Blame SOURCES/dhcp-4.2.5-standard_ddns.patch

fad460
diff --git a/client/dhclient.8 b/client/dhclient.8
fad460
index a29757a..c66a912 100644
fad460
--- a/client/dhclient.8
fad460
+++ b/client/dhclient.8
fad460
@@ -56,6 +56,12 @@ dhclient - Dynamic Host Configuration Protocol Client
fad460
 ]
fad460
 ]
fad460
 [
fad460
+.B -i
fad460
+]
fad460
+[
fad460
+.B -C
fad460
+]
fad460
+[
fad460
 .B -D
fad460
 .I LL|LLT
fad460
 ]
fad460
@@ -441,6 +447,17 @@ Set the giaddr field of all packets to the \fIrelay\fR IP address
fad460
 simulating a relay agent.  This is for testing pruposes only and
fad460
 should not be expected to work in any consistent or useful way.
fad460
 .TP
fad460
+.BI \-i
fad460
+Use a DUID with DHCPv4 clients.  If no DUID is available in the
fad460
+lease file one will be constructed and saved.  The DUID will be
fad460
+used to contstuct a RFC4361 style client id that will be included
fad460
+in the client's messages.  This client id can be overridden by
fad460
+setting a client id in the configuration file.  Overridding the
fad460
+client id in this fashion is discouraged.
fad460
+.TP
fad460
+.BI \-C
fad460
+Use the standard DDNS scheme from RFCs 4701 & 4702.  
fad460
+.TP
fad460
 .BI \--version
fad460
 Print version number and exit.
fad460
 .PP
fad460
@@ -470,8 +487,10 @@ DHCPv6 \fBdhclient\fR creates an identifier based on the link-layer address
fad460
 (DUID-LL) if it is running in stateless mode (with \fB\-S\fR, not
fad460
 requesting an address), or it creates an identifier based on the
fad460
 link-layer address plus a timestamp (DUID-LLT) if it is running in
fad460
-stateful mode (without \fB\-S\fR, requesting an address).  \fB\-D\fR
fad460
-overrides this default, with a value of either \fILL\fR or \fILLT\fR.
fad460
+stateful mode (without \fB\-S\fR, requesting an address).  When DHCPv4
fad460
+is configued to use a DUID using \fB\-i\fR option the default is to use
fad460
+a DUID-LLT.  \fB\-D\fR
fad460
+overrides these default, with a value of either \fILL\fR or \fILLT\fR.
fad460
 .TP
fad460
 .BI \-N
fad460
 .\" TODO: is this for telling an already running dhclient?
fad460
diff --git a/client/dhclient.c b/client/dhclient.c
fad460
index 0db4703..6403754 100644
fad460
--- a/client/dhclient.c
fad460
+++ b/client/dhclient.c
fad460
@@ -79,6 +79,8 @@ struct sockaddr_in sockaddr_broadcast;
fad460
 struct in_addr giaddr;
fad460
 struct data_string default_duid;
fad460
 int duid_type = 0;
fad460
+int duid_v4 = 0;
fad460
+int std_dhcid = 0;
fad460
 
fad460
 /* ASSERT_STATE() does nothing now; it used to be
fad460
    assert (state_is == state_shouldbe). */
fad460
@@ -325,12 +327,9 @@ main(int argc, char **argv) {
fad460
 				wanted_ia_na = 0;
fad460
 			}
fad460
 			wanted_ia_pd++;
fad460
+#endif /* DHCPv6 */
fad460
 		} else if (!strcmp(argv[i], "-D")) {
fad460
-			if (local_family_set && (local_family == AF_INET)) {
fad460
-				usage();
fad460
-			}
fad460
-			local_family_set = 1;
fad460
-			local_family = AF_INET6;
fad460
+			duid_v4 = 1;
fad460
 			if (++i == argc)
fad460
 				usage();
fad460
 			if (!strcasecmp(argv[i], "LL")) {
fad460
@@ -340,7 +339,12 @@ main(int argc, char **argv) {
fad460
 			} else {
fad460
 				usage();
fad460
 			}
fad460
-#endif /* DHCPv6 */
fad460
+		} else if (!strcmp(argv[i], "-i")) {
fad460
+			/* enable DUID support for DHCPv4 clients */
fad460
+			duid_v4 = 1;
fad460
+		} else if (!strcmp(argv[i], "-C")) {
fad460
+			/* enable standard DHCID support for DDNS updates */
fad460
+			std_dhcid = 1;
fad460
 		} else if (!strcmp(argv[i], "-v")) {
fad460
 			quiet = 0;
fad460
 		} else if (!strcmp(argv[i], "--version")) {
fad460
@@ -970,12 +974,13 @@ main(int argc, char **argv) {
fad460
 		}
fad460
 	}
fad460
 
fad460
-	/* Start a configuration state machine for each interface. */
fad460
-#ifdef DHCPv6
fad460
-	if (local_family == AF_INET6) {
fad460
-		/* Establish a default DUID.  This may be moved to the
fad460
-		 * DHCPv4 area later.
fad460
-		 */
fad460
+
fad460
+	/*
fad460
+	 * Establish a default DUID.  We always do so for v6 and
fad460
+	 * do so if desired for v4 via the -D or -i options
fad460
+	 */
fad460
+	if ((local_family == AF_INET6) ||
fad460
+	    ((local_family == AF_INET) && (duid_v4 == 1))) {
fad460
 		if (default_duid.len == 0) {
fad460
 			if (default_duid.buffer != NULL)
fad460
 				data_string_forget(&default_duid, MDL);
fad460
@@ -983,7 +988,11 @@ main(int argc, char **argv) {
fad460
 			if (form_duid(&default_duid, MDL) == ISC_R_SUCCESS)
fad460
 				write_duid(&default_duid);
fad460
 		}
fad460
+	}
fad460
 
fad460
+	/* Start a configuration state machine for each interface. */
fad460
+#ifdef DHCPv6
fad460
+	if (local_family == AF_INET6) {
fad460
 		for (ip = interfaces ; ip != NULL ; ip = ip->next) {
fad460
 			for (client = ip->client ; client != NULL ;
fad460
 			     client = client->next) {
fad460
@@ -1115,9 +1124,9 @@ static void usage()
fad460
 
fad460
 	log_fatal("Usage: dhclient "
fad460
 #ifdef DHCPv6
fad460
-		  "[-4|-6] [-SNTP1dvrx] [-nw] [-p <port>] [-D LL|LLT]\n"
fad460
+		  "[-4|-6] [-SNTPI1dvrxc] [-nw] [-p <port>] [-D LL|LLT] \n"
fad460
 #else /* DHCPv6 */
fad460
-		  "[-1dvrx] [-nw] [-p <port>]\n"
fad460
+		  "[-C1dvrxc] [-nw] [-p <port>] [-D LL|LLT] \n"
fad460
 #endif /* DHCPv6 */
fad460
 		  "                [-s server-addr] [-cf config-file] "
fad460
 		  "[-lf lease-file]\n"
fad460
@@ -2823,24 +2832,24 @@ make_client_options(struct client_state *client, struct client_lease *lease,
fad460
 	unsigned i;
fad460
 	struct option_cache *oc;
fad460
 	struct option *option = NULL;
fad460
-	struct buffer *bp = (struct buffer *)0;
fad460
+	struct buffer *bp = NULL;
fad460
 
fad460
 	/* If there are any leftover options, get rid of them. */
fad460
 	if (*op)
fad460
-		option_state_dereference (op, MDL);
fad460
+		option_state_dereference(op, MDL);
fad460
 
fad460
 	/* Allocate space for options. */
fad460
-	option_state_allocate (op, MDL);
fad460
+	option_state_allocate(op, MDL);
fad460
 
fad460
 	/* Send the server identifier if provided. */
fad460
 	if (sid)
fad460
-		save_option (&dhcp_universe, *op, sid);
fad460
+		save_option(&dhcp_universe, *op, sid);
fad460
 
fad460
-	oc = (struct option_cache *)0;
fad460
+	oc = NULL;
fad460
 
fad460
 	/* Send the requested address if provided. */
fad460
 	if (rip) {
fad460
-		client -> requested_address = *rip;
fad460
+		client->requested_address = *rip;
fad460
 		i = DHO_DHCP_REQUESTED_ADDRESS;
fad460
 		if (!(option_code_hash_lookup(&option, dhcp_universe.code_hash,
fad460
 					      &i, 0, MDL) &&
fad460
@@ -2848,22 +2857,22 @@ make_client_options(struct client_state *client, struct client_lease *lease,
fad460
 					      option, MDL)))
fad460
 			log_error ("can't make requested address cache.");
fad460
 		else {
fad460
-			save_option (&dhcp_universe, *op, oc);
fad460
-			option_cache_dereference (&oc, MDL);
fad460
+			save_option(&dhcp_universe, *op, oc);
fad460
+			option_cache_dereference(&oc, MDL);
fad460
 		}
fad460
 		option_dereference(&option, MDL);
fad460
 	} else {
fad460
-		client -> requested_address.len = 0;
fad460
+		client->requested_address.len = 0;
fad460
 	}
fad460
 
fad460
 	i = DHO_DHCP_MESSAGE_TYPE;
fad460
 	if (!(option_code_hash_lookup(&option, dhcp_universe.code_hash, &i, 0,
fad460
 				      MDL) &&
fad460
 	      make_const_option_cache(&oc, NULL, type, 1, option, MDL)))
fad460
-		log_error ("can't make message type.");
fad460
+		log_error("can't make message type.");
fad460
 	else {
fad460
-		save_option (&dhcp_universe, *op, oc);
fad460
-		option_cache_dereference (&oc, MDL);
fad460
+		save_option(&dhcp_universe, *op, oc);
fad460
+		option_cache_dereference(&oc, MDL);
fad460
 	}
fad460
 	option_dereference(&option, MDL);
fad460
 
fad460
@@ -2876,8 +2885,8 @@ make_client_options(struct client_state *client, struct client_lease *lease,
fad460
 			if (prl[i]->universe == &dhcp_universe)
fad460
 				len++;
fad460
 
fad460
-		if (!buffer_allocate (&bp, len, MDL))
fad460
-			log_error ("can't make parameter list buffer.");
fad460
+		if (!buffer_allocate(&bp, len, MDL))
fad460
+			log_error("can't make parameter list buffer.");
fad460
 		else {
fad460
 			unsigned code = DHO_DHCP_PARAMETER_REQUEST_LIST;
fad460
 
fad460
@@ -2891,15 +2900,69 @@ make_client_options(struct client_state *client, struct client_lease *lease,
fad460
 						      &code, 0, MDL) &&
fad460
 			      make_const_option_cache(&oc, &bp, NULL, len,
fad460
 						      option, MDL)))
fad460
-				log_error ("can't make option cache");
fad460
+				log_error("can't make option cache");
fad460
 			else {
fad460
-				save_option (&dhcp_universe, *op, oc);
fad460
-				option_cache_dereference (&oc, MDL);
fad460
+				save_option(&dhcp_universe, *op, oc);
fad460
+				option_cache_dereference(&oc, MDL);
fad460
 			}
fad460
 			option_dereference(&option, MDL);
fad460
 		}
fad460
 	}
fad460
 
fad460
+	/*
fad460
+	 * If requested (duid_v4 == 1) add an RFC4361 compliant client-identifier
fad460
+	 * This can be overridden by including a client id in the configuration
fad460
+	 * file.
fad460
+	 */
fad460
+ 	if (duid_v4 == 1) {
fad460
+		struct data_string client_identifier;
fad460
+		int hw_idx, hw_len;
fad460
+
fad460
+		memset(&client_identifier, 0, sizeof(client_identifier));
fad460
+		client_identifier.len = 1 + 4 + default_duid.len;
fad460
+		if (!buffer_allocate(&client_identifier.buffer,
fad460
+				     client_identifier.len, MDL))
fad460
+			log_fatal("no memory for default DUID!");
fad460
+		client_identifier.data = client_identifier.buffer->data;
fad460
+
fad460
+		i = DHO_DHCP_CLIENT_IDENTIFIER;
fad460
+
fad460
+		/* Client-identifier type : 1 byte */
fad460
+		*client_identifier.buffer->data = 255;
fad460
+		
fad460
+		/* IAID : 4 bytes
fad460
+		 * we use the low 4 bytes from the interface address
fad460
+		 */
fad460
+		if (client->interface->hw_address.hlen > 4) {
fad460
+			hw_idx = client->interface->hw_address.hlen - 4;
fad460
+			hw_len = 4;
fad460
+		} else {
fad460
+			hw_idx = 0;
fad460
+			hw_len = client->interface->hw_address.hlen;
fad460
+		}
fad460
+		memcpy(&client_identifier.buffer->data + 5 - hw_len,
fad460
+		       client->interface->hw_address.hbuf + hw_idx,
fad460
+		       hw_len);
fad460
+	
fad460
+		/* Add the default duid */
fad460
+		memcpy(&client_identifier.buffer->data+(1+4),
fad460
+		       default_duid.data, default_duid.len);
fad460
+
fad460
+		/* And save the option */
fad460
+		if (!(option_code_hash_lookup(&option, dhcp_universe.code_hash,
fad460
+					      &i, 0, MDL) &&
fad460
+		      make_const_option_cache(&oc, NULL,
fad460
+					      (u_int8_t *)client_identifier.data,
fad460
+					      client_identifier.len,
fad460
+					      option, MDL)))
fad460
+			log_error ("can't make requested client id cache..");
fad460
+		else {
fad460
+			save_option (&dhcp_universe, *op, oc);
fad460
+			option_cache_dereference (&oc, MDL);
fad460
+		}
fad460
+		option_dereference(&option, MDL);
fad460
+	}
fad460
+
fad460
 	/* Run statements that need to be run on transmission. */
fad460
 	if (client -> config -> on_transmission)
fad460
 		execute_statements_in_scope
fad460
@@ -4522,6 +4585,7 @@ client_dns_update(struct client_state *client, dhcp_ddns_cb_t *ddns_cb)
fad460
 	struct option_cache *oc;
fad460
 	int ignorep;
fad460
 	int result;
fad460
+	int ddns_v4_type;
fad460
 	isc_result_t rcode;
fad460
 
fad460
 	/* If we didn't send an FQDN option, we certainly aren't going to
fad460
@@ -4564,47 +4628,82 @@ client_dns_update(struct client_state *client, dhcp_ddns_cb_t *ddns_cb)
fad460
 				    &global_scope, oc, MDL))
fad460
 		return ISC_R_SUCCESS;
fad460
 
fad460
-	/* If this is a DHCPv6 client update, make a dhcid string out of
fad460
-	 * the DUID.  If this is a DHCPv4 client update, choose either
fad460
-	 * the client identifier, if there is one, or the interface's
fad460
-	 * MAC address.
fad460
+        /*
fad460
+	 * Construct the DHCID value for use in the DDNS update process
fad460
+	 * We have the newer standard version and the older interim version
fad460
+	 * chosen by the '-C' option.  The interim version is left as is
fad460
+	 * for backwards compatibility.  The standard version is based on
fad460
+	 * RFC 4701 section 3.3
fad460
 	 */
fad460
+
fad460
 	result = 0;
fad460
 	memset(&client_identifier, 0, sizeof(client_identifier));
fad460
-	if (client->active_lease != NULL) {
fad460
-		if (((oc =
fad460
-		      lookup_option(&dhcpv6_universe, client->sent_options,
fad460
-				    D6O_CLIENTID)) != NULL) &&
fad460
-		    evaluate_option_cache(&client_identifier, NULL, NULL,
fad460
-					  client, client->sent_options, NULL,
fad460
+
fad460
+        if (std_dhcid == 1) {
fad460
+          /* standard style */
fad460
+          ddns_cb->dhcid_class = dns_rdatatype_dhcid;
fad460
+          ddns_v4_type = 1;
fad460
+	} else {
fad460
+          /* interim style */
fad460
+          ddns_cb->dhcid_class = dns_rdatatype_txt;
fad460
+          /* for backwards compatibility */
fad460
+          ddns_v4_type = DHO_DHCP_CLIENT_IDENTIFIER;
fad460
+	}
fad460
+
fad460
+        	if (client->active_lease != NULL) {
fad460
+		/* V6 request, get the client identifier, then
fad460
+		 * construct the dhcid for either standard 
fad460
+		 * or interim */
fad460
+		if (((oc = lookup_option(&dhcpv6_universe,
fad460
+					 client->sent_options,
fad460
+					 D6O_CLIENTID)) != NULL) &&
fad460
+		    evaluate_option_cache(&client_identifier, NULL,
fad460
+					  NULL, client,
fad460
+					  client->sent_options, NULL,
fad460
 					  &global_scope, oc, MDL)) {
fad460
-			/* RFC4701 defines type '2' as being for the DUID
fad460
-			 * field.  We aren't using RFC4701 DHCID RR's yet,
fad460
-			 * but this is as good a value as any.
fad460
-			 */
fad460
-			result = get_dhcid(&ddns_cb->dhcid, 2,
fad460
+			result = get_dhcid(ddns_cb, 2,
fad460
 					   client_identifier.data,
fad460
 					   client_identifier.len);
fad460
 			data_string_forget(&client_identifier, MDL);
fad460
 		} else
fad460
 			log_fatal("Impossible condition at %s:%d.", MDL);
fad460
 	} else {
fad460
-		if (((oc =
fad460
-		      lookup_option(&dhcp_universe, client->sent_options,
fad460
-				    DHO_DHCP_CLIENT_IDENTIFIER)) != NULL) &&
fad460
-		    evaluate_option_cache(&client_identifier, NULL, NULL,
fad460
-					  client, client->sent_options, NULL,
fad460
+		/*
fad460
+		 * V4 request, use the client id if there is one or the
fad460
+		 * mac address if there isn't.  If we have a client id
fad460
+		 * we check to see if it is an embedded DUID.
fad460
+		 */
fad460
+		if (((oc = lookup_option(&dhcp_universe,
fad460
+					 client->sent_options,
fad460
+					 DHO_DHCP_CLIENT_IDENTIFIER)) != NULL) &&
fad460
+		    evaluate_option_cache(&client_identifier, NULL,
fad460
+					  NULL, client,
fad460
+					  client->sent_options, NULL,
fad460
 					  &global_scope, oc, MDL)) {
fad460
-			result = get_dhcid(&ddns_cb->dhcid,
fad460
-					   DHO_DHCP_CLIENT_IDENTIFIER,
fad460
-					   client_identifier.data,
fad460
-					   client_identifier.len);
fad460
+			if ((std_dhcid == 1) && (duid_v4 == 1) &&
fad460
+			    (client_identifier.data[0] == 255)) {
fad460
+				/*
fad460
+				 * This appears to be an embedded DUID,
fad460
+				 * extract it and treat it as such
fad460
+				 */
fad460
+				if (client_identifier.len <= 5)
fad460
+					log_fatal("Impossible condition at %s:%d.",
fad460
+						  MDL);
fad460
+				result = get_dhcid(ddns_cb, 2,
fad460
+						   client_identifier.data + 5,
fad460
+						   client_identifier.len - 5);
fad460
+			} else {
fad460
+				result = get_dhcid(ddns_cb, ddns_v4_type,
fad460
+						   client_identifier.data,
fad460
+						   client_identifier.len);
fad460
+			}
fad460
 			data_string_forget(&client_identifier, MDL);
fad460
 		} else
fad460
-			result = get_dhcid(&ddns_cb->dhcid, 0,
fad460
+			result = get_dhcid(ddns_cb, 0,
fad460
 					   client->interface->hw_address.hbuf,
fad460
 					   client->interface->hw_address.hlen);
fad460
 	}
fad460
+
fad460
 	if (!result) {
fad460
 		return ISC_R_SUCCESS;
fad460
 	}
fad460
@@ -4886,3 +4985,4 @@ dhclient_ddns_cb_free(dhcp_ddns_cb_t *ddns_cb, char* file, int line) {
fad460
         ddns_cb_free(ddns_cb, file, line);
fad460
     }
fad460
 }
fad460
+
fad460
diff --git a/common/conflex.c b/common/conflex.c
fad460
index 4611616..c99732e 100644
fad460
--- a/common/conflex.c
fad460
+++ b/common/conflex.c
fad460
@@ -879,10 +879,6 @@ intern(char *atom, enum dhcp_token dfv) {
fad460
 	      case 'd':
fad460
 		if (!strcasecmp(atom + 1, "b-time-format"))
fad460
 			return DB_TIME_FORMAT;
fad460
-		if (!strcasecmp (atom + 1, "ns-update"))
fad460
-			return DNS_UPDATE;
fad460
-		if (!strcasecmp (atom + 1, "ns-delete"))
fad460
-			return DNS_DELETE;
fad460
 		if (!strcasecmp (atom + 1, "omain"))
fad460
 			return DOMAIN;
fad460
 		if (!strncasecmp (atom + 1, "omain-", 6)) {
fad460
@@ -1178,8 +1174,6 @@ intern(char *atom, enum dhcp_token dfv) {
fad460
 			return TOKEN_NOT;
fad460
 		if (!strcasecmp (atom + 1, "o"))
fad460
 			return TOKEN_NO;
fad460
-		if (!strcasecmp (atom + 1, "s-update"))
fad460
-			return NS_UPDATE;
fad460
 		if (!strcasecmp (atom + 1, "oerror"))
fad460
 			return NS_NOERROR;
fad460
 		if (!strcasecmp (atom + 1, "otauth"))
fad460
@@ -1496,8 +1490,6 @@ intern(char *atom, enum dhcp_token dfv) {
fad460
 		}
fad460
 		if (!strcasecmp (atom + 1, "nauthenticated"))
fad460
 			return UNAUTHENTICATED;
fad460
-		if (!strcasecmp (atom + 1, "pdated-dns-rr"))
fad460
-			return UPDATED_DNS_RR;
fad460
 		if (!strcasecmp (atom + 1, "pdate"))
fad460
 			return UPDATE;
fad460
 		break;
fad460
diff --git a/common/dns.c b/common/dns.c
fad460
index d3ac966..a04c61d 100644
fad460
--- a/common/dns.c
fad460
+++ b/common/dns.c
fad460
@@ -30,10 +30,12 @@
fad460
  * asynchronous DNS routines.
fad460
  */
fad460
 
fad460
+/*! \file common/dns.c
fad460
+ */
fad460
 #include "dhcpd.h"
fad460
 #include "arpa/nameser.h"
fad460
 #include <isc/md5.h>
fad460
-
fad460
+#include <isc/sha2.h>
fad460
 #include <dns/result.h>
fad460
 
fad460
 /*
fad460
@@ -823,45 +825,123 @@ void repudiate_zone (struct dns_zone **zone)
fad460
 	dns_zone_dereference (zone, MDL);
fad460
 }
fad460
 
fad460
-/* Have to use TXT records for now. */
fad460
-#define T_DHCID T_TXT
fad460
+/*!
fad460
+ * \brief Create an id for a client
fad460
+ *
fad460
+ * This function is used to create an id for a client to use with DDNS
fad460
+ * This version of the function is for the standard style, RFC 4701
fad460
+ *
fad460
+ * This function takes information from the type and data fields and
fad460
+ * mangles it into a dhcid string which it places in ddns_cb.  It also
fad460
+ * sets a field in ddns_cb to specify the class that should be used
fad460
+ * when sending the dhcid, in this case it is a DHCID record so we use
fad460
+ * dns_rdatatype_dhcid
fad460
+ *
fad460
+ * The DHCID we construct is:
fad460
+ *  2 bytes - identifier type (see 4701 and IANA)
fad460
+ *  1 byte  - digest type, currently only SHA256 (1)
fad460
+ *  n bytes - digest, length depends on digest type, currently 32 for
fad460
+ *            SHA256
fad460
+ *
fad460
+ * What we base the digest on is up to the calling code for an id type of
fad460
+ * 0 - 1 octet htype followed by hlen octets of chaddr from v4 client request
fad460
+ * 1 - data octets from a dhcpv4 client's client identifier option
fad460
+ * 2 - the client DUID from a v4 or v6 client's client id option
fad460
+ * This identifier is concatenated with the fqdn and the result is digested.
fad460
+ */
fad460
+int get_std_dhcid(dhcp_ddns_cb_t *ddns_cb,
fad460
+		  int type,
fad460
+		  const u_int8_t *identifier,
fad460
+		  unsigned id_len)
fad460
+{
fad460
+	struct data_string *id = &ddns_cb->dhcid;
fad460
+	isc_sha256_t sha256;
fad460
+	unsigned char buf[ISC_SHA256_DIGESTLENGTH];
fad460
+	unsigned char fwd_buf[256];
fad460
+	unsigned fwd_buflen = 0;
fad460
+
fad460
+	/* Types can only be 0..(2^16)-1. */
fad460
+	if (type < 0 || type > 65535)
fad460
+		return (0);
fad460
+
fad460
+	/* We need to convert the fwd name to wire representation */
fad460
+	if (MRns_name_pton((char *)ddns_cb->fwd_name.data, fwd_buf, 256) == -1)
fad460
+		return (0);
fad460
+	while(fwd_buf[fwd_buflen] != 0) {
fad460
+		fwd_buflen += fwd_buf[fwd_buflen] + 1;
fad460
+	}
fad460
+	fwd_buflen++;
fad460
+
fad460
+	if (!buffer_allocate(&id->buffer,
fad460
+			     ISC_SHA256_DIGESTLENGTH + 2 + 1,
fad460
+			     MDL))
fad460
+		return (0);
fad460
+	id->data = id->buffer->data;
fad460
+
fad460
+	/* The two first bytes contain the type identifier. */
fad460
+	putUShort(id->buffer->data, (unsigned)type);
fad460
+
fad460
+	/* The next is the digest type, SHA-256 is 1 */
fad460
+	putUChar(id->buffer->data + 2, 1u);
fad460
+
fad460
+	/* Computing the digest */
fad460
+	isc_sha256_init(&sha256);
fad460
+	isc_sha256_update(&sha256, identifier, id_len);
fad460
+	isc_sha256_update(&sha256, fwd_buf, fwd_buflen);
fad460
+	isc_sha256_final(buf, &sha256);
fad460
 
fad460
-int get_dhcid (struct data_string *id,
fad460
-	       int type, const u_int8_t *data, unsigned len)
fad460
+	memcpy(id->buffer->data + 3, &buf, ISC_SHA256_DIGESTLENGTH);
fad460
+
fad460
+	id->len = ISC_SHA256_DIGESTLENGTH + 2 + 1;
fad460
+
fad460
+	return (1);
fad460
+}
fad460
+
fad460
+/*!
fad460
+ *
fad460
+ * \brief Create an id for a client
fad460
+ *
fad460
+ * This function is used to create an id for a client to use with DDNS
fad460
+ * This version of the function is for the interim style.  It is retained
fad460
+ * to allow users to continue using the interim style but they should
fad460
+ * switch to the standard style (which uses get_std_dhcid) for better
fad460
+ * interoperability.  
fad460
+ *
fad460
+ * This function takes information from the type and data fields and
fad460
+ * mangles it into a dhcid string which it places in ddns_cb.  It also
fad460
+ * sets a field in ddns_cb to specify the class that should be used
fad460
+ * when sending the dhcid, in this case it is a txt record so we use
fad460
+ * dns_rdata_type_txt
fad460
+ *
fad460
+ * NOTE WELL: this function has issues with how it calculates the
fad460
+ * dhcid, they can't be changed now as that would break the records
fad460
+ * already in use.
fad460
+ */
fad460
+
fad460
+int get_int_dhcid (dhcp_ddns_cb_t *ddns_cb,
fad460
+		   int type,
fad460
+		   const u_int8_t *data,
fad460
+		   unsigned len)
fad460
 {
fad460
+	struct data_string *id = &ddns_cb->dhcid;
fad460
 	unsigned char buf[ISC_MD5_DIGESTLENGTH];
fad460
 	isc_md5_t md5;
fad460
 	int i;
fad460
 
fad460
 	/* Types can only be 0..(2^16)-1. */
fad460
 	if (type < 0 || type > 65535)
fad460
-		return 0;
fad460
+		return (0);
fad460
 
fad460
 	/*
fad460
 	 * Hexadecimal MD5 digest plus two byte type, NUL,
fad460
 	 * and one byte for length for dns.
fad460
 	 */
fad460
-	if (!buffer_allocate (&id -> buffer,
fad460
-			      (ISC_MD5_DIGESTLENGTH * 2) + 4, MDL))
fad460
-		return 0;
fad460
-	id -> data = id -> buffer -> data;
fad460
+	if (!buffer_allocate(&id -> buffer,
fad460
+			     (ISC_MD5_DIGESTLENGTH * 2) + 4, MDL))
fad460
+		return (0);
fad460
+	id->data = id->buffer->data;
fad460
 
fad460
 	/*
fad460
-	 * DHCP clients and servers should use the following forms of client
fad460
-	 * identification, starting with the most preferable, and finishing
fad460
-	 * with the least preferable.  If the client does not send any of these
fad460
-	 * forms of identification, the DHCP/DDNS interaction is not defined by
fad460
-	 * this specification.  The most preferable form of identification is
fad460
-	 * the Globally Unique Identifier Option [TBD].  Next is the DHCP
fad460
-	 * Client Identifier option.  Last is the client's link-layer address,
fad460
-	 * as conveyed in its DHCPREQUEST message.  Implementors should note
fad460
-	 * that the link-layer address cannot be used if there are no
fad460
-	 * significant bytes in the chaddr field of the DHCP client's request,
fad460
-	 * because this does not constitute a unique identifier.
fad460
-	 *   -- "Interaction between DHCP and DNS"
fad460
-	 *      <draft-ietf-dhc-dhcp-dns-12.txt>
fad460
-	 *      M. Stapp, Y. Rekhter
fad460
-	 *
fad460
 	 * We put the length into the first byte to turn 
fad460
 	 * this into a dns text string.  This avoid needing to
fad460
 	 * copy the string to add the byte later.
fad460
@@ -893,7 +973,18 @@ int get_dhcid (struct data_string *id,
fad460
 	id->buffer->data[id->len] = 0;
fad460
 	id->terminated = 1;
fad460
 
fad460
-	return 1;
fad460
+	return (1);
fad460
+}
fad460
+
fad460
+int get_dhcid(dhcp_ddns_cb_t *ddns_cb,
fad460
+	      int type,
fad460
+	      const u_int8_t *identifier,
fad460
+	      unsigned id_len)
fad460
+{
fad460
+	if (ddns_cb->dhcid_class == dns_rdatatype_dhcid)
fad460
+		return get_std_dhcid(ddns_cb, type, identifier, id_len);
fad460
+	else 
fad460
+		return get_int_dhcid(ddns_cb, type, identifier, id_len);
fad460
 }
fad460
 
fad460
 /*
fad460
@@ -1015,12 +1106,12 @@ make_dns_dataset(dns_rdataclass_t  dataclass,
fad460
  * For the server the first step will have a request of:
fad460
  * The name is not in use
fad460
  * Add an A RR
fad460
- * Add a DHCID RR (currently txt)
fad460
+ * Add a DHCID RR
fad460
  *
fad460
  * For the client the first step will have a request of:
fad460
  * The A RR does not exist
fad460
  * Add an A RR
fad460
- * Add a DHCID RR (currently txt)
fad460
+ * Add a DHCID RR
fad460
  */
fad460
 
fad460
 static isc_result_t
fad460
@@ -1062,7 +1153,7 @@ ddns_modify_fwd_add1(dhcp_ddns_cb_t   *ddns_cb,
fad460
 	dataspace++;
fad460
 
fad460
 	/* Add the DHCID RR */
fad460
-	result = make_dns_dataset(dns_rdataclass_in, dns_rdatatype_txt,
fad460
+	result = make_dns_dataset(dns_rdataclass_in, ddns_cb->dhcid_class,
fad460
 				  dataspace, 
fad460
 				  (unsigned char *)ddns_cb->dhcid.data,
fad460
 				  ddns_cb->dhcid.len, ddns_cb->ttl);
fad460
@@ -1108,7 +1199,7 @@ ddns_modify_fwd_add2(dhcp_ddns_cb_t   *ddns_cb,
fad460
 		     dns_name_t       *pname,
fad460
 		     dns_name_t       *uname)
fad460
 {
fad460
-	isc_result_t result;
fad460
+	isc_result_t result = ISC_R_SUCCESS;
fad460
 
fad460
 	/*
fad460
 	 * If we are doing conflict resolution (unset) we use a prereq list.
fad460
@@ -1117,7 +1208,7 @@ ddns_modify_fwd_add2(dhcp_ddns_cb_t   *ddns_cb,
fad460
 	if ((ddns_cb->flags & DDNS_CONFLICT_OVERRIDE) == 0) {
fad460
 		/* Construct the prereq list */
fad460
 		/* The DHCID RR exists and matches the client identity */
fad460
-		result = make_dns_dataset(dns_rdataclass_in, dns_rdatatype_txt,
fad460
+		result = make_dns_dataset(dns_rdataclass_in, ddns_cb->dhcid_class,
fad460
 					  dataspace, 
fad460
 					  (unsigned char *)ddns_cb->dhcid.data,
fad460
 					  ddns_cb->dhcid.len, 0);
fad460
@@ -1130,7 +1221,7 @@ ddns_modify_fwd_add2(dhcp_ddns_cb_t   *ddns_cb,
fad460
 		/* Start constructing the update list.
fad460
 		 * Conflict detection override: delete DHCID RRs */
fad460
 		result = make_dns_dataset(dns_rdataclass_any,
fad460
-					  dns_rdatatype_txt,
fad460
+					  ddns_cb->dhcid_class,
fad460
 					  dataspace, NULL, 0, 0);
fad460
 		if (result != ISC_R_SUCCESS) {
fad460
 			return(result);
fad460
@@ -1139,7 +1230,7 @@ ddns_modify_fwd_add2(dhcp_ddns_cb_t   *ddns_cb,
fad460
 		dataspace++;
fad460
 
fad460
 		/* Add current DHCID RR */
fad460
-		result = make_dns_dataset(dns_rdataclass_in, dns_rdatatype_txt,
fad460
+		result = make_dns_dataset(dns_rdataclass_in, ddns_cb->dhcid_class,
fad460
 					  dataspace, 
fad460
 					  (unsigned char *)ddns_cb->dhcid.data,
fad460
 					  ddns_cb->dhcid.len, ddns_cb->ttl);
fad460
@@ -1201,11 +1292,11 @@ ddns_modify_fwd_rem1(dhcp_ddns_cb_t   *ddns_cb,
fad460
 		     dns_name_t       *pname,
fad460
 		     dns_name_t       *uname)
fad460
 {
fad460
-	isc_result_t result;
fad460
+	isc_result_t result = ISC_R_SUCCESS;
fad460
 
fad460
 	/* Consruct the prereq list */
fad460
 	/* The DHCID RR exists and matches the client identity */
fad460
-	result = make_dns_dataset(dns_rdataclass_in, dns_rdatatype_txt,
fad460
+	result = make_dns_dataset(dns_rdataclass_in, ddns_cb->dhcid_class,
fad460
 				  dataspace, 
fad460
 				  (unsigned char *)ddns_cb->dhcid.data,
fad460
 				  ddns_cb->dhcid.len, 0);
fad460
@@ -1271,7 +1362,7 @@ ddns_modify_fwd_rem2(dhcp_ddns_cb_t   *ddns_cb,
fad460
 
fad460
 	/* Construct the update list */
fad460
 	/* Delete DHCID RR */
fad460
-	result = make_dns_dataset(dns_rdataclass_none, dns_rdatatype_txt,
fad460
+	result = make_dns_dataset(dns_rdataclass_none, ddns_cb->dhcid_class,
fad460
 				  dataspace,
fad460
 				  (unsigned char *)ddns_cb->dhcid.data,
fad460
 				  ddns_cb->dhcid.len, 0);
fad460
diff --git a/common/parse.c b/common/parse.c
fad460
index fc51327..7477543 100644
fad460
--- a/common/parse.c
fad460
+++ b/common/parse.c
fad460
@@ -3558,42 +3558,7 @@ int parse_numeric_expression (expr, cfile, lose)
fad460
 	}
fad460
 	return 1;
fad460
 }
fad460
-#if defined (NSUPDATE_OLD)
fad460
-/*
fad460
- * dns-expression :==
fad460
- *	UPDATE LPAREN ns-class COMMA ns-type COMMA data-expression COMMA
fad460
- *				data-expression COMMA numeric-expression RPAREN
fad460
- *	DELETE LPAREN ns-class COMMA ns-type COMMA data-expression COMMA
fad460
- *				data-expression RPAREN
fad460
- *	EXISTS LPAREN ns-class COMMA ns-type COMMA data-expression COMMA
fad460
- *				data-expression RPAREN
fad460
- *	NOT EXISTS LPAREN ns-class COMMA ns-type COMMA data-expression COMMA
fad460
- *				data-expression RPAREN
fad460
- * ns-class :== IN | CHAOS | HS | NUMBER
fad460
- * ns-type :== A | PTR | MX | TXT | NUMBER
fad460
- */
fad460
-
fad460
-int parse_dns_expression (expr, cfile, lose)
fad460
-	struct expression **expr;
fad460
-	struct parse *cfile;
fad460
-	int *lose;
fad460
-{
fad460
-	/* Parse an expression... */
fad460
-	if (!parse_expression (expr, cfile, lose, context_dns,
fad460
-			       (struct expression **)0, expr_none))
fad460
-		return 0;
fad460
 
fad460
-	if (!is_dns_expression (*expr) &&
fad460
-	    (*expr) -> op != expr_variable_reference &&
fad460
-	    (*expr) -> op != expr_funcall) {
fad460
-		expression_dereference (expr, MDL);
fad460
-		parse_warn (cfile, "Expecting a dns update subexpression.");
fad460
-		*lose = 1;
fad460
-		return 0;
fad460
-	}
fad460
-	return 1;
fad460
-}
fad460
-#endif /* NSUPDATE_OLD */
fad460
 /* Parse a subexpression that does not contain a binary operator. */
fad460
 
fad460
 int parse_non_binary (expr, cfile, lose, context)
fad460
@@ -3608,11 +3573,6 @@ int parse_non_binary (expr, cfile, lose, context)
fad460
 	struct expression *nexp, **ep;
fad460
 	int known;
fad460
 	char *cptr;
fad460
-#if defined (NSUPDATE_OLD)
fad460
-	enum expr_op opcode;
fad460
-	const char *s;
fad460
-	unsigned long u;
fad460
-#endif 
fad460
 	isc_result_t status;
fad460
 	unsigned len;
fad460
 
fad460
@@ -3645,12 +3605,7 @@ int parse_non_binary (expr, cfile, lose, context)
fad460
 
fad460
 	      case TOKEN_NOT:
fad460
 		token = next_token (&val, (unsigned *)0, cfile);
fad460
-#if defined(NSUPDATE_OLD)
fad460
-		if (context == context_dns) {
fad460
-			token = peek_token (&val, (unsigned *)0, cfile);
fad460
-			goto not_exists;
fad460
-		}
fad460
-#endif
fad460
+
fad460
 		if (!expression_allocate (expr, MDL))
fad460
 			log_fatal ("can't allocate expression");
fad460
 		(*expr) -> op = expr_not;
fad460
@@ -3662,7 +3617,7 @@ int parse_non_binary (expr, cfile, lose, context)
fad460
 			}
fad460
 			*lose = 1;
fad460
 			expression_dereference (expr, MDL);
fad460
-			return 0;
fad460
+			return (0);
fad460
 		}
fad460
 		if (!is_boolean_expression ((*expr) -> data.not)) {
fad460
 			*lose = 1;
fad460
@@ -3694,10 +3649,6 @@ int parse_non_binary (expr, cfile, lose, context)
fad460
 		break;
fad460
 
fad460
 	      case EXISTS:
fad460
-#if defined(NSUPDATE_OLD)
fad460
-		if (context == context_dns)
fad460
-			goto ns_exists;
fad460
-#endif
fad460
 		token = next_token (&val, (unsigned *)0, cfile);
fad460
 		if (!expression_allocate (expr, MDL))
fad460
 			log_fatal ("can't allocate expression");
fad460
@@ -3710,7 +3661,7 @@ int parse_non_binary (expr, cfile, lose, context)
fad460
 		    (*expr)->data.option == NULL) {
fad460
 			*lose = 1;
fad460
 			expression_dereference (expr, MDL);
fad460
-			return 0;
fad460
+			return (0);
fad460
 		}
fad460
 		break;
fad460
 
fad460
@@ -4011,285 +3962,7 @@ int parse_non_binary (expr, cfile, lose, context)
fad460
 			goto norparen;
fad460
 		break;
fad460
 
fad460
-#if defined(NSUPDATE_OLD)
fad460
-		/* dns-update and dns-delete are present for historical
fad460
-		   purposes, but are deprecated in favor of ns-update
fad460
-		   in combination with update, delete, exists and not
fad460
-		   exists. */
fad460
-	      case DNS_UPDATE:
fad460
-	      case DNS_DELETE:
fad460
-#if !defined (NSUPDATE)
fad460
-		parse_warn (cfile,
fad460
-			    "Please rebuild dhcpd with --with-nsupdate.");
fad460
-#endif
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token == DNS_UPDATE)
fad460
-			opcode = expr_ns_add;
fad460
-		else
fad460
-			opcode = expr_ns_delete;
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != LPAREN)
fad460
-			goto nolparen;
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != STRING) {
fad460
-			parse_warn (cfile,
fad460
-				    "parse_expression: expecting string.");
fad460
-		      badnsupdate:
fad460
-			skip_to_semi (cfile);
fad460
-			*lose = 1;
fad460
-			return 0;
fad460
-		}
fad460
-			
fad460
-		if (!strcasecmp (val, "a"))
fad460
-			u = T_A;
fad460
-		else if (!strcasecmp (val, "aaaa"))
fad460
-			u = T_AAAA;
fad460
-		else if (!strcasecmp (val, "ptr"))
fad460
-			u = T_PTR;
fad460
-		else if (!strcasecmp (val, "mx"))
fad460
-			u = T_MX;
fad460
-		else if (!strcasecmp (val, "cname"))
fad460
-			u = T_CNAME;
fad460
-		else if (!strcasecmp (val, "TXT"))
fad460
-			u = T_TXT;
fad460
-		else {
fad460
-			parse_warn (cfile, "unexpected rrtype: %s", val);
fad460
-			goto badnsupdate;
fad460
-		}
fad460
-
fad460
-		s = (opcode == expr_ns_add
fad460
-		     ? "old-dns-update"
fad460
-		     : "old-dns-delete");
fad460
-		cptr = dmalloc (strlen (s) + 1, MDL);
fad460
-		if (!cptr)
fad460
-			log_fatal ("can't allocate name for %s", s);
fad460
-		strcpy (cptr, s);
fad460
-		if (!expression_allocate (expr, MDL))
fad460
-			log_fatal ("can't allocate expression");
fad460
-		(*expr) -> op = expr_funcall;
fad460
-		(*expr) -> data.funcall.name = cptr;
fad460
-
fad460
-		/* Fake up a function call. */
fad460
-		ep = &(*expr) -> data.funcall.arglist;
fad460
-		if (!expression_allocate (ep, MDL))
fad460
-			log_fatal ("can't allocate expression");
fad460
-		(*ep) -> op = expr_arg;
fad460
-		if (!make_const_int (&(*ep) -> data.arg.val, u))
fad460
-			log_fatal ("can't allocate rrtype value.");
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != COMMA)
fad460
-			goto nocomma;
fad460
-		ep = &((*ep) -> data.arg.next);
fad460
-		if (!expression_allocate (ep, MDL))
fad460
-			log_fatal ("can't allocate expression");
fad460
-		(*ep) -> op = expr_arg;
fad460
-		if (!(parse_data_expression (&(*ep) -> data.arg.val,
fad460
-					     cfile, lose)))
fad460
-			goto nodata;
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != COMMA)
fad460
-			goto nocomma;
fad460
-
fad460
-		ep = &((*ep) -> data.arg.next);
fad460
-		if (!expression_allocate (ep, MDL))
fad460
-			log_fatal ("can't allocate expression");
fad460
-		(*ep) -> op = expr_arg;
fad460
-		if (!(parse_data_expression (&(*ep) -> data.arg.val,
fad460
-					     cfile, lose)))
fad460
-			goto nodata;
fad460
-
fad460
-		if (opcode == expr_ns_add) {
fad460
-			token = next_token (&val, (unsigned *)0, cfile);
fad460
-			if (token != COMMA)
fad460
-				goto nocomma;
fad460
-			
fad460
-			ep = &((*ep) -> data.arg.next);
fad460
-			if (!expression_allocate (ep, MDL))
fad460
-				log_fatal ("can't allocate expression");
fad460
-			(*ep) -> op = expr_arg;
fad460
-			if (!(parse_numeric_expression (&(*ep) -> data.arg.val,
fad460
-							cfile, lose))) {
fad460
-				parse_warn (cfile,
fad460
-					    "expecting numeric expression.");
fad460
-				goto badnsupdate;
fad460
-			}
fad460
-		}
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != RPAREN)
fad460
-			goto norparen;
fad460
-		break;
fad460
-
fad460
-	      case NS_UPDATE:
fad460
-#if !defined (NSUPDATE)
fad460
-		parse_warn (cfile,
fad460
-			    "Please rebuild dhcpd with --with-nsupdate.");
fad460
-#endif
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (!expression_allocate (expr, MDL))
fad460
-			log_fatal ("can't allocate expression");
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != LPAREN)
fad460
-			goto nolparen;
fad460
-
fad460
-		nexp = *expr;
fad460
-		do {
fad460
-			nexp -> op = expr_dns_transaction;
fad460
-			if (!(parse_dns_expression
fad460
-			      (&nexp -> data.dns_transaction.car,
fad460
-			       cfile, lose)))
fad460
-			{
fad460
-				if (!*lose)
fad460
-					parse_warn
fad460
-						(cfile,
fad460
-						 "expecting dns expression.");
fad460
-				expression_dereference (expr, MDL);
fad460
-				*lose = 1;
fad460
-				return 0;
fad460
-			}
fad460
-
fad460
-			token = next_token (&val, (unsigned *)0, cfile);
fad460
-			
fad460
-			if (token == COMMA) {
fad460
-				if (!(expression_allocate
fad460
-				      (&nexp -> data.dns_transaction.cdr,
fad460
-				       MDL)))
fad460
-					log_fatal
fad460
-						("can't allocate expression");
fad460
-				nexp = nexp -> data.dns_transaction.cdr;
fad460
-			}
fad460
-		} while (token == COMMA);
fad460
-
fad460
-		if (token != RPAREN)
fad460
-			goto norparen;
fad460
-		break;
fad460
-
fad460
-		/* NOT EXISTS is special cased above... */
fad460
-	      not_exists:
fad460
-		token = peek_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != EXISTS) {
fad460
-			parse_warn (cfile, "expecting DNS prerequisite.");
fad460
-			*lose = 1;
fad460
-			return 0;
fad460
-		}
fad460
-		opcode = expr_ns_not_exists;
fad460
-		goto nsupdatecode;
fad460
-	      case TOKEN_ADD:
fad460
-		opcode = expr_ns_add;
fad460
-		goto nsupdatecode;
fad460
-	      case TOKEN_DELETE:
fad460
-		opcode = expr_ns_delete;
fad460
-		goto nsupdatecode;
fad460
-	      ns_exists:
fad460
-		opcode = expr_ns_exists;
fad460
-	      nsupdatecode:
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-
fad460
-#if !defined (NSUPDATE)
fad460
-		parse_warn (cfile,
fad460
-			    "Please rebuild dhcpd with --with-nsupdate.");
fad460
-#endif
fad460
-		if (!expression_allocate (expr, MDL))
fad460
-			log_fatal ("can't allocate expression");
fad460
-		(*expr) -> op = opcode;
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != LPAREN)
fad460
-			goto nolparen;
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (!is_identifier (token) && token != NUMBER) {
fad460
-			parse_warn (cfile, "expecting identifier or number.");
fad460
-		      badnsop:
fad460
-			expression_dereference (expr, MDL);
fad460
-			skip_to_semi (cfile);
fad460
-			*lose = 1;
fad460
-			return 0;
fad460
-		}
fad460
-			
fad460
-		if (token == NUMBER)
fad460
-			(*expr) -> data.ns_add.rrclass = atoi (val);
fad460
-		else if (!strcasecmp (val, "in"))
fad460
-			(*expr) -> data.ns_add.rrclass = C_IN;
fad460
-		else if (!strcasecmp (val, "chaos"))
fad460
-			(*expr) -> data.ns_add.rrclass = C_CHAOS;
fad460
-		else if (!strcasecmp (val, "hs"))
fad460
-			(*expr) -> data.ns_add.rrclass = C_HS;
fad460
-		else {
fad460
-			parse_warn (cfile, "unexpected rrclass: %s", val);
fad460
-			goto badnsop;
fad460
-		}
fad460
-		
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != COMMA)
fad460
-			goto nocomma;
fad460
 
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (!is_identifier (token) && token != NUMBER) {
fad460
-			parse_warn (cfile, "expecting identifier or number.");
fad460
-			goto badnsop;
fad460
-		}
fad460
-			
fad460
-		if (token == NUMBER)
fad460
-			(*expr) -> data.ns_add.rrtype = atoi (val);
fad460
-		else if (!strcasecmp (val, "a"))
fad460
-			(*expr) -> data.ns_add.rrtype = T_A;
fad460
-		else if (!strcasecmp (val, "aaaa"))
fad460
-			(*expr) -> data.ns_add.rrtype = T_AAAA;
fad460
-		else if (!strcasecmp (val, "ptr"))
fad460
-			(*expr) -> data.ns_add.rrtype = T_PTR;
fad460
-		else if (!strcasecmp (val, "mx"))
fad460
-			(*expr) -> data.ns_add.rrtype = T_MX;
fad460
-		else if (!strcasecmp (val, "cname"))
fad460
-			(*expr) -> data.ns_add.rrtype = T_CNAME;
fad460
-		else if (!strcasecmp (val, "TXT"))
fad460
-			(*expr) -> data.ns_add.rrtype = T_TXT;
fad460
-		else {
fad460
-			parse_warn (cfile, "unexpected rrtype: %s", val);
fad460
-			goto badnsop;
fad460
-		}
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != COMMA)
fad460
-			goto nocomma;
fad460
-
fad460
-		if (!(parse_data_expression
fad460
-		      (&(*expr) -> data.ns_add.rrname, cfile, lose)))
fad460
-			goto nodata;
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != COMMA)
fad460
-			goto nocomma;
fad460
-
fad460
-		if (!(parse_data_expression
fad460
-		      (&(*expr) -> data.ns_add.rrdata, cfile, lose)))
fad460
-			goto nodata;
fad460
-
fad460
-		if (opcode == expr_ns_add) {
fad460
-			token = next_token (&val, (unsigned *)0, cfile);
fad460
-			if (token != COMMA)
fad460
-				goto nocomma;
fad460
-			
fad460
-			if (!(parse_numeric_expression
fad460
-			      (&(*expr) -> data.ns_add.ttl, cfile,
fad460
-			       lose))) {
fad460
-			    if (!*lose)
fad460
-				parse_warn (cfile,
fad460
-					    "expecting numeric expression.");
fad460
-			    goto badnsupdate;
fad460
-			}
fad460
-		}
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != RPAREN)
fad460
-			goto norparen;
fad460
-		break;
fad460
-#endif /* NSUPDATE_OLD */
fad460
 	      case OPTION:
fad460
 	      case CONFIG_OPTION:
fad460
 		if (!expression_allocate (expr, MDL))
fad460
@@ -4366,44 +4039,7 @@ int parse_non_binary (expr, cfile, lose, context)
fad460
 		(*expr) -> op = expr_host_decl_name;
fad460
 		break;
fad460
 
fad460
-#if defined(NSUPDATE_OLD)
fad460
-	      case UPDATED_DNS_RR:
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != LPAREN)
fad460
-			goto nolparen;
fad460
 
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != STRING) {
fad460
-			parse_warn (cfile, "expecting string.");
fad460
-		      bad_rrtype:
fad460
-			*lose = 1;
fad460
-			return 0;
fad460
-		}
fad460
-		if (!strcasecmp (val, "a"))
fad460
-			s = "ddns-fwd-name";
fad460
-		else if (!strcasecmp (val, "ptr"))
fad460
-			s = "ddns-rev-name";
fad460
-		else {
fad460
-			parse_warn (cfile, "invalid DNS rrtype: %s", val);
fad460
-			goto bad_rrtype;
fad460
-		}
fad460
-
fad460
-		token = next_token (&val, (unsigned *)0, cfile);
fad460
-		if (token != RPAREN)
fad460
-			goto norparen;
fad460
-
fad460
-		if (!expression_allocate (expr, MDL))
fad460
-			log_fatal ("can't allocate expression");
fad460
-		(*expr) -> op = expr_variable_reference;
fad460
-		(*expr) -> data.variable =
fad460
-			dmalloc (strlen (s) + 1, MDL);
fad460
-		if (!(*expr) -> data.variable)
fad460
-			log_fatal ("can't allocate variable name.");
fad460
-		strcpy ((*expr) -> data.variable, s);
fad460
-		break;
fad460
-#endif /* NSUPDATE_OLD */
fad460
 	      case PACKET:
fad460
 		token = next_token (&val, (unsigned *)0, cfile);
fad460
 		if (!expression_allocate (expr, MDL))
fad460
diff --git a/common/tree.c b/common/tree.c
fad460
index 8c2056c..26e0add 100644
fad460
--- a/common/tree.c
fad460
+++ b/common/tree.c
fad460
@@ -645,15 +645,6 @@ int evaluate_expression (result, packet, lease, client_state,
fad460
 		status = (evaluate_data_expression
fad460
 			  (&bv -> value.data, packet, lease, client_state,
fad460
 			   in_options, cfg_options, scope, expr, MDL));
fad460
-#if defined (NSUPDATE_OLD)
fad460
-	} else if (is_dns_expression (expr)) {
fad460
-		if (!binding_value_allocate (&bv, MDL))
fad460
-			return 0;
fad460
-		bv -> type = binding_dns;
fad460
-		status = (evaluate_dns_expression
fad460
-			  (&bv -> value.dns, packet, lease, client_state,
fad460
-			   in_options, cfg_options, scope, expr));
fad460
-#endif
fad460
 	} else {
fad460
 		log_error ("%s: invalid expression type: %d",
fad460
 			   "evaluate_expression", expr -> op);
fad460
@@ -699,19 +690,6 @@ int binding_value_dereference (struct binding_value **v,
fad460
 		if (bv -> value.data.buffer)
fad460
 			data_string_forget (&bv -> value.data, file, line);
fad460
 		break;
fad460
-	      case binding_dns:
fad460
-#if defined (NSUPDATE_OLD)
fad460
-		if (bv -> value.dns) {
fad460
-			if (bv -> value.dns -> r_data) {
fad460
-				dfree (bv -> value.dns -> r_data_ephem, MDL);
fad460
-				bv -> value.dns -> r_data = (unsigned char *)0;
fad460
-				bv -> value.dns -> r_data_ephem =
fad460
-					(unsigned char *)0;
fad460
-			}
fad460
-			minires_freeupdrec (bv -> value.dns);
fad460
-		}
fad460
-		break;
fad460
-#endif
fad460
 	      default:
fad460
 		log_error ("%s(%d): invalid binding type: %d",
fad460
 			   file, line, bv -> type);
fad460
@@ -721,270 +699,6 @@ int binding_value_dereference (struct binding_value **v,
fad460
 	return 1;
fad460
 }
fad460
 
fad460
-#if defined (NSUPDATE_OLD)
fad460
-int evaluate_dns_expression (result, packet, lease, client_state, in_options,
fad460
-			     cfg_options, scope, expr)
fad460
-	ns_updrec **result;
fad460
-	struct packet *packet;
fad460
-	struct lease *lease;
fad460
-	struct client_state *client_state;
fad460
-	struct option_state *in_options;
fad460
-	struct option_state *cfg_options;
fad460
-	struct binding_scope **scope;
fad460
-	struct expression *expr;
fad460
-{
fad460
-	unsigned long ttl = 0;
fad460
-	char *tname;
fad460
-	struct data_string name, data;
fad460
-	int r0, r1, r2;
fad460
-
fad460
-	if (!result || *result) {
fad460
-		log_error ("evaluate_dns_expression called with non-null %s",
fad460
-			   "result pointer");
fad460
-#if defined (POINTER_DEBUG)
fad460
-		abort ();
fad460
-#else
fad460
-		return 0;
fad460
-#endif
fad460
-	}
fad460
-		
fad460
-	switch (expr -> op) {
fad460
-#if defined (NSUPDATE)
fad460
-	      case expr_ns_add:
fad460
-		r0 = evaluate_numeric_expression (&ttl, packet, lease,
fad460
-						  client_state,
fad460
-						  in_options, cfg_options,
fad460
-						  scope,
fad460
-						  expr -> data.ns_add.ttl);
fad460
-		goto nsfinish;
fad460
-
fad460
-	      case expr_ns_exists:
fad460
-		ttl = 1;
fad460
-
fad460
-	      case expr_ns_delete:
fad460
-	      case expr_ns_not_exists:
fad460
-		r0 = 1;
fad460
-	      nsfinish:
fad460
-		memset (&name, 0, sizeof name);
fad460
-		r1 = evaluate_data_expression (&name, packet, lease,
fad460
-					       client_state,
fad460
-					       in_options, cfg_options, scope,
fad460
-					       expr -> data.ns_add.rrname,
fad460
-					       MDL);
fad460
-		if (r1) {
fad460
-			/* The result of the evaluation may or may not
fad460
-			   be NUL-terminated, but we need it
fad460
-			   terminated for sure, so we have to allocate
fad460
-			   a buffer and terminate it. */
fad460
-			tname = dmalloc (name.len + 1, MDL);
fad460
-			if (!tname) {
fad460
-				r2 = 0;
fad460
-				r1 = 0;
fad460
-				data_string_forget (&name, MDL);
fad460
-			} else {
fad460
-				memcpy (tname, name.data, name.len);
fad460
-				tname [name.len] = 0;
fad460
-				memset (&data, 0, sizeof data);
fad460
-				r2 = evaluate_data_expression
fad460
-					(&data, packet, lease, client_state,
fad460
-					 in_options, cfg_options, scope,
fad460
-					 expr -> data.ns_add.rrdata, MDL);
fad460
-			}
fad460
-		} else {
fad460
-			r2 = 0;
fad460
-			tname = NULL;
fad460
-		}
fad460
-		if (r0 && r1 && (r2 || expr -> op != expr_ns_add)) {
fad460
-		    *result = minires_mkupdrec (((expr -> op == expr_ns_add ||
fad460
-						  expr -> op == expr_ns_delete)
fad460
-						 ? S_UPDATE : S_PREREQ),
fad460
-						tname,
fad460
-						expr -> data.ns_add.rrclass,
fad460
-						expr -> data.ns_add.rrtype,
fad460
-						ttl);
fad460
-		    if (!*result) {
fad460
-			  ngood:
fad460
-			    if (r2) {
fad460
-				data_string_forget (&data, MDL);
fad460
-				r2 = 0;
fad460
-			    }
fad460
-		    } else {
fad460
-			if (data.len) {
fad460
-				/* As a special case, if we get exactly
fad460
-				   four bytes of data, it's an IP address
fad460
-				   represented as a 32-bit quantity, which
fad460
-				   is actually what we *should* be getting
fad460
-				   here.   Because res_mkupdrec is currently
fad460
-				   broken and expects a dotted quad, convert
fad460
-				   it.   This should be fixed when the new
fad460
-				   resolver is merged. */
fad460
-				if (data.len == 4) {
fad460
-				    (*result) -> r_data_ephem =
fad460
-					    dmalloc (16, MDL);
fad460
-				    if (!(*result) -> r_data_ephem)
fad460
-					goto dpngood;
fad460
-				    (*result) -> r_data =
fad460
-					    (*result) -> r_data_ephem;
fad460
-				    /*%Audit% 16 bytes max. %2004.06.17,Safe%*/
fad460
-				    sprintf ((char *)(*result) -> r_data_ephem,
fad460
-					     "%u.%u.%u.%u",
fad460
-					     data.data [0] & 0xff,
fad460
-					     data.data [1] & 0xff,
fad460
-					     data.data [2] & 0xff,
fad460
-					     data.data [3] & 0xff);
fad460
-				    (*result) -> r_size = 
fad460
-					    strlen ((const char *)
fad460
-						    (*result) -> r_data);
fad460
-				} else {
fad460
-				    (*result) -> r_size = data.len;
fad460
-				    (*result) -> r_data_ephem =
fad460
-					    dmalloc (data.len, MDL);
fad460
-				    if (!(*result) -> r_data_ephem) {
fad460
-				      dpngood: /* double plus ungood. */
fad460
-					minires_freeupdrec (*result);
fad460
-					*result = 0;
fad460
-					goto ngood;
fad460
-				    }
fad460
-				    (*result) -> r_data =
fad460
-					    (*result) -> r_data_ephem;
fad460
-				    memcpy ((*result) -> r_data_ephem,
fad460
-					    data.data, data.len);
fad460
-				}
fad460
-			} else {
fad460
-				(*result) -> r_data = 0;
fad460
-				(*result) -> r_size = 0;
fad460
-			}
fad460
-			switch (expr -> op) {
fad460
-			      case expr_ns_add:
fad460
-				(*result) -> r_opcode = ADD;
fad460
-				break;
fad460
-			      case expr_ns_delete:
fad460
-				(*result) -> r_opcode = DELETE;
fad460
-				break;
fad460
-			      case expr_ns_exists:
fad460
-				(*result) -> r_opcode = YXRRSET;
fad460
-				break;
fad460
-			      case expr_ns_not_exists:
fad460
-				(*result) -> r_opcode = NXRRSET;
fad460
-				break;
fad460
-
fad460
-				/* Can't happen, but satisfy gcc. */
fad460
-			      default:
fad460
-				break;
fad460
-			}
fad460
-		    }
fad460
-		}
fad460
-		if (r1) {
fad460
-			data_string_forget (&name, MDL);
fad460
-			dfree (tname, MDL);
fad460
-		}
fad460
-		if (r2)
fad460
-			data_string_forget (&data, MDL);
fad460
-		/* One flaw in the thinking here: an IP address and an
fad460
-		   ASCII string both look like data expressions, but
fad460
-		   for A records, we want an ASCII string, not a
fad460
-		   binary IP address.  Do I need to turn binary IP
fad460
-		   addresses into a separate type?  */
fad460
-		return (r0 && r1 &&
fad460
-			(r2 || expr -> op != expr_ns_add) && *result);
fad460
-
fad460
-#else
fad460
-	      case expr_ns_add:
fad460
-	      case expr_ns_delete:
fad460
-	      case expr_ns_exists:
fad460
-	      case expr_ns_not_exists:
fad460
-		return 0;
fad460
-#endif
fad460
-	      case expr_funcall:
fad460
-		log_error ("%s: dns values for functions not supported.",
fad460
-			   expr -> data.funcall.name);
fad460
-		break;
fad460
-
fad460
-	      case expr_variable_reference:
fad460
-		log_error ("%s: dns values for variables not supported.",
fad460
-			   expr -> data.variable);
fad460
-		break;
fad460
-
fad460
-	      case expr_check:
fad460
-	      case expr_equal:
fad460
-	      case expr_not_equal:
fad460
-	      case expr_regex_match:
fad460
-	      case expr_iregex_match:
fad460
-	      case expr_and:
fad460
-	      case expr_or:
fad460
-	      case expr_not:
fad460
-	      case expr_match:
fad460
-	      case expr_static:
fad460
-	      case expr_known:
fad460
-	      case expr_exists:
fad460
-	      case expr_variable_exists:
fad460
-		log_error ("Boolean opcode in evaluate_dns_expression: %d",
fad460
-		      expr -> op);
fad460
-		return 0;
fad460
-
fad460
-	      case expr_none:
fad460
-	      case expr_substring:
fad460
-	      case expr_suffix:
fad460
-	      case expr_lcase:
fad460
-	      case expr_ucase:
fad460
-	      case expr_option:
fad460
-	      case expr_hardware:
fad460
-	      case expr_const_data:
fad460
-	      case expr_packet:
fad460
-	      case expr_concat:
fad460
-	      case expr_encapsulate:
fad460
-	      case expr_host_lookup:
fad460
-	      case expr_encode_int8:
fad460
-	      case expr_encode_int16:
fad460
-	      case expr_encode_int32:
fad460
-	      case expr_binary_to_ascii:
fad460
-	      case expr_reverse:
fad460
-	      case expr_filename:
fad460
-	      case expr_sname:
fad460
-	      case expr_pick_first_value:
fad460
-	      case expr_host_decl_name:
fad460
-	      case expr_config_option:
fad460
-	      case expr_leased_address:
fad460
-	      case expr_null:
fad460
-	      case expr_gethostname:
fad460
-		log_error ("Data opcode in evaluate_dns_expression: %d",
fad460
-		      expr -> op);
fad460
-		return 0;
fad460
-
fad460
-	      case expr_extract_int8:
fad460
-	      case expr_extract_int16:
fad460
-	      case expr_extract_int32:
fad460
-	      case expr_const_int:
fad460
-	      case expr_lease_time:
fad460
-	      case expr_dns_transaction:
fad460
-	      case expr_add:
fad460
-	      case expr_subtract:
fad460
-	      case expr_multiply:
fad460
-	      case expr_divide:
fad460
-	      case expr_remainder:
fad460
-	      case expr_binary_and:
fad460
-	      case expr_binary_or:
fad460
-	      case expr_binary_xor:
fad460
-	      case expr_client_state:
fad460
-		log_error ("Numeric opcode in evaluate_dns_expression: %d",
fad460
-		      expr -> op);
fad460
-		return 0;
fad460
-
fad460
-	      case expr_function:
fad460
-		log_error ("Function opcode in evaluate_dns_expression: %d",
fad460
-		      expr -> op);
fad460
-		return 0;
fad460
-
fad460
-	      case expr_arg:
fad460
-		break;
fad460
-	}
fad460
-
fad460
-	log_error ("Bogus opcode in evaluate_dns_expression: %d",
fad460
-		   expr -> op);
fad460
-	return 0;
fad460
-}
fad460
-#endif /* defined (NSUPDATE_OLD) */
fad460
-
fad460
 int evaluate_boolean_expression (result, packet, lease, client_state,
fad460
 				 in_options, cfg_options, scope, expr)
fad460
 	int *result;
fad460
@@ -1056,20 +770,7 @@ int evaluate_boolean_expression (result, packet, lease, client_state,
fad460
 			    else
fad460
 				*result = expr -> op == expr_not_equal;
fad460
 			    break;
fad460
-#if defined (NSUPDATE_OLD)
fad460
-			  case binding_dns:
fad460
-#if defined (NSUPDATE)
fad460
-			    /* XXX This should be a comparison for equal
fad460
-			       XXX values, not for identity. */
fad460
-			    if (bv -> value.dns == obv -> value.dns)
fad460
-				*result = expr -> op == expr_equal;
fad460
-			    else
fad460
-				*result = expr -> op == expr_not_equal;
fad460
-#else
fad460
-				*result = expr -> op == expr_not_equal;
fad460
-#endif
fad460
-			    break;
fad460
-#endif /* NSUPDATE_OLD */
fad460
+
fad460
 			  case binding_function:
fad460
 			    if (bv -> value.fundef == obv -> value.fundef)
fad460
 				*result = expr -> op == expr_equal;
fad460
@@ -2369,7 +2070,7 @@ int evaluate_data_expression (result, packet, lease, client_state,
fad460
 	      case expr_ns_delete:
fad460
 	      case expr_ns_exists:
fad460
 	      case expr_ns_not_exists:
fad460
-		log_error ("dns update opcode in evaluate_data_expression: %d",
fad460
+		log_error ("dns opcode in evaluate_boolean_expression: %d",
fad460
 		      expr -> op);
fad460
 		return 0;
fad460
 
fad460
@@ -2398,11 +2099,6 @@ int evaluate_numeric_expression (result, packet, lease, client_state,
fad460
 {
fad460
 	struct data_string data;
fad460
 	int status, sleft, sright;
fad460
-#if defined (NSUPDATE_OLD)
fad460
-	ns_updrec *nut;
fad460
-	ns_updque uq;
fad460
-	struct expression *cur, *next;
fad460
-#endif
fad460
 
fad460
 	struct binding *binding;
fad460
 	struct binding_value *bv;
fad460
@@ -2541,53 +2237,6 @@ int evaluate_numeric_expression (result, packet, lease, client_state,
fad460
 #endif
fad460
 		return (1);
fad460
  
fad460
-	      case expr_dns_transaction:
fad460
-#if !defined (NSUPDATE_OLD)
fad460
-		return 0;
fad460
-#else
fad460
-		if (!resolver_inited) {
fad460
-			minires_ninit (&resolver_state);
fad460
-			resolver_inited = 1;
fad460
-			resolver_state.retrans = 1;
fad460
-			resolver_state.retry = 1;
fad460
-		}
fad460
-		ISC_LIST_INIT (uq);
fad460
-		cur = expr;
fad460
-		do {
fad460
-		    next = cur -> data.dns_transaction.cdr;
fad460
-		    nut = 0;
fad460
-		    status = (evaluate_dns_expression
fad460
-			      (&nut, packet,
fad460
-			       lease, client_state, in_options, cfg_options,
fad460
-			       scope, cur -> data.dns_transaction.car));
fad460
-		    if (!status)
fad460
-			    goto dns_bad;
fad460
-		    ISC_LIST_APPEND (uq, nut, r_link);
fad460
-		    cur = next;
fad460
-		} while (next);
fad460
-
fad460
-		/* Do the update and record the error code, if there was
fad460
-		   an error; otherwise set it to NOERROR. */
fad460
-		*result = minires_nupdate (&resolver_state,
fad460
-					   ISC_LIST_HEAD (uq));
fad460
-		status = 1;
fad460
-
fad460
-		print_dns_status ((int)*result, &uq;;
fad460
-
fad460
-	      dns_bad:
fad460
-		while (!ISC_LIST_EMPTY (uq)) {
fad460
-			ns_updrec *tmp = ISC_LIST_HEAD (uq);
fad460
-			ISC_LIST_UNLINK (uq, tmp, r_link);
fad460
-			if (tmp -> r_data_ephem) {
fad460
-				dfree (tmp -> r_data_ephem, MDL);
fad460
-				tmp -> r_data = (unsigned char *)0;
fad460
-				tmp -> r_data_ephem = (unsigned char *)0;
fad460
-			}
fad460
-			minires_freeupdrec (tmp);
fad460
-		}
fad460
-		return status;
fad460
-#endif /* NSUPDATE_OLD */
fad460
-
fad460
 	      case expr_variable_reference:
fad460
 		if (scope && *scope) {
fad460
 		    binding = find_binding (*scope, expr -> data.variable);
fad460
@@ -2877,14 +2526,6 @@ int evaluate_numeric_expression (result, packet, lease, client_state,
fad460
 			return 0;
fad460
 		}
fad460
 
fad460
-	      case expr_ns_add:
fad460
-	      case expr_ns_delete:
fad460
-	      case expr_ns_exists:
fad460
-	      case expr_ns_not_exists:
fad460
-		log_error ("dns opcode in evaluate_numeric_expression: %d",
fad460
-		      expr -> op);
fad460
-		return 0;
fad460
-
fad460
 	      case expr_function:
fad460
 		log_error ("function definition in evaluate_numeric_expr");
fad460
 		return 0;
fad460
@@ -3182,38 +2823,6 @@ void expression_dereference (eptr, file, line)
fad460
 				(&expr -> data.reverse.buffer, file, line);
fad460
 		break;
fad460
 
fad460
-	      case expr_dns_transaction:
fad460
-		if (expr -> data.dns_transaction.car)
fad460
-		    expression_dereference (&expr -> data.dns_transaction.car,
fad460
-					    file, line);
fad460
-		if (expr -> data.dns_transaction.cdr)
fad460
-		    expression_dereference (&expr -> data.dns_transaction.cdr,
fad460
-					    file, line);
fad460
-		break;
fad460
-
fad460
-	      case expr_ns_add:
fad460
-		if (expr -> data.ns_add.rrname)
fad460
-		    expression_dereference (&expr -> data.ns_add.rrname,
fad460
-					    file, line);
fad460
-		if (expr -> data.ns_add.rrdata)
fad460
-		    expression_dereference (&expr -> data.ns_add.rrdata,
fad460
-					    file, line);
fad460
-		if (expr -> data.ns_add.ttl)
fad460
-		    expression_dereference (&expr -> data.ns_add.ttl,
fad460
-					    file, line);
fad460
-		break;
fad460
-
fad460
-	      case expr_ns_delete:
fad460
-	      case expr_ns_exists:
fad460
-	      case expr_ns_not_exists:
fad460
-		if (expr -> data.ns_delete.rrname)
fad460
-		    expression_dereference (&expr -> data.ns_delete.rrname,
fad460
-					    file, line);
fad460
-		if (expr -> data.ns_delete.rrdata)
fad460
-		    expression_dereference (&expr -> data.ns_delete.rrdata,
fad460
-					    file, line);
fad460
-		break;
fad460
-
fad460
 	      case expr_variable_reference:
fad460
 	      case expr_variable_exists:
fad460
 		if (expr -> data.variable)
fad460
@@ -3262,15 +2871,6 @@ void expression_dereference (eptr, file, line)
fad460
 	free_expression (expr, MDL);
fad460
 }
fad460
 
fad460
-int is_dns_expression (expr)
fad460
-	struct expression *expr;
fad460
-{
fad460
-      return (expr -> op == expr_ns_add ||
fad460
-	      expr -> op == expr_ns_delete ||
fad460
-	      expr -> op == expr_ns_exists ||
fad460
-	      expr -> op == expr_ns_not_exists);
fad460
-}
fad460
-
fad460
 int is_boolean_expression (expr)
fad460
 	struct expression *expr;
fad460
 {
fad460
@@ -3325,7 +2925,6 @@ int is_numeric_expression (expr)
fad460
 		expr -> op == expr_extract_int32 ||
fad460
 		expr -> op == expr_const_int ||
fad460
 		expr -> op == expr_lease_time ||
fad460
-		expr -> op == expr_dns_transaction ||
fad460
 		expr -> op == expr_add ||
fad460
 		expr -> op == expr_subtract ||
fad460
 		expr -> op == expr_multiply ||
fad460
@@ -3340,11 +2939,7 @@ int is_numeric_expression (expr)
fad460
 int is_compound_expression (expr)
fad460
 	struct expression *expr;
fad460
 {
fad460
-	return (expr -> op == expr_ns_add ||
fad460
-		expr -> op == expr_ns_delete ||
fad460
-		expr -> op == expr_ns_exists ||
fad460
-		expr -> op == expr_ns_not_exists ||
fad460
-		expr -> op == expr_substring ||
fad460
+	return (expr -> op == expr_substring ||
fad460
 		expr -> op == expr_suffix ||
fad460
 		expr -> op == expr_option ||
fad460
 		expr -> op == expr_concat ||
fad460
@@ -3357,8 +2952,7 @@ int is_compound_expression (expr)
fad460
 		expr -> op == expr_config_option ||
fad460
 		expr -> op == expr_extract_int8 ||
fad460
 		expr -> op == expr_extract_int16 ||
fad460
-		expr -> op == expr_extract_int32 ||
fad460
-		expr -> op == expr_dns_transaction);
fad460
+		expr -> op == expr_extract_int32);
fad460
 }
fad460
 
fad460
 static int op_val (enum expr_op);
fad460
@@ -3456,8 +3050,6 @@ enum expression_context expression_context (struct expression *expr)
fad460
 		return context_numeric;
fad460
 	if (is_boolean_expression (expr))
fad460
 		return context_boolean;
fad460
-	if (is_dns_expression (expr))
fad460
-		return context_dns;
fad460
 	return context_any;
fad460
 }
fad460
 
fad460
@@ -3928,99 +3520,6 @@ int write_expression (file, expr, col, indent, firstp)
fad460
 					  "lease-time");
fad460
 		break;
fad460
 
fad460
-	      case expr_dns_transaction:
fad460
-		col = token_print_indent (file, col, indent, "", "",
fad460
-					  "ns-update");
fad460
-		col = token_print_indent (file, col, indent, " ", "",
fad460
-					  "(");
fad460
-		scol = 0;
fad460
-		for (e = expr;
fad460
-		     e && e -> op == expr_dns_transaction;
fad460
-		     e = e -> data.dns_transaction.cdr) {
fad460
-			if (!scol) {
fad460
-				scol = col;
fad460
-				firstp = 1;
fad460
-			} else
fad460
-				firstp = 0;
fad460
-			col = write_expression (file,
fad460
-						e -> data.dns_transaction.car,
fad460
-						col, scol, firstp);
fad460
-			if (e -> data.dns_transaction.cdr)
fad460
-				col = token_print_indent (file, col, scol,
fad460
-							  "", " ", ",");
fad460
-		}
fad460
-		if (e)
fad460
-			col = write_expression (file, e, col, scol, 0);
fad460
-		col = token_print_indent (file, col, indent, "", "", ")");
fad460
-		break;
fad460
-
fad460
-	      case expr_ns_add:
fad460
-		col = token_print_indent (file, col, indent, "", "",
fad460
-					  "update");
fad460
-		col = token_print_indent (file, col, indent, " ", "",
fad460
-					  "(");
fad460
-		scol = col;
fad460
-		sprintf (obuf, "%d", expr -> data.ns_add.rrclass);
fad460
-		col = token_print_indent (file, col, scol, "", "", obuf);
fad460
-		col = token_print_indent (file, col, scol, "", " ",
fad460
-					  ",");
fad460
-		sprintf (obuf, "%d", expr -> data.ns_add.rrtype);
fad460
-		col = token_print_indent (file, col, scol, "", "", obuf);
fad460
-		col = token_print_indent (file, col, scol, "", " ",
fad460
-					  ",");
fad460
-		col = write_expression (file, expr -> data.ns_add.rrname,
fad460
-					col, scol, 0);
fad460
-		col = token_print_indent (file, col, scol, "", " ",
fad460
-					  ",");
fad460
-		col = write_expression (file, expr -> data.ns_add.rrdata,
fad460
-					col, scol, 0);
fad460
-		col = token_print_indent (file, col, scol, "", " ",
fad460
-					  ",");
fad460
-		col = write_expression (file, expr -> data.ns_add.ttl,
fad460
-					col, scol, 0);
fad460
-		col = token_print_indent (file, col, indent, "", "",
fad460
-					  ")");
fad460
-		break;
fad460
-
fad460
-	      case expr_ns_delete:
fad460
-		col = token_print_indent (file, col, indent, "", "",
fad460
-					  "delete");
fad460
-		col = token_print_indent (file, col, indent, " ", "",
fad460
-					  "(");
fad460
-	      finish_ns_small:
fad460
-		scol = col;
fad460
-		sprintf (obuf, "%d", expr -> data.ns_add.rrclass);
fad460
-		col = token_print_indent (file, col, scol, "", "", obuf);
fad460
-		col = token_print_indent (file, col, scol, "", " ",
fad460
-					  ",");
fad460
-		sprintf (obuf, "%d", expr -> data.ns_add.rrtype);
fad460
-		col = token_print_indent (file, col, scol, "", "", obuf);
fad460
-		col = token_print_indent (file, col, scol, "", " ",
fad460
-					  ",");
fad460
-		col = write_expression (file, expr -> data.ns_add.rrname,
fad460
-					col, scol, 0);
fad460
-		col = token_print_indent (file, col, scol, "", " ",
fad460
-					  ",");
fad460
-		col = write_expression (file, expr -> data.ns_add.rrdata,
fad460
-					col, scol, 0);
fad460
-		col = token_print_indent (file, col, indent, "", "",
fad460
-					  ")");
fad460
-		break;
fad460
-
fad460
-	      case expr_ns_exists:
fad460
-		col = token_print_indent (file, col, indent, "", "",
fad460
-					  "exists");
fad460
-		col = token_print_indent (file, col, indent, " ", "",
fad460
-					  "(");
fad460
-		goto finish_ns_small;
fad460
-
fad460
-	      case expr_ns_not_exists:
fad460
-		col = token_print_indent (file, col, indent, "", "",
fad460
-					  "not exists");
fad460
-		col = token_print_indent (file, col, indent, " ", "",
fad460
-					  "(");
fad460
-		goto finish_ns_small;
fad460
-
fad460
 	      case expr_static:
fad460
 		col = token_print_indent (file, col, indent, "", "",
fad460
 					  "static");
fad460
@@ -4293,12 +3792,7 @@ int data_subexpression_length (int *rv,
fad460
 	      case expr_const_int:
fad460
 	      case expr_exists:
fad460
 	      case expr_known:
fad460
-	      case expr_dns_transaction:
fad460
 	      case expr_static:
fad460
-	      case expr_ns_add:
fad460
-	      case expr_ns_delete:
fad460
-	      case expr_ns_exists:
fad460
-	      case expr_ns_not_exists:
fad460
 	      case expr_not_equal:
fad460
 	      case expr_null:
fad460
 	      case expr_variable_exists:
fad460
@@ -4349,12 +3843,6 @@ int expr_valid_for_context (struct expression *expr,
fad460
 			return 1;
fad460
 		return 0;
fad460
 
fad460
-	      case context_dns:
fad460
-		if (is_dns_expression (expr)) {
fad460
-			return 1;
fad460
-		}
fad460
-		return 0;
fad460
-
fad460
 	      case context_data_or_numeric:
fad460
 		if (is_numeric_expression (expr) ||
fad460
 		    is_data_expression (expr)) {
fad460
diff --git a/includes/dhcpd.h b/includes/dhcpd.h
fad460
index 1d2bf2c..7e756e0 100644
fad460
--- a/includes/dhcpd.h
fad460
+++ b/includes/dhcpd.h
fad460
@@ -638,6 +638,7 @@ struct lease_state {
fad460
 #define DDNS_UPDATE_STYLE_NONE		0
fad460
 #define DDNS_UPDATE_STYLE_AD_HOC	1
fad460
 #define DDNS_UPDATE_STYLE_INTERIM	2
fad460
+#define DDNS_UPDATE_STYLE_STANDARD	3
fad460
 
fad460
 /* Server option names. */
fad460
 
fad460
@@ -1627,6 +1628,9 @@ typedef struct dhcp_ddns_cb {
fad460
 
fad460
 	void *transaction;
fad460
 	void *dataspace;
fad460
+
fad460
+	dns_rdataclass_t dhcid_class;
fad460
+	char *lease_tag;
fad460
 } dhcp_ddns_cb_t;
fad460
 
fad460
 extern struct ipv6_pool **pools;
fad460
@@ -2047,11 +2051,6 @@ struct expression *parse_domain_list(struct parse *cfile, int);
fad460
 
fad460
 
fad460
 /* tree.c */
fad460
-#if defined (NSUPDATE)
fad460
-extern struct __res_state resolver_state;
fad460
-extern int resolver_inited;
fad460
-#endif
fad460
-
fad460
 extern struct binding_scope *global_scope;
fad460
 pair cons (caddr_t, pair);
fad460
 int make_const_option_cache (struct option_cache **, struct buffer **,
fad460
@@ -2079,15 +2078,6 @@ int evaluate_expression (struct binding_value **, struct packet *,
fad460
 			 struct binding_scope **, struct expression *,
fad460
 			 const char *, int);
fad460
 int binding_value_dereference (struct binding_value **, const char *, int);
fad460
-#if defined (NSUPDATE_OLD)
fad460
-int evaluate_dns_expression (ns_updrec **, struct packet *,
fad460
-			     struct lease *,
fad460
-			     struct client_state *,
fad460
-			     struct option_state *,
fad460
-			     struct option_state *,
fad460
-			     struct binding_scope **,
fad460
-			     struct expression *);
fad460
-#endif
fad460
 int evaluate_boolean_expression (int *,
fad460
 				 struct packet *,  struct lease *,
fad460
 				 struct client_state *,
fad460
@@ -2913,21 +2903,18 @@ int icmp_echorequest (struct iaddr *);
fad460
 isc_result_t icmp_echoreply (omapi_object_t *);
fad460
 
fad460
 /* dns.c */
fad460
-#if defined (NSUPDATE)
fad460
-isc_result_t find_tsig_key (ns_tsig_key **, const char *, struct dns_zone *);
fad460
-void tkey_free (ns_tsig_key **);
fad460
-#endif
fad460
 isc_result_t enter_dns_zone (struct dns_zone *);
fad460
 isc_result_t dns_zone_lookup (struct dns_zone **, const char *);
fad460
 int dns_zone_dereference (struct dns_zone **, const char *, int);
fad460
 #if defined (NSUPDATE)
fad460
 #define FIND_FORWARD 0
fad460
 #define FIND_REVERSE 1
fad460
+isc_result_t find_tsig_key (ns_tsig_key **, const char *, struct dns_zone *);
fad460
+void tkey_free (ns_tsig_key **);
fad460
 isc_result_t find_cached_zone (dhcp_ddns_cb_t *, int);
fad460
 void forget_zone (struct dns_zone **);
fad460
 void repudiate_zone (struct dns_zone **);
fad460
-//void cache_found_zone (ns_class, char *, struct in_addr *, int);
fad460
-int get_dhcid (struct data_string *, int, const u_int8_t *, unsigned);
fad460
+int get_dhcid (dhcp_ddns_cb_t *, int, const u_int8_t *, unsigned);
fad460
 void dhcid_tolease (struct data_string *, struct data_string *);
fad460
 isc_result_t dhcid_fromlease (struct data_string *, struct data_string *);
fad460
 isc_result_t ddns_update_fwd(struct data_string *, struct iaddr,
fad460
@@ -2937,6 +2924,16 @@ isc_result_t ddns_remove_fwd(struct data_string *,
fad460
 			     struct iaddr, struct data_string *);
fad460
 #endif /* NSUPDATE */
fad460
 
fad460
+dhcp_ddns_cb_t *ddns_cb_alloc(const char *file, int line);
fad460
+void ddns_cb_free (dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
+void ddns_cb_forget_zone (dhcp_ddns_cb_t *ddns_cb);
fad460
+isc_result_t
fad460
+ddns_modify_fwd(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
+isc_result_t
fad460
+ddns_modify_ptr(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
+void
fad460
+ddns_cancel(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
+
fad460
 /* resolv.c */
fad460
 extern char path_resolv_conf [];
fad460
 extern struct name_server *name_servers;
fad460
@@ -3302,21 +3299,6 @@ void dump_subnets (void);
fad460
 void free_everything (void);
fad460
 #endif
fad460
 
fad460
-/* nsupdate.c */
fad460
-char *ddns_rev_name (struct lease *, struct lease_state *, struct packet *);
fad460
-char *ddns_fwd_name (struct lease *, struct lease_state *, struct packet *);
fad460
-int nsupdateA (const char *, const unsigned char *, u_int32_t, int);
fad460
-int nsupdatePTR (const char *, const unsigned char *, u_int32_t, int);
fad460
-void nsupdate (struct lease *, struct lease_state *, struct packet *, int);
fad460
-int updateA (const struct data_string *, const struct data_string *,
fad460
-	     unsigned int, struct lease *);
fad460
-int updatePTR (const struct data_string *, const struct data_string *,
fad460
-	       unsigned int, struct lease *);
fad460
-int deleteA (const struct data_string *, const struct data_string *,
fad460
-	     struct lease *);
fad460
-int deletePTR (const struct data_string *, const struct data_string *,
fad460
-	       struct lease *);
fad460
-
fad460
 /* failover.c */
fad460
 #if defined (FAILOVER_PROTOCOL)
fad460
 extern dhcp_failover_state_t *failover_states;
fad460
@@ -3576,20 +3558,5 @@ void mark_hosts_unavailable(void);
fad460
 void mark_phosts_unavailable(void);
fad460
 void mark_interfaces_unavailable(void);
fad460
 
fad460
-dhcp_ddns_cb_t *ddns_cb_alloc(const char *file, int line);
fad460
-void ddns_cb_free (dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
-void ddns_cb_forget_zone (dhcp_ddns_cb_t *ddns_cb);
fad460
-
fad460
-//void *key_from_zone(struct dns_zone *zone);
fad460
-
fad460
-isc_result_t
fad460
-ddns_modify_fwd(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
-
fad460
-isc_result_t
fad460
-ddns_modify_ptr(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
-
fad460
-void
fad460
-ddns_cancel(dhcp_ddns_cb_t *ddns_cb, const char *file, int line);
fad460
-
fad460
 #define MAX_ADDRESS_STRING_LEN \
fad460
    (sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"))
fad460
diff --git a/includes/dhctoken.h b/includes/dhctoken.h
fad460
index 3d9a21d..a75eb97 100644
fad460
--- a/includes/dhctoken.h
fad460
+++ b/includes/dhctoken.h
fad460
@@ -32,6 +32,11 @@
fad460
  * ``http://www.nominum.com''.
fad460
  */
fad460
 
fad460
+/*
fad460
+ * The following tokens have been deprecated and aren't in use anymore.
fad460
+ * They have been left in place to avoid disturbing the code.
fad460
+ * DNS_UPDATE, DNS_DELETE, NS_UPDATE, UPDATED_DNS_RR
fad460
+ */
fad460
 enum dhcp_token {
fad460
 	SEMI = ';',
fad460
 	DOT = '.',
fad460
diff --git a/includes/site.h b/includes/site.h
fad460
index 8ff2834..1c7ec96 100644
fad460
--- a/includes/site.h
fad460
+++ b/includes/site.h
fad460
@@ -281,3 +281,17 @@
fad460
    limit the number of TCP connections that the server will
fad460
    allow at one time.  A value of 0 means there is no limit.*/
fad460
 #define MAX_FD_VALUE 200
fad460
+
fad460
+
fad460
+/* Include code to do a slow transition of DDNS records
fad460
+   from the interim to the standard version, or backwards.
fad460
+   The normal code will handle removing an old style record
fad460
+   when the name on a lease is being changed.  This adds code
fad460
+   to handle the case where the name isn't being changed but
fad460
+   the old record should be removed to allow a new record to
fad460
+   be added.  This is the slow transition as leases are only
fad460
+   updated as a client touches them.  A fast transition would
fad460
+   entail updating all the records at once, probably at start
fad460
+   up. */
fad460
+#define DDNS_UPDATE_SLOW_TRANSITION
fad460
+   
fad460
diff --git a/includes/tree.h b/includes/tree.h
fad460
index 291c0f6..746d31c 100644
fad460
--- a/includes/tree.h
fad460
+++ b/includes/tree.h
fad460
@@ -116,9 +116,6 @@ struct binding_value {
fad460
 		struct data_string data;
fad460
 		unsigned long intval;
fad460
 		int boolean;
fad460
-#if defined (NSUPDATE_OLD)
fad460
-		ns_updrec *dns;
fad460
-#endif
fad460
 		struct fundef *fundef;
fad460
 		struct binding_value *bv;
fad460
 	} value;
fad460
diff --git a/server/ddns.c b/server/ddns.c
fad460
index 2a64bc9..3cf15ce 100644
fad460
--- a/server/ddns.c
fad460
+++ b/server/ddns.c
fad460
@@ -36,6 +36,9 @@
fad460
 #include "dhcpd.h"
fad460
 #include <dns/result.h>
fad460
 
fad460
+char *ddns_standard_tag = "ddns-dhcid";
fad460
+char *ddns_interim_tag  = "ddns-txt";
fad460
+
fad460
 #ifdef NSUPDATE
fad460
 
fad460
 static void ddns_fwd_srv_connector(struct lease          *lease,
fad460
@@ -71,16 +74,13 @@ ddns_updates(struct packet *packet, struct lease *lease, struct lease *old,
fad460
 	struct data_string ddns_domainname;
fad460
 	struct data_string old_ddns_fwd_name;
fad460
 	struct data_string ddns_fwd_name;
fad460
-	//struct data_string ddns_rev_name;
fad460
 	struct data_string ddns_dhcid;
fad460
 	struct binding_scope **scope = NULL;
fad460
-	//struct iaddr addr;
fad460
 	struct data_string d1;
fad460
 	struct option_cache *oc;
fad460
 	int s1, s2;
fad460
 	int result = 0;
fad460
 	int server_updates_a = 1;
fad460
-	//int server_updates_ptr = 1;
fad460
 	struct buffer *bp = (struct buffer *)0;
fad460
 	int ignorep = 0, client_ignorep = 0;
fad460
 	int rev_name_len;
fad460
@@ -89,8 +89,9 @@ ddns_updates(struct packet *packet, struct lease *lease, struct lease *old,
fad460
 	dhcp_ddns_cb_t *ddns_cb;
fad460
 	int do_remove = 0;
fad460
 
fad460
-	if (ddns_update_style != 2)
fad460
-		return 0;
fad460
+	if ((ddns_update_style != DDNS_UPDATE_STYLE_STANDARD) &&
fad460
+	    (ddns_update_style != DDNS_UPDATE_STYLE_INTERIM))
fad460
+		return (0);
fad460
 
fad460
 	/*
fad460
 	 * sigh, I want to cancel any previous udpates before we do anything
fad460
@@ -149,7 +150,6 @@ ddns_updates(struct packet *packet, struct lease *lease, struct lease *old,
fad460
 	memset (&ddns_domainname, 0, sizeof (ddns_domainname));
fad460
 	memset (&old_ddns_fwd_name, 0, sizeof (ddns_fwd_name));
fad460
 	memset (&ddns_fwd_name, 0, sizeof (ddns_fwd_name));
fad460
-	//memset (&ddns_rev_name, 0, sizeof (ddns_rev_name));
fad460
 	memset (&ddns_dhcid, 0, sizeof (ddns_dhcid));
fad460
 
fad460
 	/* If we are allowed to accept the client's update of its own A
fad460
@@ -263,31 +263,22 @@ ddns_updates(struct packet *packet, struct lease *lease, struct lease *old,
fad460
 			goto in;
fad460
 		}
fad460
 
fad460
-		/* See if there's a DHCID on the lease, and if not
fad460
-		 * then potentially look for 'on events' for ad-hoc ddns.
fad460
+#if defined  (DDNS_UPDATE_SLOW_TRANSITION)
fad460
+		/*
fad460
+		 * If the slow transition code is enabled check to see
fad460
+		 * if the stored type (standard or interim doesn't
fad460
+		 * match the type currently in use.  If it doesn't
fad460
+		 * try to remove and replace the DNS record
fad460
 		 */
fad460
-		if (!find_bound_string(&ddns_dhcid, *scope, "ddns-txt") &&
fad460
-		    (old != NULL)) {
fad460
-			/* If there's no DHCID, the update was probably
fad460
-			   done with the old-style ad-hoc DDNS updates.
fad460
-			   So if the expiry and release events look like
fad460
-			   they're the same, run them.   This should delete
fad460
-			   the old DDNS data. */
fad460
-			if (old -> on_expiry == old -> on_release) {
fad460
-				execute_statements(NULL, NULL, lease, NULL,
fad460
-						   NULL, NULL, scope,
fad460
-						   old->on_expiry);
fad460
-				if (old -> on_expiry)
fad460
-					executable_statement_dereference
fad460
-						(&old -> on_expiry, MDL);
fad460
-				if (old -> on_release)
fad460
-					executable_statement_dereference
fad460
-						(&old -> on_release, MDL);
fad460
-				/* Now, install the DDNS data the new way. */
fad460
-				goto in;
fad460
-			}
fad460
-		} else
fad460
+		if (((ddns_update_style == DDNS_UPDATE_STYLE_STANDARD) &&
fad460
+		     find_bound_string(&ddns_dhcid, *scope, ddns_interim_tag)) ||
fad460
+		    ((ddns_update_style == DDNS_UPDATE_STYLE_INTERIM) &&
fad460
+		     find_bound_string(&ddns_dhcid, *scope, ddns_standard_tag))) {
fad460
 			data_string_forget(&ddns_dhcid, MDL);
fad460
+			do_remove = 1;
fad460
+			goto in;
fad460
+		}
fad460
+#endif
fad460
 
fad460
 		/* See if the administrator wants to do updates even
fad460
 		   in cases where the update already appears to have been
fad460
@@ -486,22 +477,68 @@ ddns_updates(struct packet *packet, struct lease *lease, struct lease *old,
fad460
 	}
fad460
 
fad460
 	/*
fad460
+	 * copy the string now so we can pass it to the dhcid routines
fad460
+	 * via the ddns_cb pointer
fad460
+	 */
fad460
+	data_string_copy(&ddns_cb->fwd_name, &ddns_fwd_name, MDL);
fad460
+
fad460
+	/*
fad460
 	 * If we are updating the A record, compute the DHCID value.
fad460
+	 * We have two options for computing the DHCID value, the older
fad460
+	 * interim version and the newer standard version.  The interim
fad460
+	 * has some issues but is left as is to avoid compatibility issues.
fad460
+	 *
fad460
+	 * We select the type of DHCID to construct and the information to
fad460
+	 * use for the digest based on 4701 section 3.3
fad460
 	 */
fad460
 	if ((ddns_cb->flags & DDNS_UPDATE_ADDR) != 0) {
fad460
-		if (lease6 != NULL)
fad460
-			result = get_dhcid(&ddns_cb->dhcid, 2,
fad460
-					   lease6->ia->iaid_duid.data,
fad460
-					   lease6->ia->iaid_duid.len);
fad460
-		else if ((lease != NULL) && (lease->uid != NULL) &&
fad460
-			 (lease->uid_len != 0))
fad460
-			result = get_dhcid (&ddns_cb->dhcid,
fad460
-					    DHO_DHCP_CLIENT_IDENTIFIER,
fad460
-					    lease -> uid, lease -> uid_len);
fad460
-		else if (lease != NULL)
fad460
-			result = get_dhcid (&ddns_cb->dhcid, 0,
fad460
-					    lease -> hardware_addr.hbuf,
fad460
-					    lease -> hardware_addr.hlen);
fad460
+		int ddns_type;
fad460
+		int ddns_len;
fad460
+		if (ddns_update_style == DDNS_UPDATE_STYLE_STANDARD) {
fad460
+			/* The standard style */
fad460
+			ddns_cb->lease_tag = ddns_standard_tag;
fad460
+			ddns_cb->dhcid_class = dns_rdatatype_dhcid;
fad460
+			ddns_type = 1;
fad460
+			ddns_len = 4;
fad460
+		} else {
fad460
+			/* The older interim style */
fad460
+			ddns_cb->lease_tag = ddns_interim_tag;
fad460
+			ddns_cb->dhcid_class = dns_rdatatype_txt;
fad460
+			/* for backwards compatibility */
fad460
+			ddns_type = DHO_DHCP_CLIENT_IDENTIFIER;
fad460
+			/* IAID incorrectly included */
fad460
+			ddns_len = 0;
fad460
+		}
fad460
+
fad460
+
fad460
+		if (lease6 != NULL) {
fad460
+			if (lease6->ia->iaid_duid.len < ddns_len)
fad460
+				goto badfqdn;
fad460
+			result = get_dhcid(ddns_cb, 2,
fad460
+					   lease6->ia->iaid_duid.data + ddns_len,
fad460
+					   lease6->ia->iaid_duid.len - ddns_len);
fad460
+		} else if ((lease != NULL) &&
fad460
+			   (lease->uid != NULL) &&
fad460
+			   (lease->uid_len != 0)) {
fad460
+			/* If this is standard check for an RFC 4361
fad460
+			 * compliant client identifier
fad460
+			 */
fad460
+			if ((ddns_update_style == DDNS_UPDATE_STYLE_STANDARD) &&
fad460
+			    (lease->uid[0] == 255)) {
fad460
+				if (lease->uid_len < 5)
fad460
+					goto badfqdn;
fad460
+				result = get_dhcid(ddns_cb, 2,
fad460
+						   lease->uid + 5,
fad460
+						   lease->uid_len - 5);
fad460
+			} else {
fad460
+				result = get_dhcid(ddns_cb, ddns_type,
fad460
+						   lease->uid,
fad460
+						   lease->uid_len);
fad460
+			}
fad460
+		} else if (lease != NULL)
fad460
+			result = get_dhcid(ddns_cb, 0,
fad460
+					   lease->hardware_addr.hbuf,
fad460
+					   lease->hardware_addr.hlen);
fad460
 		else
fad460
 			log_fatal("Impossible condition at %s:%d.", MDL);
fad460
 
fad460
@@ -513,8 +550,6 @@ ddns_updates(struct packet *packet, struct lease *lease, struct lease *old,
fad460
 	 * Perform updates.
fad460
 	 */
fad460
 
fad460
-	data_string_copy(&ddns_cb->fwd_name, &ddns_fwd_name, MDL);
fad460
-
fad460
 	if (ddns_cb->flags && DDNS_UPDATE_ADDR) {
fad460
 		oc = lookup_option(&server_universe, options,
fad460
 				   SV_DDNS_CONFLICT_DETECT);
fad460
@@ -707,8 +742,6 @@ ddns_updates(struct packet *packet, struct lease *lease, struct lease *old,
fad460
 	data_string_forget(&ddns_domainname, MDL);
fad460
 	data_string_forget(&old_ddns_fwd_name, MDL);
fad460
 	data_string_forget(&ddns_fwd_name, MDL);
fad460
-	//data_string_forget(&ddns_rev_name, MDL);
fad460
-	//data_string_forget(&ddns_dhcid, MDL);
fad460
 	if (bp)
fad460
 		buffer_dereference(&bp, MDL);
fad460
 
fad460
@@ -822,18 +855,21 @@ ddns_update_lease_text(dhcp_ddns_cb_t        *ddns_cb,
fad460
 	case DDNS_STATE_ADD_FW_NXDOMAIN:
fad460
 		bind_ds_value(scope, "ddns-fwd-name", &ddns_cb->fwd_name);
fad460
 
fad460
-		/* convert from dns version to lease version of dhcid */
fad460
-		memset(&lease_dhcid, 0, sizeof(lease_dhcid));
fad460
-		dhcid_tolease(&ddns_cb->dhcid, &lease_dhcid);
fad460
-		bind_ds_value(scope, "ddns-txt", &lease_dhcid);
fad460
-		data_string_forget(&lease_dhcid, MDL);
fad460
-
fad460
+		if (ddns_cb->lease_tag == ddns_standard_tag) {
fad460
+			bind_ds_value(scope, ddns_standard_tag, &ddns_cb->dhcid);
fad460
+		} else {
fad460
+			/* convert from dns version to lease version of dhcid */
fad460
+			memset(&lease_dhcid, 0, sizeof(lease_dhcid));
fad460
+			dhcid_tolease(&ddns_cb->dhcid, &lease_dhcid);
fad460
+			bind_ds_value(scope, ddns_interim_tag, &lease_dhcid);
fad460
+			data_string_forget(&lease_dhcid, MDL);
fad460
+		}
fad460
 		break;
fad460
 
fad460
 	case DDNS_STATE_REM_FW_NXRR:
fad460
 	case DDNS_STATE_REM_FW_YXDHCID:
fad460
 		unset(*scope, "ddns-fwd-name");
fad460
-		unset(*scope, "ddns-txt");
fad460
+		unset(*scope, ddns_cb->lease_tag);
fad460
 		break;
fad460
 	}
fad460
 		
fad460
@@ -1791,7 +1827,8 @@ ddns_removals(struct lease    *lease,
fad460
 	if (*scope == NULL)
fad460
 		goto cleanup;
fad460
 
fad460
-	if (ddns_update_style != 2)
fad460
+	if ((ddns_update_style != DDNS_UPDATE_STYLE_STANDARD) &&
fad460
+	    (ddns_update_style != DDNS_UPDATE_STYLE_INTERIM))
fad460
 		goto cleanup;
fad460
 
fad460
 	/* Assume that we are removing both records */
fad460
@@ -1823,15 +1860,22 @@ ddns_removals(struct lease    *lease,
fad460
 	}
fad460
 
fad460
 	/*
fad460
-	 * Find the ptr name and copy it to the control block.  If we don't
fad460
-	 * have it this isn't an interim or rfc3??? record so we can't delete
fad460
+	 * Find the txt or dhcid tag and copy it to the control block.  If we don't
fad460
+	 * have one this isn't an interim or standard record so we can't delete
fad460
 	 * the A record using this mechanism but we can delete the ptr record.
fad460
 	 * In this case we will attempt to do any requested next step.
fad460
 	 */
fad460
 	memset(&leaseid, 0, sizeof(leaseid));
fad460
-	if (!find_bound_string (&leaseid, *scope, "ddns-txt")) {
fad460
-		ddns_cb->flags &= ~DDNS_UPDATE_ADDR;
fad460
-	} else {
fad460
+	if (find_bound_string (&leaseid, *scope, ddns_standard_tag)) {
fad460
+		/* We have a standard tag */
fad460
+		ddns_cb->lease_tag = ddns_standard_tag;
fad460
+		ddns_cb->dhcid_class = dns_rdatatype_dhcid;
fad460
+		data_string_copy(&ddns_cb->dhcid, &leaseid, MDL);
fad460
+		data_string_forget(&leaseid, MDL);
fad460
+	} else 	if (find_bound_string (&leaseid, *scope, ddns_interim_tag)) {
fad460
+		/* we have an interim tag */
fad460
+		ddns_cb->lease_tag = ddns_interim_tag;
fad460
+		ddns_cb->dhcid_class = dns_rdatatype_txt;
fad460
 		if (dhcid_fromlease(&ddns_cb->dhcid, &leaseid) != 
fad460
 		    ISC_R_SUCCESS) {
fad460
 			/* We couldn't convert the dhcid from the lease
fad460
@@ -1841,7 +1885,9 @@ ddns_removals(struct lease    *lease,
fad460
 			ddns_cb->flags &= ~DDNS_UPDATE_ADDR;
fad460
 		}
fad460
 		data_string_forget(&leaseid, MDL);
fad460
-	}
fad460
+	} else {
fad460
+		ddns_cb->flags &= ~DDNS_UPDATE_ADDR;
fad460
+	}		
fad460
 
fad460
 	/*
fad460
 	 * Find the rev name and copy it to the control block.  If we don't
fad460
@@ -1888,7 +1934,7 @@ ddns_removals(struct lease    *lease,
fad460
 		else {
fad460
 			/*remove info from scope */
fad460
 			unset(*scope, "ddns-fwd-name");
fad460
-			unset(*scope, "ddns-txt");
fad460
+			unset(*scope, ddns_cb->lease_tag);
fad460
 		}
fad460
 	}
fad460
 
fad460
diff --git a/server/dhcpd.c b/server/dhcpd.c
fad460
index 67fec83..9617d75 100644
fad460
--- a/server/dhcpd.c
fad460
+++ b/server/dhcpd.c
fad460
@@ -82,86 +82,6 @@ option server.ddns-hostname =						    \n\
fad460
 option server.ddns-domainname =	config-option domain-name;		    \n\
fad460
 option server.ddns-rev-domainname = \"in-addr.arpa.\";";
fad460
 
fad460
-/* This is the old-style name service updater that is executed
fad460
-   whenever a lease is committed.  It does not follow the DHCP-DNS
fad460
-   draft at all. */
fad460
-
fad460
-char old_nsupdate [] = "						    \n\
fad460
-on commit {								    \n\
fad460
-  if (not static and							    \n\
fad460
-      ((config-option server.ddns-updates = null) or			    \n\
fad460
-       (config-option server.ddns-updates != 0))) {			    \n\
fad460
-    set new-ddns-fwd-name =						    \n\
fad460
-      concat (pick (config-option server.ddns-hostname,			    \n\
fad460
-		    option host-name), \".\",				    \n\
fad460
-	      pick (config-option server.ddns-domainname,		    \n\
fad460
-		    config-option domain-name));			    \n\
fad460
-    if (defined (ddns-fwd-name) and ddns-fwd-name != new-ddns-fwd-name) {   \n\
fad460
-      switch (ns-update (delete (IN, A, ddns-fwd-name, leased-address))) {  \n\
fad460
-      case NOERROR:							    \n\
fad460
-	unset ddns-fwd-name;						    \n\
fad460
-	on expiry or release {						    \n\
fad460
-	}								    \n\
fad460
-      }									    \n\
fad460
-    }									    \n\
fad460
-									    \n\
fad460
-    if (not defined (ddns-fwd-name)) {					    \n\
fad460
-      set ddns-fwd-name = new-ddns-fwd-name;				    \n\
fad460
-      if defined (ddns-fwd-name) {					    \n\
fad460
-	switch (ns-update (not exists (IN, A, ddns-fwd-name, null),	    \n\
fad460
-			   add (IN, A, ddns-fwd-name, leased-address,	    \n\
fad460
-				lease-time / 2))) {			    \n\
fad460
-	default:							    \n\
fad460
-	  unset ddns-fwd-name;						    \n\
fad460
-	  break;							    \n\
fad460
-									    \n\
fad460
-	case NOERROR:							    \n\
fad460
-	  set ddns-rev-name =						    \n\
fad460
-	    concat (binary-to-ascii (10, 8, \".\",			    \n\
fad460
-				     reverse (1,			    \n\
fad460
-					      leased-address)), \".\",	    \n\
fad460
-		    pick (config-option server.ddns-rev-domainname,	    \n\
fad460
-			  \"in-addr.arpa.\"));				    \n\
fad460
-	  switch (ns-update (delete (IN, PTR, ddns-rev-name, null),	    \n\
fad460
-			     add (IN, PTR, ddns-rev-name, ddns-fwd-name,    \n\
fad460
-				  lease-time / 2)))			    \n\
fad460
-	    {								    \n\
fad460
-	    default:							    \n\
fad460
-	      unset ddns-rev-name;					    \n\
fad460
-	      on release or expiry {					    \n\
fad460
-		switch (ns-update (delete (IN, A, ddns-fwd-name,	    \n\
fad460
-					   leased-address))) {		    \n\
fad460
-		case NOERROR:						    \n\
fad460
-		  unset ddns-fwd-name;					    \n\
fad460
-		  break;						    \n\
fad460
-		}							    \n\
fad460
-		on release or expiry;					    \n\
fad460
-	      }								    \n\
fad460
-	      break;							    \n\
fad460
-									    \n\
fad460
-	    case NOERROR:						    \n\
fad460
-	      on release or expiry {					    \n\
fad460
-		switch (ns-update (delete (IN, PTR, ddns-rev-name, null))) {\n\
fad460
-		case NOERROR:						    \n\
fad460
-		  unset ddns-rev-name;					    \n\
fad460
-		  break;						    \n\
fad460
-		}							    \n\
fad460
-		switch (ns-update (delete (IN, A, ddns-fwd-name,	    \n\
fad460
-					   leased-address))) {		    \n\
fad460
-		case NOERROR:						    \n\
fad460
-		  unset ddns-fwd-name;					    \n\
fad460
-		  break;						    \n\
fad460
-		}							    \n\
fad460
-		on release or expiry;					    \n\
fad460
-	      }								    \n\
fad460
-	    }								    \n\
fad460
-	}								    \n\
fad460
-      }									    \n\
fad460
-    }									    \n\
fad460
-    unset new-ddns-fwd-name;						    \n\
fad460
-  }									    \n\
fad460
-}";
fad460
-
fad460
 #endif /* NSUPDATE */
fad460
 int ddns_update_style;
fad460
 
fad460
@@ -897,9 +817,6 @@ void postconf_initialization (int quiet)
fad460
 	struct option_cache *oc;
fad460
 	char *s;
fad460
 	isc_result_t result;
fad460
-#if defined (NSUPDATE)
fad460
-	struct parse *parse;
fad460
-#endif
fad460
 	int tmp;
fad460
 
fad460
 	/* Now try to get the lease file name. */
fad460
@@ -1160,49 +1077,6 @@ void postconf_initialization (int quiet)
fad460
 
fad460
 	/* Don't need the options anymore. */
fad460
 	option_state_dereference (&options, MDL);
fad460
-	
fad460
-#if defined (NSUPDATE)
fad460
-	/* If old-style ddns updates have been requested, parse the
fad460
-	   old-style ddns updater. */
fad460
-	if (ddns_update_style == 1) {
fad460
-		struct executable_statement **e, *s;
fad460
-
fad460
-		if (root_group -> statements) {
fad460
-			s = (struct executable_statement *)0;
fad460
-			if (!executable_statement_allocate (&s, MDL))
fad460
-				log_fatal ("no memory for ddns updater");
fad460
-			executable_statement_reference
fad460
-				(&s -> next, root_group -> statements, MDL);
fad460
-			executable_statement_dereference
fad460
-				(&root_group -> statements, MDL);
fad460
-			executable_statement_reference
fad460
-				(&root_group -> statements, s, MDL);
fad460
-			s -> op = statements_statement;
fad460
-			e = &s -> data.statements;
fad460
-			executable_statement_dereference (&s, MDL);
fad460
-		} else {
fad460
-			e = &root_group -> statements;
fad460
-		}
fad460
-
fad460
-		/* Set up the standard name service updater routine. */
fad460
-		parse = NULL;
fad460
-		result = new_parse(&parse, -1, old_nsupdate,
fad460
-				   sizeof(old_nsupdate) - 1,
fad460
-				   "old name service update routine", 0);
fad460
-		if (result != ISC_R_SUCCESS)
fad460
-			log_fatal ("can't begin parsing old ddns updater!");
fad460
-
fad460
-		if (parse != NULL) {
fad460
-			tmp = 0;
fad460
-			if (!(parse_executable_statements(e, parse, &tmp,
fad460
-							  context_any))) {
fad460
-				end_parse(&parse;;
fad460
-				log_fatal("can't parse standard ddns updater!");
fad460
-			}
fad460
-		}
fad460
-		end_parse(&parse;;
fad460
-	}
fad460
-#endif
fad460
 }
fad460
 
fad460
 void postdb_startup (void)
fad460
diff --git a/server/dhcpd.conf.5 b/server/dhcpd.conf.5
fad460
index 74393c2..2351e21 100644
fad460
--- a/server/dhcpd.conf.5
fad460
+++ b/server/dhcpd.conf.5
fad460
@@ -1076,115 +1076,24 @@ the Domain Name System to be updated.  These updates are RFC 2136
fad460
 compliant so any DNS server supporting RFC 2136 should be able to
fad460
 accept updates from the DHCP server.
fad460
 .PP
fad460
-Two DNS update schemes are currently implemented, and another is
fad460
-planned.  The two that are currently implemented are the ad-hoc DNS
fad460
-update mode and the interim DHCP-DNS interaction draft update mode.
fad460
-In the future we plan to add a third mode which will be the standard
fad460
-DNS update method based on the RFCS for DHCP-DNS interaction and DHCID
fad460
-The DHCP server must be configured to use one of the two
fad460
-currently-supported methods, or not to do dns updates.
fad460
-This can be done with the
fad460
+There are two DNS schemes implemented.  The interim option is
fad460
+based on draft revisions of the DDNS documents while the standard
fad460
+option is based on the RFCs for DHCP-DNS interaction and DHCIDs.
fad460
+A third option, ad-hoc, was deprecated and has now been removed
fad460
+from the code base.  The DHCP server must be configured to use
fad460
+one of the two currently-supported methods, or not to do DNS updates.
fad460
+.PP
fad460
+New installations should use the standard option. Older
fad460
+installations may want to continue using the interim option for
fad460
+backwards compatibility with the DNS database until the database
fad460
+can be updated.  This can be done with the
fad460
 .I ddns-update-style
fad460
 configuration parameter.
fad460
-.SH THE AD-HOC DNS UPDATE SCHEME
fad460
-The ad-hoc Dynamic DNS update scheme is
fad460
-.B now deprecated
fad460
-and
fad460
-.B
fad460
-does not work.
fad460
-In future releases of the ISC DHCP server, this scheme will not likely be
fad460
-available.  The interim scheme works, allows for failover, and should now be
fad460
-used.  The following description is left here for informational purposes
fad460
-only.
fad460
-.PP
fad460
-The ad-hoc Dynamic DNS update scheme implemented in this version of
fad460
-the ISC DHCP server is a prototype design, which does not
fad460
-have much to do with the standard update method that is being
fad460
-standardized in the IETF DHC working group, but rather implements some
fad460
-very basic, yet useful, update capabilities.  This mode
fad460
-.B does not work
fad460
-with the
fad460
-.I failover protocol
fad460
-because it does not account for the possibility of two different DHCP
fad460
-servers updating the same set of DNS records.
fad460
-.PP
fad460
-For the ad-hoc DNS update method, the client's FQDN is derived in two
fad460
-parts.  First, the hostname is determined.  Then, the domain name is
fad460
-determined, and appended to the hostname.
fad460
-.PP
fad460
-The DHCP server determines the client's hostname by first looking for
fad460
-a \fIddns-hostname\fR configuration option, and using that if it is
fad460
-present.  If no such option is present, the server looks for a
fad460
-valid hostname in the FQDN option sent by the client.  If one is
fad460
-found, it is used; otherwise, if the client sent a host-name option,
fad460
-that is used.  Otherwise, if there is a host declaration that applies
fad460
-to the client, the name from that declaration will be used.  If none
fad460
-of these applies, the server will not have a hostname for the client,
fad460
-and will not be able to do a DNS update.
fad460
-.PP
fad460
-The domain name is determined from the
fad460
-.I ddns-domainname
fad460
-configuration option.  The default configuration for this option is:
fad460
-.nf
fad460
-.sp 1
fad460
-  option server.ddns-domainname = config-option domain-name;
fad460
-
fad460
-.fi
fad460
-So if this configuration option is not configured to a different
fad460
-value (over-riding the above default), or if a domain-name option
fad460
-has not been configured for the client's scope, then the server will
fad460
-not attempt to perform a DNS update.
fad460
-.PP
fad460
-The client's fully-qualified domain name, derived as we have
fad460
-described, is used as the name on which an "A" record will be stored.
fad460
-The A record will contain the IP address that the client was assigned
fad460
-in its lease.  If there is already an A record with the same name in
fad460
-the DNS server, no update of either the A or PTR records will occur -
fad460
-this prevents a client from claiming that its hostname is the name of
fad460
-some network server.  For example, if you have a fileserver called
fad460
-"fs.sneedville.edu", and the client claims its hostname is "fs", no
fad460
-DNS update will be done for that client, and an error message will be
fad460
-logged.
fad460
-.PP
fad460
-If the A record update succeeds, a PTR record update for the assigned
fad460
-IP address will be done, pointing to the A record.  This update is
fad460
-unconditional - it will be done even if another PTR record of the same
fad460
-name exists.  Since the IP address has been assigned to the DHCP
fad460
-server, this should be safe.
fad460
-.PP
fad460
-Please note that the current implementation assumes clients only have
fad460
-a single network interface.  A client with two network interfaces
fad460
-will see unpredictable behavior.  This is considered a bug, and will
fad460
-be fixed in a later release.  It may be helpful to enable the
fad460
-.I one-lease-per-client
fad460
-parameter so that roaming clients do not trigger this same behavior.
fad460
-.PP
fad460
-The DHCP protocol normally involves a four-packet exchange - first the
fad460
-client sends a DHCPDISCOVER message, then the server sends a
fad460
-DHCPOFFER, then the client sends a DHCPREQUEST, then the server sends
fad460
-a DHCPACK.  In the current version of the server, the server will do
fad460
-a DNS update after it has received the DHCPREQUEST, and before it has
fad460
-sent the DHCPACK.  It only sends the DNS update if it has not sent
fad460
-one for the client's address before, in order to minimize the impact
fad460
-on the DHCP server.
fad460
-.PP
fad460
-When the client's lease expires, the DHCP server (if it is operating
fad460
-at the time, or when next it operates) will remove the client's A and
fad460
-PTR records from the DNS database.  If the client releases its lease
fad460
-by sending a DHCPRELEASE message, the server will likewise remove the
fad460
-A and PTR records.
fad460
-.SH THE INTERIM DNS UPDATE SCHEME
fad460
-The interim DNS update scheme operates mostly according to several
fad460
-drafts considered by the IETF.  While the drafts have since become
fad460
-RFCs the code was written before they were finalized and there are
fad460
-some differences between our code and the final RFCs.  We plan to
fad460
-update our code, probably adding a standard DNS update option, at
fad460
-some time.  The basic framework is similar with the main material
fad460
-difference being that a DHCID RR was assigned in the RFCs whereas
fad460
-our code continues to use an experimental TXT record.  The format
fad460
-of the TXT record bears a resemblance to the DHCID RR but it is not
fad460
-equivalent (MD5 vs SHA1, field length differences etc).
fad460
-The standard RFCs are:
fad460
+.SH THE DNS UPDATE SCHEME
fad460
+the interim and standard DNS update schemes operate mostly according
fad460
+to work from the IETF.  The interim version was based on the drafts
fad460
+in progress at the time while the standard is based on the completed
fad460
+RFCs.  The standard RFCs are:
fad460
 .PP
fad460
 .nf
fad460
 .ce 3
fad460
@@ -1202,15 +1111,17 @@ draft-ietf-dhc-fqdn-option-??.txt
fad460
 draft-ietf-dhc-ddns-resolution-??.txt
fad460
 .fi
fad460
 .PP
fad460
-Because our implementation is slightly different than the standard, we
fad460
-will briefly document the operation of this update style here.
fad460
+The basic framework for the two schemes is similar with the main
fad460
+material difference being that a DHCID RR is used in the standard
fad460
+version while the interim versions uses a TXT RR.  The format
fad460
+of the TXT record bears a resemblance to the DHCID RR but it is not
fad460
+equivalent (MD5 vs SHA2, field length differences etc).
fad460
 .PP
fad460
-The first point to understand about this style of DNS update is that
fad460
-unlike the ad-hoc style, the DHCP server does not necessarily
fad460
+In these two schemes the DHCP server does not necessarily
fad460
 always update both the A and the PTR records.  The FQDN option
fad460
 includes a flag which, when sent by the client, indicates that the
fad460
 client wishes to update its own A record.  In that case, the server
fad460
-can be configured either to honor the client's intentions or ignore
fad460
+can be configured either to honor the client\'s intentions or ignore
fad460
 them.  This is done with the statement \fIallow client-updates;\fR or
fad460
 the statement \fIignore client-updates;\fR.  By default, client
fad460
 updates are allowed.
fad460
@@ -1230,15 +1141,14 @@ IP address, it can update its own A record, assuming that the
fad460
 "radish.org" DNS server will allow it to do so.
fad460
 .PP
fad460
 If the server is configured not to allow client updates, or if the
fad460
-client doesn't want to do its own update, the server will simply
fad460
+client doesn\'t want to do its own update, the server will simply
fad460
 choose a name for the client from either the fqdn option (if present)
fad460
 or the hostname option (if present).  It will use its own
fad460
-domain name for the client, just as in the ad-hoc update scheme.
fad460
-It will then update both the A and PTR record, using the name that it
fad460
-chose for the client.  If the client sends a fully-qualified domain
fad460
-name in the fqdn option, the server uses only the leftmost part of the
fad460
-domain name - in the example above, "jschmoe" instead of
fad460
-"jschmoe.radish.org".
fad460
+domain name for the client.  It will then update both the A and PTR
fad460
+record, using the name that it chose for the client.  If the client
fad460
+sends a fully-qualified domain name in the \fBfqdn\fR option, the
fad460
+server uses only the leftmost part of the domain name - in the
fad460
+example above, "jschmoe" instead of "jschmoe.radish.org".
fad460
 .PP
fad460
 Further, if the \fIignore client-updates;\fR directive is used, then
fad460
 the server will in addition send a response in the DHCP packet, using
fad460
@@ -1248,49 +1158,41 @@ response is sent which indicates the client may not perform updates.
fad460
 .PP
fad460
 Also, if the
fad460
 .I use-host-decl-names
fad460
-configuration option is enabled, then the host declaration's
fad460
+configuration option is enabled, then the host declaration\'s
fad460
 .I hostname
fad460
 will be used in place of the
fad460
 .I hostname
fad460
 option, and the same rules will apply as described above.
fad460
 .PP
fad460
-The other difference between the ad-hoc scheme and the interim
fad460
-scheme is that with the interim scheme, a method is used that
fad460
-allows more than one DHCP server to update the DNS database without
fad460
-accidentally deleting A records that shouldn't be deleted nor failing
fad460
-to add A records that should be added.  The scheme works as follows:
fad460
+Both the standard and interim options also include a method to 
fad460
+allow more than one DHCP server to update the DNS database without
fad460
+accidentally deleting A records that shouldn\'t be deleted nor failing
fad460
+to add A records that should be added.  For the standard option the
fad460
+method works as follows:
fad460
 .PP
fad460
 When the DHCP server issues a client a new lease, it creates a text
fad460
-string that is an MD5 hash over the DHCP client's identification (see
fad460
-draft-ietf-dnsext-dhcid-rr-??.txt for details).  The update adds an A
fad460
-record with the name the server chose and a TXT record containing the
fad460
+string that is an SHA hash over the DHCP client\'s identification (see
fad460
+RFCs 4701 & 4702 for details).  The update attempts to add an A
fad460
+record with the name the server chose and a DHCID record containing the
fad460
 hashed identifier string (hashid).  If this update succeeds, the
fad460
 server is done.
fad460
 .PP
fad460
 If the update fails because the A record already exists, then the DHCP
fad460
 server attempts to add the A record with the prerequisite that there
fad460
-must be a TXT record in the same name as the new A record, and that
fad460
-TXT record's contents must be equal to hashid.  If this update
fad460
+must be a DHCID record in the same name as the new A record, and that
fad460
+DHCID record\'s contents must be equal to hashid.  If this update
fad460
 succeeds, then the client has its A record and PTR record.  If it
fad460
 fails, then the name the client has been assigned (or requested) is in
fad460
-use, and can't be used by the client.  At this point the DHCP server
fad460
+use, and can\'t be used by the client.  At this point the DHCP server
fad460
 gives up trying to do a DNS update for the client until the client
fad460
 chooses a new name.
fad460
 .PP
fad460
-The interim DNS update scheme is called interim for two reasons.
fad460
-First, it does not quite follow the RFCs.  The RFCs call for a
fad460
-new DHCID RRtype while he interim DNS update scheme uses a TXT record.
fad460
-The ddns-resolution draft called for the DHCP server to put a DHCID RR
fad460
-on the PTR record, but the \fIinterim\fR update method does not do this.
fad460
-In the final RFC this requirement was relaxed such that a server may
fad460
-add a DHCID RR to the PTR record.
fad460
-.PP
fad460
-In addition to these differences, the server also does not update very
fad460
-aggressively.  Because each DNS update involves a round trip to the
fad460
-DNS server, there is a cost associated with doing updates even if they
fad460
-do not actually modify the DNS database.  So the DHCP server tracks
fad460
-whether or not it has updated the record in the past (this information
fad460
-is stored on the lease) and does not attempt to update records that it
fad460
+The server also does not update very aggressively.  Because each
fad460
+DNS update involves a round trip to the DNS server, there is a cost
fad460
+associated with doing updates even if they do not actually modify
fad460
+the DNS database.  So the DHCP server tracks whether or not it has
fad460
+updated the record in the past (this information is stored on the
fad460
+lease) and does not attempt to update records that it
fad460
 thinks it has already updated.
fad460
 .PP
fad460
 This can lead to cases where the DHCP server adds a record, and then
fad460
@@ -1299,6 +1201,15 @@ never again updates the DNS because it thinks the data is already
fad460
 there.  In this case the data can be removed from the lease through
fad460
 operator intervention, and once this has been done, the DNS will be
fad460
 updated the next time the client renews.
fad460
+.PP
fad460
+The interim DNS update scheme was written before the RFCs were finalized
fad460
+and does not quite follow them.  The RFCs call for a new DHCID RRtype
fad460
+while he interim DNS update scheme uses a TXT record.  In addition
fad460
+the ddns-resolution draft called for the DHCP server to put a DHCID RR
fad460
+on the PTR record, but the \fIinterim\fR update method does not do this.
fad460
+In the final RFC this requirement was relaxed such that a server may
fad460
+add a DHCID RR to the PTR record.
fad460
+.PP
fad460
 .SH DYNAMIC DNS UPDATE SECURITY
fad460
 .PP
fad460
 When you set your DNS server up to allow updates from the DHCP server,
fad460
@@ -1380,24 +1291,15 @@ Also keep in mind that zone names in your DHCP configuration should end in a
fad460
 configuration, zone names are not encapsulated in quotes where there are in
fad460
 the DNS configuration.
fad460
 .PP
fad460
-You should choose your own secret key, of course.  The ISC BIND 8 and
fad460
-9 distributions come with a program for generating secret keys called
fad460
-dnssec-keygen.  The version that comes with BIND 9 is likely to produce a
fad460
-substantially more random key, so we recommend you use that one even
fad460
-if you are not using BIND 9 as your DNS server.  If you are using BIND 9's
fad460
+You should choose your own secret key, of course.  The ISC BIND 9
fad460
+distribution comes with a program for generating secret keys called
fad460
+dnssec-keygen.  If you are using BIND 9\'s
fad460
 dnssec-keygen, the above key would be created as follows:
fad460
 .PP
fad460
 .nf
fad460
 	dnssec-keygen -a HMAC-MD5 -b 128 -n USER DHCP_UPDATER
fad460
 .fi
fad460
 .PP
fad460
-If you are using the BIND 8 dnskeygen program, the following command will
fad460
-generate a key as seen above:
fad460
-.PP
fad460
-.nf
fad460
-	dnskeygen -H 128 -u -c -n DHCP_UPDATER
fad460
-.fi
fad460
-.PP
fad460
 The key name, algorithm, and secret must match that being used by the DNS
fad460
 server. The DHCP server currently supports the following algorithms:
fad460
 .nf
fad460
@@ -1451,15 +1353,7 @@ and the expiry event, when the commitment expires.
fad460
 To declare a set of statements to execute when an event happens, you
fad460
 must use the \fBon\fR statement, followed by the name of the event,
fad460
 followed by a series of statements to execute when the event happens,
fad460
-enclosed in braces.  Events are used to implement DNS
fad460
-updates, so you should not define your own event handlers if you are
fad460
-using the built-in DNS update mechanism.
fad460
-.PP
fad460
-The built-in version of the DNS update mechanism is in a text
fad460
-string towards the top of server/dhcpd.c.  If you want to use events
fad460
-for things other than DNS updates, and you also want DNS updates, you
fad460
-will have to start out by copying this code into your dhcpd.conf file
fad460
-and modifying it.
fad460
+enclosed in braces.
fad460
 .SH REFERENCE: DECLARATIONS
fad460
 .PP
fad460
 .B The
fad460
@@ -2109,7 +2003,7 @@ The \fIddns-update-style\fR parameter
fad460
 .PP
fad460
 The
fad460
 .I style
fad460
-parameter must be one of \fBad-hoc\fR, \fBinterim\fR or \fBnone\fR.
fad460
+parameter must be one of \fBstandard\fR, \fBinterim\fR or \fBnone\fR.
fad460
 The \fIddns-update-style\fR statement is only meaningful in the outer
fad460
 scope - it is evaluated once after reading the dhcpd.conf file, rather
fad460
 than each time a client is assigned an IP address, so there is no way
fad460
@@ -2186,16 +2080,15 @@ statement
fad460
 .B do-forward-updates \fIflag\fB;\fR
fad460
 .PP
fad460
 The \fIdo-forward-updates\fR statement instructs the DHCP server as
fad460
-to whether it should attempt to update a DHCP client's A record
fad460
+to whether it should attempt to update a DHCP client\'s A record
fad460
 when the client acquires or renews a lease.  This statement has no
fad460
-effect unless DNS updates are enabled and \fBddns-update-style\fR is
fad460
-set to \fBinterim\fR.  Forward updates are enabled by default.  If
fad460
-this statement is used to disable forward updates, the DHCP server
fad460
-will never attempt to update the client's A record, and will only ever
fad460
-attempt to update the client's PTR record if the client supplies an
fad460
-FQDN that should be placed in the PTR record using the fqdn option.
fad460
-If forward updates are enabled, the DHCP server will still honor the
fad460
-setting of the \fBclient-updates\fR flag.
fad460
+effect unless DNS updates are enabled.  Forward updates are enabled
fad460
+by default.  If this statement is used to disable forward updates,
fad460
+the DHCP server will never attempt to update the client\'s A record,
fad460
+and will only ever attempt to update the client\'s PTR record if the
fad460
+client supplies an FQDN that should be placed in the PTR record using
fad460
+the \fBfqdn\fR option.  If forward updates are enabled, the DHCP server
fad460
+will still honor the setting of the \fBclient-updates\fR flag.
fad460
 .RE
fad460
 .PP
fad460
 The
fad460
@@ -2747,7 +2640,7 @@ on which the request arrived.
fad460
 The usual case where the
fad460
 \fIserver-identifier\fR statement needs to be sent is when a physical
fad460
 interface has more than one IP address, and the one being sent by default
fad460
-isn't appropriate for some or all clients served by that interface.
fad460
+isn\'t appropriate for some or all clients served by that interface.
fad460
 Another common case is when an alias is defined for the purpose of
fad460
 having a consistent IP address for the DHCP server, and it is desired
fad460
 that the clients use this IP address when contacting the server.
fad460
diff --git a/server/stables.c b/server/stables.c
fad460
index 6a900c8..8ef8bf2 100644
fad460
--- a/server/stables.c
fad460
+++ b/server/stables.c
fad460
@@ -3,7 +3,7 @@
fad460
    Tables of information only used by server... */
fad460
 
fad460
 /*
fad460
- * Copyright (c) 2004-2011 by Internet Systems Consortium, Inc. ("ISC")
fad460
+ * Copyright (c) 2004-2011,2013 by Internet Systems Consortium, Inc. ("ISC")
fad460
  * Copyright (c) 1995-2003 by Internet Software Consortium
fad460
  *
fad460
  * Permission to use, copy, modify, and distribute this software for any
fad460
@@ -330,6 +330,7 @@ struct enumeration_value ddns_styles_values [] = {
fad460
 	{ "none", 0 },
fad460
 	{ "ad-hoc", 1 },
fad460
 	{ "interim", 2 },
fad460
+	{ "standard", 3 },
fad460
 	{ (char *)0, 0 }
fad460
 };
fad460