From 623bb196ca62f513345a93fffd77a60704261f38 Mon Sep 17 00:00:00 2001

From: Stepan Broz <sbroz@redhat.com>

Date: Mon, 6 May 2024 19:40:19 +0200

Subject: [PATCH] Use hashtable when parsing a message

When parsing messages use a hashtable instead of a linear search to reduce

the amount of work done in findname when there's more than one name in

the section.

There are two hashtables:

1) hashtable for owner names - that's constructed for each section when we

hit the second name in the section and destroyed right after parsing

that section;

2) per-name hashtable - for each name in the section, we construct a new

hashtable for that name if there are more than one rdataset for that

particular name.

(cherry picked from commit b8a96317544c7b310b4f74360825a87b6402ddc2)

(cherry picked from commit 0ceed03ebea395da1a39ad1cb39205ce75a3f768)

Backport isc_ht API changes from BIND 9.18

To prevent allocating large hashtable in dns_message, we need to

backport the improvements to isc_ht API from BIND 9.18+ that includes

support for case insensitive keys and incremental rehashing of the

hashtables.

(cherry picked from commit a4baf324159ec3764195c949cb56c861d9f173ff)

(cherry picked from commit 2fc28056b33018f7f78b625409eb44c32d5c9b11)

fix a message parsing regression

the fix for CVE-2023-4408 introduced a regression in the message

parser, which could cause a crash if duplicate rdatasets were found

in the question section. this commit ensures that rdatasets are

correctly disassociated and freed when this occurs.

(cherry picked from commit 4c19d35614f8cd80d8748156a5bad361e19abc28)

(cherry picked from commit 98ab8c81cc7739dc220aa3f50efa3061774de8ba)

fix another message parsing regression

The fix for CVE-2023-4408 introduced a regression in the message

parser, which could cause a crash if an rdata type that can only

occur in the question was found in another section.

(cherry picked from commit 510f1de8a6add516b842a55750366944701d3d9a)

(cherry picked from commit bbbcaf8b2ec17d2cad28841ea86078168072ae2f)

Apply various tweaks specific to BIND 9.11

(cherry picked from commit c6026cbbaa9d297910af350fa6cc45788cc9f397)

Fix case insensitive matching in isc_ht hash table implementation

The case insensitive matching in isc_ht was basically completely broken

as only the hashvalue computation was case insensitive, but the key

comparison was always case sensitive.

(cherry picked from commit c462d65b2fd0db362947db4a18a87df78f8d8e5d)

(cherry picked from commit 418b3793598a1e1c7e391bb317866d405cd03501)

Add a system test for mixed-case data for the same owner

We were missing a test where a single owner name would have multiple

types with a different case.  The generated RRSIGs and NSEC records will

then have different case than the signed records and message parser have

to cope with that and treat everything as the same owner.

(cherry picked from commit c8b623d87f0fb8f9cba8dea5c6a4b600953895e7)

(cherry picked from commit 1f9bbe1fe34b7a2c9765431e8a86b460afc9b323)

6315.   [security]      Speed up parsing of DNS messages with many different

                        names. (CVE-2023-4408) [GL #4234]

Fix assertion failure in nslookup/dig/mdig when message has

 multiple SIG(0) options.

When parsing message with DNS_MESSAGE_BESTEFFORT (used exclusively in

tools, never in named itself) if we hit an invalid SIG(0) in wrong

place we continue parsing the message, and put the sig0 in msg->sig0.

If we then hit another sig0 in a proper place we see that msg->sig0

is already 'taken' and we don't free name and rdataset, and we don't

set seen_problem. This causes an assertion failure.

This fixes that issue by setting seen_problem if we hit second sig0,

tsig or opt, which causes name and rdataset to be always freed.

(cherry picked from commit 51a55ddbb73f8707de3d1b8cda15c8f61585bacb)

(cherry picked from commit 736d8c5b80d02f10555f324abef920a7257f9f43)

---

 .../system/dnssec/ns3/secure.example.db.in    |   5 +

 bin/tests/system/dnssec/ns3/sign.sh           | 112 ++--

 bin/tests/system/dnssec/tests.sh              |  15 +

 lib/dns/catz.c                                |  50 +-

 lib/dns/include/dns/message.h                 |  39 --

 lib/dns/include/dns/name.h                    |   9 +-

 lib/dns/message.c                             | 624 +++++++++++-------

 lib/dns/name.c                                |   1 +

 lib/isc/ht.c                                  | 598 ++++++++++++-----

 lib/isc/include/isc/ht.h                      |  45 +-

 lib/isc/tests/ht_test.c                       |  75 ++-

 11 files changed, 1032 insertions(+), 541 deletions(-)

diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in

index 9d310d8..3b713d8 100644

--- a/bin/tests/system/dnssec/ns3/secure.example.db.in

+++ b/bin/tests/system/dnssec/ns3/secure.example.db.in

@@ -44,3 +44,8 @@ rrsigonly		A	10.0.0.29

 cnameandkey		CNAME	@

 cnamenokey		CNAME	@

 dnameandkey		DNAME	@

+

+mixedcase		A	10.0.0.30

+mixedCASE		TXT	"mixed case"

+MIXEDcase		AAAA	2002::

+mIxEdCaSe		LOC	37 52 56.788 N 121 54 55.02 W 1120m 10m 100m 10m

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh

index 99e9b49..ce5b2ee 100644

--- a/bin/tests/system/dnssec/ns3/sign.sh

+++ b/bin/tests/system/dnssec/ns3/sign.sh

@@ -28,7 +28,9 @@ keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`

 cat $infile $cnameandkey.key $dnameandkey.key $keyname.key >$zonefile

-$SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -D -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

+cat "$zonefile" "$zonefile".signed >"$zonefile".tmp

+mv "$zonefile".tmp "$zonefile".signed

 zone=bogus.example.

 infile=bogus.example.db.in

@@ -313,11 +315,11 @@ zone=rsasha512.example.

 infile=rsasha512.example.db.in

 zonefile=rsasha512.example.db

-keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA512 -b 1024 -n zone $zone`

+keyname=$($KEYGEN -q -r $RANDFILE -a RSASHA512 -b 1024 -n zone $zone)

 cat $infile $keyname.key >$zonefile

-$SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # A zone with the DNSKEY set only signed by the KSK

@@ -326,10 +328,10 @@ zone=kskonly.example.

 infile=kskonly.example.db.in

 zonefile=kskonly.example.db

-kskname=`$KEYGEN -q -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -r $RANDFILE $zone)

 cat $infile $kskname.key $zskname.key >$zonefile

-$SIGNER -x -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -x -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # A zone with the expired signatures

@@ -338,10 +340,10 @@ zone=expired.example.

 infile=expired.example.db.in

 zonefile=expired.example.db

-kskname=`$KEYGEN -q -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -r $RANDFILE $zone)

 cat $infile $kskname.key $zskname.key >$zonefile

-$SIGNER -P -r $RANDFILE -o $zone -s -1d -e +1h $zonefile > /dev/null 2>&1

+$SIGNER -P -r $RANDFILE -o $zone -s -1d -e +1h $zonefile >/dev/null 2>&1

 rm -f $kskname.* $zskname.*

 #

@@ -351,10 +353,10 @@ zone=update-nsec3.example.

 infile=update-nsec3.example.db.in

 zonefile=update-nsec3.example.db

-kskname=`$KEYGEN -q -3 -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -3 -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -3 -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -3 -r $RANDFILE $zone)

 cat $infile $kskname.key $zskname.key >$zonefile

-$SIGNER -P -3 - -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -3 - -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # A NSEC signed zone that will have auto-dnssec enabled and

@@ -364,12 +366,12 @@ zone=auto-nsec.example.

 infile=auto-nsec.example.db.in

 zonefile=auto-nsec.example.db

-kskname=`$KEYGEN -q -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -r $RANDFILE $zone`

-kskname=`$KEYGEN -q -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -r $RANDFILE $zone)

+kskname=$($KEYGEN -q -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -r $RANDFILE $zone)

 cat $infile $kskname.key $zskname.key >$zonefile

-$SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # A NSEC3 signed zone that will have auto-dnssec enabled and

@@ -379,12 +381,12 @@ zone=auto-nsec3.example.

 infile=auto-nsec3.example.db.in

 zonefile=auto-nsec3.example.db

-kskname=`$KEYGEN -q -3 -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -3 -r $RANDFILE $zone`

-kskname=`$KEYGEN -q -3 -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -3 -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -3 -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -3 -r $RANDFILE $zone)

+kskname=$($KEYGEN -q -3 -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -3 -r $RANDFILE $zone)

 cat $infile $kskname.key $zskname.key >$zonefile

-$SIGNER -P -3 - -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -3 - -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # Secure below cname test zone.

@@ -447,10 +449,10 @@ zone="expiring.example."

 infile="expiring.example.db.in"

 zonefile="expiring.example.db"

 signedfile="expiring.example.db.signed"

-kskname=`$KEYGEN -q -r $RANDFILE $zone`

-zskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`

+kskname=$($KEYGEN -q -r $RANDFILE $zone)

+zskname=$($KEYGEN -q -r $RANDFILE -f KSK $zone)

 cp $infile $zonefile

-$SIGNER -S -r $RANDFILE -e now+1mi -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -S -r $RANDFILE -e now+1mi -o $zone $zonefile >/dev/null 2>&1

 mv -f ${zskname}.private ${zskname}.private.moved

 mv -f ${kskname}.private ${kskname}.private.moved

@@ -462,12 +464,12 @@ infile="upper.example.db.in"

 zonefile="upper.example.db"

 lower="upper.example.db.lower"

 signedfile="upper.example.db.signed"

-kskname=`$KEYGEN -q -r $RANDFILE $zone`

-zskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`

+kskname=$($KEYGEN -q -r $RANDFILE $zone)

+zskname=$($KEYGEN -q -r $RANDFILE -f KSK $zone)

 cp $infile $zonefile

-$SIGNER -P -S -r $RANDFILE -o $zone -f $lower $zonefile > /dev/null 2>/dev/null

-$CHECKZONE -D upper.example $lower 2>/dev/null | \

-	sed '/RRSIG/s/ upper.example. / UPPER.EXAMPLE. /' > $signedfile

+$SIGNER -P -S -r $RANDFILE -o $zone -f $lower $zonefile >/dev/null 2>/dev/null

+$CHECKZONE -D upper.example $lower 2>/dev/null |

+	sed '/RRSIG/s/ upper.example. / UPPER.EXAMPLE. /' >$signedfile

 #

 # Check that the signer's name is in lower case when zone name is in

@@ -477,10 +479,10 @@ zone="LOWER.EXAMPLE."

 infile="lower.example.db.in"

 zonefile="lower.example.db"

 signedfile="lower.example.db.signed"

-kskname=`$KEYGEN -q -r $RANDFILE $zone`

-zskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`

+kskname=$($KEYGEN -q -r $RANDFILE $zone)

+zskname=$($KEYGEN -q -r $RANDFILE -f KSK $zone)

 cp $infile $zonefile

-$SIGNER -P -S -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -S -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # Zone with signatures about to expire, and dynamic, but configured

@@ -490,21 +492,21 @@ zone="nosign.example."

 infile="nosign.example.db.in"

 zonefile="nosign.example.db"

 signedfile="nosign.example.db.signed"

-kskname=`$KEYGEN -q -r $RANDFILE $zone`

-zskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`

+kskname=$($KEYGEN -q -r $RANDFILE $zone)

+zskname=$($KEYGEN -q -r $RANDFILE -f KSK $zone)

 cp $infile $zonefile

-$SIGNER -S -r $RANDFILE -e now+1mi -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -S -r $RANDFILE -e now+1mi -o $zone $zonefile >/dev/null 2>&1

 # preserve a normalized copy of the NS RRSIG for comparison later

-$CHECKZONE -D nosign.example nosign.example.db.signed 2>/dev/null | \

-        awk '$4 == "RRSIG" && $5 == "NS" {$2 = ""; print}' | \

-        sed 's/[ 	][ 	]*/ /g'> ../nosign.before

+$CHECKZONE -D nosign.example nosign.example.db.signed 2>/dev/null |

+	awk '$4 == "RRSIG" && $5 == "NS" {$2 = ""; print}' |

+	sed 's/[ 	][ 	]*/ /g' >../nosign.before

 #

 # An inline signing zone

 #

 zone=inline.example.

-kskname=`$KEYGEN -q -3 -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -3 -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -3 -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -3 -r $RANDFILE $zone)

 #

 # publish a new key while deactivating another key at the same time.

@@ -512,13 +514,13 @@ zskname=`$KEYGEN -q -3 -r $RANDFILE $zone`

 zone=publish-inactive.example

 infile=publish-inactive.example.db.in

 zonefile=publish-inactive.example.db

-now=`date -u +%Y%m%d%H%M%S`

-kskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`

-kskname=`$KEYGEN -P $now+90s -A $now+3600s -q -r $RANDFILE -f KSK $zone`

-kskname=`$KEYGEN -I $now+90s -q -r $RANDFILE -f KSK $zone`

-zskname=`$KEYGEN -q -r $RANDFILE $zone`

+now=$(date -u +%Y%m%d%H%M%S)

+kskname=$($KEYGEN -q -r $RANDFILE -f KSK $zone)

+kskname=$($KEYGEN -P $now+90s -A $now+3600s -q -r $RANDFILE -f KSK $zone)

+kskname=$($KEYGEN -I $now+90s -q -r $RANDFILE -f KSK $zone)

+zskname=$($KEYGEN -q -r $RANDFILE $zone)

 cp $infile $zonefile

-$SIGNER -S -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -S -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # A zone which will change its sig-validity-interval

@@ -526,8 +528,8 @@ $SIGNER -S -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

 zone=siginterval.example

 infile=siginterval.example.db.in

 zonefile=siginterval.example.db

-kskname=`$KEYGEN -q -3 -r $RANDFILE -fk $zone`

-zskname=`$KEYGEN -q -3 -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -3 -r $RANDFILE -fk $zone)

+zskname=$($KEYGEN -q -3 -r $RANDFILE $zone)

 cp $infile $zonefile

 #

@@ -551,10 +553,10 @@ sed -e 's/bogus/badds/g' < dsset-bogus.example$TP > dsset-badds.example$TP

 zone=future.example

 infile=future.example.db.in

 zonefile=future.example.db

-kskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`

-zskname=`$KEYGEN -q -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -r $RANDFILE -f KSK $zone)

+zskname=$($KEYGEN -q -r $RANDFILE $zone)

 cat $infile $kskname.key $zskname.key >$zonefile

-$SIGNER -P -s +3600 -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -s +3600 -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 cp -f $kskname.key trusted-future.key

 #

@@ -563,10 +565,10 @@ cp -f $kskname.key trusted-future.key

 zone=managed-future.example

 infile=managed-future.example.db.in

 zonefile=managed-future.example.db

-kskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`

-zskname=`$KEYGEN -q -r $RANDFILE $zone`

+kskname=$($KEYGEN -q -r $RANDFILE -f KSK $zone)

+zskname=$($KEYGEN -q -r $RANDFILE $zone)

 cat $infile $kskname.key $zskname.key >$zonefile

-$SIGNER -P -s +3600 -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

+$SIGNER -P -s +3600 -r $RANDFILE -o $zone $zonefile >/dev/null 2>&1

 #

 # A zone with a revoked key

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh

index 91a4822..e8d8f7e 100644

--- a/bin/tests/system/dnssec/tests.sh

+++ b/bin/tests/system/dnssec/tests.sh

@@ -699,6 +699,21 @@ n=`expr $n + 1`

 if [ $ret != 0 ]; then echo_i "failed"; fi

 status=`expr $status + $ret`

+echo_i "checking mixed-case positive validation ($n)"

+ret=0

+for type in a txt aaaa loc; do

+  $DIG $DIGOPTS +noauth mixedcase.secure.example. \

+    @10.53.0.3 $type >dig.out.$type.ns3.test$n || ret=1

+  $DIG $DIGOPTS +noauth mixedcase.secure.example. \

+    @10.53.0.4 $type >dig.out.$type.ns4.test$n || ret=1

+  digcomp --lc dig.out.$type.ns3.test$n dig.out.$type.ns4.test$n || ret=1

+  grep "status: NOERROR" dig.out.$type.ns4.test$n >/dev/null || ret=1

+  grep "flags:.*ad.*QUERY" dig.out.$type.ns4.test$n >/dev/null || ret=1

+done

+n=$((n + 1))

+test "$ret" -eq 0 || echo_i "failed"

+status=$((status + ret))

+

 echo_i "checking multi-stage positive validation NSEC/NSEC3 ($n)"

 ret=0

 $DIG $DIGOPTS +noauth a.nsec3.example. \

diff --git a/lib/dns/catz.c b/lib/dns/catz.c

index 767c710..98ddd01 100644

--- a/lib/dns/catz.c

+++ b/lib/dns/catz.c

@@ -395,33 +395,21 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {

 	dns_name_format(&target->name, czname, DNS_NAME_FORMATSIZE);

-	result = isc_ht_init(&toadd, target->catzs->mctx, 16);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup;

+	isc_ht_init(&toadd, target->catzs->mctx, 16, ISC_HT_CASE_SENSITIVE);

-	result = isc_ht_init(&tomod, target->catzs->mctx, 16);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup;

+	isc_ht_init(&tomod, target->catzs->mctx, 16, ISC_HT_CASE_SENSITIVE);

-	result = isc_ht_iter_create(newzone->entries, &iter1);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup;

+	isc_ht_iter_create(newzone->entries, &iter1);

-	result = isc_ht_iter_create(target->entries, &iter2);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup;

+	isc_ht_iter_create(target->entries, &iter2);

 	/*

 	 * We can create those iterators now, even though toadd and tomod are

 	 * empty

 	 */

-	result = isc_ht_iter_create(toadd, &iteradd);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup;

+	isc_ht_iter_create(toadd, &iteradd);

-	result = isc_ht_iter_create(tomod, &itermod);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup;

+	isc_ht_iter_create(tomod, &itermod);

 	/*

 	 * First - walk the new zone and find all nodes that are not in the

@@ -565,7 +553,6 @@ dns_catz_zones_merge(dns_catz_zone_t *target, dns_catz_zone_t *newzone) {

 	result = ISC_R_SUCCESS;

-cleanup:

 	if (iter1 != NULL)

 		isc_ht_iter_destroy(&iter1);

 	if (iter2 != NULL)

@@ -605,9 +592,7 @@ dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,

 	if (result != ISC_R_SUCCESS)

 		goto cleanup_mutex;

-	result = isc_ht_init(&new_zones->zones, mctx, 4);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup_refcount;

+	isc_ht_init(&new_zones->zones, mctx, 4, ISC_HT_CASE_SENSITIVE);

 	isc_mem_attach(mctx, &new_zones->mctx);

 	new_zones->zmm = zmm;

@@ -624,7 +609,6 @@ dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,

   cleanup_ht:

 	isc_ht_destroy(&new_zones->zones);

-  cleanup_refcount:

 	isc_refcount_destroy(&new_zones->refs);

   cleanup_mutex:

 	isc_mutex_destroy(&new_zones->lock);

@@ -667,9 +651,7 @@ dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,

 	if (result != ISC_R_SUCCESS)

 		goto cleanup_newzone;

-	result = isc_ht_init(&new_zone->entries, catzs->mctx, 4);

-	if (result != ISC_R_SUCCESS)

-		goto cleanup_name;

+	isc_ht_init(&new_zone->entries, catzs->mctx, 4, ISC_HT_CASE_SENSITIVE);

 	new_zone->updatetimer = NULL;

 	result = isc_timer_create(catzs->timermgr, isc_timertype_inactive,

@@ -698,7 +680,6 @@ dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,

   cleanup_ht:

 	isc_ht_destroy(&new_zone->entries);

-  cleanup_name:

 	dns_name_free(&new_zone->name, catzs->mctx);

   cleanup_newzone:

 	isc_mem_put(catzs->mctx, new_zone, sizeof(*new_zone));

@@ -800,8 +781,7 @@ dns_catz_zone_detach(dns_catz_zone_t **zonep) {

 	if (refs == 0) {

 		isc_mem_t *mctx = zone->catzs->mctx;

 		if (zone->entries != NULL) {

-			result = isc_ht_iter_create(zone->entries, &iter);

-			INSIST(result == ISC_R_SUCCESS);

+			isc_ht_iter_create(zone->entries, &iter);

 			for (result = isc_ht_iter_first(iter);

 			     result == ISC_R_SUCCESS;

 			     result = isc_ht_iter_delcurrent_next(iter))

@@ -860,8 +840,7 @@ dns_catz_catzs_detach(dns_catz_zones_t **catzsp) {

 		catzs->magic = 0;

 		DESTROYLOCK(&catzs->lock);

 		if (catzs->zones != NULL) {

-			result = isc_ht_iter_create(catzs->zones, &iter);

-			INSIST(result == ISC_R_SUCCESS);

+			isc_ht_iter_create(catzs->zones, &iter);

 			for (result = isc_ht_iter_first(iter);

 			     result == ISC_R_SUCCESS;)

 			{

@@ -1970,8 +1949,7 @@ dns_catz_prereconfig(dns_catz_zones_t *catzs) {

 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));

-	result = isc_ht_iter_create(catzs->zones, &iter);

-	INSIST(result == ISC_R_SUCCESS);

+	isc_ht_iter_create(catzs->zones, &iter);

 	for (result = isc_ht_iter_first(iter);

 	     result == ISC_R_SUCCESS;

 	     result = isc_ht_iter_next(iter))

@@ -1993,8 +1971,7 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {

 	REQUIRE(DNS_CATZ_ZONES_VALID(catzs));

 	LOCK(&catzs->lock);

-	result = isc_ht_iter_create(catzs->zones, &iter);

-	INSIST(result == ISC_R_SUCCESS);

+	isc_ht_iter_create(catzs->zones, &iter);

 	for (result = isc_ht_iter_first(iter);

 	     result == ISC_R_SUCCESS;)

 	{

@@ -2036,5 +2013,6 @@ dns_catz_postreconfig(dns_catz_zones_t *catzs) {

 isc_result_t

 dns_catz_get_iterator(dns_catz_zone_t *catz, isc_ht_iter_t **itp) {

 	REQUIRE(DNS_CATZ_ZONE_VALID(catz));

-	return (isc_ht_iter_create(catz->entries, itp));

+	isc_ht_iter_create(catz->entries, itp);

+	return (ISC_R_SUCCESS);

 }

diff --git a/lib/dns/include/dns/message.h b/lib/dns/include/dns/message.h

index 868a87d..6682450 100644

--- a/lib/dns/include/dns/message.h

+++ b/lib/dns/include/dns/message.h

@@ -739,45 +739,6 @@ dns_message_findtype(dns_name_t *name, dns_rdatatype_t type,

  *\li	#ISC_R_NOTFOUND		-- the desired type does not exist.

  */

-isc_result_t

-dns_message_find(dns_name_t *name, dns_rdataclass_t rdclass,

-		 dns_rdatatype_t type, dns_rdatatype_t covers,

-		 dns_rdataset_t **rdataset);

-/*%<

- * Search the name for the specified rdclass and type.  If it is found,

- * *rdataset is filled in with a pointer to that rdataset.

- *

- * Requires:

- *\li	if '**rdataset' is non-NULL, *rdataset needs to be NULL.

- *

- *\li	'type' be a valid type, and NOT dns_rdatatype_any.

- *

- *\li	If 'type' is dns_rdatatype_rrsig, 'covers' must be a valid type.

- *	Otherwise it should be 0.

- *

- * Returns:

- *\li	#ISC_R_SUCCESS		-- all is well.

- *\li	#ISC_R_NOTFOUND		-- the desired type does not exist.

- */

-

-void

-dns_message_movename(dns_message_t *msg, dns_name_t *name,

-		     dns_section_t fromsection,

-		     dns_section_t tosection);

-/*%<

- * Move a name from one section to another.

- *

- * Requires:

- *

- *\li	'msg' be valid.

- *

- *\li	'name' must be a name already in 'fromsection'.

- *

- *\li	'fromsection' must be a valid section.

- *

- *\li	'tosection' must be a valid section.

- */

-

 void

 dns_message_addname(dns_message_t *msg, dns_name_t *name,

 		    dns_section_t section);

diff --git a/lib/dns/include/dns/name.h b/lib/dns/include/dns/name.h

index 93ddacd..9f60081 100644

--- a/lib/dns/include/dns/name.h

+++ b/lib/dns/include/dns/name.h

@@ -67,6 +67,7 @@

 #include <stdio.h>

 #include <isc/boolean.h>

+#include <isc/ht.h>

 #include <isc/lang.h>

 #include <isc/magic.h>

 #include <isc/region.h>		/* Required for storage size of dns_label_t. */

@@ -110,6 +111,7 @@ struct dns_name {

 	isc_buffer_t *			buffer;

 	ISC_LINK(dns_name_t)		link;

 	ISC_LIST(dns_rdataset_t)	list;

+	isc_ht_t *ht;

 };

 #define DNS_NAME_MAGIC			ISC_MAGIC('D','N','S','n')

@@ -170,7 +172,7 @@ LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_wildcardname;

 	A, (sizeof(A) - 1), sizeof(B), \

 	DNS_NAMEATTR_READONLY, \

 	B, NULL, { (void *)-1, (void *)-1}, \

-	{NULL, NULL} \

+	{NULL, NULL}, NULL			    \

 }

 #define DNS_NAME_INITABSOLUTE(A,B) { \

@@ -178,12 +180,12 @@ LIBDNS_EXTERNAL_DATA extern dns_name_t *dns_wildcardname;

 	A, sizeof(A), sizeof(B), \

 	DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE, \

 	B, NULL, { (void *)-1, (void *)-1}, \

-	{NULL, NULL} \

+	{NULL, NULL}, NULL			    \

 }

 #define DNS_NAME_INITEMPTY { \

 	DNS_NAME_MAGIC, NULL, 0, 0, 0, NULL, NULL, \

-	{ (void *)-1, (void *)-1 }, { NULL, NULL } \

+	{ (void *)-1, (void *)-1 }, { NULL, NULL }, NULL	\

 }

 /*%

@@ -1373,6 +1375,7 @@ do { \

 	_n->buffer = NULL; \

 	ISC_LINK_INIT(_n, link); \

 	ISC_LIST_INIT(_n->list); \

+	_n->ht = NULL; \

 } while (0)

 #define DNS_NAME_RESET(n) \

diff --git a/lib/dns/message.c b/lib/dns/message.c

index 9210c26..c97b7bd 100644

--- a/lib/dns/message.c

+++ b/lib/dns/message.c

@@ -19,6 +19,8 @@

 #include <ctype.h>

 #include <isc/buffer.h>

+#include <isc/hash.h>

+#include <isc/ht.h>

 #include <isc/mem.h>

 #include <isc/print.h>

 #include <isc/string.h>		/* Required for HP/UX (and others?) */

@@ -159,6 +161,9 @@ msgblock_allocate(isc_mem_t *, unsigned int, unsigned int);

 #define msgblock_get(block, type) \

 	((type *)msgblock_internalget(block, sizeof(type)))

+static void

+dns__message_puttemprdataset(dns_message_t *msg, dns_rdataset_t **rdatasetp);

+

 static inline void *

 msgblock_internalget(dns_msgblock_t *, unsigned int);

@@ -470,7 +475,7 @@ msgresetopt(dns_message_t *msg)

 		}

 		INSIST(dns_rdataset_isassociated(msg->opt));

 		dns_rdataset_disassociate(msg->opt);

-		isc_mempool_put(msg->rdspool, msg->opt);

+		dns__message_puttemprdataset(msg, &msg->opt);

 		msg->opt = NULL;

 		msg->cc_ok = 0;

 		msg->cc_bad = 0;

@@ -491,10 +496,11 @@ msgresetsigs(dns_message_t *msg, isc_boolean_t replying) {

 			msg->querytsig = msg->tsig;

 		} else {

 			dns_rdataset_disassociate(msg->tsig);

-			isc_mempool_put(msg->rdspool, msg->tsig);

+			dns__message_puttemprdataset(msg, &msg->tsig);

 			if (msg->querytsig != NULL) {

 				dns_rdataset_disassociate(msg->querytsig);

-				isc_mempool_put(msg->rdspool, msg->querytsig);

+				dns__message_puttemprdataset(msg,

+							     &msg->querytsig);

 			}

 		}

 		if (dns_name_dynamic(msg->tsigname))

@@ -504,13 +510,10 @@ msgresetsigs(dns_message_t *msg, isc_boolean_t replying) {

 		msg->tsigname = NULL;

 	} else if (msg->querytsig != NULL && !replying) {

 		dns_rdataset_disassociate(msg->querytsig);

-		isc_mempool_put(msg->rdspool, msg->querytsig);

-		msg->querytsig = NULL;

+		dns__message_puttemprdataset(msg, &msg->querytsig);

 	}

 	if (msg->sig0 != NULL) {

-		INSIST(dns_rdataset_isassociated(msg->sig0));

-		dns_rdataset_disassociate(msg->sig0);

-		isc_mempool_put(msg->rdspool, msg->sig0);

+		dns__message_puttemprdataset(msg, &msg->sig0);

 		if (msg->sig0name != NULL) {

 			if (dns_name_dynamic(msg->sig0name))

 				dns_name_free(msg->sig0name, msg->mctx);

@@ -812,6 +815,18 @@ dns_message_destroy(dns_message_t **msgp) {

 	isc_mem_putanddetach(&msg->mctx, msg, sizeof(dns_message_t));

 }

+static isc_result_t

+name_hash_add(isc_ht_t *ht, dns_name_t *name, dns_name_t **foundp) {

+	isc_result_t result = isc_ht_find(ht, name->ndata, name->length,

+					  (void **)foundp);

+	if (result == ISC_R_SUCCESS) {

+		return (ISC_R_EXISTS);

+	}

+	result = isc_ht_add(ht, name->ndata, name->length, (void *)name);

+	INSIST(result == ISC_R_SUCCESS);

+	return (ISC_R_SUCCESS);

+}

+

 static isc_result_t

 findname(dns_name_t **foundname, dns_name_t *target,

 	 dns_namelist_t *section)

@@ -831,28 +846,36 @@ findname(dns_name_t **foundname, dns_name_t *target,

 	return (ISC_R_NOTFOUND);

 }

-isc_result_t

-dns_message_find(dns_name_t *name, dns_rdataclass_t rdclass,

-		 dns_rdatatype_t type, dns_rdatatype_t covers,

-		 dns_rdataset_t **rdataset)

-{

-	dns_rdataset_t *curr;

-

-	REQUIRE(name != NULL);