        REQUIRE(zonep != NULL && DNS_ZONE_VALID(*zonep));
        zone = *zonep;
        *zonep = NULL;

        LOCK_ZONE(zone);
        INSIST(zone->irefs > 0);
        zone->irefs--;
        free_needed = exit_check(zone);
        UNLOCK_ZONE(zone);
        if (free_needed)
                zone_free(zone);
}

isc_mem_t *
dns_zone_getmctx(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->mctx);
}

dns_zonemgr_t *
dns_zone_getmgr(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->zmgr);
}

void
dns_zone_setflag(dns_zone_t *zone, unsigned int flags, isc_boolean_t value) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        if (value)
                DNS_ZONE_SETFLAG(zone, flags);
        else
                DNS_ZONE_CLRFLAG(zone, flags);
        UNLOCK_ZONE(zone);
}

void
dns_zone_setoption(dns_zone_t *zone, unsigned int option,
                   isc_boolean_t value)
{
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        if (value)
                zone->options |= option;
        else
                zone->options &= ~option;
        UNLOCK_ZONE(zone);
}

void
dns_zone_setoption2(dns_zone_t *zone, unsigned int option,
                    isc_boolean_t value)
{
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        if (value)
                zone->options2 |= option;
        else
                zone->options2 &= ~option;
        UNLOCK_ZONE(zone);
}

unsigned int
dns_zone_getoptions(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->options);
}

unsigned int
dns_zone_getoptions2(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->options2);
}

void
dns_zone_setkeyopt(dns_zone_t *zone, unsigned int keyopt, isc_boolean_t value)
{
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        if (value)
                zone->keyopts |= keyopt;
        else
                zone->keyopts &= ~keyopt;
        UNLOCK_ZONE(zone);
}

unsigned int
dns_zone_getkeyopts(dns_zone_t *zone) {

        REQUIRE(DNS_ZONE_VALID(zone));

        return (zone->keyopts);
}

isc_result_t
dns_zone_setxfrsource4(dns_zone_t *zone, const isc_sockaddr_t *xfrsource) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->xfrsource4 = *xfrsource;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_sockaddr_t *
dns_zone_getxfrsource4(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (&zone->xfrsource4);
}

isc_result_t
dns_zone_setxfrsource4dscp(dns_zone_t *zone, isc_dscp_t dscp) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->xfrsource4dscp = dscp;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_dscp_t
dns_zone_getxfrsource4dscp(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (zone->xfrsource4dscp);
}

isc_result_t
dns_zone_setxfrsource6(dns_zone_t *zone, const isc_sockaddr_t *xfrsource) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->xfrsource6 = *xfrsource;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_sockaddr_t *
dns_zone_getxfrsource6(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (&zone->xfrsource6);
}

isc_dscp_t
dns_zone_getxfrsource6dscp(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (zone->xfrsource6dscp);
}

isc_result_t
dns_zone_setxfrsource6dscp(dns_zone_t *zone, isc_dscp_t dscp) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->xfrsource6dscp = dscp;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_result_t
dns_zone_setaltxfrsource4(dns_zone_t *zone,
                          const isc_sockaddr_t *altxfrsource)
{
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->altxfrsource4 = *altxfrsource;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_sockaddr_t *
dns_zone_getaltxfrsource4(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (&zone->altxfrsource4);
}

isc_result_t
dns_zone_setaltxfrsource4dscp(dns_zone_t *zone, isc_dscp_t dscp) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->altxfrsource4dscp = dscp;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_dscp_t
dns_zone_getaltxfrsource4dscp(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (zone->altxfrsource4dscp);
}

isc_result_t
dns_zone_setaltxfrsource6(dns_zone_t *zone,
                          const isc_sockaddr_t *altxfrsource)
{
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->altxfrsource6 = *altxfrsource;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_sockaddr_t *
dns_zone_getaltxfrsource6(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (&zone->altxfrsource6);
}

isc_result_t
dns_zone_setaltxfrsource6dscp(dns_zone_t *zone, isc_dscp_t dscp) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->altxfrsource6dscp = dscp;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_dscp_t
dns_zone_getaltxfrsource6dscp(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (zone->altxfrsource6dscp);
}

isc_result_t
dns_zone_setnotifysrc4(dns_zone_t *zone, const isc_sockaddr_t *notifysrc) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->notifysrc4 = *notifysrc;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_sockaddr_t *
dns_zone_getnotifysrc4(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (&zone->notifysrc4);
}

isc_result_t
dns_zone_setnotifysrc4dscp(dns_zone_t *zone, isc_dscp_t dscp) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->notifysrc4dscp = dscp;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_dscp_t
dns_zone_getnotifysrc4dscp(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (zone->notifysrc4dscp);
}

isc_result_t
dns_zone_setnotifysrc6(dns_zone_t *zone, const isc_sockaddr_t *notifysrc) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->notifysrc6 = *notifysrc;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_sockaddr_t *
dns_zone_getnotifysrc6(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (&zone->notifysrc6);
}

static isc_boolean_t
same_addrs(const isc_sockaddr_t *old, const isc_sockaddr_t *new,
             isc_uint32_t count)
{
        unsigned int i;

        for (i = 0; i < count; i++)
                if (!isc_sockaddr_equal(&old[i], &new[i]))
                        return (ISC_FALSE);
        return (ISC_TRUE);
}

static isc_boolean_t
same_keynames(dns_name_t **old, dns_name_t **new, isc_uint32_t count) {
        unsigned int i;

        if (old == NULL && new == NULL)
                return (ISC_TRUE);
        if (old == NULL || new == NULL)
                return (ISC_FALSE);

        for (i = 0; i < count; i++) {
                if (old[i] == NULL && new[i] == NULL)
                        continue;
                if (old[i] == NULL || new[i] == NULL ||
                     !dns_name_equal(old[i], new[i]))
                        return (ISC_FALSE);
        }
        return (ISC_TRUE);
}

static void
clear_addresskeylist(isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
                     dns_name_t ***keynamesp, unsigned int *countp,
                     isc_mem_t *mctx)
{
        unsigned int count;
        isc_sockaddr_t *addrs;
        isc_dscp_t *dscps;
        dns_name_t **keynames;

        REQUIRE(countp != NULL && addrsp != NULL && dscpsp != NULL &&
                keynamesp != NULL);

        count = *countp;
        *countp = 0;
        addrs = *addrsp;
        *addrsp = NULL;
        dscps = *dscpsp;
        *dscpsp = NULL;
        keynames = *keynamesp;
        *keynamesp = NULL;

        if (addrs != NULL)
                isc_mem_put(mctx, addrs, count * sizeof(isc_sockaddr_t));

        if (dscps != NULL)
                isc_mem_put(mctx, dscps, count * sizeof(isc_dscp_t));

        if (keynames != NULL) {
                unsigned int i;
                for (i = 0; i < count; i++) {
                        if (keynames[i] != NULL) {
                                dns_name_free(keynames[i], mctx);
                                isc_mem_put(mctx, keynames[i],
                                            sizeof(dns_name_t));
                                keynames[i] = NULL;
                        }
                }
                isc_mem_put(mctx, keynames, count * sizeof(dns_name_t *));
        }
}

static isc_result_t
set_addrkeylist(unsigned int count,
                const isc_sockaddr_t *addrs, isc_sockaddr_t **newaddrsp,
                const isc_dscp_t *dscp, isc_dscp_t **newdscpp,
                dns_name_t **names, dns_name_t ***newnamesp,
                isc_mem_t *mctx)
{
        isc_result_t result;
        isc_sockaddr_t *newaddrs = NULL;
        isc_dscp_t *newdscp = NULL;
        dns_name_t **newnames = NULL;
        unsigned int i;

        REQUIRE(newaddrsp != NULL && *newaddrsp == NULL);
        REQUIRE(newdscpp != NULL && *newdscpp == NULL);
        REQUIRE(newnamesp != NULL && *newnamesp == NULL);

        newaddrs = isc_mem_get(mctx, count * sizeof(*newaddrs));
        if (newaddrs == NULL)
                return (ISC_R_NOMEMORY);
        memmove(newaddrs, addrs, count * sizeof(*newaddrs));

        if (dscp != NULL) {
                newdscp = isc_mem_get(mctx, count * sizeof(*newdscp));
                if (newdscp == NULL) {
                        isc_mem_put(mctx, newaddrs, count * sizeof(*newaddrs));
                        return (ISC_R_NOMEMORY);
                }
                memmove(newdscp, dscp, count * sizeof(*newdscp));
        } else
                newdscp = NULL;

        if (names != NULL) {
                newnames = isc_mem_get(mctx, count * sizeof(*newnames));
                if (newnames == NULL) {
                        if (newdscp != NULL)
                                isc_mem_put(mctx, newdscp,
                                            count * sizeof(*newdscp));
                        isc_mem_put(mctx, newaddrs, count * sizeof(*newaddrs));
                        return (ISC_R_NOMEMORY);
                }
                for (i = 0; i < count; i++)
                        newnames[i] = NULL;
                for (i = 0; i < count; i++) {
                        if (names[i] != NULL) {
                                newnames[i] = isc_mem_get(mctx,
                                                         sizeof(dns_name_t));
                                if (newnames[i] == NULL)
                                        goto allocfail;
                                dns_name_init(newnames[i], NULL);
                                result = dns_name_dup(names[i], mctx,
                                                      newnames[i]);
                                if (result != ISC_R_SUCCESS) {
                                allocfail:
                                        for (i = 0; i < count; i++)
                                                if (newnames[i] != NULL)
                                                        dns_name_free(
                                                               newnames[i],
                                                               mctx);
                                        isc_mem_put(mctx, newaddrs,
                                                    count * sizeof(*newaddrs));
                                        isc_mem_put(mctx, newdscp,
                                                    count * sizeof(*newdscp));
                                        isc_mem_put(mctx, newnames,
                                                    count * sizeof(*newnames));
                                        return (ISC_R_NOMEMORY);
                                }
                        }
                }
        } else
                newnames = NULL;

        *newdscpp = newdscp;
        *newaddrsp = newaddrs;
        *newnamesp = newnames;
        return (ISC_R_SUCCESS);
}

isc_result_t
dns_zone_setnotifysrc6dscp(dns_zone_t *zone, isc_dscp_t dscp) {
        REQUIRE(DNS_ZONE_VALID(zone));

        LOCK_ZONE(zone);
        zone->notifysrc6dscp = dscp;
        UNLOCK_ZONE(zone);

        return (ISC_R_SUCCESS);
}

isc_dscp_t
dns_zone_getnotifysrc6dscp(dns_zone_t *zone) {
        REQUIRE(DNS_ZONE_VALID(zone));
        return (zone->notifysrc6dscp);
}

isc_result_t
dns_zone_setalsonotify(dns_zone_t *zone, const isc_sockaddr_t *notify,
                       isc_uint32_t count)
{
        return (dns_zone_setalsonotifydscpkeys(zone, notify, NULL, NULL,
                                               count));
}

isc_result_t
dns_zone_setalsonotifywithkeys(dns_zone_t *zone, const isc_sockaddr_t *notify,
                               dns_name_t **keynames, isc_uint32_t count)
{
        return (dns_zone_setalsonotifydscpkeys(zone, notify, NULL, keynames,
                                               count));
}

isc_result_t
dns_zone_setalsonotifydscpkeys(dns_zone_t *zone, const isc_sockaddr_t *notify,
                               const isc_dscp_t *dscps, dns_name_t **keynames,
                               isc_uint32_t count)
{
        isc_result_t result;
        isc_sockaddr_t *newaddrs = NULL;
        isc_dscp_t *newdscps = NULL;
        dns_name_t **newnames = NULL;

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(count == 0 || notify != NULL);
        if (keynames != NULL)
                REQUIRE(count != 0);

        LOCK_ZONE(zone);

        if (count == zone->notifycnt &&
            same_addrs(zone->notify, notify, count) &&
            same_keynames(zone->notifykeynames, keynames, count))
                goto unlock;

        clear_addresskeylist(&zone->notify, &zone->notifydscp,
                             &zone->notifykeynames, &zone->notifycnt,
                             zone->mctx);

        if (count == 0)
                goto unlock;

        /*
         * Set up the notify and notifykey lists
         */
        result = set_addrkeylist(count, notify, &newaddrs, dscps, &newdscps,
                                 keynames, &newnames, zone->mctx);
        if (result != ISC_R_SUCCESS)
                goto unlock;

        /*
         * Everything is ok so attach to the zone.
         */
        zone->notify = newaddrs;
        zone->notifydscp = newdscps;
        zone->notifykeynames = newnames;
        zone->notifycnt = count;
 unlock:
        UNLOCK_ZONE(zone);
        return (ISC_R_SUCCESS);
}

isc_result_t
dns_zone_setmasters(dns_zone_t *zone, const isc_sockaddr_t *masters,
                    isc_uint32_t count)
{
        isc_result_t result;

        result = dns_zone_setmasterswithkeys(zone, masters, NULL, count);
        return (result);
}

isc_result_t
dns_zone_setmasterswithkeys(dns_zone_t *zone,
                            const isc_sockaddr_t *masters,
                            dns_name_t **keynames,
                            isc_uint32_t count)
{
        isc_result_t result = ISC_R_SUCCESS;
        isc_sockaddr_t *newaddrs = NULL;
        isc_dscp_t *newdscps = NULL;
        dns_name_t **newnames = NULL;
        isc_boolean_t *newok;
        unsigned int i;

        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(count == 0 || masters != NULL);
        if (keynames != NULL) {
                REQUIRE(count != 0);
        }

        LOCK_ZONE(zone);
        /*
         * The refresh code assumes that 'masters' wouldn't change under it.
         * If it will change then kill off any current refresh in progress
         * and update the masters info.  If it won't change then we can just
         * unlock and exit.
         */
        if (count != zone->masterscnt ||
            !same_addrs(zone->masters, masters, count) ||
            !same_keynames(zone->masterkeynames, keynames, count)) {
                if (zone->request != NULL)
                        dns_request_cancel(zone->request);
        } else
                goto unlock;

        /*
         * This needs to happen before clear_addresskeylist() sets
         * zone->masterscnt to 0:
         */
        if (zone->mastersok != NULL) {
                isc_mem_put(zone->mctx, zone->mastersok,
                            zone->masterscnt * sizeof(isc_boolean_t));
                zone->mastersok = NULL;
        }
        clear_addresskeylist(&zone->masters, &zone->masterdscps,
                             &zone->masterkeynames, &zone->masterscnt,
                             zone->mctx);
        /*
         * If count == 0, don't allocate any space for masters, mastersok or
         * keynames so internally, those pointers are NULL if count == 0
         */
        if (count == 0)
                goto unlock;

        /*
         * mastersok must contain count elements
         */
        newok = isc_mem_get(zone->mctx, count * sizeof(*newok));
        if (newok == NULL) {
                result = ISC_R_NOMEMORY;
                isc_mem_put(zone->mctx, newaddrs, count * sizeof(*newaddrs));
                goto unlock;
        };
        for (i = 0; i < count; i++)
                newok[i] = ISC_FALSE;

        /*
         * Now set up the masters and masterkey lists
         */
        result = set_addrkeylist(count, masters, &newaddrs, NULL, &newdscps,
                                 keynames, &newnames, zone->mctx);
        INSIST(newdscps == NULL);
        if (result != ISC_R_SUCCESS) {
                isc_mem_put(zone->mctx, newok, count * sizeof(*newok));
                goto unlock;
        }

        /*
         * Everything is ok so attach to the zone.
         */
        zone->curmaster = 0;
        zone->mastersok = newok;
        zone->masters = newaddrs;
        zone->masterdscps = newdscps;
        zone->masterkeynames = newnames;
        zone->masterscnt = count;
        DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NOMASTERS);

 unlock:
        UNLOCK_ZONE(zone);
        return (result);
}

isc_result_t
dns_zone_getdb(dns_zone_t *zone, dns_db_t **dpb) {
        isc_result_t result = ISC_R_SUCCESS;

        REQUIRE(DNS_ZONE_VALID(zone));

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        if (zone->db == NULL)
                result = DNS_R_NOTLOADED;
        else
                dns_db_attach(zone->db, dpb);
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);

        return (result);
}

void
dns_zone_setdb(dns_zone_t *zone, dns_db_t *db) {
        REQUIRE(DNS_ZONE_VALID(zone));
        REQUIRE(zone->type == dns_zone_staticstub);

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_write);
        REQUIRE(zone->db == NULL);
        dns_db_attach(db, &zone->db);
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_write);
}

/*
 * Co-ordinates the starting of routine jobs.
 */

void
dns_zone_maintenance(dns_zone_t *zone) {
        const char me[] = "dns_zone_maintenance";
        isc_time_t now;

        REQUIRE(DNS_ZONE_VALID(zone));
        ENTER;

        LOCK_ZONE(zone);
        TIME_NOW(&now);
        zone_settimer(zone, &now);
        UNLOCK_ZONE(zone);
}

static inline isc_boolean_t
was_dumping(dns_zone_t *zone) {
        isc_boolean_t dumping;

        REQUIRE(LOCKED_ZONE(zone));

        dumping = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING);
        DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_DUMPING);
        if (!dumping) {
                DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDDUMP);
                isc_time_settoepoch(&zone->dumptime);
        }
        return (dumping);
}

static isc_result_t
find_zone_keys(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver,
               isc_mem_t *mctx, unsigned int maxkeys,
               dst_key_t **keys, unsigned int *nkeys)
{
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        const char *directory = dns_zone_getkeydirectory(zone);

        CHECK(dns_db_findnode(db, dns_db_origin(db), ISC_FALSE, &node));
        memset(keys, 0, sizeof(*keys) * maxkeys);
        result = dns_dnssec_findzonekeys2(db, ver, node, dns_db_origin(db),
                                          directory, mctx, maxkeys, keys,
                                          nkeys);
        if (result == ISC_R_NOTFOUND)
                result = ISC_R_SUCCESS;
 failure:
        if (node != NULL)
                dns_db_detachnode(db, &node);
        return (result);
}

static isc_result_t
offline(dns_db_t *db, dns_dbversion_t *ver, zonediff_t *zonediff,
        dns_name_t *name, dns_ttl_t ttl, dns_rdata_t *rdata)
{
        isc_result_t result;

        if ((rdata->flags & DNS_RDATA_OFFLINE) != 0)
                return (ISC_R_SUCCESS);
        result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_DELRESIGN,
                               name, ttl, rdata);
        if (result != ISC_R_SUCCESS)
                return (result);
        rdata->flags |= DNS_RDATA_OFFLINE;
        result = update_one_rr(db, ver, zonediff->diff, DNS_DIFFOP_ADDRESIGN,
                               name, ttl, rdata);
        zonediff->offline = ISC_TRUE;
        return (result);
}

static void
set_key_expiry_warning(dns_zone_t *zone, isc_stdtime_t when, isc_stdtime_t now)
{
        unsigned int delta;
        char timebuf[80];

        zone->key_expiry = when;
        if (when <= now) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "DNSKEY RRSIG(s) have expired");
                isc_time_settoepoch(&zone->keywarntime);
        } else if (when < now + 7 * 24 * 3600) {
                isc_time_t t;
                isc_time_set(&t, when, 0);
                isc_time_formattimestamp(&t, timebuf, 80);
                dns_zone_log(zone, ISC_LOG_WARNING,
                             "DNSKEY RRSIG(s) will expire within 7 days: %s",
                             timebuf);
                delta = when - now;
                delta--;                /* loop prevention */
                delta /= 24 * 3600;     /* to whole days */
                delta *= 24 * 3600;     /* to seconds */
                isc_time_set(&zone->keywarntime, when - delta, 0);
        }  else {
                isc_time_set(&zone->keywarntime, when - 7 * 24 * 3600, 0);
                isc_time_formattimestamp(&zone->refreshkeytime, timebuf, 80);
                dns_zone_log(zone, ISC_LOG_NOTICE,
                             "setting keywarntime to %s", timebuf);
        }
}

/*
 * Helper function to del_sigs(). We don't want to delete RRSIGs that
 * have no new key.
 */
static isc_boolean_t
delsig_ok(dns_rdata_rrsig_t *rrsig_ptr, dst_key_t **keys, unsigned int nkeys,
          isc_boolean_t *warn)
{
        unsigned int i = 0;
        isc_boolean_t have_ksk = ISC_FALSE, have_zsk = ISC_FALSE;
        isc_boolean_t have_pksk = ISC_FALSE, have_pzsk = ISC_FALSE;

        for (i = 0; i < nkeys; i++) {
                if (rrsig_ptr->algorithm != dst_key_alg(keys[i]))
                        continue;
                if (dst_key_isprivate(keys[i])) {
                        if (KSK(keys[i]))
                                have_ksk = have_pksk = ISC_TRUE;
                        else
                                have_zsk = have_pzsk = ISC_TRUE;
                } else {
                        if (KSK(keys[i]))
                                have_ksk = ISC_TRUE;
                        else
                                have_zsk = ISC_TRUE;
                }
        }

        if (have_zsk && have_ksk && !have_pzsk)
                *warn = ISC_TRUE;

        /*
         * It's okay to delete a signature if there is an active key
         * with the same algorithm to replace it.
         */
        if (have_pksk || have_pzsk)
                return (ISC_TRUE);

        /*
         * Failing that, it is *not* okay to delete a signature
         * if the associated public key is still in the DNSKEY RRset
         */
        for (i = 0; i < nkeys; i++) {
                if ((rrsig_ptr->algorithm == dst_key_alg(keys[i])) &&
                    (rrsig_ptr->keyid == dst_key_id(keys[i])))
                        return (ISC_FALSE);
        }

        /*
         * But if the key is gone, then go ahead.
         */
        return (ISC_TRUE);
}

/*
 * Delete expired RRsigs and any RRsigs we are about to re-sign.
 * See also update.c:del_keysigs().
 */
static isc_result_t
del_sigs(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
         dns_rdatatype_t type, zonediff_t *zonediff, dst_key_t **keys,
         unsigned int nkeys, isc_stdtime_t now, isc_boolean_t incremental)
{
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        dns_rdataset_t rdataset;
        unsigned int i;
        dns_rdata_rrsig_t rrsig;
        isc_boolean_t found;
        isc_int64_t timewarn = 0, timemaybe = 0;

        dns_rdataset_init(&rdataset);

        if (type == dns_rdatatype_nsec3)
                result = dns_db_findnsec3node(db, name, ISC_FALSE, &node);
        else
                result = dns_db_findnode(db, name, ISC_FALSE, &node);
        if (result == ISC_R_NOTFOUND)
                return (ISC_R_SUCCESS);
        if (result != ISC_R_SUCCESS)
                goto failure;
        result = dns_db_findrdataset(db, node, ver, dns_rdatatype_rrsig, type,
                                     (isc_stdtime_t) 0, &rdataset, NULL);
        dns_db_detachnode(db, &node);

        if (result == ISC_R_NOTFOUND) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                return (ISC_R_SUCCESS);
        }
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto failure;
        }

        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset)) {
                dns_rdata_t rdata = DNS_RDATA_INIT;

                dns_rdataset_current(&rdataset, &rdata);
                result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
                RUNTIME_CHECK(result == ISC_R_SUCCESS);

                if (type != dns_rdatatype_dnskey) {
                        isc_boolean_t warn = ISC_FALSE, deleted = ISC_FALSE;
                        if (delsig_ok(&rrsig, keys, nkeys, &warn)) {
                                result = update_one_rr(db, ver, zonediff->diff,
                                               DNS_DIFFOP_DELRESIGN, name,
                                               rdataset.ttl, &rdata);
                                if (result != ISC_R_SUCCESS)
                                        break;
                                deleted = ISC_TRUE;
                        }
                        if (warn) {
                                /*
                                 * At this point, we've got an RRSIG,
                                 * which is signed by an inactive key.
                                 * An administrator needs to provide a new
                                 * key/alg, but until that time, we want to
                                 * keep the old RRSIG.  Marking the key as
                                 * offline will prevent us spinning waiting
                                 * for the private part.
                                 */
                                if (incremental && !deleted) {
                                        result = offline(db, ver, zonediff,
                                                         name, rdataset.ttl,
                                                         &rdata);
                                        if (result != ISC_R_SUCCESS)
                                                break;
                                }

                                /*
                                 * Log the key id and algorithm of
                                 * the inactive key with no replacement
                                 */
                                if (zone->log_key_expired_timer <= now) {
                                        char origin[DNS_NAME_FORMATSIZE];
                                        char algbuf[DNS_NAME_FORMATSIZE];
                                        dns_name_format(&zone->origin, origin,
                                                        sizeof(origin));
                                        dns_secalg_format(rrsig.algorithm,
                                                          algbuf,
                                                          sizeof(algbuf));
                                        dns_zone_log(zone, ISC_LOG_WARNING,
                                                     "Key %s/%s/%d "
                                                     "missing or inactive "
                                                     "and has no replacement: "
                                                     "retaining signatures.",
                                                     origin, algbuf,
                                                     rrsig.keyid);
                                        zone->log_key_expired_timer = now +
                                                                        3600;
                                }
                        }
                        continue;
                }

                /*
                 * RRSIG(DNSKEY) requires special processing.
                 */
                found = ISC_FALSE;
                for (i = 0; i < nkeys; i++) {
                        if (rrsig.algorithm == dst_key_alg(keys[i]) &&
                            rrsig.keyid == dst_key_id(keys[i])) {
                                found = ISC_TRUE;
                                /*
                                 * Mark offline RRSIG(DNSKEY).
                                 * We want the earliest offline expire time
                                 * iff there is a new offline signature.
                                 */
                                if (!dst_key_inactive(keys[i]) &&
                                    !dst_key_isprivate(keys[i]))
                                {
                                        isc_int64_t timeexpire =
                                           dns_time64_from32(rrsig.timeexpire);
                                        if (timewarn != 0 &&
                                            timewarn > timeexpire)
                                                timewarn = timeexpire;
                                        if (rdata.flags & DNS_RDATA_OFFLINE) {
                                                if (timemaybe == 0 ||
                                                    timemaybe > timeexpire)
                                                        timemaybe = timeexpire;
                                                break;
                                        }
                                        if (timewarn == 0)
                                                timewarn = timemaybe;
                                        if (timewarn == 0 ||
                                            timewarn > timeexpire)
                                                timewarn = timeexpire;
                                        result = offline(db, ver, zonediff,
                                                         name, rdataset.ttl,
                                                         &rdata);
                                        break;
                                }
                                result = update_one_rr(db, ver, zonediff->diff,
                                                       DNS_DIFFOP_DELRESIGN,
                                                       name, rdataset.ttl,
                                                       &rdata);
                                break;
                        }
                }

                /*
                 * If there is not a matching DNSKEY then
                 * delete the RRSIG.
                 */
                if (!found)
                        result = update_one_rr(db, ver, zonediff->diff,
                                               DNS_DIFFOP_DELRESIGN, name,
                                               rdataset.ttl, &rdata);
                if (result != ISC_R_SUCCESS)
                        break;
        }

        dns_rdataset_disassociate(&rdataset);
        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;
        if (timewarn > 0) {
#if defined(STDTIME_ON_32BITS)
                isc_stdtime_t stdwarn = (isc_stdtime_t)timewarn;
                if (timewarn == stdwarn)
#endif
                        set_key_expiry_warning(zone, (isc_stdtime_t)timewarn,
                                               now);
#if defined(STDTIME_ON_32BITS)
                else
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "key expiry warning time out of range");
#endif
        }
 failure:
        if (node != NULL)
                dns_db_detachnode(db, &node);
        return (result);
}

static isc_result_t
add_sigs(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
         dns_rdatatype_t type, dns_diff_t *diff, dst_key_t **keys,
         unsigned int nkeys, isc_mem_t *mctx, isc_stdtime_t inception,
         isc_stdtime_t expire, isc_boolean_t check_ksk,
         isc_boolean_t keyset_kskonly)
{
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        dns_rdataset_t rdataset;
        dns_rdata_t sig_rdata = DNS_RDATA_INIT;
        unsigned char data[1024]; /* XXX */
        isc_buffer_t buffer;
        unsigned int i, j;

        dns_rdataset_init(&rdataset);
        isc_buffer_init(&buffer, data, sizeof(data));

        if (type == dns_rdatatype_nsec3)
                result = dns_db_findnsec3node(db, name, ISC_FALSE, &node);
        else
                result = dns_db_findnode(db, name, ISC_FALSE, &node);
        if (result == ISC_R_NOTFOUND)
                return (ISC_R_SUCCESS);
        if (result != ISC_R_SUCCESS)
                goto failure;
        result = dns_db_findrdataset(db, node, ver, type, 0,
                                     (isc_stdtime_t) 0, &rdataset, NULL);
        dns_db_detachnode(db, &node);
        if (result == ISC_R_NOTFOUND) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                return (ISC_R_SUCCESS);
        }
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto failure;
        }

        for (i = 0; i < nkeys; i++) {
                isc_boolean_t both = ISC_FALSE;

                if (!dst_key_isprivate(keys[i]))
                        continue;

                if (check_ksk && !REVOKE(keys[i])) {
                        isc_boolean_t have_ksk, have_nonksk;
                        if (KSK(keys[i])) {
                                have_ksk = ISC_TRUE;
                                have_nonksk = ISC_FALSE;
                        } else {
                                have_ksk = ISC_FALSE;
                                have_nonksk = ISC_TRUE;
                        }
                        for (j = 0; j < nkeys; j++) {
                                if (j == i || ALG(keys[i]) != ALG(keys[j]))
                                        continue;
                                if (REVOKE(keys[j]))
                                        continue;
                                if (KSK(keys[j]))
                                        have_ksk = ISC_TRUE;
                                else
                                        have_nonksk = ISC_TRUE;
                                both = have_ksk && have_nonksk;
                                if (both)
                                        break;
                        }
                }
                if (both) {
                        if (type == dns_rdatatype_dnskey) {
                                if (!KSK(keys[i]) && keyset_kskonly)
                                        continue;
                        } else if (KSK(keys[i]))
                                continue;
                } else if (REVOKE(keys[i]) && type != dns_rdatatype_dnskey)
                                continue;

                /* Calculate the signature, creating a RRSIG RDATA. */
                isc_buffer_clear(&buffer);
                CHECK(dns_dnssec_sign(name, &rdataset, keys[i],
                                      &inception, &expire,
                                      mctx, &buffer, &sig_rdata));
                /* Update the database and journal with the RRSIG. */
                /* XXX inefficient - will cause dataset merging */
                CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADDRESIGN,
                                    name, rdataset.ttl, &sig_rdata));
                dns_rdata_reset(&sig_rdata);
                isc_buffer_init(&buffer, data, sizeof(data));
        }

 failure:
        if (dns_rdataset_isassociated(&rdataset))
                dns_rdataset_disassociate(&rdataset);
        if (node != NULL)
                dns_db_detachnode(db, &node);
        return (result);
}

static void
zone_resigninc(dns_zone_t *zone) {
        const char *me = "zone_resigninc";
        dns_db_t *db = NULL;
        dns_dbversion_t *version = NULL;
        dns_diff_t _sig_diff;
        zonediff_t zonediff;
        dns_fixedname_t fixed;
        dns_name_t *name;
        dns_rdataset_t rdataset;
        dns_rdatatype_t covers;
        dst_key_t *zone_keys[DNS_MAXZONEKEYS];
        isc_boolean_t check_ksk, keyset_kskonly = ISC_FALSE;
        isc_result_t result;
        isc_stdtime_t now, inception, soaexpire, expire, stop;
        isc_uint32_t jitter;
        unsigned int i;
        unsigned int nkeys = 0;
        unsigned int resign;

        ENTER;

        dns_rdataset_init(&rdataset);
        dns_fixedname_init(&fixed);
        dns_diff_init(zone->mctx, &_sig_diff);
        zonediff_init(&zonediff, &_sig_diff);

        /*
         * Zone is frozen or automatic resigning is disabled.
         * Pause for 5 minutes.
         */
        if (zone->update_disabled ||
            DNS_ZONEKEY_OPTION(zone, DNS_ZONEKEY_NORESIGN))
        {
                result = ISC_R_FAILURE;
                goto failure;
        }

        ZONEDB_LOCK(&zone->dblock, isc_rwlocktype_read);
        dns_db_attach(zone->db, &db);
        ZONEDB_UNLOCK(&zone->dblock, isc_rwlocktype_read);

        result = dns_db_newversion(db, &version);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:dns_db_newversion -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        result = find_zone_keys(zone, db, version, zone->mctx, DNS_MAXZONEKEYS,
                                zone_keys, &nkeys);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:find_zone_keys -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        isc_stdtime_get(&now);
        inception = now - 3600; /* Allow for clock skew. */
        soaexpire = now + dns_zone_getsigvalidityinterval(zone);
        /*
         * Spread out signatures over time if they happen to be
         * clumped.  We don't do this for each add_sigs() call as
         * we still want some clustering to occur.
         */
        isc_random_get(&jitter);
        expire = soaexpire - jitter % 3600;
        stop = now + 5;

        check_ksk = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_UPDATECHECKKSK);
        keyset_kskonly = DNS_ZONE_OPTION(zone, DNS_ZONEOPT_DNSKEYKSKONLY);

        name = dns_fixedname_name(&fixed);
        result = dns_db_getsigningtime(db, &rdataset, name);
        if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:dns_db_getsigningtime -> %s",
                             dns_result_totext(result));
        }

        i = 0;
        while (result == ISC_R_SUCCESS) {
                resign = rdataset.resign - zone->sigresigninginterval;
                covers = rdataset.covers;
                dns_rdataset_disassociate(&rdataset);

                /*
                 * Stop if we hit the SOA as that means we have walked the
                 * entire zone.  The SOA record should always be the most
                 * recent signature.
                 */
                /* XXXMPA increase number of RRsets signed pre call */
                if (covers == dns_rdatatype_soa || i++ > zone->signatures ||
                    resign > stop)
                        break;

                result = del_sigs(zone, db, version, name, covers, &zonediff,
                                  zone_keys, nkeys, now, ISC_TRUE);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "zone_resigninc:del_sigs -> %s",
                                     dns_result_totext(result));
                        break;
                }

                result = add_sigs(db, version, name, covers, zonediff.diff,
                                  zone_keys, nkeys, zone->mctx, inception,
                                  expire, check_ksk, keyset_kskonly);
                if (result != ISC_R_SUCCESS) {
                        dns_zone_log(zone, ISC_LOG_ERROR,
                                     "zone_resigninc:add_sigs -> %s",
                                     dns_result_totext(result));
                        break;
                }
                result  = dns_db_getsigningtime(db, &rdataset, name);
                if (nkeys == 0 && result == ISC_R_NOTFOUND) {
                        result = ISC_R_SUCCESS;
                        break;
                }
                if (result != ISC_R_SUCCESS)
                        dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:dns_db_getsigningtime -> %s",
                                     dns_result_totext(result));
        }

        if (result != ISC_R_NOMORE && result != ISC_R_SUCCESS)
                goto failure;

        result = del_sigs(zone, db, version, &zone->origin, dns_rdatatype_soa,
                          &zonediff, zone_keys, nkeys, now, ISC_TRUE);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:del_sigs -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        /*
         * Did we change anything in the zone?
         */
        if (ISC_LIST_EMPTY(zonediff.diff->tuples)) {
                /*
                 * Commit the changes if any key has been marked as offline.                     */
                if (zonediff.offline)
                        dns_db_closeversion(db, &version, ISC_TRUE);
                goto failure;
        }

        /* Increment SOA serial if we have made changes */
        result = update_soa_serial(db, version, zonediff.diff, zone->mctx,
                                   zone->updatemethod);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:update_soa_serial -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        /*
         * Generate maximum life time signatures so that the above loop
         * termination is sensible.
         */
        result = add_sigs(db, version, &zone->origin, dns_rdatatype_soa,
                          zonediff.diff, zone_keys, nkeys, zone->mctx,
                          inception, soaexpire, check_ksk, keyset_kskonly);
        if (result != ISC_R_SUCCESS) {
                dns_zone_log(zone, ISC_LOG_ERROR,
                             "zone_resigninc:add_sigs -> %s",
                             dns_result_totext(result));
                goto failure;
        }

        /* Write changes to journal file. */
        CHECK(zone_journal(zone, zonediff.diff, NULL, "zone_resigninc"));

        /* Everything has succeeded. Commit the changes. */
        dns_db_closeversion(db, &version, ISC_TRUE);

 failure:
        dns_diff_clear(&_sig_diff);
        for (i = 0; i < nkeys; i++)
                dst_key_free(&zone_keys[i]);
        if (version != NULL) {
                dns_db_closeversion(zone->db, &version, ISC_FALSE);
                dns_db_detach(&db);
        } else if (db != NULL)
                dns_db_detach(&db);
        if (result == ISC_R_SUCCESS) {
                set_resigntime(zone);
                LOCK_ZONE(zone);
                zone_needdump(zone, DNS_DUMP_DELAY);
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
                UNLOCK_ZONE(zone);
        } else {
                /*
                 * Something failed.  Retry in 5 minutes.
                 */
                isc_interval_t ival;
                isc_interval_set(&ival, 300, 0);
                isc_time_nowplusinterval(&zone->resigntime, &ival);
        }

        INSIST(version == NULL);
}

static isc_result_t
next_active(dns_db_t *db, dns_dbversion_t *version, dns_name_t *oldname,
            dns_name_t *newname, isc_boolean_t bottom)
{
        isc_result_t result;
        dns_dbiterator_t *dbit = NULL;
        dns_rdatasetiter_t *rdsit = NULL;
        dns_dbnode_t *node = NULL;

        CHECK(dns_db_createiterator(db, DNS_DB_NONSEC3, &dbit));
        CHECK(dns_dbiterator_seek(dbit, oldname));
        do {
                result = dns_dbiterator_next(dbit);
                if (result == ISC_R_NOMORE)
                        CHECK(dns_dbiterator_first(dbit));
                CHECK(dns_dbiterator_current(dbit, &node, newname));
                if (bottom && dns_name_issubdomain(newname, oldname) &&
                    !dns_name_equal(newname, oldname)) {
                        dns_db_detachnode(db, &node);
                        continue;
                }
                /*
                 * Is this node empty?
                 */
                CHECK(dns_db_allrdatasets(db, node, version, 0, &rdsit));
                result = dns_rdatasetiter_first(rdsit);
                dns_db_detachnode(db, &node);
                dns_rdatasetiter_destroy(&rdsit);
                if (result != ISC_R_NOMORE)
                        break;
        } while (1);
 failure:
        if (node != NULL)
                dns_db_detachnode(db, &node);
        if (dbit != NULL)
                dns_dbiterator_destroy(&dbit);
        return (result);
}

static isc_boolean_t
signed_with_key(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
                dns_rdatatype_t type, dst_key_t *key)
{
        isc_result_t result;
        dns_rdataset_t rdataset;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdata_rrsig_t rrsig;

        dns_rdataset_init(&rdataset);
        result = dns_db_findrdataset(db, node, version, dns_rdatatype_rrsig,
                                     type, 0, &rdataset, NULL);
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                return (ISC_FALSE);
        }
        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset)) {
                dns_rdataset_current(&rdataset, &rdata);
                result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
                INSIST(result == ISC_R_SUCCESS);
                if (rrsig.algorithm == dst_key_alg(key) &&
                    rrsig.keyid == dst_key_id(key)) {
                        dns_rdataset_disassociate(&rdataset);
                        return (ISC_TRUE);
                }
                dns_rdata_reset(&rdata);
        }
        dns_rdataset_disassociate(&rdataset);
        return (ISC_FALSE);
}

static isc_result_t
add_nsec(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
         dns_dbnode_t *node, dns_ttl_t ttl, isc_boolean_t bottom,
         dns_diff_t *diff)
{
        dns_fixedname_t fixed;
        dns_name_t *next;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        isc_result_t result;
        unsigned char nsecbuffer[DNS_NSEC_BUFFERSIZE];

        dns_fixedname_init(&fixed);
        next = dns_fixedname_name(&fixed);

        CHECK(next_active(db, version, name, next, bottom));
        CHECK(dns_nsec_buildrdata(db, version, node, next, nsecbuffer,
                                  &rdata));
        CHECK(update_one_rr(db, version, diff, DNS_DIFFOP_ADD, name, ttl,
                            &rdata));
 failure:
        return (result);
}

static isc_result_t
sign_a_node(dns_db_t *db, dns_name_t *name, dns_dbnode_t *node,
            dns_dbversion_t *version, isc_boolean_t build_nsec3,
            isc_boolean_t build_nsec, dst_key_t *key,
            isc_stdtime_t inception, isc_stdtime_t expire,
            unsigned int minimum, isc_boolean_t is_ksk,
            isc_boolean_t keyset_kskonly, isc_boolean_t *delegation,
            dns_diff_t *diff, isc_int32_t *signatures, isc_mem_t *mctx)
{
        isc_result_t result;
        dns_rdatasetiter_t *iterator = NULL;
        dns_rdataset_t rdataset;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        isc_buffer_t buffer;
        unsigned char data[1024];
        isc_boolean_t seen_soa, seen_ns, seen_rr, seen_dname, seen_nsec,
                      seen_nsec3, seen_ds;
        isc_boolean_t bottom;

        result = dns_db_allrdatasets(db, node, version, 0, &iterator);
        if (result != ISC_R_SUCCESS) {
                if (result == ISC_R_NOTFOUND)
                        result = ISC_R_SUCCESS;
                return (result);
        }

        dns_rdataset_init(&rdataset);
        isc_buffer_init(&buffer, data, sizeof(data));
        seen_rr = seen_soa = seen_ns = seen_dname = seen_nsec =
        seen_nsec3 = seen_ds = ISC_FALSE;
        for (result = dns_rdatasetiter_first(iterator);
             result == ISC_R_SUCCESS;
             result = dns_rdatasetiter_next(iterator)) {
                dns_rdatasetiter_current(iterator, &rdataset);
                if (rdataset.type == dns_rdatatype_soa)
                        seen_soa = ISC_TRUE;
                else if (rdataset.type == dns_rdatatype_ns)
                        seen_ns = ISC_TRUE;
                else if (rdataset.type == dns_rdatatype_ds)
                        seen_ds = ISC_TRUE;
                else if (rdataset.type == dns_rdatatype_dname)
                        seen_dname = ISC_TRUE;
                else if (rdataset.type == dns_rdatatype_nsec)
                        seen_nsec = ISC_TRUE;
                else if (rdataset.type == dns_rdatatype_nsec3)
                        seen_nsec3 = ISC_TRUE;
                if (rdataset.type != dns_rdatatype_rrsig)
                        seen_rr = ISC_TRUE;
                dns_rdataset_disassociate(&rdataset);
        }
        if (result != ISC_R_NOMORE)
                goto failure;
        if (seen_ns && !seen_soa)
                *delegation = ISC_TRUE;
        /*
         * Going from insecure to NSEC3.
         * Don't generate NSEC3 records for NSEC3 records.
         */
        if (build_nsec3 && !seen_nsec3 && seen_rr) {
                isc_boolean_t unsecure = !seen_ds && seen_ns && !seen_soa;
                CHECK(dns_nsec3_addnsec3s(db, version, name, minimum,
                                          unsecure, diff));
                (*signatures)--;
        }
        /*
         * Going from insecure to NSEC.
         * Don't generate NSEC records for NSEC3 records.
         */
        if (build_nsec && !seen_nsec3 && !seen_nsec && seen_rr) {
                /* Build and add NSEC. */
                bottom = (seen_ns && !seen_soa) || seen_dname;
                /*
                 * Build a NSEC record except at the origin.
                 */
                if (!dns_name_equal(name, dns_db_origin(db))) {
                        CHECK(add_nsec(db, version, name, node, minimum,
                                       bottom, diff));
                        /* Count a NSEC generation as a signature generation. */
                        (*signatures)--;
                }
        }
        result = dns_rdatasetiter_first(iterator);
        while (result == ISC_R_SUCCESS) {
                dns_rdatasetiter_current(iterator, &rdataset);
                if (rdataset.type == dns_rdatatype_soa ||
                    rdataset.type == dns_rdatatype_rrsig)
                        goto next_rdataset;
                if (rdataset.type == dns_rdatatype_dnskey) {
                        if (!is_ksk && keyset_kskonly)
                                goto next_rdataset;
                } else if (is_ksk)
                        goto next_rdataset;
                if (*delegation &&
                    rdataset.type != dns_rdatatype_ds &&
                    rdataset.type != dns_rdatatype_nsec)
                        goto next_rdataset;
                if (signed_with_key(db, node, version, rdataset.type, key))
                        goto next_rdataset;
                /* Calculate the signature, creating a RRSIG RDATA. */
                isc_buffer_clear(&buffer);
                CHECK(dns_dnssec_sign(name, &rdataset, key, &inception,
                                      &expire, mctx, &buffer, &rdata));
                /* Update the database and journal with the RRSIG. */
                /* XXX inefficient - will cause dataset merging */
                CHECK(update_one_rr(db, version, diff, DNS_DIFFOP_ADDRESIGN,
                                    name, rdataset.ttl, &rdata));
                dns_rdata_reset(&rdata);
                (*signatures)--;
 next_rdataset:
                dns_rdataset_disassociate(&rdataset);
                result = dns_rdatasetiter_next(iterator);
        }
        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;
        if (seen_dname)
                *delegation = ISC_TRUE;
 failure:
        if (dns_rdataset_isassociated(&rdataset))
                dns_rdataset_disassociate(&rdataset);
        if (iterator != NULL)
                dns_rdatasetiter_destroy(&iterator);
        return (result);
}

/*
 * If 'update_only' is set then don't create a NSEC RRset if it doesn't exist.
 */
static isc_result_t
updatesecure(dns_db_t *db, dns_dbversion_t *version, dns_name_t *name,
             dns_ttl_t minimum, isc_boolean_t update_only, dns_diff_t *diff)
{
        isc_result_t result;
        dns_rdataset_t rdataset;
        dns_dbnode_t *node = NULL;

        CHECK(dns_db_getoriginnode(db, &node));
        if (update_only) {
                dns_rdataset_init(&rdataset);
                result = dns_db_findrdataset(db, node, version,
                                             dns_rdatatype_nsec,
                                             dns_rdatatype_none,
                                             0, &rdataset, NULL);
                if (dns_rdataset_isassociated(&rdataset))
                        dns_rdataset_disassociate(&rdataset);
                if (result == ISC_R_NOTFOUND)
                        goto success;
                if (result != ISC_R_SUCCESS)
                        goto failure;
        }
        CHECK(delete_nsec(db, version, node, name, diff));
        CHECK(add_nsec(db, version, name, node, minimum, ISC_FALSE, diff));
 success:
        result = ISC_R_SUCCESS;
 failure:
        if (node != NULL)
                dns_db_detachnode(db, &node);
        return (result);
}

static isc_result_t
updatesignwithkey(dns_zone_t *zone, dns_signing_t *signing,
                  dns_dbversion_t *version, isc_boolean_t build_nsec3,
                  dns_ttl_t minimum, dns_diff_t *diff)
{
        isc_result_t result;
        dns_dbnode_t *node = NULL;
        dns_rdataset_t rdataset;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        unsigned char data[5];
        isc_boolean_t seen_done = ISC_FALSE;
        isc_boolean_t have_rr = ISC_FALSE;

        dns_rdataset_init(&rdataset);
        result = dns_db_getoriginnode(signing->db, &node);
        if (result != ISC_R_SUCCESS)
                goto failure;

        result = dns_db_findrdataset(signing->db, node, version,
                                     zone->privatetype, dns_rdatatype_none,
                                     0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                result = ISC_R_SUCCESS;
                goto failure;
        }
        if (result != ISC_R_SUCCESS) {
                INSIST(!dns_rdataset_isassociated(&rdataset));
                goto failure;
        }
        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset)) {
                dns_rdataset_current(&rdataset, &rdata);
                /*
                 * If we don't match the algorithm or keyid skip the record.
                 */
                if (rdata.length != 5 ||
                    rdata.data[0] != signing->algorithm ||
                    rdata.data[1] != ((signing->keyid >> 8) & 0xff) ||
                    rdata.data[2] != (signing->keyid & 0xff)) {
                        have_rr = ISC_TRUE;
                        dns_rdata_reset(&rdata);
                        continue;
                }
                /*
                 * We have a match.  If we were signing (!signing->delete)
                 * and we already have a record indicating that we have
                 * finished signing (rdata.data[4] != 0) then keep it.
                 * Otherwise it needs to be deleted as we have removed all
                 * the signatures (signing->delete), so any record indicating
                 * completion is now out of date, or we have finished signing
                 * with the new record so we no longer need to remember that
                 * we need to sign the zone with the matching key across a
                 * nameserver re-start.
                 */
                if (!signing->delete && rdata.data[4] != 0) {
                        seen_done = ISC_TRUE;
                        have_rr = ISC_TRUE;
                } else
                        CHECK(update_one_rr(signing->db, version, diff,
                                            DNS_DIFFOP_DEL, &zone->origin,
                                            rdataset.ttl, &rdata));
                dns_rdata_reset(&rdata);
        }
        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;
        if (!signing->delete && !seen_done) {
                /*
                 * If we were signing then we need to indicate that we have
                 * finished signing the zone with this key.  If it is already
                 * there we don't need to add it a second time.
                 */
                data[0] = signing->algorithm;
                data[1] = (signing->keyid >> 8) & 0xff;
                data[2] = signing->keyid & 0xff;
                data[3] = 0;
                data[4] = 1;
                rdata.length = sizeof(data);
                rdata.data = data;
                rdata.type = zone->privatetype;
                rdata.rdclass = dns_db_class(signing->db);
                CHECK(update_one_rr(signing->db, version, diff, DNS_DIFFOP_ADD,
                                    &zone->origin, rdataset.ttl, &rdata));
        } else if (!have_rr) {
                dns_name_t *origin = dns_db_origin(signing->db);
                /*
                 * Rebuild the NSEC/NSEC3 record for the origin as we no
                 * longer have any private records.
                 */
                if (build_nsec3)
                        CHECK(dns_nsec3_addnsec3s(signing->db, version, origin,
                                                  minimum, ISC_FALSE, diff));
                CHECK(updatesecure(signing->db, version, origin, minimum,
                                   ISC_TRUE, diff));
        }

 failure:
        if (dns_rdataset_isassociated(&rdataset))
                dns_rdataset_disassociate(&rdataset);
        if (node != NULL)
                dns_db_detachnode(signing->db, &node);
        return (result);
}

/*
 * If 'active' is set then we are not done with the chain yet so only
 * delete the nsec3param record which indicates a full chain exists
 * (flags == 0).
 */
static isc_result_t
fixup_nsec3param(dns_db_t *db, dns_dbversion_t *ver, dns_nsec3chain_t *chain,
                 isc_boolean_t active, dns_rdatatype_t privatetype,
                 dns_diff_t *diff)
{
        dns_dbnode_t *node = NULL;
        dns_name_t *name = dns_db_origin(db);
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdataset_t rdataset;
        dns_rdata_nsec3param_t nsec3param;
        isc_result_t result;
        isc_buffer_t buffer;
        unsigned char parambuf[DNS_NSEC3PARAM_BUFFERSIZE];
        dns_ttl_t ttl = 0;
        isc_boolean_t nseconly = ISC_FALSE, nsec3ok = ISC_FALSE;

        dns_rdataset_init(&rdataset);

        result = dns_db_getoriginnode(db, &node);
        RUNTIME_CHECK(result == ISC_R_SUCCESS);
        result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3param,
                                     0, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND)
                goto try_private;
        if (result != ISC_R_SUCCESS)
                goto failure;

        /*
         * Preserve the existing ttl.
         */
        ttl = rdataset.ttl;

        /*
         * Delete all NSEC3PARAM records which match that in nsec3chain.
         */
        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset)) {

                dns_rdataset_current(&rdataset, &rdata);
                CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));

                if (nsec3param.hash != chain->nsec3param.hash ||
                    (active && nsec3param.flags != 0) ||
                    nsec3param.iterations != chain->nsec3param.iterations ||
                    nsec3param.salt_length != chain->nsec3param.salt_length ||
                    memcmp(nsec3param.salt, chain->nsec3param.salt,
                           nsec3param.salt_length)) {
                        dns_rdata_reset(&rdata);
                        continue;
                }

                CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_DEL,
                                    name, rdataset.ttl, &rdata));
                dns_rdata_reset(&rdata);
        }
        if (result != ISC_R_NOMORE)
                goto failure;

        dns_rdataset_disassociate(&rdataset);

 try_private:

        if (active)
                goto add;

        result = dns_nsec_nseconly(db, ver, &nseconly);
        nsec3ok = (result == ISC_R_SUCCESS && !nseconly);

        /*
         * Delete all private records which match that in nsec3chain.
         */
        result = dns_db_findrdataset(db, node, ver, privatetype,
                                     0, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND)
                goto add;
        if (result != ISC_R_SUCCESS)
                goto failure;

        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset)) {
                dns_rdata_t private = DNS_RDATA_INIT;
                unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE];

                dns_rdataset_current(&rdataset, &private);
                if (!dns_nsec3param_fromprivate(&private, &rdata,
                                                buf, sizeof(buf)))
                        continue;
                CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));

                if ((!nsec3ok &&
                     (nsec3param.flags & DNS_NSEC3FLAG_INITIAL) != 0) ||
                    nsec3param.hash != chain->nsec3param.hash ||
                    nsec3param.iterations != chain->nsec3param.iterations ||
                    nsec3param.salt_length != chain->nsec3param.salt_length ||
                    memcmp(nsec3param.salt, chain->nsec3param.salt,
                           nsec3param.salt_length)) {
                        dns_rdata_reset(&rdata);
                        continue;
                }

                CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_DEL,
                                    name, rdataset.ttl, &private));
                dns_rdata_reset(&rdata);
        }
        if (result != ISC_R_NOMORE)
                goto failure;

  add:
        if ((chain->nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0) {
                result = ISC_R_SUCCESS;
                goto failure;
        }

        /*
         * Add a NSEC3PARAM record which matches that in nsec3chain but
         * with all flags bits cleared.
         *
         * Note: we do not clear chain->nsec3param.flags as this change
         * may be reversed.
         */
        isc_buffer_init(&buffer, &parambuf, sizeof(parambuf));
        CHECK(dns_rdata_fromstruct(&rdata, dns_db_class(db),
                                   dns_rdatatype_nsec3param,
                                   &chain->nsec3param, &buffer));
        rdata.data[1] = 0;      /* Clear flag bits. */
        CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_ADD, name, ttl, &rdata));

  failure:
        dns_db_detachnode(db, &node);
        if (dns_rdataset_isassociated(&rdataset))
                dns_rdataset_disassociate(&rdataset);
        return (result);
}

static isc_result_t
delete_nsec(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
            dns_name_t *name, dns_diff_t *diff)
{
        dns_rdataset_t rdataset;
        isc_result_t result;

        dns_rdataset_init(&rdataset);

        result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec,
                                     0, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND)
                return (ISC_R_SUCCESS);
        if (result != ISC_R_SUCCESS)
                return (result);
        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset)) {
                dns_rdata_t rdata = DNS_RDATA_INIT;

                dns_rdataset_current(&rdataset, &rdata);
                CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_DEL, name,
                                    rdataset.ttl, &rdata));
        }
        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;
 failure:
        dns_rdataset_disassociate(&rdataset);
        return (result);
}

static isc_result_t
deletematchingnsec3(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node,
                    dns_name_t *name, const dns_rdata_nsec3param_t *param,
                    dns_diff_t *diff)
{
        dns_rdataset_t rdataset;
        dns_rdata_nsec3_t nsec3;
        isc_result_t result;

        dns_rdataset_init(&rdataset);
        result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3,
                                     0, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND)
                return (ISC_R_SUCCESS);
        if (result != ISC_R_SUCCESS)
                return (result);

        for (result = dns_rdataset_first(&rdataset);
             result == ISC_R_SUCCESS;
             result = dns_rdataset_next(&rdataset)) {
                dns_rdata_t rdata = DNS_RDATA_INIT;

                dns_rdataset_current(&rdataset, &rdata);
                CHECK(dns_rdata_tostruct(&rdata, &nsec3, NULL));
                if (nsec3.hash != param->hash ||
                    nsec3.iterations != param->iterations ||
                    nsec3.salt_length != param->salt_length ||
                    memcmp(nsec3.salt, param->salt, nsec3.salt_length))
                        continue;
                CHECK(update_one_rr(db, ver, diff, DNS_DIFFOP_DEL, name,
                                    rdataset.ttl, &rdata));
        }
        if (result == ISC_R_NOMORE)
                result = ISC_R_SUCCESS;
 failure:
        dns_rdataset_disassociate(&rdataset);
        return (result);
}

static isc_result_t
need_nsec_chain(dns_db_t *db, dns_dbversion_t *ver,
                const dns_rdata_nsec3param_t *param,
                isc_boolean_t *answer)
{
        dns_dbnode_t *node = NULL;
        dns_rdata_t rdata = DNS_RDATA_INIT;
        dns_rdata_nsec3param_t myparam;
        dns_rdataset_t rdataset;
        isc_result_t result;

        *answer = ISC_FALSE;

        result = dns_db_getoriginnode(db, &node);
        RUNTIME_CHECK(result == ISC_R_SUCCESS);

        dns_rdataset_init(&rdataset);

        result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec,
                                     0, 0, &rdataset, NULL);
        if (result == ISC_R_SUCCESS) {
                dns_rdataset_disassociate(&rdataset);
                dns_db_detachnode(db, &node);
                return (result);
        }
        if (result != ISC_R_NOTFOUND) {
                dns_db_detachnode(db, &node);
                return (result);
        }

        result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3param,
                                     0, 0, &rdataset, NULL);
        if (result == ISC_R_NOTFOUND) {
                *answer = ISC_TRUE;